@kynver-app/runtime 0.1.120 → 0.1.123

package/dist/cli.js

@@ -523,23 +523,23 @@ function isWslHost() {
 function observeWslHostDisk(options = {}) {
   const wsl = options.forceWsl === void 0 ? isWslHost() : options.forceWsl;
   if (!wsl) return null;
-  const path77 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
+  const path79 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
   const warnBelowBytes = options.wslHostFreeWarnBytes ?? DEFAULT_WSL_HOST_WARN_FREE_BYTES;
   const criticalBelowBytes = options.wslHostFreeCriticalBytes ?? DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES;
   const statfs = options.statfs ?? statfsSync;
   let stats;
   try {
-    stats = statfs(path77);
+    stats = statfs(path79);
   } catch (error) {
     return {
       ok: false,
-      path: path77,
+      path: path79,
       freeBytes: 0,
       totalBytes: 0,
       usedPercent: 100,
       warnBelowBytes,
       criticalBelowBytes,
-      reason: `Windows host disk probe failed at ${path77}: ${error.message}`,
+      reason: `Windows host disk probe failed at ${path79}: ${error.message}`,
       probeError: error.message
     };
   }
@@ -553,11 +553,11 @@ function observeWslHostDisk(options = {}) {
   let reason = null;
   if (!ok) {
     const tag = criticalFree ? "critical" : "warning";
-    reason = `Windows host disk ${path77} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
+    reason = `Windows host disk ${path79} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
   }
   return {
     ok,
-    path: path77,
+    path: path79,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -583,12 +583,12 @@ var init_wsl_host = __esm({
 // src/disk-gate.ts
 import { statfsSync as statfsSync2 } from "node:fs";
 function observeRunnerDiskGate(input = {}) {
-  const path77 = input.diskPath?.trim() || "/";
+  const path79 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync2(path77);
+  const stats = statfsSync2(path79);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -611,7 +611,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path77,
+    path: path79,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -2616,23 +2616,29 @@ function resolveConfiguredCallbackSecret(argsSecret, agentOsId) {
   }
   return void 0;
 }
-async function resolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
+async function tryResolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
   const configured = resolveConfiguredCallbackSecret(argsSecret, agentOsId);
-  if (configured) return configured;
+  if (configured) return { ok: true, secret: configured };
   const apiKey = loadApiKey();
   const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
   if (apiKey && agentOsId && baseUrl) {
     try {
       const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
       saveRunnerToken(agentOsId, token);
-      return token;
+      return { ok: true, secret: token };
     } catch (error) {
-      failConfig(`runner credential mint failed: ${error.message}`);
+      return { ok: false, reason: `runner credential mint failed: ${error.message}` };
     }
   }
-  failConfig(
-    "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / KYNVER_CRON_SECRET / OPENCLAW_CRON_SECRET"
-  );
+  return {
+    ok: false,
+    reason: "no runner credential: requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, or KYNVER_API_KEY + API base URL to mint one"
+  };
+}
+async function resolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
+  const result = await tryResolveCallbackSecretWithMint(argsSecret, agentOsId, opts);
+  if (result.ok) return result.secret;
+  failConfig(result.reason);
 }
 async function refreshRunnerToken(agentOsId, opts) {
   const apiKey = loadApiKey();
@@ -2752,7 +2758,10 @@ async function runSetup(args) {
     ...existing,
     ...inferSetupFields(existing, args),
     ...workerConfig,
-    workerProvider: typeof args.provider === "string" ? args.provider : existing.workerProvider || "cursor"
+    workerProvider: typeof args.provider === "string" ? args.provider : existing.workerProvider || "cursor",
+    // M5.4 chat-turn delegation: `--chat-oauth` persists consent to use the
+    // Claude Code CLI's local OAuth token for delegated chat turns.
+    ...args.chatOauth === true ? { chatUseClaudeOauth: true } : {}
   });
   saveUserConfig(config);
   const boxIdentity = resolveBoxIdentity(process.env, config);
@@ -2820,7 +2829,7 @@ var init_config = __esm({
 
 // src/cli.ts
 init_config();
-import { mkdirSync as mkdirSync13, realpathSync } from "node:fs";
+import { mkdirSync as mkdirSync15, realpathSync } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/bootstrap.ts
@@ -3508,7 +3517,7 @@ async function runKynverCronTick(opts = {}) {
 init_util();
 
 // src/pipeline-tick.ts
-import path55 from "node:path";
+import path57 from "node:path";
 
 // src/active-harness-workers.ts
 init_run_store();
@@ -6176,8 +6185,8 @@ function dirtyPathsCoveredByDisposableRemoval(changedFiles, removed) {
   if (removed.length === 0) return false;
   const removedSet = new Set(removed.map((p) => normalizeRelativePath(p)));
   return material.every((line) => {
-    const path77 = normalizeRelativePath(pathFromGitStatusLine(line));
-    return removedSet.has(path77);
+    const path79 = normalizeRelativePath(pathFromGitStatusLine(line));
+    return removedSet.has(path79);
   });
 }
 
@@ -7013,6 +7022,9 @@ function buildBoard(run, workers, compact) {
   }
   return board;
 }
+function isTerminalDoneBoardWorker(worker) {
+  return worker.status === "done" && worker.attention === "done";
+}
 function buildRunBoard(runId) {
   const run = loadRun(runId);
   const names = Object.keys(run.workers || {});
@@ -7033,7 +7045,7 @@ function buildRunBoard(runId) {
 function buildCompactRunBoard(runId) {
   const run = loadRun(runId);
   const names = Object.keys(run.workers || {});
-  const workers = names.map((name) => {
+  const allWorkers = names.map((name) => {
     const worker = readJson(
       path23.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
@@ -7044,7 +7056,17 @@ function buildCompactRunBoard(runId) {
     if (isMetadataTerminalDone(worker)) return buildCompactDoneEntry(name, worker);
     return buildWorkerBoardEntry({ run, workerName: name, worker });
   });
+  const workers = allWorkers.filter((worker) => !isTerminalDoneBoardWorker(worker));
   const board = buildBoard(run, workers, true);
+  board.status = deriveRunStatus(run.status, allWorkers);
+  board.summary = {
+    ...board.summary ?? {},
+    totalWorkerCount: allWorkers.length,
+    shownWorkerCount: workers.length,
+    omittedTerminalDoneWorkerCount: allWorkers.length - workers.length,
+    allStatusCounts: countBy(allWorkers, "status"),
+    allAttentionCounts: countBy(allWorkers, "attention")
+  };
   writeJson(path23.join(runDirectory(run.id), "last-board-compact.json"), board);
   return board;
 }
@@ -9251,7 +9273,7 @@ init_util();
 // src/worker-metadata-reconcile.ts
 init_heartbeat();
 init_stream();
-import { existsSync as existsSync25, lstatSync, readdirSync as readdirSync7, readlinkSync, renameSync as renameSync3, rmSync } from "node:fs";
+import { existsSync as existsSync25, lstatSync, readdirSync as readdirSync7, readlinkSync, renameSync as renameSync4, rmSync } from "node:fs";
 import path33 from "node:path";
 
 // src/worker-metadata-paths.ts
@@ -9300,7 +9322,7 @@ function resolveWorkerJsonPath(input) {
 }
 
 // src/run-metadata-retention.ts
-import { existsSync as existsSync24, readdirSync as readdirSync6, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync24, mkdirSync as mkdirSync7, readdirSync as readdirSync6, renameSync as renameSync3, statSync as statSync5 } from "node:fs";
 import path32 from "node:path";
 
 // src/default-repo.ts
@@ -9362,6 +9384,7 @@ init_paths();
 init_run_store();
 init_util();
 var RUN_METADATA_ACTIVE_SIGNAL_MS = 15 * 60 * 1e3;
+var TERMINAL_WORKER_ARCHIVE_AGE_MS = 60 * 60 * 1e3;
 function isHarnessRunMetadataPath(targetPath, harnessRoot) {
   const resolved = path32.resolve(targetPath);
   const runsDir = path32.resolve(harnessRunsDir(harnessRoot));
@@ -9385,6 +9408,14 @@ function listWorkerNamesOnDisk(runDir2) {
     return [];
   }
 }
+function workerArchiveDir(runDir2) {
+  return path32.join(runDir2, "archived-workers");
+}
+function uniqueArchivePath(runDir2, workerName) {
+  const base = path32.join(workerArchiveDir(runDir2), safeSlug(workerName));
+  if (!existsSync24(base)) return base;
+  return `${base}-${Date.now()}`;
+}
 function pathRecentlyTouched(target, now, windowMs) {
   if (!existsSync24(target)) return false;
   try {
@@ -9411,6 +9442,41 @@ function workerDirHasActiveRetentionSignals(workerDir, now = Date.now(), windowM
   if (pathRecentlyTouched(artifacts.heartbeatPath, now, windowMs)) return true;
   return false;
 }
+function workerTerminalArchiveAgeMs(workerDir, worker, now) {
+  const completionReportedAt = typeof worker.completionReportedAt === "string" ? Date.parse(worker.completionReportedAt) : NaN;
+  if (Number.isFinite(completionReportedAt)) return now - completionReportedAt;
+  const completionSnapshotAt = (() => {
+    const raw = worker.completionResponse;
+    if (!raw || typeof raw !== "object") return NaN;
+    const task = raw.task;
+    if (!task || typeof task !== "object") return NaN;
+    const updatedAt = task.updatedAt;
+    return typeof updatedAt === "string" ? Date.parse(updatedAt) : NaN;
+  })();
+  if (Number.isFinite(completionSnapshotAt)) return now - completionSnapshotAt;
+  try {
+    return now - statSync5(path32.join(workerDir, "worker.json")).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function isArchiveEligibleTerminalWorker(workerDir, worker, now, archiveAgeMs) {
+  if (workerDirHasActiveRetentionSignals(workerDir, now)) {
+    return { eligible: false, reason: "worker has active/recent retention signals" };
+  }
+  const status = typeof worker.status === "string" ? worker.status : "";
+  const completionBlocker = typeof worker.completionBlocker === "string" && worker.completionBlocker.trim().length > 0;
+  if (completionBlocker) return { eligible: false, reason: "worker has completion blocker" };
+  const completionAcknowledged = typeof worker.completionReportedAt === "string" || worker.completionOutcome === "acknowledged";
+  if (status !== "done" && !completionAcknowledged) {
+    return { eligible: false, reason: `worker status is ${status || "unknown"}` };
+  }
+  const age = workerTerminalArchiveAgeMs(workerDir, worker, now);
+  if (!Number.isFinite(age) || age < archiveAgeMs) {
+    return { eligible: false, reason: "terminal worker is still within archive grace window" };
+  }
+  return { eligible: true, reason: "terminal worker metadata archived" };
+}
 function runDirHasActiveRetentionSignals(runDir2, now = Date.now(), windowMs = RUN_METADATA_ACTIVE_SIGNAL_MS) {
   for (const name of listWorkerNamesOnDisk(runDir2)) {
     if (workerDirHasActiveRetentionSignals(path32.join(runDir2, "workers", name), now, windowMs)) {
@@ -9488,6 +9554,59 @@ function repairMissingRunMetadata(harnessRootInput) {
   }
   return { runs: outcomes };
 }
+function archiveTerminalWorkerMetadata(harnessRootInput, options = {}) {
+  const harnessRoot = normalizeHarnessRoot(harnessRootInput ?? resolveHarnessRoot());
+  const runsDir = harnessRunsDir(harnessRoot);
+  const now = options.now ?? Date.now();
+  const archiveAgeMs = options.archiveAgeMs ?? TERMINAL_WORKER_ARCHIVE_AGE_MS;
+  const outcomes = [];
+  repairMissingRunMetadata(harnessRoot);
+  for (const runId of listRunDirIds(runsDir)) {
+    const runDir2 = path32.join(runsDir, runId);
+    const runJsonPath = path32.join(runDir2, "run.json");
+    const run = readJson(runJsonPath, void 0);
+    if (!run?.id) continue;
+    const names = /* @__PURE__ */ new Set([...Object.keys(run.workers || {}), ...listWorkerNamesOnDisk(runDir2)]);
+    let changed = false;
+    for (const name of names) {
+      const workerDir = path32.join(runDir2, "workers", safeSlug(name));
+      const workerJsonPath = path32.join(workerDir, "worker.json");
+      const worker = readJson(workerJsonPath, void 0);
+      if (!worker) {
+        const archivedWorkerDir = path32.join(workerArchiveDir(runDir2), safeSlug(name));
+        if (existsSync24(archivedWorkerDir) && (run.workers[safeSlug(name)] || run.workers[name])) {
+          delete run.workers[safeSlug(name)];
+          delete run.workers[name];
+          changed = true;
+          outcomes.push({
+            runId: run.id,
+            worker: name,
+            action: "archived",
+            reason: "removed stale live index entry for archived worker metadata",
+            archivePath: archivedWorkerDir
+          });
+          continue;
+        }
+        outcomes.push({ runId: run.id, worker: name, action: "skipped", reason: "worker.json missing" });
+        continue;
+      }
+      const eligibility = isArchiveEligibleTerminalWorker(workerDir, worker, now, archiveAgeMs);
+      if (!eligibility.eligible) {
+        outcomes.push({ runId: run.id, worker: name, action: "skipped", reason: eligibility.reason });
+        continue;
+      }
+      const archivePath = uniqueArchivePath(runDir2, name);
+      mkdirSync7(path32.dirname(archivePath), { recursive: true });
+      renameSync3(workerDir, archivePath);
+      delete run.workers[safeSlug(name)];
+      delete run.workers[name];
+      changed = true;
+      outcomes.push({ runId: run.id, worker: name, action: "archived", reason: eligibility.reason, archivePath });
+    }
+    if (changed) saveRun(run);
+  }
+  return { workers: outcomes };
+}
 function collectFilesystemLiveRunKeys(harnessRoot, now = Date.now()) {
   const keys = /* @__PURE__ */ new Set();
   const runsDir = harnessRunsDir(harnessRoot);
@@ -9517,9 +9636,9 @@ function materializeSymlinkedRunDir(harnessRoot, runId) {
     return null;
   }
   const staging = `${canonical}.materialize-${Date.now()}`;
-  renameSync3(linkedTarget, staging);
+  renameSync4(linkedTarget, staging);
   rmSync(canonical);
-  renameSync3(staging, canonical);
+  renameSync4(staging, canonical);
   return linkedTarget;
 }
 function relocateArtifacts(input) {
@@ -9528,7 +9647,7 @@ function relocateArtifacts(input) {
     const from = path33.join(input.fromDir, fileName);
     const to = path33.join(input.toDir, fileName);
     if (!existsSync25(from) || existsSync25(to)) continue;
-    renameSync3(from, to);
+    renameSync4(from, to);
     moved.push(fileName);
   }
   return moved;
@@ -9986,7 +10105,14 @@ function reconcileStaleWorkers() {
   const metadataReconcile = reconcileWorkerMetadata();
   if (staleReconcileDisabled()) {
     const localPrAttentionReconcile2 = reconcileLocalOnlyMergedPrAttention();
-    return { workers: [], finalizedRuns: finalizeStaleRuns(), metadataReconcile, localPrAttentionReconcile: localPrAttentionReconcile2 };
+    const terminalWorkerArchive2 = archiveTerminalWorkerMetadata();
+    return {
+      workers: [],
+      finalizedRuns: finalizeStaleRuns(),
+      metadataReconcile,
+      localPrAttentionReconcile: localPrAttentionReconcile2,
+      terminalWorkerArchive: terminalWorkerArchive2
+    };
   }
   const outcomes = [];
   const now = Date.now();
@@ -10065,7 +10191,8 @@ function reconcileStaleWorkers() {
     }
   }
   const localPrAttentionReconcile = reconcileLocalOnlyMergedPrAttention();
-  return { workers: outcomes, finalizedRuns: finalizeStaleRuns(), metadataReconcile, localPrAttentionReconcile };
+  const terminalWorkerArchive = archiveTerminalWorkerMetadata();
+  return { workers: outcomes, finalizedRuns: finalizeStaleRuns(), metadataReconcile, localPrAttentionReconcile, terminalWorkerArchive };
 }
 function reconcileRunsCli() {
   const result = reconcileStaleWorkers();
@@ -10084,6 +10211,10 @@ function reconcileRunsCli() {
     acc[row.action] = (acc[row.action] ?? 0) + 1;
     return acc;
   }, {});
+  const archiveTotals = result.terminalWorkerArchive.workers.reduce((acc, row) => {
+    acc[row.action] = (acc[row.action] ?? 0) + 1;
+    return acc;
+  }, {});
   console.log(
     JSON.stringify(
       {
@@ -10101,11 +10232,16 @@ function reconcileRunsCli() {
           totals: localPrAttentionTotals,
           total: result.localPrAttentionReconcile.workers.length
         },
+        terminalWorkerArchive: {
+          totals: archiveTotals,
+          total: result.terminalWorkerArchive.workers.length
+        },
         finalizedRuns: result.finalizedRuns.length,
         details: {
           workers: result.workers,
           metadataReconcile: result.metadataReconcile.workers,
           localPrAttentionReconcile: result.localPrAttentionReconcile.workers,
+          terminalWorkerArchive: result.terminalWorkerArchive.workers,
           runMetadataRetention: result.metadataReconcile.runMetadataRetention.runs,
           finalizedRuns: result.finalizedRuns
         }
@@ -10312,11 +10448,11 @@ init_box_identity();
 
 // src/cleanup.ts
 init_paths();
-import path51 from "node:path";
+import path53 from "node:path";
 
 // src/cleanup-guards.ts
 init_landing_gate();
-import path38 from "node:path";
+import path39 from "node:path";
 
 // src/cleanup-index-status.ts
 init_git();
@@ -10459,6 +10595,44 @@ init_status();
 // src/cleanup-run-liveness.ts
 init_status();
 
+// src/cleanup-worker-harness-live.ts
+init_heartbeat();
+init_util();
+function heartbeatContentIsFresh(worker, now = Date.now(), windowMs = RUN_METADATA_ACTIVE_SIGNAL_MS) {
+  const heartbeat = parseHeartbeat(worker.heartbeatPath);
+  if (!heartbeat.lastHeartbeatAt) return false;
+  const age = now - Date.parse(heartbeat.lastHeartbeatAt);
+  return Number.isFinite(age) && age >= 0 && age < windowMs;
+}
+function isHarnessWorkerHarnessLive(worker, now = Date.now(), windowMs = RUN_METADATA_ACTIVE_SIGNAL_MS) {
+  if (isPidAlive(worker.pid)) return true;
+  return heartbeatContentIsFresh(worker, now, windowMs);
+}
+
+// src/cleanup-run-liveness.ts
+function deriveRunTerminal(indexed, ctx) {
+  if (ctx) return ctx.runTerminalCache.derive(indexed.run);
+  return deriveTerminalRunStatus(indexed.run);
+}
+function isWorkerProcessLive(indexed, now = Date.now()) {
+  return isHarnessWorkerHarnessLive(indexed.worker, now);
+}
+function isRunStaleActive(indexed, ctx) {
+  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
+  return deriveRunTerminal(indexed, ctx) !== null;
+}
+function runBlocksWorktreeRemoval(indexed, ctx, now = Date.now()) {
+  if (isWorkerProcessLive(indexed, now)) return true;
+  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
+  if (isRunStaleActive(indexed, ctx)) return false;
+  const status = indexedWorktreeStatus(indexed);
+  if (!isFinishedWorkerStatus(status)) {
+    if (!isWorkerProcessLive(indexed, now)) return false;
+    return true;
+  }
+  return false;
+}
+
 // src/cleanup-completion-blocker.ts
 init_landing_gate();
 init_status();
@@ -10480,51 +10654,80 @@ function completionBlockerBlocksWorktreeRemoval(indexed, status) {
   return false;
 }
 
-// src/cleanup-run-liveness.ts
+// src/cleanup-salvage-evidence.ts
+init_git();
 init_util();
-var TERMINAL_WORKER_JSON_STATUSES = /* @__PURE__ */ new Set([
-  "done",
-  "exited",
-  "blocked",
-  "failed",
-  "abandoned"
-]);
-function deriveRunTerminal(indexed, ctx) {
-  if (ctx) return ctx.runTerminalCache.derive(indexed.run);
-  return deriveTerminalRunStatus(indexed.run);
-}
-function isWorkerProcessLive(indexed) {
-  if (isPidAlive(indexed.worker.pid)) return true;
-  if (typeof indexed.worker.completionReportedAt === "string" && indexed.worker.completionReportedAt.trim().length > 0) {
-    return false;
-  }
-  const workerStatus2 = indexed.worker.status;
-  if (workerStatus2 && TERMINAL_WORKER_JSON_STATUSES.has(workerStatus2)) return false;
-  if (!indexed.worker.pid) {
-    if (workerStatus2 !== "running") return false;
-    return indexedWorktreeStatus(indexed).alive;
-  }
-  return false;
+import { existsSync as existsSync26, mkdirSync as mkdirSync8, writeFileSync as writeFileSync6 } from "node:fs";
+import path38 from "node:path";
+function salvageEvidenceDir(harnessRoot, runId, workerName) {
+  return path38.join(harnessRoot, "salvage", safeSlug(runId), safeSlug(workerName));
 }
-function isRunStaleActive(indexed, ctx) {
-  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
-  return deriveRunTerminal(indexed, ctx) !== null;
+function hasSalvageEvidence(input) {
+  return existsSync26(path38.join(salvageEvidenceDir(input.harnessRoot, input.runId, input.workerName), "evidence.json"));
 }
-function runBlocksWorktreeRemoval(indexed, ctx) {
-  if (isWorkerProcessLive(indexed)) return true;
-  const workerStatus2 = indexed.worker.status;
-  if (workerStatus2 && TERMINAL_WORKER_JSON_STATUSES.has(workerStatus2) && !indexed.worker.completionBlocker) {
-    return false;
-  }
-  const status = indexedWorktreeStatus(indexed);
-  if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return true;
-  if (isFinishedWorkerStatus(status)) return false;
-  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
-  if (isRunStaleActive(indexed, ctx)) return false;
-  return deriveRunTerminal(indexed, ctx) === null;
+function writeWorktreeSalvageEvidence(input) {
+  const dir = salvageEvidenceDir(input.harnessRoot, input.indexed.runId, input.indexed.workerName);
+  mkdirSync8(dir, { recursive: true });
+  const patchPath = path38.join(dir, "salvage.patch");
+  let wrotePatch = false;
+  if (existsSync26(input.indexed.worktreePath)) {
+    const diff = gitCapture(input.indexed.worktreePath, ["diff", "HEAD"]);
+    const staged = gitCapture(input.indexed.worktreePath, ["diff", "--cached"]);
+    const patch = [diff.stdout, staged.stdout].filter((chunk) => chunk.trim()).join("\n");
+    if (patch.trim()) {
+      writeFileSync6(patchPath, patch.endsWith("\n") ? patch : `${patch}
+`);
+      wrotePatch = true;
+    }
+  }
+  const record = {
+    capturedAt: new Date(input.now ?? Date.now()).toISOString(),
+    skipReason: input.skipReason,
+    runId: input.indexed.runId,
+    workerName: input.indexed.workerName,
+    worktreePath: input.indexed.worktreePath,
+    taskId: input.indexed.worker.taskId,
+    agentOsId: input.indexed.worker.agentOsId,
+    branch: input.indexed.worker.branch,
+    completionBlocker: input.indexed.worker.completionBlocker,
+    finalResult: input.status.finalResult,
+    changedFiles: input.status.changedFiles,
+    gitAncestry: input.status.gitAncestry,
+    prUrl: input.status.prUrl ?? null,
+    ...wrotePatch ? { patchPath } : {}
+  };
+  writeFileSync6(path38.join(dir, "evidence.json"), `${JSON.stringify(record, null, 2)}
+`);
+  return record;
 }
 
 // src/cleanup-guards.ts
+var SALVAGE_ELIGIBLE_SKIP_REASONS = /* @__PURE__ */ new Set([
+  "completion_blocked",
+  "dirty_worktree",
+  "pr_or_unmerged_commits",
+  "landing_blocked"
+]);
+function maybeSalvageBlockedWorktree(input) {
+  if (!SALVAGE_ELIGIBLE_SKIP_REASONS.has(input.skipReason)) return false;
+  if (isWorkerProcessLive(input.indexed, input.now)) return false;
+  if (hasSalvageEvidence({
+    harnessRoot: input.harnessRoot,
+    runId: input.indexed.runId,
+    workerName: input.indexed.workerName
+  })) {
+    return true;
+  }
+  if (!input.writeSalvageEvidence) return false;
+  writeWorktreeSalvageEvidence({
+    harnessRoot: input.harnessRoot,
+    indexed: input.indexed,
+    skipReason: input.skipReason,
+    status: input.status,
+    now: input.now
+  });
+  return true;
+}
 function effectiveWorktreeAgeMs(input) {
   const { indexed, includeOrphans, worktreesAgeMs, terminalWorktreesAgeMs } = input;
   if (!indexed) return includeOrphans ? terminalWorktreesAgeMs : worktreesAgeMs;
@@ -10539,8 +10742,18 @@ function effectiveWorktreeAgeMs(input) {
   }
   return worktreesAgeMs;
 }
+function resolveHarnessRoot2(input, indexed) {
+  if (input.harnessRoot?.trim()) return path39.resolve(input.harnessRoot);
+  const workerDir = indexed.worker.workerDir;
+  if (!workerDir) return null;
+  const runsMarker = `${path39.sep}runs${path39.sep}`;
+  const idx = workerDir.indexOf(runsMarker);
+  if (idx < 0) return null;
+  return workerDir.slice(0, idx + runsMarker.length - 1);
+}
 function skipWorktreeRemoval(input) {
   const { indexed, includeOrphans, worktreesAgeMs, ageMs, orphanSafety, worktreeRemovalGuard } = input;
+  const now = input.now ?? Date.now();
   if (!indexed) {
     if (!includeOrphans) return "orphan_without_flag";
     return orphanSafety ?? null;
@@ -10548,25 +10761,55 @@ function skipWorktreeRemoval(input) {
   const ageThresholdMs = effectiveWorktreeAgeMs(input);
   if (worktreesAgeMs <= 0 && !includeOrphans && ageThresholdMs <= 0) return "worktrees_disabled";
   if (ageThresholdMs > 0 && ageMs < ageThresholdMs) return "below_age_threshold";
-  if (isWorkerProcessLive(indexed)) return "active_worker";
+  if (isWorkerProcessLive(indexed, now)) return "active_worker";
+  const status = resolveWorktreeGuardStatus(indexed, input.liveness);
+  const salvageHarnessRoot = resolveHarnessRoot2(input, indexed);
+  const salvageOrBlock = (skipReason) => {
+    if (salvageHarnessRoot && maybeSalvageBlockedWorktree({
+      indexed,
+      harnessRoot: salvageHarnessRoot,
+      skipReason,
+      status,
+      now,
+      writeSalvageEvidence: input.writeSalvageEvidence === true
+    })) {
+      return null;
+    }
+    return skipReason;
+  };
+  if (completionBlockerBlocksWorktreeRemoval(indexed, status)) {
+    const blocked = salvageOrBlock("completion_blocked");
+    if (blocked) return blocked;
+  }
   if (indexedWorktreeHasMaterialChanges(indexed, input.liveness?.gitStatusCache)) {
-    return "dirty_worktree";
+    const blocked = salvageOrBlock("dirty_worktree");
+    if (blocked) return blocked;
   }
   const ahead = input.liveness?.gitRevCache?.countAheadOfMain(input.worktreePath);
-  if (ahead !== null && ahead !== void 0 && ahead > 0) return "pr_or_unmerged_commits";
-  const status = resolveWorktreeGuardStatus(indexed, input.liveness);
-  if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return "completion_blocked";
-  if (runBlocksWorktreeRemoval(indexed, input.liveness)) return "run_still_active";
+  if (ahead !== null && ahead !== void 0 && ahead > 0) {
+    const blocked = salvageOrBlock("pr_or_unmerged_commits");
+    if (blocked) return blocked;
+  }
+  if (runBlocksWorktreeRemoval(indexed, input.liveness, now)) return "run_still_active";
   if (!isFinishedWorkerStatus(status)) return "run_still_active";
-  if (isPrOrUnmergedWork(status)) return "pr_or_unmerged_commits";
-  if (materialWorktreeChanges2(status.changedFiles).length > 0) return "dirty_worktree";
+  if (isPrOrUnmergedWork(status)) {
+    const blocked = salvageOrBlock("pr_or_unmerged_commits");
+    if (blocked) return blocked;
+  }
+  if (materialWorktreeChanges2(status.changedFiles).length > 0) {
+    const blocked = salvageOrBlock("dirty_worktree");
+    if (blocked) return blocked;
+  }
   const landing = assessWorkerLanding({
     finalResult: status.finalResult,
     changedFiles: status.changedFiles,
     gitAncestry: status.gitAncestry,
     prUrl: prUrlFromFinalResult(status.finalResult)
   });
-  if (landing.blocked) return "landing_blocked";
+  if (landing.blocked) {
+    const blocked = salvageOrBlock("landing_blocked");
+    if (blocked) return blocked;
+  }
   if (worktreeRemovalGuard && input.worktreePath) {
     const overlay = worktreeRemovalGuard({
       worktreePath: input.worktreePath,
@@ -10583,7 +10826,7 @@ function skipWorktreeRemoval(input) {
 function skipDependencyCacheRemoval(input) {
   const { indexed, nodeModulesAgeMs, ageMs, worktreePath, activeWorktreePaths, diskPressure } = input;
   if (!diskPressure && ageMs < nodeModulesAgeMs) return "below_age_threshold";
-  if (activeWorktreePaths.has(path38.resolve(worktreePath))) return "active_worker";
+  if (activeWorktreePaths.has(path39.resolve(worktreePath))) return "active_worker";
   if (indexed && isWorkerProcessLive(indexed)) return "active_worker";
   if (indexed && indexedWorktreeHasMaterialChanges(indexed, input.gitStatusCache)) {
     return "dirty_worktree";
@@ -10612,11 +10855,11 @@ var LIVE_SKIP_REASONS = /* @__PURE__ */ new Set([
 function collectPreservedLivePaths(actions, skips) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const push = (path77, reason, detail) => {
-    const key = `${path77}\0${reason}`;
+  const push = (path79, reason, detail) => {
+    const key = `${path79}\0${reason}`;
     if (seen.has(key) || out.length >= MAX_PRESERVED_LIVE_PATH_SAMPLES) return;
     seen.add(key);
-    out.push({ path: path77, reason, ...detail ? { detail } : {} });
+    out.push({ path: path79, reason, ...detail ? { detail } : {} });
   };
   for (const skip2 of skips) {
     if (!LIVE_SKIP_REASONS.has(skip2.reason)) continue;
@@ -10631,31 +10874,16 @@ function collectPreservedLivePaths(actions, skips) {
 }
 
 // src/cleanup-run-directory.ts
-import { existsSync as existsSync27, readdirSync as readdirSync9, statSync as statSync7 } from "node:fs";
-import path40 from "node:path";
+import { existsSync as existsSync27, readdirSync as readdirSync8, statSync as statSync6 } from "node:fs";
+import path41 from "node:path";
 
 // src/cleanup-active-worktrees.ts
 init_run_store();
 init_paths();
-import { existsSync as existsSync26, readdirSync as readdirSync8, statSync as statSync6 } from "node:fs";
-import path39 from "node:path";
+import path40 from "node:path";
 init_util();
-function workerHasRecentHarnessActivity(worker, now) {
-  const paths = [worker.heartbeatPath, worker.stdoutPath, worker.stderrPath];
-  for (const target of paths) {
-    if (!existsSync26(target)) continue;
-    try {
-      const age = now - statSync6(target).mtimeMs;
-      if (Number.isFinite(age) && age >= 0 && age < RUN_METADATA_ACTIVE_SIGNAL_MS) return true;
-    } catch {
-    }
-  }
-  return false;
-}
 function isActiveHarnessWorker2(worker, now) {
-  if (isPidAlive(worker.pid)) return true;
-  if (worker.status === "running" && workerHasRecentHarnessActivity(worker, now)) return true;
-  return false;
+  return isHarnessWorkerHarnessLive(worker, now);
 }
 function collectActiveWorktreeGuards(harnessRoots, now = Date.now()) {
   const activeWorktreePaths = /* @__PURE__ */ new Set();
@@ -10665,11 +10893,11 @@ function collectActiveWorktreeGuards(harnessRoots, now = Date.now()) {
       let runHasLive = false;
       for (const name of Object.keys(run.workers || {})) {
         const worker = readJson(
-          path39.join(runDirectoryAt(harnessRoot, run.id), "workers", safeSlug(name), "worker.json"),
+          path40.join(runDirectoryAt(harnessRoot, run.id), "workers", safeSlug(name), "worker.json"),
           void 0
         );
         if (!worker?.worktreePath) continue;
-        const worktreePath = path39.resolve(worker.worktreePath);
+        const worktreePath = path40.resolve(worker.worktreePath);
         if (!isActiveHarnessWorker2(worker, now)) continue;
         runHasLive = true;
         activeWorktreePaths.add(worktreePath);
@@ -10691,20 +10919,20 @@ function isWorktreeOnLiveRun(worktreePath, harnessRoot, runId, liveRunKeys) {
 init_util();
 function pathAgeMs(target, now) {
   try {
-    const mtime = statSync7(target).mtimeMs;
+    const mtime = statSync6(target).mtimeMs;
     return Math.max(0, now - mtime);
   } catch {
     return 0;
   }
 }
 function loadRunStatus(harnessRoot, runId) {
-  const runPath = path40.join(harnessRoot, "runs", runId, "run.json");
+  const runPath = path41.join(harnessRoot, "runs", runId, "run.json");
   if (!existsSync27(runPath)) return null;
   return readJson(runPath, null);
 }
 function runDirectoryIsEmpty(runPath) {
   try {
-    const entries = readdirSync9(runPath);
+    const entries = readdirSync8(runPath);
     return entries.length === 0;
   } catch {
     return false;
@@ -10728,7 +10956,7 @@ function scanStaleRunDirectoryCandidates(opts) {
   const candidates = [];
   let entries;
   try {
-    entries = readdirSync9(opts.worktreesDir, { withFileTypes: true });
+    entries = readdirSync8(opts.worktreesDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -10736,7 +10964,7 @@ function scanStaleRunDirectoryCandidates(opts) {
     if (!runEntry.isDirectory()) continue;
     const runId = runEntry.name;
     if (opts.runIdFilter && runId !== opts.runIdFilter) continue;
-    const runPath = path40.join(opts.worktreesDir, runId);
+    const runPath = path41.join(opts.worktreesDir, runId);
     if (!runDirectoryIsEmpty(runPath)) continue;
     candidates.push({
       kind: "remove_run_directory",
@@ -10756,8 +10984,8 @@ import { existsSync as existsSync30, rmSync as rmSync3 } from "node:fs";
 
 // src/cleanup-dir-size.ts
 import { execFileSync as execFileSync2 } from "node:child_process";
-import { existsSync as existsSync28, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
-import path41 from "node:path";
+import { existsSync as existsSync28, readdirSync as readdirSync9, statSync as statSync7 } from "node:fs";
+import path42 from "node:path";
 var DEFAULT_DU_TIMEOUT_MS = 2500;
 function directorySizeBytesDu(root, timeoutMs = DEFAULT_DU_TIMEOUT_MS) {
   if (!existsSync28(root)) return 0;
@@ -10785,16 +11013,16 @@ function directorySizeBytes(root, maxEntries = 5e4) {
     const current = stack.pop();
     let entries;
     try {
-      entries = readdirSync10(current);
+      entries = readdirSync9(current);
     } catch {
       continue;
     }
     for (const name of entries) {
       if (seen++ > maxEntries) return null;
-      const full = path41.join(current, name);
+      const full = path42.join(current, name);
       let st;
       try {
-        st = statSync8(full);
+        st = statSync7(full);
       } catch {
         continue;
       }
@@ -10810,7 +11038,7 @@ import { existsSync as existsSync29, rmSync as rmSync2 } from "node:fs";
 init_paths();
 
 // src/cleanup-path-ownership.ts
-import { lstatSync as lstatSync2, readdirSync as readdirSync11 } from "node:fs";
+import { lstatSync as lstatSync2, readdirSync as readdirSync10 } from "node:fs";
 function readPathOwnership(targetPath) {
   try {
     const st = lstatSync2(targetPath);
@@ -10827,7 +11055,7 @@ function pathHasForeignOwnedEntry(targetPath, maxEntries = 32) {
   if (!root) return false;
   if (root.foreign) return true;
   try {
-    const names = readdirSync11(targetPath);
+    const names = readdirSync10(targetPath);
     let checked = 0;
     for (const name of names) {
       if (checked >= maxEntries) break;
@@ -10843,20 +11071,20 @@ function pathHasForeignOwnedEntry(targetPath, maxEntries = 32) {
 
 // src/cleanup-privileged-remove.ts
 import { spawnSync as spawnSync6 } from "node:child_process";
-import path43 from "node:path";
+import path44 from "node:path";
 
 // src/cleanup-harness-path-validate.ts
-import path42 from "node:path";
+import path43 from "node:path";
 function isHarnessDependencyCachePath(targetPath, harnessRoot, worktreesDir, cacheDirName) {
-  const resolved = path42.resolve(targetPath);
-  const suffix = `${path42.sep}${cacheDirName}`;
+  const resolved = path43.resolve(targetPath);
+  const suffix = `${path43.sep}${cacheDirName}`;
   const cachePath = resolved.endsWith(suffix) ? resolved : null;
   if (!cachePath) return "path_outside_harness";
-  const rel = path42.relative(worktreesDir, cachePath);
-  if (rel.startsWith("..") || path42.isAbsolute(rel)) return "path_outside_harness";
-  const parts = rel.split(path42.sep);
+  const rel = path43.relative(worktreesDir, cachePath);
+  if (rel.startsWith("..") || path43.isAbsolute(rel)) return "path_outside_harness";
+  const parts = rel.split(path43.sep);
   if (parts.length < 3 || parts[parts.length - 1] !== cacheDirName) return "path_outside_harness";
-  if (!resolved.startsWith(path42.resolve(harnessRoot))) return "path_outside_harness";
+  if (!resolved.startsWith(path43.resolve(harnessRoot))) return "path_outside_harness";
   return null;
 }
 function isHarnessNodeModulesPath(targetPath, harnessRoot, worktreesDir) {
@@ -10866,16 +11094,16 @@ function isHarnessNextCachePath(targetPath, harnessRoot, worktreesDir) {
   return isHarnessDependencyCachePath(targetPath, harnessRoot, worktreesDir, ".next");
 }
 function isHarnessBuildCachePath(targetPath, harnessRoot, worktreesDir) {
-  const resolved = path42.resolve(targetPath);
-  const relToWt = path42.relative(worktreesDir, resolved);
-  if (relToWt.startsWith("..") || path42.isAbsolute(relToWt)) return "path_outside_harness";
-  const parts = relToWt.split(path42.sep);
+  const resolved = path43.resolve(targetPath);
+  const relToWt = path43.relative(worktreesDir, resolved);
+  if (relToWt.startsWith("..") || path43.isAbsolute(relToWt)) return "path_outside_harness";
+  const parts = relToWt.split(path43.sep);
   if (parts.length < 3) return "path_outside_harness";
-  if (!resolved.startsWith(path42.resolve(harnessRoot))) return "path_outside_harness";
+  if (!resolved.startsWith(path43.resolve(harnessRoot))) return "path_outside_harness";
   return null;
 }
 function isHarnessGeneratedCachePath(targetPath, harnessRoot, worktreesDir) {
-  const resolved = path42.resolve(targetPath);
+  const resolved = path43.resolve(targetPath);
   return isHarnessNodeModulesPath(resolved, harnessRoot, worktreesDir) === null || isHarnessNextCachePath(resolved, harnessRoot, worktreesDir) === null || isHarnessBuildCachePath(resolved, harnessRoot, worktreesDir) === null;
 }
 
@@ -10909,12 +11137,12 @@ function tryPrivilegedReclaimHarnessCache(targetPath, harnessRoot, worktreesDir)
     "chown",
     "-R",
     `${effectiveUid}:${effectiveGid}`,
-    path43.resolve(targetPath)
+    path44.resolve(targetPath)
   ]);
   if (chown.ok) {
     return { ok: true, method: "chown_then_rm" };
   }
-  const rm = runSudoNonInteractive(["rm", "-rf", path43.resolve(targetPath)]);
+  const rm = runSudoNonInteractive(["rm", "-rf", path44.resolve(targetPath)]);
   if (rm.ok) {
     return { ok: true, method: "sudo_rm" };
   }
@@ -11115,27 +11343,27 @@ function removeWorktree(candidate, execute) {
 }
 
 // src/cleanup-scan.ts
-import { existsSync as existsSync31, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
-import path44 from "node:path";
+import { existsSync as existsSync31, readdirSync as readdirSync11, statSync as statSync8 } from "node:fs";
+import path45 from "node:path";
 function pathAgeMs2(target, now) {
   try {
-    const mtime = statSync9(target).mtimeMs;
+    const mtime = statSync8(target).mtimeMs;
     return Math.max(0, now - mtime);
   } catch {
     return 0;
   }
 }
 function isPathInside(child, parent) {
-  const rel = path44.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path44.isAbsolute(rel);
+  const rel = path45.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path45.isAbsolute(rel);
 }
 function collectBuildCacheForWorktree(worktreePath, opts, seen, meta) {
   const out = [];
   for (const rel of HARNESS_BUILD_CACHE_RELATIVE_PATHS) {
     if (rel === ".next") continue;
-    const target = path44.join(worktreePath, rel);
+    const target = path45.join(worktreePath, rel);
     if (!existsSync31(target)) continue;
-    const resolved = path44.resolve(target);
+    const resolved = path45.resolve(target);
     if (seen.has(resolved)) continue;
     if (!isPathInside(resolved, opts.harnessRoot)) continue;
     seen.add(resolved);
@@ -11165,12 +11393,12 @@ function scanBuildCacheCandidates(opts) {
     );
   }
   if (!opts.includeOrphans || !existsSync31(opts.worktreesDir)) return candidates;
-  for (const runEntry of readdirSync12(opts.worktreesDir, { withFileTypes: true })) {
+  for (const runEntry of readdirSync11(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
-    const runPath = path44.join(opts.worktreesDir, runEntry.name);
-    for (const workerEntry of readdirSync12(runPath, { withFileTypes: true })) {
+    const runPath = path45.join(opts.worktreesDir, runEntry.name);
+    for (const workerEntry of readdirSync11(runPath, { withFileTypes: true })) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path44.join(runPath, workerEntry.name);
+      const worktreePath = path45.join(runPath, workerEntry.name);
       candidates.push(
         ...collectBuildCacheForWorktree(worktreePath, opts, seen, {
           runId: runEntry.name,
@@ -11208,21 +11436,21 @@ function scanWorktreeCandidates(opts) {
   if (!orphanEnabled || !existsSync31(opts.worktreesDir)) return candidates;
   const indexedPaths = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
-    indexedPaths.add(path44.resolve(entry.worktreePath));
+    indexedPaths.add(path45.resolve(entry.worktreePath));
   }
-  for (const runEntry of readdirSync12(opts.worktreesDir, { withFileTypes: true })) {
+  for (const runEntry of readdirSync11(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
     if (opts.runIdFilter && runEntry.name !== opts.runIdFilter) continue;
-    const runPath = path44.join(opts.worktreesDir, runEntry.name);
+    const runPath = path45.join(opts.worktreesDir, runEntry.name);
     let workerEntries;
     try {
-      workerEntries = readdirSync12(runPath, { withFileTypes: true });
+      workerEntries = readdirSync11(runPath, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const workerEntry of workerEntries) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path44.resolve(path44.join(runPath, workerEntry.name));
+      const worktreePath = path45.resolve(path45.join(runPath, workerEntry.name));
       if (seen.has(worktreePath)) continue;
       if (indexedPaths.has(worktreePath)) continue;
       if (!isPathInside(worktreePath, opts.harnessRoot)) continue;
@@ -11241,27 +11469,27 @@ function scanWorktreeCandidates(opts) {
 }
 
 // src/cleanup-dependency-scan.ts
-import { existsSync as existsSync32, readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
-import path45 from "node:path";
+import { existsSync as existsSync32, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
+import path46 from "node:path";
 var DEPENDENCY_CACHE_DIRS = [
   { dirName: "node_modules", kind: "remove_node_modules" },
   { dirName: ".next", kind: "remove_next_cache" }
 ];
 function pathAgeMs3(target, now) {
   try {
-    const mtime = statSync10(target).mtimeMs;
+    const mtime = statSync9(target).mtimeMs;
     return Math.max(0, now - mtime);
   } catch {
     return 0;
   }
 }
 function isPathInside2(child, parent) {
-  const rel = path45.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path45.isAbsolute(rel);
+  const rel = path46.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path46.isAbsolute(rel);
 }
 function pushCandidate2(candidates, seen, opts, targetPath, kind, meta) {
   if (!existsSync32(targetPath)) return;
-  const resolved = path45.resolve(targetPath);
+  const resolved = path46.resolve(targetPath);
   if (seen.has(resolved)) return;
   if (!isPathInside2(resolved, opts.harnessRoot)) return;
   seen.add(resolved);
@@ -11278,7 +11506,7 @@ function pushCandidate2(candidates, seen, opts, targetPath, kind, meta) {
 }
 function scanWorktreeDependencyCaches(candidates, seen, opts, worktreePath, meta) {
   for (const entry of DEPENDENCY_CACHE_DIRS) {
-    pushCandidate2(candidates, seen, opts, path45.join(worktreePath, entry.dirName), entry.kind, meta);
+    pushCandidate2(candidates, seen, opts, path46.join(worktreePath, entry.dirName), entry.kind, meta);
   }
 }
 function scanDependencyCacheCandidates(opts) {
@@ -11293,19 +11521,19 @@ function scanDependencyCacheCandidates(opts) {
     });
   }
   if (!opts.includeOrphans || !existsSync32(opts.worktreesDir)) return candidates;
-  for (const runEntry of readdirSync13(opts.worktreesDir, { withFileTypes: true })) {
+  for (const runEntry of readdirSync12(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
     if (opts.runIdFilter && runEntry.name !== opts.runIdFilter) continue;
-    const runPath = path45.join(opts.worktreesDir, runEntry.name);
+    const runPath = path46.join(opts.worktreesDir, runEntry.name);
     let workerEntries;
     try {
-      workerEntries = readdirSync13(runPath, { withFileTypes: true });
+      workerEntries = readdirSync12(runPath, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const workerEntry of workerEntries) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path45.join(runPath, workerEntry.name);
+      const worktreePath = path46.join(runPath, workerEntry.name);
       scanWorktreeDependencyCaches(candidates, seen, opts, worktreePath, {
         runId: runEntry.name,
         worker: workerEntry.name
@@ -11317,11 +11545,11 @@ function scanDependencyCacheCandidates(opts) {
 
 // src/cleanup-duplicate-worktrees.ts
 init_git();
-import { existsSync as existsSync33, statSync as statSync11 } from "node:fs";
-import path46 from "node:path";
+import { existsSync as existsSync33, statSync as statSync10 } from "node:fs";
+import path47 from "node:path";
 function pathAgeMs4(target, now) {
   try {
-    const mtime = statSync11(target).mtimeMs;
+    const mtime = statSync10(target).mtimeMs;
     return Math.max(0, now - mtime);
   } catch {
     return 0;
@@ -11348,32 +11576,24 @@ function parseWorktreePorcelain(output) {
   return records;
 }
 function isUnderWorktreesDir(worktreePath, worktreesDir) {
-  const rel = path46.relative(path46.resolve(worktreesDir), path46.resolve(worktreePath));
-  return rel !== "" && !rel.startsWith("..") && !path46.isAbsolute(rel);
-}
-function isCleanWorktree(worktreePath, repoRoot) {
-  try {
-    const porcelain = git(repoRoot, ["-C", worktreePath, "status", "--porcelain"], {
-      allowFailure: true
-    });
-    return !String(porcelain || "").trim();
-  } catch {
-    return false;
-  }
+  const rel = path47.relative(path47.resolve(worktreesDir), path47.resolve(worktreePath));
+  return rel !== "" && !rel.startsWith("..") && !path47.isAbsolute(rel);
 }
+var MAX_DUPLICATE_WORKTREE_CANDIDATES_PER_REPO = 200;
 function scanDuplicateWorktreeCandidates(opts) {
   if (!opts.includeOrphans || !existsSync33(opts.worktreesDir)) return [];
   const repos = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
-    if (entry.run.repo) repos.add(path46.resolve(entry.run.repo));
+    if (entry.run.repo) repos.add(path47.resolve(entry.run.repo));
   }
   const indexedPaths = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
-    indexedPaths.add(path46.resolve(entry.worktreePath));
+    indexedPaths.add(path47.resolve(entry.worktreePath));
   }
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
   for (const repoRoot of repos) {
+    let repoCandidateCount = 0;
     let porcelain;
     try {
       porcelain = git(repoRoot, ["worktree", "list", "--porcelain"], { allowFailure: true });
@@ -11382,18 +11602,19 @@ function scanDuplicateWorktreeCandidates(opts) {
     }
     const worktrees = parseWorktreePorcelain(porcelain);
     for (const wt of worktrees) {
-      const resolved = path46.resolve(wt.path);
-      if (resolved === path46.resolve(repoRoot)) continue;
+      if (repoCandidateCount >= MAX_DUPLICATE_WORKTREE_CANDIDATES_PER_REPO) break;
+      const resolved = path47.resolve(wt.path);
+      if (resolved === path47.resolve(repoRoot)) continue;
       if (!isUnderWorktreesDir(resolved, opts.worktreesDir)) continue;
       if (indexedPaths.has(resolved)) continue;
       if (seen.has(resolved)) continue;
       if (!existsSync33(resolved)) continue;
-      if (!isCleanWorktree(resolved, repoRoot)) continue;
-      const rel = path46.relative(opts.worktreesDir, resolved);
-      const parts = rel.split(path46.sep);
+      const rel = path47.relative(opts.worktreesDir, resolved);
+      const parts = rel.split(path47.sep);
       const runId = parts[0];
       const worker = parts[1] ?? "unknown";
       seen.add(resolved);
+      repoCandidateCount += 1;
       candidates.push({
         kind: "remove_worktree",
         path: resolved,
@@ -11411,12 +11632,22 @@ function scanDuplicateWorktreeCandidates(opts) {
 // src/cleanup-worktree-index.ts
 init_run_store();
 init_util();
-import path47 from "node:path";
+import path48 from "node:path";
+function filterWorktreeIndexForRoot(index, harnessRoot) {
+  const resolvedRoot = path48.resolve(harnessRoot);
+  const scoped = /* @__PURE__ */ new Map();
+  for (const [key, entry] of index) {
+    const entryRoot = entry.harnessRoot ? path48.resolve(entry.harnessRoot) : null;
+    if (entryRoot && entryRoot !== resolvedRoot) continue;
+    scoped.set(key, entry);
+  }
+  return scoped;
+}
 function buildWorktreeIndexAt(harnessRoot) {
   const index = /* @__PURE__ */ new Map();
   for (const run of listRunRecordsForHarnessRoot(harnessRoot)) {
     for (const name of Object.keys(run.workers || {})) {
-      const workerPath = path47.join(
+      const workerPath = path48.join(
         runDirectoryAt(harnessRoot, run.id),
         "workers",
         safeSlug(name),
@@ -11424,9 +11655,9 @@ function buildWorktreeIndexAt(harnessRoot) {
       );
       const worker = readJson(workerPath, void 0);
       if (!worker?.worktreePath) continue;
-      index.set(path47.resolve(worker.worktreePath), {
+      index.set(path48.resolve(worker.worktreePath), {
         harnessRoot,
-        worktreePath: path47.resolve(worker.worktreePath),
+        worktreePath: path48.resolve(worker.worktreePath),
         runId: run.id,
         workerName: name,
         run,
@@ -11452,6 +11683,7 @@ function resolveHarnessRetention(options = {}) {
   const execute = options.execute === true || options.execute !== false && envFlag3("KYNVER_CLEANUP_EXECUTE");
   const finalizeStaleRuns2 = options.finalizeStaleRuns !== false && !envFlag3("KYNVER_CLEANUP_SKIP_FINALIZE");
   const nodeModulesAgeMs = options.nodeModulesAgeMs ?? envMs("KYNVER_CLEANUP_NODE_MODULES_AGE_MS", DEFAULT_NODE_MODULES_AGE_MS);
+  const scanDependencyCaches = options.scanDependencyCaches ?? (options.nodeModulesAgeMs !== void 0 || process.env.KYNVER_CLEANUP_NODE_MODULES_AGE_MS != null);
   const worktreesAgeMs = options.worktreesAgeMs ?? envMs("KYNVER_CLEANUP_WORKTREES_AGE_MS", 0);
   const terminalWorktreesAgeMs = options.terminalWorktreesAgeMs ?? envMs("KYNVER_CLEANUP_TERMINAL_WORKTREES_AGE_MS", DEFAULT_TERMINAL_WORKTREES_AGE_MS);
   const runDirectoriesAgeMs = options.runDirectoriesAgeMs ?? envMs("KYNVER_CLEANUP_RUN_DIRECTORIES_AGE_MS", DEFAULT_RUN_DIRECTORIES_AGE_MS);
@@ -11467,6 +11699,7 @@ function resolveHarnessRetention(options = {}) {
   return {
     execute,
     finalizeStaleRuns: finalizeStaleRuns2,
+    scanDependencyCaches,
     nodeModulesAgeMs,
     worktreesAgeMs: worktreesAgeMs > 0 ? worktreesAgeMs : 0,
     terminalWorktreesAgeMs: terminalWorktreesAgeMs >= 0 ? terminalWorktreesAgeMs : 0,
@@ -11490,35 +11723,38 @@ function resolvePipelineHarnessRetention(runId) {
     runDirectoriesAgeMs: scopeAll ? DEFAULT_RUN_DIRECTORIES_AGE_MS : void 0,
     includeOrphans: scopeAll ? true : void 0,
     finalizeStaleRuns: true,
-    accountBytes: true
+    accountBytes: true,
+    scanDependencyCaches: true
   });
 }
 
 // src/cleanup-orphan-safety.ts
 init_git();
-import { existsSync as existsSync34, statSync as statSync12 } from "node:fs";
-import path48 from "node:path";
+import { existsSync as existsSync34 } from "node:fs";
+import path49 from "node:path";
+init_util();
 var DEFAULT_HEARTBEAT_FRESH_MS = 30 * 60 * 1e3;
 function assessOrphanWorktreeSafety(input) {
   const now = input.now ?? Date.now();
   const heartbeatFreshMs = input.heartbeatFreshMs ?? DEFAULT_HEARTBEAT_FRESH_MS;
   if (!existsSync34(input.worktreePath)) return null;
   if (input.runId && input.workerName) {
-    const heartbeatPath = path48.join(
+    const workerDir = path49.join(
       input.harnessRoot,
       "runs",
       input.runId,
       "workers",
-      input.workerName,
-      "heartbeat.jsonl"
+      input.workerName
     );
-    try {
-      const mtime = statSync12(heartbeatPath).mtimeMs;
-      if (now - mtime < heartbeatFreshMs) return "active_worker";
-    } catch {
+    const worker = readJson(
+      path49.join(workerDir, "worker.json"),
+      void 0
+    );
+    if (worker && heartbeatContentIsFresh(worker, now, heartbeatFreshMs)) {
+      return "active_worker";
     }
   }
-  const gitDir = path48.join(input.worktreePath, ".git");
+  const gitDir = path49.join(input.worktreePath, ".git");
   if (!existsSync34(gitDir)) return null;
   const porcelain = gitCapture(input.worktreePath, ["status", "--porcelain"]);
   if (porcelain.status !== 0) return "pr_or_unmerged_commits";
@@ -11549,8 +11785,8 @@ function assessOrphanWorktreeSafety(input) {
 
 // src/harness-storage-snapshot.ts
 init_paths();
-import { existsSync as existsSync35, readdirSync as readdirSync14, statSync as statSync13 } from "node:fs";
-import path49 from "node:path";
+import { existsSync as existsSync35, readdirSync as readdirSync13, statSync as statSync11 } from "node:fs";
+import path50 from "node:path";
 function harnessStorageSnapshot(opts = {}) {
   const harnessRoot = normalizeHarnessRoot(opts.harnessRoot ?? resolveHarnessRoot());
   const worktreesDir = harnessWorktreesDir(harnessRoot);
@@ -11573,7 +11809,7 @@ function harnessStorageSnapshot(opts = {}) {
   let oldestMs = null;
   let entries;
   try {
-    entries = readdirSync14(worktreesDir, { withFileTypes: true });
+    entries = readdirSync13(worktreesDir, { withFileTypes: true });
   } catch {
     return {
       harnessRoot,
@@ -11588,14 +11824,14 @@ function harnessStorageSnapshot(opts = {}) {
   for (const runEntry of entries) {
     if (!runEntry.isDirectory()) continue;
     runCount += 1;
-    const runPath = path49.join(worktreesDir, runEntry.name);
+    const runPath = path50.join(worktreesDir, runEntry.name);
     try {
-      const st = statSync13(runPath);
+      const st = statSync11(runPath);
       oldestMs = oldestMs === null ? st.mtimeMs : Math.min(oldestMs, st.mtimeMs);
     } catch {
     }
     try {
-      for (const workerEntry of readdirSync14(runPath, { withFileTypes: true })) {
+      for (const workerEntry of readdirSync13(runPath, { withFileTypes: true })) {
         if (workerEntry.isDirectory()) workerCount += 1;
       }
     } catch {
@@ -11626,10 +11862,10 @@ function harnessStorageSnapshot(opts = {}) {
 init_paths();
 import { existsSync as existsSync36 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import path50 from "node:path";
+import path51 from "node:path";
 var WELL_KNOWN_HARNESS_SCAN_ROOTS = [
   "/var/tmp/kynver-harness",
-  path50.join(homedir13(), ".openclaw", "harness")
+  path51.join(homedir13(), ".openclaw", "harness")
 ];
 function addRoot(seen, roots, candidate) {
   if (!candidate?.trim()) return;
@@ -11651,7 +11887,7 @@ function resolveHarnessScanRoots(options = {}) {
   for (const candidate of extra ?? []) addRoot(seen, roots, candidate);
   if (shouldScanWellKnownRoots(options)) {
     for (const candidate of WELL_KNOWN_HARNESS_SCAN_ROOTS) {
-      const resolved = path50.resolve(candidate);
+      const resolved = path51.resolve(candidate);
       if (!seen.has(resolved) && existsSync36(resolved)) addRoot(seen, roots, resolved);
     }
   }
@@ -11730,15 +11966,52 @@ var CleanupGitRevCache = class {
   }
 };
 
+// src/cleanup-git-probe.ts
+import { spawnSync as spawnSync7 } from "node:child_process";
+import { existsSync as existsSync37 } from "node:fs";
+import path52 from "node:path";
+var CLEANUP_GIT_PROBE_TIMEOUT_MS = 5e3;
+function cleanupGitCapture(cwd, args) {
+  if (!existsSync37(path52.join(cwd, ".git"))) {
+    return { status: null, stdout: "", stderr: "", error: "not_a_git_repo" };
+  }
+  try {
+    const res = spawnSync7("git", args, {
+      cwd,
+      encoding: "utf8",
+      timeout: CLEANUP_GIT_PROBE_TIMEOUT_MS
+    });
+    const timedOut = res.error?.message?.includes("ETIMEDOUT") === true;
+    return {
+      status: timedOut ? null : res.status,
+      stdout: res.stdout || "",
+      stderr: res.stderr || "",
+      error: timedOut ? "git_timeout" : res.error ? res.error.message : null
+    };
+  } catch (error) {
+    return {
+      status: null,
+      stdout: "",
+      stderr: "",
+      error: error.message
+    };
+  }
+}
+function gitStatusShortForCleanup(worktreePath) {
+  const captured = cleanupGitCapture(worktreePath, ["status", "--short"]);
+  if (captured.error === "not_a_git_repo") return [];
+  if (captured.error === "git_timeout" || captured.status !== 0) return null;
+  return captured.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+}
+
 // src/cleanup-git-status-cache.ts
-init_git();
 var CleanupGitStatusCache = class {
   cache = /* @__PURE__ */ new Map();
   porcelain(worktreePath) {
     const resolved = worktreePath;
     const cached = this.cache.get(resolved);
     if (cached !== void 0) return cached;
-    const lines = gitStatusShort(resolved);
+    const lines = gitStatusShortForCleanup(resolved) ?? [];
     this.cache.set(resolved, lines);
     return lines;
   }
@@ -11843,9 +12116,9 @@ function mergeWorktreeIndexes(scanRoots) {
 }
 function worktreePathForCandidate(candidate, worktreesDir) {
   if (candidate.runId && candidate.worker) {
-    return path51.join(worktreesDir, candidate.runId, candidate.worker);
+    return path53.join(worktreesDir, candidate.runId, candidate.worker);
   }
-  return path51.resolve(candidate.path, "..");
+  return path53.resolve(candidate.path, "..");
 }
 function runHarnessCleanup(options = {}) {
   let retention = resolveHarnessRetention(options);
@@ -11874,7 +12147,8 @@ function runHarnessCleanup(options = {}) {
   for (const harnessRoot of paths.scanRoots) {
     if (atSweepCap()) break;
     emitCleanupProgress("root", harnessRoot);
-    const worktreesDir = path51.join(harnessRoot, "worktrees");
+    const worktreesDir = path53.join(harnessRoot, "worktrees");
+    const rootIndex = filterWorktreeIndexForRoot(index, harnessRoot);
     const scanOpts = {
       harnessRoot,
       worktreesDir,
@@ -11882,11 +12156,14 @@ function runHarnessCleanup(options = {}) {
       worktreesAgeMs: retention.worktreesAgeMs,
       includeOrphans: retention.includeOrphans,
       runIdFilter: retention.runIdFilter,
-      index,
+      index: rootIndex,
       now: paths.now
     };
-    const dependencyCandidates = scanDependencyCacheCandidates(scanOpts);
-    emitCleanupProgress("dependency", `${dependencyCandidates.length} cache candidate(s) at ${harnessRoot}`);
+    const dependencyCandidates = retention.scanDependencyCaches ? scanDependencyCacheCandidates(scanOpts) : [];
+    emitCleanupProgress(
+      "dependency",
+      retention.scanDependencyCaches ? `${dependencyCandidates.length} cache candidate(s) at ${harnessRoot}` : "skipped (worktree-only sweep)"
+    );
     let dependencyProcessed = 0;
     for (const raw of dependencyCandidates) {
       if (atSweepCap()) break;
@@ -11894,7 +12171,7 @@ function runHarnessCleanup(options = {}) {
       if (dependencyProcessed % 50 === 0) {
         emitCleanupProgress("dependency", `${dependencyProcessed}/${dependencyCandidates.length} evaluated`);
       }
-      const resolved = path51.resolve(raw.path);
+      const resolved = path53.resolve(raw.path);
       if (processedPaths.has(resolved)) continue;
       processedPaths.add(resolved);
       const candidate = { ...raw, path: resolved };
@@ -11905,7 +12182,7 @@ function runHarnessCleanup(options = {}) {
         continue;
       }
       const worktreePath = worktreePathForCandidate(candidate, worktreesDir);
-      const indexed = index.get(path51.resolve(worktreePath)) ?? null;
+      const indexed = rootIndex.get(path53.resolve(worktreePath)) ?? null;
       const guardReason = skipDependencyCacheRemoval({
         indexed,
         includeOrphans: true,
@@ -11928,9 +12205,9 @@ function runHarnessCleanup(options = {}) {
         )
       );
     }
-    for (const raw of scanBuildCacheCandidates(scanOpts)) {
+    if (retention.scanDependencyCaches) for (const raw of scanBuildCacheCandidates(scanOpts)) {
       if (atSweepCap()) break;
-      const resolved = path51.resolve(raw.path);
+      const resolved = path53.resolve(raw.path);
       if (processedPaths.has(resolved)) continue;
       processedPaths.add(resolved);
       const candidate = { ...raw, path: resolved };
@@ -11941,7 +12218,7 @@ function runHarnessCleanup(options = {}) {
         continue;
       }
       const worktreePath = worktreePathForCandidate(candidate, worktreesDir);
-      const indexed = index.get(path51.resolve(worktreePath)) ?? null;
+      const indexed = rootIndex.get(path53.resolve(worktreePath)) ?? null;
       const guardReason = skipBuildCacheRemoval({
         indexed,
         includeOrphans: true,
@@ -11977,11 +12254,11 @@ function runHarnessCleanup(options = {}) {
       if (worktreeProcessed % 50 === 0) {
         emitCleanupProgress("worktrees", `${worktreeProcessed}/${worktreeCandidates.length} evaluated`);
       }
-      const resolved = path51.resolve(raw.path);
+      const resolved = path53.resolve(raw.path);
       if (worktreeSeen.has(resolved)) continue;
       worktreeSeen.add(resolved);
       const candidate = { ...raw, path: resolved };
-      const indexed = index.get(path51.resolve(candidate.path)) ?? null;
+      const indexed = rootIndex.get(path53.resolve(candidate.path)) ?? null;
       const orphanSafety = indexed ? null : assessOrphanWorktreeSafety({
         worktreePath: candidate.path,
         harnessRoot,
@@ -11991,14 +12268,17 @@ function runHarnessCleanup(options = {}) {
       });
       const guardSkip = skipWorktreeRemoval({
         indexed,
-        worktreePath: path51.resolve(candidate.path),
+        worktreePath: path53.resolve(candidate.path),
         includeOrphans: retention.includeOrphans,
         worktreesAgeMs: retention.worktreesAgeMs,
         terminalWorktreesAgeMs: retention.terminalWorktreesAgeMs,
         ageMs: candidate.ageMs,
         orphanSafety,
         worktreeRemovalGuard: options.worktreeRemovalGuard,
-        liveness
+        liveness,
+        now: paths.now,
+        harnessRoot,
+        writeSalvageEvidence: retention.execute
       });
       if (guardSkip) {
         const { reason: guardReason, detail: guardDetail } = normalizeGuardSkip(guardSkip);
@@ -12023,11 +12303,11 @@ function runHarnessCleanup(options = {}) {
         now: paths.now
       })) {
         if (atSweepCap()) break;
-        const resolved = path51.resolve(raw.path);
+        const resolved = path53.resolve(raw.path);
         if (processedPaths.has(resolved)) continue;
         processedPaths.add(resolved);
         const candidate = { ...raw, path: resolved };
-        const runId = candidate.runId ?? path51.basename(resolved);
+        const runId = candidate.runId ?? path53.basename(resolved);
         const dirSkip = skipRunDirectoryRemoval({
           harnessRoot,
           runId,
@@ -12163,12 +12443,12 @@ function isPipelineCleanupEnabled() {
 // src/installed-package-versions.ts
 import { readFile } from "node:fs/promises";
 import { homedir as homedir14 } from "node:os";
-import path53 from "node:path";
+import path55 from "node:path";
 
 // src/memory-cost-package-version-guard.ts
 init_default_repo_discovery();
-import { existsSync as existsSync37, readFileSync as readFileSync13 } from "node:fs";
-import path52 from "node:path";
+import { existsSync as existsSync38, readFileSync as readFileSync13 } from "node:fs";
+import path54 from "node:path";
 var MEMORY_COST_PACKAGE_MIN_VERSIONS = {
   "@kynver-app/runtime": "0.1.83",
   "@kynver-app/openclaw-agent-os": "0.1.43",
@@ -12230,8 +12510,8 @@ function resolveRepoRoot(cwd, explicitRepoRoot) {
     (value) => Boolean(value?.trim())
   );
   for (const candidate of candidates) {
-    const resolved = path52.resolve(candidate);
-    if (existsSync37(path52.join(resolved, "packages/kynver-runtime/package.json")) && existsSync37(path52.join(resolved, "package.json"))) {
+    const resolved = path54.resolve(candidate);
+    if (existsSync38(path54.join(resolved, "packages/kynver-runtime/package.json")) && existsSync38(path54.join(resolved, "package.json"))) {
       return resolved;
     }
   }
@@ -12244,7 +12524,7 @@ function probeRepoPackageVersions(input = {}) {
   if (!repoRoot) return {};
   const out = {};
   for (const packageName of MEMORY_COST_MANAGED_PACKAGES) {
-    const packageJsonPath = path52.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
+    const packageJsonPath = path54.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
     const version = readPackageJsonVersion(packageJsonPath);
     if (!version) continue;
     out[packageName] = { version, source: "repo", path: packageJsonPath };
@@ -12364,12 +12644,12 @@ function unique(values) {
 }
 function moduleRoots() {
   const home = homedir14();
-  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path53.join(home, ".openclaw", "npm");
-  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path53.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path53.join(home, ".npm-global", "lib", "node_modules"));
+  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path55.join(home, ".openclaw", "npm");
+  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path55.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path55.join(home, ".npm-global", "lib", "node_modules"));
   return unique([
-    path53.join(openClawPrefix, "lib", "node_modules"),
-    path53.join(openClawPrefix, "node_modules"),
-    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path53.join(npmGlobalRoot, "lib", "node_modules")
+    path55.join(openClawPrefix, "lib", "node_modules"),
+    path55.join(openClawPrefix, "node_modules"),
+    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path55.join(npmGlobalRoot, "lib", "node_modules")
   ]);
 }
 async function readVersion(packageJsonPath) {
@@ -12385,7 +12665,7 @@ function installedPackageJsonCandidates(packageName) {
   const seen = /* @__PURE__ */ new Set();
   const out = [];
   for (const root of roots) {
-    const candidate = path53.join(root, packageName, "package.json");
+    const candidate = path55.join(root, packageName, "package.json");
     if (seen.has(candidate)) continue;
     seen.add(candidate);
     out.push(candidate);
@@ -12411,12 +12691,12 @@ async function collectInstalledPackageVersions(observedAt = (/* @__PURE__ */ new
 }
 
 // src/provider-evidence/exec.ts
-import { spawnSync as spawnSync7 } from "node:child_process";
+import { spawnSync as spawnSync8 } from "node:child_process";
 var DEFAULT_CLI_TIMEOUT_MS = 1e4;
 var MAX_CLI_BUFFER_BYTES = 4 * 1024 * 1024;
 var defaultCliRunner = (cmd, args, opts) => {
   try {
-    const result = spawnSync7(cmd, args, {
+    const result = spawnSync8(cmd, args, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: opts?.timeoutMs ?? DEFAULT_CLI_TIMEOUT_MS,
@@ -12716,10 +12996,10 @@ function collectProviderEvidence(wanted, opts = {}) {
 // src/provider-evidence/wanted-store.ts
 init_run_store();
 init_util();
-import path54 from "node:path";
+import path56 from "node:path";
 var WANTED_FILE = "provider-evidence-wanted.json";
 function wantedFilePath(runId) {
-  return path54.join(runDirectory(runId), WANTED_FILE);
+  return path56.join(runDirectory(runId), WANTED_FILE);
 }
 function parseWantedItems(value) {
   if (!Array.isArray(value)) return [];
@@ -12758,7 +13038,7 @@ async function completeFinishedWorkers(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path55.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path57.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || worker.localOnly) continue;
@@ -12933,7 +13213,7 @@ import os11 from "node:os";
 // src/chat/anthropic-credentials.ts
 import { readFileSync as readFileSync14 } from "node:fs";
 import { homedir as homedir15, platform } from "node:os";
-import path56 from "node:path";
+import path58 from "node:path";
 import { execFileSync as execFileSync3 } from "node:child_process";
 function parseClaudeCredentials(raw, now = Date.now()) {
   try {
@@ -12961,17 +13241,18 @@ function readClaudeCliToken() {
     }
   }
   try {
-    const raw = readFileSync14(path56.join(homedir15(), ".claude", ".credentials.json"), "utf8");
+    const raw = readFileSync14(path58.join(homedir15(), ".claude", ".credentials.json"), "utf8");
     return parseClaudeCredentials(raw);
   } catch {
     return null;
   }
 }
-function resolveLocalAnthropicCredentials(env = process.env) {
+function resolveLocalAnthropicCredentials(env = process.env, opts = {}) {
   const apiKey = env.ANTHROPIC_API_KEY?.trim();
   if (apiKey) return { kind: "api_key", key: apiKey };
-  const optIn = env.KYNVER_CHAT_USE_CLAUDE_OAUTH;
-  if (optIn === "1" || optIn === "true" || optIn === "yes") {
+  const envOptIn = env.KYNVER_CHAT_USE_CLAUDE_OAUTH;
+  const optedIn = opts.oauthOptIn === true || envOptIn === "1" || envOptIn === "true" || envOptIn === "yes";
+  if (optedIn) {
     const token = readClaudeCliToken();
     if (token) return { kind: "oauth", token };
   }
@@ -13157,20 +13438,43 @@ var CLAIM_WAIT_MS = 25e3;
 var CLAIM_FETCH_TIMEOUT_MS = 32e3;
 var ERROR_BACKOFF_MS = 5e3;
 var AUTH_BACKOFF_MS = 6e4;
+var BRIDGE_REDISCOVER_MS = 5 * 6e4;
+var DISCOVERY_TIMEOUT_MS = 5e3;
 var DEFAULT_CHAT_MODEL = "claude-sonnet-4-6";
-function resolveChatBridgeTarget(env = process.env) {
-  const bridgeUrl = env.KYNVER_RUNTIME_CHAT_BRIDGE_URL?.trim();
-  if (!bridgeUrl) return null;
+async function discoverBridgeUrl(apiBaseUrl, apiKey, env) {
+  const override = env.KYNVER_RUNTIME_CHAT_BRIDGE_URL?.trim();
+  if (override) return override;
+  if (!apiBaseUrl) return null;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DISCOVERY_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${apiBaseUrl.replace(/\/$/, "")}/api/runtime/chat-bridge`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    if (!res.ok) return null;
+    const body = await res.json().catch(() => null);
+    return typeof body?.bridgeUrl === "string" && body.bridgeUrl.trim() ? body.bridgeUrl.trim() : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolveChatBridgeTarget(env = process.env) {
   const config = loadUserConfig();
   const agentOsId = config.agentOsId?.trim();
   const apiKey = loadApiKey();
   if (!agentOsId || !apiKey) return null;
+  const bridgeUrl = await discoverBridgeUrl(config.apiBaseUrl, apiKey, env);
+  if (!bridgeUrl) return null;
   return {
     bridgeUrl: bridgeUrl.replace(/\/$/, ""),
     agentOsId,
     apiKey,
     boxId: os11.hostname(),
-    model: env.KYNVER_CHAT_MODEL?.trim() || config.defaultModel?.trim() || DEFAULT_CHAT_MODEL
+    model: env.KYNVER_CHAT_MODEL?.trim() || config.defaultModel?.trim() || DEFAULT_CHAT_MODEL,
+    useClaudeOauth: config.chatUseClaudeOauth === true
   };
 }
 async function claimOnce(target, shouldStop) {
@@ -13231,7 +13535,7 @@ async function executeChatTurn(target, turn) {
     });
   };
   const batcher = new DeltaBatcher(sendBatch);
-  const creds = resolveLocalAnthropicCredentials();
+  const creds = resolveLocalAnthropicCredentials(process.env, { oauthOptIn: target.useClaudeOauth });
   if (!creds) {
     await pushEvents(target, turn.turnId, [
       { seq: 0, kind: "error", error: "no_local_credentials" }
@@ -13276,15 +13580,31 @@ async function sleep2(ms, shouldStop) {
   }
 }
 async function runChatClaimLoop(opts) {
-  const target = resolveChatBridgeTarget();
-  if (!target) return;
+  let target = await resolveChatBridgeTarget();
+  if (!target) {
+    console.error(
+      JSON.stringify({
+        event: "chat_claim_loop_waiting",
+        reason: !loadApiKey() || !loadUserConfig().agentOsId?.trim() ? "machine_not_linked" : "bridge_not_discovered (rollout off, discovery route missing/404, or API unreachable)",
+        rediscoverMs: BRIDGE_REDISCOVER_MS
+      })
+    );
+  }
+  while (!target && !opts.shouldStop()) {
+    if (!loadApiKey() || !loadUserConfig().agentOsId?.trim()) return;
+    await sleep2(BRIDGE_REDISCOVER_MS, opts.shouldStop);
+    if (opts.shouldStop()) return;
+    target = await resolveChatBridgeTarget();
+  }
+  if (!target || opts.shouldStop()) return;
   console.error(
     JSON.stringify({
       event: "chat_claim_loop_start",
       bridgeUrl: target.bridgeUrl,
       agentOsId: target.agentOsId,
       boxId: target.boxId,
-      model: target.model
+      model: target.model,
+      useClaudeOauth: target.useClaudeOauth
     })
   );
   while (!opts.shouldStop()) {
@@ -13369,10 +13689,34 @@ async function runDaemon(args) {
       })
     );
   });
+  let credentialMissingLogged = false;
   while (!stopping) {
     try {
       writeDaemonHeartbeat({ agentOsId, runId });
-      if (cronEnv.tickEnabled) {
+      const credential = await tryResolveCallbackSecretWithMint(
+        args.secret ? String(args.secret) : void 0,
+        agentOsId
+      );
+      if (!credential.ok) {
+        if (!credentialMissingLogged) {
+          credentialMissingLogged = true;
+          console.error(
+            JSON.stringify({
+              event: "daemon_runner_credential_missing",
+              agentOsId,
+              reason: credential.reason,
+              remedy: `run \`kynver runner credential --agent-os-id ${agentOsId}\` (or \`kynver bootstrap\`); ticks resume automatically once the credential exists`
+            })
+          );
+        }
+        await awaitDaemonBackoff(intervalMs, () => stopping);
+        continue;
+      }
+      if (credentialMissingLogged) {
+        credentialMissingLogged = false;
+        console.error(JSON.stringify({ event: "daemon_runner_credential_recovered", agentOsId }));
+      }
+      if (cronEnv.tickEnabled) {
         const cronTick = await runKynverCronTick({
           env: cronEnv,
           agentOsIdFilter: agentOsId
@@ -13399,21 +13743,152 @@ async function runDaemon(args) {
   console.error(JSON.stringify({ event: "daemon_stop", runId, agentOsId }));
 }
 
+// src/daemon-keeper.ts
+init_config();
+import { spawn as spawn6 } from "node:child_process";
+init_util();
+var DEFAULT_STALL_MS = 15 * 6e4;
+var STARTUP_GRACE_MS = 2 * 6e4;
+var KILL_GRACE_MS = 1e4;
+var BACKOFF_BASE_MS = 5e3;
+var BACKOFF_CAP_MS = 5 * 6e4;
+var HEALTHY_RESET_MS = 30 * 6e4;
+var POLL_MS = 5e3;
+function resolveKeeperStallMs(flag, env = process.env) {
+  const fromFlag = typeof flag === "string" ? Number.parseInt(flag, 10) : NaN;
+  if (Number.isFinite(fromFlag) && fromFlag > 0) return fromFlag;
+  const fromEnv = Number.parseInt(env.KYNVER_DAEMON_STALL_MS ?? "", 10);
+  if (Number.isFinite(fromEnv) && fromEnv > 0) return fromEnv;
+  return DEFAULT_STALL_MS;
+}
+function shouldRunDaemonKeeper(args, env = process.env) {
+  if (args.keeperChild === true || args.keeperChild === "true") return false;
+  if (args.noSupervise === true || args.noSupervise === "true") return false;
+  if (args.supervised === "false") return false;
+  const envFlag5 = (env.KYNVER_DAEMON_SUPERVISED ?? "").trim().toLowerCase();
+  if (envFlag5 === "0" || envFlag5 === "false" || envFlag5 === "no" || envFlag5 === "off") {
+    return false;
+  }
+  return true;
+}
+function nextKeeperBackoffMs(consecutiveFailures, base = BACKOFF_BASE_MS, cap = BACKOFF_CAP_MS) {
+  const exp = Math.min(Math.max(consecutiveFailures, 1) - 1, 10);
+  return Math.min(base * 2 ** exp, cap);
+}
+function keeperRunWasHealthy(startedAtMs, endedAtMs, healthyMs = HEALTHY_RESET_MS) {
+  return endedAtMs - startedAtMs >= healthyMs;
+}
+function keeperLog(event, detail = {}) {
+  console.error(JSON.stringify({ event: `daemon_keeper_${event}`, ...detail }));
+}
+function buildKeeperChildArgv(argv) {
+  const out = [];
+  for (let i = 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === "--supervised" || arg === "--no-supervise" || arg === "--keeper-child") continue;
+    if (arg === "--stall-ms") {
+      if (i + 1 < argv.length && !argv[i + 1].startsWith("--")) i += 1;
+      continue;
+    }
+    if (arg.startsWith("--stall-ms=") || arg.startsWith("--supervised=")) continue;
+    out.push(arg);
+  }
+  out.push("--keeper-child");
+  return out;
+}
+async function runDaemonKeeper(args, rawArgv = process.argv.slice(2)) {
+  const agentOsId = String(
+    required(String(args.agentOsId || loadUserConfig().agentOsId || ""), "--agent-os-id")
+  );
+  const stallMs = resolveKeeperStallMs(args.stallMs);
+  const childArgv = buildKeeperChildArgv(rawArgv);
+  const cliEntry = process.argv[1];
+  let stopping = false;
+  let child = null;
+  let consecutiveFailures = 0;
+  const stop = (signal) => {
+    stopping = true;
+    keeperLog("stop", { signal });
+    if (child?.pid) child.kill(signal);
+  };
+  process.on("SIGINT", () => stop("SIGINT"));
+  process.on("SIGTERM", () => stop("SIGTERM"));
+  keeperLog("start", { agentOsId, stallMs, childArgv });
+  while (!stopping) {
+    const startedAt = Date.now();
+    let exited = false;
+    let exitCode = null;
+    let exitSignal = null;
+    child = spawn6(process.execPath, [cliEntry, ...childArgv], {
+      stdio: "inherit",
+      env: process.env
+    });
+    keeperLog("child_spawned", { pid: child.pid ?? null });
+    child.on("exit", (code, signal) => {
+      exited = true;
+      exitCode = code;
+      exitSignal = signal;
+    });
+    while (!exited && !stopping) {
+      await sleepMsAsync(POLL_MS);
+      if (exited || stopping) break;
+      if (Date.now() - startedAt < STARTUP_GRACE_MS) continue;
+      const beat = readDaemonHeartbeat(agentOsId);
+      const ownBeat = beat && beat.pid === child.pid ? beat : null;
+      if (ownBeat && isDaemonHeartbeatStale(ownBeat, stallMs)) {
+        keeperLog("stall_detected", {
+          pid: child.pid ?? null,
+          lastBeatAt: ownBeat.observedAt,
+          stallMs
+        });
+        child.kill("SIGTERM");
+        await sleepMsAsync(KILL_GRACE_MS);
+        if (!exited) child.kill("SIGKILL");
+        break;
+      }
+      if (!ownBeat && Date.now() - startedAt > stallMs + STARTUP_GRACE_MS) {
+        keeperLog("no_heartbeat_detected", { pid: child.pid ?? null, stallMs });
+        child.kill("SIGTERM");
+        await sleepMsAsync(KILL_GRACE_MS);
+        if (!exited) child.kill("SIGKILL");
+        break;
+      }
+    }
+    while (!exited && !stopping) {
+      await sleepMsAsync(POLL_MS);
+    }
+    if (stopping) break;
+    const endedAt = Date.now();
+    if (keeperRunWasHealthy(startedAt, endedAt)) consecutiveFailures = 0;
+    consecutiveFailures += 1;
+    const backoff = nextKeeperBackoffMs(consecutiveFailures);
+    keeperLog("child_exited", {
+      code: exitCode,
+      signal: exitSignal,
+      uptimeMs: endedAt - startedAt,
+      consecutiveFailures,
+      respawnInMs: backoff
+    });
+    await sleepMsAsync(backoff);
+  }
+  keeperLog("stopped", { agentOsId });
+}
+
 // src/worktree.ts
 init_git();
 init_run_store();
-import { existsSync as existsSync39, mkdirSync as mkdirSync7 } from "node:fs";
-import path58 from "node:path";
+import { existsSync as existsSync40, mkdirSync as mkdirSync9 } from "node:fs";
+import path60 from "node:path";
 
 // src/run-list.ts
 init_run_store();
 init_run_worker_index();
-import { existsSync as existsSync38, readFileSync as readFileSync15 } from "node:fs";
-import path57 from "node:path";
+import { existsSync as existsSync39, readFileSync as readFileSync15 } from "node:fs";
+import path59 from "node:path";
 init_status();
 init_util();
 function heartbeatByteLength(heartbeatPath) {
-  if (!heartbeatPath || !existsSync38(heartbeatPath)) return 0;
+  if (!heartbeatPath || !existsSync39(heartbeatPath)) return 0;
   try {
     return readFileSync15(heartbeatPath, "utf8").trim().length;
   } catch {
@@ -13421,7 +13896,7 @@ function heartbeatByteLength(heartbeatPath) {
   }
 }
 function workerEvidence(run, workerName) {
-  const workerPath = path57.join(runDirectory(run.id), "workers", safeSlug(workerName), "worker.json");
+  const workerPath = path59.join(runDirectory(run.id), "workers", safeSlug(workerName), "worker.json");
   const worker = readJson(workerPath, void 0);
   if (!worker) {
     return {
@@ -13478,7 +13953,7 @@ function aggregateRunAttention(workers) {
 function countOpenWorkers(run) {
   let open = 0;
   for (const name of listRunWorkerNames(run)) {
-    const workerPath = path57.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+    const workerPath = path59.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
     const worker = readJson(workerPath, void 0);
     if (!worker) continue;
     const status = computeWorkerStatus(worker, { base: run.base, baseCommit: run.baseCommit });
@@ -13541,8 +14016,8 @@ function createRun(args) {
   ensureGitRepo(repo);
   const id = args.id ? validateRunId(String(args.id)) : timestampSlug(String(args.name || "run"));
   const dir = runDirectory(id);
-  if (existsSync39(dir)) failExists(`run already exists: ${id}`);
-  mkdirSync7(dir, { recursive: true });
+  if (existsSync40(dir)) failExists(`run already exists: ${id}`);
+  mkdirSync9(dir, { recursive: true });
   const base = String(args.base || "origin/main");
   const baseCommit = git(repo, ["rev-parse", base]).trim();
   const run = {
@@ -13555,7 +14030,7 @@ function createRun(args) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     workers: {}
   };
-  writeJson(path58.join(dir, "run.json"), run);
+  writeJson(path60.join(dir, "run.json"), run);
   const info = { runId: id, runDir: dir, repo, base, baseCommit };
   console.log(JSON.stringify(info, null, 2));
   return info;
@@ -13587,6 +14062,11 @@ async function runStart(args) {
     console.error("No AgentOS workspace configured \u2014 run `kynver bootstrap` (or pass --agent-os-id).");
     process.exit(1);
   }
+  if (args.chatOauth === true && config.chatUseClaudeOauth !== true) {
+    saveUserConfig({ ...config, chatUseClaudeOauth: true });
+    config = loadUserConfig();
+    console.log("  Chat: Claude Code OAuth opt-in saved (delegated turns may use your local subscription).");
+  }
   const repo = (typeof args.repo === "string" ? args.repo.trim() : "") || config.defaultRepo?.trim() || resolveDefaultRepo()?.repo || "";
   if (!repo) {
     console.error("No repo configured \u2014 pass --repo /path/to/repo or run `kynver setup --discover-repo`.");
@@ -13608,7 +14088,25 @@ async function runStart(args) {
   console.log(`    run:       ${runId}`);
   console.log("  Ctrl-C stops the agent. (Advanced control: `kynver daemon --help`.)");
   console.log("");
-  await runDaemon({ ...args, run: runId, agentOsId });
+  const daemonArgs = { ...args, run: runId, agentOsId };
+  if (shouldRunDaemonKeeper(daemonArgs)) {
+    await runDaemonKeeper(daemonArgs, buildStartDaemonArgv(runId, agentOsId, args));
+    return;
+  }
+  await runDaemon(daemonArgs);
+}
+function buildStartDaemonArgv(runId, agentOsId, args) {
+  const argv = ["daemon", "--run", runId, "--agent-os-id", agentOsId];
+  if (typeof args.intervalMs === "string" && args.intervalMs.trim()) {
+    argv.push("--interval-ms", args.intervalMs.trim());
+  }
+  if (args.execute === false || args.execute === "false") {
+    argv.push("--execute", "false");
+  }
+  if (typeof args.stallMs === "string" && args.stallMs.trim()) {
+    argv.push("--stall-ms", args.stallMs.trim());
+  }
+  return argv;
 }
 
 // src/cli.ts
@@ -13617,8 +14115,8 @@ init_run_store();
 // src/discard-disposable.ts
 init_run_store();
 init_status();
-import { existsSync as existsSync40, rmSync as rmSync4 } from "node:fs";
-import path59 from "node:path";
+import { existsSync as existsSync41, rmSync as rmSync4 } from "node:fs";
+import path61 from "node:path";
 function normalizeRelativePath2(value) {
   const normalized = value.replace(/\\/g, "/").replace(/^\.\//, "").trim();
   if (!normalized || normalized.startsWith("/") || normalized.includes("..")) {
@@ -13640,15 +14138,15 @@ function discardDisposableArtifacts(args) {
   if (paths.length === 0) {
     return { ok: false, removed: [], reason: "requires at least one --path" };
   }
-  const worktreeRoot = path59.resolve(worker.worktreePath);
+  const worktreeRoot = path61.resolve(worker.worktreePath);
   const removed = [];
   for (const raw of paths) {
     const rel = normalizeRelativePath2(raw);
-    const abs = path59.resolve(worktreeRoot, rel);
-    if (!abs.startsWith(worktreeRoot + path59.sep) && abs !== worktreeRoot) {
+    const abs = path61.resolve(worktreeRoot, rel);
+    if (!abs.startsWith(worktreeRoot + path61.sep) && abs !== worktreeRoot) {
       return { ok: false, removed, reason: `path escapes worktree: ${raw}` };
     }
-    if (!existsSync40(abs)) {
+    if (!existsSync41(abs)) {
       return { ok: false, removed, reason: `path not found: ${raw}` };
     }
     rmSync4(abs, { recursive: true, force: true });
@@ -13670,140 +14168,9 @@ function discardDisposableCli(args) {
   if (!result.ok) process.exit(1);
 }
 
-// src/daemon-keeper.ts
-init_config();
-import { spawn as spawn6 } from "node:child_process";
-init_util();
-var DEFAULT_STALL_MS = 15 * 6e4;
-var STARTUP_GRACE_MS = 2 * 6e4;
-var KILL_GRACE_MS = 1e4;
-var BACKOFF_BASE_MS = 5e3;
-var BACKOFF_CAP_MS = 5 * 6e4;
-var HEALTHY_RESET_MS = 30 * 6e4;
-var POLL_MS = 5e3;
-function resolveKeeperStallMs(flag, env = process.env) {
-  const fromFlag = typeof flag === "string" ? Number.parseInt(flag, 10) : NaN;
-  if (Number.isFinite(fromFlag) && fromFlag > 0) return fromFlag;
-  const fromEnv = Number.parseInt(env.KYNVER_DAEMON_STALL_MS ?? "", 10);
-  if (Number.isFinite(fromEnv) && fromEnv > 0) return fromEnv;
-  return DEFAULT_STALL_MS;
-}
-function shouldRunDaemonKeeper(args, env = process.env) {
-  if (args.keeperChild === true || args.keeperChild === "true") return false;
-  if (args.noSupervise === true || args.noSupervise === "true") return false;
-  if (args.supervised === "false") return false;
-  const envFlag5 = (env.KYNVER_DAEMON_SUPERVISED ?? "").trim().toLowerCase();
-  if (envFlag5 === "0" || envFlag5 === "false" || envFlag5 === "no" || envFlag5 === "off") {
-    return false;
-  }
-  return true;
-}
-function nextKeeperBackoffMs(consecutiveFailures, base = BACKOFF_BASE_MS, cap = BACKOFF_CAP_MS) {
-  const exp = Math.min(Math.max(consecutiveFailures, 1) - 1, 10);
-  return Math.min(base * 2 ** exp, cap);
-}
-function keeperRunWasHealthy(startedAtMs, endedAtMs, healthyMs = HEALTHY_RESET_MS) {
-  return endedAtMs - startedAtMs >= healthyMs;
-}
-function keeperLog(event, detail = {}) {
-  console.error(JSON.stringify({ event: `daemon_keeper_${event}`, ...detail }));
-}
-function buildKeeperChildArgv(argv) {
-  const out = [];
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (arg === "--supervised" || arg === "--no-supervise" || arg === "--keeper-child") continue;
-    if (arg === "--stall-ms") {
-      if (i + 1 < argv.length && !argv[i + 1].startsWith("--")) i += 1;
-      continue;
-    }
-    if (arg.startsWith("--stall-ms=") || arg.startsWith("--supervised=")) continue;
-    out.push(arg);
-  }
-  out.push("--keeper-child");
-  return out;
-}
-async function runDaemonKeeper(args, rawArgv = process.argv.slice(2)) {
-  const agentOsId = String(
-    required(String(args.agentOsId || loadUserConfig().agentOsId || ""), "--agent-os-id")
-  );
-  const stallMs = resolveKeeperStallMs(args.stallMs);
-  const childArgv = buildKeeperChildArgv(rawArgv);
-  const cliEntry = process.argv[1];
-  let stopping = false;
-  let child = null;
-  let consecutiveFailures = 0;
-  const stop = (signal) => {
-    stopping = true;
-    keeperLog("stop", { signal });
-    if (child?.pid) child.kill(signal);
-  };
-  process.on("SIGINT", () => stop("SIGINT"));
-  process.on("SIGTERM", () => stop("SIGTERM"));
-  keeperLog("start", { agentOsId, stallMs, childArgv });
-  while (!stopping) {
-    const startedAt = Date.now();
-    let exited = false;
-    let exitCode = null;
-    let exitSignal = null;
-    child = spawn6(process.execPath, [cliEntry, ...childArgv], {
-      stdio: "inherit",
-      env: process.env
-    });
-    keeperLog("child_spawned", { pid: child.pid ?? null });
-    child.on("exit", (code, signal) => {
-      exited = true;
-      exitCode = code;
-      exitSignal = signal;
-    });
-    while (!exited && !stopping) {
-      await sleepMsAsync(POLL_MS);
-      if (exited || stopping) break;
-      if (Date.now() - startedAt < STARTUP_GRACE_MS) continue;
-      const beat = readDaemonHeartbeat(agentOsId);
-      const ownBeat = beat && beat.pid === child.pid ? beat : null;
-      if (ownBeat && isDaemonHeartbeatStale(ownBeat, stallMs)) {
-        keeperLog("stall_detected", {
-          pid: child.pid ?? null,
-          lastBeatAt: ownBeat.observedAt,
-          stallMs
-        });
-        child.kill("SIGTERM");
-        await sleepMsAsync(KILL_GRACE_MS);
-        if (!exited) child.kill("SIGKILL");
-        break;
-      }
-      if (!ownBeat && Date.now() - startedAt > stallMs + STARTUP_GRACE_MS) {
-        keeperLog("no_heartbeat_detected", { pid: child.pid ?? null, stallMs });
-        child.kill("SIGTERM");
-        await sleepMsAsync(KILL_GRACE_MS);
-        if (!exited) child.kill("SIGKILL");
-        break;
-      }
-    }
-    while (!exited && !stopping) {
-      await sleepMsAsync(POLL_MS);
-    }
-    if (stopping) break;
-    const endedAt = Date.now();
-    if (keeperRunWasHealthy(startedAt, endedAt)) consecutiveFailures = 0;
-    consecutiveFailures += 1;
-    const backoff = nextKeeperBackoffMs(consecutiveFailures);
-    keeperLog("child_exited", {
-      code: exitCode,
-      signal: exitSignal,
-      uptimeMs: endedAt - startedAt,
-      consecutiveFailures,
-      respawnInMs: backoff
-    });
-    await sleepMsAsync(backoff);
-  }
-  keeperLog("stopped", { agentOsId });
-}
-
 // src/plan-progress.ts
 init_config();
-import path63 from "node:path";
+import path65 from "node:path";
 
 // src/bounded-build/constants.ts
 var DEFAULT_BUILD_MEM_BUDGET_BYTES = 1536 * 1024 * 1024;
@@ -13844,7 +14211,7 @@ function formatNodeOptionsFlag(mb = resolveNodeOldSpaceSizeMb()) {
 }
 
 // src/bounded-build/systemd-wrap.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 var systemdAvailableCache;
 function isSystemdRunAvailable() {
   if (process.env.KYNVER_BUILD_SKIP_SYSTEMD === "1" || process.env.KYNVER_BUILD_SKIP_SYSTEMD === "true") {
@@ -13855,7 +14222,7 @@ function isSystemdRunAvailable() {
     systemdAvailableCache = false;
     return false;
   }
-  const res = spawnSync8("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
+  const res = spawnSync9("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
   systemdAvailableCache = res.status === 0;
   return systemdAvailableCache;
 }
@@ -13880,7 +14247,7 @@ function buildSystemdRunArgv(opts) {
 
 // src/bounded-build/admission.ts
 init_config();
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 init_meminfo();
 function positiveInt4(value, fallback) {
   const n = Number(value);
@@ -13917,7 +14284,7 @@ function assessBuildAdmission(opts = {}) {
 }
 function sleepMs2(ms) {
   if (ms <= 0) return;
-  spawnSync9(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync10(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -13938,34 +14305,34 @@ function waitForBuildAdmission(timeoutMs, pollMs = 2e3, opts = {}) {
 }
 
 // src/bounded-build/exec.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 
 // src/heavy-verification/slot.ts
 init_util();
 import {
   closeSync as closeSync7,
-  existsSync as existsSync41,
-  mkdirSync as mkdirSync9,
+  existsSync as existsSync42,
+  mkdirSync as mkdirSync11,
   openSync as openSync7,
-  readdirSync as readdirSync15,
+  readdirSync as readdirSync14,
   readFileSync as readFileSync16,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "node:fs";
-import path61 from "node:path";
+import path63 from "node:path";
 
 // src/heavy-verification/paths.ts
-import { mkdirSync as mkdirSync8 } from "node:fs";
-import path60 from "node:path";
+import { mkdirSync as mkdirSync10 } from "node:fs";
+import path62 from "node:path";
 function resolveHeavyVerificationRoot() {
-  return path60.join(resolveKynverStateRoot(), "heavy-verification");
+  return path62.join(resolveKynverStateRoot(), "heavy-verification");
 }
 function heavyVerificationSlotsDir() {
-  return path60.join(resolveHeavyVerificationRoot(), "slots");
+  return path62.join(resolveHeavyVerificationRoot(), "slots");
 }
 function ensureHeavyVerificationDirs() {
   const dir = heavyVerificationSlotsDir();
-  mkdirSync8(dir, { recursive: true });
+  mkdirSync10(dir, { recursive: true });
   return dir;
 }
 
@@ -13990,10 +14357,10 @@ function indexedSlotId(index) {
   return `slot-${index}`;
 }
 function slotFilePath(slotId, slotsDir = heavyVerificationSlotsDir()) {
-  return path61.join(slotsDir, `${slotId}.json`);
+  return path63.join(slotsDir, `${slotId}.json`);
 }
 function readSlotRecord(filePath) {
-  if (!existsSync41(filePath)) return null;
+  if (!existsSync42(filePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync16(filePath, "utf8"));
     if (typeof parsed.slotId === "string" && typeof parsed.pid === "number" && typeof parsed.acquiredAt === "string" && typeof parsed.command === "string") {
@@ -14020,19 +14387,19 @@ function reclaimStaleSlot(filePath, staleMs) {
   }
 }
 function ensureSlotsDir(slotsDir) {
-  mkdirSync9(slotsDir, { recursive: true });
+  mkdirSync11(slotsDir, { recursive: true });
   return slotsDir;
 }
 function reclaimStaleHeavyVerificationSlots(opts = {}) {
   const slotsDir = ensureSlotsDir(opts.slotsDir ?? ensureHeavyVerificationDirs());
   const staleMs = opts.staleMs ?? DEFAULT_HEAVY_VERIFICATION_STALE_MS;
   let reclaimed = 0;
-  for (const name of readdirSync15(slotsDir)) {
+  for (const name of readdirSync14(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const filePath = path61.join(slotsDir, name);
-    const before = existsSync41(filePath);
+    const filePath = path63.join(slotsDir, name);
+    const before = existsSync42(filePath);
     reclaimStaleSlot(filePath, staleMs);
-    if (before && !existsSync41(filePath)) reclaimed += 1;
+    if (before && !existsSync42(filePath)) reclaimed += 1;
   }
   return reclaimed;
 }
@@ -14041,9 +14408,9 @@ function listActiveHeavyVerificationSlots(opts = {}) {
   const staleMs = opts.staleMs ?? DEFAULT_HEAVY_VERIFICATION_STALE_MS;
   reclaimStaleHeavyVerificationSlots({ slotsDir, staleMs });
   const active = [];
-  for (const name of readdirSync15(slotsDir)) {
+  for (const name of readdirSync14(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const record = readSlotRecord(path61.join(slotsDir, name));
+    const record = readSlotRecord(path63.join(slotsDir, name));
     if (record && !slotIsStale(record, staleMs)) active.push(record);
   }
   return active;
@@ -14085,7 +14452,7 @@ function tryAcquireHeavyVerificationSlot(command, opts = {}) {
     };
     try {
       const fd = openSync7(filePath, "wx");
-      writeFileSync6(fd, JSON.stringify(record, null, 2), "utf8");
+      writeFileSync7(fd, JSON.stringify(record, null, 2), "utf8");
       closeSync7(fd);
       const activeSlots2 = countActiveHeavyVerificationSlots({ slotsDir, staleMs });
       return {
@@ -14145,10 +14512,10 @@ function assessHeavyVerificationGate(command, opts = {}) {
 }
 
 // src/heavy-verification/gate.ts
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 function sleepMs3(ms) {
   if (ms <= 0) return;
-  spawnSync10(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync11(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -14164,11 +14531,11 @@ function waitForHeavyVerificationSlot(command, timeoutMs, pollMs = 2e3, opts = {
 
 // src/harness-worktree-build-guard.ts
 init_paths();
-import path62 from "node:path";
+import path64 from "node:path";
 function isPathUnderHarnessWorktree(cwd) {
   const worktreesDir = harnessWorktreesDir(resolveHarnessRoot());
-  const rel = path62.relative(worktreesDir, path62.resolve(cwd));
-  return rel.length > 0 && !rel.startsWith("..") && !path62.isAbsolute(rel);
+  const rel = path64.relative(worktreesDir, path64.resolve(cwd));
+  return rel.length > 0 && !rel.startsWith("..") && !path64.isAbsolute(rel);
 }
 function assessHarnessWorktreeBuildGuard(cwd) {
   if (!isPathUnderHarnessWorktree(cwd)) return { ok: true };
@@ -14192,7 +14559,7 @@ function envArgv(env) {
   return out;
 }
 function runSpawn(argv, opts) {
-  const res = spawnSync11(argv[0], argv.slice(1), {
+  const res = spawnSync12(argv[0], argv.slice(1), {
     cwd: opts.cwd,
     env: opts.env,
     encoding: "utf8",
@@ -14381,7 +14748,7 @@ async function emitPlanProgress(args) {
 }
 function verifyPlanLocal(args) {
   const worktree = required(args.worktree ? String(args.worktree) : void 0, "worktree");
-  const cwd = path63.resolve(worktree);
+  const cwd = path65.resolve(worktree);
   const summary = runHarnessVerifyCommands(cwd);
   const emitJson = args.json === true || args.json === "true";
   const payload = { passed: summary.passed, worktree: cwd, steps: summary.steps };
@@ -14430,10 +14797,10 @@ async function verifyPlan(args) {
 }
 
 // src/harness-verify-cli.ts
-import path64 from "node:path";
+import path66 from "node:path";
 init_util();
 function runHarnessVerifyCli(args) {
-  const cwd = path64.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
+  const cwd = path66.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
   const emitJson = args.json === true || args.json === "true" || args.emitJson === true || args.emitJson === "true";
   const commands = [];
   const rawCmd = args.command;
@@ -14565,7 +14932,9 @@ function runCleanupCli(args) {
   const skipFinalize = args.skipFinalize === true || args.skipFinalize === "true";
   const accountBytes = args.accountBytes === true || args.accountBytes === "true";
   const compact = args.compact === true || args.compact === "true";
-  const nodeModulesAgeMs = args.nodeModulesAgeMs ? Number(args.nodeModulesAgeMs) : DEFAULT_NODE_MODULES_AGE_MS;
+  const nodeModulesAgeMsRaw = args.nodeModulesAgeMs;
+  const scanDependencyCaches = nodeModulesAgeMsRaw != null && nodeModulesAgeMsRaw !== "";
+  const nodeModulesAgeMs = scanDependencyCaches ? Number(nodeModulesAgeMsRaw) : void 0;
   const worktreesAgeMs = args.worktreesAgeMs ? Number(args.worktreesAgeMs) : 0;
   const includeOrphans = args.includeOrphans === true || args.includeOrphans === "true";
   const harnessRoot = args.harnessRoot ? String(args.harnessRoot) : void 0;
@@ -14573,7 +14942,8 @@ function runCleanupCli(args) {
     execute,
     finalizeStaleRuns: !skipFinalize,
     accountBytes,
-    nodeModulesAgeMs: Number.isFinite(nodeModulesAgeMs) ? nodeModulesAgeMs : DEFAULT_NODE_MODULES_AGE_MS,
+    scanDependencyCaches,
+    nodeModulesAgeMs: nodeModulesAgeMs !== void 0 && Number.isFinite(nodeModulesAgeMs) ? nodeModulesAgeMs : scanDependencyCaches ? DEFAULT_NODE_MODULES_AGE_MS : void 0,
     worktreesAgeMs: Number.isFinite(worktreesAgeMs) ? worktreesAgeMs : 0,
     includeOrphans,
     harnessRoot
@@ -14643,7 +15013,7 @@ function formatMonitorTickNotice(tick) {
 }
 
 // src/monitor/monitor.service.ts
-import path66 from "node:path";
+import path68 from "node:path";
 init_run_store();
 init_status();
 init_util();
@@ -14702,19 +15072,19 @@ function classifyWorkerHealth(input) {
 // src/monitor/monitor.store.ts
 init_paths();
 init_util();
-import { existsSync as existsSync42, mkdirSync as mkdirSync10, readdirSync as readdirSync16, unlinkSync as unlinkSync5 } from "node:fs";
-import path65 from "node:path";
+import { existsSync as existsSync43, mkdirSync as mkdirSync12, readdirSync as readdirSync15, unlinkSync as unlinkSync5 } from "node:fs";
+import path67 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path65.join(harnessRoot, "monitors");
-  mkdirSync10(dir, { recursive: true });
+  const dir = path67.join(harnessRoot, "monitors");
+  mkdirSync12(dir, { recursive: true });
   return dir;
 }
 function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path65.join(monitorsDir(), `${monitorId}.json`);
+  return path67.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -14724,18 +15094,18 @@ function saveMonitorSession(session) {
 }
 function deleteMonitorSession(monitorId) {
   const file = monitorPath(monitorId);
-  if (!existsSync42(file)) return false;
+  if (!existsSync43(file)) return false;
   unlinkSync5(file);
   return true;
 }
 function listMonitorSessions() {
   const dir = monitorsDir();
-  if (!existsSync42(dir)) return [];
+  if (!existsSync43(dir)) return [];
   const entries = [];
-  for (const name of readdirSync16(dir)) {
+  for (const name of readdirSync15(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path65.join(dir, name),
+      path67.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -14828,7 +15198,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path66.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path68.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -15037,18 +15407,18 @@ async function runMonitorLoop(args) {
 init_util();
 init_paths();
 import { spawn as spawn7 } from "node:child_process";
-import { closeSync as closeSync8, existsSync as existsSync43, openSync as openSync8 } from "node:fs";
-import path67 from "node:path";
+import { closeSync as closeSync8, existsSync as existsSync44, openSync as openSync8 } from "node:fs";
+import path69 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path67.join(fileURLToPath3(new URL(".", import.meta.url)), "cli.js");
+  return path69.join(fileURLToPath3(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
-  if (!existsSync43(cliPath)) return void 0;
+  if (!existsSync44(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path67.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path69.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
     logFd = openSync8(logPath, "a");
@@ -15169,13 +15539,13 @@ async function monitorTickCli(args) {
 }
 
 // src/package-version.ts
-import { existsSync as existsSync44, readFileSync as readFileSync18 } from "node:fs";
+import { existsSync as existsSync45, readFileSync as readFileSync18 } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function resolvePackageRoot(moduleUrl) {
   let dir = dirname(fileURLToPath4(moduleUrl));
   for (let depth = 0; depth < 6; depth += 1) {
-    if (existsSync44(join(dir, "package.json"))) return dir;
+    if (existsSync45(join(dir, "package.json"))) return dir;
     const parent = dirname(dir);
     if (parent === dir) break;
     dir = parent;
@@ -15281,7 +15651,7 @@ init_run_store();
 init_status();
 init_util();
 init_config();
-import path68 from "node:path";
+import path70 from "node:path";
 function skip(runId, worker, taskId, agentOsId, leaseOwner, reason) {
   return { runId, worker, taskId, agentOsId, leaseOwner, action: "skipped", reason };
 }
@@ -15294,7 +15664,7 @@ async function postRestartUnblock(args) {
   const errors = [];
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers ?? {})) {
-      const workerPath = path68.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path70.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker) {
         skipped.push(skip(run.id, name, "", "", "", "worker.json missing"));
@@ -15408,9 +15778,9 @@ async function postRestartUnblockCli(args) {
 // src/default-repo-cli.ts
 init_path_values();
 init_config();
-import path69 from "node:path";
+import path71 from "node:path";
 import { homedir as homedir16 } from "node:os";
-var CONFIG_FILE2 = path69.join(homedir16(), ".kynver", "config.json");
+var CONFIG_FILE2 = path71.join(homedir16(), ".kynver", "config.json");
 function ensureDefaultRepo(opts) {
   const existing = loadUserConfig();
   const resolved = resolveDefaultRepo({ ...opts, config: existing });
@@ -15491,19 +15861,19 @@ function summarizeResolvedDefaultRepo(resolved) {
 }
 
 // src/doctor/runtime-takeover.ts
-import path71 from "node:path";
+import path73 from "node:path";
 init_path_values();
 
 // src/doctor/runtime-takeover.probes.ts
 init_config();
-import { accessSync, constants, existsSync as existsSync45, readFileSync as readFileSync19 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync46, readFileSync as readFileSync19 } from "node:fs";
 import { homedir as homedir17 } from "node:os";
-import path70 from "node:path";
-import { spawnSync as spawnSync12 } from "node:child_process";
+import path72 from "node:path";
+import { spawnSync as spawnSync13 } from "node:child_process";
 init_paths();
 function captureCommand(bin, args) {
   try {
-    const res = spawnSync12(bin, args, { encoding: "utf8" });
+    const res = spawnSync13(bin, args, { encoding: "utf8" });
     const stdout = (res.stdout || "").trim();
     const stderr = (res.stderr || "").trim();
     const ok = res.status === 0;
@@ -15528,7 +15898,7 @@ function tokenPrefix(token) {
   return trimmed.length <= 12 ? `${trimmed}\u2026` : `${trimmed.slice(0, 12)}\u2026`;
 }
 function isWritable(target) {
-  if (!existsSync45(target)) return false;
+  if (!existsSync46(target)) return false;
   try {
     accessSync(target, constants.W_OK);
     return true;
@@ -15541,11 +15911,11 @@ var defaultRuntimeTakeoverProbes = {
   commandOnPath: (bin) => captureCommand(process.platform === "win32" ? "where" : "which", [bin]),
   kynverVersion: (bin) => captureCommand(bin, ["--version"]),
   loadConfig: () => loadUserConfig(),
-  configFilePath: () => path70.join(homedir17(), ".kynver", "config.json"),
-  credentialsFilePath: () => path70.join(homedir17(), ".kynver", "credentials"),
+  configFilePath: () => path72.join(homedir17(), ".kynver", "config.json"),
+  credentialsFilePath: () => path72.join(homedir17(), ".kynver", "credentials"),
   readCredentials: () => {
-    const credPath = path70.join(homedir17(), ".kynver", "credentials");
-    if (!existsSync45(credPath)) {
+    const credPath = path72.join(homedir17(), ".kynver", "credentials");
+    if (!existsSync46(credPath)) {
       return { hasApiKey: false };
     }
     try {
@@ -15579,8 +15949,8 @@ var defaultRuntimeTakeoverProbes = {
     })()
   }),
   harnessRoot: () => resolveHarnessRoot(),
-  legacyOpenclawHarnessRoot: () => path70.join(homedir17(), ".openclaw", "harness"),
-  pathExists: (target) => existsSync45(target),
+  legacyOpenclawHarnessRoot: () => path72.join(homedir17(), ".openclaw", "harness"),
+  pathExists: (target) => existsSync46(target),
   pathWritable: (target) => isWritable(target)
 };
 
@@ -15986,8 +16356,8 @@ function assessVercelDeployEvidence(probes) {
 }
 function assessHarnessDirs(probes) {
   const harnessRoot = probes.harnessRoot();
-  const runsDir = path71.join(harnessRoot, "runs");
-  const worktreesDir = path71.join(harnessRoot, "worktrees");
+  const runsDir = path73.join(harnessRoot, "runs");
+  const worktreesDir = path73.join(harnessRoot, "worktrees");
   const displayHarnessRoot = redactHomePath(harnessRoot);
   const displayRunsDir = redactHomePath(runsDir);
   const displayWorktreesDir = redactHomePath(worktreesDir);
@@ -16256,9 +16626,9 @@ function applySchedulerCutoverAttestation(config) {
 
 // src/scheduler-cutover-cli.ts
 init_config();
-import path72 from "node:path";
+import path74 from "node:path";
 import { homedir as homedir18 } from "node:os";
-var CONFIG_FILE3 = path72.join(homedir18(), ".kynver", "config.json");
+var CONFIG_FILE3 = path74.join(homedir18(), ".kynver", "config.json");
 function runSchedulerCutoverCheckCli(json = false) {
   const config = loadUserConfig();
   const report = assessSchedulerCutover(config);
@@ -16402,7 +16772,7 @@ init_config();
 init_config();
 init_path_values();
 init_util();
-import { existsSync as existsSync49 } from "node:fs";
+import { existsSync as existsSync50 } from "node:fs";
 
 // src/cron/cron-id.ts
 import { createHash as createHash4 } from "node:crypto";
@@ -16421,13 +16791,13 @@ function deterministicCronProviderId(spec) {
 
 // src/cron/cron-install-plan.ts
 import { homedir as homedir20 } from "node:os";
-import path74 from "node:path";
+import path76 from "node:path";
 
 // src/cron/cron-env-file.ts
-import { existsSync as existsSync46, mkdirSync as mkdirSync11, readFileSync as readFileSync20, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync47, mkdirSync as mkdirSync13, readFileSync as readFileSync20, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir19 } from "node:os";
-import path73 from "node:path";
-var DEFAULT_KYNVER_ENV_FILE = path73.join(homedir19(), ".kynver", ".env");
+import path75 from "node:path";
+var DEFAULT_KYNVER_ENV_FILE = path75.join(homedir19(), ".kynver", ".env");
 function parseEnvFile(content) {
   const map = /* @__PURE__ */ new Map();
   for (const line of content.split(/\r?\n/)) {
@@ -16454,12 +16824,12 @@ function serializeEnvFile(values, header = "# Managed by kynver cron install \u2
   return lines.join("\n");
 }
 function readEnvFile(filePath = DEFAULT_KYNVER_ENV_FILE) {
-  if (!existsSync46(filePath)) return /* @__PURE__ */ new Map();
+  if (!existsSync47(filePath)) return /* @__PURE__ */ new Map();
   return parseEnvFile(readFileSync20(filePath, "utf8"));
 }
 function mergeEnvFile(updates, options = {}) {
   const filePath = options.filePath ?? DEFAULT_KYNVER_ENV_FILE;
-  const existing = existsSync46(filePath) ? readFileSync20(filePath, "utf8") : "";
+  const existing = existsSync47(filePath) ? readFileSync20(filePath, "utf8") : "";
   const map = parseEnvFile(existing);
   const keysWritten = [];
   const keysRemoved = [];
@@ -16484,8 +16854,8 @@ function mergeEnvFile(updates, options = {}) {
   }
   const nextContent = serializeEnvFile(map);
   if (changed) {
-    mkdirSync11(path73.dirname(filePath), { recursive: true });
-    writeFileSync7(filePath, nextContent, { mode: 384 });
+    mkdirSync13(path75.dirname(filePath), { recursive: true });
+    writeFileSync8(filePath, nextContent, { mode: 384 });
   }
   return { path: filePath, changed, keysWritten, keysRemoved };
 }
@@ -16502,7 +16872,7 @@ var VERCEL_KYNVER_CRON_CUTOVER_STEPS = [
 function buildCronInstallPlan(input) {
   const storePath = input.storePath?.trim() || defaultKynverCronStorePath();
   const envFilePath = input.envFilePath?.trim() || DEFAULT_KYNVER_ENV_FILE;
-  const configPath = path74.join(homedir20(), ".kynver", "config.json");
+  const configPath = path76.join(homedir20(), ".kynver", "config.json");
   const callbackPath = `/api/agent-os/by-id/${input.agentOsId}/scheduler/fire`;
   const prerequisites = [];
   if (!input.apiBaseUrl?.trim()) prerequisites.push("apiBaseUrl \u2014 run `kynver setup --api-base-url \u2026`");
@@ -16654,13 +17024,13 @@ function resolveCronSecretForInstall(envFilePath = DEFAULT_KYNVER_ENV_FILE) {
 }
 
 // src/cron/cron-install-systemd.ts
-import { existsSync as existsSync47, mkdirSync as mkdirSync12, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync48, mkdirSync as mkdirSync14, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir21 } from "node:os";
-import path75 from "node:path";
-import { spawnSync as spawnSync13 } from "node:child_process";
+import path77 from "node:path";
+import { spawnSync as spawnSync14 } from "node:child_process";
 var KYNVER_CRON_DAEMON_UNIT = "kynver-cron-daemon.service";
 function defaultSystemdUserUnitDir() {
-  return path75.join(homedir21(), ".config", "systemd", "user");
+  return path77.join(homedir21(), ".config", "systemd", "user");
 }
 function renderKynverCronDaemonService(input) {
   const kynverBin = input.kynverBin?.trim() || "kynver";
@@ -16693,7 +17063,7 @@ function installSystemdUserDaemon(input, execute) {
     };
   }
   const unitDir = defaultSystemdUserUnitDir();
-  const unitPath = path75.join(unitDir, KYNVER_CRON_DAEMON_UNIT);
+  const unitPath = path77.join(unitDir, KYNVER_CRON_DAEMON_UNIT);
   const content = renderKynverCronDaemonService(input);
   if (!execute) {
     return {
@@ -16705,10 +17075,10 @@ function installSystemdUserDaemon(input, execute) {
       note: "Dry-run \u2014 pass --execute to write and enable the user unit."
     };
   }
-  mkdirSync12(unitDir, { recursive: true });
-  const existed = existsSync47(unitPath);
-  writeFileSync8(unitPath, content, "utf8");
-  const reload = spawnSync13("systemctl", ["--user", "daemon-reload"], { encoding: "utf8" });
+  mkdirSync14(unitDir, { recursive: true });
+  const existed = existsSync48(unitPath);
+  writeFileSync9(unitPath, content, "utf8");
+  const reload = spawnSync14("systemctl", ["--user", "daemon-reload"], { encoding: "utf8" });
   if (reload.status !== 0) {
     return {
       supported: true,
@@ -16719,7 +17089,7 @@ function installSystemdUserDaemon(input, execute) {
       note: `Wrote ${unitPath} but systemctl --user daemon-reload failed: ${reload.stderr || reload.stdout}`
     };
   }
-  const enable = spawnSync13("systemctl", ["--user", "enable", "--now", KYNVER_CRON_DAEMON_UNIT], {
+  const enable = spawnSync14("systemctl", ["--user", "enable", "--now", KYNVER_CRON_DAEMON_UNIT], {
     encoding: "utf8"
   });
   return {
@@ -16733,7 +17103,7 @@ function installSystemdUserDaemon(input, execute) {
 }
 
 // src/cron/cron-install-verify.ts
-import { existsSync as existsSync48 } from "node:fs";
+import { existsSync as existsSync49 } from "node:fs";
 async function verifyCronInstall(input) {
   const envFilePath = input.envFilePath ?? DEFAULT_KYNVER_ENV_FILE;
   const checks = [];
@@ -16766,14 +17136,14 @@ async function verifyCronInstall(input) {
   });
   checks.push({
     id: "env_file",
-    ok: existsSync48(envFilePath) && Boolean(fileEnv.get("KYNVER_CRON_SECRET")),
-    summary: existsSync48(envFilePath) ? `~/.kynver/.env present (${fileEnv.size} keys)` : "~/.kynver/.env missing",
+    ok: existsSync49(envFilePath) && Boolean(fileEnv.get("KYNVER_CRON_SECRET")),
+    summary: existsSync49(envFilePath) ? `~/.kynver/.env present (${fileEnv.size} keys)` : "~/.kynver/.env missing",
     remediation: "Run `kynver cron install` to write ~/.kynver/.env."
   });
   checks.push({
     id: "cron_store",
-    ok: existsSync48(env.storePath),
-    summary: existsSync48(env.storePath) ? `cron store present (${env.storePath})` : `cron store missing (${env.storePath})`,
+    ok: existsSync49(env.storePath),
+    summary: existsSync49(env.storePath) ? `cron store present (${env.storePath})` : `cron store missing (${env.storePath})`,
     remediation: "Run `kynver cron install` to initialize the local store."
   });
   const jobs = await loadCronJobs(env.storePath).catch(() => []);
@@ -16807,7 +17177,7 @@ function resolveDaemonRunId(config, explicit) {
   if (explicit?.trim()) return explicit.trim();
   if (config.defaultDaemonRunId?.trim()) return config.defaultDaemonRunId.trim();
   const runsDir = getPaths().runsDir;
-  if (!existsSync49(runsDir)) return null;
+  if (!existsSync50(runsDir)) return null;
   const runs = listRunRecords().sort(
     (a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt)
   );
@@ -16859,7 +17229,7 @@ async function runCronInstall(opts = {}) {
     process.env.KYNVER_CRON_STORE_PATH = plan.storePath;
     process.env.KYNVER_CRON_TICK_ENABLED = "1";
     const storeInit = await ensureCronStoreInitialized(plan.storePath);
-    result.storeInitialized = storeInit.created || existsSync49(plan.storePath);
+    result.storeInitialized = storeInit.created || existsSync50(plan.storePath);
     const apiKey = loadApiKey();
     if (apiKey) {
       try {
@@ -17078,10 +17448,10 @@ var LANDING_MAINTAINER_LANE_SPEC = {
 };
 
 // src/lane/landing-maintainer-local.ts
-import { spawnSync as spawnSync14 } from "node:child_process";
-import path76 from "node:path";
+import { spawnSync as spawnSync15 } from "node:child_process";
+import path78 from "node:path";
 function runLandingWrapper(prNumber, repoRoot, execute) {
-  const script = path76.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
+  const script = path78.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
   const args = [script, String(prNumber), ...LANDING_MAINTAINER_LANE_SPEC.landScriptArgs];
   if (!execute) {
     return {
@@ -17092,7 +17462,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
       stderr: ""
     };
   }
-  const result = spawnSync14("node", args, {
+  const result = spawnSync15("node", args, {
     cwd: repoRoot,
     encoding: "utf8",
     timeout: 10 * 60 * 1e3
@@ -17107,7 +17477,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
 }
 function resolveLandingMaintainerRepoRoot(args) {
   const explicit = args.repoPath ? String(args.repoPath).trim() : "";
-  if (explicit) return path76.resolve(explicit);
+  if (explicit) return path78.resolve(explicit);
   const resolved = resolveDefaultRepo();
   return resolved?.repo ?? process.cwd();
 }
@@ -17232,9 +17602,9 @@ function usage(code = 0) {
       "Usage:",
       "  kynver login [--api-key KEY] [--api-base-url URL]   (omit --api-key to authorize in the browser)",
       "  kynver bootstrap [--api-base-url URL] [--api-key KEY] [--repo PATH]   (login + setup + runner credential in one shot)",
-      "  kynver start [--repo PATH] [--api-base-url URL] [--run RUN_ID] [--interval-ms MS]   (bring your agent online: bootstrap if needed + run + daemon)",
+      "  kynver start [--repo PATH] [--api-base-url URL] [--run RUN_ID] [--interval-ms MS] [--chat-oauth]   (bring your agent online: bootstrap if needed + run + daemon; --chat-oauth lets delegated chat turns use your local Claude subscription)",
       "  kynver runner credential [--agent-os-id ID] [--base-url URL]",
-      "  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind forge|ghost] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor]",
+      "  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind forge|ghost] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor] [--chat-oauth]",
       "  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS] [--stall-ms MS] [--no-supervise]",
       "  kynver status --run RUN_ID [--blocked] [--running] [--task TASK_ID] [--worker WORKER] [--full]  # top-level compact run status",
       "  kynver run create [--repo /path/repo] [--name name] [--base origin/main]",
@@ -17298,8 +17668,8 @@ async function main(argv = process.argv.slice(2)) {
   if (action && isHelpFlag(action) || rest.some(isHelpFlag)) return usage(0);
   const args = parseArgs(rest);
   const { runsDir, worktreesDir } = getPaths();
-  mkdirSync13(runsDir, { recursive: true });
-  mkdirSync13(worktreesDir, { recursive: true });
+  mkdirSync15(runsDir, { recursive: true });
+  mkdirSync15(worktreesDir, { recursive: true });
   if (scope === "daemon") {
     assertNativeDaemonAllowed();
   }