@kynver-app/runtime 0.2.122 → 0.2.129

package/dist/server/worker-policy.js

@@ -1,2 +1,66 @@
-var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function X(e){let r=e[Br];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function k(e,r={}){return Wr.has(e)?!0:Mr.has(e)||r.operatorAllow?.has(e)||Ur.some(t=>e.endsWith(t))?!1:Kr.some(t=>e.endsWith(t))}function ke(e){let r=X(e);return Object.keys(e).filter(t=>k(t,{operatorAllow:r})).sort()}function _e(e){let r=X(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!k(t,{operatorAllow:r})&&k(t)).sort()}function A(e){let r=X(e),t={...e};for(let n of Object.keys(t))k(n,{operatorAllow:r})&&delete t[n];return t}function Lr(e){let r=ke(e),t=_e(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var Nr,Wr,Kr,Dr,Mr,Ur,Br,w=o(()=>{"use strict";Nr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Wr=new Set(Nr),Kr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],Dr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Mr=new Set(Dr),Ur=["_PUBLIC_KEY"],Br="KYNVER_WORKER_ENV_ALLOW"});var m=o(()=>{"use strict"});var Ae=o(()=>{"use strict"});function T(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict";Ae()});var W=o(()=>{"use strict";m();a();w()});var we=o(()=>{"use strict";W()});var ee=o(()=>{"use strict";W();m();we()});var re=o(()=>{"use strict";a()});var f=o(()=>{"use strict"});var K=o(()=>{"use strict"});var Pe=o(()=>{"use strict"});var Xn,Qn,te=o(()=>{"use strict";Xn=25*1024*1024*1024,Qn=12*1024*1024*1024});var no,oo,Ie=o(()=>{"use strict";te();no=5*1024*1024*1024,oo=10*1024*1024*1024});var uo,po,ne=o(()=>{"use strict";Ie();te();uo=30*1024*1024*1024,po=15*1024*1024*1024});var Ne=o(()=>{"use strict";a()});import nt from"node:path";var _o,oe=o(()=>{"use strict";m();Ne();_o=nt.join(".openclaw","harness")});var M=o(()=>{"use strict";g();f();K();U();oe()});var De=o(()=>{"use strict";g();oe();M();a()});var se=o(()=>{"use strict";De();a()});var Me=o(()=>{"use strict";se();a()});var Ue=o(()=>{"use strict"});var Be=o(()=>{"use strict";Ue();a()});var Le=o(()=>{"use strict"});var Fe=o(()=>{"use strict";Le()});var L=o(()=>{"use strict"});var $e=o(()=>{"use strict"});var He=o(()=>{"use strict"});var Ve=o(()=>{"use strict";Fe();a();L();$e();He()});var je=o(()=>{"use strict";L()});var Ye=o(()=>{"use strict"});var Si,Ci,Ge=o(()=>{"use strict";W();Si=10*6e4,Ci=60*6e4});var qe=o(()=>{"use strict"});var ae=o(()=>{"use strict"});var Je=o(()=>{"use strict"});var ze=o(()=>{"use strict";ae();Je()});var Xe=o(()=>{"use strict";Be();Ve();L();je();Ye();Ge();qe();ze();ae();a()});var Qe=o(()=>{"use strict";Xe();a()});var ft,gt,Ze=o(()=>{"use strict";Pe();g();f();K();U();ne();se();Me();Qe();a();ft=500*1024*1024,gt=4*1024*1024*1024});var U=o(()=>{"use strict";Ze()});import{homedir as ht}from"node:os";import yt from"node:path";var er,le=o(()=>{"use strict";er=yt.join(ht(),".kynver",".env")});var rr=o(()=>{"use strict"});var tr=o(()=>{"use strict";rr()});var nr=o(()=>{"use strict"});var or=o(()=>{"use strict";a()});var ce=o(()=>{"use strict";tr();nr();or()});var ir=o(()=>{"use strict"});var sr=o(()=>{"use strict";ir()});var F=o(()=>{"use strict";le();m();g();ce();sr()});var ar=o(()=>{"use strict";f();f()});var lr=o(()=>{"use strict";le();ce();F()});var ue=o(()=>{"use strict"});var cr=o(()=>{"use strict";ee();f();ar();g();F();lr();re();ue();M()});function _(e){let r=e.trim().toLowerCase();return Ot[r]??r}var ur,Ct,Ot,$=o(()=>{"use strict";ur=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],Ct=ur.join("|"),Ot={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});var dr=o(()=>{"use strict";m()});var pr=o(()=>{"use strict";dr()});var mr=o(()=>{"use strict"});var fr=o(()=>{"use strict";mr()});import{homedir as wt,totalmem as al}from"node:os";import de from"node:path";var gr,xl,El,Sl,Cl,g=o(()=>{"use strict";ee();m();re();f();K();U();ne();F();cr();$();M();pr();ue();fr();gr=de.join(wt(),".kynver"),xl=de.join(gr,"config.json"),El=de.join(gr,"credentials"),Sl=500*1024*1024,Cl=4*1024*1024*1024});w();w();var Q="KYNVER_NO_PROD_DB_CREDENTIALS",Fr=["KYNVER_ENV_FILE"],$r=new Set(["1","true","yes","on"]);function xe(e){let r=e[Q]?.trim().toLowerCase();return r!==void 0&&$r.has(r)}function d(e,r={}){let t=A(e);if(!r.reviewWorker)return t;let n={...t,[Q]:"1"};for(let i of Fr)delete n[i];return n}var be=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Hr(e,r={}){let t=d(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||be.includes(c)),i=be.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=xe(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var Vr="expert-lane-pr-review:",jr="plan-review-task",Yr="scheduledjob:",P=new Set(["lorentz","dalton","rhea","sentinel"]);function Gr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function Z(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function qr(e,r){return e.startsWith("factory:")?e.includes("lb")||Z(r):!1}function Jr(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
-${n}`,s=Gr(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(Vr)||r===jr||r.startsWith("daemon-review:")||s&&P.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||qr(r,i)||Z(i))||r.startsWith(Yr)&&e.parentTaskId&&s&&P.has(s)||e.planId&&!e.parentTaskId&&s&&P.has(s)&&Z(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&P.has(s))}var zr=/^claude[-_]/i,Xr=/^(?:opus|sonnet|haiku)\b/i;function Ee(e){let r=e.trim();return zr.test(r)||Xr.test(r)}function Se(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Ce(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Oe(e){return e.trim().toLowerCase().startsWith("gemini-")}function Qr(e){return Se(e)?"codex":Ee(e)?"claude":Oe(e)?"gemini":(Ce(e),"cursor")}function Zr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:i,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:i,rule:i?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function et(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Ee(n)||Se(n)||Ce(n)||Oe(n)?{lane:t,model:n,provider:Qr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function I(e){let r=typeof e=="string"?e.trim():"";return r?Zr(r)??et(r):null}g();a();a();var vr="kynver",Rr=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Kt=Rr.map(e=>`mcp__${vr}__${e}`);a();a();var Gc=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5";function Mt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5"}var Ut=Mt();a();var xu=600*1e3;a();var ju=600*1e3;var kr="composer-2.5";$();$();var p="cursor",$t=new Set(["claude","opus","anthropic"]),Ht=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function x(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return $t.has(r)?!0:r.includes("claude")||r.includes("opus")}function pe(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=x(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=I(x(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(Vt(n.model)))return!0;let i=x(e,"description");if(Ht.some(l=>l.test(i)))return!0;let s=x(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function Vt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function jt(e,r){return{provider:p,model:kr,rule:`policy:cursor_default${r}`,requestedModel:e}}var Yt=["explicit:","executor_ref:","factory:","task:"];function Gt(e){return Yt.some(r=>e.startsWith(r))}function me(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||I(x(e,"executorRef"))?.provider?!0:pe(e)}function _r(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Gt(r.rule)||me(t)||!u(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return jt(r.model,i)}function qt(e,r=p){let t=e?.trim();return t?_(t):r}function Jt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(p)?[...new Set(r.map(t=>u(t)?p:t))]:r.every(t=>u(t))?[p]:r}var zt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,Xt=/\b(npm run build\b|next build\b)\b/i,Qt=/\b(vercel (build|deploy|--prod))\b/i,Zt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function fe(e){let r=e.trim();return r?Zt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:Qt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:Xt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:zt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var Y="heavy_verification_token_required";import{spawnSync as vn}from"node:child_process";a();import{closeSync as sn,existsSync as S,mkdirSync as an,openSync as ln,readdirSync as Sr,readFileSync as cn,statSync as un,unlinkSync as Cr,writeFileSync as dn}from"node:fs";import ye from"node:path";import{mkdirSync as rn}from"node:fs";import{tmpdir as tn}from"node:os";import G from"node:path";import{homedir as en,tmpdir as hd}from"node:os";import br from"node:path";function xr(){let e=process.env.KYNVER_STATE_ROOT;return e?br.resolve(e):br.join(en(),".kynver","state")}function nn(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function on(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?G.resolve(e):nn()?G.join(tn(),"kynver","state","heavy-verification"):G.join(xr(),"heavy-verification")}function ge(){return G.join(on(),"slots")}function E(){let e=ge();return rn(e,{recursive:!0}),e}var C=120*6e4,Er=1;function pn(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function J(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function q(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?pn(e,Er):Er}function mn(e){return`slot-${e}`}function fn(e,r=ge()){return ye.join(r,`${e}.json`)}function ve(e){if(!S(e))return null;try{let r=JSON.parse(cn(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function Or(e,r=C){if(!e||!T(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function Ar(e,r){let t=ve(e);if(t)return Or(t,r);if(!S(e))return!0;try{return Date.now()-un(e).mtimeMs>r}catch{return!0}}function gn(e,r){if(Ar(e,r))try{Cr(e)}catch{}}function hn(e){return an(e,{recursive:!0}),e}function Re(e={}){let r=hn(e.slotsDir??E()),t=e.staleMs??C,n=0;for(let i of Sr(r)){if(!i.endsWith(".json"))continue;let s=ye.join(r,i),l=S(s);gn(s,t),l&&!S(s)&&(n+=1)}return n}function yn(e={}){let r=e.slotsDir??E(),t=e.staleMs??C;Re({slotsDir:r,staleMs:t});let n=[];for(let i of Sr(r)){if(!i.endsWith(".json"))continue;let s=ve(ye.join(r,i));s&&!Or(s,t)&&n.push(s)}return n}function he(e={}){return yn(e).length}function O(e,r={}){if(J())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:q(),reason:null};let t=r.slotsDir??E(),n=r.staleMs??C,i=r.maxSlots??q();Re({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=mn(l),v=fn(c,t),Pr=ve(v);if(Ar(v,n))try{Cr(v)}catch{}else if(Pr||S(v))continue;let Ir={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let R=ln(v,"wx");dn(R,JSON.stringify(Ir,null,2),"utf8"),sn(R);let Tr=he({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:Tr,maxSlots:i,reason:null}}catch(R){if(R.code==="EEXIST")continue;throw R}}let s=he({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function z(e,r={}){if(J())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:q(),reason:null};let t=r.slotsDir??E(),n=r.staleMs??C,i=r.maxSlots??q();Re({slotsDir:t,staleMs:n});let s=he({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Rn(e){e<=0||vn(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore",windowsHide:!0})}function wr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=O(e,n);for(;!s.admitted&&Date.now()<i;)Rn(Math.min(t,i-Date.now())),s=O(e,n);return s}function kn(e,r={}){let t=fe(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...z(e),slotId:null}};if(J())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...z(e),slotId:null}};let n=r.waitMs??0,i=n>0?wr(e,n,r.pollMs):O(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:Y,commandClass:t.commandClass,reason:t.reason??i.reason??Y,verificationGate:i}}export{p as DEFAULT_WORKER_PROVIDER,Y as HEAVY_VERIFICATION_TOKEN_REQUIRED,Q as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Hr as auditReviewWorkerCredentialScope,Lr as auditWorkerEnv,d as buildWorkerSpawnEnv,fe as classifyHeavyShellCommand,_r as enforceCursorWorkerProvider,kn as gateWorkerShellCommand,u as isClaudeFamilyProvider,k as isForbiddenWorkerEnvKey,Jr as isHarnessExpertReviewWorker,xe as isNoProdCredentialReviewEnvironment,ke as listForbiddenWorkerEnvKeys,_e as listOperatorAllowedWorkerEnvKeys,_ as normalizeWorkerProviderName,Jt as preferCursorExecutor,qt as resolveConfiguredWorkerProvider,A as scrubWorkerEnv,pe as taskAllowsClaudeWorker,me as taskExpressesWorkerProviderPreference};
+var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function re(e){let r=e[Hr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function k(e,r={}){return Br.has(e)?!0:Fr.has(e)||r.operatorAllow?.has(e)||$r.some(t=>e.endsWith(t))?!1:Ur.some(t=>e.endsWith(t))}function be(e){let r=re(e);return Object.keys(e).filter(t=>k(t,{operatorAllow:r})).sort()}function Ee(e){let r=re(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!k(t,{operatorAllow:r})&&k(t)).sort()}function P(e){let r=re(e),t={...e};for(let n of Object.keys(t))k(n,{operatorAllow:r})&&delete t[n];return t}function jr(e){let r=be(e),t=Ee(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var Mr,Br,Ur,Lr,Fr,$r,Hr,I=o(()=>{"use strict";Mr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Br=new Set(Mr),Ur=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],Lr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Fr=new Set(Lr),$r=["_PUBLIC_KEY"],Hr="KYNVER_WORKER_ENV_ALLOW"});var f=o(()=>{"use strict"});var Ie=o(()=>{"use strict"});function W(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict";Ie()});var D=o(()=>{"use strict";f();a();I()});var Te=o(()=>{"use strict";D()});var oe=o(()=>{"use strict";D();f();Te()});var ie=o(()=>{"use strict";a()});var g=o(()=>{"use strict"});var M=o(()=>{"use strict"});var Ne=o(()=>{"use strict"});var no,oo,se=o(()=>{"use strict";no=25*1024*1024*1024,oo=12*1024*1024*1024});var co,uo,We=o(()=>{"use strict";se();co=5*1024*1024*1024,uo=10*1024*1024*1024});var yo,vo,ae=o(()=>{"use strict";We();se();yo=30*1024*1024*1024,vo=15*1024*1024*1024});var Ke=o(()=>{"use strict";a()});import at from"node:path";var Oo,ce=o(()=>{"use strict";f();Ke();Oo=at.join(".openclaw","harness")});var U=o(()=>{"use strict";h();g();M();L();ce()});var Be=o(()=>{"use strict";h();ce();U();a()});var H=o(()=>{"use strict";Be();a()});var Le=o(()=>{"use strict";H();a()});var Fe=o(()=>{"use strict"});var $e=o(()=>{"use strict";Fe();a()});var He=o(()=>{"use strict"});var je=o(()=>{"use strict";He()});var j=o(()=>{"use strict"});var Ve=o(()=>{"use strict"});var Ye=o(()=>{"use strict"});var Ge=o(()=>{"use strict";je();a();j();Ve();Ye()});var Ei,u=o(()=>{"use strict";Ei=String.raw`"use strict";
+const cp = require("child_process"), fs = require("fs");
+const argv = process.argv.slice(1);
+const exitFile = argv[0], cmd = argv[1], args = argv.slice(2);
+const startedMs = Date.now();
+function cgroupOomKills() {
+  try {
+    const line = fs.readFileSync("/proc/self/cgroup", "utf8").split("\n").find((l) => l.startsWith("0::"));
+    if (!line) return null;
+    const file = "/sys/fs/cgroup" + line.slice(3).trim().replace(/\/$/, "") + "/memory.events";
+    const m = /(?:^|\n)oom_kill (\d+)/.exec(fs.readFileSync(file, "utf8"));
+    return m ? Number(m[1]) : null;
+  } catch { return null; }
+}
+function kernelLog() {
+  const override = process.env.KYNVER_EXIT_CAPTURE_KERNEL_LOG_FILE;
+  if (override) { try { return fs.readFileSync(override, "utf8"); } catch { return ""; } }
+  const run = (bin, a) => {
+    try {
+      const r = cp.spawnSync(bin, a, { encoding: "utf8", timeout: 3000, maxBuffer: 8 * 1024 * 1024, stdio: ["ignore", "pipe", "ignore"] });
+      return r.status === 0 ? String(r.stdout || "") : "";
+    } catch { return ""; }
+  };
+  return run("journalctl", ["-k", "-q", "--no-pager", "--since", "@" + Math.floor(startedMs / 1000)]) || run("dmesg", []);
+}
+const oomBefore = cgroupOomKills();
+let child, finished = false;
+function write(rec) {
+  try { fs.writeFileSync(exitFile, JSON.stringify(rec, null, 2) + "\n"); } catch {}
+}
+function finish(code, signal, spawnError) {
+  if (finished) return;
+  finished = true;
+  const rec = { exitCode: code, signal: signal || null, startedAt: new Date(startedMs).toISOString(), endedAt: new Date().toISOString(), childPid: child && child.pid };
+  if (spawnError) rec.spawnError = spawnError;
+  if (signal === "SIGKILL" || code === 137 || (code !== 0 && code !== null)) {
+    const oomAfter = cgroupOomKills();
+    if (oomBefore !== null && oomAfter !== null && oomAfter > oomBefore) {
+      rec.oomEvidence = { source: "cgroup", detail: "memory.events oom_kill " + oomBefore + " -> " + oomAfter };
+    } else if (signal === "SIGKILL" || code === 137) {
+      const pid = child && child.pid;
+      const hit = kernelLog().split("\n").find((l) => pid && new RegExp("(?:Killed process|oom-kill:.*pid=|Memory cgroup out of memory: Killed process) ?" + pid + "\\b").test(l));
+      if (hit) rec.oomEvidence = { source: "kernel_log", detail: hit.trim().slice(0, 300) };
+    }
+  }
+  write(rec);
+  if (signal) {
+    const n = (require("os").constants.signals || {})[signal];
+    process.exit(128 + (n || 9));
+  }
+  process.exit(code === null ? 1 : code);
+}
+try {
+  child = cp.spawn(cmd, args, { stdio: "inherit" });
+} catch (e) {
+  process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
+  finish(127, null, String(e && e.message));
+}
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
+child.on("error", (e) => {
+  process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
+  if (!child.pid) finish(127, null, String(e && e.message));
+});
+child.on("exit", (code, signal) => finish(code, signal));
+`});var qe=o(()=>{"use strict";H();a();u()});var Je=o(()=>{"use strict";j()});var ze=o(()=>{"use strict"});var Bi,Ui,Xe=o(()=>{"use strict";D();Bi=10*6e4,Ui=60*6e4});var Ze=o(()=>{"use strict"});var ue=o(()=>{"use strict"});var Qe=o(()=>{"use strict"});var er=o(()=>{"use strict";ue();Qe()});var rr=o(()=>{"use strict";$e();Ge();qe();u();j();Je();ze();Xe();Ze();er();ue();a()});var tr=o(()=>{"use strict";rr();a()});var Rt,kt,nr=o(()=>{"use strict";Ne();h();g();M();L();ae();H();Le();tr();a();Rt=500*1024*1024,kt=4*1024*1024*1024});var L=o(()=>{"use strict";nr()});import{homedir as xt}from"node:os";import bt from"node:path";var or,de=o(()=>{"use strict";or=bt.join(xt(),".kynver",".env")});var ir=o(()=>{"use strict"});var sr=o(()=>{"use strict";ir()});var ar=o(()=>{"use strict"});var lr=o(()=>{"use strict";a()});var pe=o(()=>{"use strict";sr();ar();lr()});var cr=o(()=>{"use strict"});var ur=o(()=>{"use strict";cr()});var V=o(()=>{"use strict";de();f();h();pe();ur()});var dr=o(()=>{"use strict";g();g()});var pr=o(()=>{"use strict";de();pe();V()});var me=o(()=>{"use strict"});var mr=o(()=>{"use strict";oe();g();dr();h();V();pr();ie();me();U()});function x(e){let r=e.trim().toLowerCase();return Nt[r]??r}var fr,Tt,Nt,Y=o(()=>{"use strict";fr=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],Tt=fr.join("|"),Nt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});var gr=o(()=>{"use strict";f()});var hr=o(()=>{"use strict";gr()});var yr=o(()=>{"use strict"});var vr=o(()=>{"use strict";yr()});import{homedir as Kt,totalmem as El}from"node:os";import fe from"node:path";var _r,Ll,Fl,$l,Hl,h=o(()=>{"use strict";oe();f();ie();g();M();L();ae();V();mr();Y();U();hr();me();vr();_r=fe.join(Kt(),".kynver"),Ll=fe.join(_r,"config.json"),Fl=fe.join(_r,"credentials"),$l=500*1024*1024,Hl=4*1024*1024*1024});I();I();var te="KYNVER_NO_PROD_DB_CREDENTIALS",Vr=["KYNVER_ENV_FILE"],Yr=new Set(["1","true","yes","on"]);function Ce(e){let r=e[te]?.trim().toLowerCase();return r!==void 0&&Yr.has(r)}function p(e,r={}){let t=P(e);if(!r.reviewWorker)return t;let n={...t,[te]:"1"};for(let i of Vr)delete n[i];return n}var Se=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Gr(e,r={}){let t=p(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||Se.includes(c)),i=Se.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=Ce(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var qr="expert-lane-pr-review:",Jr="plan-review-task",zr="scheduledjob:",T=new Set(["lorentz","dalton","rhea","sentinel"]);function Xr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function ne(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function Zr(e,r){return e.startsWith("factory:")?e.includes("lb")||ne(r):!1}function Qr(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
+${n}`,s=Xr(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(qr)||r===Jr||r.startsWith("daemon-review:")||s&&T.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Zr(r,i)||ne(i))||r.startsWith(zr)&&e.parentTaskId&&s&&T.has(s)||e.planId&&!e.parentTaskId&&s&&T.has(s)&&ne(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&T.has(s))}var et=/^claude[-_]/i,rt=/^(?:opus|sonnet|haiku)\b/i;function Oe(e){let r=e.trim();return et.test(r)||rt.test(r)}function Ae(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function we(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Pe(e){return e.trim().toLowerCase().startsWith("gemini-")}function tt(e){return Ae(e)?"codex":Oe(e)?"claude":Pe(e)?"gemini":(we(e),"cursor")}function nt(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:i,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:i,rule:i?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function ot(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Oe(n)||Ae(n)||we(n)||Pe(n)?{lane:t,model:n,provider:tt(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function N(e){let r=typeof e=="string"?e.trim():"";return r?nt(r)??ot(r):null}h();u();a();u();a();var xr="kynver",br=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Ft=br.map(e=>`mcp__${xr}__${e}`);u();a();u();a();var mu=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5";function Ht(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5"}var jt=Ht();u();a();var Vu=600*1e3;u();a();var fd=600*1e3;var Er="composer-2.5";Y();Y();var m="cursor",qt=new Set(["claude","opus","anthropic"]),Jt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function S(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function d(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return qt.has(r)?!0:r.includes("claude")||r.includes("opus")}function ge(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&d(r))return!0;let t=S(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=N(S(e,"executorRef"));if(n?.provider&&d(n.provider)||n?.model&&d(zt(n.model)))return!0;let i=S(e,"description");if(Jt.some(l=>l.test(i)))return!0;let s=S(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function zt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Xt(e,r){return{provider:m,model:Er,rule:`policy:cursor_default${r}`,requestedModel:e}}var Zt=["explicit:","executor_ref:","factory:","task:"];function Qt(e){return Zt.some(r=>e.startsWith(r))}function he(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||N(S(e,"executorRef"))?.provider?!0:ge(e)}function Sr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&d(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Qt(r.rule)||he(t)||!d(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Xt(r.model,i)}function en(e,r=m){let t=e?.trim();return t?x(t):r}function rn(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(m)?[...new Set(r.map(t=>d(t)?m:t))]:r.every(t=>d(t))?[m]:r}var tn=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,nn=/\b(npm run build\b|next build\b)\b/i,on=/\b(vercel (build|deploy|--prod))\b/i,sn=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function ye(e){let r=e.trim();return r?sn.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:on.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:nn.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:tn.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var z="heavy_verification_token_required";import{spawnSync as En}from"node:child_process";a();import{closeSync as pn,existsSync as O,mkdirSync as mn,openSync as fn,readdirSync as wr,readFileSync as gn,statSync as hn,unlinkSync as Pr,writeFileSync as yn}from"node:fs";import Re from"node:path";import{mkdirSync as ln}from"node:fs";import{tmpdir as cn}from"node:os";import X from"node:path";import{homedir as an,tmpdir as Ud}from"node:os";import Cr from"node:path";function Or(){let e=process.env.KYNVER_STATE_ROOT;return e?Cr.resolve(e):Cr.join(an(),".kynver","state")}function un(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function dn(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?X.resolve(e):un()?X.join(cn(),"kynver","state","heavy-verification"):X.join(Or(),"heavy-verification")}function ve(){return X.join(dn(),"slots")}function C(){let e=ve();return ln(e,{recursive:!0}),e}var A=120*6e4,Ar=1;function vn(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function Q(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function Z(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?vn(e,Ar):Ar}function _n(e){return`slot-${e}`}function Rn(e,r=ve()){return Re.join(r,`${e}.json`)}function ke(e){if(!O(e))return null;try{let r=JSON.parse(gn(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function Ir(e,r=A){if(!e||!W(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function Tr(e,r){let t=ke(e);if(t)return Ir(t,r);if(!O(e))return!0;try{return Date.now()-hn(e).mtimeMs>r}catch{return!0}}function kn(e,r){if(Tr(e,r))try{Pr(e)}catch{}}function xn(e){return mn(e,{recursive:!0}),e}function xe(e={}){let r=xn(e.slotsDir??C()),t=e.staleMs??A,n=0;for(let i of wr(r)){if(!i.endsWith(".json"))continue;let s=Re.join(r,i),l=O(s);kn(s,t),l&&!O(s)&&(n+=1)}return n}function bn(e={}){let r=e.slotsDir??C(),t=e.staleMs??A;xe({slotsDir:r,staleMs:t});let n=[];for(let i of wr(r)){if(!i.endsWith(".json"))continue;let s=ke(Re.join(r,i));s&&!Ir(s,t)&&n.push(s)}return n}function _e(e={}){return bn(e).length}function w(e,r={}){if(Q())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Z(),reason:null};let t=r.slotsDir??C(),n=r.staleMs??A,i=r.maxSlots??Z();xe({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=_n(l),_=Rn(c,t),Wr=ke(_);if(Tr(_,n))try{Pr(_)}catch{}else if(Wr||O(_))continue;let Kr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let R=fn(_,"wx");yn(R,JSON.stringify(Kr,null,2),"utf8"),pn(R);let Dr=_e({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:Dr,maxSlots:i,reason:null}}catch(R){if(R.code==="EEXIST")continue;throw R}}let s=_e({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function ee(e,r={}){if(Q())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Z(),reason:null};let t=r.slotsDir??C(),n=r.staleMs??A,i=r.maxSlots??Z();xe({slotsDir:t,staleMs:n});let s=_e({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Sn(e){e<=0||En(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore",windowsHide:!0})}function Nr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=w(e,n);for(;!s.admitted&&Date.now()<i;)Sn(Math.min(t,i-Date.now())),s=w(e,n);return s}function Cn(e,r={}){let t=ye(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...ee(e),slotId:null}};if(Q())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...ee(e),slotId:null}};let n=r.waitMs??0,i=n>0?Nr(e,n,r.pollMs):w(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:z,commandClass:t.commandClass,reason:t.reason??i.reason??z,verificationGate:i}}export{m as DEFAULT_WORKER_PROVIDER,z as HEAVY_VERIFICATION_TOKEN_REQUIRED,te as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Gr as auditReviewWorkerCredentialScope,jr as auditWorkerEnv,p as buildWorkerSpawnEnv,ye as classifyHeavyShellCommand,Sr as enforceCursorWorkerProvider,Cn as gateWorkerShellCommand,d as isClaudeFamilyProvider,k as isForbiddenWorkerEnvKey,Qr as isHarnessExpertReviewWorker,Ce as isNoProdCredentialReviewEnvironment,be as listForbiddenWorkerEnvKeys,Ee as listOperatorAllowedWorkerEnvKeys,x as normalizeWorkerProviderName,rn as preferCursorExecutor,en as resolveConfiguredWorkerProvider,P as scrubWorkerEnv,ge as taskAllowsClaudeWorker,he as taskExpressesWorkerProviderPreference};

package/dist/worker-broker/index.js

@@ -1,7 +1,7 @@
-import Y from"node:net";import{chmodSync as H,unlinkSync as X}from"node:fs";var u=1,x="KYNVER_WORKER_BROKER_SOCKET",g=1048576,_=1;function y(o){return`${JSON.stringify(o)}
-`}function h(o){let e;try{e=JSON.parse(o)}catch{return{ok:!1,reason:"malformed_request",error:"request was not valid JSON",id:""}}if(!e||typeof e!="object"||Array.isArray(e))return{ok:!1,reason:"malformed_request",error:"request must be a JSON object",id:""};let r=e,t=typeof r.id=="string"?r.id:"";if(r.v!==1)return{ok:!1,reason:"unsupported_protocol",error:"unsupported protocol version (expected 1)",id:t};if(!t)return{ok:!1,reason:"malformed_request",error:"request id must be a non-empty string",id:""};if(r.op==="list_tools")return{ok:!0,request:{v:1,id:t,op:"list_tools"}};if(r.op==="call_tool"){if(typeof r.name!="string"||!r.name)return{ok:!1,reason:"malformed_request",error:"call_tool requires a tool name",id:t};let n=r.args&&typeof r.args=="object"&&!Array.isArray(r.args)?r.args:{};return{ok:!0,request:{v:1,id:t,op:"call_tool",name:r.name,args:n}}}return{ok:!1,reason:"malformed_request",error:"unknown op",id:t}}var A="kynver",l=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],ce=l.map(o=>`mcp__${A}__${o}`),M={"worker.context":["agent_os_context_envelope"],"worker.memory.read":["agent_os_search_memory"],"worker.skills.read":["agent_os_search_skills","agent_os_get_skill"],"worker.progress.report":["agent_os_progress_note"]};function E(o){if(!o||o.length===0)return[...l];let e=new Set;for(let r of o)for(let t of M[r]??[])e.add(t);return l.filter(r=>e.has(r))}var L="X-Kynver-Job-Token",R={agent_os_context_envelope:{name:"agent_os_context_envelope",description:"Fetch the context envelope for YOUR OWN task: goal/plan/task summaries, relevant memory, and recent session context. Optional memoryQuery focuses the memory portion.",inputSchema:{type:"object",properties:{memoryQuery:{type:"string",description:"Focus the memory portion of the envelope."},mode:{type:"string",description:"Envelope mode hint."}},additionalProperties:!1}},agent_os_search_memory:{name:"agent_os_search_memory",description:"Semantic search over the workspace's long-term memory. Returns a bounded top-N of relevant entries.",inputSchema:{type:"object",properties:{query:{type:"string",description:"What to search for."},k:{type:"integer",minimum:1,maximum:20,description:"How many entries to return."}},required:["query"],additionalProperties:!1}},agent_os_search_skills:{name:"agent_os_search_skills",description:"Search the workspace's skill library (bounded, metadata-only index). Use agent_os_get_skill to fetch one full skill by slug.",inputSchema:{type:"object",properties:{query:{type:"string"},limit:{type:"integer",minimum:1,maximum:25}},additionalProperties:!1}},agent_os_get_skill:{name:"agent_os_get_skill",description:"Fetch ONE full skill (including instructions) by slug.",inputSchema:{type:"object",properties:{slug:{type:"string"}},required:["slug"],additionalProperties:!1}},agent_os_progress_note:{name:"agent_os_progress_note",description:"Append a progress or blocker note to YOUR OWN task's journal. kind: 'progress' (default) or 'blocked'.",inputSchema:{type:"object",properties:{note:{type:"string"},kind:{type:"string",enum:["progress","blocked"]},eventKey:{type:"string"}},required:["note"],additionalProperties:!1}}};function D(o){return`/api/agent-os/by-id/${encodeURIComponent(o.agentOsId)}/worker`}async function c(o,e,r){let t=await o.fetchImpl(`${o.apiBaseUrl}${e}`,{method:r?.method??"GET",headers:{[L]:o.token,...r?{"Content-Type":"application/json"}:{}},...r?{body:JSON.stringify(r.body)}:{}});if(!t.ok)throw new Error(`request failed (${t.status})`);return t.json()}function p(o){return typeof o=="string"&&o.trim()?o.trim():void 0}async function O(o,e,r){let t=D(o);switch(e){case"agent_os_context_envelope":{let n=new URLSearchParams({task:o.taskId}),s=p(r.memoryQuery);s&&n.set("memoryQuery",s);let i=p(r.mode);return i&&n.set("mode",i),c(o,`${t}/context-envelope?${n.toString()}`)}case"agent_os_search_memory":{let n=new URLSearchParams({q:String(r.query??"")});return typeof r.k=="number"&&n.set("k",String(r.k)),c(o,`${t}/memory-search?${n.toString()}`)}case"agent_os_search_skills":{let n=new URLSearchParams,s=p(r.query);s&&n.set("q",s),typeof r.limit=="number"&&n.set("limit",String(r.limit));let i=n.toString();return c(o,`${t}/skills${i?`?${i}`:""}`)}case"agent_os_get_skill":return c(o,`${t}/skills/${encodeURIComponent(String(r.slug??""))}`);case"agent_os_progress_note":return c(o,`${t}/progress-note`,{method:"POST",body:{note:String(r.note??""),...r.kind==="blocked"?{kind:"blocked"}:{},...p(r.eventKey)?{eventKey:p(r.eventKey)}:{}}})}}function k(o){return l.includes(o)}import{createHash as q}from"node:crypto";import{chmodSync as $,mkdirSync as U}from"node:fs";import v from"node:os";import J from"node:path";var j=100,P="\\\\.\\pipe\\";function B(o,e){return q("sha256").update(o).digest("hex").slice(0,e)}function V(o){let e=o.platform??process.platform,r=B(o.agentOsId,12),t=B(o.workerKey,16);if(e==="win32")return{socketPath:`${P}kynver-worker-${r}-${t}`,socketDir:null,isNamedPipe:!0,relocated:!1};let n=J.posix,s=o.homeDir??v.homedir(),i=n.join(s,".kynver","brokers",r),d=n.join(i,`${t}.sock`);if(Buffer.byteLength(d,"utf8")<=j)return{socketPath:d,socketDir:i,isNamedPipe:!1,relocated:!1};let T=n.join(o.tmpDir??v.tmpdir(),`kynver-brokers-${r}`);return{socketPath:n.join(T,`${t}.sock`),socketDir:T,isNamedPipe:!1,relocated:!0}}function S(o){o.socketDir&&(U(o.socketDir,{recursive:!0,mode:448}),$(o.socketDir,448))}function F(o){return o.startsWith(P)}var W=class o{server;opts;now;fetchImpl;grantedTools;connections=new Set;sockets=new Set;revoked=!1;closed=!1;constructor(e){if(typeof e.identity?.verify!="function")throw new Error("WorkerBroker requires an explicit identity posture (S11) \u2014 see worker-broker/identity.ts");this.opts=e,this.now=e.now??Date.now,this.fetchImpl=e.fetchImpl??fetch,this.grantedTools=E(e.capabilities),this.server=Y.createServer(r=>{this.handleConnection(r)}),this.server.on("error",()=>{})}static async start(e){let r=new o(e);if(S(e.address),await new Promise((t,n)=>{r.server.once("error",n),r.server.listen(e.address.socketPath,()=>{r.server.removeListener("error",n),t()})}),!e.address.isNamedPipe)try{H(e.address.socketPath,384)}catch{}return r}get identitySummary(){return this.opts.identity.summary}get toolDescriptors(){return this.grantedTools.filter(k).map(e=>R[e])}async revoke(){this.revoked=!0,await this.close()}async close(){if(!this.closed){this.closed=!0;for(let e of this.sockets)e.destroy();if(this.sockets.clear(),this.connections.clear(),await new Promise(e=>this.server.close(()=>e())),!this.opts.address.isNamedPipe)try{X(this.opts.address.socketPath)}catch{}}}refuse(e,r){this.opts.onRefusal?.(e,r)}async handleConnection(e){this.sockets.add(e),e.on("close",()=>{this.sockets.delete(e),this.connections.delete(e)});for(let n of this.connections)(n.destroyed||n.readableEnded)&&this.connections.delete(n);if(this.connections.size>=1){this.refuse("concurrent_connection","a second concurrent connection was attempted while the worker's own connection was open"),this.write(e,{id:"",ok:!1,reason:"concurrent_connection",error:"worker tools are already in use for this task"}),e.end();return}this.connections.add(e);let r=await this.opts.identity.verify({socket:e,workerPid:this.opts.workerPid});if(!r.ok){this.refuse("identity_refused",r.detail),this.write(e,{id:"",ok:!1,reason:"identity_refused",error:"caller could not be identified as this worker"}),e.end();return}let t="";e.setEncoding("utf8"),e.on("data",n=>{if(t+=n,Buffer.byteLength(t,"utf8")>1048576){this.refuse("request_too_large","request exceeded the line cap"),this.write(e,{id:"",ok:!1,reason:"request_too_large",error:"request exceeded the maximum size"}),e.end();return}let s=t.indexOf(`
+import Y from"node:net";import{chmodSync as H,unlinkSync as X}from"node:fs";var u=1,T="KYNVER_WORKER_BROKER_SOCKET",g=1048576,_=1;function y(o){return`${JSON.stringify(o)}
+`}function h(o){let e;try{e=JSON.parse(o)}catch{return{ok:!1,reason:"malformed_request",error:"request was not valid JSON",id:""}}if(!e||typeof e!="object"||Array.isArray(e))return{ok:!1,reason:"malformed_request",error:"request must be a JSON object",id:""};let r=e,t=typeof r.id=="string"?r.id:"";if(r.v!==1)return{ok:!1,reason:"unsupported_protocol",error:"unsupported protocol version (expected 1)",id:t};if(!t)return{ok:!1,reason:"malformed_request",error:"request id must be a non-empty string",id:""};if(r.op==="list_tools")return{ok:!0,request:{v:1,id:t,op:"list_tools"}};if(r.op==="call_tool"){if(typeof r.name!="string"||!r.name)return{ok:!1,reason:"malformed_request",error:"call_tool requires a tool name",id:t};let n=r.args&&typeof r.args=="object"&&!Array.isArray(r.args)?r.args:{};return{ok:!0,request:{v:1,id:t,op:"call_tool",name:r.name,args:n}}}return{ok:!1,reason:"malformed_request",error:"unknown op",id:t}}var A="kynver",l=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],ce=l.map(o=>`mcp__${A}__${o}`),M={"worker.context":["agent_os_context_envelope"],"worker.memory.read":["agent_os_search_memory"],"worker.skills.read":["agent_os_search_skills","agent_os_get_skill"],"worker.progress.report":["agent_os_progress_note"]};function E(o){if(!o||o.length===0)return[...l];let e=new Set;for(let r of o)for(let t of M[r]??[])e.add(t);return l.filter(r=>e.has(r))}var L="X-Kynver-Job-Token",R={agent_os_context_envelope:{name:"agent_os_context_envelope",description:"Fetch the context envelope for YOUR OWN task: goal/plan/task summaries, relevant memory, and recent session context. Optional memoryQuery focuses the memory portion.",inputSchema:{type:"object",properties:{memoryQuery:{type:"string",description:"Focus the memory portion of the envelope."},mode:{type:"string",description:"Envelope mode hint."}},additionalProperties:!1}},agent_os_search_memory:{name:"agent_os_search_memory",description:"Semantic search over the workspace's long-term memory. Returns a bounded top-N of relevant entries.",inputSchema:{type:"object",properties:{query:{type:"string",description:"What to search for."},k:{type:"integer",minimum:1,maximum:20,description:"How many entries to return."}},required:["query"],additionalProperties:!1}},agent_os_search_skills:{name:"agent_os_search_skills",description:"Search the workspace's skill library (bounded, metadata-only index). Use agent_os_get_skill to fetch one full skill by slug.",inputSchema:{type:"object",properties:{query:{type:"string"},limit:{type:"integer",minimum:1,maximum:25}},additionalProperties:!1}},agent_os_get_skill:{name:"agent_os_get_skill",description:"Fetch ONE full skill (including instructions) by slug.",inputSchema:{type:"object",properties:{slug:{type:"string"}},required:["slug"],additionalProperties:!1}},agent_os_progress_note:{name:"agent_os_progress_note",description:"Append a progress or blocker note to YOUR OWN task's journal. kind: 'progress' (default) or 'blocked'.",inputSchema:{type:"object",properties:{note:{type:"string"},kind:{type:"string",enum:["progress","blocked"]},eventKey:{type:"string"}},required:["note"],additionalProperties:!1}}};function D(o){return`/api/agent-os/by-id/${encodeURIComponent(o.agentOsId)}/worker`}async function c(o,e,r){let t=await o.fetchImpl(`${o.apiBaseUrl}${e}`,{method:r?.method??"GET",headers:{[L]:o.token,...r?{"Content-Type":"application/json"}:{}},...r?{body:JSON.stringify(r.body)}:{}});if(!t.ok)throw new Error(`request failed (${t.status})`);return t.json()}function p(o){return typeof o=="string"&&o.trim()?o.trim():void 0}async function O(o,e,r){let t=D(o);switch(e){case"agent_os_context_envelope":{let n=new URLSearchParams({task:o.taskId}),s=p(r.memoryQuery);s&&n.set("memoryQuery",s);let i=p(r.mode);return i&&n.set("mode",i),c(o,`${t}/context-envelope?${n.toString()}`)}case"agent_os_search_memory":{let n=new URLSearchParams({q:String(r.query??"")});return typeof r.k=="number"&&n.set("k",String(r.k)),c(o,`${t}/memory-search?${n.toString()}`)}case"agent_os_search_skills":{let n=new URLSearchParams,s=p(r.query);s&&n.set("q",s),typeof r.limit=="number"&&n.set("limit",String(r.limit));let i=n.toString();return c(o,`${t}/skills${i?`?${i}`:""}`)}case"agent_os_get_skill":return c(o,`${t}/skills/${encodeURIComponent(String(r.slug??""))}`);case"agent_os_progress_note":return c(o,`${t}/progress-note`,{method:"POST",body:{note:String(r.note??""),...r.kind==="blocked"?{kind:"blocked"}:{},...p(r.eventKey)?{eventKey:p(r.eventKey)}:{}}})}}function k(o){return l.includes(o)}import{createHash as q}from"node:crypto";import{chmodSync as $,mkdirSync as U}from"node:fs";import v from"node:os";import J from"node:path";var j=100,P="\\\\.\\pipe\\";function B(o,e){return q("sha256").update(o).digest("hex").slice(0,e)}function V(o){let e=o.platform??process.platform,r=B(o.agentOsId,12),t=B(o.workerKey,16);if(e==="win32")return{socketPath:`${P}kynver-worker-${r}-${t}`,socketDir:null,isNamedPipe:!0,relocated:!1};let n=J.posix,s=o.homeDir??v.homedir(),i=n.join(s,".kynver","brokers",r),d=n.join(i,`${t}.sock`);if(Buffer.byteLength(d,"utf8")<=j)return{socketPath:d,socketDir:i,isNamedPipe:!1,relocated:!1};let x=n.join(o.tmpDir??v.tmpdir(),`kynver-brokers-${r}`);return{socketPath:n.join(x,`${t}.sock`),socketDir:x,isNamedPipe:!1,relocated:!0}}function S(o){o.socketDir&&(U(o.socketDir,{recursive:!0,mode:448}),$(o.socketDir,448))}function F(o){return o.startsWith(P)}var w=class o{server;opts;now;fetchImpl;grantedTools;connections=new Set;sockets=new Set;revoked=!1;closed=!1;constructor(e){if(typeof e.identity?.verify!="function")throw new Error("WorkerBroker requires an explicit identity posture (S11) \u2014 see worker-broker/identity.ts");this.opts=e,this.now=e.now??Date.now,this.fetchImpl=e.fetchImpl??fetch,this.grantedTools=E(e.capabilities),this.server=Y.createServer(r=>{this.handleConnection(r)}),this.server.on("error",()=>{})}static async start(e){let r=new o(e);if(S(e.address),await new Promise((t,n)=>{r.server.once("error",n),r.server.listen(e.address.socketPath,()=>{r.server.removeListener("error",n),t()})}),!e.address.isNamedPipe)try{H(e.address.socketPath,384)}catch{}return r}get identitySummary(){return this.opts.identity.summary}get toolDescriptors(){return this.grantedTools.filter(k).map(e=>R[e])}async revoke(){this.revoked=!0,await this.close()}async close(){if(!this.closed){this.closed=!0;for(let e of this.sockets)e.destroy();if(this.sockets.clear(),this.connections.clear(),await new Promise(e=>this.server.close(()=>e())),!this.opts.address.isNamedPipe)try{X(this.opts.address.socketPath)}catch{}}}refuse(e,r){this.opts.onRefusal?.(e,r)}async handleConnection(e){this.sockets.add(e),e.on("close",()=>{this.sockets.delete(e),this.connections.delete(e)});for(let n of this.connections)(n.destroyed||n.readableEnded)&&this.connections.delete(n);if(this.connections.size>=1){this.refuse("concurrent_connection","a second concurrent connection was attempted while the worker's own connection was open"),this.write(e,{id:"",ok:!1,reason:"concurrent_connection",error:"worker tools are already in use for this task"}),e.end();return}this.connections.add(e);let r=await this.opts.identity.verify({socket:e,workerPid:this.opts.workerPid});if(!r.ok){this.refuse("identity_refused",r.detail),this.write(e,{id:"",ok:!1,reason:"identity_refused",error:"caller could not be identified as this worker"}),e.end();return}let t="";e.setEncoding("utf8"),e.on("data",n=>{if(t+=n,Buffer.byteLength(t,"utf8")>1048576){this.refuse("request_too_large","request exceeded the line cap"),this.write(e,{id:"",ok:!1,reason:"request_too_large",error:"request exceeded the maximum size"}),e.end();return}let s=t.indexOf(`
 `);for(;s>=0;){let i=t.slice(0,s);t=t.slice(s+1),i.trim()&&this.handleLine(e,i),s=t.indexOf(`
-`)}})}write(e,r){if(!e.destroyed)try{e.write(y(r))}catch{}}async handleLine(e,r){let t=h(r);if(!t.ok){this.refuse(t.reason,t.error),this.write(e,{id:t.id,ok:!1,reason:t.reason,error:t.error});return}let{request:n}=t;if(this.revoked||this.closed){this.refuse("revoked","grant revoked"),this.write(e,{id:n.id,ok:!1,reason:"revoked",error:"worker tools are no longer available for this task"});return}if(this.now()>=this.opts.expiresAt){this.refuse("grant_expired","grant expired"),this.write(e,{id:n.id,ok:!1,reason:"grant_expired",error:"worker tools are no longer available for this task"});return}if(n.op==="list_tools"){this.write(e,{id:n.id,ok:!0,tools:this.toolDescriptors});return}if(!k(n.name)){this.refuse("unknown_tool",n.name),this.write(e,{id:n.id,ok:!1,reason:"unknown_tool",error:`unknown tool: ${n.name}`});return}if(!this.grantedTools.includes(n.name)){this.refuse("capability_not_granted",n.name),this.write(e,{id:n.id,ok:!1,reason:"capability_not_granted",error:`tool not granted for this task: ${n.name}`});return}try{let s=await O({apiBaseUrl:this.opts.apiBaseUrl,agentOsId:this.opts.agentOsId,taskId:this.opts.taskId,token:this.opts.token,fetchImpl:this.fetchImpl},n.name,n.args??{});this.write(e,{id:n.id,ok:!0,result:s})}catch(s){let i=s instanceof Error?s.message:"request failed";this.refuse("upstream_error",i),this.write(e,{id:n.id,ok:!1,reason:"upstream_error",error:i})}}};var b={posture:"scoped",summary:"scoped: per-worker endpoint in an owner-only (0700) directory, one connection at a time. Peer identity is not observed \u2014 another process of the same OS user is not excluded.",verify:async()=>({ok:!0})};function z(){return b}import G from"node:net";var Q=6e4,w=class o{socket;pending=new Map;timeoutMs;buffer="";nextId=1;closedReason=null;constructor(e,r){this.socket=e,this.timeoutMs=r,e.setEncoding("utf8"),e.on("data",t=>this.onData(t)),e.on("close",()=>this.failAll("worker tools connection closed")),e.on("error",t=>this.failAll(t.message))}static connect(e,r=Q){return new Promise((t,n)=>{let s=G.createConnection(e),i=d=>{s.destroy(),n(d)};s.once("error",i),s.once("connect",()=>{s.removeListener("error",i),t(new o(s,r))})})}onData(e){this.buffer+=e;let r=this.buffer.indexOf(`
+`)}})}write(e,r){if(!e.destroyed)try{e.write(y(r))}catch{}}async handleLine(e,r){let t=h(r);if(!t.ok){this.refuse(t.reason,t.error),this.write(e,{id:t.id,ok:!1,reason:t.reason,error:t.error});return}let{request:n}=t;if(this.revoked||this.closed){this.refuse("revoked","grant revoked"),this.write(e,{id:n.id,ok:!1,reason:"revoked",error:"worker tools are no longer available for this task"});return}if(this.now()>=this.opts.expiresAt){this.refuse("grant_expired","grant expired"),this.write(e,{id:n.id,ok:!1,reason:"grant_expired",error:"worker tools are no longer available for this task"});return}if(n.op==="list_tools"){this.write(e,{id:n.id,ok:!0,tools:this.toolDescriptors});return}if(!k(n.name)){this.refuse("unknown_tool",n.name),this.write(e,{id:n.id,ok:!1,reason:"unknown_tool",error:`unknown tool: ${n.name}`});return}if(!this.grantedTools.includes(n.name)){this.refuse("capability_not_granted",n.name),this.write(e,{id:n.id,ok:!1,reason:"capability_not_granted",error:`tool not granted for this task: ${n.name}`});return}try{let s=await O({apiBaseUrl:this.opts.apiBaseUrl,agentOsId:this.opts.agentOsId,taskId:this.opts.taskId,token:this.opts.token,fetchImpl:this.fetchImpl},n.name,n.args??{});this.write(e,{id:n.id,ok:!0,result:s})}catch(s){let i=s instanceof Error?s.message:"request failed";this.refuse("upstream_error",i),this.write(e,{id:n.id,ok:!1,reason:"upstream_error",error:i})}}};var b={posture:"scoped",summary:"scoped: per-worker endpoint in an owner-only (0700) directory, one connection at a time. Peer identity is not observed \u2014 another process of the same OS user is not excluded.",verify:async()=>({ok:!0})};function z(){return b}import G from"node:net";var Q=6e4,W=class o{socket;pending=new Map;timeoutMs;buffer="";nextId=1;closedReason=null;constructor(e,r){this.socket=e,this.timeoutMs=r,e.setEncoding("utf8"),e.on("data",t=>this.onData(t)),e.on("close",()=>this.failAll("worker tools connection closed")),e.on("error",t=>this.failAll(t.message))}static connect(e,r=Q){return new Promise((t,n)=>{let s=G.createConnection(e),i=d=>{s.destroy(),n(d)};s.once("error",i),s.once("connect",()=>{s.removeListener("error",i),t(new o(s,r))})})}onData(e){this.buffer+=e;let r=this.buffer.indexOf(`
 `);for(;r>=0;){let t=this.buffer.slice(0,r);this.buffer=this.buffer.slice(r+1),t.trim()&&this.dispatch(t),r=this.buffer.indexOf(`
 `)}}dispatch(e){let r;try{r=JSON.parse(e)}catch{return}if(!r.id){let n="error"in r?r.error:"worker tools unavailable";this.failAll(n);return}let t=this.pending.get(r.id);t&&(this.pending.delete(r.id),clearTimeout(t.timer),t.resolve(r))}failAll(e){this.closedReason??=e;for(let[r,t]of this.pending)this.pending.delete(r),clearTimeout(t.timer),t.reject(new Error(e))}send(e){if(this.closedReason)return Promise.reject(new Error(this.closedReason));let r=String(this.nextId++);return new Promise((t,n)=>{let s=setTimeout(()=>{this.pending.delete(r),n(new Error("worker tools request timed out"))},this.timeoutMs);s.unref?.(),this.pending.set(r,{resolve:t,reject:n,timer:s}),this.socket.write(`${JSON.stringify({v:1,id:r,...e})}
-`,i=>{i&&(this.pending.delete(r),clearTimeout(s),n(i))})})}async listTools(){let e=await this.send({op:"list_tools"});if(!e.ok)throw new Error(e.error);return"tools"in e?e.tools:[]}async callTool(e,r){let t=await this.send({op:"call_tool",name:e,args:r});return t.ok?{ok:!0,result:"result"in t?t.result:null}:{ok:!1,error:t.error}}close(){this.failAll("worker tools client closed"),this.socket.destroy()}};import re from"node:path";import{existsSync as Ke,mkdirSync as Ce,readFileSync as Z,readdirSync as Ae,renameSync as Me,rmSync as Le,statSync as De,writeFileSync as qe}from"node:fs";function ee(o){console.error(o),process.exit(1)}function N(o,e){try{return JSON.parse(Z(o,"utf8"))}catch(r){if(arguments.length>1)return e;ee(`failed to read ${o}: ${r.message}`)}}function I(o){if(!o)return!1;try{return process.kill(o,0),!0}catch{return!1}}var a=new Map,m=new Map;function f(o){clearInterval(m.get(o)),m.delete(o)}function oe(o,e){if(f(o),!a.has(o))return;let r=setInterval(()=>{(N(re.join(o,"worker.json"),null)?.completionReportedAt||!I(e))&&C(o)},1e3);r.unref(),m.set(o,r)}function te(o,e){f(o);let r=a.get(o);r&&r.close(),a.set(o,e)}function ne(o){return a.get(o)}async function K(o){f(o);let e=a.get(o);return e?(a.delete(o),await e.close(),!0):!1}function C(o){K(o).catch(()=>{})}async function se(){for(let e of m.keys())f(e);let o=[...a.values()];a.clear(),await Promise.all(o.map(e=>e.close().catch(()=>{})))}function ie(){return a.size}export{b as SCOPED_WORKER_BROKER_IDENTITY,_ as WORKER_BROKER_MAX_CONCURRENT_CONNECTIONS,g as WORKER_BROKER_MAX_LINE_BYTES,u as WORKER_BROKER_PROTOCOL_VERSION,x as WORKER_BROKER_SOCKET_ENV,R as WORKER_TOOL_DESCRIPTORS,W as WorkerBroker,w as WorkerBrokerClient,oe as bindWorkerBrokerLifetime,se as closeAllWorkerBrokers,K as closeWorkerBroker,C as closeWorkerBrokerSync,y as encodeBrokerFrame,S as ensureWorkerBrokerSocketDir,O as executeWorkerTool,ne as getWorkerBroker,F as isNamedPipePath,k as isWorkerToolName,h as parseBrokerRequest,te as registerWorkerBroker,V as resolveWorkerBrokerAddress,z as resolveWorkerBrokerIdentity,ie as workerBrokerCount};
+`,i=>{i&&(this.pending.delete(r),clearTimeout(s),n(i))})})}async listTools(){let e=await this.send({op:"list_tools"});if(!e.ok)throw new Error(e.error);return"tools"in e?e.tools:[]}async callTool(e,r){let t=await this.send({op:"call_tool",name:e,args:r});return t.ok?{ok:!0,result:"result"in t?t.result:null}:{ok:!1,error:t.error}}close(){this.failAll("worker tools client closed"),this.socket.destroy()}};import re from"node:path";import{existsSync as Ke,mkdirSync as Ce,readFileSync as Z,readdirSync as Ae,renameSync as Me,rmSync as Le,statSync as De,writeFileSync as qe}from"node:fs";function ee(o){console.error(o),process.exit(1)}function N(o,e){try{return JSON.parse(Z(o,"utf8"))}catch(r){if(arguments.length>1)return e;ee(`failed to read ${o}: ${r.message}`)}}function I(o){if(!o)return!1;try{return process.kill(o,0),!0}catch{return!1}}var a=new Map,m=new Map;function f(o){clearInterval(m.get(o)),m.delete(o)}function oe(o,e){if(f(o),!a.has(o))return;let r=setInterval(()=>{(N(re.join(o,"worker.json"),null)?.completionReportedAt||!I(e))&&C(o)},1e3);r.unref(),m.set(o,r)}function te(o,e){f(o);let r=a.get(o);r&&r.close(),a.set(o,e)}function ne(o){return a.get(o)}async function K(o){f(o);let e=a.get(o);return e?(a.delete(o),await e.close(),!0):!1}function C(o){K(o).catch(()=>{})}async function se(){for(let e of m.keys())f(e);let o=[...a.values()];a.clear(),await Promise.all(o.map(e=>e.close().catch(()=>{})))}function ie(){return a.size}export{b as SCOPED_WORKER_BROKER_IDENTITY,_ as WORKER_BROKER_MAX_CONCURRENT_CONNECTIONS,g as WORKER_BROKER_MAX_LINE_BYTES,u as WORKER_BROKER_PROTOCOL_VERSION,T as WORKER_BROKER_SOCKET_ENV,R as WORKER_TOOL_DESCRIPTORS,w as WorkerBroker,W as WorkerBrokerClient,oe as bindWorkerBrokerLifetime,se as closeAllWorkerBrokers,K as closeWorkerBroker,C as closeWorkerBrokerSync,y as encodeBrokerFrame,S as ensureWorkerBrokerSocketDir,O as executeWorkerTool,ne as getWorkerBroker,F as isNamedPipePath,k as isWorkerToolName,h as parseBrokerRequest,te as registerWorkerBroker,V as resolveWorkerBrokerAddress,z as resolveWorkerBrokerIdentity,ie as workerBrokerCount};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.2.122",
+  "version": "0.2.129",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",