@kynver-app/runtime 0.1.105 → 0.1.108

package/dist/cli.js

@@ -311,7 +311,9 @@ function redactHomePath(value) {
   if (resolved.startsWith(`${home}${path2.sep}`)) {
     return `~/${path2.relative(home, resolved).split(path2.sep).join("/")}`;
   }
-  return resolved.replace(/^\/home\/[^/]+(?=\/|$)/, "~").replace(/^\/Users\/[^/]+(?=\/|$)/, "~");
+  const posix = resolved.replace(/\\/g, "/");
+  const redacted = posix.replace(/^\/home\/[^/]+(?=\/|$)/, "~").replace(/^\/Users\/[^/]+(?=\/|$)/, "~").replace(/^[A-Za-z]:\/home\/[^/]+(?=\/|$)/i, "~").replace(/^[A-Za-z]:\/Users\/[^/]+(?=\/|$)/i, "~");
+  return redacted;
 }
 function displayUserPath(value) {
   return redactHomePath(value);
@@ -2696,14 +2698,14 @@ var WORKER_PERSONA_CATALOG = [
   {
     slug: "lorentz",
     displayName: "Lorentz",
-    description: "Review / testing \u2014 pre-landing and post-landing verification, report + deep review.",
+    description: "Deep/adversarial review lane expert for risk, correctness, and safety gates. Run adversarial review and validation gating.",
     dispatchLane: "review",
     defaultRoleLane: "report_reviewer"
   },
   {
     slug: "dalton",
     displayName: "Dalton",
-    description: "Landing / merge execution \u2014 merge-ready PR landing and merge evidence only (no implementation).",
+    description: "Landing-only \u2014 merge-ready handoff and final verification evidence; no implementation ownership.",
     dispatchLane: "landing",
     defaultRoleLane: "implementer"
   }
@@ -7036,6 +7038,325 @@ async function releaseDispatchClaimAfterSpawnFailure(input) {
   };
 }
 
+// src/landing/land-pr.ts
+import { spawnSync as spawnSync5 } from "node:child_process";
+
+// src/landing/cli-auth.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+function ensureGitHubTokenFromCliAuth() {
+  if (process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim()) {
+    return {
+      source: "env",
+      configured: true,
+      reason: "GitHub token already configured in environment"
+    };
+  }
+  const result = spawnSync4("gh", ["auth", "token"], {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.status !== 0) {
+    const reason = typeof result.stderr === "string" && result.stderr.trim() ? result.stderr.trim() : "gh auth token failed; run `gh auth login` on this machine";
+    return { source: "missing", configured: false, reason };
+  }
+  const token = typeof result.stdout === "string" ? result.stdout.trim() : "";
+  if (!token) {
+    return {
+      source: "missing",
+      configured: false,
+      reason: "gh auth token returned an empty token; run `gh auth login` on this machine"
+    };
+  }
+  process.env.GH_TOKEN = token;
+  return {
+    source: "gh-cli",
+    configured: true,
+    reason: "Using local GitHub CLI auth for daemon land_pr merge"
+  };
+}
+
+// src/landing/land-pr.ts
+var SUCCESSFUL_CHECK_CONCLUSIONS = /* @__PURE__ */ new Set(["SUCCESS", "SKIPPED", "NEUTRAL"]);
+var READY_MERGE_STATES = /* @__PURE__ */ new Set(["CLEAN", "HAS_HOOKS"]);
+function repoArgs(repo) {
+  return repo?.trim() ? ["--repo", repo.trim()] : [];
+}
+function ghJson(exec, cwd, args) {
+  const res = exec.gh(cwd, args);
+  if (res.status !== 0) {
+    throw new Error(res.stderr || res.stdout || `gh ${args.join(" ")} failed`);
+  }
+  return JSON.parse(res.stdout || "{}");
+}
+function checkName(check3) {
+  return typeof check3.name === "string" && check3.name || typeof check3.context === "string" && check3.context || typeof check3.workflowName === "string" && check3.workflowName || "unknown check";
+}
+function classifyChecks(statusCheckRollup) {
+  const checks = Array.isArray(statusCheckRollup) ? statusCheckRollup : [];
+  const pending = [];
+  const failed = [];
+  for (const raw of checks) {
+    const check3 = raw && typeof raw === "object" ? raw : {};
+    const conclusion = typeof check3.conclusion === "string" ? check3.conclusion.toUpperCase() : "";
+    const status = typeof check3.status === "string" ? check3.status.toUpperCase() : "";
+    const state = typeof check3.state === "string" ? check3.state.toUpperCase() : "";
+    if (conclusion && SUCCESSFUL_CHECK_CONCLUSIONS.has(conclusion)) continue;
+    if (conclusion) {
+      failed.push(`${checkName(check3)}=${conclusion}`);
+      continue;
+    }
+    if (state && SUCCESSFUL_CHECK_CONCLUSIONS.has(state)) continue;
+    if (state && state !== "PENDING") {
+      failed.push(`${checkName(check3)}=${state}`);
+      continue;
+    }
+    if (state === "PENDING") {
+      pending.push(`${checkName(check3)}=${state}`);
+      continue;
+    }
+    if (status && status !== "COMPLETED") {
+      pending.push(`${checkName(check3)}=${status}`);
+      continue;
+    }
+    pending.push(`${checkName(check3)}=PENDING`);
+  }
+  return { pending, failed };
+}
+function vercelCheckSuccess(statusCheckRollup) {
+  const checks = Array.isArray(statusCheckRollup) ? statusCheckRollup : [];
+  return checks.some((raw) => {
+    const check3 = raw && typeof raw === "object" ? raw : {};
+    const name = typeof check3.name === "string" && check3.name || typeof check3.context === "string" && check3.context || "";
+    const conclusion = typeof check3.conclusion === "string" ? check3.conclusion.toUpperCase() : "";
+    const state = typeof check3.state === "string" ? check3.state.toUpperCase() : "";
+    return /^vercel/i.test(name) && (conclusion === "SUCCESS" || state === "SUCCESS");
+  });
+}
+var STRUCTURED_SECTION_RE = /^##\s*(test\s*plan|verification|test\s*evidence|verify)\b/im;
+var LOCAL_VERIFICATION_RE = /typecheck|npm run (test|build|typecheck)|vitest|tsc\b|verify-pr-local|local verify|local-verify|tests? (pass|green)|build green|node --test/i;
+var DOCS_TITLE_RE = /^docs[(:]/i;
+var DOCS_BODY_RE = /docs[- ]only|documentation only|no[- ]code change|no code changes|low[- ]risk|plan tracker only|markdown only/i;
+function assertVerificationEvidence(pr) {
+  const title = typeof pr.title === "string" ? pr.title : "";
+  const body = typeof pr.body === "string" ? pr.body : "";
+  const docsLowRisk = DOCS_TITLE_RE.test(title) || DOCS_BODY_RE.test(body);
+  const structuredSection = STRUCTURED_SECTION_RE.test(body);
+  const localVerification = LOCAL_VERIFICATION_RE.test(body);
+  const vercelOk = vercelCheckSuccess(pr.statusCheckRollup);
+  if (docsLowRisk || structuredSection || localVerification || vercelOk) return;
+  throw new Error(
+    `PR #${pr.number} lacks landing verification evidence \u2014 add ## Test plan / ## Verification with local commands, Vercel preview, or docs/no-code rationale`
+  );
+}
+function assertLandingReady(pr) {
+  if (pr.state !== "OPEN") throw new Error(`PR #${pr.number} is ${pr.state}, not OPEN`);
+  if (pr.isDraft) throw new Error(`PR #${pr.number} is still a draft`);
+  if (!READY_MERGE_STATES.has(pr.mergeStateStatus)) {
+    throw new Error(`PR #${pr.number} mergeStateStatus is ${pr.mergeStateStatus}`);
+  }
+  const checks = classifyChecks(pr.statusCheckRollup);
+  if (checks.failed.length > 0) {
+    throw new Error(`PR #${pr.number} has failing checks: ${checks.failed.join(", ")}`);
+  }
+  if (checks.pending.length > 0) {
+    throw new Error(`PR #${pr.number} has pending checks: ${checks.pending.join(", ")}`);
+  }
+  assertVerificationEvidence(pr);
+}
+function landingReadinessError(pr) {
+  try {
+    assertLandingReady(pr);
+    return null;
+  } catch (err) {
+    return err instanceof Error ? err.message : String(err);
+  }
+}
+function deleteRemoteBranch(exec, cwd, repo, branch) {
+  if (!branch?.trim()) return;
+  const refPath = encodeURI(`heads/${branch}`);
+  exec.gh(cwd, ["api", "-X", "DELETE", `repos/${repo}/git/refs/${refPath}`]);
+}
+function resolveRepo(exec, cwd, repo) {
+  if (repo?.trim()) return repo.trim();
+  const res = exec.gh(cwd, ["repo", "view", "--json", "nameWithOwner"]);
+  if (res.status !== 0) throw new Error(res.stderr || "Could not resolve GitHub repo");
+  const parsed = JSON.parse(res.stdout || "{}");
+  if (!parsed.nameWithOwner) throw new Error("Could not resolve GitHub repo");
+  return parsed.nameWithOwner;
+}
+function removeBranchWorktrees(cwd, branch) {
+  if (!branch?.trim()) return;
+  const list = spawnSync5("git", ["worktree", "list", "--porcelain"], {
+    cwd,
+    encoding: "utf8"
+  });
+  if (list.status !== 0) return;
+  const lines = String(list.stdout || "").split(/\r?\n/);
+  let currentPath = null;
+  let currentBranch = null;
+  for (const line of lines) {
+    if (line.startsWith("worktree ")) {
+      currentPath = line.slice("worktree ".length).trim();
+      currentBranch = null;
+      continue;
+    }
+    if (line.startsWith("branch ") && currentPath) {
+      currentBranch = line.slice("branch ".length).trim();
+      if (currentBranch.endsWith(`/${branch}`)) {
+        spawnSync5("git", ["worktree", "remove", "--force", currentPath], {
+          cwd,
+          encoding: "utf8"
+        });
+      }
+    }
+  }
+}
+async function executeLandPrMerge(input) {
+  const cwd = input.cwd ?? process.cwd();
+  const exec = input.exec ?? defaultPrHandoffExec;
+  const prTarget = input.prUrl.trim();
+  if (!prTarget) throw new Error("prUrl is required");
+  const auth = ensureGitHubTokenFromCliAuth();
+  if (!auth.configured) {
+    return {
+      prUrl: prTarget,
+      outcome: "blocked",
+      reason: auth.reason
+    };
+  }
+  const before = ghJson(exec, cwd, [
+    "pr",
+    "view",
+    prTarget,
+    ...repoArgs(input.repo),
+    "--json",
+    [
+      "number",
+      "url",
+      "title",
+      "body",
+      "state",
+      "isDraft",
+      "mergeStateStatus",
+      "statusCheckRollup",
+      "headRefName",
+      "mergedAt",
+      "mergeCommit"
+    ].join(",")
+  ]);
+  const notReadyReason = landingReadinessError(before);
+  if (notReadyReason) {
+    if (input.skipNotReady) {
+      return {
+        prUrl: before.url || prTarget,
+        outcome: "skipped",
+        reason: notReadyReason
+      };
+    }
+    return {
+      prUrl: before.url || prTarget,
+      outcome: "blocked",
+      reason: notReadyReason
+    };
+  }
+  if (input.dryRun) {
+    return {
+      prUrl: before.url || prTarget,
+      outcome: "skipped",
+      reason: "dry-run: PR is ready to merge"
+    };
+  }
+  const target = String(before.number);
+  const mergeRes = exec.gh(cwd, [
+    "pr",
+    "merge",
+    target,
+    ...repoArgs(input.repo),
+    "--squash"
+  ]);
+  if (mergeRes.status !== 0) {
+    return {
+      prUrl: before.url || prTarget,
+      outcome: "blocked",
+      reason: mergeRes.stderr || mergeRes.stdout || "gh pr merge failed"
+    };
+  }
+  const after = ghJson(exec, cwd, [
+    "pr",
+    "view",
+    target,
+    ...repoArgs(input.repo),
+    "--json",
+    "number,url,mergedAt,mergeCommit,state"
+  ]);
+  if (after.state !== "MERGED" && !after.mergedAt) {
+    return {
+      prUrl: after.url || before.url || prTarget,
+      outcome: "blocked",
+      reason: `PR #${after.number} did not verify as merged after gh pr merge`
+    };
+  }
+  const repo = resolveRepo(exec, cwd, input.repo);
+  deleteRemoteBranch(exec, cwd, repo, before.headRefName);
+  removeBranchWorktrees(cwd, before.headRefName);
+  const mergeCommit = after.mergeCommit?.oid ?? null;
+  return {
+    prUrl: after.url || before.url || prTarget,
+    outcome: "merged",
+    mergeCommit,
+    reason: `Daemon land_pr merged PR #${after.number}`
+  };
+}
+
+// src/landing/land-pr-completion-post.ts
+async function postLandPrHarnessCompletion(input) {
+  const secret = await resolveCallbackSecretWithMint(input.secret, input.agentOsId, {
+    baseUrl: input.baseUrl
+  });
+  const taskId = String(input.task.id);
+  const url = `${input.baseUrl}/api/agent-os/by-id/${encodeURIComponent(input.agentOsId)}/harness/completion`;
+  const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+  const body = {
+    source: "kynver-harness",
+    agentOsId: input.agentOsId,
+    runId: input.runId,
+    workerName: `land-pr-${taskId}`,
+    taskId,
+    leaseToken: input.task.leaseToken ?? null,
+    startedAt: finishedAt,
+    finishedAt,
+    status: {
+      finalResult: input.report,
+      prUrl: input.report.prUrl,
+      summary: input.report.reason,
+      leaseToken: input.task.leaseToken ?? null
+    },
+    workerInjection: null
+  };
+  const result = await postJsonWithCredentialRefresh(url, secret, body, {
+    agentOsId: input.agentOsId,
+    baseUrl: input.baseUrl
+  });
+  return { ok: result.ok, status: result.status };
+}
+
+// src/verify-live/verify-live-prompt.ts
+function formatVerifyLiveCompletionContract() {
+  return [
+    "## verify_live completion contract",
+    "Finish with a JSON finalResult object:",
+    "{",
+    '  "prUrl": "<landed pr>",',
+    '  "outcome": "passed" | "failed" | "skipped" | "no_mcp_surface",',
+    '  "reason": "<human summary>",',
+    '  "mergeCommit": "<sha optional>",',
+    '  "mcpCalls": [{ "tool": "<name>", "ok": true, "summary": "..." }]',
+    "}",
+    "",
+    "Drive the feature MCP tools against live production. Do not mark passed without exercising the MCP surface."
+  ].join("\n");
+}
+
 // src/dispatch.ts
 var DEFAULT_DISPATCH_LEASE_MS = 60 * 60 * 1e3;
 function readAdmissionExhaustion(result) {
@@ -7093,6 +7414,9 @@ function buildDispatchTaskText(task, agentOsId) {
     `Board linkage: agentOsId=${agentOsId}, taskId=${task.id}, attempt=${task.attempt}, executor=${task.executor}${task.executorRef ? `, executorRef=${task.executorRef}` : ""}.`,
     "This worker was dispatched from the AgentOS board. The harness reports your completion back to the board when you finish."
   ];
+  if (task.executor === "verify_live") {
+    lines.push("", formatVerifyLiveCompletionContract());
+  }
   const outboxRef = extractPlanOutboxFromTask(task);
   if (outboxRef?.outboxId) {
     const item = loadOutboxById(outboxRef.outboxId);
@@ -7126,6 +7450,12 @@ function requestedTargetTaskIds(args) {
 async function dispatchRun(args) {
   const pipeline = args.pipeline === true || args.pipeline === "true";
   try {
+    let isLandPrDecision2 = function(decision) {
+      if (decision.landPrDispatch === true) return true;
+      const task = decision.task;
+      return task?.executor === "land_pr";
+    };
+    var isLandPrDecision = isLandPrDecision2;
     const run = loadRun(String(required(String(args.run || ""), "--run")));
     const agentOsId = String(required(String(args.agentOsId || ""), "--agent-os-id"));
     const base = resolveBaseUrl(args.baseUrl ? String(args.baseUrl) : void 0);
@@ -7260,6 +7590,41 @@ async function dispatchRun(args) {
       });
       return false;
     }
+    async function runLandPrClaimed(decision) {
+      const task = decision.task;
+      const taskId = String(task.id);
+      const prUrl = task.prUrl ? String(task.prUrl) : "";
+      if (!prUrl) {
+        return abortClaimedSpawn(task, "land_pr task missing prUrl");
+      }
+      try {
+        const report = await executeLandPrMerge({ prUrl, cwd: process.cwd() });
+        const post = await postLandPrHarnessCompletion({
+          baseUrl: base,
+          secret,
+          agentOsId,
+          runId: run.id,
+          task,
+          report
+        });
+        outcomes.push({
+          taskId,
+          started: true,
+          landPr: true,
+          outcome: report.outcome,
+          completionStatus: post.status
+        });
+        if (!post.ok) {
+          return abortClaimedSpawn(
+            task,
+            `land_pr completion POST failed (HTTP ${post.status})`
+          );
+        }
+        return true;
+      } catch (error) {
+        return abortClaimedSpawn(task, error.message);
+      }
+    }
     async function spawnClaimed(decision) {
       const task = decision.task;
       const harnessContext = readHarnessWorkerContext(decision);
@@ -7377,7 +7742,8 @@ async function dispatchRun(args) {
     }
     let shouldContinueDispatch = true;
     for (const decision of result.started) {
-      shouldContinueDispatch = await spawnClaimed(decision) && shouldContinueDispatch;
+      const admitted = isLandPrDecision2(decision) ? await runLandPrClaimed(decision) : await spawnClaimed(decision);
+      shouldContinueDispatch = admitted && shouldContinueDispatch;
     }
     skipped.push(
       ...result.skipped ?? []
@@ -7415,7 +7781,8 @@ async function dispatchRun(args) {
       if (started.length === 0) break;
       for (const decision of started) {
         if (outcomes.length >= cappedStarts) break;
-        shouldContinueDispatch = await spawnClaimed(decision) && shouldContinueDispatch;
+        const admitted = isLandPrDecision2(decision) ? await runLandPrClaimed(decision) : await spawnClaimed(decision);
+        shouldContinueDispatch = admitted && shouldContinueDispatch;
         if (!shouldContinueDispatch) break;
       }
     }
@@ -9815,7 +10182,7 @@ function pathHasForeignOwnedEntry(targetPath, maxEntries = 32) {
 }
 
 // src/cleanup-privileged-remove.ts
-import { spawnSync as spawnSync4 } from "node:child_process";
+import { spawnSync as spawnSync6 } from "node:child_process";
 import path45 from "node:path";
 
 // src/cleanup-harness-path-validate.ts
@@ -9860,7 +10227,7 @@ function resolvePrivilegedCleanupMode() {
   return "auto";
 }
 function runSudoNonInteractive(argv) {
-  const res = spawnSync4("sudo", ["-n", ...argv], {
+  const res = spawnSync6("sudo", ["-n", ...argv], {
     encoding: "utf8",
     stdio: ["ignore", "pipe", "pipe"]
   });
@@ -11588,7 +11955,7 @@ function formatNodeOptionsFlag(mb = resolveNodeOldSpaceSizeMb()) {
 }
 
 // src/bounded-build/systemd-wrap.ts
-import { spawnSync as spawnSync5 } from "node:child_process";
+import { spawnSync as spawnSync7 } from "node:child_process";
 var systemdAvailableCache;
 function isSystemdRunAvailable() {
   if (process.env.KYNVER_BUILD_SKIP_SYSTEMD === "1" || process.env.KYNVER_BUILD_SKIP_SYSTEMD === "true") {
@@ -11599,7 +11966,7 @@ function isSystemdRunAvailable() {
     systemdAvailableCache = false;
     return false;
   }
-  const res = spawnSync5("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
+  const res = spawnSync7("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
   systemdAvailableCache = res.status === 0;
   return systemdAvailableCache;
 }
@@ -11623,7 +11990,7 @@ function buildSystemdRunArgv(opts) {
 }
 
 // src/bounded-build/admission.ts
-import { spawnSync as spawnSync6 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 function positiveInt4(value, fallback) {
   const n = Number(value);
   if (!Number.isFinite(n) || n <= 0) return fallback;
@@ -11659,7 +12026,7 @@ function assessBuildAdmission(opts = {}) {
 }
 function sleepMs2(ms) {
   if (ms <= 0) return;
-  spawnSync6(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync8(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -11680,7 +12047,7 @@ function waitForBuildAdmission(timeoutMs, pollMs = 2e3, opts = {}) {
 }
 
 // src/bounded-build/exec.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 
 // src/heavy-verification/slot.ts
 import {
@@ -11886,10 +12253,10 @@ function assessHeavyVerificationGate(command, opts = {}) {
 }
 
 // src/heavy-verification/gate.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 function sleepMs3(ms) {
   if (ms <= 0) return;
-  spawnSync7(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync9(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -11932,7 +12299,7 @@ function envArgv(env) {
   return out;
 }
 function runSpawn(argv, opts) {
-  const res = spawnSync8(argv[0], argv.slice(1), {
+  const res = spawnSync10(argv[0], argv.slice(1), {
     cwd: opts.cwd,
     env: opts.env,
     encoding: "utf8",
@@ -13212,10 +13579,10 @@ import path68 from "node:path";
 import { accessSync, constants, existsSync as existsSync45, readFileSync as readFileSync17 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
 import path67 from "node:path";
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 function captureCommand(bin, args) {
   try {
-    const res = spawnSync9(bin, args, { encoding: "utf8" });
+    const res = spawnSync11(bin, args, { encoding: "utf8" });
     const stdout = (res.stdout || "").trim();
     const stderr = (res.stderr || "").trim();
     const ok = res.status === 0;
@@ -14115,7 +14482,7 @@ var LANDING_MAINTAINER_LANE_SPEC = {
 };
 
 // src/lane/landing-maintainer-local.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 import path70 from "node:path";
 function runLandingWrapper(prNumber, repoRoot, execute) {
   const script = path70.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
@@ -14129,7 +14496,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
       stderr: ""
     };
   }
-  const result = spawnSync10("node", args, {
+  const result = spawnSync12("node", args, {
     cwd: repoRoot,
     encoding: "utf8",
     timeout: 10 * 60 * 1e3