@kynver-app/runtime 0.1.120 → 0.1.123

package/dist/index.js

@@ -532,23 +532,23 @@ function isWslHost() {
 function observeWslHostDisk(options = {}) {
   const wsl = options.forceWsl === void 0 ? isWslHost() : options.forceWsl;
   if (!wsl) return null;
-  const path79 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
+  const path81 = options.wslHostMount?.trim() || process.env.KYNVER_WSL_HOST_MOUNT?.trim() || DEFAULT_WSL_HOST_MOUNT;
   const warnBelowBytes = options.wslHostFreeWarnBytes ?? DEFAULT_WSL_HOST_WARN_FREE_BYTES;
   const criticalBelowBytes = options.wslHostFreeCriticalBytes ?? DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES;
   const statfs = options.statfs ?? statfsSync;
   let stats;
   try {
-    stats = statfs(path79);
+    stats = statfs(path81);
   } catch (error) {
     return {
       ok: false,
-      path: path79,
+      path: path81,
       freeBytes: 0,
       totalBytes: 0,
       usedPercent: 100,
       warnBelowBytes,
       criticalBelowBytes,
-      reason: `Windows host disk probe failed at ${path79}: ${error.message}`,
+      reason: `Windows host disk probe failed at ${path81}: ${error.message}`,
       probeError: error.message
     };
   }
@@ -562,11 +562,11 @@ function observeWslHostDisk(options = {}) {
   let reason = null;
   if (!ok) {
     const tag = criticalFree ? "critical" : "warning";
-    reason = `Windows host disk ${path79} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
+    reason = `Windows host disk ${path81} at ${tag}: ${freeGiB} GiB free (<${(criticalFree ? criticalBelowBytes : warnBelowBytes) / 1024 / 1024 / 1024} GiB); WSL VHDX cannot grow safely. ${summarizeWslRecoverySteps()}`;
   }
   return {
     ok,
-    path: path79,
+    path: path81,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -592,12 +592,12 @@ var init_wsl_host = __esm({
 // src/disk-gate.ts
 import { statfsSync as statfsSync2 } from "node:fs";
 function observeRunnerDiskGate(input = {}) {
-  const path79 = input.diskPath?.trim() || "/";
+  const path81 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync2(path79);
+  const stats = statfsSync2(path81);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -620,7 +620,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path79,
+    path: path81,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -2635,23 +2635,29 @@ function resolveCallbackSecret(argsSecret, agentOsId) {
     "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / KYNVER_CRON_SECRET / OPENCLAW_CRON_SECRET"
   );
 }
-async function resolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
+async function tryResolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
   const configured = resolveConfiguredCallbackSecret(argsSecret, agentOsId);
-  if (configured) return configured;
+  if (configured) return { ok: true, secret: configured };
   const apiKey = loadApiKey();
   const baseUrl = resolveConfiguredBaseUrl(opts?.baseUrl);
   if (apiKey && agentOsId && baseUrl) {
     try {
       const token = await fetchRunnerCredential(agentOsId, { baseUrl, apiKey });
       saveRunnerToken(agentOsId, token);
-      return token;
+      return { ok: true, secret: token };
     } catch (error) {
-      failConfig(`runner credential mint failed: ${error.message}`);
+      return { ok: false, reason: `runner credential mint failed: ${error.message}` };
     }
   }
-  failConfig(
-    "requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, KYNVER_API_KEY with an API base URL to mint one, or (legacy) KYNVER_RUNTIME_SECRET / KYNVER_CRON_SECRET / OPENCLAW_CRON_SECRET"
-  );
+  return {
+    ok: false,
+    reason: "no runner credential: requires --secret, KYNVER_RUNNER_TOKEN, a scoped runner token (`kynver runner credential`), ~/.kynver/credentials runnerToken, or KYNVER_API_KEY + API base URL to mint one"
+  };
+}
+async function resolveCallbackSecretWithMint(argsSecret, agentOsId, opts) {
+  const result = await tryResolveCallbackSecretWithMint(argsSecret, agentOsId, opts);
+  if (result.ok) return result.secret;
+  failConfig(result.reason);
 }
 async function refreshRunnerToken(agentOsId, opts) {
   const apiKey = loadApiKey();
@@ -2771,7 +2777,10 @@ async function runSetup(args) {
     ...existing,
     ...inferSetupFields(existing, args),
     ...workerConfig,
-    workerProvider: typeof args.provider === "string" ? args.provider : existing.workerProvider || "cursor"
+    workerProvider: typeof args.provider === "string" ? args.provider : existing.workerProvider || "cursor",
+    // M5.4 chat-turn delegation: `--chat-oauth` persists consent to use the
+    // Claude Code CLI's local OAuth token for delegated chat turns.
+    ...args.chatOauth === true ? { chatUseClaudeOauth: true } : {}
   });
   saveUserConfig(config);
   const boxIdentity = resolveBoxIdentity(process.env, config);
@@ -5858,8 +5867,8 @@ function dirtyPathsCoveredByDisposableRemoval(changedFiles, removed) {
   if (removed.length === 0) return false;
   const removedSet = new Set(removed.map((p) => normalizeRelativePath(p)));
   return material.every((line) => {
-    const path79 = normalizeRelativePath(pathFromGitStatusLine(line));
-    return removedSet.has(path79);
+    const path81 = normalizeRelativePath(pathFromGitStatusLine(line));
+    return removedSet.has(path81);
   });
 }
 
@@ -6709,6 +6718,9 @@ function buildBoard(run, workers, compact) {
   }
   return board;
 }
+function isTerminalDoneBoardWorker(worker) {
+  return worker.status === "done" && worker.attention === "done";
+}
 function buildRunBoard(runId) {
   const run = loadRun(runId);
   const names = Object.keys(run.workers || {});
@@ -6729,7 +6741,7 @@ function buildRunBoard(runId) {
 function buildCompactRunBoard(runId) {
   const run = loadRun(runId);
   const names = Object.keys(run.workers || {});
-  const workers = names.map((name) => {
+  const allWorkers = names.map((name) => {
     const worker = readJson(
       path21.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
@@ -6740,7 +6752,17 @@ function buildCompactRunBoard(runId) {
     if (isMetadataTerminalDone(worker)) return buildCompactDoneEntry(name, worker);
     return buildWorkerBoardEntry({ run, workerName: name, worker });
   });
+  const workers = allWorkers.filter((worker) => !isTerminalDoneBoardWorker(worker));
   const board = buildBoard(run, workers, true);
+  board.status = deriveRunStatus(run.status, allWorkers);
+  board.summary = {
+    ...board.summary ?? {},
+    totalWorkerCount: allWorkers.length,
+    shownWorkerCount: workers.length,
+    omittedTerminalDoneWorkerCount: allWorkers.length - workers.length,
+    allStatusCounts: countBy(allWorkers, "status"),
+    allAttentionCounts: countBy(allWorkers, "attention")
+  };
   writeJson(path21.join(runDirectory(run.id), "last-board-compact.json"), board);
   return board;
 }
@@ -9355,7 +9377,7 @@ function applyProductionDatabaseToProcess(options = {}) {
 // src/worktree.ts
 init_git();
 init_run_store();
-import { existsSync as existsSync29, mkdirSync as mkdirSync6 } from "node:fs";
+import { existsSync as existsSync29, mkdirSync as mkdirSync7 } from "node:fs";
 import path38 from "node:path";
 
 // src/run-list.ts
@@ -9438,7 +9460,7 @@ init_util();
 // src/worker-metadata-reconcile.ts
 init_heartbeat();
 init_stream();
-import { existsSync as existsSync27, lstatSync, readdirSync as readdirSync7, readlinkSync, renameSync as renameSync2, rmSync } from "node:fs";
+import { existsSync as existsSync27, lstatSync, readdirSync as readdirSync7, readlinkSync, renameSync as renameSync3, rmSync } from "node:fs";
 import path34 from "node:path";
 
 // src/worker-metadata-paths.ts
@@ -9497,7 +9519,7 @@ function resolveWorkerJsonPath(input) {
 }
 
 // src/run-metadata-retention.ts
-import { existsSync as existsSync26, readdirSync as readdirSync6, statSync as statSync5 } from "node:fs";
+import { existsSync as existsSync26, mkdirSync as mkdirSync6, readdirSync as readdirSync6, renameSync as renameSync2, statSync as statSync5 } from "node:fs";
 import path33 from "node:path";
 
 // src/default-repo.ts
@@ -9578,6 +9600,7 @@ init_paths();
 init_run_store();
 init_util();
 var RUN_METADATA_ACTIVE_SIGNAL_MS = 15 * 60 * 1e3;
+var TERMINAL_WORKER_ARCHIVE_AGE_MS = 60 * 60 * 1e3;
 function isHarnessRunMetadataPath(targetPath, harnessRoot) {
   const resolved = path33.resolve(targetPath);
   const runsDir = path33.resolve(harnessRunsDir(harnessRoot));
@@ -9601,6 +9624,14 @@ function listWorkerNamesOnDisk(runDir2) {
     return [];
   }
 }
+function workerArchiveDir(runDir2) {
+  return path33.join(runDir2, "archived-workers");
+}
+function uniqueArchivePath(runDir2, workerName) {
+  const base = path33.join(workerArchiveDir(runDir2), safeSlug(workerName));
+  if (!existsSync26(base)) return base;
+  return `${base}-${Date.now()}`;
+}
 function pathRecentlyTouched(target, now, windowMs) {
   if (!existsSync26(target)) return false;
   try {
@@ -9627,6 +9658,41 @@ function workerDirHasActiveRetentionSignals(workerDir, now = Date.now(), windowM
   if (pathRecentlyTouched(artifacts.heartbeatPath, now, windowMs)) return true;
   return false;
 }
+function workerTerminalArchiveAgeMs(workerDir, worker, now) {
+  const completionReportedAt = typeof worker.completionReportedAt === "string" ? Date.parse(worker.completionReportedAt) : NaN;
+  if (Number.isFinite(completionReportedAt)) return now - completionReportedAt;
+  const completionSnapshotAt = (() => {
+    const raw = worker.completionResponse;
+    if (!raw || typeof raw !== "object") return NaN;
+    const task = raw.task;
+    if (!task || typeof task !== "object") return NaN;
+    const updatedAt = task.updatedAt;
+    return typeof updatedAt === "string" ? Date.parse(updatedAt) : NaN;
+  })();
+  if (Number.isFinite(completionSnapshotAt)) return now - completionSnapshotAt;
+  try {
+    return now - statSync5(path33.join(workerDir, "worker.json")).mtimeMs;
+  } catch {
+    return 0;
+  }
+}
+function isArchiveEligibleTerminalWorker(workerDir, worker, now, archiveAgeMs) {
+  if (workerDirHasActiveRetentionSignals(workerDir, now)) {
+    return { eligible: false, reason: "worker has active/recent retention signals" };
+  }
+  const status = typeof worker.status === "string" ? worker.status : "";
+  const completionBlocker = typeof worker.completionBlocker === "string" && worker.completionBlocker.trim().length > 0;
+  if (completionBlocker) return { eligible: false, reason: "worker has completion blocker" };
+  const completionAcknowledged = typeof worker.completionReportedAt === "string" || worker.completionOutcome === "acknowledged";
+  if (status !== "done" && !completionAcknowledged) {
+    return { eligible: false, reason: `worker status is ${status || "unknown"}` };
+  }
+  const age = workerTerminalArchiveAgeMs(workerDir, worker, now);
+  if (!Number.isFinite(age) || age < archiveAgeMs) {
+    return { eligible: false, reason: "terminal worker is still within archive grace window" };
+  }
+  return { eligible: true, reason: "terminal worker metadata archived" };
+}
 function runDirHasActiveRetentionSignals(runDir2, now = Date.now(), windowMs = RUN_METADATA_ACTIVE_SIGNAL_MS) {
   for (const name of listWorkerNamesOnDisk(runDir2)) {
     if (workerDirHasActiveRetentionSignals(path33.join(runDir2, "workers", name), now, windowMs)) {
@@ -9704,6 +9770,59 @@ function repairMissingRunMetadata(harnessRootInput) {
   }
   return { runs: outcomes };
 }
+function archiveTerminalWorkerMetadata(harnessRootInput, options = {}) {
+  const harnessRoot = normalizeHarnessRoot(harnessRootInput ?? resolveHarnessRoot());
+  const runsDir = harnessRunsDir(harnessRoot);
+  const now = options.now ?? Date.now();
+  const archiveAgeMs = options.archiveAgeMs ?? TERMINAL_WORKER_ARCHIVE_AGE_MS;
+  const outcomes = [];
+  repairMissingRunMetadata(harnessRoot);
+  for (const runId of listRunDirIds(runsDir)) {
+    const runDir2 = path33.join(runsDir, runId);
+    const runJsonPath = path33.join(runDir2, "run.json");
+    const run = readJson(runJsonPath, void 0);
+    if (!run?.id) continue;
+    const names = /* @__PURE__ */ new Set([...Object.keys(run.workers || {}), ...listWorkerNamesOnDisk(runDir2)]);
+    let changed = false;
+    for (const name of names) {
+      const workerDir = path33.join(runDir2, "workers", safeSlug(name));
+      const workerJsonPath = path33.join(workerDir, "worker.json");
+      const worker = readJson(workerJsonPath, void 0);
+      if (!worker) {
+        const archivedWorkerDir = path33.join(workerArchiveDir(runDir2), safeSlug(name));
+        if (existsSync26(archivedWorkerDir) && (run.workers[safeSlug(name)] || run.workers[name])) {
+          delete run.workers[safeSlug(name)];
+          delete run.workers[name];
+          changed = true;
+          outcomes.push({
+            runId: run.id,
+            worker: name,
+            action: "archived",
+            reason: "removed stale live index entry for archived worker metadata",
+            archivePath: archivedWorkerDir
+          });
+          continue;
+        }
+        outcomes.push({ runId: run.id, worker: name, action: "skipped", reason: "worker.json missing" });
+        continue;
+      }
+      const eligibility = isArchiveEligibleTerminalWorker(workerDir, worker, now, archiveAgeMs);
+      if (!eligibility.eligible) {
+        outcomes.push({ runId: run.id, worker: name, action: "skipped", reason: eligibility.reason });
+        continue;
+      }
+      const archivePath = uniqueArchivePath(runDir2, name);
+      mkdirSync6(path33.dirname(archivePath), { recursive: true });
+      renameSync2(workerDir, archivePath);
+      delete run.workers[safeSlug(name)];
+      delete run.workers[name];
+      changed = true;
+      outcomes.push({ runId: run.id, worker: name, action: "archived", reason: eligibility.reason, archivePath });
+    }
+    if (changed) saveRun(run);
+  }
+  return { workers: outcomes };
+}
 function collectFilesystemLiveRunKeys(harnessRoot, now = Date.now()) {
   const keys = /* @__PURE__ */ new Set();
   const runsDir = harnessRunsDir(harnessRoot);
@@ -9733,9 +9852,9 @@ function materializeSymlinkedRunDir(harnessRoot, runId) {
     return null;
   }
   const staging = `${canonical}.materialize-${Date.now()}`;
-  renameSync2(linkedTarget, staging);
+  renameSync3(linkedTarget, staging);
   rmSync(canonical);
-  renameSync2(staging, canonical);
+  renameSync3(staging, canonical);
   return linkedTarget;
 }
 function relocateArtifacts(input) {
@@ -9744,7 +9863,7 @@ function relocateArtifacts(input) {
     const from = path34.join(input.fromDir, fileName);
     const to = path34.join(input.toDir, fileName);
     if (!existsSync27(from) || existsSync27(to)) continue;
-    renameSync2(from, to);
+    renameSync3(from, to);
     moved.push(fileName);
   }
   return moved;
@@ -10225,7 +10344,14 @@ function reconcileStaleWorkers() {
   const metadataReconcile = reconcileWorkerMetadata();
   if (staleReconcileDisabled()) {
     const localPrAttentionReconcile2 = reconcileLocalOnlyMergedPrAttention();
-    return { workers: [], finalizedRuns: finalizeStaleRuns(), metadataReconcile, localPrAttentionReconcile: localPrAttentionReconcile2 };
+    const terminalWorkerArchive2 = archiveTerminalWorkerMetadata();
+    return {
+      workers: [],
+      finalizedRuns: finalizeStaleRuns(),
+      metadataReconcile,
+      localPrAttentionReconcile: localPrAttentionReconcile2,
+      terminalWorkerArchive: terminalWorkerArchive2
+    };
   }
   const outcomes = [];
   const now = Date.now();
@@ -10304,7 +10430,8 @@ function reconcileStaleWorkers() {
     }
   }
   const localPrAttentionReconcile = reconcileLocalOnlyMergedPrAttention();
-  return { workers: outcomes, finalizedRuns: finalizeStaleRuns(), metadataReconcile, localPrAttentionReconcile };
+  const terminalWorkerArchive = archiveTerminalWorkerMetadata();
+  return { workers: outcomes, finalizedRuns: finalizeStaleRuns(), metadataReconcile, localPrAttentionReconcile, terminalWorkerArchive };
 }
 function reconcileRunsCli() {
   const result = reconcileStaleWorkers();
@@ -10323,6 +10450,10 @@ function reconcileRunsCli() {
     acc[row.action] = (acc[row.action] ?? 0) + 1;
     return acc;
   }, {});
+  const archiveTotals = result.terminalWorkerArchive.workers.reduce((acc, row) => {
+    acc[row.action] = (acc[row.action] ?? 0) + 1;
+    return acc;
+  }, {});
   console.log(
     JSON.stringify(
       {
@@ -10340,11 +10471,16 @@ function reconcileRunsCli() {
           totals: localPrAttentionTotals,
           total: result.localPrAttentionReconcile.workers.length
         },
+        terminalWorkerArchive: {
+          totals: archiveTotals,
+          total: result.terminalWorkerArchive.workers.length
+        },
         finalizedRuns: result.finalizedRuns.length,
         details: {
           workers: result.workers,
           metadataReconcile: result.metadataReconcile.workers,
           localPrAttentionReconcile: result.localPrAttentionReconcile.workers,
+          terminalWorkerArchive: result.terminalWorkerArchive.workers,
           runMetadataRetention: result.metadataReconcile.runMetadataRetention.runs,
           finalizedRuns: result.finalizedRuns
         }
@@ -10488,7 +10624,7 @@ function createRun(args) {
   const id = args.id ? validateRunId(String(args.id)) : timestampSlug(String(args.name || "run"));
   const dir = runDirectory(id);
   if (existsSync29(dir)) failExists(`run already exists: ${id}`);
-  mkdirSync6(dir, { recursive: true });
+  mkdirSync7(dir, { recursive: true });
   const base = String(args.base || "origin/main");
   const baseCommit = git(repo, ["rev-parse", base]).trim();
   const run = {
@@ -10742,11 +10878,11 @@ function harnessStorageSnapshot(opts = {}) {
 
 // src/cleanup.ts
 init_paths();
-import path53 from "node:path";
+import path55 from "node:path";
 
 // src/cleanup-guards.ts
 init_landing_gate();
-import path42 from "node:path";
+import path43 from "node:path";
 
 // src/cleanup-index-status.ts
 init_git();
@@ -10889,6 +11025,44 @@ init_status();
 // src/cleanup-run-liveness.ts
 init_status();
 
+// src/cleanup-worker-harness-live.ts
+init_heartbeat();
+init_util();
+function heartbeatContentIsFresh(worker, now = Date.now(), windowMs = RUN_METADATA_ACTIVE_SIGNAL_MS) {
+  const heartbeat = parseHeartbeat(worker.heartbeatPath);
+  if (!heartbeat.lastHeartbeatAt) return false;
+  const age = now - Date.parse(heartbeat.lastHeartbeatAt);
+  return Number.isFinite(age) && age >= 0 && age < windowMs;
+}
+function isHarnessWorkerHarnessLive(worker, now = Date.now(), windowMs = RUN_METADATA_ACTIVE_SIGNAL_MS) {
+  if (isPidAlive(worker.pid)) return true;
+  return heartbeatContentIsFresh(worker, now, windowMs);
+}
+
+// src/cleanup-run-liveness.ts
+function deriveRunTerminal(indexed, ctx) {
+  if (ctx) return ctx.runTerminalCache.derive(indexed.run);
+  return deriveTerminalRunStatus(indexed.run);
+}
+function isWorkerProcessLive(indexed, now = Date.now()) {
+  return isHarnessWorkerHarnessLive(indexed.worker, now);
+}
+function isRunStaleActive(indexed, ctx) {
+  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
+  return deriveRunTerminal(indexed, ctx) !== null;
+}
+function runBlocksWorktreeRemoval(indexed, ctx, now = Date.now()) {
+  if (isWorkerProcessLive(indexed, now)) return true;
+  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
+  if (isRunStaleActive(indexed, ctx)) return false;
+  const status = indexedWorktreeStatus(indexed);
+  if (!isFinishedWorkerStatus(status)) {
+    if (!isWorkerProcessLive(indexed, now)) return false;
+    return true;
+  }
+  return false;
+}
+
 // src/cleanup-completion-blocker.ts
 init_landing_gate();
 init_status();
@@ -10910,51 +11084,80 @@ function completionBlockerBlocksWorktreeRemoval(indexed, status) {
   return false;
 }
 
-// src/cleanup-run-liveness.ts
+// src/cleanup-salvage-evidence.ts
+init_git();
 init_util();
-var TERMINAL_WORKER_JSON_STATUSES = /* @__PURE__ */ new Set([
-  "done",
-  "exited",
-  "blocked",
-  "failed",
-  "abandoned"
-]);
-function deriveRunTerminal(indexed, ctx) {
-  if (ctx) return ctx.runTerminalCache.derive(indexed.run);
-  return deriveTerminalRunStatus(indexed.run);
-}
-function isWorkerProcessLive(indexed) {
-  if (isPidAlive(indexed.worker.pid)) return true;
-  if (typeof indexed.worker.completionReportedAt === "string" && indexed.worker.completionReportedAt.trim().length > 0) {
-    return false;
-  }
-  const workerStatus2 = indexed.worker.status;
-  if (workerStatus2 && TERMINAL_WORKER_JSON_STATUSES.has(workerStatus2)) return false;
-  if (!indexed.worker.pid) {
-    if (workerStatus2 !== "running") return false;
-    return indexedWorktreeStatus(indexed).alive;
-  }
-  return false;
+import { existsSync as existsSync32, mkdirSync as mkdirSync8, writeFileSync as writeFileSync4 } from "node:fs";
+import path42 from "node:path";
+function salvageEvidenceDir(harnessRoot, runId, workerName) {
+  return path42.join(harnessRoot, "salvage", safeSlug(runId), safeSlug(workerName));
 }
-function isRunStaleActive(indexed, ctx) {
-  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
-  return deriveRunTerminal(indexed, ctx) !== null;
+function hasSalvageEvidence(input) {
+  return existsSync32(path42.join(salvageEvidenceDir(input.harnessRoot, input.runId, input.workerName), "evidence.json"));
 }
-function runBlocksWorktreeRemoval(indexed, ctx) {
-  if (isWorkerProcessLive(indexed)) return true;
-  const workerStatus2 = indexed.worker.status;
-  if (workerStatus2 && TERMINAL_WORKER_JSON_STATUSES.has(workerStatus2) && !indexed.worker.completionBlocker) {
-    return false;
-  }
-  const status = indexedWorktreeStatus(indexed);
-  if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return true;
-  if (isFinishedWorkerStatus(status)) return false;
-  if (TERMINAL_RUN_STATUSES.has(indexed.run.status)) return false;
-  if (isRunStaleActive(indexed, ctx)) return false;
-  return deriveRunTerminal(indexed, ctx) === null;
+function writeWorktreeSalvageEvidence(input) {
+  const dir = salvageEvidenceDir(input.harnessRoot, input.indexed.runId, input.indexed.workerName);
+  mkdirSync8(dir, { recursive: true });
+  const patchPath = path42.join(dir, "salvage.patch");
+  let wrotePatch = false;
+  if (existsSync32(input.indexed.worktreePath)) {
+    const diff = gitCapture(input.indexed.worktreePath, ["diff", "HEAD"]);
+    const staged = gitCapture(input.indexed.worktreePath, ["diff", "--cached"]);
+    const patch = [diff.stdout, staged.stdout].filter((chunk) => chunk.trim()).join("\n");
+    if (patch.trim()) {
+      writeFileSync4(patchPath, patch.endsWith("\n") ? patch : `${patch}
+`);
+      wrotePatch = true;
+    }
+  }
+  const record3 = {
+    capturedAt: new Date(input.now ?? Date.now()).toISOString(),
+    skipReason: input.skipReason,
+    runId: input.indexed.runId,
+    workerName: input.indexed.workerName,
+    worktreePath: input.indexed.worktreePath,
+    taskId: input.indexed.worker.taskId,
+    agentOsId: input.indexed.worker.agentOsId,
+    branch: input.indexed.worker.branch,
+    completionBlocker: input.indexed.worker.completionBlocker,
+    finalResult: input.status.finalResult,
+    changedFiles: input.status.changedFiles,
+    gitAncestry: input.status.gitAncestry,
+    prUrl: input.status.prUrl ?? null,
+    ...wrotePatch ? { patchPath } : {}
+  };
+  writeFileSync4(path42.join(dir, "evidence.json"), `${JSON.stringify(record3, null, 2)}
+`);
+  return record3;
 }
 
 // src/cleanup-guards.ts
+var SALVAGE_ELIGIBLE_SKIP_REASONS = /* @__PURE__ */ new Set([
+  "completion_blocked",
+  "dirty_worktree",
+  "pr_or_unmerged_commits",
+  "landing_blocked"
+]);
+function maybeSalvageBlockedWorktree(input) {
+  if (!SALVAGE_ELIGIBLE_SKIP_REASONS.has(input.skipReason)) return false;
+  if (isWorkerProcessLive(input.indexed, input.now)) return false;
+  if (hasSalvageEvidence({
+    harnessRoot: input.harnessRoot,
+    runId: input.indexed.runId,
+    workerName: input.indexed.workerName
+  })) {
+    return true;
+  }
+  if (!input.writeSalvageEvidence) return false;
+  writeWorktreeSalvageEvidence({
+    harnessRoot: input.harnessRoot,
+    indexed: input.indexed,
+    skipReason: input.skipReason,
+    status: input.status,
+    now: input.now
+  });
+  return true;
+}
 function effectiveWorktreeAgeMs(input) {
   const { indexed, includeOrphans, worktreesAgeMs, terminalWorktreesAgeMs } = input;
   if (!indexed) return includeOrphans ? terminalWorktreesAgeMs : worktreesAgeMs;
@@ -10969,8 +11172,18 @@ function effectiveWorktreeAgeMs(input) {
   }
   return worktreesAgeMs;
 }
+function resolveHarnessRoot2(input, indexed) {
+  if (input.harnessRoot?.trim()) return path43.resolve(input.harnessRoot);
+  const workerDir = indexed.worker.workerDir;
+  if (!workerDir) return null;
+  const runsMarker = `${path43.sep}runs${path43.sep}`;
+  const idx = workerDir.indexOf(runsMarker);
+  if (idx < 0) return null;
+  return workerDir.slice(0, idx + runsMarker.length - 1);
+}
 function skipWorktreeRemoval(input) {
   const { indexed, includeOrphans, worktreesAgeMs, ageMs, orphanSafety, worktreeRemovalGuard } = input;
+  const now = input.now ?? Date.now();
   if (!indexed) {
     if (!includeOrphans) return "orphan_without_flag";
     return orphanSafety ?? null;
@@ -10978,25 +11191,55 @@ function skipWorktreeRemoval(input) {
   const ageThresholdMs = effectiveWorktreeAgeMs(input);
   if (worktreesAgeMs <= 0 && !includeOrphans && ageThresholdMs <= 0) return "worktrees_disabled";
   if (ageThresholdMs > 0 && ageMs < ageThresholdMs) return "below_age_threshold";
-  if (isWorkerProcessLive(indexed)) return "active_worker";
+  if (isWorkerProcessLive(indexed, now)) return "active_worker";
+  const status = resolveWorktreeGuardStatus(indexed, input.liveness);
+  const salvageHarnessRoot = resolveHarnessRoot2(input, indexed);
+  const salvageOrBlock = (skipReason) => {
+    if (salvageHarnessRoot && maybeSalvageBlockedWorktree({
+      indexed,
+      harnessRoot: salvageHarnessRoot,
+      skipReason,
+      status,
+      now,
+      writeSalvageEvidence: input.writeSalvageEvidence === true
+    })) {
+      return null;
+    }
+    return skipReason;
+  };
+  if (completionBlockerBlocksWorktreeRemoval(indexed, status)) {
+    const blocked = salvageOrBlock("completion_blocked");
+    if (blocked) return blocked;
+  }
   if (indexedWorktreeHasMaterialChanges(indexed, input.liveness?.gitStatusCache)) {
-    return "dirty_worktree";
+    const blocked = salvageOrBlock("dirty_worktree");
+    if (blocked) return blocked;
   }
   const ahead = input.liveness?.gitRevCache?.countAheadOfMain(input.worktreePath);
-  if (ahead !== null && ahead !== void 0 && ahead > 0) return "pr_or_unmerged_commits";
-  const status = resolveWorktreeGuardStatus(indexed, input.liveness);
-  if (completionBlockerBlocksWorktreeRemoval(indexed, status)) return "completion_blocked";
-  if (runBlocksWorktreeRemoval(indexed, input.liveness)) return "run_still_active";
+  if (ahead !== null && ahead !== void 0 && ahead > 0) {
+    const blocked = salvageOrBlock("pr_or_unmerged_commits");
+    if (blocked) return blocked;
+  }
+  if (runBlocksWorktreeRemoval(indexed, input.liveness, now)) return "run_still_active";
   if (!isFinishedWorkerStatus(status)) return "run_still_active";
-  if (isPrOrUnmergedWork(status)) return "pr_or_unmerged_commits";
-  if (materialWorktreeChanges2(status.changedFiles).length > 0) return "dirty_worktree";
+  if (isPrOrUnmergedWork(status)) {
+    const blocked = salvageOrBlock("pr_or_unmerged_commits");
+    if (blocked) return blocked;
+  }
+  if (materialWorktreeChanges2(status.changedFiles).length > 0) {
+    const blocked = salvageOrBlock("dirty_worktree");
+    if (blocked) return blocked;
+  }
   const landing = assessWorkerLanding({
     finalResult: status.finalResult,
     changedFiles: status.changedFiles,
     gitAncestry: status.gitAncestry,
     prUrl: prUrlFromFinalResult(status.finalResult)
   });
-  if (landing.blocked) return "landing_blocked";
+  if (landing.blocked) {
+    const blocked = salvageOrBlock("landing_blocked");
+    if (blocked) return blocked;
+  }
   if (worktreeRemovalGuard && input.worktreePath) {
     const overlay = worktreeRemovalGuard({
       worktreePath: input.worktreePath,
@@ -11013,7 +11256,7 @@ function skipWorktreeRemoval(input) {
 function skipDependencyCacheRemoval(input) {
   const { indexed, nodeModulesAgeMs, ageMs, worktreePath, activeWorktreePaths, diskPressure } = input;
   if (!diskPressure && ageMs < nodeModulesAgeMs) return "below_age_threshold";
-  if (activeWorktreePaths.has(path42.resolve(worktreePath))) return "active_worker";
+  if (activeWorktreePaths.has(path43.resolve(worktreePath))) return "active_worker";
   if (indexed && isWorkerProcessLive(indexed)) return "active_worker";
   if (indexed && indexedWorktreeHasMaterialChanges(indexed, input.gitStatusCache)) {
     return "dirty_worktree";
@@ -11042,11 +11285,11 @@ var LIVE_SKIP_REASONS = /* @__PURE__ */ new Set([
 function collectPreservedLivePaths(actions, skips) {
   const out = [];
   const seen = /* @__PURE__ */ new Set();
-  const push = (path79, reason, detail) => {
-    const key = `${path79}\0${reason}`;
+  const push = (path81, reason, detail) => {
+    const key = `${path81}\0${reason}`;
     if (seen.has(key) || out.length >= MAX_PRESERVED_LIVE_PATH_SAMPLES) return;
     seen.add(key);
-    out.push({ path: path79, reason, ...detail ? { detail } : {} });
+    out.push({ path: path81, reason, ...detail ? { detail } : {} });
   };
   for (const skip2 of skips) {
     if (!LIVE_SKIP_REASONS.has(skip2.reason)) continue;
@@ -11061,31 +11304,16 @@ function collectPreservedLivePaths(actions, skips) {
 }
 
 // src/cleanup-run-directory.ts
-import { existsSync as existsSync33, readdirSync as readdirSync11, statSync as statSync9 } from "node:fs";
-import path44 from "node:path";
+import { existsSync as existsSync33, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
+import path45 from "node:path";
 
 // src/cleanup-active-worktrees.ts
 init_run_store();
 init_paths();
-import { existsSync as existsSync32, readdirSync as readdirSync10, statSync as statSync8 } from "node:fs";
-import path43 from "node:path";
+import path44 from "node:path";
 init_util();
-function workerHasRecentHarnessActivity(worker, now) {
-  const paths = [worker.heartbeatPath, worker.stdoutPath, worker.stderrPath];
-  for (const target of paths) {
-    if (!existsSync32(target)) continue;
-    try {
-      const age = now - statSync8(target).mtimeMs;
-      if (Number.isFinite(age) && age >= 0 && age < RUN_METADATA_ACTIVE_SIGNAL_MS) return true;
-    } catch {
-    }
-  }
-  return false;
-}
 function isActiveHarnessWorker2(worker, now) {
-  if (isPidAlive(worker.pid)) return true;
-  if (worker.status === "running" && workerHasRecentHarnessActivity(worker, now)) return true;
-  return false;
+  return isHarnessWorkerHarnessLive(worker, now);
 }
 function collectActiveWorktreeGuards(harnessRoots, now = Date.now()) {
   const activeWorktreePaths = /* @__PURE__ */ new Set();
@@ -11095,11 +11323,11 @@ function collectActiveWorktreeGuards(harnessRoots, now = Date.now()) {
       let runHasLive = false;
       for (const name of Object.keys(run.workers || {})) {
         const worker = readJson(
-          path43.join(runDirectoryAt(harnessRoot, run.id), "workers", safeSlug(name), "worker.json"),
+          path44.join(runDirectoryAt(harnessRoot, run.id), "workers", safeSlug(name), "worker.json"),
           void 0
         );
         if (!worker?.worktreePath) continue;
-        const worktreePath = path43.resolve(worker.worktreePath);
+        const worktreePath = path44.resolve(worker.worktreePath);
         if (!isActiveHarnessWorker2(worker, now)) continue;
         runHasLive = true;
         activeWorktreePaths.add(worktreePath);
@@ -11121,20 +11349,20 @@ function isWorktreeOnLiveRun(worktreePath, harnessRoot, runId, liveRunKeys) {
 init_util();
 function pathAgeMs(target, now) {
   try {
-    const mtime = statSync9(target).mtimeMs;
+    const mtime = statSync8(target).mtimeMs;
     return Math.max(0, now - mtime);
   } catch {
     return 0;
   }
 }
 function loadRunStatus(harnessRoot, runId) {
-  const runPath = path44.join(harnessRoot, "runs", runId, "run.json");
+  const runPath = path45.join(harnessRoot, "runs", runId, "run.json");
   if (!existsSync33(runPath)) return null;
   return readJson(runPath, null);
 }
 function runDirectoryIsEmpty(runPath) {
   try {
-    const entries = readdirSync11(runPath);
+    const entries = readdirSync10(runPath);
     return entries.length === 0;
   } catch {
     return false;
@@ -11158,7 +11386,7 @@ function scanStaleRunDirectoryCandidates(opts) {
   const candidates = [];
   let entries;
   try {
-    entries = readdirSync11(opts.worktreesDir, { withFileTypes: true });
+    entries = readdirSync10(opts.worktreesDir, { withFileTypes: true });
   } catch {
     return [];
   }
@@ -11166,7 +11394,7 @@ function scanStaleRunDirectoryCandidates(opts) {
     if (!runEntry.isDirectory()) continue;
     const runId = runEntry.name;
     if (opts.runIdFilter && runId !== opts.runIdFilter) continue;
-    const runPath = path44.join(opts.worktreesDir, runId);
+    const runPath = path45.join(opts.worktreesDir, runId);
     if (!runDirectoryIsEmpty(runPath)) continue;
     candidates.push({
       kind: "remove_run_directory",
@@ -11189,7 +11417,7 @@ import { existsSync as existsSync34, rmSync as rmSync2 } from "node:fs";
 init_paths();
 
 // src/cleanup-path-ownership.ts
-import { lstatSync as lstatSync2, readdirSync as readdirSync12 } from "node:fs";
+import { lstatSync as lstatSync2, readdirSync as readdirSync11 } from "node:fs";
 function readPathOwnership(targetPath) {
   try {
     const st = lstatSync2(targetPath);
@@ -11206,7 +11434,7 @@ function pathHasForeignOwnedEntry(targetPath, maxEntries = 32) {
   if (!root) return false;
   if (root.foreign) return true;
   try {
-    const names = readdirSync12(targetPath);
+    const names = readdirSync11(targetPath);
     let checked = 0;
     for (const name of names) {
       if (checked >= maxEntries) break;
@@ -11222,20 +11450,20 @@ function pathHasForeignOwnedEntry(targetPath, maxEntries = 32) {
 
 // src/cleanup-privileged-remove.ts
 import { spawnSync as spawnSync7 } from "node:child_process";
-import path46 from "node:path";
+import path47 from "node:path";
 
 // src/cleanup-harness-path-validate.ts
-import path45 from "node:path";
+import path46 from "node:path";
 function isHarnessDependencyCachePath(targetPath, harnessRoot, worktreesDir, cacheDirName) {
-  const resolved = path45.resolve(targetPath);
-  const suffix = `${path45.sep}${cacheDirName}`;
+  const resolved = path46.resolve(targetPath);
+  const suffix = `${path46.sep}${cacheDirName}`;
   const cachePath = resolved.endsWith(suffix) ? resolved : null;
   if (!cachePath) return "path_outside_harness";
-  const rel = path45.relative(worktreesDir, cachePath);
-  if (rel.startsWith("..") || path45.isAbsolute(rel)) return "path_outside_harness";
-  const parts = rel.split(path45.sep);
+  const rel = path46.relative(worktreesDir, cachePath);
+  if (rel.startsWith("..") || path46.isAbsolute(rel)) return "path_outside_harness";
+  const parts = rel.split(path46.sep);
   if (parts.length < 3 || parts[parts.length - 1] !== cacheDirName) return "path_outside_harness";
-  if (!resolved.startsWith(path45.resolve(harnessRoot))) return "path_outside_harness";
+  if (!resolved.startsWith(path46.resolve(harnessRoot))) return "path_outside_harness";
   return null;
 }
 function isHarnessNodeModulesPath(targetPath, harnessRoot, worktreesDir) {
@@ -11245,16 +11473,16 @@ function isHarnessNextCachePath(targetPath, harnessRoot, worktreesDir) {
   return isHarnessDependencyCachePath(targetPath, harnessRoot, worktreesDir, ".next");
 }
 function isHarnessBuildCachePath(targetPath, harnessRoot, worktreesDir) {
-  const resolved = path45.resolve(targetPath);
-  const relToWt = path45.relative(worktreesDir, resolved);
-  if (relToWt.startsWith("..") || path45.isAbsolute(relToWt)) return "path_outside_harness";
-  const parts = relToWt.split(path45.sep);
+  const resolved = path46.resolve(targetPath);
+  const relToWt = path46.relative(worktreesDir, resolved);
+  if (relToWt.startsWith("..") || path46.isAbsolute(relToWt)) return "path_outside_harness";
+  const parts = relToWt.split(path46.sep);
   if (parts.length < 3) return "path_outside_harness";
-  if (!resolved.startsWith(path45.resolve(harnessRoot))) return "path_outside_harness";
+  if (!resolved.startsWith(path46.resolve(harnessRoot))) return "path_outside_harness";
   return null;
 }
 function isHarnessGeneratedCachePath(targetPath, harnessRoot, worktreesDir) {
-  const resolved = path45.resolve(targetPath);
+  const resolved = path46.resolve(targetPath);
   return isHarnessNodeModulesPath(resolved, harnessRoot, worktreesDir) === null || isHarnessNextCachePath(resolved, harnessRoot, worktreesDir) === null || isHarnessBuildCachePath(resolved, harnessRoot, worktreesDir) === null;
 }
 
@@ -11288,12 +11516,12 @@ function tryPrivilegedReclaimHarnessCache(targetPath, harnessRoot, worktreesDir)
     "chown",
     "-R",
     `${effectiveUid}:${effectiveGid}`,
-    path46.resolve(targetPath)
+    path47.resolve(targetPath)
   ]);
   if (chown.ok) {
     return { ok: true, method: "chown_then_rm" };
   }
-  const rm = runSudoNonInteractive(["rm", "-rf", path46.resolve(targetPath)]);
+  const rm = runSudoNonInteractive(["rm", "-rf", path47.resolve(targetPath)]);
   if (rm.ok) {
     return { ok: true, method: "sudo_rm" };
   }
@@ -11494,27 +11722,27 @@ function removeWorktree(candidate, execute) {
 }
 
 // src/cleanup-scan.ts
-import { existsSync as existsSync36, readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
-import path47 from "node:path";
+import { existsSync as existsSync36, readdirSync as readdirSync12, statSync as statSync9 } from "node:fs";
+import path48 from "node:path";
 function pathAgeMs2(target, now) {
   try {
-    const mtime = statSync10(target).mtimeMs;
+    const mtime = statSync9(target).mtimeMs;
     return Math.max(0, now - mtime);
   } catch {
     return 0;
   }
 }
 function isPathInside(child, parent) {
-  const rel = path47.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path47.isAbsolute(rel);
+  const rel = path48.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path48.isAbsolute(rel);
 }
 function collectBuildCacheForWorktree(worktreePath, opts, seen, meta) {
   const out = [];
   for (const rel of HARNESS_BUILD_CACHE_RELATIVE_PATHS) {
     if (rel === ".next") continue;
-    const target = path47.join(worktreePath, rel);
+    const target = path48.join(worktreePath, rel);
     if (!existsSync36(target)) continue;
-    const resolved = path47.resolve(target);
+    const resolved = path48.resolve(target);
     if (seen.has(resolved)) continue;
     if (!isPathInside(resolved, opts.harnessRoot)) continue;
     seen.add(resolved);
@@ -11544,12 +11772,12 @@ function scanBuildCacheCandidates(opts) {
     );
   }
   if (!opts.includeOrphans || !existsSync36(opts.worktreesDir)) return candidates;
-  for (const runEntry of readdirSync13(opts.worktreesDir, { withFileTypes: true })) {
+  for (const runEntry of readdirSync12(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
-    const runPath = path47.join(opts.worktreesDir, runEntry.name);
-    for (const workerEntry of readdirSync13(runPath, { withFileTypes: true })) {
+    const runPath = path48.join(opts.worktreesDir, runEntry.name);
+    for (const workerEntry of readdirSync12(runPath, { withFileTypes: true })) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path47.join(runPath, workerEntry.name);
+      const worktreePath = path48.join(runPath, workerEntry.name);
       candidates.push(
         ...collectBuildCacheForWorktree(worktreePath, opts, seen, {
           runId: runEntry.name,
@@ -11587,21 +11815,21 @@ function scanWorktreeCandidates(opts) {
   if (!orphanEnabled || !existsSync36(opts.worktreesDir)) return candidates;
   const indexedPaths = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
-    indexedPaths.add(path47.resolve(entry.worktreePath));
+    indexedPaths.add(path48.resolve(entry.worktreePath));
   }
-  for (const runEntry of readdirSync13(opts.worktreesDir, { withFileTypes: true })) {
+  for (const runEntry of readdirSync12(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
     if (opts.runIdFilter && runEntry.name !== opts.runIdFilter) continue;
-    const runPath = path47.join(opts.worktreesDir, runEntry.name);
+    const runPath = path48.join(opts.worktreesDir, runEntry.name);
     let workerEntries;
     try {
-      workerEntries = readdirSync13(runPath, { withFileTypes: true });
+      workerEntries = readdirSync12(runPath, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const workerEntry of workerEntries) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path47.resolve(path47.join(runPath, workerEntry.name));
+      const worktreePath = path48.resolve(path48.join(runPath, workerEntry.name));
       if (seen.has(worktreePath)) continue;
       if (indexedPaths.has(worktreePath)) continue;
       if (!isPathInside(worktreePath, opts.harnessRoot)) continue;
@@ -11620,27 +11848,27 @@ function scanWorktreeCandidates(opts) {
 }
 
 // src/cleanup-dependency-scan.ts
-import { existsSync as existsSync37, readdirSync as readdirSync14, statSync as statSync11 } from "node:fs";
-import path48 from "node:path";
+import { existsSync as existsSync37, readdirSync as readdirSync13, statSync as statSync10 } from "node:fs";
+import path49 from "node:path";
 var DEPENDENCY_CACHE_DIRS = [
   { dirName: "node_modules", kind: "remove_node_modules" },
   { dirName: ".next", kind: "remove_next_cache" }
 ];
 function pathAgeMs3(target, now) {
   try {
-    const mtime = statSync11(target).mtimeMs;
+    const mtime = statSync10(target).mtimeMs;
     return Math.max(0, now - mtime);
   } catch {
     return 0;
   }
 }
 function isPathInside2(child, parent) {
-  const rel = path48.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path48.isAbsolute(rel);
+  const rel = path49.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path49.isAbsolute(rel);
 }
 function pushCandidate2(candidates, seen, opts, targetPath, kind, meta) {
   if (!existsSync37(targetPath)) return;
-  const resolved = path48.resolve(targetPath);
+  const resolved = path49.resolve(targetPath);
   if (seen.has(resolved)) return;
   if (!isPathInside2(resolved, opts.harnessRoot)) return;
   seen.add(resolved);
@@ -11657,7 +11885,7 @@ function pushCandidate2(candidates, seen, opts, targetPath, kind, meta) {
 }
 function scanWorktreeDependencyCaches(candidates, seen, opts, worktreePath, meta) {
   for (const entry of DEPENDENCY_CACHE_DIRS) {
-    pushCandidate2(candidates, seen, opts, path48.join(worktreePath, entry.dirName), entry.kind, meta);
+    pushCandidate2(candidates, seen, opts, path49.join(worktreePath, entry.dirName), entry.kind, meta);
   }
 }
 function scanDependencyCacheCandidates(opts) {
@@ -11672,19 +11900,19 @@ function scanDependencyCacheCandidates(opts) {
     });
   }
   if (!opts.includeOrphans || !existsSync37(opts.worktreesDir)) return candidates;
-  for (const runEntry of readdirSync14(opts.worktreesDir, { withFileTypes: true })) {
+  for (const runEntry of readdirSync13(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
     if (opts.runIdFilter && runEntry.name !== opts.runIdFilter) continue;
-    const runPath = path48.join(opts.worktreesDir, runEntry.name);
+    const runPath = path49.join(opts.worktreesDir, runEntry.name);
     let workerEntries;
     try {
-      workerEntries = readdirSync14(runPath, { withFileTypes: true });
+      workerEntries = readdirSync13(runPath, { withFileTypes: true });
     } catch {
       continue;
     }
     for (const workerEntry of workerEntries) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path48.join(runPath, workerEntry.name);
+      const worktreePath = path49.join(runPath, workerEntry.name);
       scanWorktreeDependencyCaches(candidates, seen, opts, worktreePath, {
         runId: runEntry.name,
         worker: workerEntry.name
@@ -11696,11 +11924,11 @@ function scanDependencyCacheCandidates(opts) {
 
 // src/cleanup-duplicate-worktrees.ts
 init_git();
-import { existsSync as existsSync38, statSync as statSync12 } from "node:fs";
-import path49 from "node:path";
+import { existsSync as existsSync38, statSync as statSync11 } from "node:fs";
+import path50 from "node:path";
 function pathAgeMs4(target, now) {
   try {
-    const mtime = statSync12(target).mtimeMs;
+    const mtime = statSync11(target).mtimeMs;
     return Math.max(0, now - mtime);
   } catch {
     return 0;
@@ -11727,32 +11955,24 @@ function parseWorktreePorcelain(output) {
   return records;
 }
 function isUnderWorktreesDir(worktreePath, worktreesDir) {
-  const rel = path49.relative(path49.resolve(worktreesDir), path49.resolve(worktreePath));
-  return rel !== "" && !rel.startsWith("..") && !path49.isAbsolute(rel);
-}
-function isCleanWorktree(worktreePath, repoRoot) {
-  try {
-    const porcelain = git(repoRoot, ["-C", worktreePath, "status", "--porcelain"], {
-      allowFailure: true
-    });
-    return !String(porcelain || "").trim();
-  } catch {
-    return false;
-  }
+  const rel = path50.relative(path50.resolve(worktreesDir), path50.resolve(worktreePath));
+  return rel !== "" && !rel.startsWith("..") && !path50.isAbsolute(rel);
 }
+var MAX_DUPLICATE_WORKTREE_CANDIDATES_PER_REPO = 200;
 function scanDuplicateWorktreeCandidates(opts) {
   if (!opts.includeOrphans || !existsSync38(opts.worktreesDir)) return [];
   const repos = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
-    if (entry.run.repo) repos.add(path49.resolve(entry.run.repo));
+    if (entry.run.repo) repos.add(path50.resolve(entry.run.repo));
   }
   const indexedPaths = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
-    indexedPaths.add(path49.resolve(entry.worktreePath));
+    indexedPaths.add(path50.resolve(entry.worktreePath));
   }
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
   for (const repoRoot of repos) {
+    let repoCandidateCount = 0;
     let porcelain;
     try {
       porcelain = git(repoRoot, ["worktree", "list", "--porcelain"], { allowFailure: true });
@@ -11761,18 +11981,19 @@ function scanDuplicateWorktreeCandidates(opts) {
     }
     const worktrees = parseWorktreePorcelain(porcelain);
     for (const wt of worktrees) {
-      const resolved = path49.resolve(wt.path);
-      if (resolved === path49.resolve(repoRoot)) continue;
+      if (repoCandidateCount >= MAX_DUPLICATE_WORKTREE_CANDIDATES_PER_REPO) break;
+      const resolved = path50.resolve(wt.path);
+      if (resolved === path50.resolve(repoRoot)) continue;
       if (!isUnderWorktreesDir(resolved, opts.worktreesDir)) continue;
       if (indexedPaths.has(resolved)) continue;
       if (seen.has(resolved)) continue;
       if (!existsSync38(resolved)) continue;
-      if (!isCleanWorktree(resolved, repoRoot)) continue;
-      const rel = path49.relative(opts.worktreesDir, resolved);
-      const parts = rel.split(path49.sep);
+      const rel = path50.relative(opts.worktreesDir, resolved);
+      const parts = rel.split(path50.sep);
       const runId = parts[0];
       const worker = parts[1] ?? "unknown";
       seen.add(resolved);
+      repoCandidateCount += 1;
       candidates.push({
         kind: "remove_worktree",
         path: resolved,
@@ -11790,12 +12011,22 @@ function scanDuplicateWorktreeCandidates(opts) {
 // src/cleanup-worktree-index.ts
 init_run_store();
 init_util();
-import path50 from "node:path";
+import path51 from "node:path";
+function filterWorktreeIndexForRoot(index, harnessRoot) {
+  const resolvedRoot = path51.resolve(harnessRoot);
+  const scoped = /* @__PURE__ */ new Map();
+  for (const [key, entry] of index) {
+    const entryRoot = entry.harnessRoot ? path51.resolve(entry.harnessRoot) : null;
+    if (entryRoot && entryRoot !== resolvedRoot) continue;
+    scoped.set(key, entry);
+  }
+  return scoped;
+}
 function buildWorktreeIndexAt(harnessRoot) {
   const index = /* @__PURE__ */ new Map();
   for (const run of listRunRecordsForHarnessRoot(harnessRoot)) {
     for (const name of Object.keys(run.workers || {})) {
-      const workerPath = path50.join(
+      const workerPath = path51.join(
         runDirectoryAt(harnessRoot, run.id),
         "workers",
         safeSlug(name),
@@ -11803,9 +12034,9 @@ function buildWorktreeIndexAt(harnessRoot) {
       );
       const worker = readJson(workerPath, void 0);
       if (!worker?.worktreePath) continue;
-      index.set(path50.resolve(worker.worktreePath), {
+      index.set(path51.resolve(worker.worktreePath), {
         harnessRoot,
-        worktreePath: path50.resolve(worker.worktreePath),
+        worktreePath: path51.resolve(worker.worktreePath),
         runId: run.id,
         workerName: name,
         run,
@@ -11831,6 +12062,7 @@ function resolveHarnessRetention(options = {}) {
   const execute = options.execute === true || options.execute !== false && envFlag("KYNVER_CLEANUP_EXECUTE");
   const finalizeStaleRuns2 = options.finalizeStaleRuns !== false && !envFlag("KYNVER_CLEANUP_SKIP_FINALIZE");
   const nodeModulesAgeMs = options.nodeModulesAgeMs ?? envMs("KYNVER_CLEANUP_NODE_MODULES_AGE_MS", DEFAULT_NODE_MODULES_AGE_MS);
+  const scanDependencyCaches = options.scanDependencyCaches ?? (options.nodeModulesAgeMs !== void 0 || process.env.KYNVER_CLEANUP_NODE_MODULES_AGE_MS != null);
   const worktreesAgeMs = options.worktreesAgeMs ?? envMs("KYNVER_CLEANUP_WORKTREES_AGE_MS", 0);
   const terminalWorktreesAgeMs = options.terminalWorktreesAgeMs ?? envMs("KYNVER_CLEANUP_TERMINAL_WORKTREES_AGE_MS", DEFAULT_TERMINAL_WORKTREES_AGE_MS);
   const runDirectoriesAgeMs = options.runDirectoriesAgeMs ?? envMs("KYNVER_CLEANUP_RUN_DIRECTORIES_AGE_MS", DEFAULT_RUN_DIRECTORIES_AGE_MS);
@@ -11846,6 +12078,7 @@ function resolveHarnessRetention(options = {}) {
   return {
     execute,
     finalizeStaleRuns: finalizeStaleRuns2,
+    scanDependencyCaches,
     nodeModulesAgeMs,
     worktreesAgeMs: worktreesAgeMs > 0 ? worktreesAgeMs : 0,
     terminalWorktreesAgeMs: terminalWorktreesAgeMs >= 0 ? terminalWorktreesAgeMs : 0,
@@ -11869,35 +12102,38 @@ function resolvePipelineHarnessRetention(runId) {
     runDirectoriesAgeMs: scopeAll ? DEFAULT_RUN_DIRECTORIES_AGE_MS : void 0,
     includeOrphans: scopeAll ? true : void 0,
     finalizeStaleRuns: true,
-    accountBytes: true
+    accountBytes: true,
+    scanDependencyCaches: true
   });
 }
 
 // src/cleanup-orphan-safety.ts
 init_git();
-import { existsSync as existsSync39, statSync as statSync13 } from "node:fs";
-import path51 from "node:path";
+import { existsSync as existsSync39 } from "node:fs";
+import path52 from "node:path";
+init_util();
 var DEFAULT_HEARTBEAT_FRESH_MS = 30 * 60 * 1e3;
 function assessOrphanWorktreeSafety(input) {
   const now = input.now ?? Date.now();
   const heartbeatFreshMs = input.heartbeatFreshMs ?? DEFAULT_HEARTBEAT_FRESH_MS;
   if (!existsSync39(input.worktreePath)) return null;
   if (input.runId && input.workerName) {
-    const heartbeatPath = path51.join(
+    const workerDir = path52.join(
       input.harnessRoot,
       "runs",
       input.runId,
       "workers",
-      input.workerName,
-      "heartbeat.jsonl"
+      input.workerName
     );
-    try {
-      const mtime = statSync13(heartbeatPath).mtimeMs;
-      if (now - mtime < heartbeatFreshMs) return "active_worker";
-    } catch {
+    const worker = readJson(
+      path52.join(workerDir, "worker.json"),
+      void 0
+    );
+    if (worker && heartbeatContentIsFresh(worker, now, heartbeatFreshMs)) {
+      return "active_worker";
     }
   }
-  const gitDir = path51.join(input.worktreePath, ".git");
+  const gitDir = path52.join(input.worktreePath, ".git");
   if (!existsSync39(gitDir)) return null;
   const porcelain = gitCapture(input.worktreePath, ["status", "--porcelain"]);
   if (porcelain.status !== 0) return "pr_or_unmerged_commits";
@@ -11930,10 +12166,10 @@ function assessOrphanWorktreeSafety(input) {
 init_paths();
 import { existsSync as existsSync40 } from "node:fs";
 import { homedir as homedir13 } from "node:os";
-import path52 from "node:path";
+import path53 from "node:path";
 var WELL_KNOWN_HARNESS_SCAN_ROOTS = [
   "/var/tmp/kynver-harness",
-  path52.join(homedir13(), ".openclaw", "harness")
+  path53.join(homedir13(), ".openclaw", "harness")
 ];
 function addRoot(seen, roots, candidate) {
   if (!candidate?.trim()) return;
@@ -11955,7 +12191,7 @@ function resolveHarnessScanRoots(options = {}) {
   for (const candidate of extra ?? []) addRoot(seen, roots, candidate);
   if (shouldScanWellKnownRoots(options)) {
     for (const candidate of WELL_KNOWN_HARNESS_SCAN_ROOTS) {
-      const resolved = path52.resolve(candidate);
+      const resolved = path53.resolve(candidate);
       if (!seen.has(resolved) && existsSync40(resolved)) addRoot(seen, roots, resolved);
     }
   }
@@ -12034,15 +12270,52 @@ var CleanupGitRevCache = class {
   }
 };
 
+// src/cleanup-git-probe.ts
+import { spawnSync as spawnSync8 } from "node:child_process";
+import { existsSync as existsSync41 } from "node:fs";
+import path54 from "node:path";
+var CLEANUP_GIT_PROBE_TIMEOUT_MS = 5e3;
+function cleanupGitCapture(cwd, args) {
+  if (!existsSync41(path54.join(cwd, ".git"))) {
+    return { status: null, stdout: "", stderr: "", error: "not_a_git_repo" };
+  }
+  try {
+    const res = spawnSync8("git", args, {
+      cwd,
+      encoding: "utf8",
+      timeout: CLEANUP_GIT_PROBE_TIMEOUT_MS
+    });
+    const timedOut = res.error?.message?.includes("ETIMEDOUT") === true;
+    return {
+      status: timedOut ? null : res.status,
+      stdout: res.stdout || "",
+      stderr: res.stderr || "",
+      error: timedOut ? "git_timeout" : res.error ? res.error.message : null
+    };
+  } catch (error) {
+    return {
+      status: null,
+      stdout: "",
+      stderr: "",
+      error: error.message
+    };
+  }
+}
+function gitStatusShortForCleanup(worktreePath) {
+  const captured = cleanupGitCapture(worktreePath, ["status", "--short"]);
+  if (captured.error === "not_a_git_repo") return [];
+  if (captured.error === "git_timeout" || captured.status !== 0) return null;
+  return captured.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+}
+
 // src/cleanup-git-status-cache.ts
-init_git();
 var CleanupGitStatusCache = class {
   cache = /* @__PURE__ */ new Map();
   porcelain(worktreePath) {
     const resolved = worktreePath;
     const cached = this.cache.get(resolved);
     if (cached !== void 0) return cached;
-    const lines = gitStatusShort(resolved);
+    const lines = gitStatusShortForCleanup(resolved) ?? [];
     this.cache.set(resolved, lines);
     return lines;
   }
@@ -12147,9 +12420,9 @@ function mergeWorktreeIndexes(scanRoots) {
 }
 function worktreePathForCandidate(candidate, worktreesDir) {
   if (candidate.runId && candidate.worker) {
-    return path53.join(worktreesDir, candidate.runId, candidate.worker);
+    return path55.join(worktreesDir, candidate.runId, candidate.worker);
   }
-  return path53.resolve(candidate.path, "..");
+  return path55.resolve(candidate.path, "..");
 }
 function runHarnessCleanup(options = {}) {
   let retention = resolveHarnessRetention(options);
@@ -12178,7 +12451,8 @@ function runHarnessCleanup(options = {}) {
   for (const harnessRoot of paths.scanRoots) {
     if (atSweepCap()) break;
     emitCleanupProgress("root", harnessRoot);
-    const worktreesDir = path53.join(harnessRoot, "worktrees");
+    const worktreesDir = path55.join(harnessRoot, "worktrees");
+    const rootIndex = filterWorktreeIndexForRoot(index, harnessRoot);
     const scanOpts = {
       harnessRoot,
       worktreesDir,
@@ -12186,11 +12460,14 @@ function runHarnessCleanup(options = {}) {
       worktreesAgeMs: retention.worktreesAgeMs,
       includeOrphans: retention.includeOrphans,
       runIdFilter: retention.runIdFilter,
-      index,
+      index: rootIndex,
       now: paths.now
     };
-    const dependencyCandidates = scanDependencyCacheCandidates(scanOpts);
-    emitCleanupProgress("dependency", `${dependencyCandidates.length} cache candidate(s) at ${harnessRoot}`);
+    const dependencyCandidates = retention.scanDependencyCaches ? scanDependencyCacheCandidates(scanOpts) : [];
+    emitCleanupProgress(
+      "dependency",
+      retention.scanDependencyCaches ? `${dependencyCandidates.length} cache candidate(s) at ${harnessRoot}` : "skipped (worktree-only sweep)"
+    );
     let dependencyProcessed = 0;
     for (const raw of dependencyCandidates) {
       if (atSweepCap()) break;
@@ -12198,7 +12475,7 @@ function runHarnessCleanup(options = {}) {
       if (dependencyProcessed % 50 === 0) {
         emitCleanupProgress("dependency", `${dependencyProcessed}/${dependencyCandidates.length} evaluated`);
       }
-      const resolved = path53.resolve(raw.path);
+      const resolved = path55.resolve(raw.path);
       if (processedPaths.has(resolved)) continue;
       processedPaths.add(resolved);
       const candidate = { ...raw, path: resolved };
@@ -12209,7 +12486,7 @@ function runHarnessCleanup(options = {}) {
         continue;
       }
       const worktreePath = worktreePathForCandidate(candidate, worktreesDir);
-      const indexed = index.get(path53.resolve(worktreePath)) ?? null;
+      const indexed = rootIndex.get(path55.resolve(worktreePath)) ?? null;
       const guardReason = skipDependencyCacheRemoval({
         indexed,
         includeOrphans: true,
@@ -12232,9 +12509,9 @@ function runHarnessCleanup(options = {}) {
         )
       );
     }
-    for (const raw of scanBuildCacheCandidates(scanOpts)) {
+    if (retention.scanDependencyCaches) for (const raw of scanBuildCacheCandidates(scanOpts)) {
       if (atSweepCap()) break;
-      const resolved = path53.resolve(raw.path);
+      const resolved = path55.resolve(raw.path);
       if (processedPaths.has(resolved)) continue;
       processedPaths.add(resolved);
       const candidate = { ...raw, path: resolved };
@@ -12245,7 +12522,7 @@ function runHarnessCleanup(options = {}) {
         continue;
       }
       const worktreePath = worktreePathForCandidate(candidate, worktreesDir);
-      const indexed = index.get(path53.resolve(worktreePath)) ?? null;
+      const indexed = rootIndex.get(path55.resolve(worktreePath)) ?? null;
       const guardReason = skipBuildCacheRemoval({
         indexed,
         includeOrphans: true,
@@ -12281,11 +12558,11 @@ function runHarnessCleanup(options = {}) {
       if (worktreeProcessed % 50 === 0) {
         emitCleanupProgress("worktrees", `${worktreeProcessed}/${worktreeCandidates.length} evaluated`);
       }
-      const resolved = path53.resolve(raw.path);
+      const resolved = path55.resolve(raw.path);
       if (worktreeSeen.has(resolved)) continue;
       worktreeSeen.add(resolved);
       const candidate = { ...raw, path: resolved };
-      const indexed = index.get(path53.resolve(candidate.path)) ?? null;
+      const indexed = rootIndex.get(path55.resolve(candidate.path)) ?? null;
       const orphanSafety = indexed ? null : assessOrphanWorktreeSafety({
         worktreePath: candidate.path,
         harnessRoot,
@@ -12295,14 +12572,17 @@ function runHarnessCleanup(options = {}) {
       });
       const guardSkip = skipWorktreeRemoval({
         indexed,
-        worktreePath: path53.resolve(candidate.path),
+        worktreePath: path55.resolve(candidate.path),
         includeOrphans: retention.includeOrphans,
         worktreesAgeMs: retention.worktreesAgeMs,
         terminalWorktreesAgeMs: retention.terminalWorktreesAgeMs,
         ageMs: candidate.ageMs,
         orphanSafety,
         worktreeRemovalGuard: options.worktreeRemovalGuard,
-        liveness
+        liveness,
+        now: paths.now,
+        harnessRoot,
+        writeSalvageEvidence: retention.execute
       });
       if (guardSkip) {
         const { reason: guardReason, detail: guardDetail } = normalizeGuardSkip(guardSkip);
@@ -12327,11 +12607,11 @@ function runHarnessCleanup(options = {}) {
         now: paths.now
       })) {
         if (atSweepCap()) break;
-        const resolved = path53.resolve(raw.path);
+        const resolved = path55.resolve(raw.path);
         if (processedPaths.has(resolved)) continue;
         processedPaths.add(resolved);
         const candidate = { ...raw, path: resolved };
-        const runId = candidate.runId ?? path53.basename(resolved);
+        const runId = candidate.runId ?? path55.basename(resolved);
         const dirSkip = skipRunDirectoryRemoval({
           harnessRoot,
           runId,
@@ -12466,7 +12746,7 @@ function isPipelineCleanupEnabled() {
 
 // src/cli.ts
 init_config();
-import { mkdirSync as mkdirSync13, realpathSync } from "node:fs";
+import { mkdirSync as mkdirSync15, realpathSync } from "node:fs";
 import { fileURLToPath as fileURLToPath5 } from "node:url";
 
 // src/bootstrap.ts
@@ -12582,17 +12862,17 @@ function validateDaemonInstallIdentity(config = loadUserConfig(), env = process.
 }
 
 // src/daemon-heartbeat.ts
-import { mkdirSync as mkdirSync7, readFileSync as readFileSync16, renameSync as renameSync3, writeFileSync as writeFileSync4 } from "node:fs";
+import { mkdirSync as mkdirSync9, readFileSync as readFileSync16, renameSync as renameSync4, writeFileSync as writeFileSync5 } from "node:fs";
 import { homedir as homedir14 } from "node:os";
-import path54 from "node:path";
+import path56 from "node:path";
 function daemonHeartbeatPath(agentOsId) {
   const safe = agentOsId.replace(/[^A-Za-z0-9_-]/g, "_");
-  return path54.join(homedir14(), ".kynver", `daemon-heartbeat-${safe}.json`);
+  return path56.join(homedir14(), ".kynver", `daemon-heartbeat-${safe}.json`);
 }
 function writeDaemonHeartbeat(input) {
   try {
     const file = daemonHeartbeatPath(input.agentOsId);
-    mkdirSync7(path54.dirname(file), { recursive: true });
+    mkdirSync9(path56.dirname(file), { recursive: true });
     const beat = {
       observedAt: (input.now ?? /* @__PURE__ */ new Date()).toISOString(),
       pid: process.pid,
@@ -12600,8 +12880,8 @@ function writeDaemonHeartbeat(input) {
       agentOsId: input.agentOsId
     };
     const tmp = `${file}.tmp-${process.pid}`;
-    writeFileSync4(tmp, JSON.stringify(beat), "utf8");
-    renameSync3(tmp, file);
+    writeFileSync5(tmp, JSON.stringify(beat), "utf8");
+    renameSync4(tmp, file);
   } catch {
   }
 }
@@ -12642,9 +12922,9 @@ function assertNativeDaemonAllowed() {
 
 // src/cron/cron-env.ts
 init_config();
-import { existsSync as existsSync41 } from "node:fs";
+import { existsSync as existsSync42 } from "node:fs";
 import { homedir as homedir15 } from "node:os";
-import path55 from "node:path";
+import path57 from "node:path";
 function envFlag4(name, defaultValue) {
   const raw = process.env[name]?.trim().toLowerCase();
   if (!raw) return defaultValue;
@@ -12660,7 +12940,7 @@ function envInt(name, fallback, min = 1) {
 function defaultKynverCronStorePath() {
   const explicit = process.env.KYNVER_CRON_STORE_PATH?.trim() || process.env.OPENCLAW_CRON_STORE_PATH?.trim();
   if (explicit) return explicit;
-  return path55.join(homedir15(), ".kynver", "agent-os-cron.json");
+  return path57.join(homedir15(), ".kynver", "agent-os-cron.json");
 }
 function defaultKynverCronStatePath(storePath = defaultKynverCronStorePath()) {
   const explicit = process.env.KYNVER_CRON_TICK_STATE_PATH?.trim();
@@ -12680,7 +12960,7 @@ function resolveKynverCronEnv() {
   const fireBaseUrl = resolveKynverCronFireBaseUrl();
   const secret = resolveKynverCronSecret();
   const credsReady = Boolean(fireBaseUrl && secret);
-  const storeExists = existsSync41(storePath);
+  const storeExists = existsSync42(storePath);
   const defaultEnabled = credsReady && (storeExists || envFlag4("KYNVER_CRON_TICK_FORCE", false));
   return {
     storePath,
@@ -12734,10 +13014,10 @@ async function fireKynverCronJob(input) {
 
 // src/cron/cron-lock.ts
 init_util();
-import { closeSync as closeSync6, existsSync as existsSync42, openSync as openSync6, readFileSync as readFileSync17, unlinkSync as unlinkSync3, writeFileSync as writeFileSync5 } from "node:fs";
+import { closeSync as closeSync6, existsSync as existsSync43, openSync as openSync6, readFileSync as readFileSync17, unlinkSync as unlinkSync3, writeFileSync as writeFileSync6 } from "node:fs";
 var STALE_LOCK_MS = 10 * 6e4;
 function readLockInfo(lockPath) {
-  if (!existsSync42(lockPath)) return null;
+  if (!existsSync43(lockPath)) return null;
   try {
     const parsed = JSON.parse(readFileSync17(lockPath, "utf8"));
     if (typeof parsed.pid === "number" && typeof parsed.at === "string") return parsed;
@@ -12755,14 +13035,14 @@ function lockIsStale(lockPath) {
   return Date.now() - atMs > STALE_LOCK_MS;
 }
 function tryAcquireCronTickLock(lockPath) {
-  if (existsSync42(lockPath) && !lockIsStale(lockPath)) {
+  if (existsSync43(lockPath) && !lockIsStale(lockPath)) {
     const info = readLockInfo(lockPath);
     return {
       acquired: false,
       reason: info ? `held by pid ${info.pid}` : "held by another process"
     };
   }
-  if (existsSync42(lockPath)) {
+  if (existsSync43(lockPath)) {
     try {
       unlinkSync3(lockPath);
     } catch {
@@ -12770,7 +13050,7 @@ function tryAcquireCronTickLock(lockPath) {
   }
   try {
     const fd = openSync6(lockPath, "wx");
-    writeFileSync5(
+    writeFileSync6(
       fd,
       JSON.stringify({ pid: process.pid, at: (/* @__PURE__ */ new Date()).toISOString() }),
       "utf8"
@@ -12926,7 +13206,7 @@ async function ensureCronStoreInitialized(storePath = defaultKynverCronStorePath
 // src/cron/cron-tick-state.ts
 import { randomBytes } from "node:crypto";
 import { promises as fs4 } from "node:fs";
-import path56 from "node:path";
+import path58 from "node:path";
 var EMPTY = { version: 1, jobs: {} };
 async function readFileIfExists2(filePath) {
   try {
@@ -12953,7 +13233,7 @@ async function loadCronTickState(statePath) {
   return parseCronTickState(raw);
 }
 async function writeStateAtomic(statePath, state) {
-  await fs4.mkdir(path56.dirname(statePath), { recursive: true });
+  await fs4.mkdir(path58.dirname(statePath), { recursive: true });
   const suffix = randomBytes(6).toString("hex");
   const tmp = `${statePath}.tmp-${process.pid}-${Date.now()}-${suffix}`;
   await fs4.writeFile(tmp, `${JSON.stringify(state, null, 2)}
@@ -13133,7 +13413,7 @@ async function runKynverCronTick(opts = {}) {
 init_util();
 
 // src/pipeline-tick.ts
-import path59 from "node:path";
+import path61 from "node:path";
 init_config();
 
 // src/pipeline-dispatch.ts
@@ -13275,7 +13555,7 @@ init_util();
 init_status();
 init_run_store();
 init_util();
-import path57 from "node:path";
+import path59 from "node:path";
 
 // src/plan-progress-sync.ts
 init_config();
@@ -13300,7 +13580,7 @@ async function syncActiveWorkerPlanProgress(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path57.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path59.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.dispatched || !worker.taskId) continue;
@@ -13363,12 +13643,12 @@ init_config();
 init_box_identity();
 
 // src/provider-evidence/exec.ts
-import { spawnSync as spawnSync8 } from "node:child_process";
+import { spawnSync as spawnSync9 } from "node:child_process";
 var DEFAULT_CLI_TIMEOUT_MS = 1e4;
 var MAX_CLI_BUFFER_BYTES = 4 * 1024 * 1024;
 var defaultCliRunner = (cmd, args, opts) => {
   try {
-    const result = spawnSync8(cmd, args, {
+    const result = spawnSync9(cmd, args, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"],
       timeout: opts?.timeoutMs ?? DEFAULT_CLI_TIMEOUT_MS,
@@ -13668,10 +13948,10 @@ function collectProviderEvidence(wanted, opts = {}) {
 // src/provider-evidence/wanted-store.ts
 init_run_store();
 init_util();
-import path58 from "node:path";
+import path60 from "node:path";
 var WANTED_FILE = "provider-evidence-wanted.json";
 function wantedFilePath(runId) {
-  return path58.join(runDirectory(runId), WANTED_FILE);
+  return path60.join(runDirectory(runId), WANTED_FILE);
 }
 function parseWantedItems(value) {
   if (!Array.isArray(value)) return [];
@@ -13710,7 +13990,7 @@ async function completeFinishedWorkers(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path59.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path61.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || worker.localOnly) continue;
@@ -13885,7 +14165,7 @@ import os11 from "node:os";
 // src/chat/anthropic-credentials.ts
 import { readFileSync as readFileSync18 } from "node:fs";
 import { homedir as homedir16, platform } from "node:os";
-import path60 from "node:path";
+import path62 from "node:path";
 import { execFileSync as execFileSync4 } from "node:child_process";
 function parseClaudeCredentials(raw, now = Date.now()) {
   try {
@@ -13913,17 +14193,18 @@ function readClaudeCliToken() {
     }
   }
   try {
-    const raw = readFileSync18(path60.join(homedir16(), ".claude", ".credentials.json"), "utf8");
+    const raw = readFileSync18(path62.join(homedir16(), ".claude", ".credentials.json"), "utf8");
     return parseClaudeCredentials(raw);
   } catch {
     return null;
   }
 }
-function resolveLocalAnthropicCredentials(env = process.env) {
+function resolveLocalAnthropicCredentials(env = process.env, opts = {}) {
   const apiKey = env.ANTHROPIC_API_KEY?.trim();
   if (apiKey) return { kind: "api_key", key: apiKey };
-  const optIn = env.KYNVER_CHAT_USE_CLAUDE_OAUTH;
-  if (optIn === "1" || optIn === "true" || optIn === "yes") {
+  const envOptIn = env.KYNVER_CHAT_USE_CLAUDE_OAUTH;
+  const optedIn = opts.oauthOptIn === true || envOptIn === "1" || envOptIn === "true" || envOptIn === "yes";
+  if (optedIn) {
     const token = readClaudeCliToken();
     if (token) return { kind: "oauth", token };
   }
@@ -14109,20 +14390,43 @@ var CLAIM_WAIT_MS = 25e3;
 var CLAIM_FETCH_TIMEOUT_MS = 32e3;
 var ERROR_BACKOFF_MS = 5e3;
 var AUTH_BACKOFF_MS = 6e4;
+var BRIDGE_REDISCOVER_MS = 5 * 6e4;
+var DISCOVERY_TIMEOUT_MS = 5e3;
 var DEFAULT_CHAT_MODEL = "claude-sonnet-4-6";
-function resolveChatBridgeTarget(env = process.env) {
-  const bridgeUrl = env.KYNVER_RUNTIME_CHAT_BRIDGE_URL?.trim();
-  if (!bridgeUrl) return null;
+async function discoverBridgeUrl(apiBaseUrl, apiKey, env) {
+  const override = env.KYNVER_RUNTIME_CHAT_BRIDGE_URL?.trim();
+  if (override) return override;
+  if (!apiBaseUrl) return null;
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), DISCOVERY_TIMEOUT_MS);
+  try {
+    const res = await fetch(`${apiBaseUrl.replace(/\/$/, "")}/api/runtime/chat-bridge`, {
+      headers: { Authorization: `Bearer ${apiKey}` },
+      signal: controller.signal
+    });
+    if (!res.ok) return null;
+    const body = await res.json().catch(() => null);
+    return typeof body?.bridgeUrl === "string" && body.bridgeUrl.trim() ? body.bridgeUrl.trim() : null;
+  } catch {
+    return null;
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function resolveChatBridgeTarget(env = process.env) {
   const config = loadUserConfig();
   const agentOsId = config.agentOsId?.trim();
   const apiKey = loadApiKey();
   if (!agentOsId || !apiKey) return null;
+  const bridgeUrl = await discoverBridgeUrl(config.apiBaseUrl, apiKey, env);
+  if (!bridgeUrl) return null;
   return {
     bridgeUrl: bridgeUrl.replace(/\/$/, ""),
     agentOsId,
     apiKey,
     boxId: os11.hostname(),
-    model: env.KYNVER_CHAT_MODEL?.trim() || config.defaultModel?.trim() || DEFAULT_CHAT_MODEL
+    model: env.KYNVER_CHAT_MODEL?.trim() || config.defaultModel?.trim() || DEFAULT_CHAT_MODEL,
+    useClaudeOauth: config.chatUseClaudeOauth === true
   };
 }
 async function claimOnce(target, shouldStop) {
@@ -14183,7 +14487,7 @@ async function executeChatTurn(target, turn) {
     });
   };
   const batcher = new DeltaBatcher(sendBatch);
-  const creds = resolveLocalAnthropicCredentials();
+  const creds = resolveLocalAnthropicCredentials(process.env, { oauthOptIn: target.useClaudeOauth });
   if (!creds) {
     await pushEvents(target, turn.turnId, [
       { seq: 0, kind: "error", error: "no_local_credentials" }
@@ -14228,15 +14532,31 @@ async function sleep2(ms, shouldStop) {
   }
 }
 async function runChatClaimLoop(opts) {
-  const target = resolveChatBridgeTarget();
-  if (!target) return;
+  let target = await resolveChatBridgeTarget();
+  if (!target) {
+    console.error(
+      JSON.stringify({
+        event: "chat_claim_loop_waiting",
+        reason: !loadApiKey() || !loadUserConfig().agentOsId?.trim() ? "machine_not_linked" : "bridge_not_discovered (rollout off, discovery route missing/404, or API unreachable)",
+        rediscoverMs: BRIDGE_REDISCOVER_MS
+      })
+    );
+  }
+  while (!target && !opts.shouldStop()) {
+    if (!loadApiKey() || !loadUserConfig().agentOsId?.trim()) return;
+    await sleep2(BRIDGE_REDISCOVER_MS, opts.shouldStop);
+    if (opts.shouldStop()) return;
+    target = await resolveChatBridgeTarget();
+  }
+  if (!target || opts.shouldStop()) return;
   console.error(
     JSON.stringify({
       event: "chat_claim_loop_start",
       bridgeUrl: target.bridgeUrl,
       agentOsId: target.agentOsId,
       boxId: target.boxId,
-      model: target.model
+      model: target.model,
+      useClaudeOauth: target.useClaudeOauth
     })
   );
   while (!opts.shouldStop()) {
@@ -14321,9 +14641,33 @@ async function runDaemon(args) {
       })
     );
   });
+  let credentialMissingLogged = false;
   while (!stopping) {
     try {
       writeDaemonHeartbeat({ agentOsId, runId });
+      const credential = await tryResolveCallbackSecretWithMint(
+        args.secret ? String(args.secret) : void 0,
+        agentOsId
+      );
+      if (!credential.ok) {
+        if (!credentialMissingLogged) {
+          credentialMissingLogged = true;
+          console.error(
+            JSON.stringify({
+              event: "daemon_runner_credential_missing",
+              agentOsId,
+              reason: credential.reason,
+              remedy: `run \`kynver runner credential --agent-os-id ${agentOsId}\` (or \`kynver bootstrap\`); ticks resume automatically once the credential exists`
+            })
+          );
+        }
+        await awaitDaemonBackoff(intervalMs, () => stopping);
+        continue;
+      }
+      if (credentialMissingLogged) {
+        credentialMissingLogged = false;
+        console.error(JSON.stringify({ event: "daemon_runner_credential_recovered", agentOsId }));
+      }
       if (cronEnv.tickEnabled) {
         const cronTick = await runKynverCronTick({
           env: cronEnv,
@@ -14351,108 +14695,6 @@ async function runDaemon(args) {
   console.error(JSON.stringify({ event: "daemon_stop", runId, agentOsId }));
 }
 
-// src/start.ts
-init_run_store();
-function resolveStartRunId(runs, repo) {
-  const candidates = runs.filter((r) => r.repo === repo && !TERMINAL_RUN_STATUSES.has(r.status)).sort((a, b) => (b.createdAt ?? "").localeCompare(a.createdAt ?? ""));
-  return candidates[0]?.id ?? null;
-}
-async function runStart(args) {
-  assertNativeDaemonAllowed();
-  let config = loadUserConfig();
-  if (!loadApiKey() || !config.agentOsId?.trim()) {
-    console.log("  This machine isn't linked yet \u2014 running bootstrap first.");
-    await runBootstrap(args);
-    config = loadUserConfig();
-  }
-  const agentOsId = (typeof args.agentOsId === "string" ? args.agentOsId.trim() : "") || config.agentOsId?.trim() || "";
-  if (!agentOsId) {
-    console.error("No AgentOS workspace configured \u2014 run `kynver bootstrap` (or pass --agent-os-id).");
-    process.exit(1);
-  }
-  const repo = (typeof args.repo === "string" ? args.repo.trim() : "") || config.defaultRepo?.trim() || resolveDefaultRepo()?.repo || "";
-  if (!repo) {
-    console.error("No repo configured \u2014 pass --repo /path/to/repo or run `kynver setup --discover-repo`.");
-    process.exit(1);
-  }
-  let runId = typeof args.run === "string" && args.run.trim() ? args.run.trim() : "";
-  if (!runId) {
-    runId = resolveStartRunId(listRunRecords(), repo) ?? "";
-    if (runId) {
-      console.log(`  Reusing run ${runId} for ${repo}.`);
-    } else {
-      runId = createRun({ ...args, repo, name: "agent" }).runId;
-    }
-  }
-  console.log("");
-  console.log(`  ${os12.hostname()} \u2014 agent coming online`);
-  console.log(`    workspace: ${agentOsId}`);
-  console.log(`    repo:      ${repo}`);
-  console.log(`    run:       ${runId}`);
-  console.log("  Ctrl-C stops the agent. (Advanced control: `kynver daemon --help`.)");
-  console.log("");
-  await runDaemon({ ...args, run: runId, agentOsId });
-}
-
-// src/cli.ts
-init_run_store();
-
-// src/discard-disposable.ts
-init_run_store();
-init_status();
-import { existsSync as existsSync43, rmSync as rmSync4 } from "node:fs";
-import path61 from "node:path";
-function normalizeRelativePath2(value) {
-  const normalized = value.replace(/\\/g, "/").replace(/^\.\//, "").trim();
-  if (!normalized || normalized.startsWith("/") || normalized.includes("..")) {
-    throw new Error(`unsafe path: ${value}`);
-  }
-  return normalized;
-}
-function parsePathsArg(raw) {
-  if (typeof raw !== "string" || !raw.trim()) return [];
-  return raw.split(",").map((p) => p.trim()).filter(Boolean);
-}
-function discardDisposableArtifacts(args) {
-  const { runId, workerName } = resolveWorkerTargetArgs(args);
-  const worker = loadWorker(runId, workerName);
-  const paths = [
-    ...parsePathsArg(args.path),
-    ...Array.isArray(args.paths) ? args.paths : []
-  ];
-  if (paths.length === 0) {
-    return { ok: false, removed: [], reason: "requires at least one --path" };
-  }
-  const worktreeRoot = path61.resolve(worker.worktreePath);
-  const removed = [];
-  for (const raw of paths) {
-    const rel = normalizeRelativePath2(raw);
-    const abs = path61.resolve(worktreeRoot, rel);
-    if (!abs.startsWith(worktreeRoot + path61.sep) && abs !== worktreeRoot) {
-      return { ok: false, removed, reason: `path escapes worktree: ${raw}` };
-    }
-    if (!existsSync43(abs)) {
-      return { ok: false, removed, reason: `path not found: ${raw}` };
-    }
-    rmSync4(abs, { recursive: true, force: true });
-    removed.push(rel);
-  }
-  const prior = Array.isArray(worker.disposableArtifactsRemoved) ? worker.disposableArtifactsRemoved.filter((p) => typeof p === "string") : [];
-  worker.disposableArtifactsRemoved = [.../* @__PURE__ */ new Set([...prior, ...removed])];
-  saveWorker(worker.runId, worker);
-  const status = computeWorkerStatus(worker);
-  return {
-    ok: true,
-    removed,
-    ...status.changedFiles.length ? { reason: "worktree still has other changes" } : {}
-  };
-}
-function discardDisposableCli(args) {
-  const result = discardDisposableArtifacts(args);
-  console.log(JSON.stringify(result, null, 2));
-  if (!result.ok) process.exit(1);
-}
-
 // src/daemon-keeper.ts
 init_config();
 import { spawn as spawn6 } from "node:child_process";
@@ -14584,9 +14826,134 @@ async function runDaemonKeeper(args, rawArgv = process.argv.slice(2)) {
   keeperLog("stopped", { agentOsId });
 }
 
+// src/start.ts
+init_run_store();
+function resolveStartRunId(runs, repo) {
+  const candidates = runs.filter((r) => r.repo === repo && !TERMINAL_RUN_STATUSES.has(r.status)).sort((a, b) => (b.createdAt ?? "").localeCompare(a.createdAt ?? ""));
+  return candidates[0]?.id ?? null;
+}
+async function runStart(args) {
+  assertNativeDaemonAllowed();
+  let config = loadUserConfig();
+  if (!loadApiKey() || !config.agentOsId?.trim()) {
+    console.log("  This machine isn't linked yet \u2014 running bootstrap first.");
+    await runBootstrap(args);
+    config = loadUserConfig();
+  }
+  const agentOsId = (typeof args.agentOsId === "string" ? args.agentOsId.trim() : "") || config.agentOsId?.trim() || "";
+  if (!agentOsId) {
+    console.error("No AgentOS workspace configured \u2014 run `kynver bootstrap` (or pass --agent-os-id).");
+    process.exit(1);
+  }
+  if (args.chatOauth === true && config.chatUseClaudeOauth !== true) {
+    saveUserConfig({ ...config, chatUseClaudeOauth: true });
+    config = loadUserConfig();
+    console.log("  Chat: Claude Code OAuth opt-in saved (delegated turns may use your local subscription).");
+  }
+  const repo = (typeof args.repo === "string" ? args.repo.trim() : "") || config.defaultRepo?.trim() || resolveDefaultRepo()?.repo || "";
+  if (!repo) {
+    console.error("No repo configured \u2014 pass --repo /path/to/repo or run `kynver setup --discover-repo`.");
+    process.exit(1);
+  }
+  let runId = typeof args.run === "string" && args.run.trim() ? args.run.trim() : "";
+  if (!runId) {
+    runId = resolveStartRunId(listRunRecords(), repo) ?? "";
+    if (runId) {
+      console.log(`  Reusing run ${runId} for ${repo}.`);
+    } else {
+      runId = createRun({ ...args, repo, name: "agent" }).runId;
+    }
+  }
+  console.log("");
+  console.log(`  ${os12.hostname()} \u2014 agent coming online`);
+  console.log(`    workspace: ${agentOsId}`);
+  console.log(`    repo:      ${repo}`);
+  console.log(`    run:       ${runId}`);
+  console.log("  Ctrl-C stops the agent. (Advanced control: `kynver daemon --help`.)");
+  console.log("");
+  const daemonArgs = { ...args, run: runId, agentOsId };
+  if (shouldRunDaemonKeeper(daemonArgs)) {
+    await runDaemonKeeper(daemonArgs, buildStartDaemonArgv(runId, agentOsId, args));
+    return;
+  }
+  await runDaemon(daemonArgs);
+}
+function buildStartDaemonArgv(runId, agentOsId, args) {
+  const argv = ["daemon", "--run", runId, "--agent-os-id", agentOsId];
+  if (typeof args.intervalMs === "string" && args.intervalMs.trim()) {
+    argv.push("--interval-ms", args.intervalMs.trim());
+  }
+  if (args.execute === false || args.execute === "false") {
+    argv.push("--execute", "false");
+  }
+  if (typeof args.stallMs === "string" && args.stallMs.trim()) {
+    argv.push("--stall-ms", args.stallMs.trim());
+  }
+  return argv;
+}
+
+// src/cli.ts
+init_run_store();
+
+// src/discard-disposable.ts
+init_run_store();
+init_status();
+import { existsSync as existsSync44, rmSync as rmSync4 } from "node:fs";
+import path63 from "node:path";
+function normalizeRelativePath2(value) {
+  const normalized = value.replace(/\\/g, "/").replace(/^\.\//, "").trim();
+  if (!normalized || normalized.startsWith("/") || normalized.includes("..")) {
+    throw new Error(`unsafe path: ${value}`);
+  }
+  return normalized;
+}
+function parsePathsArg(raw) {
+  if (typeof raw !== "string" || !raw.trim()) return [];
+  return raw.split(",").map((p) => p.trim()).filter(Boolean);
+}
+function discardDisposableArtifacts(args) {
+  const { runId, workerName } = resolveWorkerTargetArgs(args);
+  const worker = loadWorker(runId, workerName);
+  const paths = [
+    ...parsePathsArg(args.path),
+    ...Array.isArray(args.paths) ? args.paths : []
+  ];
+  if (paths.length === 0) {
+    return { ok: false, removed: [], reason: "requires at least one --path" };
+  }
+  const worktreeRoot = path63.resolve(worker.worktreePath);
+  const removed = [];
+  for (const raw of paths) {
+    const rel = normalizeRelativePath2(raw);
+    const abs = path63.resolve(worktreeRoot, rel);
+    if (!abs.startsWith(worktreeRoot + path63.sep) && abs !== worktreeRoot) {
+      return { ok: false, removed, reason: `path escapes worktree: ${raw}` };
+    }
+    if (!existsSync44(abs)) {
+      return { ok: false, removed, reason: `path not found: ${raw}` };
+    }
+    rmSync4(abs, { recursive: true, force: true });
+    removed.push(rel);
+  }
+  const prior = Array.isArray(worker.disposableArtifactsRemoved) ? worker.disposableArtifactsRemoved.filter((p) => typeof p === "string") : [];
+  worker.disposableArtifactsRemoved = [.../* @__PURE__ */ new Set([...prior, ...removed])];
+  saveWorker(worker.runId, worker);
+  const status = computeWorkerStatus(worker);
+  return {
+    ok: true,
+    removed,
+    ...status.changedFiles.length ? { reason: "worktree still has other changes" } : {}
+  };
+}
+function discardDisposableCli(args) {
+  const result = discardDisposableArtifacts(args);
+  console.log(JSON.stringify(result, null, 2));
+  if (!result.ok) process.exit(1);
+}
+
 // src/plan-progress.ts
 init_config();
-import path65 from "node:path";
+import path67 from "node:path";
 
 // src/bounded-build/constants.ts
 var DEFAULT_BUILD_MEM_BUDGET_BYTES = 1536 * 1024 * 1024;
@@ -14627,7 +14994,7 @@ function formatNodeOptionsFlag(mb = resolveNodeOldSpaceSizeMb()) {
 }
 
 // src/bounded-build/systemd-wrap.ts
-import { spawnSync as spawnSync9 } from "node:child_process";
+import { spawnSync as spawnSync10 } from "node:child_process";
 var systemdAvailableCache;
 function isSystemdRunAvailable() {
   if (process.env.KYNVER_BUILD_SKIP_SYSTEMD === "1" || process.env.KYNVER_BUILD_SKIP_SYSTEMD === "true") {
@@ -14638,7 +15005,7 @@ function isSystemdRunAvailable() {
     systemdAvailableCache = false;
     return false;
   }
-  const res = spawnSync9("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
+  const res = spawnSync10("systemd-run", ["--version"], { encoding: "utf8", stdio: ["ignore", "ignore", "pipe"] });
   systemdAvailableCache = res.status === 0;
   return systemdAvailableCache;
 }
@@ -14663,7 +15030,7 @@ function buildSystemdRunArgv(opts) {
 
 // src/bounded-build/admission.ts
 init_config();
-import { spawnSync as spawnSync10 } from "node:child_process";
+import { spawnSync as spawnSync11 } from "node:child_process";
 init_meminfo();
 function positiveInt4(value, fallback) {
   const n = Number(value);
@@ -14700,7 +15067,7 @@ function assessBuildAdmission(opts = {}) {
 }
 function sleepMs2(ms) {
   if (ms <= 0) return;
-  spawnSync10(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync11(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -14721,34 +15088,34 @@ function waitForBuildAdmission(timeoutMs, pollMs = 2e3, opts = {}) {
 }
 
 // src/bounded-build/exec.ts
-import { spawnSync as spawnSync12 } from "node:child_process";
+import { spawnSync as spawnSync13 } from "node:child_process";
 
 // src/heavy-verification/slot.ts
 init_util();
 import {
   closeSync as closeSync7,
-  existsSync as existsSync44,
-  mkdirSync as mkdirSync9,
+  existsSync as existsSync45,
+  mkdirSync as mkdirSync11,
   openSync as openSync7,
-  readdirSync as readdirSync15,
+  readdirSync as readdirSync14,
   readFileSync as readFileSync19,
   unlinkSync as unlinkSync4,
-  writeFileSync as writeFileSync6
+  writeFileSync as writeFileSync7
 } from "node:fs";
-import path63 from "node:path";
+import path65 from "node:path";
 
 // src/heavy-verification/paths.ts
-import { mkdirSync as mkdirSync8 } from "node:fs";
-import path62 from "node:path";
+import { mkdirSync as mkdirSync10 } from "node:fs";
+import path64 from "node:path";
 function resolveHeavyVerificationRoot() {
-  return path62.join(resolveKynverStateRoot(), "heavy-verification");
+  return path64.join(resolveKynverStateRoot(), "heavy-verification");
 }
 function heavyVerificationSlotsDir() {
-  return path62.join(resolveHeavyVerificationRoot(), "slots");
+  return path64.join(resolveHeavyVerificationRoot(), "slots");
 }
 function ensureHeavyVerificationDirs() {
   const dir = heavyVerificationSlotsDir();
-  mkdirSync8(dir, { recursive: true });
+  mkdirSync10(dir, { recursive: true });
   return dir;
 }
 
@@ -14773,10 +15140,10 @@ function indexedSlotId(index) {
   return `slot-${index}`;
 }
 function slotFilePath(slotId, slotsDir = heavyVerificationSlotsDir()) {
-  return path63.join(slotsDir, `${slotId}.json`);
+  return path65.join(slotsDir, `${slotId}.json`);
 }
 function readSlotRecord(filePath) {
-  if (!existsSync44(filePath)) return null;
+  if (!existsSync45(filePath)) return null;
   try {
     const parsed = JSON.parse(readFileSync19(filePath, "utf8"));
     if (typeof parsed.slotId === "string" && typeof parsed.pid === "number" && typeof parsed.acquiredAt === "string" && typeof parsed.command === "string") {
@@ -14803,19 +15170,19 @@ function reclaimStaleSlot(filePath, staleMs) {
   }
 }
 function ensureSlotsDir(slotsDir) {
-  mkdirSync9(slotsDir, { recursive: true });
+  mkdirSync11(slotsDir, { recursive: true });
   return slotsDir;
 }
 function reclaimStaleHeavyVerificationSlots(opts = {}) {
   const slotsDir = ensureSlotsDir(opts.slotsDir ?? ensureHeavyVerificationDirs());
   const staleMs = opts.staleMs ?? DEFAULT_HEAVY_VERIFICATION_STALE_MS;
   let reclaimed = 0;
-  for (const name of readdirSync15(slotsDir)) {
+  for (const name of readdirSync14(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const filePath = path63.join(slotsDir, name);
-    const before = existsSync44(filePath);
+    const filePath = path65.join(slotsDir, name);
+    const before = existsSync45(filePath);
     reclaimStaleSlot(filePath, staleMs);
-    if (before && !existsSync44(filePath)) reclaimed += 1;
+    if (before && !existsSync45(filePath)) reclaimed += 1;
   }
   return reclaimed;
 }
@@ -14824,9 +15191,9 @@ function listActiveHeavyVerificationSlots(opts = {}) {
   const staleMs = opts.staleMs ?? DEFAULT_HEAVY_VERIFICATION_STALE_MS;
   reclaimStaleHeavyVerificationSlots({ slotsDir, staleMs });
   const active = [];
-  for (const name of readdirSync15(slotsDir)) {
+  for (const name of readdirSync14(slotsDir)) {
     if (!name.endsWith(".json")) continue;
-    const record3 = readSlotRecord(path63.join(slotsDir, name));
+    const record3 = readSlotRecord(path65.join(slotsDir, name));
     if (record3 && !slotIsStale(record3, staleMs)) active.push(record3);
   }
   return active;
@@ -14868,7 +15235,7 @@ function tryAcquireHeavyVerificationSlot(command, opts = {}) {
     };
     try {
       const fd = openSync7(filePath, "wx");
-      writeFileSync6(fd, JSON.stringify(record3, null, 2), "utf8");
+      writeFileSync7(fd, JSON.stringify(record3, null, 2), "utf8");
       closeSync7(fd);
       const activeSlots2 = countActiveHeavyVerificationSlots({ slotsDir, staleMs });
       return {
@@ -14928,10 +15295,10 @@ function assessHeavyVerificationGate(command, opts = {}) {
 }
 
 // src/heavy-verification/gate.ts
-import { spawnSync as spawnSync11 } from "node:child_process";
+import { spawnSync as spawnSync12 } from "node:child_process";
 function sleepMs3(ms) {
   if (ms <= 0) return;
-  spawnSync11(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
+  spawnSync12(process.execPath, ["-e", `const d=Date.now()+${Math.floor(ms)};while(Date.now()<d);`], {
     stdio: "ignore"
   });
 }
@@ -14947,11 +15314,11 @@ function waitForHeavyVerificationSlot(command, timeoutMs, pollMs = 2e3, opts = {
 
 // src/harness-worktree-build-guard.ts
 init_paths();
-import path64 from "node:path";
+import path66 from "node:path";
 function isPathUnderHarnessWorktree(cwd) {
   const worktreesDir = harnessWorktreesDir(resolveHarnessRoot());
-  const rel = path64.relative(worktreesDir, path64.resolve(cwd));
-  return rel.length > 0 && !rel.startsWith("..") && !path64.isAbsolute(rel);
+  const rel = path66.relative(worktreesDir, path66.resolve(cwd));
+  return rel.length > 0 && !rel.startsWith("..") && !path66.isAbsolute(rel);
 }
 function assessHarnessWorktreeBuildGuard(cwd) {
   if (!isPathUnderHarnessWorktree(cwd)) return { ok: true };
@@ -14975,7 +15342,7 @@ function envArgv(env) {
   return out;
 }
 function runSpawn(argv, opts) {
-  const res = spawnSync12(argv[0], argv.slice(1), {
+  const res = spawnSync13(argv[0], argv.slice(1), {
     cwd: opts.cwd,
     env: opts.env,
     encoding: "utf8",
@@ -15164,7 +15531,7 @@ async function emitPlanProgress(args) {
 }
 function verifyPlanLocal(args) {
   const worktree = required(args.worktree ? String(args.worktree) : void 0, "worktree");
-  const cwd = path65.resolve(worktree);
+  const cwd = path67.resolve(worktree);
   const summary = runHarnessVerifyCommands(cwd);
   const emitJson = args.json === true || args.json === "true";
   const payload = { passed: summary.passed, worktree: cwd, steps: summary.steps };
@@ -15213,10 +15580,10 @@ async function verifyPlan(args) {
 }
 
 // src/harness-verify-cli.ts
-import path66 from "node:path";
+import path68 from "node:path";
 init_util();
 function runHarnessVerifyCli(args) {
-  const cwd = path66.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
+  const cwd = path68.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
   const emitJson = args.json === true || args.json === "true" || args.emitJson === true || args.emitJson === "true";
   const commands = [];
   const rawCmd = args.command;
@@ -15348,7 +15715,9 @@ function runCleanupCli(args) {
   const skipFinalize = args.skipFinalize === true || args.skipFinalize === "true";
   const accountBytes = args.accountBytes === true || args.accountBytes === "true";
   const compact = args.compact === true || args.compact === "true";
-  const nodeModulesAgeMs = args.nodeModulesAgeMs ? Number(args.nodeModulesAgeMs) : DEFAULT_NODE_MODULES_AGE_MS;
+  const nodeModulesAgeMsRaw = args.nodeModulesAgeMs;
+  const scanDependencyCaches = nodeModulesAgeMsRaw != null && nodeModulesAgeMsRaw !== "";
+  const nodeModulesAgeMs = scanDependencyCaches ? Number(nodeModulesAgeMsRaw) : void 0;
   const worktreesAgeMs = args.worktreesAgeMs ? Number(args.worktreesAgeMs) : 0;
   const includeOrphans = args.includeOrphans === true || args.includeOrphans === "true";
   const harnessRoot = args.harnessRoot ? String(args.harnessRoot) : void 0;
@@ -15356,7 +15725,8 @@ function runCleanupCli(args) {
     execute,
     finalizeStaleRuns: !skipFinalize,
     accountBytes,
-    nodeModulesAgeMs: Number.isFinite(nodeModulesAgeMs) ? nodeModulesAgeMs : DEFAULT_NODE_MODULES_AGE_MS,
+    scanDependencyCaches,
+    nodeModulesAgeMs: nodeModulesAgeMs !== void 0 && Number.isFinite(nodeModulesAgeMs) ? nodeModulesAgeMs : scanDependencyCaches ? DEFAULT_NODE_MODULES_AGE_MS : void 0,
     worktreesAgeMs: Number.isFinite(worktreesAgeMs) ? worktreesAgeMs : 0,
     includeOrphans,
     harnessRoot
@@ -15655,7 +16025,7 @@ ${text.slice(0, 800)}`,
 }
 
 // src/monitor/monitor.service.ts
-import path68 from "node:path";
+import path70 from "node:path";
 init_run_store();
 init_status();
 init_util();
@@ -15714,19 +16084,19 @@ function classifyWorkerHealth(input) {
 // src/monitor/monitor.store.ts
 init_paths();
 init_util();
-import { existsSync as existsSync45, mkdirSync as mkdirSync10, readdirSync as readdirSync16, unlinkSync as unlinkSync5 } from "node:fs";
-import path67 from "node:path";
+import { existsSync as existsSync46, mkdirSync as mkdirSync12, readdirSync as readdirSync15, unlinkSync as unlinkSync5 } from "node:fs";
+import path69 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path67.join(harnessRoot, "monitors");
-  mkdirSync10(dir, { recursive: true });
+  const dir = path69.join(harnessRoot, "monitors");
+  mkdirSync12(dir, { recursive: true });
   return dir;
 }
 function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path67.join(monitorsDir(), `${monitorId}.json`);
+  return path69.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -15736,18 +16106,18 @@ function saveMonitorSession(session) {
 }
 function deleteMonitorSession(monitorId) {
   const file = monitorPath(monitorId);
-  if (!existsSync45(file)) return false;
+  if (!existsSync46(file)) return false;
   unlinkSync5(file);
   return true;
 }
 function listMonitorSessions() {
   const dir = monitorsDir();
-  if (!existsSync45(dir)) return [];
+  if (!existsSync46(dir)) return [];
   const entries = [];
-  for (const name of readdirSync16(dir)) {
+  for (const name of readdirSync15(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path67.join(dir, name),
+      path69.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -15840,7 +16210,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path68.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path70.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -16049,18 +16419,18 @@ async function runMonitorLoop(args) {
 init_util();
 init_paths();
 import { spawn as spawn7 } from "node:child_process";
-import { closeSync as closeSync8, existsSync as existsSync46, openSync as openSync8 } from "node:fs";
-import path69 from "node:path";
+import { closeSync as closeSync8, existsSync as existsSync47, openSync as openSync8 } from "node:fs";
+import path71 from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path69.join(fileURLToPath4(new URL(".", import.meta.url)), "cli.js");
+  return path71.join(fileURLToPath4(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
-  if (!existsSync46(cliPath)) return void 0;
+  if (!existsSync47(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path69.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path71.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
     logFd = openSync8(logPath, "a");
@@ -16185,7 +16555,7 @@ init_run_store();
 init_status();
 init_util();
 init_config();
-import path70 from "node:path";
+import path72 from "node:path";
 function skip(runId, worker, taskId, agentOsId, leaseOwner, reason) {
   return { runId, worker, taskId, agentOsId, leaseOwner, action: "skipped", reason };
 }
@@ -16198,7 +16568,7 @@ async function postRestartUnblock(args) {
   const errors = [];
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers ?? {})) {
-      const workerPath = path70.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path72.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker) {
         skipped.push(skip(run.id, name, "", "", "", "worker.json missing"));
@@ -16312,9 +16682,9 @@ async function postRestartUnblockCli(args) {
 // src/default-repo-cli.ts
 init_path_values();
 init_config();
-import path71 from "node:path";
+import path73 from "node:path";
 import { homedir as homedir17 } from "node:os";
-var CONFIG_FILE2 = path71.join(homedir17(), ".kynver", "config.json");
+var CONFIG_FILE2 = path73.join(homedir17(), ".kynver", "config.json");
 function ensureDefaultRepo(opts) {
   const existing = loadUserConfig();
   const resolved = resolveDefaultRepo({ ...opts, config: existing });
@@ -16395,19 +16765,19 @@ function summarizeResolvedDefaultRepo(resolved) {
 }
 
 // src/doctor/runtime-takeover.ts
-import path73 from "node:path";
+import path75 from "node:path";
 init_path_values();
 
 // src/doctor/runtime-takeover.probes.ts
 init_config();
-import { accessSync, constants, existsSync as existsSync47, readFileSync as readFileSync21 } from "node:fs";
+import { accessSync, constants, existsSync as existsSync48, readFileSync as readFileSync21 } from "node:fs";
 import { homedir as homedir18 } from "node:os";
-import path72 from "node:path";
-import { spawnSync as spawnSync13 } from "node:child_process";
+import path74 from "node:path";
+import { spawnSync as spawnSync14 } from "node:child_process";
 init_paths();
 function captureCommand(bin, args) {
   try {
-    const res = spawnSync13(bin, args, { encoding: "utf8" });
+    const res = spawnSync14(bin, args, { encoding: "utf8" });
     const stdout = (res.stdout || "").trim();
     const stderr = (res.stderr || "").trim();
     const ok = res.status === 0;
@@ -16432,7 +16802,7 @@ function tokenPrefix(token) {
   return trimmed.length <= 12 ? `${trimmed}\u2026` : `${trimmed.slice(0, 12)}\u2026`;
 }
 function isWritable(target) {
-  if (!existsSync47(target)) return false;
+  if (!existsSync48(target)) return false;
   try {
     accessSync(target, constants.W_OK);
     return true;
@@ -16445,11 +16815,11 @@ var defaultRuntimeTakeoverProbes = {
   commandOnPath: (bin) => captureCommand(process.platform === "win32" ? "where" : "which", [bin]),
   kynverVersion: (bin) => captureCommand(bin, ["--version"]),
   loadConfig: () => loadUserConfig(),
-  configFilePath: () => path72.join(homedir18(), ".kynver", "config.json"),
-  credentialsFilePath: () => path72.join(homedir18(), ".kynver", "credentials"),
+  configFilePath: () => path74.join(homedir18(), ".kynver", "config.json"),
+  credentialsFilePath: () => path74.join(homedir18(), ".kynver", "credentials"),
   readCredentials: () => {
-    const credPath = path72.join(homedir18(), ".kynver", "credentials");
-    if (!existsSync47(credPath)) {
+    const credPath = path74.join(homedir18(), ".kynver", "credentials");
+    if (!existsSync48(credPath)) {
       return { hasApiKey: false };
     }
     try {
@@ -16483,8 +16853,8 @@ var defaultRuntimeTakeoverProbes = {
     })()
   }),
   harnessRoot: () => resolveHarnessRoot(),
-  legacyOpenclawHarnessRoot: () => path72.join(homedir18(), ".openclaw", "harness"),
-  pathExists: (target) => existsSync47(target),
+  legacyOpenclawHarnessRoot: () => path74.join(homedir18(), ".openclaw", "harness"),
+  pathExists: (target) => existsSync48(target),
   pathWritable: (target) => isWritable(target)
 };
 
@@ -16890,8 +17260,8 @@ function assessVercelDeployEvidence(probes) {
 }
 function assessHarnessDirs(probes) {
   const harnessRoot = probes.harnessRoot();
-  const runsDir = path73.join(harnessRoot, "runs");
-  const worktreesDir = path73.join(harnessRoot, "worktrees");
+  const runsDir = path75.join(harnessRoot, "runs");
+  const worktreesDir = path75.join(harnessRoot, "worktrees");
   const displayHarnessRoot = redactHomePath(harnessRoot);
   const displayRunsDir = redactHomePath(runsDir);
   const displayWorktreesDir = redactHomePath(worktreesDir);
@@ -17160,9 +17530,9 @@ function applySchedulerCutoverAttestation(config) {
 
 // src/scheduler-cutover-cli.ts
 init_config();
-import path74 from "node:path";
+import path76 from "node:path";
 import { homedir as homedir19 } from "node:os";
-var CONFIG_FILE3 = path74.join(homedir19(), ".kynver", "config.json");
+var CONFIG_FILE3 = path76.join(homedir19(), ".kynver", "config.json");
 function runSchedulerCutoverCheckCli(json = false) {
   const config = loadUserConfig();
   const report = assessSchedulerCutover(config);
@@ -17306,7 +17676,7 @@ init_config();
 init_config();
 init_path_values();
 init_util();
-import { existsSync as existsSync51 } from "node:fs";
+import { existsSync as existsSync52 } from "node:fs";
 
 // src/cron/cron-id.ts
 import { createHash as createHash5 } from "node:crypto";
@@ -17325,13 +17695,13 @@ function deterministicCronProviderId(spec) {
 
 // src/cron/cron-install-plan.ts
 import { homedir as homedir21 } from "node:os";
-import path76 from "node:path";
+import path78 from "node:path";
 
 // src/cron/cron-env-file.ts
-import { existsSync as existsSync48, mkdirSync as mkdirSync11, readFileSync as readFileSync22, writeFileSync as writeFileSync7 } from "node:fs";
+import { existsSync as existsSync49, mkdirSync as mkdirSync13, readFileSync as readFileSync22, writeFileSync as writeFileSync8 } from "node:fs";
 import { homedir as homedir20 } from "node:os";
-import path75 from "node:path";
-var DEFAULT_KYNVER_ENV_FILE = path75.join(homedir20(), ".kynver", ".env");
+import path77 from "node:path";
+var DEFAULT_KYNVER_ENV_FILE = path77.join(homedir20(), ".kynver", ".env");
 function parseEnvFile(content) {
   const map = /* @__PURE__ */ new Map();
   for (const line of content.split(/\r?\n/)) {
@@ -17358,12 +17728,12 @@ function serializeEnvFile(values, header = "# Managed by kynver cron install \u2
   return lines.join("\n");
 }
 function readEnvFile(filePath = DEFAULT_KYNVER_ENV_FILE) {
-  if (!existsSync48(filePath)) return /* @__PURE__ */ new Map();
+  if (!existsSync49(filePath)) return /* @__PURE__ */ new Map();
   return parseEnvFile(readFileSync22(filePath, "utf8"));
 }
 function mergeEnvFile(updates, options = {}) {
   const filePath = options.filePath ?? DEFAULT_KYNVER_ENV_FILE;
-  const existing = existsSync48(filePath) ? readFileSync22(filePath, "utf8") : "";
+  const existing = existsSync49(filePath) ? readFileSync22(filePath, "utf8") : "";
   const map = parseEnvFile(existing);
   const keysWritten = [];
   const keysRemoved = [];
@@ -17388,8 +17758,8 @@ function mergeEnvFile(updates, options = {}) {
   }
   const nextContent = serializeEnvFile(map);
   if (changed) {
-    mkdirSync11(path75.dirname(filePath), { recursive: true });
-    writeFileSync7(filePath, nextContent, { mode: 384 });
+    mkdirSync13(path77.dirname(filePath), { recursive: true });
+    writeFileSync8(filePath, nextContent, { mode: 384 });
   }
   return { path: filePath, changed, keysWritten, keysRemoved };
 }
@@ -17406,7 +17776,7 @@ var VERCEL_KYNVER_CRON_CUTOVER_STEPS = [
 function buildCronInstallPlan(input) {
   const storePath = input.storePath?.trim() || defaultKynverCronStorePath();
   const envFilePath = input.envFilePath?.trim() || DEFAULT_KYNVER_ENV_FILE;
-  const configPath = path76.join(homedir21(), ".kynver", "config.json");
+  const configPath = path78.join(homedir21(), ".kynver", "config.json");
   const callbackPath = `/api/agent-os/by-id/${input.agentOsId}/scheduler/fire`;
   const prerequisites = [];
   if (!input.apiBaseUrl?.trim()) prerequisites.push("apiBaseUrl \u2014 run `kynver setup --api-base-url \u2026`");
@@ -17558,13 +17928,13 @@ function resolveCronSecretForInstall(envFilePath = DEFAULT_KYNVER_ENV_FILE) {
 }
 
 // src/cron/cron-install-systemd.ts
-import { existsSync as existsSync49, mkdirSync as mkdirSync12, writeFileSync as writeFileSync8 } from "node:fs";
+import { existsSync as existsSync50, mkdirSync as mkdirSync14, writeFileSync as writeFileSync9 } from "node:fs";
 import { homedir as homedir22 } from "node:os";
-import path77 from "node:path";
-import { spawnSync as spawnSync14 } from "node:child_process";
+import path79 from "node:path";
+import { spawnSync as spawnSync15 } from "node:child_process";
 var KYNVER_CRON_DAEMON_UNIT = "kynver-cron-daemon.service";
 function defaultSystemdUserUnitDir() {
-  return path77.join(homedir22(), ".config", "systemd", "user");
+  return path79.join(homedir22(), ".config", "systemd", "user");
 }
 function renderKynverCronDaemonService(input) {
   const kynverBin = input.kynverBin?.trim() || "kynver";
@@ -17597,7 +17967,7 @@ function installSystemdUserDaemon(input, execute) {
     };
   }
   const unitDir = defaultSystemdUserUnitDir();
-  const unitPath = path77.join(unitDir, KYNVER_CRON_DAEMON_UNIT);
+  const unitPath = path79.join(unitDir, KYNVER_CRON_DAEMON_UNIT);
   const content = renderKynverCronDaemonService(input);
   if (!execute) {
     return {
@@ -17609,10 +17979,10 @@ function installSystemdUserDaemon(input, execute) {
       note: "Dry-run \u2014 pass --execute to write and enable the user unit."
     };
   }
-  mkdirSync12(unitDir, { recursive: true });
-  const existed = existsSync49(unitPath);
-  writeFileSync8(unitPath, content, "utf8");
-  const reload = spawnSync14("systemctl", ["--user", "daemon-reload"], { encoding: "utf8" });
+  mkdirSync14(unitDir, { recursive: true });
+  const existed = existsSync50(unitPath);
+  writeFileSync9(unitPath, content, "utf8");
+  const reload = spawnSync15("systemctl", ["--user", "daemon-reload"], { encoding: "utf8" });
   if (reload.status !== 0) {
     return {
       supported: true,
@@ -17623,7 +17993,7 @@ function installSystemdUserDaemon(input, execute) {
       note: `Wrote ${unitPath} but systemctl --user daemon-reload failed: ${reload.stderr || reload.stdout}`
     };
   }
-  const enable = spawnSync14("systemctl", ["--user", "enable", "--now", KYNVER_CRON_DAEMON_UNIT], {
+  const enable = spawnSync15("systemctl", ["--user", "enable", "--now", KYNVER_CRON_DAEMON_UNIT], {
     encoding: "utf8"
   });
   return {
@@ -17637,7 +18007,7 @@ function installSystemdUserDaemon(input, execute) {
 }
 
 // src/cron/cron-install-verify.ts
-import { existsSync as existsSync50 } from "node:fs";
+import { existsSync as existsSync51 } from "node:fs";
 async function verifyCronInstall(input) {
   const envFilePath = input.envFilePath ?? DEFAULT_KYNVER_ENV_FILE;
   const checks = [];
@@ -17670,14 +18040,14 @@ async function verifyCronInstall(input) {
   });
   checks.push({
     id: "env_file",
-    ok: existsSync50(envFilePath) && Boolean(fileEnv.get("KYNVER_CRON_SECRET")),
-    summary: existsSync50(envFilePath) ? `~/.kynver/.env present (${fileEnv.size} keys)` : "~/.kynver/.env missing",
+    ok: existsSync51(envFilePath) && Boolean(fileEnv.get("KYNVER_CRON_SECRET")),
+    summary: existsSync51(envFilePath) ? `~/.kynver/.env present (${fileEnv.size} keys)` : "~/.kynver/.env missing",
     remediation: "Run `kynver cron install` to write ~/.kynver/.env."
   });
   checks.push({
     id: "cron_store",
-    ok: existsSync50(env.storePath),
-    summary: existsSync50(env.storePath) ? `cron store present (${env.storePath})` : `cron store missing (${env.storePath})`,
+    ok: existsSync51(env.storePath),
+    summary: existsSync51(env.storePath) ? `cron store present (${env.storePath})` : `cron store missing (${env.storePath})`,
     remediation: "Run `kynver cron install` to initialize the local store."
   });
   const jobs = await loadCronJobs(env.storePath).catch(() => []);
@@ -17711,7 +18081,7 @@ function resolveDaemonRunId(config, explicit) {
   if (explicit?.trim()) return explicit.trim();
   if (config.defaultDaemonRunId?.trim()) return config.defaultDaemonRunId.trim();
   const runsDir = getPaths().runsDir;
-  if (!existsSync51(runsDir)) return null;
+  if (!existsSync52(runsDir)) return null;
   const runs = listRunRecords().sort(
     (a, b) => Date.parse(b.createdAt) - Date.parse(a.createdAt)
   );
@@ -17763,7 +18133,7 @@ async function runCronInstall(opts = {}) {
     process.env.KYNVER_CRON_STORE_PATH = plan.storePath;
     process.env.KYNVER_CRON_TICK_ENABLED = "1";
     const storeInit = await ensureCronStoreInitialized(plan.storePath);
-    result.storeInitialized = storeInit.created || existsSync51(plan.storePath);
+    result.storeInitialized = storeInit.created || existsSync52(plan.storePath);
     const apiKey = loadApiKey();
     if (apiKey) {
       try {
@@ -17982,10 +18352,10 @@ var LANDING_MAINTAINER_LANE_SPEC = {
 };
 
 // src/lane/landing-maintainer-local.ts
-import { spawnSync as spawnSync15 } from "node:child_process";
-import path78 from "node:path";
+import { spawnSync as spawnSync16 } from "node:child_process";
+import path80 from "node:path";
 function runLandingWrapper(prNumber, repoRoot, execute) {
-  const script = path78.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
+  const script = path80.join(repoRoot, LANDING_MAINTAINER_LANE_SPEC.landScript);
   const args = [script, String(prNumber), ...LANDING_MAINTAINER_LANE_SPEC.landScriptArgs];
   if (!execute) {
     return {
@@ -17996,7 +18366,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
       stderr: ""
     };
   }
-  const result = spawnSync15("node", args, {
+  const result = spawnSync16("node", args, {
     cwd: repoRoot,
     encoding: "utf8",
     timeout: 10 * 60 * 1e3
@@ -18011,7 +18381,7 @@ function runLandingWrapper(prNumber, repoRoot, execute) {
 }
 function resolveLandingMaintainerRepoRoot(args) {
   const explicit = args.repoPath ? String(args.repoPath).trim() : "";
-  if (explicit) return path78.resolve(explicit);
+  if (explicit) return path80.resolve(explicit);
   const resolved = resolveDefaultRepo();
   return resolved?.repo ?? process.cwd();
 }
@@ -18136,9 +18506,9 @@ function usage(code = 0) {
       "Usage:",
       "  kynver login [--api-key KEY] [--api-base-url URL]   (omit --api-key to authorize in the browser)",
       "  kynver bootstrap [--api-base-url URL] [--api-key KEY] [--repo PATH]   (login + setup + runner credential in one shot)",
-      "  kynver start [--repo PATH] [--api-base-url URL] [--run RUN_ID] [--interval-ms MS]   (bring your agent online: bootstrap if needed + run + daemon)",
+      "  kynver start [--repo PATH] [--api-base-url URL] [--run RUN_ID] [--interval-ms MS] [--chat-oauth]   (bring your agent online: bootstrap if needed + run + daemon; --chat-oauth lets delegated chat turns use your local Claude subscription)",
       "  kynver runner credential [--agent-os-id ID] [--base-url URL]",
-      "  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind forge|ghost] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor]",
+      "  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind forge|ghost] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor] [--chat-oauth]",
       "  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS] [--stall-ms MS] [--no-supervise]",
       "  kynver status --run RUN_ID [--blocked] [--running] [--task TASK_ID] [--worker WORKER] [--full]  # top-level compact run status",
       "  kynver run create [--repo /path/repo] [--name name] [--base origin/main]",
@@ -18202,8 +18572,8 @@ async function main(argv = process.argv.slice(2)) {
   if (action && isHelpFlag(action) || rest.some(isHelpFlag)) return usage(0);
   const args = parseArgs(rest);
   const { runsDir, worktreesDir } = getPaths();
-  mkdirSync13(runsDir, { recursive: true });
-  mkdirSync13(worktreesDir, { recursive: true });
+  mkdirSync15(runsDir, { recursive: true });
+  mkdirSync15(worktreesDir, { recursive: true });
   if (scope === "daemon") {
     assertNativeDaemonAllowed();
   }
@@ -18682,9 +19052,11 @@ export {
   ORCHESTRATION_POLICY_MODES,
   PACKAGE_VERSION,
   RUN_METADATA_ACTIVE_SIGNAL_MS,
+  TERMINAL_WORKER_ARCHIVE_AGE_MS,
   TRANSIENT_OPENAI_CODEX_ERROR_CLASSES,
   WORKER_PERSONA_CATALOG,
   applyProductionDatabaseToProcess,
+  archiveTerminalWorkerMetadata,
   assertMemoryCostPackageVersionGuard,
   assessAutoCompleteEligibility,
   assessBuildAdmission,