@kynver-app/runtime 0.1.129 → 0.1.132

package/dist/instruction-bundle/contract.js

@@ -1,5 +1,5 @@
-import{createHash as u}from"node:crypto";function o(e){return JSON.stringify(i(e))}function i(e){if(Array.isArray(e))return e.map(i);if(e&&typeof e=="object"){let t={};for(let n of Object.keys(e).sort())t[n]=i(e[n]);return t}return e}function L(e){return`ib1-${u("sha256").update(o(e),"utf8").digest("hex").slice(0,16)}`}function N(e){return`ib-${u("sha256").update(Buffer.from(e)).digest("hex").slice(0,12)}`}function a(e){if(!e)return null;let t=e.trim();if(!t)return null;if(/^[0-9a-fA-F]{64}$/.test(t))return new Uint8Array(t.match(/.{2}/g).map(n=>parseInt(n,16)));try{let n=Buffer.from(t,"base64");if(n.length===32)return new Uint8Array(n)}catch{}return null}function s(e){if(!e||typeof e!="object")return!1;let t=e;if(typeof t.signature!="string"||!t.signature||typeof t.publicKeyId!="string"||!t.publicKeyId)return!1;let n=t.bundle;return!(!n||typeof n!="object"||typeof n.version!="string"||!n.version||typeof n.generatedAt!="string"||!Array.isArray(n.personas)||!n.instructions||typeof n.instructions!="object"||!n.policyThresholds||typeof n.policyThresholds!="object")}var p={"ib-3bab6314f0ba":"53a2040646cd479e1f5f1aea9abf7848ce8b62e32001efb8044dfd90e8ab87ed"};function l(e,t=process.env){let n=a(t.KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY);if(n)return n;let r=p[e];return r?a(r):null}import{createPublicKey as f,verify as m}from"node:crypto";var g=Buffer.from("302a300506032b6570032100","hex");function y(e){return f({key:Buffer.concat([g,Buffer.from(e)]),format:"der",type:"spki"})}function d(e,t){if(!s(e))return{ok:!1,reason:"malformed signed bundle payload"};let n;try{n=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(n.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let r=Buffer.from(o(e.bundle),"utf8");return m(null,r,y(t),n)?{ok:!0,bundle:e.bundle}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(r){return{ok:!1,reason:`signature verification failed: ${r.message}`}}}function h(e,t=process.env){if(!s(e))return{ok:!1,reason:"malformed signed bundle payload"};let n=l(e.publicKeyId,t);return n?d(e,n):{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}" (not pinned; set KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY)`}}var c="embedded-1",I=[{slug:"ghost",displayName:"Ghost",description:"Orchestration persona.",dispatchLane:null,defaultRoleLane:"system"},{slug:"astra",displayName:"Astra",description:"Planning persona.",dispatchLane:"implementation",defaultRoleLane:"plan_author"},{slug:"rhea",displayName:"Rhea",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"mnemo",displayName:"Mnemo",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"sentinel",displayName:"Sentinel",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"deep_reviewer"},{slug:"pixel",displayName:"Pixel",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"schema",displayName:"Schema",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"atlas",displayName:"Atlas",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"runtime_verifier"},{slug:"bridge",displayName:"Bridge",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"catalyst",displayName:"Catalyst",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"lorentz",displayName:"Lorentz",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"report_reviewer"},{slug:"dalton",displayName:"Dalton",description:"Landing persona.",dispatchLane:"landing",defaultRoleLane:"implementer"}],b={"worker.prompt.core_rules":["Structured final result (recommended): record completion as JSON with summary, files, PR URLs, verification, risks, and blockers.","Completion handoff (required): before you stop, summarize the outcome in your last message and append a heartbeat line with phase `complete`. Commit your work cleanly and open a GitHub PR (draft OK) for substantial changes \u2014 never leave uncommitted changes behind without reporting them.","Review-only workers must not open new implementation PRs \u2014 review the existing PR and record a verdict in the final result.","Keep verification targeted to touched paths; avoid full-monorepo verification unless explicitly requested.","Do not run `npm publish`.","If verification fails, append a heartbeat line immediately with the failing command, reason, and next action."].join(`
+import{createHash as u}from"node:crypto";function o(e){return JSON.stringify(i(e))}function i(e){if(Array.isArray(e))return e.map(i);if(e&&typeof e=="object"){let t={};for(let n of Object.keys(e).sort())t[n]=i(e[n]);return t}return e}function L(e){return`ib1-${u("sha256").update(o(e),"utf8").digest("hex").slice(0,16)}`}function N(e){return`ib-${u("sha256").update(Buffer.from(e)).digest("hex").slice(0,12)}`}function a(e){if(!e)return null;let t=e.trim();if(!t)return null;if(/^[0-9a-fA-F]{64}$/.test(t))return new Uint8Array(t.match(/.{2}/g).map(n=>parseInt(n,16)));try{let n=Buffer.from(t,"base64");if(n.length===32)return new Uint8Array(n)}catch{}return null}function s(e){if(!e||typeof e!="object")return!1;let t=e;if(typeof t.signature!="string"||!t.signature||typeof t.publicKeyId!="string"||!t.publicKeyId)return!1;let n=t.bundle;return!(!n||typeof n!="object"||typeof n.version!="string"||!n.version||typeof n.generatedAt!="string"||!Array.isArray(n.personas)||!n.instructions||typeof n.instructions!="object"||!n.policyThresholds||typeof n.policyThresholds!="object")}var c={"ib-3bab6314f0ba":"53a2040646cd479e1f5f1aea9abf7848ce8b62e32001efb8044dfd90e8ab87ed","ib-26e6c695da06":"bb1700f25b2ee7d7cdcdb9f446f0f44ef2cc22a3096bc161232fb658e7cdaf38"};function l(e,t=process.env){let n=a(t.KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY);if(n)return n;let r=c[e];return r?a(r):null}import{createPublicKey as f,verify as m}from"node:crypto";var g=Buffer.from("302a300506032b6570032100","hex");function y(e){return f({key:Buffer.concat([g,Buffer.from(e)]),format:"der",type:"spki"})}function d(e,t){if(!s(e))return{ok:!1,reason:"malformed signed bundle payload"};let n;try{n=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(n.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let r=Buffer.from(o(e.bundle),"utf8");return m(null,r,y(t),n)?{ok:!0,bundle:e.bundle}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(r){return{ok:!1,reason:`signature verification failed: ${r.message}`}}}function h(e,t=process.env){if(!s(e))return{ok:!1,reason:"malformed signed bundle payload"};let n=l(e.publicKeyId,t);return n?d(e,n):{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}" (not pinned; set KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY)`}}var p="embedded-1",I=[{slug:"ghost",displayName:"Ghost",description:"Orchestration persona.",dispatchLane:null,defaultRoleLane:"system"},{slug:"astra",displayName:"Astra",description:"Planning persona.",dispatchLane:"implementation",defaultRoleLane:"plan_author"},{slug:"rhea",displayName:"Rhea",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"mnemo",displayName:"Mnemo",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"sentinel",displayName:"Sentinel",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"deep_reviewer"},{slug:"pixel",displayName:"Pixel",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"schema",displayName:"Schema",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"atlas",displayName:"Atlas",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"runtime_verifier"},{slug:"bridge",displayName:"Bridge",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"catalyst",displayName:"Catalyst",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"lorentz",displayName:"Lorentz",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"report_reviewer"},{slug:"dalton",displayName:"Dalton",description:"Landing persona.",dispatchLane:"landing",defaultRoleLane:"implementer"}],b={"worker.prompt.core_rules":["Structured final result (recommended): record completion as JSON with summary, files, PR URLs, verification, risks, and blockers.","Completion handoff (required): before you stop, summarize the outcome in your last message and append a heartbeat line with phase `complete`. Commit your work cleanly and open a GitHub PR (draft OK) for substantial changes \u2014 never leave uncommitted changes behind without reporting them.","Review-only workers must not open new implementation PRs \u2014 review the existing PR and record a verdict in the final result.","Keep verification targeted to touched paths; avoid full-monorepo verification unless explicitly requested.","Do not run `npm publish`.","If verification fails, append a heartbeat line immediately with the failing command, reason, and next action."].join(`
 `),"worker.prompt.progress.compact":"Plan progress: when planId is set, report progress with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`. Do not mark rows done from the worker CLI.","worker.prompt.progress.full":["Structured plan progress (required when planId is set):","- Report checkpoints with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`.","- When a slice is finished, emit `partial` with evidence (`--evidence pr:<url>`, `--evidence path:<file>`, or `--evidence command:<cmd>`).","- Do not propose or confirm row `done` from the worker CLI."].join(`
 `),"worker.prompt.merge_gate.compact":"Verification cost control: prefer local verification before requesting CI runs; do not push empty commits to re-trigger CI; record verification evidence on the PR.","worker.prompt.merge_gate.full":["Verification cost control:","- Prefer local verification of touched paths before requesting any CI run.","- Do not push empty commits to re-trigger CI.","- Record verification evidence on the PR before requesting review."].join(`
 `),"worker.prompt.plan_artifacts.compact":"Plan artifacts: when authoring or revising plan documents, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in a local worktree.","worker.prompt.plan_artifacts.full":["Plan artifacts (when authoring or revising plan documents):","- Create a feature branch and open a GitHub PR (draft OK) before substantial drafting; commit and push the plan file.","- Iterate on that PR branch and link the PR URL on the related task and progress evidence."].join(`
-`)},R={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},B={version:c,generatedAt:"1970-01-01T00:00:00.000Z",personas:I,instructions:b,policyThresholds:R};export{B as EMBEDDED_INSTRUCTION_BUNDLE,c as EMBEDDED_INSTRUCTION_BUNDLE_VERSION,p as PINNED_INSTRUCTION_BUNDLE_PUBLIC_KEYS,o as canonicalJsonStringify,L as computeInstructionBundleVersion,N as deriveInstructionBundleKeyId,s as isSignedInstructionBundleShape,a as parseRawEd25519Key,l as resolveInstructionBundlePublicKey,d as verifyInstructionBundleSignatureWithKey,h as verifySignedInstructionBundle};
+`)},R={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},B={version:p,generatedAt:"1970-01-01T00:00:00.000Z",personas:I,instructions:b,policyThresholds:R};export{B as EMBEDDED_INSTRUCTION_BUNDLE,p as EMBEDDED_INSTRUCTION_BUNDLE_VERSION,c as PINNED_INSTRUCTION_BUNDLE_PUBLIC_KEYS,o as canonicalJsonStringify,L as computeInstructionBundleVersion,N as deriveInstructionBundleKeyId,s as isSignedInstructionBundleShape,a as parseRawEd25519Key,l as resolveInstructionBundlePublicKey,d as verifyInstructionBundleSignatureWithKey,h as verifySignedInstructionBundle};

package/dist/runner-identity.d.ts

@@ -4,6 +4,13 @@ export interface RunnerPresencePayload {
     profile: string | null;
     harnessRepo: string | null;
     runId?: string | null;
+    /**
+     * Active server-delivered instruction bundle version (M6); additive. Reports
+     * the embedded fallback version (`embedded-1`) when no server bundle has
+     * loaded — the System console instruction-freshness panel reads this from
+     * the runner registry to flag daemons running stale content.
+     */
+    instructionBundleVersion?: string | null;
 }
 /** True when this host belongs to the Ghost orchestrator pool (not Hermes Forge). */
 export declare function isGhostPoolHost(env?: NodeJS.ProcessEnv): boolean;

package/dist/server/worker-policy.d.ts

@@ -1,2 +1,4 @@
 export { auditWorkerEnv, scrubWorkerEnv, listForbiddenWorkerEnvKeys, isForbiddenWorkerEnvKey, } from "../worker-env.js";
 export { DEFAULT_WORKER_PROVIDER, resolveConfiguredWorkerProvider, isClaudeFamilyProvider, taskAllowsClaudeWorker, enforceCursorWorkerProvider, preferCursorExecutor, type EnforceCursorWorkerProviderInput, } from "../worker-provider-policy.js";
+export { classifyHeavyShellCommand } from "../heavy-verification/command-classify.js";
+export { gateWorkerShellCommand, HEAVY_VERIFICATION_TOKEN_REQUIRED, type GateWorkerShellCommandOpts, type WorkerCommandGateOutcome, type WorkerCommandGateResult, } from "../heavy-verification/worker-command-gate.js";

package/dist/server/worker-policy.js

@@ -1 +1 @@
-var t=(r,e)=>()=>(r&&(e=r(r=0)),e);function h(r){return ee.has(r)?!0:re.some(e=>r.endsWith(e))}function O(r){return Object.keys(r).filter(h).sort()}function c(r){let e={...r};for(let n of Object.keys(e))h(n)&&delete e[n];return e}function te(r){let e=O(r);return{forbiddenPresent:e,safe:e.length===0}}var Z,ee,re,a=t(()=>{"use strict";Z=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY"],ee=new Set(Z),re=["_SECRET","_API_KEY"]});var o=t(()=>{"use strict"});var b=t(()=>{"use strict";o();a()});var u=t(()=>{"use strict"});var P=t(()=>{"use strict";b();u()});var k=t(()=>{"use strict"});var w=t(()=>{"use strict"});var De,Le,I=t(()=>{"use strict";De=25*1024*1024*1024,Le=12*1024*1024*1024});var Ye,Ge,R=t(()=>{"use strict";I();Ye=30*1024*1024*1024,Ge=15*1024*1024*1024});import{homedir as oe}from"node:os";import ie from"node:path";var Ze,B=t(()=>{"use strict";d();u();o();Ze=ie.join(oe(),".openclaw","harness")});var x=t(()=>{"use strict";B();o()});var T=t(()=>{"use strict";x();o()});var W=t(()=>{"use strict"});var M=t(()=>{"use strict";W();o()});var K=t(()=>{"use strict"});var U=t(()=>{"use strict";K()});var F=t(()=>{"use strict";U();o()});var D=t(()=>{"use strict"});var L=t(()=>{"use strict"});var $=t(()=>{"use strict"});var _=t(()=>{"use strict"});var H=t(()=>{"use strict";_()});var j=t(()=>{"use strict";M();F();D();L();b();$();H();_();o()});var Y=t(()=>{"use strict";j()});var de,me,G=t(()=>{"use strict";w();d();k();S();R();x();T();Y();o();de=500*1024*1024,me=4*1024*1024*1024});var S=t(()=>{"use strict";G()});import{homedir as fe,totalmem as Ft}from"node:os";import C from"node:path";var V,Vt,zt,Jt,qt,d=t(()=>{"use strict";P();u();o();k();S();R();V=C.join(fe(),".kynver"),Vt=C.join(V,"config.json"),zt=C.join(V,"credentials"),Jt=500*1024*1024,qt=4*1024*1024*1024});a();d();a();o();a();o();a();o();var Yn=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function be(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var ke=be();var q="composer-2.5";var s="cursor",Re=new Set(["claude","opus","anthropic"]),ve=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function A(r,e){let n=r[e];return typeof n=="string"?n.trim():""}function i(r){if(!r?.trim())return!1;let e=r.trim().toLowerCase();return Re.has(e)?!0:e.includes("claude")||e.includes("opus")}function E(r){if(!r)return!1;let e=r.workerProviderOverride;if(typeof e=="string"&&i(e))return!0;let n=A(r,"executorRef").toLowerCase();if(n==="provider:claude"||n.startsWith("provider:claude:")||n.includes("claude-worker-override")||n.includes("operator-claude"))return!0;let p=A(r,"description");if(ve.some(Q=>Q.test(p)))return!0;let g=A(r,"title");return!!/\[use-claude-worker\]/i.test(g)}function xe(r,e){return{provider:s,model:q,rule:`policy:cursor_default${e}`,requestedModel:r}}function X(r){let{routing:e,task:n}=r,p=r.explicitProvider?.trim().toLowerCase();if(r.explicitProviderIsOperatorOverride&&i(p))return{...e,provider:"claude",rule:e.rule.startsWith("explicit:")?e.rule:"explicit:operator_provider"};if(E(n)||e.rule==="explicit:cli"&&i(e.provider)||!i(e.provider))return e;let g=e.rule&&e.rule!=="default:global"?`:${e.rule.replace(/:/g,"_")}`:"";return xe(e.model,g)}function _e(r,e=s){let n=r?.trim();return n?i(n)?s:n==="codex"?"codex":n:e}function Se(r){let e=[...new Set(r.map(n=>n.trim().toLowerCase()).filter(Boolean))];return e.includes(s)?[...new Set(e.map(n=>i(n)?s:n))]:e.every(n=>i(n))?[s]:e}export{s as DEFAULT_WORKER_PROVIDER,te as auditWorkerEnv,X as enforceCursorWorkerProvider,i as isClaudeFamilyProvider,h as isForbiddenWorkerEnvKey,O as listForbiddenWorkerEnvKeys,Se as preferCursorExecutor,_e as resolveConfiguredWorkerProvider,c as scrubWorkerEnv,E as taskAllowsClaudeWorker};
+var n=(e,r)=>()=>(e&&(r=e(e=0)),r);function w(e){return we.has(e)?!0:Ie.some(r=>e.endsWith(r))}function J(e){return Object.keys(e).filter(w).sort()}function f(e){let r={...e};for(let t of Object.keys(r))w(t)&&delete r[t];return r}function Be(e){let r=J(e);return{forbiddenPresent:r,safe:r.length===0}}var Pe,we,Ie,d=n(()=>{"use strict";Pe=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY"],we=new Set(Pe),Ie=["_SECRET","_API_KEY"]});function I(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=n(()=>{"use strict"});var N=n(()=>{"use strict";a();d()});var v=n(()=>{"use strict"});var X=n(()=>{"use strict";N();v()});var T=n(()=>{"use strict"});var Q=n(()=>{"use strict"});var Dr,Kr,Z=n(()=>{"use strict";Dr=25*1024*1024*1024,Kr=12*1024*1024*1024});var Lr,$r,M=n(()=>{"use strict";Z();Lr=30*1024*1024*1024,$r=15*1024*1024*1024});import{homedir as Te}from"node:os";import Me from"node:path";var Jr,ee=n(()=>{"use strict";k();v();a();Jr=Me.join(Te(),".openclaw","harness")});var D=n(()=>{"use strict";ee();a()});var te=n(()=>{"use strict";D();a()});var ne=n(()=>{"use strict"});var oe=n(()=>{"use strict";ne();a()});var ie=n(()=>{"use strict"});var se=n(()=>{"use strict";ie()});var ae=n(()=>{"use strict";se();a()});var ce=n(()=>{"use strict"});var le=n(()=>{"use strict"});var ue=n(()=>{"use strict"});var K=n(()=>{"use strict"});var de=n(()=>{"use strict";K()});var me=n(()=>{"use strict";oe();ae();ce();le();N();ue();de();K();a()});var fe=n(()=>{"use strict";me()});var Fe,Le,pe=n(()=>{"use strict";Q();k();T();U();M();D();te();fe();a();Fe=500*1024*1024,Le=4*1024*1024*1024});var U=n(()=>{"use strict";pe()});import{homedir as $e,totalmem as Wn}from"node:os";import H from"node:path";var ge,jn,Vn,Yn,Gn,k=n(()=>{"use strict";X();v();a();T();U();M();ge=H.join($e(),".kynver"),jn=H.join(ge,"config.json"),Vn=H.join(ge,"credentials"),Yn=500*1024*1024,Gn=4*1024*1024*1024});d();k();d();a();d();a();d();a();var Lo=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function ze(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var qe=ze();var be="composer-2.5";var u="cursor",Je=new Set(["claude","opus","anthropic"]),Xe=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function L(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function c(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Je.has(r)?!0:r.includes("claude")||r.includes("opus")}function F(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&c(r))return!0;let t=L(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let i=L(e,"description");if(Xe.some(s=>s.test(i)))return!0;let o=L(e,"title");return!!/\[use-claude-worker\]/i.test(o)}function Qe(e,r){return{provider:u,model:be,rule:`policy:cursor_default${r}`,requestedModel:e}}function ve(e){let{routing:r,task:t}=e,i=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&c(i))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(F(t)||r.rule==="explicit:cli"&&c(r.provider)||!c(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Qe(r.model,o)}function Ze(e,r=u){let t=e?.trim();return t?c(t)?u:t==="codex"?"codex":t:r}function er(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(u)?[...new Set(r.map(t=>c(t)?u:t))]:r.every(t=>c(t))?[u]:r}var rr=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,tr=/\b(npm run build\b|next build\b)\b/i,nr=/\b(vercel (build|deploy|--prod))\b/i,or=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function $(e){let r=e.trim();return r?or.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:nr.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:tr.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:rr.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var _="heavy_verification_token_required";import{spawnSync as vr}from"node:child_process";a();import{closeSync as cr,existsSync as V,mkdirSync as lr,openSync as ur,readdirSync as Se,readFileSync as dr,unlinkSync as Ce,writeFileSync as mr}from"node:fs";import G from"node:path";import{mkdirSync as sr}from"node:fs";import xe from"node:path";import{homedir as ir}from"node:os";import ke from"node:path";function Re(){let e=process.env.KYNVER_STATE_ROOT;return e?ke.resolve(e):ke.join(ir(),".kynver","state")}function ar(){return xe.join(Re(),"heavy-verification")}function j(){return xe.join(ar(),"slots")}function g(){let e=j();return sr(e,{recursive:!0}),e}var h=120*6e4,_e=1;function fr(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function E(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function S(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?fr(e,_e):_e}function pr(e){return`slot-${e}`}function gr(e,r=j()){return G.join(r,`${e}.json`)}function z(e){if(!V(e))return null;try{let r=JSON.parse(dr(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function C(e,r=h){if(!e||!I(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function hr(e,r){let t=z(e);if(C(t,r))try{Ce(e)}catch{}}function yr(e){return lr(e,{recursive:!0}),e}function q(e={}){let r=yr(e.slotsDir??g()),t=e.staleMs??h,i=0;for(let o of Se(r)){if(!o.endsWith(".json"))continue;let s=G.join(r,o),l=V(s);hr(s,t),l&&!V(s)&&(i+=1)}return i}function br(e={}){let r=e.slotsDir??g(),t=e.staleMs??h;q({slotsDir:r,staleMs:t});let i=[];for(let o of Se(r)){if(!o.endsWith(".json"))continue;let s=z(G.join(r,o));s&&!C(s,t)&&i.push(s)}return i}function Y(e={}){return br(e).length}function y(e,r={}){if(E())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:S(),reason:null};let t=r.slotsDir??g(),i=r.staleMs??h,o=r.maxSlots??S();q({slotsDir:t,staleMs:i});for(let l=0;l<o;l+=1){let O=pr(l),P=gr(O,t),b=z(P);if(b&&C(b,i))try{Ce(P)}catch{}else if(b&&!C(b,i))continue;let Ae={slotId:O,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let m=ur(P,"wx");mr(m,JSON.stringify(Ae,null,2),"utf8"),cr(m);let Oe=Y({slotsDir:t,staleMs:i});return{admitted:!0,slotId:O,activeSlots:Oe,maxSlots:o,reason:null}}catch(m){if(m.code==="EEXIST")continue;throw m}}let s=Y({slotsDir:t,staleMs:i});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:o,reason:`heavy verification at capacity (${s}/${o} slots)`}}function A(e,r={}){if(E())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:S(),reason:null};let t=r.slotsDir??g(),i=r.staleMs??h,o=r.maxSlots??S();q({slotsDir:t,staleMs:i});let s=Y({slotsDir:t,staleMs:i}),l=s<o;return{admitted:l,slotId:null,activeSlots:s,maxSlots:o,reason:l?null:`heavy verification at capacity (${s}/${o} slots); waiting for ${e}`}}function kr(e){e<=0||vr(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function Ee(e,r,t=2e3,i={}){let o=Date.now()+Math.max(0,r),s=y(e,i);for(;!s.admitted&&Date.now()<o;)kr(Math.min(t,o-Date.now())),s=y(e,i);return s}function Rr(e,r={}){let t=$(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...A(e),slotId:null}};if(E())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...A(e),slotId:null}};let i=r.waitMs??0,o=i>0?Ee(e,i,r.pollMs):y(e);return o.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:o}:{allowed:!1,outcome:_,commandClass:t.commandClass,reason:t.reason??o.reason??_,verificationGate:o}}export{u as DEFAULT_WORKER_PROVIDER,_ as HEAVY_VERIFICATION_TOKEN_REQUIRED,Be as auditWorkerEnv,$ as classifyHeavyShellCommand,ve as enforceCursorWorkerProvider,Rr as gateWorkerShellCommand,c as isClaudeFamilyProvider,w as isForbiddenWorkerEnvKey,J as listForbiddenWorkerEnvKeys,er as preferCursorExecutor,Ze as resolveConfiguredWorkerProvider,f as scrubWorkerEnv,F as taskAllowsClaudeWorker};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.1.129",
+  "version": "0.1.132",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",