@kynver-app/runtime 0.1.117 → 0.1.119

package/dist/index.js

@@ -532,23 +532,23 @@ function isWslHost() {
 function observeWslHostDisk(options = {}) {
   const wsl = options.forceWsl === void 0 ? isWslHost() : options.forceWsl;
   if (!wsl) return null;
-  const path75 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
+  const path79 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
   const warnBelowBytes = options.wslHostFreeWarnBytes ?? DEFAULT_WSL_HOST_WARN_FREE_BYTES;
   const criticalBelowBytes = options.wslHostFreeCriticalBytes ?? DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES;
   const statfs = options.statfs ?? statfsSync;
   let stats;
   try {
-    stats = statfs(path75);
+    stats = statfs(path79);
   } catch (error) {
     return {
       ok: false,
-      path: path75,
+      path: path79,
       freeBytes: 0,
       totalBytes: 0,
       usedPercent: 100,
       warnBelowBytes,
       criticalBelowBytes,
-      reason: `Windows host disk probe failed at ${path75}: ${error.message}`,
+      reason: `Windows host disk probe failed at ${path79}: ${error.message}`,
       probeError: error.message
     };
   }
@@ -562,11 +562,11 @@ function observeWslHostDisk(options = {}) {
   let reason = null;
   if (!ok) {
     const tag = criticalFree ? "critical" : "warning";
-    reason = `Windows host disk ${path75} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
+    reason = `Windows host disk ${path79} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
   }
   return {
     ok,
-    path: path75,
+    path: path79,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -592,12 +592,12 @@ var init_wsl_host = __esm({
 // src/disk-gate.ts
 import { statfsSync as statfsSync2 } from "node:fs";
 function observeRunnerDiskGate(input = {}) {
-  const path75 = input.diskPath?.trim() || "/";
+  const path79 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync2(path75);
+  const stats = statfsSync2(path79);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -620,7 +620,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path75,
+    path: path79,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -3165,6 +3165,7 @@ async function enforceMemoryCostPackageGuardAtStartup(input = {}) {
 function shouldEnforceMemoryCostPackageGuardCli(scope, action) {
   if (!scope) return false;
   if (scope === "daemon") return true;
+  if (scope === "start") return true;
   if (scope === "worker") return true;
   if (scope === "monitor") return true;
   if (scope === "run" && (action === "dispatch" || action === "sweep" || action === "reconcile" || action === "unblock")) {
@@ -5857,8 +5858,8 @@ function dirtyPathsCoveredByDisposableRemoval(changedFiles, removed) {
   if (removed.length === 0) return false;
   const removedSet = new Set(removed.map((p) => normalizeRelativePath(p)));
   return material.every((line) => {
-    const path75 = normalizeRelativePath(pathFromGitStatusLine(line));
-    return removedSet.has(path75);
+    const path79 = normalizeRelativePath(pathFromGitStatusLine(line));
+    return removedSet.has(path79);
   });
 }
 
@@ -8424,7 +8425,10 @@ async function dispatchRun(args) {
       } : {}
     });
     const requestDispatch = async (maxStarts) => {
-      const dispatch = await postJsonWithCredentialRefresh(dispatchUrl, secret, buildBody(maxStarts), { agentOsId, baseUrl: base });
+      const dispatch = await postJsonWithCredentialRefresh(dispatchUrl, secret, buildBody(maxStarts), {
+        agentOsId,
+        baseUrl: base
+      }) ?? { ok: false, status: 0, response: null };
       const responseBody = dispatch.response;
       return { dispatch, result: responseBody?.result };
     };
@@ -8525,6 +8529,13 @@ async function dispatchRun(args) {
           task,
           report
         });
+        if (!post.ok) {
+          return abortClaimedSpawn(
+            task,
+            `land_pr completion POST failed (HTTP ${post.status})`,
+            { landPr: true, outcome: report.outcome }
+          );
+        }
         outcomes.push({
           taskId,
           started: true,
@@ -8532,12 +8543,6 @@ async function dispatchRun(args) {
           outcome: report.outcome,
           completionStatus: post.status
         });
-        if (!post.ok) {
-          return abortClaimedSpawn(
-            task,
-            `land_pr completion POST failed (HTTP ${post.status})`
-          );
-        }
         return true;
       } catch (error) {
         return abortClaimedSpawn(task, error.message);
@@ -8676,10 +8681,22 @@ async function dispatchRun(args) {
         return abortClaimedSpawn(task, error.message);
       }
     }
-    let shouldContinueDispatch = true;
-    for (const decision of result.started) {
+    const failedStartTaskIds = /* @__PURE__ */ new Set();
+    async function admitClaimedDecision(decision) {
+      const task = decision.task;
+      const taskId = String(task.id);
+      if (failedStartTaskIds.has(taskId)) {
+        return abortClaimedSpawn(
+          task,
+          "dispatch_retry_loop_prevented: task already failed to start this tick"
+        );
+      }
       const admitted = isLandPrDecision2(decision) ? await runLandPrClaimed(decision) : await spawnClaimed(decision);
-      shouldContinueDispatch = admitted && shouldContinueDispatch;
+      if (!admitted) failedStartTaskIds.add(taskId);
+      return admitted;
+    }
+    for (const decision of result.started) {
+      await admitClaimedDecision(decision);
     }
     skipped.push(
       ...result.skipped ?? []
@@ -8698,9 +8715,7 @@ async function dispatchRun(args) {
         });
       }
     }
-    if (exactTargetMode) shouldContinueDispatch = false;
-    while (shouldContinueDispatch && outcomes.length < cappedStarts) {
-      if (exactTargetMode) break;
+    while (!exactTargetMode && outcomes.length < cappedStarts) {
       const next = await requestDispatch(1);
       if (!next.dispatch.ok || !next.result) {
         outcomes.push({
@@ -8717,9 +8732,7 @@ async function dispatchRun(args) {
       if (started.length === 0) break;
       for (const decision of started) {
         if (outcomes.length >= cappedStarts) break;
-        const admitted = isLandPrDecision2(decision) ? await runLandPrClaimed(decision) : await spawnClaimed(decision);
-        shouldContinueDispatch = admitted && shouldContinueDispatch;
-        if (!shouldContinueDispatch) break;
+        await admitClaimedDecision(decision);
       }
     }
     const startedCount = outcomes.filter((o) => o.started).length;
@@ -8947,8 +8960,8 @@ function resolveOpenAiCodexRetryBudget(input) {
   const env = input.env ?? process.env;
   const base = Math.max(1, input.defaultRetries ?? 3);
   const provider = String(input.provider ?? "").toLowerCase();
-  const platform = String(input.platform ?? "").toLowerCase();
-  if (provider !== OPENAI_CODEX_PROVIDER || platform !== "cron") {
+  const platform2 = String(input.platform ?? "").toLowerCase();
+  if (provider !== OPENAI_CODEX_PROVIDER || platform2 !== "cron") {
     return base;
   }
   const raw = env.HERMES_CODEX_CRON_API_MAX_RETRIES?.trim();
@@ -10489,7 +10502,9 @@ function createRun(args) {
     workers: {}
   };
   writeJson(path38.join(dir, "run.json"), run);
-  console.log(JSON.stringify({ runId: id, runDir: dir, repo, base, baseCommit }, null, 2));
+  const info = { runId: id, runDir: dir, repo, base, baseCommit };
+  console.log(JSON.stringify(info, null, 2));
+  return info;
 }
 function listRuns() {
   listRunsCli();
@@ -11027,11 +11042,11 @@ var LIVE_SKIP_REASONS = /* @__PURE__ */ new Set([
 function collectPreservedLivePaths(actions, skips) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const push = (path75, reason, detail) => {
-    const key = `${path75}\0${reason}`;
+  const push = (path79, reason, detail) => {
+    const key = `${path79}\0${reason}`;
     if (seen.has(key) || out.length >= MAX_PRESERVED_LIVE_PATH_SAMPLES) return;
     seen.add(key);
-    out.push({ path: path75, reason, ...detail ? { detail } : {} });
+    out.push({ path: path79, reason, ...detail ? { detail } : {} });
   };
   for (const skip2 of skips) {
     if (!LIVE_SKIP_REASONS.has(skip2.reason)) continue;
@@ -11967,7 +11982,10 @@ function observeCleanupDiskPressure(input = {}) {
     diskPath,
     diskMaxUsedPercent: input.diskMaxUsedPercent ?? maxUsedPercent
   });
-  const pressured = !diskGate.ok || diskGate.usedPercent >= maxUsedPercent;
+  let pressured = !diskGate.ok || diskGate.usedPercent >= maxUsedPercent;
+  const force = process.env.KYNVER_CLEANUP_DISK_PRESSURE_FORCE?.trim().toLowerCase();
+  if (force === "none" || force === "off" || force === "0") pressured = false;
+  else if (force === "pressured" || force === "on" || force === "1") pressured = true;
   return { diskGate, pressured, maxUsedPercent };
 }
 function applyDiskPressureToRetention(retention, pressure) {
@@ -12448,7 +12466,7 @@ function isPipelineCleanupEnabled() {
 
 // src/cli.ts
 init_config();
-import { mkdirSync as mkdirSync11, realpathSync } from "node:fs";
+import { mkdirSync as mkdirSync13, realpathSync } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/bootstrap.ts
@@ -12510,68 +12528,13 @@ async function runBootstrap(args) {
   await runSetup(setupArgs);
   console.log("");
   console.log(`  Bootstrap complete \u2014 ${os9.hostname()} is linked to workspace "${primary.slug}".`);
-  console.log("  Next: run autonomous work with `kynver daemon --run <RUN_ID> --agent-os-id <AOS_ID> --execute`");
-  console.log("  (create a run first with `kynver run create --repo /path/to/repo`).");
+  console.log("  Next: bring your agent online with `kynver start`.");
+  console.log("  (Advanced: `kynver run create --repo /path/to/repo` + `kynver daemon --run <RUN_ID> --agent-os-id <AOS_ID> --execute`.)");
 }
 
-// src/cli.ts
-init_run_store();
-
-// src/discard-disposable.ts
-init_run_store();
-init_status();
-import { existsSync as existsSync41, rmSync as rmSync4 } from "node:fs";
-import path54 from "node:path";
-function normalizeRelativePath2(value) {
-  const normalized = value.replace(/\\/g, "/").replace(/^\.\//, "").trim();
-  if (!normalized || normalized.startsWith("/") || normalized.includes("..")) {
-    throw new Error(`unsafe path: ${value}`);
-  }
-  return normalized;
-}
-function parsePathsArg(raw) {
-  if (typeof raw !== "string" || !raw.trim()) return [];
-  return raw.split(",").map((p) => p.trim()).filter(Boolean);
-}
-function discardDisposableArtifacts(args) {
-  const { runId, workerName } = resolveWorkerTargetArgs(args);
-  const worker = loadWorker(runId, workerName);
-  const paths = [
-    ...parsePathsArg(args.path),
-    ...Array.isArray(args.paths) ? args.paths : []
-  ];
-  if (paths.length === 0) {
-    return { ok: false, removed: [], reason: "requires at least one --path" };
-  }
-  const worktreeRoot = path54.resolve(worker.worktreePath);
-  const removed = [];
-  for (const raw of paths) {
-    const rel = normalizeRelativePath2(raw);
-    const abs = path54.resolve(worktreeRoot, rel);
-    if (!abs.startsWith(worktreeRoot + path54.sep) && abs !== worktreeRoot) {
-      return { ok: false, removed, reason: `path escapes worktree: ${raw}` };
-    }
-    if (!existsSync41(abs)) {
-      return { ok: false, removed, reason: `path not found: ${raw}` };
-    }
-    rmSync4(abs, { recursive: true, force: true });
-    removed.push(rel);
-  }
-  const prior = Array.isArray(worker.disposableArtifactsRemoved) ? worker.disposableArtifactsRemoved.filter((p) => typeof p === "string") : [];
-  worker.disposableArtifactsRemoved = [.../* @__PURE__ */ new Set([...prior, ...removed])];
-  saveWorker(worker.runId, worker);
-  const status = computeWorkerStatus(worker);
-  return {
-    ok: true,
-    removed,
-    ...status.changedFiles.length ? { reason: "worktree still has other changes" } : {}
-  };
-}
-function discardDisposableCli(args) {
-  const result = discardDisposableArtifacts(args);
-  console.log(JSON.stringify(result, null, 2));
-  if (!result.ok) process.exit(1);
-}
+// src/start.ts
+init_config();
+import os12 from "node:os";
 
 // src/daemon.ts
 init_config();
@@ -12621,15 +12584,15 @@ function validateDaemonInstallIdentity(config = loadUserConfig(), env = process.
 // src/daemon-heartbeat.ts
 import { mkdirSync as mkdirSync7, readFileSync as readFileSync16, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
 import { homedir as homedir14 } from "node:os";
-import path55 from "node:path";
+import path54 from "node:path";
 function daemonHeartbeatPath(agentOsId) {
   const safe = agentOsId.replace(/[^A-Za-z0-9_-]/g, "_");
-  return path55.join(homedir14(), ".kynver", `daemon-heartbeat-${safe}.json`);
+  return path54.join(homedir14(), ".kynver", `daemon-heartbeat-${safe}.json`);
 }
 function writeDaemonHeartbeat(input) {
   try {
     const file = daemonHeartbeatPath(input.agentOsId);
-    mkdirSync7(path55.dirname(file), { recursive: true });
+    mkdirSync7(path54.dirname(file), { recursive: true });
     const beat = {
       observedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
       pid: process.pid,
@@ -12679,9 +12642,9 @@ function assertNativeDaemonAllowed() {
 
 // src/cron/cron-env.ts
 init_config();
-import { existsSync as existsSync42 } from "node:fs";
+import { existsSync as existsSync41 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
-import path56 from "node:path";
+import path55 from "node:path";
 function envFlag4(name, defaultValue) {
   const raw = process.env[name]?.trim().toLowerCase();
   if (!raw) return defaultValue;
@@ -12697,7 +12660,7 @@ function envInt(name, fallback, min = 1) {
 function defaultKynverCronStorePath() {
   const explicit = process.env.KYNVER_CRON_STORE_PATH?.trim() || process.env.OPENCLAW_CRON_STORE_PATH?.trim();
   if (explicit) return explicit;
-  return path56.join(homedir15(), ".kynver", "agent-os-cron.json");
+  return path55.join(homedir15(), ".kynver", "agent-os-cron.json");
 }
 function defaultKynverCronStatePath(storePath = defaultKynverCronStorePath()) {
   const explicit = process.env.KYNVER_CRON_TICK_STATE_PATH?.trim();
@@ -12717,7 +12680,7 @@ function resolveKynverCronEnv() {
   const fireBaseUrl = resolveKynverCronFireBaseUrl();
   const secret = resolveKynverCronSecret();
   const credsReady = Boolean(fireBaseUrl && secret);
-  const storeExists = existsSync42(storePath);
+  const storeExists = existsSync41(storePath);
   const defaultEnabled = credsReady && (storeExists || envFlag4("KYNVER_CRON_TICK_FORCE", false));
   return {
     storePath,
@@ -12771,10 +12734,10 @@ async function fireKynverCronJob(input) {
 
 // src/cron/cron-lock.ts
 init_util();
-import { closeSync as closeSync6, existsSync as existsSync43, openSync as openSync6, readFileSync as readFileSync17, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { closeSync as closeSync6, existsSync as existsSync42, openSync as openSync6, readFileSync as readFileSync17, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
 var STALE_LOCK_MS = 10 * 6e4;
 function readLockInfo(lockPath) {
-  if (!existsSync43(lockPath)) return null;
+  if (!existsSync42(lockPath)) return null;
   try {
     const parsed = JSON.parse(readFileSync17(lockPath, "utf8"));
     if (typeof parsed.pid === "number" && typeof parsed.at === "string") return parsed;
@@ -12792,14 +12755,14 @@ function lockIsStale(lockPath) {
   return Date.now() - atMs > STALE_LOCK_MS;
 }
 function tryAcquireCronTickLock(lockPath) {
-  if (existsSync43(lockPath) && !lockIsStale(lockPath)) {
+  if (existsSync42(lockPath) && !lockIsStale(lockPath)) {
     const info = readLockInfo(lockPath);
     return {
       acquired: false,
       reason: info ? `held by pid ${info.pid}` : "held by another process"
     };
   }
-  if (existsSync43(lockPath)) {
+  if (existsSync42(lockPath)) {
     try {
       unlinkSync3(lockPath);
     } catch {
@@ -12936,11 +12899,34 @@ async function loadCronJobs(storePath = defaultKynverCronStorePath()) {
   const raw = await readFileIfExists(storePath);
   return parseCronStore(raw);
 }
+async function writeCronStore(storePath, entries) {
+  const { mkdir, writeFile, rename } = await import("node:fs/promises");
+  const { randomBytes: randomBytes3 } = await import("node:crypto");
+  const { dirname: dirname3 } = await import("node:path");
+  await mkdir(dirname3(storePath), { recursive: true });
+  const tmp = `${storePath}.${randomBytes3(4).toString("hex")}.tmp`;
+  const body = JSON.stringify({ entries }, null, 2);
+  await writeFile(tmp, body, "utf8");
+  await rename(tmp, storePath);
+}
+async function saveCronJob(entry, storePath = defaultKynverCronStorePath()) {
+  const entries = await loadCronJobs(storePath);
+  const idx = entries.findIndex((e) => e.providerScheduleId === entry.providerScheduleId);
+  if (idx >= 0) entries[idx] = entry;
+  else entries.push(entry);
+  await writeCronStore(storePath, entries);
+}
+async function ensureCronStoreInitialized(storePath = defaultKynverCronStorePath()) {
+  const raw = await readFileIfExists(storePath);
+  if (raw !== null) return { created: false };
+  await writeCronStore(storePath, []);
+  return { created: true };
+}
 
 // src/cron/cron-tick-state.ts
 import { randomBytes } from "node:crypto";
 import { promises as fs4 } from "node:fs";
-import path57 from "node:path";
+import path56 from "node:path";
 var EMPTY = { version: 1, jobs: {} };
 async function readFileIfExists2(filePath) {
   try {
@@ -12967,7 +12953,7 @@ async function loadCronTickState(statePath) {
   return parseCronTickState(raw);
 }
 async function writeStateAtomic(statePath, state) {
-  await fs4.mkdir(path57.dirname(statePath), { recursive: true });
+  await fs4.mkdir(path56.dirname(statePath), { recursive: true });
   const suffix = randomBytes(6).toString("hex");
   const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}-${suffix}`;
   await fs4.writeFile(tmp, `${JSON.stringify(state, null, 2)}
@@ -13147,7 +13133,7 @@ async function runKynverCronTick(opts = {}) {
 init_util();
 
 // src/pipeline-tick.ts
-import path60 from "node:path";
+import path59 from "node:path";
 init_config();
 
 // src/pipeline-dispatch.ts
@@ -13289,7 +13275,7 @@ init_util();
 init_status();
 init_run_store();
 init_util();
-import path58 from "node:path";
+import path57 from "node:path";
 
 // src/plan-progress-sync.ts
 init_config();
@@ -13314,7 +13300,7 @@ async function syncActiveWorkerPlanProgress(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path58.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path57.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.dispatched || !worker.taskId) continue;
@@ -13682,10 +13668,10 @@ function collectProviderEvidence(wanted, opts = {}) {
 // src/provider-evidence/wanted-store.ts
 init_run_store();
 init_util();
-import path59 from "node:path";
+import path58 from "node:path";
 var WANTED_FILE = "provider-evidence-wanted.json";
 function wantedFilePath(runId) {
-  return path59.join(runDirectory(runId), WANTED_FILE);
+  return path58.join(runDirectory(runId), WANTED_FILE);
 }
 function parseWantedItems(value) {
   if (!Array.isArray(value)) return [];
@@ -13724,7 +13710,7 @@ async function completeFinishedWorkers(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path60.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path59.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || worker.localOnly) continue;
@@ -13892,6 +13878,389 @@ async function runPipelineTick(args) {
   };
 }
 
+// src/chat/chat-claim-loop.ts
+init_config();
+import os11 from "node:os";
+
+// src/chat/anthropic-credentials.ts
+import { readFileSync as readFileSync18 } from "node:fs";
+import { homedir as homedir16, platform } from "node:os";
+import path60 from "node:path";
+import { execFileSync as execFileSync4 } from "node:child_process";
+function parseClaudeCredentials(raw, now = Date.now()) {
+  try {
+    const blob = JSON.parse(raw);
+    const token = blob.claudeAiOauth?.accessToken;
+    const expiresAt = blob.claudeAiOauth?.expiresAt;
+    if (typeof token !== "string" || !token) return null;
+    if (typeof expiresAt === "number" && expiresAt - now < 6e4) return null;
+    return token;
+  } catch {
+    return null;
+  }
+}
+function readClaudeCliToken() {
+  if (platform() === "darwin") {
+    try {
+      const raw = execFileSync4(
+        "security",
+        ["find-generic-password", "-s", "Claude Code-credentials", "-w"],
+        { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }
+      );
+      return parseClaudeCredentials(raw.trim());
+    } catch {
+      return null;
+    }
+  }
+  try {
+    const raw = readFileSync18(path60.join(homedir16(), ".claude", ".credentials.json"), "utf8");
+    return parseClaudeCredentials(raw);
+  } catch {
+    return null;
+  }
+}
+function resolveLocalAnthropicCredentials(env = process.env) {
+  const apiKey = env.ANTHROPIC_API_KEY?.trim();
+  if (apiKey) return { kind: "api_key", key: apiKey };
+  const optIn = env.KYNVER_CHAT_USE_CLAUDE_OAUTH;
+  if (optIn === "1" || optIn === "true" || optIn === "yes") {
+    const token = readClaudeCliToken();
+    if (token) return { kind: "oauth", token };
+  }
+  return null;
+}
+
+// src/chat/anthropic-stream.ts
+var CLAUDE_CODE_IDENTITY = "You are Claude Code, Anthropic's official CLI for Claude.";
+function createAnthropicAccumulator() {
+  return { blocks: [], stopReason: null, inputTokens: 0, outputTokens: 0 };
+}
+function foldAnthropicEvent(acc, event) {
+  const e = event;
+  switch (e.type) {
+    case "message_start":
+      acc.inputTokens = e.message?.usage?.input_tokens ?? 0;
+      return "";
+    case "content_block_start": {
+      const idx = e.index ?? acc.blocks.length;
+      acc.blocks[idx] = {
+        type: e.content_block?.type === "tool_use" ? "tool_use" : "text",
+        text: "",
+        id: e.content_block?.id,
+        name: e.content_block?.name,
+        inputJson: ""
+      };
+      return "";
+    }
+    case "content_block_delta": {
+      const block = acc.blocks[e.index ?? acc.blocks.length - 1];
+      if (!block) return "";
+      if (e.delta?.type === "text_delta" && e.delta.text) {
+        block.text += e.delta.text;
+        return e.delta.text;
+      }
+      if (e.delta?.type === "input_json_delta" && e.delta.partial_json) {
+        block.inputJson += e.delta.partial_json;
+      }
+      return "";
+    }
+    case "message_delta":
+      if (e.delta?.stop_reason) acc.stopReason = e.delta.stop_reason;
+      if (typeof e.usage?.output_tokens === "number") acc.outputTokens = e.usage.output_tokens;
+      return "";
+    default:
+      return "";
+  }
+}
+function toLocalTurnMessage(acc) {
+  const content = [];
+  for (const block of acc.blocks) {
+    if (!block) continue;
+    if (block.type === "tool_use") {
+      let input = {};
+      try {
+        input = block.inputJson ? JSON.parse(block.inputJson) : {};
+      } catch {
+        input = {};
+      }
+      content.push({ type: "tool_use", id: block.id ?? "", name: block.name ?? "", input });
+    } else if (block.text) {
+      content.push({ type: "text", text: block.text });
+    }
+  }
+  return {
+    content,
+    stop_reason: acc.stopReason ?? "end_turn",
+    usage: { input_tokens: acc.inputTokens, output_tokens: acc.outputTokens }
+  };
+}
+async function* parseSseLines(body) {
+  const reader = body.getReader();
+  const decoder = new TextDecoder();
+  let buffer = "";
+  try {
+    for (; ; ) {
+      const { done, value } = await reader.read();
+      if (done) break;
+      buffer += decoder.decode(value, { stream: true });
+      let idx;
+      while ((idx = buffer.indexOf("\n")) !== -1) {
+        const line = buffer.slice(0, idx).trim();
+        buffer = buffer.slice(idx + 1);
+        if (!line.startsWith("data:")) continue;
+        const payload = line.slice(5).trim();
+        if (!payload || payload === "[DONE]") continue;
+        try {
+          yield JSON.parse(payload);
+        } catch {
+        }
+      }
+    }
+  } finally {
+    reader.releaseLock();
+  }
+}
+function getAnthropicBaseUrl(env = process.env) {
+  return (env.ANTHROPIC_BASE_URL?.trim() || "https://api.anthropic.com").replace(/\/$/, "");
+}
+async function streamLocalAnthropicTurn(input) {
+  const { creds, model, payload } = input;
+  const headers = {
+    "Content-Type": "application/json",
+    "anthropic-version": "2023-06-01"
+  };
+  let system = payload.system;
+  if (creds.kind === "api_key") {
+    headers["x-api-key"] = creds.key;
+  } else {
+    headers.Authorization = `Bearer ${creds.token}`;
+    headers["anthropic-beta"] = "oauth-2025-04-20";
+    system = [
+      { type: "text", text: CLAUDE_CODE_IDENTITY },
+      { type: "text", text: payload.system }
+    ];
+  }
+  const res = await fetch(`${getAnthropicBaseUrl()}/v1/messages`, {
+    method: "POST",
+    headers,
+    signal: input.signal,
+    body: JSON.stringify({
+      model,
+      max_tokens: payload.maxTokens,
+      system,
+      messages: payload.messages,
+      ...Array.isArray(payload.tools) && payload.tools.length > 0 ? { tools: payload.tools } : {},
+      ...payload.temperature !== void 0 ? { temperature: payload.temperature } : {},
+      stream: true
+    })
+  });
+  if (!res.ok || !res.body) {
+    const detail = await res.text().catch(() => "");
+    throw new Error(`Anthropic stream failed: HTTP ${res.status}${detail ? ` \u2014 ${detail.slice(0, 300)}` : ""}`);
+  }
+  const acc = createAnthropicAccumulator();
+  for await (const event of parseSseLines(res.body)) {
+    const delta = foldAnthropicEvent(acc, event);
+    if (delta) input.onDelta(delta);
+  }
+  return toLocalTurnMessage(acc);
+}
+
+// src/chat/delta-batcher.ts
+var DELTA_FLUSH_FLOOR_MS = 150;
+var DeltaBatcher = class {
+  constructor(flushFn, floorMs = DELTA_FLUSH_FLOOR_MS) {
+    this.flushFn = flushFn;
+    this.floorMs = floorMs;
+  }
+  buffer = "";
+  timer = null;
+  closed = false;
+  push(text) {
+    if (this.closed || !text) return;
+    this.buffer += text;
+    if (!this.timer) {
+      this.timer = setTimeout(() => {
+        this.timer = null;
+        this.flushNow();
+      }, this.floorMs);
+    }
+  }
+  flushNow() {
+    if (!this.buffer) return;
+    const text = this.buffer;
+    this.buffer = "";
+    this.flushFn(text);
+  }
+  /** Flush any remainder and stop the timer. Idempotent. */
+  close() {
+    if (this.closed) return;
+    this.closed = true;
+    if (this.timer) {
+      clearTimeout(this.timer);
+      this.timer = null;
+    }
+    this.flushNow();
+  }
+};
+
+// src/chat/chat-claim-loop.ts
+var CLAIM_WAIT_MS = 25e3;
+var CLAIM_FETCH_TIMEOUT_MS = 32e3;
+var ERROR_BACKOFF_MS = 5e3;
+var AUTH_BACKOFF_MS = 6e4;
+var DEFAULT_CHAT_MODEL = "claude-sonnet-4-6";
+function resolveChatBridgeTarget(env = process.env) {
+  const bridgeUrl = env.KYNVER_RUNTIME_CHAT_BRIDGE_URL?.trim();
+  if (!bridgeUrl) return null;
+  const config = loadUserConfig();
+  const agentOsId = config.agentOsId?.trim();
+  const apiKey = loadApiKey();
+  if (!agentOsId || !apiKey) return null;
+  return {
+    bridgeUrl: bridgeUrl.replace(/\/$/, ""),
+    agentOsId,
+    apiKey,
+    boxId: os11.hostname(),
+    model: env.KYNVER_CHAT_MODEL?.trim() || config.defaultModel?.trim() || DEFAULT_CHAT_MODEL
+  };
+}
+async function claimOnce(target, shouldStop) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), CLAIM_FETCH_TIMEOUT_MS);
+  const stopPoll = setInterval(() => {
+    if (shouldStop()) controller.abort();
+  }, 500);
+  try {
+    const res = await fetch(`${target.bridgeUrl}/runtime-chat/claim`, {
+      method: "POST",
+      headers: {
+        "Content-Type": "application/json",
+        Authorization: `Bearer ${target.apiKey}`
+      },
+      body: JSON.stringify({
+        agentOsId: target.agentOsId,
+        boxId: target.boxId,
+        waitMs: CLAIM_WAIT_MS
+      }),
+      signal: controller.signal
+    });
+    if (res.status === 204) return null;
+    if (res.status === 401 || res.status === 403) return "auth_error";
+    if (!res.ok) throw new Error(`claim failed: HTTP ${res.status}`);
+    const body = await res.json().catch(() => null);
+    return body?.turn ?? null;
+  } catch (err) {
+    if (shouldStop()) return null;
+    throw err;
+  } finally {
+    clearTimeout(timer);
+    clearInterval(stopPoll);
+  }
+}
+async function pushEvents(target, turnId, events) {
+  const res = await fetch(`${target.bridgeUrl}/runtime-chat/turns/${encodeURIComponent(turnId)}/events`, {
+    method: "POST",
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${target.apiKey}`
+    },
+    body: JSON.stringify({ agentOsId: target.agentOsId, events })
+  });
+  return res.ok;
+}
+async function executeChatTurn(target, turn) {
+  let seq = 0;
+  let turnClosed = false;
+  const abort = new AbortController();
+  const sendBatch = (text) => {
+    if (turnClosed) return;
+    void pushEvents(target, turn.turnId, [{ seq: seq++, kind: "delta", text }]).then((ok) => {
+      if (!ok) {
+        turnClosed = true;
+        abort.abort();
+      }
+    });
+  };
+  const batcher = new DeltaBatcher(sendBatch);
+  const creds = resolveLocalAnthropicCredentials();
+  if (!creds) {
+    await pushEvents(target, turn.turnId, [
+      { seq: 0, kind: "error", error: "no_local_credentials" }
+    ]).catch(() => {
+    });
+    return;
+  }
+  try {
+    const message = await streamLocalAnthropicTurn({
+      creds,
+      model: target.model,
+      payload: turn.payload,
+      onDelta: (text) => batcher.push(text),
+      signal: abort.signal
+    });
+    batcher.close();
+    if (!turnClosed) {
+      await pushEvents(target, turn.turnId, [{ seq: seq++, kind: "final", message }]);
+    }
+    console.error(JSON.stringify({ event: "chat_turn_done", turnId: turn.turnId, model: target.model }));
+  } catch (err) {
+    batcher.close();
+    if (!turnClosed) {
+      await pushEvents(target, turn.turnId, [
+        { seq: seq++, kind: "error", error: err instanceof Error ? err.message : String(err) }
+      ]).catch(() => {
+      });
+    }
+    console.error(
+      JSON.stringify({
+        event: "chat_turn_error",
+        turnId: turn.turnId,
+        error: err instanceof Error ? err.message : String(err)
+      })
+    );
+  }
+}
+async function sleep2(ms, shouldStop) {
+  const step = 500;
+  for (let waited = 0; waited < ms && !shouldStop(); waited += step) {
+    await new Promise((resolve2) => setTimeout(resolve2, Math.min(step, ms - waited)));
+  }
+}
+async function runChatClaimLoop(opts) {
+  const target = resolveChatBridgeTarget();
+  if (!target) return;
+  console.error(
+    JSON.stringify({
+      event: "chat_claim_loop_start",
+      bridgeUrl: target.bridgeUrl,
+      agentOsId: target.agentOsId,
+      boxId: target.boxId,
+      model: target.model
+    })
+  );
+  while (!opts.shouldStop()) {
+    try {
+      const claimed = await claimOnce(target, opts.shouldStop);
+      if (claimed === "auth_error") {
+        console.error(JSON.stringify({ event: "chat_claim_auth_error" }));
+        await sleep2(AUTH_BACKOFF_MS, opts.shouldStop);
+        continue;
+      }
+      if (claimed) await executeChatTurn(target, claimed);
+    } catch (err) {
+      console.error(
+        JSON.stringify({
+          event: "chat_claim_error",
+          error: err instanceof Error ? err.message : String(err)
+        })
+      );
+      await sleep2(ERROR_BACKOFF_MS, opts.shouldStop);
+    }
+  }
+  console.error(JSON.stringify({ event: "chat_claim_loop_stop" }));
+}
+
 // src/daemon.ts
 var DEFAULT_INTERVAL_MS = 6e4;
 var IDLE_INTERVAL_MS = 5 * 6e4;
@@ -13944,6 +14313,14 @@ async function runDaemon(args) {
     })
   );
   const cronEnv = resolveKynverCronEnv();
+  const chatLoop = runChatClaimLoop({ shouldStop: () => stopping }).catch((err) => {
+    console.error(
+      JSON.stringify({
+        event: "chat_claim_loop_crashed",
+        error: err instanceof Error ? err.message : String(err)
+      })
+    );
+  });
   while (!stopping) {
     try {
       writeDaemonHeartbeat({ agentOsId, runId });
@@ -13970,40 +14347,143 @@ async function runDaemon(args) {
       await awaitDaemonBackoff(intervalMs, () => stopping);
     }
   }
+  await chatLoop;
   console.error(JSON.stringify({ event: "daemon_stop", runId, agentOsId }));
 }
 
-// src/daemon-keeper.ts
-init_config();
-import { spawn as spawn6 } from "node:child_process";
-init_util();
-var DEFAULT_STALL_MS = 15 * 6e4;
-var STARTUP_GRACE_MS = 2 * 6e4;
-var KILL_GRACE_MS = 1e4;
-var BACKOFF_BASE_MS = 5e3;
-var BACKOFF_CAP_MS = 5 * 6e4;
-var HEALTHY_RESET_MS = 30 * 6e4;
-var POLL_MS = 5e3;
-function resolveKeeperStallMs(flag, env = process.env) {
-  const fromFlag = typeof flag === "string" ? Number.parseInt(flag, 10) : NaN;
-  if (Number.isFinite(fromFlag) && fromFlag > 0) return fromFlag;
-  const fromEnv = Number.parseInt(env.KYNVER_DAEMON_STALL_MS ?? "", 10);
-  if (Number.isFinite(fromEnv) && fromEnv > 0) return fromEnv;
-  return DEFAULT_STALL_MS;
+// src/start.ts
+init_run_store();
+function resolveStartRunId(runs, repo) {
+  const candidates = runs.filter((r) => r.repo === repo && !TERMINAL_RUN_STATUSES.has(r.status)).sort((a, b) => (b.createdAt ?? "").localeCompare(a.createdAt ?? ""));
+  return candidates[0]?.id ?? null;
 }
-function shouldRunDaemonKeeper(args, env = process.env) {
-  if (args.keeperChild === true || args.keeperChild === "true") return false;
-  if (args.noSupervise === true || args.noSupervise === "true") return false;
-  if (args.supervised === "false") return false;
-  const envFlag5 = (env.KYNVER_DAEMON_SUPERVISED ?? "").trim().toLowerCase();
-  if (envFlag5 === "0" || envFlag5 === "false" || envFlag5 === "no" || envFlag5 === "off") {
-    return false;
+async function runStart(args) {
+  assertNativeDaemonAllowed();
+  let config = loadUserConfig();
+  if (!loadApiKey() || !config.agentOsId?.trim()) {
+    console.log("  This machine isn't linked yet \u2014 running bootstrap first.");
+    await runBootstrap(args);
+    config = loadUserConfig();
   }
-  return true;
+  const agentOsId = (typeof args.agentOsId === "string" ? args.agentOsId.trim() : "") || config.agentOsId?.trim() || "";
+  if (!agentOsId) {
+    console.error("No AgentOS workspace configured \u2014 run `kynver bootstrap` (or pass --agent-os-id).");
+    process.exit(1);
+  }
+  const repo = (typeof args.repo === "string" ? args.repo.trim() : "") || config.defaultRepo?.trim() || resolveDefaultRepo()?.repo || "";
+  if (!repo) {
+    console.error("No repo configured \u2014 pass --repo /path/to/repo or run `kynver setup --discover-repo`.");
+    process.exit(1);
+  }
+  let runId = typeof args.run === "string" && args.run.trim() ? args.run.trim() : "";
+  if (!runId) {
+    runId = resolveStartRunId(listRunRecords(), repo) ?? "";
+    if (runId) {
+      console.log(`  Reusing run ${runId} for ${repo}.`);
+    } else {
+      runId = createRun({ ...args, repo, name: "agent" }).runId;
+    }
+  }
+  console.log("");
+  console.log(`  ${os12.hostname()} \u2014 agent coming online`);
+  console.log(`    workspace: ${agentOsId}`);
+  console.log(`    repo:      ${repo}`);
+  console.log(`    run:       ${runId}`);
+  console.log("  Ctrl-C stops the agent. (Advanced control: `kynver daemon --help`.)");
+  console.log("");
+  await runDaemon({ ...args, run: runId, agentOsId });
 }
-function nextKeeperBackoffMs(consecutiveFailures, base = BACKOFF_BASE_MS, cap = BACKOFF_CAP_MS) {
-  const exp = Math.min(Math.max(consecutiveFailures, 1) - 1, 10);
-  return Math.min(base * 2 ** exp, cap);
+
+// src/cli.ts
+init_run_store();
+
+// src/discard-disposable.ts
+init_run_store();
+init_status();
+import { existsSync as existsSync43, rmSync as rmSync4 } from "node:fs";
+import path61 from "node:path";
+function normalizeRelativePath2(value) {
+  const normalized = value.replace(/\\/g, "/").replace(/^\.\//, "").trim();
+  if (!normalized || normalized.startsWith("/") || normalized.includes("..")) {
+    throw new Error(`unsafe path: ${value}`);
+  }
+  return normalized;
+}
+function parsePathsArg(raw) {
+  if (typeof raw !== "string" || !raw.trim()) return [];
+  return raw.split(",").map((p) => p.trim()).filter(Boolean);
+}
+function discardDisposableArtifacts(args) {
+  const { runId, workerName } = resolveWorkerTargetArgs(args);
+  const worker = loadWorker(runId, workerName);
+  const paths = [
+    ...parsePathsArg(args.path),
+    ...Array.isArray(args.paths) ? args.paths : []
+  ];
+  if (paths.length === 0) {
+    return { ok: false, removed: [], reason: "requires at least one --path" };
+  }
+  const worktreeRoot = path61.resolve(worker.worktreePath);
+  const removed = [];
+  for (const raw of paths) {
+    const rel = normalizeRelativePath2(raw);
+    const abs = path61.resolve(worktreeRoot, rel);
+    if (!abs.startsWith(worktreeRoot + path61.sep) && abs !== worktreeRoot) {
+      return { ok: false, removed, reason: `path escapes worktree: ${raw}` };
+    }
+    if (!existsSync43(abs)) {
+      return { ok: false, removed, reason: `path not found: ${raw}` };
+    }
+    rmSync4(abs, { recursive: true, force: true });
+    removed.push(rel);
+  }
+  const prior = Array.isArray(worker.disposableArtifactsRemoved) ? worker.disposableArtifactsRemoved.filter((p) => typeof p === "string") : [];
+  worker.disposableArtifactsRemoved = [.../* @__PURE__ */ new Set([...prior, ...removed])];
+  saveWorker(worker.runId, worker);
+  const status = computeWorkerStatus(worker);
+  return {
+    ok: true,
+    removed,
+    ...status.changedFiles.length ? { reason: "worktree still has other changes" } : {}
+  };
+}
+function discardDisposableCli(args) {
+  const result = discardDisposableArtifacts(args);
+  console.log(JSON.stringify(result, null, 2));
+  if (!result.ok) process.exit(1);
+}
+
+// src/daemon-keeper.ts
+init_config();
+import { spawn as spawn6 } from "node:child_process";
+init_util();
+var DEFAULT_STALL_MS = 15 * 6e4;
+var STARTUP_GRACE_MS = 2 * 6e4;
+var KILL_GRACE_MS = 1e4;
+var BACKOFF_BASE_MS = 5e3;
+var BACKOFF_CAP_MS = 5 * 6e4;
+var HEALTHY_RESET_MS = 30 * 6e4;
+var POLL_MS = 5e3;
+function resolveKeeperStallMs(flag, env = process.env) {
+  const fromFlag = typeof flag === "string" ? Number.parseInt(flag, 10) : NaN;
+  if (Number.isFinite(fromFlag) && fromFlag > 0) return fromFlag;
+  const fromEnv = Number.parseInt(env.KYNVER_DAEMON_STALL_MS ?? "", 10);
+  if (Number.isFinite(fromEnv) && fromEnv > 0) return fromEnv;
+  return DEFAULT_STALL_MS;
+}
+function shouldRunDaemonKeeper(args, env = process.env) {
+  if (args.keeperChild === true || args.keeperChild === "true") return false;
+  if (args.noSupervise === true || args.noSupervise === "true") return false;
+  if (args.supervised === "false") return false;
+  const envFlag5 = (env.KYNVER_DAEMON_SUPERVISED ?? "").trim().toLowerCase();
+  if (envFlag5 === "0" || envFlag5 === "false" || envFlag5 === "no" || envFlag5 === "off") {
+    return false;
+  }
+  return true;
+}
+function nextKeeperBackoffMs(consecutiveFailures, base = BACKOFF_BASE_MS, cap = BACKOFF_CAP_MS) {
+  const exp = Math.min(Math.max(consecutiveFailures, 1) - 1, 10);
+  return Math.min(base * 2 ** exp, cap);
 }
 function keeperRunWasHealthy(startedAtMs, endedAtMs, healthyMs = HEALTHY_RESET_MS) {
   return endedAtMs - startedAtMs >= healthyMs;
@@ -14106,7 +14586,7 @@ async function runDaemonKeeper(args, rawArgv = process.argv.slice(2)) {
 
 // src/plan-progress.ts
 init_config();
-import path64 from "node:path";
+import path65 from "node:path";
 
 // src/bounded-build/constants.ts
 var DEFAULT_BUILD_MEM_BUDGET_BYTES = 1536 * 1024 * 1024;
@@ -14251,20 +14731,20 @@ import {
   mkdirSync as mkdirSync9,
   openSync as openSync7,
   readdirSync as readdirSync15,
-  readFileSync as readFileSync18,
+  readFileSync as readFileSync19,
   unlinkSync as unlinkSync4,
   writeFileSync as writeFileSync6
 } from "node:fs";
-import path62 from "node:path";
+import path63 from "node:path";
 
 // src/heavy-verification/paths.ts
 import { mkdirSync as mkdirSync8 } from "node:fs";
-import path61 from "node:path";
+import path62 from "node:path";
 function resolveHeavyVerificationRoot() {
-  return path61.join(resolveKynverStateRoot(), "heavy-verification");
+  return path62.join(resolveKynverStateRoot(), "heavy-verification");
 }
 function heavyVerificationSlotsDir() {
-  return path61.join(resolveHeavyVerificationRoot(), "slots");
+  return path62.join(resolveHeavyVerificationRoot(), "slots");
 }
 function ensureHeavyVerificationDirs() {
   const dir = heavyVerificationSlotsDir();
@@ -14293,12 +14773,12 @@ function indexedSlotId(index) {
   return `slot-${index}`;
 }
 function slotFilePath(slotId, slotsDir = heavyVerificationSlotsDir()) {
-  return path62.join(slotsDir, `${slotId}.json`);
+  return path63.join(slotsDir, `${slotId}.json`);
 }
 function readSlotRecord(filePath) {
   if (!existsSync44(filePath)) return null;
   try {
-    const parsed = JSON.parse(readFileSync18(filePath, "utf8"));
+    const parsed = JSON.parse(readFileSync19(filePath, "utf8"));
     if (typeof parsed.slotId === "string" && typeof parsed.pid === "number" && typeof parsed.acquiredAt === "string" && typeof parsed.command === "string") {
       return parsed;
     }
@@ -14332,7 +14812,7 @@ function reclaimStaleHeavyVerificationSlots(opts = {}) {
   let reclaimed = 0;
   for (const name of readdirSync15(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const filePath = path62.join(slotsDir, name);
+    const filePath = path63.join(slotsDir, name);
     const before = existsSync44(filePath);
     reclaimStaleSlot(filePath, staleMs);
     if (before && !existsSync44(filePath)) reclaimed += 1;
@@ -14346,7 +14826,7 @@ function listActiveHeavyVerificationSlots(opts = {}) {
   const active = [];
   for (const name of readdirSync15(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const record3 = readSlotRecord(path62.join(slotsDir, name));
+    const record3 = readSlotRecord(path63.join(slotsDir, name));
     if (record3 && !slotIsStale(record3, staleMs)) active.push(record3);
   }
   return active;
@@ -14467,11 +14947,11 @@ function waitForHeavyVerificationSlot(command, timeoutMs, pollMs = 2e3, opts = {
 
 // src/harness-worktree-build-guard.ts
 init_paths();
-import path63 from "node:path";
+import path64 from "node:path";
 function isPathUnderHarnessWorktree(cwd) {
   const worktreesDir = harnessWorktreesDir(resolveHarnessRoot());
-  const rel = path63.relative(worktreesDir, path63.resolve(cwd));
-  return rel.length > 0 && !rel.startsWith("..") && !path63.isAbsolute(rel);
+  const rel = path64.relative(worktreesDir, path64.resolve(cwd));
+  return rel.length > 0 && !rel.startsWith("..") && !path64.isAbsolute(rel);
 }
 function assessHarnessWorktreeBuildGuard(cwd) {
   if (!isPathUnderHarnessWorktree(cwd)) return { ok: true };
@@ -14684,7 +15164,7 @@ async function emitPlanProgress(args) {
 }
 function verifyPlanLocal(args) {
   const worktree = required(args.worktree ? String(args.worktree) : void 0, "worktree");
-  const cwd = path64.resolve(worktree);
+  const cwd = path65.resolve(worktree);
   const summary = runHarnessVerifyCommands(cwd);
   const emitJson = args.json === true || args.json === "true";
   const payload = { passed: summary.passed, worktree: cwd, steps: summary.steps };
@@ -14733,10 +15213,10 @@ async function verifyPlan(args) {
 }
 
 // src/harness-verify-cli.ts
-import path65 from "node:path";
+import path66 from "node:path";
 init_util();
 function runHarnessVerifyCli(args) {
-  const cwd = path65.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
+  const cwd = path66.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
   const emitJson = args.json === true || args.json === "true" || args.emitJson === true || args.emitJson === "true";
   const commands = [];
   const rawCmd = args.command;
@@ -14782,7 +15262,7 @@ function runHarnessVerifyCli(args) {
 
 // src/plan-persist-cli.ts
 init_config();
-import { readFileSync as readFileSync19 } from "node:fs";
+import { readFileSync as readFileSync20 } from "node:fs";
 init_util();
 var OPERATIONS = ["create", "add_version", "update_metadata"];
 var FAILURE_KINDS = [
@@ -14795,7 +15275,7 @@ var FAILURE_KINDS = [
 function readBodyArg(args) {
   const bodyFile = args.bodyFile ? String(args.bodyFile) : void 0;
   if (bodyFile) {
-    return { body: readFileSync19(bodyFile, "utf8"), bodyPathHint: bodyFile };
+    return { body: readFileSync20(bodyFile, "utf8"), bodyPathHint: bodyFile };
   }
   const inline = args.body ? String(args.body) : void 0;
   if (inline) return { body: inline };
@@ -15175,7 +15655,7 @@ ${text.slice(0, 800)}`,
 }
 
 // src/monitor/monitor.service.ts
-import path67 from "node:path";
+import path68 from "node:path";
 init_run_store();
 init_status();
 init_util();
@@ -15235,10 +15715,10 @@ function classifyWorkerHealth(input) {
 init_paths();
 init_util();
 import { existsSync as existsSync45, mkdirSync as mkdirSync10, readdirSync as readdirSync16, unlinkSync as unlinkSync5 } from "node:fs";
-import path66 from "node:path";
+import path67 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path66.join(harnessRoot, "monitors");
+  const dir = path67.join(harnessRoot, "monitors");
   mkdirSync10(dir, { recursive: true });
   return dir;
 }
@@ -15246,7 +15726,7 @@ function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path66.join(monitorsDir(), `${monitorId}.json`);
+  return path67.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -15267,7 +15747,7 @@ function listMonitorSessions() {
   for (const name of readdirSync16(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path66.join(dir, name),
+      path67.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -15360,7 +15840,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path67.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path68.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -15570,17 +16050,17 @@ init_util();
 init_paths();
 import { spawn as spawn7 } from "node:child_process";
 import { closeSync as closeSync8, existsSync as existsSync46, openSync as openSync8 } from "node:fs";
-import path68 from "node:path";
+import path69 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path68.join(fileURLToPath4(new URL(".", import.meta.url)), "cli.js");
+  return path69.join(fileURLToPath4(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
   if (!existsSync46(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path68.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path69.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
     logFd = openSync8(logPath, "a");
@@ -15705,7 +16185,7 @@ init_run_store();
 init_status();
 init_util();
 init_config();
-import path69 from "node:path";
+import path70 from "node:path";
 function skip(runId, worker, taskId, agentOsId, leaseOwner, reason) {
   return { runId, worker, taskId, agentOsId, leaseOwner, action: "skipped", reason };
 }
@@ -15718,7 +16198,7 @@ async function postRestartUnblock(args) {
   const errors = [];
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers ?? {})) {
-      const workerPath = path69.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path70.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker) {
         skipped.push(skip(run.id, name, "", "", "", "worker.json missing"));
@@ -15832,9 +16312,9 @@ async function postRestartUnblockCli(args) {
 // src/default-repo-cli.ts
 init_path_values();
 init_config();
-import path70 from "node:path";
-import { homedir as homedir16 } from "node:os";
-var CONFIG_FILE2 = path70.join(homedir16(), ".kynver", "config.json");
+import path71 from "node:path";
+import { homedir as homedir17 } from "node:os";
+var CONFIG_FILE2 = path71.join(homedir17(), ".kynver", "config.json");
 function ensureDefaultRepo(opts) {
   const existing = loadUserConfig();
   const resolved = resolveDefaultRepo({ ...opts, config: existing });
@@ -15915,14 +16395,14 @@ function summarizeResolvedDefaultRepo(resolved) {
 }
 
 // src/doctor/runtime-takeover.ts
-import path72 from "node:path";
+import path73 from "node:path";
 init_path_values();
 
 // src/doctor/runtime-takeover.probes.ts
 init_config();
-import { accessSync, constants, existsSync as existsSync47, readFileSync as readFileSync20 } from "node:fs";
-import { homedir as homedir17 } from "node:os";
-import path71 from "node:path";
+import { accessSync, constants, existsSync as existsSync47, readFileSync as readFileSync21 } from "node:fs";
+import { homedir as homedir18 } from "node:os";
+import path72 from "node:path";
 import { spawnSync as spawnSync13 } from "node:child_process";
 init_paths();
 function captureCommand(bin, args) {
@@ -15965,15 +16445,15 @@ var defaultRuntimeTakeoverProbes = {
   commandOnPath: (bin) => captureCommand(process.platform === "win32" ? "where" : "which", [bin]),
   kynverVersion: (bin) => captureCommand(bin, ["--version"]),
   loadConfig: () => loadUserConfig(),
-  configFilePath: () => path71.join(homedir17(), ".kynver", "config.json"),
-  credentialsFilePath: () => path71.join(homedir17(), ".kynver", "credentials"),
+  configFilePath: () => path72.join(homedir18(), ".kynver", "config.json"),
+  credentialsFilePath: () => path72.join(homedir18(), ".kynver", "credentials"),
   readCredentials: () => {
-    const credPath = path71.join(homedir17(), ".kynver", "credentials");
+    const credPath = path72.join(homedir18(), ".kynver", "credentials");
     if (!existsSync47(credPath)) {
       return { hasApiKey: false };
     }
     try {
-      const parsed = JSON.parse(readFileSync20(credPath, "utf8"));
+      const parsed = JSON.parse(readFileSync21(credPath, "utf8"));
       return {
         hasApiKey: Boolean(parsed.apiKey?.trim()),
         runnerTokenPrefix: tokenPrefix(parsed.runnerToken),
@@ -16003,7 +16483,7 @@ var defaultRuntimeTakeoverProbes = {
     })()
   }),
   harnessRoot: () => resolveHarnessRoot(),
-  legacyOpenclawHarnessRoot: () => path71.join(homedir17(), ".openclaw", "harness"),
+  legacyOpenclawHarnessRoot: () => path72.join(homedir18(), ".openclaw", "harness"),
   pathExists: (target) => existsSync47(target),
   pathWritable: (target) => isWritable(target)
 };
@@ -16410,8 +16890,8 @@ function assessVercelDeployEvidence(probes) {
 }
 function assessHarnessDirs(probes) {
   const harnessRoot = probes.harnessRoot();
-  const runsDir = path72.join(harnessRoot, "runs");
-  const worktreesDir = path72.join(harnessRoot, "worktrees");
+  const runsDir = path73.join(harnessRoot, "runs");
+  const worktreesDir = path73.join(harnessRoot, "worktrees");
   const displayHarnessRoot = redactHomePath(harnessRoot);
   const displayRunsDir = redactHomePath(runsDir);
   const displayWorktreesDir = redactHomePath(worktreesDir);
@@ -16680,9 +17160,9 @@ function applySchedulerCutoverAttestation(config) {
 
 // src/scheduler-cutover-cli.ts
 init_config();
-import path73 from "node:path";
-import { homedir as homedir18 } from "node:os";
-var CONFIG_FILE3 = path73.join(homedir18(), ".kynver", "config.json");
+import path74 from "node:path";
+import { homedir as homedir19 } from "node:os";
+var CONFIG_FILE3 = path74.join(homedir19(), ".kynver", "config.json");
 function runSchedulerCutoverCheckCli(json = false) {
   const config = loadUserConfig();
   const report = assessSchedulerCutover(config);
@@ -16819,9 +17299,674 @@ async function runCronTickCli(args) {
   );
 }
 
+// src/cron/cron-install-cli.ts
+init_config();
+
+// src/cron/cron-install.ts
+init_config();
+init_path_values();
+init_util();
+import { existsSync as existsSync51 } from "node:fs";
+
+// src/cron/cron-id.ts
+import { createHash as createHash5 } from "node:crypto";
+function deterministicCronProviderId(spec) {
+  const seed = JSON.stringify({
+    cb: spec.callbackPath,
+    cron: spec.cron ?? null,
+    runAt: spec.runAt ?? null,
+    kind: spec.kind,
+    target: spec.target,
+    dedupeKey: spec.dedupeKey ?? null
+  });
+  const sha = createHash5("sha1").update(seed).digest("hex").slice(0, 16);
+  return `kc-cron:${sha}`;
+}
+
+// src/cron/cron-install-plan.ts
+import { homedir as homedir21 } from "node:os";
+import path76 from "node:path";
+
+// src/cron/cron-env-file.ts
+import { existsSync as existsSync48, mkdirSync as mkdirSync11, readFileSync as readFileSync22, writeFileSync as writeFileSync7 } from "node:fs";
+import { homedir as homedir20 } from "node:os";
+import path75 from "node:path";
+var DEFAULT_KYNVER_ENV_FILE = path75.join(homedir20(), ".kynver", ".env");
+function parseEnvFile(content) {
+  const map = /* @__PURE__ */ new Map();
+  for (const line of content.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#")) continue;
+    const eq = trimmed.indexOf("=");
+    if (eq <= 0) continue;
+    const key = trimmed.slice(0, eq).trim();
+    let value = trimmed.slice(eq + 1).trim();
+    if (value.startsWith('"') && value.endsWith('"') || value.startsWith("'") && value.endsWith("'")) {
+      value = value.slice(1, -1);
+    }
+    map.set(key, value);
+  }
+  return map;
+}
+function serializeEnvFile(values, header = "# Managed by kynver cron install \u2014 safe to edit; re-run install to merge keys.\n") {
+  const lines = [header.trimEnd(), ""];
+  for (const [key, value] of [...values.entries()].sort(([a], [b]) => a.localeCompare(b))) {
+    const escaped = value.includes(" ") || value.includes("#") || value.includes('"') ? `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"` : value;
+    lines.push(`${key}=${escaped}`);
+  }
+  lines.push("");
+  return lines.join("\n");
+}
+function readEnvFile(filePath = DEFAULT_KYNVER_ENV_FILE) {
+  if (!existsSync48(filePath)) return /* @__PURE__ */ new Map();
+  return parseEnvFile(readFileSync22(filePath, "utf8"));
+}
+function mergeEnvFile(updates, options = {}) {
+  const filePath = options.filePath ?? DEFAULT_KYNVER_ENV_FILE;
+  const existing = existsSync48(filePath) ? readFileSync22(filePath, "utf8") : "";
+  const map = parseEnvFile(existing);
+  const keysWritten = [];
+  const keysRemoved = [];
+  for (const key of options.removeKeys ?? []) {
+    if (map.delete(key)) keysRemoved.push(key);
+  }
+  for (const [key, value] of Object.entries(updates)) {
+    if (value === void 0) continue;
+    const prev = map.get(key);
+    map.set(key, value);
+    if (prev !== value) keysWritten.push(key);
+  }
+  const prevMap = parseEnvFile(existing);
+  let changed = prevMap.size !== map.size;
+  if (!changed) {
+    for (const [key, value] of map) {
+      if (prevMap.get(key) !== value) {
+        changed = true;
+        break;
+      }
+    }
+  }
+  const nextContent = serializeEnvFile(map);
+  if (changed) {
+    mkdirSync11(path75.dirname(filePath), { recursive: true });
+    writeFileSync7(filePath, nextContent, { mode: 384 });
+  }
+  return { path: filePath, changed, keysWritten, keysRemoved };
+}
+
+// src/cron/cron-install-plan.ts
+var WATCHDOG_DEDUPE_KEY = "watchdog:board-sweep";
+var DEFAULT_WATCHDOG_CRON = "*/5 * * * *";
+var VERCEL_KYNVER_CRON_CUTOVER_STEPS = [
+  "Set KYNVER_SCHEDULER_PROVIDER=kynver-cron on the hosted Kynver deployment (Vercel).",
+  "Set KYNVER_CRON_SECRET to the same value written to ~/.kynver/.env by this installer.",
+  "Unset KYNVER_CRON_STORE_PATH on Vercel \u2014 the connected box owns the local store.",
+  "Keep QSTASH_TOKEN only if other non-watchdog schedules still use QStash (analyst/market jobs)."
+];
+function buildCronInstallPlan(input) {
+  const storePath = input.storePath?.trim() || defaultKynverCronStorePath();
+  const envFilePath = input.envFilePath?.trim() || DEFAULT_KYNVER_ENV_FILE;
+  const configPath = path76.join(homedir21(), ".kynver", "config.json");
+  const callbackPath = `/api/agent-os/by-id/${input.agentOsId}/scheduler/fire`;
+  const prerequisites = [];
+  if (!input.apiBaseUrl?.trim()) prerequisites.push("apiBaseUrl \u2014 run `kynver setup --api-base-url \u2026`");
+  if (!input.agentOsId?.trim()) prerequisites.push("agentOsId \u2014 run `kynver setup --agent-os-id \u2026`");
+  const envUpdates = {
+    KYNVER_API_URL: input.apiBaseUrl,
+    KYNVER_CRON_SECRET: input.cronSecret,
+    KYNVER_CRON_STORE_PATH: storePath,
+    KYNVER_CRON_TICK_ENABLED: "1"
+  };
+  const envRemovals = ["OPENCLAW_CRON_STORE_PATH", "OPENCLAW_CRON_SECRET", "OPENCLAW_CRON_FIRE_BASE_URL"];
+  const configUpdates = {
+    deploymentSchedulerProvider: "kynver-cron",
+    apiBaseUrl: input.apiBaseUrl,
+    agentOsId: input.agentOsId,
+    ...input.defaultDaemonRunId ? { defaultDaemonRunId: input.defaultDaemonRunId } : {}
+  };
+  return {
+    envFilePath,
+    configPath,
+    storePath,
+    envUpdates,
+    envRemovals,
+    configUpdates,
+    deploymentSteps: VERCEL_KYNVER_CRON_CUTOVER_STEPS,
+    prerequisites,
+    systemdSupported: process.platform === "linux",
+    watchdogSpec: {
+      kind: "watchdog",
+      cron: DEFAULT_WATCHDOG_CRON,
+      dedupeKey: WATCHDOG_DEDUPE_KEY,
+      callbackPath
+    }
+  };
+}
+
+// src/cron/cron-install-api.ts
+async function apiFetch(url, apiKey, init = {}) {
+  return fetch(url, {
+    ...init,
+    headers: {
+      "Content-Type": "application/json",
+      Authorization: `Bearer ${apiKey}`,
+      ...init.headers
+    }
+  });
+}
+async function listSchedulerJobs(baseUrl, agentOsId, apiKey, query = {}) {
+  const sp = new URLSearchParams(query);
+  const url = `${baseUrl}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/scheduler/jobs?${sp}`;
+  const res = await apiFetch(url, apiKey);
+  const text = await res.text();
+  let parsed = null;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = null;
+  }
+  if (!res.ok) {
+    throw new Error(
+      `list scheduler jobs failed (${res.status}): ${parsed?.error ?? text.slice(0, 200)}`
+    );
+  }
+  return parsed?.items ?? [];
+}
+async function ensureWatchdogScheduleRemote(baseUrl, agentOsId, apiKey, cron, options = {}) {
+  const url = `${baseUrl}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/scheduler/watchdog/ensure`;
+  const body = {};
+  if (cron) body.cron = cron;
+  if (options.requireProvider) body.requireProvider = options.requireProvider;
+  const res = await apiFetch(url, apiKey, {
+    method: "POST",
+    body: JSON.stringify(body)
+  });
+  const text = await res.text();
+  let parsed = null;
+  try {
+    parsed = JSON.parse(text);
+  } catch {
+    parsed = null;
+  }
+  if (!res.ok || !parsed?.job) {
+    throw new Error(
+      `ensure watchdog failed (${res.status}): ${parsed?.error ?? text.slice(0, 200)}`
+    );
+  }
+  return {
+    job: parsed.job,
+    route: parsed.route ?? `/api/agent-os/by-id/${agentOsId}/scheduler/fire`,
+    dedupeKey: parsed.dedupeKey ?? WATCHDOG_DEDUPE_KEY,
+    requestedCron: parsed.requestedCron ?? cron ?? "*/5 * * * *",
+    selectedProvider: parsed.selectedProvider ?? parsed.job.provider ?? null
+  };
+}
+async function cancelSchedulerJob(baseUrl, agentOsId, jobId, apiKey) {
+  const url = `${baseUrl}/api/agent-os/by-id/${encodeURIComponent(agentOsId)}/scheduler/jobs/${encodeURIComponent(jobId)}/cancel`;
+  const res = await apiFetch(url, apiKey, { method: "POST", body: "{}" });
+  if (!res.ok) {
+    const text = await res.text();
+    throw new Error(`cancel job ${jobId} failed (${res.status}): ${text.slice(0, 200)}`);
+  }
+}
+function buildWatchdogCronSpec(agentOsId, cron, dedupeKey = WATCHDOG_DEDUPE_KEY) {
+  return {
+    kind: "watchdog",
+    scheduleKind: "cron",
+    cron,
+    callbackPath: `/api/agent-os/by-id/${agentOsId}/scheduler/fire`,
+    payload: { source: "agent-os.watchdog-schedule", agentOsId },
+    target: { agentOsId },
+    description: "Watchdog board sweep (repair loop)",
+    dedupeKey
+  };
+}
+function findQstashWatchdogLeftovers(jobs) {
+  return jobs.filter(
+    (job) => job.kind === "watchdog" && job.dedupeKey === WATCHDOG_DEDUPE_KEY && job.provider === "qstash" && job.status !== "cancelled"
+  );
+}
+function findKynverCronWatchdog(jobs) {
+  return jobs.find(
+    (job) => job.kind === "watchdog" && job.dedupeKey === WATCHDOG_DEDUPE_KEY && job.provider === "kynver-cron" && job.status !== "cancelled"
+  );
+}
+function canCancelQstashWatchdogLeftovers(jobs) {
+  if (findKynverCronWatchdog(jobs)) return { allowed: true };
+  return {
+    allowed: false,
+    reason: "Cannot cancel QStash watchdog until hosted KYNVER_SCHEDULER_PROVIDER=kynver-cron is live and a kynver-cron watchdog row exists. Set Vercel env, redeploy, re-run `kynver cron install`, then `--confirm-qstash-removal`."
+  };
+}
+
+// src/cron/cron-install-secrets.ts
+import { randomBytes as randomBytes2 } from "node:crypto";
+function generateCronSecret() {
+  return randomBytes2(32).toString("base64url");
+}
+function resolveCronSecretForInstall(envFilePath = DEFAULT_KYNVER_ENV_FILE) {
+  const fromProcess = resolveKynverCronSecret();
+  if (fromProcess) {
+    return { secret: fromProcess, generated: false, source: "env" };
+  }
+  const file = readEnvFile(envFilePath);
+  const fromFile = file.get("KYNVER_CRON_SECRET")?.trim();
+  if (fromFile) {
+    return { secret: fromFile, generated: false, source: "env-file" };
+  }
+  return { secret: generateCronSecret(), generated: true, source: "generated" };
+}
+
+// src/cron/cron-install-systemd.ts
+import { existsSync as existsSync49, mkdirSync as mkdirSync12, writeFileSync as writeFileSync8 } from "node:fs";
+import { homedir as homedir22 } from "node:os";
+import path77 from "node:path";
+import { spawnSync as spawnSync14 } from "node:child_process";
+var KYNVER_CRON_DAEMON_UNIT = "kynver-cron-daemon.service";
+function defaultSystemdUserUnitDir() {
+  return path77.join(homedir22(), ".config", "systemd", "user");
+}
+function renderKynverCronDaemonService(input) {
+  const kynverBin = input.kynverBin?.trim() || "kynver";
+  return [
+    "[Unit]",
+    "Description=Kynver AgentOS daemon (pipeline + cron tick)",
+    "After=network-online.target",
+    "",
+    "[Service]",
+    "Type=simple",
+    `EnvironmentFile=${input.envFilePath}`,
+    `ExecStart=${kynverBin} daemon --run ${input.runId} --agent-os-id ${input.agentOsId} --execute`,
+    "Restart=on-failure",
+    "RestartSec=10",
+    "",
+    "[Install]",
+    "WantedBy=default.target",
+    ""
+  ].join("\n");
+}
+function installSystemdUserDaemon(input, execute) {
+  if (!isSystemdRunAvailable()) {
+    return {
+      supported: false,
+      unitPath: null,
+      written: false,
+      enabled: false,
+      started: false,
+      note: process.platform === "linux" ? "systemd-run not available \u2014 install user service manually or run `kynver daemon` under your supervisor." : "systemd user units are only supported on Linux; use `kynver daemon` manually on macOS/Windows."
+    };
+  }
+  const unitDir = defaultSystemdUserUnitDir();
+  const unitPath = path77.join(unitDir, KYNVER_CRON_DAEMON_UNIT);
+  const content = renderKynverCronDaemonService(input);
+  if (!execute) {
+    return {
+      supported: true,
+      unitPath,
+      written: false,
+      enabled: false,
+      started: false,
+      note: "Dry-run \u2014 pass --execute to write and enable the user unit."
+    };
+  }
+  mkdirSync12(unitDir, { recursive: true });
+  const existed = existsSync49(unitPath);
+  writeFileSync8(unitPath, content, "utf8");
+  const reload = spawnSync14("systemctl", ["--user", "daemon-reload"], { encoding: "utf8" });
+  if (reload.status !== 0) {
+    return {
+      supported: true,
+      unitPath,
+      written: true,
+      enabled: false,
+      started: false,
+      note: `Wrote ${unitPath} but systemctl --user daemon-reload failed: ${reload.stderr || reload.stdout}`
+    };
+  }
+  const enable = spawnSync14("systemctl", ["--user", "enable", "--now", KYNVER_CRON_DAEMON_UNIT], {
+    encoding: "utf8"
+  });
+  return {
+    supported: true,
+    unitPath,
+    written: !existed || true,
+    enabled: enable.status === 0,
+    started: enable.status === 0,
+    note: enable.status === 0 ? `Enabled and started ${KYNVER_CRON_DAEMON_UNIT}` : `Wrote ${unitPath} but enable failed: ${enable.stderr || enable.stdout}`
+  };
+}
+
+// src/cron/cron-install-verify.ts
+import { existsSync as existsSync50 } from "node:fs";
+async function verifyCronInstall(input) {
+  const envFilePath = input.envFilePath ?? DEFAULT_KYNVER_ENV_FILE;
+  const checks = [];
+  const env = resolveKynverCronEnv();
+  const status = await buildKynverCronStatusReport(env);
+  const fileEnv = readEnvFile(envFilePath);
+  checks.push({
+    id: "config_agent_os",
+    ok: Boolean(input.config.agentOsId?.trim()),
+    summary: input.config.agentOsId ? `agentOsId configured (${input.config.agentOsId})` : "agentOsId missing in ~/.kynver/config.json",
+    remediation: "Run `kynver setup --agent-os-id <id>`."
+  });
+  checks.push({
+    id: "config_api_base",
+    ok: Boolean(input.config.apiBaseUrl?.trim() || env.fireBaseUrl),
+    summary: env.fireBaseUrl ? `fire base URL resolved (${env.fireBaseUrl})` : "KYNVER_API_URL / apiBaseUrl not configured",
+    remediation: "Run `kynver setup --api-base-url https://\u2026`."
+  });
+  checks.push({
+    id: "deployment_provider",
+    ok: input.config.deploymentSchedulerProvider === "kynver-cron",
+    summary: `deploymentSchedulerProvider=${input.config.deploymentSchedulerProvider ?? "(unset)"}`,
+    remediation: 'Run `kynver cron install` or set deploymentSchedulerProvider to "kynver-cron".'
+  });
+  checks.push({
+    id: "cron_secret",
+    ok: Boolean(env.secret),
+    summary: env.secret ? "KYNVER_CRON_SECRET present" : "KYNVER_CRON_SECRET missing",
+    remediation: "Run `kynver cron install` to generate and persist the shared secret."
+  });
+  checks.push({
+    id: "env_file",
+    ok: existsSync50(envFilePath) && Boolean(fileEnv.get("KYNVER_CRON_SECRET")),
+    summary: existsSync50(envFilePath) ? `~/.kynver/.env present (${fileEnv.size} keys)` : "~/.kynver/.env missing",
+    remediation: "Run `kynver cron install` to write ~/.kynver/.env."
+  });
+  checks.push({
+    id: "cron_store",
+    ok: existsSync50(env.storePath),
+    summary: existsSync50(env.storePath) ? `cron store present (${env.storePath})` : `cron store missing (${env.storePath})`,
+    remediation: "Run `kynver cron install` to initialize the local store."
+  });
+  const jobs = await loadCronJobs(env.storePath).catch(() => []);
+  const watchdog = jobs.find((j) => j.spec.dedupeKey === WATCHDOG_DEDUPE_KEY);
+  checks.push({
+    id: "watchdog_local",
+    ok: Boolean(watchdog),
+    summary: watchdog ? `watchdog entry in local store (${watchdog.providerScheduleId})` : "watchdog entry not mirrored in local cron store",
+    remediation: "Run `kynver cron install` (with API access) to register and mirror watchdog."
+  });
+  checks.push({
+    id: "daemon_primary",
+    ok: status.daemonPrimary,
+    summary: status.daemonPrimary ? "cron tick enabled with credentials (daemon-primary)" : `cron primary=${status.primary}; tickEnabled=${status.env.tickEnabled}`,
+    remediation: "Ensure KYNVER_CRON_TICK_ENABLED=1 and run `kynver daemon` (or enable the systemd user unit)."
+  });
+  const legacyOpenclaw = fileEnv.has("OPENCLAW_CRON_STORE_PATH") || fileEnv.has("OPENCLAW_CRON_SECRET") || fileEnv.has("OPENCLAW_CRON_FIRE_BASE_URL");
+  checks.push({
+    id: "legacy_openclaw_env",
+    ok: !legacyOpenclaw,
+    summary: legacyOpenclaw ? "legacy OPENCLAW_CRON_* keys still present in ~/.kynver/.env" : "no legacy OPENCLAW_CRON_* keys in env file",
+    remediation: "Re-run `kynver cron install` to retire legacy aliases."
+  });
+  const ok = checks.every((c) => c.ok);
+  return { ok, checks };
+}
+
+// src/cron/cron-install.ts
+init_run_store();
+function resolveDaemonRunId(config, explicit) {
+  if (explicit?.trim()) return explicit.trim();
+  if (config.defaultDaemonRunId?.trim()) return config.defaultDaemonRunId.trim();
+  const runsDir = getPaths().runsDir;
+  if (!existsSync51(runsDir)) return null;
+  const runs = listRunRecords().sort(
+    (a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt)
+  );
+  return runs[0]?.id ?? null;
+}
+async function runCronInstall(opts = {}) {
+  const execute = opts.execute !== false;
+  const existing = loadUserConfig();
+  const apiBaseUrl = trimTrailingSlash(
+    opts.apiBaseUrl?.trim() || existing.apiBaseUrl?.trim() || process.env.KYNVER_API_URL?.trim() || ""
+  );
+  const agentOsId = opts.agentOsId?.trim() || existing.agentOsId?.trim() || process.env.KYNVER_AGENT_OS_ID?.trim() || "";
+  const secretResolution = resolveCronSecretForInstall();
+  const plan = buildCronInstallPlan({
+    config: existing,
+    apiBaseUrl,
+    agentOsId,
+    cronSecret: secretResolution.secret,
+    defaultDaemonRunId: opts.runId?.trim() || existing.defaultDaemonRunId,
+    installSystemd: opts.installSystemd === true
+  });
+  const blockers = [...plan.prerequisites];
+  const result = {
+    ok: false,
+    dryRun: !execute,
+    plan,
+    secretGenerated: secretResolution.generated,
+    configPath: displayUserPath(plan.configPath),
+    storeInitialized: false,
+    blockers
+  };
+  if (blockers.length) return result;
+  if (execute) {
+    const envMerge = mergeEnvFile(plan.envUpdates, {
+      filePath: plan.envFilePath,
+      removeKeys: plan.envRemovals
+    });
+    result.envFile = {
+      path: displayUserPath(envMerge.path),
+      changed: envMerge.changed,
+      keysWritten: envMerge.keysWritten
+    };
+    const nextConfig = { ...existing, ...plan.configUpdates };
+    const runId = resolveDaemonRunId(nextConfig, opts.runId);
+    if (runId) nextConfig.defaultDaemonRunId = runId;
+    saveUserConfig(nextConfig);
+    process.env.KYNVER_API_URL = apiBaseUrl;
+    process.env.KYNVER_CRON_SECRET = secretResolution.secret;
+    process.env.KYNVER_CRON_STORE_PATH = plan.storePath;
+    process.env.KYNVER_CRON_TICK_ENABLED = "1";
+    const storeInit = await ensureCronStoreInitialized(plan.storePath);
+    result.storeInitialized = storeInit.created || existsSync51(plan.storePath);
+    const apiKey = loadApiKey();
+    if (apiKey) {
+      try {
+        const token = await fetchRunnerCredential(agentOsId, { baseUrl: apiBaseUrl, apiKey });
+        saveRunnerToken(agentOsId, token);
+      } catch {
+      }
+    }
+    if (!opts.skipWatchdog) {
+      if (!apiKey) {
+        result.watchdog = { error: "KYNVER_API_KEY required to register watchdog on server" };
+        blockers.push("login \u2014 run `kynver login --api-key \u2026` to register watchdog remotely");
+      } else {
+        try {
+          const remote = await ensureWatchdogScheduleRemote(apiBaseUrl, agentOsId, apiKey, void 0, {
+            requireProvider: "kynver-cron"
+          });
+          const spec = buildWatchdogCronSpec(agentOsId, remote.requestedCron, remote.dedupeKey);
+          const entry = {
+            providerScheduleId: deterministicCronProviderId(spec),
+            spec,
+            registeredAt: (/* @__PURE__ */ new Date()).toISOString(),
+            paused: false
+          };
+          await saveCronJob(entry, plan.storePath);
+          result.watchdog = {
+            remoteJobId: remote.job.id,
+            provider: remote.selectedProvider ?? remote.job.provider,
+            localProviderScheduleId: entry.providerScheduleId
+          };
+          const allJobs = await listSchedulerJobs(apiBaseUrl, agentOsId, apiKey);
+          const leftovers = findQstashWatchdogLeftovers(allJobs);
+          const manualSteps = [
+            "Phase 1 (local): `kynver cron install` writes box env/store and may fail remote watchdog until Vercel cutover.",
+            "Phase 2 (hosted): set KYNVER_SCHEDULER_PROVIDER=kynver-cron + KYNVER_CRON_SECRET on Vercel, redeploy, re-run install.",
+            "Phase 3 (cleanup): `kynver cron install --confirm-qstash-removal` after a kynver-cron watchdog row exists.",
+            "Analyst/market QStash schedules are never touched by this installer."
+          ];
+          const removed = [];
+          if (leftovers.length) {
+            if (opts.confirmQstashRemoval) {
+              const cancelGuard = canCancelQstashWatchdogLeftovers(allJobs);
+              if (!cancelGuard.allowed) {
+                blockers.push(cancelGuard.reason);
+              } else {
+                for (const job of leftovers) {
+                  await cancelSchedulerJob(apiBaseUrl, agentOsId, job.id, apiKey);
+                  removed.push(job.id);
+                }
+              }
+            } else {
+              blockers.push(
+                `${leftovers.length} QStash watchdog job(s) still active \u2014 complete Vercel cutover (KYNVER_SCHEDULER_PROVIDER=kynver-cron + KYNVER_CRON_SECRET), re-run install, then --confirm-qstash-removal`
+              );
+            }
+          }
+          result.qstashWatchdog = {
+            found: leftovers.map((j) => ({ id: j.id, provider: j.provider, status: j.status })),
+            removed,
+            manualSteps
+          };
+        } catch (err) {
+          result.watchdog = { error: err.message };
+          blockers.push(`watchdog registration failed: ${err.message}`);
+        }
+      }
+    }
+    if (opts.installSystemd) {
+      const runId2 = resolveDaemonRunId({ ...existing, ...plan.configUpdates }, opts.runId);
+      if (!runId2) {
+        result.systemd = {
+          supported: plan.systemdSupported,
+          unitPath: null,
+          written: false,
+          enabled: false,
+          started: false,
+          note: "No harness run found \u2014 run `kynver run create` first or pass --run <runId>."
+        };
+        blockers.push("harness run \u2014 create a run before installing systemd unit");
+      } else {
+        try {
+          loadRun(runId2);
+        } catch {
+          blockers.push(`harness run ${runId2} not found`);
+        }
+        result.systemd = installSystemdUserDaemon(
+          { envFilePath: plan.envFilePath, agentOsId, runId: runId2 },
+          execute
+        );
+      }
+    }
+    if (!opts.skipTestFire && blockers.length === 0) {
+      const tick = await runKynverCronTick({ agentOsIdFilter: agentOsId });
+      result.testFire = { fired: tick.fired, errors: tick.errors };
+      if (tick.errors > 0) {
+        blockers.push(`test fire reported ${tick.errors} error(s) \u2014 check server KYNVER_CRON_SECRET matches`);
+      }
+    } else if (opts.skipTestFire) {
+      result.testFire = { fired: 0, errors: 0, skipped: true };
+    }
+    result.verify = await verifyCronInstall({
+      config: loadUserConfig(),
+      envFilePath: plan.envFilePath
+    });
+    result.blockers = blockers;
+    result.ok = blockers.length === 0 && (result.verify?.ok ?? false);
+  } else {
+    result.ok = blockers.length === 0;
+  }
+  return result;
+}
+
+// src/cron/cron-install-cli.ts
+function parseBoolArg(value, defaultValue) {
+  if (value === void 0) return defaultValue;
+  if (value === true) return true;
+  if (value === false) return false;
+  const v = String(value).trim().toLowerCase();
+  if (v === "0" || v === "false" || v === "no" || v === "off") return false;
+  if (v === "1" || v === "true" || v === "yes" || v === "on") return true;
+  return defaultValue;
+}
+async function runCronInstallCli(args) {
+  const dryRun = args.dryRun === true || args["dry-run"] === true;
+  const result = await runCronInstall({
+    execute: dryRun ? false : parseBoolArg(args.execute, true),
+    json: args.json === true,
+    installSystemd: args.installSystemd === true || args["install-systemd"] === true,
+    confirmQstashRemoval: args.confirmQstashRemoval === true || args["confirm-qstash-removal"] === true,
+    skipWatchdog: args.skipWatchdog === true || args["skip-watchdog"] === true,
+    skipTestFire: args.skipTestFire === true || args["skip-test-fire"] === true,
+    agentOsId: typeof args.agentOsId === "string" ? args.agentOsId : void 0,
+    apiBaseUrl: typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0,
+    runId: typeof args.run === "string" ? args.run : void 0
+  });
+  if (args.json === true) {
+    console.log(JSON.stringify(result, null, 2));
+    if (!result.ok) process.exitCode = 1;
+    return;
+  }
+  console.log(result.dryRun ? "Kynver Cron install (dry-run)\n" : "Kynver Cron install\n");
+  console.log(`  config: ${result.configPath}`);
+  console.log(`  env file: ${result.plan.envFilePath}`);
+  console.log(`  store: ${result.plan.storePath}`);
+  if (result.secretGenerated) console.log("  generated new KYNVER_CRON_SECRET");
+  if (result.envFile) {
+    console.log(
+      `  env merge: ${result.envFile.changed ? "updated" : "unchanged"} (${result.envFile.keysWritten.join(", ") || "no key changes"})`
+    );
+  }
+  if (result.watchdog?.remoteJobId) {
+    console.log(
+      `  watchdog: job ${result.watchdog.remoteJobId} provider=${result.watchdog.provider} local=${result.watchdog.localProviderScheduleId}`
+    );
+  } else if (result.watchdog?.error) {
+    console.log(`  watchdog: ERROR ${result.watchdog.error}`);
+  }
+  if (result.qstashWatchdog?.found.length) {
+    console.log(`  qstash watchdog leftovers: ${result.qstashWatchdog.found.length}`);
+    for (const j of result.qstashWatchdog.found) {
+      console.log(`    - ${j.id} (${j.status})`);
+    }
+    if (result.qstashWatchdog.removed.length) {
+      console.log(`  removed: ${result.qstashWatchdog.removed.join(", ")}`);
+    }
+  }
+  if (result.systemd) {
+    console.log(`  systemd: ${result.systemd.note ?? (result.systemd.started ? "running" : "not started")}`);
+  }
+  if (result.testFire && !result.testFire.skipped) {
+    console.log(`  test fire: fired=${result.testFire.fired} errors=${result.testFire.errors}`);
+  }
+  console.log("\nHosted deployment (manual):");
+  for (const step of result.plan.deploymentSteps) console.log(`  - ${step}`);
+  if (result.blockers.length) {
+    console.log("\nBlockers:");
+    for (const b of result.blockers) console.log(`  ! ${b}`);
+    process.exitCode = 1;
+    return;
+  }
+  console.log("\nInstall complete \u2014 run `kynver cron verify` to re-check.");
+}
+async function runCronVerifyCli(args) {
+  const config = loadUserConfig();
+  const report = await verifyCronInstall({ config });
+  if (args.json === true) {
+    console.log(JSON.stringify(report, null, 2));
+    if (!report.ok) process.exitCode = 1;
+    return;
+  }
+  console.log(`Kynver Cron verify: ${report.ok ? "PASS" : "FAIL"}
+`);
+  for (const check3 of report.checks) {
+    const mark = check3.ok ? "ok" : "FAIL";
+    console.log(`  [${mark}] ${check3.id}: ${check3.summary}`);
+    if (!check3.ok && check3.remediation) console.log(`         \u2192 ${check3.remediation}`);
+  }
+  if (!report.ok) process.exitCode = 1;
+}
+
 // src/lane/landing-maintainer-tick.ts
 init_config();
-import os11 from "node:os";
+import os13 from "node:os";
 init_config();
 init_box_identity();
 init_resource_gate();
@@ -16837,10 +17982,10 @@ var LANDING_MAINTAINER_LANE_SPEC = {
 };
 
 // src/lane/landing-maintainer-local.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
-import path74 from "node:path";
+import { spawnSync as spawnSync15 } from "node:child_process";
+import path78 from "node:path";
 function runLandingWrapper(prNumber, repoRoot, execute) {
-  const script = path74.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
+  const script = path78.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
   const args = [script, String(prNumber), ...LANDING_MAINTAINER_LANE_SPEC.landScriptArgs];
   if (!execute) {
     return {
@@ -16851,7 +17996,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
       stderr: ""
     };
   }
-  const result = spawnSync14("node", args, {
+  const result = spawnSync15("node", args, {
     cwd: repoRoot,
     encoding: "utf8",
     timeout: 10 * 60 * 1e3
@@ -16866,7 +18011,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
 }
 function resolveLandingMaintainerRepoRoot(args) {
   const explicit = args.repoPath ? String(args.repoPath).trim() : "";
-  if (explicit) return path74.resolve(explicit);
+  if (explicit) return path78.resolve(explicit);
   const resolved = resolveDefaultRepo();
   return resolved?.repo ?? process.cwd();
 }
@@ -16885,7 +18030,7 @@ async function runLandingMaintainerLaneTick(args) {
     ...buildBoxResourceSnapshotFromGate(resourceGate, {
       harnessRunId: runId,
       boxKind: resolveBoxKindFromConfig(loadUserConfig()),
-      hostLabel: os11.hostname()
+      hostLabel: os13.hostname()
     }),
     providerHealthy: resourceGate.ok,
     authorizedForRepair: resourceGate.ok,
@@ -16991,6 +18136,7 @@ function usage(code = 0) {
       "Usage:",
       "  kynver login [--api-key KEY] [--api-base-url URL]   (omit --api-key to authorize in the browser)",
       "  kynver bootstrap [--api-base-url URL] [--api-key KEY] [--repo PATH]   (login + setup + runner credential in one shot)",
+      "  kynver start [--repo PATH] [--api-base-url URL] [--run RUN_ID] [--interval-ms MS]   (bring your agent online: bootstrap if needed + run + daemon)",
       "  kynver runner credential [--agent-os-id ID] [--base-url URL]",
       "  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind forge|ghost] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor]",
       "  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS] [--stall-ms MS] [--no-supervise]",
@@ -17031,6 +18177,8 @@ function usage(code = 0) {
       "  kynver doctor runtime-takeover [--remediate-default-repo]",
       "  kynver scheduler cutover-check [--json]",
       "  kynver scheduler attest-cutover [--json]",
+      "  kynver cron install [--dry-run] [--json] [--install-systemd] [--confirm-qstash-removal] [--skip-watchdog] [--skip-test-fire] [--agent-os-id ID] [--api-base-url URL] [--run RUN_ID]",
+      "  kynver cron verify [--json]",
       "  kynver cron status [--json]",
       "  kynver cron tick [--agent-os-id AOS_ID] [--json]",
       "  kynver lane tick landing-maintainer [--fleet] [--repo OWNER/NAME] [--agent-os-id AOS_ID] [--execute] [--json]",
@@ -17054,8 +18202,8 @@ async function main(argv = process.argv.slice(2)) {
   if (action && isHelpFlag(action) || rest.some(isHelpFlag)) return usage(0);
   const args = parseArgs(rest);
   const { runsDir, worktreesDir } = getPaths();
-  mkdirSync11(runsDir, { recursive: true });
-  mkdirSync11(worktreesDir, { recursive: true });
+  mkdirSync13(runsDir, { recursive: true });
+  mkdirSync13(worktreesDir, { recursive: true });
   if (scope === "daemon") {
     assertNativeDaemonAllowed();
   }
@@ -17076,6 +18224,7 @@ async function main(argv = process.argv.slice(2)) {
   }
   if (scope === "login") return void await runLogin(args);
   if (scope === "bootstrap") return void await runBootstrap(args);
+  if (scope === "start") return void await runStart(args);
   if (scope === "status") return runStatus(args);
   if (scope === "runner" && action === "credential") return void await mintRunnerCredential(args);
   if (scope === "setup") return void await runSetup(args);
@@ -17106,6 +18255,12 @@ async function main(argv = process.argv.slice(2)) {
   if (scope === "scheduler" && action === "attest-cutover") {
     return runSchedulerAttestCutoverCli(args.json === true);
   }
+  if (scope === "cron" && action === "install") {
+    return void await runCronInstallCli(args);
+  }
+  if (scope === "cron" && action === "verify") {
+    return void await runCronVerifyCli(args);
+  }
   if (scope === "cron" && action === "status") {
     return void await runCronStatusCli(args.json === true);
   }
@@ -17119,7 +18274,7 @@ async function main(argv = process.argv.slice(2)) {
   if (scope === "board" && action === "contract") {
     return void await runCommandCenterContractCli(args);
   }
-  if (scope === "run" && action === "create") return createRun(args);
+  if (scope === "run" && action === "create") return void createRun(args);
   if (scope === "run" && action === "list") return listRuns();
   if (scope === "run" && action === "resolve") return resolveHarnessRunCli(args);
   if (scope === "run" && action === "status") return runStatus(args);