@kynver-app/runtime 0.1.112 → 0.1.116

package/dist/index.js

@@ -1,51 +1,12 @@
-// src/package-version.ts
-import { existsSync, readFileSync } from "node:fs";
-import { dirname, join } from "node:path";
-import { fileURLToPath } from "node:url";
-function resolvePackageRoot(moduleUrl) {
-  let dir = dirname(fileURLToPath(moduleUrl));
-  for (let depth = 0; depth < 6; depth += 1) {
-    if (existsSync(join(dir, "package.json"))) return dir;
-    const parent = dirname(dir);
-    if (parent === dir) break;
-    dir = parent;
-  }
-  throw new Error(`package.json not found above ${dirname(fileURLToPath(moduleUrl))}`);
-}
-function readOwnPackageVersion(moduleUrl = import.meta.url) {
-  const pkgPath = join(resolvePackageRoot(moduleUrl), "package.json");
-  const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
-  if (typeof pkg.version !== "string" || !pkg.version.trim()) {
-    throw new Error(`Missing package.json version at ${pkgPath}`);
-  }
-  return pkg.version;
-}
-var PACKAGE_VERSION = readOwnPackageVersion();
-function wantsCliVersion(argv) {
-  return argv.some((arg) => arg === "--version" || arg === "-v");
-}
-function printCliVersionAndExit(version, binName) {
-  console.log(binName ? `${binName} ${version}` : version);
-  process.exit(0);
-}
-function handleCliVersionFlag(argv, moduleUrl = import.meta.url, binName) {
-  if (!wantsCliVersion(argv)) return false;
-  printCliVersionAndExit(readOwnPackageVersion(moduleUrl), binName);
-  return true;
-}
-
-// src/memory-cost-package-version-guard.ts
-import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
-import path4 from "node:path";
-
-// src/default-repo-discovery.ts
-import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import path3 from "node:path";
-import { fileURLToPath as fileURLToPath2 } from "node:url";
-
-// src/git.ts
-import { spawnSync } from "node:child_process";
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
 
 // src/util.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, readdirSync, statSync, writeFileSync } from "node:fs";
@@ -154,42 +115,13 @@ function latestIso(values) {
 function secsAgo(ms) {
   return Math.max(0, Math.round((Date.now() - ms) / 1e3));
 }
+var init_util = __esm({
+  "src/util.ts"() {
+    "use strict";
+  }
+});
 
 // src/worker-env.ts
-var FORBIDDEN_WORKER_ENV_KEYS = [
-  "ANTHROPIC_API_KEY",
-  "ANALYST_API_KEY",
-  "RECRUITER_API_KEY",
-  "AUTH_SECRET",
-  "NEXTAUTH_SECRET",
-  "DATABASE_URL",
-  "PRODUCTION_DATABASE_URL",
-  "KYNVER_PRODUCTION_DATABASE_URL",
-  "REDIS_URL",
-  "GOOGLE_CLIENT_SECRET",
-  "GITHUB_CLIENT_SECRET",
-  "KYNVER_API_KEY",
-  "KYNVER_SERVICE_SECRET",
-  "KYNVER_RUNTIME_SECRET",
-  "KYNVER_CRON_SECRET",
-  "OPENCLAW_CRON_SECRET",
-  "QSTASH_TOKEN",
-  "QSTASH_CURRENT_SIGNING_KEY",
-  "QSTASH_NEXT_SIGNING_KEY",
-  "TOOL_SECRETS_KEK",
-  "TOOL_EXECUTOR_DISPATCH_SECRET",
-  "CLOUDFLARE_API_TOKEN",
-  "STRIPE_SECRET_KEY",
-  "STRIPE_WEBHOOK_SECRET",
-  "STRIPE_IDENTITY_WEBHOOK_SECRET",
-  "VOYAGE_API_KEY",
-  "PERPLEXITY_API_KEY",
-  "FRED_API_KEY",
-  "FMP_API_KEY",
-  "CURSOR_API_KEY"
-];
-var FORBIDDEN_KEY_SET = new Set(FORBIDDEN_WORKER_ENV_KEYS);
-var FORBIDDEN_SUFFIXES = ["_SECRET", "_API_KEY"];
 function isForbiddenWorkerEnvKey(key) {
   if (FORBIDDEN_KEY_SET.has(key)) return true;
   return FORBIDDEN_SUFFIXES.some((suffix) => key.endsWith(suffix));
@@ -211,8 +143,49 @@ function auditWorkerEnv(env) {
 function scrubClaudeEnv(env) {
   return scrubWorkerEnv(env);
 }
+var FORBIDDEN_WORKER_ENV_KEYS, FORBIDDEN_KEY_SET, FORBIDDEN_SUFFIXES;
+var init_worker_env = __esm({
+  "src/worker-env.ts"() {
+    "use strict";
+    FORBIDDEN_WORKER_ENV_KEYS = [
+      "ANTHROPIC_API_KEY",
+      "ANALYST_API_KEY",
+      "RECRUITER_API_KEY",
+      "AUTH_SECRET",
+      "NEXTAUTH_SECRET",
+      "DATABASE_URL",
+      "PRODUCTION_DATABASE_URL",
+      "KYNVER_PRODUCTION_DATABASE_URL",
+      "REDIS_URL",
+      "GOOGLE_CLIENT_SECRET",
+      "GITHUB_CLIENT_SECRET",
+      "KYNVER_API_KEY",
+      "KYNVER_SERVICE_SECRET",
+      "KYNVER_RUNTIME_SECRET",
+      "KYNVER_CRON_SECRET",
+      "OPENCLAW_CRON_SECRET",
+      "QSTASH_TOKEN",
+      "QSTASH_CURRENT_SIGNING_KEY",
+      "QSTASH_NEXT_SIGNING_KEY",
+      "TOOL_SECRETS_KEK",
+      "TOOL_EXECUTOR_DISPATCH_SECRET",
+      "CLOUDFLARE_API_TOKEN",
+      "STRIPE_SECRET_KEY",
+      "STRIPE_WEBHOOK_SECRET",
+      "STRIPE_IDENTITY_WEBHOOK_SECRET",
+      "VOYAGE_API_KEY",
+      "PERPLEXITY_API_KEY",
+      "FRED_API_KEY",
+      "FMP_API_KEY",
+      "CURSOR_API_KEY"
+    ];
+    FORBIDDEN_KEY_SET = new Set(FORBIDDEN_WORKER_ENV_KEYS);
+    FORBIDDEN_SUFFIXES = ["_SECRET", "_API_KEY"];
+  }
+});
 
 // src/git.ts
+import { spawnSync } from "node:child_process";
 function git(cwd, args, options = {}) {
   const res = spawnSync(
     "git",
@@ -336,6 +309,13 @@ function unknownAncestry(base, error, head = null) {
     error
   };
 }
+var init_git = __esm({
+  "src/git.ts"() {
+    "use strict";
+    init_util();
+    init_worker_env();
+  }
+});
 
 // src/path-values.ts
 import { homedir } from "node:os";
@@ -365,15 +345,17 @@ function redactHomePath(value) {
 function displayUserPath(value) {
   return redactHomePath(value);
 }
+var init_path_values = __esm({
+  "src/path-values.ts"() {
+    "use strict";
+  }
+});
 
 // src/default-repo-discovery.ts
-var WELL_KNOWN_REPO_DIRS = [
-  "Kynver",
-  "repos/Kynver",
-  "repos/kynver-source-main",
-  "code/Kynver",
-  "projects/Kynver"
-];
+import { existsSync as existsSync3, readFileSync as readFileSync3 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+import { fileURLToPath as fileURLToPath2 } from "node:url";
 function readPackageName(repoRoot) {
   const pkgPath = path3.join(repoRoot, "package.json");
   if (!existsSync3(pkgPath)) return null;
@@ -438,425 +420,135 @@ function discoverDefaultRepoCandidates(opts) {
 function discoverDefaultRepo(opts) {
   return discoverDefaultRepoCandidates(opts)[0] ?? null;
 }
-
-// src/memory-cost-package-version-guard.ts
-var MEMORY_COST_PACKAGE_MIN_VERSIONS = {
-  "@kynver-app/runtime": "0.1.83",
-  "@kynver-app/openclaw-agent-os": "0.1.43",
-  "@kynver-app/mcp-agent-os": "0.3.34"
-};
-var MEMORY_COST_MANAGED_PACKAGES = Object.keys(
-  MEMORY_COST_PACKAGE_MIN_VERSIONS
-);
-var DISPLAY_NAMES = {
-  "@kynver-app/runtime": "Kynver runtime",
-  "@kynver-app/openclaw-agent-os": "OpenClaw AgentOS plugin",
-  "@kynver-app/mcp-agent-os": "AgentOS MCP server"
-};
-var REPO_PACKAGE_JSON_RELATIVE = {
-  "@kynver-app/runtime": "packages/kynver-runtime/package.json",
-  "@kynver-app/openclaw-agent-os": "packages/kynver-openclaw-agent-os/package.json",
-  "@kynver-app/mcp-agent-os": "packages/kynver-mcp-agent-os/package.json"
-};
-function parseSemverParts(version) {
-  const core = version.trim().split("-")[0]?.split("+")[0];
-  if (!core) return null;
-  const parts = core.split(".");
-  if (parts.length < 1 || parts.length > 3) return null;
-  const nums = parts.map((p) => Number.parseInt(p, 10));
-  if (nums.some((n) => !Number.isFinite(n) || n < 0)) return null;
-  while (nums.length < 3) nums.push(0);
-  return [nums[0], nums[1], nums[2]];
-}
-function compareSemver(a, b) {
-  const pa = parseSemverParts(a);
-  const pb = parseSemverParts(b);
-  if (!pa || !pb) return 0;
-  for (let i = 0; i < 3; i += 1) {
-    if (pa[i] > pb[i]) return 1;
-    if (pa[i] < pb[i]) return -1;
+var WELL_KNOWN_REPO_DIRS;
+var init_default_repo_discovery = __esm({
+  "src/default-repo-discovery.ts"() {
+    "use strict";
+    init_git();
+    init_path_values();
+    WELL_KNOWN_REPO_DIRS = [
+      "Kynver",
+      "repos/Kynver",
+      "repos/kynver-source-main",
+      "code/Kynver",
+      "projects/Kynver"
+    ];
   }
-  return 0;
+});
+
+// src/box-identity.ts
+function normalizeWorkerPoolBoxKind(raw) {
+  const kind = (raw ?? "").trim().toLowerCase();
+  if (kind === "ghost" || kind === "forge") return kind;
+  if (kind.includes("forge")) return "forge";
+  if (kind.includes("ghost") || kind.includes("openclaw")) return "ghost";
+  return "forge";
 }
-function semverAtLeast(version, minimum) {
-  return compareSemver(version, minimum) >= 0;
+function trimEnv(env, key) {
+  const value = env[key]?.trim();
+  return value || null;
 }
-function maxSemver(versions) {
-  let best = null;
-  for (const version of versions) {
-    if (!best || compareSemver(version, best) > 0) best = version;
+function resolveBoxIdentity(env = process.env, config = {}) {
+  const warnings = [];
+  const configKind = config.boxKind?.trim();
+  if (configKind) {
+    return {
+      boxKind: normalizeWorkerPoolBoxKind(configKind),
+      source: "config",
+      slugInferenceBlocked: false,
+      warnings
+    };
   }
-  return best;
-}
-function readPackageJsonVersion(packageJsonPath) {
-  try {
-    const parsed = JSON.parse(readFileSync4(packageJsonPath, "utf8"));
-    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
-  } catch {
-    return null;
+  const envKind = trimEnv(env, "KYNVER_BOX_KIND");
+  if (envKind) {
+    return {
+      boxKind: normalizeWorkerPoolBoxKind(envKind),
+      source: "env",
+      slugInferenceBlocked: false,
+      warnings
+    };
   }
-}
-function resolveRepoRoot(cwd, explicitRepoRoot) {
-  const candidates = [explicitRepoRoot, process.env.KYNVER_REPO, cwd].filter(
-    (value) => Boolean(value?.trim())
-  );
-  for (const candidate of candidates) {
-    const resolved = path4.resolve(candidate);
-    if (existsSync4(path4.join(resolved, "packages/kynver-runtime/package.json")) && existsSync4(path4.join(resolved, "package.json"))) {
-      return resolved;
-    }
+  const agentOsSlug = trimEnv(env, "KYNVER_AGENT_OS_SLUG");
+  if (agentOsSlug) {
+    warnings.push(
+      `KYNVER_AGENT_OS_SLUG=${agentOsSlug} is a workspace slug, not box identity \u2014 set boxKind via \`kynver setup --box-kind forge|ghost\` or KYNVER_BOX_KIND (defaulting box kind to forge)`
+    );
   }
-  const discovered = discoverDefaultRepo({ cwd });
-  return discovered?.repo ?? null;
+  return {
+    boxKind: "forge",
+    source: "default",
+    slugInferenceBlocked: Boolean(agentOsSlug),
+    warnings
+  };
 }
-function probeRepoPackageVersions(input = {}) {
-  const cwd = input.cwd ?? process.cwd();
-  const repoRoot = resolveRepoRoot(cwd, input.repoRoot);
-  if (!repoRoot) return {};
-  const out = {};
-  for (const packageName of MEMORY_COST_MANAGED_PACKAGES) {
-    const packageJsonPath = path4.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
-    const version = readPackageJsonVersion(packageJsonPath);
-    if (!version) continue;
-    out[packageName] = { version, source: "repo", path: packageJsonPath };
-  }
-  return out;
+function resolveBoxKindFromConfig(config = {}, env = process.env) {
+  return resolveBoxIdentity(env, config).boxKind;
 }
-function repoSourceCommands(packageName) {
-  if (packageName === "@kynver-app/runtime") {
-    return ["npm run kynver:build", "npm run kynver"];
+var init_box_identity = __esm({
+  "src/box-identity.ts"() {
+    "use strict";
   }
-  return [`npm run build -w ${packageName}`];
-}
-function buildRemediation(input) {
-  const { packageName, minimumVersion, effectiveVersion, effectiveSource, repoVersion } = input;
-  const lines = [];
-  if (repoVersion && semverAtLeast(repoVersion, minimumVersion)) {
-    lines.push(
-      `Use the monorepo checkout (${repoVersion}) instead of a stale npm install: ${repoSourceCommands(packageName).join("; ")}.`
-    );
-    lines.push("Do not publish npm packages or wait on an operator release.");
-    return lines;
+});
+
+// src/bounded-build/meminfo.ts
+import { readFileSync as readFileSync5 } from "node:fs";
+import os from "node:os";
+function readMemAvailableBytes(meminfoText) {
+  if (meminfoText !== void 0) {
+    const match = meminfoText.match(/^MemAvailable:\s+(\d+)\s*kB/m);
+    if (match) return Number(match[1]) * 1024;
+    return os.freemem();
   }
-  if (effectiveVersion) {
-    lines.push(
-      `Upgrade ${packageName} from ${effectiveVersion} to >= ${minimumVersion} (npm install -g ${packageName}@latest or align OpenClaw npm prefix).`
-    );
-  } else {
-    lines.push(`Install ${packageName} >= ${minimumVersion} before running memory-heavy AgentOS paths.`);
+  if (process.platform === "linux") {
+    try {
+      const meminfo = readFileSync5("/proc/meminfo", "utf8");
+      const match = meminfo.match(/^MemAvailable:\s+(\d+)\s*kB/m);
+      if (match) return Number(match[1]) * 1024;
+    } catch {
+    }
   }
-  if (packageName === "@kynver-app/runtime") {
-    lines.push("Repo-source alternative: npm run kynver:build && npm run kynver");
+  return os.freemem();
+}
+var init_meminfo = __esm({
+  "src/bounded-build/meminfo.ts"() {
+    "use strict";
   }
-  if (effectiveSource === "installed" && repoVersion) {
-    lines.push(`Repo checkout reports ${repoVersion}; rebuild/link repo source if you develop from the monorepo.`);
+});
+
+// src/wsl-host.ts
+import { existsSync as existsSync5, readFileSync as readFileSync6, statfsSync } from "node:fs";
+function isWslHost() {
+  if (process.platform !== "linux") return false;
+  for (const probe of ["/proc/sys/kernel/osrelease", "/proc/version"]) {
+    try {
+      if (!existsSync5(probe)) continue;
+      const text = readFileSync6(probe, "utf8");
+      if (/microsoft|wsl/i.test(text)) return true;
+    } catch {
+    }
   }
-  return lines;
-}
-function pickEffectiveCandidate(candidates) {
-  if (candidates.length === 0) return { version: null, source: "unknown" };
-  const best = maxSemver(candidates.map((candidate) => candidate.version));
-  if (!best) return { version: null, source: "unknown" };
-  const winner = candidates.find((candidate) => candidate.version === best) ?? candidates[0];
-  return { version: winner.version, source: winner.source };
-}
-function evaluateMemoryCostPackageVersionGuard(input = {}) {
-  const normalize2 = (value, fallbackSource) => {
-    if (!value) return null;
-    if (typeof value === "string") return { version: value, source: fallbackSource };
-    return value;
-  };
-  const packages = MEMORY_COST_MANAGED_PACKAGES.map((packageName) => {
-    const minimumVersion = MEMORY_COST_PACKAGE_MIN_VERSIONS[packageName];
-    const candidates = [];
-    const installed = normalize2(input.installed?.[packageName], "installed");
-    const repo = normalize2(input.repo?.[packageName], "repo");
-    const self = normalize2(input.self?.[packageName], "self");
-    if (installed) candidates.push(installed);
-    if (repo) candidates.push(repo);
-    if (self) candidates.push(self);
-    const { version: effectiveVersion, source: effectiveSource } = pickEffectiveCandidate(candidates);
-    const repoVersion = repo?.version ?? null;
-    const ok2 = effectiveVersion ? semverAtLeast(effectiveVersion, minimumVersion) : false;
-    const remediation = ok2 ? [] : buildRemediation({
-      packageName,
-      minimumVersion,
-      effectiveVersion,
-      effectiveSource,
-      repoVersion
-    });
-    const summary2 = ok2 ? `${DISPLAY_NAMES[packageName]} ${effectiveVersion} meets memory-cost minimum ${minimumVersion} (${effectiveSource}).` : `${DISPLAY_NAMES[packageName]} is below memory-cost minimum ${minimumVersion}` + (effectiveVersion ? ` (effective ${effectiveVersion} via ${effectiveSource})` : " (no version detected)") + ".";
-    return {
-      packageName,
-      displayName: DISPLAY_NAMES[packageName],
-      minimumVersion,
-      effectiveVersion,
-      effectiveSource,
-      ok: ok2,
-      summary: summary2,
-      remediation
-    };
-  });
-  const violations = packages.filter((row) => !row.ok);
-  const ok = violations.length === 0;
-  const summary = ok ? "All managed AgentOS packages meet memory-cost minimum versions." : `Memory-cost package guard blocked ${violations.length} stale package(s): ${violations.map((row) => `${row.packageName} < ${row.minimumVersion}`).join("; ")}.`;
-  return { ok, summary, packages };
-}
-var MemoryCostPackageVersionGuardError = class extends Error {
-  result;
-  constructor(result) {
-    const lines = [
-      result.summary,
-      ...result.packages.filter((row) => !row.ok).flatMap((row) => [`- ${row.summary}`, ...row.remediation.map((line) => `  \u2192 ${line}`)])
-    ];
-    super(lines.join("\n"));
-    this.name = "MemoryCostPackageVersionGuardError";
-    this.result = result;
-  }
-};
-function assertMemoryCostPackageVersionGuard(input = {}) {
-  const result = evaluateMemoryCostPackageVersionGuard(input);
-  if (!result.ok) throw new MemoryCostPackageVersionGuardError(result);
-  return result;
-}
-function formatMemoryCostPackageGuardError(result) {
-  return new MemoryCostPackageVersionGuardError(result).message;
-}
-
-// src/installed-package-versions.ts
-import { readFile } from "node:fs/promises";
-import { homedir as homedir3 } from "node:os";
-import path5 from "node:path";
-var MANAGED_PACKAGES = [
-  "@kynver-app/runtime",
-  "@kynver-app/openclaw-agent-os",
-  "@kynver-app/mcp-agent-os"
-];
-function trim(value) {
-  const out = value?.trim();
-  return out ? out : null;
-}
-function unique(values) {
-  return [...new Set(values.filter((value) => Boolean(value)))];
-}
-function moduleRoots() {
-  const home = homedir3();
-  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path5.join(home, ".openclaw", "npm");
-  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path5.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path5.join(home, ".npm-global", "lib", "node_modules"));
-  return unique([
-    path5.join(openClawPrefix, "lib", "node_modules"),
-    path5.join(openClawPrefix, "node_modules"),
-    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path5.join(npmGlobalRoot, "lib", "node_modules")
-  ]);
-}
-async function readVersion(packageJsonPath) {
-  try {
-    const parsed = JSON.parse(await readFile(packageJsonPath, "utf8"));
-    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
-  } catch {
-    return null;
-  }
-}
-function installedPackageJsonCandidates(packageName) {
-  const roots = moduleRoots();
-  const seen = /* @__PURE__ */ new Set();
-  const out = [];
-  for (const root of roots) {
-    const candidate = path5.join(root, packageName, "package.json");
-    if (seen.has(candidate)) continue;
-    seen.add(candidate);
-    out.push(candidate);
-  }
-  return out;
-}
-async function collectInstalledPackageVersions(observedAt = (/* @__PURE__ */ new Date()).toISOString()) {
-  const out = {};
-  for (const packageName of MANAGED_PACKAGES) {
-    let best = null;
-    for (const packageJsonPath of installedPackageJsonCandidates(packageName)) {
-      const version = await readVersion(packageJsonPath);
-      if (!version) continue;
-      if (!best || compareSemver(version, best.version) > 0) {
-        best = { version, path: packageJsonPath };
-      }
-    }
-    if (best) {
-      out[packageName] = { version: best.version, observedAt, path: best.path };
-    }
-  }
-  return out;
-}
-
-// src/memory-cost-package-version-guard-enforce.ts
-function installedVersionMap(observed) {
-  const out = {};
-  for (const [packageName, row] of Object.entries(observed)) {
-    if (!row?.version) continue;
-    out[packageName] = {
-      version: row.version,
-      source: "installed",
-      path: row.path
-    };
-  }
-  return out;
-}
-async function buildMemoryCostPackageGuardInput(input = {}) {
-  const [installed, repo] = await Promise.all([
-    collectInstalledPackageVersions(),
-    Promise.resolve(probeRepoPackageVersions({ cwd: input.cwd, repoRoot: input.repoRoot }))
-  ]);
-  const self = {};
-  const runtimeSelfVersion = input.selfPackageName === "@kynver-app/runtime" && input.selfVersion ? input.selfVersion : PACKAGE_VERSION;
-  self["@kynver-app/runtime"] = { version: runtimeSelfVersion, source: "self" };
-  if (input.selfPackageName && input.selfVersion && input.selfPackageName !== "@kynver-app/runtime") {
-    self[input.selfPackageName] = { version: input.selfVersion, source: "self" };
-  }
-  return {
-    installed: installedVersionMap(installed),
-    repo,
-    self
-  };
-}
-async function evaluateMemoryCostPackageGuardAtStartup(input = {}) {
-  const guardInput = await buildMemoryCostPackageGuardInput(input);
-  return evaluateMemoryCostPackageVersionGuard(guardInput);
-}
-async function enforceMemoryCostPackageGuardAtStartup(input = {}) {
-  const guardInput = await buildMemoryCostPackageGuardInput(input);
-  return assertMemoryCostPackageVersionGuard(guardInput);
-}
-function shouldEnforceMemoryCostPackageGuardCli(scope, action) {
-  if (!scope) return false;
-  if (scope === "daemon") return true;
-  if (scope === "worker") return true;
-  if (scope === "monitor") return true;
-  if (scope === "run" && (action === "dispatch" || action === "sweep" || action === "reconcile" || action === "unblock")) {
-    return true;
-  }
-  if (scope === "cron" && action === "tick") return true;
-  return false;
-}
-
-// src/config.ts
-import { existsSync as existsSync11, mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync2 } from "node:fs";
-import { homedir as homedir5, totalmem } from "node:os";
-import path10 from "node:path";
-
-// src/box-identity.ts
-function normalizeWorkerPoolBoxKind(raw) {
-  const kind = (raw ?? "").trim().toLowerCase();
-  if (kind === "ghost" || kind === "forge") return kind;
-  if (kind.includes("forge")) return "forge";
-  if (kind.includes("ghost") || kind.includes("openclaw")) return "ghost";
-  return "forge";
-}
-function trimEnv(env, key) {
-  const value = env[key]?.trim();
-  return value || null;
-}
-function resolveBoxIdentity(env = process.env, config = {}) {
-  const warnings = [];
-  const configKind = config.boxKind?.trim();
-  if (configKind) {
-    return {
-      boxKind: normalizeWorkerPoolBoxKind(configKind),
-      source: "config",
-      slugInferenceBlocked: false,
-      warnings
-    };
-  }
-  const envKind = trimEnv(env, "KYNVER_BOX_KIND");
-  if (envKind) {
-    return {
-      boxKind: normalizeWorkerPoolBoxKind(envKind),
-      source: "env",
-      slugInferenceBlocked: false,
-      warnings
-    };
-  }
-  const agentOsSlug = trimEnv(env, "KYNVER_AGENT_OS_SLUG");
-  if (agentOsSlug) {
-    warnings.push(
-      `KYNVER_AGENT_OS_SLUG=${agentOsSlug} is a workspace slug, not box identity \u2014 set boxKind via \`kynver setup --box-kind forge|ghost\` or KYNVER_BOX_KIND (defaulting box kind to forge)`
-    );
-  }
-  return {
-    boxKind: "forge",
-    source: "default",
-    slugInferenceBlocked: Boolean(agentOsSlug),
-    warnings
-  };
-}
-function resolveBoxKindFromConfig(config = {}, env = process.env) {
-  return resolveBoxIdentity(env, config).boxKind;
-}
-
-// src/resource-gate.ts
-import os2 from "node:os";
-
-// src/bounded-build/meminfo.ts
-import { readFileSync as readFileSync5 } from "node:fs";
-import os from "node:os";
-function readMemAvailableBytes(meminfoText) {
-  if (meminfoText !== void 0) {
-    const match = meminfoText.match(/^MemAvailable:\s+(\d+)\s*kB/m);
-    if (match) return Number(match[1]) * 1024;
-    return os.freemem();
-  }
-  if (process.platform === "linux") {
-    try {
-      const meminfo = readFileSync5("/proc/meminfo", "utf8");
-      const match = meminfo.match(/^MemAvailable:\s+(\d+)\s*kB/m);
-      if (match) return Number(match[1]) * 1024;
-    } catch {
-    }
-  }
-  return os.freemem();
-}
-
-// src/resource-gate.ts
-import path9 from "node:path";
-
-// src/disk-gate.ts
-import { statfsSync as statfsSync2 } from "node:fs";
-
-// src/wsl-host.ts
-import { existsSync as existsSync5, readFileSync as readFileSync6, statfsSync } from "node:fs";
-var DEFAULT_WSL_HOST_WARN_FREE_BYTES = 25 * 1024 * 1024 * 1024;
-var DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES = 12 * 1024 * 1024 * 1024;
-var DEFAULT_WSL_HOST_MOUNT = "/mnt/c";
-function isWslHost() {
-  if (process.platform !== "linux") return false;
-  for (const probe of ["/proc/sys/kernel/osrelease", "/proc/version"]) {
-    try {
-      if (!existsSync5(probe)) continue;
-      const text = readFileSync6(probe, "utf8");
-      if (/microsoft|wsl/i.test(text)) return true;
-    } catch {
-    }
-  }
-  return false;
+  return false;
 }
 function observeWslHostDisk(options = {}) {
   const wsl = options.forceWsl === void 0 ? isWslHost() : options.forceWsl;
   if (!wsl) return null;
-  const path73 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
+  const path75 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
   const warnBelowBytes = options.wslHostFreeWarnBytes ?? DEFAULT_WSL_HOST_WARN_FREE_BYTES;
   const criticalBelowBytes = options.wslHostFreeCriticalBytes ?? DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES;
   const statfs = options.statfs ?? statfsSync;
   let stats;
   try {
-    stats = statfs(path73);
+    stats = statfs(path75);
   } catch (error) {
     return {
       ok: false,
-      path: path73,
+      path: path75,
       freeBytes: 0,
       totalBytes: 0,
       usedPercent: 100,
       warnBelowBytes,
       criticalBelowBytes,
-      reason: `Windows host disk probe failed at ${path73}: ${error.message}`,
+      reason: `Windows host disk probe failed at ${path75}: ${error.message}`,
       probeError: error.message
     };
   }
@@ -870,11 +562,11 @@ function observeWslHostDisk(options = {}) {
   let reason = null;
   if (!ok) {
     const tag = criticalFree ? "critical" : "warning";
-    reason = `Windows host disk ${path73} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
+    reason = `Windows host disk ${path75} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
   }
   return {
     ok,
-    path: path73,
+    path: path75,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -887,19 +579,25 @@ function observeWslHostDisk(options = {}) {
 function summarizeWslRecoverySteps() {
   return "Recovery: 1) free Windows C: (empty Recycle Bin / Storage Sense / clear %TEMP%); 2) shut down WSL (`wsl --shutdown`) then compact the VHDX (`Optimize-VHD` or `diskpart compact vdisk`); 3) clear local node_modules / .next / harness worktrees before restarting workers. Full runbook: docs/runbooks/wsl-disk-pressure.md.";
 }
+var DEFAULT_WSL_HOST_WARN_FREE_BYTES, DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES, DEFAULT_WSL_HOST_MOUNT;
+var init_wsl_host = __esm({
+  "src/wsl-host.ts"() {
+    "use strict";
+    DEFAULT_WSL_HOST_WARN_FREE_BYTES = 25 * 1024 * 1024 * 1024;
+    DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES = 12 * 1024 * 1024 * 1024;
+    DEFAULT_WSL_HOST_MOUNT = "/mnt/c";
+  }
+});
 
 // src/disk-gate.ts
-var DEFAULT_WARN_FREE_BYTES = 30 * 1024 * 1024 * 1024;
-var DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
-var DEFAULT_MAX_USED_PERCENT = 80;
-var DEFAULT_HARD_MAX_USED_PERCENT = 90;
+import { statfsSync as statfsSync2 } from "node:fs";
 function observeRunnerDiskGate(input = {}) {
-  const path73 = input.diskPath?.trim() || "/";
+  const path75 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync2(path73);
+  const stats = statfsSync2(path75);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -922,7 +620,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path73,
+    path: path75,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -934,17 +632,22 @@ function observeRunnerDiskGate(input = {}) {
     wslHost
   };
 }
-
-// src/run-store.ts
-import { existsSync as existsSync7, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
-import path7 from "node:path";
+var DEFAULT_WARN_FREE_BYTES, DEFAULT_CRITICAL_FREE_BYTES, DEFAULT_MAX_USED_PERCENT, DEFAULT_HARD_MAX_USED_PERCENT;
+var init_disk_gate = __esm({
+  "src/disk-gate.ts"() {
+    "use strict";
+    init_wsl_host();
+    DEFAULT_WARN_FREE_BYTES = 30 * 1024 * 1024 * 1024;
+    DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
+    DEFAULT_MAX_USED_PERCENT = 80;
+    DEFAULT_HARD_MAX_USED_PERCENT = 90;
+  }
+});
 
 // src/paths.ts
 import { existsSync as existsSync6 } from "node:fs";
 import { homedir as homedir4 } from "node:os";
 import path6 from "node:path";
-var LEGACY_ROOT = path6.join(homedir4(), ".openclaw", "harness");
-var HARNESS_LAYOUT_DIR_NAMES = /* @__PURE__ */ new Set(["runs", "worktrees"]);
 function normalizeHarnessRoot(root) {
   let resolved = path6.resolve(resolveUserPath(root.trim()));
   while (HARNESS_LAYOUT_DIR_NAMES.has(path6.basename(resolved))) {
@@ -979,8 +682,21 @@ function getHarnessPaths() {
 function runDir(runsDir, id) {
   return path6.join(runsDir, safeSlug(id));
 }
+var LEGACY_ROOT, HARNESS_LAYOUT_DIR_NAMES;
+var init_paths = __esm({
+  "src/paths.ts"() {
+    "use strict";
+    init_config();
+    init_path_values();
+    init_util();
+    LEGACY_ROOT = path6.join(homedir4(), ".openclaw", "harness");
+    HARNESS_LAYOUT_DIR_NAMES = /* @__PURE__ */ new Set(["runs", "worktrees"]);
+  }
+});
 
 // src/run-store.ts
+import { existsSync as existsSync7, readdirSync as readdirSync2, statSync as statSync2 } from "node:fs";
+import path7 from "node:path";
 function getPaths() {
   return getHarnessPaths();
 }
@@ -1038,6 +754,13 @@ function runDirectory(id) {
 function runDirectoryAt(harnessRoot, id) {
   return runDir(harnessRunsDir(harnessRoot), safeSlug(id));
 }
+var init_run_store = __esm({
+  "src/run-store.ts"() {
+    "use strict";
+    init_paths();
+    init_util();
+  }
+});
 
 // src/run-worker-index.ts
 import { existsSync as existsSync8, readdirSync as readdirSync3 } from "node:fs";
@@ -1055,12 +778,13 @@ function listRunWorkerNames(run) {
   }
   return [...names];
 }
-
-// src/harness-worker-active.ts
-import { readFileSync as readFileSync9 } from "node:fs";
-
-// src/heartbeat.ts
-import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
+var init_run_worker_index = __esm({
+  "src/run-worker-index.ts"() {
+    "use strict";
+    init_run_store();
+    init_util();
+  }
+});
 
 // src/heartbeat-final-result.ts
 function tryParseJsonObject(text) {
@@ -1111,9 +835,14 @@ function terminalFinalResultFromHeartbeatRow(row) {
   if (embedded) return embedded;
   return summary;
 }
+var init_heartbeat_final_result = __esm({
+  "src/heartbeat-final-result.ts"() {
+    "use strict";
+  }
+});
 
 // src/heartbeat.ts
-var HEARTBEAT_FUTURE_SKEW_MS = 6e4;
+import { existsSync as existsSync9, readFileSync as readFileSync7 } from "node:fs";
 function isTerminalHeartbeatPhase(phase) {
   return phase === "complete";
 }
@@ -1176,29 +905,17 @@ function parseHeartbeat(file) {
   }
   return result;
 }
-
-// src/stream.ts
-import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
+var HEARTBEAT_FUTURE_SKEW_MS;
+var init_heartbeat = __esm({
+  "src/heartbeat.ts"() {
+    "use strict";
+    init_heartbeat_final_result();
+    init_util();
+    HEARTBEAT_FUTURE_SKEW_MS = 6e4;
+  }
+});
 
 // src/repo-search.ts
-var RG_BINARIES = /* @__PURE__ */ new Set(["rg", "ripgrep", "grep"]);
-var RG_OPTS_WITH_VALUE = /* @__PURE__ */ new Set([
-  "-e",
-  "--regexp",
-  "-f",
-  "--file",
-  "-m",
-  "--max-count",
-  "-A",
-  "--after-context",
-  "-B",
-  "--before-context",
-  "-C",
-  "--context",
-  "-g",
-  "--glob",
-  "--iglob"
-]);
 function binaryName(token) {
   if (!token) return null;
   const base = token.split("/").pop() ?? token;
@@ -1397,11 +1114,32 @@ function diagnoseRepoSearchFailure(input) {
   }
   return null;
 }
+var RG_BINARIES, RG_OPTS_WITH_VALUE;
+var init_repo_search = __esm({
+  "src/repo-search.ts"() {
+    "use strict";
+    RG_BINARIES = /* @__PURE__ */ new Set(["rg", "ripgrep", "grep"]);
+    RG_OPTS_WITH_VALUE = /* @__PURE__ */ new Set([
+      "-e",
+      "--regexp",
+      "-f",
+      "--file",
+      "-m",
+      "--max-count",
+      "-A",
+      "--after-context",
+      "-B",
+      "--before-context",
+      "-C",
+      "--context",
+      "-g",
+      "--glob",
+      "--iglob"
+    ]);
+  }
+});
 
 // src/shell-command-outcome.ts
-var NPM_AUDIT_RE = /\bnpm\s+audit\b/i;
-var RG_CMD_RE = /\b(rg|ripgrep)\b/i;
-var RG_REAL_ERROR_RE = /\b(error|invalid|unknown|panic|not found)\b/i;
 function tidy(text, max = 200) {
   const one = text.replace(/\s+/g, " ").trim();
   return one.length > max ? `${one.slice(0, max - 1)}\u2026` : one;
@@ -1605,8 +1343,19 @@ function classifyShellCommandOutcome(input) {
     summary: `command failed (exit ${input.exitCode}): ${tail}`
   };
 }
+var NPM_AUDIT_RE, RG_CMD_RE, RG_REAL_ERROR_RE;
+var init_shell_command_outcome = __esm({
+  "src/shell-command-outcome.ts"() {
+    "use strict";
+    init_repo_search();
+    NPM_AUDIT_RE = /\bnpm\s+audit\b/i;
+    RG_CMD_RE = /\b(rg|ripgrep)\b/i;
+    RG_REAL_ERROR_RE = /\b(error|invalid|unknown|panic|not found)\b/i;
+  }
+});
 
 // src/stream.ts
+import { existsSync as existsSync10, readFileSync as readFileSync8 } from "node:fs";
 function eventTimestampIso(event) {
   const tsMs = event.timestamp_ms;
   return event.timestamp || event.ts || (tsMs ? new Date(tsMs).toISOString() : void 0);
@@ -1775,38 +1524,15 @@ function summarizeEvent(event) {
   }
   return void 0;
 }
+var init_stream = __esm({
+  "src/stream.ts"() {
+    "use strict";
+    init_shell_command_outcome();
+    init_util();
+  }
+});
 
 // src/exit-classify.ts
-var FAILURE_PATTERNS = [
-  {
-    test: /\b(?:invalid|unknown|unsupported|unrecognized)\b[^.\n]*\bmodel\b/i,
-    label: "provider rejected the requested model"
-  },
-  {
-    test: /\bmodel\b[^.\n]*\b(?:not\s+(?:found|supported|available|recognized|valid)|is\s+not\s+valid|does\s+not\s+exist)/i,
-    label: "provider rejected the requested model"
-  },
-  {
-    test: /\b(?:did you mean|available models|choose (?:a|one of)|supported models)\b/i,
-    label: "provider rejected the requested model"
-  },
-  {
-    test: /model preflight failed/i,
-    label: "model/provider preflight failed"
-  },
-  {
-    test: /\b(?:command not found|ENOENT|is the .*CLI on PATH|executable not found|no such file or directory)\b/i,
-    label: "provider CLI is missing or not on PATH"
-  },
-  {
-    test: /\bfailed to spawn\b/i,
-    label: "provider failed to spawn the worker process"
-  },
-  {
-    test: /\b(?:not logged in|unauthorized|authentication (?:failed|required)|invalid api key|missing api key|401)\b/i,
-    label: "provider authentication failed"
-  }
-];
 function tidy2(errorText, max = 240) {
   const oneLine2 = errorText.replace(/\s+/g, " ").trim();
   return oneLine2.length > max ? `${oneLine2.slice(0, max - 1)}\u2026` : oneLine2;
@@ -1819,8 +1545,44 @@ function classifyExitFailure(errorText) {
       return { blocked: true, reason: `${pattern.label}: ${tidy2(text)}` };
     }
   }
-  return null;
-}
+  return null;
+}
+var FAILURE_PATTERNS;
+var init_exit_classify = __esm({
+  "src/exit-classify.ts"() {
+    "use strict";
+    FAILURE_PATTERNS = [
+      {
+        test: /\b(?:invalid|unknown|unsupported|unrecognized)\b[^.\n]*\bmodel\b/i,
+        label: "provider rejected the requested model"
+      },
+      {
+        test: /\bmodel\b[^.\n]*\b(?:not\s+(?:found|supported|available|recognized|valid)|is\s+not\s+valid|does\s+not\s+exist)/i,
+        label: "provider rejected the requested model"
+      },
+      {
+        test: /\b(?:did you mean|available models|choose (?:a|one of)|supported models)\b/i,
+        label: "provider rejected the requested model"
+      },
+      {
+        test: /model preflight failed/i,
+        label: "model/provider preflight failed"
+      },
+      {
+        test: /\b(?:command not found|ENOENT|is the .*CLI on PATH|executable not found|no such file or directory)\b/i,
+        label: "provider CLI is missing or not on PATH"
+      },
+      {
+        test: /\bfailed to spawn\b/i,
+        label: "provider failed to spawn the worker process"
+      },
+      {
+        test: /\b(?:not logged in|unauthorized|authentication (?:failed|required)|invalid api key|missing api key|401)\b/i,
+        label: "provider authentication failed"
+      }
+    ];
+  }
+});
 
 // src/exited-salvage.ts
 function trimOrNull(value) {
@@ -1879,6 +1641,11 @@ function assessExitedWorkerSalvage(input) {
     attentionReason: buildAttentionReason(kind, uncommittedCount, headCommit)
   };
 }
+var init_exited_salvage = __esm({
+  "src/exited-salvage.ts"() {
+    "use strict";
+  }
+});
 
 // src/landing-gate.ts
 function trimOrNull2(value) {
@@ -1924,6 +1691,11 @@ function landingAttentionReason(verdict) {
   if (!verdict.blocked) return void 0;
   return verdict.detail ?? verdict.reason ?? "dirty_worktree_no_pr";
 }
+var init_landing_gate = __esm({
+  "src/landing-gate.ts"() {
+    "use strict";
+  }
+});
 
 // src/worker-final-result-embed.ts
 function tryParseJsonObject2(text) {
@@ -1973,6 +1745,11 @@ function extractEmbeddedWorkerFinalResultRecord(value) {
   }
   return best;
 }
+var init_worker_final_result_embed = __esm({
+  "src/worker-final-result-embed.ts"() {
+    "use strict";
+  }
+});
 
 // src/landing-contract-gate.ts
 function trimOrNull3(value) {
@@ -2132,10 +1909,14 @@ function landingContractAttentionReason(verdict) {
   if (!verdict.blocked) return void 0;
   return verdict.detail ?? verdict.reason;
 }
+var init_landing_contract_gate = __esm({
+  "src/landing-contract-gate.ts"() {
+    "use strict";
+    init_worker_final_result_embed();
+  }
+});
 
 // src/status.ts
-var NO_START_MS = 18e4;
-var STALE_MS = 6e5;
 function computeAttention(input) {
   const now = Date.now();
   if (input.completionBlocker && !isSkippedTerminalCompletionBlocker(input.completionBlocker)) {
@@ -2327,7 +2108,15 @@ function computeWorkerStatus(worker, options = {}) {
     changedFiles,
     gitAncestry,
     instructionPolicyFingerprint: worker.instructionPolicyFingerprint ?? null,
-    instructionPolicyEvidence: worker.instructionPolicyEvidence ?? null
+    instructionPolicyEvidence: worker.instructionPolicyEvidence ?? null,
+    model: worker.model ?? worker.orchestrationAudit?.model ?? null,
+    provider: worker.orchestrationAudit?.provider ?? null,
+    boxKind: worker.boxKind ?? null,
+    boxId: worker.boxId ?? null,
+    runtimeId: worker.runtimeId ?? null,
+    personaSlug: worker.personaSlug ?? null,
+    dispatched: worker.dispatched ?? null,
+    localOnly: worker.localOnly ?? null
   };
 }
 function isFinishedWorkerStatus(status) {
@@ -2349,8 +2138,26 @@ function deriveRunStatus(fallback, workers) {
   if (workers.some((w) => w.status === "running")) return "running";
   return fallback;
 }
+var NO_START_MS, STALE_MS;
+var init_status = __esm({
+  "src/status.ts"() {
+    "use strict";
+    init_heartbeat();
+    init_stream();
+    init_exit_classify();
+    init_exited_salvage();
+    init_git();
+    init_landing_gate();
+    init_landing_contract_gate();
+    init_worker_final_result_embed();
+    init_util();
+    NO_START_MS = 18e4;
+    STALE_MS = 6e5;
+  }
+});
 
 // src/harness-worker-active.ts
+import { readFileSync as readFileSync9 } from "node:fs";
 function pidCommandLine(pid) {
   if (!pid || process.platform !== "linux") return null;
   try {
@@ -2376,12 +2183,16 @@ function isActiveHarnessWorker(worker) {
   if (status.alive && !workerProcessMatchesRecord(worker)) return false;
   return status.alive && !status.finalResult && status.attention.state !== "done";
 }
+var init_harness_worker_active = __esm({
+  "src/harness-worker-active.ts"() {
+    "use strict";
+    init_status();
+  }
+});
 
 // src/resource-gate.ts
-var DEFAULT_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
-var DEFAULT_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
-var DEFAULT_MEM_UTILIZATION = 0.85;
-var AUTO_MAX_WORKERS_CEILING = 64;
+import os2 from "node:os";
+import path9 from "node:path";
 function positiveInt(value, fallback) {
   const n = Number(value);
   if (!Number.isFinite(n) || n <= 0) return fallback;
@@ -2487,6 +2298,25 @@ function observeRunnerResourceGate(input) {
     ...diskGate ? { diskGate } : {}
   };
 }
+var DEFAULT_PER_WORKER_MEM_BYTES, DEFAULT_MEM_RESERVE_BYTES, DEFAULT_MEM_UTILIZATION, AUTO_MAX_WORKERS_CEILING;
+var init_resource_gate = __esm({
+  "src/resource-gate.ts"() {
+    "use strict";
+    init_meminfo();
+    init_config();
+    init_box_identity();
+    init_worker_cap_source();
+    init_disk_gate();
+    init_run_store();
+    init_run_worker_index();
+    init_harness_worker_active();
+    init_util();
+    DEFAULT_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
+    DEFAULT_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
+    DEFAULT_MEM_UTILIZATION = 0.85;
+    AUTO_MAX_WORKERS_CEILING = 64;
+  }
+});
 
 // src/worker-cap-source.ts
 function positiveInt2(value, fallback) {
@@ -2534,357 +2364,819 @@ function resolveWorkerCap(input) {
       workerCapSource: "env"
     };
   }
-  return {
-    configuredMaxWorkers: null,
-    autoCap,
-    workerCapSource: "auto"
-  };
+  return {
+    configuredMaxWorkers: null,
+    autoCap,
+    workerCapSource: "auto"
+  };
+}
+function recommendSetupWorkerCap(input = {}) {
+  const totalMemBytes = input.totalMemBytes ?? 0;
+  const autoCap = computeAutoMaxWorkers(totalMemBytes, {
+    perWorkerMemBytes: positiveInt2(input.config?.perWorkerMemBytes, DEFAULT_PER_WORKER_MEM_BYTES),
+    memReserveBytes: positiveInt2(input.config?.memReserveBytes, DEFAULT_MEM_RESERVE_BYTES),
+    memUtilization: input.config?.memUtilization && Number(input.config.memUtilization) > 0 ? Number(input.config.memUtilization) : DEFAULT_MEM_UTILIZATION
+  });
+  const diskGateOk = input.diskGateOk ?? true;
+  const recommendedMaxWorkers = diskGateOk ? autoCap : Math.max(1, Math.min(autoCap, 4));
+  return {
+    totalMemBytes,
+    autoCap,
+    recommendedMaxWorkers,
+    diskPath: input.diskPath ?? "/",
+    diskGateOk,
+    diskFreeBytes: input.diskFreeBytes ?? null
+  };
+}
+var init_worker_cap_source = __esm({
+  "src/worker-cap-source.ts"() {
+    "use strict";
+    init_resource_gate();
+  }
+});
+
+// src/device-login.ts
+var device_login_exports = {};
+__export(device_login_exports, {
+  runDeviceLogin: () => runDeviceLogin
+});
+import os3 from "node:os";
+function resolveDeviceBaseUrl(args) {
+  const raw = (typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0) || (typeof args.baseUrl === "string" ? args.baseUrl : void 0) || process.env.KYNVER_API_URL || loadUserConfig().apiBaseUrl;
+  return raw ? trimTrailingSlash(String(raw)) : void 0;
+}
+async function sleep(ms) {
+  await new Promise((resolve2) => setTimeout(resolve2, ms));
+}
+async function runDeviceLogin(args) {
+  const base = resolveDeviceBaseUrl(args);
+  if (!base) {
+    console.error(
+      "kynver login (device flow) requires a Kynver URL \u2014 pass --api-base-url https://your-kynver-site, set KYNVER_API_URL, or run `kynver setup` first."
+    );
+    return { ok: false };
+  }
+  const clientName = `${os3.hostname()} (${os3.platform()})`;
+  let start;
+  try {
+    const res = await fetch(`${base}/api/auth/device/code`, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: JSON.stringify({ clientName })
+    });
+    if (!res.ok) {
+      console.error(`Could not start device authorization (${res.status}).`);
+      return { ok: false };
+    }
+    start = await res.json();
+  } catch (err) {
+    console.error(`Could not reach ${base}: ${err.message}`);
+    return { ok: false };
+  }
+  const verifyUrl = start.verification_uri_complete || start.verification_uri;
+  console.log("");
+  console.log("  Authorize this machine:");
+  console.log(`    1. Open: ${verifyUrl}`);
+  console.log(`    2. Confirm the code: ${start.user_code}`);
+  console.log("");
+  console.log("  Waiting for approval\u2026");
+  const deadline = Date.now() + start.expires_in * 1e3;
+  let intervalMs = Math.max(1, start.interval) * 1e3;
+  while (Date.now() < deadline) {
+    await sleep(intervalMs);
+    let body;
+    try {
+      const res = await fetch(`${base}/api/auth/device/token`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+        body: JSON.stringify({ device_code: start.device_code })
+      });
+      body = await res.json().catch(() => ({}));
+    } catch {
+      continue;
+    }
+    switch (body.status) {
+      case "approved":
+        if (body.api_key) {
+          saveApiKey(body.api_key);
+          console.log("  Approved \u2014 this machine is now linked to your Kynver account.");
+          return { ok: true, apiKey: body.api_key };
+        }
+        return { ok: false };
+      case "slow_down":
+        intervalMs += 2e3;
+        break;
+      case "authorization_pending":
+        if (typeof body.interval === "number") intervalMs = Math.max(intervalMs, body.interval * 1e3);
+        break;
+      case "access_denied":
+        console.error("  Request was denied in the browser.");
+        return { ok: false };
+      case "expired_token":
+        console.error("  The code expired before it was approved. Run `kynver login` again.");
+        return { ok: false };
+      default:
+        break;
+    }
+  }
+  console.error("  Timed out waiting for approval. Run `kynver login` again.");
+  return { ok: false };
+}
+var init_device_login = __esm({
+  "src/device-login.ts"() {
+    "use strict";
+    init_config();
+    init_util();
+  }
+});
+
+// src/config.ts
+import { existsSync as existsSync11, mkdirSync as mkdirSync2, readFileSync as readFileSync10, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir5, totalmem } from "node:os";
+import path10 from "node:path";
+import os4 from "node:os";
+function loadUserConfig() {
+  if (!existsSync11(CONFIG_FILE)) return {};
+  try {
+    return JSON.parse(readFileSync10(CONFIG_FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function saveUserConfig(config) {
+  mkdirSync2(CONFIG_DIR, { recursive: true });
+  writeFileSync2(CONFIG_FILE, `${JSON.stringify(normalizeConfigPaths(config), null, 2)}
+`, { mode: 384 });
+}
+function normalizeConfigPaths(config) {
+  return {
+    ...config,
+    ...config.harnessRoot?.trim() ? { harnessRoot: redactHomePath(config.harnessRoot.trim()) } : {},
+    ...config.defaultRepo?.trim() ? { defaultRepo: redactHomePath(config.defaultRepo.trim()) } : {}
+  };
+}
+function presentUserConfig(config) {
+  return normalizeConfigPaths(config);
+}
+function inferSetupFields(existing, args) {
+  const creds = loadCredentialsFile();
+  const apiBaseUrl = (typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0) || existing.apiBaseUrl?.trim() || process.env.KYNVER_API_URL?.trim() || process.env.KYNVER_CRON_FIRE_BASE_URL?.trim() || process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim();
+  const agentOsId = (typeof args.agentOsId === "string" ? args.agentOsId : void 0) || existing.agentOsId?.trim() || process.env.KYNVER_AGENT_OS_ID?.trim() || (creds.runnerToken?.trim().startsWith("krc1.") ? creds.runnerTokenAgentOsId?.trim() : void 0);
+  const explicitRepo = typeof args.repo === "string" ? args.repo : args.discoverRepo === true || args.discoverRepo === "true" ? discoverDefaultRepo()?.repo : void 0;
+  const defaultRepo = explicitRepo || existing.defaultRepo?.trim() || process.env.KYNVER_DEFAULT_REPO?.trim() || process.env.KYNVER_HARNESS_REPO?.trim() || discoverDefaultRepo()?.repo;
+  const harnessRoot = (typeof args.harnessRoot === "string" ? args.harnessRoot : void 0) || existing.harnessRoot?.trim() || process.env.KYNVER_HARNESS_ROOT?.trim() || process.env.OPUS_HARNESS_ROOT?.trim();
+  return {
+    ...apiBaseUrl ? { apiBaseUrl: trimTrailingSlash(apiBaseUrl) } : {},
+    ...agentOsId ? { agentOsId } : {},
+    ...defaultRepo ? { defaultRepo } : {},
+    ...harnessRoot ? { harnessRoot } : {},
+    ...typeof args.agentOsSlug === "string" ? { agentOsSlug: args.agentOsSlug } : existing.agentOsSlug ? { agentOsSlug: existing.agentOsSlug } : {}
+  };
+}
+function resolveSetupWorkerConfig(existing, args, totalMemBytes = totalmem()) {
+  const maxWorkersRaw = typeof args.maxWorkers === "string" ? args.maxWorkers : typeof args.maxConcurrentWorkers === "string" ? args.maxConcurrentWorkers : void 0;
+  const explicitBoxKindArg = typeof args.boxKind === "string" ? args.boxKind : typeof args["box-kind"] === "string" ? String(args["box-kind"]) : void 0;
+  const boxKind = resolveBoxIdentity(process.env, {
+    ...existing,
+    ...explicitBoxKindArg ? { boxKind: normalizeWorkerPoolBoxKind(explicitBoxKindArg) } : {}
+  }).boxKind;
+  const diskGate = observeRunnerDiskGate({
+    diskPath: typeof args.diskPath === "string" ? args.diskPath : "/"
+  });
+  const capRecommendation = recommendSetupWorkerCap({
+    totalMemBytes,
+    diskPath: diskGate.path,
+    diskGateOk: diskGate.ok,
+    diskFreeBytes: diskGate.freeBytes,
+    config: existing
+  });
+  if (maxWorkersRaw) {
+    return {
+      maxConcurrentWorkers: Math.max(1, Math.floor(Number(maxWorkersRaw))),
+      maxConcurrentWorkersSource: "setup-flag",
+      boxKind
+    };
+  }
+  if (existing.maxConcurrentWorkers !== void 0 && existing.maxConcurrentWorkers !== null) {
+    return {
+      maxConcurrentWorkers: Math.max(1, Math.floor(Number(existing.maxConcurrentWorkers))),
+      maxConcurrentWorkersSource: existing.maxConcurrentWorkersSource ?? "operator",
+      boxKind
+    };
+  }
+  return {
+    maxConcurrentWorkers: capRecommendation.recommendedMaxWorkers,
+    maxConcurrentWorkersSource: "setup-auto",
+    boxKind
+  };
+}
+function loadCredentialsFile() {
+  if (!existsSync11(CREDENTIALS_FILE)) return {};
+  try {
+    return JSON.parse(readFileSync10(CREDENTIALS_FILE, "utf8"));
+  } catch {
+    return {};
+  }
+}
+function saveCredentialsFile(parsed) {
+  mkdirSync2(CONFIG_DIR, { recursive: true });
+  writeFileSync2(CREDENTIALS_FILE, `${JSON.stringify(parsed, null, 2)}
+`, { mode: 384 });
+}
+function loadApiKey() {
+  if (process.env.KYNVER_API_KEY) return process.env.KYNVER_API_KEY;
+  return loadCredentialsFile().apiKey;
+}
+function saveApiKey(apiKey) {
+  saveCredentialsFile({ ...loadCredentialsFile(), apiKey });
+}
+function loadRunnerToken(agentOsId) {
+  const envToken = process.env.KYNVER_RUNNER_TOKEN?.trim();
+  if (envToken) return envToken;
+  const creds = loadCredentialsFile();
+  if (!creds.runnerToken) return void 0;
+  if (agentOsId && creds.runnerTokenAgentOsId && creds.runnerTokenAgentOsId !== agentOsId) {
+    return void 0;
+  }
+  return creds.runnerToken;
+}
+function saveRunnerToken(agentOsId, token) {
+  saveCredentialsFile({
+    ...loadCredentialsFile(),
+    runnerToken: token,
+    runnerTokenAgentOsId: agentOsId
+  });
+}
+function resolveBaseUrl(argsBaseUrl) {
+  const baseUrl = resolveConfiguredBaseUrl(argsBaseUrl);
+  if (!baseUrl) failConfig("requires --base-url, KYNVER_API_URL, KYNVER_CRON_FIRE_BASE_URL, or ~/.kynver/config.json apiBaseUrl");
+  return baseUrl;
+}
+function resolveConfiguredBaseUrl(argsBaseUrl) {
+  const baseUrl = argsBaseUrl || process.env.KYNVER_API_URL || process.env.KYNVER_CRON_FIRE_BASE_URL || process.env.OPENCLAW_CRON_FIRE_BASE_URL || loadUserConfig().apiBaseUrl;
+  return baseUrl ? trimTrailingSlash(String(baseUrl)) : void 0;
+}
+function resolveConfiguredCallbackSecret(argsSecret, agentOsId) {
+  const scoped = argsSecret || loadRunnerToken(agentOsId) || (agentOsId ? void 0 : loadRunnerToken(loadUserConfig().agentOsId));
+  if (scoped) return String(scoped);
+  const globalSecret = process.env.KYNVER_RUNTIME_SECRET || process.env.KYNVER_CRON_SECRET || process.env.OPENCLAW_CRON_SECRET;
+  if (globalSecret) {
+    console.warn(
+      "[kynver] using deployment-level callback secret; run `kynver runner credential --agent-os-id <id>` for a scoped token"
+    );
+    return String(globalSecret);
+  }
+  return void 0;
+}
+function resolveCallbackSecret(argsSecret, agentOsId) {
+  const configured = resolveConfiguredCallbackSecret(argsSecret, agentOsId);
+  if (configured) return configured;
+  failConfig(
+    "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / KYNVER_CRON_SECRET / OPENCLAW_CRON_SECRET"
+  );
+}
+async function resolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
+  const configured = resolveConfiguredCallbackSecret(argsSecret, agentOsId);
+  if (configured) return configured;
+  const apiKey = loadApiKey();
+  const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
+  if (apiKey && agentOsId && baseUrl) {
+    try {
+      const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
+      saveRunnerToken(agentOsId, token);
+      return token;
+    } catch (error) {
+      failConfig(`runner credential mint failed: ${error.message}`);
+    }
+  }
+  failConfig(
+    "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / KYNVER_CRON_SECRET / OPENCLAW_CRON_SECRET"
+  );
+}
+async function refreshRunnerToken(agentOsId, opts) {
+  const apiKey = loadApiKey();
+  const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
+  if (!apiKey || !agentOsId || !baseUrl) return null;
+  try {
+    const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
+    saveRunnerToken(agentOsId, token);
+    return token;
+  } catch {
+    return null;
+  }
+}
+async function refreshRunnerTokenForAuthFailure(rejectedSecret, agentOsId, opts) {
+  const apiKey = loadApiKey();
+  const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
+  if (!apiKey) return { ok: false, reason: "KYNVER_API_KEY is required to refresh a rejected runner token" };
+  if (!agentOsId) return { ok: false, reason: "agentOsId is required to refresh a rejected runner token" };
+  if (!baseUrl) return { ok: false, reason: "KYNVER_API_URL or --base-url is required to refresh a rejected runner token" };
+  try {
+    const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
+    if (token && token !== rejectedSecret) {
+      saveRunnerToken(agentOsId, token);
+      return { ok: true, token };
+    }
+    return { ok: false, reason: "runner credential refresh returned the rejected token" };
+  } catch (error) {
+    return { ok: false, reason: error.message };
+  }
 }
-function recommendSetupWorkerCap(input = {}) {
-  const totalMemBytes = input.totalMemBytes ?? 0;
-  const autoCap = computeAutoMaxWorkers(totalMemBytes, {
-    perWorkerMemBytes: positiveInt2(input.config?.perWorkerMemBytes, DEFAULT_PER_WORKER_MEM_BYTES),
-    memReserveBytes: positiveInt2(input.config?.memReserveBytes, DEFAULT_MEM_RESERVE_BYTES),
-    memUtilization: input.config?.memUtilization && Number(input.config.memUtilization) > 0 ? Number(input.config.memUtilization) : DEFAULT_MEM_UTILIZATION
+async function fetchRunnerCredential(agentOsId, opts) {
+  const apiKey = opts?.apiKey || loadApiKey();
+  if (!apiKey) throw new Error("API key required \u2014 run `kynver login` first");
+  const base = resolveBaseUrl(opts?.baseUrl);
+  const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/runner-credentials`;
+  const res = await fetch(url, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`
+    },
+    body: JSON.stringify({})
   });
-  const diskGateOk = input.diskGateOk ?? true;
-  const recommendedMaxWorkers = diskGateOk ? autoCap : Math.max(1, Math.min(autoCap, 4));
-  return {
-    totalMemBytes,
-    autoCap,
-    recommendedMaxWorkers,
-    diskPath: input.diskPath ?? "/",
-    diskGateOk,
-    diskFreeBytes: input.diskFreeBytes ?? null
-  };
-}
-
-// src/config.ts
-import os3 from "node:os";
-var CONFIG_DIR = path10.join(homedir5(), ".kynver");
-var CONFIG_FILE = path10.join(CONFIG_DIR, "config.json");
-var CREDENTIALS_FILE = path10.join(CONFIG_DIR, "credentials");
-function loadUserConfig() {
-  if (!existsSync11(CONFIG_FILE)) return {};
+  const text = await res.text();
+  let parsed = null;
   try {
-    return JSON.parse(readFileSync10(CONFIG_FILE, "utf8"));
+    parsed = JSON.parse(text);
   } catch {
-    return {};
+    parsed = null;
   }
+  if (!res.ok || !parsed?.token) {
+    throw new Error(
+      `runner credential mint failed (${res.status}): ${parsed?.error ?? text.slice(0, 200)}`
+    );
+  }
+  return parsed.token;
 }
-function saveUserConfig(config) {
-  mkdirSync2(CONFIG_DIR, { recursive: true });
-  writeFileSync2(CONFIG_FILE, `${JSON.stringify(normalizeConfigPaths(config), null, 2)}
-`, { mode: 384 });
-}
-function normalizeConfigPaths(config) {
-  return {
-    ...config,
-    ...config.harnessRoot?.trim() ? { harnessRoot: redactHomePath(config.harnessRoot.trim()) } : {},
-    ...config.defaultRepo?.trim() ? { defaultRepo: redactHomePath(config.defaultRepo.trim()) } : {}
-  };
+async function mintRunnerCredential(args) {
+  const agentOsId = (args.agentOsId ? String(args.agentOsId) : loadUserConfig().agentOsId) || "";
+  if (!agentOsId) failConfig("runner credential requires --agent-os-id or agentOsId in ~/.kynver/config.json");
+  try {
+    const token = await fetchRunnerCredential(agentOsId, {
+      baseUrl: args.baseUrl ? String(args.baseUrl) : void 0
+    });
+    saveRunnerToken(agentOsId, token);
+    console.log(
+      JSON.stringify(
+        {
+          ok: true,
+          agentOsId,
+          credentialsPath: displayUserPath(CREDENTIALS_FILE),
+          tokenPrefix: `${token.slice(0, 12)}\u2026`,
+          note: "Scoped runner token saved; callbacks use X-Kynver-Runner-Token."
+        },
+        null,
+        2
+      )
+    );
+  } catch (err) {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(1);
+  }
 }
-function presentUserConfig(config) {
-  return normalizeConfigPaths(config);
+function failConfig(message) {
+  console.error(message);
+  process.exit(1);
 }
-function inferSetupFields(existing, args) {
-  const creds = loadCredentialsFile();
-  const apiBaseUrl = (typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0) || existing.apiBaseUrl?.trim() || process.env.KYNVER_API_URL?.trim() || process.env.KYNVER_CRON_FIRE_BASE_URL?.trim() || process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim();
-  const agentOsId = (typeof args.agentOsId === "string" ? args.agentOsId : void 0) || existing.agentOsId?.trim() || process.env.KYNVER_AGENT_OS_ID?.trim() || (creds.runnerToken?.trim().startsWith("krc1.") ? creds.runnerTokenAgentOsId?.trim() : void 0);
-  const explicitRepo = typeof args.repo === "string" ? args.repo : args.discoverRepo === true || args.discoverRepo === "true" ? discoverDefaultRepo()?.repo : void 0;
-  const defaultRepo = explicitRepo || existing.defaultRepo?.trim() || process.env.KYNVER_DEFAULT_REPO?.trim() || process.env.KYNVER_HARNESS_REPO?.trim() || discoverDefaultRepo()?.repo;
-  const harnessRoot = (typeof args.harnessRoot === "string" ? args.harnessRoot : void 0) || existing.harnessRoot?.trim() || process.env.KYNVER_HARNESS_ROOT?.trim() || process.env.OPUS_HARNESS_ROOT?.trim();
-  return {
-    ...apiBaseUrl ? { apiBaseUrl: trimTrailingSlash(apiBaseUrl) } : {},
-    ...agentOsId ? { agentOsId } : {},
-    ...defaultRepo ? { defaultRepo } : {},
-    ...harnessRoot ? { harnessRoot } : {},
-    ...typeof args.agentOsSlug === "string" ? { agentOsSlug: args.agentOsSlug } : existing.agentOsSlug ? { agentOsSlug: existing.agentOsSlug } : {}
-  };
+function parseArgs(argv) {
+  const args = {};
+  for (let i = 0; i < argv.length; i++) {
+    const item = argv[i];
+    if (!item.startsWith("--")) continue;
+    const key = item.slice(2).replace(/-([a-z])/g, (_, c) => c.toUpperCase());
+    const next = argv[i + 1];
+    if (!next || next.startsWith("--")) args[key] = true;
+    else {
+      args[key] = next;
+      i++;
+    }
+  }
+  return args;
 }
-var SETUP_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
-var SETUP_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
-function resolveSetupWorkerConfig(existing, args, totalMemBytes = totalmem()) {
-  const maxWorkersRaw = typeof args.maxWorkers === "string" ? args.maxWorkers : typeof args.maxConcurrentWorkers === "string" ? args.maxConcurrentWorkers : void 0;
-  const explicitBoxKindArg = typeof args.boxKind === "string" ? args.boxKind : typeof args["box-kind"] === "string" ? String(args["box-kind"]) : void 0;
-  const boxKind = resolveBoxIdentity(process.env, {
-    ...existing,
-    ...explicitBoxKindArg ? { boxKind: normalizeWorkerPoolBoxKind(explicitBoxKindArg) } : {}
-  }).boxKind;
+async function runSetup(args) {
+  const existing = loadUserConfig();
   const diskGate = observeRunnerDiskGate({
     diskPath: typeof args.diskPath === "string" ? args.diskPath : "/"
   });
   const capRecommendation = recommendSetupWorkerCap({
-    totalMemBytes,
+    totalMemBytes: os4.totalmem(),
     diskPath: diskGate.path,
     diskGateOk: diskGate.ok,
     diskFreeBytes: diskGate.freeBytes,
     config: existing
   });
-  if (maxWorkersRaw) {
-    return {
-      maxConcurrentWorkers: Math.max(1, Math.floor(Number(maxWorkersRaw))),
-      maxConcurrentWorkersSource: "setup-flag",
-      boxKind
-    };
+  const workerConfig = resolveSetupWorkerConfig(existing, args);
+  const config = normalizeConfigPaths({
+    ...existing,
+    ...inferSetupFields(existing, args),
+    ...workerConfig,
+    workerProvider: typeof args.provider === "string" ? args.provider : existing.workerProvider || "cursor"
+  });
+  saveUserConfig(config);
+  const boxIdentity = resolveBoxIdentity(process.env, config);
+  let runnerCredentialNote;
+  const apiKey = loadApiKey();
+  const agentOsId = config.agentOsId;
+  if (apiKey && agentOsId) {
+    try {
+      const token = await fetchRunnerCredential(agentOsId, {
+        baseUrl: typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : config.apiBaseUrl,
+        apiKey
+      });
+      saveRunnerToken(agentOsId, token);
+      runnerCredentialNote = "Scoped runner token minted and saved to ~/.kynver/credentials.";
+    } catch {
+      runnerCredentialNote = "Runner token not minted (server offline or master secret unset). Run `kynver runner credential` after deploy.";
+    }
+  }
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        configPath: displayUserPath(CONFIG_FILE),
+        config: presentUserConfig(config),
+        boxKind: config.boxKind,
+        boxKindSource: boxIdentity.source,
+        workerCapRecommendation: capRecommendation,
+        ...boxIdentity.warnings.length ? { boxIdentityWarnings: boxIdentity.warnings } : {},
+        note: runnerCredentialNote ?? "boxKind and maxConcurrentWorkers persisted; override with --box-kind and --max-workers. Run `kynver login` + `kynver runner credential` for scoped callbacks."
+      },
+      null,
+      2
+    )
+  );
+}
+async function runLogin(args) {
+  const apiKey = typeof args.apiKey === "string" ? args.apiKey : process.env.KYNVER_API_KEY;
+  if (apiKey) {
+    saveApiKey(apiKey);
+    console.log(JSON.stringify({ ok: true, credentialsPath: displayUserPath(CREDENTIALS_FILE) }, null, 2));
+    return;
+  }
+  const { runDeviceLogin: runDeviceLogin2 } = await Promise.resolve().then(() => (init_device_login(), device_login_exports));
+  const result = await runDeviceLogin2(args);
+  if (!result.ok) process.exit(1);
+  console.log(JSON.stringify({ ok: true, credentialsPath: displayUserPath(CREDENTIALS_FILE) }, null, 2));
+}
+var CONFIG_DIR, CONFIG_FILE, CREDENTIALS_FILE, SETUP_PER_WORKER_MEM_BYTES, SETUP_MEM_RESERVE_BYTES;
+var init_config = __esm({
+  "src/config.ts"() {
+    "use strict";
+    init_default_repo_discovery();
+    init_path_values();
+    init_util();
+    init_box_identity();
+    init_worker_cap_source();
+    init_disk_gate();
+    CONFIG_DIR = path10.join(homedir5(), ".kynver");
+    CONFIG_FILE = path10.join(CONFIG_DIR, "config.json");
+    CREDENTIALS_FILE = path10.join(CONFIG_DIR, "credentials");
+    SETUP_PER_WORKER_MEM_BYTES = 500 * 1024 * 1024;
+    SETUP_MEM_RESERVE_BYTES = 4 * 1024 * 1024 * 1024;
+  }
+});
+
+// src/package-version.ts
+import { existsSync, readFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+function resolvePackageRoot(moduleUrl) {
+  let dir = dirname(fileURLToPath(moduleUrl));
+  for (let depth = 0; depth < 6; depth += 1) {
+    if (existsSync(join(dir, "package.json"))) return dir;
+    const parent = dirname(dir);
+    if (parent === dir) break;
+    dir = parent;
+  }
+  throw new Error(`package.json not found above ${dirname(fileURLToPath(moduleUrl))}`);
+}
+function readOwnPackageVersion(moduleUrl = import.meta.url) {
+  const pkgPath = join(resolvePackageRoot(moduleUrl), "package.json");
+  const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+  if (typeof pkg.version !== "string" || !pkg.version.trim()) {
+    throw new Error(`Missing package.json version at ${pkgPath}`);
+  }
+  return pkg.version;
+}
+var PACKAGE_VERSION = readOwnPackageVersion();
+function wantsCliVersion(argv) {
+  return argv.some((arg) => arg === "--version" || arg === "-v");
+}
+function printCliVersionAndExit(version, binName) {
+  console.log(binName ? `${binName} ${version}` : version);
+  process.exit(0);
+}
+function handleCliVersionFlag(argv, moduleUrl = import.meta.url, binName) {
+  if (!wantsCliVersion(argv)) return false;
+  printCliVersionAndExit(readOwnPackageVersion(moduleUrl), binName);
+  return true;
+}
+
+// src/memory-cost-package-version-guard.ts
+init_default_repo_discovery();
+import { existsSync as existsSync4, readFileSync as readFileSync4 } from "node:fs";
+import path4 from "node:path";
+var MEMORY_COST_PACKAGE_MIN_VERSIONS = {
+  "@kynver-app/runtime": "0.1.83",
+  "@kynver-app/openclaw-agent-os": "0.1.43",
+  "@kynver-app/mcp-agent-os": "0.3.34"
+};
+var MEMORY_COST_MANAGED_PACKAGES = Object.keys(
+  MEMORY_COST_PACKAGE_MIN_VERSIONS
+);
+var DISPLAY_NAMES = {
+  "@kynver-app/runtime": "Kynver runtime",
+  "@kynver-app/openclaw-agent-os": "OpenClaw AgentOS plugin",
+  "@kynver-app/mcp-agent-os": "AgentOS MCP server"
+};
+var REPO_PACKAGE_JSON_RELATIVE = {
+  "@kynver-app/runtime": "packages/kynver-runtime/package.json",
+  "@kynver-app/openclaw-agent-os": "packages/kynver-openclaw-agent-os/package.json",
+  "@kynver-app/mcp-agent-os": "packages/kynver-mcp-agent-os/package.json"
+};
+function parseSemverParts(version) {
+  const core = version.trim().split("-")[0]?.split("+")[0];
+  if (!core) return null;
+  const parts = core.split(".");
+  if (parts.length < 1 || parts.length > 3) return null;
+  const nums = parts.map((p) => Number.parseInt(p, 10));
+  if (nums.some((n) => !Number.isFinite(n) || n < 0)) return null;
+  while (nums.length < 3) nums.push(0);
+  return [nums[0], nums[1], nums[2]];
+}
+function compareSemver(a, b) {
+  const pa = parseSemverParts(a);
+  const pb = parseSemverParts(b);
+  if (!pa || !pb) return 0;
+  for (let i = 0; i < 3; i += 1) {
+    if (pa[i] > pb[i]) return 1;
+    if (pa[i] < pb[i]) return -1;
   }
-  if (existing.maxConcurrentWorkers !== void 0 && existing.maxConcurrentWorkers !== null) {
-    return {
-      maxConcurrentWorkers: Math.max(1, Math.floor(Number(existing.maxConcurrentWorkers))),
-      maxConcurrentWorkersSource: existing.maxConcurrentWorkersSource ?? "operator",
-      boxKind
-    };
+  return 0;
+}
+function semverAtLeast(version, minimum) {
+  return compareSemver(version, minimum) >= 0;
+}
+function maxSemver(versions) {
+  let best = null;
+  for (const version of versions) {
+    if (!best || compareSemver(version, best) > 0) best = version;
   }
-  return {
-    maxConcurrentWorkers: capRecommendation.recommendedMaxWorkers,
-    maxConcurrentWorkersSource: "setup-auto",
-    boxKind
-  };
+  return best;
 }
-function loadCredentialsFile() {
-  if (!existsSync11(CREDENTIALS_FILE)) return {};
+function readPackageJsonVersion(packageJsonPath) {
   try {
-    return JSON.parse(readFileSync10(CREDENTIALS_FILE, "utf8"));
+    const parsed = JSON.parse(readFileSync4(packageJsonPath, "utf8"));
+    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
   } catch {
-    return {};
+    return null;
   }
 }
-function saveCredentialsFile(parsed) {
-  mkdirSync2(CONFIG_DIR, { recursive: true });
-  writeFileSync2(CREDENTIALS_FILE, `${JSON.stringify(parsed, null, 2)}
-`, { mode: 384 });
-}
-function loadApiKey() {
-  if (process.env.KYNVER_API_KEY) return process.env.KYNVER_API_KEY;
-  return loadCredentialsFile().apiKey;
+function resolveRepoRoot(cwd, explicitRepoRoot) {
+  const candidates = [explicitRepoRoot, process.env.KYNVER_REPO, cwd].filter(
+    (value) => Boolean(value?.trim())
+  );
+  for (const candidate of candidates) {
+    const resolved = path4.resolve(candidate);
+    if (existsSync4(path4.join(resolved, "packages/kynver-runtime/package.json")) && existsSync4(path4.join(resolved, "package.json"))) {
+      return resolved;
+    }
+  }
+  const discovered = discoverDefaultRepo({ cwd });
+  return discovered?.repo ?? null;
 }
-function saveApiKey(apiKey) {
-  saveCredentialsFile({ ...loadCredentialsFile(), apiKey });
+function probeRepoPackageVersions(input = {}) {
+  const cwd = input.cwd ?? process.cwd();
+  const repoRoot = resolveRepoRoot(cwd, input.repoRoot);
+  if (!repoRoot) return {};
+  const out = {};
+  for (const packageName of MEMORY_COST_MANAGED_PACKAGES) {
+    const packageJsonPath = path4.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
+    const version = readPackageJsonVersion(packageJsonPath);
+    if (!version) continue;
+    out[packageName] = { version, source: "repo", path: packageJsonPath };
+  }
+  return out;
 }
-function loadRunnerToken(agentOsId) {
-  const envToken = process.env.KYNVER_RUNNER_TOKEN?.trim();
-  if (envToken) return envToken;
-  const creds = loadCredentialsFile();
-  if (!creds.runnerToken) return void 0;
-  if (agentOsId && creds.runnerTokenAgentOsId && creds.runnerTokenAgentOsId !== agentOsId) {
-    return void 0;
+function repoSourceCommands(packageName) {
+  if (packageName === "@kynver-app/runtime") {
+    return ["npm run kynver:build", "npm run kynver"];
   }
-  return creds.runnerToken;
+  return [`npm run build -w ${packageName}`];
 }
-function saveRunnerToken(agentOsId, token) {
-  saveCredentialsFile({
-    ...loadCredentialsFile(),
-    runnerToken: token,
-    runnerTokenAgentOsId: agentOsId
-  });
+function buildRemediation(input) {
+  const { packageName, minimumVersion, effectiveVersion, effectiveSource, repoVersion } = input;
+  const lines = [];
+  if (repoVersion && semverAtLeast(repoVersion, minimumVersion)) {
+    lines.push(
+      `Use the monorepo checkout (${repoVersion}) instead of a stale npm install: ${repoSourceCommands(packageName).join("; ")}.`
+    );
+    lines.push("Do not publish npm packages or wait on an operator release.");
+    return lines;
+  }
+  if (effectiveVersion) {
+    lines.push(
+      `Upgrade ${packageName} from ${effectiveVersion} to >= ${minimumVersion} (npm install -g ${packageName}@latest or align OpenClaw npm prefix).`
+    );
+  } else {
+    lines.push(`Install ${packageName} >= ${minimumVersion} before running memory-heavy AgentOS paths.`);
+  }
+  if (packageName === "@kynver-app/runtime") {
+    lines.push("Repo-source alternative: npm run kynver:build && npm run kynver");
+  }
+  if (effectiveSource === "installed" && repoVersion) {
+    lines.push(`Repo checkout reports ${repoVersion}; rebuild/link repo source if you develop from the monorepo.`);
+  }
+  return lines;
 }
-function resolveBaseUrl(argsBaseUrl) {
-  const baseUrl = resolveConfiguredBaseUrl(argsBaseUrl);
-  if (!baseUrl) failConfig("requires --base-url, KYNVER_API_URL, KYNVER_CRON_FIRE_BASE_URL, or ~/.kynver/config.json apiBaseUrl");
-  return baseUrl;
+function pickEffectiveCandidate(candidates) {
+  if (candidates.length === 0) return { version: null, source: "unknown" };
+  const best = maxSemver(candidates.map((candidate) => candidate.version));
+  if (!best) return { version: null, source: "unknown" };
+  const winner = candidates.find((candidate) => candidate.version === best) ?? candidates[0];
+  return { version: winner.version, source: winner.source };
 }
-function resolveConfiguredBaseUrl(argsBaseUrl) {
-  const baseUrl = argsBaseUrl || process.env.KYNVER_API_URL || process.env.KYNVER_CRON_FIRE_BASE_URL || process.env.OPENCLAW_CRON_FIRE_BASE_URL || loadUserConfig().apiBaseUrl;
-  return baseUrl ? trimTrailingSlash(String(baseUrl)) : void 0;
+function evaluateMemoryCostPackageVersionGuard(input = {}) {
+  const normalize2 = (value, fallbackSource) => {
+    if (!value) return null;
+    if (typeof value === "string") return { version: value, source: fallbackSource };
+    return value;
+  };
+  const packages = MEMORY_COST_MANAGED_PACKAGES.map((packageName) => {
+    const minimumVersion = MEMORY_COST_PACKAGE_MIN_VERSIONS[packageName];
+    const candidates = [];
+    const installed = normalize2(input.installed?.[packageName], "installed");
+    const repo = normalize2(input.repo?.[packageName], "repo");
+    const self = normalize2(input.self?.[packageName], "self");
+    if (installed) candidates.push(installed);
+    if (repo) candidates.push(repo);
+    if (self) candidates.push(self);
+    const { version: effectiveVersion, source: effectiveSource } = pickEffectiveCandidate(candidates);
+    const repoVersion = repo?.version ?? null;
+    const ok2 = effectiveVersion ? semverAtLeast(effectiveVersion, minimumVersion) : false;
+    const remediation = ok2 ? [] : buildRemediation({
+      packageName,
+      minimumVersion,
+      effectiveVersion,
+      effectiveSource,
+      repoVersion
+    });
+    const summary2 = ok2 ? `${DISPLAY_NAMES[packageName]} ${effectiveVersion} meets memory-cost minimum ${minimumVersion} (${effectiveSource}).` : `${DISPLAY_NAMES[packageName]} is below memory-cost minimum ${minimumVersion}` + (effectiveVersion ? ` (effective ${effectiveVersion} via ${effectiveSource})` : " (no version detected)") + ".";
+    return {
+      packageName,
+      displayName: DISPLAY_NAMES[packageName],
+      minimumVersion,
+      effectiveVersion,
+      effectiveSource,
+      ok: ok2,
+      summary: summary2,
+      remediation
+    };
+  });
+  const violations = packages.filter((row) => !row.ok);
+  const ok = violations.length === 0;
+  const summary = ok ? "All managed AgentOS packages meet memory-cost minimum versions." : `Memory-cost package guard blocked ${violations.length} stale package(s): ${violations.map((row) => `${row.packageName} < ${row.minimumVersion}`).join("; ")}.`;
+  return { ok, summary, packages };
 }
-function resolveConfiguredCallbackSecret(argsSecret, agentOsId) {
-  const scoped = argsSecret || loadRunnerToken(agentOsId) || (agentOsId ? void 0 : loadRunnerToken(loadUserConfig().agentOsId));
-  if (scoped) return String(scoped);
-  const globalSecret = process.env.KYNVER_RUNTIME_SECRET || process.env.KYNVER_CRON_SECRET || process.env.OPENCLAW_CRON_SECRET;
-  if (globalSecret) {
-    console.warn(
-      "[kynver] using deployment-level callback secret; run `kynver runner credential --agent-os-id <id>` for a scoped token"
-    );
-    return String(globalSecret);
+var MemoryCostPackageVersionGuardError = class extends Error {
+  result;
+  constructor(result) {
+    const lines = [
+      result.summary,
+      ...result.packages.filter((row) => !row.ok).flatMap((row) => [`- ${row.summary}`, ...row.remediation.map((line) => `  \u2192 ${line}`)])
+    ];
+    super(lines.join("\n"));
+    this.name = "MemoryCostPackageVersionGuardError";
+    this.result = result;
   }
-  return void 0;
+};
+function assertMemoryCostPackageVersionGuard(input = {}) {
+  const result = evaluateMemoryCostPackageVersionGuard(input);
+  if (!result.ok) throw new MemoryCostPackageVersionGuardError(result);
+  return result;
 }
-function resolveCallbackSecret(argsSecret, agentOsId) {
-  const configured = resolveConfiguredCallbackSecret(argsSecret, agentOsId);
-  if (configured) return configured;
-  failConfig(
-    "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / KYNVER_CRON_SECRET / OPENCLAW_CRON_SECRET"
-  );
+function formatMemoryCostPackageGuardError(result) {
+  return new MemoryCostPackageVersionGuardError(result).message;
 }
-async function resolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
-  const configured = resolveConfiguredCallbackSecret(argsSecret, agentOsId);
-  if (configured) return configured;
-  const apiKey = loadApiKey();
-  const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
-  if (apiKey && agentOsId && baseUrl) {
-    try {
-      const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
-      saveRunnerToken(agentOsId, token);
-      return token;
-    } catch (error) {
-      failConfig(`runner credential mint failed: ${error.message}`);
-    }
-  }
-  failConfig(
-    "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / KYNVER_CRON_SECRET / OPENCLAW_CRON_SECRET"
-  );
+
+// src/installed-package-versions.ts
+import { readFile } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
+import path5 from "node:path";
+var MANAGED_PACKAGES = [
+  "@kynver-app/runtime",
+  "@kynver-app/openclaw-agent-os",
+  "@kynver-app/mcp-agent-os"
+];
+function trim(value) {
+  const out = value?.trim();
+  return out ? out : null;
 }
-async function refreshRunnerToken(agentOsId, opts) {
-  const apiKey = loadApiKey();
-  const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
-  if (!apiKey || !agentOsId || !baseUrl) return null;
-  try {
-    const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
-    saveRunnerToken(agentOsId, token);
-    return token;
-  } catch {
-    return null;
-  }
+function unique(values) {
+  return [...new Set(values.filter((value) => Boolean(value)))];
 }
-async function refreshRunnerTokenForAuthFailure(rejectedSecret, agentOsId, opts) {
-  const apiKey = loadApiKey();
-  const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
-  if (!apiKey) return { ok: false, reason: "KYNVER_API_KEY is required to refresh a rejected runner token" };
-  if (!agentOsId) return { ok: false, reason: "agentOsId is required to refresh a rejected runner token" };
-  if (!baseUrl) return { ok: false, reason: "KYNVER_API_URL or --base-url is required to refresh a rejected runner token" };
-  try {
-    const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
-    if (token && token !== rejectedSecret) {
-      saveRunnerToken(agentOsId, token);
-      return { ok: true, token };
-    }
-    return { ok: false, reason: "runner credential refresh returned the rejected token" };
-  } catch (error) {
-    return { ok: false, reason: error.message };
-  }
+function moduleRoots() {
+  const home = homedir3();
+  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path5.join(home, ".openclaw", "npm");
+  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path5.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path5.join(home, ".npm-global", "lib", "node_modules"));
+  return unique([
+    path5.join(openClawPrefix, "lib", "node_modules"),
+    path5.join(openClawPrefix, "node_modules"),
+    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path5.join(npmGlobalRoot, "lib", "node_modules")
+  ]);
 }
-async function fetchRunnerCredential(agentOsId, opts) {
-  const apiKey = opts?.apiKey || loadApiKey();
-  if (!apiKey) throw new Error("API key required \u2014 run `kynver login` first");
-  const base = resolveBaseUrl(opts?.baseUrl);
-  const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/runner-credentials`;
-  const res = await fetch(url, {
-    method: "POST",
-    headers: {
-      "Content-Type": "application/json",
-      Authorization: `Bearer ${apiKey}`
-    },
-    body: JSON.stringify({})
-  });
-  const text = await res.text();
-  let parsed = null;
+async function readVersion(packageJsonPath) {
   try {
-    parsed = JSON.parse(text);
+    const parsed = JSON.parse(await readFile(packageJsonPath, "utf8"));
+    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
   } catch {
-    parsed = null;
-  }
-  if (!res.ok || !parsed?.token) {
-    throw new Error(
-      `runner credential mint failed (${res.status}): ${parsed?.error ?? text.slice(0, 200)}`
-    );
+    return null;
   }
-  return parsed.token;
 }
-async function mintRunnerCredential(args) {
-  const agentOsId = (args.agentOsId ? String(args.agentOsId) : loadUserConfig().agentOsId) || "";
-  if (!agentOsId) failConfig("runner credential requires --agent-os-id or agentOsId in ~/.kynver/config.json");
-  try {
-    const token = await fetchRunnerCredential(agentOsId, {
-      baseUrl: args.baseUrl ? String(args.baseUrl) : void 0
-    });
-    saveRunnerToken(agentOsId, token);
-    console.log(
-      JSON.stringify(
-        {
-          ok: true,
-          agentOsId,
-          credentialsPath: displayUserPath(CREDENTIALS_FILE),
-          tokenPrefix: `${token.slice(0, 12)}\u2026`,
-          note: "Scoped runner token saved; callbacks use X-Kynver-Runner-Token."
-        },
-        null,
-        2
-      )
-    );
-  } catch (err) {
-    console.error(err instanceof Error ? err.message : String(err));
-    process.exit(1);
+function installedPackageJsonCandidates(packageName) {
+  const roots = moduleRoots();
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const root of roots) {
+    const candidate = path5.join(root, packageName, "package.json");
+    if (seen.has(candidate)) continue;
+    seen.add(candidate);
+    out.push(candidate);
   }
+  return out;
 }
-function failConfig(message) {
-  console.error(message);
-  process.exit(1);
-}
-function parseArgs(argv) {
-  const args = {};
-  for (let i = 0; i < argv.length; i++) {
-    const item = argv[i];
-    if (!item.startsWith("--")) continue;
-    const key = item.slice(2).replace(/-([a-z])/g, (_, c) => c.toUpperCase());
-    const next = argv[i + 1];
-    if (!next || next.startsWith("--")) args[key] = true;
-    else {
-      args[key] = next;
-      i++;
+async function collectInstalledPackageVersions(observedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+  const out = {};
+  for (const packageName of MANAGED_PACKAGES) {
+    let best = null;
+    for (const packageJsonPath of installedPackageJsonCandidates(packageName)) {
+      const version = await readVersion(packageJsonPath);
+      if (!version) continue;
+      if (!best || compareSemver(version, best.version) > 0) {
+        best = { version, path: packageJsonPath };
+      }
+    }
+    if (best) {
+      out[packageName] = { version: best.version, observedAt, path: best.path };
     }
   }
-  return args;
+  return out;
 }
-async function runSetup(args) {
-  const existing = loadUserConfig();
-  const diskGate = observeRunnerDiskGate({
-    diskPath: typeof args.diskPath === "string" ? args.diskPath : "/"
-  });
-  const capRecommendation = recommendSetupWorkerCap({
-    totalMemBytes: os3.totalmem(),
-    diskPath: diskGate.path,
-    diskGateOk: diskGate.ok,
-    diskFreeBytes: diskGate.freeBytes,
-    config: existing
-  });
-  const workerConfig = resolveSetupWorkerConfig(existing, args);
-  const config = normalizeConfigPaths({
-    ...existing,
-    ...inferSetupFields(existing, args),
-    ...workerConfig,
-    workerProvider: typeof args.provider === "string" ? args.provider : existing.workerProvider || "cursor"
-  });
-  saveUserConfig(config);
-  const boxIdentity = resolveBoxIdentity(process.env, config);
-  let runnerCredentialNote;
-  const apiKey = loadApiKey();
-  const agentOsId = config.agentOsId;
-  if (apiKey && agentOsId) {
-    try {
-      const token = await fetchRunnerCredential(agentOsId, {
-        baseUrl: typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : config.apiBaseUrl,
-        apiKey
-      });
-      saveRunnerToken(agentOsId, token);
-      runnerCredentialNote = "Scoped runner token minted and saved to ~/.kynver/credentials.";
-    } catch {
-      runnerCredentialNote = "Runner token not minted (server offline or master secret unset). Run `kynver runner credential` after deploy.";
-    }
+
+// src/memory-cost-package-version-guard-enforce.ts
+function installedVersionMap(observed) {
+  const out = {};
+  for (const [packageName, row] of Object.entries(observed)) {
+    if (!row?.version) continue;
+    out[packageName] = {
+      version: row.version,
+      source: "installed",
+      path: row.path
+    };
   }
-  console.log(
-    JSON.stringify(
-      {
-        ok: true,
-        configPath: displayUserPath(CONFIG_FILE),
-        config: presentUserConfig(config),
-        boxKind: config.boxKind,
-        boxKindSource: boxIdentity.source,
-        workerCapRecommendation: capRecommendation,
-        ...boxIdentity.warnings.length ? { boxIdentityWarnings: boxIdentity.warnings } : {},
-        note: runnerCredentialNote ?? "boxKind and maxConcurrentWorkers persisted; override with --box-kind and --max-workers. Run `kynver login` + `kynver runner credential` for scoped callbacks."
-      },
-      null,
-      2
-    )
-  );
+  return out;
 }
-async function runLogin(args) {
-  const apiKey = typeof args.apiKey === "string" ? args.apiKey : process.env.KYNVER_API_KEY;
-  if (!apiKey) failConfig("kynver login requires --api-key or KYNVER_API_KEY");
-  saveApiKey(apiKey);
-  console.log(JSON.stringify({ ok: true, credentialsPath: displayUserPath(CREDENTIALS_FILE) }, null, 2));
+async function buildMemoryCostPackageGuardInput(input = {}) {
+  const [installed, repo] = await Promise.all([
+    collectInstalledPackageVersions(),
+    Promise.resolve(probeRepoPackageVersions({ cwd: input.cwd, repoRoot: input.repoRoot }))
+  ]);
+  const self = {};
+  const runtimeSelfVersion = input.selfPackageName === "@kynver-app/runtime" && input.selfVersion ? input.selfVersion : PACKAGE_VERSION;
+  self["@kynver-app/runtime"] = { version: runtimeSelfVersion, source: "self" };
+  if (input.selfPackageName && input.selfVersion && input.selfPackageName !== "@kynver-app/runtime") {
+    self[input.selfPackageName] = { version: input.selfVersion, source: "self" };
+  }
+  return {
+    installed: installedVersionMap(installed),
+    repo,
+    self
+  };
+}
+async function evaluateMemoryCostPackageGuardAtStartup(input = {}) {
+  const guardInput = await buildMemoryCostPackageGuardInput(input);
+  return evaluateMemoryCostPackageVersionGuard(guardInput);
+}
+async function enforceMemoryCostPackageGuardAtStartup(input = {}) {
+  const guardInput = await buildMemoryCostPackageGuardInput(input);
+  return assertMemoryCostPackageVersionGuard(guardInput);
+}
+function shouldEnforceMemoryCostPackageGuardCli(scope, action) {
+  if (!scope) return false;
+  if (scope === "daemon") return true;
+  if (scope === "worker") return true;
+  if (scope === "monitor") return true;
+  if (scope === "run" && (action === "dispatch" || action === "sweep" || action === "reconcile" || action === "unblock")) {
+    return true;
+  }
+  if (scope === "cron" && action === "tick") return true;
+  return false;
 }
 
+// src/dispatch.ts
+init_config();
+
 // src/callback-headers.ts
 function buildHarnessCallbackHeaders(secret) {
   const trimmed = String(secret).trim();
@@ -2907,6 +3199,7 @@ function buildHarnessCallbackHeaders(secret) {
 }
 
 // src/callbacks.ts
+init_config();
 function callbackTimeoutMs() {
   const parsed = Number(process.env.KYNVER_CALLBACK_TIMEOUT_MS);
   if (Number.isFinite(parsed) && parsed > 0) return Math.floor(parsed);
@@ -3132,6 +3425,12 @@ function resolveDispatchNextLaneFilter(raw) {
   return normalizeDispatchNextLaneFilter(raw) ?? "any";
 }
 
+// src/dispatch.ts
+init_disk_gate();
+init_resource_gate();
+init_run_store();
+init_run_store();
+
 // src/model-routing-task-enrich.ts
 function taskString(task, key) {
   const v = task[key];
@@ -3181,6 +3480,9 @@ function enrichTaskForModelRouting(task) {
   return { ...task, roleLane };
 }
 
+// src/model-routing.ts
+init_config();
+
 // src/worker-provider-policy.ts
 var DEFAULT_WORKER_PROVIDER = "cursor";
 var CLAUDE_FAMILY = /* @__PURE__ */ new Set(["claude", "opus", "anthropic"]);
@@ -3864,6 +4166,8 @@ function resolveOrchestrationRouting(input) {
 }
 
 // src/providers/claude.ts
+init_worker_env();
+init_util();
 import { closeSync, openSync } from "node:fs";
 import { spawn } from "node:child_process";
 
@@ -4001,13 +4305,17 @@ var claudeProvider = {
 };
 
 // src/providers/codex.ts
+init_worker_env();
+init_util();
 import { closeSync as closeSync3, existsSync as existsSync17, openSync as openSync3 } from "node:fs";
 import { spawn as spawn3 } from "node:child_process";
 
 // src/providers/hermes-codex.ts
+init_worker_env();
+init_util();
 import { closeSync as closeSync2, openSync as openSync2 } from "node:fs";
 import { spawn as spawn2 } from "node:child_process";
-var HERMES_OPENAI_CODEX_DEFAULT_MODEL = "gpt-5.4";
+var HERMES_OPENAI_CODEX_DEFAULT_MODEL = process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim() || "gpt-5.4";
 function hermesWorkerEnv() {
   return scrubWorkerEnv({
     ...process.env,
@@ -4075,7 +4383,10 @@ var hermesCodexProvider = {
 };
 
 // src/providers/codex.ts
-var CODEX_DEFAULT_MODEL = "gpt-5.4";
+function resolveCodexDefaultModel() {
+  return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim() || "gpt-5.4";
+}
+var CODEX_DEFAULT_MODEL = resolveCodexDefaultModel();
 function resolveCodexBin() {
   return process.env.KYNVER_CODEX_BIN?.trim() || process.env.CODEX_BIN?.trim() || "codex";
 }
@@ -4327,7 +4638,11 @@ function readHarnessRetryLimits() {
 }
 
 // src/lease-renewal.ts
+init_config();
 import path16 from "node:path";
+init_run_store();
+init_status();
+init_util();
 
 // src/harness-lease-owner.ts
 var HARNESS_LEASE_PREFIX = "kynver-harness:";
@@ -4363,15 +4678,17 @@ function resolveHarnessLeaseOwnerForRenewal(input) {
 }
 
 // src/runner-identity.ts
-import os5 from "node:os";
+import os6 from "node:os";
 
 // src/box-resource-snapshot-shared.ts
-import os4 from "node:os";
+init_box_identity();
+init_box_identity();
+import os5 from "node:os";
 function resolveBoxKindFromEnv(env = process.env) {
   return resolveBoxIdentity(env).boxKind;
 }
 function defaultBoxId(boxKind, hostLabel) {
-  const host = (hostLabel ?? os4.hostname()).trim().toLowerCase().replace(/\s+/g, "-") || "unknown-host";
+  const host = (hostLabel ?? os5.hostname()).trim().toLowerCase().replace(/\s+/g, "-") || "unknown-host";
   return `${boxKind}:${host}`;
 }
 
@@ -4382,10 +4699,10 @@ function trimOrNull5(value) {
 }
 function resolveRunnerPresencePayload(input = {}) {
   const env = input.env ?? process.env;
-  const runnerId = trimOrNull5(env.KYNVER_RUNTIME_ID) ?? trimOrNull5(env.OPENCLAW_RUNTIME_ID) ?? trimOrNull5(env.HOSTNAME) ?? os5.hostname();
+  const runnerId = trimOrNull5(env.KYNVER_RUNTIME_ID) ?? trimOrNull5(env.OPENCLAW_RUNTIME_ID) ?? trimOrNull5(env.HOSTNAME) ?? os6.hostname();
   return {
     runnerId,
-    hostname: trimOrNull5(env.HOSTNAME) ?? os5.hostname(),
+    hostname: trimOrNull5(env.HOSTNAME) ?? os6.hostname(),
     profile: trimOrNull5(env.KYNVER_RUNNER_PROFILE) ?? trimOrNull5(env.OPENCLAW_RUNNER_PROFILE),
     harnessRepo: trimOrNull5(env.KYNVER_HARNESS_REPO) ?? trimOrNull5(env.KYNVER_DEFAULT_REPO),
     runId: input.runId ?? null
@@ -4470,6 +4787,9 @@ function hasLiveWorkerForTask(runId, taskId) {
 }
 
 // src/supervisor.ts
+init_git();
+init_run_store();
+init_run_store();
 import { existsSync as existsSync21, mkdirSync as mkdirSync4 } from "node:fs";
 import path23 from "node:path";
 
@@ -4619,10 +4939,18 @@ function buildPrompt(input) {
   ].join("\n");
 }
 
+// src/supervisor.ts
+init_util();
+
+// src/providers/registry.ts
+init_config();
+
 // src/providers/cursor.ts
+init_util();
+init_worker_env();
 import { closeSync as closeSync4, existsSync as existsSync19, mkdirSync as mkdirSync3, openSync as openSync4, statSync as statSync4, unlinkSync } from "node:fs";
 import { spawn as spawn4 } from "node:child_process";
-import os6 from "node:os";
+import os7 from "node:os";
 import path18 from "node:path";
 
 // src/providers/cursor-windows.ts
@@ -4733,7 +5061,7 @@ function positiveIntEnv(name, fallback) {
   return Number.isFinite(parsed) && parsed >= 0 ? Math.floor(parsed) : fallback;
 }
 function cursorStartLockPath() {
-  const root = process.env.KYNVER_CURSOR_START_LOCK_DIR?.trim() || path18.join(os6.homedir(), ".kynver", "locks");
+  const root = process.env.KYNVER_CURSOR_START_LOCK_DIR?.trim() || path18.join(os7.homedir(), ".kynver", "locks");
   mkdirSync3(root, { recursive: true });
   return path18.join(root, "cursor-agent-start.lock");
 }
@@ -4859,12 +5187,14 @@ function resolveWorkerProvider(name) {
 }
 
 // src/auto-complete.ts
+init_util();
 import { spawn as spawn5 } from "node:child_process";
 import { existsSync as existsSync20, openSync as openSync5, closeSync as closeSync5 } from "node:fs";
 import path22 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 
 // src/completion-ack.ts
+init_run_store();
 function hasCompletionAck(worker) {
   return Boolean(worker.completionReportedAt?.trim());
 }
@@ -4892,7 +5222,12 @@ function hasTerminalCompletionAck(worker) {
   return hasCompletionAck(worker) && !shouldReplayHarnessCompletion(worker);
 }
 
+// src/auto-complete.ts
+init_run_store();
+init_status();
+
 // src/worker-ops.ts
+init_config();
 import path21 from "node:path";
 
 // src/completion-response.ts
@@ -4934,6 +5269,10 @@ function completionPostSucceeded(summary) {
   return summary.taskAdvanced;
 }
 
+// src/worker-ops.ts
+init_run_store();
+init_exited_salvage();
+
 // src/harness-expert-review.ts
 var EXPERT_LANE_REVIEW_REF = "expert-lane-pr-review:";
 var PLAN_REVIEW_EXECUTOR_REF = "plan-review-task";
@@ -5101,6 +5440,7 @@ function normalizeOwnerRepo(value) {
 }
 
 // src/pr-handoff/pr-handoff-gh.ts
+init_git();
 function capture(bin, cwd, args) {
   try {
     const res = spawnSync3(bin, args, { cwd, encoding: "utf8" });
@@ -5471,6 +5811,10 @@ function ensurePrReadyHandoff(input, exec = defaultPrHandoffExec) {
   };
 }
 
+// src/worker-ops.ts
+init_status();
+init_stream();
+
 // src/material-worktree-changes.ts
 function materialWorktreeChanges(changedFiles) {
   return changedFiles.filter((line) => {
@@ -5513,8 +5857,8 @@ function dirtyPathsCoveredByDisposableRemoval(changedFiles, removed) {
   if (removed.length === 0) return false;
   const removedSet = new Set(removed.map((p) => normalizeRelativePath(p)));
   return material.every((line) => {
-    const path73 = normalizeRelativePath(pathFromGitStatusLine(line));
-    return removedSet.has(path73);
+    const path75 = normalizeRelativePath(pathFromGitStatusLine(line));
+    return removedSet.has(path75);
   });
 }
 
@@ -5599,6 +5943,9 @@ function assessWorktreeCompletionHandoff(input) {
 }
 
 // src/worker-lifecycle.ts
+init_run_store();
+init_status();
+init_util();
 import path19 from "node:path";
 var TASK_LEFT_RUNNING = /* @__PURE__ */ new Set([
   "awaiting_review",
@@ -5690,7 +6037,11 @@ function syncCompletionAcknowledgedFromOperatorTick(runId, operatorTick) {
   return synced;
 }
 
+// src/worker-ops.ts
+init_util();
+
 // src/validate.ts
+init_util();
 import path20 from "node:path";
 var RUN_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
 var WORKER_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
@@ -6477,6 +6828,7 @@ function stopWorker(args) {
 }
 
 // src/auto-complete.ts
+init_util();
 var DEFAULT_POLL_MS = 5e3;
 var DEFAULT_MAX_TOTAL_MS = 6 * 60 * 60 * 1e3;
 var DEFAULT_COMPLETE_ATTEMPTS = 3;
@@ -6661,6 +7013,7 @@ function spawnCompletionSidecar(opts) {
 }
 
 // src/repair-target-worktree.ts
+init_git();
 function addWorktreeForRepairBranch(repo, worktreePath, branch) {
   git(repo, ["fetch", "origin", branch, "--prune"], { allowFailure: true });
   const remoteRef = `origin/${branch}`;
@@ -6674,6 +7027,8 @@ function addWorktreeForRepairBranch(repo, worktreePath, branch) {
 }
 
 // src/supervisor.ts
+init_box_identity();
+init_config();
 function spawnWorkerProcess(run, opts) {
   const rawName = typeof opts.name === "string" ? opts.name.trim() : "";
   if (!rawName || rawName === "undefined" || rawName === "null") {
@@ -6767,6 +7122,10 @@ function spawnWorkerProcess(run, opts) {
     else process.env.KYNVER_HARNESS_AGENT_OS_ID = prevHarnessAgentOsId;
   }
   const model = resolveModelFallback(started.model, launchModel, provider.defaultModel);
+  const config = loadUserConfig();
+  const boxIdentity = resolveBoxIdentity(process.env, config);
+  const runtimeId = resolveRunnerPresencePayload().runnerId;
+  const boxId = defaultBoxId(boxIdentity.boxKind);
   const worker = {
     name,
     runId: run.id,
@@ -6802,6 +7161,9 @@ function spawnWorkerProcess(run, opts) {
     ...opts.taskPrUrl ? { taskPrUrl: String(opts.taskPrUrl) } : {},
     ...opts.repairTargetPrUrl ? { repairTargetPrUrl: String(opts.repairTargetPrUrl) } : {},
     ...opts.repairTargetBranch ? { repairTargetBranch: String(opts.repairTargetBranch) } : {},
+    boxKind: boxIdentity.boxKind,
+    boxId,
+    runtimeId,
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   saveWorker(run.id, worker);
@@ -6900,6 +7262,9 @@ async function startWorker(args) {
 }
 
 // src/active-harness-workers.ts
+init_run_store();
+init_harness_worker_active();
+init_util();
 import path24 from "node:path";
 function workerWriteSetFields(worker) {
   const ownedPaths = Array.isArray(worker.ownedPaths) ? worker.ownedPaths.filter((p) => typeof p === "string") : [];
@@ -6932,6 +7297,9 @@ function collectRunActiveHarnessWorkers(runId) {
   return out;
 }
 
+// src/dispatch.ts
+init_util();
+
 // src/plan-persist/body-hash.ts
 import { createHash as createHash2 } from "node:crypto";
 function hashPlanBody(body) {
@@ -6945,6 +7313,9 @@ function hashSummary(summary) {
   return createHash2("sha256").update(trimmed, "utf8").digest("hex");
 }
 
+// src/plan-persist/agentos-api.ts
+init_config();
+
 // src/plan-persist/errors.ts
 var PlanPersistError = class extends Error {
   kind;
@@ -7609,11 +7980,11 @@ function classifyChecks(statusCheckRollup) {
       continue;
     }
     if (state && SUCCESSFUL_CHECK_CONCLUSIONS.has(state)) continue;
-    if (state && state !== "PENDING") {
+    if (state && state !== "PENDING" && state !== "EXPECTED") {
       failed.push(`${checkName(check3)}=${state}`);
       continue;
     }
-    if (state === "PENDING") {
+    if (state === "PENDING" || state === "EXPECTED") {
       pending.push(`${checkName(check3)}=${state}`);
       continue;
     }
@@ -7640,8 +8011,8 @@ var LOCAL_VERIFICATION_RE = /typecheck|npm run (test|build|typecheck)|vitest|tsc
 var DOCS_TITLE_RE = /^docs[(:]/i;
 var DOCS_BODY_RE = /docs[- ]only|documentation only|no[- ]code change|no code changes|low[- ]risk|plan tracker only|markdown only/i;
 function runtimeVerificationEvidenceSufficient(input) {
-  const title = typeof input.title === "string" ? input.title : "";
-  const body = typeof input.body === "string" ? input.body : "";
+  const title = typeof input.title === "string" ? input.title.trim() : "";
+  const body = typeof input.body === "string" ? input.body.trim() : "";
   const docsLowRisk = DOCS_TITLE_RE.test(title) || DOCS_BODY_RE.test(body);
   const structuredSection = STRUCTURED_SECTION_RE.test(body);
   const localVerification = LOCAL_VERIFICATION_RE.test(body);
@@ -7793,40 +8164,56 @@ async function executeLandPrMerge(input) {
     "--squash"
   ]);
   if (mergeRes.status !== 0) {
+    const raced = viewMergedState(exec, cwd, target, input.repo);
+    if (raced) {
+      return {
+        prUrl: raced.url || before.url || prTarget,
+        outcome: "skipped",
+        mergeCommit: raced.mergeCommit?.oid ?? null,
+        reason: `PR #${before.number} is already merged \u2014 merged by another lane during land_pr (race)`
+      };
+    }
     return {
       prUrl: before.url || prTarget,
       outcome: "blocked",
       reason: mergeRes.stderr || mergeRes.stdout || "gh pr merge failed"
     };
   }
-  const after = ghJson(exec, cwd, [
-    "pr",
-    "view",
-    target,
-    ...repoArgs(input.repo),
-    "--json",
-    "number,url,mergedAt,mergeCommit,state"
-  ]);
-  if (after.state !== "MERGED" && !after.mergedAt) {
-    return {
-      prUrl: after.url || before.url || prTarget,
-      outcome: "blocked",
-      reason: `PR #${after.number} did not verify as merged after gh pr merge`
-    };
+  let after = viewMergedState(exec, cwd, target, input.repo);
+  if (!after) {
+    after = viewMergedState(exec, cwd, target, input.repo);
+  }
+  try {
+    const repo = resolveRepo(exec, cwd, input.repo);
+    deleteRemoteBranch(exec, cwd, repo, before.headRefName);
+    removeBranchWorktrees(cwd, before.headRefName);
+  } catch {
   }
-  const repo = resolveRepo(exec, cwd, input.repo);
-  deleteRemoteBranch(exec, cwd, repo, before.headRefName);
-  removeBranchWorktrees(cwd, before.headRefName);
-  const mergeCommit = after.mergeCommit?.oid ?? null;
   return {
-    prUrl: after.url || before.url || prTarget,
+    prUrl: after?.url || before.url || prTarget,
     outcome: "merged",
-    mergeCommit,
-    reason: `Daemon land_pr merged PR #${after.number}`
+    mergeCommit: after?.mergeCommit?.oid ?? null,
+    reason: `Daemon land_pr merged PR #${before.number}${after ? "" : " (post-merge view unavailable \u2014 merge verified by gh exit 0)"}`
   };
 }
+function viewMergedState(exec, cwd, target, repo) {
+  try {
+    const view = ghJson(exec, cwd, [
+      "pr",
+      "view",
+      target,
+      ...repoArgs(repo),
+      "--json",
+      "number,url,mergedAt,mergeCommit,state"
+    ]);
+    return view.state === "MERGED" || view.mergedAt ? view : null;
+  } catch {
+    return null;
+  }
+}
 
 // src/landing/land-pr-completion-post.ts
+init_config();
 async function postLandPrHarnessCompletion(input) {
   const secret = await resolveCallbackSecretWithMint(input.secret, input.agentOsId, {
     baseUrl: input.baseUrl
@@ -8111,6 +8498,15 @@ async function dispatchRun(args) {
     async function runLandPrClaimed(decision) {
       const task = decision.task;
       const taskId = String(task.id);
+      if (exactTargetMode && !exactTargetIds.has(taskId)) {
+        return abortClaimedSpawn(
+          task,
+          "exact_target_mismatch: dispatch-next returned a different task than requested",
+          {
+            requestedTargetTaskIds: [...exactTargetIds]
+          }
+        );
+      }
       const prUrl = task.prUrl ? String(task.prUrl) : "";
       if (!prUrl) {
         return abortClaimedSpawn(task, "land_pr task missing prUrl");
@@ -8372,11 +8768,21 @@ async function dispatchRun(args) {
   }
 }
 
+// src/index.ts
+init_disk_gate();
+init_wsl_host();
+init_stream();
+init_shell_command_outcome();
+init_repo_search();
+init_heartbeat();
+
 // src/box-resource-snapshot.ts
-import os7 from "node:os";
+init_config();
+init_box_identity();
+import os8 from "node:os";
 function buildBoxResourceSnapshotFromGate(gate, input = {}) {
   const boxKind = (input.boxKind ?? resolveBoxKindFromConfig(loadUserConfig())).trim().toLowerCase() || "forge";
-  const hostLabel = input.hostLabel ?? os7.hostname();
+  const hostLabel = input.hostLabel ?? os8.hostname();
   const boxId = input.boxId ?? defaultBoxId(boxKind, hostLabel);
   return {
     boxId,
@@ -8410,6 +8816,10 @@ function formatHeartbeatLine(input) {
 `;
 }
 
+// src/index.ts
+init_status();
+init_landing_gate();
+
 // src/fortress-engagement-gate.ts
 function isEngagementRequiredSkip(skip2) {
   if (skip2.skipReason === "engagement_required") return true;
@@ -8417,6 +8827,10 @@ function isEngagementRequiredSkip(skip2) {
   return reason.includes("engagement_required") || reason.includes("engagement_not_found") || reason.includes("engagement_expired") || reason.includes("engagement_revoked");
 }
 
+// src/index.ts
+init_landing_contract_gate();
+init_exited_salvage();
+
 // src/providers/openai-codex-resilience.ts
 var OPENAI_CODEX_PROVIDER = "openai-codex";
 var TRANSIENT_OPENAI_CODEX_ERROR_CLASSES = /* @__PURE__ */ new Set([
@@ -8706,6 +9120,9 @@ function redactHarness(text, secret) {
   return out;
 }
 
+// src/index.ts
+init_worker_env();
+
 // src/db-credential-env-paths.ts
 import * as fs from "node:fs";
 import { homedir as homedir12 } from "node:os";
@@ -8923,10 +9340,14 @@ function applyProductionDatabaseToProcess(options = {}) {
 }
 
 // src/worktree.ts
+init_git();
+init_run_store();
 import { existsSync as existsSync29, mkdirSync as mkdirSync6 } from "node:fs";
 import path38 from "node:path";
 
 // src/run-list.ts
+init_run_store();
+init_run_worker_index();
 import { existsSync as existsSync28, readFileSync as readFileSync15 } from "node:fs";
 import path37 from "node:path";
 
@@ -8934,6 +9355,10 @@ import path37 from "node:path";
 import path36 from "node:path";
 
 // src/finalize.ts
+init_run_store();
+init_run_worker_index();
+init_status();
+init_util();
 import path30 from "node:path";
 var ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set([
   "running",
@@ -8991,11 +9416,21 @@ function finalizeStaleRuns() {
   return finalized;
 }
 
+// src/stale-reconcile.ts
+init_run_store();
+init_run_worker_index();
+init_status();
+init_util();
+
 // src/worker-metadata-reconcile.ts
+init_heartbeat();
+init_stream();
 import { existsSync as existsSync27, lstatSync, readdirSync as readdirSync7, readlinkSync, renameSync as renameSync2, rmSync } from "node:fs";
 import path34 from "node:path";
 
 // src/worker-metadata-paths.ts
+init_paths();
+init_util();
 import path31 from "node:path";
 var NESTED_RUNS = `${path31.sep}runs${path31.sep}runs${path31.sep}`;
 function hasNestedRunsSegment(filePath) {
@@ -9053,6 +9488,9 @@ import { existsSync as existsSync26, readdirSync as readdirSync6, statSync as st
 import path33 from "node:path";
 
 // src/default-repo.ts
+init_config();
+init_default_repo_discovery();
+init_path_values();
 import path32 from "node:path";
 function expandConfiguredRepo(value) {
   return path32.resolve(resolveUserPath(value.trim()));
@@ -9122,6 +9560,10 @@ function formatResolvedDefaultRepo(resolved) {
 }
 
 // src/run-metadata-retention.ts
+init_heartbeat();
+init_paths();
+init_run_store();
+init_util();
 var RUN_METADATA_ACTIVE_SIGNAL_MS = 15 * 60 * 1e3;
 function isHarnessRunMetadataPath(targetPath, harnessRoot) {
   const resolved = path33.resolve(targetPath);
@@ -9262,6 +9704,8 @@ function collectFilesystemLiveRunKeys(harnessRoot, now = Date.now()) {
 }
 
 // src/worker-metadata-reconcile.ts
+init_run_store();
+init_util();
 function materializeSymlinkedRunDir(harnessRoot, runId) {
   const canonical = canonicalRunDir(harnessRoot, runId);
   let stat;
@@ -9567,6 +10011,12 @@ function reconcileWorkerMetadataCli() {
 }
 
 // src/local-pr-attention-reconcile.ts
+init_heartbeat();
+init_worker_final_result_embed();
+init_status();
+init_run_store();
+init_run_worker_index();
+init_util();
 import { execFileSync as execFileSync2 } from "node:child_process";
 import path35 from "node:path";
 function normalizePrUrl3(url) {
@@ -9893,6 +10343,8 @@ function reconcileRunsCli() {
 }
 
 // src/run-list.ts
+init_status();
+init_util();
 function heartbeatByteLength(heartbeatPath) {
   if (!heartbeatPath || !existsSync28(heartbeatPath)) return 0;
   try {
@@ -10008,6 +10460,7 @@ function listRunsCli() {
 }
 
 // src/worktree.ts
+init_util();
 function resolveCreateRunRepo(args) {
   const explicit = typeof args.repo === "string" ? args.repo.trim() : "";
   if (explicit) return explicit;
@@ -10047,6 +10500,7 @@ function failExists(message) {
 }
 
 // src/run-resolve.ts
+init_util();
 function resolveHarnessRunByName(runName) {
   const name = runName.trim();
   if (!name) return null;
@@ -10070,8 +10524,15 @@ function resolveHarnessRunCli(args) {
   );
 }
 
+// src/index.ts
+init_harness_worker_active();
+
 // src/sweep.ts
+init_config();
 import path39 from "node:path";
+init_run_store();
+init_status();
+init_util();
 async function sweepRun(args) {
   const pipeline = args.pipeline === true || args.pipeline === "true";
   try {
@@ -10131,7 +10592,13 @@ async function sweepRun(args) {
   }
 }
 
+// src/index.ts
+init_config();
+init_default_repo_discovery();
+init_paths();
+
 // src/harness-storage-snapshot.ts
+init_paths();
 import { existsSync as existsSync31, readdirSync as readdirSync9, statSync as statSync7 } from "node:fs";
 import path41 from "node:path";
 
@@ -10259,11 +10726,17 @@ function harnessStorageSnapshot(opts = {}) {
 }
 
 // src/cleanup.ts
+init_paths();
 import path53 from "node:path";
 
 // src/cleanup-guards.ts
+init_landing_gate();
 import path42 from "node:path";
 
+// src/cleanup-index-status.ts
+init_git();
+init_status();
+
 // src/cleanup-build-cache-paths.ts
 var HARNESS_BUILD_CACHE_RELATIVE_PATHS = [
   ".next",
@@ -10318,6 +10791,7 @@ function isPrOrUnmergedWork(status) {
 }
 
 // src/cleanup-index-status.ts
+init_util();
 function indexedWorktreeStatus(entry) {
   if (!entry.status) {
     entry.status = computeWorkerStatus(entry.worker, {
@@ -10394,7 +10868,15 @@ function resolveWorktreeGuardStatus(entry, ctx) {
   return indexedWorktreeStatus(entry);
 }
 
+// src/cleanup-guards.ts
+init_status();
+
+// src/cleanup-run-liveness.ts
+init_status();
+
 // src/cleanup-completion-blocker.ts
+init_landing_gate();
+init_status();
 function completionBlockerBlocksWorktreeRemoval(indexed, status) {
   const blocker = typeof indexed.worker.completionBlocker === "string" ? indexed.worker.completionBlocker.trim() : "";
   if (!blocker) return false;
@@ -10414,6 +10896,7 @@ function completionBlockerBlocksWorktreeRemoval(indexed, status) {
 }
 
 // src/cleanup-run-liveness.ts
+init_util();
 var TERMINAL_WORKER_JSON_STATUSES = /* @__PURE__ */ new Set([
   "done",
   "exited",
@@ -10544,11 +11027,11 @@ var LIVE_SKIP_REASONS = /* @__PURE__ */ new Set([
 function collectPreservedLivePaths(actions, skips) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const push = (path73, reason, detail) => {
-    const key = `${path73}\0${reason}`;
+  const push = (path75, reason, detail) => {
+    const key = `${path75}\0${reason}`;
     if (seen.has(key) || out.length >= MAX_PRESERVED_LIVE_PATH_SAMPLES) return;
     seen.add(key);
-    out.push({ path: path73, reason, ...detail ? { detail } : {} });
+    out.push({ path: path75, reason, ...detail ? { detail } : {} });
   };
   for (const skip2 of skips) {
     if (!LIVE_SKIP_REASONS.has(skip2.reason)) continue;
@@ -10567,8 +11050,11 @@ import { existsSync as existsSync33, readdirSync as readdirSync11, statSync as s
 import path44 from "node:path";
 
 // src/cleanup-active-worktrees.ts
+init_run_store();
+init_paths();
 import { existsSync as existsSync32, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
 import path43 from "node:path";
+init_util();
 function workerHasRecentHarnessActivity(worker, now) {
   const paths = [worker.heartbeatPath, worker.stdoutPath, worker.stderrPath];
   for (const target of paths) {
@@ -10617,6 +11103,7 @@ function isWorktreeOnLiveRun(worktreePath, harnessRoot, runId, liveRunKeys) {
 }
 
 // src/cleanup-run-directory.ts
+init_util();
 function pathAgeMs(target, now) {
   try {
     const mtime = statSync9(target).mtimeMs;
@@ -10679,10 +11166,12 @@ function scanStaleRunDirectoryCandidates(opts) {
 }
 
 // src/cleanup-execute.ts
+init_git();
 import { existsSync as existsSync35, rmSync as rmSync3 } from "node:fs";
 
 // src/cleanup-remove-path.ts
 import { existsSync as existsSync34, rmSync as rmSync2 } from "node:fs";
+init_paths();
 
 // src/cleanup-path-ownership.ts
 import { lstatSync as lstatSync2, readdirSync as readdirSync12 } from "node:fs";
@@ -11191,6 +11680,7 @@ function scanDependencyCacheCandidates(opts) {
 }
 
 // src/cleanup-duplicate-worktrees.ts
+init_git();
 import { existsSync as existsSync38, statSync as statSync12 } from "node:fs";
 import path49 from "node:path";
 function pathAgeMs4(target, now) {
@@ -11283,6 +11773,8 @@ function scanDuplicateWorktreeCandidates(opts) {
 }
 
 // src/cleanup-worktree-index.ts
+init_run_store();
+init_util();
 import path50 from "node:path";
 function buildWorktreeIndexAt(harnessRoot) {
   const index = /* @__PURE__ */ new Map();
@@ -11367,6 +11859,7 @@ function resolvePipelineHarnessRetention(runId) {
 }
 
 // src/cleanup-orphan-safety.ts
+init_git();
 import { existsSync as existsSync39, statSync as statSync13 } from "node:fs";
 import path51 from "node:path";
 var DEFAULT_HEARTBEAT_FRESH_MS = 30 * 60 * 1e3;
@@ -11419,6 +11912,7 @@ function assessOrphanWorktreeSafety(input) {
 }
 
 // src/cleanup-harness-roots.ts
+init_paths();
 import { existsSync as existsSync40 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
 import path52 from "node:path";
@@ -11454,6 +11948,7 @@ function resolveHarnessScanRoots(options = {}) {
 }
 
 // src/cleanup-disk-pressure.ts
+init_disk_gate();
 function envFlag2(name) {
   const v = process.env[name];
   return v === "1" || v === "true" || v === "yes";
@@ -11503,6 +11998,7 @@ function emitCleanupProgress(phase, detail) {
 }
 
 // src/cleanup-git-rev-cache.ts
+init_git();
 var CleanupGitRevCache = class {
   aheadOfMain = /* @__PURE__ */ new Map();
   countAheadOfMain(worktreePath, base = "origin/main") {
@@ -11521,6 +12017,7 @@ var CleanupGitRevCache = class {
 };
 
 // src/cleanup-git-status-cache.ts
+init_git();
 var CleanupGitStatusCache = class {
   cache = /* @__PURE__ */ new Map();
   porcelain(worktreePath) {
@@ -11950,10 +12447,79 @@ function isPipelineCleanupEnabled() {
 }
 
 // src/cli.ts
-import { mkdirSync as mkdirSync10, realpathSync } from "node:fs";
+init_config();
+import { mkdirSync as mkdirSync11, realpathSync } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
+// src/bootstrap.ts
+init_config();
+init_util();
+init_device_login();
+import os9 from "node:os";
+function resolveBootstrapBaseUrl(args) {
+  const raw = (typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0) || (typeof args.baseUrl === "string" ? args.baseUrl : void 0) || process.env.KYNVER_API_URL || loadUserConfig().apiBaseUrl;
+  return raw ? trimTrailingSlash(String(raw)) : void 0;
+}
+async function fetchPrimaryAgentOs(base, apiKey) {
+  const res = await fetch(`${base}/api/agent-os`, {
+    headers: { Authorization: `Bearer ${apiKey}` }
+  });
+  if (!res.ok) return null;
+  const body = await res.json().catch(() => null);
+  if (!body?.primarySlug) return null;
+  const match = body.items?.find((it) => it.slug === body.primarySlug);
+  if (match?.id && match.slug) return { id: match.id, slug: match.slug };
+  return { id: "", slug: body.primarySlug };
+}
+async function runBootstrap(args) {
+  const base = resolveBootstrapBaseUrl(args);
+  if (!base) {
+    console.error(
+      "kynver bootstrap requires a Kynver URL \u2014 pass --api-base-url https://your-kynver-site or set KYNVER_API_URL."
+    );
+    process.exit(1);
+  }
+  if (!loadApiKey()) {
+    if (typeof args.apiKey === "string") {
+      saveApiKey(args.apiKey);
+    } else {
+      const login = await runDeviceLogin({ ...args, apiBaseUrl: base });
+      if (!login.ok) process.exit(1);
+    }
+  }
+  const apiKey = loadApiKey();
+  if (!apiKey) {
+    console.error("No API key after login \u2014 aborting.");
+    process.exit(1);
+  }
+  const primary = await fetchPrimaryAgentOs(base, apiKey);
+  if (!primary) {
+    console.error(
+      "Could not resolve your AgentOS workspace from the account. Confirm this account has AgentOS access, then retry."
+    );
+    process.exit(1);
+  }
+  const setupArgs = {
+    ...args,
+    apiBaseUrl: base,
+    agentOsSlug: primary.slug,
+    ...primary.id ? { agentOsId: primary.id } : {},
+    // Best-effort repo discovery unless the caller pinned one.
+    ...typeof args.repo === "string" ? {} : { discoverRepo: true }
+  };
+  await runSetup(setupArgs);
+  console.log("");
+  console.log(`  Bootstrap complete \u2014 ${os9.hostname()} is linked to workspace "${primary.slug}".`);
+  console.log("  Next: run autonomous work with `kynver daemon --run <RUN_ID> --agent-os-id <AOS_ID> --execute`");
+  console.log("  (create a run first with `kynver run create --repo /path/to/repo`).");
+}
+
+// src/cli.ts
+init_run_store();
+
 // src/discard-disposable.ts
+init_run_store();
+init_status();
 import { existsSync as existsSync41, rmSync as rmSync4 } from "node:fs";
 import path54 from "node:path";
 function normalizeRelativePath2(value) {
@@ -12007,8 +12573,14 @@ function discardDisposableCli(args) {
   if (!result.ok) process.exit(1);
 }
 
+// src/daemon.ts
+init_config();
+
 // src/daemon-box-identity.ts
-import os8 from "node:os";
+init_config();
+init_box_identity();
+init_worker_cap_source();
+import os10 from "node:os";
 function emitDaemonIdentityMessage(level, message) {
   console.error(JSON.stringify({ event: "daemon_identity", level, message }));
 }
@@ -12016,7 +12588,7 @@ function validateDaemonInstallIdentity(config = loadUserConfig(), env = process.
   const box = resolveBoxIdentity(env, config);
   const cap = resolveWorkerCap({
     config,
-    totalMemBytes: os8.totalmem(),
+    totalMemBytes: os10.totalmem(),
     env
   });
   const warnings = [...box.warnings];
@@ -12046,6 +12618,47 @@ function validateDaemonInstallIdentity(config = loadUserConfig(), env = process.
   };
 }
 
+// src/daemon-heartbeat.ts
+import { mkdirSync as mkdirSync7, readFileSync as readFileSync16, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { homedir as homedir14 } from "node:os";
+import path55 from "node:path";
+function daemonHeartbeatPath(agentOsId) {
+  const safe = agentOsId.replace(/[^A-Za-z0-9_-]/g, "_");
+  return path55.join(homedir14(), ".kynver", `daemon-heartbeat-${safe}.json`);
+}
+function writeDaemonHeartbeat(input) {
+  try {
+    const file = daemonHeartbeatPath(input.agentOsId);
+    mkdirSync7(path55.dirname(file), { recursive: true });
+    const beat = {
+      observedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
+      pid: process.pid,
+      runId: input.runId,
+      agentOsId: input.agentOsId
+    };
+    const tmp = `${file}.tmp-${process.pid}`;
+    writeFileSync4(tmp, JSON.stringify(beat), "utf8");
+    renameSync3(tmp, file);
+  } catch {
+  }
+}
+function readDaemonHeartbeat(agentOsId) {
+  try {
+    const raw = readFileSync16(daemonHeartbeatPath(agentOsId), "utf8");
+    const parsed = JSON.parse(raw);
+    if (typeof parsed?.observedAt !== "string") return null;
+    return parsed;
+  } catch {
+    return null;
+  }
+}
+function isDaemonHeartbeatStale(beat, stallMs, nowMs = Date.now()) {
+  if (!beat) return false;
+  const observed = Date.parse(beat.observedAt);
+  if (Number.isNaN(observed)) return true;
+  return nowMs - observed > stallMs;
+}
+
 // src/daemon-platform-guard.ts
 function envFlag3(name) {
   const raw = process.env[name]?.trim().toLowerCase();
@@ -12065,9 +12678,10 @@ function assertNativeDaemonAllowed() {
 }
 
 // src/cron/cron-env.ts
+init_config();
 import { existsSync as existsSync42 } from "node:fs";
-import { homedir as homedir14 } from "node:os";
-import path55 from "node:path";
+import { homedir as homedir15 } from "node:os";
+import path56 from "node:path";
 function envFlag4(name, defaultValue) {
   const raw = process.env[name]?.trim().toLowerCase();
   if (!raw) return defaultValue;
@@ -12083,7 +12697,7 @@ function envInt(name, fallback, min = 1) {
 function defaultKynverCronStorePath() {
   const explicit = process.env.KYNVER_CRON_STORE_PATH?.trim() || process.env.OPENCLAW_CRON_STORE_PATH?.trim();
   if (explicit) return explicit;
-  return path55.join(homedir14(), ".kynver", "agent-os-cron.json");
+  return path56.join(homedir15(), ".kynver", "agent-os-cron.json");
 }
 function defaultKynverCronStatePath(storePath = defaultKynverCronStorePath()) {
   const explicit = process.env.KYNVER_CRON_TICK_STATE_PATH?.trim();
@@ -12156,12 +12770,13 @@ async function fireKynverCronJob(input) {
 }
 
 // src/cron/cron-lock.ts
-import { closeSync as closeSync6, existsSync as existsSync43, openSync as openSync6, readFileSync as readFileSync16, unlinkSync as unlinkSync3, writeFileSync as writeFileSync4 } from "node:fs";
+init_util();
+import { closeSync as closeSync6, existsSync as existsSync43, openSync as openSync6, readFileSync as readFileSync17, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
 var STALE_LOCK_MS = 10 * 6e4;
 function readLockInfo(lockPath) {
   if (!existsSync43(lockPath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync16(lockPath, "utf8"));
+    const parsed = JSON.parse(readFileSync17(lockPath, "utf8"));
     if (typeof parsed.pid === "number" && typeof parsed.at === "string") return parsed;
   } catch {
     return null;
@@ -12192,7 +12807,7 @@ function tryAcquireCronTickLock(lockPath) {
   }
   try {
     const fd = openSync6(lockPath, "wx");
-    writeFileSync4(
+    writeFileSync5(
       fd,
       JSON.stringify({ pid: process.pid, at: (/* @__PURE__ */ new Date()).toISOString() }),
       "utf8"
@@ -12325,7 +12940,7 @@ async function loadCronJobs(storePath = defaultKynverCronStorePath()) {
 // src/cron/cron-tick-state.ts
 import { randomBytes } from "node:crypto";
 import { promises as fs4 } from "node:fs";
-import path56 from "node:path";
+import path57 from "node:path";
 var EMPTY = { version: 1, jobs: {} };
 async function readFileIfExists2(filePath) {
   try {
@@ -12352,7 +12967,7 @@ async function loadCronTickState(statePath) {
   return parseCronTickState(raw);
 }
 async function writeStateAtomic(statePath, state) {
-  await fs4.mkdir(path56.dirname(statePath), { recursive: true });
+  await fs4.mkdir(path57.dirname(statePath), { recursive: true });
   const suffix = randomBytes(6).toString("hex");
   const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}-${suffix}`;
   await fs4.writeFile(tmp, `${JSON.stringify(state, null, 2)}
@@ -12528,8 +13143,12 @@ async function runKynverCronTick(opts = {}) {
   }
 }
 
+// src/daemon.ts
+init_util();
+
 // src/pipeline-tick.ts
-import path58 from "node:path";
+import path60 from "node:path";
+init_config();
 
 // src/pipeline-dispatch.ts
 var RESERVED_REVIEW_STARTS = 1;
@@ -12659,10 +13278,21 @@ function resolvePipelineMaxStarts(resourceGate, operatorTick) {
   };
 }
 
+// src/pipeline-tick.ts
+init_resource_gate();
+init_run_store();
+init_exited_salvage();
+init_status();
+init_util();
+
 // src/plan-progress-daemon-sync.ts
-import path57 from "node:path";
+init_status();
+init_run_store();
+init_util();
+import path58 from "node:path";
 
 // src/plan-progress-sync.ts
+init_config();
 async function syncPlanProgress(args) {
   const base = resolveBaseUrl(args.baseUrl);
   const secret = await resolveCallbackSecretWithMint(args.secret, args.agentOsId, { baseUrl: base });
@@ -12684,7 +13314,7 @@ async function syncActiveWorkerPlanProgress(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path57.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path58.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.dispatched || !worker.taskId) continue;
@@ -12712,6 +13342,8 @@ async function syncActiveWorkerPlanProgress(runId, args) {
 }
 
 // src/workspace-runtime-config.ts
+init_config();
+init_box_identity();
 function shouldApplyWorkspaceRuntimePreferences(env = process.env) {
   const config = loadUserConfig();
   return resolveBoxKindFromConfig(config, env) !== "forge";
@@ -12740,13 +13372,359 @@ async function fetchWorkspaceRuntimePreferences(agentOsId, args) {
   }
 }
 
+// src/pipeline-tick.ts
+init_config();
+init_box_identity();
+
+// src/provider-evidence/exec.ts
+import { spawnSync as spawnSync8 } from "node:child_process";
+var DEFAULT_CLI_TIMEOUT_MS = 1e4;
+var MAX_CLI_BUFFER_BYTES = 4 * 1024 * 1024;
+var defaultCliRunner = (cmd, args, opts) => {
+  try {
+    const result = spawnSync8(cmd, args, {
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"],
+      timeout: opts?.timeoutMs ?? DEFAULT_CLI_TIMEOUT_MS,
+      maxBuffer: MAX_CLI_BUFFER_BYTES
+    });
+    return {
+      ok: result.status === 0,
+      stdout: typeof result.stdout === "string" ? result.stdout : "",
+      stderr: typeof result.stderr === "string" ? result.stderr : ""
+    };
+  } catch (err) {
+    return { ok: false, stdout: "", stderr: err instanceof Error ? err.message : String(err) };
+  }
+};
+function runCliJson(run, cmd, args) {
+  const result = run(cmd, args);
+  if (!result.ok || !result.stdout.trim()) return null;
+  try {
+    return JSON.parse(result.stdout);
+  } catch {
+    return null;
+  }
+}
+
+// src/provider-evidence/types.ts
+function providerEvidenceKey(provider, kind, subject) {
+  return `${provider} ${kind} ${subject}`;
+}
+function parseCommitEvidenceSubject(subject) {
+  const at = subject.lastIndexOf("@");
+  if (at <= 0 || at === subject.length - 1) return null;
+  const repo = subject.slice(0, at);
+  const sha = subject.slice(at + 1);
+  if (!/^[^/\s]+\/[^/\s]+$/.test(repo) || !/^[0-9a-f]{7,40}$/i.test(sha)) return null;
+  return { repo, sha };
+}
+function parsePrUrlSubject(subject) {
+  const m = subject.trim().match(/[/:]([^/]+\/[^/]+)\/(?:pull|pulls|merge_requests|pull-requests)\/(\d+)/i);
+  if (!m) return null;
+  const number = Number(m[2]);
+  if (!Number.isFinite(number) || number <= 0) return null;
+  return { repo: m[1], number };
+}
+
+// src/provider-evidence/recipes-github.ts
+var MAX_BODY_CHARS = 8e3;
+var MAX_STATUS_ROWS = 30;
+var MAX_CHECK_RUNS = 100;
+var MAX_CHANGED_FILES = 400;
+function githubCliAvailable(run) {
+  if (process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim()) return true;
+  return run("gh", ["auth", "token"]).ok;
+}
+function asRecord4(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : null;
+}
+function pickStatusRows(value) {
+  if (!Array.isArray(value)) return [];
+  return value.map((raw) => asRecord4(raw)).filter((row) => row !== null).slice(0, MAX_STATUS_ROWS).map((row) => ({
+    context: row.context ?? null,
+    state: row.state ?? null,
+    target_url: row.target_url ?? null,
+    description: row.description ?? null
+  }));
+}
+function fetchCombinedStatus(run, repo, sha) {
+  const status = runCliJson(run, "gh", [
+    "api",
+    `repos/${repo}/commits/${sha}/status`
+  ]);
+  if (!status) return null;
+  return { state: status.state ?? null, statuses: pickStatusRows(status.statuses) };
+}
+var githubPrSnapshotRecipe = {
+  provider: "github",
+  kind: "pr_snapshot",
+  version: "1",
+  isAvailable: githubCliAvailable,
+  collect(subject, run) {
+    const parsed = parsePrUrlSubject(subject);
+    if (!parsed) return null;
+    const pull = runCliJson(run, "gh", [
+      "api",
+      `repos/${parsed.repo}/pulls/${parsed.number}`
+    ]);
+    if (!pull) return null;
+    const head = asRecord4(pull.head);
+    const headSha = typeof head?.sha === "string" ? head.sha : null;
+    const user = asRecord4(pull.user);
+    const headRepoOwner = asRecord4(asRecord4(head?.repo)?.owner);
+    const body = typeof pull.body === "string" ? pull.body.slice(0, MAX_BODY_CHARS) : null;
+    let checkRuns = [];
+    let combinedStatus = {
+      state: null,
+      statuses: []
+    };
+    if (headSha) {
+      const runs = runCliJson(run, "gh", [
+        "api",
+        `repos/${parsed.repo}/commits/${headSha}/check-runs?per_page=100`
+      ]);
+      if (Array.isArray(runs?.check_runs)) {
+        checkRuns = runs.check_runs.map((raw) => asRecord4(raw)).filter((row) => row !== null).slice(0, MAX_CHECK_RUNS).map((row) => ({
+          name: row.name ?? null,
+          status: row.status ?? null,
+          conclusion: row.conclusion ?? null
+        }));
+      }
+      combinedStatus = fetchCombinedStatus(run, parsed.repo, headSha) ?? combinedStatus;
+    }
+    const filesResult = run("gh", [
+      "api",
+      "--paginate",
+      `repos/${parsed.repo}/pulls/${parsed.number}/files?per_page=100`,
+      "--jq",
+      ".[].filename"
+    ]);
+    const changedFiles = filesResult.ok ? filesResult.stdout.split("\n").map((line) => line.trim()).filter(Boolean).slice(0, MAX_CHANGED_FILES) : [];
+    return {
+      pull: {
+        html_url: pull.html_url ?? null,
+        title: pull.title ?? null,
+        body,
+        user: { login: user?.login ?? null },
+        state: pull.state ?? null,
+        draft: pull.draft ?? null,
+        merged: pull.merged ?? null,
+        merged_at: pull.merged_at ?? null,
+        merge_commit_sha: pull.merge_commit_sha ?? null,
+        mergeable: pull.mergeable ?? null,
+        mergeable_state: pull.mergeable_state ?? null,
+        head: {
+          sha: headSha,
+          ref: head?.ref ?? null,
+          repo: { owner: { login: headRepoOwner?.login ?? null } }
+        }
+      },
+      checkRuns,
+      combinedStatus,
+      changedFiles
+    };
+  }
+};
+var githubCommitStatusRecipe = {
+  provider: "github",
+  kind: "commit_status",
+  version: "1",
+  isAvailable: githubCliAvailable,
+  collect(subject, run) {
+    const parsed = parseCommitEvidenceSubject(subject);
+    if (!parsed) return null;
+    return fetchCombinedStatus(run, parsed.repo, parsed.sha);
+  }
+};
+var githubBranchReachabilityRecipe = {
+  provider: "github",
+  kind: "branch_reachability",
+  version: "1",
+  isAvailable: githubCliAvailable,
+  collect(subject, run) {
+    const parsed = parseCommitEvidenceSubject(subject);
+    if (!parsed) return null;
+    const repoMeta = runCliJson(run, "gh", [
+      "api",
+      `repos/${parsed.repo}`
+    ]);
+    const defaultBranch = typeof repoMeta?.default_branch === "string" && repoMeta.default_branch.trim() ? repoMeta.default_branch.trim() : null;
+    if (!defaultBranch) return null;
+    const compare = runCliJson(run, "gh", [
+      "api",
+      `repos/${parsed.repo}/compare/${encodeURIComponent(defaultBranch)}...${parsed.sha}`
+    ]);
+    if (!compare) return null;
+    const compareStatus = typeof compare.status === "string" ? compare.status : null;
+    return {
+      defaultBranch,
+      compareStatus,
+      reachable: compareStatus === "identical" || compareStatus === "behind"
+    };
+  }
+};
+
+// src/provider-evidence/recipes-vercel.ts
+var MAX_DEPLOYMENT_ROWS = 5;
+var STATE_PATTERN = /\b(READY|ERROR|BUILDING|QUEUED|CANCELED|INITIALIZING)\b/i;
+var URL_PATTERN = /https:\/\/[^\s]+/;
+var vercelDeploymentStatusRecipe = {
+  provider: "vercel",
+  kind: "deployment_status",
+  version: "1",
+  isAvailable(run) {
+    return run("vercel", ["whoami"]).ok;
+  },
+  collect(subject, run) {
+    const parsed = parseCommitEvidenceSubject(subject);
+    if (!parsed) return null;
+    const result = run("vercel", [
+      "list",
+      "--prod",
+      "--meta",
+      `githubCommitSha=${parsed.sha}`
+    ]);
+    if (!result.ok) return null;
+    const deployments = [];
+    for (const line of result.stdout.split("\n")) {
+      const url = line.match(URL_PATTERN)?.[0];
+      if (!url) continue;
+      const state = line.match(STATE_PATTERN)?.[1]?.toUpperCase() ?? null;
+      deployments.push({ url, state });
+      if (deployments.length >= MAX_DEPLOYMENT_ROWS) break;
+    }
+    return { found: deployments.length > 0, deployments };
+  }
+};
+
+// src/provider-evidence/registry.ts
+var _recipes = [];
+function registerEvidenceCollector(recipe) {
+  if (_recipes.some((r) => r.provider === recipe.provider && r.kind === recipe.kind)) return;
+  _recipes.push(recipe);
+}
+function getEvidenceCollector(provider, kind) {
+  return _recipes.find((r) => r.provider === provider && r.kind === kind) ?? null;
+}
+function registerDefaultEvidenceCollectors() {
+  registerEvidenceCollector(githubPrSnapshotRecipe);
+  registerEvidenceCollector(githubCommitStatusRecipe);
+  registerEvidenceCollector(githubBranchReachabilityRecipe);
+  registerEvidenceCollector(vercelDeploymentStatusRecipe);
+}
+
+// src/provider-evidence/collect.ts
+var DEFAULT_MAX_SUBJECTS_PER_TICK = 8;
+var DEFAULT_DEADLINE_MS = 25e3;
+function collectProviderEvidence(wanted, opts = {}) {
+  registerDefaultEvidenceCollectors();
+  const run = opts.run ?? defaultCliRunner;
+  const now = opts.now ?? (() => /* @__PURE__ */ new Date());
+  const maxSubjects = opts.maxSubjects ?? DEFAULT_MAX_SUBJECTS_PER_TICK;
+  const deadline = Date.now() + (opts.deadlineMs ?? DEFAULT_DEADLINE_MS);
+  const seen = /* @__PURE__ */ new Set();
+  const deduped = wanted.filter((w) => {
+    const key = providerEvidenceKey(w.provider, w.kind, w.subject);
+    if (seen.has(key)) return false;
+    seen.add(key);
+    return true;
+  });
+  const offset = deduped.length > 0 ? Math.floor(now().getTime() / 6e4) % deduped.length : 0;
+  const rotated = deduped.map((_, i) => deduped[(offset + i) % deduped.length]);
+  const window = rotated.slice(0, maxSubjects);
+  const summary = {
+    attempted: 0,
+    collected: 0,
+    items: [],
+    skipped: []
+  };
+  const availability = /* @__PURE__ */ new Map();
+  for (const item of window) {
+    if (Date.now() > deadline) {
+      summary.skipped.push({ ...item, reason: "budget_exhausted" });
+      continue;
+    }
+    const recipe = getEvidenceCollector(item.provider, item.kind);
+    if (!recipe) {
+      summary.skipped.push({ ...item, reason: "no_recipe" });
+      continue;
+    }
+    const availKey = `${recipe.provider} ${recipe.kind}`;
+    let available = availability.get(availKey);
+    if (available === void 0) {
+      available = recipe.isAvailable(run);
+      availability.set(availKey, available);
+    }
+    if (!available) {
+      summary.skipped.push({ ...item, reason: "provider_unavailable" });
+      continue;
+    }
+    summary.attempted += 1;
+    const payload = recipe.collect(item.subject, run);
+    if (payload === null || payload === void 0) {
+      summary.skipped.push({ ...item, reason: "collect_failed" });
+      continue;
+    }
+    summary.collected += 1;
+    summary.items.push({
+      provider: item.provider,
+      kind: item.kind,
+      subject: item.subject,
+      payload,
+      observedAt: now().toISOString(),
+      collectorVersion: recipe.version
+    });
+  }
+  return summary;
+}
+
+// src/provider-evidence/wanted-store.ts
+init_run_store();
+init_util();
+import path59 from "node:path";
+var WANTED_FILE = "provider-evidence-wanted.json";
+function wantedFilePath(runId) {
+  return path59.join(runDirectory(runId), WANTED_FILE);
+}
+function parseWantedItems(value) {
+  if (!Array.isArray(value)) return [];
+  const out = [];
+  for (const raw of value) {
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) continue;
+    const row = raw;
+    const provider = typeof row.provider === "string" ? row.provider.trim() : "";
+    const kind = typeof row.kind === "string" ? row.kind.trim() : "";
+    const subject = typeof row.subject === "string" ? row.subject.trim() : "";
+    if (!provider || !kind || !subject) continue;
+    out.push({ provider, kind, subject });
+  }
+  return out;
+}
+function loadPersistedProviderEvidenceWanted(runId) {
+  const persisted = readJson(wantedFilePath(runId), null);
+  return parseWantedItems(persisted?.wanted);
+}
+function persistProviderEvidenceWanted(runId, wanted) {
+  writeJson(wantedFilePath(runId), {
+    savedAt: (/* @__PURE__ */ new Date()).toISOString(),
+    wanted
+  });
+}
+function extractProviderEvidenceWanted(tickResponse) {
+  if (!tickResponse || typeof tickResponse !== "object" || Array.isArray(tickResponse)) return null;
+  const wanted = tickResponse.providerEvidenceWanted;
+  if (!Array.isArray(wanted)) return null;
+  return parseWantedItems(wanted);
+}
+
 // src/pipeline-tick.ts
 async function completeFinishedWorkers(runId, args) {
   const run = loadRun(runId);
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path58.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path60.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || worker.localOnly) continue;
@@ -12779,6 +13757,13 @@ async function postOperatorTick(agentOsId, runId, resourceGate, args, harnessCle
   const url = `${base}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/operator/tick`;
   const packageVersions = await collectInstalledPackageVersions();
   const activeHarnessWorkers = collectRunActiveHarnessWorkers(runId);
+  let evidenceCollection = null;
+  try {
+    const evidenceWanted = loadPersistedProviderEvidenceWanted(runId);
+    evidenceCollection = evidenceWanted.length > 0 ? collectProviderEvidence(evidenceWanted) : null;
+  } catch {
+    evidenceCollection = null;
+  }
   const res = await postJson(url, secret, {
     agentOsId,
     runId,
@@ -12793,9 +13778,27 @@ async function postOperatorTick(agentOsId, runId, resourceGate, args, harnessCle
     ...harnessCleanup ? { harnessCleanup } : {},
     runnerPresence: resolveRunnerPresencePayload({ runId }),
     activeHarnessWorkers,
-    ...harnessCleanup ? { harnessCleanup } : {}
+    ...evidenceCollection && evidenceCollection.items.length > 0 ? { providerEvidence: evidenceCollection.items } : {}
   });
-  return { ok: res.ok, httpStatus: res.status, response: res.response };
+  const nextWanted = extractProviderEvidenceWanted(res.response);
+  if (nextWanted) {
+    try {
+      persistProviderEvidenceWanted(runId, nextWanted);
+    } catch {
+    }
+  }
+  return {
+    ok: res.ok,
+    httpStatus: res.status,
+    response: res.response,
+    ...evidenceCollection ? {
+      providerEvidence: {
+        attempted: evidenceCollection.attempted,
+        collected: evidenceCollection.collected,
+        skipped: evidenceCollection.skipped.length
+      }
+    } : {}
+  };
 }
 async function runPipelineTick(args) {
   const runId = String(required(String(args.run || ""), "--run"));
@@ -12943,6 +13946,7 @@ async function runDaemon(args) {
   const cronEnv = resolveKynverCronEnv();
   while (!stopping) {
     try {
+      writeDaemonHeartbeat({ agentOsId, runId });
       if (cronEnv.tickEnabled) {
         const cronTick = await runKynverCronTick({
           env: cronEnv,
@@ -12969,8 +13973,140 @@ async function runDaemon(args) {
   console.error(JSON.stringify({ event: "daemon_stop", runId, agentOsId }));
 }
 
+// src/daemon-keeper.ts
+init_config();
+import { spawn as spawn6 } from "node:child_process";
+init_util();
+var DEFAULT_STALL_MS = 15 * 6e4;
+var STARTUP_GRACE_MS = 2 * 6e4;
+var KILL_GRACE_MS = 1e4;
+var BACKOFF_BASE_MS = 5e3;
+var BACKOFF_CAP_MS = 5 * 6e4;
+var HEALTHY_RESET_MS = 30 * 6e4;
+var POLL_MS = 5e3;
+function resolveKeeperStallMs(flag, env = process.env) {
+  const fromFlag = typeof flag === "string" ? Number.parseInt(flag, 10) : NaN;
+  if (Number.isFinite(fromFlag) && fromFlag > 0) return fromFlag;
+  const fromEnv = Number.parseInt(env.KYNVER_DAEMON_STALL_MS ?? "", 10);
+  if (Number.isFinite(fromEnv) && fromEnv > 0) return fromEnv;
+  return DEFAULT_STALL_MS;
+}
+function shouldRunDaemonKeeper(args, env = process.env) {
+  if (args.keeperChild === true || args.keeperChild === "true") return false;
+  if (args.noSupervise === true || args.noSupervise === "true") return false;
+  if (args.supervised === "false") return false;
+  const envFlag5 = (env.KYNVER_DAEMON_SUPERVISED ?? "").trim().toLowerCase();
+  if (envFlag5 === "0" || envFlag5 === "false" || envFlag5 === "no" || envFlag5 === "off") {
+    return false;
+  }
+  return true;
+}
+function nextKeeperBackoffMs(consecutiveFailures, base = BACKOFF_BASE_MS, cap = BACKOFF_CAP_MS) {
+  const exp = Math.min(Math.max(consecutiveFailures, 1) - 1, 10);
+  return Math.min(base * 2 ** exp, cap);
+}
+function keeperRunWasHealthy(startedAtMs, endedAtMs, healthyMs = HEALTHY_RESET_MS) {
+  return endedAtMs - startedAtMs >= healthyMs;
+}
+function keeperLog(event, detail = {}) {
+  console.error(JSON.stringify({ event: `daemon_keeper_${event}`, ...detail }));
+}
+function buildKeeperChildArgv(argv) {
+  const out = [];
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--supervised" || arg === "--no-supervise" || arg === "--keeper-child") continue;
+    if (arg === "--stall-ms") {
+      if (i + 1 < argv.length && !argv[i + 1].startsWith("--")) i += 1;
+      continue;
+    }
+    if (arg.startsWith("--stall-ms=") || arg.startsWith("--supervised=")) continue;
+    out.push(arg);
+  }
+  out.push("--keeper-child");
+  return out;
+}
+async function runDaemonKeeper(args, rawArgv = process.argv.slice(2)) {
+  const agentOsId = String(
+    required(String(args.agentOsId || loadUserConfig().agentOsId || ""), "--agent-os-id")
+  );
+  const stallMs = resolveKeeperStallMs(args.stallMs);
+  const childArgv = buildKeeperChildArgv(rawArgv);
+  const cliEntry = process.argv[1];
+  let stopping = false;
+  let child = null;
+  let consecutiveFailures = 0;
+  const stop = (signal) => {
+    stopping = true;
+    keeperLog("stop", { signal });
+    if (child?.pid) child.kill(signal);
+  };
+  process.on("SIGINT", () => stop("SIGINT"));
+  process.on("SIGTERM", () => stop("SIGTERM"));
+  keeperLog("start", { agentOsId, stallMs, childArgv });
+  while (!stopping) {
+    const startedAt = Date.now();
+    let exited = false;
+    let exitCode = null;
+    let exitSignal = null;
+    child = spawn6(process.execPath, [cliEntry, ...childArgv], {
+      stdio: "inherit",
+      env: process.env
+    });
+    keeperLog("child_spawned", { pid: child.pid ?? null });
+    child.on("exit", (code, signal) => {
+      exited = true;
+      exitCode = code;
+      exitSignal = signal;
+    });
+    while (!exited && !stopping) {
+      await sleepMsAsync(POLL_MS);
+      if (exited || stopping) break;
+      if (Date.now() - startedAt < STARTUP_GRACE_MS) continue;
+      const beat = readDaemonHeartbeat(agentOsId);
+      const ownBeat = beat && beat.pid === child.pid ? beat : null;
+      if (ownBeat && isDaemonHeartbeatStale(ownBeat, stallMs)) {
+        keeperLog("stall_detected", {
+          pid: child.pid ?? null,
+          lastBeatAt: ownBeat.observedAt,
+          stallMs
+        });
+        child.kill("SIGTERM");
+        await sleepMsAsync(KILL_GRACE_MS);
+        if (!exited) child.kill("SIGKILL");
+        break;
+      }
+      if (!ownBeat && Date.now() - startedAt > stallMs + STARTUP_GRACE_MS) {
+        keeperLog("no_heartbeat_detected", { pid: child.pid ?? null, stallMs });
+        child.kill("SIGTERM");
+        await sleepMsAsync(KILL_GRACE_MS);
+        if (!exited) child.kill("SIGKILL");
+        break;
+      }
+    }
+    while (!exited && !stopping) {
+      await sleepMsAsync(POLL_MS);
+    }
+    if (stopping) break;
+    const endedAt = Date.now();
+    if (keeperRunWasHealthy(startedAt, endedAt)) consecutiveFailures = 0;
+    consecutiveFailures += 1;
+    const backoff = nextKeeperBackoffMs(consecutiveFailures);
+    keeperLog("child_exited", {
+      code: exitCode,
+      signal: exitSignal,
+      uptimeMs: endedAt - startedAt,
+      consecutiveFailures,
+      respawnInMs: backoff
+    });
+    await sleepMsAsync(backoff);
+  }
+  keeperLog("stopped", { agentOsId });
+}
+
 // src/plan-progress.ts
-import path62 from "node:path";
+init_config();
+import path64 from "node:path";
 
 // src/bounded-build/constants.ts
 var DEFAULT_BUILD_MEM_BUDGET_BYTES = 1536 * 1024 * 1024;
@@ -12979,6 +14115,9 @@ var DEFAULT_NODE_OLD_SPACE_SIZE_MB = 1024;
 var DEFAULT_SYSTEMD_MEMORY_MAX = "1.5G";
 var DEFAULT_SYSTEMD_MEMORY_SWAP_MAX = "2G";
 
+// src/bounded-build/index.ts
+init_meminfo();
+
 // src/bounded-build/node-options.ts
 var MAX_OLD_SPACE_RE = /--max-old-space-size=(\d+)/;
 function parsePositiveInt(value, fallback) {
@@ -13008,7 +14147,7 @@ function formatNodeOptionsFlag(mb = resolveNodeOldSpaceSizeMb()) {
 }
 
 // src/bounded-build/systemd-wrap.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 var systemdAvailableCache;
 function isSystemdRunAvailable() {
   if (process.env.KYNVER_BUILD_SKIP_SYSTEMD === "1" || process.env.KYNVER_BUILD_SKIP_SYSTEMD === "true") {
@@ -13019,7 +14158,7 @@ function isSystemdRunAvailable() {
     systemdAvailableCache = false;
     return false;
   }
-  const res = spawnSync8("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
+  const res = spawnSync9("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
   systemdAvailableCache = res.status === 0;
   return systemdAvailableCache;
 }
@@ -13043,7 +14182,9 @@ function buildSystemdRunArgv(opts) {
 }
 
 // src/bounded-build/admission.ts
-import { spawnSync as spawnSync9 } from "node:child_process";
+init_config();
+import { spawnSync as spawnSync10 } from "node:child_process";
+init_meminfo();
 function positiveInt4(value, fallback) {
   const n = Number(value);
   if (!Number.isFinite(n) || n <= 0) return fallback;
@@ -13079,7 +14220,7 @@ function assessBuildAdmission(opts = {}) {
 }
 function sleepMs2(ms) {
   if (ms <= 0) return;
-  spawnSync9(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync10(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -13100,33 +14241,34 @@ function waitForBuildAdmission(timeoutMs, pollMs = 2e3, opts = {}) {
 }
 
 // src/bounded-build/exec.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 
 // src/heavy-verification/slot.ts
+init_util();
 import {
   closeSync as closeSync7,
   existsSync as existsSync44,
-  mkdirSync as mkdirSync8,
+  mkdirSync as mkdirSync9,
   openSync as openSync7,
   readdirSync as readdirSync15,
-  readFileSync as readFileSync17,
+  readFileSync as readFileSync18,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync5
+  writeFileSync as writeFileSync6
 } from "node:fs";
-import path60 from "node:path";
+import path62 from "node:path";
 
 // src/heavy-verification/paths.ts
-import { mkdirSync as mkdirSync7 } from "node:fs";
-import path59 from "node:path";
+import { mkdirSync as mkdirSync8 } from "node:fs";
+import path61 from "node:path";
 function resolveHeavyVerificationRoot() {
-  return path59.join(resolveKynverStateRoot(), "heavy-verification");
+  return path61.join(resolveKynverStateRoot(), "heavy-verification");
 }
 function heavyVerificationSlotsDir() {
-  return path59.join(resolveHeavyVerificationRoot(), "slots");
+  return path61.join(resolveHeavyVerificationRoot(), "slots");
 }
 function ensureHeavyVerificationDirs() {
   const dir = heavyVerificationSlotsDir();
-  mkdirSync7(dir, { recursive: true });
+  mkdirSync8(dir, { recursive: true });
   return dir;
 }
 
@@ -13151,12 +14293,12 @@ function indexedSlotId(index) {
   return `slot-${index}`;
 }
 function slotFilePath(slotId, slotsDir = heavyVerificationSlotsDir()) {
-  return path60.join(slotsDir, `${slotId}.json`);
+  return path62.join(slotsDir, `${slotId}.json`);
 }
 function readSlotRecord(filePath) {
   if (!existsSync44(filePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync17(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync18(filePath, "utf8"));
     if (typeof parsed.slotId === "string" && typeof parsed.pid === "number" && typeof parsed.acquiredAt === "string" && typeof parsed.command === "string") {
       return parsed;
     }
@@ -13181,7 +14323,7 @@ function reclaimStaleSlot(filePath, staleMs) {
   }
 }
 function ensureSlotsDir(slotsDir) {
-  mkdirSync8(slotsDir, { recursive: true });
+  mkdirSync9(slotsDir, { recursive: true });
   return slotsDir;
 }
 function reclaimStaleHeavyVerificationSlots(opts = {}) {
@@ -13190,7 +14332,7 @@ function reclaimStaleHeavyVerificationSlots(opts = {}) {
   let reclaimed = 0;
   for (const name of readdirSync15(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const filePath = path60.join(slotsDir, name);
+    const filePath = path62.join(slotsDir, name);
     const before = existsSync44(filePath);
     reclaimStaleSlot(filePath, staleMs);
     if (before && !existsSync44(filePath)) reclaimed += 1;
@@ -13204,7 +14346,7 @@ function listActiveHeavyVerificationSlots(opts = {}) {
   const active = [];
   for (const name of readdirSync15(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const record3 = readSlotRecord(path60.join(slotsDir, name));
+    const record3 = readSlotRecord(path62.join(slotsDir, name));
     if (record3 && !slotIsStale(record3, staleMs)) active.push(record3);
   }
   return active;
@@ -13246,7 +14388,7 @@ function tryAcquireHeavyVerificationSlot(command, opts = {}) {
     };
     try {
       const fd = openSync7(filePath, "wx");
-      writeFileSync5(fd, JSON.stringify(record3, null, 2), "utf8");
+      writeFileSync6(fd, JSON.stringify(record3, null, 2), "utf8");
       closeSync7(fd);
       const activeSlots2 = countActiveHeavyVerificationSlots({ slotsDir, staleMs });
       return {
@@ -13306,10 +14448,10 @@ function assessHeavyVerificationGate(command, opts = {}) {
 }
 
 // src/heavy-verification/gate.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 function sleepMs3(ms) {
   if (ms <= 0) return;
-  spawnSync10(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync11(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -13324,11 +14466,12 @@ function waitForHeavyVerificationSlot(command, timeoutMs, pollMs = 2e3, opts = {
 }
 
 // src/harness-worktree-build-guard.ts
-import path61 from "node:path";
+init_paths();
+import path63 from "node:path";
 function isPathUnderHarnessWorktree(cwd) {
   const worktreesDir = harnessWorktreesDir(resolveHarnessRoot());
-  const rel = path61.relative(worktreesDir, path61.resolve(cwd));
-  return rel.length > 0 && !rel.startsWith("..") && !path61.isAbsolute(rel);
+  const rel = path63.relative(worktreesDir, path63.resolve(cwd));
+  return rel.length > 0 && !rel.startsWith("..") && !path63.isAbsolute(rel);
 }
 function assessHarnessWorktreeBuildGuard(cwd) {
   if (!isPathUnderHarnessWorktree(cwd)) return { ok: true };
@@ -13352,7 +14495,7 @@ function envArgv(env) {
   return out;
 }
 function runSpawn(argv, opts) {
-  const res = spawnSync11(argv[0], argv.slice(1), {
+  const res = spawnSync12(argv[0], argv.slice(1), {
     cwd: opts.cwd,
     env: opts.env,
     encoding: "utf8",
@@ -13478,6 +14621,7 @@ function runHarnessVerifyCommands(cwd, commands = DEFAULT_HARNESS_VERIFY_COMMAND
 }
 
 // src/plan-progress.ts
+init_util();
 function parseEvidenceArg(raw) {
   const idx = raw.indexOf(":");
   if (idx <= 0) throw new Error(`invalid --evidence ${raw} (expected type:value)`);
@@ -13540,7 +14684,7 @@ async function emitPlanProgress(args) {
 }
 function verifyPlanLocal(args) {
   const worktree = required(args.worktree ? String(args.worktree) : void 0, "worktree");
-  const cwd = path62.resolve(worktree);
+  const cwd = path64.resolve(worktree);
   const summary = runHarnessVerifyCommands(cwd);
   const emitJson = args.json === true || args.json === "true";
   const payload = { passed: summary.passed, worktree: cwd, steps: summary.steps };
@@ -13589,9 +14733,10 @@ async function verifyPlan(args) {
 }
 
 // src/harness-verify-cli.ts
-import path63 from "node:path";
+import path65 from "node:path";
+init_util();
 function runHarnessVerifyCli(args) {
-  const cwd = path63.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
+  const cwd = path65.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
   const emitJson = args.json === true || args.json === "true" || args.emitJson === true || args.emitJson === "true";
   const commands = [];
   const rawCmd = args.command;
@@ -13636,7 +14781,9 @@ function runHarnessVerifyCli(args) {
 }
 
 // src/plan-persist-cli.ts
-import { readFileSync as readFileSync18 } from "node:fs";
+init_config();
+import { readFileSync as readFileSync19 } from "node:fs";
+init_util();
 var OPERATIONS = ["create", "add_version", "update_metadata"];
 var FAILURE_KINDS = [
   "approval_guard",
@@ -13648,7 +14795,7 @@ var FAILURE_KINDS = [
 function readBodyArg(args) {
   const bodyFile = args.bodyFile ? String(args.bodyFile) : void 0;
   if (bodyFile) {
-    return { body: readFileSync18(bodyFile, "utf8"), bodyPathHint: bodyFile };
+    return { body: readFileSync19(bodyFile, "utf8"), bodyPathHint: bodyFile };
   }
   const inline = args.body ? String(args.body) : void 0;
   if (inline) return { body: inline };
@@ -14028,9 +15175,14 @@ ${text.slice(0, 800)}`,
 }
 
 // src/monitor/monitor.service.ts
-import path65 from "node:path";
+import path67 from "node:path";
+init_run_store();
+init_status();
+init_util();
 
 // src/monitor/monitor.classify.ts
+init_status();
+init_util();
 function classifyWorkerHealth(input) {
   const { worker, status, taskLease } = input;
   const leaseOwner = taskLease?.leaseOwner ?? null;
@@ -14080,19 +15232,21 @@ function classifyWorkerHealth(input) {
 }
 
 // src/monitor/monitor.store.ts
-import { existsSync as existsSync45, mkdirSync as mkdirSync9, readdirSync as readdirSync16, unlinkSync as unlinkSync5 } from "node:fs";
-import path64 from "node:path";
+init_paths();
+init_util();
+import { existsSync as existsSync45, mkdirSync as mkdirSync10, readdirSync as readdirSync16, unlinkSync as unlinkSync5 } from "node:fs";
+import path66 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path64.join(harnessRoot, "monitors");
-  mkdirSync9(dir, { recursive: true });
+  const dir = path66.join(harnessRoot, "monitors");
+  mkdirSync10(dir, { recursive: true });
   return dir;
 }
 function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path64.join(monitorsDir(), `${monitorId}.json`);
+  return path66.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -14113,7 +15267,7 @@ function listMonitorSessions() {
   for (const name of readdirSync16(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path64.join(dir, name),
+      path66.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -14133,6 +15287,7 @@ function listMonitorSessions() {
 }
 
 // src/monitor/monitor.terminal.ts
+init_status();
 function assessAutoCompleteEligibility(input) {
   const { worker, status } = input;
   const blockers = [];
@@ -14176,6 +15331,7 @@ function assessAutoCompleteEligibility(input) {
 }
 
 // src/monitor/monitor.task-lease.ts
+init_config();
 async function fetchTaskLeasesForWorkers(input) {
   const out = /* @__PURE__ */ new Map();
   const agentOsId = input.agentOsId?.trim();
@@ -14204,7 +15360,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path65.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path67.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -14374,6 +15530,7 @@ async function monitorAutoCompleteCli(args) {
 }
 
 // src/monitor/monitor-loop.ts
+init_util();
 var DEFAULT_POLL_MS2 = 5e3;
 var DEFAULT_MAX_TOTAL_MS2 = 6 * 60 * 60 * 1e3;
 async function runMonitorLoop(args) {
@@ -14409,19 +15566,21 @@ async function runMonitorLoop(args) {
 }
 
 // src/monitor/monitor-spawn.ts
-import { spawn as spawn6 } from "node:child_process";
+init_util();
+init_paths();
+import { spawn as spawn7 } from "node:child_process";
 import { closeSync as closeSync8, existsSync as existsSync46, openSync as openSync8 } from "node:fs";
-import path66 from "node:path";
+import path68 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path66.join(fileURLToPath4(new URL(".", import.meta.url)), "cli.js");
+  return path68.join(fileURLToPath4(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
   if (!existsSync46(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path66.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path68.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
     logFd = openSync8(logPath, "a");
@@ -14455,7 +15614,7 @@ function spawnMonitorSidecar(opts) {
     logFd ?? "ignore"
   ];
   try {
-    const child = spawn6(
+    const child = spawn7(
       nodeExecutable,
       args,
       hiddenSpawnOptions({
@@ -14490,6 +15649,7 @@ function spawnMonitorSidecar(opts) {
 }
 
 // src/monitor/monitor-cli.ts
+init_util();
 async function startMonitorCli(args) {
   const runId = String(args.run || "");
   required(runId, "--run");
@@ -14541,7 +15701,11 @@ async function monitorTickCli(args) {
 }
 
 // src/post-restart-unblock.ts
-import path67 from "node:path";
+init_run_store();
+init_status();
+init_util();
+init_config();
+import path69 from "node:path";
 function skip(runId, worker, taskId, agentOsId, leaseOwner, reason) {
   return { runId, worker, taskId, agentOsId, leaseOwner, action: "skipped", reason };
 }
@@ -14554,7 +15718,7 @@ async function postRestartUnblock(args) {
   const errors = [];
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers ?? {})) {
-      const workerPath = path67.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path69.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker) {
         skipped.push(skip(run.id, name, "", "", "", "worker.json missing"));
@@ -14666,9 +15830,11 @@ async function postRestartUnblockCli(args) {
 }
 
 // src/default-repo-cli.ts
-import path68 from "node:path";
-import { homedir as homedir15 } from "node:os";
-var CONFIG_FILE2 = path68.join(homedir15(), ".kynver", "config.json");
+init_path_values();
+init_config();
+import path70 from "node:path";
+import { homedir as homedir16 } from "node:os";
+var CONFIG_FILE2 = path70.join(homedir16(), ".kynver", "config.json");
 function ensureDefaultRepo(opts) {
   const existing = loadUserConfig();
   const resolved = resolveDefaultRepo({ ...opts, config: existing });
@@ -14749,16 +15915,19 @@ function summarizeResolvedDefaultRepo(resolved) {
 }
 
 // src/doctor/runtime-takeover.ts
-import path70 from "node:path";
+import path72 from "node:path";
+init_path_values();
 
 // src/doctor/runtime-takeover.probes.ts
-import { accessSync, constants, existsSync as existsSync47, readFileSync as readFileSync19 } from "node:fs";
-import { homedir as homedir16 } from "node:os";
-import path69 from "node:path";
-import { spawnSync as spawnSync12 } from "node:child_process";
+init_config();
+import { accessSync, constants, existsSync as existsSync47, readFileSync as readFileSync20 } from "node:fs";
+import { homedir as homedir17 } from "node:os";
+import path71 from "node:path";
+import { spawnSync as spawnSync13 } from "node:child_process";
+init_paths();
 function captureCommand(bin, args) {
   try {
-    const res = spawnSync12(bin, args, { encoding: "utf8" });
+    const res = spawnSync13(bin, args, { encoding: "utf8" });
     const stdout = (res.stdout || "").trim();
     const stderr = (res.stderr || "").trim();
     const ok = res.status === 0;
@@ -14796,15 +15965,15 @@ var defaultRuntimeTakeoverProbes = {
   commandOnPath: (bin) => captureCommand(process.platform === "win32" ? "where" : "which", [bin]),
   kynverVersion: (bin) => captureCommand(bin, ["--version"]),
   loadConfig: () => loadUserConfig(),
-  configFilePath: () => path69.join(homedir16(), ".kynver", "config.json"),
-  credentialsFilePath: () => path69.join(homedir16(), ".kynver", "credentials"),
+  configFilePath: () => path71.join(homedir17(), ".kynver", "config.json"),
+  credentialsFilePath: () => path71.join(homedir17(), ".kynver", "credentials"),
   readCredentials: () => {
-    const credPath = path69.join(homedir16(), ".kynver", "credentials");
+    const credPath = path71.join(homedir17(), ".kynver", "credentials");
     if (!existsSync47(credPath)) {
       return { hasApiKey: false };
     }
     try {
-      const parsed = JSON.parse(readFileSync19(credPath, "utf8"));
+      const parsed = JSON.parse(readFileSync20(credPath, "utf8"));
       return {
         hasApiKey: Boolean(parsed.apiKey?.trim()),
         runnerTokenPrefix: tokenPrefix(parsed.runnerToken),
@@ -14834,7 +16003,7 @@ var defaultRuntimeTakeoverProbes = {
     })()
   }),
   harnessRoot: () => resolveHarnessRoot(),
-  legacyOpenclawHarnessRoot: () => path69.join(homedir16(), ".openclaw", "harness"),
+  legacyOpenclawHarnessRoot: () => path71.join(homedir17(), ".openclaw", "harness"),
   pathExists: (target) => existsSync47(target),
   pathWritable: (target) => isWritable(target)
 };
@@ -15241,8 +16410,8 @@ function assessVercelDeployEvidence(probes) {
 }
 function assessHarnessDirs(probes) {
   const harnessRoot = probes.harnessRoot();
-  const runsDir = path70.join(harnessRoot, "runs");
-  const worktreesDir = path70.join(harnessRoot, "worktrees");
+  const runsDir = path72.join(harnessRoot, "runs");
+  const worktreesDir = path72.join(harnessRoot, "worktrees");
   const displayHarnessRoot = redactHomePath(harnessRoot);
   const displayRunsDir = redactHomePath(runsDir);
   const displayWorktreesDir = redactHomePath(worktreesDir);
@@ -15418,6 +16587,7 @@ function runRuntimeTakeoverDoctorCli(args = {}) {
 }
 
 // src/command-center-contract-cli.ts
+init_config();
 async function runCommandCenterContractCli(args) {
   const config = loadUserConfig();
   const agentOsId = (args.agentOsId ? String(args.agentOsId) : config.agentOsId) || "";
@@ -15448,6 +16618,9 @@ async function runCommandCenterContractCli(args) {
   console.log(JSON.stringify(res.response, null, 2));
 }
 
+// src/scheduler-cutover-cli.ts
+init_path_values();
+
 // src/scheduler-cutover.ts
 var DEPLOYMENT_SCHEDULER_CUTOVER_STEPS = [
   "Vercel/hosted: set KYNVER_SCHEDULER_PROVIDER=qstash",
@@ -15506,9 +16679,10 @@ function applySchedulerCutoverAttestation(config) {
 }
 
 // src/scheduler-cutover-cli.ts
-import path71 from "node:path";
-import { homedir as homedir17 } from "node:os";
-var CONFIG_FILE3 = path71.join(homedir17(), ".kynver", "config.json");
+init_config();
+import path73 from "node:path";
+import { homedir as homedir18 } from "node:os";
+var CONFIG_FILE3 = path73.join(homedir18(), ".kynver", "config.json");
 function runSchedulerCutoverCheckCli(json = false) {
   const config = loadUserConfig();
   const report = assessSchedulerCutover(config);
@@ -15646,7 +16820,12 @@ async function runCronTickCli(args) {
 }
 
 // src/lane/landing-maintainer-tick.ts
-import os9 from "node:os";
+init_config();
+import os11 from "node:os";
+init_config();
+init_box_identity();
+init_resource_gate();
+init_util();
 
 // src/lane/lane-spec.ts
 var LANDING_MAINTAINER_LANE_SPEC = {
@@ -15658,10 +16837,10 @@ var LANDING_MAINTAINER_LANE_SPEC = {
 };
 
 // src/lane/landing-maintainer-local.ts
-import { spawnSync as spawnSync13 } from "node:child_process";
-import path72 from "node:path";
+import { spawnSync as spawnSync14 } from "node:child_process";
+import path74 from "node:path";
 function runLandingWrapper(prNumber, repoRoot, execute) {
-  const script = path72.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
+  const script = path74.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
   const args = [script, String(prNumber), ...LANDING_MAINTAINER_LANE_SPEC.landScriptArgs];
   if (!execute) {
     return {
@@ -15672,7 +16851,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
       stderr: ""
     };
   }
-  const result = spawnSync13("node", args, {
+  const result = spawnSync14("node", args, {
     cwd: repoRoot,
     encoding: "utf8",
     timeout: 10 * 60 * 1e3
@@ -15687,7 +16866,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
 }
 function resolveLandingMaintainerRepoRoot(args) {
   const explicit = args.repoPath ? String(args.repoPath).trim() : "";
-  if (explicit) return path72.resolve(explicit);
+  if (explicit) return path74.resolve(explicit);
   const resolved = resolveDefaultRepo();
   return resolved?.repo ?? process.cwd();
 }
@@ -15706,7 +16885,7 @@ async function runLandingMaintainerLaneTick(args) {
     ...buildBoxResourceSnapshotFromGate(resourceGate, {
       harnessRunId: runId,
       boxKind: resolveBoxKindFromConfig(loadUserConfig()),
-      hostLabel: os9.hostname()
+      hostLabel: os11.hostname()
     }),
     providerHealthy: resourceGate.ok,
     authorizedForRepair: resourceGate.ok,
@@ -15810,10 +16989,11 @@ function usage(code = 0) {
   out(
     [
       "Usage:",
-      "  kynver login --api-key KEY",
+      "  kynver login [--api-key KEY] [--api-base-url URL]   (omit --api-key to authorize in the browser)",
+      "  kynver bootstrap [--api-base-url URL] [--api-key KEY] [--repo PATH]   (login + setup + runner credential in one shot)",
       "  kynver runner credential [--agent-os-id ID] [--base-url URL]",
       "  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind forge|ghost] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor]",
-      "  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS]",
+      "  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS] [--stall-ms MS] [--no-supervise]",
       "  kynver status --run RUN_ID [--blocked] [--running] [--task TASK_ID] [--worker WORKER] [--full]  # top-level compact run status",
       "  kynver run create [--repo /path/repo] [--name name] [--base origin/main]",
       "  kynver run list",
@@ -15874,8 +17054,8 @@ async function main(argv = process.argv.slice(2)) {
   if (action && isHelpFlag(action) || rest.some(isHelpFlag)) return usage(0);
   const args = parseArgs(rest);
   const { runsDir, worktreesDir } = getPaths();
-  mkdirSync10(runsDir, { recursive: true });
-  mkdirSync10(worktreesDir, { recursive: true });
+  mkdirSync11(runsDir, { recursive: true });
+  mkdirSync11(worktreesDir, { recursive: true });
   if (scope === "daemon") {
     assertNativeDaemonAllowed();
   }
@@ -15895,10 +17075,16 @@ async function main(argv = process.argv.slice(2)) {
     });
   }
   if (scope === "login") return void await runLogin(args);
+  if (scope === "bootstrap") return void await runBootstrap(args);
   if (scope === "status") return runStatus(args);
   if (scope === "runner" && action === "credential") return void await mintRunnerCredential(args);
   if (scope === "setup") return void await runSetup(args);
-  if (scope === "daemon") return void await runDaemon(args);
+  if (scope === "daemon") {
+    if (shouldRunDaemonKeeper(args)) {
+      return void await runDaemonKeeper(args);
+    }
+    return void await runDaemon(args);
+  }
   if (scope === "plan" && action === "progress") return void await emitPlanProgress(args);
   if (scope === "plan" && action === "verify") return void await verifyPlan(args);
   if (scope === "harness" && action === "verify") return runHarnessVerifyCli(args);