@kynver-app/runtime 0.1.39 → 0.1.42

package/dist/index.js

@@ -35,16 +35,43 @@ function handleCliVersionFlag(argv, moduleUrl = import.meta.url, binName) {
 }
 
 // src/dispatch.ts
-import path16 from "node:path";
+import path17 from "node:path";
 
 // src/config.ts
 import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "node:fs";
+import { homedir as homedir2 } from "node:os";
+import path3 from "node:path";
+
+// src/path-values.ts
 import { homedir } from "node:os";
-import path2 from "node:path";
+import path from "node:path";
+function expandHomePath(value) {
+  if (value === "~") return homedir();
+  if (value.startsWith("~/") || value.startsWith("~\\")) {
+    return path.join(homedir(), value.slice(2));
+  }
+  return value;
+}
+function resolveUserPath(value) {
+  return path.resolve(expandHomePath(value));
+}
+function redactHomePath(value) {
+  const expanded = expandHomePath(value);
+  const resolved = path.resolve(expanded);
+  const home = path.resolve(homedir());
+  if (resolved === home) return "~";
+  if (resolved.startsWith(`${home}${path.sep}`)) {
+    return `~/${path.relative(home, resolved).split(path.sep).join("/")}`;
+  }
+  return resolved.replace(/^\/home\/[^/]+(?=\/|$)/, "~").replace(/^\/Users\/[^/]+(?=\/|$)/, "~");
+}
+function displayUserPath(value) {
+  return redactHomePath(value);
+}
 
 // src/util.ts
 import { existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, readdirSync, statSync, writeFileSync } from "node:fs";
-import path from "node:path";
+import path2 from "node:path";
 function fail(message) {
   console.error(message);
   process.exit(1);
@@ -73,7 +100,7 @@ function readJson(file, fallback) {
   }
 }
 function writeJson(file, value) {
-  mkdirSync(path.dirname(file), { recursive: true });
+  mkdirSync(path2.dirname(file), { recursive: true });
   writeFileSync(file, `${JSON.stringify(value, null, 2)}
 `);
 }
@@ -109,7 +136,7 @@ function tailFile(file, lines) {
   return data.split("\n").slice(-lines).join("\n");
 }
 function readMaybeFile(file) {
-  return file ? readFileSync2(path.resolve(file), "utf8") : "";
+  return file ? readFileSync2(path2.resolve(file), "utf8") : "";
 }
 function listRunIds(runsDir) {
   if (!existsSync2(runsDir)) return [];
@@ -152,9 +179,9 @@ function secsAgo(ms) {
 }
 
 // src/config.ts
-var CONFIG_DIR = path2.join(homedir(), ".kynver");
-var CONFIG_FILE = path2.join(CONFIG_DIR, "config.json");
-var CREDENTIALS_FILE = path2.join(CONFIG_DIR, "credentials");
+var CONFIG_DIR = path3.join(homedir2(), ".kynver");
+var CONFIG_FILE = path3.join(CONFIG_DIR, "config.json");
+var CREDENTIALS_FILE = path3.join(CONFIG_DIR, "credentials");
 function loadUserConfig() {
   if (!existsSync3(CONFIG_FILE)) return {};
   try {
@@ -165,9 +192,33 @@ function loadUserConfig() {
 }
 function saveUserConfig(config) {
   mkdirSync2(CONFIG_DIR, { recursive: true });
-  writeFileSync2(CONFIG_FILE, `${JSON.stringify(config, null, 2)}
+  writeFileSync2(CONFIG_FILE, `${JSON.stringify(normalizeConfigPaths(config), null, 2)}
 `, { mode: 384 });
 }
+function normalizeConfigPaths(config) {
+  return {
+    ...config,
+    ...config.harnessRoot?.trim() ? { harnessRoot: redactHomePath(config.harnessRoot.trim()) } : {},
+    ...config.defaultRepo?.trim() ? { defaultRepo: redactHomePath(config.defaultRepo.trim()) } : {}
+  };
+}
+function presentUserConfig(config) {
+  return normalizeConfigPaths(config);
+}
+function inferSetupFields(existing, args) {
+  const creds = loadCredentialsFile();
+  const apiBaseUrl = (typeof args.apiBaseUrl === "string" ? args.apiBaseUrl : void 0) || existing.apiBaseUrl?.trim() || process.env.KYNVER_API_URL?.trim() || process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim();
+  const agentOsId = (typeof args.agentOsId === "string" ? args.agentOsId : void 0) || existing.agentOsId?.trim() || process.env.KYNVER_AGENT_OS_ID?.trim() || (creds.runnerToken?.trim().startsWith("krc1.") ? creds.runnerTokenAgentOsId?.trim() : void 0);
+  const defaultRepo = (typeof args.repo === "string" ? args.repo : void 0) || existing.defaultRepo?.trim() || process.env.KYNVER_DEFAULT_REPO?.trim() || process.env.KYNVER_HARNESS_REPO?.trim();
+  const harnessRoot = (typeof args.harnessRoot === "string" ? args.harnessRoot : void 0) || existing.harnessRoot?.trim() || process.env.KYNVER_HARNESS_ROOT?.trim() || process.env.OPUS_HARNESS_ROOT?.trim();
+  return {
+    ...apiBaseUrl ? { apiBaseUrl: trimTrailingSlash(apiBaseUrl) } : {},
+    ...agentOsId ? { agentOsId } : {},
+    ...defaultRepo ? { defaultRepo } : {},
+    ...harnessRoot ? { harnessRoot } : {},
+    ...typeof args.agentOsSlug === "string" ? { agentOsSlug: args.agentOsSlug } : existing.agentOsSlug ? { agentOsSlug: existing.agentOsSlug } : {}
+  };
+}
 function loadCredentialsFile() {
   if (!existsSync3(CREDENTIALS_FILE)) return {};
   try {
@@ -320,7 +371,7 @@ async function mintRunnerCredential(args) {
         {
           ok: true,
           agentOsId,
-          credentialsPath: CREDENTIALS_FILE,
+          credentialsPath: displayUserPath(CREDENTIALS_FILE),
           tokenPrefix: `${token.slice(0, 12)}\u2026`,
           note: "Scoped runner token saved; callbacks use X-Kynver-Runner-Token."
         },
@@ -355,16 +406,12 @@ function parseArgs(argv) {
 async function runSetup(args) {
   const existing = loadUserConfig();
   const maxWorkersRaw = typeof args.maxWorkers === "string" ? args.maxWorkers : typeof args.maxConcurrentWorkers === "string" ? args.maxConcurrentWorkers : void 0;
-  const config = {
+  const config = normalizeConfigPaths({
     ...existing,
-    ...typeof args.apiBaseUrl === "string" ? { apiBaseUrl: args.apiBaseUrl } : {},
-    ...typeof args.agentOsSlug === "string" ? { agentOsSlug: args.agentOsSlug } : {},
-    ...typeof args.agentOsId === "string" ? { agentOsId: args.agentOsId } : {},
-    ...typeof args.repo === "string" ? { defaultRepo: args.repo } : {},
-    ...typeof args.harnessRoot === "string" ? { harnessRoot: args.harnessRoot } : {},
+    ...inferSetupFields(existing, args),
     ...maxWorkersRaw ? { maxConcurrentWorkers: Math.max(1, Math.floor(Number(maxWorkersRaw))) } : {},
     workerProvider: typeof args.provider === "string" ? args.provider : existing.workerProvider || "claude"
-  };
+  });
   saveUserConfig(config);
   let runnerCredentialNote;
   const apiKey = loadApiKey();
@@ -385,8 +432,8 @@ async function runSetup(args) {
     JSON.stringify(
       {
         ok: true,
-        configPath: CONFIG_FILE,
-        config,
+        configPath: displayUserPath(CONFIG_FILE),
+        config: presentUserConfig(config),
         note: runnerCredentialNote ?? "Set worker limit once with --max-workers N (or omit to auto-size from RAM). Run `kynver login` + `kynver runner credential` for scoped callbacks."
       },
       null,
@@ -398,7 +445,7 @@ async function runLogin(args) {
   const apiKey = typeof args.apiKey === "string" ? args.apiKey : process.env.KYNVER_API_KEY;
   if (!apiKey) failConfig("kynver login requires --api-key or KYNVER_API_KEY");
   saveApiKey(apiKey);
-  console.log(JSON.stringify({ ok: true, credentialsPath: CREDENTIALS_FILE }, null, 2));
+  console.log(JSON.stringify({ ok: true, credentialsPath: displayUserPath(CREDENTIALS_FILE) }, null, 2));
 }
 
 // src/callback-headers.ts
@@ -461,12 +508,12 @@ var DEFAULT_CRITICAL_FREE_BYTES = 15 * 1024 * 1024 * 1024;
 var DEFAULT_MAX_USED_PERCENT = 80;
 var DEFAULT_HARD_MAX_USED_PERCENT = 90;
 function observeRunnerDiskGate(input = {}) {
-  const path32 = input.diskPath?.trim() || "/";
+  const path35 = input.diskPath?.trim() || "/";
   const warnBelowBytes = input.diskFreeWarnBytes ?? DEFAULT_WARN_FREE_BYTES;
   const criticalBelowBytes = input.diskFreeCriticalBytes ?? DEFAULT_CRITICAL_FREE_BYTES;
   const maxUsedPercent = input.diskMaxUsedPercent ?? DEFAULT_MAX_USED_PERCENT;
   const hardMaxUsedPercent = input.diskHardMaxUsedPercent ?? DEFAULT_HARD_MAX_USED_PERCENT;
-  const stats = statfsSync(path32);
+  const stats = statfsSync(path35);
   const freeBytes = Number(stats.bavail) * Number(stats.bsize);
   const totalBytes = Number(stats.blocks) * Number(stats.bsize);
   const usedPercent = totalBytes > 0 ? (totalBytes - freeBytes) / totalBytes * 100 : 100;
@@ -486,7 +533,7 @@ function observeRunnerDiskGate(input = {}) {
   }
   return {
     ok,
-    path: path32,
+    path: path35,
     freeBytes,
     totalBytes,
     usedPercent,
@@ -501,21 +548,23 @@ function observeRunnerDiskGate(input = {}) {
 // src/resource-gate.ts
 import { readFileSync as readFileSync6 } from "node:fs";
 import os from "node:os";
-import path5 from "node:path";
+import path6 from "node:path";
 
 // src/run-store.ts
 import { existsSync as existsSync5, readdirSync as readdirSync2 } from "node:fs";
-import path4 from "node:path";
+import path5 from "node:path";
 
 // src/paths.ts
 import { existsSync as existsSync4 } from "node:fs";
-import { homedir as homedir2 } from "node:os";
-import path3 from "node:path";
-var LEGACY_ROOT = path3.join(homedir2(), ".openclaw", "harness");
+import { homedir as homedir3 } from "node:os";
+import path4 from "node:path";
+var LEGACY_ROOT = path4.join(homedir3(), ".openclaw", "harness");
 function resolveHarnessRoot() {
   const env = process.env.KYNVER_HARNESS_ROOT || process.env.OPUS_HARNESS_ROOT;
-  if (env) return path3.resolve(env);
-  const kynverRoot = path3.join(homedir2(), ".kynver", "harness");
+  if (env) return resolveUserPath(env);
+  const configured = loadUserConfig().harnessRoot?.trim();
+  if (configured) return resolveUserPath(configured);
+  const kynverRoot = path4.join(homedir3(), ".kynver", "harness");
   if (existsSync4(kynverRoot)) return kynverRoot;
   if (existsSync4(LEGACY_ROOT)) return LEGACY_ROOT;
   return kynverRoot;
@@ -524,12 +573,12 @@ function getHarnessPaths() {
   const harnessRoot = resolveHarnessRoot();
   return {
     harnessRoot,
-    runsDir: path3.join(harnessRoot, "runs"),
-    worktreesDir: path3.join(harnessRoot, "worktrees")
+    runsDir: path4.join(harnessRoot, "runs"),
+    worktreesDir: path4.join(harnessRoot, "worktrees")
   };
 }
 function runDir(runsDir, id) {
-  return path3.join(runsDir, safeSlug(id));
+  return path4.join(runsDir, safeSlug(id));
 }
 
 // src/run-store.ts
@@ -538,7 +587,7 @@ function getPaths() {
 }
 function loadRun(id) {
   const { runsDir } = getPaths();
-  return readJson(path4.join(runDir(runsDir, safeSlug(id)), "run.json"));
+  return readJson(path5.join(runDir(runsDir, safeSlug(id)), "run.json"));
 }
 function listRunRecords() {
   const { runsDir } = getPaths();
@@ -547,7 +596,7 @@ function listRunRecords() {
   for (const entry of readdirSync2(runsDir, { withFileTypes: true })) {
     if (!entry.isDirectory()) continue;
     const run = readJson(
-      path4.join(runsDir, entry.name, "run.json"),
+      path5.join(runsDir, entry.name, "run.json"),
       void 0
     );
     if (run?.id) runs.push(run);
@@ -557,16 +606,16 @@ function listRunRecords() {
 function loadWorker(runId, name) {
   const { runsDir } = getPaths();
   return readJson(
-    path4.join(runDir(runsDir, safeSlug(runId)), "workers", safeSlug(name), "worker.json")
+    path5.join(runDir(runsDir, safeSlug(runId)), "workers", safeSlug(name), "worker.json")
   );
 }
 function saveRun(run) {
   const { runsDir } = getPaths();
-  writeJson(path4.join(runDir(runsDir, run.id), "run.json"), run);
+  writeJson(path5.join(runDir(runsDir, run.id), "run.json"), run);
 }
 function saveWorker(runId, worker) {
   const { runsDir } = getPaths();
-  writeJson(path4.join(runDir(runsDir, runId), "workers", worker.name, "worker.json"), worker);
+  writeJson(path5.join(runDir(runsDir, runId), "workers", worker.name, "worker.json"), worker);
 }
 function runDirectory(id) {
   const { runsDir } = getPaths();
@@ -1322,7 +1371,7 @@ function countActiveWorkersForRun(run) {
   let active = 0;
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path5.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path6.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker || !isActiveHarnessWorker(worker)) continue;
@@ -1530,6 +1579,7 @@ var claudeProvider = {
     const model = preflight.model;
     const stdoutFd = openSync(opts.stdoutPath, "a");
     const stderrFd = openSync(opts.stderrPath, "a");
+    const stdio = ["ignore", stdoutFd, stderrFd];
     const child = spawn(
       "claude",
       [
@@ -1547,7 +1597,7 @@ var claudeProvider = {
       hiddenSpawnOptions({
         cwd: opts.worktreePath,
         detached: true,
-        stdio: ["ignore", stdoutFd, stderrFd],
+        stdio,
         env: scrubClaudeEnv(process.env)
       })
     );
@@ -1706,10 +1756,10 @@ function readHarnessRetryLimits() {
 }
 
 // src/lease-renewal.ts
-import path6 from "node:path";
+import path7 from "node:path";
 function workerRecord(runId, name) {
   return readJson(
-    path6.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path7.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -1776,7 +1826,7 @@ function hasLiveWorkerForTask(runId, taskId) {
 
 // src/supervisor.ts
 import { existsSync as existsSync11, mkdirSync as mkdirSync3 } from "node:fs";
-import path12 from "node:path";
+import path13 from "node:path";
 
 // src/prompt.ts
 function buildPrompt(input) {
@@ -1795,6 +1845,16 @@ function buildPrompt(input) {
     "- After implementation: wait for report_reviewer then deep_reviewer confirmation (via MCP/session agents) before follow-up rows close.",
     input.planId ? `Active planId: ${input.planId}${input.taskId ? ` \xB7 taskId: ${input.taskId}` : ""}` : "No planId on this worker \u2014 still emit progress when you touch plan-scoped work."
   ];
+  const mergeGateLines = compact ? [
+    "Merge-gate cost control: run `node scripts/verify-pr-local.mjs --emit-json` and `node scripts/collect-pr-vercel-evidence.mjs --pr <url> --emit-json` (trusts GitHub Vercel status for dashboard target_url; never passes dashboard URLs to `vercel inspect`) before any GitHub Actions run; request merge-gate only via POST pr-merge-gate/request-run (one Actions run per PR head unless human approves extra)."
+  ] : [
+    "GitHub Actions merge-gate cost control (Kynver/Hermes PRs):",
+    "- Prefer local cached package verification (`node scripts/verify-pr-local.mjs --emit-json`) and Vercel preview evidence before GitHub Actions.",
+    "- Do not push empty commits to re-trigger CI. One budgeted merge-gate Actions run per PR candidate (head SHA) unless a human approves extra.",
+    "- Record evidence: POST `/api/agent-os/by-id/<agentOsId>/pr-merge-gate/refresh` with prUrl + local/vercel payloads.",
+    "- Request the final Actions run only when local + Vercel are green: POST `.../pr-merge-gate/request-run` (applies `merge-gate` label).",
+    "- Empty failed Actions jobs (no runner/steps/logs) are infra/quota \u2014 do not enter repair loops; escalate to operator."
+  ];
   const planArtifactLines = compact ? [
     "Plan artifacts: when authoring/revising docs/superpowers/plans/, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in the harness worktree."
   ] : [
@@ -1816,10 +1876,14 @@ function buildPrompt(input) {
     "Completion handoff (required): before you stop, ensure the harness records a final result \u2014 summarize outcome in your last message and append a heartbeat line with phase `complete`. If you leave uncommitted changes or committed work without a PR, the orchestrator blocks completion until a GitHub PR exists (or you discard/commit cleanly). Exiting with only dirty files and no PR routes to salvage review, not production review.",
     "PR-ready handoff: for substantial implementation work, commit, push, and open a GitHub PR (draft OK) on your branch before finishing \u2014 or rely on the harness to run `gh pr create` at completion when `gh` is authenticated.",
     "Worker resource guard: do not run full monorepo verification (`npm run typecheck`, `npm run build`, or equivalent) from this worker lane unless an operator explicitly requests it. Use targeted checks for touched paths and rely on CI/operator lanes for heavy gates.",
+    "npm publish boundary: do not run `npm publish`, do not republish `@kynver-app/*` packages, and do not block on an operator to publish. When you need newer runtime code than npm, use this repo checkout (`npm run kynver:build`, `npm run kynver`) and record evidence: packages/kynver-runtime/package.json version + git ref in your completion report.",
     "If verification fails (including OOM), append a heartbeat line immediately with the last command, failure reason, dirty-file status, commit/PR handoff state, and next action so recovery does not require log spelunking.",
+    "Landing-wrapper cleanup on a git ref: use `node scripts/agent-os-land-pr-cleanup-verify.mjs --ref origin/main` (JSON, exit 0). Do not use `git show <ref>:scripts/agent-os-land-pr.mjs | rg \u2026` \u2014 ripgrep exit 1 when markers are absent is reported as a failed command in Telegram/status tooling.",
     "",
     ...progressLines,
     "",
+    ...mergeGateLines,
+    "",
     ...planArtifactLines,
     "",
     ...input.personaMarkdown?.trim() ? [input.personaMarkdown.trim(), ""] : [],
@@ -1832,11 +1896,11 @@ function buildPrompt(input) {
 // src/providers/cursor.ts
 import { closeSync as closeSync2, existsSync as existsSync9, openSync as openSync2 } from "node:fs";
 import { spawn as spawn2 } from "node:child_process";
-import path8 from "node:path";
+import path9 from "node:path";
 
 // src/providers/cursor-windows.ts
 import { existsSync as existsSync8, readdirSync as readdirSync3 } from "node:fs";
-import path7 from "node:path";
+import path8 from "node:path";
 var CURSOR_VERSION_DIR = /^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;
 function parseCursorVersionSortKey(versionName) {
   const datePart = versionName.split("-")[0];
@@ -1847,7 +1911,7 @@ function parseCursorVersionSortKey(versionName) {
   return Number(`${year}${month.padStart(2, "0")}${day.padStart(2, "0")}`);
 }
 function pickLatestCursorVersionDir(agentRoot) {
-  const versionsRoot = path7.join(agentRoot, "versions");
+  const versionsRoot = path8.join(agentRoot, "versions");
   if (!existsSync8(versionsRoot)) return null;
   let bestDir = null;
   let bestKey = -1;
@@ -1856,21 +1920,21 @@ function pickLatestCursorVersionDir(agentRoot) {
     const key = parseCursorVersionSortKey(entry.name);
     if (key == null || key <= bestKey) continue;
     bestKey = key;
-    bestDir = path7.join(versionsRoot, entry.name);
+    bestDir = path8.join(versionsRoot, entry.name);
   }
   return bestDir;
 }
 function resolveWindowsCursorBundled(agentRoot) {
-  const root = agentRoot?.trim() || path7.join(process.env.LOCALAPPDATA || "", "cursor-agent");
-  const directNode = path7.join(root, "node.exe");
-  const directIndex = path7.join(root, "index.js");
+  const root = agentRoot?.trim() || path8.join(process.env.LOCALAPPDATA || "", "cursor-agent");
+  const directNode = path8.join(root, "node.exe");
+  const directIndex = path8.join(root, "index.js");
   if (existsSync8(directNode) && existsSync8(directIndex)) {
     return { nodeExe: directNode, indexJs: directIndex, versionDir: root };
   }
   const versionDir = pickLatestCursorVersionDir(root);
   if (!versionDir) return null;
-  const nodeExe = path7.join(versionDir, "node.exe");
-  const indexJs = path7.join(versionDir, "index.js");
+  const nodeExe = path8.join(versionDir, "node.exe");
+  const indexJs = path8.join(versionDir, "index.js");
   if (!existsSync8(nodeExe) || !existsSync8(indexJs)) return null;
   return { nodeExe, indexJs, versionDir };
 }
@@ -1889,13 +1953,13 @@ function bundledSpawnTarget(nodeExe, indexJs, versionDir) {
 function resolveCursorSpawn(agentBin) {
   if (process.platform === "win32") {
     const isCursorWrapper = /\.(cmd|bat)$/i.test(agentBin);
-    const isBundledNode = /node\.exe$/i.test(agentBin) && existsSync9(path8.join(path8.dirname(agentBin), "index.js"));
+    const isBundledNode = /node\.exe$/i.test(agentBin) && existsSync9(path9.join(path9.dirname(agentBin), "index.js"));
     const isDefaultShim = agentBin === "agent";
     if (isCursorWrapper || isBundledNode || isDefaultShim) {
-      const bundled = isCursorWrapper ? resolveWindowsCursorBundled(path8.dirname(agentBin)) : isBundledNode ? {
+      const bundled = isCursorWrapper ? resolveWindowsCursorBundled(path9.dirname(agentBin)) : isBundledNode ? {
         nodeExe: agentBin,
-        indexJs: path8.join(path8.dirname(agentBin), "index.js"),
-        versionDir: path8.dirname(agentBin)
+        indexJs: path9.join(path9.dirname(agentBin), "index.js"),
+        versionDir: path9.dirname(agentBin)
       } : resolveWindowsCursorBundled();
       if (bundled) {
         return bundledSpawnTarget(bundled.nodeExe, bundled.indexJs, bundled.versionDir);
@@ -1915,7 +1979,7 @@ function resolveAgentBin() {
       process.env.KYNVER_CURSOR_AGENT_ROOT?.trim() || void 0
     );
     if (bundled) return bundled.nodeExe;
-    const localAgent = path8.join(process.env.LOCALAPPDATA || "", "cursor-agent", "agent.cmd");
+    const localAgent = path9.join(process.env.LOCALAPPDATA || "", "cursor-agent", "agent.cmd");
     if (existsSync9(localAgent)) return localAgent;
   }
   return "agent";
@@ -1925,7 +1989,7 @@ function cursorWorkerEnv(agentBin, spawnTarget) {
     ...process.env,
     CI: "1",
     NO_COLOR: "1",
-    ...spawnTarget.bundledVersionDir ? { CURSOR_INVOKED_AS: path8.basename(agentBin) || "agent.cmd" } : {}
+    ...spawnTarget.bundledVersionDir ? { CURSOR_INVOKED_AS: path9.basename(agentBin) || "agent.cmd" } : {}
   };
 }
 var cursorProvider = {
@@ -1942,6 +2006,7 @@ var cursorProvider = {
     const model = preflight.model;
     const stdoutFd = openSync2(opts.stdoutPath, "a");
     const stderrFd = openSync2(opts.stderrPath, "a");
+    const stdio = ["ignore", stdoutFd, stderrFd];
     const agentBin = resolveAgentBin();
     const spawnTarget = resolveCursorSpawn(agentBin);
     const child = spawn2(
@@ -1964,7 +2029,7 @@ var cursorProvider = {
         cwd: opts.worktreePath,
         detached: spawnTarget.detached,
         shell: spawnTarget.shell,
-        stdio: ["ignore", stdoutFd, stderrFd],
+        stdio,
         env: cursorWorkerEnv(agentBin, spawnTarget)
       })
     );
@@ -1999,7 +2064,7 @@ function resolveWorkerProvider(name) {
 // src/auto-complete.ts
 import { spawn as spawn3 } from "node:child_process";
 import { existsSync as existsSync10, openSync as openSync3, closeSync as closeSync3 } from "node:fs";
-import path11 from "node:path";
+import path12 from "node:path";
 import { fileURLToPath as fileURLToPath2 } from "node:url";
 
 // src/completion-ack.ts
@@ -2016,7 +2081,7 @@ function persistCompletionAck(worker, runId, fields) {
 }
 
 // src/worker-ops.ts
-import path10 from "node:path";
+import path11 from "node:path";
 
 // src/pr-handoff/pr-handoff-assess.ts
 var REVIEW_LANE_RULE = /^(lane:)?(review|deep_review|planning|landing)(:|$)/i;
@@ -2353,7 +2418,7 @@ function ensurePrReadyHandoff(input, exec = defaultPrHandoffExec) {
 }
 
 // src/worker-lifecycle.ts
-import path9 from "node:path";
+import path10 from "node:path";
 var TASK_LEFT_RUNNING = /* @__PURE__ */ new Set([
   "awaiting_review",
   "blocked",
@@ -2409,7 +2474,7 @@ function syncCompletionAcknowledgedFromOperatorTick(runId, operatorTick) {
   const synced = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path9.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path10.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || isCompletionAcknowledged(worker)) continue;
@@ -2646,7 +2711,7 @@ function workerStatus(args) {
   const worker = loadWorker(String(args.run), String(args.name));
   const run = loadRun(worker.runId);
   const status = computeWorkerStatus(worker, workerStatusOptions(run));
-  writeJson(path10.join(worker.workerDir, "last-status.json"), status);
+  writeJson(path11.join(worker.workerDir, "last-status.json"), status);
   console.log(JSON.stringify(status, null, 2));
 }
 function buildRunBoard(runId) {
@@ -2654,7 +2719,7 @@ function buildRunBoard(runId) {
   const names = Object.keys(run.workers || {});
   const workers = names.map((name) => {
     const worker = readJson(
-      path10.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path11.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker) {
@@ -2682,16 +2747,17 @@ function buildRunBoard(runId) {
     const completionRouteStatus = asString(completionResponse?.status);
     const completionWarnings = Array.isArray(completionResponse?.warnings) ? completionResponse.warnings.filter((w) => typeof w === "string" && w.trim().length > 0) : [];
     const prUrl = asString(completionTask?.prUrl) ?? asString(completionResponse?.prUrl);
+    const completionReportedAt = asString(worker.completionReportedAt);
     const lifecycleStage = deriveLifecycleStage({
       finished: isFinishedWorkerStatus(status),
       completionBlocker,
       completionOutcome,
-      completionReportedAt: worker.completionReportedAt ?? null
+      completionReportedAt
     });
     const nextAction = deriveNextAction({
       completionBlocker,
       completionOutcome,
-      completionReportedAt: worker.completionReportedAt ?? null,
+      completionReportedAt,
       finished: isFinishedWorkerStatus(status)
     });
     const handoffState = deriveHandoffState({
@@ -2737,7 +2803,7 @@ function buildRunBoard(runId) {
       gitAncestry: status.gitAncestry,
       finalResult: status.finalResult,
       lifecycleStage,
-      completionReportedAt: worker.completionReportedAt ?? null,
+      completionReportedAt,
       completionOutcome: worker.completionOutcome ?? null,
       completionRouteStatus,
       completionRouteOutcome: completionOutcome,
@@ -2764,7 +2830,7 @@ function buildRunBoard(runId) {
     needsAttention: workers.filter((w) => w.attention && w.attention !== "ok" && w.attention !== "done").map((w) => w.worker),
     workers
   };
-  writeJson(path10.join(runDirectory(run.id), "last-board.json"), board);
+  writeJson(path11.join(runDirectory(run.id), "last-board.json"), board);
   return board;
 }
 async function publishHarnessBoardSnapshot(args, source) {
@@ -2953,12 +3019,12 @@ async function autoCompleteWorkerCli(raw) {
   }
 }
 function resolveDefaultCliPath() {
-  return path11.join(fileURLToPath2(new URL(".", import.meta.url)), "cli.js");
+  return path12.join(fileURLToPath2(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnCompletionSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath();
   if (!existsSync10(cliPath)) return void 0;
-  const logPath = path11.join(opts.workerDir, "auto-complete.log");
+  const logPath = path12.join(opts.workerDir, "auto-complete.log");
   let logFd;
   try {
     logFd = openSync3(logPath, "a");
@@ -3040,16 +3106,16 @@ function spawnWorkerProcess(run, opts) {
     launchModel = preflight.model;
   }
   const { worktreesDir } = getPaths();
-  const workerDir = path12.join(runDirectory(run.id), "workers", name);
+  const workerDir = path13.join(runDirectory(run.id), "workers", name);
   mkdirSync3(workerDir, { recursive: true });
-  const worktreePath = path12.join(worktreesDir, run.id, name);
+  const worktreePath = path13.join(worktreesDir, run.id, name);
   const branch = opts.branch || `agent/${run.id}/${name}`;
   if (existsSync11(worktreePath)) throw new Error(`worktree path already exists: ${worktreePath}`);
   git(run.repo, ["fetch", "origin", "--prune"], { allowFailure: true });
   git(run.repo, ["worktree", "add", "-b", branch, worktreePath, run.baseCommit], { throwError: true });
-  const stdoutPath = path12.join(workerDir, "stdout.jsonl");
-  const stderrPath = path12.join(workerDir, "stderr.log");
-  const heartbeatPath = path12.join(workerDir, "heartbeat.jsonl");
+  const stdoutPath = path13.join(workerDir, "stdout.jsonl");
+  const stderrPath = path13.join(workerDir, "stderr.log");
+  const heartbeatPath = path13.join(workerDir, "heartbeat.jsonl");
   const prompt = buildPrompt({
     task: opts.task,
     ownedPaths: opts.ownedPaths || [],
@@ -3110,7 +3176,7 @@ function spawnWorkerProcess(run, opts) {
     startedAt: (/* @__PURE__ */ new Date()).toISOString()
   };
   saveWorker(run.id, worker);
-  run.workers = { ...run.workers || {}, [name]: { workerDir, statusPath: path12.join(workerDir, "worker.json") } };
+  run.workers = { ...run.workers || {}, [name]: { workerDir, statusPath: path13.join(workerDir, "worker.json") } };
   run.status = "running";
   saveRun(run);
   if (worker.agentOsId && worker.taskId) {
@@ -3402,18 +3468,18 @@ function buildPlanPersistIdempotencyKey(input) {
 
 // src/plan-persist/paths.ts
 import { mkdirSync as mkdirSync4 } from "node:fs";
-import { homedir as homedir3 } from "node:os";
-import path13 from "node:path";
+import { homedir as homedir4 } from "node:os";
+import path14 from "node:path";
 function resolveKynverStateRoot() {
   const env = process.env.KYNVER_STATE_ROOT;
-  if (env) return path13.resolve(env);
-  return path13.join(homedir3(), ".kynver", "state");
+  if (env) return path14.resolve(env);
+  return path14.join(homedir4(), ".kynver", "state");
 }
 function planOutboxDir() {
-  return path13.join(resolveKynverStateRoot(), "plan-outbox");
+  return path14.join(resolveKynverStateRoot(), "plan-outbox");
 }
 function planOutboxArchiveDir() {
-  return path13.join(resolveKynverStateRoot(), "plan-outbox-archive");
+  return path14.join(resolveKynverStateRoot(), "plan-outbox-archive");
 }
 function ensurePlanOutboxDirs() {
   const outboxDir = planOutboxDir();
@@ -3424,8 +3490,8 @@ function ensurePlanOutboxDirs() {
 }
 function isTmpOnlyPath(filePath) {
   if (filePath.startsWith("/tmp/") || filePath.startsWith("/var/folders/")) return true;
-  const resolved = path13.resolve(filePath);
-  return resolved.startsWith("/tmp/") || resolved.startsWith(path13.join("/var", "folders"));
+  const resolved = path14.resolve(filePath);
+  return resolved.startsWith("/tmp/") || resolved.startsWith(path14.join("/var", "folders"));
 }
 
 // src/plan-persist/outbox-store.ts
@@ -3437,7 +3503,7 @@ import {
   writeFileSync as writeFileSync3,
   unlinkSync
 } from "node:fs";
-import path14 from "node:path";
+import path15 from "node:path";
 import { randomUUID } from "node:crypto";
 var DEFAULT_MAX_RETRIES = 12;
 function listOutboxItems() {
@@ -3445,7 +3511,7 @@ function listOutboxItems() {
   const files = readdirSync4(outboxDir).filter((f) => f.endsWith(".json"));
   const items = [];
   for (const file of files) {
-    const item = readOutboxItem(path14.join(outboxDir, file));
+    const item = readOutboxItem(path15.join(outboxDir, file));
     if (item && item.queueStatus === "queued") items.push(item);
   }
   return items.sort((a, b) => a.createdAt.localeCompare(b.createdAt));
@@ -3466,7 +3532,7 @@ function readOutboxItem(jsonPath) {
 }
 function readOutboxBody(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
-  const bodyFile = path14.join(outboxDir, item.bodyPath);
+  const bodyFile = path15.join(outboxDir, item.bodyPath);
   return readFileSync7(bodyFile, "utf8");
 }
 function writeOutboxItem(input, opts) {
@@ -3474,8 +3540,8 @@ function writeOutboxItem(input, opts) {
   const now = (/* @__PURE__ */ new Date()).toISOString();
   const id = opts.existing?.id ?? randomUUID();
   const bodyPath = opts.existing?.bodyPath ?? `${id}.body.md`;
-  const jsonPath = path14.join(outboxDir, `${id}.json`);
-  const bodyFile = path14.join(outboxDir, bodyPath);
+  const jsonPath = path15.join(outboxDir, `${id}.json`);
+  const bodyFile = path15.join(outboxDir, bodyPath);
   if (!opts.existing) {
     writeFileSync3(bodyFile, input.body, "utf8");
   }
@@ -3511,24 +3577,24 @@ function writeOutboxItem(input, opts) {
 }
 function saveOutboxItem(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
-  const jsonPath = path14.join(outboxDir, `${item.id}.json`);
+  const jsonPath = path15.join(outboxDir, `${item.id}.json`);
   writeFileSync3(jsonPath, `${JSON.stringify(item, null, 2)}
 `, { mode: 384 });
 }
 function archiveOutboxItem(item) {
   const { outboxDir, archiveDir } = ensurePlanOutboxDirs();
-  const jsonSrc = path14.join(outboxDir, `${item.id}.json`);
-  const bodySrc = path14.join(outboxDir, item.bodyPath);
-  const jsonDst = path14.join(archiveDir, `${item.id}.json`);
-  const bodyDst = path14.join(archiveDir, item.bodyPath);
+  const jsonSrc = path15.join(outboxDir, `${item.id}.json`);
+  const bodySrc = path15.join(outboxDir, item.bodyPath);
+  const jsonDst = path15.join(archiveDir, `${item.id}.json`);
+  const bodyDst = path15.join(archiveDir, item.bodyPath);
   if (existsSync13(jsonSrc)) renameSync(jsonSrc, jsonDst);
   if (existsSync13(bodySrc)) renameSync(bodySrc, bodyDst);
 }
 function outboxItemPaths(item) {
   const { outboxDir } = ensurePlanOutboxDirs();
   return {
-    jsonPath: path14.join(outboxDir, `${item.id}.json`),
-    bodyPath: path14.join(outboxDir, item.bodyPath)
+    jsonPath: path15.join(outboxDir, `${item.id}.json`),
+    bodyPath: path15.join(outboxDir, item.bodyPath)
   };
 }
 function outboxInputFromItem(item, body) {
@@ -3714,7 +3780,7 @@ function markOutboxFailed(item, message) {
 }
 
 // src/plan-persist/drain.ts
-import path15 from "node:path";
+import path16 from "node:path";
 async function drainPlanOutbox(opts = {}, deps = {}) {
   const items = listOutboxItems().filter(
     (item) => opts.outboxId ? item.id === opts.outboxId : true
@@ -3748,7 +3814,7 @@ async function drainPlanOutbox(opts = {}, deps = {}) {
   return result;
 }
 function loadOutboxById(outboxId) {
-  const jsonPath = path15.join(planOutboxDir(), `${outboxId}.json`);
+  const jsonPath = path16.join(planOutboxDir(), `${outboxId}.json`);
   return readOutboxItem(jsonPath);
 }
 
@@ -3848,7 +3914,7 @@ async function dispatchRun(args) {
     const activeHarnessWorkers = [];
     for (const name of Object.keys(run.workers || {})) {
       const worker = readJson(
-        path16.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+        path17.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
         void 0
       );
       if (!worker?.taskId || !isPidAlive(worker.pid)) continue;
@@ -4061,7 +4127,7 @@ function redactHarness(text, secret) {
 }
 
 // src/validate.ts
-import path17 from "node:path";
+import path18 from "node:path";
 var RUN_ID_RE = /^[a-z0-9][a-z0-9._-]{0,127}$/i;
 var WORKER_NAME_RE = /^[a-z0-9][a-z0-9._-]{0,63}$/i;
 function validateRunId(runId) {
@@ -4075,15 +4141,15 @@ function validateWorkerName(name) {
   return trimmed;
 }
 function validateRepo(repo) {
-  const resolved = path17.resolve(repo);
+  const resolved = path18.resolve(repo);
   if (resolved.includes("..")) throw new Error("repo path must not contain .. segments");
   return resolved;
 }
 function validateOwnedPaths(repoRoot, ownedPaths) {
   return ownedPaths.map((owned) => {
-    const resolved = path17.resolve(repoRoot, owned);
-    const rel = path17.relative(repoRoot, resolved);
-    if (rel.startsWith("..") || path17.isAbsolute(rel)) {
+    const resolved = path18.resolve(repoRoot, owned);
+    const rel = path18.relative(repoRoot, resolved);
+    if (rel.startsWith("..") || path18.isAbsolute(rel)) {
       throw new Error(`owned path escapes repo: ${owned}`);
     }
     return resolved;
@@ -4096,7 +4162,7 @@ function validateTailLines(lines) {
 
 // src/worktree.ts
 import { existsSync as existsSync14, mkdirSync as mkdirSync5 } from "node:fs";
-import path18 from "node:path";
+import path19 from "node:path";
 function createRun(args) {
   const repo = validateRepo(required(String(args.repo || ""), "--repo"));
   ensureGitRepo(repo);
@@ -4116,12 +4182,12 @@ function createRun(args) {
     createdAt: (/* @__PURE__ */ new Date()).toISOString(),
     workers: {}
   };
-  writeJson(path18.join(dir, "run.json"), run);
+  writeJson(path19.join(dir, "run.json"), run);
   console.log(JSON.stringify({ runId: id, runDir: dir, repo, base, baseCommit }, null, 2));
 }
 function listRuns() {
   const { runsDir } = getPaths();
-  const rows = listRunIds(runsDir).map((id) => readJson(path18.join(runDirectory(id), "run.json"), void 0)).filter(Boolean).map((run) => ({
+  const rows = listRunIds(runsDir).map((id) => readJson(path19.join(runDirectory(id), "run.json"), void 0)).filter(Boolean).map((run) => ({
     id: run.id,
     name: run.name,
     status: run.status,
@@ -4136,7 +4202,7 @@ function failExists(message) {
 }
 
 // src/sweep.ts
-import path19 from "node:path";
+import path20 from "node:path";
 async function sweepRun(args) {
   const pipeline = args.pipeline === true || args.pipeline === "true";
   try {
@@ -4149,7 +4215,7 @@ async function sweepRun(args) {
     const releasedLocalOrphans = [];
     for (const name of Object.keys(run.workers || {})) {
       const worker = readJson(
-        path19.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+        path20.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
         void 0
       );
       if (!worker || !worker.dispatched || !worker.taskId) continue;
@@ -4196,7 +4262,7 @@ import { mkdirSync as mkdirSync7, realpathSync } from "node:fs";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 
 // src/pipeline-tick.ts
-import path28 from "node:path";
+import path29 from "node:path";
 
 // src/pipeline-dispatch.ts
 var RESERVED_REVIEW_STARTS = 1;
@@ -4250,10 +4316,10 @@ async function runPipelineDispatch(args, slots) {
 }
 
 // src/stale-reconcile.ts
-import path21 from "node:path";
+import path22 from "node:path";
 
 // src/finalize.ts
-import path20 from "node:path";
+import path21 from "node:path";
 var ACTIVE_RUN_STATUSES = /* @__PURE__ */ new Set(["running", "dispatching", "pending", "queued"]);
 function terminalStatusFor(run) {
   const names = Object.keys(run.workers || {});
@@ -4264,7 +4330,7 @@ function terminalStatusFor(run) {
   let anyLandingBlocked = false;
   for (const name of names) {
     const worker = readJson(
-      path20.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path21.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker) continue;
@@ -4316,7 +4382,7 @@ function reconcileStaleWorkers() {
   const now = Date.now();
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers || {})) {
-      const workerPath = path21.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path22.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker || worker.status !== "running") {
         outcomes.push({
@@ -4410,7 +4476,7 @@ function reconcileRunsCli() {
 }
 
 // src/plan-progress-daemon-sync.ts
-import path22 from "node:path";
+import path23 from "node:path";
 
 // src/plan-progress-sync.ts
 async function syncPlanProgress(args) {
@@ -4434,7 +4500,7 @@ async function syncActiveWorkerPlanProgress(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path22.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path23.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.dispatched || !worker.taskId) continue;
@@ -4483,7 +4549,7 @@ async function fetchWorkspaceRuntimePreferences(agentOsId, args) {
 }
 
 // src/cleanup.ts
-import path27 from "node:path";
+import path28 from "node:path";
 
 // src/cleanup-types.ts
 var DEFAULT_NODE_MODULES_AGE_MS = 6 * 60 * 60 * 1e3;
@@ -4555,11 +4621,11 @@ function skipNodeModulesRemoval(input) {
 
 // src/cleanup-execute.ts
 import { existsSync as existsSync16, rmSync } from "node:fs";
-import path24 from "node:path";
+import path25 from "node:path";
 
 // src/cleanup-dir-size.ts
 import { existsSync as existsSync15, readdirSync as readdirSync5, statSync as statSync2 } from "node:fs";
-import path23 from "node:path";
+import path24 from "node:path";
 function directorySizeBytes(root, maxEntries = 5e4) {
   if (!existsSync15(root)) return 0;
   let total = 0;
@@ -4575,7 +4641,7 @@ function directorySizeBytes(root, maxEntries = 5e4) {
     }
     for (const name of entries) {
       if (seen++ > maxEntries) return null;
-      const full = path23.join(current, name);
+      const full = path24.join(current, name);
       let st;
       try {
         st = statSync2(full);
@@ -4659,20 +4725,20 @@ function removeWorktree(candidate, execute) {
   }
 }
 function isHarnessNodeModulesPath(targetPath, harnessRoot, worktreesDir) {
-  const resolved = path24.resolve(targetPath);
-  const nm = resolved.endsWith(`${path24.sep}node_modules`) ? resolved : null;
+  const resolved = path25.resolve(targetPath);
+  const nm = resolved.endsWith(`${path25.sep}node_modules`) ? resolved : null;
   if (!nm) return "path_outside_harness";
-  const rel = path24.relative(worktreesDir, nm);
-  if (rel.startsWith("..") || path24.isAbsolute(rel)) return "path_outside_harness";
-  const parts = rel.split(path24.sep);
+  const rel = path25.relative(worktreesDir, nm);
+  if (rel.startsWith("..") || path25.isAbsolute(rel)) return "path_outside_harness";
+  const parts = rel.split(path25.sep);
   if (parts.length < 3 || parts[parts.length - 1] !== "node_modules") return "path_outside_harness";
-  if (!resolved.startsWith(path24.resolve(harnessRoot))) return "path_outside_harness";
+  if (!resolved.startsWith(path25.resolve(harnessRoot))) return "path_outside_harness";
   return null;
 }
 
 // src/cleanup-scan.ts
 import { existsSync as existsSync17, readdirSync as readdirSync6, statSync as statSync3 } from "node:fs";
-import path25 from "node:path";
+import path26 from "node:path";
 function pathAgeMs(target, now) {
   try {
     const mtime = statSync3(target).mtimeMs;
@@ -4682,17 +4748,17 @@ function pathAgeMs(target, now) {
   }
 }
 function isPathInside(child, parent) {
-  const rel = path25.relative(parent, child);
-  return rel === "" || !rel.startsWith("..") && !path25.isAbsolute(rel);
+  const rel = path26.relative(parent, child);
+  return rel === "" || !rel.startsWith("..") && !path26.isAbsolute(rel);
 }
 function scanNodeModulesCandidates(opts) {
   const candidates = [];
   const seen = /* @__PURE__ */ new Set();
   for (const entry of opts.index.values()) {
     if (opts.runIdFilter && entry.runId !== opts.runIdFilter) continue;
-    const nm = path25.join(entry.worktreePath, "node_modules");
+    const nm = path26.join(entry.worktreePath, "node_modules");
     if (!existsSync17(nm)) continue;
-    const resolved = path25.resolve(nm);
+    const resolved = path26.resolve(nm);
     if (seen.has(resolved)) continue;
     seen.add(resolved);
     candidates.push({
@@ -4708,13 +4774,13 @@ function scanNodeModulesCandidates(opts) {
   if (!opts.includeOrphans || !existsSync17(opts.worktreesDir)) return candidates;
   for (const runEntry of readdirSync6(opts.worktreesDir, { withFileTypes: true })) {
     if (!runEntry.isDirectory()) continue;
-    const runPath = path25.join(opts.worktreesDir, runEntry.name);
+    const runPath = path26.join(opts.worktreesDir, runEntry.name);
     for (const workerEntry of readdirSync6(runPath, { withFileTypes: true })) {
       if (!workerEntry.isDirectory()) continue;
-      const worktreePath = path25.join(runPath, workerEntry.name);
-      const nm = path25.join(worktreePath, "node_modules");
+      const worktreePath = path26.join(runPath, workerEntry.name);
+      const nm = path26.join(worktreePath, "node_modules");
       if (!existsSync17(nm)) continue;
-      const resolved = path25.resolve(nm);
+      const resolved = path26.resolve(nm);
       if (seen.has(resolved)) continue;
       if (!isPathInside(resolved, opts.harnessRoot)) continue;
       seen.add(resolved);
@@ -4754,17 +4820,17 @@ function scanWorktreeCandidates(opts) {
 }
 
 // src/cleanup-worktree-index.ts
-import path26 from "node:path";
+import path27 from "node:path";
 function buildWorktreeIndex() {
   const index = /* @__PURE__ */ new Map();
   for (const run of listRunRecords()) {
     for (const name of Object.keys(run.workers || {})) {
-      const workerPath = path26.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
+      const workerPath = path27.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json");
       const worker = readJson(workerPath, void 0);
       if (!worker?.worktreePath) continue;
       const status = computeWorkerStatus(worker, { base: run.base, baseCommit: run.baseCommit });
-      index.set(path26.resolve(worker.worktreePath), {
-        worktreePath: path26.resolve(worker.worktreePath),
+      index.set(path27.resolve(worker.worktreePath), {
+        worktreePath: path27.resolve(worker.worktreePath),
         runId: run.id,
         workerName: name,
         run,
@@ -4778,8 +4844,8 @@ function buildWorktreeIndex() {
 
 // src/cleanup.ts
 function resolveOptions(options = {}) {
-  const harnessRoot = options.harnessRoot ? path27.resolve(options.harnessRoot) : resolveHarnessRoot();
-  const { worktreesDir } = options.harnessRoot ? { worktreesDir: path27.join(harnessRoot, "worktrees") } : getHarnessPaths();
+  const harnessRoot = options.harnessRoot ? resolveUserPath(options.harnessRoot) : resolveHarnessRoot();
+  const { worktreesDir } = options.harnessRoot ? { worktreesDir: path28.join(harnessRoot, "worktrees") } : getHarnessPaths();
   const execute = options.execute === true;
   const nodeModulesAgeMs = options.nodeModulesAgeMs ?? DEFAULT_NODE_MODULES_AGE_MS;
   const worktreesAgeMs = options.worktreesAgeMs ?? 0;
@@ -4823,7 +4889,7 @@ function runHarnessCleanup(options = {}) {
       actions.push({ ...candidate, executed: false, skipped: true, skipReason: pathSkip });
       continue;
     }
-    const worktreePath = path27.resolve(candidate.path, "..");
+    const worktreePath = path28.resolve(candidate.path, "..");
     const indexed = index.get(worktreePath) ?? null;
     const guardReason = skipNodeModulesRemoval({
       indexed,
@@ -4839,7 +4905,7 @@ function runHarnessCleanup(options = {}) {
     actions.push(removeNodeModules(candidate, resolved.execute));
   }
   for (const candidate of scanWorktreeCandidates(scanOpts)) {
-    const indexed = index.get(path27.resolve(candidate.path)) ?? null;
+    const indexed = index.get(path28.resolve(candidate.path)) ?? null;
     const guardReason = skipWorktreeRemoval({
       indexed,
       includeOrphans: resolved.includeOrphans,
@@ -4908,7 +4974,7 @@ async function completeFinishedWorkers(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path28.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path29.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || worker.localOnly) continue;
@@ -5243,7 +5309,7 @@ function runCleanupCli(args) {
 }
 
 // src/monitor/monitor.service.ts
-import path30 from "node:path";
+import path31 from "node:path";
 
 // src/monitor/monitor.classify.ts
 function expectedLeaseOwner(runId) {
@@ -5300,10 +5366,10 @@ function classifyWorkerHealth(input) {
 
 // src/monitor/monitor.store.ts
 import { existsSync as existsSync18, mkdirSync as mkdirSync6, readdirSync as readdirSync7, unlinkSync as unlinkSync2 } from "node:fs";
-import path29 from "node:path";
+import path30 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path29.join(harnessRoot, "monitors");
+  const dir = path30.join(harnessRoot, "monitors");
   mkdirSync6(dir, { recursive: true });
   return dir;
 }
@@ -5311,7 +5377,7 @@ function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path29.join(monitorsDir(), `${monitorId}.json`);
+  return path30.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -5332,7 +5398,7 @@ function listMonitorSessions() {
   for (const name of readdirSync7(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path29.join(dir, name),
+      path30.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -5423,7 +5489,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path30.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path31.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -5626,17 +5692,17 @@ async function runMonitorLoop(args) {
 // src/monitor/monitor-spawn.ts
 import { spawn as spawn4 } from "node:child_process";
 import { closeSync as closeSync4, existsSync as existsSync19, openSync as openSync4 } from "node:fs";
-import path31 from "node:path";
+import path32 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path31.join(fileURLToPath3(new URL(".", import.meta.url)), "..", "cli.js");
+  return path32.join(fileURLToPath3(new URL(".", import.meta.url)), "..", "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
   if (!existsSync19(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path31.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path32.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
     logFd = openSync4(logPath, "a");
@@ -5755,6 +5821,422 @@ async function monitorTickCli(args) {
   console.log(JSON.stringify(tick, null, 2));
 }
 
+// src/doctor/runtime-takeover.ts
+import path34 from "node:path";
+
+// src/doctor/runtime-takeover.probes.ts
+import { accessSync, constants, existsSync as existsSync20, readFileSync as readFileSync9 } from "node:fs";
+import { homedir as homedir5 } from "node:os";
+import path33 from "node:path";
+import { spawnSync as spawnSync3 } from "node:child_process";
+function captureCommand(bin, args) {
+  try {
+    const res = spawnSync3(bin, args, { encoding: "utf8" });
+    const stdout = (res.stdout || "").trim();
+    const stderr = (res.stderr || "").trim();
+    const ok = res.status === 0;
+    return {
+      ok,
+      stdout,
+      stderr,
+      error: res.error?.message
+    };
+  } catch (error) {
+    return {
+      ok: false,
+      stdout: "",
+      stderr: "",
+      error: error.message
+    };
+  }
+}
+function tokenPrefix(token) {
+  const trimmed = token?.trim();
+  if (!trimmed) return void 0;
+  return trimmed.length <= 12 ? `${trimmed}\u2026` : `${trimmed.slice(0, 12)}\u2026`;
+}
+function isWritable(target) {
+  if (!existsSync20(target)) return false;
+  try {
+    accessSync(target, constants.W_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+var defaultRuntimeTakeoverProbes = {
+  packageVersion: () => PACKAGE_VERSION,
+  commandOnPath: (bin) => captureCommand(process.platform === "win32" ? "where" : "which", [bin]),
+  kynverVersion: (bin) => captureCommand(bin, ["--version"]),
+  loadConfig: () => loadUserConfig(),
+  configFilePath: () => path33.join(homedir5(), ".kynver", "config.json"),
+  credentialsFilePath: () => path33.join(homedir5(), ".kynver", "credentials"),
+  readCredentials: () => {
+    const credPath = path33.join(homedir5(), ".kynver", "credentials");
+    if (!existsSync20(credPath)) {
+      return { hasApiKey: false };
+    }
+    try {
+      const parsed = JSON.parse(readFileSync9(credPath, "utf8"));
+      return {
+        hasApiKey: Boolean(parsed.apiKey?.trim()),
+        runnerTokenPrefix: tokenPrefix(parsed.runnerToken),
+        runnerTokenAgentOsId: parsed.runnerTokenAgentOsId
+      };
+    } catch {
+      return { hasApiKey: false };
+    }
+  },
+  envSnapshot: () => ({
+    kynverApiUrl: process.env.KYNVER_API_URL?.trim() || void 0,
+    openclawCronFireBaseUrl: process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim() || void 0,
+    kynverRunnerTokenPrefix: tokenPrefix(process.env.KYNVER_RUNNER_TOKEN),
+    kynverRuntimeSecret: Boolean(process.env.KYNVER_RUNTIME_SECRET?.trim()),
+    openclawCronSecret: Boolean(process.env.OPENCLAW_CRON_SECRET?.trim()),
+    kynverHarnessRoot: process.env.KYNVER_HARNESS_ROOT?.trim() || void 0,
+    opusHarnessRoot: process.env.OPUS_HARNESS_ROOT?.trim() || void 0,
+    kynverSchedulerProvider: process.env.KYNVER_SCHEDULER_PROVIDER?.trim() || void 0
+  }),
+  harnessRoot: () => resolveHarnessRoot(),
+  legacyOpenclawHarnessRoot: () => path33.join(homedir5(), ".openclaw", "harness"),
+  pathExists: (target) => existsSync20(target),
+  pathWritable: (target) => isWritable(target),
+  vercelVersion: () => captureCommand("vercel", ["--version"]),
+  vercelWhoami: () => captureCommand("vercel", ["whoami"])
+};
+
+// src/doctor/runtime-takeover.ts
+function check(partial) {
+  return partial;
+}
+function summarizeCounts(sections) {
+  const counts = { pass: 0, warn: 0, fail: 0 };
+  for (const section of sections) {
+    for (const item of section.checks) {
+      counts[item.status] += 1;
+    }
+  }
+  return counts;
+}
+function assessCliPackage(probes) {
+  const runningVersion = probes.packageVersion();
+  const which = probes.commandOnPath("kynver");
+  const onPath = which.ok && which.stdout.length > 0;
+  const firstPath = onPath ? which.stdout.split(/\r?\n/)[0]?.trim() : void 0;
+  const displayCliPath = firstPath ? displayUserPath(firstPath) : void 0;
+  const checks = [
+    check({
+      id: "cli_running_version",
+      label: "Running @kynver-app/runtime version",
+      status: "pass",
+      summary: `@kynver-app/runtime ${runningVersion}`,
+      details: { version: runningVersion }
+    }),
+    check({
+      id: "cli_on_path",
+      label: "kynver executable on PATH",
+      status: onPath ? "pass" : "warn",
+      summary: onPath ? `Found ${displayCliPath}` : "kynver not found on PATH (invoked via node/npx?)",
+      remediation: onPath ? void 0 : "Install globally (`npm i -g @kynver-app/runtime`) or invoke via `npx @kynver-app/runtime`.",
+      details: { path: displayCliPath }
+    })
+  ];
+  if (onPath && firstPath) {
+    const versionProbe = probes.kynverVersion(firstPath);
+    const installedVersion = versionProbe.stdout.replace(/^kynver\s+/i, "").trim() || void 0;
+    const versionMatch = versionProbe.ok && (!installedVersion || installedVersion === runningVersion);
+    checks.push(
+      check({
+        id: "cli_installed_version",
+        label: "Installed kynver CLI version matches running package",
+        status: versionMatch ? "pass" : "warn",
+        summary: versionProbe.ok && installedVersion ? versionMatch ? `Installed ${installedVersion}` : `Installed ${installedVersion} differs from running ${runningVersion}` : versionProbe.error ? `Could not read installed version (${versionProbe.error})` : versionProbe.stderr || "Could not read installed version",
+        remediation: versionMatch ? void 0 : "Reinstall or rebuild @kynver-app/runtime so PATH kynver matches the harness worktree version.",
+        details: { installedVersion, runningVersion, path: displayCliPath }
+      })
+    );
+  }
+  return { id: "cli_package", label: "CLI / package", checks };
+}
+function assessUserConfig(probes) {
+  const configPath = probes.configFilePath();
+  const displayConfigPath = displayUserPath(configPath);
+  const exists = probes.pathExists(configPath);
+  const config = probes.loadConfig();
+  const checks = [
+    check({
+      id: "config_file",
+      label: "~/.kynver/config.json present",
+      status: exists ? "pass" : "fail",
+      summary: exists ? `Found ${displayConfigPath}` : `Missing ${displayConfigPath}`,
+      remediation: exists ? void 0 : "Run `kynver setup --api-base-url <url> --agent-os-id <id> --repo <path>`.",
+      details: { configPath: displayConfigPath }
+    })
+  ];
+  if (exists) {
+    const apiBaseUrl = config.apiBaseUrl?.trim();
+    const agentOsId = config.agentOsId?.trim();
+    const defaultRepo = config.defaultRepo?.trim();
+    const displayDefaultRepo = defaultRepo ? displayUserPath(defaultRepo) : null;
+    checks.push(
+      check({
+        id: "config_api_base_url",
+        label: "Default API base URL",
+        status: apiBaseUrl ? "pass" : "warn",
+        summary: apiBaseUrl ?? "Not set in config (KYNVER_API_URL / --base-url required per command)",
+        remediation: apiBaseUrl ? void 0 : "Set `apiBaseUrl` via `kynver setup --api-base-url https://\u2026`.",
+        details: { apiBaseUrl: apiBaseUrl ?? null }
+      }),
+      check({
+        id: "config_agent_os_id",
+        label: "Default AgentOS id",
+        status: agentOsId ? "pass" : "warn",
+        summary: agentOsId ?? "Not set (pass --agent-os-id on daemon/dispatch/worker commands)",
+        remediation: agentOsId ? void 0 : "Set `agentOsId` via `kynver setup --agent-os-id <uuid>`.",
+        details: { agentOsId: agentOsId ?? null, agentOsSlug: config.agentOsSlug ?? null }
+      }),
+      check({
+        id: "config_default_repo",
+        label: "Default repo path",
+        status: defaultRepo ? "pass" : "warn",
+        summary: displayDefaultRepo ?? "Not set (pass --repo on `kynver run create`)",
+        remediation: defaultRepo ? void 0 : "Set `defaultRepo` via `kynver setup --repo /path/to/repo`.",
+        details: {
+          defaultRepo: displayDefaultRepo,
+          harnessRoot: config.harnessRoot ? redactHomePath(config.harnessRoot) : null
+        }
+      })
+    );
+  }
+  return { id: "user_config", label: "User config (~/.kynver)", checks };
+}
+function assessRunnerToken(probes) {
+  const config = probes.loadConfig();
+  const targetAgentOsId = config.agentOsId?.trim();
+  const creds = probes.readCredentials();
+  const env = probes.envSnapshot();
+  const credPath = probes.credentialsFilePath();
+  const displayCredPath = displayUserPath(credPath);
+  const envToken = env.kynverRunnerTokenPrefix;
+  const savedToken = creds.runnerTokenPrefix;
+  const savedAgentOsId = creds.runnerTokenAgentOsId;
+  const scopedSaved = Boolean(savedToken) && (!targetAgentOsId || !savedAgentOsId || savedAgentOsId === targetAgentOsId);
+  const hasScoped = Boolean(envToken?.startsWith("krc1.")) || scopedSaved && savedToken?.startsWith("krc1.");
+  const checks = [
+    check({
+      id: "runner_token_scoped",
+      label: "Scoped runner token (krc1.*) ready",
+      status: hasScoped ? "pass" : "fail",
+      summary: hasScoped ? envToken ? "KYNVER_RUNNER_TOKEN is set (scoped prefix shown)" : `Saved scoped token for agentOsId ${savedAgentOsId ?? targetAgentOsId ?? "(unknown)"}` : "No scoped runner token for the configured AgentOS workspace",
+      remediation: hasScoped ? void 0 : "Run `kynver login` then `kynver runner credential --agent-os-id <id>` (or `kynver setup` with API key).",
+      details: {
+        source: envToken ? "env" : savedToken ? "credentials" : "none",
+        tokenPrefix: envToken ?? (scopedSaved ? savedToken : void 0),
+        agentOsId: targetAgentOsId ?? savedAgentOsId ?? null,
+        credentialsPath: displayCredPath
+      }
+    }),
+    check({
+      id: "runner_token_agent_os_match",
+      label: "Saved runner token matches configured agentOsId",
+      status: !savedToken || !targetAgentOsId || !savedAgentOsId || savedAgentOsId === targetAgentOsId ? "pass" : "warn",
+      summary: !savedToken || !savedAgentOsId ? "No saved token agentOsId to compare" : !targetAgentOsId ? "Config agentOsId unset \u2014 token scope not validated against config" : savedAgentOsId === targetAgentOsId ? "Saved token scoped to configured agentOsId" : `Saved token is for ${savedAgentOsId}, config expects ${targetAgentOsId}`,
+      remediation: savedToken && targetAgentOsId && savedAgentOsId && savedAgentOsId !== targetAgentOsId ? "`kynver runner credential --agent-os-id <configured-id>` to mint a workspace-bound token." : void 0,
+      details: { configuredAgentOsId: targetAgentOsId ?? null, savedAgentOsId: savedAgentOsId ?? null }
+    }),
+    check({
+      id: "runner_api_key_for_refresh",
+      label: "API key available for token refresh",
+      status: creds.hasApiKey || Boolean(process.env.KYNVER_API_KEY?.trim()) ? "pass" : "warn",
+      summary: creds.hasApiKey || process.env.KYNVER_API_KEY ? "KYNVER API key present for runner credential mint/refresh" : "No API key \u2014 401 callback recovery cannot auto-mint a replacement token",
+      remediation: creds.hasApiKey || process.env.KYNVER_API_KEY ? void 0 : "Run `kynver login --api-key \u2026`.",
+      details: { credentialsPath: displayCredPath, hasApiKey: creds.hasApiKey || Boolean(process.env.KYNVER_API_KEY) }
+    })
+  ];
+  return { id: "runner_token", label: "Runner token readiness", checks };
+}
+function assessVercelCli(probes) {
+  const version = probes.vercelVersion();
+  const whoami = probes.vercelWhoami();
+  const installed = version.ok;
+  return {
+    id: "vercel_cli",
+    label: "Vercel CLI",
+    checks: [
+      check({
+        id: "vercel_installed",
+        label: "Vercel CLI installed",
+        status: installed ? "pass" : "warn",
+        summary: installed ? version.stdout || "vercel CLI found" : version.error ?? "vercel not found on PATH",
+        remediation: installed ? void 0 : "Install Vercel CLI (`npm i -g vercel`) for deploy evidence and env pulls.",
+        details: { stderr: version.stderr || null }
+      }),
+      check({
+        id: "vercel_authenticated",
+        label: "Vercel CLI authenticated",
+        status: !installed ? "warn" : whoami.ok ? "pass" : "warn",
+        summary: !installed ? "Skipped \u2014 Vercel CLI not installed" : whoami.ok ? `Authenticated as ${whoami.stdout}` : whoami.stderr || whoami.error || "Not logged in",
+        remediation: installed && !whoami.ok ? "Run `vercel login` and link the Kynver project if needed." : void 0,
+        details: { account: whoami.ok ? whoami.stdout : null }
+      })
+    ]
+  };
+}
+function assessHarnessDirs(probes) {
+  const harnessRoot = probes.harnessRoot();
+  const runsDir = path34.join(harnessRoot, "runs");
+  const worktreesDir = path34.join(harnessRoot, "worktrees");
+  const displayHarnessRoot = redactHomePath(harnessRoot);
+  const displayRunsDir = redactHomePath(runsDir);
+  const displayWorktreesDir = redactHomePath(worktreesDir);
+  const runsExists = probes.pathExists(runsDir);
+  const worktreesExists = probes.pathExists(worktreesDir);
+  return {
+    id: "harness_dirs",
+    label: "Harness / daemon directories",
+    checks: [
+      check({
+        id: "harness_root",
+        label: "Harness root resolved",
+        status: "pass",
+        summary: displayHarnessRoot,
+        details: { harnessRoot: displayHarnessRoot }
+      }),
+      check({
+        id: "harness_runs_dir",
+        label: "Runs directory ready",
+        status: runsExists && probes.pathWritable(runsDir) ? "pass" : runsExists ? "warn" : "warn",
+        summary: runsExists ? probes.pathWritable(runsDir) ? `Writable ${displayRunsDir}` : `Exists but not writable: ${displayRunsDir}` : `Will be created on first run: ${displayRunsDir}`,
+        remediation: runsExists && !probes.pathWritable(runsDir) ? `Fix permissions on ${displayRunsDir} or set KYNVER_HARNESS_ROOT to a writable path.` : void 0,
+        details: { runsDir: displayRunsDir, exists: runsExists, writable: probes.pathWritable(runsDir) }
+      }),
+      check({
+        id: "harness_worktrees_dir",
+        label: "Worktrees directory ready",
+        status: worktreesExists && probes.pathWritable(worktreesDir) ? "pass" : "warn",
+        summary: worktreesExists ? probes.pathWritable(worktreesDir) ? `Writable ${displayWorktreesDir}` : `Exists but not writable: ${displayWorktreesDir}` : `Will be created on first worker: ${displayWorktreesDir}`,
+        remediation: worktreesExists && !probes.pathWritable(worktreesDir) ? `Fix permissions on ${displayWorktreesDir}.` : void 0,
+        details: { worktreesDir: displayWorktreesDir, exists: worktreesExists, writable: probes.pathWritable(worktreesDir) }
+      })
+    ]
+  };
+}
+function assessCallbackAuth(probes) {
+  const config = probes.loadConfig();
+  const env = probes.envSnapshot();
+  const baseUrl = env.kynverApiUrl ?? config.apiBaseUrl?.trim() ?? env.openclawCronFireBaseUrl;
+  const usingLegacyBase = !env.kynverApiUrl && !config.apiBaseUrl && Boolean(env.openclawCronFireBaseUrl);
+  const legacySecret = env.openclawCronSecret || env.kynverRuntimeSecret;
+  const envScoped = env.kynverRunnerTokenPrefix?.startsWith("krc1.");
+  const creds = probes.readCredentials();
+  const savedScoped = creds.runnerTokenPrefix?.startsWith("krc1.");
+  const checks = [
+    check({
+      id: "callback_base_url",
+      label: "Callback base URL configured",
+      status: baseUrl ? usingLegacyBase ? "warn" : "pass" : "fail",
+      summary: baseUrl ? usingLegacyBase ? `Using legacy OPENCLAW_CRON_FIRE_BASE_URL (${baseUrl})` : baseUrl : "No KYNVER_API_URL, config apiBaseUrl, or legacy OpenClaw base URL",
+      remediation: baseUrl ? usingLegacyBase ? "Migrate to KYNVER_API_URL or `kynver setup --api-base-url` and drop OPENCLAW_CRON_FIRE_BASE_URL." : void 0 : "Set KYNVER_API_URL or run `kynver setup --api-base-url https://\u2026`.",
+      details: {
+        source: env.kynverApiUrl ? "KYNVER_API_URL" : config.apiBaseUrl ? "config.apiBaseUrl" : env.openclawCronFireBaseUrl ? "OPENCLAW_CRON_FIRE_BASE_URL" : "none",
+        baseUrl: baseUrl ?? null
+      }
+    }),
+    check({
+      id: "callback_auth_mode",
+      label: "Callback auth uses scoped runner token",
+      status: envScoped || savedScoped ? "pass" : legacySecret ? "warn" : "fail",
+      summary: envScoped ? "KYNVER_RUNNER_TOKEN scoped token will be sent as X-Kynver-Runner-Token" : savedScoped ? "Saved krc1.* token in ~/.kynver/credentials" : legacySecret ? "Deployment-level KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET in use (legacy headers)" : "No callback secret configured",
+      remediation: envScoped || savedScoped ? void 0 : "Mint a scoped token: `kynver runner credential --agent-os-id <id>`. Avoid shared OPENCLAW_CRON_SECRET on user runners.",
+      details: {
+        mode: envScoped || savedScoped ? "scoped" : legacySecret ? "legacy_global_secret" : "missing",
+        legacyHeadersWhenNotScoped: ["X-OpenClaw-Cron-Secret", "X-Kynver-Runtime-Secret"]
+      }
+    })
+  ];
+  return { id: "callback_auth", label: "Callback auth / config", checks };
+}
+function assessOpenclawHotspots(probes) {
+  const env = probes.envSnapshot();
+  const harnessRoot = probes.harnessRoot();
+  const legacyRoot = probes.legacyOpenclawHarnessRoot();
+  const displayHarnessRoot = redactHomePath(harnessRoot);
+  const displayLegacyRoot = redactHomePath(legacyRoot);
+  const displayOpusHarnessRoot = env.opusHarnessRoot ? redactHomePath(env.opusHarnessRoot) : null;
+  const legacyHarnessActive = harnessRoot === legacyRoot && probes.pathExists(legacyRoot);
+  const schedulerOpenclaw = !env.kynverSchedulerProvider || env.kynverSchedulerProvider === "openclaw-cron";
+  const checks = [
+    check({
+      id: "hotspot_legacy_harness_root",
+      label: "Legacy ~/.openclaw/harness still active",
+      status: legacyHarnessActive ? "warn" : "pass",
+      summary: legacyHarnessActive ? `Harness root is legacy ${displayLegacyRoot}` : env.opusHarnessRoot ? `OPUS_HARNESS_ROOT override in use (${displayOpusHarnessRoot})` : `Using ${displayHarnessRoot}`,
+      remediation: legacyHarnessActive ? "Set KYNVER_HARNESS_ROOT=~/.kynver/harness (or run setup), migrate artifacts, retire OPUS_HARNESS_ROOT." : env.opusHarnessRoot ? "Prefer KYNVER_HARNESS_ROOT over OPUS_HARNESS_ROOT." : void 0,
+      details: { harnessRoot: displayHarnessRoot, legacyRoot: displayLegacyRoot, opusHarnessRoot: displayOpusHarnessRoot }
+    }),
+    check({
+      id: "hotspot_openclaw_env_secrets",
+      label: "OpenClaw deployment secrets in runner env",
+      status: env.openclawCronSecret || env.openclawCronFireBaseUrl ? "warn" : "pass",
+      summary: env.openclawCronSecret || env.openclawCronFireBaseUrl ? [
+        env.openclawCronSecret ? "OPENCLAW_CRON_SECRET set" : null,
+        env.openclawCronFireBaseUrl ? "OPENCLAW_CRON_FIRE_BASE_URL set" : null
+      ].filter(Boolean).join("; ") : "No OpenClaw cron env overrides on this runner",
+      remediation: env.openclawCronSecret || env.openclawCronFireBaseUrl ? "Move to KYNVER_API_URL + scoped runner tokens; unset OpenClaw cron env on user-hosted runners." : void 0
+    }),
+    check({
+      id: "hotspot_openclaw_scheduler",
+      label: "openclaw-cron scheduler dependency (deployment)",
+      status: schedulerOpenclaw ? "warn" : "pass",
+      summary: schedulerOpenclaw ? env.kynverSchedulerProvider === "openclaw-cron" ? "KYNVER_SCHEDULER_PROVIDER=openclaw-cron \u2014 AgentOS ticks still routed via OpenClaw local cron adapter" : "KYNVER_SCHEDULER_PROVIDER unset \u2014 server may fall back to openclaw-cron when QStash is absent" : `KYNVER_SCHEDULER_PROVIDER=${env.kynverSchedulerProvider}`,
+      remediation: schedulerOpenclaw ? "On Kynver-hosted scheduler: set KYNVER_SCHEDULER_PROVIDER=qstash where QStash is configured; retire openclaw-cron stub when runtime daemon owns dispatch." : void 0,
+      details: { schedulerProvider: env.kynverSchedulerProvider ?? null }
+    }),
+    check({
+      id: "hotspot_lease_source_names",
+      label: "Harness lease/completion source names",
+      status: "pass",
+      summary: "Runtime uses kynver-harness:* lease owners and completion source kynver-harness (OpenClaw names retired in runtime)",
+      details: {
+        leaseOwnerPattern: "kynver-harness:<runId>",
+        completionSource: "kynver-harness",
+        note: "OpenClaw adapter remains optional in packages/kynver-openclaw-agent-os only"
+      }
+    })
+  ];
+  return { id: "openclaw_hotspots", label: "OpenClaw dependency hotspots", checks };
+}
+function assessRuntimeTakeoverReadiness(probes = defaultRuntimeTakeoverProbes) {
+  const sections = [
+    assessCliPackage(probes),
+    assessUserConfig(probes),
+    assessRunnerToken(probes),
+    assessVercelCli(probes),
+    assessHarnessDirs(probes),
+    assessCallbackAuth(probes),
+    assessOpenclawHotspots(probes)
+  ];
+  const counts = summarizeCounts(sections);
+  const ready = counts.fail === 0;
+  const summary = ready ? counts.warn > 0 ? `Ready with ${counts.warn} warning(s) \u2014 review remediation before retiring OpenClaw as primary runtime agent.` : "Ready \u2014 Kynver runtime can serve as primary runtime agent on this host." : `${counts.fail} blocking check(s) \u2014 fix failures before OpenClaw takeover.`;
+  return {
+    command: "doctor runtime-takeover",
+    ready,
+    summary,
+    counts,
+    sections
+  };
+}
+
+// src/doctor/runtime-takeover-cli.ts
+function runRuntimeTakeoverDoctorCli() {
+  const report = assessRuntimeTakeoverReadiness();
+  console.log(JSON.stringify(report, null, 2));
+  if (!report.ready) {
+    process.exitCode = 1;
+  }
+}
+
 // src/cli.ts
 function isHelpFlag(arg) {
   return arg === "help" || arg === "--help" || arg === "-h";
@@ -5797,7 +6279,8 @@ function usage(code = 0) {
       "  kynver monitor list",
       "  kynver monitor tick --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--auto-complete] [--renew-leases]",
       "  kynver monitor auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET]",
-      "  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]"
+      "  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]",
+      "  kynver doctor runtime-takeover"
     ].join("\n")
   );
   process.exit(code);
@@ -5808,7 +6291,7 @@ async function main(argv = process.argv.slice(2)) {
   const scope = argv.shift();
   let action;
   let rest;
-  if (scope === "run" || scope === "worker" || scope === "plan" || scope === "runner" || scope === "monitor") {
+  if (scope === "run" || scope === "worker" || scope === "plan" || scope === "runner" || scope === "monitor" || scope === "doctor") {
     action = argv.shift();
     rest = argv;
   } else {
@@ -5833,6 +6316,7 @@ async function main(argv = process.argv.slice(2)) {
     unknownCommand("plan", `outbox ${outboxAction ?? ""}`.trim());
   }
   if (scope === "cleanup") return runCleanupCli(args);
+  if (scope === "doctor" && action === "runtime-takeover") return runRuntimeTakeoverDoctorCli();
   if (scope === "run" && action === "create") return createRun(args);
   if (scope === "run" && action === "list") return listRuns();
   if (scope === "run" && action === "status") return runStatus(args);
@@ -5865,6 +6349,295 @@ if (isCliEntry) {
     process.exit(1);
   });
 }
+
+// src/vercel/vercel-url.ts
+var VERCEL_HOST_RE = /(^|\.)vercel\.app$/i;
+function tryParseUrl(raw) {
+  const trimmed = raw.trim();
+  if (!trimmed) return null;
+  try {
+    return new URL(trimmed);
+  } catch {
+    return null;
+  }
+}
+function parseDashboardDeployment(url) {
+  const parts = url.pathname.split("/").filter(Boolean);
+  if (parts.length < 3) return null;
+  const deploymentId = parts[parts.length - 1]?.trim();
+  if (!deploymentId || deploymentId === "deployments") return null;
+  return deploymentId;
+}
+function parseDeploymentsSegment(url) {
+  const parts = url.pathname.split("/").filter(Boolean);
+  const idx = parts.indexOf("deployments");
+  if (idx < 0 || idx >= parts.length - 1) return null;
+  const deploymentId = parts[idx + 1]?.trim();
+  return deploymentId || null;
+}
+function classifyVercelUrl(raw) {
+  const empty = {
+    kind: "unknown",
+    previewUrl: null,
+    inspectTarget: null,
+    deploymentId: null
+  };
+  const trimmed = raw.trim();
+  if (!trimmed) return empty;
+  if (/^dpl_[a-z0-9]+$/i.test(trimmed)) {
+    return {
+      kind: "deployment_id",
+      previewUrl: null,
+      inspectTarget: trimmed,
+      deploymentId: trimmed
+    };
+  }
+  const url = tryParseUrl(trimmed);
+  if (!url) return empty;
+  if (VERCEL_HOST_RE.test(url.hostname)) {
+    const hostUrl = url.origin;
+    return {
+      kind: "deployment_host",
+      previewUrl: hostUrl,
+      inspectTarget: hostUrl,
+      deploymentId: null
+    };
+  }
+  if (url.hostname === "vercel.com" || url.hostname.endsWith(".vercel.com")) {
+    const deploymentId = parseDeploymentsSegment(url) ?? parseDashboardDeployment(url);
+    return {
+      kind: "dashboard",
+      previewUrl: null,
+      inspectTarget: deploymentId,
+      deploymentId
+    };
+  }
+  return empty;
+}
+function isDashboardVercelUrl(raw) {
+  return classifyVercelUrl(raw).kind === "dashboard";
+}
+
+// src/vercel/vercel-github-status.ts
+var VERCEL_CONTEXT_RE = /vercel/i;
+function normalizeGitHubStatusState(state) {
+  const value = typeof state === "string" ? state.trim().toLowerCase() : "";
+  if (value === "success") return "success";
+  if (value === "pending") return "pending";
+  if (value === "failure") return "failure";
+  if (value === "error") return "error";
+  return "unknown";
+}
+function isVercelStatusContext(context) {
+  const label = typeof context === "string" ? context.trim() : "";
+  return Boolean(label && VERCEL_CONTEXT_RE.test(label));
+}
+function pickVercelStatusContext(statuses) {
+  const rows = Array.isArray(statuses) ? statuses : [];
+  const vercelRows = rows.filter((row) => isVercelStatusContext(row.context));
+  if (vercelRows.length === 0) return null;
+  const score = (state) => {
+    if (state === "failure" || state === "error") return 0;
+    if (state === "pending") return 1;
+    if (state === "success") return 2;
+    return 1;
+  };
+  let best = null;
+  let bestScore = -1;
+  for (const row of vercelRows) {
+    const rowScore = score(normalizeGitHubStatusState(row.state));
+    if (rowScore > bestScore) {
+      best = row;
+      bestScore = rowScore;
+    }
+  }
+  if (!best) return null;
+  const targetUrl = typeof best.target_url === "string" && best.target_url.trim() ? best.target_url.trim() : null;
+  const classified = targetUrl ? classifyVercelUrl(targetUrl) : null;
+  return {
+    context: String(best.context ?? "Vercel").trim(),
+    state: normalizeGitHubStatusState(best.state),
+    targetUrl,
+    description: typeof best.description === "string" && best.description.trim() ? best.description.trim() : null,
+    deploymentId: classified?.deploymentId ?? null,
+    previewUrl: classified?.previewUrl ?? null,
+    dashboardUrl: classified?.kind === "dashboard" ? targetUrl : null
+  };
+}
+
+// src/vercel/vercel-evidence.ts
+import { spawnSync as spawnSync4 } from "node:child_process";
+var DEFAULT_INSPECT_WAIT_SECONDS = 120;
+function mapGitHubStateToEvidence(state) {
+  if (state === "success") return "ready";
+  if (state === "pending") return "building";
+  if (state === "failure" || state === "error") return "error";
+  return "unavailable";
+}
+function evidenceSummary(parts) {
+  return parts.filter(Boolean).join("; ");
+}
+function resolveVercelInspectTarget(rawUrl) {
+  const trimmed = typeof rawUrl === "string" ? rawUrl.trim() : "";
+  if (!trimmed) {
+    return { target: null, classified: null, reason: "missing target_url" };
+  }
+  const classified = classifyVercelUrl(trimmed);
+  if (classified.inspectTarget) {
+    return { target: classified.inspectTarget, classified, reason: null };
+  }
+  if (classified.kind === "dashboard") {
+    return {
+      target: null,
+      classified,
+      reason: "dashboard URL is not valid for vercel inspect"
+    };
+  }
+  return { target: null, classified, reason: "unrecognized Vercel URL" };
+}
+function evidenceFromGitHubVercelStatus(statuses, options = {}) {
+  const observedAt = options.observedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const row = pickVercelStatusContext(statuses);
+  if (!row) {
+    return {
+      status: "not_run",
+      previewUrl: null,
+      deploymentUrl: null,
+      summary: "No Vercel GitHub status context on commit",
+      observedAt,
+      inspectSkipped: true,
+      inspectReason: "no_vercel_status_context",
+      githubState: null,
+      vercelContext: null
+    };
+  }
+  const status = mapGitHubStateToEvidence(row.state);
+  const previewUrl = row.previewUrl ?? row.dashboardUrl;
+  const deploymentUrl = row.previewUrl ?? row.dashboardUrl;
+  return {
+    status,
+    previewUrl,
+    deploymentUrl,
+    summary: evidenceSummary([
+      `GitHub ${row.context}=${row.state}`,
+      row.description ?? "",
+      row.dashboardUrl ? "dashboard target_url (inspect skipped)" : ""
+    ]),
+    observedAt,
+    inspectSkipped: true,
+    inspectReason: row.dashboardUrl && row.state === "success" ? "trusted_github_status_dashboard_url" : row.dashboardUrl ? "dashboard_url_not_inspectable" : "github_status_only",
+    githubState: row.state,
+    vercelContext: row.context
+  };
+}
+function defaultRunVercelInspect(target, waitSeconds) {
+  const args = ["inspect", target, "--wait", String(waitSeconds)];
+  const result = spawnSync4("vercel", args, {
+    encoding: "utf8",
+    stdio: ["ignore", "pipe", "pipe"]
+  });
+  if (result.error) {
+    return {
+      ok: false,
+      exitCode: result.status,
+      stdout: "",
+      stderr: "",
+      error: result.error.message
+    };
+  }
+  return {
+    ok: result.status === 0,
+    exitCode: result.status ?? 1,
+    stdout: (result.stdout ?? "").trim(),
+    stderr: (result.stderr ?? "").trim(),
+    error: null
+  };
+}
+function parseInspectReady(stdout, stderr) {
+  const blob = `${stdout}
+${stderr}`.toLowerCase();
+  if (/\b(status|state)\s*[:=]\s*(ready|completed)\b/.test(blob)) return true;
+  if (/\bready\b/.test(blob) && !/\bnot ready\b/.test(blob)) return true;
+  return false;
+}
+function collectVercelEvidence(input) {
+  const observedAt = input.observedAt ?? (/* @__PURE__ */ new Date()).toISOString();
+  const base = evidenceFromGitHubVercelStatus(input.statuses ?? [], { observedAt });
+  const row = pickVercelStatusContext(input.statuses ?? []);
+  if (!row) return base;
+  if (row.state === "success") {
+    return {
+      ...base,
+      inspectSkipped: true,
+      inspectReason: row.dashboardUrl ? "trusted_github_status_dashboard_url" : "trusted_github_status"
+    };
+  }
+  if (!input.allowInspect) {
+    return {
+      ...base,
+      inspectSkipped: true,
+      inspectReason: "inspect_disabled"
+    };
+  }
+  const { target, reason } = resolveVercelInspectTarget(row.targetUrl);
+  if (!target) {
+    return {
+      ...base,
+      inspectSkipped: true,
+      inspectReason: reason ?? "not_inspectable",
+      summary: evidenceSummary([
+        base.summary ?? "",
+        reason ?? "skipped vercel inspect"
+      ])
+    };
+  }
+  const waitSeconds = input.waitSeconds ?? DEFAULT_INSPECT_WAIT_SECONDS;
+  const runInspect = input.runInspect ?? defaultRunVercelInspect;
+  const inspected = runInspect(target, waitSeconds);
+  const observed = (/* @__PURE__ */ new Date()).toISOString();
+  if (inspected.error?.includes("ENOENT")) {
+    return {
+      status: "unavailable",
+      previewUrl: base.previewUrl,
+      deploymentUrl: base.deploymentUrl,
+      summary: "vercel CLI not found on PATH",
+      observedAt: observed,
+      inspectSkipped: true,
+      inspectReason: "vercel_cli_missing",
+      githubState: row.state,
+      vercelContext: row.context
+    };
+  }
+  if (!inspected.ok) {
+    const detail = [inspected.stderr, inspected.stdout, inspected.error].filter(Boolean).join("\n").trim().slice(0, 500);
+    return {
+      status: row.state === "pending" ? "building" : "error",
+      previewUrl: base.previewUrl,
+      deploymentUrl: target.startsWith("http") ? target : base.deploymentUrl,
+      summary: evidenceSummary([
+        `vercel inspect ${target} failed (exit ${inspected.exitCode ?? "?"})`,
+        detail
+      ]),
+      observedAt: observed,
+      inspectSkipped: false,
+      inspectReason: null,
+      githubState: row.state,
+      vercelContext: row.context
+    };
+  }
+  const ready = parseInspectReady(inspected.stdout, inspected.stderr);
+  return {
+    status: ready ? "ready" : row.state === "pending" ? "building" : "error",
+    previewUrl: target.startsWith("http") ? target : base.previewUrl,
+    deploymentUrl: target.startsWith("http") ? target : base.deploymentUrl,
+    summary: ready ? `vercel inspect ${target} ready` : `vercel inspect ${target} completed without ready signal`,
+    observedAt: observed,
+    inspectSkipped: false,
+    inspectReason: null,
+    githubState: row.state,
+    vercelContext: row.context
+  };
+}
 export {
   DEFAULT_DISPATCH_LEASE_MS,
   PACKAGE_VERSION,
@@ -5877,7 +6650,9 @@ export {
   autoCompleteWorkerCli,
   buildDispatchTaskText,
   buildPrompt,
+  classifyVercelUrl,
   classifyWorkerHealth,
+  collectVercelEvidence,
   completeWorker,
   computeAttention,
   computeWorkerStatus,
@@ -5886,15 +6661,18 @@ export {
   dispatchRun,
   drainPlanOutbox,
   ensurePrReadyHandoff,
+  evidenceFromGitHubVercelStatus,
   extractPlanOutboxFromTask,
   extractPrUrlFromText,
   formatPlanOutboxHandoffBlock,
   getHarnessPaths,
   getMonitorStatus,
   hashPlanBody,
+  isDashboardVercelUrl,
   isFinishedWorkerStatus,
   isLandingBlockedWorkerStatus,
   isTerminalHeartbeatPhase,
+  isVercelStatusContext,
   landingContractAttentionReason,
   listMonitors,
   listOutboxItems,
@@ -5908,6 +6686,7 @@ export {
   parseHarnessStream,
   parseHeartbeat,
   persistPlan,
+  pickVercelStatusContext,
   postJson,
   preflightCursorModel,
   reconcileRunsCli,
@@ -5917,6 +6696,7 @@ export {
   resolveCallbackSecret,
   resolveCallbackSecretWithMint,
   resolveHarnessRoot,
+  resolveVercelInspectTarget,
   runDaemon,
   runMonitorTick,
   runStatus,