@kynver-app/runtime 0.1.128 → 0.1.132

package/dist/config.d.ts

@@ -46,6 +46,8 @@ export declare function saveApiKey(apiKey: string): void;
 export declare function loadRunnerToken(agentOsId?: string): string | undefined;
 export declare function saveRunnerToken(agentOsId: string, token: string): void;
 export declare function resolveBaseUrl(argsBaseUrl?: string): string;
+/** Non-exiting sibling of `resolveBaseUrl` for long-lived callers (the daemon). */
+export declare function tryResolveBaseUrl(argsBaseUrl?: string): string | undefined;
 export declare function resolveCallbackSecret(argsSecret?: string, agentOsId?: string): string;
 /**
  * Non-exiting sibling of `resolveCallbackSecretWithMint` for long-lived

package/dist/daemon-heartbeat.d.ts

@@ -3,6 +3,8 @@ export interface DaemonHeartbeat {
     pid: number;
     runId: string;
     agentOsId: string;
+    /** Active server-delivered instruction bundle version (M6); additive. */
+    instructionBundleVersion?: string;
 }
 export declare function daemonHeartbeatPath(agentOsId: string): string;
 /** Best-effort atomic write (temp + rename). Never throws. */
@@ -10,6 +12,7 @@ export declare function writeDaemonHeartbeat(input: {
     agentOsId: string;
     runId: string;
     now?: Date;
+    instructionBundleVersion?: string;
 }): void;
 export declare function readDaemonHeartbeat(agentOsId: string): DaemonHeartbeat | null;
 /**

package/dist/heavy-verification/command-classify.d.ts

@@ -0,0 +1,9 @@
+export type HeavyCommandClass = "full_typecheck" | "full_build" | "vercel_verify" | "paid_compute" | "allowed";
+export interface HeavyCommandClassification {
+    heavy: boolean;
+    commandClass: HeavyCommandClass;
+    reason: string | null;
+}
+/** Pure classifier — unit-tested. */
+export declare function classifyHeavyShellCommand(command: string): HeavyCommandClassification;
+export declare const HEAVY_VERIFICATION_TOKEN_REQUIRED: "heavy_verification_token_required";

package/dist/heavy-verification/index.d.ts

@@ -1,3 +1,5 @@
 export { DEFAULT_HEAVY_VERIFICATION_MAX_CONCURRENT, DEFAULT_HEAVY_VERIFICATION_STALE_MS, assessHeavyVerificationGate, countActiveHeavyVerificationSlots, isHeavyVerificationGateSkipped, listActiveHeavyVerificationSlots, reclaimStaleHeavyVerificationSlots, releaseHeavyVerificationSlot, resolveHeavyVerificationMaxConcurrent, tryAcquireHeavyVerificationSlot, type HeavyVerificationGateVerdict, type HeavyVerificationSlotRecord, } from "./slot.js";
 export { waitForHeavyVerificationSlot } from "./gate.js";
+export { classifyHeavyShellCommand, HEAVY_VERIFICATION_TOKEN_REQUIRED, type HeavyCommandClassification, type HeavyCommandClass, } from "./command-classify.js";
+export { gateWorkerShellCommand, type GateWorkerShellCommandOpts, type WorkerCommandGateOutcome, type WorkerCommandGateResult, } from "./worker-command-gate.js";
 export { ensureHeavyVerificationDirs, heavyVerificationSlotsDir, resolveHeavyVerificationRoot, } from "./paths.js";

package/dist/heavy-verification/worker-command-gate.d.ts

@@ -0,0 +1,23 @@
+import { classifyHeavyShellCommand, HEAVY_VERIFICATION_TOKEN_REQUIRED } from "./command-classify.js";
+import { type HeavyVerificationGateVerdict } from "./slot.js";
+export { HEAVY_VERIFICATION_TOKEN_REQUIRED };
+export type WorkerCommandGateOutcome = typeof HEAVY_VERIFICATION_TOKEN_REQUIRED | "allowed" | "heavy_verification_skipped";
+export interface WorkerCommandGateResult {
+    allowed: boolean;
+    outcome: WorkerCommandGateOutcome;
+    commandClass: ReturnType<typeof classifyHeavyShellCommand>["commandClass"];
+    reason: string;
+    verificationGate: HeavyVerificationGateVerdict & {
+        slotId: string | null;
+    };
+}
+export interface GateWorkerShellCommandOpts {
+    /** Max ms to wait for a heavy-verification slot (0 = fail fast). */
+    waitMs?: number;
+    pollMs?: number;
+}
+/**
+ * Gate a shell command before spawn. Heavy commands require an admitted slot;
+ * denied attempts return a typed refusal (never a silent hang).
+ */
+export declare function gateWorkerShellCommand(command: string, opts?: GateWorkerShellCommandOpts): WorkerCommandGateResult;

package/dist/index.d.ts

@@ -17,6 +17,7 @@ export { isEngagementRequiredSkip } from "./fortress-engagement-gate.js";
 export { assessWorkerLandingContract, landingContractAttentionReason, type WorkerLandingContract, type WorkerLandingContractVerdict, type TargetPrReconciliation, } from "./landing-contract-gate.js";
 export { assessExitedWorkerSalvage, type ExitedSalvageAssessment, type ExitedSalvageKind, } from "./exited-salvage.js";
 export { buildPrompt } from "./prompt.js";
+export { canonicalJsonStringify, computeInstructionBundleVersion, deriveInstructionBundleKeyId, parseRawEd25519Key, isSignedInstructionBundleShape, PINNED_INSTRUCTION_BUNDLE_PUBLIC_KEYS, resolveInstructionBundlePublicKey, verifyInstructionBundleSignatureWithKey, verifySignedInstructionBundle, EMBEDDED_INSTRUCTION_BUNDLE, EMBEDDED_INSTRUCTION_BUNDLE_VERSION, getActiveInstructionBundle, getActiveInstructionBundleSource, getActiveInstructionBundleVersion, setActiveInstructionBundle, resolveInstructionText, resolvePolicyThreshold, resolveBundlePersona, ensureInstructionBundle, instructionBundleCachePath, loadInstructionBundleCache, saveInstructionBundleCache, INSTRUCTION_BUNDLE_REFRESH_TTL_MS, type InstructionBundle, type InstructionBundleContent, type InstructionBundlePersona, type SignedInstructionBundle, type InstructionBundleSource, type InstructionBundleVerifyResult, type EnsureInstructionBundleOptions, type EnsureInstructionBundleResult, } from "./instruction-bundle/index.js";
 export { WORKER_PERSONA_CATALOG, getWorkerPersonaCatalogEntry, getPersonaDispatchLane, getPersonaDefaultRoleLane, isKnownWorkerPersonaSlug, workerPersonaReviewSlugs, workerPersonaLandingSlugs, type WorkerPersonaCatalogEntry, type WorkerPersonaCatalogSlug, type WorkerPersonaDispatchLane, type WorkerPersonaDefaultRoleLane, } from "./worker-persona-catalog.js";
 export { assessPrHandoffRequirement, ensurePrReadyHandoff, extractPrUrlFromText, } from "./pr-handoff/index.js";
 export { normalizeCursorModelAlias, preflightClaudeModel, preflightCodexModel, preflightCursorModel, } from "./providers/model-preflight.js";
@@ -41,7 +42,7 @@ export { isActiveHarnessWorker } from "./harness-worker-active.js";
 export { sweepRun } from "./sweep.js";
 export { completeWorker, runStatus, workerStatus, tailWorker, stopWorker } from "./worker-ops.js";
 export { autoCompleteWorker, autoCompleteWorkerCli, spawnCompletionSidecar, type AutoCompleteArgs, type AutoCompleteOutcome, type SpawnSidecarOptions, type SpawnedSidecar, } from "./auto-complete.js";
-export { loadUserConfig, saveUserConfig, resolveBaseUrl, resolveCallbackSecret, resolveCallbackSecretWithMint, parseArgs, } from "./config.js";
+export { loadUserConfig, saveUserConfig, resolveBaseUrl, tryResolveBaseUrl, resolveCallbackSecret, resolveCallbackSecretWithMint, tryResolveCallbackSecretWithMint, parseArgs, } from "./config.js";
 export { discoverDefaultRepo, discoverDefaultRepoCandidates, isKynverMonorepoRoot, gitRepoRoot, type DiscoveredDefaultRepo, type DefaultRepoDiscoverySource, } from "./default-repo-discovery.js";
 export { resolveDefaultRepo, persistDefaultRepo, remediateDefaultRepo, formatResolvedDefaultRepo, type ResolvedDefaultRepo, type DefaultRepoSource, } from "./default-repo.js";
 export { getHarnessPaths, harnessRunsDir, harnessWorktreesDir, normalizeHarnessRoot, resolveHarnessRoot, } from "./paths.js";
@@ -60,7 +61,7 @@ export { canonicalWorkerDir, hasNestedRunsSegment, repairNestedRunsPath, resolve
 export { runDaemon } from "./daemon.js";
 export { runHarnessVerifyCommands, DEFAULT_HARNESS_VERIFY_COMMANDS, type HarnessVerifySummary, type HarnessVerifyStep, } from "./harness-verify.js";
 export { runBoundedBuildCheck, assessBuildAdmission, mergeNodeOptionsForBuildCheck, buildSystemdRunArgv, isSystemdRunAvailable, readMemAvailableBytes, type BoundedBuildExecResult, type BuildAdmissionVerdict, } from "./bounded-build/index.js";
-export { assessHeavyVerificationGate, countActiveHeavyVerificationSlots, isHeavyVerificationGateSkipped, listActiveHeavyVerificationSlots, reclaimStaleHeavyVerificationSlots, releaseHeavyVerificationSlot, resolveHeavyVerificationMaxConcurrent, tryAcquireHeavyVerificationSlot, waitForHeavyVerificationSlot, DEFAULT_HEAVY_VERIFICATION_MAX_CONCURRENT, type HeavyVerificationGateVerdict, type HeavyVerificationSlotRecord, } from "./heavy-verification/index.js";
+export { assessHeavyVerificationGate, countActiveHeavyVerificationSlots, isHeavyVerificationGateSkipped, listActiveHeavyVerificationSlots, reclaimStaleHeavyVerificationSlots, releaseHeavyVerificationSlot, resolveHeavyVerificationMaxConcurrent, tryAcquireHeavyVerificationSlot, waitForHeavyVerificationSlot, DEFAULT_HEAVY_VERIFICATION_MAX_CONCURRENT, classifyHeavyShellCommand, gateWorkerShellCommand, HEAVY_VERIFICATION_TOKEN_REQUIRED, type HeavyCommandClass, type HeavyCommandClassification, type HeavyVerificationGateVerdict, type HeavyVerificationSlotRecord, type WorkerCommandGateOutcome, type WorkerCommandGateResult, } from "./heavy-verification/index.js";
 export { assessAutoCompleteEligibility, classifyWorkerHealth, getMonitorStatus, listMonitors, runMonitorTick, spawnMonitorSidecar, type AutoCompleteAssessment, type MonitorTickResult, type TaskLeaseSnapshot, type WorkerHealthClass, type WorkerMonitorView, } from "./monitor/index.js";
 export { formatHarnessToolReadable, formatMonitorTickNotice, formatAutoCompleteOutcomeNotice, formatWorkerStatusNotice, formatWorkerCompleteNotice, joinHarnessNotice, type HarnessReadableNotice, type HarnessToolFormatContext, } from "./harness-notice/index.js";
 export { persistPlan, drainPlanOutbox, listOutboxItems, formatPlanOutboxHandoffBlock, extractPlanOutboxFromTask, hashPlanBody, type PersistPlanInput, type PersistPlanResult, type PlanPersistUserStatus, } from "./plan-persist/index.js";