@kynver-app/runtime 0.1.38 → 0.1.42

package/dist/cli.js

@@ -6,12 +6,39 @@ import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/config.ts
 import { existsSync as existsSync2, mkdirSync as mkdirSync2, readFileSync as readFileSync2, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+
+// src/path-values.ts
 import { homedir } from "node:os";
-import path2 from "node:path";
+import path from "node:path";
+function expandHomePath(value) {
+  if (value === "~") return homedir();
+  if (value.startsWith("~/") || value.startsWith("~\\")) {
+    return path.join(homedir(), value.slice(2));
+  }
+  return value;
+}
+function resolveUserPath(value) {
+  return path.resolve(expandHomePath(value));
+}
+function redactHomePath(value) {
+  const expanded = expandHomePath(value);
+  const resolved = path.resolve(expanded);
+  const home = path.resolve(homedir());
+  if (resolved === home) return "~";
+  if (resolved.startsWith(`${home}${path.sep}`)) {
+    return `~/${path.relative(home, resolved).split(path.sep).join("/")}`;
+  }
+  return resolved.replace(/^\/home\/[^/]+(?=\/|$)/, "~").replace(/^\/Users\/[^/]+(?=\/|$)/, "~");
+}
+function displayUserPath(value) {
+  return redactHomePath(value);
+}
 
 // src/util.ts
 import { existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import path from "node:path";
+import path2 from "node:path";
 function fail(message) {
   console.error(message);
   process.exit(1);
@@ -40,7 +67,7 @@ function readJson(file, fallback) {
   }
 }
 function writeJson(file, value) {
-  mkdirSync(path.dirname(file), { recursive: true });
+  mkdirSync(path2.dirname(file), { recursive: true });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}
 `);
 }
@@ -76,7 +103,7 @@ function tailFile(file, lines) {
   return data.split("\n").slice(-lines).join("\n");
 }
 function readMaybeFile(file) {
-  return file ? readFileSync(path.resolve(file), "utf8") : "";
+  return file ? readFileSync(path2.resolve(file), "utf8") : "";
 }
 function listRunIds(runsDir) {
   if (!existsSync(runsDir)) return [];
@@ -119,9 +146,9 @@ function secsAgo(ms) {
 }
 
 // src/config.ts
-var CONFIG_DIR = path2.join(homedir(), ".kynver");
-var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json");
-var CREDENTIALS_FILE = path2.join(CONFIG_DIR, "credentials");
+var CONFIG_DIR = path3.join(homedir2(), ".kynver");
+var CONFIG_FILE = path3.join(CONFIG_DIR, "config.json");
+var CREDENTIALS_FILE = path3.join(CONFIG_DIR, "credentials");
 function loadUserConfig() {
   if (!existsSync2(CONFIG_FILE)) return {};
   try {
@@ -132,9 +159,33 @@ function loadUserConfig() {
 }
 function saveUserConfig(config) {
   mkdirSync2(CONFIG_DIR, { recursive: true });
-  writeFileSync2(CONFIG_FILE, `${JSON.stringify(config, null, 2)}
+  writeFileSync2(CONFIG_FILE, `${JSON.stringify(normalizeConfigPaths(config), null, 2)}
 `, { mode: 384 });
 }
+function normalizeConfigPaths(config) {
+  return {
+    ...config,
+    ...config.harnessRoot?.trim() ? { harnessRoot: redactHomePath(config.harnessRoot.trim()) } : {},
+    ...config.defaultRepo?.trim() ? { defaultRepo: redactHomePath(config.defaultRepo.trim()) } : {}
+  };
+}
+function presentUserConfig(config) {
+  return normalizeConfigPaths(config);
+}
+function inferSetupFields(existing, args) {
+  const creds = loadCredentialsFile();
+  const apiBaseUrl = (typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0) || existing.apiBaseUrl?.trim() || process.env.KYNVER_API_URL?.trim() || process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim();
+  const agentOsId = (typeof args.agentOsId === "string" ? args.agentOsId : void 0) || existing.agentOsId?.trim() || process.env.KYNVER_AGENT_OS_ID?.trim() || (creds.runnerToken?.trim().startsWith("krc1.") ? creds.runnerTokenAgentOsId?.trim() : void 0);
+  const defaultRepo = (typeof args.repo === "string" ? args.repo : void 0) || existing.defaultRepo?.trim() || process.env.KYNVER_DEFAULT_REPO?.trim() || process.env.KYNVER_HARNESS_REPO?.trim();
+  const harnessRoot = (typeof args.harnessRoot === "string" ? args.harnessRoot : void 0) || existing.harnessRoot?.trim() || process.env.KYNVER_HARNESS_ROOT?.trim() || process.env.OPUS_HARNESS_ROOT?.trim();
+  return {
+    ...apiBaseUrl ? { apiBaseUrl: trimTrailingSlash(apiBaseUrl) } : {},
+    ...agentOsId ? { agentOsId } : {},
+    ...defaultRepo ? { defaultRepo } : {},
+    ...harnessRoot ? { harnessRoot } : {},
+    ...typeof args.agentOsSlug === "string" ? { agentOsSlug: args.agentOsSlug } : existing.agentOsSlug ? { agentOsSlug: existing.agentOsSlug } : {}
+  };
+}
 function loadCredentialsFile() {
   if (!existsSync2(CREDENTIALS_FILE)) return {};
   try {
@@ -280,7 +331,7 @@ async function mintRunnerCredential(args) {
         {
           ok: true,
           agentOsId,
-          credentialsPath: CREDENTIALS_FILE,
+          credentialsPath: displayUserPath(CREDENTIALS_FILE),
           tokenPrefix: `${token.slice(0, 12)}\u2026`,
           note: "Scoped runner token saved; callbacks use X-Kynver-Runner-Token."
         },
@@ -315,16 +366,12 @@ function parseArgs(argv) {
 async function runSetup(args) {
   const existing = loadUserConfig();
   const maxWorkersRaw = typeof args.maxWorkers === "string" ? args.maxWorkers : typeof args.maxConcurrentWorkers === "string" ? args.maxConcurrentWorkers : void 0;
-  const config = {
+  const config = normalizeConfigPaths({
     ...existing,
-    ...typeof args.apiBaseUrl === "string" ? { apiBaseUrl: args.apiBaseUrl } : {},
-    ...typeof args.agentOsSlug === "string" ? { agentOsSlug: args.agentOsSlug } : {},
-    ...typeof args.agentOsId === "string" ? { agentOsId: args.agentOsId } : {},
-    ...typeof args.repo === "string" ? { defaultRepo: args.repo } : {},
-    ...typeof args.harnessRoot === "string" ? { harnessRoot: args.harnessRoot } : {},
+    ...inferSetupFields(existing, args),
     ...maxWorkersRaw ? { maxConcurrentWorkers: Math.max(1, Math.floor(Number(maxWorkersRaw))) } : {},
     workerProvider: typeof args.provider === "string" ? args.provider : existing.workerProvider || "claude"
-  };
+  });
   saveUserConfig(config);
   let runnerCredentialNote;
   const apiKey = loadApiKey();
@@ -345,8 +392,8 @@ async function runSetup(args) {
     JSON.stringify(
       {
         ok: true,
-        configPath: CONFIG_FILE,
-        config,
+        configPath: displayUserPath(CONFIG_FILE),
+        config: presentUserConfig(config),
         note: runnerCredentialNote ?? "Set worker limit once with --max-workers N (or omit to auto-size from RAM). Run `kynver login` + `kynver runner credential` for scoped callbacks."
       },
       null,
@@ -358,11 +405,11 @@ async function runLogin(args) {
   const apiKey = typeof args.apiKey === "string" ? args.apiKey : process.env.KYNVER_API_KEY;
   if (!apiKey) failConfig("kynver login requires --api-key or KYNVER_API_KEY");
   saveApiKey(apiKey);
-  console.log(JSON.stringify({ ok: true, credentialsPath: CREDENTIALS_FILE }, null, 2));
+  console.log(JSON.stringify({ ok: true, credentialsPath: displayUserPath(CREDENTIALS_FILE) }, null, 2));
 }
 
 // src/dispatch.ts
-import path16 from "node:path";
+import path17 from "node:path";
 
 // src/callback-headers.ts
 function buildHarnessCallbackHeaders(secret) {
@@ -424,12 +471,12 @@ var DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
 var DEFAULT_MAX_USED_PERCENT = 80;
 var DEFAULT_HARD_MAX_USED_PERCENT = 90;
 function observeRunnerDiskGate(input = {}) {
-  const path32 = input.diskPath?.trim() || "/";
+  const path35 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync(path32);
+  const stats = statfsSync(path35);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -449,7 +496,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path32,
+    path: path35,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -464,21 +511,23 @@ function observeRunnerDiskGate(input = {}) {
 // src/resource-gate.ts
 import { readFileSync as readFileSync5 } from "node:fs";
 import os from "node:os";
-import path5 from "node:path";
+import path6 from "node:path";
 
 // src/run-store.ts
 import { existsSync as existsSync4, readdirSync as readdirSync2 } from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 
 // src/paths.ts
 import { existsSync as existsSync3 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import path3 from "node:path";
-var LEGACY_ROOT = path3.join(homedir2(), ".openclaw", "harness");
+import { homedir as homedir3 } from "node:os";
+import path4 from "node:path";
+var LEGACY_ROOT = path4.join(homedir3(), ".openclaw", "harness");
 function resolveHarnessRoot() {
   const env = process.env.KYNVER_HARNESS_ROOT || process.env.OPUS_HARNESS_ROOT;
-  if (env) return path3.resolve(env);
-  const kynverRoot = path3.join(homedir2(), ".kynver", "harness");
+  if (env) return resolveUserPath(env);
+  const configured = loadUserConfig().harnessRoot?.trim();
+  if (configured) return resolveUserPath(configured);
+  const kynverRoot = path4.join(homedir3(), ".kynver", "harness");
   if (existsSync3(kynverRoot)) return kynverRoot;
   if (existsSync3(LEGACY_ROOT)) return LEGACY_ROOT;
   return kynverRoot;
@@ -487,12 +536,12 @@ function getHarnessPaths() {
   const harnessRoot = resolveHarnessRoot();
   return {
     harnessRoot,
-    runsDir: path3.join(harnessRoot, "runs"),
-    worktreesDir: path3.join(harnessRoot, "worktrees")
+    runsDir: path4.join(harnessRoot, "runs"),
+    worktreesDir: path4.join(harnessRoot, "worktrees")
   };
 }
 function runDir(runsDir, id) {
-  return path3.join(runsDir, safeSlug(id));
+  return path4.join(runsDir, safeSlug(id));
 }
 
 // src/run-store.ts
@@ -501,7 +550,7 @@ function getPaths() {
 }
 function loadRun(id) {
   const { runsDir } = getPaths();
-  return readJson(path4.join(runDir(runsDir, safeSlug(id)), "run.json"));
+  return readJson(path5.join(runDir(runsDir, safeSlug(id)), "run.json"));
 }
 function listRunRecords() {
   const { runsDir } = getPaths();
@@ -510,7 +559,7 @@ function listRunRecords() {
   for (const entry of readdirSync2(runsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const run = readJson(
-      path4.join(runsDir, entry.name, "run.json"),
+      path5.join(runsDir, entry.name, "run.json"),
       void 0
     );
     if (run?.id) runs.push(run);
@@ -520,16 +569,16 @@ function listRunRecords() {
 function loadWorker(runId, name) {
   const { runsDir } = getPaths();
   return readJson(
-    path4.join(runDir(runsDir, safeSlug(runId)), "workers", safeSlug(name), "worker.json")
+    path5.join(runDir(runsDir, safeSlug(runId)), "workers", safeSlug(name), "worker.json")
   );
 }
 function saveRun(run) {
   const { runsDir } = getPaths();
-  writeJson(path4.join(runDir(runsDir, run.id), "run.json"), run);
+  writeJson(path5.join(runDir(runsDir, run.id), "run.json"), run);
 }
 function saveWorker(runId, worker) {
   const { runsDir } = getPaths();
-  writeJson(path4.join(runDir(runsDir, runId), "workers", worker.name, "worker.json"), worker);
+  writeJson(path5.join(runDir(runsDir, runId), "workers", worker.name, "worker.json"), worker);
 }
 function runDirectory(id) {
   const { runsDir } = getPaths();
@@ -1282,7 +1331,7 @@ function countActiveWorkersForRun(run) {
   let active = 0;
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path5.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path6.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker || !isActiveHarnessWorker(worker)) continue;
@@ -1490,6 +1539,7 @@ var claudeProvider = {
     const model = preflight.model;
     const stdoutFd = openSync(opts.stdoutPath, "a");
     const stderrFd = openSync(opts.stderrPath, "a");
+    const stdio = ["ignore", stdoutFd, stderrFd];
     const child = spawn(
       "claude",
       [
@@ -1507,7 +1557,7 @@ var claudeProvider = {
       hiddenSpawnOptions({
         cwd: opts.worktreePath,
         detached: true,
-        stdio: ["ignore", stdoutFd, stderrFd],
+        stdio,
         env: scrubClaudeEnv(process.env)
       })
     );
@@ -1666,10 +1716,10 @@ function readHarnessRetryLimits() {
 }
 
 // src/lease-renewal.ts
-import path6 from "node:path";
+import path7 from "node:path";
 function workerRecord(runId, name) {
   return readJson(
-    path6.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path7.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -1736,7 +1786,7 @@ function hasLiveWorkerForTask(runId, taskId) {
 
 // src/supervisor.ts
 import { existsSync as existsSync10, mkdirSync as mkdirSync3 } from "node:fs";
-import path12 from "node:path";
+import path13 from "node:path";
 
 // src/prompt.ts
 function buildPrompt(input) {
@@ -1755,6 +1805,16 @@ function buildPrompt(input) {
     "- After implementation: wait for report_reviewer then deep_reviewer confirmation (via MCP/session agents) before follow-up rows close.",
     input.planId ? `Active planId: ${input.planId}${input.taskId ? ` \xB7 taskId: ${input.taskId}` : ""}` : "No planId on this worker \u2014 still emit progress when you touch plan-scoped work."
   ];
+  const mergeGateLines = compact ? [
+    "Merge-gate cost control: run `node scripts/verify-pr-local.mjs --emit-json` and `node scripts/collect-pr-vercel-evidence.mjs --pr <url> --emit-json` (trusts GitHub Vercel status for dashboard target_url; never passes dashboard URLs to `vercel inspect`) before any GitHub Actions run; request merge-gate only via POST pr-merge-gate/request-run (one Actions run per PR head unless human approves extra)."
+  ] : [
+    "GitHub Actions merge-gate cost control (Kynver/Hermes PRs):",
+    "- Prefer local cached package verification (`node scripts/verify-pr-local.mjs --emit-json`) and Vercel preview evidence before GitHub Actions.",
+    "- Do not push empty commits to re-trigger CI. One budgeted merge-gate Actions run per PR candidate (head SHA) unless a human approves extra.",
+    "- Record evidence: POST `/api/agent-os/by-id/<agentOsId>/pr-merge-gate/refresh` with prUrl + local/vercel payloads.",
+    "- Request the final Actions run only when local + Vercel are green: POST `.../pr-merge-gate/request-run` (applies `merge-gate` label).",
+    "- Empty failed Actions jobs (no runner/steps/logs) are infra/quota \u2014 do not enter repair loops; escalate to operator."
+  ];
   const planArtifactLines = compact ? [
     "Plan artifacts: when authoring/revising docs/superpowers/plans/, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in the harness worktree."
   ] : [
@@ -1776,10 +1836,14 @@ function buildPrompt(input) {
     "Completion handoff (required): before you stop, ensure the harness records a final result \u2014 summarize outcome in your last message and append a heartbeat line with phase `complete`. If you leave uncommitted changes or committed work without a PR, the orchestrator blocks completion until a GitHub PR exists (or you discard/commit cleanly). Exiting with only dirty files and no PR routes to salvage review, not production review.",
     "PR-ready handoff: for substantial implementation work, commit, push, and open a GitHub PR (draft OK) on your branch before finishing \u2014 or rely on the harness to run `gh pr create` at completion when `gh` is authenticated.",
     "Worker resource guard: do not run full monorepo verification (`npm run typecheck`, `npm run build`, or equivalent) from this worker lane unless an operator explicitly requests it. Use targeted checks for touched paths and rely on CI/operator lanes for heavy gates.",
+    "npm publish boundary: do not run `npm publish`, do not republish `@kynver-app/*` packages, and do not block on an operator to publish. When you need newer runtime code than npm, use this repo checkout (`npm run kynver:build`, `npm run kynver`) and record evidence: packages/kynver-runtime/package.json version + git ref in your completion report.",
     "If verification fails (including OOM), append a heartbeat line immediately with the last command, failure reason, dirty-file status, commit/PR handoff state, and next action so recovery does not require log spelunking.",
+    "Landing-wrapper cleanup on a git ref: use `node scripts/agent-os-land-pr-cleanup-verify.mjs --ref origin/main` (JSON, exit 0). Do not use `git show <ref>:scripts/agent-os-land-pr.mjs | rg \u2026` \u2014 ripgrep exit 1 when markers are absent is reported as a failed command in Telegram/status tooling.",
     "",
     ...progressLines,
     "",
+    ...mergeGateLines,
+    "",
     ...planArtifactLines,
     "",
     ...input.personaMarkdown?.trim() ? [input.personaMarkdown.trim(), ""] : [],
@@ -1792,11 +1856,11 @@ function buildPrompt(input) {
 // src/providers/cursor.ts
 import { closeSync as closeSync2, existsSync as existsSync8, openSync as openSync2 } from "node:fs";
 import { spawn as spawn2 } from "node:child_process";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // src/providers/cursor-windows.ts
 import { existsSync as existsSync7, readdirSync as readdirSync3 } from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 var CURSOR_VERSION_DIR = /^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;
 function parseCursorVersionSortKey(versionName) {
   const datePart = versionName.split("-")[0];
@@ -1807,7 +1871,7 @@ function parseCursorVersionSortKey(versionName) {
   return Number(`${year}${month.padStart(2, "0")}${day.padStart(2, "0")}`);
 }
 function pickLatestCursorVersionDir(agentRoot) {
-  const versionsRoot = path7.join(agentRoot, "versions");
+  const versionsRoot = path8.join(agentRoot, "versions");
   if (!existsSync7(versionsRoot)) return null;
   let bestDir = null;
   let bestKey = -1;
@@ -1816,21 +1880,21 @@ function pickLatestCursorVersionDir(agentRoot) {
     const key = parseCursorVersionSortKey(entry.name);
     if (key == null || key <= bestKey) continue;
     bestKey = key;
-    bestDir = path7.join(versionsRoot, entry.name);
+    bestDir = path8.join(versionsRoot, entry.name);
   }
   return bestDir;
 }
 function resolveWindowsCursorBundled(agentRoot) {
-  const root = agentRoot?.trim() || path7.join(process.env.LOCALAPPDATA || "", "cursor-agent");
-  const directNode = path7.join(root, "node.exe");
-  const directIndex = path7.join(root, "index.js");
+  const root = agentRoot?.trim() || path8.join(process.env.LOCALAPPDATA || "", "cursor-agent");
+  const directNode = path8.join(root, "node.exe");
+  const directIndex = path8.join(root, "index.js");
   if (existsSync7(directNode) && existsSync7(directIndex)) {
     return { nodeExe: directNode, indexJs: directIndex, versionDir: root };
   }
   const versionDir = pickLatestCursorVersionDir(root);
   if (!versionDir) return null;
-  const nodeExe = path7.join(versionDir, "node.exe");
-  const indexJs = path7.join(versionDir, "index.js");
+  const nodeExe = path8.join(versionDir, "node.exe");
+  const indexJs = path8.join(versionDir, "index.js");
   if (!existsSync7(nodeExe) || !existsSync7(indexJs)) return null;
   return { nodeExe, indexJs, versionDir };
 }
@@ -1849,13 +1913,13 @@ function bundledSpawnTarget(nodeExe, indexJs, versionDir) {
 function resolveCursorSpawn(agentBin) {
   if (process.platform === "win32") {
     const isCursorWrapper = /\.(cmd|bat)$/i.test(agentBin);
-    const isBundledNode = /node\.exe$/i.test(agentBin) && existsSync8(path8.join(path8.dirname(agentBin), "index.js"));
+    const isBundledNode = /node\.exe$/i.test(agentBin) && existsSync8(path9.join(path9.dirname(agentBin), "index.js"));
     const isDefaultShim = agentBin === "agent";
     if (isCursorWrapper || isBundledNode || isDefaultShim) {
-      const bundled = isCursorWrapper ? resolveWindowsCursorBundled(path8.dirname(agentBin)) : isBundledNode ? {
+      const bundled = isCursorWrapper ? resolveWindowsCursorBundled(path9.dirname(agentBin)) : isBundledNode ? {
         nodeExe: agentBin,
-        indexJs: path8.join(path8.dirname(agentBin), "index.js"),
-        versionDir: path8.dirname(agentBin)
+        indexJs: path9.join(path9.dirname(agentBin), "index.js"),
+        versionDir: path9.dirname(agentBin)
       } : resolveWindowsCursorBundled();
       if (bundled) {
         return bundledSpawnTarget(bundled.nodeExe, bundled.indexJs, bundled.versionDir);
@@ -1875,7 +1939,7 @@ function resolveAgentBin() {
       process.env.KYNVER_CURSOR_AGENT_ROOT?.trim() || void 0
     );
     if (bundled) return bundled.nodeExe;
-    const localAgent = path8.join(process.env.LOCALAPPDATA || "", "cursor-agent", "agent.cmd");
+    const localAgent = path9.join(process.env.LOCALAPPDATA || "", "cursor-agent", "agent.cmd");
     if (existsSync8(localAgent)) return localAgent;
   }
   return "agent";
@@ -1885,7 +1949,7 @@ function cursorWorkerEnv(agentBin, spawnTarget) {
     ...process.env,
     CI: "1",
     NO_COLOR: "1",
-    ...spawnTarget.bundledVersionDir ? { CURSOR_INVOKED_AS: path8.basename(agentBin) || "agent.cmd" } : {}
+    ...spawnTarget.bundledVersionDir ? { CURSOR_INVOKED_AS: path9.basename(agentBin) || "agent.cmd" } : {}
   };
 }
 var cursorProvider = {
@@ -1902,6 +1966,7 @@ var cursorProvider = {
     const model = preflight.model;
     const stdoutFd = openSync2(opts.stdoutPath, "a");
     const stderrFd = openSync2(opts.stderrPath, "a");
+    const stdio = ["ignore", stdoutFd, stderrFd];
     const agentBin = resolveAgentBin();
     const spawnTarget = resolveCursorSpawn(agentBin);
     const child = spawn2(
@@ -1924,7 +1989,7 @@ var cursorProvider = {
         cwd: opts.worktreePath,
         detached: spawnTarget.detached,
         shell: spawnTarget.shell,
-        stdio: ["ignore", stdoutFd, stderrFd],
+        stdio,
         env: cursorWorkerEnv(agentBin, spawnTarget)
       })
     );
@@ -1959,11 +2024,24 @@ function resolveWorkerProvider(name) {
 // src/auto-complete.ts
 import { spawn as spawn3 } from "node:child_process";
 import { existsSync as existsSync9, openSync as openSync3, closeSync as closeSync3 } from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 import { fileURLToPath } from "node:url";
 
+// src/completion-ack.ts
+function hasCompletionAck(worker) {
+  return Boolean(worker.completionReportedAt?.trim());
+}
+function persistCompletionAck(worker, runId, fields) {
+  worker.completionReportedAt = fields.completionReportedAt;
+  worker.completionOutcome = fields.completionOutcome;
+  if (fields.completionResponse !== void 0) {
+    worker.completionResponse = fields.completionResponse;
+  }
+  saveWorker(runId, worker);
+}
+
 // src/worker-ops.ts
-import path10 from "node:path";
+import path11 from "node:path";
 
 // src/pr-handoff/pr-handoff-assess.ts
 var REVIEW_LANE_RULE = /^(lane:)?(review|deep_review|planning|landing)(:|$)/i;
@@ -2299,21 +2377,8 @@ function ensurePrReadyHandoff(input, exec = defaultPrHandoffExec) {
   };
 }
 
-// src/completion-ack.ts
-function hasCompletionAck(worker) {
-  return Boolean(worker.completionReportedAt?.trim());
-}
-function persistCompletionAck(worker, runId, fields) {
-  worker.completionReportedAt = fields.completionReportedAt;
-  worker.completionOutcome = fields.completionOutcome;
-  if (fields.completionResponse !== void 0) {
-    worker.completionResponse = fields.completionResponse;
-  }
-  saveWorker(runId, worker);
-}
-
 // src/worker-lifecycle.ts
-import path9 from "node:path";
+import path10 from "node:path";
 var TASK_LEFT_RUNNING = /* @__PURE__ */ new Set([
   "awaiting_review",
   "blocked",
@@ -2369,7 +2434,7 @@ function syncCompletionAcknowledgedFromOperatorTick(runId, operatorTick) {
   const synced = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path9.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path10.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || isCompletionAcknowledged(worker)) continue;
@@ -2606,7 +2671,7 @@ function workerStatus(args) {
   const worker = loadWorker(String(args.run), String(args.name));
   const run = loadRun(worker.runId);
   const status = computeWorkerStatus(worker, workerStatusOptions(run));
-  writeJson(path10.join(worker.workerDir, "last-status.json"), status);
+  writeJson(path11.join(worker.workerDir, "last-status.json"), status);
   console.log(JSON.stringify(status, null, 2));
 }
 function buildRunBoard(runId) {
@@ -2614,7 +2679,7 @@ function buildRunBoard(runId) {
   const names = Object.keys(run.workers || {});
   const workers = names.map((name) => {
     const worker = readJson(
-      path10.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path11.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker) {
@@ -2642,16 +2707,17 @@ function buildRunBoard(runId) {
     const completionRouteStatus = asString(completionResponse?.status);
     const completionWarnings = Array.isArray(completionResponse?.warnings) ? completionResponse.warnings.filter((w) => typeof w === "string" && w.trim().length > 0) : [];
     const prUrl = asString(completionTask?.prUrl) ?? asString(completionResponse?.prUrl);
+    const completionReportedAt = asString(worker.completionReportedAt);
     const lifecycleStage = deriveLifecycleStage({
       finished: isFinishedWorkerStatus(status),
       completionBlocker,
       completionOutcome,
-      completionReportedAt: worker.completionReportedAt ?? null
+      completionReportedAt
     });
     const nextAction = deriveNextAction({
       completionBlocker,
       completionOutcome,
-      completionReportedAt: worker.completionReportedAt ?? null,
+      completionReportedAt,
       finished: isFinishedWorkerStatus(status)
     });
     const handoffState = deriveHandoffState({
@@ -2697,7 +2763,7 @@ function buildRunBoard(runId) {
       gitAncestry: status.gitAncestry,
       finalResult: status.finalResult,
       lifecycleStage,
-      completionReportedAt: worker.completionReportedAt ?? null,
+      completionReportedAt,
       completionOutcome: worker.completionOutcome ?? null,
       completionRouteStatus,
       completionRouteOutcome: completionOutcome,
@@ -2724,7 +2790,7 @@ function buildRunBoard(runId) {
     needsAttention: workers.filter((w) => w.attention && w.attention !== "ok" && w.attention !== "done").map((w) => w.worker),
     workers
   };
-  writeJson(path10.join(runDirectory(run.id), "last-board.json"), board);
+  writeJson(path11.join(runDirectory(run.id), "last-board.json"), board);
   return board;
 }
 async function publishHarnessBoardSnapshot(args, source) {
@@ -2808,7 +2874,7 @@ async function autoCompleteWorker(raw) {
   const maxTotalMs = args.maxTotalMs ?? DEFAULT_MAX_TOTAL_MS;
   const completeAttempts = args.completeAttempts ?? DEFAULT_COMPLETE_ATTEMPTS;
   const completeBackoffMs = args.completeBackoffMs ?? DEFAULT_COMPLETE_BACKOFF_MS;
-  const worker = loadWorker(args.run, args.name);
+  let worker = loadWorker(args.run, args.name);
   if (!worker.agentOsId || !worker.taskId) {
     return {
       worker: worker.name,
@@ -2818,8 +2884,29 @@ async function autoCompleteWorker(raw) {
       reason: "worker has no agentOsId/taskId \u2014 nothing to attribute completion to"
     };
   }
+  if (hasCompletionAck(worker)) {
+    return {
+      worker: worker.name,
+      runId: worker.runId,
+      outcome: "completed",
+      httpStatus: 200,
+      attempts: 0,
+      reason: "completion-already-acknowledged"
+    };
+  }
   const startMs = Date.now();
   while (true) {
+    worker = loadWorker(args.run, args.name);
+    if (hasCompletionAck(worker)) {
+      return {
+        worker: worker.name,
+        runId: worker.runId,
+        outcome: "completed",
+        httpStatus: 200,
+        attempts: 0,
+        reason: "completion-already-acknowledged"
+      };
+    }
     const status = computeWorkerStatus(worker);
     if (isFinishedWorkerStatus(status)) break;
     if (!isPidAlive(worker.pid)) break;
@@ -2883,20 +2970,21 @@ async function autoCompleteWorkerCli(raw) {
     const outcome = await autoCompleteWorker(raw);
     console.log(JSON.stringify(outcome, null, 2));
     if (outcome.outcome === "missing_link" || outcome.outcome === "timed_out") {
-      process.exitCode = 1;
+      process.exit(1);
     }
+    process.exit(0);
   } catch (error) {
     console.error(`worker auto-complete failed: ${error.message}`);
-    process.exitCode = 1;
+    process.exit(1);
   }
 }
 function resolveDefaultCliPath() {
-  return path11.join(fileURLToPath(new URL(".", import.meta.url)), "cli.js");
+  return path12.join(fileURLToPath(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnCompletionSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath();
   if (!existsSync9(cliPath)) return void 0;
-  const logPath = path11.join(opts.workerDir, "auto-complete.log");
+  const logPath = path12.join(opts.workerDir, "auto-complete.log");
   let logFd;
   try {
     logFd = openSync3(logPath, "a");
@@ -2978,16 +3066,16 @@ function spawnWorkerProcess(run, opts) {
     launchModel = preflight.model;
   }
   const { worktreesDir } = getPaths();
-  const workerDir = path12.join(runDirectory(run.id), "workers", name);
+  const workerDir = path13.join(runDirectory(run.id), "workers", name);
   mkdirSync3(workerDir, { recursive: true });
-  const worktreePath = path12.join(worktreesDir, run.id, name);
+  const worktreePath = path13.join(worktreesDir, run.id, name);
   const branch = opts.branch || `agent/${run.id}/${name}`;
   if (existsSync10(worktreePath)) throw new Error(`worktree path already exists: ${worktreePath}`);
   git(run.repo, ["fetch", "origin", "--prune"], { allowFailure: true });
   git(run.repo, ["worktree", "add", "-b", branch, worktreePath, run.baseCommit], { throwError: true });
-  const stdoutPath = path12.join(workerDir, "stdout.jsonl");
-  const stderrPath = path12.join(workerDir, "stderr.log");
-  const heartbeatPath = path12.join(workerDir, "heartbeat.jsonl");
+  const stdoutPath = path13.join(workerDir, "stdout.jsonl");
+  const stderrPath = path13.join(workerDir, "stderr.log");
+  const heartbeatPath = path13.join(workerDir, "heartbeat.jsonl");
   const prompt = buildPrompt({
     task: opts.task,
     ownedPaths: opts.ownedPaths || [],
@@ -3048,7 +3136,7 @@ function spawnWorkerProcess(run, opts) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   saveWorker(run.id, worker);
-  run.workers = { ...run.workers || {}, [name]: { workerDir, statusPath: path12.join(workerDir, "worker.json") } };
+  run.workers = { ...run.workers || {}, [name]: { workerDir, statusPath: path13.join(workerDir, "worker.json") } };
   run.status = "running";
   saveRun(run);
   if (worker.agentOsId && worker.taskId) {
@@ -3340,18 +3428,18 @@ function buildPlanPersistIdempotencyKey(input) {
 
 // src/plan-persist/paths.ts
 import { mkdirSync as mkdirSync4 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import path13 from "node:path";
+import { homedir as homedir4 } from "node:os";
+import path14 from "node:path";
 function resolveKynverStateRoot() {
   const env = process.env.KYNVER_STATE_ROOT;
-  if (env) return path13.resolve(env);
-  return path13.join(homedir3(), ".kynver", "state");
+  if (env) return path14.resolve(env);
+  return path14.join(homedir4(), ".kynver", "state");
 }
 function planOutboxDir() {
-  return path13.join(resolveKynverStateRoot(), "plan-outbox");
+  return path14.join(resolveKynverStateRoot(), "plan-outbox");
 }
 function planOutboxArchiveDir() {
-  return path13.join(resolveKynverStateRoot(), "plan-outbox-archive");
+  return path14.join(resolveKynverStateRoot(), "plan-outbox-archive");
 }
 function ensurePlanOutboxDirs() {
   const outboxDir = planOutboxDir();
@@ -3362,8 +3450,8 @@ function ensurePlanOutboxDirs() {
 }
 function isTmpOnlyPath(filePath) {
   if (filePath.startsWith("/tmp/") || filePath.startsWith("/var/folders/")) return true;
-  const resolved = path13.resolve(filePath);
-  return resolved.startsWith("/tmp/") || resolved.startsWith(path13.join("/var", "folders"));
+  const resolved = path14.resolve(filePath);
+  return resolved.startsWith("/tmp/") || resolved.startsWith(path14.join("/var", "folders"));
 }
 
 // src/plan-persist/outbox-store.ts
@@ -3375,7 +3463,7 @@ import {
   writeFileSync as writeFileSync3,
   unlinkSync
 } from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 import { randomUUID } from "node:crypto";
 var DEFAULT_MAX_RETRIES = 12;
 function listOutboxItems() {
@@ -3383,7 +3471,7 @@ function listOutboxItems() {
   const files = readdirSync4(outboxDir).filter((f) => f.endsWith(".json"));
   const items = [];
   for (const file of files) {
-    const item = readOutboxItem(path14.join(outboxDir, file));
+    const item = readOutboxItem(path15.join(outboxDir, file));
     if (item && item.queueStatus === "queued") items.push(item);
   }
   return items.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
@@ -3404,7 +3492,7 @@ function readOutboxItem(jsonPath) {
 }
 function readOutboxBody(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
-  const bodyFile = path14.join(outboxDir, item.bodyPath);
+  const bodyFile = path15.join(outboxDir, item.bodyPath);
   return readFileSync6(bodyFile, "utf8");
 }
 function writeOutboxItem(input, opts) {
@@ -3412,8 +3500,8 @@ function writeOutboxItem(input, opts) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const id = opts.existing?.id ?? randomUUID();
   const bodyPath = opts.existing?.bodyPath ?? `${id}.body.md`;
-  const jsonPath = path14.join(outboxDir, `${id}.json`);
-  const bodyFile = path14.join(outboxDir, bodyPath);
+  const jsonPath = path15.join(outboxDir, `${id}.json`);
+  const bodyFile = path15.join(outboxDir, bodyPath);
   if (!opts.existing) {
     writeFileSync3(bodyFile, input.body, "utf8");
   }
@@ -3449,24 +3537,24 @@ function writeOutboxItem(input, opts) {
 }
 function saveOutboxItem(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
-  const jsonPath = path14.join(outboxDir, `${item.id}.json`);
+  const jsonPath = path15.join(outboxDir, `${item.id}.json`);
   writeFileSync3(jsonPath, `${JSON.stringify(item, null, 2)}
 `, { mode: 384 });
 }
 function archiveOutboxItem(item) {
   const { outboxDir, archiveDir } = ensurePlanOutboxDirs();
-  const jsonSrc = path14.join(outboxDir, `${item.id}.json`);
-  const bodySrc = path14.join(outboxDir, item.bodyPath);
-  const jsonDst = path14.join(archiveDir, `${item.id}.json`);
-  const bodyDst = path14.join(archiveDir, item.bodyPath);
+  const jsonSrc = path15.join(outboxDir, `${item.id}.json`);
+  const bodySrc = path15.join(outboxDir, item.bodyPath);
+  const jsonDst = path15.join(archiveDir, `${item.id}.json`);
+  const bodyDst = path15.join(archiveDir, item.bodyPath);
   if (existsSync12(jsonSrc)) renameSync(jsonSrc, jsonDst);
   if (existsSync12(bodySrc)) renameSync(bodySrc, bodyDst);
 }
 function outboxItemPaths(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
   return {
-    jsonPath: path14.join(outboxDir, `${item.id}.json`),
-    bodyPath: path14.join(outboxDir, item.bodyPath)
+    jsonPath: path15.join(outboxDir, `${item.id}.json`),
+    bodyPath: path15.join(outboxDir, item.bodyPath)
   };
 }
 function outboxInputFromItem(item, body) {
@@ -3652,7 +3740,7 @@ function markOutboxFailed(item, message) {
 }
 
 // src/plan-persist/drain.ts
-import path15 from "node:path";
+import path16 from "node:path";
 async function drainPlanOutbox(opts = {}, deps = {}) {
   const items = listOutboxItems().filter(
     (item) => opts.outboxId ? item.id === opts.outboxId : true
@@ -3686,7 +3774,7 @@ async function drainPlanOutbox(opts = {}, deps = {}) {
   return result;
 }
 function loadOutboxById(outboxId) {
-  const jsonPath = path15.join(planOutboxDir(), `${outboxId}.json`);
+  const jsonPath = path16.join(planOutboxDir(), `${outboxId}.json`);
   return readOutboxItem(jsonPath);
 }
 
@@ -3786,7 +3874,7 @@ async function dispatchRun(args) {
     const activeHarnessWorkers = [];
     for (const name of Object.keys(run.workers || {})) {
       const worker = readJson(
-        path16.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+        path17.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
         void 0
       );
       if (!worker?.taskId || !isPidAlive(worker.pid)) continue;
@@ -3990,7 +4078,7 @@ async function dispatchRun(args) {
 }
 
 // src/sweep.ts
-import path17 from "node:path";
+import path18 from "node:path";
 async function sweepRun(args) {
   const pipeline = args.pipeline === true || args.pipeline === "true";
   try {
@@ -4003,7 +4091,7 @@ async function sweepRun(args) {
     const releasedLocalOrphans = [];
     for (const name of Object.keys(run.workers || {})) {
       const worker = readJson(
-        path17.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+        path18.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
         void 0
       );
       if (!worker || !worker.dispatched || !worker.taskId) continue;
@@ -4047,10 +4135,10 @@ async function sweepRun(args) {
 
 // src/worktree.ts
 import { existsSync as existsSync13, mkdirSync as mkdirSync5 } from "node:fs";
-import path19 from "node:path";
+import path20 from "node:path";
 
 // src/validate.ts
-import path18 from "node:path";
+import path19 from "node:path";
 var RUN_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
 function validateRunId(runId) {
   const trimmed = runId.trim();
@@ -4058,7 +4146,7 @@ function validateRunId(runId) {
   return trimmed;
 }
 function validateRepo(repo) {
-  const resolved = path18.resolve(repo);
+  const resolved = path19.resolve(repo);
   if (resolved.includes("..")) throw new Error("repo path must not contain .. segments");
   return resolved;
 }
@@ -4083,12 +4171,12 @@ function createRun(args) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     workers: {}
   };
-  writeJson(path19.join(dir, "run.json"), run);
+  writeJson(path20.join(dir, "run.json"), run);
   console.log(JSON.stringify({ runId: id, runDir: dir, repo, base, baseCommit }, null, 2));
 }
 function listRuns() {
   const { runsDir } = getPaths();
-  const rows = listRunIds(runsDir).map((id) => readJson(path19.join(runDirectory(id), "run.json"), void 0)).filter(Boolean).map((run) => ({
+  const rows = listRunIds(runsDir).map((id) => readJson(path20.join(runDirectory(id), "run.json"), void 0)).filter(Boolean).map((run) => ({
     id: run.id,
     name: run.name,
     status: run.status,
@@ -4103,7 +4191,7 @@ function failExists(message) {
 }
 
 // src/pipeline-tick.ts
-import path28 from "node:path";
+import path29 from "node:path";
 
 // src/pipeline-dispatch.ts
 var RESERVED_REVIEW_STARTS = 1;
@@ -4157,10 +4245,10 @@ async function runPipelineDispatch(args, slots) {
 }
 
 // src/stale-reconcile.ts
-import path21 from "node:path";
+import path22 from "node:path";
 
 // src/finalize.ts
-import path20 from "node:path";
+import path21 from "node:path";
 var ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set(["running", "dispatching", "pending", "queued"]);
 function terminalStatusFor(run) {
   const names = Object.keys(run.workers || {});
@@ -4171,7 +4259,7 @@ function terminalStatusFor(run) {
   let anyLandingBlocked = false;
   for (const name of names) {
     const worker = readJson(
-      path20.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path21.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker) continue;
@@ -4223,7 +4311,7 @@ function reconcileStaleWorkers() {
   const now = Date.now();
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers || {})) {
-      const workerPath = path21.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path22.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker || worker.status !== "running") {
         outcomes.push({
@@ -4297,9 +4385,27 @@ function reconcileStaleWorkers() {
   }
   return { workers: outcomes, finalizedRuns: finalizeStaleRuns() };
 }
+function reconcileRunsCli() {
+  const result = reconcileStaleWorkers();
+  const markedExited = result.workers.filter((w) => w.action === "marked_exited").length;
+  const killedStale = result.workers.filter((w) => w.action === "killed_stale").length;
+  const skipped = result.workers.filter((w) => w.action === "skipped").length;
+  console.log(
+    JSON.stringify(
+      {
+        ok: true,
+        workers: { markedExited, killedStale, skipped, total: result.workers.length },
+        finalizedRuns: result.finalizedRuns.length,
+        details: { workers: result.workers, finalizedRuns: result.finalizedRuns }
+      },
+      null,
+      2
+    )
+  );
+}
 
 // src/plan-progress-daemon-sync.ts
-import path22 from "node:path";
+import path23 from "node:path";
 
 // src/plan-progress-sync.ts
 async function syncPlanProgress(args) {
@@ -4323,7 +4429,7 @@ async function syncActiveWorkerPlanProgress(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path22.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path23.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.dispatched || !worker.taskId) continue;
@@ -4372,7 +4478,7 @@ async function fetchWorkspaceRuntimePreferences(agentOsId, args) {
 }
 
 // src/cleanup.ts
-import path27 from "node:path";
+import path28 from "node:path";
 
 // src/cleanup-types.ts
 var DEFAULT_NODE_MODULES_AGE_MS = 6 * 60 * 60 * 1e3;
@@ -4444,11 +4550,11 @@ function skipNodeModulesRemoval(input) {
 
 // src/cleanup-execute.ts
 import { existsSync as existsSync15, rmSync } from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 
 // src/cleanup-dir-size.ts
 import { existsSync as existsSync14, readdirSync as readdirSync5, statSync as statSync2 } from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 function directorySizeBytes(root, maxEntries = 5e4) {
   if (!existsSync14(root)) return 0;
   let total = 0;
@@ -4464,7 +4570,7 @@ function directorySizeBytes(root, maxEntries = 5e4) {
     }
     for (const name of entries) {
       if (seen++ > maxEntries) return null;
-      const full = path23.join(current, name);
+      const full = path24.join(current, name);
       let st;
       try {
         st = statSync2(full);
@@ -4548,20 +4654,20 @@ function removeWorktree(candidate, execute) {
   }
 }
 function isHarnessNodeModulesPath(targetPath, harnessRoot, worktreesDir) {
-  const resolved = path24.resolve(targetPath);
-  const nm = resolved.endsWith(`${path24.sep}node_modules`) ? resolved : null;
+  const resolved = path25.resolve(targetPath);
+  const nm = resolved.endsWith(`${path25.sep}node_modules`) ? resolved : null;
   if (!nm) return "path_outside_harness";
-  const rel = path24.relative(worktreesDir, nm);
-  if (rel.startsWith("..") || path24.isAbsolute(rel)) return "path_outside_harness";
-  const parts = rel.split(path24.sep);
+  const rel = path25.relative(worktreesDir, nm);
+  if (rel.startsWith("..") || path25.isAbsolute(rel)) return "path_outside_harness";
+  const parts = rel.split(path25.sep);
   if (parts.length < 3 || parts[parts.length - 1] !== "node_modules") return "path_outside_harness";
-  if (!resolved.startsWith(path24.resolve(harnessRoot))) return "path_outside_harness";
+  if (!resolved.startsWith(path25.resolve(harnessRoot))) return "path_outside_harness";
   return null;
 }
 
 // src/cleanup-scan.ts
 import { existsSync as existsSync16, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import path25 from "node:path";
+import path26 from "node:path";
 function pathAgeMs(target, now) {
   try {
     const mtime = statSync3(target).mtimeMs;
@@ -4571,17 +4677,17 @@ function pathAgeMs(target, now) {
   }
 }
 function isPathInside(child, parent) {
-  const rel = path25.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path25.isAbsolute(rel);
+  const rel = path26.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path26.isAbsolute(rel);
 }
 function scanNodeModulesCandidates(opts) {
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
     if (opts.runIdFilter && entry.runId !== opts.runIdFilter) continue;
-    const nm = path25.join(entry.worktreePath, "node_modules");
+    const nm = path26.join(entry.worktreePath, "node_modules");
     if (!existsSync16(nm)) continue;
-    const resolved = path25.resolve(nm);
+    const resolved = path26.resolve(nm);
     if (seen.has(resolved)) continue;
     seen.add(resolved);
     candidates.push({
@@ -4597,13 +4703,13 @@ function scanNodeModulesCandidates(opts) {
   if (!opts.includeOrphans || !existsSync16(opts.worktreesDir)) return candidates;
   for (const runEntry of readdirSync6(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
-    const runPath = path25.join(opts.worktreesDir, runEntry.name);
+    const runPath = path26.join(opts.worktreesDir, runEntry.name);
     for (const workerEntry of readdirSync6(runPath, { withFileTypes: true })) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path25.join(runPath, workerEntry.name);
-      const nm = path25.join(worktreePath, "node_modules");
+      const worktreePath = path26.join(runPath, workerEntry.name);
+      const nm = path26.join(worktreePath, "node_modules");
       if (!existsSync16(nm)) continue;
-      const resolved = path25.resolve(nm);
+      const resolved = path26.resolve(nm);
       if (seen.has(resolved)) continue;
       if (!isPathInside(resolved, opts.harnessRoot)) continue;
       seen.add(resolved);
@@ -4643,17 +4749,17 @@ function scanWorktreeCandidates(opts) {
 }
 
 // src/cleanup-worktree-index.ts
-import path26 from "node:path";
+import path27 from "node:path";
 function buildWorktreeIndex() {
   const index = /* @__PURE__ */ new Map();
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers || {})) {
-      const workerPath = path26.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path27.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker?.worktreePath) continue;
       const status = computeWorkerStatus(worker, { base: run.base, baseCommit: run.baseCommit });
-      index.set(path26.resolve(worker.worktreePath), {
-        worktreePath: path26.resolve(worker.worktreePath),
+      index.set(path27.resolve(worker.worktreePath), {
+        worktreePath: path27.resolve(worker.worktreePath),
         runId: run.id,
         workerName: name,
         run,
@@ -4667,8 +4773,8 @@ function buildWorktreeIndex() {
 
 // src/cleanup.ts
 function resolveOptions(options = {}) {
-  const harnessRoot = options.harnessRoot ? path27.resolve(options.harnessRoot) : resolveHarnessRoot();
-  const { worktreesDir } = options.harnessRoot ? { worktreesDir: path27.join(harnessRoot, "worktrees") } : getHarnessPaths();
+  const harnessRoot = options.harnessRoot ? resolveUserPath(options.harnessRoot) : resolveHarnessRoot();
+  const { worktreesDir } = options.harnessRoot ? { worktreesDir: path28.join(harnessRoot, "worktrees") } : getHarnessPaths();
   const execute = options.execute === true;
   const nodeModulesAgeMs = options.nodeModulesAgeMs ?? DEFAULT_NODE_MODULES_AGE_MS;
   const worktreesAgeMs = options.worktreesAgeMs ?? 0;
@@ -4712,7 +4818,7 @@ function runHarnessCleanup(options = {}) {
       actions.push({ ...candidate, executed: false, skipped: true, skipReason: pathSkip });
       continue;
     }
-    const worktreePath = path27.resolve(candidate.path, "..");
+    const worktreePath = path28.resolve(candidate.path, "..");
     const indexed = index.get(worktreePath) ?? null;
     const guardReason = skipNodeModulesRemoval({
       indexed,
@@ -4728,7 +4834,7 @@ function runHarnessCleanup(options = {}) {
     actions.push(removeNodeModules(candidate, resolved.execute));
   }
   for (const candidate of scanWorktreeCandidates(scanOpts)) {
-    const indexed = index.get(path27.resolve(candidate.path)) ?? null;
+    const indexed = index.get(path28.resolve(candidate.path)) ?? null;
     const guardReason = skipWorktreeRemoval({
       indexed,
       includeOrphans: resolved.includeOrphans,
@@ -4797,7 +4903,7 @@ async function completeFinishedWorkers(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path28.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path29.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || worker.localOnly) continue;
@@ -5132,7 +5238,7 @@ function runCleanupCli(args) {
 }
 
 // src/monitor/monitor.service.ts
-import path30 from "node:path";
+import path31 from "node:path";
 
 // src/monitor/monitor.classify.ts
 function expectedLeaseOwner(runId) {
@@ -5189,10 +5295,10 @@ function classifyWorkerHealth(input) {
 
 // src/monitor/monitor.store.ts
 import { existsSync as existsSync17, mkdirSync as mkdirSync6, readdirSync as readdirSync7, unlinkSync as unlinkSync2 } from "node:fs";
-import path29 from "node:path";
+import path30 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path29.join(harnessRoot, "monitors");
+  const dir = path30.join(harnessRoot, "monitors");
   mkdirSync6(dir, { recursive: true });
   return dir;
 }
@@ -5200,7 +5306,7 @@ function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path29.join(monitorsDir(), `${monitorId}.json`);
+  return path30.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -5221,7 +5327,7 @@ function listMonitorSessions() {
   for (const name of readdirSync7(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path29.join(dir, name),
+      path30.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -5312,7 +5418,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path30.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path31.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -5515,17 +5621,17 @@ async function runMonitorLoop(args) {
 // src/monitor/monitor-spawn.ts
 import { spawn as spawn4 } from "node:child_process";
 import { closeSync as closeSync4, existsSync as existsSync18, openSync as openSync4 } from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path31.join(fileURLToPath2(new URL(".", import.meta.url)), "..", "cli.js");
+  return path32.join(fileURLToPath2(new URL(".", import.meta.url)), "..", "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
   if (!existsSync18(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path31.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path32.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
     logFd = openSync4(logPath, "a");
@@ -5680,6 +5786,422 @@ function handleCliVersionFlag(argv, moduleUrl = import.meta.url, binName) {
   return true;
 }
 
+// src/doctor/runtime-takeover.ts
+import path34 from "node:path";
+
+// src/doctor/runtime-takeover.probes.ts
+import { accessSync, constants, existsSync as existsSync20, readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import path33 from "node:path";
+import { spawnSync as spawnSync3 } from "node:child_process";
+function captureCommand(bin, args) {
+  try {
+    const res = spawnSync3(bin, args, { encoding: "utf8" });
+    const stdout = (res.stdout || "").trim();
+    const stderr = (res.stderr || "").trim();
+    const ok = res.status === 0;
+    return {
+      ok,
+      stdout,
+      stderr,
+      error: res.error?.message
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      stdout: "",
+      stderr: "",
+      error: error.message
+    };
+  }
+}
+function tokenPrefix(token) {
+  const trimmed = token?.trim();
+  if (!trimmed) return void 0;
+  return trimmed.length <= 12 ? `${trimmed}\u2026` : `${trimmed.slice(0, 12)}\u2026`;
+}
+function isWritable(target) {
+  if (!existsSync20(target)) return false;
+  try {
+    accessSync(target, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var defaultRuntimeTakeoverProbes = {
+  packageVersion: () => PACKAGE_VERSION,
+  commandOnPath: (bin) => captureCommand(process.platform === "win32" ? "where" : "which", [bin]),
+  kynverVersion: (bin) => captureCommand(bin, ["--version"]),
+  loadConfig: () => loadUserConfig(),
+  configFilePath: () => path33.join(homedir5(), ".kynver", "config.json"),
+  credentialsFilePath: () => path33.join(homedir5(), ".kynver", "credentials"),
+  readCredentials: () => {
+    const credPath = path33.join(homedir5(), ".kynver", "credentials");
+    if (!existsSync20(credPath)) {
+      return { hasApiKey: false };
+    }
+    try {
+      const parsed = JSON.parse(readFileSync9(credPath, "utf8"));
+      return {
+        hasApiKey: Boolean(parsed.apiKey?.trim()),
+        runnerTokenPrefix: tokenPrefix(parsed.runnerToken),
+        runnerTokenAgentOsId: parsed.runnerTokenAgentOsId
+      };
+    } catch {
+      return { hasApiKey: false };
+    }
+  },
+  envSnapshot: () => ({
+    kynverApiUrl: process.env.KYNVER_API_URL?.trim() || void 0,
+    openclawCronFireBaseUrl: process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim() || void 0,
+    kynverRunnerTokenPrefix: tokenPrefix(process.env.KYNVER_RUNNER_TOKEN),
+    kynverRuntimeSecret: Boolean(process.env.KYNVER_RUNTIME_SECRET?.trim()),
+    openclawCronSecret: Boolean(process.env.OPENCLAW_CRON_SECRET?.trim()),
+    kynverHarnessRoot: process.env.KYNVER_HARNESS_ROOT?.trim() || void 0,
+    opusHarnessRoot: process.env.OPUS_HARNESS_ROOT?.trim() || void 0,
+    kynverSchedulerProvider: process.env.KYNVER_SCHEDULER_PROVIDER?.trim() || void 0
+  }),
+  harnessRoot: () => resolveHarnessRoot(),
+  legacyOpenclawHarnessRoot: () => path33.join(homedir5(), ".openclaw", "harness"),
+  pathExists: (target) => existsSync20(target),
+  pathWritable: (target) => isWritable(target),
+  vercelVersion: () => captureCommand("vercel", ["--version"]),
+  vercelWhoami: () => captureCommand("vercel", ["whoami"])
+};
+
+// src/doctor/runtime-takeover.ts
+function check(partial) {
+  return partial;
+}
+function summarizeCounts(sections) {
+  const counts = { pass: 0, warn: 0, fail: 0 };
+  for (const section of sections) {
+    for (const item of section.checks) {
+      counts[item.status] += 1;
+    }
+  }
+  return counts;
+}
+function assessCliPackage(probes) {
+  const runningVersion = probes.packageVersion();
+  const which = probes.commandOnPath("kynver");
+  const onPath = which.ok && which.stdout.length > 0;
+  const firstPath = onPath ? which.stdout.split(/\r?\n/)[0]?.trim() : void 0;
+  const displayCliPath = firstPath ? displayUserPath(firstPath) : void 0;
+  const checks = [
+    check({
+      id: "cli_running_version",
+      label: "Running @kynver-app/runtime version",
+      status: "pass",
+      summary: `@kynver-app/runtime ${runningVersion}`,
+      details: { version: runningVersion }
+    }),
+    check({
+      id: "cli_on_path",
+      label: "kynver executable on PATH",
+      status: onPath ? "pass" : "warn",
+      summary: onPath ? `Found ${displayCliPath}` : "kynver not found on PATH (invoked via node/npx?)",
+      remediation: onPath ? void 0 : "Install globally (`npm i -g @kynver-app/runtime`) or invoke via `npx @kynver-app/runtime`.",
+      details: { path: displayCliPath }
+    })
+  ];
+  if (onPath && firstPath) {
+    const versionProbe = probes.kynverVersion(firstPath);
+    const installedVersion = versionProbe.stdout.replace(/^kynver\s+/i, "").trim() || void 0;
+    const versionMatch = versionProbe.ok && (!installedVersion || installedVersion === runningVersion);
+    checks.push(
+      check({
+        id: "cli_installed_version",
+        label: "Installed kynver CLI version matches running package",
+        status: versionMatch ? "pass" : "warn",
+        summary: versionProbe.ok && installedVersion ? versionMatch ? `Installed ${installedVersion}` : `Installed ${installedVersion} differs from running ${runningVersion}` : versionProbe.error ? `Could not read installed version (${versionProbe.error})` : versionProbe.stderr || "Could not read installed version",
+        remediation: versionMatch ? void 0 : "Reinstall or rebuild @kynver-app/runtime so PATH kynver matches the harness worktree version.",
+        details: { installedVersion, runningVersion, path: displayCliPath }
+      })
+    );
+  }
+  return { id: "cli_package", label: "CLI / package", checks };
+}
+function assessUserConfig(probes) {
+  const configPath = probes.configFilePath();
+  const displayConfigPath = displayUserPath(configPath);
+  const exists = probes.pathExists(configPath);
+  const config = probes.loadConfig();
+  const checks = [
+    check({
+      id: "config_file",
+      label: "~/.kynver/config.json present",
+      status: exists ? "pass" : "fail",
+      summary: exists ? `Found ${displayConfigPath}` : `Missing ${displayConfigPath}`,
+      remediation: exists ? void 0 : "Run `kynver setup --api-base-url <url> --agent-os-id <id> --repo <path>`.",
+      details: { configPath: displayConfigPath }
+    })
+  ];
+  if (exists) {
+    const apiBaseUrl = config.apiBaseUrl?.trim();
+    const agentOsId = config.agentOsId?.trim();
+    const defaultRepo = config.defaultRepo?.trim();
+    const displayDefaultRepo = defaultRepo ? displayUserPath(defaultRepo) : null;
+    checks.push(
+      check({
+        id: "config_api_base_url",
+        label: "Default API base URL",
+        status: apiBaseUrl ? "pass" : "warn",
+        summary: apiBaseUrl ?? "Not set in config (KYNVER_API_URL / --base-url required per command)",
+        remediation: apiBaseUrl ? void 0 : "Set `apiBaseUrl` via `kynver setup --api-base-url https://\u2026`.",
+        details: { apiBaseUrl: apiBaseUrl ?? null }
+      }),
+      check({
+        id: "config_agent_os_id",
+        label: "Default AgentOS id",
+        status: agentOsId ? "pass" : "warn",
+        summary: agentOsId ?? "Not set (pass --agent-os-id on daemon/dispatch/worker commands)",
+        remediation: agentOsId ? void 0 : "Set `agentOsId` via `kynver setup --agent-os-id <uuid>`.",
+        details: { agentOsId: agentOsId ?? null, agentOsSlug: config.agentOsSlug ?? null }
+      }),
+      check({
+        id: "config_default_repo",
+        label: "Default repo path",
+        status: defaultRepo ? "pass" : "warn",
+        summary: displayDefaultRepo ?? "Not set (pass --repo on `kynver run create`)",
+        remediation: defaultRepo ? void 0 : "Set `defaultRepo` via `kynver setup --repo /path/to/repo`.",
+        details: {
+          defaultRepo: displayDefaultRepo,
+          harnessRoot: config.harnessRoot ? redactHomePath(config.harnessRoot) : null
+        }
+      })
+    );
+  }
+  return { id: "user_config", label: "User config (~/.kynver)", checks };
+}
+function assessRunnerToken(probes) {
+  const config = probes.loadConfig();
+  const targetAgentOsId = config.agentOsId?.trim();
+  const creds = probes.readCredentials();
+  const env = probes.envSnapshot();
+  const credPath = probes.credentialsFilePath();
+  const displayCredPath = displayUserPath(credPath);
+  const envToken = env.kynverRunnerTokenPrefix;
+  const savedToken = creds.runnerTokenPrefix;
+  const savedAgentOsId = creds.runnerTokenAgentOsId;
+  const scopedSaved = Boolean(savedToken) && (!targetAgentOsId || !savedAgentOsId || savedAgentOsId === targetAgentOsId);
+  const hasScoped = Boolean(envToken?.startsWith("krc1.")) || scopedSaved && savedToken?.startsWith("krc1.");
+  const checks = [
+    check({
+      id: "runner_token_scoped",
+      label: "Scoped runner token (krc1.*) ready",
+      status: hasScoped ? "pass" : "fail",
+      summary: hasScoped ? envToken ? "KYNVER_RUNNER_TOKEN is set (scoped prefix shown)" : `Saved scoped token for agentOsId ${savedAgentOsId ?? targetAgentOsId ?? "(unknown)"}` : "No scoped runner token for the configured AgentOS workspace",
+      remediation: hasScoped ? void 0 : "Run `kynver login` then `kynver runner credential --agent-os-id <id>` (or `kynver setup` with API key).",
+      details: {
+        source: envToken ? "env" : savedToken ? "credentials" : "none",
+        tokenPrefix: envToken ?? (scopedSaved ? savedToken : void 0),
+        agentOsId: targetAgentOsId ?? savedAgentOsId ?? null,
+        credentialsPath: displayCredPath
+      }
+    }),
+    check({
+      id: "runner_token_agent_os_match",
+      label: "Saved runner token matches configured agentOsId",
+      status: !savedToken || !targetAgentOsId || !savedAgentOsId || savedAgentOsId === targetAgentOsId ? "pass" : "warn",
+      summary: !savedToken || !savedAgentOsId ? "No saved token agentOsId to compare" : !targetAgentOsId ? "Config agentOsId unset \u2014 token scope not validated against config" : savedAgentOsId === targetAgentOsId ? "Saved token scoped to configured agentOsId" : `Saved token is for ${savedAgentOsId}, config expects ${targetAgentOsId}`,
+      remediation: savedToken && targetAgentOsId && savedAgentOsId && savedAgentOsId !== targetAgentOsId ? "`kynver runner credential --agent-os-id <configured-id>` to mint a workspace-bound token." : void 0,
+      details: { configuredAgentOsId: targetAgentOsId ?? null, savedAgentOsId: savedAgentOsId ?? null }
+    }),
+    check({
+      id: "runner_api_key_for_refresh",
+      label: "API key available for token refresh",
+      status: creds.hasApiKey || Boolean(process.env.KYNVER_API_KEY?.trim()) ? "pass" : "warn",
+      summary: creds.hasApiKey || process.env.KYNVER_API_KEY ? "KYNVER API key present for runner credential mint/refresh" : "No API key \u2014 401 callback recovery cannot auto-mint a replacement token",
+      remediation: creds.hasApiKey || process.env.KYNVER_API_KEY ? void 0 : "Run `kynver login --api-key \u2026`.",
+      details: { credentialsPath: displayCredPath, hasApiKey: creds.hasApiKey || Boolean(process.env.KYNVER_API_KEY) }
+    })
+  ];
+  return { id: "runner_token", label: "Runner token readiness", checks };
+}
+function assessVercelCli(probes) {
+  const version = probes.vercelVersion();
+  const whoami = probes.vercelWhoami();
+  const installed = version.ok;
+  return {
+    id: "vercel_cli",
+    label: "Vercel CLI",
+    checks: [
+      check({
+        id: "vercel_installed",
+        label: "Vercel CLI installed",
+        status: installed ? "pass" : "warn",
+        summary: installed ? version.stdout || "vercel CLI found" : version.error ?? "vercel not found on PATH",
+        remediation: installed ? void 0 : "Install Vercel CLI (`npm i -g vercel`) for deploy evidence and env pulls.",
+        details: { stderr: version.stderr || null }
+      }),
+      check({
+        id: "vercel_authenticated",
+        label: "Vercel CLI authenticated",
+        status: !installed ? "warn" : whoami.ok ? "pass" : "warn",
+        summary: !installed ? "Skipped \u2014 Vercel CLI not installed" : whoami.ok ? `Authenticated as ${whoami.stdout}` : whoami.stderr || whoami.error || "Not logged in",
+        remediation: installed && !whoami.ok ? "Run `vercel login` and link the Kynver project if needed." : void 0,
+        details: { account: whoami.ok ? whoami.stdout : null }
+      })
+    ]
+  };
+}
+function assessHarnessDirs(probes) {
+  const harnessRoot = probes.harnessRoot();
+  const runsDir = path34.join(harnessRoot, "runs");
+  const worktreesDir = path34.join(harnessRoot, "worktrees");
+  const displayHarnessRoot = redactHomePath(harnessRoot);
+  const displayRunsDir = redactHomePath(runsDir);
+  const displayWorktreesDir = redactHomePath(worktreesDir);
+  const runsExists = probes.pathExists(runsDir);
+  const worktreesExists = probes.pathExists(worktreesDir);
+  return {
+    id: "harness_dirs",
+    label: "Harness / daemon directories",
+    checks: [
+      check({
+        id: "harness_root",
+        label: "Harness root resolved",
+        status: "pass",
+        summary: displayHarnessRoot,
+        details: { harnessRoot: displayHarnessRoot }
+      }),
+      check({
+        id: "harness_runs_dir",
+        label: "Runs directory ready",
+        status: runsExists && probes.pathWritable(runsDir) ? "pass" : runsExists ? "warn" : "warn",
+        summary: runsExists ? probes.pathWritable(runsDir) ? `Writable ${displayRunsDir}` : `Exists but not writable: ${displayRunsDir}` : `Will be created on first run: ${displayRunsDir}`,
+        remediation: runsExists && !probes.pathWritable(runsDir) ? `Fix permissions on ${displayRunsDir} or set KYNVER_HARNESS_ROOT to a writable path.` : void 0,
+        details: { runsDir: displayRunsDir, exists: runsExists, writable: probes.pathWritable(runsDir) }
+      }),
+      check({
+        id: "harness_worktrees_dir",
+        label: "Worktrees directory ready",
+        status: worktreesExists && probes.pathWritable(worktreesDir) ? "pass" : "warn",
+        summary: worktreesExists ? probes.pathWritable(worktreesDir) ? `Writable ${displayWorktreesDir}` : `Exists but not writable: ${displayWorktreesDir}` : `Will be created on first worker: ${displayWorktreesDir}`,
+        remediation: worktreesExists && !probes.pathWritable(worktreesDir) ? `Fix permissions on ${displayWorktreesDir}.` : void 0,
+        details: { worktreesDir: displayWorktreesDir, exists: worktreesExists, writable: probes.pathWritable(worktreesDir) }
+      })
+    ]
+  };
+}
+function assessCallbackAuth(probes) {
+  const config = probes.loadConfig();
+  const env = probes.envSnapshot();
+  const baseUrl = env.kynverApiUrl ?? config.apiBaseUrl?.trim() ?? env.openclawCronFireBaseUrl;
+  const usingLegacyBase = !env.kynverApiUrl && !config.apiBaseUrl && Boolean(env.openclawCronFireBaseUrl);
+  const legacySecret = env.openclawCronSecret || env.kynverRuntimeSecret;
+  const envScoped = env.kynverRunnerTokenPrefix?.startsWith("krc1.");
+  const creds = probes.readCredentials();
+  const savedScoped = creds.runnerTokenPrefix?.startsWith("krc1.");
+  const checks = [
+    check({
+      id: "callback_base_url",
+      label: "Callback base URL configured",
+      status: baseUrl ? usingLegacyBase ? "warn" : "pass" : "fail",
+      summary: baseUrl ? usingLegacyBase ? `Using legacy OPENCLAW_CRON_FIRE_BASE_URL (${baseUrl})` : baseUrl : "No KYNVER_API_URL, config apiBaseUrl, or legacy OpenClaw base URL",
+      remediation: baseUrl ? usingLegacyBase ? "Migrate to KYNVER_API_URL or `kynver setup --api-base-url` and drop OPENCLAW_CRON_FIRE_BASE_URL." : void 0 : "Set KYNVER_API_URL or run `kynver setup --api-base-url https://\u2026`.",
+      details: {
+        source: env.kynverApiUrl ? "KYNVER_API_URL" : config.apiBaseUrl ? "config.apiBaseUrl" : env.openclawCronFireBaseUrl ? "OPENCLAW_CRON_FIRE_BASE_URL" : "none",
+        baseUrl: baseUrl ?? null
+      }
+    }),
+    check({
+      id: "callback_auth_mode",
+      label: "Callback auth uses scoped runner token",
+      status: envScoped || savedScoped ? "pass" : legacySecret ? "warn" : "fail",
+      summary: envScoped ? "KYNVER_RUNNER_TOKEN scoped token will be sent as X-Kynver-Runner-Token" : savedScoped ? "Saved krc1.* token in ~/.kynver/credentials" : legacySecret ? "Deployment-level KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET in use (legacy headers)" : "No callback secret configured",
+      remediation: envScoped || savedScoped ? void 0 : "Mint a scoped token: `kynver runner credential --agent-os-id <id>`. Avoid shared OPENCLAW_CRON_SECRET on user runners.",
+      details: {
+        mode: envScoped || savedScoped ? "scoped" : legacySecret ? "legacy_global_secret" : "missing",
+        legacyHeadersWhenNotScoped: ["X-OpenClaw-Cron-Secret", "X-Kynver-Runtime-Secret"]
+      }
+    })
+  ];
+  return { id: "callback_auth", label: "Callback auth / config", checks };
+}
+function assessOpenclawHotspots(probes) {
+  const env = probes.envSnapshot();
+  const harnessRoot = probes.harnessRoot();
+  const legacyRoot = probes.legacyOpenclawHarnessRoot();
+  const displayHarnessRoot = redactHomePath(harnessRoot);
+  const displayLegacyRoot = redactHomePath(legacyRoot);
+  const displayOpusHarnessRoot = env.opusHarnessRoot ? redactHomePath(env.opusHarnessRoot) : null;
+  const legacyHarnessActive = harnessRoot === legacyRoot && probes.pathExists(legacyRoot);
+  const schedulerOpenclaw = !env.kynverSchedulerProvider || env.kynverSchedulerProvider === "openclaw-cron";
+  const checks = [
+    check({
+      id: "hotspot_legacy_harness_root",
+      label: "Legacy ~/.openclaw/harness still active",
+      status: legacyHarnessActive ? "warn" : "pass",
+      summary: legacyHarnessActive ? `Harness root is legacy ${displayLegacyRoot}` : env.opusHarnessRoot ? `OPUS_HARNESS_ROOT override in use (${displayOpusHarnessRoot})` : `Using ${displayHarnessRoot}`,
+      remediation: legacyHarnessActive ? "Set KYNVER_HARNESS_ROOT=~/.kynver/harness (or run setup), migrate artifacts, retire OPUS_HARNESS_ROOT." : env.opusHarnessRoot ? "Prefer KYNVER_HARNESS_ROOT over OPUS_HARNESS_ROOT." : void 0,
+      details: { harnessRoot: displayHarnessRoot, legacyRoot: displayLegacyRoot, opusHarnessRoot: displayOpusHarnessRoot }
+    }),
+    check({
+      id: "hotspot_openclaw_env_secrets",
+      label: "OpenClaw deployment secrets in runner env",
+      status: env.openclawCronSecret || env.openclawCronFireBaseUrl ? "warn" : "pass",
+      summary: env.openclawCronSecret || env.openclawCronFireBaseUrl ? [
+        env.openclawCronSecret ? "OPENCLAW_CRON_SECRET set" : null,
+        env.openclawCronFireBaseUrl ? "OPENCLAW_CRON_FIRE_BASE_URL set" : null
+      ].filter(Boolean).join("; ") : "No OpenClaw cron env overrides on this runner",
+      remediation: env.openclawCronSecret || env.openclawCronFireBaseUrl ? "Move to KYNVER_API_URL + scoped runner tokens; unset OpenClaw cron env on user-hosted runners." : void 0
+    }),
+    check({
+      id: "hotspot_openclaw_scheduler",
+      label: "openclaw-cron scheduler dependency (deployment)",
+      status: schedulerOpenclaw ? "warn" : "pass",
+      summary: schedulerOpenclaw ? env.kynverSchedulerProvider === "openclaw-cron" ? "KYNVER_SCHEDULER_PROVIDER=openclaw-cron \u2014 AgentOS ticks still routed via OpenClaw local cron adapter" : "KYNVER_SCHEDULER_PROVIDER unset \u2014 server may fall back to openclaw-cron when QStash is absent" : `KYNVER_SCHEDULER_PROVIDER=${env.kynverSchedulerProvider}`,
+      remediation: schedulerOpenclaw ? "On Kynver-hosted scheduler: set KYNVER_SCHEDULER_PROVIDER=qstash where QStash is configured; retire openclaw-cron stub when runtime daemon owns dispatch." : void 0,
+      details: { schedulerProvider: env.kynverSchedulerProvider ?? null }
+    }),
+    check({
+      id: "hotspot_lease_source_names",
+      label: "Harness lease/completion source names",
+      status: "pass",
+      summary: "Runtime uses kynver-harness:* lease owners and completion source kynver-harness (OpenClaw names retired in runtime)",
+      details: {
+        leaseOwnerPattern: "kynver-harness:<runId>",
+        completionSource: "kynver-harness",
+        note: "OpenClaw adapter remains optional in packages/kynver-openclaw-agent-os only"
+      }
+    })
+  ];
+  return { id: "openclaw_hotspots", label: "OpenClaw dependency hotspots", checks };
+}
+function assessRuntimeTakeoverReadiness(probes = defaultRuntimeTakeoverProbes) {
+  const sections = [
+    assessCliPackage(probes),
+    assessUserConfig(probes),
+    assessRunnerToken(probes),
+    assessVercelCli(probes),
+    assessHarnessDirs(probes),
+    assessCallbackAuth(probes),
+    assessOpenclawHotspots(probes)
+  ];
+  const counts = summarizeCounts(sections);
+  const ready = counts.fail === 0;
+  const summary = ready ? counts.warn > 0 ? `Ready with ${counts.warn} warning(s) \u2014 review remediation before retiring OpenClaw as primary runtime agent.` : "Ready \u2014 Kynver runtime can serve as primary runtime agent on this host." : `${counts.fail} blocking check(s) \u2014 fix failures before OpenClaw takeover.`;
+  return {
+    command: "doctor runtime-takeover",
+    ready,
+    summary,
+    counts,
+    sections
+  };
+}
+
+// src/doctor/runtime-takeover-cli.ts
+function runRuntimeTakeoverDoctorCli() {
+  const report = assessRuntimeTakeoverReadiness();
+  console.log(JSON.stringify(report, null, 2));
+  if (!report.ready) {
+    process.exitCode = 1;
+  }
+}
+
 // src/cli.ts
 function isHelpFlag(arg) {
   return arg === "help" || arg === "--help" || arg === "-h";
@@ -5701,7 +6223,7 @@ function usage(code = 0) {
       "  kynver run create --repo /path/repo [--name name] [--base origin/main]",
       "  kynver run list",
       "  kynver run status --run RUN_ID",
-      "  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--model claude-opus-4-7] [--disk-path /]",
+      "  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--model claude-opus-4-8] [--disk-path /]",
       "  kynver run sweep --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--grace-ms MS]",
       '  kynver worker start --run RUN_ID --name worker --task "..." [--owned path[,path]] [--model MODEL] [--provider claude|cursor] [--agent-os-id AOS_ID] [--task-id TASK_ID] [--wait]',
       "  kynver worker status --run RUN_ID --name worker",
@@ -5709,6 +6231,7 @@ function usage(code = 0) {
       "  kynver worker stop --run RUN_ID --name worker",
       "  kynver worker complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--task-id TASK_ID] [--base-url URL] [--secret SECRET]",
       "  kynver worker auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--poll-ms 5000] [--max-total-ms 21600000] [--complete-attempts 3] [--complete-backoff-ms 5000] [--base-url URL] [--secret SECRET]",
+      "  kynver run reconcile",
       "  kynver plan progress --plan PLAN_ID --row ROW_KEY --role ROLE --status STATUS [--task TASK_ID] [--note NOTE] [--evidence type:value] [--agent-os-id AOS_ID]",
       "  kynver plan verify --plan PLAN_ID [--worktree PATH] [--task TASK_ID] [--human-override]",
       "  kynver plan persist --operation create|add_version|update_metadata --title TITLE (--body-file PATH | --body TEXT) [--slug SLUG] [--plan PLAN_ID] [--summary TEXT] [--failure-kind approval_guard|auth|network|server|tool_interruption]",
@@ -5721,7 +6244,8 @@ function usage(code = 0) {
       "  kynver monitor list",
       "  kynver monitor tick --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--auto-complete] [--renew-leases]",
       "  kynver monitor auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET]",
-      "  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]"
+      "  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]",
+      "  kynver doctor runtime-takeover"
     ].join("\n")
   );
   process.exit(code);
@@ -5732,7 +6256,7 @@ async function main(argv = process.argv.slice(2)) {
   const scope = argv.shift();
   let action;
   let rest;
-  if (scope === "run" || scope === "worker" || scope === "plan" || scope === "runner" || scope === "monitor") {
+  if (scope === "run" || scope === "worker" || scope === "plan" || scope === "runner" || scope === "monitor" || scope === "doctor") {
     action = argv.shift();
     rest = argv;
   } else {
@@ -5757,11 +6281,13 @@ async function main(argv = process.argv.slice(2)) {
     unknownCommand("plan", `outbox ${outboxAction ?? ""}`.trim());
   }
   if (scope === "cleanup") return runCleanupCli(args);
+  if (scope === "doctor" && action === "runtime-takeover") return runRuntimeTakeoverDoctorCli();
   if (scope === "run" && action === "create") return createRun(args);
   if (scope === "run" && action === "list") return listRuns();
   if (scope === "run" && action === "status") return runStatus(args);
   if (scope === "run" && action === "dispatch") return void await dispatchRun(args);
   if (scope === "run" && action === "sweep") return void await sweepRun(args);
+  if (scope === "run" && action === "reconcile") return reconcileRunsCli();
   if (scope === "worker" && action === "start") return void await startWorker(args);
   if (scope === "worker" && action === "status") return workerStatus(args);
   if (scope === "worker" && action === "tail") return tailWorker(args);