@kynver-app/runtime 0.2.1 → 0.2.4

package/dist/cli.js

@@ -16,7 +16,7 @@ ${e.stderr}`.trim(),t=bS(r);if(!t||!qn(t)){let o=Jn(r||`exit ${e.exitCode}`,180)
 `),"worker.prompt.progress.compact":"Plan progress: when planId is set, report progress with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`. Do not mark rows done from the worker CLI.","worker.prompt.progress.full":["Structured plan progress (required when planId is set):","- Report checkpoints with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`.","- When a slice is finished, emit `partial` with evidence (`--evidence pr:<url>`, `--evidence path:<file>`, or `--evidence command:<cmd>`).","- Do not propose or confirm row `done` from the worker CLI."].join(`
 `),"worker.prompt.merge_gate.compact":"Verification cost control: prefer local verification before requesting CI runs; do not push empty commits to re-trigger CI; record verification evidence on the PR.","worker.prompt.merge_gate.full":["Verification cost control:","- Prefer local verification of touched paths before requesting any CI run.","- Do not push empty commits to re-trigger CI.","- Record verification evidence on the PR before requesting review."].join(`
 `),"worker.prompt.plan_artifacts.compact":"Plan artifacts: when authoring or revising plan documents, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in a local worktree.","worker.prompt.plan_artifacts.full":["Plan artifacts (when authoring or revising plan documents):","- Create a feature branch and open a GitHub PR (draft OK) before substantial drafting; commit and push the plan file.","- Iterate on that PR branch and link the PR URL on the related task and progress evidence."].join(`
-`)},tC={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},sn={version:Zw,generatedAt:"1970-01-01T00:00:00.000Z",personas:eC,instructions:rC,policyThresholds:tC};var So=sn,Vp="embedded";function st(){return So.version}function Br(){return Vp}function Gp(e,r){So=e,Vp=r}function wo(e){let r=So.instructions[e];if(typeof r=="string"&&r.trim())return r;let t=sn.instructions[e];return typeof t=="string"?t:""}function an(e,r){let t=So.policyThresholds[e];if(typeof t=="number"&&Number.isFinite(t))return t;let n=sn.policyThresholds[e];return typeof n=="number"&&Number.isFinite(n)?n:r}function Yp(e){if(!e)return null;let r=e.trim().toLowerCase();return So.personas.find(t=>t.slug===r)??null}import{createPublicKey as oC,verify as sC}from"node:crypto";var nC={"ib-3bab6314f0ba":"53a2040646cd479e1f5f1aea9abf7848ce8b62e32001efb8044dfd90e8ab87ed","ib-26e6c695da06":"bb1700f25b2ee7d7cdcdb9f446f0f44ef2cc22a3096bc161232fb658e7cdaf38"};function Jp(e,r=process.env){let t=on(r.KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY);if(t)return t;let n=nC[e];return n?on(n):null}var iC=Buffer.from("302a300506032b6570032100","hex");function aC(e){return oC({key:Buffer.concat([iC,Buffer.from(e)]),format:"der",type:"spki"})}function lC(e,r){if(!bo(e))return{ok:!1,reason:"malformed signed bundle payload"};let t;try{t=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(t.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let n=Buffer.from(ni(e.bundle),"utf8");return sC(null,n,aC(r),t)?{ok:!0,bundle:e.bundle}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(n){return{ok:!1,reason:`signature verification failed: ${n.message}`}}}function qp(e,r=process.env){if(!bo(e))return{ok:!1,reason:"malformed signed bundle payload"};let t=Jp(e.publicKeyId,r);return t?lC(e,t):{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}" (not pinned; set KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY)`}}var uC=15*6e4,cC=1e4,br={lastAttemptAtMs:0,etag:null,diskCacheTried:!1,routeMissingLogged:!1};function xo(e,r){console.error(JSON.stringify({event:e,...r}))}function zp(e,r,t){let n=qp(e);return n.ok?(Gp(n.bundle,r),r==="server"&&$p(t,e),!0):(xo("instruction_bundle_signature_invalid",{agentOsId:t,source:r,publicKeyId:e.publicKeyId,reason:n.reason}),!1)}function Co(e){if(br.diskCacheTried)return!1;br.diskCacheTried=!0;let r=jp(e);return r?zp(r,"disk",e):!1}async function Xp(e){let r=e.nowMs??Date.now(),t=()=>({source:Br(),version:st(),updated:!1});if(!e.force&&r-br.lastAttemptAtMs<uC)return t();br.lastAttemptAtMs=r;let n=e.baseUrl?.trim().replace(/\/$/,""),o=e.secret?.trim();if(!n||!o)return Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t();let s=e.fetchImpl??fetch,i=new AbortController,a=setTimeout(()=>i.abort(),cC);try{let l=De(o);delete l["Content-Type"],br.etag&&Br()==="server"&&(l["If-None-Match"]=br.etag);let u=await s(`${n}/api/agent-os/by-id/${encodeURIComponent(e.agentOsId)}/runtime/instruction-bundle`,{headers:l,signal:i.signal});if(u.status===304)return t();if(u.status===404)return br.routeMissingLogged||(br.routeMissingLogged=!0,xo("instruction_bundle_route_missing",{agentOsId:e.agentOsId,baseUrl:n})),Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t();if(!u.ok)return xo("instruction_bundle_fetch_failed",{agentOsId:e.agentOsId,status:u.status}),Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t();let c=await u.json().catch(()=>null);return!c||!zp(c,"server",e.agentOsId)?Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t():(br.etag=u.headers.get("etag"),xo("instruction_bundle_loaded",{agentOsId:e.agentOsId,version:st(),publicKeyId:c.publicKeyId}),{...t(),updated:!0})}catch(l){return xo("instruction_bundle_fetch_error",{agentOsId:e.agentOsId,error:l instanceof Error?l.message:String(l)}),Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t()}finally{clearTimeout(a)}}A();we();Ut();Gn();import dC from"node:os";function Qp(e,r){console.error(JSON.stringify({event:"daemon_identity",level:e,message:r}))}function Zp(e=R(),r=process.env){let t=he(r,e),n=Wt({config:e,totalMemBytes:dC.totalmem(),env:r}),o=[...t.warnings],s=[];if(!e.boxKind?.trim()&&!r.KYNVER_BOX_KIND?.trim()&&s.push("boxKind is not persisted in ~/.kynver/config.json and KYNVER_BOX_KIND is unset \u2014 run `kynver setup --box-kind forge|ghost` before starting the daemon so Command Center attributes snapshots to the correct pool"),t.slugInferenceBlocked){let u=r.KYNVER_DAEMON_STRICT_IDENTITY==="1"||r.KYNVER_DAEMON_STRICT_IDENTITY==="true",c="ambiguous box identity: KYNVER_AGENT_OS_SLUG is set without KYNVER_BOX_KIND or config.boxKind; treating this host as forge";u?s.push(c):o.push(c)}let i=n.configuredMaxWorkers??n.autoCap,a=Je(t.boxKind,i);Mt(t.boxKind,i)&&o.push(`Forge box maxConcurrentWorkers=${i} exceeds pool cap \u2014 using ${a}; run kynver setup --box-kind forge --max-workers 4`);let l=s.length===0;for(let u of o)Qp("warn",u);for(let u of s)Qp("error",u);return{ok:l,box:t,workerCapSource:n.workerCapSource,maxConcurrentWorkers:a,autoCap:n.autoCap,warnings:o,errors:s}}import{mkdirSync as yC,readFileSync as RC,renameSync as vC,writeFileSync as bC}from"node:fs";import{homedir as SC}from"node:os";import om from"node:path";import{existsSync as pC,readFileSync as mC}from"node:fs";import{dirname as Rl,join as rm}from"node:path";import{fileURLToPath as em}from"node:url";function fC(e){let r=Rl(em(e));for(let t=0;t<6;t+=1){if(pC(rm(r,"package.json")))return r;let n=Rl(r);if(n===r)break;r=n}throw new Error(`package.json not found above ${Rl(em(e))}`)}function tm(e=import.meta.url){let r=rm(fC(e),"package.json"),t=JSON.parse(mC(r,"utf8"));if(typeof t.version!="string"||!t.version.trim())throw new Error(`Missing package.json version at ${r}`);return t.version}var ze=tm();function gC(e){return e.some(r=>r==="--version"||r==="-v")}function hC(e,r){console.log(r?`${r} ${e}`:e),process.exit(0)}function nm(e,r=import.meta.url,t){return gC(e)?(hC(tm(r),t),!0):!1}var kC=/^[0-9a-f]{7,40}$/i;function oi(){let e=process.env.KYNVER_GIT_COMMIT_SHA?.trim();return{contractVersion:1,nodeVersion:process.versions.node,runtimePackageVersion:ze,buildIdentity:e&&kC.test(e)?e.toLowerCase():null,platform:process.platform,arch:process.arch}}function si(e){let r=e.replace(/[^A-Za-z0-9_-]/g,"_");return om.join(SC(),".kynver",`daemon-heartbeat-${r}.json`)}function sm(e){try{let r=si(e.agentOsId);yC(om.dirname(r),{recursive:!0});let t={observedAt:(e.now??new Date).toISOString(),pid:process.pid,runId:e.runId,agentOsId:e.agentOsId,...e.instructionBundleVersion?{instructionBundleVersion:e.instructionBundleVersion}:{},runtimeIdentity:oi()},n=`${r}.tmp-${process.pid}`;bC(n,JSON.stringify(t),"utf8"),vC(n,r)}catch{}}function im(e){try{let r=RC(si(e),"utf8"),t=JSON.parse(r);return typeof t?.observedAt!="string"?null:t}catch{return null}}function am(e,r,t=Date.now()){if(!e)return!1;let n=Date.parse(e.observedAt);return Number.isNaN(n)?!0:t-n>r}function wC(e){let r=process.env[e]?.trim().toLowerCase();return r==="1"||r==="true"||r==="yes"||r==="on"}function ln(){process.platform==="win32"&&(wC("KYNVER_DAEMON_ALLOW_NATIVE_WINDOWS")||(console.error(JSON.stringify({event:"daemon_start_blocked",reason:"native_windows_console_flash",remedy:"Run the daemon inside WSL: .\\scripts\\start-tier2-wsl.ps1 \u2014 or set KYNVER_DAEMON_ALLOW_NATIVE_WINDOWS=1 to override (flashes visible consoles)."})),process.exit(1)))}A();import{existsSync as CC}from"node:fs";import{homedir as xC}from"node:os";import _C from"node:path";function lm(e,r){let t=process.env[e]?.trim().toLowerCase();return t?t==="0"||t==="false"||t==="no"||t==="off"?!1:t==="1"||t==="true"||t==="yes"||t==="on"?!0:r:r}function _o(e,r,t=1){let n=Number(process.env[e]);return!Number.isFinite(n)||n<t?r:Math.floor(n)}function Wr(){let e=process.env.KYNVER_CRON_STORE_PATH?.trim()||process.env.OPENCLAW_CRON_STORE_PATH?.trim();return e||_C.join(xC(),".kynver","agent-os-cron.json")}function EC(e=Wr()){let r=process.env.KYNVER_CRON_TICK_STATE_PATH?.trim();return r||`${e.replace(/\.json$/i,"")}.tick-state.json`}function PC(){let e=R();return process.env.KYNVER_API_URL?.trim()||e.apiBaseUrl?.trim()||process.env.KYNVER_CRON_FIRE_BASE_URL?.trim()||process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||null}function vl(){let e=R();return process.env.KYNVER_CRON_SECRET?.trim()||process.env.OPENCLAW_CRON_SECRET?.trim()||process.env.KYNVER_RUNTIME_SECRET?.trim()||vr(e.agentOsId)?.trim()||vr()?.trim()||null}function Sr(){let e=Wr(),r=EC(e),t=PC(),n=vl(),o=!!(t&&n),s=CC(e),i=o&&(s||lm("KYNVER_CRON_TICK_FORCE",!1));return{storePath:e,statePath:r,lockPath:`${r}.lock`,fireBaseUrl:t,secret:n,tickEnabled:lm("KYNVER_CRON_TICK_ENABLED",i),tickIntervalMs:_o("KYNVER_CRON_TICK_INTERVAL_MS",6e4,5e3),missedRunPolicy:process.env.KYNVER_CRON_MISSED_RUN_POLICY?.trim().toLowerCase()==="skip"?"skip":"catch_up",maxCatchUpPerTick:_o("KYNVER_CRON_MAX_CATCH_UP_PER_TICK",3,0),maxRetries:_o("KYNVER_CRON_MAX_RETRIES",3,0),retryBackoffMs:_o("KYNVER_CRON_RETRY_BACKOFF_MS",6e4,1e3),inflightLeaseMs:_o("KYNVER_CRON_INFLIGHT_LEASE_MS",12e4,5e3)}}function ii(e=Sr()){return e.tickEnabled&&!!(e.fireBaseUrl&&e.secret)}function IC(e){return e.replace(/\/+$/,"")}async function um(e){let r=e.fetchFn??fetch,t=e.entry.spec.callbackPath.startsWith("/")?e.entry.spec.callbackPath:`/${e.entry.spec.callbackPath}`,n=`${IC(e.baseUrl)}${t}`,s={source:"kynver-cron",jobId:e.jobId??e.entry.spec.dedupeKey??null,agentOsId:e.entry.spec.target.agentOsId,kind:e.entry.spec.kind,target:e.entry.spec.target,...e.entry.spec.payload!==void 0&&{payload:e.entry.spec.payload}},i=await r(n,{method:"POST",headers:De(e.secret),body:JSON.stringify(s)}),a=null;try{a=await i.json()}catch{a=null}return{ok:i.ok,status:i.status,body:a,url:n}}C();import{closeSync as AC,existsSync as bl,openSync as OC,readFileSync as NC,unlinkSync as cm,writeFileSync as TC}from"node:fs";var DC=10*6e4;function dm(e){if(!bl(e))return null;try{let r=JSON.parse(NC(e,"utf8"));if(typeof r.pid=="number"&&typeof r.at=="string")return r}catch{return null}return null}function MC(e){let r=dm(e);if(!r||!K(r.pid))return!0;let t=Date.parse(r.at);return Number.isNaN(t)?!0:Date.now()-t>DC}function pm(e){if(bl(e)&&!MC(e)){let r=dm(e);return{acquired:!1,reason:r?`held by pid ${r.pid}`:"held by another process"}}if(bl(e))try{cm(e)}catch{}try{let r=OC(e,"wx");return TC(r,JSON.stringify({pid:process.pid,at:new Date().toISOString()}),"utf8"),AC(r),{acquired:!0}}catch(r){if(r.code==="EEXIST")return{acquired:!1,reason:"concurrent acquire"};throw r}}function mm(e){try{cm(e)}catch{}}A();var UC=/^[\d*/,\-?LW#]+\s+[\d*/,\-?LW#]+\s+[\d*/,\-?LW#]+\s+[\d*/,\-?LW#]+\s+[\d*/,\-?LW#]+$/;function BC(e){return UC.test(e.trim())}function WC(e,r,t){let n=new Set;for(let o of e.split(",")){let s=o.trim();if(!s)continue;if(s==="*"){for(let d=r;d<=t;d++)n.add(d);continue}let i=/^(.+)\/(\d+)$/.exec(s),a=i?i[1]:s,l=i?Math.max(1,Number(i[2])):1;if(a==="*"){for(let d=r;d<=t;d+=l)n.add(d);continue}let u=/^(\d+)-(\d+)$/.exec(a);if(u){let d=Math.max(r,Number(u[1])),p=Math.min(t,Number(u[2]));for(let m=d;m<=p;m+=l)n.add(m);continue}let c=Number(a);Number.isInteger(c)&&c>=r&&c<=t&&n.add(c)}return n}function Eo(e,r,t,n){let o=e.trim();return o==="*"?!0:WC(o,t,n).has(r)}function LC(e,r){let t=e.trim().split(/\s+/);if(t.length!==5)return!1;let[n,o,s,i,a]=t;return Eo(n,r.getUTCMinutes(),0,59)&&Eo(o,r.getUTCHours(),0,23)&&Eo(s,r.getUTCDate(),1,31)&&Eo(i,r.getUTCMonth()+1,1,12)&&Eo(a,r.getUTCDay(),0,6)}var HC=366*24*60;function FC(e){return new Date(Date.UTC(e.getUTCFullYear(),e.getUTCMonth(),e.getUTCDate(),e.getUTCHours(),e.getUTCMinutes(),0,0))}function fm(e,r){if(!BC(e))return null;let t=FC(r);t=new Date(t.getTime()+6e4);for(let n=0;n<HC;n++){if(LC(e,t))return t;t=new Date(t.getTime()+6e4)}return null}function gm(e,r){if(e.scheduleKind==="runAt"&&e.runAt){let t=Date.parse(e.runAt);return Number.isNaN(t)?null:new Date(t).toISOString()}if(e.scheduleKind==="cron"&&e.cron){let t=fm(e.cron.trim(),r);return t?t.toISOString():null}return null}function Sl(e,r){if(e.scheduleKind!=="cron"||!e.cron?.trim())return null;let t=fm(e.cron.trim(),r);return t?t.toISOString():null}import{promises as KC}from"node:fs";async function hm(e){try{return await KC.readFile(e,"utf8")}catch(r){if(r.code==="ENOENT")return null;throw r}}function $C(e){if(!e)return[];try{let r=JSON.parse(e);return Array.isArray(r.entries)?r.entries:[]}catch{return[]}}async function it(e=Wr()){let r=await hm(e);return $C(r)}async function km(e,r){let{mkdir:t,writeFile:n,rename:o}=await import("node:fs/promises"),{randomBytes:s}=await import("node:crypto"),{dirname:i}=await import("node:path");await t(i(e),{recursive:!0});let a=`${e}.${s(4).toString("hex")}.tmp`,l=JSON.stringify({entries:r},null,2);await n(a,l,"utf8"),await o(a,e)}async function ym(e,r=Wr()){let t=await it(r),n=t.findIndex(o=>o.providerScheduleId===e.providerScheduleId);n>=0?t[n]=e:t.push(e),await km(r,t)}async function Rm(e=Wr()){return await hm(e)!==null?{created:!1}:(await km(e,[]),{created:!0})}import{randomBytes as jC}from"node:crypto";import{promises as Po}from"node:fs";import VC from"node:path";var ai={version:1,jobs:{}};async function GC(e){try{return await Po.readFile(e,"utf8")}catch(r){if(r.code==="ENOENT")return null;throw r}}function YC(e){if(!e)return{...ai,jobs:{...ai.jobs}};try{let r=JSON.parse(e);return r?.version!==1||typeof r.jobs!="object"||!r.jobs?{...ai,jobs:{}}:r}catch{return{...ai,jobs:{}}}}async function li(e){let r=await GC(e);return YC(r)}async function JC(e,r){await Po.mkdir(VC.dirname(e),{recursive:!0});let t=jC(6).toString("hex"),n=`${e}.tmp-${process.pid}-${Date.now()}-${t}`;await Po.writeFile(n,`${JSON.stringify(r,null,2)}
+`)},tC={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},sn={version:Zw,generatedAt:"1970-01-01T00:00:00.000Z",personas:eC,instructions:rC,policyThresholds:tC};var So=sn,Vp="embedded";function st(){return So.version}function Br(){return Vp}function Gp(e,r){So=e,Vp=r}function wo(e){let r=So.instructions[e];if(typeof r=="string"&&r.trim())return r;let t=sn.instructions[e];return typeof t=="string"?t:""}function an(e,r){let t=So.policyThresholds[e];if(typeof t=="number"&&Number.isFinite(t))return t;let n=sn.policyThresholds[e];return typeof n=="number"&&Number.isFinite(n)?n:r}function Yp(e){if(!e)return null;let r=e.trim().toLowerCase();return So.personas.find(t=>t.slug===r)??null}import{createPublicKey as oC,verify as sC}from"node:crypto";var nC={"ib-3bab6314f0ba":"53a2040646cd479e1f5f1aea9abf7848ce8b62e32001efb8044dfd90e8ab87ed","ib-26e6c695da06":"bb1700f25b2ee7d7cdcdb9f446f0f44ef2cc22a3096bc161232fb658e7cdaf38","ib-49e76cb8052c":"8fc646b5c4f8f402120477452608398f035c3cddd2e7aa8bb328e97b84dcf6d8"};function Jp(e,r=process.env){let t=on(r.KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY);if(t)return t;let n=nC[e];return n?on(n):null}var iC=Buffer.from("302a300506032b6570032100","hex");function aC(e){return oC({key:Buffer.concat([iC,Buffer.from(e)]),format:"der",type:"spki"})}function lC(e,r){if(!bo(e))return{ok:!1,reason:"malformed signed bundle payload"};let t;try{t=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(t.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let n=Buffer.from(ni(e.bundle),"utf8");return sC(null,n,aC(r),t)?{ok:!0,bundle:e.bundle}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(n){return{ok:!1,reason:`signature verification failed: ${n.message}`}}}function qp(e,r=process.env){if(!bo(e))return{ok:!1,reason:"malformed signed bundle payload"};let t=Jp(e.publicKeyId,r);return t?lC(e,t):{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}" (not pinned; set KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY)`}}var uC=15*6e4,cC=1e4,br={lastAttemptAtMs:0,etag:null,diskCacheTried:!1,routeMissingLogged:!1};function xo(e,r){console.error(JSON.stringify({event:e,...r}))}function zp(e,r,t){let n=qp(e);return n.ok?(Gp(n.bundle,r),r==="server"&&$p(t,e),!0):(xo("instruction_bundle_signature_invalid",{agentOsId:t,source:r,publicKeyId:e.publicKeyId,reason:n.reason}),!1)}function Co(e){if(br.diskCacheTried)return!1;br.diskCacheTried=!0;let r=jp(e);return r?zp(r,"disk",e):!1}async function Xp(e){let r=e.nowMs??Date.now(),t=()=>({source:Br(),version:st(),updated:!1});if(!e.force&&r-br.lastAttemptAtMs<uC)return t();br.lastAttemptAtMs=r;let n=e.baseUrl?.trim().replace(/\/$/,""),o=e.secret?.trim();if(!n||!o)return Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t();let s=e.fetchImpl??fetch,i=new AbortController,a=setTimeout(()=>i.abort(),cC);try{let l=De(o);delete l["Content-Type"],br.etag&&Br()==="server"&&(l["If-None-Match"]=br.etag);let u=await s(`${n}/api/agent-os/by-id/${encodeURIComponent(e.agentOsId)}/runtime/instruction-bundle`,{headers:l,signal:i.signal});if(u.status===304)return t();if(u.status===404)return br.routeMissingLogged||(br.routeMissingLogged=!0,xo("instruction_bundle_route_missing",{agentOsId:e.agentOsId,baseUrl:n})),Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t();if(!u.ok)return xo("instruction_bundle_fetch_failed",{agentOsId:e.agentOsId,status:u.status}),Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t();let c=await u.json().catch(()=>null);return!c||!zp(c,"server",e.agentOsId)?Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t():(br.etag=u.headers.get("etag"),xo("instruction_bundle_loaded",{agentOsId:e.agentOsId,version:st(),publicKeyId:c.publicKeyId}),{...t(),updated:!0})}catch(l){return xo("instruction_bundle_fetch_error",{agentOsId:e.agentOsId,error:l instanceof Error?l.message:String(l)}),Br()==="embedded"&&Co(e.agentOsId)?{...t(),updated:!0}:t()}finally{clearTimeout(a)}}A();we();Ut();Gn();import dC from"node:os";function Qp(e,r){console.error(JSON.stringify({event:"daemon_identity",level:e,message:r}))}function Zp(e=R(),r=process.env){let t=he(r,e),n=Wt({config:e,totalMemBytes:dC.totalmem(),env:r}),o=[...t.warnings],s=[];if(!e.boxKind?.trim()&&!r.KYNVER_BOX_KIND?.trim()&&s.push("boxKind is not persisted in ~/.kynver/config.json and KYNVER_BOX_KIND is unset \u2014 run `kynver setup --box-kind forge|ghost` before starting the daemon so Command Center attributes snapshots to the correct pool"),t.slugInferenceBlocked){let u=r.KYNVER_DAEMON_STRICT_IDENTITY==="1"||r.KYNVER_DAEMON_STRICT_IDENTITY==="true",c="ambiguous box identity: KYNVER_AGENT_OS_SLUG is set without KYNVER_BOX_KIND or config.boxKind; treating this host as forge";u?s.push(c):o.push(c)}let i=n.configuredMaxWorkers??n.autoCap,a=Je(t.boxKind,i);Mt(t.boxKind,i)&&o.push(`Forge box maxConcurrentWorkers=${i} exceeds pool cap \u2014 using ${a}; run kynver setup --box-kind forge --max-workers 4`);let l=s.length===0;for(let u of o)Qp("warn",u);for(let u of s)Qp("error",u);return{ok:l,box:t,workerCapSource:n.workerCapSource,maxConcurrentWorkers:a,autoCap:n.autoCap,warnings:o,errors:s}}import{mkdirSync as yC,readFileSync as RC,renameSync as vC,writeFileSync as bC}from"node:fs";import{homedir as SC}from"node:os";import om from"node:path";import{existsSync as pC,readFileSync as mC}from"node:fs";import{dirname as Rl,join as rm}from"node:path";import{fileURLToPath as em}from"node:url";function fC(e){let r=Rl(em(e));for(let t=0;t<6;t+=1){if(pC(rm(r,"package.json")))return r;let n=Rl(r);if(n===r)break;r=n}throw new Error(`package.json not found above ${Rl(em(e))}`)}function tm(e=import.meta.url){let r=rm(fC(e),"package.json"),t=JSON.parse(mC(r,"utf8"));if(typeof t.version!="string"||!t.version.trim())throw new Error(`Missing package.json version at ${r}`);return t.version}var ze=tm();function gC(e){return e.some(r=>r==="--version"||r==="-v")}function hC(e,r){console.log(r?`${r} ${e}`:e),process.exit(0)}function nm(e,r=import.meta.url,t){return gC(e)?(hC(tm(r),t),!0):!1}var kC=/^[0-9a-f]{7,40}$/i;function oi(){let e=process.env.KYNVER_GIT_COMMIT_SHA?.trim();return{contractVersion:1,nodeVersion:process.versions.node,runtimePackageVersion:ze,buildIdentity:e&&kC.test(e)?e.toLowerCase():null,platform:process.platform,arch:process.arch}}function si(e){let r=e.replace(/[^A-Za-z0-9_-]/g,"_");return om.join(SC(),".kynver",`daemon-heartbeat-${r}.json`)}function sm(e){try{let r=si(e.agentOsId);yC(om.dirname(r),{recursive:!0});let t={observedAt:(e.now??new Date).toISOString(),pid:process.pid,runId:e.runId,agentOsId:e.agentOsId,...e.instructionBundleVersion?{instructionBundleVersion:e.instructionBundleVersion}:{},runtimeIdentity:oi()},n=`${r}.tmp-${process.pid}`;bC(n,JSON.stringify(t),"utf8"),vC(n,r)}catch{}}function im(e){try{let r=RC(si(e),"utf8"),t=JSON.parse(r);return typeof t?.observedAt!="string"?null:t}catch{return null}}function am(e,r,t=Date.now()){if(!e)return!1;let n=Date.parse(e.observedAt);return Number.isNaN(n)?!0:t-n>r}function wC(e){let r=process.env[e]?.trim().toLowerCase();return r==="1"||r==="true"||r==="yes"||r==="on"}function ln(){process.platform==="win32"&&(wC("KYNVER_DAEMON_ALLOW_NATIVE_WINDOWS")||(console.error(JSON.stringify({event:"daemon_start_blocked",reason:"native_windows_console_flash",remedy:"Run the daemon inside WSL: .\\scripts\\start-tier2-wsl.ps1 \u2014 or set KYNVER_DAEMON_ALLOW_NATIVE_WINDOWS=1 to override (flashes visible consoles)."})),process.exit(1)))}A();import{existsSync as CC}from"node:fs";import{homedir as xC}from"node:os";import _C from"node:path";function lm(e,r){let t=process.env[e]?.trim().toLowerCase();return t?t==="0"||t==="false"||t==="no"||t==="off"?!1:t==="1"||t==="true"||t==="yes"||t==="on"?!0:r:r}function _o(e,r,t=1){let n=Number(process.env[e]);return!Number.isFinite(n)||n<t?r:Math.floor(n)}function Wr(){let e=process.env.KYNVER_CRON_STORE_PATH?.trim()||process.env.OPENCLAW_CRON_STORE_PATH?.trim();return e||_C.join(xC(),".kynver","agent-os-cron.json")}function EC(e=Wr()){let r=process.env.KYNVER_CRON_TICK_STATE_PATH?.trim();return r||`${e.replace(/\.json$/i,"")}.tick-state.json`}function PC(){let e=R();return process.env.KYNVER_API_URL?.trim()||e.apiBaseUrl?.trim()||process.env.KYNVER_CRON_FIRE_BASE_URL?.trim()||process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||null}function vl(){let e=R();return process.env.KYNVER_CRON_SECRET?.trim()||process.env.OPENCLAW_CRON_SECRET?.trim()||process.env.KYNVER_RUNTIME_SECRET?.trim()||vr(e.agentOsId)?.trim()||vr()?.trim()||null}function Sr(){let e=Wr(),r=EC(e),t=PC(),n=vl(),o=!!(t&&n),s=CC(e),i=o&&(s||lm("KYNVER_CRON_TICK_FORCE",!1));return{storePath:e,statePath:r,lockPath:`${r}.lock`,fireBaseUrl:t,secret:n,tickEnabled:lm("KYNVER_CRON_TICK_ENABLED",i),tickIntervalMs:_o("KYNVER_CRON_TICK_INTERVAL_MS",6e4,5e3),missedRunPolicy:process.env.KYNVER_CRON_MISSED_RUN_POLICY?.trim().toLowerCase()==="skip"?"skip":"catch_up",maxCatchUpPerTick:_o("KYNVER_CRON_MAX_CATCH_UP_PER_TICK",3,0),maxRetries:_o("KYNVER_CRON_MAX_RETRIES",3,0),retryBackoffMs:_o("KYNVER_CRON_RETRY_BACKOFF_MS",6e4,1e3),inflightLeaseMs:_o("KYNVER_CRON_INFLIGHT_LEASE_MS",12e4,5e3)}}function ii(e=Sr()){return e.tickEnabled&&!!(e.fireBaseUrl&&e.secret)}function IC(e){return e.replace(/\/+$/,"")}async function um(e){let r=e.fetchFn??fetch,t=e.entry.spec.callbackPath.startsWith("/")?e.entry.spec.callbackPath:`/${e.entry.spec.callbackPath}`,n=`${IC(e.baseUrl)}${t}`,s={source:"kynver-cron",jobId:e.jobId??e.entry.spec.dedupeKey??null,agentOsId:e.entry.spec.target.agentOsId,kind:e.entry.spec.kind,target:e.entry.spec.target,...e.entry.spec.payload!==void 0&&{payload:e.entry.spec.payload}},i=await r(n,{method:"POST",headers:De(e.secret),body:JSON.stringify(s)}),a=null;try{a=await i.json()}catch{a=null}return{ok:i.ok,status:i.status,body:a,url:n}}C();import{closeSync as AC,existsSync as bl,openSync as OC,readFileSync as NC,unlinkSync as cm,writeFileSync as TC}from"node:fs";var DC=10*6e4;function dm(e){if(!bl(e))return null;try{let r=JSON.parse(NC(e,"utf8"));if(typeof r.pid=="number"&&typeof r.at=="string")return r}catch{return null}return null}function MC(e){let r=dm(e);if(!r||!K(r.pid))return!0;let t=Date.parse(r.at);return Number.isNaN(t)?!0:Date.now()-t>DC}function pm(e){if(bl(e)&&!MC(e)){let r=dm(e);return{acquired:!1,reason:r?`held by pid ${r.pid}`:"held by another process"}}if(bl(e))try{cm(e)}catch{}try{let r=OC(e,"wx");return TC(r,JSON.stringify({pid:process.pid,at:new Date().toISOString()}),"utf8"),AC(r),{acquired:!0}}catch(r){if(r.code==="EEXIST")return{acquired:!1,reason:"concurrent acquire"};throw r}}function mm(e){try{cm(e)}catch{}}A();var UC=/^[\d*/,\-?LW#]+\s+[\d*/,\-?LW#]+\s+[\d*/,\-?LW#]+\s+[\d*/,\-?LW#]+\s+[\d*/,\-?LW#]+$/;function BC(e){return UC.test(e.trim())}function WC(e,r,t){let n=new Set;for(let o of e.split(",")){let s=o.trim();if(!s)continue;if(s==="*"){for(let d=r;d<=t;d++)n.add(d);continue}let i=/^(.+)\/(\d+)$/.exec(s),a=i?i[1]:s,l=i?Math.max(1,Number(i[2])):1;if(a==="*"){for(let d=r;d<=t;d+=l)n.add(d);continue}let u=/^(\d+)-(\d+)$/.exec(a);if(u){let d=Math.max(r,Number(u[1])),p=Math.min(t,Number(u[2]));for(let m=d;m<=p;m+=l)n.add(m);continue}let c=Number(a);Number.isInteger(c)&&c>=r&&c<=t&&n.add(c)}return n}function Eo(e,r,t,n){let o=e.trim();return o==="*"?!0:WC(o,t,n).has(r)}function LC(e,r){let t=e.trim().split(/\s+/);if(t.length!==5)return!1;let[n,o,s,i,a]=t;return Eo(n,r.getUTCMinutes(),0,59)&&Eo(o,r.getUTCHours(),0,23)&&Eo(s,r.getUTCDate(),1,31)&&Eo(i,r.getUTCMonth()+1,1,12)&&Eo(a,r.getUTCDay(),0,6)}var HC=366*24*60;function FC(e){return new Date(Date.UTC(e.getUTCFullYear(),e.getUTCMonth(),e.getUTCDate(),e.getUTCHours(),e.getUTCMinutes(),0,0))}function fm(e,r){if(!BC(e))return null;let t=FC(r);t=new Date(t.getTime()+6e4);for(let n=0;n<HC;n++){if(LC(e,t))return t;t=new Date(t.getTime()+6e4)}return null}function gm(e,r){if(e.scheduleKind==="runAt"&&e.runAt){let t=Date.parse(e.runAt);return Number.isNaN(t)?null:new Date(t).toISOString()}if(e.scheduleKind==="cron"&&e.cron){let t=fm(e.cron.trim(),r);return t?t.toISOString():null}return null}function Sl(e,r){if(e.scheduleKind!=="cron"||!e.cron?.trim())return null;let t=fm(e.cron.trim(),r);return t?t.toISOString():null}import{promises as KC}from"node:fs";async function hm(e){try{return await KC.readFile(e,"utf8")}catch(r){if(r.code==="ENOENT")return null;throw r}}function $C(e){if(!e)return[];try{let r=JSON.parse(e);return Array.isArray(r.entries)?r.entries:[]}catch{return[]}}async function it(e=Wr()){let r=await hm(e);return $C(r)}async function km(e,r){let{mkdir:t,writeFile:n,rename:o}=await import("node:fs/promises"),{randomBytes:s}=await import("node:crypto"),{dirname:i}=await import("node:path");await t(i(e),{recursive:!0});let a=`${e}.${s(4).toString("hex")}.tmp`,l=JSON.stringify({entries:r},null,2);await n(a,l,"utf8"),await o(a,e)}async function ym(e,r=Wr()){let t=await it(r),n=t.findIndex(o=>o.providerScheduleId===e.providerScheduleId);n>=0?t[n]=e:t.push(e),await km(r,t)}async function Rm(e=Wr()){return await hm(e)!==null?{created:!1}:(await km(e,[]),{created:!0})}import{randomBytes as jC}from"node:crypto";import{promises as Po}from"node:fs";import VC from"node:path";var ai={version:1,jobs:{}};async function GC(e){try{return await Po.readFile(e,"utf8")}catch(r){if(r.code==="ENOENT")return null;throw r}}function YC(e){if(!e)return{...ai,jobs:{...ai.jobs}};try{let r=JSON.parse(e);return r?.version!==1||typeof r.jobs!="object"||!r.jobs?{...ai,jobs:{}}:r}catch{return{...ai,jobs:{}}}}async function li(e){let r=await GC(e);return YC(r)}async function JC(e,r){await Po.mkdir(VC.dirname(e),{recursive:!0});let t=jC(6).toString("hex"),n=`${e}.tmp-${process.pid}-${Date.now()}-${t}`;await Po.writeFile(n,`${JSON.stringify(r,null,2)}
 `,"utf8");try{await Po.rename(n,e)}catch(o){let s=o.code;if(s!=="EPERM"&&s!=="EEXIST"&&s!=="EACCES")throw o;await Po.unlink(n).catch(()=>{})}}async function vm(e,r){await JC(e,r)}function bm(e,r){let t=e.jobs[r];if(t)return t;let n={providerScheduleId:r,nextFireAt:null,lastFiredAt:null,lastAttemptAt:null,consecutiveFailures:0,completedAt:null,inflightUntil:null};return e.jobs[r]=n,n}function qC(e,r){if(!e.inflightUntil)return!1;let t=Date.parse(e.inflightUntil);return!Number.isNaN(t)&&t>r}function zC(e){return!!e.completedAt}function XC(e,r,t,n){if(r.consecutiveFailures===0)return!0;if(e.spec.scheduleKind!=="cron"&&r.consecutiveFailures>t.maxRetries)return!1;if(!r.lastAttemptAt)return!0;let o=Date.parse(r.lastAttemptAt);return Number.isNaN(o)?!0:n-o>=t.retryBackoffMs}function QC(e,r,t){if(r.nextFireAt)return r.nextFireAt;let n=gm(e.spec,t);return r.nextFireAt=n,n}function ZC(e,r,t,n){if(e.paused||zC(r)||qC(r,t)||!XC(e,r,n,t))return!1;let o=r.nextFireAt?Date.parse(r.nextFireAt):NaN;return Number.isNaN(o)?!1:t>=o}function ex(e,r,t){e.spec.scheduleKind==="cron"&&(r.nextFireAt=Sl(e.spec,t))}async function un(e={}){let r=e.env??Sr(),t=e.now??new Date,n=t.getTime(),o=e.agentOsIdFilter?vr(e.agentOsIdFilter):vr();if(!r.tickEnabled)return{enabled:!1,skipped:"tick_disabled",scanned:0,due:0,fired:0,skippedJobs:0,errors:0};if(!r.fireBaseUrl||!r.secret&&!o)return{enabled:!0,skipped:"missing_fire_credentials",scanned:0,due:0,fired:0,skippedJobs:0,errors:0};let s=pm(r.lockPath);if(!s.acquired)return{enabled:!0,skipped:s.reason??"lock_not_acquired",scanned:0,due:0,fired:0,skippedJobs:0,errors:0,lockHeld:!0};try{let i=await it(r.storePath),a=e.agentOsIdFilter?i.filter(g=>g.spec.target.agentOsId===e.agentOsIdFilter):i,l=await li(r.statePath),u=[];for(let g of a){let k=bm(l,g.providerScheduleId);QC(g,k,t),ZC(g,k,n,r)&&u.push({entry:g,job:k})}u.sort((g,k)=>{let h=Date.parse(g.job.nextFireAt??"")||0,y=Date.parse(k.job.nextFireAt??"")||0;return h-y});let c=0,d=0,p=0,m=r.maxCatchUpPerTick,f=[];for(let{entry:g,job:k}of u){if(r.missedRunPolicy==="skip"&&g.spec.scheduleKind==="cron"){let h=Date.parse(k.nextFireAt??"");if(!Number.isNaN(h)&&h<n-r.tickIntervalMs*2){k.nextFireAt=Sl(g.spec,t),p++;continue}}if(m<=0){p++;continue}k.inflightUntil=new Date(n+r.inflightLeaseMs).toISOString(),k.lastAttemptAt=t.toISOString(),ex(g,k,t);try{let h=vr(g.spec.target.agentOsId)||r.secret;if(!h){k.inflightUntil=null,k.consecutiveFailures+=1,d++,f.push({providerScheduleId:g.providerScheduleId,callbackPath:g.spec.callbackPath,error:"missing_fire_credentials"});continue}let y=await um({entry:g,baseUrl:r.fireBaseUrl,secret:h,fetchFn:e.fetchFn});k.inflightUntil=null,y.ok?(k.lastFiredAt=t.toISOString(),k.consecutiveFailures=0,g.spec.scheduleKind==="runAt"&&(k.completedAt=t.toISOString(),k.nextFireAt=null),c++,m--):(k.consecutiveFailures+=1,d++,f.push({providerScheduleId:g.providerScheduleId,callbackPath:g.spec.callbackPath,url:y.url,status:y.status,body:y.body}))}catch(h){k.inflightUntil=null,k.consecutiveFailures+=1,d++,f.push({providerScheduleId:g.providerScheduleId,callbackPath:g.spec.callbackPath,error:h instanceof Error?h.message:String(h)})}}return await vm(r.statePath,l),{enabled:!0,scanned:a.length,due:u.length,fired:c,skippedJobs:p,errors:d,...f.length?{errorDetails:f}:{}}}finally{mm(r.lockPath)}}qe();C();D();import Sm from"node:path";var wm="mesh-cron-lease.json";function ui(e){return x(Sm.join(N(e),wm),null)}function Cm(e,r){ue(Sm.join(N(e),wm),{...r,updatedAt:new Date().toISOString()})}function xm(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let r=e.response;if(!r||typeof r!="object"||Array.isArray(r))return null;let t=r.meshLiveness;if(!t||typeof t!="object"||Array.isArray(t))return null;let n=t.cronLease;if(!n||typeof n!="object"||Array.isArray(n))return null;let o=n;return{leaseToken:typeof o.leaseToken=="string"?o.leaseToken:null,holderBoxId:typeof o.holderBoxId=="string"?o.holderBoxId:null,authorized:o.authorized===!0,updatedAt:new Date().toISOString()}}C();import LO from"node:path";D();Zn();C();import rx from"node:path";function tx(e){let r=Array.isArray(e.ownedPaths)?e.ownedPaths.filter(n=>typeof n=="string"):[],t=Array.isArray(e.writeSetPrefixes)?(e.writeSetPrefixes??[]).filter(n=>typeof n=="string"):[];return{...r.length?{ownedPaths:r}:{},...t.length?{writeSetPrefixes:t}:{},...e.allowConcurrentHotspot?{allowConcurrentHotspot:!0}:{}}}function ci(e){let r=H(e),t=[];for(let n of Object.keys(r.workers||{})){let o=x(rx.join(N(r.id),"workers",S(n),"worker.json"),void 0);!o?.taskId||!qt(o)||t.push({runId:r.id,workerName:n,taskId:o.taskId,pid:o.pid,...tx(o)})}return t}A();A();function _m(e){if(e!==void 0&&Number.isFinite(e)&&e>0)return Math.floor(e);let r=Number(process.env.KYNVER_CALLBACK_TIMEOUT_MS);return Number.isFinite(r)&&r>0?Math.floor(r):3e4}async function Em(e,r){let t=_m(r),n=new AbortController,o;try{return await Promise.race([e(n.signal),new Promise((s,i)=>{o=setTimeout(()=>{n.abort(),i(new Error(`callback timeout after ${t}ms`))},t)})])}finally{o&&clearTimeout(o)}}function Pm(e,r){let t=_m(r);return{ok:!1,status:0,response:{error:e instanceof Error?e.message:String(e),timeoutMs:t}}}async function at(e,r,t,n){try{return await Em(async o=>{let s=await fetch(e,{method:"POST",headers:De(r),body:JSON.stringify(t),signal:o}),i=null;try{i=await s.json()}catch{i=null}return{ok:s.ok,status:s.status,response:i}},n?.timeoutMs)}catch(o){return Pm(o,n?.timeoutMs)}}async function Z(e,r,t,n){let o=await at(e,r,t,{timeoutMs:n.timeoutMs});if(o.ok||o.status!==401)return o;let s=await Pp(r,n.agentOsId,{baseUrl:n.baseUrl});return s.ok?{...await at(e,s.token,t,{timeoutMs:n.timeoutMs}),refreshedAuth:!0}:{...o,authRefreshFailure:s.reason}}async function cn(e,r,t){try{return await Em(async n=>{let o=await fetch(e,{method:"GET",headers:De(r),signal:n}),s=null;try{s=await o.json()}catch{s=null}return{ok:o.ok,status:o.status,response:s}},t?.timeoutMs)}catch(n){return Pm(n,t?.timeoutMs)}}A();function Im(){let e=Number(process.env.KYNVER_DISPATCH_CALLBACK_TIMEOUT_MS);return Number.isFinite(e)&&e>0?Math.floor(e):12e4}function wl(e){console.error(JSON.stringify({event:"dispatch_progress",ts:new Date().toISOString(),...e}))}function Am(e){if(!e||typeof e!="object")return!1;let r=e;if(r.timeoutMs!==void 0)return!0;let t=r.error;if(typeof t!="string"||!t.trim())return!1;let n=t.toLowerCase();return n.includes("abort")||n.includes("timeout")}var nx=["implementation","review","landing"],ox=["plan_author","implementer","report_reviewer","deep_reviewer","runtime_verifier","system"];function sx(e){return nx.includes(e)}function ix(e){return ox.includes(e)}function Om(e){return{slug:e.slug,displayName:e.displayName,description:e.description,dispatchLane:e.dispatchLane===null||sx(e.dispatchLane)?e.dispatchLane:null,defaultRoleLane:ix(e.defaultRoleLane)?e.defaultRoleLane:"implementer"}}var Nm=sn.personas.map(Om),ax=new Map(Nm.map(e=>[e.slug,e]));function lx(e){if(!e)return null;let r=e.trim().toLowerCase(),t=ax.get(r)??null,n=Yp(r);if(!n)return t;let o=Om(n);return t?{...o,dispatchLane:t.dispatchLane,defaultRoleLane:t.defaultRoleLane}:o}function Cl(e){return lx(e)?.defaultRoleLane??null}function Tm(){return Nm.filter(e=>e.dispatchLane==="review").map(e=>e.slug)}function Dm(e){return(e??"").trim().toLowerCase()}function ux(e){switch(Dm(e)){case"implementer":case"repair_implementer":case"plan_author":case"runtime_verifier":return"implementation";case"plan_reviewer":case"report_reviewer":case"deep_reviewer":return"review";default:return null}}function cx(e){let r=Dm(e);if(!r)return;if(r==="implementation"||r==="review"||r==="landing"||r==="any")return r;let t=ux(r);if(t)return t;if(r==="implement"||r==="repair"||r==="coding")return"implementation";if(r==="land"||r==="merge")return"landing"}function Mm(e){return cx(e)??"any"}Vn();A();we();function dx(e=process.env){let r=R();return Ye(r,e)!=="forge"}function di(e,r=process.env){if(dx(r))return e?.maxConcurrentWorkers??void 0}async function pi(e,r){let t=W(r.baseUrl?String(r.baseUrl):void 0),n=await G(r.secret?String(r.secret):void 0,e,{baseUrl:t}),o=`${t}/api/agent-os/by-id/${encodeURIComponent(e)}/runtime`;try{let s=await cn(o,n);if(!s.ok)return null;let a=s.response?.preferences?.maxConcurrentWorkers;if(a==null)return{maxConcurrentWorkers:null};let l=Number(a);return!Number.isFinite(l)||l<=0?{maxConcurrentWorkers:null}:{maxConcurrentWorkers:Math.floor(l)}}catch{return null}}zt();var px={fetchPreferences:pi,configuredOverride:di,observe:yr};async function Um(e,r=px){let t=await r.fetchPreferences(e.agentOsId,e.args),n=r.configuredOverride(t,e.env);return r.observe({runId:e.runId,configuredMaxWorkersOverride:n})}D();D();function mi(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function xl(e){return e.toLowerCase()}function mx(e){let r=mi(e,"roleLane");if(r)return r;let t=xl(mi(e,"executorRef")),n=xl(mi(e,"title")),o=xl(mi(e,"personaSlug")),s=`${t} ${n}`;if(s.includes("deep review")||s.includes("security review")||t.includes("deep-reviewer"))return"deep_reviewer";if(s.includes("plan author")||s.includes("plan-author")||n.includes("strategy plan"))return"plan_author";if(s.includes("plan review")||t.includes("plan-reviewer"))return"plan_reviewer";if(s.includes("report review")||s.includes("completion report"))return"report_reviewer";if(s.includes("repair")||n.startsWith("fix ")||t.includes("repair"))return"repair_implementer";if(t.includes("cursor")||t.includes("codex")||t.includes("composer")||n.includes("implement")||n.includes("land:"))return"implementer";let i=Cl(o);if(i)return o==="lorentz"&&(s.includes("deep")||s.includes("security"))?"deep_reviewer":i;if(s.includes("review"))return"report_reviewer"}function Bm(e){let r=mx(e);return r?{...e,roleLane:r}:e}A();var fx=/^claude[-_]/i,gx=/^(?:opus|sonnet|haiku)\b/i;function Wm(e){let r=e.trim();return fx.test(r)||gx.test(r)}function Lm(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function _l(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function hx(e){return Lm(e)?"codex":Wm(e)?"claude":(_l(e),"cursor")}function kx(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:null:null}function yx(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Wm(n)||Lm(n)||_l(n)?{lane:t,model:n,provider:hx(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function lt(e){let r=typeof e=="string"?e.trim():"";return r?kx(r)??yx(r):null}function Hm(e){let r=lt(e);return r?!!(r.provider&&r.provider!=="cursor"||r.model&&!_l(r.model)):!1}var wr="cursor",Rx=new Set(["claude","opus","anthropic"]),vx=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function fi(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Xe(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Rx.has(r)?!0:r.includes("claude")||r.includes("opus")}function gi(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&Xe(r))return!0;let t=fi(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=lt(fi(e,"executorRef"));if(n?.provider&&Xe(n.provider)||n?.model&&Xe(bx(n.model)))return!0;let o=fi(e,"description");if(vx.some(i=>i.test(o)))return!0;let s=fi(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function bx(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Sx(e,r){return{provider:wr,model:El,rule:`policy:cursor_default${r}`,requestedModel:e}}function Fm(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&Xe(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(gi(t)||r.rule==="explicit:cli"&&Xe(r.provider)||!Xe(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Sx(r.model,o)}function hi(e,r=wr){let t=e?.trim();return t?Xe(t)?wr:t==="codex"?"codex":t:r}var Km={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0}};function dn(e){return Km[e]}function $m(){return Object.values(Km)}import{existsSync as Cx}from"node:fs";import{homedir as xx}from"node:os";import Io from"node:path";import{createHash as jm}from"node:crypto";import{statSync as wx}from"node:fs";import{spawnSync as Vm}from"node:child_process";function or(e){try{let r=wx(e),t=`${e}|${r.size}|${r.mtimeMs}`;return jm("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function pn(e){return jm("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function He(e,r){for(let t of r){let n=process.env[t]?.trim();if(n)return n}return e}function Qe(e,r,t={}){let n=t.timeoutMs??8e3;try{let o=Vm(e,r,{encoding:"utf8",timeout:n,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(o.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let s=(o.stderr||o.stdout||"").trim(),i=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:s?`${i}: ${s.slice(0,200)}`:i}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} probe failed`}}}function ki(e,r,t={}){let n=t.timeoutMs??8e3;try{return Vm(e,r,{stdio:"ignore",timeout:n,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} auth probe failed`}}}var _x="codex";function Ex(){let e=xx();return[process.env.CODEX_HOME?.trim()?Io.join(Io.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,Io.join(e,".codex","auth.json"),Io.join(e,".config","codex","auth.json")].filter(t=>!!t)}function Px(e){return Io.dirname(e)}function Ix(e){let r,t;for(let n of Ex()){if(!Cx(n))continue;r??=n;let o=Qe(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:Px(n)}});if(t??=o,o.ok)return{authPath:n,login:o}}return{authPath:r,login:t??Qe(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function Gm(e=new Date().toISOString()){let r=He(_x,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:pn("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:n}=Ix(r),o=!!t&&n.ok;return{providerId:"codex",ready:o,authSource:"oauth_local",sessionFingerprint:t?or(t):void 0,checkedAt:e,note:o?"Local Codex OAuth session bound on runner":[n.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as Ax}from"node:fs";import{homedir as Ox}from"node:os";import Pl from"node:path";function Nx(){let e=process.env.HERMES_HOME?.trim(),r=e?Pl.resolve(e):Pl.join(Ox(),".hermes");return Pl.join(r,"auth.json")}function yi(e=new Date().toISOString()){let r=He("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=Qe(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=Nx(),o=Ax(n),s=ki(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),i=t.ok&&s.ok;return{path:"hermes_openai_codex",ready:i,authSource:i?"subscription_hermes":"none",sessionFingerprint:o?or(n):void 0,checkedAt:e,note:i?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,s.note,o?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function mn(e=new Date().toISOString()){let r=Gm(e);if(r.ready)return{...r,path:"codex_cli"};let t=yi(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}var Ym=["low","medium","high"],Jm={oauth_local:0,subscription_hermes:0,runner_token:1,api_key_env:2,none:3};function qm(e,r){let t=dn(e);return r==="privileged"?t.supportsPrivilegedPlatformActions:r==="low"?t.supportsLowRiskOrchestration:!0}function Tx(e,r){let t=dn(e.providerId),n=dn(r.providerId),o=Ym.indexOf(t.costTier)-Ym.indexOf(n.costTier);if(o!==0)return o;let s=Jm[e.binding.authSource]-Jm[r.binding.authSource];return s!==0?s:e.providerId.localeCompare(r.providerId)}function Il(e){let r=$m().map(a=>({providerId:a.id,binding:e.inventory.bindings[a.id]})).filter(a=>a.binding.ready&&qm(a.providerId,e.riskClass));if(r.length===0)return null;let n=[...r].sort(Tx)[0],o="codex";if(n.providerId===o)return{providerId:n.providerId,binding:n.binding};let s=e.inventory.bindings[o],i;return qm(o,e.riskClass)?s.ready||(i=s.note??`${o} not bound`):i=`${e.riskClass} orchestration requires privileged-capable provider`,{providerId:n.providerId,binding:n.binding,escalatedFrom:o,escalatedReason:i}}import{existsSync as Dx}from"node:fs";import{homedir as Mx}from"node:os";import Ux from"node:path";var Bx="claude";function Wx(){let e=Mx();return[Ux.join(e,".claude",".credentials.json")]}function zm(e=new Date().toISOString()){let r=He(Bx,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!0,authSource:"api_key_env",sessionFingerprint:pn("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let t=Qe(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=Wx().find(i=>Dx(i)),o=ki(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),s=t.ok&&(o.ok||!!n);return{providerId:"claude",ready:s,authSource:"oauth_local",sessionFingerprint:n?or(n):void 0,checkedAt:e,note:s?"Local Claude Code OAuth session bound on runner":[t.note,o.note,n?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as Lx}from"node:fs";import{homedir as Hx}from"node:os";import Fx from"node:path";var Kx="agent";function $x(){let e=Hx();return[Fx.join(e,".config","cursor","auth.json")]}function Xm(e=new Date().toISOString()){let r=He(Kx,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!0,authSource:"api_key_env",sessionFingerprint:pn("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let t=Qe(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=$x().find(s=>Lx(s)),o=!!n&&t.ok;return{providerId:"cursor",ready:o,authSource:"oauth_local",sessionFingerprint:n?or(n):void 0,checkedAt:e,note:o?"Local Cursor/Composer OAuth session bound on runner":[t.note,n?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as jx,readFileSync as Vx}from"node:fs";import{homedir as Gx}from"node:os";import Al from"node:path";var Yx=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function Jx(){let e=process.env.HERMES_HOME?.trim(),r=e?Al.resolve(e):Al.join(Gx(),".hermes");return Al.join(r,".env")}function qx(e){try{let r=Vx(e,"utf8"),t=[];for(let n of Yx)new RegExp(`^${n}=`,"m").test(r)&&t.push(n);return t}catch{return[]}}function Qm(e=new Date().toISOString()){let r=He("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=Qe(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=Jx(),o=jx(n),s=o?qx(n):[],a=s.some(u=>u.endsWith("_API_KEY"))?"api_key_env":o?"oauth_local":"none",l=t.ok&&o;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:o,authSource:a,sessionFingerprint:o?or(n):void 0,checkedAt:e,note:l?`Hermes profile bound (${s.length?`keys: ${s.join(", ")}`:"no API keys detected"})`:[t.note,o?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function Zm(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=mn(r),n={codex:t,cursor:Xm(r),claude:zm(r)},o=Object.values(n).filter(s=>s.ready).length;return{generatedAt:r,bindings:n,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},hermes:Qm(r),hermesOpenAiCodex:yi(r),codexAdapterPath:t.path,readyCount:o}}var zx=[/\bprivileged\b/i,/\bproduction\s+db\b/i,/\bdb:push\b/i,/\bmigration\b/i,/\bdeploy\b/i,/\bsecrets?\b/i,/\bstripe\b/i,/\[require-approval\]/i,/\[operator-only\]/i],Xx=[/\borchestration\b/i,/\bplan[- ]?progress\b/i,/\bstatus\s+sync\b/i,/\bheartbeat\b/i,/\bboard[- ]?drain\b/i,/\bmaintenance\b/i,/\[orchestration:\s*low-risk\]/i];function Ol(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Qx(e){let r=Ol(e,"executorRef").toLowerCase(),t=Ol(e,"title").toLowerCase(),n=Ol(e,"description").toLowerCase(),o=`${r}
 ${t}
 ${n}`;return zx.some(s=>s.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":Xx.some(s=>s.test(o))?"low":"elevated"}function Zx(e){let r=dn(e.provider),t=e.escalatedFrom&&e.escalatedReason?`Escalated from ${e.escalatedFrom} (${e.escalatedReason}); using ${r.displayName} (${r.costTier} tier)`:`${r.displayName} selected for ${e.riskClass} orchestration (${r.costTier} tier, auth=${e.authSource})`;return{provider:e.provider,model:e.model,authSource:e.authSource,costTier:r.costTier,riskClass:e.riskClass,costRationale:t,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason}}function e_(e){let r=e.inventory??Zm();return e.codexBinding?{...r,bindings:{...r.bindings,codex:e.codexBinding}}:r}function ut(e){let r=Zx({provider:e.providerId,model:e.model,authSource:e.binding.authSource,riskClass:e.riskClass,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason});return{provider:e.providerId,model:e.model,rule:r.routingRule,audit:r}}function ef(e){let r=e.task??{},t=Qx(r),n=e_({inventory:e.inventory,codexBinding:e.codexBinding??(e.inventory?null:mn())}),o=e.preferLowCost===!1?null:e.explicitProvider?.trim().toLowerCase(),s=e.explicitModel?.trim()||void 0,i=wr;if(o==="codex"||o==="provider:codex"){let u=n.bindings.codex;if(!u.ready){let c=Il({inventory:n,riskClass:t});return ut(c?{providerId:c.providerId,binding:c.binding,riskClass:t,routingRule:"orchestration:explicit_codex_unavailable_cost_aware",model:s,escalatedFrom:"codex",escalatedReason:u.note??"codex oauth not bound"}:{providerId:i,binding:n.bindings[i],riskClass:t,routingRule:"orchestration:codex_unavailable_escalate_cursor",model:s,escalatedFrom:"codex",escalatedReason:u.note??"codex oauth not bound"})}return ut({providerId:"codex",binding:u,riskClass:t,routingRule:"orchestration:explicit_codex",model:s})}if(o==="cursor"||o==="provider:cursor"){let u=n.bindings.cursor;if(u.ready)return ut({providerId:"cursor",binding:u,riskClass:t,routingRule:"orchestration:explicit_cursor",model:s})}if(o==="claude"||o==="provider:claude"){let u=n.bindings.claude;if(u.ready)return ut({providerId:"claude",binding:u,riskClass:t,routingRule:"orchestration:explicit_claude",model:s})}let a=Il({inventory:n,riskClass:t});if(a)return ut({providerId:a.providerId,binding:a.binding,riskClass:t,routingRule:`orchestration:cost_aware_${a.providerId}`,model:s,escalatedFrom:a.escalatedFrom,escalatedReason:a.escalatedReason});let l=n.bindings.codex;return ut({providerId:i,binding:n.bindings[i],riskClass:t,routingRule:l.ready?"orchestration:inventory_empty_default_cursor":"orchestration:codex_unavailable_default_cursor",model:s,...l.ready?{}:{escalatedFrom:"codex",escalatedReason:l.note??"codex oauth not bound"}})}import{closeSync as rf,openSync as tf}from"node:fs";import{spawn as l_}from"node:child_process";Ba();var r_="KYNVER_NO_PROD_DB_CREDENTIALS",t_=["KYNVER_ENV_FILE"];function Lr(e,r={}){let t=Ua(e);if(!r.reviewWorker)return t;let n={...t,[r_]:"1"};for(let o of t_)delete n[o];return n}C();var n_=/-(?:thinking(?:-(?:high|medium|low|minimal|max|none))?|high|medium|low|minimal)$/i;function o_(e){return e.replace(n_,"")}var s_=/^(?:gpt-|gpt5|o1|o3|o4|gemini-|grok-|composer|deepseek|llama|mistral|qwen|command-)/i;function Nl(e){return/^claude[-_]/i.test(e)||/^(?:opus|sonnet|haiku)\b/i.test(e)}var i_=new Set(["cursor"]);function a_(e){let r=e.trim().toLowerCase();return i_.has(r)?"auto":null}function Tl(e,r){let t=(e??"").trim();if(!t)return{ok:!0,model:r,normalized:!1};let o=o_(t).trim()||r;return s_.test(o)||!Nl(o)&&o!==r?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is not a Claude model \u2014 the "claude" provider drives the Claude CLI, which only accepts claude-* model ids (got "${o}"). Pick a Claude model or switch the worker provider.`}:o!==t?{ok:!0,model:o,normalized:!0,requested:t,note:`normalized model "${t}" \u2192 "${o}" (the Claude CLI rejects reasoning-effort suffixes)`}:{ok:!0,model:o,normalized:!1}}function fn(e,r){let t=(e??"").trim();return t?Nl(t)?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is a Claude model but the worker provider is "codex". Switch the provider or pick a Codex/OpenAI model.`}:{ok:!0,model:t,normalized:!1}:{ok:!0,model:r,normalized:!1}}function Dl(e,r){let t=(e??"").trim();if(!t)return{ok:!0,model:r,normalized:!1};let n=a_(t);return n?{ok:!0,model:n,normalized:!0,requested:t,note:`normalized model "${t}" \u2192 "${n}" (Cursor provider alias \u2014 use "auto" or a composer id, not "cursor")`}:Nl(t)?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is a Claude model but the worker provider is "cursor". Switch the provider to "claude" or pick a Cursor model.`}:{ok:!0,model:t,normalized:!1}}var ct="claude-sonnet-4-6",Ao="claude-opus-4-8",nf={name:"claude",defaultModel:ct,preflightModel(e){return Tl(e,ct)},start(e){let r=Tl(e.model,ct);if(!r.ok)throw new Error(`claude provider model preflight failed: ${r.note}`);let t=r.model,n=tf(e.stdoutPath,"a"),o=tf(e.stderrPath,"a"),s=["ignore",n,o],i=l_("claude",u_(e,t),be({cwd:e.worktreePath,detached:!0,stdio:s,env:Lr(process.env,{reviewWorker:e.reviewWorker})}));if(rf(n),rf(o),!i.pid)throw new Error("failed to spawn claude worker process (is the `claude` CLI on PATH?)");return i.unref(),{pid:i.pid,model:t}}};function u_(e,r){return["--model",r,"-p","--verbose","--permission-mode",e.executionMode==="read_only"?"plan":"bypassPermissions","--output-format","stream-json","--include-partial-messages",e.prompt]}import{closeSync as lf,existsSync as m_,openSync as uf}from"node:fs";import{spawn as cf}from"node:child_process";C();import{closeSync as of,openSync as sf}from"node:fs";import{spawn as c_}from"node:child_process";C();var Ml=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function d_(e){return Lr({...process.env,CI:"1",NO_COLOR:"1",HERMES_ACCEPT_HOOKS:process.env.HERMES_ACCEPT_HOOKS??"1"},{reviewWorker:e})}function p_(e,r){let t=process.env.KYNVER_HERMES_CODEX_MAX_TURNS?.trim()||"40";return["chat","-q",r,"--provider","openai-codex","-m",e,"-Q","--accept-hooks","--max-turns",t,"--toolsets","hermes-cli"]}var af={name:"hermes-codex",defaultModel:Ml,preflightModel(e){return fn(e,Ml)},start(e){let r=fn(e.model,Ml);if(!r.ok)throw new Error(`hermes-codex provider model preflight failed: ${r.note}`);let t=r.model,n=sf(e.stdoutPath,"a"),o=sf(e.stderrPath,"a"),s=["ignore",n,o],i=He("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),a=p_(t,e.prompt),l=c_(i,a,be({cwd:e.worktreePath,detached:!0,shell:!1,stdio:s,env:d_(e.reviewWorker)}));if(of(n),of(o),!l.pid)throw new Error(`failed to spawn Hermes openai-codex worker (is \`${i}\` on PATH? run \`hermes auth status openai-codex\`)`);return l.unref(),{pid:l.pid,model:t}}};function f_(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var dt=f_();function g_(){return process.env.KYNVER_CODEX_BIN?.trim()||process.env.CODEX_BIN?.trim()||"codex"}function h_(e){return Lr({...process.env,CI:"1",NO_COLOR:"1"},{reviewWorker:e})}function k_(e,r){return["--ask-for-approval","never","exec","--sandbox","read-only","--model",e,r]}function y_(e,r,t){if(!(process.platform!=="win32"&&m_("/usr/bin/script")))return cf(e,r,t);let o=[e,...r].map(s=>`'${s.replace(/'/g,"'\\''")}'`).join(" ");return cf("script",["-qfc",o,"/dev/null"],t)}var df={name:"codex",defaultModel:dt,preflightModel(e){return fn(e,dt)},start(e){if(mn().path==="hermes_openai_codex")return af.start(e);let t=fn(e.model,dt);if(!t.ok)throw new Error(`codex provider model preflight failed: ${t.note}`);let n=t.model,o=uf(e.stdoutPath,"a"),s=uf(e.stderrPath,"a"),i=["ignore",o,s],a=g_(),l=k_(n,e.prompt),u=y_(a,l,be({cwd:e.worktreePath,detached:!0,shell:!1,stdio:i,env:h_(e.reviewWorker)}));if(lf(o),lf(s),!u.pid)throw new Error(`failed to spawn Codex worker (is \`${a}\` on PATH? run \`codex login\` or set CODEX_API_KEY)`);return u.unref(),{pid:u.pid,model:n}}};var R_="claude-sonnet-4-6",El="composer-2.5";function sr(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function v_(e){if(!e)return;let r=sr(e,"workerModelOverride")||sr(e,"modelOverride");return r||`${sr(e,"title")}
@@ -54,7 +54,7 @@ ${e.stderr}`.toLowerCase();return r.includes("api rate limit exceeded")||r.inclu
 `)}),a={passed:i.passed,worktree:t,steps:i.steps};console.log(n?JSON.stringify(a,null,2):i.passed?"local plan verify passed":"local plan verify failed"),i.passed||process.exit(1)}async function vR(e){let r=U(e.plan?String(e.plan):void 0,"plan");if(e.local===!0||e.local==="true"){JT(e);return}let n=R().agentOsSlug;n||(console.error("requires agentOsSlug in ~/.kynver/config.json for verify (session route)"),process.exit(1));let o=W(e.baseUrl?String(e.baseUrl):void 0),s=process.env.KYNVER_API_KEY,i={"Content-Type":"application/json"};s&&(i.Authorization=`Bearer ${s}`);let a=`${o}/api/agent-os/${encodeURIComponent(n)}/plans/${encodeURIComponent(r)}/verify`,l=await fetch(a,{method:"POST",headers:i,body:JSON.stringify({worktreePath:e.worktree?String(e.worktree):void 0,taskId:e.task?String(e.task):void 0,humanOverride:e.humanOverride===!0||e.humanOverride==="true"})}),u=await l.text(),c=null;try{c=JSON.parse(u)}catch{c=u}l.ok||(console.error(JSON.stringify({httpStatus:l.status,response:c},null,2)),process.exit(1)),console.log(JSON.stringify(c,null,2))}import qT from"node:path";C();function bR(e){let r=qT.resolve(U(e.worktree?String(e.worktree):void 0,"worktree")),t=e.json===!0||e.json==="true"||e.emitJson===!0||e.emitJson==="true",n=[],o=e.command;if(Array.isArray(o))for(let a of o)n.push(String(a));else typeof o=="string"&&n.push(o);let s=Ea(r,n.length?n:Oc,{waitForAdmissionMs:e.waitForAdmissionMs?Number(e.waitForAdmissionMs):void 0,timeoutMs:e.timeoutMs?Number(e.timeoutMs):void 0}),i={passed:s.passed,worktree:r,steps:s.steps.map(a=>({command:a.command,ok:a.result.ok,exitCode:a.result.exitCode,admitted:a.result.admitted,wrappedWithSystemd:a.result.wrappedWithSystemd,nodeOptionsFlag:a.result.nodeOptionsFlag,admission:a.result.admission,verificationGate:a.result.verificationGate,stderr:a.result.stderr.slice(0,4e3)}))};if(t)console.log(JSON.stringify(i,null,2));else{console.log(s.passed?"harness verify passed":"harness verify failed");for(let a of i.steps)console.log(`  ${a.ok?"\u2713":"\u2717"} ${a.command} (exit ${a.exitCode}, systemd=${a.wrappedWithSystemd})`),!a.ok&&a.stderr&&console.log(`    ${a.stderr.split(`
 `)[0]}`)}process.exit(s.passed?0:1)}A();import{readFileSync as zT}from"node:fs";C();var XT=["create","add_version","update_metadata"],QT=["approval_guard","auth","network","server","tool_interruption"];function ZT(e){let r=e.bodyFile?String(e.bodyFile):void 0;if(r)return{body:zT(r,"utf8"),bodyPathHint:r};let t=e.body?String(e.body):void 0;if(t)return{body:t};throw new Error("requires --body-file PATH or --body TEXT")}async function SR(e){let r=U(e.operation?String(e.operation):void 0,"operation");if(!XT.includes(r))throw new Error(`invalid --operation ${r}`);let t=r,n=R(),o=U(e.slug?String(e.slug):n.agentOsSlug,"slug (or agentOsSlug in ~/.kynver/config.json)"),s=U(e.title?String(e.title):void 0,"title"),{body:i,bodyPathHint:a}=ZT(e);a&&jo(a)&&console.warn(JSON.stringify({warning:"/tmp-only body path is not durable; AgentOS persistence requires outbox or successful API write",bodyPathHint:a}));let l={operation:t,agentOsSlug:o,title:s,body:i,bodyPathHint:a,summary:e.summary?String(e.summary):void 0,planId:e.plan?String(e.plan):void 0,planSlug:e.planSlug?String(e.planSlug):void 0,changeSummary:e.changeSummary?String(e.changeSummary):void 0,author:e.author?String(e.author):void 0,model:e.model?String(e.model):void 0,maxRetries:e.maxRetries?Number(e.maxRetries):void 0,immediateFailure:eD(e)},u=await Go(l);console.log(JSON.stringify(u,null,2)),u.userStatus==="failed and needs action"&&process.exit(1)}function eD(e){let r=e.failureKind?String(e.failureKind):void 0;if(!r)return;if(!QT.includes(r))throw new Error(`invalid --failure-kind ${r}`);let t=e.failureMessage?String(e.failureMessage):`immediate failure (${r})`;return{kind:r,message:t}}async function wR(){let e=vn();console.log(JSON.stringify({count:e.length,items:e},null,2))}async function CR(e){let r=e.max?Number(e.max):void 0,t=e.id?String(e.id):void 0,n=await yu({max:r,outboxId:t});console.log(JSON.stringify(n,null,2)),n.failed>0&&process.exit(1)}function xR(e){let r=e.execute===!0||e.execute==="true",t=e.skipFinalize===!0||e.skipFinalize==="true",n=e.accountBytes===!0||e.accountBytes==="true",o=e.compact===!0||e.compact==="true",s=e.nodeModulesAgeMs,i=s!=null&&s!=="",a=i?Number(s):void 0,l=e.worktreesAgeMs?Number(e.worktreesAgeMs):0,u=e.includeOrphans===!0||e.includeOrphans==="true",c=e.harnessRoot?String(e.harnessRoot):void 0,d=Zu({execute:r,finalizeStaleRuns:!t,accountBytes:n,scanDependencyCaches:i,nodeModulesAgeMs:a!==void 0&&Number.isFinite(a)?a:i?216e5:void 0,worktreesAgeMs:Number.isFinite(l)?l:0,includeOrphans:u,harnessRoot:c});o&&d.compactSummary?console.log(JSON.stringify(d.compactSummary,null,2)):console.log(JSON.stringify(d,null,2)),r&&d.totals.removedPaths===0&&d.actions.length===0&&(process.exitCode=0)}jn();function _R(e){let r=e.execute===!0||e.execute==="true",t=e.json===!0||e.json==="true",n=e["purge-all"]===!0||e["purge-all"]==="true",o=e["keep-newest"]?Number(e["keep-newest"]):void 0;if(r||n){let a=na({execute:r,purgeAll:n,keepNewest:o}),l={...a,observation:a.observation?{...a.observation,dumps:a.observation.dumps.map(u=>({name:u.name,bytes:u.bytes,executableHint:u.executableHint,mtimeMs:u.mtimeMs}))}:null};console.log(JSON.stringify(l,null,t?2:0));return}let s=Tr(),i=s?{...s,dumps:s.dumps.map(a=>({name:a.name,bytes:a.bytes,executableHint:a.executableHint,mtimeMs:a.mtimeMs}))}:{skipped:!0,reason:"not_wsl"};console.log(JSON.stringify(i,null,t?2:0))}function Pr(e,r=2400){if(e==null)return;let n=(typeof e=="string"?e:JSON.stringify(e,null,2)).trim();if(n)return n.length<=r?n:`${n.slice(0,r-1).trimEnd()}\u2026`}function Pa(e){let r=[],t=typeof e.monitorId=="string"?e.monitorId:void 0;if(r.push(t?`Harness monitor tick \xB7 ${e.runId} (${t})`:`Harness monitor tick \xB7 ${e.runId}`),!e.workers.length)return r.push("No workers in scope for this poll."),{primary:r.join(`
 `),diagnostic:Pr(e)};for(let i of e.workers){let a=i.autoComplete.eligible?"eligible for auto-complete":"not auto-completing",l=i.autoComplete.blockers.length>0?` (${i.autoComplete.blockers.slice(0,2).join("; ")})`:"";r.push(`\u2022 ${i.worker}: ${i.workerStatus}, ${i.health}${i.healthReason?` \u2014 ${i.healthReason}`:""}; ${a}${l}`),i.taskStatus&&r.push(`  Board task: ${i.taskStatus}${i.leaseOwner?` (lease: ${i.leaseOwner})`:""}`)}let n=e.autoCompleted?.filter(i=>i.outcome==="completed"&&i.ok)??[],o=e.autoCompleted?.filter(i=>!i.ok&&i.outcome!=="skipped")??[];n.length&&r.push(`Auto-completed: ${n.map(i=>i.worker).join(", ")} \u2014 AgentOS completion should be posted.`),o.length&&r.push(`Auto-complete blocked: ${o.map(i=>`${i.worker}${i.reason?` (${i.reason})`:""}`).join("; ")}`),e.leaseRenewal?.failed?.length&&r.push(`Lease renew failed for: ${e.leaseRenewal.failed.map(i=>i.worker).join(", ")}`);let s=e.workers.length>0&&e.workers.every(i=>i.autoComplete.terminalVerified)&&(e.autoCompleted?.every(i=>i.ok||i.outcome==="skipped")??!0);return r.push(s?"Next: monitor loop should stop \u2014 all workers terminal and handled.":"Next: monitor will poll again until workers are terminal-verified or max time elapses."),{primary:r.join(`
-`),diagnostic:Pr(e)}}import cD from"node:path";D();Q();C();Q();C();function ER(e){let{worker:r,status:t,taskLease:n}=e,o=n?.leaseOwner??null;if(r.dispatched&&n){if(n.status==="running"&&o&&!Hl(o,r.runId))return{health:"orphaned",reason:`task lease held by ${o}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=n.leaseToken?.trim()??"";if(n.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(n.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(t.attention.state==="stale")return{health:"stale",reason:t.attention.reason};let s=t.lastHeartbeatAt?Date.parse(t.lastHeartbeatAt):NaN;return t.alive&&Number.isFinite(s)&&Date.now()-s>Yt?{health:"stale",reason:`heartbeat older than ${Math.floor(Yt/1e3)}s`}:t.alive&&r.pid&&!K(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:n?.status==="running"&&!t.alive&&t.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:t.attention.reason||"worker within expected lifecycle bounds"}}Ne();C();import{existsSync as PR,mkdirSync as aD,readdirSync as lD,unlinkSync as uD}from"node:fs";import Nc from"node:path";function IR(){let{harnessRoot:e}=Lt(),r=Nc.join(e,"monitors");return aD(r,{recursive:!0}),r}function Dn(e,r){return r?`${S(e)}--${S(r)}`:S(e)}function Tc(e){return Nc.join(IR(),`${e}.json`)}function Mn(e){return x(Tc(e),void 0)}function Un(e){ue(Tc(e.monitorId),e)}function AR(e){let r=Tc(e);return PR(r)?(uD(r),!0):!1}function OR(){let e=IR();if(!PR(e))return[];let r=[];for(let t of lD(e)){if(!t.endsWith(".json"))continue;let n=x(Nc.join(e,t),void 0);n?.monitorId&&r.push({monitorId:n.monitorId,runId:n.runId,workerName:n.workerName,agentOsId:n.agentOsId,pid:n.pid,alive:n.pid?K(n.pid):!1,startedAt:n.startedAt,pollMs:n.pollMs,logPath:n.logPath})}return r.sort((t,n)=>t.startedAt.localeCompare(n.startedAt))}Q();function Dc(e){let{worker:r,status:t}=e,n=[];r.localOnly&&n.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&n.push("missing agentOsId/taskId linkage"),Ei(r)&&n.push("completion already acknowledged"),r.completionBlocker&&n.push(r.completionBlocker),t.heartbeatBlocker&&t.alive&&n.push(`worker heartbeat blocker: ${t.heartbeatBlocker}`),t.attention.state==="blocked"&&n.push(t.attention.reason||"worker attention blocked"),Jt(t)&&n.push(t.attention.reason||"landing gate blocked");let o=ce(t),s;return o?t.finalResult?s="final_result":t.alive?s="terminal_status":s="process_exited":n.push("worker has not reached a terminal condition"),{eligible:o&&n.length===0,terminalVerified:o,terminalReason:s,blockers:n}}function NR(e,r){return x(cD.join(N(e),"workers",S(r),"worker.json"),void 0)}function TR(e,r){let t=H(e),n=Object.keys(t.workers||{});if(!r)return n;let o=S(r);return n.filter(s=>S(s)===o)}function DR(e,r){let t=H(e.runId),n=B(e,{base:t.base,baseCommit:t.baseCommit}),o=e.taskId?r.get(e.taskId)??null:null,s=ER({worker:e,status:n,taskLease:o}),i=Dc({worker:e,status:n});return{runId:e.runId,worker:e.name,health:s.health,healthReason:s.reason,workerStatus:n.status,attentionState:n.attention.state,attentionReason:n.attention.reason,alive:n.alive,taskId:e.taskId,leaseOwner:o?.leaseOwner??void 0,taskStatus:o?.status,autoComplete:i,status:n}}async function cs(e){let r=String(e.run||"");U(r,"--run");let t=e.name?String(e.name):void 0,n=e.agentOsId?String(e.agentOsId):void 0,o=H(r),s=TR(r,t),i=[];for(let f of s){let g=NR(r,f);g&&i.push(g)}let a=n||i.map(f=>f.agentOsId).find(f=>typeof f=="string"&&f.trim())||void 0,l=i.map(f=>f.taskId).filter(f=>!!f),u=await gn({agentOsId:a,taskIds:l,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0}),c=i.map(f=>DR(f,u)),d;a&&e.renewLeases!==!1&&e.renewLeases!=="false"&&(d=await wi(r,{...e,agentOsId:a}));let p=[];if(e.autoComplete===!0||e.autoComplete==="true")for(let f of c){if(!f.autoComplete.eligible){p.push({worker:f.worker,outcome:"skipped",ok:!1,reason:f.autoComplete.blockers.join("; ")||"not eligible"});continue}let g=await hn({run:r,name:f.worker,...a?{agentOsId:a}:{},...e.baseUrl?{baseUrl:String(e.baseUrl)}:{},...e.secret?{secret:String(e.secret)}:{}});p.push({worker:f.worker,outcome:g.outcome,ok:g.outcome==="completed",reason:g.reason})}return{runId:r,agentOsId:a,workers:c,leaseRenewal:d,autoCompleted:p}}function MR(e){let r=String(e.run||"");U(r,"--run");let t=e.name?String(e.name):void 0,n=TR(r,t),o=[];for(let s of n){let i=NR(r,s);i&&o.push(DR(i,new Map))}return{runId:r,workers:o,autoCompleted:[]}}function Mc(){return OR()}function UR(e){let r=String(e.run||"");U(r,"--run");let t=Dn(r,e.name?String(e.name):void 0),n=Mn(t);if(!n)return{monitorId:t,stopped:!1};if(n.pid&&K(n.pid))try{process.kill(n.pid,"SIGTERM")}catch{}return n.stoppedAt=new Date().toISOString(),Un(n),AR(t),{monitorId:t,stopped:!0,pid:n.pid}}async function Uc(e){let r=String(e.run||""),t=String(e.name||"");U(r,"--run"),U(t,"--name");let n=Re(r,t),o=H(r),s=B(n,{base:o.base,baseCommit:o.baseCommit}),i=Dc({worker:n,status:s});if(!i.eligible){console.log(JSON.stringify({runId:r,worker:t,outcome:"blocked",blockers:i.blockers,terminalVerified:i.terminalVerified},null,2)),process.exitCode=1;return}let a=await hn({...e,run:r,name:t});console.log(JSON.stringify(a,null,2)),a.outcome!=="completed"&&a.outcome!=="blocked"&&(process.exitCode=1)}C();var dD=5e3,pD=360*60*1e3;async function BR(e){let r=String(e.monitorId||""),t=Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):dD,n=Number(e.maxTotalMs)>0?Math.floor(Number(e.maxTotalMs)):pD,o=Date.now();for(;Date.now()-o<=n;){let s=r?Mn(r):void 0;if(s?.stoppedAt)break;let i=await cs({...e,autoComplete:e.autoComplete??!0,renewLeases:e.renewLeases??!0}),a=Pa({monitorId:r,phase:"tick",...i});if(console.log(a.primary),a.diagnostic&&console.error(`[monitor diagnostic] ${a.diagnostic}`),i.workers.length>0&&i.workers.every(u=>u.autoComplete.terminalVerified&&(u.autoComplete.eligible||u.autoComplete.blockers.some(c=>c.includes("already acknowledged"))))&&i.autoCompleted.every(u=>u.ok||u.outcome==="skipped")){r&&s&&(s.stoppedAt=new Date().toISOString(),Un(s));break}qr(t)}}C();Ne();import{spawn as mD}from"node:child_process";import{closeSync as WR,existsSync as fD,openSync as gD}from"node:fs";import hD from"node:path";function LR(e){let r=e.nodeExecutable??process.execPath,t=Wi({importMetaUrl:import.meta.url,explicitCliPath:e.cliPath,nodeExecutable:r});if(!t)return;let n=t.cliPath;if(!fD(n))return;let o=Dn(e.runId,e.workerName),{harnessRoot:s}=Lt(),i=hD.join(s,"monitors",`${o}.log`),a;try{a=gD(i,"a")}catch{a=void 0}let l=e.pollMs??5e3,u=[...t.argsPrefix,"monitor","run-loop","--run",e.runId,"--monitor-id",o,"--poll-ms",String(l),"--auto-complete","true","--renew-leases","true"];e.workerName&&u.push("--name",e.workerName),e.agentOsId&&u.push("--agent-os-id",e.agentOsId),e.baseUrl&&u.push("--base-url",e.baseUrl),e.secret&&u.push("--secret",e.secret);let c=["ignore",a??"ignore",a??"ignore"];try{let d=mD(t.command,u,be({detached:!0,stdio:c,env:process.env}));a!==void 0&&WR(a),d.unref();let p={monitorId:o,runId:e.runId,workerName:e.workerName,agentOsId:e.agentOsId,pid:d.pid,startedAt:new Date().toISOString(),pollMs:l,logPath:i};return Un(p),{monitorId:o,pid:d.pid,logPath:i,session:p}}catch{if(a!==void 0)try{WR(a)}catch{}return}}C();async function HR(e){let r=String(e.run||"");U(r,"--run");let t=e.name?String(e.name):void 0,n=Dn(r,t),o=Mn(n);if(o?.pid&&!o.stoppedAt)return{monitorId:n,session:o,spawned:!1,pid:o.pid};let s=LR({runId:r,workerName:t,agentOsId:e.agentOsId?String(e.agentOsId):void 0,pollMs:Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):void 0,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0});if(!s)throw new Error("failed to spawn monitor sidecar (cli.js missing or spawn error)");return{monitorId:n,session:s.session,spawned:!0,pid:s.pid}}async function FR(e){if(String(e.run||"")){let t=e.tick===!0||e.tick==="true"?await cs({...e,autoComplete:!1}):MR(e);console.log(JSON.stringify(t,null,2));return}console.log(JSON.stringify({monitors:Mc()},null,2))}function KR(e){console.log(JSON.stringify(UR(e),null,2))}function $R(){console.log(JSON.stringify({monitors:Mc()},null,2))}async function jR(e){await BR(e)}async function VR(e){let r=await cs(e);console.log(JSON.stringify(r,null,2))}function kD(e){let r={};for(let[t,n]of Object.entries(e))n?.version&&(r[t]={version:n.version,source:"installed",path:n.path});return r}async function yD(e={}){let[r,t]=await Promise.all([ca(),Promise.resolve(sy({cwd:e.cwd,repoRoot:e.repoRoot}))]),n={},o=e.selfPackageName==="@kynver-app/runtime"&&e.selfVersion?e.selfVersion:ze;return n["@kynver-app/runtime"]={version:o,source:"self"},e.selfPackageName&&e.selfVersion&&e.selfPackageName!=="@kynver-app/runtime"&&(n[e.selfPackageName]={version:e.selfVersion,source:"self"}),{installed:kD(r),repo:t,self:n}}async function GR(e={}){let r=await yD(e);return ay(r)}function YR(e,r){return e?e==="daemon"||e==="start"||e==="worker"||e==="monitor"||e==="run"&&(r==="dispatch"||r==="sweep"||r==="reconcile"||r==="unblock")||e==="cron"&&r==="tick":!1}C();function RD(e){let r=e.trim();return r?ns().find(n=>n.name===r&&n.status!=="completed")??null:null}function JR(e){let r=String(U(String(e.name||""),"--name")),t=RD(r);console.log(JSON.stringify({runId:t?.id??null,name:r,status:t?.status??null,effectiveStatus:t?.effectiveStatus??null},null,2))}D();Q();C();A();import vD from"node:path";function ds(e,r,t,n,o,s){return{runId:e,worker:r,taskId:t,agentOsId:n,leaseOwner:o,action:"skipped",reason:s}}async function bD(e){let r=W(e.baseUrl?String(e.baseUrl):void 0),t=e.agentOsId?String(e.agentOsId).trim():null,n=e.dryRun===!0||e.dryRun==="true",o=[],s=[],i=[];for(let a of X())for(let l of Object.keys(a.workers??{})){let u=vD.join(N(a.id),"workers",S(l),"worker.json"),c=x(u,void 0);if(!c){s.push(ds(a.id,l,"","","","worker.json missing"));continue}let d=c.taskId??"",p=c.agentOsId??"",m=c.leaseOwner??"";if(!c.dispatched||!d||!p||!m){s.push(ds(a.id,l,d,p,m,"not a fully-leased dispatched worker"));continue}if(t&&p!==t)continue;if(c.completionReportedAt){s.push(ds(a.id,l,d,p,m,"completion already reported"));continue}let f=B(c);if(f.finalResult){s.push(ds(a.id,l,d,p,m,"has final result \u2014 let pipeline tick complete it"));continue}if(f.alive){s.push(ds(a.id,l,d,p,m,"worker process is still alive"));continue}if(n){o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:m,action:"released",reason:"dry-run: would release dead dispatched worker lease"});continue}try{let g=await G(e.secret?String(e.secret):void 0,p,{baseUrl:r}),k=`${r}/api/agent-os/by-id/${encodeURIComponent(p)}/tasks/${encodeURIComponent(d)}/release`,h=await Z(k,g,{agentOsId:p,leaseOwner:m},{agentOsId:p,baseUrl:r});h.ok===!0||h.response?.ok===!0?o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:m,action:"released",reason:"dead dispatched worker lease released; task requeued"}):s.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:m,action:"skipped",reason:`release returned ok:false (likely owner mismatch or already released): HTTP ${h.status}`})}catch(g){i.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:m,action:"error",reason:g.message})}}return{dryRun:n,released:o,skipped:s,errors:i}}async function qR(e){let r=await bD(e),t={ok:r.errors.length===0,dryRun:r.dryRun,released:r.released.length,skipped:r.skipped.length,errors:r.errors.length,details:r};console.log(JSON.stringify(t,null,2)),r.errors.length>0&&process.exit(1)}Xs();import sv from"node:path";Ge();A();import{accessSync as SD,constants as wD,existsSync as Wc,readFileSync as CD}from"node:fs";import{homedir as Ia}from"node:os";import Aa from"node:path";import{spawnSync as xD}from"node:child_process";Ne();function Bc(e,r){try{let t=xD(e,r,{encoding:"utf8"}),n=(t.stdout||"").trim(),o=(t.stderr||"").trim();return{ok:t.status===0,stdout:n,stderr:o,error:t.error?.message}}catch(t){return{ok:!1,stdout:"",stderr:"",error:t.message}}}function zR(e){let r=e?.trim();if(r)return r.length<=12?`${r}\u2026`:`${r.slice(0,12)}\u2026`}function _D(e){if(!Wc(e))return!1;try{return SD(e,wD.W_OK),!0}catch{return!1}}var XR={packageVersion:()=>ze,commandOnPath:e=>Bc(process.platform==="win32"?"where":"which",[e]),kynverVersion:e=>Bc(e,["--version"]),loadConfig:()=>R(),configFilePath:()=>Aa.join(Ia(),".kynver","config.json"),credentialsFilePath:()=>Aa.join(Ia(),".kynver","credentials"),readCredentials:()=>{let e=Aa.join(Ia(),".kynver","credentials");if(!Wc(e))return{hasApiKey:!1};try{let r=JSON.parse(CD(e,"utf8"));return{hasApiKey:!!r.apiKey?.trim(),runnerTokenPrefix:zR(r.runnerToken),runnerTokenAgentOsId:r.runnerTokenAgentOsId}}catch{return{hasApiKey:!1}}},envSnapshot:()=>({kynverApiUrl:process.env.KYNVER_API_URL?.trim()||void 0,openclawCronFireBaseUrl:process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||void 0,kynverRunnerTokenPrefix:zR(process.env.KYNVER_RUNNER_TOKEN),kynverRuntimeSecret:!!process.env.KYNVER_RUNTIME_SECRET?.trim(),openclawCronSecret:!!process.env.OPENCLAW_CRON_SECRET?.trim(),kynverHarnessRoot:process.env.KYNVER_HARNESS_ROOT?.trim()||void 0,opusHarnessRoot:process.env.OPUS_HARNESS_ROOT?.trim()||void 0,kynverSchedulerProvider:process.env.KYNVER_SCHEDULER_PROVIDER?.trim()||void 0,openclawCronStorePath:!!(process.env.KYNVER_CRON_STORE_PATH?.trim()||process.env.OPENCLAW_CRON_STORE_PATH?.trim()),kynverCronDaemonPrimary:ii(),qstashTokenPresent:!!process.env.QSTASH_TOKEN?.trim(),kynverHostedDeployment:(()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"})()}),harnessRoot:()=>Pe(),legacyOpenclawHarnessRoot:()=>Aa.join(Ia(),".openclaw","harness"),pathExists:e=>Wc(e),pathWritable:e=>_D(e),ghAuthToken:()=>Bc("gh",["auth","token"]),deployEvidenceNeedsGithub:()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return!(e==="1"||e==="true"||e==="yes")}};function QR(e,r){return e.kynverSchedulerProvider==="openclaw-cron"||r.deploymentSchedulerProvider==="openclaw-cron"}function ED(e,r){return e.kynverSchedulerProvider==="kynver-cron"||r.deploymentSchedulerProvider==="kynver-cron"}function ZR(e){return!!e.openclawCronStorePath}function PD(e,r){return e.kynverSchedulerProvider==="qstash"||r.deploymentSchedulerProvider==="qstash"}function ev(e,r){let t={schedulerProvider:e.kynverSchedulerProvider??null,deploymentSchedulerProvider:r.deploymentSchedulerProvider??null,openclawCronStorePath:!!e.openclawCronStorePath,kynverCronDaemonPrimary:!!e.kynverCronDaemonPrimary},n=!!r.agentOsId?.trim()&&!!r.apiBaseUrl?.trim()&&r.hasScopedRunnerToken;if(PD(e,r)&&!QR(e,r)){let c=e.kynverSchedulerProvider==="qstash"?"KYNVER_SCHEDULER_PROVIDER=qstash on this host":"deploymentSchedulerProvider=qstash in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler cut over to QStash (${c})`,details:t}}if(ED(e,r)&&!QR(e,r)){if(ZR(e)&&e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let c=e.kynverSchedulerProvider==="kynver-cron"?"KYNVER_SCHEDULER_PROVIDER=kynver-cron on this host":"deploymentSchedulerProvider=kynver-cron in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler owned by Kynver Cron (${c})`,details:t}}if(ZR(e)){if(e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let c=[];return e.openclawCronStorePath&&c.push("KYNVER_CRON_STORE_PATH or OPENCLAW_CRON_STORE_PATH set (local cron store)"),{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Local cron store without daemon tick (${c.join("; ")})`,remediation:"Run `kynver daemon` with KYNVER_CRON_SECRET + KYNVER_API_URL (or KYNVER_CRON_FIRE_BASE_URL) so the daemon-owned cron tick fires schedules. On hosted deploys use QStash (KYNVER_SCHEDULER_PROVIDER=qstash). Legacy OpenClaw cron env aliases still work during cutover.",details:t}}let o=e.kynverSchedulerProvider==="openclaw-cron",s=r.deploymentSchedulerProvider==="openclaw-cron",i=e.kynverSchedulerProvider==="qstash",a=!!e.qstashTokenPresent||!!e.kynverHostedDeployment,l=a&&!n,u=l&&e.kynverSchedulerProvider==="openclaw-cron";return s&&!o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"deploymentSchedulerProvider=openclaw-cron in ~/.kynver/config.json \u2014 migrate to kynver-cron or qstash",remediation:'Run `kynver scheduler attest-cutover` or set deploymentSchedulerProvider to "kynver-cron" or "qstash" in ~/.kynver/config.json.',details:t}:n&&o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 dispatch is owned by kynver daemon; unset the OpenClaw override",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:n?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:i?"Runner override qstash present; hosted dispatch still owned by kynver daemon pipeline-tick":"Hosted dispatch owned by kynver daemon (pipeline-tick \u2192 operator/tick); no OpenClaw cron on runner",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 hosted dispatch still depends on the OpenClaw local-cron adapter",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,hostedDeployment:a}}:u?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment has KYNVER_SCHEDULER_PROVIDER=openclaw-cron \u2014 AgentOS scheduled ticks should use QStash or kynver-cron",remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server (or kynver-cron for Kynver-owned local scheduling). User runners use `kynver daemon` for dispatch and should not set a scheduler provider.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:l&&e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"QSTASH_TOKEN present; hosted scheduler auto-selects qstash (explicit KYNVER_SCHEDULER_PROVIDER=qstash optional)",details:{schedulerProvider:null,qstashTokenPresent:!0,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment with no QSTASH_TOKEN and no KYNVER_SCHEDULER_PROVIDER \u2014 kynver-cron is an in-process stub here and will NOT fire; no firing scheduler is configured",remediation:"Set QSTASH_TOKEN + KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server for hosted AgentOS schedules. Only use kynver-cron when a `kynver daemon` (or local cron store) actually owns firing on this box.",details:{schedulerProvider:null,resolvedFallback:"none",qstashTokenPresent:!1,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&e.kynverSchedulerProvider&&e.kynverSchedulerProvider!=="qstash"&&e.kynverSchedulerProvider!=="kynver-cron"?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Hosted deployment without QSTASH_TOKEN (KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}) \u2014 use qstash or kynver-cron`,remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server, or kynver-cron for Kynver-owned local scheduling. User runners use `kynver daemon` for dispatch.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}`,details:{schedulerProvider:e.kynverSchedulerProvider??null}}:{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"No KYNVER_SCHEDULER_PROVIDER on runner (expected) \u2014 finish runner setup so daemon pipeline-tick owns dispatch",details:{schedulerProvider:null,dispatchPath:"kynver-daemon-pipeline-tick-pending"}}}qe();uo();nt();Ys();dl();function rv(e,r={}){let t=Qt(),n=Js(e,t),o=[],s=r.envFilePath??ge,i=zs(e,{envFilePath:s,systemdUnitActive:r.systemdUnitActive});if(o.push({id:"daemon_supervision_owner",ok:!!e.daemonSupervisionOwner||i.effectivelyConfigured,summary:e.daemonSupervisionOwner?`daemonSupervisionOwner=${e.daemonSupervisionOwner} (${t})`:i.owner?`daemonSupervisionOwner inferred as ${i.owner} from healthy supervision signals \u2014 run \`kynver setup\` to persist`:"daemonSupervisionOwner unset \u2014 run `kynver setup` to persist Kynver-owned restart policy",remediation:e.daemonSupervisionOwner||i.effectivelyConfigured?e.daemonSupervisionOwner?void 0:"Run `kynver setup` or `kynver doctor runtime-takeover --remediate` to persist daemonSupervisionOwner.":"Run `kynver setup` (or `kynver bootstrap`) on this box."}),o.push({id:"daemon_present_signal",ok:i.daemonPresentSignal||i.systemdUnitActive,summary:i.systemdUnitActive?"systemd user unit active \u2014 local daemon supervision is healthy":i.daemonPresentSignal?`KYNVER_CRON_DAEMON_PRESENT=1 (persisted in ${s})`:`KYNVER_CRON_DAEMON_PRESENT not set in persisted env (${s})`,remediation:i.daemonPresentSignal||i.systemdUnitActive?void 0:"Run `kynver setup` or `kynver start` once to write ~/.kynver/.env supervision keys."}),n==="systemd"){let l=Zt();o.push({id:"systemd_user_unit",ok:l,summary:l?"systemd user unit present (~/.config/systemd/user/kynver-cron-daemon.service)":"daemonSupervisionOwner=systemd but user unit missing",remediation:l?void 0:"Run `kynver start --install-systemd` or `kynver cron install --install-systemd`."})}let a=ll(t,n);return o.push({id:"supervision_guidance",ok:!0,summary:a[0]??"Kynver keeper supervises daemon restarts by default."}),o}uo();nt();function tv(e){let r=e.loadConfig(),t=Qt(),n=Js(r,t),s=rv(r,{systemdUnitActive:e.systemdDaemonActive}).map(i=>({id:i.id,label:i.id.replace(/_/g," "),status:i.ok?"pass":i.id==="daemon_supervision_owner"||i.id==="daemon_present_signal"?"warn":"fail",summary:i.summary,remediation:i.remediation}));return s.push({id:"daemon_keeper_default",label:"Kynver keeper owns in-process restarts",status:n==="keeper"||n==="systemd"?"pass":"warn",summary:n==="systemd"?"systemd persists the keeper parent \u2014 Hermes/OpenClaw cron is not required to restart the daemon":"`kynver start` / `kynver daemon` run the keeper by default (opt out with --no-supervise only when an external supervisor owns restarts)",details:{owner:n,hostKind:t}}),{id:"daemon_supervision",label:"Daemon restart supervision",checks:s}}function nv(e){if(e.envGithubToken)return{viable:!0,source:"env",summary:"GITHUB_TOKEN present for GitHub commit-status evidence"};if(e.envGhToken)return{viable:!0,source:"env",summary:"GH_TOKEN present for GitHub commit-status evidence"};let r=e.ghAuthToken();return r.ok&&r.stdout.trim().length>0?{viable:!0,source:"gh-cli",summary:"GitHub CLI authenticated (`gh auth login`) for commit-status evidence"}:{viable:!1,source:"missing",summary:"No GITHUB_TOKEN/GH_TOKEN and `gh auth token` unavailable"}}function ov(e,r){let t=e.commandOnPath("vercel"),n=t.ok,o=!!process.env.VERCEL_TOKEN?.trim(),s=nv(r),i=e.deployEvidenceNeedsGithub?.()??!0,a=[{id:"vercel_global_cli_absent",label:"Global Vercel CLI not installed",status:n?"warn":"pass",summary:n?`Global Vercel CLI on PATH (${t.stdout||"vercel"}) \u2014 conflicts with GitHub-status evidence path`:"No global Vercel CLI on PATH",remediation:n?"Uninstall global Vercel CLI (`npm uninstall -g vercel`) \u2014 prefer GitHub commit status or scoped VERCEL_TOKEN + REST API.":void 0,details:{path:n&&t.stdout||null}}];return i?(a.push({id:"github_token_for_vercel_status",label:"GitHub token for Vercel status",status:s.viable?"pass":"warn",summary:s.viable?s.summary:"No GitHub auth \u2014 merge-gate Vercel evidence needs GITHUB_TOKEN/GH_TOKEN or `gh auth login`",remediation:s.viable?void 0:"Export GITHUB_TOKEN (or GH_TOKEN) or run `gh auth login` for PR head commit-status lookups.",details:{source:s.source}},{id:"vercel_api_token_optional",label:"Vercel API token (optional fallback)",status:o||s.viable?"pass":"warn",summary:o?"VERCEL_TOKEN configured for optional REST API deployment lookup":s.viable?"VERCEL_TOKEN unset \u2014 GitHub commit-status is the default evidence path":"VERCEL_TOKEN unset and GitHub auth missing \u2014 no deploy-evidence fallback",remediation:o||s.viable?void 0:"Set ephemeral/scoped VERCEL_TOKEN only when GitHub status is insufficient; avoid persistent ~/.vercel auth on runner hosts.",details:{vercelTokenPresent:o,githubEvidenceViable:s.viable}}),{id:"vercel_deploy_evidence",label:"Vercel deploy evidence",checks:a}):(a.push({id:"github_token_for_vercel_status",label:"GitHub token for Vercel status",status:"pass",summary:"Skipped \u2014 no enabled workflow on this host requires GitHub deploy evidence",details:{skipped:!0,reason:"workflow_not_enabled"}},{id:"vercel_api_token_optional",label:"Vercel API token (optional fallback)",status:"pass",summary:"Skipped \u2014 GitHub evidence workflow not enabled on this host",details:{skipped:!0,reason:"workflow_not_enabled"}}),{id:"vercel_deploy_evidence",label:"Vercel deploy evidence",checks:a})}function ID(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function AD(e){let r=e.packageVersion(),t=e.commandOnPath("kynver"),n=t.ok&&t.stdout.length>0,o=n?t.stdout.split(/\r?\n/)[0]?.trim():void 0,s=o?V(o):void 0,i=[{id:"cli_running_version",label:"Running @kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${r}`,details:{version:r}},{id:"cli_on_path",label:"kynver executable on PATH",status:n?"pass":"warn",summary:n?`Found ${s}`:"kynver not found on PATH (invoked via node/npx?)",remediation:n?void 0:"Install globally (`npm i -g @kynver-app/runtime`) or invoke via `npx @kynver-app/runtime`.",details:{path:s}}];if(n&&o){let a=e.kynverVersion(o),l=a.stdout.replace(/^kynver\s+/i,"").trim()||void 0,u=a.ok&&(!l||l===r);i.push({id:"cli_installed_version",label:"Installed kynver CLI version matches running package",status:u?"pass":"warn",summary:a.ok&&l?u?`Installed ${l}`:`Installed ${l} differs from running ${r}`:a.error?`Could not read installed version (${a.error})`:a.stderr||"Could not read installed version",remediation:u?void 0:"Reinstall or rebuild @kynver-app/runtime so PATH kynver matches the harness worktree version.",details:{installedVersion:l,runningVersion:r,path:s}})}return{id:"cli_package",label:"CLI / package",checks:i}}function OD(e){let r=e.configFilePath(),t=V(r),n=e.pathExists(r),o=e.loadConfig(),s=[{id:"config_file",label:"~/.kynver/config.json present",status:n?"pass":"fail",summary:n?`Found ${t}`:`Missing ${t}`,remediation:n?void 0:"Run `kynver setup --api-base-url <url> --agent-os-id <id> --repo <path>`.",details:{configPath:t}}];if(n){let i=o.apiBaseUrl?.trim(),a=o.agentOsId?.trim(),l=Le({config:o}),u=l?Ro(l):null,c=Hp(l);s.push({id:"config_api_base_url",label:"Default API base URL",status:i?"pass":"warn",summary:i??"Not set in config (KYNVER_API_URL / --base-url required per command)",remediation:i?void 0:"Set `apiBaseUrl` via `kynver setup --api-base-url https://\u2026`.",details:{apiBaseUrl:i??null}},{id:"config_agent_os_id",label:"Default AgentOS id",status:a?"pass":"warn",summary:a??"Not set (pass --agent-os-id on daemon/dispatch/worker commands)",remediation:a?void 0:"Set `agentOsId` via `kynver setup --agent-os-id <uuid>`.",details:{agentOsId:a??null,agentOsSlug:o.agentOsSlug??null}},{id:"config_default_repo",label:"Default repo path",status:c.status,summary:l?l.persistedInConfig?`${u.defaultRepo} (config)`:`${u.defaultRepo} (${l.source}, not persisted in ~/.kynver/config.json)`:"Not set in ~/.kynver/config.json (`kynver run create` requires --repo)",remediation:c.remediation,details:{defaultRepo:u?.defaultRepo??null,source:u?.source??null,persistedInConfig:u?.persistedInConfig??!1,harnessRoot:o.harnessRoot?Ee(o.harnessRoot):null}})}return{id:"user_config",label:"User config (~/.kynver)",checks:s}}function ND(e){let t=e.loadConfig().agentOsId?.trim(),n=e.readCredentials(),o=e.envSnapshot(),s=e.credentialsFilePath(),i=V(s),a=o.kynverRunnerTokenPrefix,l=n.runnerTokenPrefix,u=n.runnerTokenAgentOsId,c=!!l&&(!t||!u||u===t),d=!!a?.startsWith("krc1.")||c&&l?.startsWith("krc1.");return{id:"runner_token",label:"Runner token readiness",checks:[{id:"runner_token_scoped",label:"Scoped runner token (krc1.*) ready",status:d?"pass":"fail",summary:d?a?"KYNVER_RUNNER_TOKEN is set (scoped prefix shown)":`Saved scoped token for agentOsId ${u??t??"(unknown)"}`:"No scoped runner token for the configured AgentOS workspace",remediation:d?void 0:"Run `kynver login` then `kynver runner credential --agent-os-id <id>` (or `kynver setup` with API key).",details:{source:a?"env":l?"credentials":"none",tokenPrefix:a??(c?l:void 0),agentOsId:t??u??null,credentialsPath:i}},{id:"runner_token_agent_os_match",label:"Saved runner token matches configured agentOsId",status:!l||!t||!u||u===t?"pass":"warn",summary:!l||!u?"No saved token agentOsId to compare":t?u===t?"Saved token scoped to configured agentOsId":`Saved token is for ${u}, config expects ${t}`:"Config agentOsId unset \u2014 token scope not validated against config",remediation:l&&t&&u&&u!==t?"`kynver runner credential --agent-os-id <configured-id>` to mint a workspace-bound token.":void 0,details:{configuredAgentOsId:t??null,savedAgentOsId:u??null}},{id:"runner_api_key_for_refresh",label:"API key available for token refresh",status:n.hasApiKey||process.env.KYNVER_API_KEY?.trim()?"pass":"warn",summary:n.hasApiKey||process.env.KYNVER_API_KEY?"KYNVER API key present for runner credential mint/refresh":"No API key \u2014 401 callback recovery cannot auto-mint a replacement token",remediation:n.hasApiKey||process.env.KYNVER_API_KEY?void 0:"Run `kynver login --api-key \u2026`.",details:{credentialsPath:i,hasApiKey:n.hasApiKey||!!process.env.KYNVER_API_KEY}}]}}function TD(e){return ov(e,{envGithubToken:!!process.env.GITHUB_TOKEN?.trim(),envGhToken:!!process.env.GH_TOKEN?.trim(),ghAuthToken:()=>e.ghAuthToken()})}function DD(e){let r=e.harnessRoot(),t=sv.join(r,"runs"),n=sv.join(r,"worktrees"),o=Ee(r),s=Ee(t),i=Ee(n),a=e.pathExists(t),l=e.pathExists(n);return{id:"harness_dirs",label:"Harness / daemon directories",checks:[{id:"harness_root",label:"Harness root resolved",status:"pass",summary:o,details:{harnessRoot:o}},{id:"harness_runs_dir",label:"Runs directory ready",status:a&&e.pathWritable(t)?"pass":"warn",summary:a?e.pathWritable(t)?`Writable ${s}`:`Exists but not writable: ${s}`:`Will be created on first run: ${s}`,remediation:a&&!e.pathWritable(t)?`Fix permissions on ${s} or set KYNVER_HARNESS_ROOT to a writable path.`:void 0,details:{runsDir:s,exists:a,writable:e.pathWritable(t)}},{id:"harness_worktrees_dir",label:"Worktrees directory ready",status:l&&e.pathWritable(n)?"pass":"warn",summary:l?e.pathWritable(n)?`Writable ${i}`:`Exists but not writable: ${i}`:`Will be created on first worker: ${i}`,remediation:l&&!e.pathWritable(n)?`Fix permissions on ${i}.`:void 0,details:{worktreesDir:i,exists:l,writable:e.pathWritable(n)}}]}}function MD(e){let r=e.loadConfig(),t=e.envSnapshot(),n=t.kynverApiUrl??r.apiBaseUrl?.trim()??t.openclawCronFireBaseUrl,o=!t.kynverApiUrl&&!r.apiBaseUrl&&!!t.openclawCronFireBaseUrl,s=t.openclawCronSecret||t.kynverRuntimeSecret,i=t.kynverRunnerTokenPrefix?.startsWith("krc1."),l=e.readCredentials().runnerTokenPrefix?.startsWith("krc1.");return{id:"callback_auth",label:"Callback auth / config",checks:[{id:"callback_base_url",label:"Callback base URL configured",status:n?o?"warn":"pass":"fail",summary:n?o?`Using legacy OPENCLAW_CRON_FIRE_BASE_URL (${n})`:n:"No KYNVER_API_URL, config apiBaseUrl, or legacy OpenClaw base URL",remediation:n?o?"Migrate to KYNVER_API_URL or `kynver setup --api-base-url` and drop OPENCLAW_CRON_FIRE_BASE_URL.":void 0:"Set KYNVER_API_URL or run `kynver setup --api-base-url https://\u2026`.",details:{source:t.kynverApiUrl?"KYNVER_API_URL":r.apiBaseUrl?"config.apiBaseUrl":t.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL":"none",baseUrl:n??null}},{id:"callback_auth_mode",label:"Callback auth uses scoped runner token",status:i||l?"pass":s?"warn":"fail",summary:i?"KYNVER_RUNNER_TOKEN scoped token will be sent as X-Kynver-Runner-Token":l?"Saved krc1.* token in ~/.kynver/credentials":s?"Deployment-level KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET in use (legacy headers)":"No callback secret configured",remediation:i||l?void 0:"Mint a scoped token: `kynver runner credential --agent-os-id <id>`. Avoid shared OPENCLAW_CRON_SECRET on user runners.",details:{mode:i||l?"scoped":s?"legacy_global_secret":"missing",legacyHeadersWhenNotScoped:["X-OpenClaw-Cron-Secret","X-Kynver-Runtime-Secret"]}}]}}function UD(e){let r=e.envSnapshot(),t=e.loadConfig(),n=e.readCredentials(),o=e.harnessRoot(),s=e.legacyOpenclawHarnessRoot(),i=Ee(o),a=Ee(s),l=r.opusHarnessRoot?Ee(r.opusHarnessRoot):null,u=o===s&&e.pathExists(s),c=t.agentOsId?.trim(),d=r.kynverRunnerTokenPrefix,p=n.runnerTokenPrefix,m=n.runnerTokenAgentOsId,f=!!p&&(!c||!m||m===c),g=!!d?.startsWith("krc1.")||f&&!!p?.startsWith("krc1.");return{id:"openclaw_hotspots",label:"OpenClaw dependency hotspots",checks:[{id:"hotspot_legacy_harness_root",label:"Legacy ~/.openclaw/harness still active",status:u?"warn":"pass",summary:u?`Harness root is legacy ${a}`:r.opusHarnessRoot?`OPUS_HARNESS_ROOT override in use (${l})`:`Using ${i}`,remediation:u?"Set KYNVER_HARNESS_ROOT=~/.kynver/harness (or run setup), migrate artifacts, retire OPUS_HARNESS_ROOT.":r.opusHarnessRoot?"Prefer KYNVER_HARNESS_ROOT over OPUS_HARNESS_ROOT.":void 0,details:{harnessRoot:i,legacyRoot:a,opusHarnessRoot:l}},{id:"hotspot_openclaw_env_secrets",label:"OpenClaw deployment secrets in runner env",status:r.openclawCronSecret||r.openclawCronFireBaseUrl?"warn":"pass",summary:r.openclawCronSecret||r.openclawCronFireBaseUrl?[r.openclawCronSecret?"OPENCLAW_CRON_SECRET set":null,r.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL set":null].filter(Boolean).join("; "):"No OpenClaw cron env overrides on this runner",remediation:r.openclawCronSecret||r.openclawCronFireBaseUrl?"Move to KYNVER_API_URL + scoped runner tokens; unset OpenClaw cron env on user-hosted runners.":void 0},ev(r,{agentOsId:c??null,apiBaseUrl:t.apiBaseUrl?.trim()??r.kynverApiUrl??null,hasScopedRunnerToken:g,deploymentSchedulerProvider:t.deploymentSchedulerProvider==="qstash"||t.deploymentSchedulerProvider==="kynver-cron"||t.deploymentSchedulerProvider==="openclaw-cron"?t.deploymentSchedulerProvider:void 0}),{id:"hotspot_lease_source_names",label:"Harness lease/completion source names",status:"pass",summary:"Runtime uses kynver-harness:* lease owners and completion source kynver-harness (OpenClaw names retired in runtime)",details:{leaseOwnerPattern:"kynver-harness:<runId>",completionSource:"kynver-harness",note:"OpenClaw adapter remains optional in packages/kynver-openclaw-agent-os only"}}]}}function iv(e=XR){let r=[AD(e),OD(e),ND(e),TD(e),DD(e),MD(e),tv(e),UD(e)],t=ID(r),n=t.fail===0,o=n?t.warn>0?`Ready with ${t.warn} warning(s) \u2014 review remediation before retiring OpenClaw as primary runtime agent.`:"Ready \u2014 Kynver runtime can serve as primary runtime agent on this host.":`${t.fail} blocking check(s) \u2014 fix failures before OpenClaw takeover.`;return{command:"doctor runtime-takeover",ready:n,summary:o,counts:t,sections:r}}function av(e={}){let r=[];if(e.remediate===!0||e.remediate==="true"){let n=rn();n.updated?r.push(`Remediated config fields: ${n.fields.join(", ")}`):r.push("Config backfill: no unambiguous legacy fields to persist"),n.skippedAmbiguous.length>0&&r.push(`Skipped ambiguous identity: ${n.skippedAmbiguous.join("; ")}`)}if(e.remediateDefaultRepo===!0){let n=vo();if(!n.ok){console.error(n.reason??"defaultRepo remediation failed"),n.remediation&&console.error(n.remediation),process.exitCode=1;return}n.remediated?r.push(`Remediated defaultRepo \u2192 ${n.resolved?.defaultRepo??"unknown"}`):r.push(`defaultRepo already persisted (${n.resolved?.defaultRepo??"unknown"})`)}let t=iv();r.length>0&&(t.notes=[...t.notes??[],...r]),console.log(JSON.stringify(t,null,2)),t.ready||(process.exitCode=1)}A();import{existsSync as ms,readFileSync as dv}from"node:fs";import{homedir as WD}from"node:os";import Hc from"node:path";import{spawnSync as LD}from"node:child_process";var lv="24.11.0",ps=">=24.11.0";function Lc(e){let r=e.trim().replace(/^v/,""),t=/^(\d+)\.(\d+)\.(\d+)$/.exec(r);return t?{major:Number(t[1]),minor:Number(t[2]),patch:Number(t[3])}:null}function uv(e,r){return e.major!==r.major?e.major-r.major:e.minor!==r.minor?e.minor-r.minor:e.patch-r.patch}function BD(e){let r=e.trim().split(/\s+/),t=null,n=null;for(let o of r)if(o.startsWith(">="))t=Lc(o.slice(2));else if(o.startsWith("<")){let s=o.slice(1);n=Lc(s)??(/^\d+$/.test(s)?{major:Number(s),minor:0,patch:0}:null)}if(!t)throw new Error(`Unsupported node policy range: ${e}`);return{floor:t,below:n}}function Bn(e,r=ps){let{floor:t,below:n}=BD(r),o=Lc(e);if(!o)return{status:"invalid_version",currentVersion:e.trim(),requiredRange:r,remediation:`Node version could not be parsed as X.Y.Z (prereleases are unsupported). Install Node ${lv} or a later release within the supported range.`};let s=`${o.major}.${o.minor}.${o.patch}`;return uv(o,t)<0?{status:"upgrade_required",currentVersion:s,requiredRange:r,remediation:`Upgrade Node to >=${lv}. See docs/runbooks/node-24-fleet-migration.md for the per-host procedure.`}:n&&uv(o,n)>=0?{status:"unsupported_major",currentVersion:s,requiredRange:r,remediation:`Node ${o.major}.x is newer than this artifact's qualified range (${r}). Use a qualified Node major or wait for the next runtime qualification.`}:{status:"compatible",currentVersion:s,requiredRange:r,remediation:null}}Ge();var pv=Hc.join(WD(),".kynver"),h3=Hc.join(pv,"config.json"),_t=Hc.join(pv,"credentials"),cv=(()=>{let e=process.env.KYNVER_DAEMON_STALL_MS?.trim(),r=e?parseInt(e,10):NaN;return Number.isFinite(r)&&r>0?r:900*1e3})();function HD(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function Wn(e){return e.checks.some(r=>r.status==="fail")}function FD(e){try{let r=LD(process.platform==="win32"?"where":"which",[e],{encoding:"utf8",timeout:3e3});return r.status===0&&!!r.stdout?.trim()}catch{return!1}}function KD(){if(!ms(_t))return{hasApiKey:!1};try{let e=JSON.parse(dv(_t,"utf8"));return{hasApiKey:!!e.apiKey?.trim(),runnerToken:e.runnerToken?.trim()||void 0,runnerTokenAgentOsId:e.runnerTokenAgentOsId?.trim()||void 0}}catch{return{hasApiKey:!1}}}function $D(){let e=FD("kynver"),r=Bn(process.versions.node);return{id:"stage_1_install",label:"Stage 1 \u2014 Install",checks:[{id:"install_package_version",label:"@kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${ze} is running`,details:{version:ze}},{id:"install_node_runtime_policy",label:"Node runtime policy (report-only)",status:r.status==="compatible"?"pass":"warn",summary:r.status==="compatible"?`Node ${r.currentVersion} satisfies ${r.requiredRange}`:`Node ${r.currentVersion} \u2192 ${r.status} against ${r.requiredRange} (advisory during rollout)`,remediation:r.remediation??void 0,details:{status:r.status,requiredRange:r.requiredRange}},{id:"install_on_path",label:"kynver executable on PATH",status:e?"pass":"warn",summary:e?"kynver found on PATH \u2014 global install confirmed":"kynver not on PATH \u2014 running via node/npx (fine for first-timers)",remediation:e?void 0:"Install globally for a shorter command: `npm install -g @kynver-app/runtime`",details:{onPath:e}}]}}function jD(e,r){return{id:"stage_2_login",label:"Stage 2 \u2014 Device Login",checks:[{id:"login_credentials_file",label:"Credentials file present",status:ms(_t)?"pass":"fail",summary:ms(_t)?`${V(_t)} exists`:`${V(_t)} missing \u2014 not logged in`,remediation:ms(_t)?void 0:r?`kynver login --api-base-url ${r}`:"kynver login --api-base-url https://your-kynver-site"},{id:"login_api_key",label:"API key present",status:e.hasApiKey?"pass":"fail",summary:e.hasApiKey?"API key found in credentials":"No API key \u2014 device login not completed",remediation:e.hasApiKey?void 0:r?`kynver login --api-base-url ${r}`:"kynver login --api-base-url https://your-kynver-site"}]}}function VD(e,r){return{id:"stage_3_workspace",label:"Stage 3 \u2014 Workspace Binding",checks:[{id:"workspace_api_base_url",label:"API base URL configured",status:r?"pass":"fail",summary:r?`apiBaseUrl = ${r}`:"apiBaseUrl not set \u2014 bootstrap required",remediation:r?void 0:"kynver bootstrap --api-base-url https://your-kynver-site",details:{apiBaseUrl:r??null}},{id:"workspace_agent_os_id",label:"AgentOS workspace bound",status:e?"pass":"fail",summary:e?`Workspace ${e} bound`:"agentOsId not set \u2014 workspace not bound",remediation:e?void 0:r?`kynver bootstrap --api-base-url ${r}`:"kynver bootstrap --api-base-url https://your-kynver-site",details:{agentOsId:e??null}}]}}function GD(e){let r=R(),t=Le({config:r}),n=!!t?.repo,o=!!t?.persistedInConfig,s=[{id:"repo_configured",label:"Default repo configured",status:n?"pass":"fail",summary:n?o?`${V(t.repo)} (from config)`:`${V(t.repo)} (discovered \u2014 not persisted yet)`:"No default repo \u2014 kynver start requires --repo or a configured path",remediation:n?o?void 0:"kynver config ensure-default-repo":"kynver setup --repo /path/to/your/repo",details:{defaultRepo:t?.repo??null,source:t?.source??null,persistedInConfig:o}}];return n&&!o&&s.push({id:"repo_persisted",label:"Default repo persisted in ~/.kynver/config.json",status:"warn",summary:`Repo discovered via ${t?.source} but not saved to config \u2014 may not survive env changes`,remediation:"kynver config ensure-default-repo"}),{id:"stage_4_repo",label:"Stage 4 \u2014 Repo Selection",checks:s}}function YD(e,r){let t=e.runnerToken,n=!!t?.startsWith("krc1."),o=e.runnerTokenAgentOsId,s=!r||!o||o===r,i=[{id:"credential_scoped_token",label:"Scoped runner token (krc1.*) present",status:n?"pass":"fail",summary:n?`Scoped token present (krc1.\u2026 for ${o??r??"workspace"})`:t?"Runner token present but not a krc1.* scoped token \u2014 re-mint required":"No runner token \u2014 mint one with `kynver runner credential`",remediation:n?void 0:r?`kynver runner credential --agent-os-id ${r}`:"kynver runner credential --agent-os-id <your-agent-os-id>",details:{hasToken:!!t,isScoped:n,tokenAgentOsId:o??null}}];return n&&!s&&i.push({id:"credential_workspace_match",label:"Runner token matches configured workspace",status:"warn",summary:`Token is for workspace ${o}, config expects ${r}`,remediation:r?`kynver runner credential --agent-os-id ${r}`:void 0,details:{tokenAgentOsId:o??null,configAgentOsId:r??null}}),{id:"stage_5_credential",label:"Stage 5 \u2014 Runner Credential",checks:i}}function JD(e){if(!e)return{id:"stage_6_daemon",label:"Stage 6 \u2014 Supervised Daemon",checks:[{id:"daemon_workspace_required",label:"Workspace required for daemon liveness check",status:"warn",summary:"agentOsId not set \u2014 cannot locate heartbeat file; complete stage 3 first"}]};let r=si(e),t=ms(r),n=!1,o=null,s=null;if(t)try{let a=JSON.parse(dv(r,"utf8"));a.observedAt&&(o=Date.now()-new Date(a.observedAt).getTime(),n=o<cv),s=a.pid??null}catch{}let i=[{id:"daemon_running",label:"Daemon running (heartbeat present)",status:t?"pass":"warn",summary:t?`Heartbeat file found: ${V(r)}`:`No heartbeat file at ${V(r)} \u2014 daemon not started`,remediation:t?void 0:"kynver start",details:{heartbeatPath:V(r),exists:t}}];return t&&i.push({id:"daemon_heartbeat_fresh",label:"Daemon heartbeat fresh",status:n?"pass":"warn",summary:n?`Last beat ${Math.round((o??0)/1e3)}s ago (pid ${s??"?"})`:o!==null?`Heartbeat is ${Math.round(o/6e4)}m old \u2014 daemon may be stalled`:"Cannot parse heartbeat timestamp",remediation:n?void 0:"kynver start  # keeper will respawn the daemon",details:{ageMs:o,stallThresholdMs:cv,pid:s}}),{id:"stage_6_daemon",label:"Stage 6 \u2014 Supervised Daemon",checks:i}}function mv(){let e=R(),r=KD(),t=e.agentOsId?.trim()||void 0,n=e.apiBaseUrl?.trim()||process.env.KYNVER_API_URL?.trim()||void 0,o=$D(),s=jD(r,n),i=VD(t,n),a=GD(t),l=YD(r,t),u=JD(t),c=[o,s,i,a,l,u],d=HD(c),p=0;Wn(o)||(p=1),p>=1&&!Wn(s)&&(p=2),p>=2&&!Wn(i)&&(p=3),p>=3&&!Wn(a)&&(p=4),p>=4&&!Wn(l)&&(p=5),p>=5&&!Wn(u)&&(p=6);let m=p>=5,f={0:"not started",1:"installed",2:"logged in",3:"workspace bound",4:"repo selected",5:"ready (credential minted)",6:"fully operational (daemon running)"},g=m?p===6?"Fully operational \u2014 daemon running with supervised respawn.":`Ready \u2014 runner at stage ${p} (${f[p]}). Run \`kynver start\` to bring the daemon online.`:`Lifecycle at stage ${p} (${f[p]}). ${d.fail} blocking check(s) \u2014 see remediation hints above.`;return{command:"doctor runner-install",ready:m,lifecycleStage:p,summary:g,counts:d,sections:c}}function fv(){let e=mv();console.log(JSON.stringify(e,null,2)),e.ready||(process.exitCode=1)}function gv(e){let r=e?.identity??oi(),t=e?.nodeVersion??process.env.KYNVER_NODE_POLICY_TEST_VERSION?.trim()??r.nodeVersion,n=e?.requiredRange??ps,o=Bn(t,n);return{command:"doctor node-runtime",contractVersion:1,nodeVersion:o.currentVersion,requiredRange:n,status:o.status,remediation:o.remediation,platform:r.platform,arch:r.arch,runtimePackageVersion:ze,buildIdentity:r.buildIdentity}}function hv(){let e=gv();console.log(JSON.stringify(e,null,2))}A();function Fc(e,r){let t=e;return r&&(t=t.split(r).join("[REDACTED_SECRET]")),t=t.replace(/kynver_[a-z0-9_]+/gi,"[REDACTED_KYNVER_TOKEN]"),t=t.replace(/sk-[a-zA-Z0-9_-]+/g,"[REDACTED_API_KEY]"),t}A();function kv(e){let r={Accept:"application/json"};return e?.trim()&&(r.Authorization=`Bearer ${e.trim()}`),r}async function Kc(e,r,t=3e4){let n=new AbortController,o=setTimeout(()=>n.abort(),t);try{let s=await fetch(e,{...r,signal:n.signal}),i=null;try{i=await s.json()}catch{i=null}return{ok:s.ok,status:s.status,response:i}}catch(s){return{ok:!1,status:0,response:{error:s instanceof Error?s.message:String(s)}}}finally{clearTimeout(o)}}function yv(){return{loadConfig(){let e=R(),r=e.agentOsSlug?.trim()??"",t=e.agentOsId?.trim()??"",n=W(e.apiBaseUrl),o=q();return{slug:r,agentOsId:t,baseUrl:n,apiKey:o}},async resolveRunnerSecret(e,r){try{return await G(void 0,e,{baseUrl:r})}catch{return null}},fetchContextEnvelope(e,r,t){let n=new URLSearchParams({anchorType:r,anchorId:t,mode:"routine"}),o=`${e.baseUrl}/api/agent-os/${encodeURIComponent(e.slug)}/context-envelope?${n.toString()}`;return Kc(o,{method:"GET",headers:kv(e.apiKey)})},fetchTasks(e,r=25){let t=new URLSearchParams({limit:String(r)}),n=`${e.baseUrl}/api/agent-os/${encodeURIComponent(e.slug)}/tasks?${t.toString()}`;return Kc(n,{method:"GET",headers:kv(e.apiKey)})},fetchRetrieveTelemetryDiagnostic(e){let r=e.runnerSecret;if(!r)return Promise.resolve({ok:!1,status:0,response:{error:"runner secret unavailable"}});let t=`${e.baseUrl}/api/agent-os/by-id/${encodeURIComponent(e.agentOsId)}/diagnostics?slug=context-envelope-retrieve-telemetry`;return Kc(t,{method:"GET",headers:De(r)})}}}var Rv="00000000-0000-4000-8000-000000000001";function $c(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function qD(e){return e.checks.some(r=>r.status==="fail")}function pe(e){return e&&typeof e=="object"?e:null}function z(e){return typeof e=="string"&&e.trim()?e.trim():null}function fs(e){return typeof e=="boolean"?e:null}function Oa(e){return typeof e=="number"&&Number.isFinite(e)?e:null}function gs(e){return Array.isArray(e)?e:[]}function zD(e){let r=pe(e),t=gs(r?.items);if(t.length===0)return null;let n=t.map(s=>{let i=pe(s);if(!i)return null;let a=z(i.id);return a?{taskId:a,personaSlug:z(i.personaSlug),title:z(i.title)}:null}).filter(s=>s!==null);return n.find(s=>s.personaSlug)??n[0]??null}function XD(e){let r=pe(e.envelope.anchor)??{},t=pe(e.envelope.persona),n=pe(e.envelope.resultContract)??{},o=gs(e.envelope.memories),s=t?gs(t.operatingRules).length:0;return{slug:e.slug,agentOsId:e.agentOsId,taskId:e.taskId,anchor:{type:z(r.type)??"task",id:z(r.id)??e.taskId,exists:fs(r.exists)===!0,title:z(r.title),status:z(r.status)},personaSlug:z(t?.slug),memoryCount:o.length,operatingRuleCount:s,withinBudget:fs(n.withinBudget)===!0,projection:z(n.projection)??z(e.envelope.projection),mode:z(e.envelope.mode),contractVersion:z(n.contractVersion),serializedBytes:Oa(n.serializedBytes)}}function QD(e){let r=pe(e),t=pe(r?.result);if(!t)return null;let n=pe(t.detail)??{};return{slug:"context-envelope-retrieve-telemetry",status:z(t.status)??"unknown",summary:z(t.summary)??"",eventCount:Oa(n.eventCount),retrieveCount:Oa(n.retrieveCount)}}function jc(e,r){return Fc(e,r)}function ZD(e){return{id:"config",label:"Configuration",checks:[{id:"config_slug",label:"AgentOS slug",status:e.slug?"pass":"fail",summary:e.slug?`Resolved slug "${e.slug}"`:"Missing agentOsSlug \u2014 run `kynver setup --agent-os-slug \u2026`",remediation:e.slug?void 0:"Run `kynver setup --agent-os-slug ghost` (or your workspace slug)."},{id:"config_agent_os_id",label:"AgentOS id",status:e.agentOsId?"pass":"fail",summary:e.agentOsId?`Resolved agentOsId ${e.agentOsId}`:"Missing agentOsId \u2014 run `kynver setup --agent-os-id \u2026`",remediation:e.agentOsId?void 0:"Run `kynver setup` or `kynver bootstrap` to bind the workspace."},{id:"config_api_key",label:"Dashboard API key",status:e.apiKey?"pass":"fail",summary:e.apiKey?"Bearer API key present for slug context-envelope route":"Missing API key \u2014 run `kynver login`",remediation:e.apiKey?void 0:"Run `kynver login --api-key \u2026` (or device login)."},{id:"config_runner_secret",label:"Harness runner credential",status:e.runnerSecret?"pass":"warn",summary:e.runnerSecret?"Runner credential available for diagnostics probe":"No runner credential \u2014 retrieve-telemetry diagnostic will be skipped",remediation:e.runnerSecret?void 0:"Run `kynver runner credential mint` to enable diagnostics probe."}]}}function eM(e,r,t,n){if(!t.ok)return{id:r,label:e,status:"fail",summary:jc(`GET context-envelope failed: HTTP ${t.status||"network"}`,n),details:{httpStatus:t.status}};let o=pe(t.response);return o?{id:r,label:e,status:"pass",summary:"Context-envelope GET succeeded",details:{anchorType:z(pe(o.anchor)?.type),anchorId:z(pe(o.anchor)?.id)}}:{id:r,label:e,status:"fail",summary:"Context-envelope response was not JSON object"}}function rM(e){let r=pe(e.anchor)??{},t=fs(r.exists)===!0;return{id:"anchor_exists",label:"Anchor exists",status:t?"pass":"fail",summary:t?`anchor.exists=true (${z(r.title)??z(r.id)??"task"})`:"anchor.exists=false for the probed task \u2014 envelope cannot anchor dispatch",details:{exists:t,title:z(r.title),status:z(r.status)}}}function tM(e,r){let t=pe(e.persona),n=z(t?.slug);if(r){let o=n===r;return{id:"persona_slug",label:"Persona slug",status:o?"pass":"fail",summary:o?`persona.slug="${n}" matches task personaSlug`:`persona.slug="${n??"(null)"}" expected "${r}"`,details:{expectedPersona:r,actualPersona:n}}}return{id:"persona_slug",label:"Persona slug",status:n?"warn":"pass",summary:n?`Task has no personaSlug but envelope returned persona "${n}"`:"No persona block (task has no personaSlug)",details:{actualPersona:n}}}function nM(e){let t=gs(e.memories).length;return{id:"memory_count",label:"Memory retrieval count",status:"pass",summary:`${t} memory hit(s) in envelope`,details:{memoryCount:t}}}function oM(e){let r=pe(e.resultContract)??{},t=fs(r.withinBudget)===!0,n=Oa(r.serializedBytes);return{id:"within_budget",label:"Result contract within budget",status:t?"pass":"fail",summary:t?`resultContract.withinBudget=true${n!=null?` (${n} bytes)`:""}`:"resultContract.withinBudget=false \u2014 envelope exceeds MCP transport cap",details:{withinBudget:t,serializedBytes:n,omitted:gs(r.omitted).length}}}function sM(e,r){if(!e.ok)return{id:"missing_anchor_fail_closed",label:"Missing anchor fail-closed",status:"fail",summary:jc(`Missing-anchor probe failed: HTTP ${e.status||"network"}`,r)};let t=pe(e.response),n=pe(t?.anchor)??{},o=fs(n.exists),s=z(n.id),i=o===!1&&s===Rv;return{id:"missing_anchor_fail_closed",label:"Missing anchor fail-closed",status:i?"pass":"fail",summary:i?"Unknown anchor collapses to anchor.exists=false (no cross-workspace confirmation)":`Expected anchor.exists=false for probe id; got exists=${String(o)}`,details:{exists:o,anchorId:s}}}function iM(e,r){if(!e.ok)return{check:{id:"retrieve_telemetry",label:"Retrieve telemetry diagnostic",status:e.status===0?"warn":"fail",summary:jc(e.status===0?"Retrieve-telemetry diagnostic skipped (no runner credential)":`Diagnostics probe failed: HTTP ${e.status}`,r)},telemetry:null};let t=QD(e.response),n=t?.status??"unknown";return{check:{id:"retrieve_telemetry",label:"Retrieve telemetry diagnostic",status:n==="ok"?"pass":n==="degraded"?"warn":"fail",summary:t?.summary??"context-envelope-retrieve-telemetry returned no summary",details:t?{status:t.status,eventCount:t.eventCount,retrieveCount:t.retrieveCount}:void 0},telemetry:t}}async function vv(e={},r=yv()){let t=r.loadConfig(),n=(e.slug??t.slug).trim(),o=(e.agentOsId??t.agentOsId).trim(),s=W(e.baseUrl??t.baseUrl),i=e.apiKey??t.apiKey,a=await r.resolveRunnerSecret(o,s),l={slug:n,agentOsId:o,baseUrl:s,apiKey:i,runnerSecret:a??void 0},u=[];u.push(ZD({slug:n,agentOsId:o,apiKey:i,runnerSecret:a}));let c=null,d=null;if(!!!(n&&o&&i))return{command:"doctor context-envelope",ready:!1,summary:"Context-envelope preflight blocked \u2014 fix configuration checks first.",counts:$c(u),sections:u,envelopeSummary:c,telemetryDiagnostic:d};let m=e.taskId?.trim()||process.env.KYNVER_HARNESS_TASK_ID?.trim()||"",f=null;if(!m){let L=await r.fetchTasks(l),P=L.ok?zD(L.response):null;P&&(m=P.taskId,f=P.personaSlug)}let g={id:"anchor_resolution",label:"Task anchor",checks:[{id:"task_anchor_resolved",label:"Probe task id",status:m?"pass":"fail",summary:m?`Using task anchor ${m}`:"No task id \u2014 pass --task-id or ensure board has tasks",remediation:m?void 0:"Pass --task-id <uuid> or create a board task to probe.",details:m?{taskId:m,expectedPersona:f}:void 0}]};if(u.push(g),!m)return{command:"doctor context-envelope",ready:!1,summary:"Context-envelope preflight blocked \u2014 no task anchor to probe.",counts:$c(u),sections:u,envelopeSummary:c,telemetryDiagnostic:d};let k=await r.fetchContextEnvelope(l,"task",m),h=[eM("Live task envelope","envelope_fetch",k,a??void 0)],y=pe(k.response);if(k.ok&&y){if(!f){let L=pe(y.task);f=z(L?.personaSlug)}c=XD({slug:n,agentOsId:o,taskId:m,envelope:y}),h.push(rM(y),tM(y,f),nM(y),oM(y))}let b=await r.fetchContextEnvelope(l,"task",Rv);h.push(sM(b,a??void 0)),u.push({id:"envelope",label:"Context envelope",checks:h});let E=await r.fetchRetrieveTelemetryDiagnostic(l),_=iM(E,a??void 0);d=_.telemetry,u.push({id:"telemetry",label:"Retrieval telemetry",checks:[_.check]});let I=$c(u),F=!u.some(qD),ee=F?`Context-envelope preflight passed for task ${m} (${c?.memoryCount??0} memories, withinBudget=${String(c?.withinBudget??!1)}).`:"Context-envelope preflight failed \u2014 see failing checks.";return{command:"doctor context-envelope",ready:F,summary:ee,counts:I,sections:u,envelopeSummary:c,telemetryDiagnostic:d}}function bv(e,r){let t=n=>Fc(n,r);return{...e,summary:t(e.summary),sections:e.sections.map(n=>({...n,checks:n.checks.map(o=>({...o,summary:t(o.summary),remediation:o.remediation?t(o.remediation):void 0}))})),envelopeSummary:e.envelopeSummary,telemetryDiagnostic:e.telemetryDiagnostic?{...e.telemetryDiagnostic,summary:t(e.telemetryDiagnostic.summary)}:null}}async function Sv(e){let r=await vv({slug:e.slug?String(e.slug):void 0,agentOsId:e.agentOsId?String(e.agentOsId):void 0,baseUrl:e.baseUrl?String(e.baseUrl):void 0,taskId:e.taskId?String(e.taskId):void 0,apiKey:e.apiKey?String(e.apiKey):void 0}),t=bv(r);console.log(JSON.stringify(t,null,2)),t.ready||(process.exitCode=1)}A();async function wv(e){let r=R(),t=(e.agentOsId?String(e.agentOsId):r.agentOsId)||"";t||(console.error("requires --agent-os-id or agentOsId in ~/.kynver/config.json"),process.exit(1));let n=W(e.baseUrl?String(e.baseUrl):r.apiBaseUrl),o=await G(e.secret?String(e.secret):void 0,t,{baseUrl:n}),s=new URLSearchParams;if(typeof e.since=="string"&&e.since.trim()&&s.set("since",e.since.trim()),e.limit!=null&&String(e.limit).trim()){let u=Number(e.limit);Number.isFinite(u)&&u>0&&s.set("limit",String(Math.floor(u)))}let i=s.toString()?`?${s.toString()}`:"",a=`${n}/api/agent-os/by-id/${encodeURIComponent(t)}/command-center/dashboard-contract${i}`,l=await cn(a,o);l.ok||(console.error(`dashboard-contract GET failed: HTTP ${l.status}`),l.response&&console.error(JSON.stringify(l.response,null,2)),process.exit(1)),console.log(JSON.stringify(l.response,null,2))}Ge();var Vc=["Vercel/hosted: set KYNVER_SCHEDULER_PROVIDER=qstash","Vercel/hosted: ensure QSTASH_TOKEN (and QStash signing keys) are configured","Vercel/hosted: unset OPENCLAW_CRON_STORE_PATH if present"],Gc=["User runner: unset KYNVER_SCHEDULER_PROVIDER (scheduling is deployment-owned)","User runner: unset OPENCLAW_CRON_STORE_PATH, OPENCLAW_CRON_SECRET, OPENCLAW_CRON_FIRE_BASE_URL",'User runner: after deployment cutover, run `kynver scheduler attest-cutover` (or set deploymentSchedulerProvider to "qstash" in ~/.kynver/config.json)',"Verify: kynver doctor runtime-takeover \u2014 hotspot_openclaw_scheduler should pass"];function aM(e=process.env){return{kynverSchedulerProvider:e.KYNVER_SCHEDULER_PROVIDER?.trim()||null,kynverCronStorePath:e.KYNVER_CRON_STORE_PATH?.trim()||e.OPENCLAW_CRON_STORE_PATH?.trim()||null,kynverCronSecret:!!(e.KYNVER_CRON_SECRET?.trim()||e.OPENCLAW_CRON_SECRET?.trim()),kynverCronFireBaseUrl:e.KYNVER_CRON_FIRE_BASE_URL?.trim()||e.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||null,openclawCronStorePath:e.OPENCLAW_CRON_STORE_PATH?.trim()||null,openclawCronSecret:!!e.OPENCLAW_CRON_SECRET?.trim(),openclawCronFireBaseUrl:e.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||null}}function Yc(e,r=aM()){let t=[];return r.kynverSchedulerProvider==="openclaw-cron"&&t.push("Runner still has KYNVER_SCHEDULER_PROVIDER=openclaw-cron"),r.kynverCronStorePath&&r.kynverSchedulerProvider!=="kynver-cron"&&t.push("Runner has KYNVER_CRON_STORE_PATH but KYNVER_SCHEDULER_PROVIDER is not kynver-cron \u2014 use `kynver daemon` cron tick or unset the store for QStash-only runners"),r.openclawCronStorePath&&!r.kynverCronStorePath&&t.push("Runner still has legacy OPENCLAW_CRON_STORE_PATH (prefer KYNVER_CRON_STORE_PATH)"),e.deploymentSchedulerProvider==="openclaw-cron"&&t.push("~/.kynver/config.json deploymentSchedulerProvider is still openclaw-cron"),{ok:t.length===0,blockers:t,runnerEnv:r,deploymentSchedulerProvider:e.deploymentSchedulerProvider??null,deploymentSteps:[...Vc],runnerSteps:[...Gc]}}function Cv(e){return{...e,deploymentSchedulerProvider:"qstash"}}A();import lM from"node:path";import{homedir as uM}from"node:os";var xv=lM.join(uM(),".kynver","config.json");function _v(e=!1){let r=R(),t=Yc(r),n={...t,configPath:V(xv),configAttestationExample:{deploymentSchedulerProvider:"qstash"}};if(e){console.log(JSON.stringify(n,null,2)),t.ok||(process.exitCode=1);return}console.log(`AgentOS scheduler provider cutover checklist
+`),diagnostic:Pr(e)}}import cD from"node:path";D();Q();C();Q();C();function ER(e){let{worker:r,status:t,taskLease:n}=e,o=n?.leaseOwner??null;if(r.dispatched&&n){if(n.status==="running"&&o&&!Hl(o,r.runId))return{health:"orphaned",reason:`task lease held by ${o}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=n.leaseToken?.trim()??"";if(n.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(n.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(t.attention.state==="stale")return{health:"stale",reason:t.attention.reason};let s=t.lastHeartbeatAt?Date.parse(t.lastHeartbeatAt):NaN;return t.alive&&Number.isFinite(s)&&Date.now()-s>Yt?{health:"stale",reason:`heartbeat older than ${Math.floor(Yt/1e3)}s`}:t.alive&&r.pid&&!K(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:n?.status==="running"&&!t.alive&&t.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:t.attention.reason||"worker within expected lifecycle bounds"}}Ne();C();import{existsSync as PR,mkdirSync as aD,readdirSync as lD,unlinkSync as uD}from"node:fs";import Nc from"node:path";function IR(){let{harnessRoot:e}=Lt(),r=Nc.join(e,"monitors");return aD(r,{recursive:!0}),r}function Dn(e,r){return r?`${S(e)}--${S(r)}`:S(e)}function Tc(e){return Nc.join(IR(),`${e}.json`)}function Mn(e){return x(Tc(e),void 0)}function Un(e){ue(Tc(e.monitorId),e)}function AR(e){let r=Tc(e);return PR(r)?(uD(r),!0):!1}function OR(){let e=IR();if(!PR(e))return[];let r=[];for(let t of lD(e)){if(!t.endsWith(".json"))continue;let n=x(Nc.join(e,t),void 0);n?.monitorId&&r.push({monitorId:n.monitorId,runId:n.runId,workerName:n.workerName,agentOsId:n.agentOsId,pid:n.pid,alive:n.pid?K(n.pid):!1,startedAt:n.startedAt,pollMs:n.pollMs,logPath:n.logPath})}return r.sort((t,n)=>t.startedAt.localeCompare(n.startedAt))}Q();function Dc(e){let{worker:r,status:t}=e,n=[];r.localOnly&&n.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&n.push("missing agentOsId/taskId linkage"),Ei(r)&&n.push("completion already acknowledged"),r.completionBlocker&&n.push(r.completionBlocker),t.heartbeatBlocker&&t.alive&&n.push(`worker heartbeat blocker: ${t.heartbeatBlocker}`),t.attention.state==="blocked"&&n.push(t.attention.reason||"worker attention blocked"),Jt(t)&&n.push(t.attention.reason||"landing gate blocked");let o=ce(t),s;return o?t.finalResult?s="final_result":t.alive?s="terminal_status":s="process_exited":n.push("worker has not reached a terminal condition"),{eligible:o&&n.length===0,terminalVerified:o,terminalReason:s,blockers:n}}function NR(e,r){return x(cD.join(N(e),"workers",S(r),"worker.json"),void 0)}function TR(e,r){let t=H(e),n=Object.keys(t.workers||{});if(!r)return n;let o=S(r);return n.filter(s=>S(s)===o)}function DR(e,r){let t=H(e.runId),n=B(e,{base:t.base,baseCommit:t.baseCommit}),o=e.taskId?r.get(e.taskId)??null:null,s=ER({worker:e,status:n,taskLease:o}),i=Dc({worker:e,status:n});return{runId:e.runId,worker:e.name,health:s.health,healthReason:s.reason,workerStatus:n.status,attentionState:n.attention.state,attentionReason:n.attention.reason,alive:n.alive,taskId:e.taskId,leaseOwner:o?.leaseOwner??void 0,taskStatus:o?.status,autoComplete:i,status:n}}async function cs(e){let r=String(e.run||"");U(r,"--run");let t=e.name?String(e.name):void 0,n=e.agentOsId?String(e.agentOsId):void 0,o=H(r),s=TR(r,t),i=[];for(let f of s){let g=NR(r,f);g&&i.push(g)}let a=n||i.map(f=>f.agentOsId).find(f=>typeof f=="string"&&f.trim())||void 0,l=i.map(f=>f.taskId).filter(f=>!!f),u=await gn({agentOsId:a,taskIds:l,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0}),c=i.map(f=>DR(f,u)),d;a&&e.renewLeases!==!1&&e.renewLeases!=="false"&&(d=await wi(r,{...e,agentOsId:a}));let p=[];if(e.autoComplete===!0||e.autoComplete==="true")for(let f of c){if(!f.autoComplete.eligible){p.push({worker:f.worker,outcome:"skipped",ok:!1,reason:f.autoComplete.blockers.join("; ")||"not eligible"});continue}let g=await hn({run:r,name:f.worker,...a?{agentOsId:a}:{},...e.baseUrl?{baseUrl:String(e.baseUrl)}:{},...e.secret?{secret:String(e.secret)}:{}});p.push({worker:f.worker,outcome:g.outcome,ok:g.outcome==="completed",reason:g.reason})}return{runId:r,agentOsId:a,workers:c,leaseRenewal:d,autoCompleted:p}}function MR(e){let r=String(e.run||"");U(r,"--run");let t=e.name?String(e.name):void 0,n=TR(r,t),o=[];for(let s of n){let i=NR(r,s);i&&o.push(DR(i,new Map))}return{runId:r,workers:o,autoCompleted:[]}}function Mc(){return OR()}function UR(e){let r=String(e.run||"");U(r,"--run");let t=Dn(r,e.name?String(e.name):void 0),n=Mn(t);if(!n)return{monitorId:t,stopped:!1};if(n.pid&&K(n.pid))try{process.kill(n.pid,"SIGTERM")}catch{}return n.stoppedAt=new Date().toISOString(),Un(n),AR(t),{monitorId:t,stopped:!0,pid:n.pid}}async function Uc(e){let r=String(e.run||""),t=String(e.name||"");U(r,"--run"),U(t,"--name");let n=Re(r,t),o=H(r),s=B(n,{base:o.base,baseCommit:o.baseCommit}),i=Dc({worker:n,status:s});if(!i.eligible){console.log(JSON.stringify({runId:r,worker:t,outcome:"blocked",blockers:i.blockers,terminalVerified:i.terminalVerified},null,2)),process.exitCode=1;return}let a=await hn({...e,run:r,name:t});console.log(JSON.stringify(a,null,2)),a.outcome!=="completed"&&a.outcome!=="blocked"&&(process.exitCode=1)}C();var dD=5e3,pD=360*60*1e3;async function BR(e){let r=String(e.monitorId||""),t=Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):dD,n=Number(e.maxTotalMs)>0?Math.floor(Number(e.maxTotalMs)):pD,o=Date.now();for(;Date.now()-o<=n;){let s=r?Mn(r):void 0;if(s?.stoppedAt)break;let i=await cs({...e,autoComplete:e.autoComplete??!0,renewLeases:e.renewLeases??!0}),a=Pa({monitorId:r,phase:"tick",...i});if(console.log(a.primary),a.diagnostic&&console.error(`[monitor diagnostic] ${a.diagnostic}`),i.workers.length>0&&i.workers.every(u=>u.autoComplete.terminalVerified&&(u.autoComplete.eligible||u.autoComplete.blockers.some(c=>c.includes("already acknowledged"))))&&i.autoCompleted.every(u=>u.ok||u.outcome==="skipped")){r&&s&&(s.stoppedAt=new Date().toISOString(),Un(s));break}qr(t)}}C();Ne();import{spawn as mD}from"node:child_process";import{closeSync as WR,existsSync as fD,openSync as gD}from"node:fs";import hD from"node:path";function LR(e){let r=e.nodeExecutable??process.execPath,t=Wi({importMetaUrl:import.meta.url,explicitCliPath:e.cliPath,nodeExecutable:r});if(!t)return;let n=t.cliPath;if(!fD(n))return;let o=Dn(e.runId,e.workerName),{harnessRoot:s}=Lt(),i=hD.join(s,"monitors",`${o}.log`),a;try{a=gD(i,"a")}catch{a=void 0}let l=e.pollMs??5e3,u=[...t.argsPrefix,"monitor","run-loop","--run",e.runId,"--monitor-id",o,"--poll-ms",String(l),"--auto-complete","true","--renew-leases","true"];e.workerName&&u.push("--name",e.workerName),e.agentOsId&&u.push("--agent-os-id",e.agentOsId),e.baseUrl&&u.push("--base-url",e.baseUrl),e.secret&&u.push("--secret",e.secret);let c=["ignore",a??"ignore",a??"ignore"];try{let d=mD(t.command,u,be({detached:!0,stdio:c,env:process.env}));a!==void 0&&WR(a),d.unref();let p={monitorId:o,runId:e.runId,workerName:e.workerName,agentOsId:e.agentOsId,pid:d.pid,startedAt:new Date().toISOString(),pollMs:l,logPath:i};return Un(p),{monitorId:o,pid:d.pid,logPath:i,session:p}}catch{if(a!==void 0)try{WR(a)}catch{}return}}C();async function HR(e){let r=String(e.run||"");U(r,"--run");let t=e.name?String(e.name):void 0,n=Dn(r,t),o=Mn(n);if(o?.pid&&!o.stoppedAt)return{monitorId:n,session:o,spawned:!1,pid:o.pid};let s=LR({runId:r,workerName:t,agentOsId:e.agentOsId?String(e.agentOsId):void 0,pollMs:Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):void 0,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0});if(!s)throw new Error("failed to spawn monitor sidecar (cli.js missing or spawn error)");return{monitorId:n,session:s.session,spawned:!0,pid:s.pid}}async function FR(e){if(String(e.run||"")){let t=e.tick===!0||e.tick==="true"?await cs({...e,autoComplete:!1}):MR(e);console.log(JSON.stringify(t,null,2));return}console.log(JSON.stringify({monitors:Mc()},null,2))}function KR(e){console.log(JSON.stringify(UR(e),null,2))}function $R(){console.log(JSON.stringify({monitors:Mc()},null,2))}async function jR(e){await BR(e)}async function VR(e){let r=await cs(e);console.log(JSON.stringify(r,null,2))}function kD(e){let r={};for(let[t,n]of Object.entries(e))n?.version&&(r[t]={version:n.version,source:"installed",path:n.path});return r}async function yD(e={}){let[r,t]=await Promise.all([ca(),Promise.resolve(sy({cwd:e.cwd,repoRoot:e.repoRoot}))]),n={},o=e.selfPackageName==="@kynver-app/runtime"&&e.selfVersion?e.selfVersion:ze;return n["@kynver-app/runtime"]={version:o,source:"self"},e.selfPackageName&&e.selfVersion&&e.selfPackageName!=="@kynver-app/runtime"&&(n[e.selfPackageName]={version:e.selfVersion,source:"self"}),{installed:kD(r),repo:t,self:n}}async function GR(e={}){let r=await yD(e);return ay(r)}function YR(e,r){return e?e==="daemon"||e==="start"||e==="worker"||e==="monitor"||e==="run"&&(r==="dispatch"||r==="sweep"||r==="reconcile"||r==="unblock")||e==="cron"&&r==="tick":!1}C();function RD(e){let r=e.trim();return r?ns().find(n=>n.name===r&&n.status!=="completed")??null:null}function JR(e){let r=String(U(String(e.name||""),"--name")),t=RD(r);console.log(JSON.stringify({runId:t?.id??null,name:r,status:t?.status??null,effectiveStatus:t?.effectiveStatus??null},null,2))}D();Q();C();A();import vD from"node:path";function ds(e,r,t,n,o,s){return{runId:e,worker:r,taskId:t,agentOsId:n,leaseOwner:o,action:"skipped",reason:s}}async function bD(e){let r=W(e.baseUrl?String(e.baseUrl):void 0),t=e.agentOsId?String(e.agentOsId).trim():null,n=e.dryRun===!0||e.dryRun==="true",o=[],s=[],i=[];for(let a of X())for(let l of Object.keys(a.workers??{})){let u=vD.join(N(a.id),"workers",S(l),"worker.json"),c=x(u,void 0);if(!c){s.push(ds(a.id,l,"","","","worker.json missing"));continue}let d=c.taskId??"",p=c.agentOsId??"",m=c.leaseOwner??"";if(!c.dispatched||!d||!p||!m){s.push(ds(a.id,l,d,p,m,"not a fully-leased dispatched worker"));continue}if(t&&p!==t)continue;if(c.completionReportedAt){s.push(ds(a.id,l,d,p,m,"completion already reported"));continue}let f=B(c);if(f.finalResult){s.push(ds(a.id,l,d,p,m,"has final result \u2014 let pipeline tick complete it"));continue}if(f.alive){s.push(ds(a.id,l,d,p,m,"worker process is still alive"));continue}if(n){o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:m,action:"released",reason:"dry-run: would release dead dispatched worker lease"});continue}try{let g=await G(e.secret?String(e.secret):void 0,p,{baseUrl:r}),k=`${r}/api/agent-os/by-id/${encodeURIComponent(p)}/tasks/${encodeURIComponent(d)}/release`,h=await Z(k,g,{agentOsId:p,leaseOwner:m},{agentOsId:p,baseUrl:r});h.ok===!0||h.response?.ok===!0?o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:m,action:"released",reason:"dead dispatched worker lease released; task requeued"}):s.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:m,action:"skipped",reason:`release returned ok:false (likely owner mismatch or already released): HTTP ${h.status}`})}catch(g){i.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:m,action:"error",reason:g.message})}}return{dryRun:n,released:o,skipped:s,errors:i}}async function qR(e){let r=await bD(e),t={ok:r.errors.length===0,dryRun:r.dryRun,released:r.released.length,skipped:r.skipped.length,errors:r.errors.length,details:r};console.log(JSON.stringify(t,null,2)),r.errors.length>0&&process.exit(1)}Xs();import sv from"node:path";Ge();A();import{accessSync as SD,constants as wD,existsSync as Wc,readFileSync as CD}from"node:fs";import{homedir as Ia}from"node:os";import Aa from"node:path";import{spawnSync as xD}from"node:child_process";Ne();function Bc(e,r){try{let t=xD(e,r,{encoding:"utf8"}),n=(t.stdout||"").trim(),o=(t.stderr||"").trim();return{ok:t.status===0,stdout:n,stderr:o,error:t.error?.message}}catch(t){return{ok:!1,stdout:"",stderr:"",error:t.message}}}function zR(e){let r=e?.trim();if(r)return r.length<=12?`${r}\u2026`:`${r.slice(0,12)}\u2026`}function _D(e){if(!Wc(e))return!1;try{return SD(e,wD.W_OK),!0}catch{return!1}}var XR={packageVersion:()=>ze,commandOnPath:e=>Bc(process.platform==="win32"?"where":"which",[e]),kynverVersion:e=>Bc(e,["--version"]),loadConfig:()=>R(),configFilePath:()=>Aa.join(Ia(),".kynver","config.json"),credentialsFilePath:()=>Aa.join(Ia(),".kynver","credentials"),readCredentials:()=>{let e=Aa.join(Ia(),".kynver","credentials");if(!Wc(e))return{hasApiKey:!1};try{let r=JSON.parse(CD(e,"utf8"));return{hasApiKey:!!r.apiKey?.trim(),runnerTokenPrefix:zR(r.runnerToken),runnerTokenAgentOsId:r.runnerTokenAgentOsId}}catch{return{hasApiKey:!1}}},envSnapshot:()=>({kynverApiUrl:process.env.KYNVER_API_URL?.trim()||void 0,openclawCronFireBaseUrl:process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||void 0,kynverRunnerTokenPrefix:zR(process.env.KYNVER_RUNNER_TOKEN),kynverRuntimeSecret:!!process.env.KYNVER_RUNTIME_SECRET?.trim(),openclawCronSecret:!!process.env.OPENCLAW_CRON_SECRET?.trim(),kynverHarnessRoot:process.env.KYNVER_HARNESS_ROOT?.trim()||void 0,opusHarnessRoot:process.env.OPUS_HARNESS_ROOT?.trim()||void 0,kynverSchedulerProvider:process.env.KYNVER_SCHEDULER_PROVIDER?.trim()||void 0,openclawCronStorePath:!!(process.env.KYNVER_CRON_STORE_PATH?.trim()||process.env.OPENCLAW_CRON_STORE_PATH?.trim()),kynverCronDaemonPrimary:ii(),qstashTokenPresent:!!process.env.QSTASH_TOKEN?.trim(),kynverHostedDeployment:(()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"})()}),harnessRoot:()=>Pe(),legacyOpenclawHarnessRoot:()=>Aa.join(Ia(),".openclaw","harness"),pathExists:e=>Wc(e),pathWritable:e=>_D(e),ghAuthToken:()=>Bc("gh",["auth","token"]),deployEvidenceNeedsGithub:()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return!(e==="1"||e==="true"||e==="yes")}};function QR(e,r){return e.kynverSchedulerProvider==="openclaw-cron"||r.deploymentSchedulerProvider==="openclaw-cron"}function ED(e,r){return e.kynverSchedulerProvider==="kynver-cron"||r.deploymentSchedulerProvider==="kynver-cron"}function ZR(e){return!!e.openclawCronStorePath}function PD(e,r){return e.kynverSchedulerProvider==="qstash"||r.deploymentSchedulerProvider==="qstash"}function ev(e,r){let t={schedulerProvider:e.kynverSchedulerProvider??null,deploymentSchedulerProvider:r.deploymentSchedulerProvider??null,openclawCronStorePath:!!e.openclawCronStorePath,kynverCronDaemonPrimary:!!e.kynverCronDaemonPrimary},n=!!r.agentOsId?.trim()&&!!r.apiBaseUrl?.trim()&&r.hasScopedRunnerToken;if(PD(e,r)&&!QR(e,r)){let c=e.kynverSchedulerProvider==="qstash"?"KYNVER_SCHEDULER_PROVIDER=qstash on this host":"deploymentSchedulerProvider=qstash in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler cut over to QStash (${c})`,details:t}}if(ED(e,r)&&!QR(e,r)){if(ZR(e)&&e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let c=e.kynverSchedulerProvider==="kynver-cron"?"KYNVER_SCHEDULER_PROVIDER=kynver-cron on this host":"deploymentSchedulerProvider=kynver-cron in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler owned by Kynver Cron (${c})`,details:t}}if(ZR(e)){if(e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let c=[];return e.openclawCronStorePath&&c.push("KYNVER_CRON_STORE_PATH or OPENCLAW_CRON_STORE_PATH set (local cron store)"),{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Local cron store without daemon tick (${c.join("; ")})`,remediation:"Run `kynver daemon` with KYNVER_CRON_SECRET + KYNVER_API_URL (or KYNVER_CRON_FIRE_BASE_URL) so the daemon-owned cron tick fires schedules. On hosted deploys use QStash (KYNVER_SCHEDULER_PROVIDER=qstash). Legacy OpenClaw cron env aliases still work during cutover.",details:t}}let o=e.kynverSchedulerProvider==="openclaw-cron",s=r.deploymentSchedulerProvider==="openclaw-cron",i=e.kynverSchedulerProvider==="qstash",a=!!e.qstashTokenPresent||!!e.kynverHostedDeployment,l=a&&!n,u=l&&e.kynverSchedulerProvider==="openclaw-cron";return s&&!o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"deploymentSchedulerProvider=openclaw-cron in ~/.kynver/config.json \u2014 migrate to kynver-cron or qstash",remediation:'Run `kynver scheduler attest-cutover` or set deploymentSchedulerProvider to "kynver-cron" or "qstash" in ~/.kynver/config.json.',details:t}:n&&o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 dispatch is owned by kynver daemon; unset the OpenClaw override",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:n?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:i?"Runner override qstash present; hosted dispatch still owned by kynver daemon pipeline-tick":"Hosted dispatch owned by kynver daemon (pipeline-tick \u2192 operator/tick); no OpenClaw cron on runner",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 hosted dispatch still depends on the OpenClaw local-cron adapter",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,hostedDeployment:a}}:u?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment has KYNVER_SCHEDULER_PROVIDER=openclaw-cron \u2014 AgentOS scheduled ticks should use QStash or kynver-cron",remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server (or kynver-cron for Kynver-owned local scheduling). User runners use `kynver daemon` for dispatch and should not set a scheduler provider.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:l&&e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"QSTASH_TOKEN present; hosted scheduler auto-selects qstash (explicit KYNVER_SCHEDULER_PROVIDER=qstash optional)",details:{schedulerProvider:null,qstashTokenPresent:!0,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment with no QSTASH_TOKEN and no KYNVER_SCHEDULER_PROVIDER \u2014 kynver-cron is an in-process stub here and will NOT fire; no firing scheduler is configured",remediation:"Set QSTASH_TOKEN + KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server for hosted AgentOS schedules. Only use kynver-cron when a `kynver daemon` (or local cron store) actually owns firing on this box.",details:{schedulerProvider:null,resolvedFallback:"none",qstashTokenPresent:!1,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&e.kynverSchedulerProvider&&e.kynverSchedulerProvider!=="qstash"&&e.kynverSchedulerProvider!=="kynver-cron"?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Hosted deployment without QSTASH_TOKEN (KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}) \u2014 use qstash or kynver-cron`,remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server, or kynver-cron for Kynver-owned local scheduling. User runners use `kynver daemon` for dispatch.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}`,details:{schedulerProvider:e.kynverSchedulerProvider??null}}:{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"No KYNVER_SCHEDULER_PROVIDER on runner (expected) \u2014 finish runner setup so daemon pipeline-tick owns dispatch",details:{schedulerProvider:null,dispatchPath:"kynver-daemon-pipeline-tick-pending"}}}qe();uo();nt();Ys();dl();function rv(e,r={}){let t=Qt(),n=Js(e,t),o=[],s=r.envFilePath??ge,i=zs(e,{envFilePath:s,systemdUnitActive:r.systemdUnitActive});if(o.push({id:"daemon_supervision_owner",ok:!!e.daemonSupervisionOwner||i.effectivelyConfigured,summary:e.daemonSupervisionOwner?`daemonSupervisionOwner=${e.daemonSupervisionOwner} (${t})`:i.owner?`daemonSupervisionOwner inferred as ${i.owner} from healthy supervision signals \u2014 run \`kynver setup\` to persist`:"daemonSupervisionOwner unset \u2014 run `kynver setup` to persist Kynver-owned restart policy",remediation:e.daemonSupervisionOwner||i.effectivelyConfigured?e.daemonSupervisionOwner?void 0:"Run `kynver setup` or `kynver doctor runtime-takeover --remediate` to persist daemonSupervisionOwner.":"Run `kynver setup` (or `kynver bootstrap`) on this box."}),o.push({id:"daemon_present_signal",ok:i.daemonPresentSignal||i.systemdUnitActive,summary:i.systemdUnitActive?"systemd user unit active \u2014 local daemon supervision is healthy":i.daemonPresentSignal?`KYNVER_CRON_DAEMON_PRESENT=1 (persisted in ${s})`:`KYNVER_CRON_DAEMON_PRESENT not set in persisted env (${s})`,remediation:i.daemonPresentSignal||i.systemdUnitActive?void 0:"Run `kynver setup` or `kynver start` once to write ~/.kynver/.env supervision keys."}),n==="systemd"){let l=Zt();o.push({id:"systemd_user_unit",ok:l,summary:l?"systemd user unit present (~/.config/systemd/user/kynver-cron-daemon.service)":"daemonSupervisionOwner=systemd but user unit missing",remediation:l?void 0:"Run `kynver start --install-systemd` or `kynver cron install --install-systemd`."})}let a=ll(t,n);return o.push({id:"supervision_guidance",ok:!0,summary:a[0]??"Kynver keeper supervises daemon restarts by default."}),o}uo();nt();function tv(e){let r=e.loadConfig(),t=Qt(),n=Js(r,t),s=rv(r,{systemdUnitActive:e.systemdDaemonActive}).map(i=>({id:i.id,label:i.id.replace(/_/g," "),status:i.ok?"pass":i.id==="daemon_supervision_owner"||i.id==="daemon_present_signal"?"warn":"fail",summary:i.summary,remediation:i.remediation}));return s.push({id:"daemon_keeper_default",label:"Kynver keeper owns in-process restarts",status:n==="keeper"||n==="systemd"?"pass":"warn",summary:n==="systemd"?"systemd persists the keeper parent \u2014 Hermes/OpenClaw cron is not required to restart the daemon":"`kynver start` / `kynver daemon` run the keeper by default (opt out with --no-supervise only when an external supervisor owns restarts)",details:{owner:n,hostKind:t}}),{id:"daemon_supervision",label:"Daemon restart supervision",checks:s}}function nv(e){if(e.envGithubToken)return{viable:!0,source:"env",summary:"GITHUB_TOKEN present for GitHub commit-status evidence"};if(e.envGhToken)return{viable:!0,source:"env",summary:"GH_TOKEN present for GitHub commit-status evidence"};let r=e.ghAuthToken();return r.ok&&r.stdout.trim().length>0?{viable:!0,source:"gh-cli",summary:"GitHub CLI authenticated (`gh auth login`) for commit-status evidence"}:{viable:!1,source:"missing",summary:"No GITHUB_TOKEN/GH_TOKEN and `gh auth token` unavailable"}}function ov(e,r){let t=e.commandOnPath("vercel"),n=t.ok,o=!!process.env.VERCEL_TOKEN?.trim(),s=nv(r),i=e.deployEvidenceNeedsGithub?.()??!0,a=[{id:"vercel_global_cli_absent",label:"Global Vercel CLI not installed",status:n?"warn":"pass",summary:n?`Global Vercel CLI on PATH (${t.stdout||"vercel"}) \u2014 conflicts with GitHub-status evidence path`:"No global Vercel CLI on PATH",remediation:n?"Uninstall global Vercel CLI (`npm uninstall -g vercel`) \u2014 prefer GitHub commit status or scoped VERCEL_TOKEN + REST API.":void 0,details:{path:n&&t.stdout||null}}];return i?(a.push({id:"github_token_for_vercel_status",label:"GitHub token for Vercel status",status:s.viable?"pass":"warn",summary:s.viable?s.summary:"No GitHub auth \u2014 merge-gate Vercel evidence needs GITHUB_TOKEN/GH_TOKEN or `gh auth login`",remediation:s.viable?void 0:"Export GITHUB_TOKEN (or GH_TOKEN) or run `gh auth login` for PR head commit-status lookups.",details:{source:s.source}},{id:"vercel_api_token_optional",label:"Vercel API token (optional fallback)",status:o||s.viable?"pass":"warn",summary:o?"VERCEL_TOKEN configured for optional REST API deployment lookup":s.viable?"VERCEL_TOKEN unset \u2014 GitHub commit-status is the default evidence path":"VERCEL_TOKEN unset and GitHub auth missing \u2014 no deploy-evidence fallback",remediation:o||s.viable?void 0:"Set ephemeral/scoped VERCEL_TOKEN only when GitHub status is insufficient; avoid persistent ~/.vercel auth on runner hosts.",details:{vercelTokenPresent:o,githubEvidenceViable:s.viable}}),{id:"vercel_deploy_evidence",label:"Vercel deploy evidence",checks:a}):(a.push({id:"github_token_for_vercel_status",label:"GitHub token for Vercel status",status:"pass",summary:"Skipped \u2014 no enabled workflow on this host requires GitHub deploy evidence",details:{skipped:!0,reason:"workflow_not_enabled"}},{id:"vercel_api_token_optional",label:"Vercel API token (optional fallback)",status:"pass",summary:"Skipped \u2014 GitHub evidence workflow not enabled on this host",details:{skipped:!0,reason:"workflow_not_enabled"}}),{id:"vercel_deploy_evidence",label:"Vercel deploy evidence",checks:a})}function ID(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function AD(e){let r=e.packageVersion(),t=e.commandOnPath("kynver"),n=t.ok&&t.stdout.length>0,o=n?t.stdout.split(/\r?\n/)[0]?.trim():void 0,s=o?V(o):void 0,i=[{id:"cli_running_version",label:"Running @kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${r}`,details:{version:r}},{id:"cli_on_path",label:"kynver executable on PATH",status:n?"pass":"warn",summary:n?`Found ${s}`:"kynver not found on PATH (invoked via node/npx?)",remediation:n?void 0:"Install globally (`npm i -g @kynver-app/runtime`) or invoke via `npx @kynver-app/runtime`.",details:{path:s}}];if(n&&o){let a=e.kynverVersion(o),l=a.stdout.replace(/^kynver\s+/i,"").trim()||void 0,u=a.ok&&(!l||l===r);i.push({id:"cli_installed_version",label:"Installed kynver CLI version matches running package",status:u?"pass":"warn",summary:a.ok&&l?u?`Installed ${l}`:`Installed ${l} differs from running ${r}`:a.error?`Could not read installed version (${a.error})`:a.stderr||"Could not read installed version",remediation:u?void 0:"Reinstall or rebuild @kynver-app/runtime so PATH kynver matches the harness worktree version.",details:{installedVersion:l,runningVersion:r,path:s}})}return{id:"cli_package",label:"CLI / package",checks:i}}function OD(e){let r=e.configFilePath(),t=V(r),n=e.pathExists(r),o=e.loadConfig(),s=[{id:"config_file",label:"~/.kynver/config.json present",status:n?"pass":"fail",summary:n?`Found ${t}`:`Missing ${t}`,remediation:n?void 0:"Run `kynver setup --api-base-url <url> --agent-os-id <id> --repo <path>`.",details:{configPath:t}}];if(n){let i=o.apiBaseUrl?.trim(),a=o.agentOsId?.trim(),l=Le({config:o}),u=l?Ro(l):null,c=Hp(l);s.push({id:"config_api_base_url",label:"Default API base URL",status:i?"pass":"warn",summary:i??"Not set in config (KYNVER_API_URL / --base-url required per command)",remediation:i?void 0:"Set `apiBaseUrl` via `kynver setup --api-base-url https://\u2026`.",details:{apiBaseUrl:i??null}},{id:"config_agent_os_id",label:"Default AgentOS id",status:a?"pass":"warn",summary:a??"Not set (pass --agent-os-id on daemon/dispatch/worker commands)",remediation:a?void 0:"Set `agentOsId` via `kynver setup --agent-os-id <uuid>`.",details:{agentOsId:a??null,agentOsSlug:o.agentOsSlug??null}},{id:"config_default_repo",label:"Default repo path",status:c.status,summary:l?l.persistedInConfig?`${u.defaultRepo} (config)`:`${u.defaultRepo} (${l.source}, not persisted in ~/.kynver/config.json)`:"Not set in ~/.kynver/config.json (`kynver run create` requires --repo)",remediation:c.remediation,details:{defaultRepo:u?.defaultRepo??null,source:u?.source??null,persistedInConfig:u?.persistedInConfig??!1,harnessRoot:o.harnessRoot?Ee(o.harnessRoot):null}})}return{id:"user_config",label:"User config (~/.kynver)",checks:s}}function ND(e){let t=e.loadConfig().agentOsId?.trim(),n=e.readCredentials(),o=e.envSnapshot(),s=e.credentialsFilePath(),i=V(s),a=o.kynverRunnerTokenPrefix,l=n.runnerTokenPrefix,u=n.runnerTokenAgentOsId,c=!!l&&(!t||!u||u===t),d=!!a?.startsWith("krc1.")||c&&l?.startsWith("krc1.");return{id:"runner_token",label:"Runner token readiness",checks:[{id:"runner_token_scoped",label:"Scoped runner token (krc1.*) ready",status:d?"pass":"fail",summary:d?a?"KYNVER_RUNNER_TOKEN is set (scoped prefix shown)":`Saved scoped token for agentOsId ${u??t??"(unknown)"}`:"No scoped runner token for the configured AgentOS workspace",remediation:d?void 0:"Run `kynver login` then `kynver runner credential --agent-os-id <id>` (or `kynver setup` with API key).",details:{source:a?"env":l?"credentials":"none",tokenPrefix:a??(c?l:void 0),agentOsId:t??u??null,credentialsPath:i}},{id:"runner_token_agent_os_match",label:"Saved runner token matches configured agentOsId",status:!l||!t||!u||u===t?"pass":"warn",summary:!l||!u?"No saved token agentOsId to compare":t?u===t?"Saved token scoped to configured agentOsId":`Saved token is for ${u}, config expects ${t}`:"Config agentOsId unset \u2014 token scope not validated against config",remediation:l&&t&&u&&u!==t?"`kynver runner credential --agent-os-id <configured-id>` to mint a workspace-bound token.":void 0,details:{configuredAgentOsId:t??null,savedAgentOsId:u??null}},{id:"runner_api_key_for_refresh",label:"API key available for token refresh",status:n.hasApiKey||process.env.KYNVER_API_KEY?.trim()?"pass":"warn",summary:n.hasApiKey||process.env.KYNVER_API_KEY?"KYNVER API key present for runner credential mint/refresh":"No API key \u2014 401 callback recovery cannot auto-mint a replacement token",remediation:n.hasApiKey||process.env.KYNVER_API_KEY?void 0:"Run `kynver login --api-key \u2026`.",details:{credentialsPath:i,hasApiKey:n.hasApiKey||!!process.env.KYNVER_API_KEY}}]}}function TD(e){return ov(e,{envGithubToken:!!process.env.GITHUB_TOKEN?.trim(),envGhToken:!!process.env.GH_TOKEN?.trim(),ghAuthToken:()=>e.ghAuthToken()})}function DD(e){let r=e.harnessRoot(),t=sv.join(r,"runs"),n=sv.join(r,"worktrees"),o=Ee(r),s=Ee(t),i=Ee(n),a=e.pathExists(t),l=e.pathExists(n);return{id:"harness_dirs",label:"Harness / daemon directories",checks:[{id:"harness_root",label:"Harness root resolved",status:"pass",summary:o,details:{harnessRoot:o}},{id:"harness_runs_dir",label:"Runs directory ready",status:a&&e.pathWritable(t)?"pass":"warn",summary:a?e.pathWritable(t)?`Writable ${s}`:`Exists but not writable: ${s}`:`Will be created on first run: ${s}`,remediation:a&&!e.pathWritable(t)?`Fix permissions on ${s} or set KYNVER_HARNESS_ROOT to a writable path.`:void 0,details:{runsDir:s,exists:a,writable:e.pathWritable(t)}},{id:"harness_worktrees_dir",label:"Worktrees directory ready",status:l&&e.pathWritable(n)?"pass":"warn",summary:l?e.pathWritable(n)?`Writable ${i}`:`Exists but not writable: ${i}`:`Will be created on first worker: ${i}`,remediation:l&&!e.pathWritable(n)?`Fix permissions on ${i}.`:void 0,details:{worktreesDir:i,exists:l,writable:e.pathWritable(n)}}]}}function MD(e){let r=e.loadConfig(),t=e.envSnapshot(),n=t.kynverApiUrl??r.apiBaseUrl?.trim()??t.openclawCronFireBaseUrl,o=!t.kynverApiUrl&&!r.apiBaseUrl&&!!t.openclawCronFireBaseUrl,s=t.openclawCronSecret||t.kynverRuntimeSecret,i=t.kynverRunnerTokenPrefix?.startsWith("krc1."),l=e.readCredentials().runnerTokenPrefix?.startsWith("krc1.");return{id:"callback_auth",label:"Callback auth / config",checks:[{id:"callback_base_url",label:"Callback base URL configured",status:n?o?"warn":"pass":"fail",summary:n?o?`Using legacy OPENCLAW_CRON_FIRE_BASE_URL (${n})`:n:"No KYNVER_API_URL, config apiBaseUrl, or legacy OpenClaw base URL",remediation:n?o?"Migrate to KYNVER_API_URL or `kynver setup --api-base-url` and drop OPENCLAW_CRON_FIRE_BASE_URL.":void 0:"Set KYNVER_API_URL or run `kynver setup --api-base-url https://\u2026`.",details:{source:t.kynverApiUrl?"KYNVER_API_URL":r.apiBaseUrl?"config.apiBaseUrl":t.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL":"none",baseUrl:n??null}},{id:"callback_auth_mode",label:"Callback auth uses scoped runner token",status:i||l?"pass":s?"warn":"fail",summary:i?"KYNVER_RUNNER_TOKEN scoped token will be sent as X-Kynver-Runner-Token":l?"Saved krc1.* token in ~/.kynver/credentials":s?"Deployment-level KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET in use (legacy headers)":"No callback secret configured",remediation:i||l?void 0:"Mint a scoped token: `kynver runner credential --agent-os-id <id>`. Avoid shared OPENCLAW_CRON_SECRET on user runners.",details:{mode:i||l?"scoped":s?"legacy_global_secret":"missing",legacyHeadersWhenNotScoped:["X-OpenClaw-Cron-Secret","X-Kynver-Runtime-Secret"]}}]}}function UD(e){let r=e.envSnapshot(),t=e.loadConfig(),n=e.readCredentials(),o=e.harnessRoot(),s=e.legacyOpenclawHarnessRoot(),i=Ee(o),a=Ee(s),l=r.opusHarnessRoot?Ee(r.opusHarnessRoot):null,u=o===s&&e.pathExists(s),c=t.agentOsId?.trim(),d=r.kynverRunnerTokenPrefix,p=n.runnerTokenPrefix,m=n.runnerTokenAgentOsId,f=!!p&&(!c||!m||m===c),g=!!d?.startsWith("krc1.")||f&&!!p?.startsWith("krc1.");return{id:"openclaw_hotspots",label:"OpenClaw dependency hotspots",checks:[{id:"hotspot_legacy_harness_root",label:"Legacy ~/.openclaw/harness still active",status:u?"warn":"pass",summary:u?`Harness root is legacy ${a}`:r.opusHarnessRoot?`OPUS_HARNESS_ROOT override in use (${l})`:`Using ${i}`,remediation:u?"Set KYNVER_HARNESS_ROOT=~/.kynver/harness (or run setup), migrate artifacts, retire OPUS_HARNESS_ROOT.":r.opusHarnessRoot?"Prefer KYNVER_HARNESS_ROOT over OPUS_HARNESS_ROOT.":void 0,details:{harnessRoot:i,legacyRoot:a,opusHarnessRoot:l}},{id:"hotspot_openclaw_env_secrets",label:"OpenClaw deployment secrets in runner env",status:r.openclawCronSecret||r.openclawCronFireBaseUrl?"warn":"pass",summary:r.openclawCronSecret||r.openclawCronFireBaseUrl?[r.openclawCronSecret?"OPENCLAW_CRON_SECRET set":null,r.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL set":null].filter(Boolean).join("; "):"No OpenClaw cron env overrides on this runner",remediation:r.openclawCronSecret||r.openclawCronFireBaseUrl?"Move to KYNVER_API_URL + scoped runner tokens; unset OpenClaw cron env on user-hosted runners.":void 0},ev(r,{agentOsId:c??null,apiBaseUrl:t.apiBaseUrl?.trim()??r.kynverApiUrl??null,hasScopedRunnerToken:g,deploymentSchedulerProvider:t.deploymentSchedulerProvider==="qstash"||t.deploymentSchedulerProvider==="kynver-cron"||t.deploymentSchedulerProvider==="openclaw-cron"?t.deploymentSchedulerProvider:void 0}),{id:"hotspot_lease_source_names",label:"Harness lease/completion source names",status:"pass",summary:"Runtime uses kynver-harness:* lease owners and completion source kynver-harness (OpenClaw names retired in runtime)",details:{leaseOwnerPattern:"kynver-harness:<runId>",completionSource:"kynver-harness",note:"OpenClaw adapter remains optional in packages/kynver-openclaw-agent-os only"}}]}}function iv(e=XR){let r=[AD(e),OD(e),ND(e),TD(e),DD(e),MD(e),tv(e),UD(e)],t=ID(r),n=t.fail===0,o=n?t.warn>0?`Ready with ${t.warn} warning(s) \u2014 review remediation before retiring OpenClaw as primary runtime agent.`:"Ready \u2014 Kynver runtime can serve as primary runtime agent on this host.":`${t.fail} blocking check(s) \u2014 fix failures before OpenClaw takeover.`;return{command:"doctor runtime-takeover",ready:n,summary:o,counts:t,sections:r}}function av(e={}){let r=[];if(e.remediate===!0||e.remediate==="true"){let n=rn();n.updated?r.push(`Remediated config fields: ${n.fields.join(", ")}`):r.push("Config backfill: no unambiguous legacy fields to persist"),n.skippedAmbiguous.length>0&&r.push(`Skipped ambiguous identity: ${n.skippedAmbiguous.join("; ")}`)}if(e.remediateDefaultRepo===!0){let n=vo();if(!n.ok){console.error(n.reason??"defaultRepo remediation failed"),n.remediation&&console.error(n.remediation),process.exitCode=1;return}n.remediated?r.push(`Remediated defaultRepo \u2192 ${n.resolved?.defaultRepo??"unknown"}`):r.push(`defaultRepo already persisted (${n.resolved?.defaultRepo??"unknown"})`)}let t=iv();r.length>0&&(t.notes=[...t.notes??[],...r]),console.log(JSON.stringify(t,null,2)),t.ready||(process.exitCode=1)}A();import{existsSync as ms,readFileSync as dv}from"node:fs";import{homedir as WD}from"node:os";import Hc from"node:path";import{spawnSync as LD}from"node:child_process";var lv="24.11.0",ps=">=24.11.0";function Lc(e){let r=e.trim().replace(/^v/,""),t=/^(\d+)\.(\d+)\.(\d+)$/.exec(r);return t?{major:Number(t[1]),minor:Number(t[2]),patch:Number(t[3])}:null}function uv(e,r){return e.major!==r.major?e.major-r.major:e.minor!==r.minor?e.minor-r.minor:e.patch-r.patch}function BD(e){let r=e.trim().split(/\s+/),t=null,n=null;for(let o of r)if(o.startsWith(">="))t=Lc(o.slice(2));else if(o.startsWith("<")){let s=o.slice(1);n=Lc(s)??(/^\d+$/.test(s)?{major:Number(s),minor:0,patch:0}:null)}if(!t)throw new Error(`Unsupported node policy range: ${e}`);return{floor:t,below:n}}function Bn(e,r=ps){let{floor:t,below:n}=BD(r),o=Lc(e);if(!o)return{status:"invalid_version",currentVersion:e.trim(),requiredRange:r,remediation:`Node version could not be parsed as X.Y.Z (prereleases are unsupported). Install Node ${lv} or a later release within the supported range.`};let s=`${o.major}.${o.minor}.${o.patch}`;return uv(o,t)<0?{status:"upgrade_required",currentVersion:s,requiredRange:r,remediation:`Upgrade Node to >=${lv}. See docs/runbooks/node-24-fleet-migration.md for the per-host procedure.`}:n&&uv(o,n)>=0?{status:"unsupported_major",currentVersion:s,requiredRange:r,remediation:`Node ${o.major}.x is newer than this artifact's qualified range (${r}). Use a qualified Node major or wait for the next runtime qualification.`}:{status:"compatible",currentVersion:s,requiredRange:r,remediation:null}}Ge();var pv=Hc.join(WD(),".kynver"),hQ=Hc.join(pv,"config.json"),_t=Hc.join(pv,"credentials"),cv=(()=>{let e=process.env.KYNVER_DAEMON_STALL_MS?.trim(),r=e?parseInt(e,10):NaN;return Number.isFinite(r)&&r>0?r:900*1e3})();function HD(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function Wn(e){return e.checks.some(r=>r.status==="fail")}function FD(e){try{let r=LD(process.platform==="win32"?"where":"which",[e],{encoding:"utf8",timeout:3e3});return r.status===0&&!!r.stdout?.trim()}catch{return!1}}function KD(){if(!ms(_t))return{hasApiKey:!1};try{let e=JSON.parse(dv(_t,"utf8"));return{hasApiKey:!!e.apiKey?.trim(),runnerToken:e.runnerToken?.trim()||void 0,runnerTokenAgentOsId:e.runnerTokenAgentOsId?.trim()||void 0}}catch{return{hasApiKey:!1}}}function $D(){let e=FD("kynver"),r=Bn(process.versions.node);return{id:"stage_1_install",label:"Stage 1 \u2014 Install",checks:[{id:"install_package_version",label:"@kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${ze} is running`,details:{version:ze}},{id:"install_node_runtime_policy",label:"Node runtime policy (report-only)",status:r.status==="compatible"?"pass":"warn",summary:r.status==="compatible"?`Node ${r.currentVersion} satisfies ${r.requiredRange}`:`Node ${r.currentVersion} \u2192 ${r.status} against ${r.requiredRange} (advisory during rollout)`,remediation:r.remediation??void 0,details:{status:r.status,requiredRange:r.requiredRange}},{id:"install_on_path",label:"kynver executable on PATH",status:e?"pass":"warn",summary:e?"kynver found on PATH \u2014 global install confirmed":"kynver not on PATH \u2014 running via node/npx (fine for first-timers)",remediation:e?void 0:"Install globally for a shorter command: `npm install -g @kynver-app/runtime`",details:{onPath:e}}]}}function jD(e,r){return{id:"stage_2_login",label:"Stage 2 \u2014 Device Login",checks:[{id:"login_credentials_file",label:"Credentials file present",status:ms(_t)?"pass":"fail",summary:ms(_t)?`${V(_t)} exists`:`${V(_t)} missing \u2014 not logged in`,remediation:ms(_t)?void 0:r?`kynver login --api-base-url ${r}`:"kynver login --api-base-url https://your-kynver-site"},{id:"login_api_key",label:"API key present",status:e.hasApiKey?"pass":"fail",summary:e.hasApiKey?"API key found in credentials":"No API key \u2014 device login not completed",remediation:e.hasApiKey?void 0:r?`kynver login --api-base-url ${r}`:"kynver login --api-base-url https://your-kynver-site"}]}}function VD(e,r){return{id:"stage_3_workspace",label:"Stage 3 \u2014 Workspace Binding",checks:[{id:"workspace_api_base_url",label:"API base URL configured",status:r?"pass":"fail",summary:r?`apiBaseUrl = ${r}`:"apiBaseUrl not set \u2014 bootstrap required",remediation:r?void 0:"kynver bootstrap --api-base-url https://your-kynver-site",details:{apiBaseUrl:r??null}},{id:"workspace_agent_os_id",label:"AgentOS workspace bound",status:e?"pass":"fail",summary:e?`Workspace ${e} bound`:"agentOsId not set \u2014 workspace not bound",remediation:e?void 0:r?`kynver bootstrap --api-base-url ${r}`:"kynver bootstrap --api-base-url https://your-kynver-site",details:{agentOsId:e??null}}]}}function GD(e){let r=R(),t=Le({config:r}),n=!!t?.repo,o=!!t?.persistedInConfig,s=[{id:"repo_configured",label:"Default repo configured",status:n?"pass":"fail",summary:n?o?`${V(t.repo)} (from config)`:`${V(t.repo)} (discovered \u2014 not persisted yet)`:"No default repo \u2014 kynver start requires --repo or a configured path",remediation:n?o?void 0:"kynver config ensure-default-repo":"kynver setup --repo /path/to/your/repo",details:{defaultRepo:t?.repo??null,source:t?.source??null,persistedInConfig:o}}];return n&&!o&&s.push({id:"repo_persisted",label:"Default repo persisted in ~/.kynver/config.json",status:"warn",summary:`Repo discovered via ${t?.source} but not saved to config \u2014 may not survive env changes`,remediation:"kynver config ensure-default-repo"}),{id:"stage_4_repo",label:"Stage 4 \u2014 Repo Selection",checks:s}}function YD(e,r){let t=e.runnerToken,n=!!t?.startsWith("krc1."),o=e.runnerTokenAgentOsId,s=!r||!o||o===r,i=[{id:"credential_scoped_token",label:"Scoped runner token (krc1.*) present",status:n?"pass":"fail",summary:n?`Scoped token present (krc1.\u2026 for ${o??r??"workspace"})`:t?"Runner token present but not a krc1.* scoped token \u2014 re-mint required":"No runner token \u2014 mint one with `kynver runner credential`",remediation:n?void 0:r?`kynver runner credential --agent-os-id ${r}`:"kynver runner credential --agent-os-id <your-agent-os-id>",details:{hasToken:!!t,isScoped:n,tokenAgentOsId:o??null}}];return n&&!s&&i.push({id:"credential_workspace_match",label:"Runner token matches configured workspace",status:"warn",summary:`Token is for workspace ${o}, config expects ${r}`,remediation:r?`kynver runner credential --agent-os-id ${r}`:void 0,details:{tokenAgentOsId:o??null,configAgentOsId:r??null}}),{id:"stage_5_credential",label:"Stage 5 \u2014 Runner Credential",checks:i}}function JD(e){if(!e)return{id:"stage_6_daemon",label:"Stage 6 \u2014 Supervised Daemon",checks:[{id:"daemon_workspace_required",label:"Workspace required for daemon liveness check",status:"warn",summary:"agentOsId not set \u2014 cannot locate heartbeat file; complete stage 3 first"}]};let r=si(e),t=ms(r),n=!1,o=null,s=null;if(t)try{let a=JSON.parse(dv(r,"utf8"));a.observedAt&&(o=Date.now()-new Date(a.observedAt).getTime(),n=o<cv),s=a.pid??null}catch{}let i=[{id:"daemon_running",label:"Daemon running (heartbeat present)",status:t?"pass":"warn",summary:t?`Heartbeat file found: ${V(r)}`:`No heartbeat file at ${V(r)} \u2014 daemon not started`,remediation:t?void 0:"kynver start",details:{heartbeatPath:V(r),exists:t}}];return t&&i.push({id:"daemon_heartbeat_fresh",label:"Daemon heartbeat fresh",status:n?"pass":"warn",summary:n?`Last beat ${Math.round((o??0)/1e3)}s ago (pid ${s??"?"})`:o!==null?`Heartbeat is ${Math.round(o/6e4)}m old \u2014 daemon may be stalled`:"Cannot parse heartbeat timestamp",remediation:n?void 0:"kynver start  # keeper will respawn the daemon",details:{ageMs:o,stallThresholdMs:cv,pid:s}}),{id:"stage_6_daemon",label:"Stage 6 \u2014 Supervised Daemon",checks:i}}function mv(){let e=R(),r=KD(),t=e.agentOsId?.trim()||void 0,n=e.apiBaseUrl?.trim()||process.env.KYNVER_API_URL?.trim()||void 0,o=$D(),s=jD(r,n),i=VD(t,n),a=GD(t),l=YD(r,t),u=JD(t),c=[o,s,i,a,l,u],d=HD(c),p=0;Wn(o)||(p=1),p>=1&&!Wn(s)&&(p=2),p>=2&&!Wn(i)&&(p=3),p>=3&&!Wn(a)&&(p=4),p>=4&&!Wn(l)&&(p=5),p>=5&&!Wn(u)&&(p=6);let m=p>=5,f={0:"not started",1:"installed",2:"logged in",3:"workspace bound",4:"repo selected",5:"ready (credential minted)",6:"fully operational (daemon running)"},g=m?p===6?"Fully operational \u2014 daemon running with supervised respawn.":`Ready \u2014 runner at stage ${p} (${f[p]}). Run \`kynver start\` to bring the daemon online.`:`Lifecycle at stage ${p} (${f[p]}). ${d.fail} blocking check(s) \u2014 see remediation hints above.`;return{command:"doctor runner-install",ready:m,lifecycleStage:p,summary:g,counts:d,sections:c}}function fv(){let e=mv();console.log(JSON.stringify(e,null,2)),e.ready||(process.exitCode=1)}function gv(e){let r=e?.identity??oi(),t=e?.nodeVersion??process.env.KYNVER_NODE_POLICY_TEST_VERSION?.trim()??r.nodeVersion,n=e?.requiredRange??ps,o=Bn(t,n);return{command:"doctor node-runtime",contractVersion:1,nodeVersion:o.currentVersion,requiredRange:n,status:o.status,remediation:o.remediation,platform:r.platform,arch:r.arch,runtimePackageVersion:ze,buildIdentity:r.buildIdentity}}function hv(){let e=gv();console.log(JSON.stringify(e,null,2))}A();function Fc(e,r){let t=e;return r&&(t=t.split(r).join("[REDACTED_SECRET]")),t=t.replace(/kynver_[a-z0-9_]+/gi,"[REDACTED_KYNVER_TOKEN]"),t=t.replace(/sk-[a-zA-Z0-9_-]+/g,"[REDACTED_API_KEY]"),t}A();function kv(e){let r={Accept:"application/json"};return e?.trim()&&(r.Authorization=`Bearer ${e.trim()}`),r}async function Kc(e,r,t=3e4){let n=new AbortController,o=setTimeout(()=>n.abort(),t);try{let s=await fetch(e,{...r,signal:n.signal}),i=null;try{i=await s.json()}catch{i=null}return{ok:s.ok,status:s.status,response:i}}catch(s){return{ok:!1,status:0,response:{error:s instanceof Error?s.message:String(s)}}}finally{clearTimeout(o)}}function yv(){return{loadConfig(){let e=R(),r=e.agentOsSlug?.trim()??"",t=e.agentOsId?.trim()??"",n=W(e.apiBaseUrl),o=q();return{slug:r,agentOsId:t,baseUrl:n,apiKey:o}},async resolveRunnerSecret(e,r){try{return await G(void 0,e,{baseUrl:r})}catch{return null}},fetchContextEnvelope(e,r,t){let n=new URLSearchParams({anchorType:r,anchorId:t,mode:"routine"}),o=`${e.baseUrl}/api/agent-os/${encodeURIComponent(e.slug)}/context-envelope?${n.toString()}`;return Kc(o,{method:"GET",headers:kv(e.apiKey)})},fetchTasks(e,r=25){let t=new URLSearchParams({limit:String(r)}),n=`${e.baseUrl}/api/agent-os/${encodeURIComponent(e.slug)}/tasks?${t.toString()}`;return Kc(n,{method:"GET",headers:kv(e.apiKey)})},fetchRetrieveTelemetryDiagnostic(e){let r=e.runnerSecret;if(!r)return Promise.resolve({ok:!1,status:0,response:{error:"runner secret unavailable"}});let t=`${e.baseUrl}/api/agent-os/by-id/${encodeURIComponent(e.agentOsId)}/diagnostics?slug=context-envelope-retrieve-telemetry`;return Kc(t,{method:"GET",headers:De(r)})}}}var Rv="00000000-0000-4000-8000-000000000001";function $c(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function qD(e){return e.checks.some(r=>r.status==="fail")}function pe(e){return e&&typeof e=="object"?e:null}function z(e){return typeof e=="string"&&e.trim()?e.trim():null}function fs(e){return typeof e=="boolean"?e:null}function Oa(e){return typeof e=="number"&&Number.isFinite(e)?e:null}function gs(e){return Array.isArray(e)?e:[]}function zD(e){let r=pe(e),t=gs(r?.items);if(t.length===0)return null;let n=t.map(s=>{let i=pe(s);if(!i)return null;let a=z(i.id);return a?{taskId:a,personaSlug:z(i.personaSlug),title:z(i.title)}:null}).filter(s=>s!==null);return n.find(s=>s.personaSlug)??n[0]??null}function XD(e){let r=pe(e.envelope.anchor)??{},t=pe(e.envelope.persona),n=pe(e.envelope.resultContract)??{},o=gs(e.envelope.memories),s=t?gs(t.operatingRules).length:0;return{slug:e.slug,agentOsId:e.agentOsId,taskId:e.taskId,anchor:{type:z(r.type)??"task",id:z(r.id)??e.taskId,exists:fs(r.exists)===!0,title:z(r.title),status:z(r.status)},personaSlug:z(t?.slug),memoryCount:o.length,operatingRuleCount:s,withinBudget:fs(n.withinBudget)===!0,projection:z(n.projection)??z(e.envelope.projection),mode:z(e.envelope.mode),contractVersion:z(n.contractVersion),serializedBytes:Oa(n.serializedBytes)}}function QD(e){let r=pe(e),t=pe(r?.result);if(!t)return null;let n=pe(t.detail)??{};return{slug:"context-envelope-retrieve-telemetry",status:z(t.status)??"unknown",summary:z(t.summary)??"",eventCount:Oa(n.eventCount),retrieveCount:Oa(n.retrieveCount)}}function jc(e,r){return Fc(e,r)}function ZD(e){return{id:"config",label:"Configuration",checks:[{id:"config_slug",label:"AgentOS slug",status:e.slug?"pass":"fail",summary:e.slug?`Resolved slug "${e.slug}"`:"Missing agentOsSlug \u2014 run `kynver setup --agent-os-slug \u2026`",remediation:e.slug?void 0:"Run `kynver setup --agent-os-slug ghost` (or your workspace slug)."},{id:"config_agent_os_id",label:"AgentOS id",status:e.agentOsId?"pass":"fail",summary:e.agentOsId?`Resolved agentOsId ${e.agentOsId}`:"Missing agentOsId \u2014 run `kynver setup --agent-os-id \u2026`",remediation:e.agentOsId?void 0:"Run `kynver setup` or `kynver bootstrap` to bind the workspace."},{id:"config_api_key",label:"Dashboard API key",status:e.apiKey?"pass":"fail",summary:e.apiKey?"Bearer API key present for slug context-envelope route":"Missing API key \u2014 run `kynver login`",remediation:e.apiKey?void 0:"Run `kynver login --api-key \u2026` (or device login)."},{id:"config_runner_secret",label:"Harness runner credential",status:e.runnerSecret?"pass":"warn",summary:e.runnerSecret?"Runner credential available for diagnostics probe":"No runner credential \u2014 retrieve-telemetry diagnostic will be skipped",remediation:e.runnerSecret?void 0:"Run `kynver runner credential mint` to enable diagnostics probe."}]}}function eM(e,r,t,n){if(!t.ok)return{id:r,label:e,status:"fail",summary:jc(`GET context-envelope failed: HTTP ${t.status||"network"}`,n),details:{httpStatus:t.status}};let o=pe(t.response);return o?{id:r,label:e,status:"pass",summary:"Context-envelope GET succeeded",details:{anchorType:z(pe(o.anchor)?.type),anchorId:z(pe(o.anchor)?.id)}}:{id:r,label:e,status:"fail",summary:"Context-envelope response was not JSON object"}}function rM(e){let r=pe(e.anchor)??{},t=fs(r.exists)===!0;return{id:"anchor_exists",label:"Anchor exists",status:t?"pass":"fail",summary:t?`anchor.exists=true (${z(r.title)??z(r.id)??"task"})`:"anchor.exists=false for the probed task \u2014 envelope cannot anchor dispatch",details:{exists:t,title:z(r.title),status:z(r.status)}}}function tM(e,r){let t=pe(e.persona),n=z(t?.slug);if(r){let o=n===r;return{id:"persona_slug",label:"Persona slug",status:o?"pass":"fail",summary:o?`persona.slug="${n}" matches task personaSlug`:`persona.slug="${n??"(null)"}" expected "${r}"`,details:{expectedPersona:r,actualPersona:n}}}return{id:"persona_slug",label:"Persona slug",status:n?"warn":"pass",summary:n?`Task has no personaSlug but envelope returned persona "${n}"`:"No persona block (task has no personaSlug)",details:{actualPersona:n}}}function nM(e){let t=gs(e.memories).length;return{id:"memory_count",label:"Memory retrieval count",status:"pass",summary:`${t} memory hit(s) in envelope`,details:{memoryCount:t}}}function oM(e){let r=pe(e.resultContract)??{},t=fs(r.withinBudget)===!0,n=Oa(r.serializedBytes);return{id:"within_budget",label:"Result contract within budget",status:t?"pass":"fail",summary:t?`resultContract.withinBudget=true${n!=null?` (${n} bytes)`:""}`:"resultContract.withinBudget=false \u2014 envelope exceeds MCP transport cap",details:{withinBudget:t,serializedBytes:n,omitted:gs(r.omitted).length}}}function sM(e,r){if(!e.ok)return{id:"missing_anchor_fail_closed",label:"Missing anchor fail-closed",status:"fail",summary:jc(`Missing-anchor probe failed: HTTP ${e.status||"network"}`,r)};let t=pe(e.response),n=pe(t?.anchor)??{},o=fs(n.exists),s=z(n.id),i=o===!1&&s===Rv;return{id:"missing_anchor_fail_closed",label:"Missing anchor fail-closed",status:i?"pass":"fail",summary:i?"Unknown anchor collapses to anchor.exists=false (no cross-workspace confirmation)":`Expected anchor.exists=false for probe id; got exists=${String(o)}`,details:{exists:o,anchorId:s}}}function iM(e,r){if(!e.ok)return{check:{id:"retrieve_telemetry",label:"Retrieve telemetry diagnostic",status:e.status===0?"warn":"fail",summary:jc(e.status===0?"Retrieve-telemetry diagnostic skipped (no runner credential)":`Diagnostics probe failed: HTTP ${e.status}`,r)},telemetry:null};let t=QD(e.response),n=t?.status??"unknown";return{check:{id:"retrieve_telemetry",label:"Retrieve telemetry diagnostic",status:n==="ok"?"pass":n==="degraded"?"warn":"fail",summary:t?.summary??"context-envelope-retrieve-telemetry returned no summary",details:t?{status:t.status,eventCount:t.eventCount,retrieveCount:t.retrieveCount}:void 0},telemetry:t}}async function vv(e={},r=yv()){let t=r.loadConfig(),n=(e.slug??t.slug).trim(),o=(e.agentOsId??t.agentOsId).trim(),s=W(e.baseUrl??t.baseUrl),i=e.apiKey??t.apiKey,a=await r.resolveRunnerSecret(o,s),l={slug:n,agentOsId:o,baseUrl:s,apiKey:i,runnerSecret:a??void 0},u=[];u.push(ZD({slug:n,agentOsId:o,apiKey:i,runnerSecret:a}));let c=null,d=null;if(!!!(n&&o&&i))return{command:"doctor context-envelope",ready:!1,summary:"Context-envelope preflight blocked \u2014 fix configuration checks first.",counts:$c(u),sections:u,envelopeSummary:c,telemetryDiagnostic:d};let m=e.taskId?.trim()||process.env.KYNVER_HARNESS_TASK_ID?.trim()||"",f=null;if(!m){let L=await r.fetchTasks(l),P=L.ok?zD(L.response):null;P&&(m=P.taskId,f=P.personaSlug)}let g={id:"anchor_resolution",label:"Task anchor",checks:[{id:"task_anchor_resolved",label:"Probe task id",status:m?"pass":"fail",summary:m?`Using task anchor ${m}`:"No task id \u2014 pass --task-id or ensure board has tasks",remediation:m?void 0:"Pass --task-id <uuid> or create a board task to probe.",details:m?{taskId:m,expectedPersona:f}:void 0}]};if(u.push(g),!m)return{command:"doctor context-envelope",ready:!1,summary:"Context-envelope preflight blocked \u2014 no task anchor to probe.",counts:$c(u),sections:u,envelopeSummary:c,telemetryDiagnostic:d};let k=await r.fetchContextEnvelope(l,"task",m),h=[eM("Live task envelope","envelope_fetch",k,a??void 0)],y=pe(k.response);if(k.ok&&y){if(!f){let L=pe(y.task);f=z(L?.personaSlug)}c=XD({slug:n,agentOsId:o,taskId:m,envelope:y}),h.push(rM(y),tM(y,f),nM(y),oM(y))}let b=await r.fetchContextEnvelope(l,"task",Rv);h.push(sM(b,a??void 0)),u.push({id:"envelope",label:"Context envelope",checks:h});let E=await r.fetchRetrieveTelemetryDiagnostic(l),_=iM(E,a??void 0);d=_.telemetry,u.push({id:"telemetry",label:"Retrieval telemetry",checks:[_.check]});let I=$c(u),F=!u.some(qD),ee=F?`Context-envelope preflight passed for task ${m} (${c?.memoryCount??0} memories, withinBudget=${String(c?.withinBudget??!1)}).`:"Context-envelope preflight failed \u2014 see failing checks.";return{command:"doctor context-envelope",ready:F,summary:ee,counts:I,sections:u,envelopeSummary:c,telemetryDiagnostic:d}}function bv(e,r){let t=n=>Fc(n,r);return{...e,summary:t(e.summary),sections:e.sections.map(n=>({...n,checks:n.checks.map(o=>({...o,summary:t(o.summary),remediation:o.remediation?t(o.remediation):void 0}))})),envelopeSummary:e.envelopeSummary,telemetryDiagnostic:e.telemetryDiagnostic?{...e.telemetryDiagnostic,summary:t(e.telemetryDiagnostic.summary)}:null}}async function Sv(e){let r=await vv({slug:e.slug?String(e.slug):void 0,agentOsId:e.agentOsId?String(e.agentOsId):void 0,baseUrl:e.baseUrl?String(e.baseUrl):void 0,taskId:e.taskId?String(e.taskId):void 0,apiKey:e.apiKey?String(e.apiKey):void 0}),t=bv(r);console.log(JSON.stringify(t,null,2)),t.ready||(process.exitCode=1)}A();async function wv(e){let r=R(),t=(e.agentOsId?String(e.agentOsId):r.agentOsId)||"";t||(console.error("requires --agent-os-id or agentOsId in ~/.kynver/config.json"),process.exit(1));let n=W(e.baseUrl?String(e.baseUrl):r.apiBaseUrl),o=await G(e.secret?String(e.secret):void 0,t,{baseUrl:n}),s=new URLSearchParams;if(typeof e.since=="string"&&e.since.trim()&&s.set("since",e.since.trim()),e.limit!=null&&String(e.limit).trim()){let u=Number(e.limit);Number.isFinite(u)&&u>0&&s.set("limit",String(Math.floor(u)))}let i=s.toString()?`?${s.toString()}`:"",a=`${n}/api/agent-os/by-id/${encodeURIComponent(t)}/command-center/dashboard-contract${i}`,l=await cn(a,o);l.ok||(console.error(`dashboard-contract GET failed: HTTP ${l.status}`),l.response&&console.error(JSON.stringify(l.response,null,2)),process.exit(1)),console.log(JSON.stringify(l.response,null,2))}Ge();var Vc=["Vercel/hosted: set KYNVER_SCHEDULER_PROVIDER=qstash","Vercel/hosted: ensure QSTASH_TOKEN (and QStash signing keys) are configured","Vercel/hosted: unset OPENCLAW_CRON_STORE_PATH if present"],Gc=["User runner: unset KYNVER_SCHEDULER_PROVIDER (scheduling is deployment-owned)","User runner: unset OPENCLAW_CRON_STORE_PATH, OPENCLAW_CRON_SECRET, OPENCLAW_CRON_FIRE_BASE_URL",'User runner: after deployment cutover, run `kynver scheduler attest-cutover` (or set deploymentSchedulerProvider to "qstash" in ~/.kynver/config.json)',"Verify: kynver doctor runtime-takeover \u2014 hotspot_openclaw_scheduler should pass"];function aM(e=process.env){return{kynverSchedulerProvider:e.KYNVER_SCHEDULER_PROVIDER?.trim()||null,kynverCronStorePath:e.KYNVER_CRON_STORE_PATH?.trim()||e.OPENCLAW_CRON_STORE_PATH?.trim()||null,kynverCronSecret:!!(e.KYNVER_CRON_SECRET?.trim()||e.OPENCLAW_CRON_SECRET?.trim()),kynverCronFireBaseUrl:e.KYNVER_CRON_FIRE_BASE_URL?.trim()||e.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||null,openclawCronStorePath:e.OPENCLAW_CRON_STORE_PATH?.trim()||null,openclawCronSecret:!!e.OPENCLAW_CRON_SECRET?.trim(),openclawCronFireBaseUrl:e.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||null}}function Yc(e,r=aM()){let t=[];return r.kynverSchedulerProvider==="openclaw-cron"&&t.push("Runner still has KYNVER_SCHEDULER_PROVIDER=openclaw-cron"),r.kynverCronStorePath&&r.kynverSchedulerProvider!=="kynver-cron"&&t.push("Runner has KYNVER_CRON_STORE_PATH but KYNVER_SCHEDULER_PROVIDER is not kynver-cron \u2014 use `kynver daemon` cron tick or unset the store for QStash-only runners"),r.openclawCronStorePath&&!r.kynverCronStorePath&&t.push("Runner still has legacy OPENCLAW_CRON_STORE_PATH (prefer KYNVER_CRON_STORE_PATH)"),e.deploymentSchedulerProvider==="openclaw-cron"&&t.push("~/.kynver/config.json deploymentSchedulerProvider is still openclaw-cron"),{ok:t.length===0,blockers:t,runnerEnv:r,deploymentSchedulerProvider:e.deploymentSchedulerProvider??null,deploymentSteps:[...Vc],runnerSteps:[...Gc]}}function Cv(e){return{...e,deploymentSchedulerProvider:"qstash"}}A();import lM from"node:path";import{homedir as uM}from"node:os";var xv=lM.join(uM(),".kynver","config.json");function _v(e=!1){let r=R(),t=Yc(r),n={...t,configPath:V(xv),configAttestationExample:{deploymentSchedulerProvider:"qstash"}};if(e){console.log(JSON.stringify(n,null,2)),t.ok||(process.exitCode=1);return}console.log(`AgentOS scheduler provider cutover checklist
 `),console.log("Deployment (Vercel):");for(let o of Vc)console.log(`  - ${o}`);console.log(`
 User runner:`);for(let o of Gc)console.log(`  - ${o}`);if(console.log(`
 This host:`),console.log(`  config: ${n.configPath}`),console.log(`  deploymentSchedulerProvider: ${t.deploymentSchedulerProvider??"(unset)"}`),console.log(`  KYNVER_SCHEDULER_PROVIDER: ${t.runnerEnv.kynverSchedulerProvider??"(unset)"}`),console.log(`  KYNVER_CRON_STORE_PATH: ${t.runnerEnv.kynverCronStorePath??"(unset)"}`),console.log(`  OPENCLAW_CRON_STORE_PATH (legacy): ${t.runnerEnv.openclawCronStorePath??"(unset)"}`),t.blockers.length){console.log(`

package/dist/context-preview/chat-memory-preview.d.ts

@@ -0,0 +1,33 @@
+/** Shared with app memory-retrieval.constants — single source for MCP + server preview blocks. */
+export declare const MEMORY_LANE_PREVIEW_CHARS = 160;
+export interface ContextPreviewMemoryItem {
+    slug: string;
+    lane?: string | null;
+    trust?: string | null;
+    contentPreview: string;
+    selectedBecause?: string | null;
+    expansionRoute?: string | null;
+    expandable?: boolean;
+}
+export interface ContextPreviewBlockInput {
+    sectionTitle: string;
+    items: ContextPreviewMemoryItem[];
+    emptyFallback?: string;
+    previewCharsPerItem?: number;
+}
+/** Compact preview block — handles-first, never full memory bodies. */
+export declare function formatContextPreviewMemoryBlock(input: ContextPreviewBlockInput): string;
+export declare function chatMemoriesToPreviewItems(memories: {
+    content: string;
+    similarity?: number;
+}[]): ContextPreviewMemoryItem[];
+/** Legacy chat memory block — flag-invariant (PR1 baseline capture, diagnostics). */
+export declare function buildLegacyChatMemorySection(memories: {
+    content: string;
+    similarity?: number;
+}[]): string;
+/** Shadow chat preview — ignores dark flag (diagnostics / MCP comparison). */
+export declare function buildChatMemoryShadowPreview(memories: {
+    content: string;
+    similarity?: number;
+}[]): string;

package/dist/index.d.ts

@@ -21,6 +21,7 @@ export { assessExitedWorkerSalvage, type ExitedSalvageAssessment, type ExitedSal
 export { persistExitedWorkerHandoffCapture, resolveExitedWorkerFinalResult, type ExitedHandoffCapture, type ExitedHandoffCaptureSource, } from "./exited-worker-handoff-capture.js";
 export { buildPrompt, buildPromptWithReceipt, RUNTIME_PROMPT_ENFORCEMENT, type BuildPromptInput, } from "./prompt.js";
 export { RUNTIME_CONTEXT_BUDGET_RECEIPT_SCHEMA_VERSION, RUNTIME_CONTEXT_BUDGET_RECEIPT_V2_SCHEMA_VERSION, buildContextBudgetReceiptV2, estimateTokensFromChars, finalizeReceiptTotals, isRuntimeContextBudgetReceiptV2, sectionReceiptFromMarkdown, upgradeReceiptToV2, type BuildContextBudgetReceiptV2Input, type ContextBudgetReceiptSurface, type ContextEnvelopeMode, type RuntimeContextActiveStateLookup, type RuntimeContextActiveStateLookupKind, type RuntimeContextActiveStateLookupStatus, type RuntimeContextBudgetReceipt, type RuntimeContextBudgetReceiptSchemaVersion, type RuntimeContextBudgetReceiptV2, type RuntimeContextRehydrationKind, type RuntimeContextRehydrationRoute, type RuntimeContextSection, type RuntimeContextSectionReceipt, type UsefulContextCoverage, } from "./context-budget-receipt.js";
+export { MEMORY_LANE_PREVIEW_CHARS, buildChatMemoryShadowPreview, buildLegacyChatMemorySection, chatMemoriesToPreviewItems, formatContextPreviewMemoryBlock, type ContextPreviewBlockInput, type ContextPreviewMemoryItem, } from "./context-preview/chat-memory-preview.js";
 export { canonicalJsonStringify, computeInstructionBundleVersion, deriveInstructionBundleKeyId, parseRawEd25519Key, isSignedInstructionBundleShape, PINNED_INSTRUCTION_BUNDLE_PUBLIC_KEYS, resolveInstructionBundlePublicKey, verifyInstructionBundleSignatureWithKey, verifySignedInstructionBundle, EMBEDDED_INSTRUCTION_BUNDLE, EMBEDDED_INSTRUCTION_BUNDLE_VERSION, getActiveInstructionBundle, getActiveInstructionBundleSource, getActiveInstructionBundleVersion, setActiveInstructionBundle, resolveInstructionText, resolvePolicyThreshold, resolveBundlePersona, ensureInstructionBundle, instructionBundleCachePath, loadInstructionBundleCache, saveInstructionBundleCache, INSTRUCTION_BUNDLE_REFRESH_TTL_MS, type InstructionBundle, type InstructionBundleContent, type InstructionBundlePersona, type SignedInstructionBundle, type InstructionBundleSource, type InstructionBundleVerifyResult, type EnsureInstructionBundleOptions, type EnsureInstructionBundleResult, } from "./instruction-bundle/index.js";
 export { WORKER_PERSONA_CATALOG, getWorkerPersonaCatalogEntry, getPersonaDispatchLane, getPersonaDefaultRoleLane, isKnownWorkerPersonaSlug, workerPersonaReviewSlugs, workerPersonaLandingSlugs, type WorkerPersonaCatalogEntry, type WorkerPersonaCatalogSlug, type WorkerPersonaDispatchLane, type WorkerPersonaDefaultRoleLane, } from "./worker-persona-catalog.js";
 export { assessPrHandoffRequirement, ensurePrReadyHandoff, extractPrUrlFromText, } from "./pr-handoff/index.js";