@kynver-app/runtime 0.2.135 → 0.2.140

package/dist/instruction-bundle/contract.js

@@ -1,5 +1,5 @@
-import{createHash as u}from"node:crypto";function o(e){return JSON.stringify(i(e))}function i(e){if(Array.isArray(e))return e.map(i);if(e&&typeof e=="object"){let t={};for(let n of Object.keys(e).sort())t[n]=i(e[n]);return t}return e}function v(e){return`ib1-${u("sha256").update(o(e),"utf8").digest("hex").slice(0,16)}`}function d(e){return`ib-${u("sha256").update(Buffer.from(e)).digest("hex").slice(0,12)}`}function a(e){if(!e)return null;let t=e.trim();if(!t)return null;if(/^[0-9a-fA-F]{64}$/.test(t))return new Uint8Array(t.match(/.{2}/g).map(n=>parseInt(n,16)));try{let n=Buffer.from(t,"base64");if(n.length===32)return new Uint8Array(n)}catch{}return null}function s(e){if(!e||typeof e!="object")return!1;let t=e;if(typeof t.signature!="string"||!t.signature||typeof t.publicKeyId!="string"||!t.publicKeyId)return!1;let n=t.bundle;return!(!n||typeof n!="object"||typeof n.version!="string"||!n.version||typeof n.generatedAt!="string"||!Array.isArray(n.personas)||!n.instructions||typeof n.instructions!="object"||!n.policyThresholds||typeof n.policyThresholds!="object")}function c(e=process.env){if(e.NODE_ENV==="production")return!1;let t=e.KYNVER_ALLOW_DEV_SIGNING_KEYS?.trim().toLowerCase();return t==="1"||t==="true"||t==="yes"||t==="on"?!0:e.NODE_ENV==="test"||e.VITEST==="true"}var g="ib-3bab6314f0ba",p={"ib-3bab6314f0ba":"53a2040646cd479e1f5f1aea9abf7848ce8b62e32001efb8044dfd90e8ab87ed","ib-26e6c695da06":"bb1700f25b2ee7d7cdcdb9f446f0f44ef2cc22a3096bc161232fb658e7cdaf38","ib-49e76cb8052c":"8fc646b5c4f8f402120477452608398f035c3cddd2e7aa8bb328e97b84dcf6d8"};function l(e,t=process.env){let n=a(t.KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY);if(n&&d(n)===e)return n;if(e===g&&!c(t))return null;let r=p[e];return r?a(r):null}import{createPublicKey as y,verify as h}from"node:crypto";var I=Buffer.from("302a300506032b6570032100","hex");function b(e){return y({key:Buffer.concat([I,Buffer.from(e)]),format:"der",type:"spki"})}function f(e,t){if(!s(e))return{ok:!1,reason:"malformed signed bundle payload"};let n;try{n=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(n.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let r=Buffer.from(o(e.bundle),"utf8");return h(null,r,b(t),n)?{ok:!0,bundle:e.bundle}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(r){return{ok:!1,reason:`signature verification failed: ${r.message}`}}}function R(e,t=process.env){if(!s(e))return{ok:!1,reason:"malformed signed bundle payload"};let n=l(e.publicKeyId,t);return n?f(e,n):{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}" (not pinned; set KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY)`}}var m="embedded-1",B=[{slug:"ghost",displayName:"Ghost",description:"Orchestration persona.",dispatchLane:null,defaultRoleLane:"system"},{slug:"astra",displayName:"Astra",description:"Planning persona.",dispatchLane:"implementation",defaultRoleLane:"plan_author"},{slug:"rhea",displayName:"Rhea",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"mnemo",displayName:"Mnemo",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"sentinel",displayName:"Sentinel",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"deep_reviewer"},{slug:"pixel",displayName:"Pixel",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"schema",displayName:"Schema",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"atlas",displayName:"Atlas",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"runtime_verifier"},{slug:"bridge",displayName:"Bridge",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"catalyst",displayName:"Catalyst",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"lorentz",displayName:"Lorentz",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"report_reviewer"},{slug:"dalton",displayName:"Dalton",description:"Landing persona.",dispatchLane:"landing",defaultRoleLane:"implementer"}],w={"worker.prompt.core_rules":["Structured final result (recommended): record completion as JSON with summary, files, PR URLs, verification, risks, and blockers.","Completion handoff (required): before you stop, summarize the outcome in your last message and append a heartbeat line with phase `complete` and a structured finalResult object. Commit your work cleanly and open a GitHub PR (draft OK) for substantial changes \u2014 never leave uncommitted changes behind without reporting them.","Review-only workers must not open new implementation PRs \u2014 review the existing PR and record a verdict in the final result. Prefer `gh pr view` / `gh pr diff`; if a local checkout is needed, use a disposable ref or detached worktree, not a checked-out `pr-*` branch.","Keep verification targeted to touched paths; avoid full-monorepo verification unless explicitly requested.","Do not run `npm publish`.","If verification fails, append a heartbeat line immediately with the failing command, reason, and next action."].join(`
+import{createHash as u}from"node:crypto";function o(e){return JSON.stringify(i(e))}function i(e){if(Array.isArray(e))return e.map(i);if(e&&typeof e=="object"){let n={};for(let t of Object.keys(e).sort())n[t]=i(e[t]);return n}return e}function v(e){return`ib1-${u("sha256").update(o(e),"utf8").digest("hex").slice(0,16)}`}function c(e){return`ib-${u("sha256").update(Buffer.from(e)).digest("hex").slice(0,12)}`}function a(e){if(!e)return null;let n=e.trim();if(!n)return null;if(/^[0-9a-fA-F]{64}$/.test(n))return new Uint8Array(n.match(/.{2}/g).map(t=>parseInt(t,16)));try{let t=Buffer.from(n,"base64");if(t.length===32)return new Uint8Array(t)}catch{}return null}function d(e){if(!e)return[];let n=[];for(let t of e.split(/[,\s]+/)){let r=a(t);r&&n.push(r)}return n}function s(e){if(!e||typeof e!="object")return!1;let n=e;if(typeof n.signature!="string"||!n.signature||typeof n.publicKeyId!="string"||!n.publicKeyId)return!1;let t=n.bundle;return!(!t||typeof t!="object"||typeof t.version!="string"||!t.version||typeof t.generatedAt!="string"||!Array.isArray(t.personas)||!t.instructions||typeof t.instructions!="object"||!t.policyThresholds||typeof t.policyThresholds!="object")}function p(e=process.env){if(e.NODE_ENV==="production")return!1;let n=e.KYNVER_ALLOW_DEV_SIGNING_KEYS?.trim().toLowerCase();return n==="1"||n==="true"||n==="yes"||n==="on"?!0:e.NODE_ENV==="test"||e.VITEST==="true"}var y="ib-3bab6314f0ba",f={"ib-3bab6314f0ba":"53a2040646cd479e1f5f1aea9abf7848ce8b62e32001efb8044dfd90e8ab87ed","ib-26e6c695da06":"bb1700f25b2ee7d7cdcdb9f446f0f44ef2cc22a3096bc161232fb658e7cdaf38","ib-49e76cb8052c":"8fc646b5c4f8f402120477452608398f035c3cddd2e7aa8bb328e97b84dcf6d8","ib-f990c4fcc3dd":"fb4119813196e466429716bab7055c528cd79b4ec94c40a9c63c5c8313548df6"};function l(e,n=process.env){for(let r of d(n.KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY))if(c(r)===e)return r;if(e===y&&!p(n))return null;let t=f[e];return t?a(t):null}import{createPublicKey as h,verify as I}from"node:crypto";var b=Buffer.from("302a300506032b6570032100","hex");function R(e){return h({key:Buffer.concat([b,Buffer.from(e)]),format:"der",type:"spki"})}function m(e,n){if(!s(e))return{ok:!1,reason:"malformed signed bundle payload"};let t;try{t=Buffer.from(e.signature,"base64url")}catch{return{ok:!1,reason:"signature is not base64url"}}if(t.length!==64)return{ok:!1,reason:"signature is not a 64-byte Ed25519 signature"};try{let r=Buffer.from(o(e.bundle),"utf8");return I(null,r,R(n),t)?{ok:!0,bundle:e.bundle}:{ok:!1,reason:"Ed25519 signature mismatch"}}catch(r){return{ok:!1,reason:`signature verification failed: ${r.message}`}}}function B(e,n=process.env){if(!s(e))return{ok:!1,reason:"malformed signed bundle payload"};let t=l(e.publicKeyId,n);return t?m(e,t):{ok:!1,reason:`no verification key for publicKeyId "${e.publicKeyId}" (not pinned; set KYNVER_INSTRUCTION_BUNDLE_PUBLIC_KEY)`}}var g="embedded-1",w=[{slug:"ghost",displayName:"Ghost",description:"Orchestration persona.",dispatchLane:null,defaultRoleLane:"system"},{slug:"astra",displayName:"Astra",description:"Planning persona.",dispatchLane:"implementation",defaultRoleLane:"plan_author"},{slug:"rhea",displayName:"Rhea",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"mnemo",displayName:"Mnemo",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"sentinel",displayName:"Sentinel",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"deep_reviewer"},{slug:"pixel",displayName:"Pixel",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"schema",displayName:"Schema",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"atlas",displayName:"Atlas",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"runtime_verifier"},{slug:"bridge",displayName:"Bridge",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"catalyst",displayName:"Catalyst",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"lorentz",displayName:"Lorentz",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"report_reviewer"},{slug:"dalton",displayName:"Dalton",description:"Landing persona.",dispatchLane:"landing",defaultRoleLane:"implementer"}],E={"worker.prompt.core_rules":["Structured final result (recommended): record completion as JSON with summary, files, PR URLs, verification, risks, and blockers.","Completion handoff (required): before you stop, summarize the outcome in your last message and append a heartbeat line with phase `complete` and a structured finalResult object. Commit your work cleanly and open a GitHub PR (draft OK) for substantial changes \u2014 never leave uncommitted changes behind without reporting them.","Review-only workers must not open new implementation PRs \u2014 review the existing PR and record a verdict in the final result. Prefer `gh pr view` / `gh pr diff`; if a local checkout is needed, use a disposable ref or detached worktree, not a checked-out `pr-*` branch.","Keep verification targeted to touched paths; avoid full-monorepo verification unless explicitly requested.","Do not run `npm publish`.","If verification fails, append a heartbeat line immediately with the failing command, reason, and next action."].join(`
 `),"worker.prompt.progress.compact":"Plan progress: when planId is set, report progress with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`. Do not mark rows done from the worker CLI.","worker.prompt.progress.full":["Structured plan progress (required when planId is set):","- Report checkpoints with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`.","- When a slice is finished, emit `partial` with evidence (`--evidence pr:<url>`, `--evidence path:<file>`, or `--evidence command:<cmd>`).","- Do not propose or confirm row `done` from the worker CLI."].join(`
 `),"worker.prompt.merge_gate.compact":"Verification cost control: prefer local verification before requesting CI runs; do not push empty commits to re-trigger CI; record verification evidence on the PR.","worker.prompt.merge_gate.full":["Verification cost control:","- Prefer local verification of touched paths before requesting any CI run.","- Do not push empty commits to re-trigger CI.","- Record verification evidence on the PR before requesting review."].join(`
 `),"worker.prompt.plan_artifacts.compact":"Plan artifacts: when authoring or revising plan documents, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in a local worktree.","worker.prompt.plan_artifacts.full":["Plan artifacts (when authoring or revising plan documents):","- Create a feature branch and open a GitHub PR (draft OK) before substantial drafting; commit and push the plan file.","- Iterate on that PR branch and link the PR URL on the related task and progress evidence."].join(`
-`)},_={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},N={version:m,generatedAt:"1970-01-01T00:00:00.000Z",personas:B,instructions:w,policyThresholds:_};export{N as EMBEDDED_INSTRUCTION_BUNDLE,m as EMBEDDED_INSTRUCTION_BUNDLE_VERSION,p as PINNED_INSTRUCTION_BUNDLE_PUBLIC_KEYS,o as canonicalJsonStringify,v as computeInstructionBundleVersion,d as deriveInstructionBundleKeyId,c as devSigningKeysAllowed,s as isSignedInstructionBundleShape,a as parseRawEd25519Key,l as resolveInstructionBundlePublicKey,f as verifyInstructionBundleSignatureWithKey,R as verifySignedInstructionBundle};
+`)},_={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},N={version:g,generatedAt:"1970-01-01T00:00:00.000Z",personas:w,instructions:E,policyThresholds:_};export{N as EMBEDDED_INSTRUCTION_BUNDLE,g as EMBEDDED_INSTRUCTION_BUNDLE_VERSION,f as PINNED_INSTRUCTION_BUNDLE_PUBLIC_KEYS,o as canonicalJsonStringify,v as computeInstructionBundleVersion,c as deriveInstructionBundleKeyId,p as devSigningKeysAllowed,s as isSignedInstructionBundleShape,a as parseRawEd25519Key,d as parseRawEd25519KeyList,l as resolveInstructionBundlePublicKey,m as verifyInstructionBundleSignatureWithKey,B as verifySignedInstructionBundle};

package/dist/local-run-store/index.js

@@ -1,5 +1,5 @@
-var a=(r,e,t)=>()=>{if(t)throw t[0];try{return r&&(e=r(r=0)),e}catch(n){throw t=[n],n}};import{homedir as Vr}from"node:os";import Gr from"node:path";function ro(r){return r==="~"?Vr():r.startsWith("~/")||r.startsWith("~\\")?Gr.join(Vr(),r.slice(2)):r}function I(r){return Gr.resolve(ro(r))}var F=a(()=>{"use strict"});var Jr=a(()=>{"use strict"});import{existsSync as Gi,mkdirSync as to,readFileSync as no,readdirSync as Ji,renameSync as oo,rmSync as so,statSync as qi,writeFileSync as io}from"node:fs";import{randomBytes as ao}from"node:crypto";import lo from"node:path";function Fe(r){console.error(r),process.exit(1)}function q(r,e){try{return JSON.parse(no(r,"utf8"))}catch(t){if(arguments.length>1)return e;Fe(`failed to read ${r}: ${t.message}`)}}function ae(r,e){to(lo.dirname(r),{recursive:!0});let t=`${r}.${process.pid}.${ao(4).toString("hex")}.tmp`;try{io(t,`${JSON.stringify(e,null,2)}
-`),oo(t,r)}catch(n){try{so(t,{force:!0})}catch{}throw n}}function le(r){return String(r).replace(/\/+$/,"")}var b=a(()=>{"use strict";Jr()});var co,ea,uo,ra,qr=a(()=>{"use strict";co=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],ea=new Set(co),uo=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],ra=new Set(uo)});var ce=a(()=>{"use strict";F();b();qr()});import{homedir as zr}from"node:os";import Be from"node:path";function mo(r=zr()){return Be.join(r,".kynver",fo)}function Qr(r,e=zr()){return Be.resolve(r)===Be.resolve(mo(e))}var fo,Xr,Ue=a(()=>{"use strict";ce();fo="workspace",Xr="main"});var $e=a(()=>{"use strict";ce();F();Ue()});var Zr=a(()=>{"use strict"});var et=a(()=>{"use strict";Zr()});function nt(r){let e=le(r);try{let t=new URL(e);return t.hostname.toLowerCase()===rt?(t.hostname=`www.${rt}`,le(t.toString())):e}catch{return e}}function He(r){if(r?.trim())return nt(le(r.trim()))}async function ue(r,e,t=fetch){let n=nt(r),o=new Headers(e?.headers),s=0;for(;s<=tt;){let i=await t(n,{...e,headers:o,redirect:"manual"});if(![301,302,303,307,308].includes(i.status))return i;let l=i.headers.get("location");if(!l)return i;let u=new URL(l,n);if(u.origin!==new URL(n).origin||u.username||u.password)throw await i.body?.cancel(),new Error("kynver API fetch refused unsafe redirect (origin change or embedded credentials)");let c=(e?.method??"GET").toUpperCase();if(!["GET","HEAD"].includes(c)&&i.status!==307&&i.status!==308)return i;await i.body?.cancel(),n=u.toString(),s+=1}throw new Error(`kynver API fetch exceeded ${tt} redirects for ${r}`)}var rt,tt,de=a(()=>{"use strict";b();rt="kynver.com";tt=10});function B(r){let e=(r??"").trim().toLowerCase();return e==="ghost"||e==="forge"||e==="box"?e:e.includes("forge")?"forge":e.includes("ghost")||e.includes("openclaw")?"ghost":"box"}function pe(r,e){return r[e]?.trim()||null}function ot(r){let e=r?.split(":")[0]?.trim();return e?B(e):null}function z(r=process.env,e={}){let t=[],n=ot(e.boxId),o=ot(pe(r,"KYNVER_BOX_ID")),s=e.boxKind?.trim();if(s)return n&&n!==B(s)&&t.push(`config.boxId=${e.boxId} conflicts with boxKind=${s}; using explicit boxKind=${s}`),{boxKind:B(s),source:"config",slugInferenceBlocked:!1,warnings:t};let i=pe(r,"KYNVER_BOX_KIND");if(i)return o&&o!==B(i)&&t.push(`KYNVER_BOX_ID=${pe(r,"KYNVER_BOX_ID")} conflicts with KYNVER_BOX_KIND=${i}; using explicit KYNVER_BOX_KIND=${i}`),{boxKind:B(i),source:"env",slugInferenceBlocked:!1,warnings:t};if(n)return{boxKind:n,source:"config",slugInferenceBlocked:!1,warnings:t};if(o)return{boxKind:o,source:"env",slugInferenceBlocked:!1,warnings:t};let l=pe(r,"KYNVER_AGENT_OS_SLUG");return l&&t.push(`KYNVER_AGENT_OS_SLUG=${l} is a workspace slug, not box identity \u2014 operators set boxKind via \`kynver setup --box-kind forge|ghost\` or KYNVER_BOX_KIND; customers default to box`),{boxKind:"box",source:"default",slugInferenceBlocked:!!l,warnings:t}}var W=a(()=>{"use strict"});function je(r,e){return r==="forge"?4:Math.max(1,e)}function fe(r,e){return r==="forge"?Math.min(Math.max(1,e),4):Math.max(1,e)}var me=a(()=>{"use strict"});var st=a(()=>{"use strict"});var wa,Oa,Ye=a(()=>{"use strict";wa=25*1024*1024*1024,Oa=12*1024*1024*1024});var Da,La,it=a(()=>{"use strict";Ye();Da=5*1024*1024*1024,La=10*1024*1024*1024});var Ua,$a,Ve=a(()=>{"use strict";it();Ye();Ua=30*1024*1024*1024,$a=15*1024*1024*1024});function at(){return ct()}var re=a(()=>{"use strict";Ge();b()});var dt=a(()=>{"use strict";re();b()});var pt=a(()=>{"use strict"});var ft=a(()=>{"use strict";pt();b()});var mt=a(()=>{"use strict"});var gt=a(()=>{"use strict";mt()});var he=a(()=>{"use strict"});var ho,yo,ul,Je=a(()=>{"use strict";ho="claude-sonnet-5-5",yo="claude-opus-5-5",ul={[ho]:"claude-sonnet-4-6",[yo]:"claude-opus-4-8"}});var ht=a(()=>{"use strict"});var yt=a(()=>{"use strict"});var Rt=a(()=>{"use strict";gt();b();he();Je();ht();yt()});var Ol,qe=a(()=>{"use strict";Ol=String.raw`"use strict";
+var a=(r,e,t)=>()=>{if(t)throw t[0];try{return r&&(e=r(r=0)),e}catch(n){throw t=[n],n}};import{homedir as Vr}from"node:os";import Gr from"node:path";function ro(r){return r==="~"?Vr():r.startsWith("~/")||r.startsWith("~\\")?Gr.join(Vr(),r.slice(2)):r}function I(r){return Gr.resolve(ro(r))}var W=a(()=>{"use strict"});var Jr=a(()=>{"use strict"});import{existsSync as Gi,mkdirSync as to,readFileSync as no,readdirSync as Ji,renameSync as oo,rmSync as so,statSync as qi,writeFileSync as io}from"node:fs";import{randomBytes as ao}from"node:crypto";import lo from"node:path";function We(r){console.error(r),process.exit(1)}function q(r,e){try{return JSON.parse(no(r,"utf8"))}catch(t){if(arguments.length>1)return e;We(`failed to read ${r}: ${t.message}`)}}function ae(r,e){to(lo.dirname(r),{recursive:!0});let t=`${r}.${process.pid}.${ao(4).toString("hex")}.tmp`;try{io(t,`${JSON.stringify(e,null,2)}
+`),oo(t,r)}catch(n){try{so(t,{force:!0})}catch{}throw n}}function le(r){return String(r).replace(/\/+$/,"")}var b=a(()=>{"use strict";Jr()});var co,ea,uo,ra,qr=a(()=>{"use strict";co=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],ea=new Set(co),uo=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],ra=new Set(uo)});var ce=a(()=>{"use strict";W();b();qr()});import{homedir as zr}from"node:os";import Be from"node:path";function mo(r=zr()){return Be.join(r,".kynver",fo)}function Qr(r,e=zr()){return Be.resolve(r)===Be.resolve(mo(e))}var fo,Xr,Ue=a(()=>{"use strict";ce();fo="workspace",Xr="main"});var $e=a(()=>{"use strict";ce();W();Ue()});var Zr=a(()=>{"use strict"});var et=a(()=>{"use strict";Zr()});function nt(r){let e=le(r);try{let t=new URL(e);return t.hostname.toLowerCase()===rt?(t.hostname=`www.${rt}`,le(t.toString())):e}catch{return e}}function He(r){if(r?.trim())return nt(le(r.trim()))}async function ue(r,e,t=fetch){let n=nt(r),o=new Headers(e?.headers),s=0;for(;s<=tt;){let i=await t(n,{...e,headers:o,redirect:"manual"});if(![301,302,303,307,308].includes(i.status))return i;let l=i.headers.get("location");if(!l)return i;let u=new URL(l,n);if(u.origin!==new URL(n).origin||u.username||u.password)throw await i.body?.cancel(),new Error("kynver API fetch refused unsafe redirect (origin change or embedded credentials)");let c=(e?.method??"GET").toUpperCase();if(!["GET","HEAD"].includes(c)&&i.status!==307&&i.status!==308)return i;await i.body?.cancel(),n=u.toString(),s+=1}throw new Error(`kynver API fetch exceeded ${tt} redirects for ${r}`)}var rt,tt,de=a(()=>{"use strict";b();rt="kynver.com";tt=10});function B(r){let e=(r??"").trim().toLowerCase();return e==="ghost"||e==="forge"||e==="box"?e:e.includes("forge")?"forge":e.includes("ghost")||e.includes("openclaw")?"ghost":"box"}function pe(r,e){return r[e]?.trim()||null}function ot(r){let e=r?.split(":")[0]?.trim();return e?B(e):null}function z(r=process.env,e={}){let t=[],n=ot(e.boxId),o=ot(pe(r,"KYNVER_BOX_ID")),s=e.boxKind?.trim();if(s)return n&&n!==B(s)&&t.push(`config.boxId=${e.boxId} conflicts with boxKind=${s}; using explicit boxKind=${s}`),{boxKind:B(s),source:"config",slugInferenceBlocked:!1,warnings:t};let i=pe(r,"KYNVER_BOX_KIND");if(i)return o&&o!==B(i)&&t.push(`KYNVER_BOX_ID=${pe(r,"KYNVER_BOX_ID")} conflicts with KYNVER_BOX_KIND=${i}; using explicit KYNVER_BOX_KIND=${i}`),{boxKind:B(i),source:"env",slugInferenceBlocked:!1,warnings:t};if(n)return{boxKind:n,source:"config",slugInferenceBlocked:!1,warnings:t};if(o)return{boxKind:o,source:"env",slugInferenceBlocked:!1,warnings:t};let l=pe(r,"KYNVER_AGENT_OS_SLUG");return l&&t.push(`KYNVER_AGENT_OS_SLUG=${l} is a workspace slug, not box identity \u2014 operators set boxKind via \`kynver setup --box-kind forge|ghost\` or KYNVER_BOX_KIND; customers default to box`),{boxKind:"box",source:"default",slugInferenceBlocked:!!l,warnings:t}}var F=a(()=>{"use strict"});function je(r,e){return r==="forge"?4:Math.max(1,e)}function fe(r,e){return r==="forge"?Math.min(Math.max(1,e),4):Math.max(1,e)}var me=a(()=>{"use strict"});var st=a(()=>{"use strict"});var wa,Oa,Ye=a(()=>{"use strict";wa=25*1024*1024*1024,Oa=12*1024*1024*1024});var Da,La,it=a(()=>{"use strict";Ye();Da=5*1024*1024*1024,La=10*1024*1024*1024});var Ua,$a,Ve=a(()=>{"use strict";it();Ye();Ua=30*1024*1024*1024,$a=15*1024*1024*1024});function at(){return ct()}var re=a(()=>{"use strict";Ge();b()});var dt=a(()=>{"use strict";re();b()});var pt=a(()=>{"use strict"});var ft=a(()=>{"use strict";pt();b()});var mt=a(()=>{"use strict"});var gt=a(()=>{"use strict";mt()});var he=a(()=>{"use strict"});var ho,yo,ul,Je=a(()=>{"use strict";ho="claude-sonnet-5-5",yo="claude-opus-5-5",ul={[ho]:"claude-sonnet-4-6",[yo]:"claude-opus-4-8"}});var ht=a(()=>{"use strict"});var yt=a(()=>{"use strict"});var Rt=a(()=>{"use strict";gt();b();he();Je();ht();yt()});var Ol,qe=a(()=>{"use strict";Ol=String.raw`"use strict";
 const cp = require("child_process"), fs = require("fs");
 const argv = process.argv.slice(1);
 const exitFile = argv[0], cmd = argv[1], args = argv.slice(2);
@@ -51,23 +51,25 @@ function finish(code, signal, spawnError) {
   }
   process.exit(code === null ? 1 : code);
 }
+// Handlers go in BEFORE the spawn: a worker that signals its parent right away
+// must not catch this wrapper with the default action (dies, no exit.json).
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 try {
   child = cp.spawn(cmd, args, { stdio: "inherit" });
 } catch (e) {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   finish(127, null, String(e && e.message));
 }
-for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 child.on("error", (e) => {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   if (!child.pid) finish(127, null, String(e && e.message));
 });
 child.on("exit", (code, signal) => finish(code, signal));
-`});var St=a(()=>{"use strict";re();b();qe()});var bt=a(()=>{"use strict";he();Je()});var kt=a(()=>{"use strict"});var Yl,Vl,xt=a(()=>{"use strict";ce();Yl=10*6e4,Vl=60*6e4});var vt=a(()=>{"use strict"});var ze=a(()=>{"use strict"});var Et=a(()=>{"use strict"});var _t=a(()=>{"use strict";ze();Et()});var Ct=a(()=>{"use strict";ft();Rt();St();qe();he();bt();kt();xt();vt();_t();ze();b()});var At=a(()=>{"use strict";Ct();b()});function wt(r,e={}){let t=e.perWorkerMemBytes??Xe,n=e.memReserveBytes??Qe,o=e.memUtilization??Ze,s=Math.max(0,Math.floor(r*o)-n),i=Math.max(1,Math.floor(s/t));return Math.min(i,ye)}var Xe,Qe,Ze,ye,Ot=a(()=>{"use strict";st();T();W();me();Re();Ve();re();dt();At();b();Xe=500*1024*1024,Qe=4*1024*1024*1024,Ze=.85,ye=64});function te(r,e){let t=Number(r);return!Number.isFinite(t)||t<=0?e:Math.floor(t)}function er(r){let e=r.config??{},t=r.env??process.env,n=te(e.perWorkerMemBytes,Xe),o=te(e.memReserveBytes,Qe),s=Math.min(1,Math.max(.1,Number(e.memUtilization)>0?Number(e.memUtilization):Ze)),i=wt(r.totalMemBytes,{perWorkerMemBytes:n,memReserveBytes:o,memUtilization:s});if(r.configuredMaxWorkersOverride!==void 0&&r.configuredMaxWorkersOverride!==null)return{configuredMaxWorkers:te(r.configuredMaxWorkersOverride,i),autoCap:i,workerCapSource:"workspace_override"};if(e.maxConcurrentWorkers!==void 0&&e.maxConcurrentWorkers!==null){let c=te(e.maxConcurrentWorkers,0)||null;if(c)return{configuredMaxWorkers:Math.min(c,ye),autoCap:i,workerCapSource:"config"}}let u=(t.KYNVER_MAX_WORKERS_INTENTIONAL==="1"||t.KYNVER_MAX_WORKERS_INTENTIONAL==="true")&&t.KYNVER_MAX_WORKERS&&te(t.KYNVER_MAX_WORKERS,0)||null;return u?{configuredMaxWorkers:Math.min(u,ye),autoCap:i,workerCapSource:"env"}:{configuredMaxWorkers:null,autoCap:i,workerCapSource:"auto"}}var Re=a(()=>{"use strict";Ot()});import{homedir as Ao}from"node:os";import wo from"node:path";var It,rr=a(()=>{"use strict";It=wo.join(Ao(),".kynver",".env")});var Tt=a(()=>{"use strict"});var Pt=a(()=>{"use strict";Tt()});var Nt=a(()=>{"use strict"});var Dt=a(()=>{"use strict";b()});var tr=a(()=>{"use strict";Pt();Nt();Dt()});var Lt=a(()=>{"use strict"});var Kt=a(()=>{"use strict";Lt()});var Se=a(()=>{"use strict";rr();F();T();tr();Kt()});var Mt=a(()=>{"use strict";W();W()});var Wt=a(()=>{"use strict";rr();tr();Se()});function Ut(r){if(!Bt)return r;if(!Ft)throw new nr;return Ft}function sr(){if(Bt)throw new or}var nr,or,Bt,Ft,ir=a(()=>{"use strict";nr=class extends Error{constructor(){super("desktop credential provider is not installed; refusing to fall back to file or env credentials"),this.name="DesktopCredentialProviderMissingError"}},or=class extends Error{constructor(){super("the credentials file is disabled in desktop mode"),this.name="LegacyCredentialStoreDisabledError"}},Bt=!1,Ft=null});import{existsSync as P,mkdirSync as Po,readdirSync as be,renameSync as $t,statSync as No}from"node:fs";import N from"node:path";function jt(r){try{return No(r).isDirectory()}catch{return!1}}function Do(r){if(!P(r))return!0;for(let e of Ht){let t=N.join(r,e);if(P(t)&&(!jt(t)||be(t).length>0))return!1}return!0}function Lo(r){let e=N.join(r,"runs");if(!P(e)||!jt(e))return!1;for(let t of be(e,{withFileTypes:!0})){if(!t.isDirectory()||t.name==="runs")continue;let n=N.join(e,t.name,"run.json");if(q(n,void 0)?.id)return!0}return!1}function Ko(r){let e=N.join(r,"runs");if(!P(e))return!1;for(let t of be(e,{withFileTypes:!0})){if(!t.isDirectory())continue;if(q(N.join(e,t.name,"run.json"),void 0)?.boxKind==="ghost")return!0}return!1}function Mo(r){let e=N.join(r,"ghost");return P(e)?!P(N.join(e,"runs")):Ko(r)}function Yt(r){return Lo(r.sharedRoot)?Do(r.forgeRoot)?Mo(r.sharedRoot)?{action:"blocked",blocker:"Forge legacy harness migration blocked: Ghost pool is co-hosted on this host (ghost namespace or ghost-attributed runs under ~/.kynver/harness). Drain in-flight Ghost runs from the shared root, or get operator sign-off for a fresh Forge cutover before enabling box-scoped isolation."}:{action:"migrate"}:{action:"none"}:{action:"none"}}function Vt(r,e){Po(e,{recursive:!0});for(let t of Ht){let n=N.join(r,t),o=N.join(e,t);if(P(n)){if(P(o)&&be(o).length>0)throw new Error(`Forge legacy harness migration failed: ${o} is not empty`);if(P(o)){$t(n,o);continue}$t(n,o)}}}var Ht,Gt=a(()=>{"use strict";b();Ht=["runs","worktrees"]});import{existsSync as k}from"node:fs";import{homedir as Wo}from"node:os";import S from"node:path";function ar(r=process.env){return r.HOME?.trim()||Wo()}function lr(r=process.env){return S.join(ar(r),".kynver","harness")}function ke(r){let e=S.resolve(I(r.trim()));for(;Fo.has(S.basename(e));)e=S.dirname(e);return e}function Bo(r,e=process.env){return S.join(lr(e),r)}function Uo(r=process.env){let e=lr(r);if(k(S.join(e,"runs")))return!0;if(k(e)&&!k(S.join(e,"ghost"))&&!k(S.join(e,"forge")))return k(e);let t=S.join(ar(r),Jt);return k(t)}function xe(r){let e=r.env??process.env,t=e.KYNVER_HARNESS_ROOT?.trim()||e.OPUS_HARNESS_ROOT?.trim();if(t)return{harnessRoot:ke(t),source:"env"};let n=r.configuredHarnessRoot?.trim();if(n)return{harnessRoot:ke(n),source:"config"};let o=Bo(r.boxKind,e);if(k(S.join(o,"runs"))||k(o)&&!$o(o))return{harnessRoot:o,source:"box_scoped"};let i=lr(e);if(r.boxKind==="forge"){let l=Yt({sharedRoot:i,forgeRoot:o});if(l.action==="blocked")return{harnessRoot:o,source:"box_scoped",migrationBlocker:l.blocker};if(l.action==="migrate")return r.allowForgeLegacyMigration!==!1&&Vt(i,o),{harnessRoot:o,source:"legacy_migrated"}}if(r.boxKind==="ghost"&&Uo(e)){if(k(S.join(i,"runs")))return{harnessRoot:i,source:"legacy_shared"};if(k(i)&&!k(S.join(i,"ghost"))&&!k(S.join(i,"forge")))return{harnessRoot:i,source:"legacy_shared"};let u=S.join(ar(e),Jt);if(k(u))return{harnessRoot:u,source:"legacy_shared"}}return{harnessRoot:o,source:"box_scoped"}}function $o(r){if(!k(r))return!0;for(let e of["runs","worktrees"]){let t=S.join(r,e);if(k(t))return!1}return!0}var Jt,Fo,cr=a(()=>{"use strict";F();Gt();Jt=S.join(".openclaw","harness");Fo=new Set(["runs","worktrees"])});import qt from"node:os";function ve(r){return r?.trim()?r.trim():null}function Ho(r,e){let t=e.trim().toLowerCase()||"host";return`${r}-${t}`.replace(/[^a-z0-9._-]+/g,"-")}function jo(r){return r.KYNVER_DISPATCH_STRICT_IDENTITY==="1"||r.KYNVER_DISPATCH_STRICT_IDENTITY==="true"||r.KYNVER_DAEMON_STRICT_IDENTITY==="1"||r.KYNVER_DAEMON_STRICT_IDENTITY==="true"}function Ee(r=E(),e=process.env,t={}){let n=z(e,r),o=[...n.warnings],s=[],i=!!(r.boxKind?.trim()||ve(e.KYNVER_BOX_KIND)),l=t.strict===!0||jo(e);if((t.requireExplicitBoxKind||l)&&!i&&s.push("boxKind is not persisted in ~/.kynver/config.json and KYNVER_BOX_KIND is unset \u2014 run `kynver setup` (customers: boxKind=box) or `kynver setup --box-kind forge|ghost` for operator pools before dispatch"),n.slugInferenceBlocked&&!i){let V="ambiguous box identity: KYNVER_AGENT_OS_SLUG is set without KYNVER_BOX_KIND or config.boxKind";l||t.requireExplicitBoxKind?s.push(V):o.push(`${V} \u2014 defaulting box kind to box (customer), not forge/ghost`)}let u=ve(r.runnerId),c=ve(e.KYNVER_RUNTIME_ID)??ve(e.OPENCLAW_RUNTIME_ID),p=u??c??Ho(n.boxKind,qt.hostname()),f=u?"config":c?"env":"derived";f==="derived"&&o.push(`runnerId not persisted \u2014 using derived id "${p}"; run \`kynver setup --box-kind ${n.boxKind}\` to persist runner identity`);let d=er({config:r,env:e,totalMemBytes:qt.totalmem()}),Y=fe(n.boxKind,d.configuredMaxWorkers??je(n.boxKind,d.autoCap)),x=xe({boxKind:n.boxKind,configuredHarnessRoot:r.harnessRoot,env:e});return x.migrationBlocker&&s.push(x.migrationBlocker),s.length>0?{ok:!1,identity:null,errors:s,warnings:o}:{ok:!0,identity:{boxKind:n.boxKind,boxKindSource:n.source,runnerId:p,runnerIdSource:f,maxConcurrentWorkers:Y,workerCapSource:d.workerCapSource,harnessRoot:x.harnessRoot,harnessRootSource:x.source},errors:s,warnings:o}}var _e=a(()=>{"use strict";T();W();me();Re();cr()});var zt=a(()=>{"use strict";$e();W();Mt();T();Se();Wt();de();ir();_e()});var Jo,Rd,Xt=a(()=>{"use strict";Jo=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],Rd=Jo.join("|")});var Qt=a(()=>{"use strict";F()});var Zt=a(()=>{"use strict";Qt()});import{execFileSync as qo}from"node:child_process";function pr(r=process.env){let e=r[zo]?.trim().toLowerCase();return e==="file"?"file":e==="keychain"?"keychain":"auto"}function Xo(r,e,t){let n={encoding:"utf8",timeout:t.timeoutMs,stdio:["pipe","pipe","pipe"],windowsHide:!0,...t.input!==void 0?{input:t.input}:{}};return qo(r,e,n)}function Qo(r=process.platform){return r==="darwin"?"macos":r==="linux"?"libsecret":r==="win32"?"windows":null}function ur(r,e){let t=JSON.stringify(U),n=JSON.stringify(e),o="[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]; $v = New-Object Windows.Security.Credentials.PasswordVault;";return r==="get"?`${o} try { $c = $v.Retrieve(${t}, ${n}); $c.RetrievePassword(); [Console]::Out.Write($c.Password) } catch { exit 3 }`:r==="set"?`${o} $s = [Console]::In.ReadToEnd().TrimEnd("\`r","\`n"); try { $old = $v.Retrieve(${t}, ${n}); $v.Remove($old) } catch {}; $v.Add((New-Object Windows.Security.Credentials.PasswordCredential(${t}, ${n}, $s)))`:`${o} try { $old = $v.Retrieve(${t}, ${n}); $v.Remove($old) } catch {}`}function en(r={}){if(pr(r.env??process.env)==="file")return null;let t=Qo(r.platform??process.platform);return t?new dr(t,r.exec):null}var U,zo,D,dr,rn=a(()=>{"use strict";U="kynver",zo="KYNVER_CREDENTIAL_STORE";D=5e3;dr=class{constructor(e,t=Xo){this.backend=e;this.exec=t}backend;exec;get(e){try{if(this.backend==="macos"){let s=this.exec("security",["find-generic-password","-s",U,"-a",e,"-w"],{timeoutMs:D}).replace(/\r?\n$/,"");return s||null}if(this.backend==="libsecret"){let s=this.exec("secret-tool",["lookup","service",U,"account",e],{timeoutMs:D}).replace(/\r?\n$/,"");return s||null}let n=this.exec("powershell.exe",["-NoProfile","-NonInteractive","-Command",ur("get",e)],{timeoutMs:D}).replace(/\r?\n$/,"");return n||null}catch{return null}}set(e,t){if(!t||/[\r\n]/.test(t))return!1;try{this.backend==="macos"?this.exec("security",["add-generic-password","-U","-s",U,"-a",e,"-l",`Kynver (${e})`,"-w",t],{timeoutMs:D}):this.backend==="libsecret"?this.exec("secret-tool",["store",`--label=Kynver (${e})`,"service",U,"account",e],{input:`${t}
+`});var St=a(()=>{"use strict";re();b();qe()});var bt=a(()=>{"use strict";he();Je()});var kt=a(()=>{"use strict"});var Yl,Vl,xt=a(()=>{"use strict";ce();Yl=10*6e4,Vl=60*6e4});var vt=a(()=>{"use strict"});var ze=a(()=>{"use strict"});var Et=a(()=>{"use strict"});var _t=a(()=>{"use strict";ze();Et()});var Ct=a(()=>{"use strict";ft();Rt();St();qe();he();bt();kt();xt();vt();_t();ze();b()});var At=a(()=>{"use strict";Ct();b()});function wt(r,e={}){let t=e.perWorkerMemBytes??Xe,n=e.memReserveBytes??Qe,o=e.memUtilization??Ze,s=Math.max(0,Math.floor(r*o)-n),i=Math.max(1,Math.floor(s/t));return Math.min(i,ye)}var Xe,Qe,Ze,ye,Ot=a(()=>{"use strict";st();T();F();me();Re();Ve();re();dt();At();b();Xe=500*1024*1024,Qe=4*1024*1024*1024,Ze=.85,ye=64});function te(r,e){let t=Number(r);return!Number.isFinite(t)||t<=0?e:Math.floor(t)}function er(r){let e=r.config??{},t=r.env??process.env,n=te(e.perWorkerMemBytes,Xe),o=te(e.memReserveBytes,Qe),s=Math.min(1,Math.max(.1,Number(e.memUtilization)>0?Number(e.memUtilization):Ze)),i=wt(r.totalMemBytes,{perWorkerMemBytes:n,memReserveBytes:o,memUtilization:s});if(r.configuredMaxWorkersOverride!==void 0&&r.configuredMaxWorkersOverride!==null)return{configuredMaxWorkers:te(r.configuredMaxWorkersOverride,i),autoCap:i,workerCapSource:"workspace_override"};if(e.maxConcurrentWorkers!==void 0&&e.maxConcurrentWorkers!==null){let c=te(e.maxConcurrentWorkers,0)||null;if(c)return{configuredMaxWorkers:Math.min(c,ye),autoCap:i,workerCapSource:"config"}}let u=(t.KYNVER_MAX_WORKERS_INTENTIONAL==="1"||t.KYNVER_MAX_WORKERS_INTENTIONAL==="true")&&t.KYNVER_MAX_WORKERS&&te(t.KYNVER_MAX_WORKERS,0)||null;return u?{configuredMaxWorkers:Math.min(u,ye),autoCap:i,workerCapSource:"env"}:{configuredMaxWorkers:null,autoCap:i,workerCapSource:"auto"}}var Re=a(()=>{"use strict";Ot()});import{homedir as Ao}from"node:os";import wo from"node:path";var It,rr=a(()=>{"use strict";It=wo.join(Ao(),".kynver",".env")});var Tt=a(()=>{"use strict"});var Pt=a(()=>{"use strict";Tt()});var Nt=a(()=>{"use strict"});var Dt=a(()=>{"use strict";b()});var tr=a(()=>{"use strict";Pt();Nt();Dt()});var Lt=a(()=>{"use strict"});var Kt=a(()=>{"use strict";Lt()});var Se=a(()=>{"use strict";rr();W();T();tr();Kt()});var Mt=a(()=>{"use strict";F();F()});var Ft=a(()=>{"use strict";rr();tr();Se()});function Ut(r){if(!Bt)return r;if(!Wt)throw new nr;return Wt}function sr(){if(Bt)throw new or}var nr,or,Bt,Wt,ir=a(()=>{"use strict";nr=class extends Error{constructor(){super("desktop credential provider is not installed; refusing to fall back to file or env credentials"),this.name="DesktopCredentialProviderMissingError"}},or=class extends Error{constructor(){super("the credentials file is disabled in desktop mode"),this.name="LegacyCredentialStoreDisabledError"}},Bt=!1,Wt=null});import{existsSync as P,mkdirSync as Po,readdirSync as be,renameSync as $t,statSync as No}from"node:fs";import N from"node:path";function jt(r){try{return No(r).isDirectory()}catch{return!1}}function Do(r){if(!P(r))return!0;for(let e of Ht){let t=N.join(r,e);if(P(t)&&(!jt(t)||be(t).length>0))return!1}return!0}function Lo(r){let e=N.join(r,"runs");if(!P(e)||!jt(e))return!1;for(let t of be(e,{withFileTypes:!0})){if(!t.isDirectory()||t.name==="runs")continue;let n=N.join(e,t.name,"run.json");if(q(n,void 0)?.id)return!0}return!1}function Ko(r){let e=N.join(r,"runs");if(!P(e))return!1;for(let t of be(e,{withFileTypes:!0})){if(!t.isDirectory())continue;if(q(N.join(e,t.name,"run.json"),void 0)?.boxKind==="ghost")return!0}return!1}function Mo(r){let e=N.join(r,"ghost");return P(e)?!P(N.join(e,"runs")):Ko(r)}function Yt(r){return Lo(r.sharedRoot)?Do(r.forgeRoot)?Mo(r.sharedRoot)?{action:"blocked",blocker:"Forge legacy harness migration blocked: Ghost pool is co-hosted on this host (ghost namespace or ghost-attributed runs under ~/.kynver/harness). Drain in-flight Ghost runs from the shared root, or get operator sign-off for a fresh Forge cutover before enabling box-scoped isolation."}:{action:"migrate"}:{action:"none"}:{action:"none"}}function Vt(r,e){Po(e,{recursive:!0});for(let t of Ht){let n=N.join(r,t),o=N.join(e,t);if(P(n)){if(P(o)&&be(o).length>0)throw new Error(`Forge legacy harness migration failed: ${o} is not empty`);if(P(o)){$t(n,o);continue}$t(n,o)}}}var Ht,Gt=a(()=>{"use strict";b();Ht=["runs","worktrees"]});import{existsSync as k}from"node:fs";import{homedir as Fo}from"node:os";import S from"node:path";function ar(r=process.env){return r.HOME?.trim()||Fo()}function lr(r=process.env){return S.join(ar(r),".kynver","harness")}function ke(r){let e=S.resolve(I(r.trim()));for(;Wo.has(S.basename(e));)e=S.dirname(e);return e}function Bo(r,e=process.env){return S.join(lr(e),r)}function Uo(r=process.env){let e=lr(r);if(k(S.join(e,"runs")))return!0;if(k(e)&&!k(S.join(e,"ghost"))&&!k(S.join(e,"forge")))return k(e);let t=S.join(ar(r),Jt);return k(t)}function xe(r){let e=r.env??process.env,t=e.KYNVER_HARNESS_ROOT?.trim()||e.OPUS_HARNESS_ROOT?.trim();if(t)return{harnessRoot:ke(t),source:"env"};let n=r.configuredHarnessRoot?.trim();if(n)return{harnessRoot:ke(n),source:"config"};let o=Bo(r.boxKind,e);if(k(S.join(o,"runs"))||k(o)&&!$o(o))return{harnessRoot:o,source:"box_scoped"};let i=lr(e);if(r.boxKind==="forge"){let l=Yt({sharedRoot:i,forgeRoot:o});if(l.action==="blocked")return{harnessRoot:o,source:"box_scoped",migrationBlocker:l.blocker};if(l.action==="migrate")return r.allowForgeLegacyMigration!==!1&&Vt(i,o),{harnessRoot:o,source:"legacy_migrated"}}if(r.boxKind==="ghost"&&Uo(e)){if(k(S.join(i,"runs")))return{harnessRoot:i,source:"legacy_shared"};if(k(i)&&!k(S.join(i,"ghost"))&&!k(S.join(i,"forge")))return{harnessRoot:i,source:"legacy_shared"};let u=S.join(ar(e),Jt);if(k(u))return{harnessRoot:u,source:"legacy_shared"}}return{harnessRoot:o,source:"box_scoped"}}function $o(r){if(!k(r))return!0;for(let e of["runs","worktrees"]){let t=S.join(r,e);if(k(t))return!1}return!0}var Jt,Wo,cr=a(()=>{"use strict";W();Gt();Jt=S.join(".openclaw","harness");Wo=new Set(["runs","worktrees"])});import qt from"node:os";function ve(r){return r?.trim()?r.trim():null}function Ho(r,e){let t=e.trim().toLowerCase()||"host";return`${r}-${t}`.replace(/[^a-z0-9._-]+/g,"-")}function jo(r){return r.KYNVER_DISPATCH_STRICT_IDENTITY==="1"||r.KYNVER_DISPATCH_STRICT_IDENTITY==="true"||r.KYNVER_DAEMON_STRICT_IDENTITY==="1"||r.KYNVER_DAEMON_STRICT_IDENTITY==="true"}function Ee(r=E(),e=process.env,t={}){let n=z(e,r),o=[...n.warnings],s=[],i=!!(r.boxKind?.trim()||ve(e.KYNVER_BOX_KIND)),l=t.strict===!0||jo(e);if((t.requireExplicitBoxKind||l)&&!i&&s.push("boxKind is not persisted in ~/.kynver/config.json and KYNVER_BOX_KIND is unset \u2014 run `kynver setup` (customers: boxKind=box) or `kynver setup --box-kind forge|ghost` for operator pools before dispatch"),n.slugInferenceBlocked&&!i){let V="ambiguous box identity: KYNVER_AGENT_OS_SLUG is set without KYNVER_BOX_KIND or config.boxKind";l||t.requireExplicitBoxKind?s.push(V):o.push(`${V} \u2014 defaulting box kind to box (customer), not forge/ghost`)}let u=ve(r.runnerId),c=ve(e.KYNVER_RUNTIME_ID)??ve(e.OPENCLAW_RUNTIME_ID),p=u??c??Ho(n.boxKind,qt.hostname()),f=u?"config":c?"env":"derived";f==="derived"&&o.push(`runnerId not persisted \u2014 using derived id "${p}"; run \`kynver setup --box-kind ${n.boxKind}\` to persist runner identity`);let d=er({config:r,env:e,totalMemBytes:qt.totalmem()}),Y=fe(n.boxKind,d.configuredMaxWorkers??je(n.boxKind,d.autoCap)),x=xe({boxKind:n.boxKind,configuredHarnessRoot:r.harnessRoot,env:e});return x.migrationBlocker&&s.push(x.migrationBlocker),s.length>0?{ok:!1,identity:null,errors:s,warnings:o}:{ok:!0,identity:{boxKind:n.boxKind,boxKindSource:n.source,runnerId:p,runnerIdSource:f,maxConcurrentWorkers:Y,workerCapSource:d.workerCapSource,harnessRoot:x.harnessRoot,harnessRootSource:x.source},errors:s,warnings:o}}var _e=a(()=>{"use strict";T();F();me();Re();cr()});var zt=a(()=>{"use strict";$e();F();Mt();T();Se();Ft();de();ir();_e()});var Jo,Rd,Xt=a(()=>{"use strict";Jo=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],Rd=Jo.join("|")});var Qt=a(()=>{"use strict";W()});var Zt=a(()=>{"use strict";Qt()});import{execFileSync as qo}from"node:child_process";function pr(r=process.env){let e=r[zo]?.trim().toLowerCase();return e==="file"?"file":e==="keychain"?"keychain":"auto"}function Xo(r,e,t){let n={encoding:"utf8",timeout:t.timeoutMs,stdio:["pipe","pipe","pipe"],windowsHide:!0,...t.input!==void 0?{input:t.input}:{}};return qo(r,e,n)}function Qo(r=process.platform){return r==="darwin"?"macos":r==="linux"?"libsecret":r==="win32"?"windows":null}function ur(r,e){let t=JSON.stringify(U),n=JSON.stringify(e),o="[void][Windows.Security.Credentials.PasswordVault,Windows.Security.Credentials,ContentType=WindowsRuntime]; $v = New-Object Windows.Security.Credentials.PasswordVault;";return r==="get"?`${o} try { $c = $v.Retrieve(${t}, ${n}); $c.RetrievePassword(); [Console]::Out.Write($c.Password) } catch { exit 3 }`:r==="set"?`${o} $s = [Console]::In.ReadToEnd().TrimEnd("\`r","\`n"); try { $old = $v.Retrieve(${t}, ${n}); $v.Remove($old) } catch {}; $v.Add((New-Object Windows.Security.Credentials.PasswordCredential(${t}, ${n}, $s)))`:`${o} try { $old = $v.Retrieve(${t}, ${n}); $v.Remove($old) } catch {}`}function en(r={}){if(pr(r.env??process.env)==="file")return null;let t=Qo(r.platform??process.platform);return t?new dr(t,r.exec):null}var U,zo,D,dr,rn=a(()=>{"use strict";U="kynver",zo="KYNVER_CREDENTIAL_STORE";D=5e3;dr=class{constructor(e,t=Xo){this.backend=e;this.exec=t}backend;exec;get(e){try{if(this.backend==="macos"){let s=this.exec("security",["find-generic-password","-s",U,"-a",e,"-w"],{timeoutMs:D}).replace(/\r?\n$/,"");return s||null}if(this.backend==="libsecret"){let s=this.exec("secret-tool",["lookup","service",U,"account",e],{timeoutMs:D}).replace(/\r?\n$/,"");return s||null}let n=this.exec("powershell.exe",["-NoProfile","-NonInteractive","-Command",ur("get",e)],{timeoutMs:D}).replace(/\r?\n$/,"");return n||null}catch{return null}}set(e,t){if(!t||/[\r\n]/.test(t))return!1;try{this.backend==="macos"?this.exec("security",["add-generic-password","-U","-s",U,"-a",e,"-l",`Kynver (${e})`,"-w",t],{timeoutMs:D}):this.backend==="libsecret"?this.exec("secret-tool",["store",`--label=Kynver (${e})`,"service",U,"account",e],{input:`${t}
 `,timeoutMs:D}):this.exec("powershell.exe",["-NoProfile","-NonInteractive","-Command",ur("set",e)],{input:`${t}
 `,timeoutMs:D})}catch{return!1}return this.get(e)===t}delete(e){try{this.backend==="macos"?this.exec("security",["delete-generic-password","-s",U,"-a",e],{timeoutMs:D}):this.backend==="libsecret"?this.exec("secret-tool",["clear","service",U,"account",e],{timeoutMs:D}):this.exec("powershell.exe",["-NoProfile","-NonInteractive","-Command",ur("delete",e)],{timeoutMs:D})}catch{}}}});function hr(){return fr||(fr=new mr),fr}var gr,Zo,Ce,mr,fr,tn=a(()=>{"use strict";rn();gr="api-key",Zo=6e4,Ce=class extends Error{constructor(e){super(`KYNVER_CREDENTIAL_STORE=keychain but the OS keychain could not store "${e}"; refusing to write the secret to disk`),this.name="KeychainUnavailableError"}},mr=class{cache=new Map;keychain;env;now;constructor(e={}){this.env=e.env??process.env,this.keychain=e.keychain===void 0?en({env:this.env}):e.keychain,this.now=e.now??Date.now}get available(){return this.keychain!==null}get backend(){return this.keychain?.backend??null}read(e){if(!this.keychain)return null;let t=this.cache.get(e);if(t&&this.now()-t.at<Zo)return t.value;let n=this.keychain.get(e);return this.cache.set(e,{value:n,at:this.now()}),n}write(e,t){let n=pr(this.env);if(!this.keychain){if(n==="keychain")throw new Ce(e);return!1}let o=this.keychain.set(e,t);if(o)this.cache.set(e,{value:t,at:this.now()});else if(this.cache.delete(e),n==="keychain")throw new Ce(e);return o}remove(e){this.cache.delete(e),this.keychain?.delete(e)}invalidate(e){e?this.cache.delete(e):this.cache.clear()}},fr=null});import{existsSync as on,mkdirSync as es,readFileSync as sn,writeFileSync as rs}from"node:fs";import{homedir as ts,totalmem as jd}from"node:os";import Sr from"node:path";function ns(r){return{...r,...r.harnessRoot?.trim()?{harnessRoot:I(r.harnessRoot.trim())}:{},...r.defaultRepo?.trim()?{defaultRepo:I(r.defaultRepo.trim())}:{}}}function os(r){let e=r.defaultRepo?.trim();return!e||r.defaultBase?.trim()||!Qr(I(e))?r:{...r,defaultBase:Xr}}function ss(){if(!on(nn))return null;try{return JSON.parse(sn(nn,"utf8"))}catch{return null}}function E(){let r=ss();return r?os(ns(r)):{}}function Ae(){if(sr(),!on(yr))return{};try{return JSON.parse(sn(yr,"utf8"))}catch{return{}}}function Rr(r){sr(),es(br,{recursive:!0}),rs(yr,`${JSON.stringify(r,null,2)}
-`,{mode:384})}function is(r,e,t,n={}){let o=Ae();if(hr().write(r,t)){let i={...o,...n};delete i[e],i.store="keychain",i.keychainAccounts=Array.from(new Set([...o.keychainAccounts??[],r])).sort(),Rr(i);return}Rr({...o,...n,[e]:t})}function as(r,e){let t=hr().read(r);return t||Ae()[e]}function an(){return Ut(ls)}function ln(){return an().getApiKey()}function cs(r,e){an().persistRunnerToken(r,e)}function us(r){let e=cn(r);return e||ps("requires --base-url, KYNVER_API_URL, KYNVER_CRON_FIRE_BASE_URL, or ~/.kynver/config.json apiBaseUrl"),e}function cn(r){let e=r||process.env.KYNVER_API_URL||process.env.KYNVER_CRON_FIRE_BASE_URL||process.env.OPENCLAW_CRON_FIRE_BASE_URL||E().apiBaseUrl;return He(e)}async function un(r,e,t){let n=ln(),o=cn(t?.baseUrl);if(!n)return{ok:!1,reason:"KYNVER_API_KEY is required to refresh a rejected runner token"};if(!e)return{ok:!1,reason:"agentOsId is required to refresh a rejected runner token"};if(!o)return{ok:!1,reason:"KYNVER_API_URL or --base-url is required to refresh a rejected runner token"};try{let s=await ds(e,{baseUrl:o,apiKey:n});return s&&s!==r?(cs(e,s),{ok:!0,token:s}):{ok:!1,reason:"runner credential refresh returned the rejected token"}}catch(s){return{ok:!1,reason:s.message}}}async function ds(r,e){let t=e?.apiKey||ln();if(!t)throw new Error("API key required \u2014 run `kynver login` first");let o=`${us(e?.baseUrl)}/api/agent-os/by-id/${encodeURIComponent(r)}/runner-credentials`,s=await ue(o,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${t}`},body:JSON.stringify(e?.enableMcpUpdates?{enableMcpUpdates:!0}:{})}),i=await s.text(),l=null;try{l=JSON.parse(i)}catch{l=null}if(!s.ok||!l?.token)throw new Error(`runner credential mint failed (${s.status}): ${l?.error??i.slice(0,200)}`);return l.token}function ps(r){console.error(r),process.exit(1)}var br,nn,yr,lp,cp,ls,T=a(()=>{"use strict";$e();F();Ue();et();de();W();me();Re();Ve();Se();zt();Xt();_e();Zt();ir();tn();br=Sr.join(ts(),".kynver"),nn=Sr.join(br,"config.json"),yr=Sr.join(br,"credentials");lp=500*1024*1024,cp=4*1024*1024*1024;ls={kind:"file",getApiKey(){return process.env.KYNVER_API_KEY?process.env.KYNVER_API_KEY:as(gr,"apiKey")},getRunnerToken(r){let e=Ae();if(!!e.runnerToken&&!!r&&e.runnerTokenAgentOsId===r)return e.runnerToken;let n=process.env.KYNVER_RUNNER_TOKEN?.trim();if(n)return n;if(e.runnerToken&&!(r&&e.runnerTokenAgentOsId&&e.runnerTokenAgentOsId!==r))return e.runnerToken},persistApiKey(r){is(gr,"apiKey",r)},persistRunnerToken(r,e){Rr({...Ae(),runnerToken:e,runnerTokenAgentOsId:r})}}});import dn from"node:path";function we(r){return ke(r)}function kr(){let r=process.env.KYNVER_HARNESS_ROOT||process.env.OPUS_HARNESS_ROOT;if(r)return we(r);let e=E(),t=e.harnessRoot?.trim();if(t)return we(t);let n=Ee(e,process.env);return n.identity?n.identity.harnessRoot:xe({boxKind:"forge",configuredHarnessRoot:null}).harnessRoot}function lt(r){return dn.join(we(r),"runs")}function fs(r){return dn.join(we(r),"worktrees")}function ct(){let r=kr();return{harnessRoot:r,runsDir:lt(r),worktreesDir:fs(r)}}var Ge=a(()=>{"use strict";T();cr();_e();b()});import{existsSync as Ln,realpathSync as Kn,readFileSync as Mn}from"node:fs";import Hr from"node:path";var Wn=new Set(["ext4","ext3","ext2","btrfs","xfs","f2fs","zfs","tmpfs","overlay","overlayfs"]),Fn=new Set(["9p","drvfs","nfs","nfs4","cifs","smb","smbfs","smb3","sshfs","fuse.sshfs","davfs","davfs2","glusterfs","ceph","lustre","afs","vboxsf","prl_fs","virtiofs"]);function Bn(){try{return Mn("/proc/self/mounts","utf8")}catch{return null}}function Un(r){let e=Hr.resolve(r);for(let t=0;t<64;t+=1){if(Ln(e))try{return Kn.native(e)}catch{return e}let n=Hr.dirname(e);if(n===e)return e;e=n}return e}function $n(r){return r.replace(/\\(\d{3})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Hn(r){let e=[];for(let t of r.split(`
-`)){let n=t.trim().split(/\s+/);n.length<3||e.push({mountPoint:$n(n[1]),fsType:n[2]})}return e}function jr(r,e=process.platform){return e==="win32"?r.replace(/\\/g,"/"):r}function jn(r,e){let t=null,n=jr(r);for(let o of e){let s=jr(o.mountPoint),i=s.endsWith("/")?s:`${s}/`;(n===s||`${n}/`.startsWith(i))&&(!t||o.mountPoint.length>t.mountPoint.length)&&(t=o)}return t}function Ke(r,e){let n=(e?.resolveRealPath??Un)(r),o=(e?.mountsSource??Bn)();if(o===null)return{verdict:"rejected",reason:"Mount information unavailable \u2014 the filesystem type cannot be established safely, so WAL mode is refused (fail closed).",filesystemType:null,mountPoint:null,resolvedPath:n};let s=jn(n,Hn(o));if(!s)return{verdict:"rejected",reason:"No mount entry covers the resolved database path \u2014 refusing WAL mode (fail closed).",filesystemType:null,mountPoint:null,resolvedPath:n};let i=s.fsType.toLowerCase();return Fn.has(i)||i.startsWith("fuse.")?{verdict:"rejected",reason:`Filesystem '${i}' is network-like or crosses an OS boundary; SQLite WAL locking is not safe there.`,filesystemType:i,mountPoint:s.mountPoint,resolvedPath:n}:Wn.has(i)?{verdict:"accepted",reason:`Local filesystem '${i}' accepted for WAL mode.`,filesystemType:i,mountPoint:s.mountPoint,resolvedPath:n}:{verdict:"rejected",reason:`Filesystem '${i}' is unknown to the qualification policy; WAL mode is refused rather than guessed (fail closed).`,filesystemType:i,mountPoint:s.mountPoint,resolvedPath:n}}var Me=1,ie=class extends Error{constructor(e,t){super(`local-run-store schema version ${e} is newer than this runtime supports (${t}); refusing to open. Upgrade the runtime or quarantine the database deliberately.`),this.name="SchemaDowngradeRefusedError"}},Yn=[`CREATE TABLE IF NOT EXISTS local_meta (
+`,{mode:384})}function is(r,e,t,n={}){let o=Ae();if(hr().write(r,t)){let i={...o,...n};delete i[e],i.store="keychain",i.keychainAccounts=Array.from(new Set([...o.keychainAccounts??[],r])).sort(),Rr(i);return}Rr({...o,...n,[e]:t})}function as(r,e){let t=hr().read(r);return t||Ae()[e]}function an(){return Ut(ls)}function ln(){return an().getApiKey()}function cs(r,e){an().persistRunnerToken(r,e)}function us(r){let e=cn(r);return e||ps("requires --base-url, KYNVER_API_URL, KYNVER_CRON_FIRE_BASE_URL, or ~/.kynver/config.json apiBaseUrl"),e}function cn(r){let e=r||process.env.KYNVER_API_URL||process.env.KYNVER_CRON_FIRE_BASE_URL||process.env.OPENCLAW_CRON_FIRE_BASE_URL||E().apiBaseUrl;return He(e)}async function un(r,e,t){let n=ln(),o=cn(t?.baseUrl);if(!n)return{ok:!1,reason:"KYNVER_API_KEY is required to refresh a rejected runner token"};if(!e)return{ok:!1,reason:"agentOsId is required to refresh a rejected runner token"};if(!o)return{ok:!1,reason:"KYNVER_API_URL or --base-url is required to refresh a rejected runner token"};try{let s=await ds(e,{baseUrl:o,apiKey:n});return s&&s!==r?(cs(e,s),{ok:!0,token:s}):{ok:!1,reason:"runner credential refresh returned the rejected token"}}catch(s){return{ok:!1,reason:s.message}}}async function ds(r,e){let t=e?.apiKey||ln();if(!t)throw new Error("API key required \u2014 run `kynver login` first");let o=`${us(e?.baseUrl)}/api/agent-os/by-id/${encodeURIComponent(r)}/runner-credentials`,s=await ue(o,{method:"POST",headers:{"Content-Type":"application/json",Authorization:`Bearer ${t}`},body:JSON.stringify(e?.enableMcpUpdates?{enableMcpUpdates:!0}:{})}),i=await s.text(),l=null;try{l=JSON.parse(i)}catch{l=null}if(!s.ok||!l?.token)throw new Error(`runner credential mint failed (${s.status}): ${l?.error??i.slice(0,200)}`);return l.token}function ps(r){console.error(r),process.exit(1)}var br,nn,yr,lp,cp,ls,T=a(()=>{"use strict";$e();W();Ue();et();de();F();me();Re();Ve();Se();zt();Xt();_e();Zt();ir();tn();br=Sr.join(ts(),".kynver"),nn=Sr.join(br,"config.json"),yr=Sr.join(br,"credentials");lp=500*1024*1024,cp=4*1024*1024*1024;ls={kind:"file",getApiKey(){return process.env.KYNVER_API_KEY?process.env.KYNVER_API_KEY:as(gr,"apiKey")},getRunnerToken(r){let e=Ae();if(!!e.runnerToken&&!!r&&e.runnerTokenAgentOsId===r)return e.runnerToken;let n=process.env.KYNVER_RUNNER_TOKEN?.trim();if(n)return n;if(e.runnerToken&&!(r&&e.runnerTokenAgentOsId&&e.runnerTokenAgentOsId!==r))return e.runnerToken},persistApiKey(r){is(gr,"apiKey",r)},persistRunnerToken(r,e){Rr({...Ae(),runnerToken:e,runnerTokenAgentOsId:r})}}});import dn from"node:path";function we(r){return ke(r)}function kr(){let r=process.env.KYNVER_HARNESS_ROOT||process.env.OPUS_HARNESS_ROOT;if(r)return we(r);let e=E(),t=e.harnessRoot?.trim();if(t)return we(t);let n=Ee(e,process.env);return n.identity?n.identity.harnessRoot:xe({boxKind:"forge",configuredHarnessRoot:null}).harnessRoot}function lt(r){return dn.join(we(r),"runs")}function fs(r){return dn.join(we(r),"worktrees")}function ct(){let r=kr();return{harnessRoot:r,runsDir:lt(r),worktreesDir:fs(r)}}var Ge=a(()=>{"use strict";T();cr();_e();b()});import{existsSync as Ln,realpathSync as Kn,readFileSync as Mn}from"node:fs";import Hr from"node:path";var Fn=new Set(["ext4","ext3","ext2","btrfs","xfs","f2fs","zfs","tmpfs","overlay","overlayfs"]),Wn=new Set(["9p","drvfs","nfs","nfs4","cifs","smb","smbfs","smb3","sshfs","fuse.sshfs","davfs","davfs2","glusterfs","ceph","lustre","afs","vboxsf","prl_fs","virtiofs"]);function Bn(){try{return Mn("/proc/self/mounts","utf8")}catch{return null}}function Un(r){let e=Hr.resolve(r);for(let t=0;t<64;t+=1){if(Ln(e))try{return Kn.native(e)}catch{return e}let n=Hr.dirname(e);if(n===e)return e;e=n}return e}function $n(r){return r.replace(/\\(\d{3})/g,(e,t)=>String.fromCharCode(Number.parseInt(t,8)))}function Hn(r){let e=[];for(let t of r.split(`
+`)){let n=t.trim().split(/\s+/);n.length<3||e.push({mountPoint:$n(n[1]),fsType:n[2]})}return e}function jr(r,e=process.platform){return e==="win32"?r.replace(/\\/g,"/"):r}function jn(r,e){let t=null,n=jr(r);for(let o of e){let s=jr(o.mountPoint),i=s.endsWith("/")?s:`${s}/`;(n===s||`${n}/`.startsWith(i))&&(!t||o.mountPoint.length>t.mountPoint.length)&&(t=o)}return t}function Ke(r,e){let n=(e?.resolveRealPath??Un)(r),o=(e?.mountsSource??Bn)();if(o===null)return{verdict:"rejected",reason:"Mount information unavailable \u2014 the filesystem type cannot be established safely, so WAL mode is refused (fail closed).",filesystemType:null,mountPoint:null,resolvedPath:n};let s=jn(n,Hn(o));if(!s)return{verdict:"rejected",reason:"No mount entry covers the resolved database path \u2014 refusing WAL mode (fail closed).",filesystemType:null,mountPoint:null,resolvedPath:n};let i=s.fsType.toLowerCase();return Wn.has(i)||i.startsWith("fuse.")?{verdict:"rejected",reason:`Filesystem '${i}' is network-like or crosses an OS boundary; SQLite WAL locking is not safe there.`,filesystemType:i,mountPoint:s.mountPoint,resolvedPath:n}:Fn.has(i)?{verdict:"accepted",reason:`Local filesystem '${i}' accepted for WAL mode.`,filesystemType:i,mountPoint:s.mountPoint,resolvedPath:n}:{verdict:"rejected",reason:`Filesystem '${i}' is unknown to the qualification policy; WAL mode is refused rather than guessed (fail closed).`,filesystemType:i,mountPoint:s.mountPoint,resolvedPath:n}}var Me=1,ie=class extends Error{constructor(e,t){super(`local-run-store schema version ${e} is newer than this runtime supports (${t}); refusing to open. Upgrade the runtime or quarantine the database deliberately.`),this.name="SchemaDowngradeRefusedError"}},Yn=[`CREATE TABLE IF NOT EXISTS local_meta (
      key TEXT PRIMARY KEY,
      value TEXT NOT NULL
    ) STRICT`,`CREATE TABLE IF NOT EXISTS process_identity (
@@ -117,8 +119,8 @@ child.on("exit", (code, signal) => finish(code, signal));
          LIMIT ?`).all(...s,n).map(u=>({idempotencyKey:u.idempotency_key,operation:u.operation,resultJson:u.result_json,recordedAt:u.recorded_at}))}deleteOperationReceiptsByKeys(e){return e.length===0?0:this.inImmediateTransaction(()=>{let t=this.db.prepare("DELETE FROM operation_receipts WHERE idempotency_key = ?"),n=0;for(let o of e)n+=Number(t.run(o).changes);return n})}getOperationReceipt(e){let t=this.db.prepare(`SELECT idempotency_key, operation, result_json, recorded_at
          FROM operation_receipts WHERE idempotency_key = ?`).get(e);return t?{idempotencyKey:t.idempotency_key,operation:t.operation,resultJson:t.result_json,recordedAt:t.recorded_at}:null}saveRecoveryCheckpoint(e){return this.inImmediateTransaction(()=>{let t=this.db.prepare("SELECT COALESCE(MAX(seq), 0) AS max_seq FROM recovery_checkpoints WHERE scope = ?").get(e.scope),n=Number(t.max_seq)+1;return this.db.prepare(`INSERT INTO recovery_checkpoints (scope, seq, payload_json, created_at)
            VALUES (?, ?, ?, ?)`).run(e.scope,n,e.payloadJson,this.now().toISOString()),{seq:n}})}latestRecoveryCheckpoint(e){let t=this.db.prepare(`SELECT scope, seq, payload_json, created_at FROM recovery_checkpoints
-         WHERE scope = ? ORDER BY seq DESC LIMIT 1`).get(e);return t?{scope:t.scope,seq:t.seq,payloadJson:t.payload_json,createdAt:t.created_at}:null}localSchemaVersion(){return 1}checkpointTruncate(){this.db.exec("PRAGMA wal_checkpoint(TRUNCATE)")}integrityCheck(){return this.db.prepare("PRAGMA integrity_check").get()?.integrity_check==="ok"}pragma(e){let t=this.db.prepare(`PRAGMA ${e}`).get();return String(Object.values(t)[0])}close(){this.db.close()}};import{existsSync as Qn,renameSync as Zn}from"node:fs";function eo(r,e){let t=`${r}.quarantine-${e}`;for(let n of["","-wal","-shm"]){let o=`${r}${n}`;Qn(o)&&Zn(o,`${t}${n}`)}return t}function We(r){let e=r.quarantineStamp??(r.now??(()=>new Date))().toISOString().replace(/[:.]/g,"-"),t=null;try{let s=J.open(r);if(s.integrityCheck())return{store:s,recovered:!1,quarantinedTo:null};s.close()}catch(s){if(s.name==="SchemaDowngradeRefusedError"||s.name==="FilesystemPolicyError")throw s;t=s}let n=`${r.directory}/${r.filename??"local-run-store.sqlite"}`,o=eo(n,e);try{return{store:J.open(r),recovered:!0,quarantinedTo:o}}catch(s){throw new AggregateError([t,s].filter(Boolean),"local-run-store rebuild after quarantine failed")}}Ge();function ms(){if(process.env.KYNVER_LRS_TEST_CLASSIFY_BYPASS==="1")return{mountsSource:()=>"/dev/vda / ext4 rw 0 0",resolveRealPath:()=>"/tmp/kynver-lrs-test/db"}}function gs(){return pn.classifyOptions??ms()}var pn={};function hs(r){pn=r}var fn=300*1e3,L=null,ne=0;function ys(r){ne+=1;try{let e=gs(),t=We({directory:r,...e?{classifyOptions:e}:{}});return{store:t.store,status:{state:"open",harnessRoot:r,databasePath:t.store.databasePath,schemaVersion:t.store.localSchemaVersion(),recovered:t.recovered,quarantinedTo:t.quarantinedTo,reason:null,openAttempts:ne},failedAtMs:null,permanentRefusal:!1}}catch(e){return{store:null,status:{state:"unavailable",harnessRoot:r,databasePath:null,schemaVersion:null,recovered:!1,quarantinedTo:null,reason:`${e.name}: ${e.message}`,openAttempts:ne},failedAtMs:Date.now(),permanentRefusal:e.name==="FilesystemPolicyError"||e.name==="SchemaDowngradeRefusedError"}}}function Rs(r,e){return r.store||r.permanentRefusal?!1:r.failedAtMs===null?!0:e-r.failedAtMs>=fn}function m(r=Date.now()){let e=kr();return(!L||L.status.harnessRoot!==e||Rs(L,r))&&(vr(),L=ys(e)),L.store}function mn(){return L?L.status:{state:"unopened",harnessRoot:null,databasePath:null,schemaVersion:null,recovered:!1,quarantinedTo:null,reason:null,openAttempts:ne}}function xr(){return m(),mn()}function vr(){try{L?.store?.close()}catch{}L=null}function Ss(){vr(),ne=0}T();b();import{existsSync as bs,readFileSync as ks}from"node:fs";import{homedir as xs}from"node:os";import vs from"node:path";var Es=3e4,v=null;function Er(r){let e=r.replace(/[^A-Za-z0-9_-]/g,"_");return vs.join(xs(),".kynver",`local-run-store-flags-${e}.json`)}function _r(r){if(!r||typeof r!="object"||Array.isArray(r))return{};let e=r,t={},n=["dispatchReceipts","admission","planOutbox","keeper","meshLease","quota"];for(let o of n){let s=e[o];(s==="off"||s==="shadow"||s==="enforce")&&(t[o]=s)}return t}function _s(r){if(!r||typeof r!="object"||Array.isArray(r))return null;let e=r.response;if(!e||typeof e!="object"||Array.isArray(e))return null;let t=e.localRunStoreFlags;return t===void 0?null:_r(t)}function Cs(r,e){try{let t=Er(r),n={contractVersion:1,agentOsId:r,flags:_r(e),deliveredAt:new Date().toISOString()};ae(t,n),v={flags:n.flags,loadedAtMs:Date.now(),file:t}}catch{}}function Cr(r=Date.now()){if(process.env.KYNVER_LRS_REMOTE_FLAGS_DISABLED==="1")return{};if(v&&r-v.loadedAtMs<Es)return v.flags;try{let e=E().agentOsId?.trim();if(!e)return v={flags:{},loadedAtMs:r,file:null},v.flags;let t=Er(e);if(!bs(t))return v={flags:{},loadedAtMs:r,file:t},v.flags;let n=JSON.parse(ks(t,"utf8")),o=n?.contractVersion===1?_r(n.flags):{};return v={flags:o,loadedAtMs:r,file:t},o}catch{return v={flags:{},loadedAtMs:r,file:null},v.flags}}function As(){v=null}var gn=[{key:"dispatchReceipts",env:"KYNVER_LRS_DISPATCH_RECEIPTS",milestone:"D1"},{key:"admission",env:"KYNVER_LRS_ADMISSION",milestone:"D2"},{key:"planOutbox",env:"KYNVER_LRS_PLAN_OUTBOX",milestone:"D3"},{key:"keeper",env:"KYNVER_LRS_KEEPER",milestone:"D4"},{key:"meshLease",env:"KYNVER_LRS_MESH_LEASE",milestone:"D4"},{key:"quota",env:"KYNVER_LRS_QUOTA",milestone:"D4"}];function hn(r){let e=r?.trim().toLowerCase()??"";return e===""?{mode:"off",unknown:!1}:e==="off"||e==="shadow"||e==="enforce"?{mode:e,unknown:!1}:{mode:"off",unknown:!0}}function A(r=process.env){let e={},t={},n=[],o=Cr();for(let s of gn){let i=r[s.env];if(typeof i=="string"&&i.trim()!==""){let c=hn(i);e[s.key]=c.mode,t[s.key]="env",c.unknown&&n.push(`${s.env}='${i}' is not off|shadow|enforce \u2014 treating as off`);continue}let u=o[s.key];if(u){e[s.key]=u,t[s.key]="server";continue}e[s.key]="off",t[s.key]="default"}return{flags:e,sources:t,warnings:n}}function ws(r){return Object.values(r).some(e=>e!=="off")}var R={storeFailures:0,completionReplaysObserved:0,completionReplaysShortCircuited:0,agedReceiptsPruned:0};function w(r=process.env){return A(r).flags.dispatchReceipts}function Ar(r){return w(r)!=="off"}function wr(r,e){return`dispatch:${r}:${e.taskId}:${e.leaseToken}`}function oe(r,e,t){if(!Ar())return;let n=m();if(n)try{n.recordOperationReceipt({idempotencyKey:wr(r,e),operation:`dispatch-${r}`,resultJson:t===void 0?null:JSON.stringify(t)})}catch{R.storeFailures+=1}}function Os(r){oe("claim",r,{runId:r.runId,workerName:r.workerName,provider:r.provider})}function Or(r){oe("spawned",r)}function Oe(r,e){oe("released",r,{reasonClass:e})}function Is(r){oe("completion-sent",r)}function Ts(r,e){oe("completion-acked",r,{outcome:e})}function Ps(r){if(!Ar())return!1;let e=m();if(!e)return!1;try{let t=e.getOperationReceipt(wr("completion-acked",r));if(t){let n=null;try{n=t.resultJson?JSON.parse(t.resultJson).outcome??null:null}catch{n=null}if(n==="acknowledged")return R.completionReplaysObserved+=1,!0}}catch{R.storeFailures+=1}return!1}function Ns(r){let e=String(r??"").split(":")[0]?.trim()??"";return e.length>0?e.slice(0,64):"unknown"}function Ds(r){if(w()!=="enforce")return!1;let e=m();if(!e)return!1;try{let t=e.getOperationReceipt(wr("completion-acked",r));if(!t)return!1;let n=null;try{n=t.resultJson?JSON.parse(t.resultJson).outcome??null:null}catch{n=null}return n==="acknowledged"?(R.completionReplaysShortCircuited+=1,!0):!1}catch{return R.storeFailures+=1,!1}}var Ls=600*1e3;function Ks(r,e){if(w()!=="enforce")return;let t=m();if(t)try{t.recordOperationReceipt({idempotencyKey:`dispatch:start-failed:${r}:${e}`,operation:"dispatch-start-failed",resultJson:JSON.stringify({runId:e})})}catch{R.storeFailures+=1}}function Ms(r,e){if(w()!=="enforce")return[];let t=m();if(!t)return[];let n=e?.nowMs??Date.now(),o=e?.windowMs??Ls;try{return t.listOperationReceipts({operation:"dispatch-start-failed",recordedAfter:new Date(n-o).toISOString(),limit:200}).filter(s=>{try{return s.resultJson?JSON.parse(s.resultJson).runId===r:!1}catch{return!1}}).map(s=>{let i=s.idempotencyKey.slice(22);return i.slice(0,i.length-(r.length+1))}).filter(s=>s.length>0)}catch{return R.storeFailures+=1,[]}}function X(r){let e=r.split(":")[0]??"",t=Number(e);return Number.isInteger(t)&&t>=0?t:null}var Ws=900*1e3,yn=10080*60*1e3,Fs=1440*60*1e3,Bs=500,Us=300;function Ir(r){let e={scannedClaims:0,strandedClaimCandidates:0,prunedReceipts:0};if(!Ar())return e;let t=m();if(!t)return e;let n=r?.nowMs??Date.now(),o=r?.strandedAfterMs??Ws;try{let s=t.listOperationReceipts({operation:"dispatch-claim",recordedAfter:new Date(n-yn).toISOString(),limit:Bs}),i=0,l=[];for(let c of s){let p=c.idempotencyKey.slice(15),f=Date.parse(c.recordedAt);if(!Number.isFinite(f)||n-f<o)continue;let d=t.getOperationReceipt(`dispatch:spawned:${p}`),Y=t.getOperationReceipt(`dispatch:released:${p}`);if(d||Y){n-f>=Fs&&l.length+5<=Us&&l.push(c.idempotencyKey,`dispatch:spawned:${p}`,`dispatch:released:${p}`,`dispatch:completion-sent:${p}`,`dispatch:completion-acked:${p}`);continue}let x=p.split(":")[0]??"",V=X(p.slice(x.length+1));if((x?t.listOperationReceipts({keyPrefix:`dispatch:completion-acked:${x}:`,limit:10}):[]).some(h=>{if(V===null)return!0;let G=h.idempotencyKey.slice(`dispatch:completion-acked:${x}:`.length),M=X(G);return M===null||M>=V}))continue;let y=!1;if(r?.hasLiveWorker&&c.resultJson)try{let h=JSON.parse(c.resultJson);h.runId&&h.workerName&&(y=r.hasLiveWorker({runId:h.runId,workerName:h.workerName}))}catch{y=!1}y||(i+=1)}let u=l.length>0?t.deleteOperationReceiptsByKeys(l):0;if(w()==="enforce"){let c=t.listOperationReceipts({limit:100}).filter(p=>{let f=Date.parse(p.recordedAt);return Number.isFinite(f)&&n-f>=yn}).map(p=>p.idempotencyKey);if(c.length>0){let p=t.deleteOperationReceiptsByKeys(c);u+=p,R.agedReceiptsPruned+=p}}return{scannedClaims:s.length,strandedClaimCandidates:i,prunedReceipts:u}}catch{return R.storeFailures+=1,e}}function Tr(){return{"dispatchReceipts.storeFailures":R.storeFailures,"dispatchReceipts.completionReplaysObserved":R.completionReplaysObserved,"dispatchReceipts.completionReplaysShortCircuited":R.completionReplaysShortCircuited,"dispatchReceipts.agedReceiptsPruned":R.agedReceiptsPruned}}function $s(){R.storeFailures=0,R.completionReplaysObserved=0,R.completionReplaysShortCircuited=0,R.agedReceiptsPruned=0}import{readdirSync as zs,readFileSync as Xs}from"node:fs";var $=900*1e3,Nr="admission-shadow",Pr="worker-slot:",_={storeFailures:0,missingForLive:0,deadSlotsReleased:0},Ie=!1;function Hs(){Ie=!1}function H(r=process.env){return A(r).flags.admission}function Te(r,e){return`${Pr}${r}:${e}`}function js(r,e){if(H()==="off")return;let t=m();if(t)try{t.tryReserveAdmission(Te(r,e),Nr,$)}catch{_.storeFailures+=1}}function Dr(r,e){if(H()==="off")return;let t=m();if(t)try{t.releaseAdmission(Te(r,e),Nr)}catch{_.storeFailures+=1}}function Ys(r){let e={liveReservations:0,refreshed:0,deadReleased:0,missingForLive:0,orphaned:0,adoptionPass:!1};if(H()==="off")return e;let t=m();if(!t)return e;try{let n=new Set(r.liveWorkers.map(d=>Te(d.runId,d.workerName))),o=t.listAdmissionReservations({keyPrefix:Pr,limit:500}),s=new Set(o.map(d=>d.key)),i=[...n].filter(d=>!s.has(d)).length,l=o.filter(d=>!n.has(d.key)).length,u=!Ie;Ie=!0,!u&&i>0&&(_.missingForLive+=i);let c=0;for(let d of r.liveWorkers)t.tryReserveAdmission(Te(d.runId,d.workerName),Nr,$),c+=1;let p=0;for(let d of o)n.has(d.key)||t.releaseAdmission(d.key,d.owner)&&(p+=1,_.deadSlotsReleased+=1);return{liveReservations:t.listAdmissionReservations({keyPrefix:Pr,limit:500}).length,refreshed:c,deadReleased:p,missingForLive:i,orphaned:l,adoptionPass:u}}catch{return _.storeFailures+=1,e}}function Lr(){return{"admission.storeFailures":_.storeFailures,"admission.missingForLive":_.missingForLive,"admission.deadSlotsReleased":_.deadSlotsReleased}}function Vs(){_.storeFailures=0,_.missingForLive=0,_.deadSlotsReleased=0,Ie=!1}var De="worker-slot-n:",Pe=64;function Rn(r){return`${De}${r}`}function Ne(r,e){return`${r}:${e}`}var C={enforceStoreFailures:0,admissionsRefusedSlots:0,admissionsRefusedDiskBackstop:0};function Gs(r){if(H()!=="enforce")return{admitted:!0};let e=m();if(!e)return{admitted:!0};let t=Math.max(0,Math.min(Pe,Math.floor(r.maxSlots)));if(r.diskActiveWorkers>=t)return C.admissionsRefusedDiskBackstop+=1,{admitted:!1,reason:"disk_backstop"};try{let n=Ne(r.runId,r.workerName);for(let o=0;o<t;o+=1)if(e.tryReserveAdmission(Rn(o),n,$).acquired)return{admitted:!0,slot:o};return C.admissionsRefusedSlots+=1,{admitted:!1,reason:"slots_exhausted"}}catch{return C.enforceStoreFailures+=1,{admitted:!0}}}function Kr(r,e){if(H()==="off")return;let t=m();if(t)try{let n=Ne(r,e),o=t.listAdmissionReservations({keyPrefix:De,limit:Pe});for(let s of o)s.owner===n&&t.releaseAdmission(s.key,n)}catch{C.enforceStoreFailures+=1}}function Js(r){let e={refreshed:0,deadReleased:0,adopted:0};if(H()!=="enforce")return e;let t=m();if(!t)return e;try{let n=new Set(r.liveWorkers.map(c=>Ne(c.runId,c.workerName))),o=t.listAdmissionReservations({keyPrefix:De,limit:Pe}),s=0,i=0,l=new Set;for(let c of o)n.has(c.owner)?(t.tryReserveAdmission(c.key,c.owner,$),l.add(c.owner),s+=1):t.releaseAdmission(c.key,c.owner)&&(i+=1);let u=0;for(let c of r.liveWorkers){let p=Ne(c.runId,c.workerName);if(!l.has(p)){for(let f=0;f<Pe;f+=1)if(t.tryReserveAdmission(Rn(f),p,$).acquired){u+=1;break}}}return{refreshed:s,deadReleased:i,adopted:u}}catch{return C.enforceStoreFailures+=1,e}}function Mr(){return{"admission.enforceStoreFailures":C.enforceStoreFailures,"admission.refusedSlotsExhausted":C.admissionsRefusedSlots,"admission.refusedDiskBackstop":C.admissionsRefusedDiskBackstop}}function qs(){C.enforceStoreFailures=0,C.admissionsRefusedSlots=0,C.admissionsRefusedDiskBackstop=0}var Qs="dispatch:claim:",Zs=900*1e3,ei=10080*60*1e3,ri=200,O={recoveredStrandedClaims:0,recoveryDeferredOrphans:0,recoveryStoreFailures:0};function Sn(r){if(process.platform!=="linux"||!r.trim())return null;let e=[];try{e=zs("/proc")}catch{return null}for(let t of e)if(/^\d+$/.test(t)&&Number(t)!==process.pid)try{if(Xs(`/proc/${t}/cmdline`,"utf8").replace(/\0/g," ").includes(r))return Number(t)}catch{}return null}async function Wr(r){let e=w(),t={mode:e,scanned:0,outcomes:[]};if(e!=="enforce")return t;let n=m();if(!n)return t;let o=r.nowMs??Date.now(),s=r.strandedAfterMs??Zs,i=r.findOrphanPid??Sn,l=[],u;try{u=n.listOperationReceipts({operation:"dispatch-claim",recordedAfter:new Date(o-ei).toISOString(),limit:ri})}catch{return O.recoveryStoreFailures+=1,t}for(let c of u){let p=c.idempotencyKey.slice(Qs.length),f=p.split(":")[0]??"",d=p.slice(f.length+1);if(!(!f||!d))try{let Y=Date.parse(c.recordedAt);if(!Number.isFinite(Y)||o-Y<s||n.getOperationReceipt(`dispatch:spawned:${p}`)||n.getOperationReceipt(`dispatch:released:${p}`))continue;let x=X(d);if(n.listOperationReceipts({keyPrefix:`dispatch:completion-acked:${f}:`,limit:10}).some(M=>{if(x===null)return!0;let Z=X(M.idempotencyKey.slice(`dispatch:completion-acked:${f}:`.length));return Z===null||Z>=x}))continue;let Q={};try{Q=c.resultJson?JSON.parse(c.resultJson):{}}catch{Q={}}let y=Q.runId??null,h=Q.workerName??null;if(y&&h&&r.hasLiveWorker({runId:y,workerName:h})){Or({taskId:f,leaseToken:d}),l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"finalized_late"});continue}if(y&&h){let M=r.worktreePathFor({runId:y,workerName:h}),Z=M?i(M):null;if(Z!==null){O.recoveryDeferredOrphans+=1,l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"deferred_orphan",detail:`live pid ${Z} references ${M}`});continue}}if(!y){l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"skipped",detail:"claim intent missing runId \u2014 cannot resolve lease owner"});continue}let G=await r.releaseClaim({taskId:f,leaseToken:d,runId:y});G.released?(Oe({taskId:f,leaseToken:d},"restart_recovery"),h&&(Dr(y,h),Kr(y,h)),O.recoveredStrandedClaims+=1,l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"released"})):G.transportError?l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"deferred_transport",detail:G.detail}):(Oe({taskId:f,leaseToken:d},"restart_recovery_refused"),l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"release_refused",detail:G.detail}))}catch{O.recoveryStoreFailures+=1}}return{mode:e,scanned:u.length,outcomes:l}}function Fr(){return{"dispatchReceipts.recoveredStrandedClaims":O.recoveredStrandedClaims,"dispatchReceipts.recoveryDeferredOrphans":O.recoveryDeferredOrphans,"dispatchReceipts.recoveryStoreFailures":O.recoveryStoreFailures}}function ti(){O.recoveredStrandedClaims=0,O.recoveryDeferredOrphans=0,O.recoveryStoreFailures=0}re();import pi from"node:path";var ni="kynver-harness:",oi="@runner:";function bn(r,e){let t=r.trim(),n=e.trim();return`${ni}${t}${oi}${n}`}T();import vn from"node:os";var si="embedded-1",ii=[{slug:"ghost",displayName:"Ghost",description:"Orchestration persona.",dispatchLane:null,defaultRoleLane:"system"},{slug:"astra",displayName:"Astra",description:"Planning persona.",dispatchLane:"implementation",defaultRoleLane:"plan_author"},{slug:"rhea",displayName:"Rhea",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"mnemo",displayName:"Mnemo",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"sentinel",displayName:"Sentinel",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"deep_reviewer"},{slug:"pixel",displayName:"Pixel",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"schema",displayName:"Schema",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"atlas",displayName:"Atlas",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"runtime_verifier"},{slug:"bridge",displayName:"Bridge",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"catalyst",displayName:"Catalyst",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"lorentz",displayName:"Lorentz",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"report_reviewer"},{slug:"dalton",displayName:"Dalton",description:"Landing persona.",dispatchLane:"landing",defaultRoleLane:"implementer"}],ai={"worker.prompt.core_rules":["Structured final result (recommended): record completion as JSON with summary, files, PR URLs, verification, risks, and blockers.","Completion handoff (required): before you stop, summarize the outcome in your last message and append a heartbeat line with phase `complete` and a structured finalResult object. Commit your work cleanly and open a GitHub PR (draft OK) for substantial changes \u2014 never leave uncommitted changes behind without reporting them.","Review-only workers must not open new implementation PRs \u2014 review the existing PR and record a verdict in the final result. Prefer `gh pr view` / `gh pr diff`; if a local checkout is needed, use a disposable ref or detached worktree, not a checked-out `pr-*` branch.","Keep verification targeted to touched paths; avoid full-monorepo verification unless explicitly requested.","Do not run `npm publish`.","If verification fails, append a heartbeat line immediately with the failing command, reason, and next action."].join(`
+         WHERE scope = ? ORDER BY seq DESC LIMIT 1`).get(e);return t?{scope:t.scope,seq:t.seq,payloadJson:t.payload_json,createdAt:t.created_at}:null}localSchemaVersion(){return 1}checkpointTruncate(){this.db.exec("PRAGMA wal_checkpoint(TRUNCATE)")}integrityCheck(){return this.db.prepare("PRAGMA integrity_check").get()?.integrity_check==="ok"}pragma(e){let t=this.db.prepare(`PRAGMA ${e}`).get();return String(Object.values(t)[0])}close(){this.db.close()}};import{existsSync as Qn,renameSync as Zn}from"node:fs";function eo(r,e){let t=`${r}.quarantine-${e}`;for(let n of["","-wal","-shm"]){let o=`${r}${n}`;Qn(o)&&Zn(o,`${t}${n}`)}return t}function Fe(r){let e=r.quarantineStamp??(r.now??(()=>new Date))().toISOString().replace(/[:.]/g,"-"),t=null;try{let s=J.open(r);if(s.integrityCheck())return{store:s,recovered:!1,quarantinedTo:null};s.close()}catch(s){if(s.name==="SchemaDowngradeRefusedError"||s.name==="FilesystemPolicyError")throw s;t=s}let n=`${r.directory}/${r.filename??"local-run-store.sqlite"}`,o=eo(n,e);try{return{store:J.open(r),recovered:!0,quarantinedTo:o}}catch(s){throw new AggregateError([t,s].filter(Boolean),"local-run-store rebuild after quarantine failed")}}Ge();function ms(){if(process.env.KYNVER_LRS_TEST_CLASSIFY_BYPASS==="1")return{mountsSource:()=>"/dev/vda / ext4 rw 0 0",resolveRealPath:()=>"/tmp/kynver-lrs-test/db"}}function gs(){return pn.classifyOptions??ms()}var pn={};function hs(r){pn=r}var fn=300*1e3,L=null,ne=0;function ys(r){ne+=1;try{let e=gs(),t=Fe({directory:r,...e?{classifyOptions:e}:{}});return{store:t.store,status:{state:"open",harnessRoot:r,databasePath:t.store.databasePath,schemaVersion:t.store.localSchemaVersion(),recovered:t.recovered,quarantinedTo:t.quarantinedTo,reason:null,openAttempts:ne},failedAtMs:null,permanentRefusal:!1}}catch(e){return{store:null,status:{state:"unavailable",harnessRoot:r,databasePath:null,schemaVersion:null,recovered:!1,quarantinedTo:null,reason:`${e.name}: ${e.message}`,openAttempts:ne},failedAtMs:Date.now(),permanentRefusal:e.name==="FilesystemPolicyError"||e.name==="SchemaDowngradeRefusedError"}}}function Rs(r,e){return r.store||r.permanentRefusal?!1:r.failedAtMs===null?!0:e-r.failedAtMs>=fn}function m(r=Date.now()){let e=kr();return(!L||L.status.harnessRoot!==e||Rs(L,r))&&(vr(),L=ys(e)),L.store}function mn(){return L?L.status:{state:"unopened",harnessRoot:null,databasePath:null,schemaVersion:null,recovered:!1,quarantinedTo:null,reason:null,openAttempts:ne}}function xr(){return m(),mn()}function vr(){try{L?.store?.close()}catch{}L=null}function Ss(){vr(),ne=0}T();b();import{existsSync as bs,readFileSync as ks}from"node:fs";import{homedir as xs}from"node:os";import vs from"node:path";var Es=3e4,v=null;function Er(r){let e=r.replace(/[^A-Za-z0-9_-]/g,"_");return vs.join(xs(),".kynver",`local-run-store-flags-${e}.json`)}function _r(r){if(!r||typeof r!="object"||Array.isArray(r))return{};let e=r,t={},n=["dispatchReceipts","admission","planOutbox","keeper","meshLease","quota"];for(let o of n){let s=e[o];(s==="off"||s==="shadow"||s==="enforce")&&(t[o]=s)}return t}function _s(r){if(!r||typeof r!="object"||Array.isArray(r))return null;let e=r.response;if(!e||typeof e!="object"||Array.isArray(e))return null;let t=e.localRunStoreFlags;return t===void 0?null:_r(t)}function Cs(r,e){try{let t=Er(r),n={contractVersion:1,agentOsId:r,flags:_r(e),deliveredAt:new Date().toISOString()};ae(t,n),v={flags:n.flags,loadedAtMs:Date.now(),file:t}}catch{}}function Cr(r=Date.now()){if(process.env.KYNVER_LRS_REMOTE_FLAGS_DISABLED==="1")return{};if(v&&r-v.loadedAtMs<Es)return v.flags;try{let e=E().agentOsId?.trim();if(!e)return v={flags:{},loadedAtMs:r,file:null},v.flags;let t=Er(e);if(!bs(t))return v={flags:{},loadedAtMs:r,file:t},v.flags;let n=JSON.parse(ks(t,"utf8")),o=n?.contractVersion===1?_r(n.flags):{};return v={flags:o,loadedAtMs:r,file:t},o}catch{return v={flags:{},loadedAtMs:r,file:null},v.flags}}function As(){v=null}var gn=[{key:"dispatchReceipts",env:"KYNVER_LRS_DISPATCH_RECEIPTS",milestone:"D1"},{key:"admission",env:"KYNVER_LRS_ADMISSION",milestone:"D2"},{key:"planOutbox",env:"KYNVER_LRS_PLAN_OUTBOX",milestone:"D3"},{key:"keeper",env:"KYNVER_LRS_KEEPER",milestone:"D4"},{key:"meshLease",env:"KYNVER_LRS_MESH_LEASE",milestone:"D4"},{key:"quota",env:"KYNVER_LRS_QUOTA",milestone:"D4"}];function hn(r){let e=r?.trim().toLowerCase()??"";return e===""?{mode:"off",unknown:!1}:e==="off"||e==="shadow"||e==="enforce"?{mode:e,unknown:!1}:{mode:"off",unknown:!0}}function A(r=process.env){let e={},t={},n=[],o=Cr();for(let s of gn){let i=r[s.env];if(typeof i=="string"&&i.trim()!==""){let c=hn(i);e[s.key]=c.mode,t[s.key]="env",c.unknown&&n.push(`${s.env}='${i}' is not off|shadow|enforce \u2014 treating as off`);continue}let u=o[s.key];if(u){e[s.key]=u,t[s.key]="server";continue}e[s.key]="off",t[s.key]="default"}return{flags:e,sources:t,warnings:n}}function ws(r){return Object.values(r).some(e=>e!=="off")}var R={storeFailures:0,completionReplaysObserved:0,completionReplaysShortCircuited:0,agedReceiptsPruned:0};function w(r=process.env){return A(r).flags.dispatchReceipts}function Ar(r){return w(r)!=="off"}function wr(r,e){return`dispatch:${r}:${e.taskId}:${e.leaseToken}`}function oe(r,e,t){if(!Ar())return;let n=m();if(n)try{n.recordOperationReceipt({idempotencyKey:wr(r,e),operation:`dispatch-${r}`,resultJson:t===void 0?null:JSON.stringify(t)})}catch{R.storeFailures+=1}}function Os(r){oe("claim",r,{runId:r.runId,workerName:r.workerName,provider:r.provider})}function Or(r){oe("spawned",r)}function Oe(r,e){oe("released",r,{reasonClass:e})}function Is(r){oe("completion-sent",r)}function Ts(r,e){oe("completion-acked",r,{outcome:e})}function Ps(r){if(!Ar())return!1;let e=m();if(!e)return!1;try{let t=e.getOperationReceipt(wr("completion-acked",r));if(t){let n=null;try{n=t.resultJson?JSON.parse(t.resultJson).outcome??null:null}catch{n=null}if(n==="acknowledged")return R.completionReplaysObserved+=1,!0}}catch{R.storeFailures+=1}return!1}function Ns(r){let e=String(r??"").split(":")[0]?.trim()??"";return e.length>0?e.slice(0,64):"unknown"}function Ds(r){if(w()!=="enforce")return!1;let e=m();if(!e)return!1;try{let t=e.getOperationReceipt(wr("completion-acked",r));if(!t)return!1;let n=null;try{n=t.resultJson?JSON.parse(t.resultJson).outcome??null:null}catch{n=null}return n==="acknowledged"?(R.completionReplaysShortCircuited+=1,!0):!1}catch{return R.storeFailures+=1,!1}}var Ls=600*1e3;function Ks(r,e){if(w()!=="enforce")return;let t=m();if(t)try{t.recordOperationReceipt({idempotencyKey:`dispatch:start-failed:${r}:${e}`,operation:"dispatch-start-failed",resultJson:JSON.stringify({runId:e})})}catch{R.storeFailures+=1}}function Ms(r,e){if(w()!=="enforce")return[];let t=m();if(!t)return[];let n=e?.nowMs??Date.now(),o=e?.windowMs??Ls;try{return t.listOperationReceipts({operation:"dispatch-start-failed",recordedAfter:new Date(n-o).toISOString(),limit:200}).filter(s=>{try{return s.resultJson?JSON.parse(s.resultJson).runId===r:!1}catch{return!1}}).map(s=>{let i=s.idempotencyKey.slice(22);return i.slice(0,i.length-(r.length+1))}).filter(s=>s.length>0)}catch{return R.storeFailures+=1,[]}}function X(r){let e=r.split(":")[0]??"",t=Number(e);return Number.isInteger(t)&&t>=0?t:null}var Fs=900*1e3,yn=10080*60*1e3,Ws=1440*60*1e3,Bs=500,Us=300;function Ir(r){let e={scannedClaims:0,strandedClaimCandidates:0,prunedReceipts:0};if(!Ar())return e;let t=m();if(!t)return e;let n=r?.nowMs??Date.now(),o=r?.strandedAfterMs??Fs;try{let s=t.listOperationReceipts({operation:"dispatch-claim",recordedAfter:new Date(n-yn).toISOString(),limit:Bs}),i=0,l=[];for(let c of s){let p=c.idempotencyKey.slice(15),f=Date.parse(c.recordedAt);if(!Number.isFinite(f)||n-f<o)continue;let d=t.getOperationReceipt(`dispatch:spawned:${p}`),Y=t.getOperationReceipt(`dispatch:released:${p}`);if(d||Y){n-f>=Ws&&l.length+5<=Us&&l.push(c.idempotencyKey,`dispatch:spawned:${p}`,`dispatch:released:${p}`,`dispatch:completion-sent:${p}`,`dispatch:completion-acked:${p}`);continue}let x=p.split(":")[0]??"",V=X(p.slice(x.length+1));if((x?t.listOperationReceipts({keyPrefix:`dispatch:completion-acked:${x}:`,limit:10}):[]).some(h=>{if(V===null)return!0;let G=h.idempotencyKey.slice(`dispatch:completion-acked:${x}:`.length),M=X(G);return M===null||M>=V}))continue;let y=!1;if(r?.hasLiveWorker&&c.resultJson)try{let h=JSON.parse(c.resultJson);h.runId&&h.workerName&&(y=r.hasLiveWorker({runId:h.runId,workerName:h.workerName}))}catch{y=!1}y||(i+=1)}let u=l.length>0?t.deleteOperationReceiptsByKeys(l):0;if(w()==="enforce"){let c=t.listOperationReceipts({limit:100}).filter(p=>{let f=Date.parse(p.recordedAt);return Number.isFinite(f)&&n-f>=yn}).map(p=>p.idempotencyKey);if(c.length>0){let p=t.deleteOperationReceiptsByKeys(c);u+=p,R.agedReceiptsPruned+=p}}return{scannedClaims:s.length,strandedClaimCandidates:i,prunedReceipts:u}}catch{return R.storeFailures+=1,e}}function Tr(){return{"dispatchReceipts.storeFailures":R.storeFailures,"dispatchReceipts.completionReplaysObserved":R.completionReplaysObserved,"dispatchReceipts.completionReplaysShortCircuited":R.completionReplaysShortCircuited,"dispatchReceipts.agedReceiptsPruned":R.agedReceiptsPruned}}function $s(){R.storeFailures=0,R.completionReplaysObserved=0,R.completionReplaysShortCircuited=0,R.agedReceiptsPruned=0}import{readdirSync as zs,readFileSync as Xs}from"node:fs";var $=900*1e3,Nr="admission-shadow",Pr="worker-slot:",_={storeFailures:0,missingForLive:0,deadSlotsReleased:0},Ie=!1;function Hs(){Ie=!1}function H(r=process.env){return A(r).flags.admission}function Te(r,e){return`${Pr}${r}:${e}`}function js(r,e){if(H()==="off")return;let t=m();if(t)try{t.tryReserveAdmission(Te(r,e),Nr,$)}catch{_.storeFailures+=1}}function Dr(r,e){if(H()==="off")return;let t=m();if(t)try{t.releaseAdmission(Te(r,e),Nr)}catch{_.storeFailures+=1}}function Ys(r){let e={liveReservations:0,refreshed:0,deadReleased:0,missingForLive:0,orphaned:0,adoptionPass:!1};if(H()==="off")return e;let t=m();if(!t)return e;try{let n=new Set(r.liveWorkers.map(d=>Te(d.runId,d.workerName))),o=t.listAdmissionReservations({keyPrefix:Pr,limit:500}),s=new Set(o.map(d=>d.key)),i=[...n].filter(d=>!s.has(d)).length,l=o.filter(d=>!n.has(d.key)).length,u=!Ie;Ie=!0,!u&&i>0&&(_.missingForLive+=i);let c=0;for(let d of r.liveWorkers)t.tryReserveAdmission(Te(d.runId,d.workerName),Nr,$),c+=1;let p=0;for(let d of o)n.has(d.key)||t.releaseAdmission(d.key,d.owner)&&(p+=1,_.deadSlotsReleased+=1);return{liveReservations:t.listAdmissionReservations({keyPrefix:Pr,limit:500}).length,refreshed:c,deadReleased:p,missingForLive:i,orphaned:l,adoptionPass:u}}catch{return _.storeFailures+=1,e}}function Lr(){return{"admission.storeFailures":_.storeFailures,"admission.missingForLive":_.missingForLive,"admission.deadSlotsReleased":_.deadSlotsReleased}}function Vs(){_.storeFailures=0,_.missingForLive=0,_.deadSlotsReleased=0,Ie=!1}var De="worker-slot-n:",Pe=64;function Rn(r){return`${De}${r}`}function Ne(r,e){return`${r}:${e}`}var C={enforceStoreFailures:0,admissionsRefusedSlots:0,admissionsRefusedDiskBackstop:0};function Gs(r){if(H()!=="enforce")return{admitted:!0};let e=m();if(!e)return{admitted:!0};let t=Math.max(0,Math.min(Pe,Math.floor(r.maxSlots)));if(r.diskActiveWorkers>=t)return C.admissionsRefusedDiskBackstop+=1,{admitted:!1,reason:"disk_backstop"};try{let n=Ne(r.runId,r.workerName);for(let o=0;o<t;o+=1)if(e.tryReserveAdmission(Rn(o),n,$).acquired)return{admitted:!0,slot:o};return C.admissionsRefusedSlots+=1,{admitted:!1,reason:"slots_exhausted"}}catch{return C.enforceStoreFailures+=1,{admitted:!0}}}function Kr(r,e){if(H()==="off")return;let t=m();if(t)try{let n=Ne(r,e),o=t.listAdmissionReservations({keyPrefix:De,limit:Pe});for(let s of o)s.owner===n&&t.releaseAdmission(s.key,n)}catch{C.enforceStoreFailures+=1}}function Js(r){let e={refreshed:0,deadReleased:0,adopted:0};if(H()!=="enforce")return e;let t=m();if(!t)return e;try{let n=new Set(r.liveWorkers.map(c=>Ne(c.runId,c.workerName))),o=t.listAdmissionReservations({keyPrefix:De,limit:Pe}),s=0,i=0,l=new Set;for(let c of o)n.has(c.owner)?(t.tryReserveAdmission(c.key,c.owner,$),l.add(c.owner),s+=1):t.releaseAdmission(c.key,c.owner)&&(i+=1);let u=0;for(let c of r.liveWorkers){let p=Ne(c.runId,c.workerName);if(!l.has(p)){for(let f=0;f<Pe;f+=1)if(t.tryReserveAdmission(Rn(f),p,$).acquired){u+=1;break}}}return{refreshed:s,deadReleased:i,adopted:u}}catch{return C.enforceStoreFailures+=1,e}}function Mr(){return{"admission.enforceStoreFailures":C.enforceStoreFailures,"admission.refusedSlotsExhausted":C.admissionsRefusedSlots,"admission.refusedDiskBackstop":C.admissionsRefusedDiskBackstop}}function qs(){C.enforceStoreFailures=0,C.admissionsRefusedSlots=0,C.admissionsRefusedDiskBackstop=0}var Qs="dispatch:claim:",Zs=900*1e3,ei=10080*60*1e3,ri=200,O={recoveredStrandedClaims:0,recoveryDeferredOrphans:0,recoveryStoreFailures:0};function Sn(r){if(process.platform!=="linux"||!r.trim())return null;let e=[];try{e=zs("/proc")}catch{return null}for(let t of e)if(/^\d+$/.test(t)&&Number(t)!==process.pid)try{if(Xs(`/proc/${t}/cmdline`,"utf8").replace(/\0/g," ").includes(r))return Number(t)}catch{}return null}async function Fr(r){let e=w(),t={mode:e,scanned:0,outcomes:[]};if(e!=="enforce")return t;let n=m();if(!n)return t;let o=r.nowMs??Date.now(),s=r.strandedAfterMs??Zs,i=r.findOrphanPid??Sn,l=[],u;try{u=n.listOperationReceipts({operation:"dispatch-claim",recordedAfter:new Date(o-ei).toISOString(),limit:ri})}catch{return O.recoveryStoreFailures+=1,t}for(let c of u){let p=c.idempotencyKey.slice(Qs.length),f=p.split(":")[0]??"",d=p.slice(f.length+1);if(!(!f||!d))try{let Y=Date.parse(c.recordedAt);if(!Number.isFinite(Y)||o-Y<s||n.getOperationReceipt(`dispatch:spawned:${p}`)||n.getOperationReceipt(`dispatch:released:${p}`))continue;let x=X(d);if(n.listOperationReceipts({keyPrefix:`dispatch:completion-acked:${f}:`,limit:10}).some(M=>{if(x===null)return!0;let Z=X(M.idempotencyKey.slice(`dispatch:completion-acked:${f}:`.length));return Z===null||Z>=x}))continue;let Q={};try{Q=c.resultJson?JSON.parse(c.resultJson):{}}catch{Q={}}let y=Q.runId??null,h=Q.workerName??null;if(y&&h&&r.hasLiveWorker({runId:y,workerName:h})){Or({taskId:f,leaseToken:d}),l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"finalized_late"});continue}if(y&&h){let M=r.worktreePathFor({runId:y,workerName:h}),Z=M?i(M):null;if(Z!==null){O.recoveryDeferredOrphans+=1,l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"deferred_orphan",detail:`live pid ${Z} references ${M}`});continue}}if(!y){l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"skipped",detail:"claim intent missing runId \u2014 cannot resolve lease owner"});continue}let G=await r.releaseClaim({taskId:f,leaseToken:d,runId:y});G.released?(Oe({taskId:f,leaseToken:d},"restart_recovery"),h&&(Dr(y,h),Kr(y,h)),O.recoveredStrandedClaims+=1,l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"released"})):G.transportError?l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"deferred_transport",detail:G.detail}):(Oe({taskId:f,leaseToken:d},"restart_recovery_refused"),l.push({taskId:f,leaseToken:d,runId:y,workerName:h,action:"release_refused",detail:G.detail}))}catch{O.recoveryStoreFailures+=1}}return{mode:e,scanned:u.length,outcomes:l}}function Wr(){return{"dispatchReceipts.recoveredStrandedClaims":O.recoveredStrandedClaims,"dispatchReceipts.recoveryDeferredOrphans":O.recoveryDeferredOrphans,"dispatchReceipts.recoveryStoreFailures":O.recoveryStoreFailures}}function ti(){O.recoveredStrandedClaims=0,O.recoveryDeferredOrphans=0,O.recoveryStoreFailures=0}re();import pi from"node:path";var ni="kynver-harness:",oi="@runner:";function bn(r,e){let t=r.trim(),n=e.trim();return`${ni}${t}${oi}${n}`}T();import vn from"node:os";var si="embedded-1",ii=[{slug:"ghost",displayName:"Ghost",description:"Orchestration persona.",dispatchLane:null,defaultRoleLane:"system"},{slug:"astra",displayName:"Astra",description:"Planning persona.",dispatchLane:"implementation",defaultRoleLane:"plan_author"},{slug:"rhea",displayName:"Rhea",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"mnemo",displayName:"Mnemo",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"sentinel",displayName:"Sentinel",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"deep_reviewer"},{slug:"pixel",displayName:"Pixel",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"schema",displayName:"Schema",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"atlas",displayName:"Atlas",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"runtime_verifier"},{slug:"bridge",displayName:"Bridge",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"catalyst",displayName:"Catalyst",description:"Implementation persona.",dispatchLane:"implementation",defaultRoleLane:"implementer"},{slug:"lorentz",displayName:"Lorentz",description:"Review persona.",dispatchLane:"review",defaultRoleLane:"report_reviewer"},{slug:"dalton",displayName:"Dalton",description:"Landing persona.",dispatchLane:"landing",defaultRoleLane:"implementer"}],ai={"worker.prompt.core_rules":["Structured final result (recommended): record completion as JSON with summary, files, PR URLs, verification, risks, and blockers.","Completion handoff (required): before you stop, summarize the outcome in your last message and append a heartbeat line with phase `complete` and a structured finalResult object. Commit your work cleanly and open a GitHub PR (draft OK) for substantial changes \u2014 never leave uncommitted changes behind without reporting them.","Review-only workers must not open new implementation PRs \u2014 review the existing PR and record a verdict in the final result. Prefer `gh pr view` / `gh pr diff`; if a local checkout is needed, use a disposable ref or detached worktree, not a checked-out `pr-*` branch.","Keep verification targeted to touched paths; avoid full-monorepo verification unless explicitly requested.","Do not run `npm publish`.","If verification fails, append a heartbeat line immediately with the failing command, reason, and next action."].join(`
 `),"worker.prompt.progress.compact":"Plan progress: when planId is set, report progress with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`. Do not mark rows done from the worker CLI.","worker.prompt.progress.full":["Structured plan progress (required when planId is set):","- Report checkpoints with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`.","- When a slice is finished, emit `partial` with evidence (`--evidence pr:<url>`, `--evidence path:<file>`, or `--evidence command:<cmd>`).","- Do not propose or confirm row `done` from the worker CLI."].join(`
 `),"worker.prompt.merge_gate.compact":"Verification cost control: prefer local verification before requesting CI runs; do not push empty commits to re-trigger CI; record verification evidence on the PR.","worker.prompt.merge_gate.full":["Verification cost control:","- Prefer local verification of touched paths before requesting any CI run.","- Do not push empty commits to re-trigger CI.","- Record verification evidence on the PR before requesting review."].join(`
 `),"worker.prompt.plan_artifacts.compact":"Plan artifacts: when authoring or revising plan documents, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in a local worktree.","worker.prompt.plan_artifacts.full":["Plan artifacts (when authoring or revising plan documents):","- Create a feature branch and open a GitHub PR (draft OK) before substantial drafting; commit and push the plan file.","- Iterate on that PR branch and link the PR URL on the related task and progress evidence."].join(`
-`)},li={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},kn={version:si,generatedAt:"1970-01-01T00:00:00.000Z",personas:ii,instructions:ai,policyThresholds:li};var ci=kn;function xn(){return ci.version}W();function K(r){return r?.trim()?r.trim():null}function En(r={}){let e=r.env??process.env,t=E();return{runnerId:K(t.runnerId)??K(e.KYNVER_RUNTIME_ID)??K(e.OPENCLAW_RUNTIME_ID)??K(e.HOSTNAME)??vn.hostname(),hostname:K(e.HOSTNAME)??vn.hostname(),profile:K(e.KYNVER_RUNNER_PROFILE)??K(e.OPENCLAW_RUNNER_PROFILE),harnessRepo:K(e.KYNVER_HARNESS_REPO)??K(e.KYNVER_DEFAULT_REPO),runId:r.runId??null,instructionBundleVersion:xn()}}function _n(r){let e=String(r).trim();return e.startsWith("krc1.")?{"Content-Type":"application/json","X-Kynver-Runner-Token":e}:{"Content-Type":"application/json","X-Kynver-Cron-Secret":e,"X-OpenClaw-Cron-Secret":e,"X-Kynver-Runtime-Secret":e}}de();T();function wn(r){if(r!==void 0&&Number.isFinite(r)&&r>0)return Math.floor(r);let e=Number(process.env.KYNVER_CALLBACK_TIMEOUT_MS);return Number.isFinite(e)&&e>0?Math.floor(e):3e4}function Cn(r){return new Error(`callback timeout after ${r}ms`)}async function ui(r,e){let t=wn(e),n=new AbortController,o,s=!1;try{return await Promise.race([r(n.signal),new Promise((i,l)=>{o=setTimeout(()=>{s=!0,n.abort(),l(Cn(t))},t)})])}catch(i){throw s?Cn(t):i}finally{o&&clearTimeout(o)}}function di(r,e){let t=wn(e);return{ok:!1,status:0,response:{error:r instanceof Error?r.message:String(r),timeoutMs:t}}}async function An(r,e,t,n){try{return await ui(async o=>{let s=await ue(r,{method:"POST",headers:_n(e),body:JSON.stringify(t),signal:o}),i=null;try{i=await s.json()}catch{i=null}return{ok:s.ok,status:s.status,response:i}},n?.timeoutMs)}catch(o){return di(o,n?.timeoutMs)}}async function On(r,e,t,n){let o=await An(r,e,t,{timeoutMs:n.timeoutMs});if(o.ok||o.status!==401)return o;let s=await un(e,n.agentOsId,{baseUrl:n.baseUrl});return s.ok?{...await An(r,s.token,t,{timeoutMs:n.timeoutMs}),refreshedAuth:!0}:{...o,authRefreshFailure:s.reason}}async function In(r){let e=`${r.baseUrl}/api/agent-os/by-id/${encodeURIComponent(r.agentOsId)}/tasks/${encodeURIComponent(r.taskId)}/release`,t;try{t=await On(e,r.secret,{agentOsId:r.agentOsId,leaseOwner:r.leaseOwner,...r.leaseToken?.trim()?{leaseToken:r.leaseToken.trim()}:{},...r.failureDetail?{failureDetail:r.failureDetail}:{}},{agentOsId:r.agentOsId,baseUrl:r.baseUrl})}catch(s){return{released:!1,httpOk:!1,transportError:!0,releaseResponse:{ok:!1,error:s.message}}}let n=t.response;return{released:t.ok===!0||n?.ok===!0,httpOk:t.ok===!0,transportError:!1,releaseResponse:t.response??t}}var Br=!1;function fi(){Br=!1}async function mi(r){if(Br||w()!=="enforce")return null;Br=!0;try{let e=En().runnerId,t=await Wr({hasLiveWorker:r.hasLiveWorker,worktreePathFor:({runId:n,workerName:o})=>pi.join(at().worktreesDir,n,o),releaseClaim:async({taskId:n,leaseToken:o,runId:s})=>{let i=await In({baseUrl:r.baseUrl,secret:r.secret,agentOsId:r.agentOsId,taskId:n,leaseOwner:bn(s,e),leaseToken:o});return{released:i.released,transportError:i.transportError,detail:i.httpOk?void 0:JSON.stringify(i.releaseResponse).slice(0,200)}}});return t.outcomes.length>0&&console.error(`[daemon] D1b claim recovery: ${t.outcomes.map(n=>`${n.taskId}:${n.action}`).join(", ")}`),t}catch{return null}}var hf=600*1e3,se={storeFailures:0,corruptItemsSeen:0,corruptItemsQuarantined:0,duplicateDrainsObserved:0,halfArchivesCompleted:0};function Tn(){return{"planOutbox.storeFailures":se.storeFailures,"planOutbox.corruptItemsSeen":se.corruptItemsSeen,"planOutbox.corruptItemsQuarantined":se.corruptItemsQuarantined,"planOutbox.duplicateDrainsObserved":se.duplicateDrainsObserved,"planOutbox.halfArchivesCompleted":se.halfArchivesCompleted}}var g={keeperStoreFailures:0,meshStoreFailures:0,quotaStoreFailures:0,meshLeaseDivergences:0,meshEnforceStaleInversions:0,quotaVerdictDivergences:0};function j(r){return A(process.env).flags[r]}var Pn="daemon-keeper",gi=1800*1e3;function hi(r){if(j("keeper")==="off")return;let e=m();if(e)try{e.saveRecoveryCheckpoint({scope:Pn,payloadJson:JSON.stringify(r)})}catch{g.keeperStoreFailures+=1}}function yi(){if(j("keeper")!=="enforce")return null;let r=m();if(!r)return null;try{let e=r.latestRecoveryCheckpoint(Pn);if(!e)return null;let t=JSON.parse(e.payloadJson),n=Date.now()-Date.parse(e.createdAt);if(!Number.isFinite(n)||n>gi)return null;let o=Number(t.consecutiveFailures);return Number.isFinite(o)&&o>=0?Math.floor(o):null}catch{return g.keeperStoreFailures+=1,null}}function Ur(r){return`mesh-cron-lease:${r}`}function Ri(r,e){if(j("meshLease")==="off")return;let t=m();if(t)try{let n=t.latestRecoveryCheckpoint(Ur(r));if(n){let o=JSON.parse(n.payloadJson);if((o.leaseToken??null)===(e.leaseToken??null)&&(o.holderBoxId??null)===(e.holderBoxId??null)&&o.authorized===e.authorized)return}t.saveRecoveryCheckpoint({scope:Ur(r),payloadJson:JSON.stringify(e)})}catch{g.meshStoreFailures+=1}}function Si(r,e){let t=j("meshLease");if(t==="off")return null;let n=m();if(!n)return null;try{let o=n.latestRecoveryCheckpoint(Ur(r)),s=o?JSON.parse(o.payloadJson):null,i=s!==null&&((s.leaseToken??null)!==(e?.leaseToken??null)||(s.holderBoxId??null)!==(e?.holderBoxId??null)||(s.authorized??null)!==(e?.authorized??null));return i&&(g.meshLeaseDivergences+=1),t!=="enforce"?null:i&&e?.updatedAt&&s?.updatedAt&&Date.parse(e.updatedAt)>Date.parse(s.updatedAt)?(g.meshEnforceStaleInversions+=1,null):s}catch{return g.meshStoreFailures+=1,null}}function Le(r){return`quota-cooldown:${r}`}var Nn="quota-preflight";function bi(r,e){if(j("quota")==="off")return;let t=m();if(t)try{t.tryReserveAdmission(Le(r),Nn,e)}catch{g.quotaStoreFailures+=1}}function ki(r){if(j("quota")==="off")return;let e=m();if(e)try{e.releaseAdmission(Le(r),Nn)}catch{g.quotaStoreFailures+=1}}function xi(r,e){let t=j("quota");if(t==="off")return null;let n=m();if(!n)return null;try{let o=n.listAdmissionReservations({keyPrefix:Le(r),limit:50}).find(i=>i.key===Le(r)),s=!!o;return s!==e&&(g.quotaVerdictDivergences+=1),t==="enforce"?{blocked:s,retryAtIso:o?.expiresAt??null}:null}catch{return g.quotaStoreFailures+=1,null}}function $r(){return{"keeper.storeFailures":g.keeperStoreFailures,"meshLease.storeFailures":g.meshStoreFailures,"meshLease.divergences":g.meshLeaseDivergences,"meshLease.enforceStaleInversions":g.meshEnforceStaleInversions,"quota.storeFailures":g.quotaStoreFailures,"quota.verdictDivergences":g.quotaVerdictDivergences}}function vi(){g.keeperStoreFailures=0,g.meshStoreFailures=0,g.quotaStoreFailures=0,g.meshLeaseDivergences=0,g.meshEnforceStaleInversions=0,g.quotaVerdictDivergences=0}function Ei(r){let e=xr(),t=A(r?.env??process.env),n=(r?.now??(()=>new Date))().getTime(),o={};if(t.flags.dispatchReceipts!=="off"){Object.assign(o,Tr());let s=Ir({nowMs:n,hasLiveWorker:r?.hasLiveWorker});o["dispatchReceipts.strandedClaimCandidates"]=s.strandedClaimCandidates,t.flags.dispatchReceipts==="enforce"&&Object.assign(o,Fr())}return t.flags.planOutbox!=="off"&&Object.assign(o,Tn()),t.flags.admission!=="off"&&(Object.assign(o,Lr()),t.flags.admission==="enforce"&&Object.assign(o,Mr())),(t.flags.keeper!=="off"||t.flags.meshLease!=="off"||t.flags.quota!=="off")&&Object.assign(o,$r()),{contractVersion:1,observedAt:new Date(n).toISOString(),state:e.state,schemaVersion:e.schemaVersion,recovered:e.recovered,unavailableClass:e.reason?e.reason.split(":")[0]??null:null,flags:t.flags,flagSources:t.sources,flagWarningCount:t.warnings.length,divergenceCounters:o}}export{$ as ADMISSION_RESERVATION_TTL_MS,De as ADMISSION_SLOT_KEY_PREFIX,ee as FilesystemPolicyError,fn as LOCAL_RUN_STORE_OPEN_RETRY_MS,gn as LOCAL_RUN_STORE_SURFACES,Me as LOCAL_SCHEMA_VERSION,ie as SchemaDowngradeRefusedError,J as SqliteLocalRunStore,qs as __resetAdmissionEnforceCountersForTests,Vs as __resetAdmissionShadowCountersForTests,ti as __resetDispatchClaimRecoveryForTests,$s as __resetDispatchReceiptCountersForTests,Ss as __resetLocalRunStoreLifecycleForTests,As as __resetRemoteSurfaceFlagsCacheForTests,vi as __resetSmallSurfaceCountersForTests,fi as __resetStartupClaimRecoveryForTests,hs as __setLocalRunStoreLifecycleTestOverrides,Gs as acquireWorkerAdmissionSlot,Mr as admissionEnforceCounters,Lr as admissionShadowCounters,ws as anyLocalRunStoreSurfaceActive,xi as assessQuotaCooldownReservation,Ei as buildLocalRunStoreTickPosture,Ke as classifyDatabaseDirectory,ki as clearQuotaCooldownReservation,vr as closeLocalRunStore,Fr as dispatchClaimRecoveryCounters,Tr as dispatchReceiptCounters,w as dispatchReceiptsMode,_s as extractLocalRunStoreFlagsFromOperatorTickResponse,Sn as findLiveProcessByCmdlinePath,m as getLocalRunStore,mn as getLocalRunStoreLifecycleStatus,Cr as getRemoteSurfaceFlags,X as leaseTokenAttempt,Ms as listRecentDispatchStartFailures,mi as maybeRunStartupClaimRecovery,Ps as noteCompletionReplayIfAcked,We as openSqliteLocalRunStoreWithRecovery,hn as parseLocalRunStoreSurfaceMode,Cs as persistRemoteSurfaceFlags,xr as probeLocalRunStore,Si as readMeshLeaseCheckpoint,Hs as rearmAdmissionAdoptionPass,Ys as reconcileAdmissionShadow,Js as reconcileNumberedAdmissionSlots,Ts as recordCompletionAckedReceipt,Is as recordCompletionSentReceipt,Os as recordDispatchClaimReceipt,Oe as recordDispatchReleasedReceipt,Or as recordDispatchSpawnedReceipt,Ks as recordDispatchStartFailedReceipt,bi as recordQuotaCooldownReservation,Wr as recoverStrandedDispatchClaims,Ns as releaseReasonClass,Kr as releaseWorkerAdmissionSlot,Dr as releaseWorkerSlotReservation,Er as remoteSurfaceFlagsPath,A as resolveLocalRunStoreSurfaceFlags,yi as restoreKeeperBackoffCheckpoint,hi as saveKeeperBackoffCheckpoint,Ri as saveMeshLeaseCheckpoint,Ir as scanDispatchReceiptInvariants,Ds as shouldShortCircuitCompletionReplay,$r as smallSurfaceCounters,js as takeWorkerSlotReservation};
+`)},li={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},kn={version:si,generatedAt:"1970-01-01T00:00:00.000Z",personas:ii,instructions:ai,policyThresholds:li};var ci=kn;function xn(){return ci.version}F();function K(r){return r?.trim()?r.trim():null}function En(r={}){let e=r.env??process.env,t=E();return{runnerId:K(t.runnerId)??K(e.KYNVER_RUNTIME_ID)??K(e.OPENCLAW_RUNTIME_ID)??K(e.HOSTNAME)??vn.hostname(),hostname:K(e.HOSTNAME)??vn.hostname(),profile:K(e.KYNVER_RUNNER_PROFILE)??K(e.OPENCLAW_RUNNER_PROFILE),harnessRepo:K(e.KYNVER_HARNESS_REPO)??K(e.KYNVER_DEFAULT_REPO),runId:r.runId??null,instructionBundleVersion:xn()}}function _n(r){let e=String(r).trim();return e.startsWith("krc1.")?{"Content-Type":"application/json","X-Kynver-Runner-Token":e}:{"Content-Type":"application/json","X-Kynver-Cron-Secret":e,"X-OpenClaw-Cron-Secret":e,"X-Kynver-Runtime-Secret":e}}de();T();function wn(r){if(r!==void 0&&Number.isFinite(r)&&r>0)return Math.floor(r);let e=Number(process.env.KYNVER_CALLBACK_TIMEOUT_MS);return Number.isFinite(e)&&e>0?Math.floor(e):3e4}function Cn(r){return new Error(`callback timeout after ${r}ms`)}async function ui(r,e){let t=wn(e),n=new AbortController,o,s=!1;try{return await Promise.race([r(n.signal),new Promise((i,l)=>{o=setTimeout(()=>{s=!0,n.abort(),l(Cn(t))},t)})])}catch(i){throw s?Cn(t):i}finally{o&&clearTimeout(o)}}function di(r,e){let t=wn(e);return{ok:!1,status:0,response:{error:r instanceof Error?r.message:String(r),timeoutMs:t}}}async function An(r,e,t,n){try{return await ui(async o=>{let s=await ue(r,{method:"POST",headers:_n(e),body:JSON.stringify(t),signal:o}),i=null;try{i=await s.json()}catch{i=null}return{ok:s.ok,status:s.status,response:i}},n?.timeoutMs)}catch(o){return di(o,n?.timeoutMs)}}async function On(r,e,t,n){let o=await An(r,e,t,{timeoutMs:n.timeoutMs});if(o.ok||o.status!==401)return o;let s=await un(e,n.agentOsId,{baseUrl:n.baseUrl});return s.ok?{...await An(r,s.token,t,{timeoutMs:n.timeoutMs}),refreshedAuth:!0}:{...o,authRefreshFailure:s.reason}}async function In(r){let e=`${r.baseUrl}/api/agent-os/by-id/${encodeURIComponent(r.agentOsId)}/tasks/${encodeURIComponent(r.taskId)}/release`,t;try{t=await On(e,r.secret,{agentOsId:r.agentOsId,leaseOwner:r.leaseOwner,...r.leaseToken?.trim()?{leaseToken:r.leaseToken.trim()}:{},...r.failureDetail?{failureDetail:r.failureDetail}:{}},{agentOsId:r.agentOsId,baseUrl:r.baseUrl})}catch(s){return{released:!1,httpOk:!1,transportError:!0,releaseResponse:{ok:!1,error:s.message}}}let n=t.response;return{released:t.ok===!0||n?.ok===!0,httpOk:t.ok===!0,transportError:!1,releaseResponse:t.response??t}}var Br=!1;function fi(){Br=!1}async function mi(r){if(Br||w()!=="enforce")return null;Br=!0;try{let e=En().runnerId,t=await Fr({hasLiveWorker:r.hasLiveWorker,worktreePathFor:({runId:n,workerName:o})=>pi.join(at().worktreesDir,n,o),releaseClaim:async({taskId:n,leaseToken:o,runId:s})=>{let i=await In({baseUrl:r.baseUrl,secret:r.secret,agentOsId:r.agentOsId,taskId:n,leaseOwner:bn(s,e),leaseToken:o});return{released:i.released,transportError:i.transportError,detail:i.httpOk?void 0:JSON.stringify(i.releaseResponse).slice(0,200)}}});return t.outcomes.length>0&&console.error(`[daemon] D1b claim recovery: ${t.outcomes.map(n=>`${n.taskId}:${n.action}`).join(", ")}`),t}catch{return null}}var hf=600*1e3,se={storeFailures:0,corruptItemsSeen:0,corruptItemsQuarantined:0,duplicateDrainsObserved:0,halfArchivesCompleted:0};function Tn(){return{"planOutbox.storeFailures":se.storeFailures,"planOutbox.corruptItemsSeen":se.corruptItemsSeen,"planOutbox.corruptItemsQuarantined":se.corruptItemsQuarantined,"planOutbox.duplicateDrainsObserved":se.duplicateDrainsObserved,"planOutbox.halfArchivesCompleted":se.halfArchivesCompleted}}var g={keeperStoreFailures:0,meshStoreFailures:0,quotaStoreFailures:0,meshLeaseDivergences:0,meshEnforceStaleInversions:0,quotaVerdictDivergences:0};function j(r){return A(process.env).flags[r]}var Pn="daemon-keeper",gi=1800*1e3;function hi(r){if(j("keeper")==="off")return;let e=m();if(e)try{e.saveRecoveryCheckpoint({scope:Pn,payloadJson:JSON.stringify(r)})}catch{g.keeperStoreFailures+=1}}function yi(){if(j("keeper")!=="enforce")return null;let r=m();if(!r)return null;try{let e=r.latestRecoveryCheckpoint(Pn);if(!e)return null;let t=JSON.parse(e.payloadJson),n=Date.now()-Date.parse(e.createdAt);if(!Number.isFinite(n)||n>gi)return null;let o=Number(t.consecutiveFailures);return Number.isFinite(o)&&o>=0?Math.floor(o):null}catch{return g.keeperStoreFailures+=1,null}}function Ur(r){return`mesh-cron-lease:${r}`}function Ri(r,e){if(j("meshLease")==="off")return;let t=m();if(t)try{let n=t.latestRecoveryCheckpoint(Ur(r));if(n){let o=JSON.parse(n.payloadJson);if((o.leaseToken??null)===(e.leaseToken??null)&&(o.holderBoxId??null)===(e.holderBoxId??null)&&o.authorized===e.authorized)return}t.saveRecoveryCheckpoint({scope:Ur(r),payloadJson:JSON.stringify(e)})}catch{g.meshStoreFailures+=1}}function Si(r,e){let t=j("meshLease");if(t==="off")return null;let n=m();if(!n)return null;try{let o=n.latestRecoveryCheckpoint(Ur(r)),s=o?JSON.parse(o.payloadJson):null,i=s!==null&&((s.leaseToken??null)!==(e?.leaseToken??null)||(s.holderBoxId??null)!==(e?.holderBoxId??null)||(s.authorized??null)!==(e?.authorized??null));return i&&(g.meshLeaseDivergences+=1),t!=="enforce"?null:i&&e?.updatedAt&&s?.updatedAt&&Date.parse(e.updatedAt)>Date.parse(s.updatedAt)?(g.meshEnforceStaleInversions+=1,null):s}catch{return g.meshStoreFailures+=1,null}}function Le(r){return`quota-cooldown:${r}`}var Nn="quota-preflight";function bi(r,e){if(j("quota")==="off")return;let t=m();if(t)try{t.tryReserveAdmission(Le(r),Nn,e)}catch{g.quotaStoreFailures+=1}}function ki(r){if(j("quota")==="off")return;let e=m();if(e)try{e.releaseAdmission(Le(r),Nn)}catch{g.quotaStoreFailures+=1}}function xi(r,e){let t=j("quota");if(t==="off")return null;let n=m();if(!n)return null;try{let o=n.listAdmissionReservations({keyPrefix:Le(r),limit:50}).find(i=>i.key===Le(r)),s=!!o;return s!==e&&(g.quotaVerdictDivergences+=1),t==="enforce"?{blocked:s,retryAtIso:o?.expiresAt??null}:null}catch{return g.quotaStoreFailures+=1,null}}function $r(){return{"keeper.storeFailures":g.keeperStoreFailures,"meshLease.storeFailures":g.meshStoreFailures,"meshLease.divergences":g.meshLeaseDivergences,"meshLease.enforceStaleInversions":g.meshEnforceStaleInversions,"quota.storeFailures":g.quotaStoreFailures,"quota.verdictDivergences":g.quotaVerdictDivergences}}function vi(){g.keeperStoreFailures=0,g.meshStoreFailures=0,g.quotaStoreFailures=0,g.meshLeaseDivergences=0,g.meshEnforceStaleInversions=0,g.quotaVerdictDivergences=0}function Ei(r){let e=xr(),t=A(r?.env??process.env),n=(r?.now??(()=>new Date))().getTime(),o={};if(t.flags.dispatchReceipts!=="off"){Object.assign(o,Tr());let s=Ir({nowMs:n,hasLiveWorker:r?.hasLiveWorker});o["dispatchReceipts.strandedClaimCandidates"]=s.strandedClaimCandidates,t.flags.dispatchReceipts==="enforce"&&Object.assign(o,Wr())}return t.flags.planOutbox!=="off"&&Object.assign(o,Tn()),t.flags.admission!=="off"&&(Object.assign(o,Lr()),t.flags.admission==="enforce"&&Object.assign(o,Mr())),(t.flags.keeper!=="off"||t.flags.meshLease!=="off"||t.flags.quota!=="off")&&Object.assign(o,$r()),{contractVersion:1,observedAt:new Date(n).toISOString(),state:e.state,schemaVersion:e.schemaVersion,recovered:e.recovered,unavailableClass:e.reason?e.reason.split(":")[0]??null:null,flags:t.flags,flagSources:t.sources,flagWarningCount:t.warnings.length,divergenceCounters:o}}export{$ as ADMISSION_RESERVATION_TTL_MS,De as ADMISSION_SLOT_KEY_PREFIX,ee as FilesystemPolicyError,fn as LOCAL_RUN_STORE_OPEN_RETRY_MS,gn as LOCAL_RUN_STORE_SURFACES,Me as LOCAL_SCHEMA_VERSION,ie as SchemaDowngradeRefusedError,J as SqliteLocalRunStore,qs as __resetAdmissionEnforceCountersForTests,Vs as __resetAdmissionShadowCountersForTests,ti as __resetDispatchClaimRecoveryForTests,$s as __resetDispatchReceiptCountersForTests,Ss as __resetLocalRunStoreLifecycleForTests,As as __resetRemoteSurfaceFlagsCacheForTests,vi as __resetSmallSurfaceCountersForTests,fi as __resetStartupClaimRecoveryForTests,hs as __setLocalRunStoreLifecycleTestOverrides,Gs as acquireWorkerAdmissionSlot,Mr as admissionEnforceCounters,Lr as admissionShadowCounters,ws as anyLocalRunStoreSurfaceActive,xi as assessQuotaCooldownReservation,Ei as buildLocalRunStoreTickPosture,Ke as classifyDatabaseDirectory,ki as clearQuotaCooldownReservation,vr as closeLocalRunStore,Wr as dispatchClaimRecoveryCounters,Tr as dispatchReceiptCounters,w as dispatchReceiptsMode,_s as extractLocalRunStoreFlagsFromOperatorTickResponse,Sn as findLiveProcessByCmdlinePath,m as getLocalRunStore,mn as getLocalRunStoreLifecycleStatus,Cr as getRemoteSurfaceFlags,X as leaseTokenAttempt,Ms as listRecentDispatchStartFailures,mi as maybeRunStartupClaimRecovery,Ps as noteCompletionReplayIfAcked,Fe as openSqliteLocalRunStoreWithRecovery,hn as parseLocalRunStoreSurfaceMode,Cs as persistRemoteSurfaceFlags,xr as probeLocalRunStore,Si as readMeshLeaseCheckpoint,Hs as rearmAdmissionAdoptionPass,Ys as reconcileAdmissionShadow,Js as reconcileNumberedAdmissionSlots,Ts as recordCompletionAckedReceipt,Is as recordCompletionSentReceipt,Os as recordDispatchClaimReceipt,Oe as recordDispatchReleasedReceipt,Or as recordDispatchSpawnedReceipt,Ks as recordDispatchStartFailedReceipt,bi as recordQuotaCooldownReservation,Fr as recoverStrandedDispatchClaims,Ns as releaseReasonClass,Kr as releaseWorkerAdmissionSlot,Dr as releaseWorkerSlotReservation,Er as remoteSurfaceFlagsPath,A as resolveLocalRunStoreSurfaceFlags,yi as restoreKeeperBackoffCheckpoint,hi as saveKeeperBackoffCheckpoint,Ri as saveMeshLeaseCheckpoint,Ir as scanDispatchReceiptInvariants,Ds as shouldShortCircuitCompletionReplay,$r as smallSurfaceCounters,js as takeWorkerSlotReservation};

package/dist/server/cleanup.js

@@ -58,13 +58,15 @@ function finish(code, signal, spawnError) {
   }
   process.exit(code === null ? 1 : code);
 }
+// Handlers go in BEFORE the spawn: a worker that signals its parent right away
+// must not catch this wrapper with the default action (dies, no exit.json).
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 try {
   child = cp.spawn(cmd, args, { stdio: "inherit" });
 } catch (e) {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   finish(127, null, String(e && e.message));
 }
-for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 child.on("error", (e) => {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   if (!child.pid) finish(127, null, String(e && e.message));

package/dist/server/default-repo.js

@@ -50,13 +50,15 @@ function finish(code, signal, spawnError) {
   }
   process.exit(code === null ? 1 : code);
 }
+// Handlers go in BEFORE the spawn: a worker that signals its parent right away
+// must not catch this wrapper with the default action (dies, no exit.json).
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 try {
   child = cp.spawn(cmd, args, { stdio: "inherit" });
 } catch (e) {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   finish(127, null, String(e && e.message));
 }
-for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 child.on("error", (e) => {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   if (!child.pid) finish(127, null, String(e && e.message));

package/dist/server/dispatch-routing.js

@@ -50,13 +50,15 @@ function finish(code, signal, spawnError) {
   }
   process.exit(code === null ? 1 : code);
 }
+// Handlers go in BEFORE the spawn: a worker that signals its parent right away
+// must not catch this wrapper with the default action (dies, no exit.json).
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 try {
   child = cp.spawn(cmd, args, { stdio: "inherit" });
 } catch (e) {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   finish(127, null, String(e && e.message));
 }
-for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 child.on("error", (e) => {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   if (!child.pid) finish(127, null, String(e && e.message));

package/dist/server/model-routing.js

@@ -50,13 +50,15 @@ function finish(code, signal, spawnError) {
   }
   process.exit(code === null ? 1 : code);
 }
+// Handlers go in BEFORE the spawn: a worker that signals its parent right away
+// must not catch this wrapper with the default action (dies, no exit.json).
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 try {
   child = cp.spawn(cmd, args, { stdio: "inherit" });
 } catch (e) {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   finish(127, null, String(e && e.message));
 }
-for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 child.on("error", (e) => {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   if (!child.pid) finish(127, null, String(e && e.message));

package/dist/server/monitor.js

@@ -57,13 +57,15 @@ function finish(code, signal, spawnError) {
   }
   process.exit(code === null ? 1 : code);
 }
+// Handlers go in BEFORE the spawn: a worker that signals its parent right away
+// must not catch this wrapper with the default action (dies, no exit.json).
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 try {
   child = cp.spawn(cmd, args, { stdio: "inherit" });
 } catch (e) {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   finish(127, null, String(e && e.message));
 }
-for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 child.on("error", (e) => {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   if (!child.pid) finish(127, null, String(e && e.message));

package/dist/server/orchestration.js

@@ -1,4 +1,4 @@
-import{existsSync as ie}from"node:fs";import{homedir as se}from"node:os";import ae from"node:path";import{createHash as Y}from"node:crypto";import{statSync as ne}from"node:fs";import{spawnSync as U}from"node:child_process";import{existsSync as M,readFileSync as z}from"node:fs";import p from"node:path";var _=class extends Error{constructor(t){super(`${t} is a batch file that is not a Node CLI shim; it cannot be spawned without a shell. Point the matching KYNVER_*_BIN setting at the real .exe or the CLI's JS entry, or run the daemon inside WSL.`);this.shimPath=t;this.name="UnresolvableWindowsShimError"}shimPath},X=".COM;.EXE;.BAT;.CMD";function q(e){return e.includes("/")||e.includes("\\")}function Q(e){return(e.PATHEXT||X).split(";").map(r=>r.trim().toLowerCase()).filter(r=>r.startsWith("."))}function Z(e){let r=Object.keys(e).find(t=>t.toUpperCase()==="PATH");return r?e[r]??"":""}function ee(e,r={}){let t=r.env??process.env,o=r.exists??M,n=Q(t),i=p.win32.extname(e)!=="",s=a=>i?[a]:n.map(c=>`${a}${c}`);if(q(e)||p.win32.isAbsolute(e))return s(e).find(a=>o(a))??null;for(let a of Z(t).split(";").map(c=>c.trim()).filter(Boolean)){let c=s(p.win32.join(a,e)).find(m=>o(m));if(c)return c}return null}var D=/%~?dp0%?\\?([^"%\r\n]+?\.(?:c|m)?js)\b/i,re=/^\s*SET\s+"?([A-Za-z_]\w*)=([^"\r\n]*)"?\s*$/i;function B(e){return e.replace(/^[\\/]+/,"")}function te(e){let r=e.split(/\r?\n/),t=new Map;for(let i of r){let s=re.exec(i);s&&t.set(s[1].toUpperCase(),s[2])}let o=r.filter(i=>i.includes("%*")).pop();if(!o)return null;let n=D.exec(o);if(n)return B(n[1]);for(let i of o.matchAll(/%([A-Za-z_]\w*)%/g)){let s=t.get(i[1].toUpperCase()),a=s?D.exec(s):null;if(a)return B(a[1])}return null}function oe(e,r={}){if((r.platform??process.platform)!=="win32")return{executable:e,prefixArgs:[],kind:"passthrough"};let o=ee(e,r);if(!o)return{executable:e,prefixArgs:[],kind:"passthrough"};let n=p.win32.extname(o).toLowerCase();if(n!==".cmd"&&n!==".bat")return{executable:o,prefixArgs:[],kind:"exe"};let i=r.readText??(G=>z(G,"utf8")),s=r.exists??M,a;try{a=i(o)}catch{throw new _(o)}let c=te(a);if(!c)throw new _(o);let m=p.win32.dirname(o),K=p.win32.join(m,c);if(!s(K))throw new _(o);let L=p.win32.join(m,"node.exe");return{executable:s(L)?L:r.nodeExecutable??process.execPath,prefixArgs:[K],kind:"node-shim"}}function R(e,r,t={}){let o=oe(e,t);return[o.executable,[...o.prefixArgs,...r]]}function u(e){try{let r=ne(e),t=`${e}|${r.size}|${r.mtimeMs}`;return Y("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function h(e){return Y("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,r){for(let t of r){let o=process.env[t]?.trim();if(o)return o}return e}function l(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r),s=U(n,i,{windowsHide:!0,encoding:"utf8",timeout:o,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(s.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let a=(s.stderr||s.stdout||"").trim(),c=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:a?`${c}: ${a.slice(0,200)}`:c}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function A(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r);return U(n,i,{windowsHide:!0,stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var ce="claude";function le(){let e=se();return[ae.join(e,".claude",".credentials.json")]}function j(e=new Date().toISOString()){let r=d(ce,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:h("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=le().find(s=>ie(s)),n=A(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(n.ok||!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as ue}from"node:fs";import{homedir as de}from"node:os";import S from"node:path";var pe="codex";function fe(){let e=de();return[process.env.CODEX_HOME?.trim()?S.join(S.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,S.join(e,".codex","auth.json"),S.join(e,".config","codex","auth.json")].filter(t=>!!t)}function me(e){return S.dirname(e)}function he(e){let r,t;for(let o of fe()){if(!ue(o))continue;r??=o;let n=l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:me(o)}});if(t??=n,n.ok)return{authPath:o,login:n}}return{authPath:r,login:t??l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function H(e=new Date().toISOString()){let r=d(pe,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:h("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:o}=he(r),n=!!t&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:t?u(t):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as ge}from"node:fs";import{homedir as Ee}from"node:os";import y from"node:path";function _e(){let e=process.env.HERMES_HOME?.trim(),r=e?y.resolve(e):y.join(Ee(),".hermes");return y.join(r,"auth.json")}function x(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=_e(),n=ge(o),i=A(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?u(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function $(e=new Date().toISOString()){let r=H(e);if(r.ready)return{...r,path:"codex_cli"};let t=x(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as be}from"node:fs";import{homedir as ke}from"node:os";import E from"node:path";import{closeSync as Yr,existsSync as Pe,mkdirSync as Ur,openSync as jr,statSync as Hr,unlinkSync as $r}from"node:fs";var Er=String.raw`"use strict";
+import{existsSync as ie}from"node:fs";import{homedir as se}from"node:os";import ae from"node:path";import{createHash as Y}from"node:crypto";import{statSync as ne}from"node:fs";import{spawnSync as U}from"node:child_process";import{existsSync as M,readFileSync as z}from"node:fs";import p from"node:path";var _=class extends Error{constructor(t){super(`${t} is a batch file that is not a Node CLI shim; it cannot be spawned without a shell. Point the matching KYNVER_*_BIN setting at the real .exe or the CLI's JS entry, or run the daemon inside WSL.`);this.shimPath=t;this.name="UnresolvableWindowsShimError"}shimPath},X=".COM;.EXE;.BAT;.CMD";function q(e){return e.includes("/")||e.includes("\\")}function Q(e){return(e.PATHEXT||X).split(";").map(r=>r.trim().toLowerCase()).filter(r=>r.startsWith("."))}function Z(e){let r=Object.keys(e).find(t=>t.toUpperCase()==="PATH");return r?e[r]??"":""}function ee(e,r={}){let t=r.env??process.env,o=r.exists??M,n=Q(t),i=p.win32.extname(e)!=="",s=a=>i?[a]:n.map(c=>`${a}${c}`);if(q(e)||p.win32.isAbsolute(e))return s(e).find(a=>o(a))??null;for(let a of Z(t).split(";").map(c=>c.trim()).filter(Boolean)){let c=s(p.win32.join(a,e)).find(m=>o(m));if(c)return c}return null}var D=/%~?dp0%?\\?([^"%\r\n]+?\.(?:c|m)?js)\b/i,re=/^\s*SET\s+"?([A-Za-z_]\w*)=([^"\r\n]*)"?\s*$/i;function B(e){return e.replace(/^[\\/]+/,"")}function te(e){let r=e.split(/\r?\n/),t=new Map;for(let i of r){let s=re.exec(i);s&&t.set(s[1].toUpperCase(),s[2])}let o=r.filter(i=>i.includes("%*")).pop();if(!o)return null;let n=D.exec(o);if(n)return B(n[1]);for(let i of o.matchAll(/%([A-Za-z_]\w*)%/g)){let s=t.get(i[1].toUpperCase()),a=s?D.exec(s):null;if(a)return B(a[1])}return null}function oe(e,r={}){if((r.platform??process.platform)!=="win32")return{executable:e,prefixArgs:[],kind:"passthrough"};let o=ee(e,r);if(!o)return{executable:e,prefixArgs:[],kind:"passthrough"};let n=p.win32.extname(o).toLowerCase();if(n!==".cmd"&&n!==".bat")return{executable:o,prefixArgs:[],kind:"exe"};let i=r.readText??(G=>z(G,"utf8")),s=r.exists??M,a;try{a=i(o)}catch{throw new _(o)}let c=te(a);if(!c)throw new _(o);let m=p.win32.dirname(o),K=p.win32.join(m,c);if(!s(K))throw new _(o);let L=p.win32.join(m,"node.exe");return{executable:s(L)?L:r.nodeExecutable??process.execPath,prefixArgs:[K],kind:"node-shim"}}function R(e,r,t={}){let o=oe(e,t);return[o.executable,[...o.prefixArgs,...r]]}function u(e){try{let r=ne(e),t=`${e}|${r.size}|${r.mtimeMs}`;return Y("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function h(e){return Y("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,r){for(let t of r){let o=process.env[t]?.trim();if(o)return o}return e}function l(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r),s=U(n,i,{windowsHide:!0,encoding:"utf8",timeout:o,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(s.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let a=(s.stderr||s.stdout||"").trim(),c=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:a?`${c}: ${a.slice(0,200)}`:c}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function A(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r);return U(n,i,{windowsHide:!0,stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var ce="claude";function le(){let e=se();return[ae.join(e,".claude",".credentials.json")]}function j(e=new Date().toISOString()){let r=d(ce,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:h("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=le().find(s=>ie(s)),n=A(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(n.ok||!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as ue}from"node:fs";import{homedir as de}from"node:os";import S from"node:path";var pe="codex";function fe(){let e=de();return[process.env.CODEX_HOME?.trim()?S.join(S.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,S.join(e,".codex","auth.json"),S.join(e,".config","codex","auth.json")].filter(t=>!!t)}function me(e){return S.dirname(e)}function he(e){let r,t;for(let o of fe()){if(!ue(o))continue;r??=o;let n=l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:me(o)}});if(t??=n,n.ok)return{authPath:o,login:n}}return{authPath:r,login:t??l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function H(e=new Date().toISOString()){let r=d(pe,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:h("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:o}=he(r),n=!!t&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:t?u(t):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as ge}from"node:fs";import{homedir as Ee}from"node:os";import y from"node:path";function _e(){let e=process.env.HERMES_HOME?.trim(),r=e?y.resolve(e):y.join(Ee(),".hermes");return y.join(r,"auth.json")}function x(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=_e(),n=ge(o),i=A(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?u(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function F(e=new Date().toISOString()){let r=H(e);if(r.ready)return{...r,path:"codex_cli"};let t=x(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as be}from"node:fs";import{homedir as ke}from"node:os";import E from"node:path";import{closeSync as Yr,existsSync as Pe,mkdirSync as Ur,openSync as jr,statSync as Hr,unlinkSync as Fr}from"node:fs";var Er=String.raw`"use strict";
 const cp = require("child_process"), fs = require("fs");
 const argv = process.argv.slice(1);
 const exitFile = argv[0], cmd = argv[1], args = argv.slice(2);
@@ -50,16 +50,18 @@ function finish(code, signal, spawnError) {
   }
   process.exit(code === null ? 1 : code);
 }
+// Handlers go in BEFORE the spawn: a worker that signals its parent right away
+// must not catch this wrapper with the default action (dies, no exit.json).
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 try {
   child = cp.spawn(cmd, args, { stdio: "inherit" });
 } catch (e) {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   finish(127, null, String(e && e.message));
 }
-for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 child.on("error", (e) => {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   if (!child.pid) finish(127, null, String(e && e.message));
 });
 child.on("exit", (code, signal) => finish(code, signal));
-`;import g from"node:path";function v(e=process.platform){return e!=="win32"}var Se=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],vr=new Set(Se);var Ce=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Pr=new Set(Ce);import{existsSync as C,readdirSync as Oe}from"node:fs";import f from"node:path";var Ae=/^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;function xe(e){let t=e.split("-")[0].split(".");if(t.length!==3)return null;let[o,n,i]=t;return!o||!n||!i?null:+`${o}${n.padStart(2,"0")}${i.padStart(2,"0")}`}function ve(e){let r=f.join(e,"versions");if(!C(r))return null;let t=null,o=-1;for(let n of Oe(r,{withFileTypes:!0})){if(!n.isDirectory()||!Ae.test(n.name))continue;let i=xe(n.name);i==null||i<=o||(o=i,t=f.join(r,n.name))}return t}function k(e){let r=e?.trim()||f.join(process.env.LOCALAPPDATA||"","cursor-agent"),t=f.join(r,"node.exe"),o=f.join(r,"index.js");if(C(t)&&C(o))return{nodeExe:t,indexJs:o,versionDir:r};let n=ve(r);if(!n)return null;let i=f.join(n,"node.exe"),s=f.join(n,"index.js");return!C(i)||!C(s)?null:{nodeExe:i,indexJs:s,versionDir:n}}function Re(e,r,t){return{executable:e,prefixArgs:[r],shell:!1,detached:v(),bundledVersionDir:t}}function F(e){if(process.platform==="win32"){let r=/\.(cmd|bat)$/i.test(e),t=/node\.exe$/i.test(e)&&Pe(g.join(g.dirname(e),"index.js"));if(r||t||e==="agent"){let n=r?k(g.dirname(e)):t?{nodeExe:e,indexJs:g.join(g.dirname(e),"index.js"),versionDir:g.dirname(e)}:k();if(n)return Re(n.nodeExe,n.indexJs,n.versionDir);throw new Error("Cursor Agent on Windows has no headless bundled node.exe under %LOCALAPPDATA%\\cursor-agent\\versions\\\u2026. Run `agent login` / update Cursor Agent CLI, use `--provider claude`, or set KYNVER_CURSOR_AGENT_ROOT to the cursor-agent folder.")}}return{executable:e,prefixArgs:[],shell:!1,detached:v()}}import{spawnSync as ye}from"node:child_process";function b(e,r=process.env){try{let t;try{t=F(e)}catch{t={executable:e,prefixArgs:[]}}let o=ye(t.executable,[...t.prefixArgs,"status","--format","json"],{encoding:"utf8",windowsHide:!0,timeout:8e3,env:{...r,CI:"1",NO_COLOR:"1"}});if(o.status!==0)return{ok:!1,note:"agent status: not authenticated"};let n=(o.stdout||"").trim();if(!n)return{ok:!1,note:"agent status: empty response"};let i;try{i=JSON.parse(n)}catch{return{ok:!1,note:"agent status: unparseable response"}}return typeof i=="object"&&i!==null&&i.isAuthenticated===!0?{ok:!0,note:"agent status: authenticated"}:{ok:!1,note:"agent status: not authenticated"}}catch(t){return{ok:!1,note:t instanceof Error?t.message:"agent status probe failed"}}}function I(e=process.env){let r=[],t=e.KYNVER_CURSOR_AUTH_HOME?.trim();t&&(r.push(E.join(t,".config","cursor","auth.json")),r.push(E.join(t,".cursor-agent","auth.json")));let o=ke();if(r.push(E.join(o,".config","cursor","auth.json")),r.push(E.join(o,".cursor-agent","auth.json")),process.platform==="win32"){let n=e.LOCALAPPDATA?.trim(),i=e.APPDATA?.trim();n&&r.push(E.join(n,"cursor-agent","auth.json")),i&&r.push(E.join(i,"cursor","auth.json"))}return r}var Ie="agent";function W(e=new Date().toISOString()){let r=d(Ie,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:h("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=l(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=I().find(a=>be(a)),n=b(r),i=!!o||n.ok,s=t.ok&&i;return{providerId:"cursor",ready:s,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:s?"Local Cursor/Composer OAuth session bound on runner":[t.note,i?void 0:n.note??"no ~/.config/cursor/auth.json or `agent login` session"].filter(Boolean).join("; ")}}import{existsSync as Ne,readFileSync as Te}from"node:fs";import{homedir as we}from"node:os";import N from"node:path";var Ke=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function Le(){let e=process.env.HERMES_HOME?.trim(),r=e?N.resolve(e):N.join(we(),".hermes");return N.join(r,".env")}function De(e){try{let r=Te(e,"utf8"),t=[];for(let o of Ke)new RegExp(`^${o}=`,"m").test(r)&&t.push(o);return t}catch{return[]}}function V(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=Le(),n=Ne(o),i=n?De(o):[],a=i.some(m=>m.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",c=t.ok&&n;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:n,authSource:a,sessionFingerprint:n?u(o):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function Be(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=$(r),o={codex:t,cursor:W(r),claude:j(r)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:r,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:V(r),hermesOpenAiCodex:x(r),codexAdapterPath:t.path,readyCount:n}}var Me={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function Ye(){return Object.values(Me)}var J=["off","observe","enforce"];function Ue(e){let r=(e??"off").trim().toLowerCase();return J.includes(r)?r:"off"}function P(e=process.env){return Ue(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function T(e=process.env){let r=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return r?r==="1"||r==="true"||r==="yes"||r==="on":P(e)==="enforce"}import{createHash as je}from"node:crypto";function O(e){if(e==null)return null;let r=e.trim();return r.length?r:null}function w(e){let r=O(e.sessionId)??"anonymous",t=O(e.title)??O(e.action)??"foreground",o=je("sha256").update([O(e.planId)??"",O(e.parentTaskId)??"",t.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${r}:${o}`}function He(e,r){return e==="enforce"&&r?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function $e(e,r=process.env){let t=P(r),o=T(r),n=He(t,o),i=n==="enforce_harness_task"?w({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return t==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:t,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{w as buildForegroundHarnessIdempotencyKey,Be as buildOrchestrationProviderInventory,$e as evaluateOrchestrationPolicy,T as isOrchestrationEnforceTasksEnabled,Ye as listOrchestrationProviderCapabilities,P as resolveOrchestrationPolicyMode};
+`;import g from"node:path";function v(e=process.platform){return e!=="win32"}var Se=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],vr=new Set(Se);var Oe=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Pr=new Set(Oe);import{existsSync as O,readdirSync as Ce}from"node:fs";import f from"node:path";var Ae=/^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;function xe(e){let t=e.split("-")[0].split(".");if(t.length!==3)return null;let[o,n,i]=t;return!o||!n||!i?null:+`${o}${n.padStart(2,"0")}${i.padStart(2,"0")}`}function ve(e){let r=f.join(e,"versions");if(!O(r))return null;let t=null,o=-1;for(let n of Ce(r,{withFileTypes:!0})){if(!n.isDirectory()||!Ae.test(n.name))continue;let i=xe(n.name);i==null||i<=o||(o=i,t=f.join(r,n.name))}return t}function k(e){let r=e?.trim()||f.join(process.env.LOCALAPPDATA||"","cursor-agent"),t=f.join(r,"node.exe"),o=f.join(r,"index.js");if(O(t)&&O(o))return{nodeExe:t,indexJs:o,versionDir:r};let n=ve(r);if(!n)return null;let i=f.join(n,"node.exe"),s=f.join(n,"index.js");return!O(i)||!O(s)?null:{nodeExe:i,indexJs:s,versionDir:n}}function Re(e,r,t){return{executable:e,prefixArgs:[r],shell:!1,detached:v(),bundledVersionDir:t}}function $(e){if(process.platform==="win32"){let r=/\.(cmd|bat)$/i.test(e),t=/node\.exe$/i.test(e)&&Pe(g.join(g.dirname(e),"index.js"));if(r||t||e==="agent"){let n=r?k(g.dirname(e)):t?{nodeExe:e,indexJs:g.join(g.dirname(e),"index.js"),versionDir:g.dirname(e)}:k();if(n)return Re(n.nodeExe,n.indexJs,n.versionDir);throw new Error("Cursor Agent on Windows has no headless bundled node.exe under %LOCALAPPDATA%\\cursor-agent\\versions\\\u2026. Run `agent login` / update Cursor Agent CLI, use `--provider claude`, or set KYNVER_CURSOR_AGENT_ROOT to the cursor-agent folder.")}}return{executable:e,prefixArgs:[],shell:!1,detached:v()}}import{spawnSync as ye}from"node:child_process";function b(e,r=process.env){try{let t;try{t=$(e)}catch{t={executable:e,prefixArgs:[]}}let o=ye(t.executable,[...t.prefixArgs,"status","--format","json"],{encoding:"utf8",windowsHide:!0,timeout:8e3,env:{...r,CI:"1",NO_COLOR:"1"}});if(o.status!==0)return{ok:!1,note:"agent status: not authenticated"};let n=(o.stdout||"").trim();if(!n)return{ok:!1,note:"agent status: empty response"};let i;try{i=JSON.parse(n)}catch{return{ok:!1,note:"agent status: unparseable response"}}return typeof i=="object"&&i!==null&&i.isAuthenticated===!0?{ok:!0,note:"agent status: authenticated"}:{ok:!1,note:"agent status: not authenticated"}}catch(t){return{ok:!1,note:t instanceof Error?t.message:"agent status probe failed"}}}function I(e=process.env){let r=[],t=e.KYNVER_CURSOR_AUTH_HOME?.trim();t&&(r.push(E.join(t,".config","cursor","auth.json")),r.push(E.join(t,".cursor-agent","auth.json")));let o=ke();if(r.push(E.join(o,".config","cursor","auth.json")),r.push(E.join(o,".cursor-agent","auth.json")),process.platform==="win32"){let n=e.LOCALAPPDATA?.trim(),i=e.APPDATA?.trim();n&&r.push(E.join(n,"cursor-agent","auth.json")),i&&r.push(E.join(i,"cursor","auth.json"))}return r}var Ie="agent";function W(e=new Date().toISOString()){let r=d(Ie,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:h("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=l(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=I().find(a=>be(a)),n=b(r),i=!!o||n.ok,s=t.ok&&i;return{providerId:"cursor",ready:s,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:s?"Local Cursor/Composer OAuth session bound on runner":[t.note,i?void 0:n.note??"no ~/.config/cursor/auth.json or `agent login` session"].filter(Boolean).join("; ")}}import{existsSync as we,readFileSync as Ne}from"node:fs";import{homedir as Te}from"node:os";import w from"node:path";var Ke=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function Le(){let e=process.env.HERMES_HOME?.trim(),r=e?w.resolve(e):w.join(Te(),".hermes");return w.join(r,".env")}function De(e){try{let r=Ne(e,"utf8"),t=[];for(let o of Ke)new RegExp(`^${o}=`,"m").test(r)&&t.push(o);return t}catch{return[]}}function V(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=Le(),n=we(o),i=n?De(o):[],a=i.some(m=>m.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",c=t.ok&&n;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:n,authSource:a,sessionFingerprint:n?u(o):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function Be(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=F(r),o={codex:t,cursor:W(r),claude:j(r)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:r,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:V(r),hermesOpenAiCodex:x(r),codexAdapterPath:t.path,readyCount:n}}var Me={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function Ye(){return Object.values(Me)}var J=["off","observe","enforce"];function Ue(e){let r=(e??"off").trim().toLowerCase();return J.includes(r)?r:"off"}function P(e=process.env){return Ue(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function N(e=process.env){let r=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return r?r==="1"||r==="true"||r==="yes"||r==="on":P(e)==="enforce"}import{createHash as je}from"node:crypto";function C(e){if(e==null)return null;let r=e.trim();return r.length?r:null}function T(e){let r=C(e.sessionId)??"anonymous",t=C(e.title)??C(e.action)??"foreground",o=je("sha256").update([C(e.planId)??"",C(e.parentTaskId)??"",t.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${r}:${o}`}function He(e,r){return e==="enforce"&&r?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function Fe(e,r=process.env){let t=P(r),o=N(r),n=He(t,o),i=n==="enforce_harness_task"?T({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return t==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:t,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{T as buildForegroundHarnessIdempotencyKey,Be as buildOrchestrationProviderInventory,Fe as evaluateOrchestrationPolicy,N as isOrchestrationEnforceTasksEnabled,Ye as listOrchestrationProviderCapabilities,P as resolveOrchestrationPolicyMode};