@kynver-app/runtime 0.1.103 → 0.1.105

package/dist/server/cleanup.js

@@ -0,0 +1,3511 @@
+// src/cleanup.ts
+import path23 from "node:path";
+
+// src/paths.ts
+import { existsSync as existsSync8 } from "node:fs";
+import { homedir as homedir3 } from "node:os";
+import path6 from "node:path";
+
+// src/config.ts
+import { existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync5, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir2, totalmem } from "node:os";
+import path5 from "node:path";
+
+// src/git.ts
+import { spawnSync } from "node:child_process";
+
+// src/util.ts
+import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
+import path from "node:path";
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+function safeJson(line) {
+  try {
+    return JSON.parse(line);
+  } catch {
+    return null;
+  }
+}
+function readJson(file, fallback) {
+  try {
+    return JSON.parse(readFileSync(file, "utf8"));
+  } catch (error) {
+    if (arguments.length > 1) return fallback;
+    fail(`failed to read ${file}: ${error.message}`);
+  }
+}
+function writeJson(file, value) {
+  mkdirSync(path.dirname(file), { recursive: true });
+  writeFileSync(file, `${JSON.stringify(value, null, 2)}
+`);
+}
+function safeSlug(value) {
+  return String(value || "").toLowerCase().replace(/[^a-z0-9._-]+/g, "-").replace(/^-+|-+$/g, "") || "worker";
+}
+function fileSize(file) {
+  try {
+    return statSync(file).size;
+  } catch {
+    return 0;
+  }
+}
+function fileMtime(file) {
+  try {
+    return statSync(file).mtime.toISOString();
+  } catch {
+    return null;
+  }
+}
+function tailFile(file, lines) {
+  if (!existsSync(file)) return "";
+  const data = readFileSync(file, "utf8");
+  return data.split("\n").slice(-lines).join("\n");
+}
+function isPidAlive(pid) {
+  if (!pid) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function latestIso(values) {
+  let best = null;
+  let bestMs = -Infinity;
+  for (const value of values) {
+    if (!value) continue;
+    const ms = Date.parse(value);
+    if (Number.isFinite(ms) && ms > bestMs) {
+      bestMs = ms;
+      best = value;
+    }
+  }
+  return best;
+}
+function secsAgo(ms) {
+  return Math.max(0, Math.round((Date.now() - ms) / 1e3));
+}
+
+// src/worker-env.ts
+var FORBIDDEN_WORKER_ENV_KEYS = [
+  "ANTHROPIC_API_KEY",
+  "ANALYST_API_KEY",
+  "RECRUITER_API_KEY",
+  "AUTH_SECRET",
+  "NEXTAUTH_SECRET",
+  "DATABASE_URL",
+  "PRODUCTION_DATABASE_URL",
+  "KYNVER_PRODUCTION_DATABASE_URL",
+  "REDIS_URL",
+  "GOOGLE_CLIENT_SECRET",
+  "GITHUB_CLIENT_SECRET",
+  "KYNVER_API_KEY",
+  "KYNVER_SERVICE_SECRET",
+  "KYNVER_RUNTIME_SECRET",
+  "KYNVER_CRON_SECRET",
+  "OPENCLAW_CRON_SECRET",
+  "QSTASH_TOKEN",
+  "QSTASH_CURRENT_SIGNING_KEY",
+  "QSTASH_NEXT_SIGNING_KEY",
+  "TOOL_SECRETS_KEK",
+  "TOOL_EXECUTOR_DISPATCH_SECRET",
+  "CLOUDFLARE_API_TOKEN",
+  "STRIPE_SECRET_KEY",
+  "STRIPE_WEBHOOK_SECRET",
+  "STRIPE_IDENTITY_WEBHOOK_SECRET",
+  "VOYAGE_API_KEY",
+  "PERPLEXITY_API_KEY",
+  "FRED_API_KEY",
+  "FMP_API_KEY",
+  "CURSOR_API_KEY"
+];
+var FORBIDDEN_KEY_SET = new Set(FORBIDDEN_WORKER_ENV_KEYS);
+
+// src/git.ts
+function git(cwd, args, options = {}) {
+  const res = spawnSync("git", args, { cwd, encoding: "utf8" });
+  if (res.status !== 0 && !options.allowFailure) {
+    const message = `git ${args.join(" ")} failed: ${res.stderr || res.stdout}`;
+    if (options.throwError) throw new Error(message);
+    fail(message);
+  }
+  return res.stdout || "";
+}
+function gitStatusShort(worktreePath) {
+  return git(worktreePath, ["status", "--short"], { allowFailure: true }).split("\n").map((line) => line.trim()).filter(Boolean);
+}
+function gitCapture(cwd, args) {
+  try {
+    const res = spawnSync("git", args, { cwd, encoding: "utf8" });
+    return {
+      status: res.status,
+      stdout: res.stdout || "",
+      stderr: res.stderr || "",
+      error: res.error ? res.error.message : null
+    };
+  } catch (error) {
+    return {
+      status: null,
+      stdout: "",
+      stderr: "",
+      error: error.message
+    };
+  }
+}
+function gitIsAncestor(cwd, ancestor, descendant) {
+  const res = gitCapture(cwd, ["merge-base", "--is-ancestor", ancestor, descendant]);
+  if (res.status === 0) return { isAncestor: true, error: null };
+  if (res.status === 1) return { isAncestor: false, error: null };
+  return { isAncestor: null, error: res.error || res.stderr || res.stdout || `git exited ${res.status}` };
+}
+function computeGitAncestry(worktreePath, baseOrOptions = "origin/main") {
+  const options = typeof baseOrOptions === "string" ? { base: baseOrOptions } : baseOrOptions;
+  const baseLabel = options.baseCommit?.trim() || options.base?.trim() || "origin/main";
+  const pinnedBaseCommit = options.baseCommit?.trim() || null;
+  if (!worktreePath) {
+    return unknownAncestry(baseLabel, "missing worktree path");
+  }
+  const head = gitCapture(worktreePath, ["rev-parse", "HEAD"]);
+  if (head.status !== 0) {
+    return unknownAncestry(baseLabel, head.error || head.stderr || head.stdout || "failed to resolve HEAD");
+  }
+  let baseSha;
+  if (pinnedBaseCommit) {
+    baseSha = pinnedBaseCommit;
+  } else {
+    const baseHead = gitCapture(worktreePath, ["rev-parse", baseLabel]);
+    if (baseHead.status !== 0) {
+      return unknownAncestry(
+        baseLabel,
+        baseHead.error || baseHead.stderr || baseHead.stdout || `failed to resolve ${baseLabel}`,
+        head.stdout.trim()
+      );
+    }
+    baseSha = baseHead.stdout.trim();
+  }
+  const headSha = head.stdout.trim();
+  if (headSha === baseSha) {
+    return {
+      checked: true,
+      base: baseLabel,
+      head: headSha,
+      baseHead: baseSha,
+      baseIsAncestorOfHead: true,
+      headIsAncestorOfBase: true,
+      relation: "synced"
+    };
+  }
+  const baseIsAncestorOfHead = gitIsAncestor(worktreePath, baseSha, headSha);
+  const headIsAncestorOfBase = gitIsAncestor(worktreePath, headSha, baseSha);
+  const error = baseIsAncestorOfHead.error || headIsAncestorOfBase.error || void 0;
+  if (baseIsAncestorOfHead.isAncestor == null || headIsAncestorOfBase.isAncestor == null) {
+    return {
+      checked: false,
+      base: baseLabel,
+      head: headSha,
+      baseHead: baseSha,
+      baseIsAncestorOfHead: baseIsAncestorOfHead.isAncestor,
+      headIsAncestorOfBase: headIsAncestorOfBase.isAncestor,
+      relation: "unknown",
+      ...error ? { error } : {}
+    };
+  }
+  const relation = baseIsAncestorOfHead.isAncestor ? "ahead" : headIsAncestorOfBase.isAncestor ? "merged" : "diverged";
+  return {
+    checked: true,
+    base: baseLabel,
+    head: headSha,
+    baseHead: baseSha,
+    baseIsAncestorOfHead: baseIsAncestorOfHead.isAncestor,
+    headIsAncestorOfBase: headIsAncestorOfBase.isAncestor,
+    relation,
+    ...error ? { error } : {}
+  };
+}
+function unknownAncestry(base, error, head = null) {
+  return {
+    checked: false,
+    base,
+    head,
+    baseHead: null,
+    baseIsAncestorOfHead: null,
+    headIsAncestorOfBase: null,
+    relation: "unknown",
+    error
+  };
+}
+
+// src/path-values.ts
+import { homedir } from "node:os";
+import path2 from "node:path";
+function expandHomePath(value) {
+  if (value === "~") return homedir();
+  if (value.startsWith("~/") || value.startsWith("~\\")) {
+    return path2.join(homedir(), value.slice(2));
+  }
+  return value;
+}
+function resolveUserPath(value) {
+  return path2.resolve(expandHomePath(value));
+}
+
+// src/disk-gate.ts
+import { statfsSync as statfsSync2 } from "node:fs";
+
+// src/wsl-host.ts
+import { existsSync as existsSync2, readFileSync as readFileSync2, statfsSync } from "node:fs";
+var DEFAULT_WSL_HOST_WARN_FREE_BYTES = 25 * 1024 * 1024 * 1024;
+var DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES = 12 * 1024 * 1024 * 1024;
+var DEFAULT_WSL_HOST_MOUNT = "/mnt/c";
+function isWslHost() {
+  if (process.platform !== "linux") return false;
+  for (const probe of ["/proc/sys/kernel/osrelease", "/proc/version"]) {
+    try {
+      if (!existsSync2(probe)) continue;
+      const text = readFileSync2(probe, "utf8");
+      if (/microsoft|wsl/i.test(text)) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function observeWslHostDisk(options = {}) {
+  const wsl = options.forceWsl === void 0 ? isWslHost() : options.forceWsl;
+  if (!wsl) return null;
+  const path24 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
+  const warnBelowBytes = options.wslHostFreeWarnBytes ?? DEFAULT_WSL_HOST_WARN_FREE_BYTES;
+  const criticalBelowBytes = options.wslHostFreeCriticalBytes ?? DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES;
+  const statfs = options.statfs ?? statfsSync;
+  let stats;
+  try {
+    stats = statfs(path24);
+  } catch (error) {
+    return {
+      ok: false,
+      path: path24,
+      freeBytes: 0,
+      totalBytes: 0,
+      usedPercent: 100,
+      warnBelowBytes,
+      criticalBelowBytes,
+      reason: `Windows host disk probe failed at ${path24}: ${error.message}`,
+      probeError: error.message
+    };
+  }
+  const freeBytes = Number(stats.bavail) * Number(stats.bsize);
+  const totalBytes = Number(stats.blocks) * Number(stats.bsize);
+  const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
+  const lowFree = freeBytes < warnBelowBytes;
+  const criticalFree = freeBytes < criticalBelowBytes;
+  const ok = !lowFree && !criticalFree;
+  const freeGiB = (freeBytes / (1024 * 1024 * 1024)).toFixed(1);
+  let reason = null;
+  if (!ok) {
+    const tag = criticalFree ? "critical" : "warning";
+    reason = `Windows host disk ${path24} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
+  }
+  return {
+    ok,
+    path: path24,
+    freeBytes,
+    totalBytes,
+    usedPercent,
+    warnBelowBytes,
+    criticalBelowBytes,
+    reason,
+    probeError: null
+  };
+}
+function summarizeWslRecoverySteps() {
+  return "Recovery: 1) free Windows C: (empty Recycle Bin / Storage Sense / clear %TEMP%); 2) shut down WSL (`wsl --shutdown`) then compact the VHDX (`Optimize-VHD` or `diskpart compact vdisk`); 3) clear local node_modules / .next / harness worktrees before restarting workers. Full runbook: docs/runbooks/wsl-disk-pressure.md.";
+}
+
+// src/disk-gate.ts
+var DEFAULT_WARN_FREE_BYTES = 30 * 1024 * 1024 * 1024;
+var DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
+var DEFAULT_MAX_USED_PERCENT = 80;
+var DEFAULT_HARD_MAX_USED_PERCENT = 90;
+function observeRunnerDiskGate(input = {}) {
+  const path24 = input.diskPath?.trim() || "/";
+  const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
+  const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
+  const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
+  const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
+  const stats = statfsSync2(path24);
+  const freeBytes = Number(stats.bavail) * Number(stats.bsize);
+  const totalBytes = Number(stats.blocks) * Number(stats.bsize);
+  const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
+  const lowFree = freeBytes < warnBelowBytes;
+  const criticalFree = freeBytes < criticalBelowBytes;
+  const highUse = usedPercent > maxUsedPercent;
+  const hardHighUse = usedPercent > hardMaxUsedPercent;
+  const localOk = !lowFree && !criticalFree && !highUse && !hardHighUse;
+  const wslHost = input.skipWslHostCheck ? null : observeWslHostDisk(input.wslHost);
+  const ok = localOk && (wslHost ? wslHost.ok : true);
+  let reason = null;
+  if (!ok) {
+    reason = [
+      criticalFree ? `free space below critical ${criticalBelowBytes} bytes` : null,
+      lowFree ? `free space below warning ${warnBelowBytes} bytes` : null,
+      hardHighUse ? `used percent above hard cap ${hardMaxUsedPercent}%` : null,
+      highUse ? `used percent above cap ${maxUsedPercent}%` : null,
+      wslHost && !wslHost.ok ? wslHost.reason : null
+    ].filter(Boolean).join("; ");
+  }
+  return {
+    ok,
+    path: path24,
+    freeBytes,
+    totalBytes,
+    usedPercent,
+    warnBelowBytes,
+    criticalBelowBytes,
+    maxUsedPercent,
+    hardMaxUsedPercent,
+    reason,
+    wslHost
+  };
+}
+
+// src/run-store.ts
+import { existsSync as existsSync3, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
+import path3 from "node:path";
+function getPaths() {
+  return getHarnessPaths();
+}
+function listRunRecords() {
+  const { runsDir } = getPaths();
+  return listRunRecordsAt(runsDir);
+}
+function listRunRecordsForHarnessRoot(harnessRoot) {
+  return listRunRecordsAt(harnessRunsDir(harnessRoot));
+}
+function isRunDirectoryEntry(runDirPath) {
+  try {
+    return statSync2(runDirPath).isDirectory();
+  } catch {
+    return false;
+  }
+}
+function listRunRecordsAt(runsDir) {
+  if (!existsSync3(runsDir)) return [];
+  const runs = [];
+  for (const entry of readdirSync2(runsDir, { withFileTypes: true })) {
+    if (entry.name === "runs") continue;
+    const runDir2 = path3.join(runsDir, entry.name);
+    if (!isRunDirectoryEntry(runDir2)) continue;
+    const run = readJson(
+      path3.join(runDir2, "run.json"),
+      void 0
+    );
+    if (run?.id) runs.push(run);
+  }
+  return runs;
+}
+function saveRun(run) {
+  const { runsDir } = getPaths();
+  writeJson(path3.join(runDir(runsDir, run.id), "run.json"), run);
+}
+function runDirectory(id) {
+  const { harnessRoot } = getPaths();
+  return runDirectoryAt(harnessRoot, id);
+}
+function runDirectoryAt(harnessRoot, id) {
+  return runDir(harnessRunsDir(harnessRoot), safeSlug(id));
+}
+
+// src/run-worker-index.ts
+import { existsSync as existsSync4, readdirSync as readdirSync3 } from "node:fs";
+import path4 from "node:path";
+function listRunWorkerNames(run) {
+  const names = /* @__PURE__ */ new Set();
+  for (const name of Object.keys(run.workers || {})) {
+    names.add(safeSlug(name));
+  }
+  const workersDir = path4.join(runDirectory(run.id), "workers");
+  if (!existsSync4(workersDir)) return [...names];
+  for (const entry of readdirSync3(workersDir, { withFileTypes: true })) {
+    if (!entry.isDirectory()) continue;
+    names.add(safeSlug(entry.name));
+  }
+  return [...names];
+}
+
+// src/heartbeat.ts
+import { existsSync as existsSync5, readFileSync as readFileSync3 } from "node:fs";
+
+// src/heartbeat-final-result.ts
+function tryParseJsonObject(text) {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith("{")) return null;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function embeddedRecordFromProse(text) {
+  const trimmed = text.trim();
+  if (!trimmed) return null;
+  const direct = tryParseJsonObject(trimmed);
+  if (direct) return direct;
+  const candidates = [];
+  const fenceRe = /```(?:json)?\s*([\s\S]*?)```/gi;
+  let fenceMatch;
+  while ((fenceMatch = fenceRe.exec(trimmed)) !== null) {
+    const fromFence = tryParseJsonObject(fenceMatch[1] ?? "");
+    if (fromFence) candidates.push(fromFence);
+  }
+  const firstBrace = trimmed.indexOf("{");
+  const lastBrace = trimmed.lastIndexOf("}");
+  if (firstBrace >= 0 && lastBrace > firstBrace) {
+    const slice = tryParseJsonObject(trimmed.slice(firstBrace, lastBrace + 1));
+    if (slice) candidates.push(slice);
+  }
+  return candidates.length > 0 ? candidates[candidates.length - 1] : null;
+}
+function terminalFinalResultFromHeartbeatRow(row) {
+  const explicit = row.finalResult ?? row.final_result;
+  if (explicit !== void 0 && explicit !== null) {
+    if (typeof explicit === "string") {
+      const embedded2 = embeddedRecordFromProse(explicit);
+      return embedded2 ?? (explicit.trim() || null);
+    }
+    return explicit;
+  }
+  const summary = typeof row.summary === "string" ? row.summary.trim() : "";
+  if (!summary) return null;
+  const embedded = embeddedRecordFromProse(summary);
+  if (embedded) return embedded;
+  return summary;
+}
+
+// src/heartbeat.ts
+var HEARTBEAT_FUTURE_SKEW_MS = 6e4;
+function isTerminalHeartbeatPhase(phase) {
+  return phase === "complete";
+}
+function terminalFinalResultFromHeartbeat(heartbeat) {
+  if (!isTerminalHeartbeatPhase(heartbeat.lastHeartbeatPhase)) return null;
+  if (heartbeat.terminalFinalResult !== void 0 && heartbeat.terminalFinalResult !== null) {
+    return heartbeat.terminalFinalResult;
+  }
+  const summary = heartbeat.lastHeartbeatSummary?.trim();
+  return summary || "completed";
+}
+function parseHeartbeat(file) {
+  const result = {
+    heartbeatCount: 0,
+    lastHeartbeatAt: null,
+    lastHeartbeatPhase: null,
+    lastHeartbeatSummary: null,
+    terminalFinalResult: null,
+    heartbeatBlocker: null,
+    timestampAnomalies: [],
+    lastBoxResourceSnapshot: null,
+    lastPrEvidence: []
+  };
+  if (!existsSync5(file)) return result;
+  const maxFutureMs = Date.now() + HEARTBEAT_FUTURE_SKEW_MS;
+  const clampedTo = new Date(maxFutureMs).toISOString();
+  const lines = readFileSync3(file, "utf8").split("\n").filter(Boolean);
+  for (const line of lines) {
+    const entry = safeJson(line);
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) continue;
+    const row = entry;
+    result.heartbeatCount++;
+    if (row.ts) {
+      const ts = String(row.ts);
+      const tsMs = Date.parse(ts);
+      if (Number.isFinite(tsMs) && tsMs > maxFutureMs) {
+        result.timestampAnomalies.push({
+          kind: "future_heartbeat_timestamp",
+          observedAt: ts,
+          clampedTo
+        });
+      } else {
+        result.lastHeartbeatAt = ts;
+      }
+    }
+    if (row.phase !== void 0 && row.phase !== null) result.lastHeartbeatPhase = String(row.phase);
+    if (row.summary !== void 0 && row.summary !== null) result.lastHeartbeatSummary = String(row.summary);
+    if (isTerminalHeartbeatPhase(result.lastHeartbeatPhase)) {
+      result.terminalFinalResult = terminalFinalResultFromHeartbeatRow(row);
+    }
+    result.heartbeatBlocker = row.blocker ? String(row.blocker) : null;
+    if (row.boxResourceSnapshot && typeof row.boxResourceSnapshot === "object" && !Array.isArray(row.boxResourceSnapshot)) {
+      result.lastBoxResourceSnapshot = row.boxResourceSnapshot;
+    }
+    if (Array.isArray(row.prEvidence)) {
+      result.lastPrEvidence = row.prEvidence.filter(
+        (entry2) => !!entry2 && typeof entry2 === "object" && typeof entry2.prUrl === "string"
+      );
+    }
+  }
+  return result;
+}
+
+// src/stream.ts
+import { existsSync as existsSync6, readFileSync as readFileSync4 } from "node:fs";
+
+// src/repo-search.ts
+var RG_BINARIES = /* @__PURE__ */ new Set(["rg", "ripgrep", "grep"]);
+var RG_OPTS_WITH_VALUE = /* @__PURE__ */ new Set([
+  "-e",
+  "--regexp",
+  "-f",
+  "--file",
+  "-m",
+  "--max-count",
+  "-A",
+  "--after-context",
+  "-B",
+  "--before-context",
+  "-C",
+  "--context",
+  "-g",
+  "--glob",
+  "--iglob"
+]);
+function binaryName(token) {
+  if (!token) return null;
+  const base = token.split("/").pop() ?? token;
+  return base.replace(/\.exe$/i, "").toLowerCase();
+}
+function splitShellWords(input) {
+  if (!input) return [];
+  const words = [];
+  let current = "";
+  let quote;
+  let escaped = false;
+  for (const char of input) {
+    if (escaped) {
+      current += char;
+      escaped = false;
+      continue;
+    }
+    if (char === "\\") {
+      escaped = true;
+      continue;
+    }
+    if (quote) {
+      if (char === quote) quote = void 0;
+      else current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      continue;
+    }
+    if (/\s/.test(char)) {
+      if (current) {
+        words.push(current);
+        current = "";
+      }
+      continue;
+    }
+    current += char;
+  }
+  if (current) words.push(current);
+  return words;
+}
+function isRgArgv(argv) {
+  const bin = binaryName(argv[0]);
+  return Boolean(bin && RG_BINARIES.has(bin));
+}
+function isSingleFileSearchTarget(target) {
+  if (!target || target.includes("/") || target.includes("*")) return false;
+  return /\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(target);
+}
+function isRgExcludeScopeTarget(target) {
+  if (!target) return false;
+  const t = target.trim();
+  return t.startsWith("!") && !t.includes("/") && !t.endsWith("/**");
+}
+function fixRgGlobToken(token) {
+  if (!token.startsWith("--glob=")) return token;
+  const value = token.slice("--glob=".length);
+  if (value.startsWith("!") && !value.includes("/") && !value.endsWith("/**")) {
+    return `--glob=${value}/**`;
+  }
+  return token;
+}
+function collectRgPositional(argv) {
+  const positional = [];
+  for (let i = 1; i < argv.length; i += 1) {
+    const token = argv[i];
+    if (!token) continue;
+    if (token === "--") {
+      positional.push(...argv.slice(i + 1));
+      break;
+    }
+    if (token.startsWith("-")) {
+      if (token.includes("=")) continue;
+      if (RG_OPTS_WITH_VALUE.has(token)) i += 1;
+      continue;
+    }
+    positional.push(token);
+  }
+  return positional;
+}
+function normalizeRgArgv(argv) {
+  let changed = false;
+  const out = argv.map((token) => {
+    const fixed = fixRgGlobToken(token);
+    if (fixed !== token) changed = true;
+    return fixed;
+  });
+  const positional = collectRgPositional(out);
+  if (positional.length === 2) {
+    const [pattern, target] = positional;
+    if (isSingleFileSearchTarget(target)) {
+      return { argv: [out[0] ?? "rg", "-g", target, pattern, "."], changed: true };
+    }
+  }
+  return { argv: out, changed };
+}
+function normalizeRepoSearchCommand(command) {
+  const trimmed = command.trim();
+  if (!trimmed) return { command: trimmed, changed: false };
+  const joiner = trimmed.includes("&&") ? " && " : trimmed.includes("||") ? " || " : "; ";
+  const stages = trimmed.split(/\s*(?:&&|\|\||;)\s*/u);
+  let changed = false;
+  const normalizedStages = stages.map((stage) => {
+    const argv = splitShellWords(stage.trim());
+    if (!argv.length || !isRgArgv(argv)) return stage;
+    const normalized = normalizeRgArgv(argv);
+    if (normalized.changed) {
+      changed = true;
+      return normalized.argv.join(" ");
+    }
+    return stage;
+  });
+  if (!changed) return { command: trimmed, changed: false };
+  return { command: normalizedStages.join(joiner), changed: true };
+}
+function extractSearchMeta(meta) {
+  if (!meta) return {};
+  const pipelineMatch = meta.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(|$)/iu);
+  if (pipelineMatch) {
+    return { pattern: pipelineMatch[1], target: pipelineMatch[2]?.trim() };
+  }
+  const match = meta.match(/^search\s+"(.+)"\s+in\s+(.+)$/iu);
+  if (!match) return {};
+  return { pattern: match[1], target: match[2]?.trim() };
+}
+function classifyRepoSearchMeta(meta) {
+  const { pattern, target } = extractSearchMeta(meta);
+  if (!pattern) return { kind: "not_repo_search" };
+  if (isRgExcludeScopeTarget(target)) {
+    return { kind: "rg_exclude_syntax", pattern, target };
+  }
+  if (isSingleFileSearchTarget(target)) {
+    return { kind: "bad_scope", pattern, target };
+  }
+  return { kind: "not_repo_search", pattern, target };
+}
+function metaToNormalizedRgCommand(meta) {
+  const { pattern, target } = extractSearchMeta(meta);
+  if (!pattern) return null;
+  if (isRgExcludeScopeTarget(target)) {
+    const glob = `${target.trim()}/**`;
+    return {
+      command: `rg "${pattern}" -g '${glob}' .`,
+      changed: true
+    };
+  }
+  if (target && isSingleFileSearchTarget(target)) {
+    return {
+      command: `rg -g ${target} "${pattern}" .`,
+      changed: true
+    };
+  }
+  return null;
+}
+function formatRepoSearchGuidance(ctx) {
+  if (ctx.kind === "bad_scope" && ctx.pattern?.includes("agent-os-land-pr") && ctx.target === "package.json") {
+    return "Search package.json with a glob from the repo root: `rg -g package.json agent-os-land-pr .` \u2014 or run `node scripts/agent-os-land-pr.mjs <pr-url>` directly.";
+  }
+  if (ctx.kind === "bad_scope" && ctx.pattern && ctx.target) {
+    return `Use \`rg -g '${ctx.target}' ${ctx.pattern} .\` from the repo root instead of treating ${ctx.target} as a folder.`;
+  }
+  if (ctx.kind === "rg_exclude_syntax" && ctx.pattern) {
+    const glob = ctx.target ? `${ctx.target.trim()}/**` : "!node_modules/**";
+    return `Repo search scope \`${ctx.target ?? "!node_modules"}\` is not a valid ripgrep path. Use \`rg "${ctx.pattern}" -g '${glob}' .\` from the repo root (exclude globs need a \`/**\` suffix).`;
+  }
+  if (ctx.kind === "no_matches" && ctx.pattern) {
+    return `No matches for "${ctx.pattern}". Try a broader pattern, drop overly short tokens, or search from the repo root with \`rg "${ctx.pattern}" .\`.`;
+  }
+  return null;
+}
+function extractSearchMetaFromToolLine(line) {
+  const match = line.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(agent\)|\s*failed|$)/iu);
+  if (!match) return null;
+  return `search "${match[1]}" in ${match[2]?.trim()}`;
+}
+function diagnoseRepoSearchFailure(input) {
+  const meta = input.meta?.trim() || (input.command ? extractSearchMetaFromToolLine(input.command) : null) || null;
+  if (meta) {
+    const ctx = classifyRepoSearchMeta(meta);
+    const guidance = formatRepoSearchGuidance(ctx);
+    if (guidance) return guidance;
+    const normalized = metaToNormalizedRgCommand(meta);
+    if (normalized?.changed) {
+      return `Repo search used an invalid scope. Retry with: \`${normalized.command}\`.`;
+    }
+  }
+  if (input.command && /\b(rg|ripgrep)\b/i.test(input.command)) {
+    const normalized = normalizeRepoSearchCommand(input.command);
+    if (normalized.changed) {
+      return `Ripgrep scope may be invalid. Retry with: \`${normalized.command}\`.`;
+    }
+    if (input.exitCode === 1) {
+      return "Ripgrep returned no matches (exit 1). Try a broader pattern or search from the repo root.";
+    }
+  }
+  return null;
+}
+
+// src/shell-command-outcome.ts
+var NPM_AUDIT_RE = /\bnpm\s+audit\b/i;
+var RG_CMD_RE = /\b(rg|ripgrep)\b/i;
+var RG_REAL_ERROR_RE = /\b(error|invalid|unknown|panic|not found)\b/i;
+function tidy(text, max = 200) {
+  const one = text.replace(/\s+/g, " ").trim();
+  return one.length > max ? `${one.slice(0, max - 1)}\u2026` : one;
+}
+function extractJsonObject(text) {
+  const trimmed = text.trim();
+  if (!trimmed) return null;
+  if (trimmed.startsWith("{")) {
+    try {
+      return JSON.parse(trimmed);
+    } catch {
+    }
+  }
+  const start = trimmed.indexOf("{");
+  const end = trimmed.lastIndexOf("}");
+  if (start >= 0 && end > start) {
+    try {
+      return JSON.parse(trimmed.slice(start, end + 1));
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+function isRecord(value) {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function summarizeNpmAuditReport(report) {
+  const meta = report.metadata;
+  if (!isRecord(meta)) return null;
+  const vuln = meta.vulnerabilities;
+  if (!isRecord(vuln)) return null;
+  const num = (key) => typeof vuln[key] === "number" ? vuln[key] : 0;
+  const summary = {
+    info: num("info"),
+    low: num("low"),
+    moderate: num("moderate"),
+    high: num("high"),
+    critical: num("critical"),
+    total: num("total")
+  };
+  if (typeof vuln.total !== "number" && !summary.critical && !summary.high && !summary.moderate && !summary.low && !summary.info) {
+    return null;
+  }
+  return summary;
+}
+function formatAuditSummaryLine(audit) {
+  const parts = [];
+  if (audit.critical) parts.push(`${audit.critical} critical`);
+  if (audit.high) parts.push(`${audit.high} high`);
+  if (audit.moderate) parts.push(`${audit.moderate} moderate`);
+  if (audit.low) parts.push(`${audit.low} low`);
+  if (audit.info) parts.push(`${audit.info} info`);
+  const breakdown = parts.length ? parts.join(", ") : "see report";
+  return `npm audit: ${audit.total} vulnerabilit${audit.total === 1 ? "y" : "ies"} (${breakdown}) \u2014 remediation required`;
+}
+function npmAuditFailureReason(report, stderr) {
+  const err = report.error;
+  if (isRecord(err)) {
+    const summary = typeof err.summary === "string" ? err.summary.trim() : "";
+    const code = typeof err.code === "string" ? err.code.trim() : "";
+    if (summary) return code ? `${code}: ${summary}` : summary;
+    if (code) return code;
+  }
+  const detail = typeof report.message === "string" ? report.message.trim() : "";
+  if (detail) return detail;
+  const errTail = stderr.trim();
+  if (errTail) return tidy(errTail.split("\n").find(Boolean) ?? errTail, 160);
+  return "npm audit failed";
+}
+function classifyNpmAuditOutcome(input) {
+  const combined = `${input.stdout}
+${input.stderr}`.trim();
+  const parsed = extractJsonObject(combined);
+  if (!parsed || !isRecord(parsed)) {
+    const tail = tidy(combined || `exit ${input.exitCode}`, 180);
+    return {
+      kind: "command_failure",
+      exitCode: input.exitCode,
+      summary: `npm audit failed (invalid or missing JSON): ${tail}`,
+      parseError: "invalid_json"
+    };
+  }
+  if (isRecord(parsed.error)) {
+    return {
+      kind: "command_failure",
+      exitCode: input.exitCode,
+      summary: `npm audit command failed: ${npmAuditFailureReason(parsed, input.stderr)}`
+    };
+  }
+  const audit = summarizeNpmAuditReport(parsed);
+  if (!audit) {
+    return {
+      kind: "command_failure",
+      exitCode: input.exitCode,
+      summary: "npm audit failed: JSON response missing vulnerability metadata",
+      parseError: "missing_metadata"
+    };
+  }
+  if (input.exitCode === 0 && audit.total === 0) {
+    return {
+      kind: "success",
+      exitCode: 0,
+      summary: "npm audit: no vulnerabilities reported",
+      audit
+    };
+  }
+  return {
+    kind: "audit_findings",
+    exitCode: input.exitCode,
+    summary: formatAuditSummaryLine(audit),
+    audit
+  };
+}
+function isNpmAuditCommand(command) {
+  return NPM_AUDIT_RE.test(command);
+}
+function isRgCommand(command) {
+  return RG_CMD_RE.test(command);
+}
+function classifyRgOutcome(input) {
+  const diagnosis = diagnoseRepoSearchFailure({
+    command: input.command,
+    exitCode: input.exitCode
+  });
+  if (input.exitCode === 0) {
+    return {
+      kind: "success",
+      exitCode: 0,
+      summary: "ripgrep finished (exit 0)"
+    };
+  }
+  if (input.exitCode === 1) {
+    const errText = (input.stderr || input.interleaved).trim();
+    if (errText && RG_REAL_ERROR_RE.test(errText)) {
+      const tail2 = tidy(errText, 160);
+      return {
+        kind: "command_failure",
+        exitCode: 1,
+        summary: diagnosis ?? `ripgrep failed (exit 1): ${tail2}`
+      };
+    }
+    const normalized = normalizeRepoSearchCommand(input.command);
+    const retry = normalized.changed && !diagnosis ? ` Retry with: \`${normalized.command}\`.` : "";
+    return {
+      kind: "search_no_matches",
+      exitCode: 1,
+      summary: diagnosis ?? `ripgrep: no matches (exit 1).${retry} Try a broader pattern or search from the repo root.`
+    };
+  }
+  const tail = tidy(input.interleaved || input.stdout || input.stderr || `exit ${input.exitCode}`, 180);
+  return {
+    kind: "command_failure",
+    exitCode: input.exitCode,
+    summary: diagnosis ?? `ripgrep failed (exit ${input.exitCode}): ${tail}`
+  };
+}
+function classifyShellCommandOutcome(input) {
+  const stdout = input.stdout ?? "";
+  const stderr = input.stderr ?? "";
+  const interleaved = input.interleavedOutput ?? "";
+  if (isNpmAuditCommand(input.command)) {
+    const body = stdout.trim() || interleaved.trim() || stderr.trim();
+    return classifyNpmAuditOutcome({
+      exitCode: input.exitCode,
+      stdout: body,
+      stderr
+    });
+  }
+  if (isRgCommand(input.command)) {
+    return classifyRgOutcome({
+      command: input.command,
+      exitCode: input.exitCode,
+      stdout,
+      stderr,
+      interleaved
+    });
+  }
+  const searchDiagnosis = diagnoseRepoSearchFailure({
+    command: input.command,
+    exitCode: input.exitCode
+  });
+  if (searchDiagnosis && input.exitCode !== 0) {
+    return {
+      kind: "command_failure",
+      exitCode: input.exitCode,
+      summary: searchDiagnosis
+    };
+  }
+  if (input.exitCode === 0) {
+    return {
+      kind: "success",
+      exitCode: 0,
+      summary: `command succeeded (exit 0)`
+    };
+  }
+  const tail = tidy(interleaved || stdout || stderr || `exit ${input.exitCode}`, 180);
+  return {
+    kind: "command_failure",
+    exitCode: input.exitCode,
+    summary: `command failed (exit ${input.exitCode}): ${tail}`
+  };
+}
+
+// src/stream.ts
+function eventTimestampIso(event) {
+  const tsMs = event.timestamp_ms;
+  return event.timestamp || event.ts || (tsMs ? new Date(tsMs).toISOString() : void 0);
+}
+function cursorToolNameFromCall(toolCall) {
+  if (!toolCall) return null;
+  for (const key of Object.keys(toolCall)) {
+    if (key.endsWith("ToolCall")) {
+      const stem = key.slice(0, -"ToolCall".length);
+      return stem.length ? stem : key;
+    }
+  }
+  return null;
+}
+function recordStreamResult(result, event) {
+  result.finalResult = event.result || event.subtype || event.terminal_reason || "completed";
+  if (event.is_error) {
+    result.error = String(event.result || event.api_error_status || "stream result error");
+  }
+}
+function shellPayloadFromCursorEvent(event) {
+  if (event.type !== "tool_call" || event.subtype !== "completed") return null;
+  const toolCall = event.tool_call && typeof event.tool_call === "object" && !Array.isArray(event.tool_call) ? event.tool_call : null;
+  const shell = toolCall?.shellToolCall;
+  if (!shell || typeof shell !== "object" || Array.isArray(shell)) return null;
+  const shellObj = shell;
+  const args = shellObj.args;
+  const command = args && typeof args === "object" && !Array.isArray(args) && typeof args.command === "string" ? String(args.command) : "";
+  const result = shellObj.result;
+  if (!result || typeof result !== "object" || Array.isArray(result)) return null;
+  const body = result.success ?? result.failure;
+  if (!body || typeof body !== "object" || Array.isArray(body)) return null;
+  const row = body;
+  const exitCode = typeof row.exitCode === "number" ? row.exitCode : 0;
+  return {
+    command,
+    exitCode,
+    stdout: typeof row.stdout === "string" ? row.stdout : "",
+    stderr: typeof row.stderr === "string" ? row.stderr : "",
+    interleaved: typeof row.interleavedOutput === "string" ? row.interleavedOutput : ""
+  };
+}
+function applyShellOutcome(parsed, outcome) {
+  if (outcome.kind === "success" || outcome.kind === "search_no_matches") return;
+  parsed.lastShellOutcome = outcome;
+}
+function parseHarnessStream(file) {
+  const result = {
+    firstEventAt: null,
+    lastEventAt: null,
+    currentTool: null,
+    finalResult: null,
+    error: null,
+    lastShellOutcome: null
+  };
+  if (!existsSync6(file)) return result;
+  const lines = readFileSync4(file, "utf8").split("\n").filter(Boolean);
+  for (const line of lines) {
+    const event = safeJson(line);
+    if (!event) continue;
+    const ts = eventTimestampIso(event);
+    if (ts) {
+      result.firstEventAt ||= ts;
+      result.lastEventAt = ts;
+    }
+    if (event.type === "stream_event" && event.event && typeof event.event === "object" && event.event.type === "content_block_start") {
+      const block = event.event.content_block;
+      if (block?.type === "tool_use") result.currentTool = String(block.name || "tool");
+    }
+    if (event.type === "assistant" && event.message && typeof event.message === "object") {
+      const content = event.message.content;
+      if (Array.isArray(content)) {
+        const tool = content.find((item) => item?.type === "tool_use");
+        if (tool) result.currentTool = String(tool.name || result.currentTool);
+      }
+    }
+    if (event.type === "tool_call" && event.subtype === "started") {
+      const toolCall = event.tool_call && typeof event.tool_call === "object" && !Array.isArray(event.tool_call) ? event.tool_call : void 0;
+      const name = cursorToolNameFromCall(toolCall);
+      if (name) result.currentTool = name;
+    }
+    const shell = shellPayloadFromCursorEvent(event);
+    if (shell) {
+      applyShellOutcome(
+        result,
+        classifyShellCommandOutcome({
+          command: shell.command,
+          exitCode: shell.exitCode,
+          stdout: shell.stdout,
+          stderr: shell.stderr,
+          interleavedOutput: shell.interleaved
+        })
+      );
+    }
+    if (event.type === "result") {
+      recordStreamResult(result, event);
+    }
+  }
+  return result;
+}
+
+// src/exit-classify.ts
+var FAILURE_PATTERNS = [
+  {
+    test: /\b(?:invalid|unknown|unsupported|unrecognized)\b[^.\n]*\bmodel\b/i,
+    label: "provider rejected the requested model"
+  },
+  {
+    test: /\bmodel\b[^.\n]*\b(?:not\s+(?:found|supported|available|recognized|valid)|is\s+not\s+valid|does\s+not\s+exist)/i,
+    label: "provider rejected the requested model"
+  },
+  {
+    test: /\b(?:did you mean|available models|choose (?:a|one of)|supported models)\b/i,
+    label: "provider rejected the requested model"
+  },
+  {
+    test: /model preflight failed/i,
+    label: "model/provider preflight failed"
+  },
+  {
+    test: /\b(?:command not found|ENOENT|is the .*CLI on PATH|executable not found|no such file or directory)\b/i,
+    label: "provider CLI is missing or not on PATH"
+  },
+  {
+    test: /\bfailed to spawn\b/i,
+    label: "provider failed to spawn the worker process"
+  },
+  {
+    test: /\b(?:not logged in|unauthorized|authentication (?:failed|required)|invalid api key|missing api key|401)\b/i,
+    label: "provider authentication failed"
+  }
+];
+function tidy2(errorText, max = 240) {
+  const oneLine2 = errorText.replace(/\s+/g, " ").trim();
+  return oneLine2.length > max ? `${oneLine2.slice(0, max - 1)}\u2026` : oneLine2;
+}
+function classifyExitFailure(errorText) {
+  const text = (errorText ?? "").trim();
+  if (!text) return null;
+  for (const pattern of FAILURE_PATTERNS) {
+    if (pattern.test.test(text)) {
+      return { blocked: true, reason: `${pattern.label}: ${tidy2(text)}` };
+    }
+  }
+  return null;
+}
+
+// src/exited-salvage.ts
+function trimOrNull(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length ? trimmed : null;
+}
+function hasFinalResult(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string") return value.trim().length > 0;
+  if (typeof value === "boolean") return value;
+  if (Array.isArray(value)) return value.length > 0;
+  if (typeof value === "object") return Object.keys(value).length > 0;
+  return true;
+}
+function committedHeadFromAncestry(ancestry) {
+  if (!ancestry?.checked) return null;
+  if (ancestry.headIsAncestorOfBase !== false) return null;
+  return trimOrNull(ancestry.head);
+}
+function buildAttentionReason(kind, uncommittedCount, headCommit) {
+  const parts = ["exited_with_changes_salvage"];
+  if (kind === "uncommitted" || kind === "both") {
+    parts.push(
+      `${uncommittedCount} uncommitted change${uncommittedCount === 1 ? "" : "s"} with no final result`
+    );
+  }
+  if ((kind === "committed_ahead" || kind === "both") && headCommit) {
+    const sha = headCommit.length > 12 ? headCommit.slice(0, 12) : headCommit;
+    parts.push(`commit ${sha} ahead of base with no final result`);
+  }
+  parts.push("review worktree \u2014 commit, open a PR, or run a salvage worker before discarding");
+  return parts.join(": ");
+}
+function assessExitedWorkerSalvage(input) {
+  if (input.alive || hasFinalResult(input.finalResult)) return null;
+  const uncommittedCount = (input.changedFiles ?? []).filter((line) => line.trim()).length;
+  const headCommit = trimOrNull(input.headCommit) ?? committedHeadFromAncestry(input.gitAncestry);
+  const hasUncommitted = uncommittedCount > 0;
+  const hasCommittedAhead = Boolean(headCommit);
+  if (!hasUncommitted && !hasCommittedAhead) {
+    return {
+      kind: "none",
+      salvageable: false,
+      uncommittedCount: 0,
+      headCommit: null,
+      attentionReason: "process exited without a final result"
+    };
+  }
+  const kind = hasUncommitted && hasCommittedAhead ? "both" : hasUncommitted ? "uncommitted" : "committed_ahead";
+  return {
+    kind,
+    salvageable: true,
+    uncommittedCount,
+    headCommit,
+    attentionReason: buildAttentionReason(kind, uncommittedCount, headCommit)
+  };
+}
+
+// src/landing-gate.ts
+function trimOrNull2(value) {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed.length ? trimmed : null;
+}
+function hasFinalResult2(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string") return value.trim().length > 0;
+  if (typeof value === "boolean") return value;
+  if (Array.isArray(value)) return value.length > 0;
+  if (typeof value === "object") return Object.keys(value).length > 0;
+  return true;
+}
+function hasCommittedLandingRef(snapshot) {
+  if (trimOrNull2(snapshot.headCommit)) return true;
+  if (trimOrNull2(snapshot.prUrl)) return true;
+  if (trimOrNull2(snapshot.artifactBundlePath)) return true;
+  if (trimOrNull2(snapshot.patchPath)) return true;
+  const ancestry = snapshot.gitAncestry;
+  if (ancestry?.checked && ancestry.headIsAncestorOfBase === false && trimOrNull2(ancestry.head)) {
+    return true;
+  }
+  return false;
+}
+function assessWorkerLanding(snapshot) {
+  if (!hasFinalResult2(snapshot.finalResult)) return { blocked: false };
+  if (snapshot.changedFiles.length === 0) return { blocked: false };
+  if (!hasCommittedLandingRef(snapshot)) {
+    return {
+      blocked: true,
+      reason: "dirty_worktree_no_pr",
+      detail: `Worktree has ${snapshot.changedFiles.length} uncommitted change(s) with no commit or PR; commit, open a PR, or discard before landing`
+    };
+  }
+  return {
+    blocked: true,
+    detail: `Worktree has ${snapshot.changedFiles.length} uncommitted change(s); commit or discard before landing`
+  };
+}
+function landingAttentionReason(verdict) {
+  if (!verdict.blocked) return void 0;
+  return verdict.detail ?? verdict.reason ?? "dirty_worktree_no_pr";
+}
+
+// src/worker-final-result-embed.ts
+function tryParseJsonObject2(text) {
+  const trimmed = text.trim();
+  if (!trimmed.startsWith("{")) return null;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+    return null;
+  }
+  return null;
+}
+function reconciliationEntryCount(record) {
+  const raw = record.targetPrReconciliation ?? record.target_pr_reconciliation ?? record.targetPrs ?? record.target_prs;
+  return Array.isArray(raw) ? raw.length : 0;
+}
+function extractEmbeddedWorkerFinalResultRecord(value) {
+  const trimmed = value.trim();
+  if (!trimmed) return null;
+  const direct = tryParseJsonObject2(trimmed);
+  if (direct) return direct;
+  const candidates = [];
+  const fenceRe = /```(?:json)?\s*([\s\S]*?)```/gi;
+  let fenceMatch;
+  while ((fenceMatch = fenceRe.exec(trimmed)) !== null) {
+    const fromFence = tryParseJsonObject2(fenceMatch[1] ?? "");
+    if (fromFence) candidates.push(fromFence);
+  }
+  const firstBrace = trimmed.indexOf("{");
+  const lastBrace = trimmed.lastIndexOf("}");
+  if (firstBrace >= 0 && lastBrace > firstBrace) {
+    const slice = tryParseJsonObject2(trimmed.slice(firstBrace, lastBrace + 1));
+    if (slice) candidates.push(slice);
+  }
+  if (candidates.length === 0) return null;
+  let best = candidates[candidates.length - 1];
+  let bestScore = reconciliationEntryCount(best);
+  for (const candidate of candidates) {
+    const score = reconciliationEntryCount(candidate);
+    if (score > bestScore) {
+      best = candidate;
+      bestScore = score;
+    }
+  }
+  return best;
+}
+
+// src/landing-contract-gate.ts
+function trimOrNull3(value) {
+  if (typeof value !== "string") return null;
+  const t = value.trim();
+  return t.length ? t : null;
+}
+function hasFinalResult3(value) {
+  if (value === void 0 || value === null) return false;
+  if (typeof value === "string") return value.trim().length > 0;
+  if (typeof value === "object") return Object.keys(value).length > 0;
+  return true;
+}
+function normalizePrUrl(url) {
+  const m = url.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);
+  if (!m) return trimOrNull3(url);
+  return `https://github.com/${m[1]}/pull/${m[2]}`;
+}
+function prUrlSetKey(url) {
+  const m = url.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);
+  if (!m) return url.trim().toLowerCase();
+  return `${m[1].toLowerCase()}/pull/${m[2]}`;
+}
+function parseReconciliation(finalResult) {
+  let record = null;
+  if (typeof finalResult === "string") {
+    const embedded = extractEmbeddedWorkerFinalResultRecord(finalResult);
+    if (embedded) record = embedded;
+  } else if (finalResult && typeof finalResult === "object" && !Array.isArray(finalResult)) {
+    record = finalResult;
+  }
+  if (!record) return [];
+  const raw = record.targetPrReconciliation ?? record.target_pr_reconciliation;
+  if (!Array.isArray(raw)) return [];
+  const out = [];
+  for (const item of raw) {
+    if (!item || typeof item !== "object" || Array.isArray(item)) continue;
+    const row = item;
+    const prUrl = normalizePrUrl(String(row.prUrl ?? row.pr_url ?? ""));
+    const outcome = trimOrNull3(row.outcome);
+    if (!prUrl || outcome !== "merged" && outcome !== "skipped" && outcome !== "blocked") continue;
+    out.push({
+      prUrl,
+      outcome,
+      mergeCommit: trimOrNull3(row.mergeCommit ?? row.merge_commit),
+      reason: trimOrNull3(row.reason)
+    });
+  }
+  return out;
+}
+function workerAttachedPrUrls(snapshot, finalResult) {
+  const urls = [];
+  const fromSnapshot = normalizePrUrl(trimOrNull3(snapshot.prUrl) ?? "");
+  if (fromSnapshot) urls.push(fromSnapshot);
+  if (finalResult && typeof finalResult === "object" && !Array.isArray(finalResult)) {
+    const record = finalResult;
+    const pr = normalizePrUrl(String(record.prUrl ?? record.pr_url ?? ""));
+    if (pr) urls.push(pr);
+  }
+  return [...new Set(urls)];
+}
+function assessWorkerLandingContract(input) {
+  const { contract, snapshot } = input;
+  const finalResult = input.finalResult ?? snapshot.finalResult;
+  if (!contract.landingOnly && contract.targetPrUrls.length === 0 && !contract.repairEnforceOriginalPr) {
+    return { blocked: false };
+  }
+  if (!hasFinalResult3(finalResult)) {
+    const requiresEarly = contract.requiresTargetPrReconciliation ?? (contract.landingOnly || Boolean(contract.repairEnforceOriginalPr) || contract.targetPrUrls.length > 0);
+    if (requiresEarly && contract.targetPrUrls.length > 0) {
+      return {
+        blocked: true,
+        reason: "missing_target_pr_reconciliation",
+        detail: `Final result required to reconcile target PR(s): ${contract.targetPrUrls.join(", ")}`
+      };
+    }
+    return { blocked: false };
+  }
+  const requiresTargetPrReconciliation = contract.requiresTargetPrReconciliation ?? (contract.landingOnly || Boolean(contract.repairEnforceOriginalPr) || contract.targetPrUrls.length > 0);
+  if (!requiresTargetPrReconciliation && !contract.repairEnforceOriginalPr) {
+    return { blocked: false };
+  }
+  const repairTarget = contract.repairEnforceOriginalPr ? normalizePrUrl(trimOrNull3(contract.targetPrUrl) ?? "") ?? (contract.targetPrUrls.length === 1 ? normalizePrUrl(contract.targetPrUrls[0]) : null) : null;
+  if (repairTarget) {
+    const workerPrs = workerAttachedPrUrls(snapshot, finalResult);
+    const supersedes = finalResult && typeof finalResult === "object" && !Array.isArray(finalResult) && finalResult.supersedesOriginalTargetPr === true;
+    if (!supersedes) {
+      for (const pr of workerPrs) {
+        if (pr !== repairTarget) {
+          return {
+            blocked: true,
+            reason: "duplicate_repair_pr",
+            detail: `Repair worker opened or attached PR ${pr} instead of canonical target ${repairTarget}`
+          };
+        }
+      }
+    }
+    const reconciliation2 = parseReconciliation(finalResult);
+    const entry = reconciliation2.find((r) => r.prUrl === repairTarget);
+    if (!entry || entry.outcome !== "merged" && !(entry.reason?.trim() && (entry.outcome === "skipped" || entry.outcome === "blocked"))) {
+      return {
+        blocked: true,
+        reason: "missing_repair_target_reconciliation",
+        detail: `Repair worker must reconcile target PR ${repairTarget}`
+      };
+    }
+  }
+  const reconciliation = parseReconciliation(finalResult);
+  const byUrl = new Map(
+    reconciliation.map((r) => [prUrlSetKey(r.prUrl), r])
+  );
+  const targetSet = new Set(
+    contract.targetPrUrls.map((u) => prUrlSetKey(normalizePrUrl(u) ?? u)).filter(Boolean)
+  );
+  const attachedPrs = workerAttachedPrUrls(snapshot, finalResult);
+  if (contract.landingOnly) {
+    for (const pr of attachedPrs) {
+      if (targetSet.size > 0 && !targetSet.has(prUrlSetKey(pr))) {
+        return {
+          blocked: true,
+          reason: "unrelated_implementation_pr",
+          detail: `Landing-only worker attached unrelated PR ${pr}`
+        };
+      }
+      if (targetSet.size === 0) {
+        return {
+          blocked: true,
+          reason: "unrelated_implementation_pr",
+          detail: "Landing-only worker must not open new implementation PRs"
+        };
+      }
+    }
+  }
+  if (contract.targetPrUrls.length === 0) return { blocked: false };
+  const missing = [];
+  for (const target of contract.targetPrUrls) {
+    const key = prUrlSetKey(normalizePrUrl(target) ?? target);
+    const entry = byUrl.get(key);
+    if (!entry) {
+      missing.push(key);
+      continue;
+    }
+    if (entry.outcome !== "merged" && !entry.reason?.trim()) {
+      missing.push(key);
+    }
+  }
+  if (missing.length > 0) {
+    return {
+      blocked: true,
+      reason: missing.every((u) => byUrl.has(u)) ? "incomplete_target_pr_landing" : "missing_target_pr_reconciliation",
+      detail: `Target PR reconciliation incomplete: ${missing.join(", ")}`
+    };
+  }
+  return { blocked: false };
+}
+function landingContractAttentionReason(verdict) {
+  if (!verdict.blocked) return void 0;
+  return verdict.detail ?? verdict.reason;
+}
+
+// src/status.ts
+var NO_START_MS = 18e4;
+var STALE_MS = 6e5;
+function computeAttention(input) {
+  const now = Date.now();
+  if (input.completionBlocker && !isSkippedTerminalCompletionBlocker(input.completionBlocker)) {
+    return { state: "blocked", reason: input.completionBlocker };
+  }
+  if (input.finalResult) {
+    if (input.localOnly && hasMergedTargetPrReconciliation(input.finalResult)) {
+      return { state: "done", reason: "local-only worker superseded by merged PR" };
+    }
+    const landingSnapshot = {
+      finalResult: input.finalResult,
+      changedFiles: input.changedFiles ?? [],
+      gitAncestry: input.gitAncestry ?? null,
+      prUrl: input.prUrl ?? null
+    };
+    const landing = assessWorkerLanding(landingSnapshot);
+    if (landing.blocked) {
+      const detail = landingAttentionReason(landing);
+      return {
+        state: "needs_attention",
+        reason: landing.reason ? `landing blocked (${landing.reason}): ${detail}` : `landing blocked: ${detail}`
+      };
+    }
+    if (input.landingContract) {
+      const contractVerdict = assessWorkerLandingContract({
+        contract: input.landingContract,
+        snapshot: landingSnapshot,
+        finalResult: input.finalResult
+      });
+      const contractDetail = landingContractAttentionReason(contractVerdict);
+      if (contractDetail) {
+        return {
+          state: "needs_attention",
+          reason: contractVerdict.reason ? `landing contract (${contractVerdict.reason}): ${contractDetail}` : `landing contract: ${contractDetail}`
+        };
+      }
+    }
+    return { state: "done", reason: "final result recorded" };
+  }
+  if (!input.alive) {
+    if (isAbandonedEmptyWorker(input)) {
+      return { state: "done", reason: "empty abandoned worker record" };
+    }
+    const classified = classifyExitFailure(input.error);
+    if (classified) return { state: "blocked", reason: classified.reason };
+    const salvage = assessExitedWorkerSalvage({
+      alive: false,
+      finalResult: null,
+      changedFiles: input.changedFiles,
+      gitAncestry: input.gitAncestry
+    });
+    if (salvage?.salvageable) {
+      const tail2 = input.error?.trim();
+      return {
+        state: "needs_attention",
+        reason: tail2 ? `${salvage.attentionReason} (${tail2})` : salvage.attentionReason
+      };
+    }
+    const tail = input.error?.trim();
+    return {
+      state: "needs_attention",
+      reason: tail ? `process exited without a final result: ${tail}` : salvage?.attentionReason ?? "process exited without a final result"
+    };
+  }
+  if (input.heartbeatBlocker) {
+    return { state: "blocked", reason: `worker heartbeat reported blocker: ${input.heartbeatBlocker}` };
+  }
+  const startMs = input.startedAt ? Date.parse(input.startedAt) : NaN;
+  if (!input.firstEventAt && input.stdoutBytes === 0 && input.heartbeatBytes === 0 && Number.isFinite(startMs) && now - startMs > NO_START_MS) {
+    return { state: "needs_attention", reason: `no first stream event ${secsAgo(startMs)}s after start` };
+  }
+  const actMs = input.lastActivityAt ? Date.parse(input.lastActivityAt) : NaN;
+  if (Number.isFinite(actMs) && now - actMs > STALE_MS) {
+    return { state: "stale", reason: `no log/event/heartbeat activity for ${secsAgo(actMs)}s` };
+  }
+  return { state: "ok", reason: "recent activity" };
+}
+function isSkippedTerminalCompletionBlocker(reason) {
+  const text = reason?.trim();
+  if (!text) return false;
+  return /completion acknowledged but board not advanced/i.test(text) && /task already terminal/i.test(text);
+}
+function isAbandonedEmptyWorker(input) {
+  if (input.finalResult) return false;
+  if (input.taskId || input.agentOsId) return false;
+  if (input.stdoutBytes > 0 || (input.stderrBytes ?? 0) > 0 || input.heartbeatBytes > 0) return false;
+  if (input.error?.trim()) return false;
+  if ((input.changedFiles ?? []).some((line) => line.trim())) return false;
+  return /empty worker dir|marked abandoned/i.test(input.reconcileReason ?? "");
+}
+function hasMergedTargetPrReconciliation(value) {
+  let record = null;
+  if (typeof value === "string") record = extractEmbeddedWorkerFinalResultRecord(value);
+  else if (value && typeof value === "object" && !Array.isArray(value)) record = value;
+  if (!record) return false;
+  const raw = record.targetPrReconciliation ?? record.target_pr_reconciliation;
+  if (!Array.isArray(raw)) return false;
+  return raw.some((item) => {
+    if (!item || typeof item !== "object" || Array.isArray(item)) return false;
+    return String(item.outcome ?? "").trim() === "merged";
+  });
+}
+function resolveFinalResult(worker, parsedFinalResult, heartbeat) {
+  const ackSnapshot = worker.completionSnapshot?.finalResult;
+  if (worker.completionAckSource === "local-pr-merged-reconcile" && ackSnapshot !== void 0 && ackSnapshot !== null) {
+    return ackSnapshot;
+  }
+  if (parsedFinalResult) return parsedFinalResult;
+  if (ackSnapshot !== void 0 && ackSnapshot !== null) return ackSnapshot;
+  return terminalFinalResultFromHeartbeat(heartbeat);
+}
+function computeWorkerStatus(worker, options = {}) {
+  const parsed = parseHarnessStream(worker.stdoutPath);
+  const heartbeat = parseHeartbeat(worker.heartbeatPath);
+  const completionAcknowledged = typeof worker.completionReportedAt === "string" && worker.completionReportedAt.trim().length > 0;
+  const finalResult = resolveFinalResult(worker, parsed.finalResult, heartbeat);
+  const alive = completionAcknowledged ? false : isPidAlive(worker.pid);
+  const stdoutBytes = fileSize(worker.stdoutPath);
+  const stderrBytes = fileSize(worker.stderrPath);
+  const heartbeatBytes = fileSize(worker.heartbeatPath);
+  const changedFiles = gitStatusShort(worker.worktreePath);
+  const gitAncestry = computeGitAncestry(worker.worktreePath, {
+    base: options.base,
+    baseCommit: options.baseCommit
+  });
+  const lastActivityAt = latestIso([
+    parsed.lastEventAt,
+    heartbeat.lastHeartbeatAt,
+    fileMtime(worker.stdoutPath),
+    fileMtime(worker.stderrPath),
+    fileMtime(worker.heartbeatPath)
+  ]);
+  const error = parsed.error || (!alive && !finalResult ? tailFile(worker.stderrPath, 10).trim() || void 0 : void 0);
+  const completionBlocker = typeof worker.completionBlocker === "string" && worker.completionBlocker.trim() ? worker.completionBlocker.trim() : null;
+  const effectiveCompletionBlocker = isSkippedTerminalCompletionBlocker(completionBlocker) ? null : completionBlocker;
+  const landingContract = worker.repairTargetPrUrl ? {
+    landingOnly: false,
+    targetPrUrls: [worker.repairTargetPrUrl],
+    targetPrUrl: worker.repairTargetPrUrl,
+    repairEnforceOriginalPr: true
+  } : null;
+  const attention = computeAttention({
+    alive,
+    finalResult,
+    firstEventAt: parsed.firstEventAt,
+    stdoutBytes,
+    stderrBytes,
+    heartbeatBytes,
+    lastActivityAt,
+    heartbeatBlocker: heartbeat.heartbeatBlocker,
+    startedAt: worker.startedAt,
+    error,
+    changedFiles,
+    gitAncestry,
+    completionBlocker: effectiveCompletionBlocker,
+    landingContract,
+    prUrl: worker.repairTargetPrUrl ?? worker.taskPrUrl ?? null,
+    localOnly: worker.localOnly === true,
+    taskId: worker.taskId ?? null,
+    agentOsId: worker.agentOsId ?? null,
+    reconcileReason: worker.reconcileReason ?? null
+  });
+  const workerStatusLabel = effectiveCompletionBlocker || attention.state === "blocked" ? "blocked" : completionAcknowledged || attention.state === "done" ? "done" : finalResult ? "exited" : alive ? "running" : "exited";
+  return {
+    runId: worker.runId,
+    worker: worker.name,
+    pid: worker.pid,
+    alive,
+    status: workerStatusLabel,
+    attention,
+    branch: worker.branch,
+    worktreePath: worker.worktreePath,
+    ownedPaths: worker.ownedPaths,
+    stdoutBytes,
+    stderrBytes,
+    heartbeatBytes,
+    firstEventAt: parsed.firstEventAt,
+    lastEventAt: parsed.lastEventAt,
+    lastActivityAt,
+    currentTool: completionAcknowledged ? null : parsed.currentTool,
+    heartbeatCount: heartbeat.heartbeatCount,
+    lastHeartbeatAt: heartbeat.lastHeartbeatAt,
+    lastHeartbeatPhase: heartbeat.lastHeartbeatPhase,
+    lastHeartbeatSummary: heartbeat.lastHeartbeatSummary,
+    heartbeatBlocker: heartbeat.heartbeatBlocker,
+    timestampAnomalies: heartbeat.timestampAnomalies,
+    finalResult,
+    error,
+    changedFiles,
+    gitAncestry,
+    instructionPolicyFingerprint: worker.instructionPolicyFingerprint ?? null,
+    instructionPolicyEvidence: worker.instructionPolicyEvidence ?? null
+  };
+}
+function isFinishedWorkerStatus(status) {
+  if (status.finalResult) return true;
+  if (status.alive === false) return true;
+  if (status.status === "exited" || status.status === "done") return true;
+  return false;
+}
+function isLandingBlockedWorkerStatus(status) {
+  if (!status.finalResult) return false;
+  return status.attention.state === "needs_attention" || status.attention.state === "blocked";
+}
+
+// src/resource-gate.ts
+var DEFAULT_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
+var DEFAULT_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
+
+// src/config.ts
+var CONFIG_DIR = path5.join(homedir2(), ".kynver");
+var CONFIG_FILE = path5.join(CONFIG_DIR, "config.json");
+var CREDENTIALS_FILE = path5.join(CONFIG_DIR, "credentials");
+function loadUserConfig() {
+  if (!existsSync7(CONFIG_FILE)) return {};
+  try {
+    return JSON.parse(readFileSync5(CONFIG_FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+var SETUP_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
+var SETUP_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
+
+// src/paths.ts
+var LEGACY_ROOT = path6.join(homedir3(), ".openclaw", "harness");
+var HARNESS_LAYOUT_DIR_NAMES = /* @__PURE__ */ new Set(["runs", "worktrees"]);
+function normalizeHarnessRoot(root) {
+  let resolved = path6.resolve(resolveUserPath(root.trim()));
+  while (HARNESS_LAYOUT_DIR_NAMES.has(path6.basename(resolved))) {
+    resolved = path6.dirname(resolved);
+  }
+  return resolved;
+}
+function resolveHarnessRoot() {
+  const env = process.env.KYNVER_HARNESS_ROOT || process.env.OPUS_HARNESS_ROOT;
+  if (env) return normalizeHarnessRoot(env);
+  const configured = loadUserConfig().harnessRoot?.trim();
+  if (configured) return normalizeHarnessRoot(configured);
+  const kynverRoot = path6.join(homedir3(), ".kynver", "harness");
+  if (existsSync8(kynverRoot)) return kynverRoot;
+  if (existsSync8(LEGACY_ROOT)) return LEGACY_ROOT;
+  return kynverRoot;
+}
+function harnessRunsDir(harnessRoot) {
+  return path6.join(normalizeHarnessRoot(harnessRoot), "runs");
+}
+function harnessWorktreesDir(harnessRoot) {
+  return path6.join(normalizeHarnessRoot(harnessRoot), "worktrees");
+}
+function getHarnessPaths() {
+  const harnessRoot = resolveHarnessRoot();
+  return {
+    harnessRoot,
+    runsDir: harnessRunsDir(harnessRoot),
+    worktreesDir: harnessWorktreesDir(harnessRoot)
+  };
+}
+function runDir(runsDir, id) {
+  return path6.join(runsDir, safeSlug(id));
+}
+
+// src/cleanup-guards.ts
+import path8 from "node:path";
+
+// src/cleanup-build-cache-paths.ts
+var HARNESS_BUILD_CACHE_RELATIVE_PATHS = [
+  ".next",
+  ".turbo",
+  "dist",
+  "build",
+  ".cache",
+  "node_modules/.cache"
+];
+function isGeneratedHarnessPath(pathPart) {
+  const normalized = pathPart.replace(/\\/g, "/").replace(/\/+$/, "");
+  if (normalized === "node_modules" || normalized.startsWith("node_modules/")) return true;
+  for (const rel of HARNESS_BUILD_CACHE_RELATIVE_PATHS) {
+    if (normalized === rel || normalized.startsWith(`${rel}/`)) return true;
+  }
+  return false;
+}
+
+// src/cleanup-guards-helpers.ts
+function materialWorktreeChanges(changedFiles) {
+  return changedFiles.filter((line) => {
+    const trimmed = line.trim();
+    const pathPart = trimmed.startsWith("??") ? trimmed.slice(2).trim() : trimmed.length > 3 ? trimmed.slice(3).trim() : trimmed;
+    return !isGeneratedHarnessPath(pathPart);
+  });
+}
+
+// src/cleanup-index-status.ts
+function indexedWorktreeStatus(entry) {
+  if (!entry.status) {
+    entry.status = computeWorkerStatus(entry.worker, {
+      base: entry.run.base,
+      baseCommit: entry.run.baseCommit
+    });
+  }
+  return entry.status;
+}
+function indexedWorktreeHasMaterialChanges(entry) {
+  if (entry.status) {
+    return materialWorktreeChanges(entry.status.changedFiles).length > 0;
+  }
+  return materialWorktreeChanges(gitStatusShort(entry.worktreePath)).length > 0;
+}
+
+// src/finalize.ts
+import path7 from "node:path";
+var ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([
+  "running",
+  "dispatching",
+  "pending",
+  "queued",
+  "needs_attention"
+]);
+var TERMINAL_RUN_STATUSES = /* @__PURE__ */ new Set(["completed", "failed", "cancelled", "done"]);
+function deriveTerminalRunStatus(run) {
+  const names = listRunWorkerNames(run);
+  if (names.length === 0) return "failed";
+  let anyAlive = false;
+  let anyResult = false;
+  let anyCompletionBlocked = false;
+  let anyLandingBlocked = false;
+  for (const name of names) {
+    const worker = readJson(
+      path7.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      void 0
+    );
+    if (!worker) continue;
+    const status = computeWorkerStatus(worker, {
+      base: run.base,
+      baseCommit: run.baseCommit
+    });
+    if (status.alive && !status.finalResult) {
+      anyAlive = true;
+      break;
+    }
+    if (typeof worker.completionBlocker === "string" && worker.completionBlocker) {
+      anyCompletionBlocked = true;
+    }
+    if (isLandingBlockedWorkerStatus(status)) {
+      anyLandingBlocked = true;
+    }
+    if (status.finalResult && status.attention.state === "done") anyResult = true;
+  }
+  if (anyAlive) return null;
+  if (anyCompletionBlocked) return null;
+  if (anyLandingBlocked) return null;
+  return anyResult ? "completed" : "failed";
+}
+function finalizeStaleRuns() {
+  const finalized = [];
+  for (const run of listRunRecords()) {
+    if (!ACTIVE_RUN_STATUSES.has(run.status)) continue;
+    const next = deriveTerminalRunStatus(run);
+    if (!next || next === run.status) continue;
+    const from = run.status;
+    run.status = next;
+    saveRun(run);
+    finalized.push({ runId: run.id, from, to: next });
+  }
+  return finalized;
+}
+
+// src/cleanup-worktree-salvage.ts
+function prUrlFromFinalResult(finalResult) {
+  if (typeof finalResult === "string") {
+    const match = finalResult.match(/https:\/\/github\.com\/[^\s]+\/pull\/\d+/i);
+    return match?.[0] ?? null;
+  }
+  if (finalResult && typeof finalResult === "object") {
+    const obj = finalResult;
+    for (const key of ["prUrl", "pr_url", "pullRequestUrl"]) {
+      const value = obj[key];
+      if (typeof value === "string" && value.trim()) return value.trim();
+    }
+  }
+  return null;
+}
+function isPrOrUnmergedWork(status) {
+  const relation = status.gitAncestry?.relation;
+  if (relation === "merged" || relation === "synced") {
+    return materialWorktreeChanges(status.changedFiles).length > 0;
+  }
+  if (prUrlFromFinalResult(status.finalResult)) return true;
+  if (relation === "ahead" || relation === "diverged") return true;
+  if (status.changedFiles.length > 0 && status.finalResult) return true;
+  return false;
+}
+
+// src/cleanup-completion-blocker.ts
+function completionBlockerBlocksWorktreeRemoval(indexed, status) {
+  const blocker = typeof indexed.worker.completionBlocker === "string" ? indexed.worker.completionBlocker.trim() : "";
+  if (!blocker) return false;
+  if (isWorkerProcessLive(indexed)) return true;
+  const resolved = status ?? indexedWorktreeStatus(indexed);
+  if (!isFinishedWorkerStatus(resolved)) return true;
+  if (isPrOrUnmergedWork(resolved)) return true;
+  if (materialWorktreeChanges(resolved.changedFiles).length > 0) return true;
+  const landing = assessWorkerLanding({
+    finalResult: resolved.finalResult,
+    changedFiles: resolved.changedFiles,
+    gitAncestry: resolved.gitAncestry,
+    prUrl: prUrlFromFinalResult(resolved.finalResult)
+  });
+  if (landing.blocked) return true;
+  return false;
+}
+
+// src/cleanup-run-liveness.ts
+function deriveRunTerminal(indexed, ctx) {
+  if (ctx) return ctx.runTerminalCache.derive(indexed.run);
+  return deriveTerminalRunStatus(indexed.run);
+}
+function isWorkerProcessLive(indexed) {
+  if (isPidAlive(indexed.worker.pid)) return true;
+  if (!indexed.worker.pid) return indexedWorktreeStatus(indexed).alive;
+  return false;
+}
+function isRunStaleActive(indexed, ctx) {
+  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
+  return deriveRunTerminal(indexed, ctx) !== null;
+}
+function runBlocksWorktreeRemoval(indexed, ctx) {
+  if (isWorkerProcessLive(indexed)) return true;
+  const status = indexedWorktreeStatus(indexed);
+  if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return true;
+  if (isFinishedWorkerStatus(status)) return false;
+  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
+  if (isRunStaleActive(indexed, ctx)) return false;
+  return deriveRunTerminal(indexed, ctx) === null;
+}
+
+// src/cleanup-guards.ts
+function effectiveWorktreeAgeMs(input) {
+  const { indexed, includeOrphans, worktreesAgeMs, terminalWorktreesAgeMs } = input;
+  if (!indexed) return includeOrphans ? terminalWorktreesAgeMs : worktreesAgeMs;
+  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) {
+    return terminalWorktreesAgeMs;
+  }
+  if (input.liveness && isRunStaleActive(indexed, input.liveness)) {
+    return terminalWorktreesAgeMs;
+  }
+  if (input.liveness && isFinishedWorkerStatus(indexedWorktreeStatus(indexed)) && !isWorkerProcessLive(indexed)) {
+    return terminalWorktreesAgeMs;
+  }
+  return worktreesAgeMs;
+}
+function skipWorktreeRemoval(input) {
+  const { indexed, includeOrphans, worktreesAgeMs, ageMs, orphanSafety, worktreeRemovalGuard } = input;
+  if (!indexed) {
+    if (!includeOrphans) return "orphan_without_flag";
+    return orphanSafety ?? null;
+  }
+  const ageThresholdMs = effectiveWorktreeAgeMs(input);
+  if (worktreesAgeMs <= 0 && !includeOrphans && ageThresholdMs <= 0) return "worktrees_disabled";
+  if (ageThresholdMs > 0 && ageMs < ageThresholdMs) return "below_age_threshold";
+  const status = indexedWorktreeStatus(indexed);
+  if (isWorkerProcessLive(indexed)) return "active_worker";
+  if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return "completion_blocked";
+  if (runBlocksWorktreeRemoval(indexed, input.liveness)) return "run_still_active";
+  if (!isFinishedWorkerStatus(status)) return "run_still_active";
+  if (isPrOrUnmergedWork(status)) return "pr_or_unmerged_commits";
+  if (materialWorktreeChanges(status.changedFiles).length > 0) return "dirty_worktree";
+  const landing = assessWorkerLanding({
+    finalResult: status.finalResult,
+    changedFiles: status.changedFiles,
+    gitAncestry: status.gitAncestry,
+    prUrl: prUrlFromFinalResult(status.finalResult)
+  });
+  if (landing.blocked) return "landing_blocked";
+  if (worktreeRemovalGuard && input.worktreePath) {
+    const overlay = worktreeRemovalGuard({
+      worktreePath: input.worktreePath,
+      indexed: Boolean(indexed),
+      runId: indexed?.runId,
+      worker: indexed?.workerName
+    });
+    if (overlay) {
+      return overlay.detail ? { reason: overlay.reason, detail: overlay.detail } : overlay.reason;
+    }
+  }
+  return null;
+}
+function skipDependencyCacheRemoval(input) {
+  const { indexed, nodeModulesAgeMs, ageMs, worktreePath, activeWorktreePaths, diskPressure } = input;
+  if (!diskPressure && ageMs < nodeModulesAgeMs) return "below_age_threshold";
+  if (activeWorktreePaths.has(path8.resolve(worktreePath))) return "active_worker";
+  if (indexed && isWorkerProcessLive(indexed)) return "active_worker";
+  if (indexed && indexedWorktreeHasMaterialChanges(indexed)) return "dirty_worktree";
+  return null;
+}
+function skipBuildCacheRemoval(input) {
+  return skipDependencyCacheRemoval(input);
+}
+
+// src/cleanup-types.ts
+var DEFAULT_NODE_MODULES_AGE_MS = 6 * 60 * 60 * 1e3;
+var DEFAULT_WORKTREES_AGE_MS = 7 * 24 * 60 * 60 * 1e3;
+var DEFAULT_TERMINAL_WORKTREES_AGE_MS = DEFAULT_NODE_MODULES_AGE_MS;
+var DEFAULT_RUN_DIRECTORIES_AGE_MS = 60 * 60 * 1e3;
+var DEFAULT_MAX_ACTIONS_PER_SWEEP = 120;
+var MAX_PRESERVED_LIVE_PATH_SAMPLES = 24;
+
+// src/cleanup-evidence.ts
+var LIVE_SKIP_REASONS = /* @__PURE__ */ new Set([
+  "active_worker",
+  "run_still_active",
+  "completion_blocked",
+  "landing_blocked"
+]);
+function collectPreservedLivePaths(actions, skips) {
+  const out = [];
+  const seen = /* @__PURE__ */ new Set();
+  const push = (path24, reason, detail) => {
+    const key = `${path24}\0${reason}`;
+    if (seen.has(key) || out.length >= MAX_PRESERVED_LIVE_PATH_SAMPLES) return;
+    seen.add(key);
+    out.push({ path: path24, reason, ...detail ? { detail } : {} });
+  };
+  for (const skip of skips) {
+    if (!LIVE_SKIP_REASONS.has(skip.reason)) continue;
+    push(skip.path, skip.reason, skip.detail);
+  }
+  for (const action of actions) {
+    if (!action.skipped || !action.skipReason) continue;
+    if (!LIVE_SKIP_REASONS.has(action.skipReason)) continue;
+    push(action.path, action.skipReason);
+  }
+  return out;
+}
+
+// src/cleanup-run-directory.ts
+import { existsSync as existsSync11, readdirSync as readdirSync6, statSync as statSync5 } from "node:fs";
+import path12 from "node:path";
+
+// src/cleanup-active-worktrees.ts
+import { existsSync as existsSync10, readdirSync as readdirSync5, statSync as statSync4 } from "node:fs";
+import path11 from "node:path";
+
+// src/run-metadata-retention.ts
+import { existsSync as existsSync9, readdirSync as readdirSync4, statSync as statSync3 } from "node:fs";
+import path10 from "node:path";
+
+// src/worker-metadata-paths.ts
+import path9 from "node:path";
+var NESTED_RUNS = `${path9.sep}runs${path9.sep}runs${path9.sep}`;
+function workerArtifactPaths(workerDir) {
+  return {
+    workerJsonPath: path9.join(workerDir, "worker.json"),
+    stdoutPath: path9.join(workerDir, "stdout.jsonl"),
+    stderrPath: path9.join(workerDir, "stderr.log"),
+    heartbeatPath: path9.join(workerDir, "heartbeat.jsonl"),
+    lastStatusPath: path9.join(workerDir, "last-status.json")
+  };
+}
+
+// src/run-metadata-retention.ts
+var RUN_METADATA_ACTIVE_SIGNAL_MS = 15 * 60 * 1e3;
+function isHarnessRunMetadataPath(targetPath, harnessRoot) {
+  const resolved = path10.resolve(targetPath);
+  const runsDir = path10.resolve(harnessRunsDir(harnessRoot));
+  const rel = path10.relative(runsDir, resolved);
+  return rel !== ".." && !rel.startsWith("..") && !path10.isAbsolute(rel);
+}
+function listRunDirIds(runsDir) {
+  if (!existsSync9(runsDir)) return [];
+  try {
+    return readdirSync4(runsDir, { withFileTypes: true }).filter((entry) => entry.isDirectory() && entry.name !== "runs").map((entry) => entry.name);
+  } catch {
+    return [];
+  }
+}
+function listWorkerNamesOnDisk(runDir2) {
+  const workersDir = path10.join(runDir2, "workers");
+  if (!existsSync9(workersDir)) return [];
+  try {
+    return readdirSync4(workersDir, { withFileTypes: true }).filter((entry) => entry.isDirectory()).map((entry) => entry.name);
+  } catch {
+    return [];
+  }
+}
+function pathRecentlyTouched(target, now, windowMs) {
+  if (!existsSync9(target)) return false;
+  try {
+    const age = now - statSync3(target).mtimeMs;
+    return Number.isFinite(age) && age >= 0 && age < windowMs;
+  } catch {
+    return false;
+  }
+}
+function workerDirHasActiveRetentionSignals(workerDir, now = Date.now(), windowMs = RUN_METADATA_ACTIVE_SIGNAL_MS) {
+  if (!existsSync9(workerDir)) return false;
+  const artifacts = workerArtifactPaths(workerDir);
+  const worker = readJson(
+    artifacts.workerJsonPath,
+    void 0
+  );
+  if (worker?.status === "running" && isPidAlive(worker.pid)) return true;
+  const heartbeat = parseHeartbeat(artifacts.heartbeatPath);
+  if (heartbeat.lastHeartbeatAt) {
+    const age = now - Date.parse(heartbeat.lastHeartbeatAt);
+    if (Number.isFinite(age) && age >= 0 && age < windowMs) return true;
+  }
+  if (pathRecentlyTouched(artifacts.stdoutPath, now, windowMs)) return true;
+  if (pathRecentlyTouched(artifacts.heartbeatPath, now, windowMs)) return true;
+  return false;
+}
+function runDirHasActiveRetentionSignals(runDir2, now = Date.now(), windowMs = RUN_METADATA_ACTIVE_SIGNAL_MS) {
+  for (const name of listWorkerNamesOnDisk(runDir2)) {
+    if (workerDirHasActiveRetentionSignals(path10.join(runDir2, "workers", name), now, windowMs)) {
+      return true;
+    }
+  }
+  return false;
+}
+function collectFilesystemLiveRunKeys(harnessRoot, now = Date.now()) {
+  const keys = /* @__PURE__ */ new Set();
+  const runsDir = harnessRunsDir(harnessRoot);
+  for (const runId of listRunDirIds(runsDir)) {
+    const runDir2 = path10.join(runsDir, runId);
+    if (runDirHasActiveRetentionSignals(runDir2, now)) {
+      keys.add(`${harnessRoot}\0${runId}`);
+    }
+  }
+  return keys;
+}
+
+// src/cleanup-active-worktrees.ts
+function workerHasRecentHarnessActivity(worker, now) {
+  const paths = [worker.heartbeatPath, worker.stdoutPath, worker.stderrPath];
+  for (const target of paths) {
+    if (!existsSync10(target)) continue;
+    try {
+      const age = now - statSync4(target).mtimeMs;
+      if (Number.isFinite(age) && age >= 0 && age < RUN_METADATA_ACTIVE_SIGNAL_MS) return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function isActiveHarnessWorker2(worker, now) {
+  if (isPidAlive(worker.pid)) return true;
+  if (worker.status === "running" && workerHasRecentHarnessActivity(worker, now)) return true;
+  return false;
+}
+function collectActiveWorktreeGuards(harnessRoots, now = Date.now()) {
+  const activeWorktreePaths = /* @__PURE__ */ new Set();
+  const liveRunKeys = /* @__PURE__ */ new Set();
+  for (const harnessRoot of harnessRoots) {
+    for (const run of listRunRecordsForHarnessRoot(harnessRoot)) {
+      let runHasLive = false;
+      for (const name of Object.keys(run.workers || {})) {
+        const worker = readJson(
+          path11.join(runDirectoryAt(harnessRoot, run.id), "workers", safeSlug(name), "worker.json"),
+          void 0
+        );
+        if (!worker?.worktreePath) continue;
+        const worktreePath = path11.resolve(worker.worktreePath);
+        if (!isActiveHarnessWorker2(worker, now)) continue;
+        runHasLive = true;
+        activeWorktreePaths.add(worktreePath);
+      }
+      if (runHasLive) liveRunKeys.add(`${harnessRoot}\0${run.id}`);
+    }
+    for (const key of collectFilesystemLiveRunKeys(harnessRoot)) {
+      liveRunKeys.add(key);
+    }
+  }
+  return { activeWorktreePaths, liveRunKeys };
+}
+function isWorktreeOnLiveRun(worktreePath, harnessRoot, runId, liveRunKeys) {
+  if (!runId) return false;
+  return liveRunKeys.has(`${harnessRoot}\0${runId}`);
+}
+
+// src/cleanup-run-directory.ts
+function pathAgeMs(target, now) {
+  try {
+    const mtime = statSync5(target).mtimeMs;
+    return Math.max(0, now - mtime);
+  } catch {
+    return 0;
+  }
+}
+function loadRunStatus(harnessRoot, runId) {
+  const runPath = path12.join(harnessRoot, "runs", runId, "run.json");
+  if (!existsSync11(runPath)) return null;
+  return readJson(runPath, null);
+}
+function runDirectoryIsEmpty(runPath) {
+  try {
+    const entries = readdirSync6(runPath);
+    return entries.length === 0;
+  } catch {
+    return false;
+  }
+}
+function skipRunDirectoryRemoval(input) {
+  const { harnessRoot, runId, runPath, ageMs, runDirectoriesAgeMs, activeGuards } = input;
+  if (isWorktreeOnLiveRun(runPath, harnessRoot, runId, activeGuards.liveRunKeys)) {
+    return "run_still_active";
+  }
+  if (!runDirectoryIsEmpty(runPath)) return "run_still_active";
+  const run = loadRunStatus(harnessRoot, runId);
+  if (run && !TERMINAL_RUN_STATUSES.has(run.status)) {
+    if (!deriveTerminalRunStatus(run)) return "run_still_active";
+  }
+  if (runDirectoriesAgeMs > 0 && ageMs < runDirectoriesAgeMs) return "below_age_threshold";
+  return null;
+}
+function scanStaleRunDirectoryCandidates(opts) {
+  if (!existsSync11(opts.worktreesDir)) return [];
+  const candidates = [];
+  let entries;
+  try {
+    entries = readdirSync6(opts.worktreesDir, { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  for (const runEntry of entries) {
+    if (!runEntry.isDirectory()) continue;
+    const runId = runEntry.name;
+    if (opts.runIdFilter && runId !== opts.runIdFilter) continue;
+    const runPath = path12.join(opts.worktreesDir, runId);
+    if (!runDirectoryIsEmpty(runPath)) continue;
+    candidates.push({
+      kind: "remove_run_directory",
+      path: runPath,
+      bytes: null,
+      harnessRoot: opts.harnessRoot,
+      runId,
+      ageMs: pathAgeMs(runPath, opts.now)
+    });
+  }
+  return candidates;
+}
+
+// src/cleanup-execute.ts
+import { existsSync as existsSync14, rmSync as rmSync2 } from "node:fs";
+
+// src/cleanup-dir-size.ts
+import { execFileSync } from "node:child_process";
+import { existsSync as existsSync12, readdirSync as readdirSync7, statSync as statSync6 } from "node:fs";
+import path13 from "node:path";
+var DEFAULT_DU_TIMEOUT_MS = 2500;
+function directorySizeBytesDu(root, timeoutMs = DEFAULT_DU_TIMEOUT_MS) {
+  if (!existsSync12(root)) return 0;
+  try {
+    const out = execFileSync("du", ["-sb", root], {
+      encoding: "utf8",
+      timeout: timeoutMs,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+    const first = out.trim().split(/\s+/)[0];
+    const bytes = Number(first);
+    return Number.isFinite(bytes) && bytes >= 0 ? bytes : null;
+  } catch {
+    return null;
+  }
+}
+function directorySizeBytes(root, maxEntries = 5e4) {
+  if (!existsSync12(root)) return 0;
+  const duBytes = directorySizeBytesDu(root);
+  if (duBytes !== null) return duBytes;
+  let total = 0;
+  let seen = 0;
+  const stack = [root];
+  while (stack.length > 0) {
+    const current = stack.pop();
+    let entries;
+    try {
+      entries = readdirSync7(current);
+    } catch {
+      continue;
+    }
+    for (const name of entries) {
+      if (seen++ > maxEntries) return null;
+      const full = path13.join(current, name);
+      let st;
+      try {
+        st = statSync6(full);
+      } catch {
+        continue;
+      }
+      if (st.isDirectory()) stack.push(full);
+      else total += st.size;
+    }
+  }
+  return total;
+}
+
+// src/cleanup-remove-path.ts
+import { existsSync as existsSync13, rmSync } from "node:fs";
+
+// src/cleanup-path-ownership.ts
+import { lstatSync, readdirSync as readdirSync8 } from "node:fs";
+function readPathOwnership(targetPath) {
+  try {
+    const st = lstatSync(targetPath);
+    const effectiveUid = typeof process.getuid === "function" ? process.getuid() : null;
+    const effectiveGid = typeof process.getgid === "function" ? process.getgid() : null;
+    const foreign = effectiveUid !== null && (st.uid !== effectiveUid || effectiveGid !== null && st.gid !== effectiveGid);
+    return { uid: st.uid, gid: st.gid, foreign };
+  } catch {
+    return null;
+  }
+}
+function pathHasForeignOwnedEntry(targetPath, maxEntries = 32) {
+  const root = readPathOwnership(targetPath);
+  if (!root) return false;
+  if (root.foreign) return true;
+  try {
+    const names = readdirSync8(targetPath);
+    let checked = 0;
+    for (const name of names) {
+      if (checked >= maxEntries) break;
+      const child = `${targetPath.replace(/\/$/, "")}/${name}`;
+      const info = readPathOwnership(child);
+      checked += 1;
+      if (info?.foreign) return true;
+    }
+  } catch {
+  }
+  return false;
+}
+
+// src/cleanup-privileged-remove.ts
+import { spawnSync as spawnSync2 } from "node:child_process";
+import path15 from "node:path";
+
+// src/cleanup-harness-path-validate.ts
+import path14 from "node:path";
+function isHarnessDependencyCachePath(targetPath, harnessRoot, worktreesDir, cacheDirName) {
+  const resolved = path14.resolve(targetPath);
+  const suffix = `${path14.sep}${cacheDirName}`;
+  const cachePath = resolved.endsWith(suffix) ? resolved : null;
+  if (!cachePath) return "path_outside_harness";
+  const rel = path14.relative(worktreesDir, cachePath);
+  if (rel.startsWith("..") || path14.isAbsolute(rel)) return "path_outside_harness";
+  const parts = rel.split(path14.sep);
+  if (parts.length < 3 || parts[parts.length - 1] !== cacheDirName) return "path_outside_harness";
+  if (!resolved.startsWith(path14.resolve(harnessRoot))) return "path_outside_harness";
+  return null;
+}
+function isHarnessNodeModulesPath(targetPath, harnessRoot, worktreesDir) {
+  return isHarnessDependencyCachePath(targetPath, harnessRoot, worktreesDir, "node_modules");
+}
+function isHarnessNextCachePath(targetPath, harnessRoot, worktreesDir) {
+  return isHarnessDependencyCachePath(targetPath, harnessRoot, worktreesDir, ".next");
+}
+function isHarnessBuildCachePath(targetPath, harnessRoot, worktreesDir) {
+  const resolved = path14.resolve(targetPath);
+  const relToWt = path14.relative(worktreesDir, resolved);
+  if (relToWt.startsWith("..") || path14.isAbsolute(relToWt)) return "path_outside_harness";
+  const parts = relToWt.split(path14.sep);
+  if (parts.length < 3) return "path_outside_harness";
+  if (!resolved.startsWith(path14.resolve(harnessRoot))) return "path_outside_harness";
+  return null;
+}
+function isHarnessGeneratedCachePath(targetPath, harnessRoot, worktreesDir) {
+  const resolved = path14.resolve(targetPath);
+  return isHarnessNodeModulesPath(resolved, harnessRoot, worktreesDir) === null || isHarnessNextCachePath(resolved, harnessRoot, worktreesDir) === null || isHarnessBuildCachePath(resolved, harnessRoot, worktreesDir) === null;
+}
+
+// src/cleanup-privileged-remove.ts
+function resolvePrivilegedCleanupMode() {
+  const raw = (process.env.KYNVER_CLEANUP_PRIVILEGED ?? "auto").trim().toLowerCase();
+  if (raw === "0" || raw === "false" || raw === "off" || raw === "no") return "off";
+  if (raw === "1" || raw === "true" || raw === "force" || raw === "yes") return "force";
+  return "auto";
+}
+function runSudoNonInteractive(argv) {
+  const res = spawnSync2("sudo", ["-n", ...argv], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  return {
+    ok: res.status === 0,
+    stderr: `${res.stderr ?? ""}${res.stdout ?? ""}`.trim()
+  };
+}
+function tryPrivilegedReclaimHarnessCache(targetPath, harnessRoot, worktreesDir) {
+  if (!isHarnessGeneratedCachePath(targetPath, harnessRoot, worktreesDir)) {
+    return { ok: false, error: "path is not an allowed harness generated cache" };
+  }
+  const effectiveUid = typeof process.getuid === "function" ? process.getuid() : null;
+  const effectiveGid = typeof process.getgid === "function" ? process.getgid() : null;
+  if (effectiveUid === null || effectiveGid === null) {
+    return { ok: false, error: "privileged reclaim requires POSIX uid/gid" };
+  }
+  const chown = runSudoNonInteractive([
+    "chown",
+    "-R",
+    `${effectiveUid}:${effectiveGid}`,
+    path15.resolve(targetPath)
+  ]);
+  if (chown.ok) {
+    return { ok: true, method: "chown_then_rm" };
+  }
+  const rm = runSudoNonInteractive(["rm", "-rf", path15.resolve(targetPath)]);
+  if (rm.ok) {
+    return { ok: true, method: "sudo_rm" };
+  }
+  const detail = chown.stderr || rm.stderr || "sudo -n failed (password required or not permitted)";
+  return {
+    ok: false,
+    error: detail
+  };
+}
+var HARNESS_ROOT_OWNED_CACHE_RUNBOOK = "Root-owned harness caches require operator reclaim: configure passwordless sudo for chown/rm under ~/.kynver/harness/worktrees, or run `node scripts/reclaim-harness-root-owned-cache.mjs --execute` as the harness owner with sudo available. See docs/runbooks/harness-root-owned-cache-reclaim.md.";
+
+// src/cleanup-remove-path.ts
+function permissionFailure(error) {
+  const code = error?.code;
+  return code === "EACCES" || code === "EPERM";
+}
+function removeHarnessGeneratedPath(candidate, execute, deps = {}) {
+  if (!existsSync13(candidate.path)) {
+    return { executed: false, skipped: true, skipReason: "missing_worktree" };
+  }
+  if (!execute) {
+    return { executed: false, skipped: true, skipReason: "dry_run" };
+  }
+  const harnessRoot = candidate.harnessRoot;
+  const worktreesDir = harnessRoot ? harnessWorktreesDir(harnessRoot) : null;
+  const bytesBefore = candidate.bytes ?? directorySizeBytes(candidate.path);
+  const bytesReported = bytesBefore ?? void 0;
+  const removePath = deps.removePath ?? rmSync;
+  const hasForeignOwnedEntry = deps.hasForeignOwnedEntry ?? pathHasForeignOwnedEntry;
+  try {
+    removePath(candidate.path, { recursive: true, force: true });
+    return { executed: true, skipped: false, bytes: bytesReported };
+  } catch (error) {
+    if (!permissionFailure(error) || !harnessRoot || !worktreesDir) {
+      return {
+        executed: false,
+        skipped: true,
+        skipReason: "remove_failed",
+        error: error.message
+      };
+    }
+    const foreign = hasForeignOwnedEntry(candidate.path);
+    const mode = resolvePrivilegedCleanupMode();
+    const shouldTryPrivileged = mode === "force" || mode === "auto" && foreign;
+    if (!shouldTryPrivileged) {
+      return foreign ? {
+        executed: false,
+        skipped: true,
+        skipReason: "foreign_owner",
+        error: `${error.message}; ${HARNESS_ROOT_OWNED_CACHE_RUNBOOK}`
+      } : {
+        executed: false,
+        skipped: true,
+        skipReason: "remove_failed",
+        error: error.message
+      };
+    }
+    const reclaim = tryPrivilegedReclaimHarnessCache(candidate.path, harnessRoot, worktreesDir);
+    if (reclaim.ok && reclaim.method === "sudo_rm") {
+      return {
+        executed: true,
+        skipped: false,
+        bytes: bytesReported,
+        privilegedReclaim: true
+      };
+    }
+    if (reclaim.ok) {
+      try {
+        removePath(candidate.path, { recursive: true, force: true });
+        return {
+          executed: true,
+          skipped: false,
+          bytes: bytesReported,
+          privilegedReclaim: true
+        };
+      } catch (retryError) {
+        return {
+          executed: false,
+          skipped: true,
+          skipReason: "foreign_owner",
+          error: `${retryError.message}; privileged chown succeeded but rm still failed`
+        };
+      }
+    }
+    return {
+      executed: false,
+      skipped: true,
+      skipReason: "foreign_owner",
+      error: `${error.message}; privileged reclaim failed: ${reclaim.error}; ${HARNESS_ROOT_OWNED_CACHE_RUNBOOK}`
+    };
+  }
+}
+
+// src/cleanup-execute.ts
+function skipRunMetadataRemoval(candidate) {
+  const harnessRoot = candidate.harnessRoot;
+  if (!harnessRoot || !isHarnessRunMetadataPath(candidate.path, harnessRoot)) return null;
+  return {
+    ...candidate,
+    executed: false,
+    skipped: true,
+    skipReason: "run_metadata_protected"
+  };
+}
+function removeDependencyCache(candidate, execute) {
+  const metadataSkip = skipRunMetadataRemoval(candidate);
+  if (metadataSkip) return metadataSkip;
+  const outcome = removeHarnessGeneratedPath(candidate, execute);
+  return {
+    ...candidate,
+    bytes: outcome.bytes ?? candidate.bytes,
+    executed: outcome.executed,
+    skipped: outcome.skipped,
+    skipReason: outcome.skipReason,
+    error: outcome.error
+  };
+}
+function removeNodeModules(candidate, execute) {
+  return removeDependencyCache(candidate, execute);
+}
+function removeNextCache(candidate, execute) {
+  return removeDependencyCache(candidate, execute);
+}
+function removeBuildCache(candidate, execute) {
+  return removeDependencyCache(candidate, execute);
+}
+function removeRunDirectory(candidate, execute) {
+  const metadataSkip = skipRunMetadataRemoval(candidate);
+  if (metadataSkip) return metadataSkip;
+  if (!existsSync14(candidate.path)) {
+    return {
+      ...candidate,
+      executed: false,
+      skipped: true,
+      skipReason: "missing_worktree"
+    };
+  }
+  if (!execute) {
+    return { ...candidate, executed: false, skipped: true, skipReason: "dry_run" };
+  }
+  try {
+    const bytesBefore = candidate.bytes ?? directorySizeBytes(candidate.path);
+    rmSync2(candidate.path, { recursive: true, force: true });
+    return {
+      ...candidate,
+      bytes: bytesBefore,
+      executed: true,
+      skipped: false
+    };
+  } catch (error) {
+    return {
+      ...candidate,
+      executed: false,
+      skipped: true,
+      skipReason: "remove_failed",
+      error: error.message
+    };
+  }
+}
+function removeWorktree(candidate, execute) {
+  const metadataSkip = skipRunMetadataRemoval(candidate);
+  if (metadataSkip) return metadataSkip;
+  if (!existsSync14(candidate.path)) {
+    return {
+      ...candidate,
+      executed: false,
+      skipped: true,
+      skipReason: "missing_worktree"
+    };
+  }
+  if (!execute) {
+    return { ...candidate, executed: false, skipped: true, skipReason: "dry_run" };
+  }
+  const repo = candidate.repo;
+  try {
+    const bytesBefore = candidate.bytes ?? directorySizeBytes(candidate.path);
+    if (repo) {
+      git(repo, ["worktree", "remove", "--force", candidate.path], { allowFailure: true });
+    }
+    if (existsSync14(candidate.path)) {
+      rmSync2(candidate.path, { recursive: true, force: true });
+    }
+    return {
+      ...candidate,
+      bytes: bytesBefore,
+      executed: true,
+      skipped: false
+    };
+  } catch (error) {
+    return {
+      ...candidate,
+      executed: false,
+      skipped: true,
+      skipReason: "remove_failed",
+      error: error.message
+    };
+  }
+}
+
+// src/cleanup-scan.ts
+import { existsSync as existsSync15, readdirSync as readdirSync9, statSync as statSync7 } from "node:fs";
+import path16 from "node:path";
+function pathAgeMs2(target, now) {
+  try {
+    const mtime = statSync7(target).mtimeMs;
+    return Math.max(0, now - mtime);
+  } catch {
+    return 0;
+  }
+}
+function isPathInside(child, parent) {
+  const rel = path16.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path16.isAbsolute(rel);
+}
+function collectBuildCacheForWorktree(worktreePath, opts, seen, meta) {
+  const out = [];
+  for (const rel of HARNESS_BUILD_CACHE_RELATIVE_PATHS) {
+    if (rel === ".next") continue;
+    const target = path16.join(worktreePath, rel);
+    if (!existsSync15(target)) continue;
+    const resolved = path16.resolve(target);
+    if (seen.has(resolved)) continue;
+    if (!isPathInside(resolved, opts.harnessRoot)) continue;
+    seen.add(resolved);
+    out.push({
+      kind: "remove_build_cache",
+      path: resolved,
+      bytes: null,
+      runId: meta.runId,
+      worker: meta.worker,
+      repo: meta.repo,
+      ageMs: pathAgeMs2(resolved, opts.now)
+    });
+  }
+  return out;
+}
+function scanBuildCacheCandidates(opts) {
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of opts.index.values()) {
+    if (opts.runIdFilter && entry.runId !== opts.runIdFilter) continue;
+    candidates.push(
+      ...collectBuildCacheForWorktree(entry.worktreePath, opts, seen, {
+        runId: entry.runId,
+        worker: entry.workerName,
+        repo: entry.run.repo
+      })
+    );
+  }
+  if (!opts.includeOrphans || !existsSync15(opts.worktreesDir)) return candidates;
+  for (const runEntry of readdirSync9(opts.worktreesDir, { withFileTypes: true })) {
+    if (!runEntry.isDirectory()) continue;
+    const runPath = path16.join(opts.worktreesDir, runEntry.name);
+    for (const workerEntry of readdirSync9(runPath, { withFileTypes: true })) {
+      if (!workerEntry.isDirectory()) continue;
+      const worktreePath = path16.join(runPath, workerEntry.name);
+      candidates.push(
+        ...collectBuildCacheForWorktree(worktreePath, opts, seen, {
+          runId: runEntry.name,
+          worker: workerEntry.name
+        })
+      );
+    }
+  }
+  return candidates;
+}
+function scanWorktreeCandidates(opts) {
+  const indexedEnabled = opts.worktreesAgeMs > 0 || opts.includeOrphans;
+  const orphanEnabled = opts.includeOrphans;
+  if (!indexedEnabled && !orphanEnabled) return [];
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  if (indexedEnabled) {
+    for (const entry of opts.index.values()) {
+      if (opts.runIdFilter && entry.runId !== opts.runIdFilter) continue;
+      const resolved = entry.worktreePath;
+      if (!existsSync15(resolved)) continue;
+      if (seen.has(resolved)) continue;
+      seen.add(resolved);
+      candidates.push({
+        kind: "remove_worktree",
+        path: resolved,
+        bytes: null,
+        runId: entry.runId,
+        worker: entry.workerName,
+        repo: entry.run.repo,
+        ageMs: pathAgeMs2(resolved, opts.now)
+      });
+    }
+  }
+  if (!orphanEnabled || !existsSync15(opts.worktreesDir)) return candidates;
+  const indexedPaths = /* @__PURE__ */ new Set();
+  for (const entry of opts.index.values()) {
+    indexedPaths.add(path16.resolve(entry.worktreePath));
+  }
+  for (const runEntry of readdirSync9(opts.worktreesDir, { withFileTypes: true })) {
+    if (!runEntry.isDirectory()) continue;
+    if (opts.runIdFilter && runEntry.name !== opts.runIdFilter) continue;
+    const runPath = path16.join(opts.worktreesDir, runEntry.name);
+    let workerEntries;
+    try {
+      workerEntries = readdirSync9(runPath, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const workerEntry of workerEntries) {
+      if (!workerEntry.isDirectory()) continue;
+      const worktreePath = path16.resolve(path16.join(runPath, workerEntry.name));
+      if (seen.has(worktreePath)) continue;
+      if (indexedPaths.has(worktreePath)) continue;
+      if (!isPathInside(worktreePath, opts.harnessRoot)) continue;
+      seen.add(worktreePath);
+      candidates.push({
+        kind: "remove_worktree",
+        path: worktreePath,
+        bytes: null,
+        runId: runEntry.name,
+        worker: workerEntry.name,
+        ageMs: pathAgeMs2(worktreePath, opts.now)
+      });
+    }
+  }
+  return candidates;
+}
+
+// src/cleanup-dependency-scan.ts
+import { existsSync as existsSync16, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
+import path17 from "node:path";
+var DEPENDENCY_CACHE_DIRS = [
+  { dirName: "node_modules", kind: "remove_node_modules" },
+  { dirName: ".next", kind: "remove_next_cache" }
+];
+function pathAgeMs3(target, now) {
+  try {
+    const mtime = statSync8(target).mtimeMs;
+    return Math.max(0, now - mtime);
+  } catch {
+    return 0;
+  }
+}
+function isPathInside2(child, parent) {
+  const rel = path17.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path17.isAbsolute(rel);
+}
+function pushCandidate(candidates, seen, opts, targetPath, kind, meta) {
+  if (!existsSync16(targetPath)) return;
+  const resolved = path17.resolve(targetPath);
+  if (seen.has(resolved)) return;
+  if (!isPathInside2(resolved, opts.harnessRoot)) return;
+  seen.add(resolved);
+  candidates.push({
+    kind,
+    path: resolved,
+    bytes: null,
+    harnessRoot: opts.harnessRoot,
+    runId: meta.runId,
+    worker: meta.worker,
+    repo: meta.repo,
+    ageMs: pathAgeMs3(resolved, opts.now)
+  });
+}
+function scanWorktreeDependencyCaches(candidates, seen, opts, worktreePath, meta) {
+  for (const entry of DEPENDENCY_CACHE_DIRS) {
+    pushCandidate(candidates, seen, opts, path17.join(worktreePath, entry.dirName), entry.kind, meta);
+  }
+}
+function scanDependencyCacheCandidates(opts) {
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const entry of opts.index.values()) {
+    if (opts.runIdFilter && entry.runId !== opts.runIdFilter) continue;
+    scanWorktreeDependencyCaches(candidates, seen, opts, entry.worktreePath, {
+      runId: entry.runId,
+      worker: entry.workerName,
+      repo: entry.run.repo
+    });
+  }
+  if (!opts.includeOrphans || !existsSync16(opts.worktreesDir)) return candidates;
+  for (const runEntry of readdirSync10(opts.worktreesDir, { withFileTypes: true })) {
+    if (!runEntry.isDirectory()) continue;
+    if (opts.runIdFilter && runEntry.name !== opts.runIdFilter) continue;
+    const runPath = path17.join(opts.worktreesDir, runEntry.name);
+    let workerEntries;
+    try {
+      workerEntries = readdirSync10(runPath, { withFileTypes: true });
+    } catch {
+      continue;
+    }
+    for (const workerEntry of workerEntries) {
+      if (!workerEntry.isDirectory()) continue;
+      const worktreePath = path17.join(runPath, workerEntry.name);
+      scanWorktreeDependencyCaches(candidates, seen, opts, worktreePath, {
+        runId: runEntry.name,
+        worker: workerEntry.name
+      });
+    }
+  }
+  return candidates;
+}
+
+// src/cleanup-duplicate-worktrees.ts
+import { existsSync as existsSync17, statSync as statSync9 } from "node:fs";
+import path18 from "node:path";
+function pathAgeMs4(target, now) {
+  try {
+    const mtime = statSync9(target).mtimeMs;
+    return Math.max(0, now - mtime);
+  } catch {
+    return 0;
+  }
+}
+function parseWorktreePorcelain(output) {
+  const records = [];
+  let current = null;
+  for (const line of output.split("\n")) {
+    if (!line.trim()) continue;
+    const [key, ...rest] = line.split(" ");
+    const value = rest.join(" ");
+    if (key === "worktree") {
+      if (current) records.push(current);
+      current = { path: value };
+      continue;
+    }
+    if (!current) continue;
+    if (key === "branch") current.branch = value;
+    if (key === "HEAD") current.head = value;
+    if (key === "bare") current.bare = true;
+  }
+  if (current) records.push(current);
+  return records;
+}
+function isUnderWorktreesDir(worktreePath, worktreesDir) {
+  const rel = path18.relative(path18.resolve(worktreesDir), path18.resolve(worktreePath));
+  return rel !== "" && !rel.startsWith("..") && !path18.isAbsolute(rel);
+}
+function isCleanWorktree(worktreePath, repoRoot) {
+  try {
+    const porcelain = git(repoRoot, ["-C", worktreePath, "status", "--porcelain"], {
+      allowFailure: true
+    });
+    return !String(porcelain || "").trim();
+  } catch {
+    return false;
+  }
+}
+function scanDuplicateWorktreeCandidates(opts) {
+  if (!opts.includeOrphans || !existsSync17(opts.worktreesDir)) return [];
+  const repos = /* @__PURE__ */ new Set();
+  for (const entry of opts.index.values()) {
+    if (entry.run.repo) repos.add(path18.resolve(entry.run.repo));
+  }
+  const indexedPaths = /* @__PURE__ */ new Set();
+  for (const entry of opts.index.values()) {
+    indexedPaths.add(path18.resolve(entry.worktreePath));
+  }
+  const candidates = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const repoRoot of repos) {
+    let porcelain;
+    try {
+      porcelain = git(repoRoot, ["worktree", "list", "--porcelain"], { allowFailure: true });
+    } catch {
+      continue;
+    }
+    const worktrees = parseWorktreePorcelain(porcelain);
+    for (const wt of worktrees) {
+      const resolved = path18.resolve(wt.path);
+      if (resolved === path18.resolve(repoRoot)) continue;
+      if (!isUnderWorktreesDir(resolved, opts.worktreesDir)) continue;
+      if (indexedPaths.has(resolved)) continue;
+      if (seen.has(resolved)) continue;
+      if (!existsSync17(resolved)) continue;
+      if (!isCleanWorktree(resolved, repoRoot)) continue;
+      const rel = path18.relative(opts.worktreesDir, resolved);
+      const parts = rel.split(path18.sep);
+      const runId = parts[0];
+      const worker = parts[1] ?? "unknown";
+      seen.add(resolved);
+      candidates.push({
+        kind: "remove_worktree",
+        path: resolved,
+        bytes: null,
+        runId,
+        worker,
+        repo: repoRoot,
+        ageMs: pathAgeMs4(resolved, opts.now)
+      });
+    }
+  }
+  return candidates;
+}
+
+// src/cleanup-worktree-index.ts
+import path19 from "node:path";
+function buildWorktreeIndexAt(harnessRoot) {
+  const index = /* @__PURE__ */ new Map();
+  for (const run of listRunRecordsForHarnessRoot(harnessRoot)) {
+    for (const name of Object.keys(run.workers || {})) {
+      const workerPath = path19.join(
+        runDirectoryAt(harnessRoot, run.id),
+        "workers",
+        safeSlug(name),
+        "worker.json"
+      );
+      const worker = readJson(workerPath, void 0);
+      if (!worker?.worktreePath) continue;
+      index.set(path19.resolve(worker.worktreePath), {
+        harnessRoot,
+        worktreePath: path19.resolve(worker.worktreePath),
+        runId: run.id,
+        workerName: name,
+        run,
+        worker
+      });
+    }
+  }
+  return index;
+}
+
+// src/cleanup-retention-config.ts
+function envFlag(name) {
+  const v = process.env[name];
+  return v === "1" || v === "true" || v === "yes";
+}
+function envMs(name, fallback) {
+  const raw = process.env[name];
+  if (!raw) return fallback;
+  const n = Number(raw);
+  return Number.isFinite(n) && n >= 0 ? n : fallback;
+}
+function resolveHarnessRetention(options = {}) {
+  const execute = options.execute === true || options.execute !== false && envFlag("KYNVER_CLEANUP_EXECUTE");
+  const finalizeStaleRuns2 = options.finalizeStaleRuns !== false && !envFlag("KYNVER_CLEANUP_SKIP_FINALIZE");
+  const nodeModulesAgeMs = options.nodeModulesAgeMs ?? envMs("KYNVER_CLEANUP_NODE_MODULES_AGE_MS", DEFAULT_NODE_MODULES_AGE_MS);
+  const worktreesAgeMs = options.worktreesAgeMs ?? envMs("KYNVER_CLEANUP_WORKTREES_AGE_MS", 0);
+  const terminalWorktreesAgeMs = options.terminalWorktreesAgeMs ?? envMs("KYNVER_CLEANUP_TERMINAL_WORKTREES_AGE_MS", DEFAULT_TERMINAL_WORKTREES_AGE_MS);
+  const runDirectoriesAgeMs = options.runDirectoriesAgeMs ?? envMs("KYNVER_CLEANUP_RUN_DIRECTORIES_AGE_MS", DEFAULT_RUN_DIRECTORIES_AGE_MS);
+  const maxActionsPerSweep = options.maxActionsPerSweep ?? envMs("KYNVER_CLEANUP_MAX_ACTIONS_PER_SWEEP", DEFAULT_MAX_ACTIONS_PER_SWEEP);
+  const includeOrphans = options.includeOrphans === true || envFlag("KYNVER_CLEANUP_INCLUDE_ORPHANS");
+  const scopeAll = envFlag("KYNVER_CLEANUP_SCOPE_ALL") || process.env.KYNVER_CLEANUP_SCOPE === "all";
+  const runIdFilter = scopeAll ? options.runIdFilter : options.runIdFilter ?? (process.env.KYNVER_CLEANUP_RUN_ID || void 0);
+  const accountBytes = options.accountBytes !== false && !envFlag("KYNVER_CLEANUP_SKIP_BYTE_ACCOUNTING");
+  const storageCapEnv = envMs("KYNVER_CLEANUP_STORAGE_ENTRY_CAP", 2e3);
+  const storagePerRunEntryCap = options.storagePerRunEntryCap !== void 0 ? options.storagePerRunEntryCap : accountBytes ? storageCapEnv > 0 ? storageCapEnv : null : null;
+  const byteCapEnv = envMs("KYNVER_CLEANUP_BYTE_ENTRY_CAP", 2e3);
+  const byteAccountingEntryCap = options.byteAccountingEntryCap ?? (Number.isFinite(byteCapEnv) && byteCapEnv > 0 ? Math.floor(byteCapEnv) : 2e3);
+  return {
+    execute,
+    finalizeStaleRuns: finalizeStaleRuns2,
+    nodeModulesAgeMs,
+    worktreesAgeMs: worktreesAgeMs > 0 ? worktreesAgeMs : 0,
+    terminalWorktreesAgeMs: terminalWorktreesAgeMs >= 0 ? terminalWorktreesAgeMs : 0,
+    runDirectoriesAgeMs: runDirectoriesAgeMs >= 0 ? runDirectoriesAgeMs : 0,
+    maxActionsPerSweep: Number.isFinite(maxActionsPerSweep) && maxActionsPerSweep > 0 ? Math.floor(maxActionsPerSweep) : DEFAULT_MAX_ACTIONS_PER_SWEEP,
+    includeOrphans,
+    runIdFilter: runIdFilter ? String(runIdFilter) : void 0,
+    accountBytes,
+    storagePerRunEntryCap,
+    byteAccountingEntryCap
+  };
+}
+
+// src/cleanup-orphan-safety.ts
+import { existsSync as existsSync18, statSync as statSync10 } from "node:fs";
+import path20 from "node:path";
+var DEFAULT_HEARTBEAT_FRESH_MS = 30 * 60 * 1e3;
+function assessOrphanWorktreeSafety(input) {
+  const now = input.now ?? Date.now();
+  const heartbeatFreshMs = input.heartbeatFreshMs ?? DEFAULT_HEARTBEAT_FRESH_MS;
+  if (!existsSync18(input.worktreePath)) return null;
+  if (input.runId && input.workerName) {
+    const heartbeatPath = path20.join(
+      input.harnessRoot,
+      "runs",
+      input.runId,
+      "workers",
+      input.workerName,
+      "heartbeat.jsonl"
+    );
+    try {
+      const mtime = statSync10(heartbeatPath).mtimeMs;
+      if (now - mtime < heartbeatFreshMs) return "active_worker";
+    } catch {
+    }
+  }
+  const gitDir = path20.join(input.worktreePath, ".git");
+  if (!existsSync18(gitDir)) return null;
+  const porcelain = gitCapture(input.worktreePath, ["status", "--porcelain"]);
+  if (porcelain.status !== 0) return "pr_or_unmerged_commits";
+  const dirtyLines = porcelain.stdout.split("\n").map((line) => line.trim()).filter((line) => line.length > 0);
+  if (materialWorktreeChanges(dirtyLines).length > 0) return "dirty_worktree";
+  const upstreamAhead = gitCapture(input.worktreePath, [
+    "rev-list",
+    "--count",
+    "@{u}..HEAD"
+  ]);
+  if (upstreamAhead.status === 0) {
+    const count = Number(upstreamAhead.stdout.trim());
+    if (Number.isFinite(count) && count > 0) return "pr_or_unmerged_commits";
+  }
+  const mainAhead = gitCapture(input.worktreePath, [
+    "rev-list",
+    "--count",
+    "origin/main..HEAD"
+  ]);
+  if (mainAhead.status !== 0) {
+    if (upstreamAhead.status !== 0) return "pr_or_unmerged_commits";
+    return null;
+  }
+  const mainCount = Number(mainAhead.stdout.trim());
+  if (Number.isFinite(mainCount) && mainCount > 0) return "pr_or_unmerged_commits";
+  return null;
+}
+
+// src/harness-storage-snapshot.ts
+import { existsSync as existsSync19, readdirSync as readdirSync11, statSync as statSync11 } from "node:fs";
+import path21 from "node:path";
+function harnessStorageSnapshot(opts = {}) {
+  const harnessRoot = normalizeHarnessRoot(opts.harnessRoot ?? resolveHarnessRoot());
+  const worktreesDir = harnessWorktreesDir(harnessRoot);
+  const now = opts.now ?? Date.now();
+  const scannedAt = new Date(now).toISOString();
+  if (!existsSync19(worktreesDir)) {
+    return {
+      harnessRoot,
+      worktreesDir,
+      worktreesBytes: 0,
+      runCount: 0,
+      workerCount: 0,
+      oldestRunAt: null,
+      scannedAt
+    };
+  }
+  let totalBytes = 0;
+  let runCount = 0;
+  let workerCount = 0;
+  let oldestMs = null;
+  let entries;
+  try {
+    entries = readdirSync11(worktreesDir, { withFileTypes: true });
+  } catch {
+    return {
+      harnessRoot,
+      worktreesDir,
+      worktreesBytes: null,
+      runCount: 0,
+      workerCount: 0,
+      oldestRunAt: null,
+      scannedAt
+    };
+  }
+  for (const runEntry of entries) {
+    if (!runEntry.isDirectory()) continue;
+    runCount += 1;
+    const runPath = path21.join(worktreesDir, runEntry.name);
+    try {
+      const st = statSync11(runPath);
+      oldestMs = oldestMs === null ? st.mtimeMs : Math.min(oldestMs, st.mtimeMs);
+    } catch {
+    }
+    try {
+      for (const workerEntry of readdirSync11(runPath, { withFileTypes: true })) {
+        if (workerEntry.isDirectory()) workerCount += 1;
+      }
+    } catch {
+    }
+    if (totalBytes !== null && opts.perRunEntryCap !== null) {
+      const cap = opts.perRunEntryCap ?? 5e4;
+      if (cap <= 0) {
+        totalBytes = null;
+      } else {
+        const runBytes = directorySizeBytes(runPath, cap);
+        if (runBytes === null) totalBytes = null;
+        else totalBytes += runBytes;
+      }
+    }
+  }
+  return {
+    harnessRoot,
+    worktreesDir,
+    worktreesBytes: totalBytes,
+    runCount,
+    workerCount,
+    oldestRunAt: oldestMs === null ? null : new Date(oldestMs).toISOString(),
+    scannedAt
+  };
+}
+
+// src/cleanup-harness-roots.ts
+import { existsSync as existsSync20 } from "node:fs";
+import { homedir as homedir4 } from "node:os";
+import path22 from "node:path";
+var WELL_KNOWN_HARNESS_SCAN_ROOTS = [
+  "/var/tmp/kynver-harness",
+  path22.join(homedir4(), ".openclaw", "harness")
+];
+function addRoot(seen, roots, candidate) {
+  if (!candidate?.trim()) return;
+  const resolved = normalizeHarnessRoot(candidate.trim());
+  if (seen.has(resolved)) return;
+  seen.add(resolved);
+  roots.push(resolved);
+}
+function shouldScanWellKnownRoots(options) {
+  if (options.scanWellKnown != null) return options.scanWellKnown;
+  if (process.env.VITEST === "true") return false;
+  return process.env.KYNVER_CLEANUP_SCAN_WELL_KNOWN !== "0" && !["0", "false", "no"].includes((process.env.KYNVER_CLEANUP_SCAN_WELL_KNOWN ?? "").toLowerCase());
+}
+function resolveHarnessScanRoots(options = {}) {
+  const seen = /* @__PURE__ */ new Set();
+  const roots = [];
+  addRoot(seen, roots, options.harnessRoot ?? resolveHarnessRoot());
+  const extra = process.env.KYNVER_CLEANUP_EXTRA_ROOTS?.split(",").map((part) => part.trim()).filter(Boolean);
+  for (const candidate of extra ?? []) addRoot(seen, roots, candidate);
+  if (shouldScanWellKnownRoots(options)) {
+    for (const candidate of WELL_KNOWN_HARNESS_SCAN_ROOTS) {
+      const resolved = path22.resolve(candidate);
+      if (!seen.has(resolved) && existsSync20(resolved)) addRoot(seen, roots, resolved);
+    }
+  }
+  return roots;
+}
+
+// src/cleanup-disk-pressure.ts
+function envFlag2(name) {
+  const v = process.env[name];
+  return v === "1" || v === "true" || v === "yes";
+}
+function envNumber(name, fallback) {
+  const raw = process.env[name];
+  if (!raw) return fallback;
+  const n = Number(raw);
+  return Number.isFinite(n) ? n : fallback;
+}
+function observeCleanupDiskPressure(input = {}) {
+  const diskPath = input.diskPath?.trim() || process.env.KYNVER_DISK_GUARD_PATH?.trim() || "/";
+  const maxUsedPercent = envNumber("KYNVER_DISK_GUARD_MAX_USED_PERCENT", 75);
+  const diskGate = observeRunnerDiskGate({
+    ...input,
+    diskPath,
+    diskMaxUsedPercent: input.diskMaxUsedPercent ?? maxUsedPercent
+  });
+  const pressured = !diskGate.ok || diskGate.usedPercent >= maxUsedPercent;
+  return { diskGate, pressured, maxUsedPercent };
+}
+function applyDiskPressureToRetention(retention, pressure) {
+  if (!pressure.pressured) return retention;
+  const executeOnPressure = retention.execute || !envFlag2("KYNVER_CLEANUP_DRY_RUN_ON_PRESSURE");
+  return {
+    ...retention,
+    execute: executeOnPressure,
+    nodeModulesAgeMs: 0,
+    // Disk pressure means the current-run-only cleanup scope has already fallen
+    // behind. Expand the sweep to every known harness root/run, but keep the
+    // worktree salvage/PR/dirty/live-worker guards in the cleanup pipeline.
+    runIdFilter: void 0,
+    includeOrphans: true,
+    terminalWorktreesAgeMs: 0,
+    runDirectoriesAgeMs: 0,
+    worktreesAgeMs: retention.worktreesAgeMs > 0 ? retention.worktreesAgeMs : DEFAULT_WORKTREES_AGE_MS,
+    diskPressure: true,
+    diskGate: pressure.diskGate
+  };
+}
+
+// src/cleanup-progress.ts
+function emitCleanupProgress(phase, detail) {
+  if (process.env.KYNVER_CLEANUP_QUIET === "1") return;
+  const suffix = detail ? `: ${detail}` : "";
+  console.error(`[kynver cleanup] ${phase}${suffix}`);
+}
+
+// src/cleanup-run-terminal-cache.ts
+var CleanupRunTerminalCache = class {
+  cache = /* @__PURE__ */ new Map();
+  derive(run) {
+    const cached = this.cache.get(run.id);
+    if (cached !== void 0) return cached;
+    const derived = deriveTerminalRunStatus(run);
+    this.cache.set(run.id, derived);
+    return derived;
+  }
+};
+
+// src/cleanup-summary.ts
+var DEFAULT_SAMPLE_ACTIONS = 12;
+var DEFAULT_SAMPLE_SKIPS = 8;
+function tallyActionKinds(actions) {
+  const counts = {};
+  for (const action of actions) {
+    counts[action.kind] = (counts[action.kind] ?? 0) + 1;
+  }
+  return counts;
+}
+function buildCleanupCompactSummary(summary, options = {}) {
+  const maxActions = options.maxSampleActions ?? DEFAULT_SAMPLE_ACTIONS;
+  const maxSkips = options.maxSampleSkips ?? DEFAULT_SAMPLE_SKIPS;
+  return {
+    harnessRoot: summary.harnessRoot,
+    scanRoots: summary.scanRoots,
+    dryRun: summary.dryRun,
+    execute: summary.execute,
+    scannedAt: summary.scannedAt,
+    finalizedRuns: summary.finalizedRuns.length,
+    actionCount: summary.actions.length,
+    actionKinds: tallyActionKinds(summary.actions),
+    totals: summary.totals,
+    ...summary.storage ? { storage: summary.storage } : {},
+    ...summary.preservedLivePaths?.length ? { preservedLivePaths: summary.preservedLivePaths } : {},
+    ...summary.removedRunDirectories != null ? { removedRunDirectories: summary.removedRunDirectories } : {},
+    sampleActions: summary.actions.slice(0, maxActions).map((action) => ({
+      kind: action.kind,
+      path: action.path,
+      ...action.skipReason ? { skipReason: action.skipReason } : {},
+      ...action.bytes != null ? { bytes: action.bytes } : {},
+      ...action.runId ? { runId: action.runId } : {},
+      ...action.worker ? { worker: action.worker } : {}
+    })),
+    sampleSkips: summary.skips.slice(0, maxSkips)
+  };
+}
+
+// src/cleanup.ts
+function resolvePaths(options = {}) {
+  const harnessRoot = options.harnessRoot ? normalizeHarnessRoot(options.harnessRoot) : resolveHarnessRoot();
+  const scanRoots = resolveHarnessScanRoots({ harnessRoot });
+  const now = options.now ?? Date.now();
+  return { harnessRoot, scanRoots, now };
+}
+function normalizeGuardSkip(skip) {
+  if (typeof skip === "string") return { reason: skip };
+  return skip;
+}
+function recordSkip(skips, pathValue, reason, detail) {
+  skips.push({ path: pathValue, reason, ...detail ? { detail } : {} });
+}
+function attachCandidateBytes(candidate, accountBytes, byteEntryCap) {
+  if (!accountBytes || candidate.bytes != null) return candidate;
+  return { ...candidate, bytes: directorySizeBytes(candidate.path, byteEntryCap) };
+}
+function tallySkipReasons(actions, skips) {
+  const counts = {};
+  for (const skip of skips) {
+    counts[skip.reason] = (counts[skip.reason] ?? 0) + 1;
+  }
+  for (const action of actions) {
+    if (action.skipReason) {
+      counts[action.skipReason] = (counts[action.skipReason] ?? 0) + 1;
+    }
+  }
+  return counts;
+}
+function removeDependencyCacheAction(candidate, execute) {
+  if (candidate.kind === "remove_next_cache") return removeNextCache(candidate, execute);
+  return removeNodeModules(candidate, execute);
+}
+function pathGuardForDependencyCache(candidate, harnessRoot, worktreesDir) {
+  if (candidate.kind === "remove_next_cache") {
+    return isHarnessNextCachePath(candidate.path, harnessRoot, worktreesDir);
+  }
+  return isHarnessNodeModulesPath(candidate.path, harnessRoot, worktreesDir);
+}
+function mergeWorktreeIndexes(scanRoots) {
+  const merged = /* @__PURE__ */ new Map();
+  for (const root of scanRoots) {
+    for (const [key, value] of buildWorktreeIndexAt(root)) merged.set(key, value);
+  }
+  return merged;
+}
+function worktreePathForCandidate(candidate, worktreesDir) {
+  if (candidate.runId && candidate.worker) {
+    return path23.join(worktreesDir, candidate.runId, candidate.worker);
+  }
+  return path23.resolve(candidate.path, "..");
+}
+function runHarnessCleanup(options = {}) {
+  let retention = resolveHarnessRetention(options);
+  const diskPressure = observeCleanupDiskPressure();
+  retention = applyDiskPressureToRetention(retention, diskPressure);
+  const paths = resolvePaths(options);
+  emitCleanupProgress("scan", `${paths.scanRoots.length} harness root(s)`);
+  const activeGuards = collectActiveWorktreeGuards(paths.scanRoots, paths.now);
+  const finalizedRuns = retention.finalizeStaleRuns ? finalizeStaleRuns().map((f) => ({ runId: f.runId, from: f.from, to: f.to })) : [];
+  if (finalizedRuns.length > 0) {
+    emitCleanupProgress("finalize", `${finalizedRuns.length} stale run(s) marked terminal`);
+  }
+  emitCleanupProgress("index", "building worktree index");
+  const index = mergeWorktreeIndexes(paths.scanRoots);
+  emitCleanupProgress("index", `${index.size} indexed worktree(s)`);
+  const liveness = { runTerminalCache: new CleanupRunTerminalCache() };
+  const skips = [];
+  const actions = [];
+  const processedPaths = /* @__PURE__ */ new Set();
+  const maxActions = retention.maxActionsPerSweep;
+  const atSweepCap = () => actions.length >= maxActions;
+  for (const harnessRoot of paths.scanRoots) {
+    if (atSweepCap()) break;
+    emitCleanupProgress("root", harnessRoot);
+    const worktreesDir = path23.join(harnessRoot, "worktrees");
+    const scanOpts = {
+      harnessRoot,
+      worktreesDir,
+      nodeModulesAgeMs: retention.nodeModulesAgeMs,
+      worktreesAgeMs: retention.worktreesAgeMs,
+      includeOrphans: retention.includeOrphans,
+      runIdFilter: retention.runIdFilter,
+      index,
+      now: paths.now
+    };
+    for (const raw of scanDependencyCacheCandidates(scanOpts)) {
+      if (atSweepCap()) break;
+      const resolved = path23.resolve(raw.path);
+      if (processedPaths.has(resolved)) continue;
+      processedPaths.add(resolved);
+      const candidate = { ...raw, path: resolved };
+      const pathSkip = pathGuardForDependencyCache(candidate, harnessRoot, worktreesDir);
+      if (pathSkip) {
+        recordSkip(skips, candidate.path, pathSkip);
+        actions.push({ ...candidate, executed: false, skipped: true, skipReason: pathSkip });
+        continue;
+      }
+      const worktreePath = worktreePathForCandidate(candidate, worktreesDir);
+      const indexed = index.get(path23.resolve(worktreePath)) ?? null;
+      const guardReason = skipDependencyCacheRemoval({
+        indexed,
+        includeOrphans: true,
+        nodeModulesAgeMs: retention.nodeModulesAgeMs,
+        ageMs: candidate.ageMs,
+        worktreePath,
+        activeWorktreePaths: activeGuards.activeWorktreePaths,
+        diskPressure: retention.diskPressure
+      });
+      if (guardReason) {
+        recordSkip(skips, candidate.path, guardReason);
+        actions.push({ ...candidate, executed: false, skipped: true, skipReason: guardReason });
+        continue;
+      }
+      actions.push(
+        removeDependencyCacheAction(
+          attachCandidateBytes(candidate, retention.accountBytes, retention.byteAccountingEntryCap),
+          retention.execute
+        )
+      );
+    }
+    for (const raw of scanBuildCacheCandidates(scanOpts)) {
+      if (atSweepCap()) break;
+      const resolved = path23.resolve(raw.path);
+      if (processedPaths.has(resolved)) continue;
+      processedPaths.add(resolved);
+      const candidate = { ...raw, path: resolved };
+      const pathSkip = isHarnessBuildCachePath(candidate.path, harnessRoot, worktreesDir);
+      if (pathSkip) {
+        recordSkip(skips, candidate.path, pathSkip);
+        actions.push({ ...candidate, executed: false, skipped: true, skipReason: pathSkip });
+        continue;
+      }
+      const worktreePath = worktreePathForCandidate(candidate, worktreesDir);
+      const indexed = index.get(path23.resolve(worktreePath)) ?? null;
+      const guardReason = skipBuildCacheRemoval({
+        indexed,
+        includeOrphans: true,
+        nodeModulesAgeMs: retention.nodeModulesAgeMs,
+        ageMs: candidate.ageMs,
+        worktreePath,
+        activeWorktreePaths: activeGuards.activeWorktreePaths,
+        diskPressure: retention.diskPressure
+      });
+      if (guardReason) {
+        recordSkip(skips, candidate.path, guardReason);
+        actions.push({ ...candidate, executed: false, skipped: true, skipReason: guardReason });
+        continue;
+      }
+      actions.push(
+        removeBuildCache(
+          attachCandidateBytes(candidate, retention.accountBytes, retention.byteAccountingEntryCap),
+          retention.execute
+        )
+      );
+    }
+    const worktreeCandidates = [
+      ...scanWorktreeCandidates(scanOpts),
+      ...scanDuplicateWorktreeCandidates(scanOpts)
+    ];
+    emitCleanupProgress("worktrees", `${worktreeCandidates.length} candidate(s) at ${harnessRoot}`);
+    const worktreeSeen = /* @__PURE__ */ new Set();
+    for (const raw of worktreeCandidates) {
+      if (atSweepCap()) break;
+      const resolved = path23.resolve(raw.path);
+      if (worktreeSeen.has(resolved)) continue;
+      worktreeSeen.add(resolved);
+      const candidate = { ...raw, path: resolved };
+      const indexed = index.get(path23.resolve(candidate.path)) ?? null;
+      const orphanSafety = indexed ? null : assessOrphanWorktreeSafety({
+        worktreePath: candidate.path,
+        harnessRoot,
+        runId: candidate.runId,
+        workerName: candidate.worker,
+        now: paths.now
+      });
+      const guardSkip = skipWorktreeRemoval({
+        indexed,
+        worktreePath: path23.resolve(candidate.path),
+        includeOrphans: retention.includeOrphans,
+        worktreesAgeMs: retention.worktreesAgeMs,
+        terminalWorktreesAgeMs: retention.terminalWorktreesAgeMs,
+        ageMs: candidate.ageMs,
+        orphanSafety,
+        worktreeRemovalGuard: options.worktreeRemovalGuard,
+        liveness
+      });
+      if (guardSkip) {
+        const { reason: guardReason, detail: guardDetail } = normalizeGuardSkip(guardSkip);
+        recordSkip(skips, candidate.path, guardReason, guardDetail);
+        actions.push({ ...candidate, executed: false, skipped: true, skipReason: guardReason });
+        continue;
+      }
+      actions.push(
+        removeWorktree(
+          attachCandidateBytes(candidate, retention.accountBytes, retention.byteAccountingEntryCap),
+          retention.execute
+        )
+      );
+    }
+    if (!atSweepCap() && retention.runDirectoriesAgeMs >= 0) {
+      for (const raw of scanStaleRunDirectoryCandidates({
+        harnessRoot,
+        worktreesDir,
+        runDirectoriesAgeMs: retention.runDirectoriesAgeMs,
+        runIdFilter: retention.runIdFilter,
+        activeGuards,
+        now: paths.now
+      })) {
+        if (atSweepCap()) break;
+        const resolved = path23.resolve(raw.path);
+        if (processedPaths.has(resolved)) continue;
+        processedPaths.add(resolved);
+        const candidate = { ...raw, path: resolved };
+        const runId = candidate.runId ?? path23.basename(resolved);
+        const dirSkip = skipRunDirectoryRemoval({
+          harnessRoot,
+          runId,
+          runPath: resolved,
+          ageMs: candidate.ageMs,
+          runDirectoriesAgeMs: retention.runDirectoriesAgeMs,
+          activeGuards
+        });
+        if (dirSkip) {
+          recordSkip(skips, candidate.path, dirSkip);
+          actions.push({ ...candidate, executed: false, skipped: true, skipReason: dirSkip });
+          continue;
+        }
+        actions.push(
+          removeRunDirectory(
+            attachCandidateBytes(candidate, retention.accountBytes, retention.byteAccountingEntryCap),
+            retention.execute
+          )
+        );
+      }
+    }
+  }
+  let candidateBytes = 0;
+  let removedRunDirectories = 0;
+  let reclaimableBytes = 0;
+  let removedBytes = 0;
+  let removedPaths = 0;
+  let skippedPaths = 0;
+  for (const action of actions) {
+    if (action.bytes) candidateBytes += action.bytes;
+    if (!action.skipped && !action.executed && action.bytes) reclaimableBytes += action.bytes;
+    if (action.executed) {
+      removedPaths += 1;
+      removedBytes += action.bytes ?? 0;
+      if (action.kind === "remove_run_directory") removedRunDirectories += 1;
+    } else if (action.skipped) {
+      skippedPaths += 1;
+      if (action.skipReason === "dry_run" && action.bytes) reclaimableBytes += action.bytes;
+    }
+  }
+  const storage = retention.accountBytes ? harnessStorageSnapshot({
+    harnessRoot: paths.harnessRoot,
+    now: paths.now,
+    perRunEntryCap: retention.storagePerRunEntryCap
+  }) : void 0;
+  emitCleanupProgress(
+    "complete",
+    `${actions.length} action(s), ${skippedPaths} skipped, ${removedPaths} removed`
+  );
+  const preservedLivePaths = collectPreservedLivePaths(actions, skips);
+  const compactSummary = buildCleanupCompactSummary({
+    harnessRoot: paths.harnessRoot,
+    scanRoots: paths.scanRoots,
+    dryRun: !retention.execute,
+    execute: retention.execute,
+    nodeModulesAgeMs: retention.nodeModulesAgeMs,
+    worktreesAgeMs: retention.worktreesAgeMs,
+    includeOrphans: retention.includeOrphans,
+    diskPressure: retention.diskPressure,
+    diskGate: retention.diskGate ? {
+      ok: retention.diskGate.ok,
+      path: retention.diskGate.path,
+      freeBytes: retention.diskGate.freeBytes,
+      usedPercent: retention.diskGate.usedPercent,
+      reason: retention.diskGate.reason
+    } : void 0,
+    scannedAt: new Date(paths.now).toISOString(),
+    finalizedRuns,
+    actions,
+    skips,
+    totals: {
+      candidateBytes,
+      reclaimableBytes,
+      removedBytes,
+      removedPaths,
+      skippedPaths,
+      skipReasons: tallySkipReasons(actions, skips)
+    },
+    ...storage ? { storage } : {},
+    ...preservedLivePaths.length > 0 ? { preservedLivePaths } : {},
+    ...removedRunDirectories > 0 ? { removedRunDirectories } : {}
+  });
+  return {
+    harnessRoot: paths.harnessRoot,
+    scanRoots: paths.scanRoots,
+    dryRun: !retention.execute,
+    execute: retention.execute,
+    nodeModulesAgeMs: retention.nodeModulesAgeMs,
+    worktreesAgeMs: retention.worktreesAgeMs,
+    includeOrphans: retention.includeOrphans,
+    diskPressure: retention.diskPressure,
+    diskGate: retention.diskGate ? {
+      ok: retention.diskGate.ok,
+      path: retention.diskGate.path,
+      freeBytes: retention.diskGate.freeBytes,
+      usedPercent: retention.diskGate.usedPercent,
+      reason: retention.diskGate.reason
+    } : void 0,
+    scannedAt: new Date(paths.now).toISOString(),
+    finalizedRuns,
+    actions,
+    skips,
+    totals: {
+      candidateBytes,
+      reclaimableBytes,
+      removedBytes,
+      removedPaths,
+      skippedPaths,
+      skipReasons: tallySkipReasons(actions, skips)
+    },
+    ...storage ? { storage } : {},
+    ...preservedLivePaths.length > 0 ? { preservedLivePaths } : {},
+    ...removedRunDirectories > 0 ? { removedRunDirectories } : {},
+    compactSummary
+  };
+}
+export {
+  DEFAULT_MAX_ACTIONS_PER_SWEEP,
+  DEFAULT_NODE_MODULES_AGE_MS,
+  DEFAULT_RUN_DIRECTORIES_AGE_MS,
+  DEFAULT_WORKTREES_AGE_MS,
+  runHarnessCleanup
+};
+//# sourceMappingURL=cleanup.js.map