@kynver-app/runtime 0.2.118 → 0.2.127

package/dist/server/orchestration.js

@@ -1 +1,65 @@
-import{existsSync as ie}from"node:fs";import{homedir as se}from"node:os";import ae from"node:path";import{createHash as M}from"node:crypto";import{statSync as ne}from"node:fs";import{spawnSync as H}from"node:child_process";import{existsSync as Y,readFileSync as G}from"node:fs";import p from"node:path";var _=class extends Error{constructor(t){super(`${t} is a batch file that is not a Node CLI shim; it cannot be spawned without a shell. Point the matching KYNVER_*_BIN setting at the real .exe or the CLI's JS entry, or run the daemon inside WSL.`);this.shimPath=t;this.name="UnresolvableWindowsShimError"}shimPath},X=".COM;.EXE;.BAT;.CMD";function q(e){return e.includes("/")||e.includes("\\")}function Q(e){return(e.PATHEXT||X).split(";").map(r=>r.trim().toLowerCase()).filter(r=>r.startsWith("."))}function Z(e){let r=Object.keys(e).find(t=>t.toUpperCase()==="PATH");return r?e[r]??"":""}function ee(e,r={}){let t=r.env??process.env,o=r.exists??Y,n=Q(t),i=p.win32.extname(e)!=="",s=a=>i?[a]:n.map(c=>`${a}${c}`);if(q(e)||p.win32.isAbsolute(e))return s(e).find(a=>o(a))??null;for(let a of Z(t).split(";").map(c=>c.trim()).filter(Boolean)){let c=s(p.win32.join(a,e)).find(m=>o(m));if(c)return c}return null}var D=/%~?dp0%?\\?([^"%\r\n]+?\.(?:c|m)?js)\b/i,re=/^\s*SET\s+"?([A-Za-z_]\w*)=([^"\r\n]*)"?\s*$/i;function B(e){return e.replace(/^[\\/]+/,"")}function te(e){let r=e.split(/\r?\n/),t=new Map;for(let i of r){let s=re.exec(i);s&&t.set(s[1].toUpperCase(),s[2])}let o=r.filter(i=>i.includes("%*")).pop();if(!o)return null;let n=D.exec(o);if(n)return B(n[1]);for(let i of o.matchAll(/%([A-Za-z_]\w*)%/g)){let s=t.get(i[1].toUpperCase()),a=s?D.exec(s):null;if(a)return B(a[1])}return null}function oe(e,r={}){if((r.platform??process.platform)!=="win32")return{executable:e,prefixArgs:[],kind:"passthrough"};let o=ee(e,r);if(!o)return{executable:e,prefixArgs:[],kind:"passthrough"};let n=p.win32.extname(o).toLowerCase();if(n!==".cmd"&&n!==".bat")return{executable:o,prefixArgs:[],kind:"exe"};let i=r.readText??(z=>G(z,"utf8")),s=r.exists??Y,a;try{a=i(o)}catch{throw new _(o)}let c=te(a);if(!c)throw new _(o);let m=p.win32.dirname(o),K=p.win32.join(m,c);if(!s(K))throw new _(o);let L=p.win32.join(m,"node.exe");return{executable:s(L)?L:r.nodeExecutable??process.execPath,prefixArgs:[K],kind:"node-shim"}}function R(e,r,t={}){let o=oe(e,t);return[o.executable,[...o.prefixArgs,...r]]}function l(e){try{let r=ne(e),t=`${e}|${r.size}|${r.mtimeMs}`;return M("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function h(e){return M("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,r){for(let t of r){let o=process.env[t]?.trim();if(o)return o}return e}function u(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r),s=H(n,i,{windowsHide:!0,encoding:"utf8",timeout:o,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(s.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let a=(s.stderr||s.stdout||"").trim(),c=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:a?`${c}: ${a.slice(0,200)}`:c}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function A(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r);return H(n,i,{windowsHide:!0,stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var ce="claude";function ue(){let e=se();return[ae.join(e,".claude",".credentials.json")]}function U(e=new Date().toISOString()){let r=d(ce,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:h("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=u(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=ue().find(s=>ie(s)),n=A(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(n.ok||!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?l(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as le}from"node:fs";import{homedir as de}from"node:os";import S from"node:path";var pe="codex";function fe(){let e=de();return[process.env.CODEX_HOME?.trim()?S.join(S.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,S.join(e,".codex","auth.json"),S.join(e,".config","codex","auth.json")].filter(t=>!!t)}function me(e){return S.dirname(e)}function he(e){let r,t;for(let o of fe()){if(!le(o))continue;r??=o;let n=u(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:me(o)}});if(t??=n,n.ok)return{authPath:o,login:n}}return{authPath:r,login:t??u(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function j(e=new Date().toISOString()){let r=d(pe,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:h("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:o}=he(r),n=!!t&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:t?l(t):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as ge}from"node:fs";import{homedir as Ee}from"node:os";import y from"node:path";function _e(){let e=process.env.HERMES_HOME?.trim(),r=e?y.resolve(e):y.join(Ee(),".hermes");return y.join(r,"auth.json")}function x(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=u(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=_e(),n=ge(o),i=A(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?l(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function $(e=new Date().toISOString()){let r=j(e);if(r.ready)return{...r,path:"codex_cli"};let t=x(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as be}from"node:fs";import{homedir as ke}from"node:os";import E from"node:path";import{closeSync as Dr,existsSync as Pe,mkdirSync as Br,openSync as Yr,statSync as Mr,unlinkSync as Hr}from"node:fs";import g from"node:path";function v(e=process.platform){return e!=="win32"}var Se=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Ar=new Set(Se);var Oe=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],xr=new Set(Oe);import{existsSync as O,readdirSync as Ce}from"node:fs";import f from"node:path";var Ae=/^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;function xe(e){let t=e.split("-")[0].split(".");if(t.length!==3)return null;let[o,n,i]=t;return!o||!n||!i?null:+`${o}${n.padStart(2,"0")}${i.padStart(2,"0")}`}function ve(e){let r=f.join(e,"versions");if(!O(r))return null;let t=null,o=-1;for(let n of Ce(r,{withFileTypes:!0})){if(!n.isDirectory()||!Ae.test(n.name))continue;let i=xe(n.name);i==null||i<=o||(o=i,t=f.join(r,n.name))}return t}function k(e){let r=e?.trim()||f.join(process.env.LOCALAPPDATA||"","cursor-agent"),t=f.join(r,"node.exe"),o=f.join(r,"index.js");if(O(t)&&O(o))return{nodeExe:t,indexJs:o,versionDir:r};let n=ve(r);if(!n)return null;let i=f.join(n,"node.exe"),s=f.join(n,"index.js");return!O(i)||!O(s)?null:{nodeExe:i,indexJs:s,versionDir:n}}function Re(e,r,t){return{executable:e,prefixArgs:[r],shell:!1,detached:v(),bundledVersionDir:t}}function F(e){if(process.platform==="win32"){let r=/\.(cmd|bat)$/i.test(e),t=/node\.exe$/i.test(e)&&Pe(g.join(g.dirname(e),"index.js"));if(r||t||e==="agent"){let n=r?k(g.dirname(e)):t?{nodeExe:e,indexJs:g.join(g.dirname(e),"index.js"),versionDir:g.dirname(e)}:k();if(n)return Re(n.nodeExe,n.indexJs,n.versionDir);throw new Error("Cursor Agent on Windows has no headless bundled node.exe under %LOCALAPPDATA%\\cursor-agent\\versions\\\u2026. Run `agent login` / update Cursor Agent CLI, use `--provider claude`, or set KYNVER_CURSOR_AGENT_ROOT to the cursor-agent folder.")}}return{executable:e,prefixArgs:[],shell:!1,detached:v()}}import{spawnSync as ye}from"node:child_process";function b(e,r=process.env){try{let t;try{t=F(e)}catch{t={executable:e,prefixArgs:[]}}let o=ye(t.executable,[...t.prefixArgs,"status","--format","json"],{encoding:"utf8",windowsHide:!0,timeout:8e3,env:{...r,CI:"1",NO_COLOR:"1"}});if(o.status!==0)return{ok:!1,note:"agent status: not authenticated"};let n=(o.stdout||"").trim();if(!n)return{ok:!1,note:"agent status: empty response"};let i;try{i=JSON.parse(n)}catch{return{ok:!1,note:"agent status: unparseable response"}}return typeof i=="object"&&i!==null&&i.isAuthenticated===!0?{ok:!0,note:"agent status: authenticated"}:{ok:!1,note:"agent status: not authenticated"}}catch(t){return{ok:!1,note:t instanceof Error?t.message:"agent status probe failed"}}}function I(e=process.env){let r=[],t=e.KYNVER_CURSOR_AUTH_HOME?.trim();t&&(r.push(E.join(t,".config","cursor","auth.json")),r.push(E.join(t,".cursor-agent","auth.json")));let o=ke();if(r.push(E.join(o,".config","cursor","auth.json")),r.push(E.join(o,".cursor-agent","auth.json")),process.platform==="win32"){let n=e.LOCALAPPDATA?.trim(),i=e.APPDATA?.trim();n&&r.push(E.join(n,"cursor-agent","auth.json")),i&&r.push(E.join(i,"cursor","auth.json"))}return r}var Ie="agent";function V(e=new Date().toISOString()){let r=d(Ie,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:h("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=u(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=I().find(a=>be(a)),n=b(r),i=!!o||n.ok,s=t.ok&&i;return{providerId:"cursor",ready:s,authSource:"oauth_local",sessionFingerprint:o?l(o):void 0,checkedAt:e,note:s?"Local Cursor/Composer OAuth session bound on runner":[t.note,i?void 0:n.note??"no ~/.config/cursor/auth.json or `agent login` session"].filter(Boolean).join("; ")}}import{existsSync as Ne,readFileSync as Te}from"node:fs";import{homedir as we}from"node:os";import N from"node:path";var Ke=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function Le(){let e=process.env.HERMES_HOME?.trim(),r=e?N.resolve(e):N.join(we(),".hermes");return N.join(r,".env")}function De(e){try{let r=Te(e,"utf8"),t=[];for(let o of Ke)new RegExp(`^${o}=`,"m").test(r)&&t.push(o);return t}catch{return[]}}function W(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=u(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=Le(),n=Ne(o),i=n?De(o):[],a=i.some(m=>m.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",c=t.ok&&n;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:n,authSource:a,sessionFingerprint:n?l(o):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function Be(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=$(r),o={codex:t,cursor:V(r),claude:U(r)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:r,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:W(r),hermesOpenAiCodex:x(r),codexAdapterPath:t.path,readyCount:n}}var Ye={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function Me(){return Object.values(Ye)}var J=["off","observe","enforce"];function He(e){let r=(e??"off").trim().toLowerCase();return J.includes(r)?r:"off"}function P(e=process.env){return He(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function T(e=process.env){let r=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return r?r==="1"||r==="true"||r==="yes"||r==="on":P(e)==="enforce"}import{createHash as Ue}from"node:crypto";function C(e){if(e==null)return null;let r=e.trim();return r.length?r:null}function w(e){let r=C(e.sessionId)??"anonymous",t=C(e.title)??C(e.action)??"foreground",o=Ue("sha256").update([C(e.planId)??"",C(e.parentTaskId)??"",t.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${r}:${o}`}function je(e,r){return e==="enforce"&&r?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function $e(e,r=process.env){let t=P(r),o=T(r),n=je(t,o),i=n==="enforce_harness_task"?w({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return t==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:t,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{w as buildForegroundHarnessIdempotencyKey,Be as buildOrchestrationProviderInventory,$e as evaluateOrchestrationPolicy,T as isOrchestrationEnforceTasksEnabled,Me as listOrchestrationProviderCapabilities,P as resolveOrchestrationPolicyMode};
+import{existsSync as ie}from"node:fs";import{homedir as se}from"node:os";import ae from"node:path";import{createHash as Y}from"node:crypto";import{statSync as ne}from"node:fs";import{spawnSync as U}from"node:child_process";import{existsSync as M,readFileSync as z}from"node:fs";import p from"node:path";var _=class extends Error{constructor(t){super(`${t} is a batch file that is not a Node CLI shim; it cannot be spawned without a shell. Point the matching KYNVER_*_BIN setting at the real .exe or the CLI's JS entry, or run the daemon inside WSL.`);this.shimPath=t;this.name="UnresolvableWindowsShimError"}shimPath},X=".COM;.EXE;.BAT;.CMD";function q(e){return e.includes("/")||e.includes("\\")}function Q(e){return(e.PATHEXT||X).split(";").map(r=>r.trim().toLowerCase()).filter(r=>r.startsWith("."))}function Z(e){let r=Object.keys(e).find(t=>t.toUpperCase()==="PATH");return r?e[r]??"":""}function ee(e,r={}){let t=r.env??process.env,o=r.exists??M,n=Q(t),i=p.win32.extname(e)!=="",s=a=>i?[a]:n.map(c=>`${a}${c}`);if(q(e)||p.win32.isAbsolute(e))return s(e).find(a=>o(a))??null;for(let a of Z(t).split(";").map(c=>c.trim()).filter(Boolean)){let c=s(p.win32.join(a,e)).find(m=>o(m));if(c)return c}return null}var D=/%~?dp0%?\\?([^"%\r\n]+?\.(?:c|m)?js)\b/i,re=/^\s*SET\s+"?([A-Za-z_]\w*)=([^"\r\n]*)"?\s*$/i;function B(e){return e.replace(/^[\\/]+/,"")}function te(e){let r=e.split(/\r?\n/),t=new Map;for(let i of r){let s=re.exec(i);s&&t.set(s[1].toUpperCase(),s[2])}let o=r.filter(i=>i.includes("%*")).pop();if(!o)return null;let n=D.exec(o);if(n)return B(n[1]);for(let i of o.matchAll(/%([A-Za-z_]\w*)%/g)){let s=t.get(i[1].toUpperCase()),a=s?D.exec(s):null;if(a)return B(a[1])}return null}function oe(e,r={}){if((r.platform??process.platform)!=="win32")return{executable:e,prefixArgs:[],kind:"passthrough"};let o=ee(e,r);if(!o)return{executable:e,prefixArgs:[],kind:"passthrough"};let n=p.win32.extname(o).toLowerCase();if(n!==".cmd"&&n!==".bat")return{executable:o,prefixArgs:[],kind:"exe"};let i=r.readText??(G=>z(G,"utf8")),s=r.exists??M,a;try{a=i(o)}catch{throw new _(o)}let c=te(a);if(!c)throw new _(o);let m=p.win32.dirname(o),K=p.win32.join(m,c);if(!s(K))throw new _(o);let L=p.win32.join(m,"node.exe");return{executable:s(L)?L:r.nodeExecutable??process.execPath,prefixArgs:[K],kind:"node-shim"}}function R(e,r,t={}){let o=oe(e,t);return[o.executable,[...o.prefixArgs,...r]]}function u(e){try{let r=ne(e),t=`${e}|${r.size}|${r.mtimeMs}`;return Y("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function h(e){return Y("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,r){for(let t of r){let o=process.env[t]?.trim();if(o)return o}return e}function l(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r),s=U(n,i,{windowsHide:!0,encoding:"utf8",timeout:o,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(s.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let a=(s.stderr||s.stdout||"").trim(),c=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:a?`${c}: ${a.slice(0,200)}`:c}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function A(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r);return U(n,i,{windowsHide:!0,stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var ce="claude";function le(){let e=se();return[ae.join(e,".claude",".credentials.json")]}function j(e=new Date().toISOString()){let r=d(ce,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:h("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=le().find(s=>ie(s)),n=A(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(n.ok||!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as ue}from"node:fs";import{homedir as de}from"node:os";import S from"node:path";var pe="codex";function fe(){let e=de();return[process.env.CODEX_HOME?.trim()?S.join(S.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,S.join(e,".codex","auth.json"),S.join(e,".config","codex","auth.json")].filter(t=>!!t)}function me(e){return S.dirname(e)}function he(e){let r,t;for(let o of fe()){if(!ue(o))continue;r??=o;let n=l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:me(o)}});if(t??=n,n.ok)return{authPath:o,login:n}}return{authPath:r,login:t??l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function H(e=new Date().toISOString()){let r=d(pe,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:h("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:o}=he(r),n=!!t&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:t?u(t):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as ge}from"node:fs";import{homedir as Ee}from"node:os";import y from"node:path";function _e(){let e=process.env.HERMES_HOME?.trim(),r=e?y.resolve(e):y.join(Ee(),".hermes");return y.join(r,"auth.json")}function x(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=_e(),n=ge(o),i=A(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?u(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function $(e=new Date().toISOString()){let r=H(e);if(r.ready)return{...r,path:"codex_cli"};let t=x(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as be}from"node:fs";import{homedir as ke}from"node:os";import E from"node:path";import{closeSync as Yr,existsSync as Pe,mkdirSync as Ur,openSync as jr,statSync as Hr,unlinkSync as $r}from"node:fs";var Er=String.raw`"use strict";
+const cp = require("child_process"), fs = require("fs");
+const argv = process.argv.slice(1);
+const exitFile = argv[0], cmd = argv[1], args = argv.slice(2);
+const startedMs = Date.now();
+function cgroupOomKills() {
+  try {
+    const line = fs.readFileSync("/proc/self/cgroup", "utf8").split("\n").find((l) => l.startsWith("0::"));
+    if (!line) return null;
+    const file = "/sys/fs/cgroup" + line.slice(3).trim().replace(/\/$/, "") + "/memory.events";
+    const m = /(?:^|\n)oom_kill (\d+)/.exec(fs.readFileSync(file, "utf8"));
+    return m ? Number(m[1]) : null;
+  } catch { return null; }
+}
+function kernelLog() {
+  const override = process.env.KYNVER_EXIT_CAPTURE_KERNEL_LOG_FILE;
+  if (override) { try { return fs.readFileSync(override, "utf8"); } catch { return ""; } }
+  const run = (bin, a) => {
+    try {
+      const r = cp.spawnSync(bin, a, { encoding: "utf8", timeout: 3000, maxBuffer: 8 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
+      return r.status === 0 ? String(r.stdout || "") : "";
+    } catch { return ""; }
+  };
+  return run("journalctl", ["-k", "-q", "--no-pager", "--since", "@" + Math.floor(startedMs / 1000)]) || run("dmesg", []);
+}
+const oomBefore = cgroupOomKills();
+let child, finished = false;
+function write(rec) {
+  try { fs.writeFileSync(exitFile, JSON.stringify(rec, null, 2) + "\n"); } catch {}
+}
+function finish(code, signal, spawnError) {
+  if (finished) return;
+  finished = true;
+  const rec = { exitCode: code, signal: signal || null, startedAt: new Date(startedMs).toISOString(), endedAt: new Date().toISOString(), childPid: child && child.pid };
+  if (spawnError) rec.spawnError = spawnError;
+  if (signal === "SIGKILL" || code === 137 || (code !== 0 && code !== null)) {
+    const oomAfter = cgroupOomKills();
+    if (oomBefore !== null && oomAfter !== null && oomAfter > oomBefore) {
+      rec.oomEvidence = { source: "cgroup", detail: "memory.events oom_kill " + oomBefore + " -> " + oomAfter };
+    } else if (signal === "SIGKILL" || code === 137) {
+      const pid = child && child.pid;
+      const hit = kernelLog().split("\n").find((l) => pid && new RegExp("(?:Killed process|oom-kill:.*pid=|Memory cgroup out of memory: Killed process) ?" + pid + "\\b").test(l));
+      if (hit) rec.oomEvidence = { source: "kernel_log", detail: hit.trim().slice(0, 300) };
+    }
+  }
+  write(rec);
+  if (signal) {
+    const n = (require("os").constants.signals || {})[signal];
+    process.exit(128 + (n || 9));
+  }
+  process.exit(code === null ? 1 : code);
+}
+try {
+  child = cp.spawn(cmd, args, { stdio: "inherit" });
+} catch (e) {
+  process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
+  finish(127, null, String(e && e.message));
+}
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
+child.on("error", (e) => {
+  process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
+  if (!child.pid) finish(127, null, String(e && e.message));
+});
+child.on("exit", (code, signal) => finish(code, signal));
+`;import g from"node:path";function v(e=process.platform){return e!=="win32"}var Se=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],vr=new Set(Se);var Ce=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Pr=new Set(Ce);import{existsSync as C,readdirSync as Oe}from"node:fs";import f from"node:path";var Ae=/^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;function xe(e){let t=e.split("-")[0].split(".");if(t.length!==3)return null;let[o,n,i]=t;return!o||!n||!i?null:+`${o}${n.padStart(2,"0")}${i.padStart(2,"0")}`}function ve(e){let r=f.join(e,"versions");if(!C(r))return null;let t=null,o=-1;for(let n of Oe(r,{withFileTypes:!0})){if(!n.isDirectory()||!Ae.test(n.name))continue;let i=xe(n.name);i==null||i<=o||(o=i,t=f.join(r,n.name))}return t}function k(e){let r=e?.trim()||f.join(process.env.LOCALAPPDATA||"","cursor-agent"),t=f.join(r,"node.exe"),o=f.join(r,"index.js");if(C(t)&&C(o))return{nodeExe:t,indexJs:o,versionDir:r};let n=ve(r);if(!n)return null;let i=f.join(n,"node.exe"),s=f.join(n,"index.js");return!C(i)||!C(s)?null:{nodeExe:i,indexJs:s,versionDir:n}}function Re(e,r,t){return{executable:e,prefixArgs:[r],shell:!1,detached:v(),bundledVersionDir:t}}function F(e){if(process.platform==="win32"){let r=/\.(cmd|bat)$/i.test(e),t=/node\.exe$/i.test(e)&&Pe(g.join(g.dirname(e),"index.js"));if(r||t||e==="agent"){let n=r?k(g.dirname(e)):t?{nodeExe:e,indexJs:g.join(g.dirname(e),"index.js"),versionDir:g.dirname(e)}:k();if(n)return Re(n.nodeExe,n.indexJs,n.versionDir);throw new Error("Cursor Agent on Windows has no headless bundled node.exe under %LOCALAPPDATA%\\cursor-agent\\versions\\\u2026. Run `agent login` / update Cursor Agent CLI, use `--provider claude`, or set KYNVER_CURSOR_AGENT_ROOT to the cursor-agent folder.")}}return{executable:e,prefixArgs:[],shell:!1,detached:v()}}import{spawnSync as ye}from"node:child_process";function b(e,r=process.env){try{let t;try{t=F(e)}catch{t={executable:e,prefixArgs:[]}}let o=ye(t.executable,[...t.prefixArgs,"status","--format","json"],{encoding:"utf8",windowsHide:!0,timeout:8e3,env:{...r,CI:"1",NO_COLOR:"1"}});if(o.status!==0)return{ok:!1,note:"agent status: not authenticated"};let n=(o.stdout||"").trim();if(!n)return{ok:!1,note:"agent status: empty response"};let i;try{i=JSON.parse(n)}catch{return{ok:!1,note:"agent status: unparseable response"}}return typeof i=="object"&&i!==null&&i.isAuthenticated===!0?{ok:!0,note:"agent status: authenticated"}:{ok:!1,note:"agent status: not authenticated"}}catch(t){return{ok:!1,note:t instanceof Error?t.message:"agent status probe failed"}}}function I(e=process.env){let r=[],t=e.KYNVER_CURSOR_AUTH_HOME?.trim();t&&(r.push(E.join(t,".config","cursor","auth.json")),r.push(E.join(t,".cursor-agent","auth.json")));let o=ke();if(r.push(E.join(o,".config","cursor","auth.json")),r.push(E.join(o,".cursor-agent","auth.json")),process.platform==="win32"){let n=e.LOCALAPPDATA?.trim(),i=e.APPDATA?.trim();n&&r.push(E.join(n,"cursor-agent","auth.json")),i&&r.push(E.join(i,"cursor","auth.json"))}return r}var Ie="agent";function W(e=new Date().toISOString()){let r=d(Ie,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:h("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=l(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=I().find(a=>be(a)),n=b(r),i=!!o||n.ok,s=t.ok&&i;return{providerId:"cursor",ready:s,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:s?"Local Cursor/Composer OAuth session bound on runner":[t.note,i?void 0:n.note??"no ~/.config/cursor/auth.json or `agent login` session"].filter(Boolean).join("; ")}}import{existsSync as Ne,readFileSync as Te}from"node:fs";import{homedir as we}from"node:os";import N from"node:path";var Ke=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function Le(){let e=process.env.HERMES_HOME?.trim(),r=e?N.resolve(e):N.join(we(),".hermes");return N.join(r,".env")}function De(e){try{let r=Te(e,"utf8"),t=[];for(let o of Ke)new RegExp(`^${o}=`,"m").test(r)&&t.push(o);return t}catch{return[]}}function V(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=Le(),n=Ne(o),i=n?De(o):[],a=i.some(m=>m.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",c=t.ok&&n;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:n,authSource:a,sessionFingerprint:n?u(o):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function Be(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=$(r),o={codex:t,cursor:W(r),claude:j(r)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:r,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:V(r),hermesOpenAiCodex:x(r),codexAdapterPath:t.path,readyCount:n}}var Me={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function Ye(){return Object.values(Me)}var J=["off","observe","enforce"];function Ue(e){let r=(e??"off").trim().toLowerCase();return J.includes(r)?r:"off"}function P(e=process.env){return Ue(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function T(e=process.env){let r=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return r?r==="1"||r==="true"||r==="yes"||r==="on":P(e)==="enforce"}import{createHash as je}from"node:crypto";function O(e){if(e==null)return null;let r=e.trim();return r.length?r:null}function w(e){let r=O(e.sessionId)??"anonymous",t=O(e.title)??O(e.action)??"foreground",o=je("sha256").update([O(e.planId)??"",O(e.parentTaskId)??"",t.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${r}:${o}`}function He(e,r){return e==="enforce"&&r?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function $e(e,r=process.env){let t=P(r),o=T(r),n=He(t,o),i=n==="enforce_harness_task"?w({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return t==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:t,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{w as buildForegroundHarnessIdempotencyKey,Be as buildOrchestrationProviderInventory,$e as evaluateOrchestrationPolicy,T as isOrchestrationEnforceTasksEnabled,Ye as listOrchestrationProviderCapabilities,P as resolveOrchestrationPolicyMode};

package/dist/server/worker-policy.js

@@ -1,2 +1,66 @@
-var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function z(e){let r=e[Ur];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function k(e,r={}){return Nr.has(e)?!0:Dr.has(e)||r.operatorAllow?.has(e)||Mr.some(t=>e.endsWith(t))?!1:Kr.some(t=>e.endsWith(t))}function ke(e){let r=z(e);return Object.keys(e).filter(t=>k(t,{operatorAllow:r})).sort()}function _e(e){let r=z(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!k(t,{operatorAllow:r})&&k(t)).sort()}function A(e){let r=z(e),t={...e};for(let n of Object.keys(t))k(n,{operatorAllow:r})&&delete t[n];return t}function Br(e){let r=ke(e),t=_e(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var Tr,Nr,Kr,Wr,Dr,Mr,Ur,w=o(()=>{"use strict";Tr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Nr=new Set(Tr),Kr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],Wr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Dr=new Set(Wr),Mr=["_PUBLIC_KEY"],Ur="KYNVER_WORKER_ENV_ALLOW"});var m=o(()=>{"use strict"});var Ae=o(()=>{"use strict"});function Z(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict";Ae()});var N=o(()=>{"use strict";m();a();w()});var we=o(()=>{"use strict";N()});var ee=o(()=>{"use strict";N();m();we()});var re=o(()=>{"use strict";a()});var f=o(()=>{"use strict"});var K=o(()=>{"use strict"});var Pe=o(()=>{"use strict"});var zn,Xn,te=o(()=>{"use strict";zn=25*1024*1024*1024,Xn=12*1024*1024*1024});var to,no,Ie=o(()=>{"use strict";te();to=5*1024*1024*1024,no=10*1024*1024*1024});var co,uo,ne=o(()=>{"use strict";Ie();te();co=30*1024*1024*1024,uo=15*1024*1024*1024});var Ne=o(()=>{"use strict";a()});import tt from"node:path";var ko,oe=o(()=>{"use strict";m();Ne();ko=tt.join(".openclaw","harness")});var D=o(()=>{"use strict";g();f();K();M();oe()});var De=o(()=>{"use strict";g();oe();D();a()});var se=o(()=>{"use strict";De();a()});var Me=o(()=>{"use strict";se();a()});var Ue=o(()=>{"use strict"});var Be=o(()=>{"use strict";Ue();a()});var Le=o(()=>{"use strict"});var Fe=o(()=>{"use strict";Le()});var B=o(()=>{"use strict"});var $e=o(()=>{"use strict"});var He=o(()=>{"use strict"});var Ve=o(()=>{"use strict";Fe();a();B();$e();He()});var je=o(()=>{"use strict";B()});var Ye=o(()=>{"use strict"});var Ge=o(()=>{"use strict"});var ae=o(()=>{"use strict"});var qe=o(()=>{"use strict"});var Je=o(()=>{"use strict";ae();qe()});var ze=o(()=>{"use strict";Be();Ve();B();je();Ye();N();Ge();Je();ae();a()});var Xe=o(()=>{"use strict";ze()});var mt,ft,Qe=o(()=>{"use strict";Pe();g();f();K();M();ne();se();Me();Xe();a();mt=500*1024*1024,ft=4*1024*1024*1024});var M=o(()=>{"use strict";Qe()});import{homedir as gt}from"node:os";import ht from"node:path";var Ze,le=o(()=>{"use strict";Ze=ht.join(gt(),".kynver",".env")});var er=o(()=>{"use strict"});var rr=o(()=>{"use strict";er()});var tr=o(()=>{"use strict"});var nr=o(()=>{"use strict";a()});var ce=o(()=>{"use strict";rr();tr();nr()});var or=o(()=>{"use strict"});var ir=o(()=>{"use strict";or()});var L=o(()=>{"use strict";le();m();g();ce();ir()});var sr=o(()=>{"use strict";f();f()});var ar=o(()=>{"use strict";le();ce();L()});var ue=o(()=>{"use strict"});var lr=o(()=>{"use strict";ee();f();sr();g();L();ar();re();ue();D()});function _(e){let r=e.trim().toLowerCase();return Ct[r]??r}var cr,Et,Ct,F=o(()=>{"use strict";cr=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],Et=cr.join("|"),Ct={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});var ur=o(()=>{"use strict";m()});var dr=o(()=>{"use strict";ur()});var pr=o(()=>{"use strict"});var mr=o(()=>{"use strict";pr()});import{homedir as At,totalmem as Za}from"node:os";import de from"node:path";var fr,gl,hl,yl,vl,g=o(()=>{"use strict";ee();m();re();f();K();M();ne();L();lr();F();D();dr();ue();mr();fr=de.join(At(),".kynver"),gl=de.join(fr,"config.json"),hl=de.join(fr,"credentials"),yl=500*1024*1024,vl=4*1024*1024*1024});w();w();var X="KYNVER_NO_PROD_DB_CREDENTIALS",Lr=["KYNVER_ENV_FILE"],Fr=new Set(["1","true","yes","on"]);function be(e){let r=e[X]?.trim().toLowerCase();return r!==void 0&&Fr.has(r)}function d(e,r={}){let t=A(e);if(!r.reviewWorker)return t;let n={...t,[X]:"1"};for(let i of Lr)delete n[i];return n}var xe=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function $r(e,r={}){let t=d(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||xe.includes(c)),i=xe.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=be(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var Hr="expert-lane-pr-review:",Vr="plan-review-task",jr="scheduledjob:",P=new Set(["lorentz","dalton","rhea","sentinel"]);function Yr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function Q(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function Gr(e,r){return e.startsWith("factory:")?e.includes("lb")||Q(r):!1}function qr(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
-${n}`,s=Yr(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(Hr)||r===Vr||r.startsWith("daemon-review:")||s&&P.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Gr(r,i)||Q(i))||r.startsWith(jr)&&e.parentTaskId&&s&&P.has(s)||e.planId&&!e.parentTaskId&&s&&P.has(s)&&Q(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&P.has(s))}var Jr=/^claude[-_]/i,zr=/^(?:opus|sonnet|haiku)\b/i;function Se(e){let r=e.trim();return Jr.test(r)||zr.test(r)}function Ee(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Ce(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Oe(e){return e.trim().toLowerCase().startsWith("gemini-")}function Xr(e){return Ee(e)?"codex":Se(e)?"claude":Oe(e)?"gemini":(Ce(e),"cursor")}function Qr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:i,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:i,rule:i?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function Zr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Se(n)||Ee(n)||Ce(n)||Oe(n)?{lane:t,model:n,provider:Xr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function I(e){let r=typeof e=="string"?e.trim():"";return r?Qr(r)??Zr(r):null}g();a();a();var yr="kynver",vr=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Kt=vr.map(e=>`mcp__${yr}__${e}`);a();a();var Bc=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5";function Dt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5"}var Mt=Dt();a();var gu=600*1e3;a();var Mu=600*1e3;var Rr="composer-2.5";F();F();var p="cursor",Ft=new Set(["claude","opus","anthropic"]),$t=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function b(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Ft.has(r)?!0:r.includes("claude")||r.includes("opus")}function pe(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=b(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=I(b(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(Ht(n.model)))return!0;let i=b(e,"description");if($t.some(l=>l.test(i)))return!0;let s=b(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function Ht(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Vt(e,r){return{provider:p,model:Rr,rule:`policy:cursor_default${r}`,requestedModel:e}}var jt=["explicit:","executor_ref:","factory:","task:"];function Yt(e){return jt.some(r=>e.startsWith(r))}function me(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||I(b(e,"executorRef"))?.provider?!0:pe(e)}function kr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Yt(r.rule)||me(t)||!u(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Vt(r.model,i)}function Gt(e,r=p){let t=e?.trim();return t?_(t):r}function qt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(p)?[...new Set(r.map(t=>u(t)?p:t))]:r.every(t=>u(t))?[p]:r}var Jt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,zt=/\b(npm run build\b|next build\b)\b/i,Xt=/\b(vercel (build|deploy|--prod))\b/i,Qt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function fe(e){let r=e.trim();return r?Qt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:Xt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:zt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:Jt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var j="heavy_verification_token_required";import{spawnSync as yn}from"node:child_process";a();import{closeSync as on,existsSync as E,mkdirSync as sn,openSync as an,readdirSync as Sr,readFileSync as ln,statSync as cn,unlinkSync as Er,writeFileSync as un}from"node:fs";import ye from"node:path";import{mkdirSync as en}from"node:fs";import{tmpdir as rn}from"node:os";import Y from"node:path";import{homedir as Zt,tmpdir as ld}from"node:os";import _r from"node:path";function xr(){let e=process.env.KYNVER_STATE_ROOT;return e?_r.resolve(e):_r.join(Zt(),".kynver","state")}function tn(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function nn(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?Y.resolve(e):tn()?Y.join(rn(),"kynver","state","heavy-verification"):Y.join(xr(),"heavy-verification")}function ge(){return Y.join(nn(),"slots")}function S(){let e=ge();return en(e,{recursive:!0}),e}var C=120*6e4,br=1;function dn(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function q(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function G(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?dn(e,br):br}function pn(e){return`slot-${e}`}function mn(e,r=ge()){return ye.join(r,`${e}.json`)}function ve(e){if(!E(e))return null;try{let r=JSON.parse(ln(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function Cr(e,r=C){if(!e||!Z(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function Or(e,r){let t=ve(e);if(t)return Cr(t,r);if(!E(e))return!0;try{return Date.now()-cn(e).mtimeMs>r}catch{return!0}}function fn(e,r){if(Or(e,r))try{Er(e)}catch{}}function gn(e){return sn(e,{recursive:!0}),e}function Re(e={}){let r=gn(e.slotsDir??S()),t=e.staleMs??C,n=0;for(let i of Sr(r)){if(!i.endsWith(".json"))continue;let s=ye.join(r,i),l=E(s);fn(s,t),l&&!E(s)&&(n+=1)}return n}function hn(e={}){let r=e.slotsDir??S(),t=e.staleMs??C;Re({slotsDir:r,staleMs:t});let n=[];for(let i of Sr(r)){if(!i.endsWith(".json"))continue;let s=ve(ye.join(r,i));s&&!Cr(s,t)&&n.push(s)}return n}function he(e={}){return hn(e).length}function O(e,r={}){if(q())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:G(),reason:null};let t=r.slotsDir??S(),n=r.staleMs??C,i=r.maxSlots??G();Re({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=pn(l),v=mn(c,t),wr=ve(v);if(Or(v,n))try{Er(v)}catch{}else if(wr||E(v))continue;let Pr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let R=an(v,"wx");un(R,JSON.stringify(Pr,null,2),"utf8"),on(R);let Ir=he({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:Ir,maxSlots:i,reason:null}}catch(R){if(R.code==="EEXIST")continue;throw R}}let s=he({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function J(e,r={}){if(q())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:G(),reason:null};let t=r.slotsDir??S(),n=r.staleMs??C,i=r.maxSlots??G();Re({slotsDir:t,staleMs:n});let s=he({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function vn(e){e<=0||yn(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore",windowsHide:!0})}function Ar(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=O(e,n);for(;!s.admitted&&Date.now()<i;)vn(Math.min(t,i-Date.now())),s=O(e,n);return s}function Rn(e,r={}){let t=fe(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...J(e),slotId:null}};if(q())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...J(e),slotId:null}};let n=r.waitMs??0,i=n>0?Ar(e,n,r.pollMs):O(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:j,commandClass:t.commandClass,reason:t.reason??i.reason??j,verificationGate:i}}export{p as DEFAULT_WORKER_PROVIDER,j as HEAVY_VERIFICATION_TOKEN_REQUIRED,X as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,$r as auditReviewWorkerCredentialScope,Br as auditWorkerEnv,d as buildWorkerSpawnEnv,fe as classifyHeavyShellCommand,kr as enforceCursorWorkerProvider,Rn as gateWorkerShellCommand,u as isClaudeFamilyProvider,k as isForbiddenWorkerEnvKey,qr as isHarnessExpertReviewWorker,be as isNoProdCredentialReviewEnvironment,ke as listForbiddenWorkerEnvKeys,_e as listOperatorAllowedWorkerEnvKeys,_ as normalizeWorkerProviderName,qt as preferCursorExecutor,Gt as resolveConfiguredWorkerProvider,A as scrubWorkerEnv,pe as taskAllowsClaudeWorker,me as taskExpressesWorkerProviderPreference};
+var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function re(e){let r=e[Hr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function k(e,r={}){return Br.has(e)?!0:Fr.has(e)||r.operatorAllow?.has(e)||$r.some(t=>e.endsWith(t))?!1:Ur.some(t=>e.endsWith(t))}function be(e){let r=re(e);return Object.keys(e).filter(t=>k(t,{operatorAllow:r})).sort()}function Ee(e){let r=re(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!k(t,{operatorAllow:r})&&k(t)).sort()}function P(e){let r=re(e),t={...e};for(let n of Object.keys(t))k(n,{operatorAllow:r})&&delete t[n];return t}function jr(e){let r=be(e),t=Ee(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var Mr,Br,Ur,Lr,Fr,$r,Hr,I=o(()=>{"use strict";Mr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Br=new Set(Mr),Ur=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],Lr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Fr=new Set(Lr),$r=["_PUBLIC_KEY"],Hr="KYNVER_WORKER_ENV_ALLOW"});var f=o(()=>{"use strict"});var Ie=o(()=>{"use strict"});function W(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict";Ie()});var D=o(()=>{"use strict";f();a();I()});var Te=o(()=>{"use strict";D()});var oe=o(()=>{"use strict";D();f();Te()});var ie=o(()=>{"use strict";a()});var g=o(()=>{"use strict"});var M=o(()=>{"use strict"});var Ne=o(()=>{"use strict"});var no,oo,se=o(()=>{"use strict";no=25*1024*1024*1024,oo=12*1024*1024*1024});var co,uo,We=o(()=>{"use strict";se();co=5*1024*1024*1024,uo=10*1024*1024*1024});var yo,vo,ae=o(()=>{"use strict";We();se();yo=30*1024*1024*1024,vo=15*1024*1024*1024});var Ke=o(()=>{"use strict";a()});import at from"node:path";var Oo,ce=o(()=>{"use strict";f();Ke();Oo=at.join(".openclaw","harness")});var U=o(()=>{"use strict";h();g();M();L();ce()});var Be=o(()=>{"use strict";h();ce();U();a()});var H=o(()=>{"use strict";Be();a()});var Le=o(()=>{"use strict";H();a()});var Fe=o(()=>{"use strict"});var $e=o(()=>{"use strict";Fe();a()});var He=o(()=>{"use strict"});var je=o(()=>{"use strict";He()});var j=o(()=>{"use strict"});var Ve=o(()=>{"use strict"});var Ye=o(()=>{"use strict"});var Ge=o(()=>{"use strict";je();a();j();Ve();Ye()});var Ei,u=o(()=>{"use strict";Ei=String.raw`"use strict";
+const cp = require("child_process"), fs = require("fs");
+const argv = process.argv.slice(1);
+const exitFile = argv[0], cmd = argv[1], args = argv.slice(2);
+const startedMs = Date.now();
+function cgroupOomKills() {
+  try {
+    const line = fs.readFileSync("/proc/self/cgroup", "utf8").split("\n").find((l) => l.startsWith("0::"));
+    if (!line) return null;
+    const file = "/sys/fs/cgroup" + line.slice(3).trim().replace(/\/$/, "") + "/memory.events";
+    const m = /(?:^|\n)oom_kill (\d+)/.exec(fs.readFileSync(file, "utf8"));
+    return m ? Number(m[1]) : null;
+  } catch { return null; }
+}
+function kernelLog() {
+  const override = process.env.KYNVER_EXIT_CAPTURE_KERNEL_LOG_FILE;
+  if (override) { try { return fs.readFileSync(override, "utf8"); } catch { return ""; } }
+  const run = (bin, a) => {
+    try {
+      const r = cp.spawnSync(bin, a, { encoding: "utf8", timeout: 3000, maxBuffer: 8 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
+      return r.status === 0 ? String(r.stdout || "") : "";
+    } catch { return ""; }
+  };
+  return run("journalctl", ["-k", "-q", "--no-pager", "--since", "@" + Math.floor(startedMs / 1000)]) || run("dmesg", []);
+}
+const oomBefore = cgroupOomKills();
+let child, finished = false;
+function write(rec) {
+  try { fs.writeFileSync(exitFile, JSON.stringify(rec, null, 2) + "\n"); } catch {}
+}
+function finish(code, signal, spawnError) {
+  if (finished) return;
+  finished = true;
+  const rec = { exitCode: code, signal: signal || null, startedAt: new Date(startedMs).toISOString(), endedAt: new Date().toISOString(), childPid: child && child.pid };
+  if (spawnError) rec.spawnError = spawnError;
+  if (signal === "SIGKILL" || code === 137 || (code !== 0 && code !== null)) {
+    const oomAfter = cgroupOomKills();
+    if (oomBefore !== null && oomAfter !== null && oomAfter > oomBefore) {
+      rec.oomEvidence = { source: "cgroup", detail: "memory.events oom_kill " + oomBefore + " -> " + oomAfter };
+    } else if (signal === "SIGKILL" || code === 137) {
+      const pid = child && child.pid;
+      const hit = kernelLog().split("\n").find((l) => pid && new RegExp("(?:Killed process|oom-kill:.*pid=|Memory cgroup out of memory: Killed process) ?" + pid + "\\b").test(l));
+      if (hit) rec.oomEvidence = { source: "kernel_log", detail: hit.trim().slice(0, 300) };
+    }
+  }
+  write(rec);
+  if (signal) {
+    const n = (require("os").constants.signals || {})[signal];
+    process.exit(128 + (n || 9));
+  }
+  process.exit(code === null ? 1 : code);
+}
+try {
+  child = cp.spawn(cmd, args, { stdio: "inherit" });
+} catch (e) {
+  process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
+  finish(127, null, String(e && e.message));
+}
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
+child.on("error", (e) => {
+  process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
+  if (!child.pid) finish(127, null, String(e && e.message));
+});
+child.on("exit", (code, signal) => finish(code, signal));
+`});var qe=o(()=>{"use strict";H();a();u()});var Je=o(()=>{"use strict";j()});var ze=o(()=>{"use strict"});var Bi,Ui,Xe=o(()=>{"use strict";D();Bi=10*6e4,Ui=60*6e4});var Ze=o(()=>{"use strict"});var ue=o(()=>{"use strict"});var Qe=o(()=>{"use strict"});var er=o(()=>{"use strict";ue();Qe()});var rr=o(()=>{"use strict";$e();Ge();qe();u();j();Je();ze();Xe();Ze();er();ue();a()});var tr=o(()=>{"use strict";rr();a()});var Rt,kt,nr=o(()=>{"use strict";Ne();h();g();M();L();ae();H();Le();tr();a();Rt=500*1024*1024,kt=4*1024*1024*1024});var L=o(()=>{"use strict";nr()});import{homedir as xt}from"node:os";import bt from"node:path";var or,de=o(()=>{"use strict";or=bt.join(xt(),".kynver",".env")});var ir=o(()=>{"use strict"});var sr=o(()=>{"use strict";ir()});var ar=o(()=>{"use strict"});var lr=o(()=>{"use strict";a()});var pe=o(()=>{"use strict";sr();ar();lr()});var cr=o(()=>{"use strict"});var ur=o(()=>{"use strict";cr()});var V=o(()=>{"use strict";de();f();h();pe();ur()});var dr=o(()=>{"use strict";g();g()});var pr=o(()=>{"use strict";de();pe();V()});var me=o(()=>{"use strict"});var mr=o(()=>{"use strict";oe();g();dr();h();V();pr();ie();me();U()});function x(e){let r=e.trim().toLowerCase();return Nt[r]??r}var fr,Tt,Nt,Y=o(()=>{"use strict";fr=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],Tt=fr.join("|"),Nt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});var gr=o(()=>{"use strict";f()});var hr=o(()=>{"use strict";gr()});var yr=o(()=>{"use strict"});var vr=o(()=>{"use strict";yr()});import{homedir as Kt,totalmem as El}from"node:os";import fe from"node:path";var _r,Ll,Fl,$l,Hl,h=o(()=>{"use strict";oe();f();ie();g();M();L();ae();V();mr();Y();U();hr();me();vr();_r=fe.join(Kt(),".kynver"),Ll=fe.join(_r,"config.json"),Fl=fe.join(_r,"credentials"),$l=500*1024*1024,Hl=4*1024*1024*1024});I();I();var te="KYNVER_NO_PROD_DB_CREDENTIALS",Vr=["KYNVER_ENV_FILE"],Yr=new Set(["1","true","yes","on"]);function Ce(e){let r=e[te]?.trim().toLowerCase();return r!==void 0&&Yr.has(r)}function p(e,r={}){let t=P(e);if(!r.reviewWorker)return t;let n={...t,[te]:"1"};for(let i of Vr)delete n[i];return n}var Se=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Gr(e,r={}){let t=p(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||Se.includes(c)),i=Se.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=Ce(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var qr="expert-lane-pr-review:",Jr="plan-review-task",zr="scheduledjob:",T=new Set(["lorentz","dalton","rhea","sentinel"]);function Xr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function ne(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function Zr(e,r){return e.startsWith("factory:")?e.includes("lb")||ne(r):!1}function Qr(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
+${n}`,s=Xr(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(qr)||r===Jr||r.startsWith("daemon-review:")||s&&T.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Zr(r,i)||ne(i))||r.startsWith(zr)&&e.parentTaskId&&s&&T.has(s)||e.planId&&!e.parentTaskId&&s&&T.has(s)&&ne(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&T.has(s))}var et=/^claude[-_]/i,rt=/^(?:opus|sonnet|haiku)\b/i;function Oe(e){let r=e.trim();return et.test(r)||rt.test(r)}function Ae(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function we(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Pe(e){return e.trim().toLowerCase().startsWith("gemini-")}function tt(e){return Ae(e)?"codex":Oe(e)?"claude":Pe(e)?"gemini":(we(e),"cursor")}function nt(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:i,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:i,rule:i?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function ot(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Oe(n)||Ae(n)||we(n)||Pe(n)?{lane:t,model:n,provider:tt(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function N(e){let r=typeof e=="string"?e.trim():"";return r?nt(r)??ot(r):null}h();u();a();u();a();var xr="kynver",br=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Ft=br.map(e=>`mcp__${xr}__${e}`);u();a();u();a();var mu=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5";function Ht(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5"}var jt=Ht();u();a();var Vu=600*1e3;u();a();var fd=600*1e3;var Er="composer-2.5";Y();Y();var m="cursor",qt=new Set(["claude","opus","anthropic"]),Jt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function S(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function d(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return qt.has(r)?!0:r.includes("claude")||r.includes("opus")}function ge(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&d(r))return!0;let t=S(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=N(S(e,"executorRef"));if(n?.provider&&d(n.provider)||n?.model&&d(zt(n.model)))return!0;let i=S(e,"description");if(Jt.some(l=>l.test(i)))return!0;let s=S(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function zt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Xt(e,r){return{provider:m,model:Er,rule:`policy:cursor_default${r}`,requestedModel:e}}var Zt=["explicit:","executor_ref:","factory:","task:"];function Qt(e){return Zt.some(r=>e.startsWith(r))}function he(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||N(S(e,"executorRef"))?.provider?!0:ge(e)}function Sr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&d(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Qt(r.rule)||he(t)||!d(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Xt(r.model,i)}function en(e,r=m){let t=e?.trim();return t?x(t):r}function rn(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(m)?[...new Set(r.map(t=>d(t)?m:t))]:r.every(t=>d(t))?[m]:r}var tn=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,nn=/\b(npm run build\b|next build\b)\b/i,on=/\b(vercel (build|deploy|--prod))\b/i,sn=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function ye(e){let r=e.trim();return r?sn.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:on.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:nn.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:tn.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var z="heavy_verification_token_required";import{spawnSync as En}from"node:child_process";a();import{closeSync as pn,existsSync as O,mkdirSync as mn,openSync as fn,readdirSync as wr,readFileSync as gn,statSync as hn,unlinkSync as Pr,writeFileSync as yn}from"node:fs";import Re from"node:path";import{mkdirSync as ln}from"node:fs";import{tmpdir as cn}from"node:os";import X from"node:path";import{homedir as an,tmpdir as Ud}from"node:os";import Cr from"node:path";function Or(){let e=process.env.KYNVER_STATE_ROOT;return e?Cr.resolve(e):Cr.join(an(),".kynver","state")}function un(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function dn(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?X.resolve(e):un()?X.join(cn(),"kynver","state","heavy-verification"):X.join(Or(),"heavy-verification")}function ve(){return X.join(dn(),"slots")}function C(){let e=ve();return ln(e,{recursive:!0}),e}var A=120*6e4,Ar=1;function vn(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function Q(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function Z(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?vn(e,Ar):Ar}function _n(e){return`slot-${e}`}function Rn(e,r=ve()){return Re.join(r,`${e}.json`)}function ke(e){if(!O(e))return null;try{let r=JSON.parse(gn(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function Ir(e,r=A){if(!e||!W(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function Tr(e,r){let t=ke(e);if(t)return Ir(t,r);if(!O(e))return!0;try{return Date.now()-hn(e).mtimeMs>r}catch{return!0}}function kn(e,r){if(Tr(e,r))try{Pr(e)}catch{}}function xn(e){return mn(e,{recursive:!0}),e}function xe(e={}){let r=xn(e.slotsDir??C()),t=e.staleMs??A,n=0;for(let i of wr(r)){if(!i.endsWith(".json"))continue;let s=Re.join(r,i),l=O(s);kn(s,t),l&&!O(s)&&(n+=1)}return n}function bn(e={}){let r=e.slotsDir??C(),t=e.staleMs??A;xe({slotsDir:r,staleMs:t});let n=[];for(let i of wr(r)){if(!i.endsWith(".json"))continue;let s=ke(Re.join(r,i));s&&!Ir(s,t)&&n.push(s)}return n}function _e(e={}){return bn(e).length}function w(e,r={}){if(Q())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Z(),reason:null};let t=r.slotsDir??C(),n=r.staleMs??A,i=r.maxSlots??Z();xe({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=_n(l),_=Rn(c,t),Wr=ke(_);if(Tr(_,n))try{Pr(_)}catch{}else if(Wr||O(_))continue;let Kr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let R=fn(_,"wx");yn(R,JSON.stringify(Kr,null,2),"utf8"),pn(R);let Dr=_e({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:Dr,maxSlots:i,reason:null}}catch(R){if(R.code==="EEXIST")continue;throw R}}let s=_e({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function ee(e,r={}){if(Q())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Z(),reason:null};let t=r.slotsDir??C(),n=r.staleMs??A,i=r.maxSlots??Z();xe({slotsDir:t,staleMs:n});let s=_e({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Sn(e){e<=0||En(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore",windowsHide:!0})}function Nr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=w(e,n);for(;!s.admitted&&Date.now()<i;)Sn(Math.min(t,i-Date.now())),s=w(e,n);return s}function Cn(e,r={}){let t=ye(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...ee(e),slotId:null}};if(Q())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...ee(e),slotId:null}};let n=r.waitMs??0,i=n>0?Nr(e,n,r.pollMs):w(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:z,commandClass:t.commandClass,reason:t.reason??i.reason??z,verificationGate:i}}export{m as DEFAULT_WORKER_PROVIDER,z as HEAVY_VERIFICATION_TOKEN_REQUIRED,te as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Gr as auditReviewWorkerCredentialScope,jr as auditWorkerEnv,p as buildWorkerSpawnEnv,ye as classifyHeavyShellCommand,Sr as enforceCursorWorkerProvider,Cn as gateWorkerShellCommand,d as isClaudeFamilyProvider,k as isForbiddenWorkerEnvKey,Qr as isHarnessExpertReviewWorker,Ce as isNoProdCredentialReviewEnvironment,be as listForbiddenWorkerEnvKeys,Ee as listOperatorAllowedWorkerEnvKeys,x as normalizeWorkerProviderName,rn as preferCursorExecutor,en as resolveConfiguredWorkerProvider,P as scrubWorkerEnv,ge as taskAllowsClaudeWorker,he as taskExpressesWorkerProviderPreference};

package/dist/worker-broker/index.js

@@ -1,7 +1,7 @@
-import Y from"node:net";import{chmodSync as H,unlinkSync as X}from"node:fs";var u=1,x="KYNVER_WORKER_BROKER_SOCKET",g=1048576,_=1;function y(o){return`${JSON.stringify(o)}
-`}function h(o){let e;try{e=JSON.parse(o)}catch{return{ok:!1,reason:"malformed_request",error:"request was not valid JSON",id:""}}if(!e||typeof e!="object"||Array.isArray(e))return{ok:!1,reason:"malformed_request",error:"request must be a JSON object",id:""};let r=e,t=typeof r.id=="string"?r.id:"";if(r.v!==1)return{ok:!1,reason:"unsupported_protocol",error:"unsupported protocol version (expected 1)",id:t};if(!t)return{ok:!1,reason:"malformed_request",error:"request id must be a non-empty string",id:""};if(r.op==="list_tools")return{ok:!0,request:{v:1,id:t,op:"list_tools"}};if(r.op==="call_tool"){if(typeof r.name!="string"||!r.name)return{ok:!1,reason:"malformed_request",error:"call_tool requires a tool name",id:t};let n=r.args&&typeof r.args=="object"&&!Array.isArray(r.args)?r.args:{};return{ok:!0,request:{v:1,id:t,op:"call_tool",name:r.name,args:n}}}return{ok:!1,reason:"malformed_request",error:"unknown op",id:t}}var A="kynver",l=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],ce=l.map(o=>`mcp__${A}__${o}`),M={"worker.context":["agent_os_context_envelope"],"worker.memory.read":["agent_os_search_memory"],"worker.skills.read":["agent_os_search_skills","agent_os_get_skill"],"worker.progress.report":["agent_os_progress_note"]};function E(o){if(!o||o.length===0)return[...l];let e=new Set;for(let r of o)for(let t of M[r]??[])e.add(t);return l.filter(r=>e.has(r))}var L="X-Kynver-Job-Token",R={agent_os_context_envelope:{name:"agent_os_context_envelope",description:"Fetch the context envelope for YOUR OWN task: goal/plan/task summaries, relevant memory, and recent session context. Optional memoryQuery focuses the memory portion.",inputSchema:{type:"object",properties:{memoryQuery:{type:"string",description:"Focus the memory portion of the envelope."},mode:{type:"string",description:"Envelope mode hint."}},additionalProperties:!1}},agent_os_search_memory:{name:"agent_os_search_memory",description:"Semantic search over the workspace's long-term memory. Returns a bounded top-N of relevant entries.",inputSchema:{type:"object",properties:{query:{type:"string",description:"What to search for."},k:{type:"integer",minimum:1,maximum:20,description:"How many entries to return."}},required:["query"],additionalProperties:!1}},agent_os_search_skills:{name:"agent_os_search_skills",description:"Search the workspace's skill library (bounded, metadata-only index). Use agent_os_get_skill to fetch one full skill by slug.",inputSchema:{type:"object",properties:{query:{type:"string"},limit:{type:"integer",minimum:1,maximum:25}},additionalProperties:!1}},agent_os_get_skill:{name:"agent_os_get_skill",description:"Fetch ONE full skill (including instructions) by slug.",inputSchema:{type:"object",properties:{slug:{type:"string"}},required:["slug"],additionalProperties:!1}},agent_os_progress_note:{name:"agent_os_progress_note",description:"Append a progress or blocker note to YOUR OWN task's journal. kind: 'progress' (default) or 'blocked'.",inputSchema:{type:"object",properties:{note:{type:"string"},kind:{type:"string",enum:["progress","blocked"]},eventKey:{type:"string"}},required:["note"],additionalProperties:!1}}};function D(o){return`/api/agent-os/by-id/${encodeURIComponent(o.agentOsId)}/worker`}async function c(o,e,r){let t=await o.fetchImpl(`${o.apiBaseUrl}${e}`,{method:r?.method??"GET",headers:{[L]:o.token,...r?{"Content-Type":"application/json"}:{}},...r?{body:JSON.stringify(r.body)}:{}});if(!t.ok)throw new Error(`request failed (${t.status})`);return t.json()}function p(o){return typeof o=="string"&&o.trim()?o.trim():void 0}async function O(o,e,r){let t=D(o);switch(e){case"agent_os_context_envelope":{let n=new URLSearchParams({task:o.taskId}),s=p(r.memoryQuery);s&&n.set("memoryQuery",s);let i=p(r.mode);return i&&n.set("mode",i),c(o,`${t}/context-envelope?${n.toString()}`)}case"agent_os_search_memory":{let n=new URLSearchParams({q:String(r.query??"")});return typeof r.k=="number"&&n.set("k",String(r.k)),c(o,`${t}/memory-search?${n.toString()}`)}case"agent_os_search_skills":{let n=new URLSearchParams,s=p(r.query);s&&n.set("q",s),typeof r.limit=="number"&&n.set("limit",String(r.limit));let i=n.toString();return c(o,`${t}/skills${i?`?${i}`:""}`)}case"agent_os_get_skill":return c(o,`${t}/skills/${encodeURIComponent(String(r.slug??""))}`);case"agent_os_progress_note":return c(o,`${t}/progress-note`,{method:"POST",body:{note:String(r.note??""),...r.kind==="blocked"?{kind:"blocked"}:{},...p(r.eventKey)?{eventKey:p(r.eventKey)}:{}}})}}function k(o){return l.includes(o)}import{createHash as q}from"node:crypto";import{chmodSync as $,mkdirSync as U}from"node:fs";import v from"node:os";import J from"node:path";var j=100,P="\\\\.\\pipe\\";function B(o,e){return q("sha256").update(o).digest("hex").slice(0,e)}function V(o){let e=o.platform??process.platform,r=B(o.agentOsId,12),t=B(o.workerKey,16);if(e==="win32")return{socketPath:`${P}kynver-worker-${r}-${t}`,socketDir:null,isNamedPipe:!0,relocated:!1};let n=J.posix,s=o.homeDir??v.homedir(),i=n.join(s,".kynver","brokers",r),d=n.join(i,`${t}.sock`);if(Buffer.byteLength(d,"utf8")<=j)return{socketPath:d,socketDir:i,isNamedPipe:!1,relocated:!1};let T=n.join(o.tmpDir??v.tmpdir(),`kynver-brokers-${r}`);return{socketPath:n.join(T,`${t}.sock`),socketDir:T,isNamedPipe:!1,relocated:!0}}function S(o){o.socketDir&&(U(o.socketDir,{recursive:!0,mode:448}),$(o.socketDir,448))}function F(o){return o.startsWith(P)}var W=class o{server;opts;now;fetchImpl;grantedTools;connections=new Set;sockets=new Set;revoked=!1;closed=!1;constructor(e){if(typeof e.identity?.verify!="function")throw new Error("WorkerBroker requires an explicit identity posture (S11) \u2014 see worker-broker/identity.ts");this.opts=e,this.now=e.now??Date.now,this.fetchImpl=e.fetchImpl??fetch,this.grantedTools=E(e.capabilities),this.server=Y.createServer(r=>{this.handleConnection(r)}),this.server.on("error",()=>{})}static async start(e){let r=new o(e);if(S(e.address),await new Promise((t,n)=>{r.server.once("error",n),r.server.listen(e.address.socketPath,()=>{r.server.removeListener("error",n),t()})}),!e.address.isNamedPipe)try{H(e.address.socketPath,384)}catch{}return r}get identitySummary(){return this.opts.identity.summary}get toolDescriptors(){return this.grantedTools.filter(k).map(e=>R[e])}async revoke(){this.revoked=!0,await this.close()}async close(){if(!this.closed){this.closed=!0;for(let e of this.sockets)e.destroy();if(this.sockets.clear(),this.connections.clear(),await new Promise(e=>this.server.close(()=>e())),!this.opts.address.isNamedPipe)try{X(this.opts.address.socketPath)}catch{}}}refuse(e,r){this.opts.onRefusal?.(e,r)}async handleConnection(e){this.sockets.add(e),e.on("close",()=>{this.sockets.delete(e),this.connections.delete(e)});for(let n of this.connections)(n.destroyed||n.readableEnded)&&this.connections.delete(n);if(this.connections.size>=1){this.refuse("concurrent_connection","a second concurrent connection was attempted while the worker's own connection was open"),this.write(e,{id:"",ok:!1,reason:"concurrent_connection",error:"worker tools are already in use for this task"}),e.end();return}this.connections.add(e);let r=await this.opts.identity.verify({socket:e,workerPid:this.opts.workerPid});if(!r.ok){this.refuse("identity_refused",r.detail),this.write(e,{id:"",ok:!1,reason:"identity_refused",error:"caller could not be identified as this worker"}),e.end();return}let t="";e.setEncoding("utf8"),e.on("data",n=>{if(t+=n,Buffer.byteLength(t,"utf8")>1048576){this.refuse("request_too_large","request exceeded the line cap"),this.write(e,{id:"",ok:!1,reason:"request_too_large",error:"request exceeded the maximum size"}),e.end();return}let s=t.indexOf(`
+import Y from"node:net";import{chmodSync as H,unlinkSync as X}from"node:fs";var u=1,T="KYNVER_WORKER_BROKER_SOCKET",g=1048576,_=1;function y(o){return`${JSON.stringify(o)}
+`}function h(o){let e;try{e=JSON.parse(o)}catch{return{ok:!1,reason:"malformed_request",error:"request was not valid JSON",id:""}}if(!e||typeof e!="object"||Array.isArray(e))return{ok:!1,reason:"malformed_request",error:"request must be a JSON object",id:""};let r=e,t=typeof r.id=="string"?r.id:"";if(r.v!==1)return{ok:!1,reason:"unsupported_protocol",error:"unsupported protocol version (expected 1)",id:t};if(!t)return{ok:!1,reason:"malformed_request",error:"request id must be a non-empty string",id:""};if(r.op==="list_tools")return{ok:!0,request:{v:1,id:t,op:"list_tools"}};if(r.op==="call_tool"){if(typeof r.name!="string"||!r.name)return{ok:!1,reason:"malformed_request",error:"call_tool requires a tool name",id:t};let n=r.args&&typeof r.args=="object"&&!Array.isArray(r.args)?r.args:{};return{ok:!0,request:{v:1,id:t,op:"call_tool",name:r.name,args:n}}}return{ok:!1,reason:"malformed_request",error:"unknown op",id:t}}var A="kynver",l=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],ce=l.map(o=>`mcp__${A}__${o}`),M={"worker.context":["agent_os_context_envelope"],"worker.memory.read":["agent_os_search_memory"],"worker.skills.read":["agent_os_search_skills","agent_os_get_skill"],"worker.progress.report":["agent_os_progress_note"]};function E(o){if(!o||o.length===0)return[...l];let e=new Set;for(let r of o)for(let t of M[r]??[])e.add(t);return l.filter(r=>e.has(r))}var L="X-Kynver-Job-Token",R={agent_os_context_envelope:{name:"agent_os_context_envelope",description:"Fetch the context envelope for YOUR OWN task: goal/plan/task summaries, relevant memory, and recent session context. Optional memoryQuery focuses the memory portion.",inputSchema:{type:"object",properties:{memoryQuery:{type:"string",description:"Focus the memory portion of the envelope."},mode:{type:"string",description:"Envelope mode hint."}},additionalProperties:!1}},agent_os_search_memory:{name:"agent_os_search_memory",description:"Semantic search over the workspace's long-term memory. Returns a bounded top-N of relevant entries.",inputSchema:{type:"object",properties:{query:{type:"string",description:"What to search for."},k:{type:"integer",minimum:1,maximum:20,description:"How many entries to return."}},required:["query"],additionalProperties:!1}},agent_os_search_skills:{name:"agent_os_search_skills",description:"Search the workspace's skill library (bounded, metadata-only index). Use agent_os_get_skill to fetch one full skill by slug.",inputSchema:{type:"object",properties:{query:{type:"string"},limit:{type:"integer",minimum:1,maximum:25}},additionalProperties:!1}},agent_os_get_skill:{name:"agent_os_get_skill",description:"Fetch ONE full skill (including instructions) by slug.",inputSchema:{type:"object",properties:{slug:{type:"string"}},required:["slug"],additionalProperties:!1}},agent_os_progress_note:{name:"agent_os_progress_note",description:"Append a progress or blocker note to YOUR OWN task's journal. kind: 'progress' (default) or 'blocked'.",inputSchema:{type:"object",properties:{note:{type:"string"},kind:{type:"string",enum:["progress","blocked"]},eventKey:{type:"string"}},required:["note"],additionalProperties:!1}}};function D(o){return`/api/agent-os/by-id/${encodeURIComponent(o.agentOsId)}/worker`}async function c(o,e,r){let t=await o.fetchImpl(`${o.apiBaseUrl}${e}`,{method:r?.method??"GET",headers:{[L]:o.token,...r?{"Content-Type":"application/json"}:{}},...r?{body:JSON.stringify(r.body)}:{}});if(!t.ok)throw new Error(`request failed (${t.status})`);return t.json()}function p(o){return typeof o=="string"&&o.trim()?o.trim():void 0}async function O(o,e,r){let t=D(o);switch(e){case"agent_os_context_envelope":{let n=new URLSearchParams({task:o.taskId}),s=p(r.memoryQuery);s&&n.set("memoryQuery",s);let i=p(r.mode);return i&&n.set("mode",i),c(o,`${t}/context-envelope?${n.toString()}`)}case"agent_os_search_memory":{let n=new URLSearchParams({q:String(r.query??"")});return typeof r.k=="number"&&n.set("k",String(r.k)),c(o,`${t}/memory-search?${n.toString()}`)}case"agent_os_search_skills":{let n=new URLSearchParams,s=p(r.query);s&&n.set("q",s),typeof r.limit=="number"&&n.set("limit",String(r.limit));let i=n.toString();return c(o,`${t}/skills${i?`?${i}`:""}`)}case"agent_os_get_skill":return c(o,`${t}/skills/${encodeURIComponent(String(r.slug??""))}`);case"agent_os_progress_note":return c(o,`${t}/progress-note`,{method:"POST",body:{note:String(r.note??""),...r.kind==="blocked"?{kind:"blocked"}:{},...p(r.eventKey)?{eventKey:p(r.eventKey)}:{}}})}}function k(o){return l.includes(o)}import{createHash as q}from"node:crypto";import{chmodSync as $,mkdirSync as U}from"node:fs";import v from"node:os";import J from"node:path";var j=100,P="\\\\.\\pipe\\";function B(o,e){return q("sha256").update(o).digest("hex").slice(0,e)}function V(o){let e=o.platform??process.platform,r=B(o.agentOsId,12),t=B(o.workerKey,16);if(e==="win32")return{socketPath:`${P}kynver-worker-${r}-${t}`,socketDir:null,isNamedPipe:!0,relocated:!1};let n=J.posix,s=o.homeDir??v.homedir(),i=n.join(s,".kynver","brokers",r),d=n.join(i,`${t}.sock`);if(Buffer.byteLength(d,"utf8")<=j)return{socketPath:d,socketDir:i,isNamedPipe:!1,relocated:!1};let x=n.join(o.tmpDir??v.tmpdir(),`kynver-brokers-${r}`);return{socketPath:n.join(x,`${t}.sock`),socketDir:x,isNamedPipe:!1,relocated:!0}}function S(o){o.socketDir&&(U(o.socketDir,{recursive:!0,mode:448}),$(o.socketDir,448))}function F(o){return o.startsWith(P)}var w=class o{server;opts;now;fetchImpl;grantedTools;connections=new Set;sockets=new Set;revoked=!1;closed=!1;constructor(e){if(typeof e.identity?.verify!="function")throw new Error("WorkerBroker requires an explicit identity posture (S11) \u2014 see worker-broker/identity.ts");this.opts=e,this.now=e.now??Date.now,this.fetchImpl=e.fetchImpl??fetch,this.grantedTools=E(e.capabilities),this.server=Y.createServer(r=>{this.handleConnection(r)}),this.server.on("error",()=>{})}static async start(e){let r=new o(e);if(S(e.address),await new Promise((t,n)=>{r.server.once("error",n),r.server.listen(e.address.socketPath,()=>{r.server.removeListener("error",n),t()})}),!e.address.isNamedPipe)try{H(e.address.socketPath,384)}catch{}return r}get identitySummary(){return this.opts.identity.summary}get toolDescriptors(){return this.grantedTools.filter(k).map(e=>R[e])}async revoke(){this.revoked=!0,await this.close()}async close(){if(!this.closed){this.closed=!0;for(let e of this.sockets)e.destroy();if(this.sockets.clear(),this.connections.clear(),await new Promise(e=>this.server.close(()=>e())),!this.opts.address.isNamedPipe)try{X(this.opts.address.socketPath)}catch{}}}refuse(e,r){this.opts.onRefusal?.(e,r)}async handleConnection(e){this.sockets.add(e),e.on("close",()=>{this.sockets.delete(e),this.connections.delete(e)});for(let n of this.connections)(n.destroyed||n.readableEnded)&&this.connections.delete(n);if(this.connections.size>=1){this.refuse("concurrent_connection","a second concurrent connection was attempted while the worker's own connection was open"),this.write(e,{id:"",ok:!1,reason:"concurrent_connection",error:"worker tools are already in use for this task"}),e.end();return}this.connections.add(e);let r=await this.opts.identity.verify({socket:e,workerPid:this.opts.workerPid});if(!r.ok){this.refuse("identity_refused",r.detail),this.write(e,{id:"",ok:!1,reason:"identity_refused",error:"caller could not be identified as this worker"}),e.end();return}let t="";e.setEncoding("utf8"),e.on("data",n=>{if(t+=n,Buffer.byteLength(t,"utf8")>1048576){this.refuse("request_too_large","request exceeded the line cap"),this.write(e,{id:"",ok:!1,reason:"request_too_large",error:"request exceeded the maximum size"}),e.end();return}let s=t.indexOf(`
 `);for(;s>=0;){let i=t.slice(0,s);t=t.slice(s+1),i.trim()&&this.handleLine(e,i),s=t.indexOf(`
-`)}})}write(e,r){if(!e.destroyed)try{e.write(y(r))}catch{}}async handleLine(e,r){let t=h(r);if(!t.ok){this.refuse(t.reason,t.error),this.write(e,{id:t.id,ok:!1,reason:t.reason,error:t.error});return}let{request:n}=t;if(this.revoked||this.closed){this.refuse("revoked","grant revoked"),this.write(e,{id:n.id,ok:!1,reason:"revoked",error:"worker tools are no longer available for this task"});return}if(this.now()>=this.opts.expiresAt){this.refuse("grant_expired","grant expired"),this.write(e,{id:n.id,ok:!1,reason:"grant_expired",error:"worker tools are no longer available for this task"});return}if(n.op==="list_tools"){this.write(e,{id:n.id,ok:!0,tools:this.toolDescriptors});return}if(!k(n.name)){this.refuse("unknown_tool",n.name),this.write(e,{id:n.id,ok:!1,reason:"unknown_tool",error:`unknown tool: ${n.name}`});return}if(!this.grantedTools.includes(n.name)){this.refuse("capability_not_granted",n.name),this.write(e,{id:n.id,ok:!1,reason:"capability_not_granted",error:`tool not granted for this task: ${n.name}`});return}try{let s=await O({apiBaseUrl:this.opts.apiBaseUrl,agentOsId:this.opts.agentOsId,taskId:this.opts.taskId,token:this.opts.token,fetchImpl:this.fetchImpl},n.name,n.args??{});this.write(e,{id:n.id,ok:!0,result:s})}catch(s){let i=s instanceof Error?s.message:"request failed";this.refuse("upstream_error",i),this.write(e,{id:n.id,ok:!1,reason:"upstream_error",error:i})}}};var b={posture:"scoped",summary:"scoped: per-worker endpoint in an owner-only (0700) directory, one connection at a time. Peer identity is not observed \u2014 another process of the same OS user is not excluded.",verify:async()=>({ok:!0})};function z(){return b}import G from"node:net";var Q=6e4,w=class o{socket;pending=new Map;timeoutMs;buffer="";nextId=1;closedReason=null;constructor(e,r){this.socket=e,this.timeoutMs=r,e.setEncoding("utf8"),e.on("data",t=>this.onData(t)),e.on("close",()=>this.failAll("worker tools connection closed")),e.on("error",t=>this.failAll(t.message))}static connect(e,r=Q){return new Promise((t,n)=>{let s=G.createConnection(e),i=d=>{s.destroy(),n(d)};s.once("error",i),s.once("connect",()=>{s.removeListener("error",i),t(new o(s,r))})})}onData(e){this.buffer+=e;let r=this.buffer.indexOf(`
+`)}})}write(e,r){if(!e.destroyed)try{e.write(y(r))}catch{}}async handleLine(e,r){let t=h(r);if(!t.ok){this.refuse(t.reason,t.error),this.write(e,{id:t.id,ok:!1,reason:t.reason,error:t.error});return}let{request:n}=t;if(this.revoked||this.closed){this.refuse("revoked","grant revoked"),this.write(e,{id:n.id,ok:!1,reason:"revoked",error:"worker tools are no longer available for this task"});return}if(this.now()>=this.opts.expiresAt){this.refuse("grant_expired","grant expired"),this.write(e,{id:n.id,ok:!1,reason:"grant_expired",error:"worker tools are no longer available for this task"});return}if(n.op==="list_tools"){this.write(e,{id:n.id,ok:!0,tools:this.toolDescriptors});return}if(!k(n.name)){this.refuse("unknown_tool",n.name),this.write(e,{id:n.id,ok:!1,reason:"unknown_tool",error:`unknown tool: ${n.name}`});return}if(!this.grantedTools.includes(n.name)){this.refuse("capability_not_granted",n.name),this.write(e,{id:n.id,ok:!1,reason:"capability_not_granted",error:`tool not granted for this task: ${n.name}`});return}try{let s=await O({apiBaseUrl:this.opts.apiBaseUrl,agentOsId:this.opts.agentOsId,taskId:this.opts.taskId,token:this.opts.token,fetchImpl:this.fetchImpl},n.name,n.args??{});this.write(e,{id:n.id,ok:!0,result:s})}catch(s){let i=s instanceof Error?s.message:"request failed";this.refuse("upstream_error",i),this.write(e,{id:n.id,ok:!1,reason:"upstream_error",error:i})}}};var b={posture:"scoped",summary:"scoped: per-worker endpoint in an owner-only (0700) directory, one connection at a time. Peer identity is not observed \u2014 another process of the same OS user is not excluded.",verify:async()=>({ok:!0})};function z(){return b}import G from"node:net";var Q=6e4,W=class o{socket;pending=new Map;timeoutMs;buffer="";nextId=1;closedReason=null;constructor(e,r){this.socket=e,this.timeoutMs=r,e.setEncoding("utf8"),e.on("data",t=>this.onData(t)),e.on("close",()=>this.failAll("worker tools connection closed")),e.on("error",t=>this.failAll(t.message))}static connect(e,r=Q){return new Promise((t,n)=>{let s=G.createConnection(e),i=d=>{s.destroy(),n(d)};s.once("error",i),s.once("connect",()=>{s.removeListener("error",i),t(new o(s,r))})})}onData(e){this.buffer+=e;let r=this.buffer.indexOf(`
 `);for(;r>=0;){let t=this.buffer.slice(0,r);this.buffer=this.buffer.slice(r+1),t.trim()&&this.dispatch(t),r=this.buffer.indexOf(`
 `)}}dispatch(e){let r;try{r=JSON.parse(e)}catch{return}if(!r.id){let n="error"in r?r.error:"worker tools unavailable";this.failAll(n);return}let t=this.pending.get(r.id);t&&(this.pending.delete(r.id),clearTimeout(t.timer),t.resolve(r))}failAll(e){this.closedReason??=e;for(let[r,t]of this.pending)this.pending.delete(r),clearTimeout(t.timer),t.reject(new Error(e))}send(e){if(this.closedReason)return Promise.reject(new Error(this.closedReason));let r=String(this.nextId++);return new Promise((t,n)=>{let s=setTimeout(()=>{this.pending.delete(r),n(new Error("worker tools request timed out"))},this.timeoutMs);s.unref?.(),this.pending.set(r,{resolve:t,reject:n,timer:s}),this.socket.write(`${JSON.stringify({v:1,id:r,...e})}
-`,i=>{i&&(this.pending.delete(r),clearTimeout(s),n(i))})})}async listTools(){let e=await this.send({op:"list_tools"});if(!e.ok)throw new Error(e.error);return"tools"in e?e.tools:[]}async callTool(e,r){let t=await this.send({op:"call_tool",name:e,args:r});return t.ok?{ok:!0,result:"result"in t?t.result:null}:{ok:!1,error:t.error}}close(){this.failAll("worker tools client closed"),this.socket.destroy()}};import re from"node:path";import{existsSync as Ke,mkdirSync as Ce,readFileSync as Z,readdirSync as Ae,renameSync as Me,rmSync as Le,statSync as De,writeFileSync as qe}from"node:fs";function ee(o){console.error(o),process.exit(1)}function N(o,e){try{return JSON.parse(Z(o,"utf8"))}catch(r){if(arguments.length>1)return e;ee(`failed to read ${o}: ${r.message}`)}}function I(o){if(!o)return!1;try{return process.kill(o,0),!0}catch{return!1}}var a=new Map,m=new Map;function f(o){clearInterval(m.get(o)),m.delete(o)}function oe(o,e){if(f(o),!a.has(o))return;let r=setInterval(()=>{(N(re.join(o,"worker.json"),null)?.completionReportedAt||!I(e))&&C(o)},1e3);r.unref(),m.set(o,r)}function te(o,e){f(o);let r=a.get(o);r&&r.close(),a.set(o,e)}function ne(o){return a.get(o)}async function K(o){f(o);let e=a.get(o);return e?(a.delete(o),await e.close(),!0):!1}function C(o){K(o).catch(()=>{})}async function se(){for(let e of m.keys())f(e);let o=[...a.values()];a.clear(),await Promise.all(o.map(e=>e.close().catch(()=>{})))}function ie(){return a.size}export{b as SCOPED_WORKER_BROKER_IDENTITY,_ as WORKER_BROKER_MAX_CONCURRENT_CONNECTIONS,g as WORKER_BROKER_MAX_LINE_BYTES,u as WORKER_BROKER_PROTOCOL_VERSION,x as WORKER_BROKER_SOCKET_ENV,R as WORKER_TOOL_DESCRIPTORS,W as WorkerBroker,w as WorkerBrokerClient,oe as bindWorkerBrokerLifetime,se as closeAllWorkerBrokers,K as closeWorkerBroker,C as closeWorkerBrokerSync,y as encodeBrokerFrame,S as ensureWorkerBrokerSocketDir,O as executeWorkerTool,ne as getWorkerBroker,F as isNamedPipePath,k as isWorkerToolName,h as parseBrokerRequest,te as registerWorkerBroker,V as resolveWorkerBrokerAddress,z as resolveWorkerBrokerIdentity,ie as workerBrokerCount};
+`,i=>{i&&(this.pending.delete(r),clearTimeout(s),n(i))})})}async listTools(){let e=await this.send({op:"list_tools"});if(!e.ok)throw new Error(e.error);return"tools"in e?e.tools:[]}async callTool(e,r){let t=await this.send({op:"call_tool",name:e,args:r});return t.ok?{ok:!0,result:"result"in t?t.result:null}:{ok:!1,error:t.error}}close(){this.failAll("worker tools client closed"),this.socket.destroy()}};import re from"node:path";import{existsSync as Ke,mkdirSync as Ce,readFileSync as Z,readdirSync as Ae,renameSync as Me,rmSync as Le,statSync as De,writeFileSync as qe}from"node:fs";function ee(o){console.error(o),process.exit(1)}function N(o,e){try{return JSON.parse(Z(o,"utf8"))}catch(r){if(arguments.length>1)return e;ee(`failed to read ${o}: ${r.message}`)}}function I(o){if(!o)return!1;try{return process.kill(o,0),!0}catch{return!1}}var a=new Map,m=new Map;function f(o){clearInterval(m.get(o)),m.delete(o)}function oe(o,e){if(f(o),!a.has(o))return;let r=setInterval(()=>{(N(re.join(o,"worker.json"),null)?.completionReportedAt||!I(e))&&C(o)},1e3);r.unref(),m.set(o,r)}function te(o,e){f(o);let r=a.get(o);r&&r.close(),a.set(o,e)}function ne(o){return a.get(o)}async function K(o){f(o);let e=a.get(o);return e?(a.delete(o),await e.close(),!0):!1}function C(o){K(o).catch(()=>{})}async function se(){for(let e of m.keys())f(e);let o=[...a.values()];a.clear(),await Promise.all(o.map(e=>e.close().catch(()=>{})))}function ie(){return a.size}export{b as SCOPED_WORKER_BROKER_IDENTITY,_ as WORKER_BROKER_MAX_CONCURRENT_CONNECTIONS,g as WORKER_BROKER_MAX_LINE_BYTES,u as WORKER_BROKER_PROTOCOL_VERSION,T as WORKER_BROKER_SOCKET_ENV,R as WORKER_TOOL_DESCRIPTORS,w as WorkerBroker,W as WorkerBrokerClient,oe as bindWorkerBrokerLifetime,se as closeAllWorkerBrokers,K as closeWorkerBroker,C as closeWorkerBrokerSync,y as encodeBrokerFrame,S as ensureWorkerBrokerSocketDir,O as executeWorkerTool,ne as getWorkerBroker,F as isNamedPipePath,k as isWorkerToolName,h as parseBrokerRequest,te as registerWorkerBroker,V as resolveWorkerBrokerAddress,z as resolveWorkerBrokerIdentity,ie as workerBrokerCount};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.2.118",
+  "version": "0.2.127",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",
@@ -185,7 +185,7 @@
     "!dist/**/*.d.ts.map"
   ],
   "scripts": {
-    "build": "esbuild src/provider-terminal-failure.ts src/cli.ts src/index.ts src/node-runtime-policy.ts src/local-run-store/index.ts src/worker-broker/index.ts src/worker-persona-catalog.ts src/instruction-bundle/contract.ts src/chat/command-auth-proof.ts src/chat/chat-turn-envelope.ts src/chat/chat-access-change-record.ts src/dispatch-claim-authorization.ts src/desktop-entry.ts src/server/monitor.ts src/server/landing.ts src/server/worker-policy.ts src/server/orchestration.ts src/server/adapter-contract.ts src/server/context-budget-receipt.ts src/server/context-budget.ts src/server/prompt.ts src/server/node-runtime-policy.ts src/server/model-routing.ts src/server/dispatch-routing.ts src/server/db-credentials.ts src/server/heavy-verification.ts src/server/memory-cost.ts src/server/pr-evidence.ts src/server/default-repo.ts src/server/cleanup.ts src/server/repo-search.ts src/server/harness-notice.ts src/server/memory-cost-enforce.ts src/server/wsl-crash-dumps.ts --bundle --platform=node --format=esm --packages=external --outbase=src --outdir=dist --minify && tsc -p tsconfig.json --emitDeclarationOnly && node scripts/chmod-cli-bin.mjs",
+    "build": "esbuild src/provider-terminal-failure.ts src/cli.ts src/daemon-tick-thread.ts src/index.ts src/node-runtime-policy.ts src/local-run-store/index.ts src/worker-broker/index.ts src/worker-persona-catalog.ts src/instruction-bundle/contract.ts src/chat/command-auth-proof.ts src/chat/chat-turn-envelope.ts src/chat/chat-access-change-record.ts src/dispatch-claim-authorization.ts src/desktop-entry.ts src/server/monitor.ts src/server/landing.ts src/server/worker-policy.ts src/server/orchestration.ts src/server/adapter-contract.ts src/server/context-budget-receipt.ts src/server/context-budget.ts src/server/prompt.ts src/server/node-runtime-policy.ts src/server/model-routing.ts src/server/dispatch-routing.ts src/server/db-credentials.ts src/server/heavy-verification.ts src/server/memory-cost.ts src/server/pr-evidence.ts src/server/default-repo.ts src/server/cleanup.ts src/server/repo-search.ts src/server/harness-notice.ts src/server/memory-cost-enforce.ts src/server/wsl-crash-dumps.ts --bundle --platform=node --format=esm --packages=external --outbase=src --outdir=dist --minify && tsc -p tsconfig.json --emitDeclarationOnly && node scripts/chmod-cli-bin.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run --config vitest.config.ts",
     "prepublishOnly": "node ../../scripts/npm-publish-guard.mjs && npm run build",