@kynver-app/runtime 0.1.92 → 0.1.95

package/dist/cli.js

@@ -315,7 +315,13 @@ function displayUserPath(value) {
 }
 
 // src/default-repo-discovery.ts
-var WELL_KNOWN_REPO_DIRS = ["Kynver", "repos/Kynver", "code/Kynver", "projects/Kynver"];
+var WELL_KNOWN_REPO_DIRS = [
+  "Kynver",
+  "repos/Kynver",
+  "repos/kynver-source-main",
+  "code/Kynver",
+  "projects/Kynver"
+];
 function readPackageName(repoRoot) {
   const pkgPath = path3.join(repoRoot, "package.json");
   if (!existsSync2(pkgPath)) return null;
@@ -4069,14 +4075,15 @@ function buildPrompt(input) {
     input.planId ? `Active planId: ${input.planId}${input.taskId ? ` \xB7 taskId: ${input.taskId}` : ""}` : "No planId on this worker \u2014 still emit progress when you touch plan-scoped work."
   ];
   const mergeGateLines = compact ? [
-    "Merge-gate cost control: do not use Vercel previews/builds for PR verification. Run `node scripts/agent-os-pr-merge-gate.mjs --pr <url> --agent-os-id <id>` (or `verify-pr-local.mjs --from-pr` + POST pr-merge-gate/refresh) before any GitHub Actions run; request merge-gate only via refresh then POST pr-merge-gate/request-run (one Actions run per PR head unless human approves extra)."
+    "Merge-gate cost control: do not use Vercel previews/builds for PR verification. Run `node scripts/agent-os-pr-merge-gate.mjs --pr <url> --agent-os-id <id>` (or `verify-pr-local.mjs --from-pr` + POST pr-merge-gate/refresh) before any GitHub Actions run; request merge-gate only via refresh then POST pr-merge-gate/request-run (one Actions run per PR head unless human approves extra). Per-PR Vercel preview builds are off by default \u2014 production deploy runs via release batch after merge."
   ] : [
     "GitHub Actions merge-gate cost control (Kynver/Hermes PRs):",
     "- Prefer local cached package verification (`node scripts/verify-pr-local.mjs --emit-json`) before GitHub Actions. Do not use Vercel previews/builds as PR evidence.",
     "- Do not push empty commits to re-trigger CI. One budgeted merge-gate Actions run per PR candidate (head SHA) unless a human approves extra.",
     "- Record evidence: POST `/api/agent-os/by-id/<agentOsId>/pr-merge-gate/refresh` with prUrl + local payloads.",
     "- Request the final Actions run only when local verification is green: POST `.../pr-merge-gate/request-run` (applies `merge-gate` label).",
-    "- Empty failed Actions jobs (no runner/steps/logs) are infra/quota \u2014 do not enter repair loops; escalate to operator."
+    "- Empty failed Actions jobs (no runner/steps/logs) are infra/quota \u2014 do not enter repair loops; escalate to operator.",
+    "- After merge, landed PRs accumulate into a release batch; run batch verification then manual Vercel production deploy from Command Center (release train). PR landing completes with: verification complete, awaiting release batch/deploy."
   ];
   const planArtifactLines = compact ? [
     "Plan artifacts: when authoring/revising docs/superpowers/plans/, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in the harness worktree."
@@ -7027,7 +7034,7 @@ async function dispatchRun(args) {
       runnerPresence,
       harnessBoardSnapshot: buildRunBoard(run.id),
       ...args.lane ? { lane: resolveDispatchNextLaneFilter(String(args.lane)) } : {},
-      executor: args.executor ? String(args.executor) : "harness",
+      ...args.executor ? { executor: String(args.executor) } : {},
       ...args.diskPath ? { diskPath: String(args.diskPath) } : {},
       ...args.targetTaskId ? { targetTaskId: String(args.targetTaskId) } : {},
       ...!args.targetTaskId && args.targetTaskIds ? {
@@ -8793,7 +8800,7 @@ async function runKynverCronTick(opts = {}) {
 }
 
 // src/pipeline-tick.ts
-import path54 from "node:path";
+import path55 from "node:path";
 
 // src/pipeline-dispatch.ts
 var RESERVED_REVIEW_STARTS = 1;
@@ -10683,7 +10690,192 @@ function isPipelineCleanupEnabled() {
 // src/installed-package-versions.ts
 import { readFile } from "node:fs/promises";
 import { homedir as homedir13 } from "node:os";
+import path54 from "node:path";
+
+// src/memory-cost-package-version-guard.ts
+import { existsSync as existsSync40, readFileSync as readFileSync12 } from "node:fs";
 import path53 from "node:path";
+var MEMORY_COST_PACKAGE_MIN_VERSIONS = {
+  "@kynver-app/runtime": "0.1.83",
+  "@kynver-app/openclaw-agent-os": "0.1.43",
+  "@kynver-app/mcp-agent-os": "0.3.34"
+};
+var MEMORY_COST_MANAGED_PACKAGES = Object.keys(
+  MEMORY_COST_PACKAGE_MIN_VERSIONS
+);
+var DISPLAY_NAMES = {
+  "@kynver-app/runtime": "Kynver runtime",
+  "@kynver-app/openclaw-agent-os": "OpenClaw AgentOS plugin",
+  "@kynver-app/mcp-agent-os": "AgentOS MCP server"
+};
+var REPO_PACKAGE_JSON_RELATIVE = {
+  "@kynver-app/runtime": "packages/kynver-runtime/package.json",
+  "@kynver-app/openclaw-agent-os": "packages/kynver-openclaw-agent-os/package.json",
+  "@kynver-app/mcp-agent-os": "packages/kynver-mcp-agent-os/package.json"
+};
+function parseSemverParts(version) {
+  const core = version.trim().split("-")[0]?.split("+")[0];
+  if (!core) return null;
+  const parts = core.split(".");
+  if (parts.length < 1 || parts.length > 3) return null;
+  const nums = parts.map((p) => Number.parseInt(p, 10));
+  if (nums.some((n) => !Number.isFinite(n) || n < 0)) return null;
+  while (nums.length < 3) nums.push(0);
+  return [nums[0], nums[1], nums[2]];
+}
+function compareSemver(a, b) {
+  const pa = parseSemverParts(a);
+  const pb = parseSemverParts(b);
+  if (!pa || !pb) return 0;
+  for (let i = 0; i < 3; i += 1) {
+    if (pa[i] > pb[i]) return 1;
+    if (pa[i] < pb[i]) return -1;
+  }
+  return 0;
+}
+function semverAtLeast(version, minimum) {
+  return compareSemver(version, minimum) >= 0;
+}
+function maxSemver(versions) {
+  let best = null;
+  for (const version of versions) {
+    if (!best || compareSemver(version, best) > 0) best = version;
+  }
+  return best;
+}
+function readPackageJsonVersion(packageJsonPath) {
+  try {
+    const parsed = JSON.parse(readFileSync12(packageJsonPath, "utf8"));
+    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
+  } catch {
+    return null;
+  }
+}
+function resolveRepoRoot(cwd, explicitRepoRoot) {
+  const candidates = [explicitRepoRoot, process.env.KYNVER_REPO, cwd].filter(
+    (value) => Boolean(value?.trim())
+  );
+  for (const candidate of candidates) {
+    const resolved = path53.resolve(candidate);
+    if (existsSync40(path53.join(resolved, "packages/kynver-runtime/package.json")) && existsSync40(path53.join(resolved, "package.json"))) {
+      return resolved;
+    }
+  }
+  const discovered = discoverDefaultRepo({ cwd });
+  return discovered?.repo ?? null;
+}
+function probeRepoPackageVersions(input = {}) {
+  const cwd = input.cwd ?? process.cwd();
+  const repoRoot = resolveRepoRoot(cwd, input.repoRoot);
+  if (!repoRoot) return {};
+  const out = {};
+  for (const packageName of MEMORY_COST_MANAGED_PACKAGES) {
+    const packageJsonPath = path53.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
+    const version = readPackageJsonVersion(packageJsonPath);
+    if (!version) continue;
+    out[packageName] = { version, source: "repo", path: packageJsonPath };
+  }
+  return out;
+}
+function repoSourceCommands(packageName) {
+  if (packageName === "@kynver-app/runtime") {
+    return ["npm run kynver:build", "npm run kynver"];
+  }
+  return [`npm run build -w ${packageName}`];
+}
+function buildRemediation(input) {
+  const { packageName, minimumVersion, effectiveVersion, effectiveSource, repoVersion } = input;
+  const lines = [];
+  if (repoVersion && semverAtLeast(repoVersion, minimumVersion)) {
+    lines.push(
+      `Use the monorepo checkout (${repoVersion}) instead of a stale npm install: ${repoSourceCommands(packageName).join("; ")}.`
+    );
+    lines.push("Do not publish npm packages or wait on an operator release.");
+    return lines;
+  }
+  if (effectiveVersion) {
+    lines.push(
+      `Upgrade ${packageName} from ${effectiveVersion} to >= ${minimumVersion} (npm install -g ${packageName}@latest or align OpenClaw npm prefix).`
+    );
+  } else {
+    lines.push(`Install ${packageName} >= ${minimumVersion} before running memory-heavy AgentOS paths.`);
+  }
+  if (packageName === "@kynver-app/runtime") {
+    lines.push("Repo-source alternative: npm run kynver:build && npm run kynver");
+  }
+  if (effectiveSource === "installed" && repoVersion) {
+    lines.push(`Repo checkout reports ${repoVersion}; rebuild/link repo source if you develop from the monorepo.`);
+  }
+  return lines;
+}
+function pickEffectiveCandidate(candidates) {
+  if (candidates.length === 0) return { version: null, source: "unknown" };
+  const best = maxSemver(candidates.map((candidate) => candidate.version));
+  if (!best) return { version: null, source: "unknown" };
+  const winner = candidates.find((candidate) => candidate.version === best) ?? candidates[0];
+  return { version: winner.version, source: winner.source };
+}
+function evaluateMemoryCostPackageVersionGuard(input = {}) {
+  const normalize2 = (value, fallbackSource) => {
+    if (!value) return null;
+    if (typeof value === "string") return { version: value, source: fallbackSource };
+    return value;
+  };
+  const packages = MEMORY_COST_MANAGED_PACKAGES.map((packageName) => {
+    const minimumVersion = MEMORY_COST_PACKAGE_MIN_VERSIONS[packageName];
+    const candidates = [];
+    const installed = normalize2(input.installed?.[packageName], "installed");
+    const repo = normalize2(input.repo?.[packageName], "repo");
+    const self = normalize2(input.self?.[packageName], "self");
+    if (installed) candidates.push(installed);
+    if (repo) candidates.push(repo);
+    if (self) candidates.push(self);
+    const { version: effectiveVersion, source: effectiveSource } = pickEffectiveCandidate(candidates);
+    const repoVersion = repo?.version ?? null;
+    const ok2 = effectiveVersion ? semverAtLeast(effectiveVersion, minimumVersion) : false;
+    const remediation = ok2 ? [] : buildRemediation({
+      packageName,
+      minimumVersion,
+      effectiveVersion,
+      effectiveSource,
+      repoVersion
+    });
+    const summary2 = ok2 ? `${DISPLAY_NAMES[packageName]} ${effectiveVersion} meets memory-cost minimum ${minimumVersion} (${effectiveSource}).` : `${DISPLAY_NAMES[packageName]} is below memory-cost minimum ${minimumVersion}` + (effectiveVersion ? ` (effective ${effectiveVersion} via ${effectiveSource})` : " (no version detected)") + ".";
+    return {
+      packageName,
+      displayName: DISPLAY_NAMES[packageName],
+      minimumVersion,
+      effectiveVersion,
+      effectiveSource,
+      ok: ok2,
+      summary: summary2,
+      remediation
+    };
+  });
+  const violations = packages.filter((row) => !row.ok);
+  const ok = violations.length === 0;
+  const summary = ok ? "All managed AgentOS packages meet memory-cost minimum versions." : `Memory-cost package guard blocked ${violations.length} stale package(s): ${violations.map((row) => `${row.packageName} < ${row.minimumVersion}`).join("; ")}.`;
+  return { ok, summary, packages };
+}
+var MemoryCostPackageVersionGuardError = class extends Error {
+  result;
+  constructor(result) {
+    const lines = [
+      result.summary,
+      ...result.packages.filter((row) => !row.ok).flatMap((row) => [`- ${row.summary}`, ...row.remediation.map((line) => `  \u2192 ${line}`)])
+    ];
+    super(lines.join("\n"));
+    this.name = "MemoryCostPackageVersionGuardError";
+    this.result = result;
+  }
+};
+function assertMemoryCostPackageVersionGuard(input = {}) {
+  const result = evaluateMemoryCostPackageVersionGuard(input);
+  if (!result.ok) throw new MemoryCostPackageVersionGuardError(result);
+  return result;
+}
+
+// src/installed-package-versions.ts
 var MANAGED_PACKAGES = [
   "@kynver-app/runtime",
   "@kynver-app/openclaw-agent-os",
@@ -10698,12 +10890,12 @@ function unique(values) {
 }
 function moduleRoots() {
   const home = homedir13();
-  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path53.join(home, ".openclaw", "npm");
-  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path53.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path53.join(home, ".npm-global", "lib", "node_modules"));
+  const openClawPrefix = trim(process.env.KYNVER_OPENCLAW_NPM_ROOT) ?? trim(process.env.OPENCLAW_NPM_ROOT) ?? path54.join(home, ".openclaw", "npm");
+  const npmGlobalRoot = trim(process.env.KYNVER_NPM_GLOBAL_ROOT) ?? trim(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT) ?? (trim(process.env.NPM_CONFIG_PREFIX) ? path54.join(trim(process.env.NPM_CONFIG_PREFIX), "lib", "node_modules") : path54.join(home, ".npm-global", "lib", "node_modules"));
   return unique([
-    path53.join(openClawPrefix, "lib", "node_modules"),
-    path53.join(openClawPrefix, "node_modules"),
-    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path53.join(npmGlobalRoot, "lib", "node_modules")
+    path54.join(openClawPrefix, "lib", "node_modules"),
+    path54.join(openClawPrefix, "node_modules"),
+    npmGlobalRoot.endsWith("node_modules") ? npmGlobalRoot : path54.join(npmGlobalRoot, "lib", "node_modules")
   ]);
 }
 async function readVersion(packageJsonPath) {
@@ -10714,16 +10906,31 @@ async function readVersion(packageJsonPath) {
     return null;
   }
 }
-async function collectInstalledPackageVersions(observedAt = (/* @__PURE__ */ new Date()).toISOString()) {
+function installedPackageJsonCandidates(packageName) {
   const roots = moduleRoots();
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const root of roots) {
+    const candidate = path54.join(root, packageName, "package.json");
+    if (seen.has(candidate)) continue;
+    seen.add(candidate);
+    out.push(candidate);
+  }
+  return out;
+}
+async function collectInstalledPackageVersions(observedAt = (/* @__PURE__ */ new Date()).toISOString()) {
   const out = {};
   for (const packageName of MANAGED_PACKAGES) {
-    for (const root of roots) {
-      const packageJsonPath = path53.join(root, packageName, "package.json");
+    let best = null;
+    for (const packageJsonPath of installedPackageJsonCandidates(packageName)) {
       const version = await readVersion(packageJsonPath);
       if (!version) continue;
-      out[packageName] = { version, observedAt, path: packageJsonPath };
-      break;
+      if (!best || compareSemver(version, best.version) > 0) {
+        best = { version, path: packageJsonPath };
+      }
+    }
+    if (best) {
+      out[packageName] = { version: best.version, observedAt, path: best.path };
     }
   }
   return out;
@@ -10735,7 +10942,7 @@ async function completeFinishedWorkers(runId, args) {
   const outcomes = [];
   for (const name of Object.keys(run.workers || {})) {
     const worker = readJson(
-      path54.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
+      path55.join(runDirectory(run.id), "workers", safeSlug(name), "worker.json"),
       void 0
     );
     if (!worker?.taskId || worker.localOnly) continue;
@@ -10949,7 +11156,7 @@ async function runDaemon(args) {
 }
 
 // src/plan-progress.ts
-import path56 from "node:path";
+import path57 from "node:path";
 
 // src/bounded-build/constants.ts
 var DEFAULT_BUILD_MEM_BUDGET_BYTES = 1536 * 1024 * 1024;
@@ -11082,11 +11289,11 @@ function waitForBuildAdmission(timeoutMs, pollMs = 2e3, opts = {}) {
 import { spawnSync as spawnSync7 } from "node:child_process";
 
 // src/harness-worktree-build-guard.ts
-import path55 from "node:path";
+import path56 from "node:path";
 function isPathUnderHarnessWorktree(cwd) {
   const worktreesDir = harnessWorktreesDir(resolveHarnessRoot());
-  const rel = path55.relative(worktreesDir, path55.resolve(cwd));
-  return rel.length > 0 && !rel.startsWith("..") && !path55.isAbsolute(rel);
+  const rel = path56.relative(worktreesDir, path56.resolve(cwd));
+  return rel.length > 0 && !rel.startsWith("..") && !path56.isAbsolute(rel);
 }
 function assessHarnessWorktreeBuildGuard(cwd) {
   if (!isPathUnderHarnessWorktree(cwd)) return { ok: true };
@@ -11271,7 +11478,7 @@ async function emitPlanProgress(args) {
 }
 function verifyPlanLocal(args) {
   const worktree = required(args.worktree ? String(args.worktree) : void 0, "worktree");
-  const cwd = path56.resolve(worktree);
+  const cwd = path57.resolve(worktree);
   const summary = runHarnessVerifyCommands(cwd);
   const emitJson = args.json === true || args.json === "true";
   const payload = { passed: summary.passed, worktree: cwd, steps: summary.steps };
@@ -11320,9 +11527,9 @@ async function verifyPlan(args) {
 }
 
 // src/harness-verify-cli.ts
-import path57 from "node:path";
+import path58 from "node:path";
 function runHarnessVerifyCli(args) {
-  const cwd = path57.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
+  const cwd = path58.resolve(required(args.worktree ? String(args.worktree) : void 0, "worktree"));
   const emitJson = args.json === true || args.json === "true" || args.emitJson === true || args.emitJson === "true";
   const commands = [];
   const rawCmd = args.command;
@@ -11366,7 +11573,7 @@ function runHarnessVerifyCli(args) {
 }
 
 // src/plan-persist-cli.ts
-import { readFileSync as readFileSync12 } from "node:fs";
+import { readFileSync as readFileSync13 } from "node:fs";
 var OPERATIONS = ["create", "add_version", "update_metadata"];
 var FAILURE_KINDS = [
   "approval_guard",
@@ -11378,7 +11585,7 @@ var FAILURE_KINDS = [
 function readBodyArg(args) {
   const bodyFile = args.bodyFile ? String(args.bodyFile) : void 0;
   if (bodyFile) {
-    return { body: readFileSync12(bodyFile, "utf8"), bodyPathHint: bodyFile };
+    return { body: readFileSync13(bodyFile, "utf8"), bodyPathHint: bodyFile };
   }
   const inline = args.body ? String(args.body) : void 0;
   if (inline) return { body: inline };
@@ -11529,7 +11736,7 @@ function formatMonitorTickNotice(tick) {
 }
 
 // src/monitor/monitor.service.ts
-import path59 from "node:path";
+import path60 from "node:path";
 
 // src/monitor/monitor.classify.ts
 function classifyWorkerHealth(input) {
@@ -11581,11 +11788,11 @@ function classifyWorkerHealth(input) {
 }
 
 // src/monitor/monitor.store.ts
-import { existsSync as existsSync40, mkdirSync as mkdirSync7, readdirSync as readdirSync15, unlinkSync as unlinkSync4 } from "node:fs";
-import path58 from "node:path";
+import { existsSync as existsSync41, mkdirSync as mkdirSync7, readdirSync as readdirSync15, unlinkSync as unlinkSync4 } from "node:fs";
+import path59 from "node:path";
 function monitorsDir() {
   const { harnessRoot } = getHarnessPaths();
-  const dir = path58.join(harnessRoot, "monitors");
+  const dir = path59.join(harnessRoot, "monitors");
   mkdirSync7(dir, { recursive: true });
   return dir;
 }
@@ -11593,7 +11800,7 @@ function monitorIdFor(runId, workerName) {
   return workerName ? `${safeSlug(runId)}--${safeSlug(workerName)}` : safeSlug(runId);
 }
 function monitorPath(monitorId) {
-  return path58.join(monitorsDir(), `${monitorId}.json`);
+  return path59.join(monitorsDir(), `${monitorId}.json`);
 }
 function loadMonitorSession(monitorId) {
   return readJson(monitorPath(monitorId), void 0);
@@ -11603,18 +11810,18 @@ function saveMonitorSession(session) {
 }
 function deleteMonitorSession(monitorId) {
   const file = monitorPath(monitorId);
-  if (!existsSync40(file)) return false;
+  if (!existsSync41(file)) return false;
   unlinkSync4(file);
   return true;
 }
 function listMonitorSessions() {
   const dir = monitorsDir();
-  if (!existsSync40(dir)) return [];
+  if (!existsSync41(dir)) return [];
   const entries = [];
   for (const name of readdirSync15(dir)) {
     if (!name.endsWith(".json")) continue;
     const session = readJson(
-      path58.join(dir, name),
+      path59.join(dir, name),
       void 0
     );
     if (!session?.monitorId) continue;
@@ -11705,7 +11912,7 @@ async function fetchTaskLeasesForWorkers(input) {
 // src/monitor/monitor.service.ts
 function workerRecord2(runId, name) {
   return readJson(
-    path59.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
+    path60.join(runDirectory(runId), "workers", safeSlug(name), "worker.json"),
     void 0
   );
 }
@@ -11911,18 +12118,18 @@ async function runMonitorLoop(args) {
 
 // src/monitor/monitor-spawn.ts
 import { spawn as spawn6 } from "node:child_process";
-import { closeSync as closeSync7, existsSync as existsSync41, openSync as openSync7 } from "node:fs";
-import path60 from "node:path";
+import { closeSync as closeSync7, existsSync as existsSync42, openSync as openSync7 } from "node:fs";
+import path61 from "node:path";
 import { fileURLToPath as fileURLToPath3 } from "node:url";
 function resolveDefaultCliPath2() {
-  return path60.join(fileURLToPath3(new URL(".", import.meta.url)), "cli.js");
+  return path61.join(fileURLToPath3(new URL(".", import.meta.url)), "cli.js");
 }
 function spawnMonitorSidecar(opts) {
   const cliPath = opts.cliPath ?? resolveDefaultCliPath2();
-  if (!existsSync41(cliPath)) return void 0;
+  if (!existsSync42(cliPath)) return void 0;
   const monitorId = monitorIdFor(opts.runId, opts.workerName);
   const { harnessRoot } = getHarnessPaths();
-  const logPath = path60.join(harnessRoot, "monitors", `${monitorId}.log`);
+  const logPath = path61.join(harnessRoot, "monitors", `${monitorId}.log`);
   let logFd;
   try {
     logFd = openSync7(logPath, "a");
@@ -12042,13 +12249,13 @@ async function monitorTickCli(args) {
 }
 
 // src/package-version.ts
-import { existsSync as existsSync42, readFileSync as readFileSync13 } from "node:fs";
+import { existsSync as existsSync43, readFileSync as readFileSync14 } from "node:fs";
 import { dirname, join } from "node:path";
 import { fileURLToPath as fileURLToPath4 } from "node:url";
 function resolvePackageRoot(moduleUrl) {
   let dir = dirname(fileURLToPath4(moduleUrl));
   for (let depth = 0; depth < 6; depth += 1) {
-    if (existsSync42(join(dir, "package.json"))) return dir;
+    if (existsSync43(join(dir, "package.json"))) return dir;
     const parent = dirname(dir);
     if (parent === dir) break;
     dir = parent;
@@ -12057,7 +12264,7 @@ function resolvePackageRoot(moduleUrl) {
 }
 function readOwnPackageVersion(moduleUrl = import.meta.url) {
   const pkgPath = join(resolvePackageRoot(moduleUrl), "package.json");
-  const pkg = JSON.parse(readFileSync13(pkgPath, "utf8"));
+  const pkg = JSON.parse(readFileSync14(pkgPath, "utf8"));
   if (typeof pkg.version !== "string" || !pkg.version.trim()) {
     throw new Error(`Missing package.json version at ${pkgPath}`);
   }
@@ -12077,188 +12284,6 @@ function handleCliVersionFlag(argv, moduleUrl = import.meta.url, binName) {
   return true;
 }
 
-// src/memory-cost-package-version-guard.ts
-import { existsSync as existsSync43, readFileSync as readFileSync14 } from "node:fs";
-import path61 from "node:path";
-var MEMORY_COST_PACKAGE_MIN_VERSIONS = {
-  "@kynver-app/runtime": "0.1.83",
-  "@kynver-app/openclaw-agent-os": "0.1.43",
-  "@kynver-app/mcp-agent-os": "0.3.34"
-};
-var MEMORY_COST_MANAGED_PACKAGES = Object.keys(
-  MEMORY_COST_PACKAGE_MIN_VERSIONS
-);
-var DISPLAY_NAMES = {
-  "@kynver-app/runtime": "Kynver runtime",
-  "@kynver-app/openclaw-agent-os": "OpenClaw AgentOS plugin",
-  "@kynver-app/mcp-agent-os": "AgentOS MCP server"
-};
-var REPO_PACKAGE_JSON_RELATIVE = {
-  "@kynver-app/runtime": "packages/kynver-runtime/package.json",
-  "@kynver-app/openclaw-agent-os": "packages/kynver-openclaw-agent-os/package.json",
-  "@kynver-app/mcp-agent-os": "packages/kynver-mcp-agent-os/package.json"
-};
-function parseSemverParts(version) {
-  const core = version.trim().split("-")[0]?.split("+")[0];
-  if (!core) return null;
-  const parts = core.split(".");
-  if (parts.length < 1 || parts.length > 3) return null;
-  const nums = parts.map((p) => Number.parseInt(p, 10));
-  if (nums.some((n) => !Number.isFinite(n) || n < 0)) return null;
-  while (nums.length < 3) nums.push(0);
-  return [nums[0], nums[1], nums[2]];
-}
-function compareSemver(a, b) {
-  const pa = parseSemverParts(a);
-  const pb = parseSemverParts(b);
-  if (!pa || !pb) return 0;
-  for (let i = 0; i < 3; i += 1) {
-    if (pa[i] > pb[i]) return 1;
-    if (pa[i] < pb[i]) return -1;
-  }
-  return 0;
-}
-function semverAtLeast(version, minimum) {
-  return compareSemver(version, minimum) >= 0;
-}
-function maxSemver(versions) {
-  let best = null;
-  for (const version of versions) {
-    if (!best || compareSemver(version, best) > 0) best = version;
-  }
-  return best;
-}
-function readPackageJsonVersion(packageJsonPath) {
-  try {
-    const parsed = JSON.parse(readFileSync14(packageJsonPath, "utf8"));
-    return typeof parsed.version === "string" && parsed.version.trim() ? parsed.version.trim() : null;
-  } catch {
-    return null;
-  }
-}
-function resolveRepoRoot(cwd, explicitRepoRoot) {
-  const candidates = [explicitRepoRoot, process.env.KYNVER_REPO, cwd].filter(
-    (value) => Boolean(value?.trim())
-  );
-  for (const candidate of candidates) {
-    const resolved = path61.resolve(candidate);
-    if (existsSync43(path61.join(resolved, "packages/kynver-runtime/package.json")) && existsSync43(path61.join(resolved, "package.json"))) {
-      return resolved;
-    }
-  }
-  return null;
-}
-function probeRepoPackageVersions(input = {}) {
-  const cwd = input.cwd ?? process.cwd();
-  const repoRoot = resolveRepoRoot(cwd, input.repoRoot);
-  if (!repoRoot) return {};
-  const out = {};
-  for (const packageName of MEMORY_COST_MANAGED_PACKAGES) {
-    const packageJsonPath = path61.join(repoRoot, REPO_PACKAGE_JSON_RELATIVE[packageName]);
-    const version = readPackageJsonVersion(packageJsonPath);
-    if (!version) continue;
-    out[packageName] = { version, source: "repo", path: packageJsonPath };
-  }
-  return out;
-}
-function repoSourceCommands(packageName) {
-  if (packageName === "@kynver-app/runtime") {
-    return ["npm run kynver:build", "npm run kynver"];
-  }
-  return [`npm run build -w ${packageName}`];
-}
-function buildRemediation(input) {
-  const { packageName, minimumVersion, effectiveVersion, effectiveSource, repoVersion } = input;
-  const lines = [];
-  if (repoVersion && semverAtLeast(repoVersion, minimumVersion)) {
-    lines.push(
-      `Use the monorepo checkout (${repoVersion}) instead of a stale npm install: ${repoSourceCommands(packageName).join("; ")}.`
-    );
-    lines.push("Do not publish npm packages or wait on an operator release.");
-    return lines;
-  }
-  if (effectiveVersion) {
-    lines.push(
-      `Upgrade ${packageName} from ${effectiveVersion} to >= ${minimumVersion} (npm install -g ${packageName}@latest or align OpenClaw npm prefix).`
-    );
-  } else {
-    lines.push(`Install ${packageName} >= ${minimumVersion} before running memory-heavy AgentOS paths.`);
-  }
-  if (packageName === "@kynver-app/runtime") {
-    lines.push("Repo-source alternative: npm run kynver:build && npm run kynver");
-  }
-  if (effectiveSource === "installed" && repoVersion) {
-    lines.push(`Repo checkout reports ${repoVersion}; rebuild/link repo source if you develop from the monorepo.`);
-  }
-  return lines;
-}
-function pickEffectiveCandidate(candidates) {
-  if (candidates.length === 0) return { version: null, source: "unknown" };
-  const best = maxSemver(candidates.map((candidate) => candidate.version));
-  if (!best) return { version: null, source: "unknown" };
-  const winner = candidates.find((candidate) => candidate.version === best) ?? candidates[0];
-  return { version: winner.version, source: winner.source };
-}
-function evaluateMemoryCostPackageVersionGuard(input = {}) {
-  const normalize2 = (value, fallbackSource) => {
-    if (!value) return null;
-    if (typeof value === "string") return { version: value, source: fallbackSource };
-    return value;
-  };
-  const packages = MEMORY_COST_MANAGED_PACKAGES.map((packageName) => {
-    const minimumVersion = MEMORY_COST_PACKAGE_MIN_VERSIONS[packageName];
-    const candidates = [];
-    const installed = normalize2(input.installed?.[packageName], "installed");
-    const repo = normalize2(input.repo?.[packageName], "repo");
-    const self = normalize2(input.self?.[packageName], "self");
-    if (installed) candidates.push(installed);
-    if (repo) candidates.push(repo);
-    if (self) candidates.push(self);
-    const { version: effectiveVersion, source: effectiveSource } = pickEffectiveCandidate(candidates);
-    const repoVersion = repo?.version ?? null;
-    const ok2 = effectiveVersion ? semverAtLeast(effectiveVersion, minimumVersion) : false;
-    const remediation = ok2 ? [] : buildRemediation({
-      packageName,
-      minimumVersion,
-      effectiveVersion,
-      effectiveSource,
-      repoVersion
-    });
-    const summary2 = ok2 ? `${DISPLAY_NAMES[packageName]} ${effectiveVersion} meets memory-cost minimum ${minimumVersion} (${effectiveSource}).` : `${DISPLAY_NAMES[packageName]} is below memory-cost minimum ${minimumVersion}` + (effectiveVersion ? ` (effective ${effectiveVersion} via ${effectiveSource})` : " (no version detected)") + ".";
-    return {
-      packageName,
-      displayName: DISPLAY_NAMES[packageName],
-      minimumVersion,
-      effectiveVersion,
-      effectiveSource,
-      ok: ok2,
-      summary: summary2,
-      remediation
-    };
-  });
-  const violations = packages.filter((row) => !row.ok);
-  const ok = violations.length === 0;
-  const summary = ok ? "All managed AgentOS packages meet memory-cost minimum versions." : `Memory-cost package guard blocked ${violations.length} stale package(s): ${violations.map((row) => `${row.packageName} < ${row.minimumVersion}`).join("; ")}.`;
-  return { ok, summary, packages };
-}
-var MemoryCostPackageVersionGuardError = class extends Error {
-  result;
-  constructor(result) {
-    const lines = [
-      result.summary,
-      ...result.packages.filter((row) => !row.ok).flatMap((row) => [`- ${row.summary}`, ...row.remediation.map((line) => `  \u2192 ${line}`)])
-    ];
-    super(lines.join("\n"));
-    this.name = "MemoryCostPackageVersionGuardError";
-    this.result = result;
-  }
-};
-function assertMemoryCostPackageVersionGuard(input = {}) {
-  const result = evaluateMemoryCostPackageVersionGuard(input);
-  if (!result.ok) throw new MemoryCostPackageVersionGuardError(result);
-  return result;
-}
-
 // src/memory-cost-package-version-guard-enforce.ts
 function installedVersionMap(observed) {
   const out = {};
@@ -12278,10 +12303,10 @@ async function buildMemoryCostPackageGuardInput(input = {}) {
     Promise.resolve(probeRepoPackageVersions({ cwd: input.cwd, repoRoot: input.repoRoot }))
   ]);
   const self = {};
-  if (input.selfPackageName && input.selfVersion) {
+  const runtimeSelfVersion = input.selfPackageName === "@kynver-app/runtime" && input.selfVersion ? input.selfVersion : PACKAGE_VERSION;
+  self["@kynver-app/runtime"] = { version: runtimeSelfVersion, source: "self" };
+  if (input.selfPackageName && input.selfVersion && input.selfPackageName !== "@kynver-app/runtime") {
     self[input.selfPackageName] = { version: input.selfVersion, source: "self" };
-  } else {
-    self["@kynver-app/runtime"] = { version: PACKAGE_VERSION, source: "self" };
   }
   return {
     installed: installedVersionMap(installed),
@@ -12601,9 +12626,7 @@ var defaultRuntimeTakeoverProbes = {
   harnessRoot: () => resolveHarnessRoot(),
   legacyOpenclawHarnessRoot: () => path64.join(homedir15(), ".openclaw", "harness"),
   pathExists: (target) => existsSync44(target),
-  pathWritable: (target) => isWritable(target),
-  vercelVersion: () => captureCommand("vercel", ["--version"]),
-  vercelWhoami: () => captureCommand("vercel", ["whoami"])
+  pathWritable: (target) => isWritable(target)
 };
 
 // src/doctor/runtime-takeover-scheduler.ts
@@ -12970,29 +12993,38 @@ function assessRunnerToken(probes) {
   ];
   return { id: "runner_token", label: "Runner token readiness", checks };
 }
-function assessVercelCli(probes) {
-  const version = probes.vercelVersion();
-  const whoami = probes.vercelWhoami();
-  const installed = version.ok;
+function assessVercelDeployEvidence(probes) {
+  const globalCli = probes.commandOnPath("vercel");
+  const cliInstalled = globalCli.ok;
+  const githubToken = Boolean(
+    process.env.GITHUB_TOKEN?.trim() || process.env.GH_TOKEN?.trim()
+  );
+  const vercelToken = Boolean(process.env.VERCEL_TOKEN?.trim());
   return {
-    id: "vercel_cli",
-    label: "Vercel CLI",
+    id: "vercel_deploy_evidence",
+    label: "Vercel deploy evidence",
     checks: [
       check2({
-        id: "vercel_installed",
-        label: "Vercel CLI installed",
-        status: installed ? "pass" : "warn",
-        summary: installed ? version.stdout || "vercel CLI found" : version.error ?? "vercel not found on PATH",
-        remediation: installed ? void 0 : "Install Vercel CLI (`npm i -g vercel`) for deploy evidence and env pulls.",
-        details: { stderr: version.stderr || null }
+        id: "vercel_global_cli_absent",
+        label: "Global Vercel CLI not installed",
+        status: cliInstalled ? "warn" : "pass",
+        summary: cliInstalled ? `Global Vercel CLI found (${globalCli.stdout || "on PATH"}) \u2014 uninstall after operator approval` : "No global Vercel CLI on PATH",
+        remediation: cliInstalled ? "Uninstall global Vercel CLI (`npm uninstall -g vercel`) \u2014 use GitHub commit status or scoped VERCEL_TOKEN + REST API instead." : void 0,
+        details: { path: cliInstalled ? globalCli.stdout || null : null }
+      }),
+      check2({
+        id: "github_token_for_vercel_status",
+        label: "GitHub token for Vercel status",
+        status: githubToken ? "pass" : "warn",
+        summary: githubToken ? "GITHUB_TOKEN/GH_TOKEN present for GitHub Vercel StatusContext evidence" : "No GITHUB_TOKEN \u2014 merge-gate Vercel evidence requires GitHub commit status API",
+        remediation: githubToken ? void 0 : "Export GITHUB_TOKEN (or GH_TOKEN) for PR head commit status lookups."
       }),
       check2({
-        id: "vercel_authenticated",
-        label: "Vercel CLI authenticated",
-        status: !installed ? "warn" : whoami.ok ? "pass" : "warn",
-        summary: !installed ? "Skipped \u2014 Vercel CLI not installed" : whoami.ok ? `Authenticated as ${whoami.stdout}` : whoami.stderr || whoami.error || "Not logged in",
-        remediation: installed && !whoami.ok ? "Run `vercel login` and link the Kynver project if needed." : void 0,
-        details: { account: whoami.ok ? whoami.stdout : null }
+        id: "vercel_api_token_optional",
+        label: "Vercel API token (optional fallback)",
+        status: vercelToken ? "pass" : "warn",
+        summary: vercelToken ? "VERCEL_TOKEN configured for optional REST API deployment lookup" : "VERCEL_TOKEN unset \u2014 GitHub status is the default path; API fallback disabled",
+        remediation: vercelToken ? void 0 : "Set ephemeral/scoped VERCEL_TOKEN only when GitHub status is insufficient; avoid persistent ~/.vercel auth on runner hosts."
       })
     ]
   };
@@ -13131,7 +13163,7 @@ function assessRuntimeTakeoverReadiness(probes = defaultRuntimeTakeoverProbes) {
     assessCliPackage(probes),
     assessUserConfig(probes),
     assessRunnerToken(probes),
-    assessVercelCli(probes),
+    assessVercelDeployEvidence(probes),
     assessHarnessDirs(probes),
     assessCallbackAuth(probes),
     assessOpenclawHotspots(probes)
@@ -13481,7 +13513,19 @@ async function main(argv = process.argv.slice(2)) {
   mkdirSync8(runsDir, { recursive: true });
   mkdirSync8(worktreesDir, { recursive: true });
   if (shouldEnforceMemoryCostPackageGuardCli(scope, action)) {
-    await enforceMemoryCostPackageGuardAtStartup();
+    let repoRoot;
+    const runId = args.run ? String(args.run).trim() : "";
+    if (runId) {
+      try {
+        repoRoot = loadRun(runId).repo;
+      } catch {
+        repoRoot = void 0;
+      }
+    }
+    await enforceMemoryCostPackageGuardAtStartup({
+      repoRoot,
+      cwd: repoRoot
+    });
   }
   if (scope === "login") return void await runLogin(args);
   if (scope === "runner" && action === "credential") return void await mintRunnerCredential(args);