@kynver-app/runtime 0.2.138 → 0.2.140

package/dist/daemon-tick-thread.js

@@ -58,13 +58,15 @@ function finish(code, signal, spawnError) {
   }
   process.exit(code === null ? 1 : code);
 }
+// Handlers go in BEFORE the spawn: a worker that signals its parent right away
+// must not catch this wrapper with the default action (dies, no exit.json).
+for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 try {
   child = cp.spawn(cmd, args, { stdio: "inherit" });
 } catch (e) {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   finish(127, null, String(e && e.message));
 }
-for (const s of ["SIGTERM", "SIGINT", "SIGHUP"]) process.on(s, () => { try { child.kill(s); } catch {} });
 child.on("error", (e) => {
   process.stderr.write("failed to spawn worker process: " + (e && e.message) + "\n");
   if (!child.pid) finish(127, null, String(e && e.message));
@@ -77,7 +79,7 @@ child.on("exit", (code, signal) => finish(code, signal));
 `),"worker.prompt.progress.compact":"Plan progress: when planId is set, report progress with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`. Do not mark rows done from the worker CLI.","worker.prompt.progress.full":["Structured plan progress (required when planId is set):","- Report checkpoints with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`.","- When a slice is finished, emit `partial` with evidence (`--evidence pr:<url>`, `--evidence path:<file>`, or `--evidence command:<cmd>`).","- Do not propose or confirm row `done` from the worker CLI."].join(`
 `),"worker.prompt.merge_gate.compact":"Verification cost control: prefer local verification before requesting CI runs; do not push empty commits to re-trigger CI; record verification evidence on the PR.","worker.prompt.merge_gate.full":["Verification cost control:","- Prefer local verification of touched paths before requesting any CI run.","- Do not push empty commits to re-trigger CI.","- Record verification evidence on the PR before requesting review."].join(`
 `),"worker.prompt.plan_artifacts.compact":"Plan artifacts: when authoring or revising plan documents, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in a local worktree.","worker.prompt.plan_artifacts.full":["Plan artifacts (when authoring or revising plan documents):","- Create a feature branch and open a GitHub PR (draft OK) before substantial drafting; commit and push the plan file.","- Iterate on that PR branch and link the PR URL on the related task and progress evidence."].join(`
-`)},Ib={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},Tt={version:Cb,generatedAt:"1970-01-01T00:00:00.000Z",personas:Pb,instructions:Ab,policyThresholds:Ib};var bn=Tt,Ob="embedded";function Ju(){return bn.version}function zu(e,r){bn=e,Ob=r}function Sn(e){let r=bn.instructions[e];if(typeof r=="string"&&r.trim())return r;let t=Tt.instructions[e];return typeof t=="string"?t:""}function Zi(e,r){let t=bn.policyThresholds[e];if(typeof t=="number"&&Number.isFinite(t))return t;let n=Tt.policyThresholds[e];return typeof n=="number"&&Number.isFinite(n)?n:r}function Xu(e){if(!e)return null;let r=e.trim().toLowerCase();return bn.personas.find(t=>t.slug===r)??null}xn();import kb from"node:path";B();cs();O();import h_ from"node:path";function k_(e){let r=Array.isArray(e.ownedPaths)?e.ownedPaths.filter(n=>typeof n=="string"):[],t=Array.isArray(e.writeSetPrefixes)?(e.writeSetPrefixes??[]).filter(n=>typeof n=="string"):[];return{...r.length?{ownedPaths:r}:{},...t.length?{writeSetPrefixes:t}:{},...e.allowConcurrentHotspot?{allowConcurrentHotspot:!0}:{}}}function Is(e){let r=q(e),t=[];for(let n of Object.keys(r.workers||{})){let o=I(h_.join(N(r.id),"workers",x(n),"worker.json"),void 0);!o?.taskId||!Yr(o)||t.push({runId:r.id,workerName:n,taskId:o.taskId,pid:o.pid,...k_(o)})}return t}H();function Jn(e){let r=String(e).trim();return r.startsWith("krc1.")?{"Content-Type":"application/json","X-Kynver-Runner-Token":r}:{"Content-Type":"application/json","X-Kynver-Cron-Secret":r,"X-OpenClaw-Cron-Secret":r,"X-Kynver-Runtime-Secret":r}}In();H();function xm(e){if(e!==void 0&&Number.isFinite(e)&&e>0)return Math.floor(e);let r=Number(process.env.KYNVER_CALLBACK_TIMEOUT_MS);return Number.isFinite(r)&&r>0?Math.floor(r):3e4}function wm(e){return new Error(`callback timeout after ${e}ms`)}async function _m(e,r){let t=xm(r),n=new AbortController,o,s=!1;try{return await Promise.race([e(n.signal),new Promise((i,a)=>{o=setTimeout(()=>{s=!0,n.abort(),a(wm(t))},t)})])}catch(i){throw s?wm(t):i}finally{o&&clearTimeout(o)}}function Em(e,r){let t=xm(r);return{ok:!1,status:0,response:{error:e instanceof Error?e.message:String(e),timeoutMs:t}}}async function ft(e,r,t,n){try{return await _m(async o=>{let s=await An(e,{method:"POST",headers:Jn(r),body:JSON.stringify(t),signal:o}),i=null;try{i=await s.json()}catch{i=null}return{ok:s.ok,status:s.status,response:i}},n?.timeoutMs)}catch(o){return Em(o,n?.timeoutMs)}}async function X(e,r,t,n){let o=await ft(e,r,t,{timeoutMs:n.timeoutMs});if(o.ok||o.status!==401)return o;let s=await Rm(r,n.agentOsId,{baseUrl:n.baseUrl});return s.ok?{...await ft(e,s.token,t,{timeoutMs:n.timeoutMs}),refreshedAuth:!0}:{...o,authRefreshFailure:s.reason}}async function tl(e,r,t){try{return await _m(async n=>{let o=await An(e,{method:"GET",headers:Jn(r),signal:n}),s=null;try{s=await o.json()}catch{s=null}return{ok:o.ok,status:o.status,response:s}},t?.timeoutMs)}catch(n){return Em(n,t?.timeoutMs)}}H();jn();import{spawnSync as I_}from"node:child_process";import{randomBytes as O_}from"node:crypto";import{createPublicKey as w_,verify as x_}from"node:crypto";import{createHash as y_,createPublicKey as eK,verify as rK}from"node:crypto";function ol(e){return JSON.stringify(nl(e))}function nl(e){if(Array.isArray(e))return e.map(nl);if(e&&typeof e=="object"){let r={};for(let t of Object.keys(e).sort())r[t]=nl(e[t]);return r}return e}function sl(e){if(!e)return null;let r=e.trim();if(!r)return null;if(/^[0-9a-fA-F]{64}$/.test(r))return new Uint8Array(r.match(/.{2}/g).map(t=>parseInt(t,16)));try{let t=Buffer.from(r,"base64");if(t.length===32)return new Uint8Array(t)}catch{}return null}function Cm(e){if(!e)return[];let r=[];for(let t of e.split(/[,\s]+/)){let n=sl(t);n&&r.push(n)}return r}function Pm(e=process.env){if(e.NODE_ENV==="production")return!1;let r=e.KYNVER_ALLOW_DEV_SIGNING_KEYS?.trim().toLowerCase();return r==="1"||r==="true"||r==="yes"||r==="on"?!0:e.NODE_ENV==="test"||e.VITEST==="true"}var nK=Buffer.from("302a300506032b6570032100","hex"),Am="ca-6297fb8e1773",R_={[Am]:"16ae5cb2a61f8c94cf1b86e8258f9c2f2ff6aba5e6136250a422209b6e866881","ca-456fd128f3b3":"f29cbd559410c2578d7f9732ccd86570073355ccdb36af0d1b7dff15908466e7"};function v_(e){return`ca-${y_("sha256").update(Buffer.from(e)).digest("hex").slice(0,12)}`}function Im(e,r=process.env){let t=Cm(r.KYNVER_COMMAND_AUTH_PUBLIC_KEY);if(t.length>0)return t.find(o=>v_(o)===e)??null;let n=R_[e];return!n||e===Am&&!Pm(r)?null:sl(n)}var b_=/\[execution-mode:\s*(write|read[_-]?only)\s*\]/gi,S_=/<!--\s*harness-contract:\s*(\{[\s\S]*?\})\s*-->/gi;function Os(e){let r=typeof e.description=="string"?e.description:"",t=typeof e.executorRef=="string"?e.executorRef:"",o=[...r.matchAll(b_)].at(-1)?.[1]?.toLowerCase();if(o)return o==="write"?"write":"read_only";if(/(?:^|:)read[_-]?only(?:$|:)/i.test(t))return"read_only";for(let s of r.matchAll(S_))try{let i=JSON.parse(s[1]);if(i.readOnly===!0||i.executionMode==="read_only")return"read_only"}catch{}return"write"}var __=120,Om=["write","read_only","land_pr","verify_live"],E_=["agentOsId","attempt","exp","kind","leaseOwner","leaseToken","operationClass","repoIdentity","requestNonce","taskId","tenantId","v"];var C_=/^[a-z0-9.-]+(?::\d+)?(?:\/[A-Za-z0-9._~-]+){2,}$/;function Tm(e){let r=e.trim();if(!r||r.includes("\0")||/\s/.test(r))return null;let t,n,o=/^(?:[^@/:]+@)?([^/:]+):(?!\/\/)(.+)$/.exec(r);if(/^[a-z][a-z0-9+.-]*:\/\//i.test(r)){let a;try{a=new URL(r)}catch{return null}if(!["https:","http:","ssh:","git:","git+ssh:","ssh+git:"].includes(a.protocol))return null;t=a.port?`${a.hostname}:${a.port}`:a.hostname,n=decodeURIComponent(a.pathname)}else if(o&&!/^[A-Za-z]$/.test(o[1]))t=o[1],n=o[2];else return null;t=t.toLowerCase().replace(/\.$/,"");let s=n.replace(/\/+$/,"").replace(/\.git$/i,"").split("/").filter(Boolean);if(s.length<2||s.some(a=>a==="."||a===".."))return null;let i=`${t}/${s.join("/")}`;return C_.test(i)&&i.length<=512?i:null}function Nm(e){let r=e.task??{};return e.landPrDispatch===!0||r.executor==="land_pr"?"land_pr":r.executor==="verify_live"?"verify_live":Os(r)==="read_only"?"read_only":"write"}function P_(e){if(!e||typeof e!="object"||Array.isArray(e))return!1;let r=e;if(Object.keys(r).sort().join(",")!=="payload,publicKeyId,signature"||typeof r.signature!="string"||!r.signature||typeof r.publicKeyId!="string"||!r.publicKeyId)return!1;let t=r.payload;if(!t||typeof t!="object"||Array.isArray(t)||Object.keys(t).sort().join(",")!==[...E_].join(",")||t.v!==1||t.kind!=="dispatch_claim")return!1;for(let n of["tenantId","agentOsId","taskId","leaseOwner","leaseToken","repoIdentity","requestNonce"])if(typeof t[n]!="string"||!t[n])return!1;return!(typeof t.attempt!="number"||!Number.isInteger(t.attempt)||t.attempt<0||typeof t.exp!="number"||!Number.isFinite(t.exp)||!Om.includes(t.operationClass))}var A_=Buffer.from("302a300506032b6570032100","hex");function Dm(e,r,t=process.env,n=Math.floor(Date.now()/1e3)){if(!P_(e))return{ok:!1,code:"malformed",reason:"malformed dispatch claim authorization"};let o=e.payload;for(let a of Object.keys(r))if(o[a]!==r[a])return{ok:!1,code:"binding_mismatch",reason:`${a} mismatch`};if(o.exp<=n)return{ok:!1,code:"expired",reason:"authorization expired"};if(o.exp>n+__+60)return{ok:!1,code:"malformed",reason:"authorization lifetime exceeds the allowed window"};let s=Im(e.publicKeyId,t);if(!s)return{ok:!1,code:"unknown_key",reason:`no verification key for publicKeyId "${e.publicKeyId}"`};let i=Buffer.from(e.signature,"base64url");if(i.length!==64)return{ok:!1,code:"bad_signature",reason:"not a 64-byte Ed25519 signature"};try{let a=w_({key:Buffer.concat([A_,Buffer.from(s)]),format:"der",type:"spki"});return x_(null,Buffer.from(ol(o),"utf8"),a,i)?{ok:!0,payload:o}:{ok:!1,code:"bad_signature",reason:"Ed25519 signature mismatch"}}catch(a){return{ok:!1,code:"bad_signature",reason:`signature verification failed: ${a.message}`}}}O();var il=class{constructor(r=4096){this.capacity=r}capacity;order=[];keys=new Set;consume(r){if(this.keys.has(r))return!1;for(this.keys.add(r),this.order.push(r);this.order.length>this.capacity;)this.keys.delete(this.order.shift());return!0}};function T_(e){let r=(c,u)=>({allow:!1,code:c,reason:u}),{policy:t,identity:n}=e;if(!n)return r("no_identity","the desktop runtime has not been prepared");if(!t)return r("no_policy","no approved execution policy on this computer");if(t.accountId!==n.accountId||t.agentOsId!==n.agentOsId)return r("policy_mismatch","the approved policy is for another account or workspace");if(!e.repoIdentity)return r("repo_identity_unavailable","the repository has no canonical remote identity");if(t.repoIdentity!==e.repoIdentity)return r("policy_mismatch","the approved policy is for another repository");let o=e.decision.claimAuthorization;if(o==null||!e.requestNonce)return r("missing_authorization","the claim carries no server authorization; the Kynver server must sign Desktop claims (KYNVER_COMMAND_AUTH_KEY, dispatch-claim-authorization diagnostic) and this runtime must be 0.2.87 or newer");let s=e.decision.task??{},i=Nm(e.decision),a=Dm(o,{tenantId:n.accountId,agentOsId:n.agentOsId,taskId:typeof s.id=="string"?s.id:"",attempt:typeof s.attempt=="number"?s.attempt:-1,leaseOwner:e.leaseOwner,leaseToken:typeof s.leaseToken=="string"?s.leaseToken:"",operationClass:i,repoIdentity:e.repoIdentity,requestNonce:e.requestNonce},e.env??process.env,e.nowSec);if(!a.ok)return r(a.code,a.reason);let l=a.payload;return e.consumed.consume(`${l.taskId}\0${l.leaseToken}\0${l.requestNonce}`)?t.approvedOperationClasses.includes(i)?{allow:!0,operationClass:i}:{allow:!1,code:"operation_not_approved",reason:`${i} work in ${t.repoIdentity} has not been approved on this computer`,consentRequired:{repoIdentity:t.repoIdentity,operationClass:i}}:r("replayed","this claim authorization was already used")}var N_=null,D_=null,M_=new il,W_=new Set;function Mm(){return vs()}function Wm(e){return{v:1,repoIdentity:e,requestNonce:O_(16).toString("base64url")}}function Lm(e){let r=I_("git",["-C",e,"remote","get-url","origin"],ae({encoding:"utf8",timeout:1e4}));return r.status!==0||typeof r.stdout!="string"?null:Tm(r.stdout.trim())}function Bm(e){let r=T_({...e,policy:N_,identity:D_,consumed:M_});if(!r.allow){let t=e.decision.task??{},n={taskId:typeof t.id=="string"?t.id:"",code:r.code,reason:r.reason,...r.consentRequired?{consentRequired:r.consentRequired}:{}};for(let o of W_)try{o(n)}catch{}}return r}function Um(){let e=Number(process.env.KYNVER_DISPATCH_CALLBACK_TIMEOUT_MS);return Number.isFinite(e)&&e>0?Math.floor(e):3e5}function zn(e){console.error(JSON.stringify({event:"dispatch_progress",ts:new Date().toISOString(),...e}))}function Fm(e){if(!e||typeof e!="object")return!1;let r=e;if(r.timeout===!0||r.timeoutMs!==void 0)return!0;let t=r.error;if(typeof t!="string"||!t.trim())return!1;let n=t.toLowerCase();return n.includes("abort")||n.includes("timeout")}function al(e){if(!e||typeof e!="object")return!1;let r=e;return r.timeout===!0?!0:(typeof r.error=="string"?r.error.toLowerCase():"").includes("timeout")}var L_=["implementation","review","landing"],B_=["plan_author","implementer","report_reviewer","deep_reviewer","runtime_verifier","system"];function U_(e){return L_.includes(e)}function F_(e){return B_.includes(e)}function Km(e){return{slug:e.slug,displayName:e.displayName,description:e.description,dispatchLane:e.dispatchLane===null||U_(e.dispatchLane)?e.dispatchLane:null,defaultRoleLane:F_(e.defaultRoleLane)?e.defaultRoleLane:"implementer"}}var Hm=Tt.personas.map(Km),K_=new Map(Hm.map(e=>[e.slug,e]));function H_(e){if(!e)return null;let r=e.trim().toLowerCase(),t=K_.get(r)??null,n=Xu(r);if(!n)return t;let o=Km(n);return t?{...o,dispatchLane:t.dispatchLane,defaultRoleLane:t.defaultRoleLane}:o}function ll(e){return H_(e)?.defaultRoleLane??null}function $m(){return Hm.filter(e=>e.dispatchLane==="review").map(e=>e.slug)}function jm(e){return(e??"").trim().toLowerCase()}function $_(e){switch(jm(e)){case"implementer":case"repair_implementer":case"plan_author":case"runtime_verifier":return"implementation";case"plan_reviewer":case"report_reviewer":case"deep_reviewer":return"review";default:return null}}function j_(e){let r=jm(e);if(!r)return;if(r==="implementation"||r==="review"||r==="landing"||r==="any")return r;let t=$_(r);if(t)return t;if(r==="implement"||r==="repair"||r==="coding")return"implementation";if(r==="land"||r==="merge")return"landing"}function Vm(e){return j_(e)??"any"}Tn();H();We();function V_(e=process.env){let r=U();return br(r,e)!=="forge"}function Ts(e,r=process.env){if(V_(r))return e?.maxConcurrentWorkers??void 0}async function Ns(e,r){let t=Q(r.baseUrl?String(r.baseUrl):void 0),n=await ee(r.secret?String(r.secret):void 0,e,{baseUrl:t}),o=`${t}/api/agent-os/by-id/${encodeURIComponent(e)}/runtime`;try{let s=await tl(o,n);if(!s.ok)return null;let a=s.response?.preferences?.maxConcurrentWorkers;if(a==null)return{maxConcurrentWorkers:null};let l=Number(a);return!Number.isFinite(l)||l<=0?{maxConcurrentWorkers:null}:{maxConcurrentWorkers:Math.floor(l)}}catch{return null}}jt();var G_={fetchPreferences:Ns,configuredOverride:Ts,observe:Hn};async function Gm(e,r=G_){let t=await r.fetchPreferences(e.agentOsId,e.args),n=r.configuredOverride(t,e.env);return r.observe({runId:e.runId,configuredMaxWorkersOverride:n})}jt();B();B();function Ds(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function cl(e){return e.toLowerCase()}function Y_(e){let r=Ds(e,"roleLane");if(r)return r;let t=cl(Ds(e,"executorRef")),n=cl(Ds(e,"title")),o=cl(Ds(e,"personaSlug")),s=`${t} ${n}`;if(s.includes("deep review")||s.includes("security review")||t.includes("deep-reviewer"))return"deep_reviewer";if(s.includes("plan author")||s.includes("plan-author")||n.includes("strategy plan"))return"plan_author";if(s.includes("plan review")||t.includes("plan-reviewer"))return"plan_reviewer";if(s.includes("report review")||s.includes("completion report"))return"report_reviewer";if(s.includes("repair")||n.startsWith("fix ")||t.includes("repair"))return"repair_implementer";if(t.includes("cursor")||t.includes("codex")||t.includes("composer")||n.includes("implement")||n.includes("land:"))return"implementer";let i=ll(o);if(i)return o==="lorentz"&&(s.includes("deep")||s.includes("security"))?"deep_reviewer":i;if(s.includes("review"))return"report_reviewer"}function Ym(e){let r=Y_(e);return r?{...e,roleLane:r}:e}H();var q_=/^claude[-_]/i,J_=/^(?:opus|sonnet|haiku)\b/i;function qm(e){let r=e.trim();return q_.test(r)||J_.test(r)}function Jm(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function ul(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function zm(e){return e.trim().toLowerCase().startsWith("gemini-")}function z_(e){return Jm(e)?"codex":qm(e)?"claude":zm(e)?"gemini":(ul(e),"cursor")}function X_(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:o,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:o,rule:o?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function Q_(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?qm(n)||Jm(n)||ul(n)||zm(n)?{lane:t,model:n,provider:z_(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function Ue(e){let r=typeof e=="string"?e.trim():"";return r?X_(r)??Q_(r):null}function Xm(e){let r=Ue(e);return r?!!(r.provider&&r.provider!=="cursor"||r.model&&!ul(r.model)):!1}_s();_s();var Ir="cursor",Z_=new Set(["claude","opus","anthropic"]),eE=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function Xn(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Ar(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Z_.has(r)?!0:r.includes("claude")||r.includes("opus")}function Ms(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&Ar(r))return!0;let t=Xn(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=Ue(Xn(e,"executorRef"));if(n?.provider&&Ar(n.provider)||n?.model&&Ar(rE(n.model)))return!0;let o=Xn(e,"description");if(eE.some(i=>i.test(o)))return!0;let s=Xn(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function rE(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function tE(e,r){return{provider:Ir,model:Ws,rule:`policy:cursor_default${r}`,requestedModel:e}}var nE=["explicit:","executor_ref:","factory:","task:"];function oE(e){return nE.some(r=>e.startsWith(r))}function dl(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||Ue(Xn(e,"executorRef"))?.provider?!0:Ms(e)}function Qm(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&Ar(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||oE(r.rule)||dl(t)||!Ar(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return tE(r.model,o)}function Zm(e,r=Ir){let t=e?.trim();return t?ar(t):r}var ef={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function Jt(e){return ef[e]}function rf(){return Object.values(ef)}import{existsSync as iE}from"node:fs";import{homedir as aE}from"node:os";import Qn from"node:path";Rr();import{createHash as tf}from"node:crypto";import{statSync as sE}from"node:fs";import{spawnSync as nf}from"node:child_process";function lr(e){try{let r=sE(e),t=`${e}|${r.size}|${r.mtimeMs}`;return tf("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function zt(e){return tf("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function Fe(e,r){for(let t of r){let n=process.env[t]?.trim();if(n)return n}return e}function er(e,r,t={}){let n=t.timeoutMs??8e3;try{let[o,s]=pe(e,r),i=nf(o,s,{windowsHide:!0,encoding:"utf8",timeout:n,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(i.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let a=(i.stderr||i.stdout||"").trim(),l=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:a?`${l}: ${a.slice(0,200)}`:l}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} probe failed`}}}function Ls(e,r,t={}){let n=t.timeoutMs??8e3;try{let[o,s]=pe(e,r);return nf(o,s,{windowsHide:!0,stdio:"ignore",timeout:n,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} auth probe failed`}}}var lE="codex";function cE(){let e=aE();return[process.env.CODEX_HOME?.trim()?Qn.join(Qn.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,Qn.join(e,".codex","auth.json"),Qn.join(e,".config","codex","auth.json")].filter(t=>!!t)}function uE(e){return Qn.dirname(e)}function dE(e){let r,t;for(let n of cE()){if(!iE(n))continue;r??=n;let o=er(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:uE(n)}});if(t??=o,o.ok)return{authPath:n,login:o}}return{authPath:r,login:t??er(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function of(e=new Date().toISOString()){let r=Fe(lE,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:zt("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:n}=dE(r),o=!!t&&n.ok;return{providerId:"codex",ready:o,authSource:"oauth_local",sessionFingerprint:t?lr(t):void 0,checkedAt:e,note:o?"Local Codex OAuth session bound on runner":[n.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as pE}from"node:fs";import{homedir as mE}from"node:os";import pl from"node:path";function fE(){let e=process.env.HERMES_HOME?.trim(),r=e?pl.resolve(e):pl.join(mE(),".hermes");return pl.join(r,"auth.json")}function Bs(e=new Date().toISOString()){let r=Fe("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=er(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=fE(),o=pE(n),s=Ls(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),i=t.ok&&s.ok;return{path:"hermes_openai_codex",ready:i,authSource:i?"subscription_hermes":"none",sessionFingerprint:o?lr(n):void 0,checkedAt:e,note:i?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,s.note,o?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function Xt(e=new Date().toISOString()){let r=of(e);if(r.ready)return{...r,path:"codex_cli"};let t=Bs(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}var sf=["low","medium","high"],af={oauth_local:0,subscription_hermes:0,runner_token:1,api_key_env:2,none:3};function lf(e,r){let t=Jt(e);return r==="privileged"?t.supportsPrivilegedPlatformActions:r==="low"?t.supportsLowRiskOrchestration:!0}function gE(e,r){let t=Jt(e.providerId),n=Jt(r.providerId),o=sf.indexOf(t.costTier)-sf.indexOf(n.costTier);if(o!==0)return o;let s=af[e.binding.authSource]-af[r.binding.authSource];return s!==0?s:e.providerId.localeCompare(r.providerId)}function ml(e){let r=rf().map(a=>({providerId:a.id,binding:e.inventory.bindings[a.id]})).filter(a=>a.binding.ready&&lf(a.providerId,e.riskClass));if(r.length===0)return null;let n=[...r].sort(gE)[0],o="codex";if(n.providerId===o)return{providerId:n.providerId,binding:n.binding};let s=e.inventory.bindings[o],i;return lf(o,e.riskClass)?s.ready||(i=s.note??`${o} not bound`):i=`${e.riskClass} orchestration requires privileged-capable provider`,{providerId:n.providerId,binding:n.binding,escalatedFrom:o,escalatedReason:i}}import{existsSync as hE}from"node:fs";import{homedir as kE}from"node:os";import yE from"node:path";var RE="claude";function vE(){let e=kE();return[yE.join(e,".claude",".credentials.json")]}function cf(e=new Date().toISOString()){let r=Fe(RE,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:zt("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=er(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=vE().find(i=>hE(i)),o=Ls(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),s=t.ok&&(o.ok||!!n);return{providerId:"claude",ready:s,authSource:"oauth_local",sessionFingerprint:n?lr(n):void 0,checkedAt:e,note:s?"Local Claude Code OAuth session bound on runner":[t.note,o.note,n?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as VE}from"node:fs";import{homedir as jE}from"node:os";import en from"node:path";wr();O();import{closeSync as yl,existsSync as ff,mkdirSync as OE,openSync as Rl,statSync as TE,unlinkSync as pf}from"node:fs";import{spawn as NE}from"node:child_process";import DE from"node:os";import cr from"node:path";sa();var bE="KYNVER_NO_PROD_DB_CREDENTIALS",SE=["KYNVER_ENV_FILE"];function Ke(e,r={}){let t=oa(e);if(!r.reviewWorker)return t;let n={...t,[bE]:"1"};for(let o of SE)delete n[o];return n}var wE=/-(?:thinking(?:-(?:high|medium|low|minimal|max|none))?|high|medium|low|minimal)$/i;function uf(e){return e.replace(wE,"")}var df=/^(?:gpt-|gpt5|o1|o3|o4|gemini-|grok-|composer|deepseek|llama|mistral|qwen|command-)/i;function Us(e){return/^claude[-_]/i.test(e)||/^(?:opus|sonnet|haiku)\b/i.test(e)}function xE(e){let r=e.trim().toLowerCase();return r.startsWith("gemini-")||r==="auto"||r==="pro"||r==="flash"||r==="flash-lite"}var _E=new Set(["cursor"]);function EE(e){let r=e.trim().toLowerCase();return _E.has(r)?"auto":null}function fl(e,r){let t=(e??"").trim();if(!t)return{ok:!0,model:r,normalized:!1};let o=uf(t).trim()||r;return df.test(o)||!Us(o)&&o!==r?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is not a Claude model \u2014 the "claude" provider drives the Claude CLI, which only accepts claude-* model ids (got "${o}"). Pick a Claude model or switch the worker provider.`}:o!==t?{ok:!0,model:o,normalized:!0,requested:t,note:`normalized model "${t}" \u2192 "${o}" (the Claude CLI rejects reasoning-effort suffixes)`}:{ok:!0,model:o,normalized:!1}}function Qt(e,r){let t=(e??"").trim();return t?Us(t)?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is a Claude model but the worker provider is "codex". Switch the provider or pick a Codex/OpenAI model.`}:{ok:!0,model:t,normalized:!1}:{ok:!0,model:r,normalized:!1}}function gl(e,r){let t=(e??"").trim();if(t)return{ok:!0,model:t,normalized:!1};let n=(r??"").trim();return n?{ok:!0,model:n,normalized:!1}:{ok:!1,model:"",normalized:!1,note:'the "openai-compatible" provider has no universal default model \u2014 pass --model (any id your endpoint serves, e.g. llama3.1, qwen2.5-coder, gpt-4o-mini) or set KYNVER_WORKER_MODEL on the daemon host.'}}function Zt(e,r){let t=(e??"").trim();if(!t)return{ok:!0,model:r,normalized:!1};let o=uf(t).trim()||r;return Us(o)||!xE(o)&&df.test(o)?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is not a Gemini model \u2014 the gemini / gemini-api providers drive Google Gemini (got "${o}"). Pick a gemini-* model or an alias (auto, pro, flash, flash-lite), or switch the worker provider.`}:o!==t?{ok:!0,model:o,normalized:!0,requested:t,note:`normalized model "${t}" \u2192 "${o}"`}:{ok:!0,model:o,normalized:!1}}function hl(e,r){let t=(e??"").trim();if(!t)return{ok:!0,model:r,normalized:!1};let n=EE(t);return n?{ok:!0,model:n,normalized:!0,requested:t,note:`normalized model "${t}" \u2192 "${n}" (Cursor provider alias \u2014 use "auto" or a composer id, not "cursor")`}:Us(t)?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is a Claude model but the worker provider is "cursor". Switch the provider to "claude" or pick a Cursor model.`}:{ok:!0,model:t,normalized:!1}}import{existsSync as Zn,readdirSync as CE}from"node:fs";import gt from"node:path";var PE=/^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;function AE(e){let t=e.split("-")[0].split(".");if(t.length!==3)return null;let[n,o,s]=t;return!n||!o||!s?null:+`${n}${o.padStart(2,"0")}${s.padStart(2,"0")}`}function IE(e){let r=gt.join(e,"versions");if(!Zn(r))return null;let t=null,n=-1;for(let o of CE(r,{withFileTypes:!0})){if(!o.isDirectory()||!PE.test(o.name))continue;let s=AE(o.name);s==null||s<=n||(n=s,t=gt.join(r,o.name))}return t}function Fs(e){let r=e?.trim()||gt.join(process.env.LOCALAPPDATA||"","cursor-agent"),t=gt.join(r,"node.exe"),n=gt.join(r,"index.js");if(Zn(t)&&Zn(n))return{nodeExe:t,indexJs:n,versionDir:r};let o=IE(r);if(!o)return null;let s=gt.join(o,"node.exe"),i=gt.join(o,"index.js");return!Zn(s)||!Zn(i)?null:{nodeExe:s,indexJs:i,versionDir:o}}var kl="composer-2.5",ME=15e3,WE=6e4,LE=3e4;function BE(e,r,t){return{executable:e,prefixArgs:[r],shell:!1,detached:ce(),bundledVersionDir:t}}function bl(e){if(process.platform==="win32"){let r=/\.(cmd|bat)$/i.test(e),t=/node\.exe$/i.test(e)&&ff(cr.join(cr.dirname(e),"index.js"));if(r||t||e==="agent"){let o=r?Fs(cr.dirname(e)):t?{nodeExe:e,indexJs:cr.join(cr.dirname(e),"index.js"),versionDir:cr.dirname(e)}:Fs();if(o)return BE(o.nodeExe,o.indexJs,o.versionDir);throw new Error("Cursor Agent on Windows has no headless bundled node.exe under %LOCALAPPDATA%\\cursor-agent\\versions\\\u2026. Run `agent login` / update Cursor Agent CLI, use `--provider claude`, or set KYNVER_CURSOR_AGENT_ROOT to the cursor-agent folder.")}}return{executable:e,prefixArgs:[],shell:!1,detached:ce()}}function UE(e,r,t){return Ke({...process.env,CI:"1",NO_COLOR:"1",...r.bundledVersionDir?{CURSOR_INVOKED_AS:cr.basename(e)||"agent.cmd"}:{}},{reviewWorker:t})}function gf(e){e<=0||Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,e)}function vl(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)&&n>=0?Math.floor(n):r}function FE(){let e=process.env.KYNVER_CURSOR_START_LOCK_DIR?.trim()||cr.join(DE.homedir(),".kynver","locks");return OE(e,{recursive:!0}),cr.join(e,"cursor-agent-start.lock")}function KE(){if(process.env.KYNVER_CURSOR_START_LOCK==="0")return()=>{};let e=FE(),r=vl("KYNVER_CURSOR_START_LOCK_TIMEOUT_MS",WE),t=vl("KYNVER_CURSOR_START_LOCK_STALE_MS",LE),n=Date.now();for(;;)try{let o=Rl(e,"wx");return yl(o),()=>{try{pf(e)}catch{}}}catch(o){if(o.code!=="EEXIST")throw o;try{if(Date.now()-TE(e).mtimeMs>t){pf(e);continue}}catch{continue}if(Date.now()-n>r)throw new Error(`timed out waiting for Cursor agent start lock: ${e}`);gf(250)}}function hf(e=process.env){let r=e.KYNVER_CURSOR_AGENT_BIN?.trim()||e.CURSOR_AGENT_BIN?.trim();if(r)return r;if(process.platform==="win32"){let t=Fs(e.KYNVER_CURSOR_AGENT_ROOT?.trim()||void 0);if(t)return t.nodeExe;let n=cr.join(e.LOCALAPPDATA||"","cursor-agent","agent.cmd");if(ff(n))return n}return"agent"}function HE(){return hf(process.env)}var kf={name:"cursor",defaultModel:kl,preflightModel(e){return hl(e,kl)},start(e){let r=hl(e.model,kl);if(!r.ok)throw new Error(`cursor provider model preflight failed: ${r.note}`);let t=r.model,n=Rl(e.stdoutPath,"a"),o=Rl(e.stderrPath,"a"),s=["ignore",n,o],i=HE(),a=bl(i),l=KE(),c;try{let[u,d]=a.shell?[a.executable,mf(e,t,a.prefixArgs)]:Pe(a.executable,mf(e,t,a.prefixArgs),e.workerDir);c=NE(u,d,ae({cwd:e.worktreePath,detached:a.detached,shell:a.shell,stdio:s,env:UE(i,a,e.reviewWorker)})),gf(vl("KYNVER_CURSOR_START_LOCK_HOLD_MS",ME))}finally{l(),yl(n),yl(o)}if(!c.pid)throw new Error(`failed to spawn Cursor agent worker (is \`${i}\` on PATH? run \`agent login\` or set CURSOR_API_KEY)`);return c.unref(),{pid:c.pid,model:t}}};function mf(e,r,t=[]){return[...t,"-p",...e.executionMode==="read_only"?["--mode","plan"]:["--force"],...e.mcpConfigPath?["--approve-mcps"]:[],"--trust","--workspace",e.worktreePath,"--output-format","stream-json","--stream-partial-output","--model",r,e.prompt]}import{spawnSync as $E}from"node:child_process";function Sl(e,r=process.env){try{let t;try{t=bl(e)}catch{t={executable:e,prefixArgs:[]}}let n=$E(t.executable,[...t.prefixArgs,"status","--format","json"],{encoding:"utf8",windowsHide:!0,timeout:8e3,env:{...r,CI:"1",NO_COLOR:"1"}});if(n.status!==0)return{ok:!1,note:"agent status: not authenticated"};let o=(n.stdout||"").trim();if(!o)return{ok:!1,note:"agent status: empty response"};let s;try{s=JSON.parse(o)}catch{return{ok:!1,note:"agent status: unparseable response"}}return typeof s=="object"&&s!==null&&s.isAuthenticated===!0?{ok:!0,note:"agent status: authenticated"}:{ok:!1,note:"agent status: not authenticated"}}catch(t){return{ok:!1,note:t instanceof Error?t.message:"agent status probe failed"}}}function wl(e=process.env){let r=[],t=e.KYNVER_CURSOR_AUTH_HOME?.trim();t&&(r.push(en.join(t,".config","cursor","auth.json")),r.push(en.join(t,".cursor-agent","auth.json")));let n=jE();if(r.push(en.join(n,".config","cursor","auth.json")),r.push(en.join(n,".cursor-agent","auth.json")),process.platform==="win32"){let o=e.LOCALAPPDATA?.trim(),s=e.APPDATA?.trim();o&&r.push(en.join(o,"cursor-agent","auth.json")),s&&r.push(en.join(s,"cursor","auth.json"))}return r}var GE="agent";function yf(e=new Date().toISOString()){let r=Fe(GE,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:zt("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=er(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=wl().find(a=>VE(a)),o=Sl(r),s=!!n||o.ok,i=t.ok&&s;return{providerId:"cursor",ready:i,authSource:"oauth_local",sessionFingerprint:n?lr(n):void 0,checkedAt:e,note:i?"Local Cursor/Composer OAuth session bound on runner":[t.note,s?void 0:o.note??"no ~/.config/cursor/auth.json or `agent login` session"].filter(Boolean).join("; ")}}import{existsSync as YE,readFileSync as qE}from"node:fs";import{homedir as JE}from"node:os";import xl from"node:path";var zE=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function XE(){let e=process.env.HERMES_HOME?.trim(),r=e?xl.resolve(e):xl.join(JE(),".hermes");return xl.join(r,".env")}function QE(e){try{let r=qE(e,"utf8"),t=[];for(let n of zE)new RegExp(`^${n}=`,"m").test(r)&&t.push(n);return t}catch{return[]}}function Rf(e=new Date().toISOString()){let r=Fe("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=er(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=XE(),o=YE(n),s=o?QE(n):[],a=s.some(c=>c.endsWith("_API_KEY"))?"api_key_env":o?"oauth_local":"none",l=t.ok&&o;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:o,authSource:a,sessionFingerprint:o?lr(n):void 0,checkedAt:e,note:l?`Hermes profile bound (${s.length?`keys: ${s.join(", ")}`:"no API keys detected"})`:[t.note,o?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function vf(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=Xt(r),n={codex:t,cursor:yf(r),claude:cf(r)},o=Object.values(n).filter(s=>s.ready).length;return{generatedAt:r,bindings:n,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:Rf(r),hermesOpenAiCodex:Bs(r),codexAdapterPath:t.path,readyCount:o}}var ZE=[/\bprivileged\b/i,/\bproduction\s+db\b/i,/\bdb:push\b/i,/\bmigration\b/i,/\bdeploy\b/i,/\bsecrets?\b/i,/\bstripe\b/i,/\[require-approval\]/i,/\[operator-only\]/i],eC=[/\borchestration\b/i,/\bplan[- ]?progress\b/i,/\bstatus\s+sync\b/i,/\bheartbeat\b/i,/\bboard[- ]?drain\b/i,/\bmaintenance\b/i,/\[orchestration:\s*low-risk\]/i];function _l(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function rC(e){let r=_l(e,"executorRef").toLowerCase(),t=_l(e,"title").toLowerCase(),n=_l(e,"description").toLowerCase(),o=`${r}
+`)},Ib={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},Tt={version:Cb,generatedAt:"1970-01-01T00:00:00.000Z",personas:Pb,instructions:Ab,policyThresholds:Ib};var bn=Tt,Ob="embedded";function Ju(){return bn.version}function zu(e,r){bn=e,Ob=r}function Sn(e){let r=bn.instructions[e];if(typeof r=="string"&&r.trim())return r;let t=Tt.instructions[e];return typeof t=="string"?t:""}function Zi(e,r){let t=bn.policyThresholds[e];if(typeof t=="number"&&Number.isFinite(t))return t;let n=Tt.policyThresholds[e];return typeof n=="number"&&Number.isFinite(n)?n:r}function Xu(e){if(!e)return null;let r=e.trim().toLowerCase();return bn.personas.find(t=>t.slug===r)??null}xn();import kb from"node:path";B();cs();O();import h_ from"node:path";function k_(e){let r=Array.isArray(e.ownedPaths)?e.ownedPaths.filter(n=>typeof n=="string"):[],t=Array.isArray(e.writeSetPrefixes)?(e.writeSetPrefixes??[]).filter(n=>typeof n=="string"):[];return{...r.length?{ownedPaths:r}:{},...t.length?{writeSetPrefixes:t}:{},...e.allowConcurrentHotspot?{allowConcurrentHotspot:!0}:{}}}function Is(e){let r=q(e),t=[];for(let n of Object.keys(r.workers||{})){let o=I(h_.join(N(r.id),"workers",x(n),"worker.json"),void 0);!o?.taskId||!Yr(o)||t.push({runId:r.id,workerName:n,taskId:o.taskId,pid:o.pid,...k_(o)})}return t}H();function Jn(e){let r=String(e).trim();return r.startsWith("krc1.")?{"Content-Type":"application/json","X-Kynver-Runner-Token":r}:{"Content-Type":"application/json","X-Kynver-Cron-Secret":r,"X-OpenClaw-Cron-Secret":r,"X-Kynver-Runtime-Secret":r}}In();H();function xm(e){if(e!==void 0&&Number.isFinite(e)&&e>0)return Math.floor(e);let r=Number(process.env.KYNVER_CALLBACK_TIMEOUT_MS);return Number.isFinite(r)&&r>0?Math.floor(r):3e4}function wm(e){return new Error(`callback timeout after ${e}ms`)}async function _m(e,r){let t=xm(r),n=new AbortController,o,s=!1;try{return await Promise.race([e(n.signal),new Promise((i,a)=>{o=setTimeout(()=>{s=!0,n.abort(),a(wm(t))},t)})])}catch(i){throw s?wm(t):i}finally{o&&clearTimeout(o)}}function Em(e,r){let t=xm(r);return{ok:!1,status:0,response:{error:e instanceof Error?e.message:String(e),timeoutMs:t}}}async function ft(e,r,t,n){try{return await _m(async o=>{let s=await An(e,{method:"POST",headers:Jn(r),body:JSON.stringify(t),signal:o}),i=null;try{i=await s.json()}catch{i=null}return{ok:s.ok,status:s.status,response:i}},n?.timeoutMs)}catch(o){return Em(o,n?.timeoutMs)}}async function X(e,r,t,n){let o=await ft(e,r,t,{timeoutMs:n.timeoutMs});if(o.ok||o.status!==401)return o;let s=await Rm(r,n.agentOsId,{baseUrl:n.baseUrl});return s.ok?{...await ft(e,s.token,t,{timeoutMs:n.timeoutMs}),refreshedAuth:!0}:{...o,authRefreshFailure:s.reason}}async function tl(e,r,t){try{return await _m(async n=>{let o=await An(e,{method:"GET",headers:Jn(r),signal:n}),s=null;try{s=await o.json()}catch{s=null}return{ok:o.ok,status:o.status,response:s}},t?.timeoutMs)}catch(n){return Em(n,t?.timeoutMs)}}H();jn();import{spawnSync as I_}from"node:child_process";import{randomBytes as O_}from"node:crypto";import{createPublicKey as w_,verify as x_}from"node:crypto";import{createHash as y_,createPublicKey as eK,verify as rK}from"node:crypto";function ol(e){return JSON.stringify(nl(e))}function nl(e){if(Array.isArray(e))return e.map(nl);if(e&&typeof e=="object"){let r={};for(let t of Object.keys(e).sort())r[t]=nl(e[t]);return r}return e}function sl(e){if(!e)return null;let r=e.trim();if(!r)return null;if(/^[0-9a-fA-F]{64}$/.test(r))return new Uint8Array(r.match(/.{2}/g).map(t=>parseInt(t,16)));try{let t=Buffer.from(r,"base64");if(t.length===32)return new Uint8Array(t)}catch{}return null}function Cm(e){if(!e)return[];let r=[];for(let t of e.split(/[,\s]+/)){let n=sl(t);n&&r.push(n)}return r}function Pm(e=process.env){if(e.NODE_ENV==="production")return!1;let r=e.KYNVER_ALLOW_DEV_SIGNING_KEYS?.trim().toLowerCase();return r==="1"||r==="true"||r==="yes"||r==="on"?!0:e.NODE_ENV==="test"||e.VITEST==="true"}var nK=Buffer.from("302a300506032b6570032100","hex"),Am="ca-6297fb8e1773",R_={[Am]:"16ae5cb2a61f8c94cf1b86e8258f9c2f2ff6aba5e6136250a422209b6e866881","ca-456fd128f3b3":"f29cbd559410c2578d7f9732ccd86570073355ccdb36af0d1b7dff15908466e7","ca-fc6a2e593f40":"9c0d2fec00bdfce3a448d3fb1b9b9ecfe0dad587dd37f4de492ad9ca91f53def"};function v_(e){return`ca-${y_("sha256").update(Buffer.from(e)).digest("hex").slice(0,12)}`}function Im(e,r=process.env){let t=Cm(r.KYNVER_COMMAND_AUTH_PUBLIC_KEY);if(t.length>0)return t.find(o=>v_(o)===e)??null;let n=R_[e];return!n||e===Am&&!Pm(r)?null:sl(n)}var b_=/\[execution-mode:\s*(write|read[_-]?only)\s*\]/gi,S_=/<!--\s*harness-contract:\s*(\{[\s\S]*?\})\s*-->/gi;function Os(e){let r=typeof e.description=="string"?e.description:"",t=typeof e.executorRef=="string"?e.executorRef:"",o=[...r.matchAll(b_)].at(-1)?.[1]?.toLowerCase();if(o)return o==="write"?"write":"read_only";if(/(?:^|:)read[_-]?only(?:$|:)/i.test(t))return"read_only";for(let s of r.matchAll(S_))try{let i=JSON.parse(s[1]);if(i.readOnly===!0||i.executionMode==="read_only")return"read_only"}catch{}return"write"}var __=120,Om=["write","read_only","land_pr","verify_live"],E_=["agentOsId","attempt","exp","kind","leaseOwner","leaseToken","operationClass","repoIdentity","requestNonce","taskId","tenantId","v"];var C_=/^[a-z0-9.-]+(?::\d+)?(?:\/[A-Za-z0-9._~-]+){2,}$/;function Tm(e){let r=e.trim();if(!r||r.includes("\0")||/\s/.test(r))return null;let t,n,o=/^(?:[^@/:]+@)?([^/:]+):(?!\/\/)(.+)$/.exec(r);if(/^[a-z][a-z0-9+.-]*:\/\//i.test(r)){let a;try{a=new URL(r)}catch{return null}if(!["https:","http:","ssh:","git:","git+ssh:","ssh+git:"].includes(a.protocol))return null;t=a.port?`${a.hostname}:${a.port}`:a.hostname,n=decodeURIComponent(a.pathname)}else if(o&&!/^[A-Za-z]$/.test(o[1]))t=o[1],n=o[2];else return null;t=t.toLowerCase().replace(/\.$/,"");let s=n.replace(/\/+$/,"").replace(/\.git$/i,"").split("/").filter(Boolean);if(s.length<2||s.some(a=>a==="."||a===".."))return null;let i=`${t}/${s.join("/")}`;return C_.test(i)&&i.length<=512?i:null}function Nm(e){let r=e.task??{};return e.landPrDispatch===!0||r.executor==="land_pr"?"land_pr":r.executor==="verify_live"?"verify_live":Os(r)==="read_only"?"read_only":"write"}function P_(e){if(!e||typeof e!="object"||Array.isArray(e))return!1;let r=e;if(Object.keys(r).sort().join(",")!=="payload,publicKeyId,signature"||typeof r.signature!="string"||!r.signature||typeof r.publicKeyId!="string"||!r.publicKeyId)return!1;let t=r.payload;if(!t||typeof t!="object"||Array.isArray(t)||Object.keys(t).sort().join(",")!==[...E_].join(",")||t.v!==1||t.kind!=="dispatch_claim")return!1;for(let n of["tenantId","agentOsId","taskId","leaseOwner","leaseToken","repoIdentity","requestNonce"])if(typeof t[n]!="string"||!t[n])return!1;return!(typeof t.attempt!="number"||!Number.isInteger(t.attempt)||t.attempt<0||typeof t.exp!="number"||!Number.isFinite(t.exp)||!Om.includes(t.operationClass))}var A_=Buffer.from("302a300506032b6570032100","hex");function Dm(e,r,t=process.env,n=Math.floor(Date.now()/1e3)){if(!P_(e))return{ok:!1,code:"malformed",reason:"malformed dispatch claim authorization"};let o=e.payload;for(let a of Object.keys(r))if(o[a]!==r[a])return{ok:!1,code:"binding_mismatch",reason:`${a} mismatch`};if(o.exp<=n)return{ok:!1,code:"expired",reason:"authorization expired"};if(o.exp>n+__+60)return{ok:!1,code:"malformed",reason:"authorization lifetime exceeds the allowed window"};let s=Im(e.publicKeyId,t);if(!s)return{ok:!1,code:"unknown_key",reason:`no verification key for publicKeyId "${e.publicKeyId}"`};let i=Buffer.from(e.signature,"base64url");if(i.length!==64)return{ok:!1,code:"bad_signature",reason:"not a 64-byte Ed25519 signature"};try{let a=w_({key:Buffer.concat([A_,Buffer.from(s)]),format:"der",type:"spki"});return x_(null,Buffer.from(ol(o),"utf8"),a,i)?{ok:!0,payload:o}:{ok:!1,code:"bad_signature",reason:"Ed25519 signature mismatch"}}catch(a){return{ok:!1,code:"bad_signature",reason:`signature verification failed: ${a.message}`}}}O();var il=class{constructor(r=4096){this.capacity=r}capacity;order=[];keys=new Set;consume(r){if(this.keys.has(r))return!1;for(this.keys.add(r),this.order.push(r);this.order.length>this.capacity;)this.keys.delete(this.order.shift());return!0}};function T_(e){let r=(c,u)=>({allow:!1,code:c,reason:u}),{policy:t,identity:n}=e;if(!n)return r("no_identity","the desktop runtime has not been prepared");if(!t)return r("no_policy","no approved execution policy on this computer");if(t.accountId!==n.accountId||t.agentOsId!==n.agentOsId)return r("policy_mismatch","the approved policy is for another account or workspace");if(!e.repoIdentity)return r("repo_identity_unavailable","the repository has no canonical remote identity");if(t.repoIdentity!==e.repoIdentity)return r("policy_mismatch","the approved policy is for another repository");let o=e.decision.claimAuthorization;if(o==null||!e.requestNonce)return r("missing_authorization","the claim carries no server authorization; the Kynver server must sign Desktop claims (KYNVER_COMMAND_AUTH_KEY, dispatch-claim-authorization diagnostic) and this runtime must be 0.2.87 or newer");let s=e.decision.task??{},i=Nm(e.decision),a=Dm(o,{tenantId:n.accountId,agentOsId:n.agentOsId,taskId:typeof s.id=="string"?s.id:"",attempt:typeof s.attempt=="number"?s.attempt:-1,leaseOwner:e.leaseOwner,leaseToken:typeof s.leaseToken=="string"?s.leaseToken:"",operationClass:i,repoIdentity:e.repoIdentity,requestNonce:e.requestNonce},e.env??process.env,e.nowSec);if(!a.ok)return r(a.code,a.reason);let l=a.payload;return e.consumed.consume(`${l.taskId}\0${l.leaseToken}\0${l.requestNonce}`)?t.approvedOperationClasses.includes(i)?{allow:!0,operationClass:i}:{allow:!1,code:"operation_not_approved",reason:`${i} work in ${t.repoIdentity} has not been approved on this computer`,consentRequired:{repoIdentity:t.repoIdentity,operationClass:i}}:r("replayed","this claim authorization was already used")}var N_=null,D_=null,M_=new il,W_=new Set;function Mm(){return vs()}function Wm(e){return{v:1,repoIdentity:e,requestNonce:O_(16).toString("base64url")}}function Lm(e){let r=I_("git",["-C",e,"remote","get-url","origin"],ae({encoding:"utf8",timeout:1e4}));return r.status!==0||typeof r.stdout!="string"?null:Tm(r.stdout.trim())}function Bm(e){let r=T_({...e,policy:N_,identity:D_,consumed:M_});if(!r.allow){let t=e.decision.task??{},n={taskId:typeof t.id=="string"?t.id:"",code:r.code,reason:r.reason,...r.consentRequired?{consentRequired:r.consentRequired}:{}};for(let o of W_)try{o(n)}catch{}}return r}function Um(){let e=Number(process.env.KYNVER_DISPATCH_CALLBACK_TIMEOUT_MS);return Number.isFinite(e)&&e>0?Math.floor(e):3e5}function zn(e){console.error(JSON.stringify({event:"dispatch_progress",ts:new Date().toISOString(),...e}))}function Fm(e){if(!e||typeof e!="object")return!1;let r=e;if(r.timeout===!0||r.timeoutMs!==void 0)return!0;let t=r.error;if(typeof t!="string"||!t.trim())return!1;let n=t.toLowerCase();return n.includes("abort")||n.includes("timeout")}function al(e){if(!e||typeof e!="object")return!1;let r=e;return r.timeout===!0?!0:(typeof r.error=="string"?r.error.toLowerCase():"").includes("timeout")}var L_=["implementation","review","landing"],B_=["plan_author","implementer","report_reviewer","deep_reviewer","runtime_verifier","system"];function U_(e){return L_.includes(e)}function F_(e){return B_.includes(e)}function Km(e){return{slug:e.slug,displayName:e.displayName,description:e.description,dispatchLane:e.dispatchLane===null||U_(e.dispatchLane)?e.dispatchLane:null,defaultRoleLane:F_(e.defaultRoleLane)?e.defaultRoleLane:"implementer"}}var Hm=Tt.personas.map(Km),K_=new Map(Hm.map(e=>[e.slug,e]));function H_(e){if(!e)return null;let r=e.trim().toLowerCase(),t=K_.get(r)??null,n=Xu(r);if(!n)return t;let o=Km(n);return t?{...o,dispatchLane:t.dispatchLane,defaultRoleLane:t.defaultRoleLane}:o}function ll(e){return H_(e)?.defaultRoleLane??null}function $m(){return Hm.filter(e=>e.dispatchLane==="review").map(e=>e.slug)}function jm(e){return(e??"").trim().toLowerCase()}function $_(e){switch(jm(e)){case"implementer":case"repair_implementer":case"plan_author":case"runtime_verifier":return"implementation";case"plan_reviewer":case"report_reviewer":case"deep_reviewer":return"review";default:return null}}function j_(e){let r=jm(e);if(!r)return;if(r==="implementation"||r==="review"||r==="landing"||r==="any")return r;let t=$_(r);if(t)return t;if(r==="implement"||r==="repair"||r==="coding")return"implementation";if(r==="land"||r==="merge")return"landing"}function Vm(e){return j_(e)??"any"}Tn();H();We();function V_(e=process.env){let r=U();return br(r,e)!=="forge"}function Ts(e,r=process.env){if(V_(r))return e?.maxConcurrentWorkers??void 0}async function Ns(e,r){let t=Q(r.baseUrl?String(r.baseUrl):void 0),n=await ee(r.secret?String(r.secret):void 0,e,{baseUrl:t}),o=`${t}/api/agent-os/by-id/${encodeURIComponent(e)}/runtime`;try{let s=await tl(o,n);if(!s.ok)return null;let a=s.response?.preferences?.maxConcurrentWorkers;if(a==null)return{maxConcurrentWorkers:null};let l=Number(a);return!Number.isFinite(l)||l<=0?{maxConcurrentWorkers:null}:{maxConcurrentWorkers:Math.floor(l)}}catch{return null}}jt();var G_={fetchPreferences:Ns,configuredOverride:Ts,observe:Hn};async function Gm(e,r=G_){let t=await r.fetchPreferences(e.agentOsId,e.args),n=r.configuredOverride(t,e.env);return r.observe({runId:e.runId,configuredMaxWorkersOverride:n})}jt();B();B();function Ds(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function cl(e){return e.toLowerCase()}function Y_(e){let r=Ds(e,"roleLane");if(r)return r;let t=cl(Ds(e,"executorRef")),n=cl(Ds(e,"title")),o=cl(Ds(e,"personaSlug")),s=`${t} ${n}`;if(s.includes("deep review")||s.includes("security review")||t.includes("deep-reviewer"))return"deep_reviewer";if(s.includes("plan author")||s.includes("plan-author")||n.includes("strategy plan"))return"plan_author";if(s.includes("plan review")||t.includes("plan-reviewer"))return"plan_reviewer";if(s.includes("report review")||s.includes("completion report"))return"report_reviewer";if(s.includes("repair")||n.startsWith("fix ")||t.includes("repair"))return"repair_implementer";if(t.includes("cursor")||t.includes("codex")||t.includes("composer")||n.includes("implement")||n.includes("land:"))return"implementer";let i=ll(o);if(i)return o==="lorentz"&&(s.includes("deep")||s.includes("security"))?"deep_reviewer":i;if(s.includes("review"))return"report_reviewer"}function Ym(e){let r=Y_(e);return r?{...e,roleLane:r}:e}H();var q_=/^claude[-_]/i,J_=/^(?:opus|sonnet|haiku)\b/i;function qm(e){let r=e.trim();return q_.test(r)||J_.test(r)}function Jm(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function ul(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function zm(e){return e.trim().toLowerCase().startsWith("gemini-")}function z_(e){return Jm(e)?"codex":qm(e)?"claude":zm(e)?"gemini":(ul(e),"cursor")}function X_(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:o,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:o,rule:o?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function Q_(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?qm(n)||Jm(n)||ul(n)||zm(n)?{lane:t,model:n,provider:z_(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function Ue(e){let r=typeof e=="string"?e.trim():"";return r?X_(r)??Q_(r):null}function Xm(e){let r=Ue(e);return r?!!(r.provider&&r.provider!=="cursor"||r.model&&!ul(r.model)):!1}_s();_s();var Ir="cursor",Z_=new Set(["claude","opus","anthropic"]),eE=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function Xn(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Ar(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Z_.has(r)?!0:r.includes("claude")||r.includes("opus")}function Ms(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&Ar(r))return!0;let t=Xn(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=Ue(Xn(e,"executorRef"));if(n?.provider&&Ar(n.provider)||n?.model&&Ar(rE(n.model)))return!0;let o=Xn(e,"description");if(eE.some(i=>i.test(o)))return!0;let s=Xn(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function rE(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function tE(e,r){return{provider:Ir,model:Ws,rule:`policy:cursor_default${r}`,requestedModel:e}}var nE=["explicit:","executor_ref:","factory:","task:"];function oE(e){return nE.some(r=>e.startsWith(r))}function dl(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||Ue(Xn(e,"executorRef"))?.provider?!0:Ms(e)}function Qm(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&Ar(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||oE(r.rule)||dl(t)||!Ar(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return tE(r.model,o)}function Zm(e,r=Ir){let t=e?.trim();return t?ar(t):r}var ef={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function Jt(e){return ef[e]}function rf(){return Object.values(ef)}import{existsSync as iE}from"node:fs";import{homedir as aE}from"node:os";import Qn from"node:path";Rr();import{createHash as tf}from"node:crypto";import{statSync as sE}from"node:fs";import{spawnSync as nf}from"node:child_process";function lr(e){try{let r=sE(e),t=`${e}|${r.size}|${r.mtimeMs}`;return tf("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function zt(e){return tf("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function Fe(e,r){for(let t of r){let n=process.env[t]?.trim();if(n)return n}return e}function er(e,r,t={}){let n=t.timeoutMs??8e3;try{let[o,s]=pe(e,r),i=nf(o,s,{windowsHide:!0,encoding:"utf8",timeout:n,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(i.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let a=(i.stderr||i.stdout||"").trim(),l=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:a?`${l}: ${a.slice(0,200)}`:l}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} probe failed`}}}function Ls(e,r,t={}){let n=t.timeoutMs??8e3;try{let[o,s]=pe(e,r);return nf(o,s,{windowsHide:!0,stdio:"ignore",timeout:n,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} auth probe failed`}}}var lE="codex";function cE(){let e=aE();return[process.env.CODEX_HOME?.trim()?Qn.join(Qn.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,Qn.join(e,".codex","auth.json"),Qn.join(e,".config","codex","auth.json")].filter(t=>!!t)}function uE(e){return Qn.dirname(e)}function dE(e){let r,t;for(let n of cE()){if(!iE(n))continue;r??=n;let o=er(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:uE(n)}});if(t??=o,o.ok)return{authPath:n,login:o}}return{authPath:r,login:t??er(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function of(e=new Date().toISOString()){let r=Fe(lE,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:zt("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:n}=dE(r),o=!!t&&n.ok;return{providerId:"codex",ready:o,authSource:"oauth_local",sessionFingerprint:t?lr(t):void 0,checkedAt:e,note:o?"Local Codex OAuth session bound on runner":[n.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as pE}from"node:fs";import{homedir as mE}from"node:os";import pl from"node:path";function fE(){let e=process.env.HERMES_HOME?.trim(),r=e?pl.resolve(e):pl.join(mE(),".hermes");return pl.join(r,"auth.json")}function Bs(e=new Date().toISOString()){let r=Fe("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=er(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=fE(),o=pE(n),s=Ls(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),i=t.ok&&s.ok;return{path:"hermes_openai_codex",ready:i,authSource:i?"subscription_hermes":"none",sessionFingerprint:o?lr(n):void 0,checkedAt:e,note:i?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,s.note,o?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function Xt(e=new Date().toISOString()){let r=of(e);if(r.ready)return{...r,path:"codex_cli"};let t=Bs(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}var sf=["low","medium","high"],af={oauth_local:0,subscription_hermes:0,runner_token:1,api_key_env:2,none:3};function lf(e,r){let t=Jt(e);return r==="privileged"?t.supportsPrivilegedPlatformActions:r==="low"?t.supportsLowRiskOrchestration:!0}function gE(e,r){let t=Jt(e.providerId),n=Jt(r.providerId),o=sf.indexOf(t.costTier)-sf.indexOf(n.costTier);if(o!==0)return o;let s=af[e.binding.authSource]-af[r.binding.authSource];return s!==0?s:e.providerId.localeCompare(r.providerId)}function ml(e){let r=rf().map(a=>({providerId:a.id,binding:e.inventory.bindings[a.id]})).filter(a=>a.binding.ready&&lf(a.providerId,e.riskClass));if(r.length===0)return null;let n=[...r].sort(gE)[0],o="codex";if(n.providerId===o)return{providerId:n.providerId,binding:n.binding};let s=e.inventory.bindings[o],i;return lf(o,e.riskClass)?s.ready||(i=s.note??`${o} not bound`):i=`${e.riskClass} orchestration requires privileged-capable provider`,{providerId:n.providerId,binding:n.binding,escalatedFrom:o,escalatedReason:i}}import{existsSync as hE}from"node:fs";import{homedir as kE}from"node:os";import yE from"node:path";var RE="claude";function vE(){let e=kE();return[yE.join(e,".claude",".credentials.json")]}function cf(e=new Date().toISOString()){let r=Fe(RE,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:zt("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=er(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=vE().find(i=>hE(i)),o=Ls(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),s=t.ok&&(o.ok||!!n);return{providerId:"claude",ready:s,authSource:"oauth_local",sessionFingerprint:n?lr(n):void 0,checkedAt:e,note:s?"Local Claude Code OAuth session bound on runner":[t.note,o.note,n?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as VE}from"node:fs";import{homedir as jE}from"node:os";import en from"node:path";wr();O();import{closeSync as yl,existsSync as ff,mkdirSync as OE,openSync as Rl,statSync as TE,unlinkSync as pf}from"node:fs";import{spawn as NE}from"node:child_process";import DE from"node:os";import cr from"node:path";sa();var bE="KYNVER_NO_PROD_DB_CREDENTIALS",SE=["KYNVER_ENV_FILE"];function Ke(e,r={}){let t=oa(e);if(!r.reviewWorker)return t;let n={...t,[bE]:"1"};for(let o of SE)delete n[o];return n}var wE=/-(?:thinking(?:-(?:high|medium|low|minimal|max|none))?|high|medium|low|minimal)$/i;function uf(e){return e.replace(wE,"")}var df=/^(?:gpt-|gpt5|o1|o3|o4|gemini-|grok-|composer|deepseek|llama|mistral|qwen|command-)/i;function Us(e){return/^claude[-_]/i.test(e)||/^(?:opus|sonnet|haiku)\b/i.test(e)}function xE(e){let r=e.trim().toLowerCase();return r.startsWith("gemini-")||r==="auto"||r==="pro"||r==="flash"||r==="flash-lite"}var _E=new Set(["cursor"]);function EE(e){let r=e.trim().toLowerCase();return _E.has(r)?"auto":null}function fl(e,r){let t=(e??"").trim();if(!t)return{ok:!0,model:r,normalized:!1};let o=uf(t).trim()||r;return df.test(o)||!Us(o)&&o!==r?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is not a Claude model \u2014 the "claude" provider drives the Claude CLI, which only accepts claude-* model ids (got "${o}"). Pick a Claude model or switch the worker provider.`}:o!==t?{ok:!0,model:o,normalized:!0,requested:t,note:`normalized model "${t}" \u2192 "${o}" (the Claude CLI rejects reasoning-effort suffixes)`}:{ok:!0,model:o,normalized:!1}}function Qt(e,r){let t=(e??"").trim();return t?Us(t)?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is a Claude model but the worker provider is "codex". Switch the provider or pick a Codex/OpenAI model.`}:{ok:!0,model:t,normalized:!1}:{ok:!0,model:r,normalized:!1}}function gl(e,r){let t=(e??"").trim();if(t)return{ok:!0,model:t,normalized:!1};let n=(r??"").trim();return n?{ok:!0,model:n,normalized:!1}:{ok:!1,model:"",normalized:!1,note:'the "openai-compatible" provider has no universal default model \u2014 pass --model (any id your endpoint serves, e.g. llama3.1, qwen2.5-coder, gpt-4o-mini) or set KYNVER_WORKER_MODEL on the daemon host.'}}function Zt(e,r){let t=(e??"").trim();if(!t)return{ok:!0,model:r,normalized:!1};let o=uf(t).trim()||r;return Us(o)||!xE(o)&&df.test(o)?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is not a Gemini model \u2014 the gemini / gemini-api providers drive Google Gemini (got "${o}"). Pick a gemini-* model or an alias (auto, pro, flash, flash-lite), or switch the worker provider.`}:o!==t?{ok:!0,model:o,normalized:!0,requested:t,note:`normalized model "${t}" \u2192 "${o}"`}:{ok:!0,model:o,normalized:!1}}function hl(e,r){let t=(e??"").trim();if(!t)return{ok:!0,model:r,normalized:!1};let n=EE(t);return n?{ok:!0,model:n,normalized:!0,requested:t,note:`normalized model "${t}" \u2192 "${n}" (Cursor provider alias \u2014 use "auto" or a composer id, not "cursor")`}:Us(t)?{ok:!1,model:t,normalized:!1,requested:t,note:`model "${t}" is a Claude model but the worker provider is "cursor". Switch the provider to "claude" or pick a Cursor model.`}:{ok:!0,model:t,normalized:!1}}import{existsSync as Zn,readdirSync as CE}from"node:fs";import gt from"node:path";var PE=/^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;function AE(e){let t=e.split("-")[0].split(".");if(t.length!==3)return null;let[n,o,s]=t;return!n||!o||!s?null:+`${n}${o.padStart(2,"0")}${s.padStart(2,"0")}`}function IE(e){let r=gt.join(e,"versions");if(!Zn(r))return null;let t=null,n=-1;for(let o of CE(r,{withFileTypes:!0})){if(!o.isDirectory()||!PE.test(o.name))continue;let s=AE(o.name);s==null||s<=n||(n=s,t=gt.join(r,o.name))}return t}function Fs(e){let r=e?.trim()||gt.join(process.env.LOCALAPPDATA||"","cursor-agent"),t=gt.join(r,"node.exe"),n=gt.join(r,"index.js");if(Zn(t)&&Zn(n))return{nodeExe:t,indexJs:n,versionDir:r};let o=IE(r);if(!o)return null;let s=gt.join(o,"node.exe"),i=gt.join(o,"index.js");return!Zn(s)||!Zn(i)?null:{nodeExe:s,indexJs:i,versionDir:o}}var kl="composer-2.5",ME=15e3,WE=6e4,LE=3e4;function BE(e,r,t){return{executable:e,prefixArgs:[r],shell:!1,detached:ce(),bundledVersionDir:t}}function bl(e){if(process.platform==="win32"){let r=/\.(cmd|bat)$/i.test(e),t=/node\.exe$/i.test(e)&&ff(cr.join(cr.dirname(e),"index.js"));if(r||t||e==="agent"){let o=r?Fs(cr.dirname(e)):t?{nodeExe:e,indexJs:cr.join(cr.dirname(e),"index.js"),versionDir:cr.dirname(e)}:Fs();if(o)return BE(o.nodeExe,o.indexJs,o.versionDir);throw new Error("Cursor Agent on Windows has no headless bundled node.exe under %LOCALAPPDATA%\\cursor-agent\\versions\\\u2026. Run `agent login` / update Cursor Agent CLI, use `--provider claude`, or set KYNVER_CURSOR_AGENT_ROOT to the cursor-agent folder.")}}return{executable:e,prefixArgs:[],shell:!1,detached:ce()}}function UE(e,r,t){return Ke({...process.env,CI:"1",NO_COLOR:"1",...r.bundledVersionDir?{CURSOR_INVOKED_AS:cr.basename(e)||"agent.cmd"}:{}},{reviewWorker:t})}function gf(e){e<=0||Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,e)}function vl(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)&&n>=0?Math.floor(n):r}function FE(){let e=process.env.KYNVER_CURSOR_START_LOCK_DIR?.trim()||cr.join(DE.homedir(),".kynver","locks");return OE(e,{recursive:!0}),cr.join(e,"cursor-agent-start.lock")}function KE(){if(process.env.KYNVER_CURSOR_START_LOCK==="0")return()=>{};let e=FE(),r=vl("KYNVER_CURSOR_START_LOCK_TIMEOUT_MS",WE),t=vl("KYNVER_CURSOR_START_LOCK_STALE_MS",LE),n=Date.now();for(;;)try{let o=Rl(e,"wx");return yl(o),()=>{try{pf(e)}catch{}}}catch(o){if(o.code!=="EEXIST")throw o;try{if(Date.now()-TE(e).mtimeMs>t){pf(e);continue}}catch{continue}if(Date.now()-n>r)throw new Error(`timed out waiting for Cursor agent start lock: ${e}`);gf(250)}}function hf(e=process.env){let r=e.KYNVER_CURSOR_AGENT_BIN?.trim()||e.CURSOR_AGENT_BIN?.trim();if(r)return r;if(process.platform==="win32"){let t=Fs(e.KYNVER_CURSOR_AGENT_ROOT?.trim()||void 0);if(t)return t.nodeExe;let n=cr.join(e.LOCALAPPDATA||"","cursor-agent","agent.cmd");if(ff(n))return n}return"agent"}function HE(){return hf(process.env)}var kf={name:"cursor",defaultModel:kl,preflightModel(e){return hl(e,kl)},start(e){let r=hl(e.model,kl);if(!r.ok)throw new Error(`cursor provider model preflight failed: ${r.note}`);let t=r.model,n=Rl(e.stdoutPath,"a"),o=Rl(e.stderrPath,"a"),s=["ignore",n,o],i=HE(),a=bl(i),l=KE(),c;try{let[u,d]=a.shell?[a.executable,mf(e,t,a.prefixArgs)]:Pe(a.executable,mf(e,t,a.prefixArgs),e.workerDir);c=NE(u,d,ae({cwd:e.worktreePath,detached:a.detached,shell:a.shell,stdio:s,env:UE(i,a,e.reviewWorker)})),gf(vl("KYNVER_CURSOR_START_LOCK_HOLD_MS",ME))}finally{l(),yl(n),yl(o)}if(!c.pid)throw new Error(`failed to spawn Cursor agent worker (is \`${i}\` on PATH? run \`agent login\` or set CURSOR_API_KEY)`);return c.unref(),{pid:c.pid,model:t}}};function mf(e,r,t=[]){return[...t,"-p",...e.executionMode==="read_only"?["--mode","plan"]:["--force"],...e.mcpConfigPath?["--approve-mcps"]:[],"--trust","--workspace",e.worktreePath,"--output-format","stream-json","--stream-partial-output","--model",r,e.prompt]}import{spawnSync as $E}from"node:child_process";function Sl(e,r=process.env){try{let t;try{t=bl(e)}catch{t={executable:e,prefixArgs:[]}}let n=$E(t.executable,[...t.prefixArgs,"status","--format","json"],{encoding:"utf8",windowsHide:!0,timeout:8e3,env:{...r,CI:"1",NO_COLOR:"1"}});if(n.status!==0)return{ok:!1,note:"agent status: not authenticated"};let o=(n.stdout||"").trim();if(!o)return{ok:!1,note:"agent status: empty response"};let s;try{s=JSON.parse(o)}catch{return{ok:!1,note:"agent status: unparseable response"}}return typeof s=="object"&&s!==null&&s.isAuthenticated===!0?{ok:!0,note:"agent status: authenticated"}:{ok:!1,note:"agent status: not authenticated"}}catch(t){return{ok:!1,note:t instanceof Error?t.message:"agent status probe failed"}}}function wl(e=process.env){let r=[],t=e.KYNVER_CURSOR_AUTH_HOME?.trim();t&&(r.push(en.join(t,".config","cursor","auth.json")),r.push(en.join(t,".cursor-agent","auth.json")));let n=jE();if(r.push(en.join(n,".config","cursor","auth.json")),r.push(en.join(n,".cursor-agent","auth.json")),process.platform==="win32"){let o=e.LOCALAPPDATA?.trim(),s=e.APPDATA?.trim();o&&r.push(en.join(o,"cursor-agent","auth.json")),s&&r.push(en.join(s,"cursor","auth.json"))}return r}var GE="agent";function yf(e=new Date().toISOString()){let r=Fe(GE,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:zt("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=er(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=wl().find(a=>VE(a)),o=Sl(r),s=!!n||o.ok,i=t.ok&&s;return{providerId:"cursor",ready:i,authSource:"oauth_local",sessionFingerprint:n?lr(n):void 0,checkedAt:e,note:i?"Local Cursor/Composer OAuth session bound on runner":[t.note,s?void 0:o.note??"no ~/.config/cursor/auth.json or `agent login` session"].filter(Boolean).join("; ")}}import{existsSync as YE,readFileSync as qE}from"node:fs";import{homedir as JE}from"node:os";import xl from"node:path";var zE=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function XE(){let e=process.env.HERMES_HOME?.trim(),r=e?xl.resolve(e):xl.join(JE(),".hermes");return xl.join(r,".env")}function QE(e){try{let r=qE(e,"utf8"),t=[];for(let n of zE)new RegExp(`^${n}=`,"m").test(r)&&t.push(n);return t}catch{return[]}}function Rf(e=new Date().toISOString()){let r=Fe("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=er(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=XE(),o=YE(n),s=o?QE(n):[],a=s.some(c=>c.endsWith("_API_KEY"))?"api_key_env":o?"oauth_local":"none",l=t.ok&&o;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:o,authSource:a,sessionFingerprint:o?lr(n):void 0,checkedAt:e,note:l?`Hermes profile bound (${s.length?`keys: ${s.join(", ")}`:"no API keys detected"})`:[t.note,o?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function vf(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=Xt(r),n={codex:t,cursor:yf(r),claude:cf(r)},o=Object.values(n).filter(s=>s.ready).length;return{generatedAt:r,bindings:n,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:Rf(r),hermesOpenAiCodex:Bs(r),codexAdapterPath:t.path,readyCount:o}}var ZE=[/\bprivileged\b/i,/\bproduction\s+db\b/i,/\bdb:push\b/i,/\bmigration\b/i,/\bdeploy\b/i,/\bsecrets?\b/i,/\bstripe\b/i,/\[require-approval\]/i,/\[operator-only\]/i],eC=[/\borchestration\b/i,/\bplan[- ]?progress\b/i,/\bstatus\s+sync\b/i,/\bheartbeat\b/i,/\bboard[- ]?drain\b/i,/\bmaintenance\b/i,/\[orchestration:\s*low-risk\]/i];function _l(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function rC(e){let r=_l(e,"executorRef").toLowerCase(),t=_l(e,"title").toLowerCase(),n=_l(e,"description").toLowerCase(),o=`${r}
 ${t}
 ${n}`;return ZE.some(s=>s.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":eC.some(s=>s.test(o))?"low":"elevated"}function tC(e){let r=Jt(e.provider),t=e.escalatedFrom&&e.escalatedReason?`Escalated from ${e.escalatedFrom} (${e.escalatedReason}); using ${r.displayName} (${r.costTier} tier)`:`${r.displayName} selected for ${e.riskClass} orchestration (${r.costTier} tier, auth=${e.authSource})`;return{provider:e.provider,model:e.model,authSource:e.authSource,costTier:r.costTier,riskClass:e.riskClass,costRationale:t,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason}}function nC(e){let r=e.inventory??vf();return e.codexBinding?{...r,bindings:{...r.bindings,codex:e.codexBinding}}:r}function ht(e){let r=tC({provider:e.providerId,model:e.model,authSource:e.binding.authSource,riskClass:e.riskClass,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason});return{provider:e.providerId,model:e.model,rule:r.routingRule,audit:r}}function bf(e){let r=e.task??{},t=rC(r),n=nC({inventory:e.inventory,codexBinding:e.codexBinding??(e.inventory?null:Xt())}),o=e.preferLowCost===!1?null:e.explicitProvider?.trim().toLowerCase(),s=e.explicitModel?.trim()||void 0,i=Ir;if(o==="codex"||o==="provider:codex"){let c=n.bindings.codex;if(!c.ready){let u=ml({inventory:n,riskClass:t});return ht(u?{providerId:u.providerId,binding:u.binding,riskClass:t,routingRule:"orchestration:explicit_codex_unavailable_cost_aware",model:s,escalatedFrom:"codex",escalatedReason:c.note??"codex oauth not bound"}:{providerId:i,binding:n.bindings[i],riskClass:t,routingRule:"orchestration:codex_unavailable_escalate_cursor",model:s,escalatedFrom:"codex",escalatedReason:c.note??"codex oauth not bound"})}return ht({providerId:"codex",binding:c,riskClass:t,routingRule:"orchestration:explicit_codex",model:s})}if(o==="cursor"||o==="provider:cursor"){let c=n.bindings.cursor;if(c.ready)return ht({providerId:"cursor",binding:c,riskClass:t,routingRule:"orchestration:explicit_cursor",model:s})}if(o==="claude"||o==="provider:claude"){let c=n.bindings.claude;if(c.ready)return ht({providerId:"claude",binding:c,riskClass:t,routingRule:"orchestration:explicit_claude",model:s})}let a=ml({inventory:n,riskClass:t});if(a)return ht({providerId:a.providerId,binding:a.binding,riskClass:t,routingRule:`orchestration:cost_aware_${a.providerId}`,model:s,escalatedFrom:a.escalatedFrom,escalatedReason:a.escalatedReason});let l=n.bindings.codex;return ht({providerId:i,binding:n.bindings[i],riskClass:t,routingRule:l.ready?"orchestration:inventory_empty_default_cursor":"orchestration:codex_unavailable_default_cursor",model:s,...l.ready?{}:{escalatedFrom:"codex",escalatedReason:l.note??"codex oauth not bound"}})}wr();import{closeSync as Cf,openSync as Pf}from"node:fs";import{spawn as mC}from"node:child_process";O();Rr();Ln();import{unlinkSync as oC,writeFileSync as sC}from"node:fs";import iC from"node:path";var rr="KYNVER_WORKER_BROKER_SOCKET";function El(e){return`${JSON.stringify(e)}
 `}function Cl(e){let r;try{r=JSON.parse(e)}catch{return{ok:!1,reason:"malformed_request",error:"request was not valid JSON",id:""}}if(!r||typeof r!="object"||Array.isArray(r))return{ok:!1,reason:"malformed_request",error:"request must be a JSON object",id:""};let t=r,n=typeof t.id=="string"?t.id:"";if(t.v!==1)return{ok:!1,reason:"unsupported_protocol",error:"unsupported protocol version (expected 1)",id:n};if(!n)return{ok:!1,reason:"malformed_request",error:"request id must be a non-empty string",id:""};if(t.op==="list_tools")return{ok:!0,request:{v:1,id:n,op:"list_tools"}};if(t.op==="call_tool"){if(typeof t.name!="string"||!t.name)return{ok:!1,reason:"malformed_request",error:"call_tool requires a tool name",id:n};let o=t.args&&typeof t.args=="object"&&!Array.isArray(t.args)?t.args:{};return{ok:!0,request:{v:1,id:n,op:"call_tool",name:t.name,args:o}}}return{ok:!1,reason:"malformed_request",error:"unknown op",id:n}}var aC="KYNVER_WORKER_MCP_TOOLS",lC="mcp-config.json",oe="kynver",eo=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Sf=eo.map(e=>`mcp__${oe}__${e}`),cC={"worker.context":["agent_os_context_envelope"],"worker.memory.read":["agent_os_search_memory"],"worker.skills.read":["agent_os_search_skills","agent_os_get_skill"],"worker.progress.report":["agent_os_progress_note"]};function ro(e){if(!e||e.length===0)return[...eo];let r=new Set;for(let t of e)for(let n of cC[t]??[])r.add(n);return eo.filter(t=>r.has(t))}function wf(e){return ro(e).map(r=>`mcp__${oe}__${r}`)}var uC=["claude","cursor","codex","openai-compatible","gemini","gemini-api"],dC=["openai-compatible","gemini-api"];function pC(e){return uC.includes(e)}function Pl(e){return dC.includes(e)}function xf(e){return pC(e)&&!Pl(e)}function to(e=process.env){let r=e[aC]?.trim().toLowerCase();return r?r==="1"||r==="true"||r==="yes"||r==="on":!0}function _f(e){return iC.join(e,lC)}function Ef(e){let r=_f(e.workerDir),t={mcpServers:{[oe]:{command:"npx",args:["-y","-p","@kynver-app/mcp-agent-os","kynver-worker-mcp"],env:{[rr]:e.brokerSocketPath}}}};return sC(r,`${JSON.stringify(t,null,2)}
@@ -174,6 +176,6 @@ ${n}`,s=kP(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock
 `),o}var oD=new Set(["completion_blocked","dirty_worktree","pr_or_unmerged_commits","landing_blocked"]);function sD(e){e.writeSalvageEvidence&&oD.has(e.skipReason)&&(Fr(e.indexed,e.now)||cR({harnessRoot:e.harnessRoot,runId:e.indexed.runId,workerName:e.indexed.workerName})||uR({harnessRoot:e.harnessRoot,indexed:e.indexed,skipReason:e.skipReason,status:e.status,now:e.now}))}function iD(e){let{indexed:r,worktreesAgeMs:t,terminalWorktreesAgeMs:n}=e;return r&&(bt.has(r.run.status)||e.liveness&&iu(r,e.liveness)||e.liveness&&we(su(r,e.liveness))&&!Fr(r))?n:t}function aD(e){return!e.indexed||e.includeOrphans&&e.worktreesAgeMs<=0?0:iD(e)}function lD(e,r){if(e.harnessRoot?.trim())return Wi.resolve(e.harnessRoot);let t=r.worker.workerDir;if(!t)return null;let n=`${Wi.sep}runs${Wi.sep}`,o=t.indexOf(n);return o<0?null:t.slice(0,o+n.length-1)}function dR(e){let{indexed:r,includeOrphans:t,worktreesAgeMs:n,ageMs:o,orphanSafety:s,worktreeRemovalGuard:i}=e,a=e.now??Date.now();if(!r)return t?s??null:"orphan_without_flag";let l=aD(e);if(n<=0&&!t&&l<=0)return"worktrees_disabled";if(l>0&&o<l)return"below_age_threshold";if(Fr(r,a))return"active_worker";let c=su(r,e.liveness),u=lD(e,r),d=f=>{if(u)try{sD({indexed:r,harnessRoot:u,skipReason:f,status:c,now:a,writeSalvageEvidence:e.writeSalvageEvidence===!0})}catch{}return f};if(sR(r,c)){let f=d("completion_blocked");if(f)return f}if(ou(r,e.liveness?.gitStatusCache)){let f=d("dirty_worktree");if(f)return f}let p=e.liveness?.gitRevCache?.countAheadOfMain(e.worktreePath);if(p!=null&&p>0){let f=d("pr_or_unmerged_commits");if(f)return f}if(oR(r,e.liveness,a)||!we(c))return"run_still_active";if(Oo(c)){let f=d("pr_or_unmerged_commits");if(f)return f}if($e(c.changedFiles).length>0){let f=d("dirty_worktree");if(f)return f}if(Ft({finalResult:c.finalResult,changedFiles:c.changedFiles,gitAncestry:c.gitAncestry,prUrl:_t(c.finalResult)}).blocked){let f=d("landing_blocked");if(f)return f}if(i&&e.worktreePath){let f=i({worktreePath:e.worktreePath,indexed:!!r,runId:r?.runId,worker:r?.workerName});if(f)return f.detail?{reason:f.reason,detail:f.detail}:f.reason}return null}function au(e){let{indexed:r,nodeModulesAgeMs:t,ageMs:n,worktreePath:o,activeWorktreePaths:s,workerFilesystemLive:i,diskPressure:a}=e;return!a&&n<t?"below_age_threshold":i||s.has(Wi.resolve(o))||r&&Fr(r)?"active_worker":r&&ou(r,e.gitStatusCache)?"dirty_worktree":null}function pR(e){return au(e)}var mR=new Set(["active_worker","run_still_active","completion_blocked","landing_blocked"]);function fR(e,r){let t=[],n=new Set,o=(s,i,a)=>{let l=`${s}\0${i}`;n.has(l)||t.length>=24||(n.add(l),t.push({path:s,reason:i,...a?{detail:a}:{}}))};for(let s of r)mR.has(s.reason)&&o(s.path,s.reason,s.detail);for(let s of e)!s.skipped||!s.skipReason||mR.has(s.skipReason)&&o(s.path,s.skipReason);return t}import{existsSync as yR,readdirSync as RR,statSync as dD}from"node:fs";import vR from"node:path";B();Ze();import gR from"node:path";O();function uD(e,r){return fn(e,r)}function hR(e,r=Date.now()){let t=new Set,n=new Set;for(let o of e){for(let s of As(o)){let i=!1;for(let a of Object.keys(s.workers||{})){let l=I(gR.join(qn(o,s.id),"workers",x(a),"worker.json"),void 0);if(!l?.worktreePath)continue;let c=gR.resolve(l.worktreePath);uD(l,r)&&(i=!0,t.add(c))}i&&n.add(`${o}\0${s.id}`)}for(let s of Ny(o))n.add(s)}return{activeWorktreePaths:t,liveRunKeys:n}}function kR(e,r,t,n){return t?n.has(`${r}\0${t}`):!1}O();function pD(e,r){try{let t=dD(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function mD(e,r){let t=vR.join(e,"runs",r,"run.json");return yR(t)?I(t,null):null}function bR(e){try{return RR(e).length===0}catch{return!1}}function SR(e){let{harnessRoot:r,runId:t,runPath:n,ageMs:o,runDirectoriesAgeMs:s,activeGuards:i}=e;if(kR(n,r,t,i.liveRunKeys)||!bR(n))return"run_still_active";let a=mD(r,t);return a&&!bt.has(a.status)&&!St(a)?"run_still_active":s>0&&o<s?"below_age_threshold":null}function wR(e){if(!yR(e.worktreesDir))return[];let r=[],t;try{t=RR(e.worktreesDir,{withFileTypes:!0})}catch{return[]}for(let n of t){if(!n.isDirectory())continue;let o=n.name;if(e.runIdFilter&&o!==e.runIdFilter)continue;let s=vR.join(e.worktreesDir,o);bR(s)&&r.push({kind:"remove_run_directory",path:s,bytes:null,harnessRoot:e.harnessRoot,runId:o,ageMs:pD(s,e.now)})}return r}de();import{existsSync as cu,rmSync as DR}from"node:fs";import{execFileSync as fD}from"node:child_process";import{existsSync as xR,readdirSync as gD,statSync as hD}from"node:fs";import kD from"node:path";var yD=2500;function RD(e,r=yD){if(!xR(e))return 0;try{let n=fD("du",["-sb",e],{encoding:"utf8",timeout:r,stdio:["ignore","pipe","ignore"]}).trim().split(/\s+/)[0],o=Number(n);return Number.isFinite(o)&&o>=0?o:null}catch{return null}}function Kr(e,r=5e4){if(!xR(e))return 0;let t=RD(e);if(t!==null)return t;let n=0,o=0,s=[e];for(;s.length>0;){let i=s.pop(),a;try{a=gD(i)}catch{continue}for(let l of a){if(o++>r)return null;let c=kD.join(i,l),u;try{u=hD(c)}catch{continue}u.isDirectory()?s.push(c):n+=u.size}}return n}import{existsSync as wD,rmSync as xD}from"node:fs";Ze();import{lstatSync as vD,readdirSync as bD}from"node:fs";function _R(e){try{let r=vD(e),t=typeof process.getuid=="function"?process.getuid():null,n=typeof process.getgid=="function"?process.getgid():null,o=t!==null&&(r.uid!==t||n!==null&&r.gid!==n);return{uid:r.uid,gid:r.gid,foreign:o}}catch{return null}}function ER(e,r=32){let t=_R(e);if(!t)return!1;if(t.foreign)return!0;try{let n=bD(e),o=0;for(let s of n){if(o>=r)break;let i=`${e.replace(/\/$/,"")}/${s}`,a=_R(i);if(o+=1,a?.foreign)return!0}}catch{}return!1}import{spawnSync as SD}from"node:child_process";import AR from"node:path";import je from"node:path";function CR(e,r,t,n){let o=je.resolve(e),s=`${je.sep}${n}`,i=o.endsWith(s)?o:null;if(!i)return"path_outside_harness";let a=je.relative(t,i);if(a.startsWith("..")||je.isAbsolute(a))return"path_outside_harness";let l=a.split(je.sep);return l.length<3||l[l.length-1]!==n||!o.startsWith(je.resolve(r))?"path_outside_harness":null}function Li(e,r,t){return CR(e,r,t,"node_modules")}function Bi(e,r,t){return CR(e,r,t,".next")}function Ui(e,r,t){let n=je.resolve(e),o=je.relative(t,n);return o.startsWith("..")||je.isAbsolute(o)||o.split(je.sep).length<3||!n.startsWith(je.resolve(r))?"path_outside_harness":null}function PR(e,r,t){let n=je.resolve(e);return Li(n,r,t)===null||Bi(n,r,t)===null||Ui(n,r,t)===null}function OR(){let e=(process.env.KYNVER_CLEANUP_PRIVILEGED??"auto").trim().toLowerCase();return e==="0"||e==="false"||e==="off"||e==="no"?"off":e==="1"||e==="true"||e==="force"||e==="yes"?"force":"auto"}function IR(e){let r=SD("sudo",["-n",...e],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});return{ok:r.status===0,stderr:`${r.stderr??""}${r.stdout??""}`.trim()}}function TR(e,r,t){if(!PR(e,r,t))return{ok:!1,error:"path is not an allowed harness generated cache"};let n=typeof process.getuid=="function"?process.getuid():null,o=typeof process.getgid=="function"?process.getgid():null;if(n===null||o===null)return{ok:!1,error:"privileged reclaim requires POSIX uid/gid"};let s=IR(["chown","-R",`${n}:${o}`,AR.resolve(e)]);if(s.ok)return{ok:!0,method:"chown_then_rm"};let i=IR(["rm","-rf",AR.resolve(e)]);return i.ok?{ok:!0,method:"sudo_rm"}:{ok:!1,error:s.stderr||i.stderr||"sudo -n failed (password required or not permitted)"}}var lu="Root-owned harness caches require operator reclaim: configure passwordless sudo for chown/rm under ~/.kynver/harness/worktrees, or remove them as the harness owner with sudo available. More help: https://www.kynver.com/help.";function _D(e){let r=e?.code;return r==="EACCES"||r==="EPERM"}function NR(e,r,t={}){if(!wD(e.path))return{executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.harnessRoot,o=n?Yt(n):null,i=e.bytes??Kr(e.path)??void 0,a=t.removePath??xD,l=t.hasForeignOwnedEntry??ER;try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i}}catch(c){if(!_D(c)||!n||!o)return{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let u=l(e.path),d=OR();if(!(d==="force"||d==="auto"&&u))return u?{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; ${lu}`}:{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let m=TR(e.path,n,o);if(m.ok&&m.method==="sudo_rm")return{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0};if(m.ok)try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0}}catch(f){return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${f.message}; privileged chown succeeded but rm still failed`}}return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; privileged reclaim failed: ${m.error}; ${lu}`}}}function uu(e){let r=e.harnessRoot;return!r||!Iy(e.path,r)?null:{...e,executed:!1,skipped:!0,skipReason:"run_metadata_protected"}}function du(e,r){let t=uu(e);if(t)return t;let n=NR(e,r);return{...e,bytes:n.bytes??e.bytes,executed:n.executed,skipped:n.skipped,skipReason:n.skipReason,error:n.error}}function MR(e,r){return du(e,r)}function WR(e,r){return du(e,r)}function LR(e,r){return du(e,r)}function BR(e,r){let t=uu(e);if(t)return t;if(!cu(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};try{let n=e.bytes??Kr(e.path);return DR(e.path,{recursive:!0,force:!0}),{...e,bytes:n,executed:!0,skipped:!1}}catch(n){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:n.message}}}function UR(e,r){let t=uu(e);if(t)return t;if(!cu(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.repo;try{let o=e.bytes??Kr(e.path);return n&&Z(n,["worktree","remove","--force",e.path],{allowFailure:!0}),cu(e.path)&&DR(e.path,{recursive:!0,force:!0}),{...e,bytes:o,executed:!0,skipped:!1}}catch(o){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:o.message}}}import{existsSync as Fi,readdirSync as Ki,statSync as ED}from"node:fs";import mr from"node:path";function pu(e,r){try{let t=ED(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function KR(e,r){let t=mr.relative(r,e);return t===""||!t.startsWith("..")&&!mr.isAbsolute(t)}function FR(e,r,t,n){let o=[];for(let s of nu){if(s===".next")continue;let i=mr.join(e,s);if(!Fi(i))continue;let a=mr.resolve(i);t.has(a)||KR(a,r.harnessRoot)&&(t.add(a),o.push({kind:"remove_build_cache",path:a,bytes:null,runId:n.runId,worker:n.worker,repo:n.repo,ageMs:pu(a,r.now)}))}return o}function HR(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||r.push(...FR(n.worktreePath,e,t,{runId:n.runId,worker:n.workerName,repo:n.run.repo}));if(!e.includeOrphans||!Fi(e.worktreesDir))return r;for(let n of Ki(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory())continue;let o=mr.join(e.worktreesDir,n.name);for(let s of Ki(o,{withFileTypes:!0})){if(!s.isDirectory())continue;let i=mr.join(o,s.name);r.push(...FR(i,e,t,{runId:n.name,worker:s.name}))}}return r}function $R(e){let r=e.worktreesAgeMs>0||e.includeOrphans,t=e.includeOrphans;if(!r&&!t)return[];let n=[],o=new Set;if(r)for(let i of e.index.values()){if(e.runIdFilter&&i.runId!==e.runIdFilter)continue;let a=i.worktreePath;Fi(a)&&(o.has(a)||(o.add(a),n.push({kind:"remove_worktree",path:a,bytes:null,runId:i.runId,worker:i.workerName,repo:i.run.repo,ageMs:pu(a,e.now)})))}if(!t||!Fi(e.worktreesDir))return n;let s=new Set;for(let i of e.index.values())s.add(mr.resolve(i.worktreePath));for(let i of Ki(e.worktreesDir,{withFileTypes:!0})){if(!i.isDirectory()||e.runIdFilter&&i.name!==e.runIdFilter)continue;let a=mr.join(e.worktreesDir,i.name),l;try{l=Ki(a,{withFileTypes:!0})}catch{continue}for(let c of l){if(!c.isDirectory())continue;let u=mr.resolve(mr.join(a,c.name));o.has(u)||s.has(u)||KR(u,e.harnessRoot)&&(o.add(u),n.push({kind:"remove_worktree",path:u,bytes:null,runId:i.name,worker:c.name,ageMs:pu(u,e.now)}))}}return n}import{existsSync as GR,readdirSync as jR,statSync as CD}from"node:fs";import gn from"node:path";var PD=[{dirName:"node_modules",kind:"remove_node_modules"},{dirName:".next",kind:"remove_next_cache"}];function AD(e,r){try{let t=CD(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function ID(e,r){let t=gn.relative(r,e);return t===""||!t.startsWith("..")&&!gn.isAbsolute(t)}function OD(e,r,t,n,o,s){if(!GR(n))return;let i=gn.resolve(n);r.has(i)||ID(i,t.harnessRoot)&&(r.add(i),e.push({kind:o,path:i,bytes:null,harnessRoot:t.harnessRoot,runId:s.runId,worker:s.worker,repo:s.repo,ageMs:AD(i,t.now)}))}function VR(e,r,t,n,o){for(let s of PD)OD(e,r,t,gn.join(n,s.dirName),s.kind,o)}function YR(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||VR(r,t,e,n.worktreePath,{runId:n.runId,worker:n.workerName,repo:n.run.repo});if(!e.includeOrphans||!GR(e.worktreesDir))return r;for(let n of jR(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory()||e.runIdFilter&&n.name!==e.runIdFilter)continue;let o=gn.join(e.worktreesDir,n.name),s;try{s=jR(o,{withFileTypes:!0})}catch{continue}for(let i of s){if(!i.isDirectory())continue;let a=gn.join(o,i.name);VR(r,t,e,a,{runId:n.name,worker:i.name})}}return r}de();import{existsSync as qR,statSync as TD}from"node:fs";import fr from"node:path";function ND(e,r){try{let t=TD(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function DD(e){let r=[],t=null;for(let n of e.split(`
 `)){if(!n.trim())continue;let[o,...s]=n.split(" "),i=s.join(" ");if(o==="worktree"){t&&r.push(t),t={path:i};continue}t&&(o==="branch"&&(t.branch=i),o==="HEAD"&&(t.head=i),o==="bare"&&(t.bare=!0))}return t&&r.push(t),r}function MD(e,r){let t=fr.relative(fr.resolve(r),fr.resolve(e));return t!==""&&!t.startsWith("..")&&!fr.isAbsolute(t)}var WD=200;function JR(e){if(!e.includeOrphans||!qR(e.worktreesDir))return[];let r=new Set;for(let s of e.index.values())s.run.repo&&r.add(fr.resolve(s.run.repo));let t=new Set;for(let s of e.index.values())t.add(fr.resolve(s.worktreePath));let n=[],o=new Set;for(let s of r){let i=0,a;try{a=Z(s,["worktree","list","--porcelain"],{allowFailure:!0})}catch{continue}let l=DD(a);for(let c of l){if(i>=WD)break;let u=fr.resolve(c.path);if(u===fr.resolve(s)||!MD(u,e.worktreesDir)||t.has(u)||o.has(u)||!qR(u))continue;let p=fr.relative(e.worktreesDir,u).split(fr.sep),m=p[0],f=p[1]??"unknown";o.add(u),i+=1,n.push({kind:"remove_worktree",path:u,bytes:null,runId:m,worker:f,repo:s,ageMs:ND(u,e.now)})}}return n}B();O();import No from"node:path";function zR(e,r){let t=No.resolve(r),n=new Map;for(let[o,s]of e){let i=s.harnessRoot?No.resolve(s.harnessRoot):null;i&&i!==t||n.set(o,s)}return n}function XR(e){let r=new Map;for(let t of As(e))for(let n of Object.keys(t.workers||{})){let o=No.join(qn(e,t.id),"workers",x(n),"worker.json"),s=I(o,void 0);s?.worktreePath&&r.set(No.resolve(s.worktreePath),{harnessRoot:e,worktreePath:No.resolve(s.worktreePath),runId:t.id,workerName:n,run:t,worker:s})}return r}function Do(e){let r=process.env[e];return r==="1"||r==="true"||r==="yes"}function Et(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)&&n>=0?n:r}function fu(e={}){let r=e.execute===!0||e.execute!==!1&&Do("KYNVER_CLEANUP_EXECUTE"),t=e.finalizeStaleRuns!==!1&&!Do("KYNVER_CLEANUP_SKIP_FINALIZE"),n=e.nodeModulesAgeMs??Et("KYNVER_CLEANUP_NODE_MODULES_AGE_MS",216e5),o=e.scanDependencyCaches??(e.nodeModulesAgeMs!==void 0||process.env.KYNVER_CLEANUP_NODE_MODULES_AGE_MS!=null),s=e.worktreesAgeMs??Et("KYNVER_CLEANUP_WORKTREES_AGE_MS",0),i=e.terminalWorktreesAgeMs??Et("KYNVER_CLEANUP_TERMINAL_WORKTREES_AGE_MS",216e5),a=e.runDirectoriesAgeMs??Et("KYNVER_CLEANUP_RUN_DIRECTORIES_AGE_MS",36e5),l=e.maxActionsPerSweep??Et("KYNVER_CLEANUP_MAX_ACTIONS_PER_SWEEP",120),c=e.includeOrphans===!0||Do("KYNVER_CLEANUP_INCLUDE_ORPHANS"),d=Do("KYNVER_CLEANUP_SCOPE_ALL")||process.env.KYNVER_CLEANUP_SCOPE==="all"?e.runIdFilter:e.runIdFilter??(process.env.KYNVER_CLEANUP_RUN_ID||void 0),p=e.accountBytes!==!1&&!Do("KYNVER_CLEANUP_SKIP_BYTE_ACCOUNTING"),m=Et("KYNVER_CLEANUP_STORAGE_ENTRY_CAP",2e3),f=e.storagePerRunEntryCap!==void 0?e.storagePerRunEntryCap:p&&m>0?m:null,y=Et("KYNVER_CLEANUP_BYTE_ENTRY_CAP",2e3),k=e.byteAccountingEntryCap??(Number.isFinite(y)&&y>0?Math.floor(y):2e3);return{execute:r,finalizeStaleRuns:t,scanDependencyCaches:o,nodeModulesAgeMs:n,worktreesAgeMs:s>0?s:0,terminalWorktreesAgeMs:i>=0?i:0,runDirectoriesAgeMs:a>=0?a:0,maxActionsPerSweep:Number.isFinite(l)&&l>0?Math.floor(l):120,includeOrphans:c,runIdFilter:d?String(d):void 0,accountBytes:p,storagePerRunEntryCap:f,byteAccountingEntryCap:k}}function rv(e){let r=process.env.KYNVER_CLEANUP_SCOPE==="all",t=Number(process.env.KYNVER_CLEANUP_WORKTREES_AGE_MS),n=r?Number.isFinite(t)&&t>0?t:6048e5:Number.isFinite(t)&&t>0?t:0;return fu({runIdFilter:r?void 0:e,worktreesAgeMs:n,terminalWorktreesAgeMs:r?216e5:void 0,runDirectoriesAgeMs:r?36e5:void 0,includeOrphans:r?!0:void 0,finalizeStaleRuns:!0,accountBytes:!0,scanDependencyCaches:!0})}de();import{existsSync as gu,statSync as BD}from"node:fs";import Ct from"node:path";O();var tv=1800*1e3;function UD(e,r){let t=Ct.relative(r,e);return t===""||!t.startsWith("..")&&!Ct.isAbsolute(t)}function FD(e,r,t){if(!gu(e))return!1;try{let n=r-BD(e).mtimeMs;return Number.isFinite(n)&&n>=0&&n<t}catch{return!1}}function hu(e){if(!e.runId||!e.workerName)return!1;let r=e.now??Date.now(),t=e.heartbeatFreshMs??tv,n=Ct.resolve(e.harnessRoot,"runs"),o=Ct.resolve(n,e.runId,"workers",e.workerName);if(!UD(o,n))return!1;let s=I(Ct.join(o,"worker.json"),void 0);return s&&fn(s,r,t)?!0:s?!1:FD(Ct.join(o,"heartbeat.jsonl"),r,t)}function nv(e){let r=e.now??Date.now(),t=e.heartbeatFreshMs??tv;if(!gu(e.worktreePath))return null;if(e.runId&&e.workerName&&hu(e))return"active_worker";let n=Ct.join(e.worktreePath,".git");if(!gu(n))return null;let o=ne(e.worktreePath,["status","--porcelain"]);if(o.status!==0)return"pr_or_unmerged_commits";let s=o.stdout.split(`
 `).map(c=>c.trim()).filter(c=>c.length>0);if($e(s).length>0)return"dirty_worktree";let i=ne(e.worktreePath,["rev-list","--count","@{u}..HEAD"]);if(i.status===0){let c=Number(i.stdout.trim());if(Number.isFinite(c)&&c>0)return"pr_or_unmerged_commits"}let a=ne(e.worktreePath,["rev-list","--count","origin/main..HEAD"]);if(a.status!==0)return i.status!==0?"pr_or_unmerged_commits":null;let l=Number(a.stdout.trim());return Number.isFinite(l)&&l>0?"pr_or_unmerged_commits":null}Ze();import{existsSync as KD,readdirSync as ov,statSync as HD}from"node:fs";import $D from"node:path";function sv(e={}){let r=he(e.harnessRoot??Be()),t=Yt(r),n=e.now??Date.now(),o=new Date(n).toISOString();if(!KD(t))return{harnessRoot:r,worktreesDir:t,worktreesBytes:0,runCount:0,workerCount:0,oldestRunAt:null,scannedAt:o};let s=0,i=0,a=0,l=null,c;try{c=ov(t,{withFileTypes:!0})}catch{return{harnessRoot:r,worktreesDir:t,worktreesBytes:null,runCount:0,workerCount:0,oldestRunAt:null,scannedAt:o}}for(let u of c){if(!u.isDirectory())continue;i+=1;let d=$D.join(t,u.name);try{let p=HD(d);l=l===null?p.mtimeMs:Math.min(l,p.mtimeMs)}catch{}try{for(let p of ov(d,{withFileTypes:!0}))p.isDirectory()&&(a+=1)}catch{}if(s!==null&&e.perRunEntryCap!==null){let p=e.perRunEntryCap??5e4;if(p<=0)s=null;else{let m=Kr(d,p);m===null?s=null:s+=m}}}return{harnessRoot:r,worktreesDir:t,worktreesBytes:s,runCount:i,workerCount:a,oldestRunAt:l===null?null:new Date(l).toISOString(),scannedAt:o}}Ze();import{existsSync as jD}from"node:fs";import{homedir as VD}from"node:os";import iv from"node:path";var GD=["/var/tmp/kynver-harness",iv.join(VD(),".openclaw","harness")];function ku(e,r,t){if(!t?.trim())return;let n=he(t.trim());e.has(n)||(e.add(n),r.push(n))}function YD(e){return e.scanWellKnown!=null?e.scanWellKnown:process.env.VITEST==="true"?!1:process.env.KYNVER_CLEANUP_SCAN_WELL_KNOWN!=="0"&&!["0","false","no"].includes((process.env.KYNVER_CLEANUP_SCAN_WELL_KNOWN??"").toLowerCase())}function av(e={}){let r=new Set,t=[];ku(r,t,e.harnessRoot??Be());let n=process.env.KYNVER_CLEANUP_EXTRA_ROOTS?.split(",").map(o=>o.trim()).filter(Boolean);for(let o of n??[])ku(r,t,o);if(YD(e))for(let o of GD){let s=iv.resolve(o);!r.has(s)&&jD(s)&&ku(r,t,s)}return t}Tn();function qD(e){let r=process.env[e];return r==="1"||r==="true"||r==="yes"}function JD(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)?n:r}function lv(e={}){let r=e.diskPath?.trim()||process.env.KYNVER_DISK_GUARD_PATH?.trim()||"/",t=JD("KYNVER_DISK_GUARD_MAX_USED_PERCENT",75),n=Vr({...e,diskPath:r,diskMaxUsedPercent:e.diskMaxUsedPercent??t}),o=!n.ok||n.usedPercent>=t,s=process.env.KYNVER_CLEANUP_DISK_PRESSURE_FORCE?.trim().toLowerCase();return s==="none"||s==="off"||s==="0"?o=!1:(s==="pressured"||s==="on"||s==="1")&&(o=!0),{diskGate:n,pressured:o,maxUsedPercent:t}}function cv(e,r){if(!r.pressured)return e;let t=e.execute||!qD("KYNVER_CLEANUP_DRY_RUN_ON_PRESSURE");return{...e,execute:t,nodeModulesAgeMs:0,runIdFilter:void 0,includeOrphans:!0,terminalWorktreesAgeMs:0,runDirectoriesAgeMs:0,worktreesAgeMs:e.worktreesAgeMs>0?e.worktreesAgeMs:6048e5,diskPressure:!0,diskGate:r.diskGate}}Xo();import{unlinkSync as zD}from"node:fs";function Hi(e){let r=process.env[e];return r==="1"||r==="true"||r==="yes"}function uv(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)?n:r}function XD(e,r,t){return e.length===0?[]:t?[...e]:e.length<=r?[]:e.slice(r)}function dv(e={}){let r=e.execute===!0||Hi("KYNVER_WSL_CRASH_DUMP_EXECUTE")||Hi("KYNVER_CLEANUP_EXECUTE"),t=e.purgeAll===!0||Hi("KYNVER_WSL_CRASH_DUMP_PURGE_ALL"),n=Math.max(0,e.keepNewest??uv("KYNVER_WSL_CRASH_DUMP_KEEP_NEWEST",t?0:1)),o=Lt({forceWsl:e.forceWsl});if(!o?.path)return{observation:o,execute:r,keepNewest:n,removed:[],removedBytes:0,skipped:o?.probeError?[{path:o.path??"(unresolved)",reason:o.probeError}]:[]};let s=XD(o.dumps,n,t),i=[],a=[],l=0;for(let c of s){if(!r){a.push({path:c.path,reason:"dry_run"});continue}try{zD(c.path),i.push({path:c.path,bytes:c.bytes,name:c.name}),l+=c.bytes}catch(u){a.push({path:c.path,reason:u.message})}}return{observation:o,execute:r,keepNewest:n,removed:i,removedBytes:l,skipped:a}}function pv(e){return e?Hi("KYNVER_WSL_CRASH_DUMP_CLEANUP")||!e.ok?!0:e.dumpCount>uv("KYNVER_WSL_CRASH_DUMP_KEEP_NEWEST",1):!1}Xo();function Ve(e,r){if(process.env.KYNVER_CLEANUP_QUIET==="1")return;let t=r?`: ${r}`:"";console.error(`[kynver cleanup] ${e}${t}`)}de();var $i=class{aheadOfMain=new Map;countAheadOfMain(r,t="origin/main"){let n=`${r}\0${t}`;if(this.aheadOfMain.has(n))return this.aheadOfMain.get(n)??null;let o=ne(r,["rev-list","--count",`${t}..HEAD`]);if(o.status!==0)return this.aheadOfMain.set(n,null),null;let s=Number(o.stdout.trim()),i=Number.isFinite(s)?s:null;return this.aheadOfMain.set(n,i),i}};import{spawnSync as QD}from"node:child_process";import{existsSync as ZD}from"node:fs";import eM from"node:path";var rM=5e3;function tM(e,r){if(!ZD(eM.join(e,".git")))return{status:null,stdout:"",stderr:"",error:"not_a_git_repo"};try{let t=QD("git",r,{windowsHide:!0,cwd:e,encoding:"utf8",timeout:rM}),n=t.error?.message?.includes("ETIMEDOUT")===!0;return{status:n?null:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:n?"git_timeout":t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}function mv(e){let r=tM(e,["status","--short"]);return r.error==="not_a_git_repo"?[]:r.error==="git_timeout"||r.status!==0?null:r.stdout.split(`
-`).map(t=>t.trim()).filter(Boolean)}var ji=class{cache=new Map;porcelain(r){let t=r,n=this.cache.get(t);if(n!==void 0)return n;let o=mv(t)??[];return this.cache.set(t,o),o}};var Vi=class{cache=new Map;derive(r){let t=this.cache.get(r.id);if(t!==void 0)return t;let n=St(r);return this.cache.set(r.id,n),n}};function nM(e){let r={};for(let t of e)r[t.kind]=(r[t.kind]??0)+1;return r}function fv(e,r={}){let t=r.maxSampleActions??12,n=r.maxSampleSkips??8;return{harnessRoot:e.harnessRoot,scanRoots:e.scanRoots,dryRun:e.dryRun,execute:e.execute,scannedAt:e.scannedAt,finalizedRuns:e.finalizedRuns.length,actionCount:e.actions.length,actionKinds:nM(e.actions),totals:e.totals,...e.storage?{storage:e.storage}:{},...e.preservedLivePaths?.length?{preservedLivePaths:e.preservedLivePaths}:{},...e.removedRunDirectories!=null?{removedRunDirectories:e.removedRunDirectories}:{},sampleActions:e.actions.slice(0,t).map(o=>({kind:o.kind,path:o.path,...o.skipReason?{skipReason:o.skipReason}:{},...o.bytes!=null?{bytes:o.bytes}:{},...o.runId?{runId:o.runId}:{},...o.worker?{worker:o.worker}:{}})),sampleSkips:e.skips.slice(0,n)}}function oM(e={}){let r=e.harnessRoot?he(e.harnessRoot):Be(),t=av({harnessRoot:r}),n=e.now??Date.now();return{harnessRoot:r,scanRoots:t,now:n}}function sM(e){return typeof e=="string"?{reason:e}:e}function hn(e,r,t,n){e.push({path:r,reason:t,...n?{detail:n}:{}})}function Gi(e,r,t){return!r||e.bytes!=null?e:{...e,bytes:Kr(e.path,t)}}function gv(e,r){let t={};for(let n of r)t[n.reason]=(t[n.reason]??0)+1;for(let n of e)n.skipReason&&(t[n.skipReason]=(t[n.skipReason]??0)+1);return t}function iM(e,r){return e.kind==="remove_next_cache"?WR(e,r):MR(e,r)}function aM(e,r,t){return e.kind==="remove_next_cache"?Bi(e.path,r,t):Li(e.path,r,t)}function lM(e){let r=new Map;for(let t of e)for(let[n,o]of XR(t))r.set(n,o);return r}function hv(e,r){return e.runId&&e.worker?Ge.join(r,e.runId,e.worker):Ge.resolve(e.path,"..")}function kv(e){return e.indexed?!1:hu({harnessRoot:e.harnessRoot,runId:e.candidate.runId,workerName:e.candidate.worker,now:e.now})}function cM(e={}){let r=fu(e),t=lv();r=cv(r,t);let n=oM(e);Ve("scan",`${n.scanRoots.length} harness root(s)`);let o=hR(n.scanRoots,n.now),s=r.finalizeStaleRuns?Ao().map(C=>({runId:C.runId,from:C.from,to:C.to})):[];s.length>0&&Ve("finalize",`${s.length} stale run(s) marked terminal`),Ve("index","building worktree index");let i=lM(n.scanRoots);Ve("index",`${i.size} indexed worktree(s)`);let a={runTerminalCache:new Vi,gitStatusCache:new ji,gitRevCache:new $i},l=[],c=[],u=new Set,d=r.maxActionsPerSweep,p=()=>c.length>=d;for(let C of n.scanRoots){if(p())break;Ve("root",C);let re=Ge.join(C,"worktrees"),ke=zR(i,C),Ye={harnessRoot:C,worktreesDir:re,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,runIdFilter:r.runIdFilter,index:ke,now:n.now},gr=r.scanDependencyCaches?YR(Ye):[];Ve("dependency",r.scanDependencyCaches?`${gr.length} cache candidate(s) at ${C}`:"skipped (worktree-only sweep)");let Hr=0;for(let F of gr){if(p())break;Hr+=1,Hr%50===0&&Ve("dependency",`${Hr}/${gr.length} evaluated`);let D=Ge.resolve(F.path);if(u.has(D))continue;u.add(D);let M={...F,path:D},ie=aM(M,C,re);if(ie){hn(l,M.path,ie),c.push({...M,executed:!1,skipped:!0,skipReason:ie});continue}let ye=hv(M,re),Re=ke.get(Ge.resolve(ye))??null,hr=kv({candidate:M,indexed:Re,harnessRoot:C,now:n.now}),V=au({indexed:Re,includeOrphans:!0,nodeModulesAgeMs:r.nodeModulesAgeMs,ageMs:M.ageMs,worktreePath:ye,activeWorktreePaths:o.activeWorktreePaths,workerFilesystemLive:hr,diskPressure:r.diskPressure,gitStatusCache:a.gitStatusCache});if(V){hn(l,M.path,V),c.push({...M,executed:!1,skipped:!0,skipReason:V});continue}c.push(iM(Gi(M,r.accountBytes,r.byteAccountingEntryCap),r.execute))}if(r.scanDependencyCaches)for(let F of HR(Ye)){if(p())break;let D=Ge.resolve(F.path);if(u.has(D))continue;u.add(D);let M={...F,path:D},ie=Ui(M.path,C,re);if(ie){hn(l,M.path,ie),c.push({...M,executed:!1,skipped:!0,skipReason:ie});continue}let ye=hv(M,re),Re=ke.get(Ge.resolve(ye))??null,hr=kv({candidate:M,indexed:Re,harnessRoot:C,now:n.now}),V=pR({indexed:Re,includeOrphans:!0,nodeModulesAgeMs:r.nodeModulesAgeMs,ageMs:M.ageMs,worktreePath:ye,activeWorktreePaths:o.activeWorktreePaths,workerFilesystemLive:hr,diskPressure:r.diskPressure,gitStatusCache:a.gitStatusCache});if(V){hn(l,M.path,V),c.push({...M,executed:!1,skipped:!0,skipReason:V});continue}c.push(LR(Gi(M,r.accountBytes,r.byteAccountingEntryCap),r.execute))}let j=[...$R(Ye),...JR(Ye)];Ve("worktrees",`${j.length} candidate(s) at ${C}`);let T=new Set,te=0;for(let F of j){if(p())break;te+=1,te%50===0&&Ve("worktrees",`${te}/${j.length} evaluated`);let D=Ge.resolve(F.path);if(T.has(D))continue;T.add(D);let M={...F,path:D},ie=ke.get(Ge.resolve(M.path))??null,ye=ie?null:nv({worktreePath:M.path,harnessRoot:C,runId:M.runId,workerName:M.worker,now:n.now}),Re=dR({indexed:ie,worktreePath:Ge.resolve(M.path),includeOrphans:r.includeOrphans,worktreesAgeMs:r.worktreesAgeMs,terminalWorktreesAgeMs:r.terminalWorktreesAgeMs,ageMs:M.ageMs,orphanSafety:ye,worktreeRemovalGuard:e.worktreeRemovalGuard,liveness:a,now:n.now,harnessRoot:C,writeSalvageEvidence:r.execute});if(Re){let{reason:hr,detail:V}=sM(Re);hn(l,M.path,hr,V),c.push({...M,executed:!1,skipped:!0,skipReason:hr});continue}c.push(UR(Gi(M,r.accountBytes,r.byteAccountingEntryCap),r.execute))}if(!p()&&r.runDirectoriesAgeMs>=0)for(let F of wR({harnessRoot:C,worktreesDir:re,runDirectoriesAgeMs:r.runDirectoriesAgeMs,runIdFilter:r.runIdFilter,activeGuards:o,now:n.now})){if(p())break;let D=Ge.resolve(F.path);if(u.has(D))continue;u.add(D);let M={...F,path:D},ie=M.runId??Ge.basename(D),ye=SR({harnessRoot:C,runId:ie,runPath:D,ageMs:M.ageMs,runDirectoriesAgeMs:r.runDirectoriesAgeMs,activeGuards:o});if(ye){hn(l,M.path,ye),c.push({...M,executed:!1,skipped:!0,skipReason:ye});continue}c.push(BR(Gi(M,r.accountBytes,r.byteAccountingEntryCap),r.execute))}}let m=0,f=0,y=0,k=0,b=0,g=0;for(let C of c)C.bytes&&(m+=C.bytes),!C.skipped&&!C.executed&&C.bytes&&(y+=C.bytes),C.executed?(b+=1,k+=C.bytes??0,C.kind==="remove_run_directory"&&(f+=1)):C.skipped&&(g+=1,C.skipReason==="dry_run"&&C.bytes&&(y+=C.bytes));let h=r.accountBytes?sv({harnessRoot:n.harnessRoot,now:n.now,perRunEntryCap:r.storagePerRunEntryCap}):void 0,w=Lt(),E=r.execute&&pv(w),S=E?dv({execute:!0}):null,_=w?{observed:!0,execute:E,dumpCount:w.dumpCount,totalBytes:w.totalBytes,removedCount:S?.removed.length??0,removedBytes:S?.removedBytes??0,executables:w.executables,path:w.path,reason:w.reason}:void 0;S&&S.removed.length>0&&(k+=S.removedBytes,b+=S.removed.length,Ve("wsl-crashes",`removed ${S.removed.length} dump(s), ${S.removedBytes} bytes`)),Ve("complete",`${c.length} action(s), ${g} skipped, ${b} removed`);let K=fR(c,l),$=fv({harnessRoot:n.harnessRoot,scanRoots:n.scanRoots,dryRun:!r.execute,execute:r.execute,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,diskPressure:r.diskPressure,diskGate:r.diskGate?{ok:r.diskGate.ok,path:r.diskGate.path,freeBytes:r.diskGate.freeBytes,usedPercent:r.diskGate.usedPercent,reason:r.diskGate.reason}:void 0,scannedAt:new Date(n.now).toISOString(),finalizedRuns:s,actions:c,skips:l,totals:{candidateBytes:m,reclaimableBytes:y,removedBytes:k,removedPaths:b,skippedPaths:g,skipReasons:gv(c,l)},...h?{storage:h}:{},...K.length>0?{preservedLivePaths:K}:{},...f>0?{removedRunDirectories:f}:{},..._?{wslCrashDumps:_}:{}});return{harnessRoot:n.harnessRoot,scanRoots:n.scanRoots,dryRun:!r.execute,execute:r.execute,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,diskPressure:r.diskPressure,diskGate:r.diskGate?{ok:r.diskGate.ok,path:r.diskGate.path,freeBytes:r.diskGate.freeBytes,usedPercent:r.diskGate.usedPercent,reason:r.diskGate.reason}:void 0,scannedAt:new Date(n.now).toISOString(),finalizedRuns:s,actions:c,skips:l,totals:{candidateBytes:m,reclaimableBytes:y,removedBytes:k,removedPaths:b,skippedPaths:g,skipReasons:gv(c,l)},...h?{storage:h}:{},...K.length>0?{preservedLivePaths:K}:{},...f>0?{removedRunDirectories:f}:{},..._?{wslCrashDumps:_}:{},compactSummary:$}}function yv(e){let r=rv(e);return cM({execute:r.execute,finalizeStaleRuns:r.finalizeStaleRuns,accountBytes:r.accountBytes,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,runIdFilter:r.runIdFilter})}function Rv(){return process.env.KYNVER_PIPELINE_CLEANUP!=="0"}import{readFile as dM}from"node:fs/promises";import{homedir as pM}from"node:os";import Pt from"node:path";En();var uM={"@kynver-app/runtime":"0.1.83","@kynver-app/openclaw-agent-os":"0.1.43","@kynver-app/mcp-agent-os":"0.3.34"},nQ=Object.keys(uM);function vv(e){let r=e.trim().split("-")[0]?.split("+")[0];if(!r)return null;let t=r.split(".");if(t.length<1||t.length>3)return null;let n=t.map(o=>Number.parseInt(o,10));if(n.some(o=>!Number.isFinite(o)||o<0))return null;for(;n.length<3;)n.push(0);return[n[0],n[1],n[2]]}function bv(e,r){let t=vv(e),n=vv(r);if(!t||!n)return 0;for(let o=0;o<3;o+=1){if(t[o]>n[o])return 1;if(t[o]<n[o])return-1}return 0}var mM=["@kynver-app/runtime","@kynver-app/openclaw-agent-os","@kynver-app/mcp-agent-os"];function kn(e){let r=e?.trim();return r||null}function fM(e){return[...new Set(e.filter(r=>!!r))]}function gM(){let e=pM(),r=kn(process.env.KYNVER_OPENCLAW_NPM_ROOT)??kn(process.env.OPENCLAW_NPM_ROOT)??Pt.join(e,".openclaw","npm"),t=kn(process.env.KYNVER_NPM_GLOBAL_ROOT)??kn(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT)??(kn(process.env.NPM_CONFIG_PREFIX)?Pt.join(kn(process.env.NPM_CONFIG_PREFIX),"lib","node_modules"):Pt.join(e,".npm-global","lib","node_modules"));return fM([Pt.join(r,"lib","node_modules"),Pt.join(r,"node_modules"),t.endsWith("node_modules")?t:Pt.join(t,"lib","node_modules")])}async function hM(e){try{let r=JSON.parse(await dM(e,"utf8"));return typeof r.version=="string"&&r.version.trim()?r.version.trim():null}catch{return null}}function kM(e){let r=gM(),t=new Set,n=[];for(let o of r){let s=Pt.join(o,e,"package.json");t.has(s)||(t.add(s),n.push(s))}return n}async function Sv(e=new Date().toISOString()){let r={};for(let t of mM){let n=null;for(let o of kM(t)){let s=await hM(o);s&&(!n||bv(s,n.version)>0)&&(n={version:s,path:o})}n&&(r[t]={version:n.version,observedAt:e,path:n.path})}return r}import{spawnSync as yM}from"node:child_process";var RM=1e4,vM=4*1024*1024,wv=(e,r,t)=>{try{let n=yM(e,r,{windowsHide:!0,encoding:"utf8",stdio:["ignore","pipe","pipe"],timeout:t?.timeoutMs??RM,maxBuffer:vM});return{ok:n.status===0,stdout:typeof n.stdout=="string"?n.stdout:"",stderr:typeof n.stderr=="string"?n.stderr:""}}catch(n){return{ok:!1,stdout:"",stderr:n instanceof Error?n.message:String(n)}}};function Yi(e,r,t){return`${e} ${r} ${t}`}function yu(e){let r=e.lastIndexOf("@");if(r<=0||r===e.length-1)return null;let t=e.slice(0,r),n=e.slice(r+1);return!/^[^/\s]+\/[^/\s]+$/.test(t)||!/^[0-9a-f]{7,40}$/i.test(n)?null:{repo:t,sha:n}}function xv(e){let r=e.trim().match(/[/:]([^/]+\/[^/]+)\/(?:pull|pulls|merge_requests|pull-requests)\/(\d+)/i);if(!r)return null;let t=Number(r[2]);return!Number.isFinite(t)||t<=0?null:{repo:r[1],number:t}}var bM=8e3,SM=30,wM=100,xM=400,_M=3600*1e3,Ru=0;function bu(){return Date.now()<Ru}function EM(e){let r=`${e.stdout}
-${e.stderr}`.toLowerCase();return r.includes("api rate limit exceeded")||r.includes("rate limit exceeded")||r.includes("secondary rate limit")}function _v(e){EM(e)&&(Ru=Math.max(Ru,Date.now()+_M))}function vu(e,r){if(bu())return null;let t=e("gh",["api",...r]);if(!t.ok||!t.stdout.trim())return _v(t),null;try{return JSON.parse(t.stdout)}catch{return null}}function CM(e,r,t,n){if(bu())return null;let o=e("gh",["pr","view",String(t),"--repo",r,"--json",n.join(",")]);if(!o.ok||!o.stdout.trim())return _v(o),null;try{return JSON.parse(o.stdout)}catch{return null}}function Su(e){return bu()?!1:process.env.GITHUB_TOKEN?.trim()||process.env.GH_TOKEN?.trim()?!0:e("gh",["auth","token"]).ok}function yn(e){return e&&typeof e=="object"&&!Array.isArray(e)?e:null}function PM(e){return Array.isArray(e)?e.map(r=>yn(r)).filter(r=>r!==null).slice(0,SM).map(r=>({context:r.context??null,state:r.state??null,target_url:r.target_url??null,description:r.description??null})):[]}function AM(e,r,t){let n=vu(e,[`repos/${r}/commits/${t}/status`]);return n?{state:n.state??null,statuses:PM(n.statuses)}:null}var Ev={provider:"github",kind:"pr_snapshot",version:"2",isAvailable:Su,collect(e,r){let t=xv(e);if(!t)return null;let n=CM(r,t.repo,t.number,["url","title","body","author","state","isDraft","mergedAt","mergeCommit","mergeable","headRefName","headRefOid","headRepositoryOwner","statusCheckRollup","files"]);if(!n)return null;let o=yn(n.author),s=yn(n.mergeCommit),i=yn(n.headRepositoryOwner),a=typeof n.body=="string"?n.body.slice(0,bM):null,l=Array.isArray(n.statusCheckRollup)?n.statusCheckRollup.map(u=>yn(u)).filter(u=>u!==null).slice(0,wM).map(u=>({name:u.name??u.context??null,status:u.status??u.state??null,conclusion:u.conclusion??null,workflowName:u.workflowName??null,detailsUrl:u.detailsUrl??null})):[],c=Array.isArray(n.files)?n.files.map(u=>yn(u)).map(u=>typeof u?.path=="string"?u.path.trim():"").filter(Boolean).slice(0,xM):[];return{pull:{html_url:n.url??null,title:n.title??null,body:a,user:{login:o?.login??null},state:typeof n.state=="string"?n.state.toLowerCase():null,draft:n.isDraft??null,merged:!!n.mergedAt,merged_at:n.mergedAt??null,merge_commit_sha:s?.oid??null,mergeable:null,mergeable_state:n.mergeable??null,head:{sha:n.headRefOid??null,ref:n.headRefName??null,repo:{owner:{login:i?.login??null}}}},checkRuns:l,combinedStatus:{state:null,statuses:[]},changedFiles:c}}},Cv={provider:"github",kind:"commit_status",version:"1",isAvailable:Su,collect(e,r){let t=yu(e);return t?AM(r,t.repo,t.sha):null}},Pv={provider:"github",kind:"branch_reachability",version:"1",isAvailable:Su,collect(e,r){let t=yu(e);if(!t)return null;let n=vu(r,[`repos/${t.repo}`]),o=typeof n?.default_branch=="string"&&n.default_branch.trim()?n.default_branch.trim():null;if(!o)return null;let s=vu(r,[`repos/${t.repo}/compare/${encodeURIComponent(o)}...${t.sha}`]);if(!s)return null;let i=typeof s.status=="string"?s.status:null;return{defaultBranch:o,compareStatus:i,reachable:i==="identical"||i==="behind"}}};var xu=[];function wu(e){xu.some(r=>r.provider===e.provider&&r.kind===e.kind)||xu.push(e)}function Av(e,r){return xu.find(t=>t.provider===e&&t.kind===r)??null}function Iv(){wu(Ev),wu(Cv),wu(Pv)}var IM=1,OM=25e3;function Ov(e,r={}){Iv();let t=r.run??wv,n=r.now??(()=>new Date),o=r.maxSubjects??IM,s=Date.now()+(r.deadlineMs??OM),i=new Set,a=e.filter(m=>{let f=Yi(m.provider,m.kind,m.subject);return i.has(f)?!1:(i.add(f),!0)}),l=a.length>0?Math.floor(n().getTime()/6e4)%a.length:0,u=a.map((m,f)=>a[(l+f)%a.length]).slice(0,o),d={attempted:0,collected:0,cached:0,items:[],skipped:[]},p=new Map;for(let m of u){let f=Yi(m.provider,m.kind,m.subject),y=n(),k=r.cache?.get(f,y)??null;if(k){d.cached+=1,d.collected+=1,d.items.push(k);continue}if(Date.now()>s){d.skipped.push({...m,reason:"budget_exhausted"});continue}let b=Av(m.provider,m.kind);if(!b){d.skipped.push({...m,reason:"no_recipe"});continue}let g=`${b.provider} ${b.kind}`,h=p.get(g);if(h===void 0&&(h=b.isAvailable(t),p.set(g,h)),!h){d.skipped.push({...m,reason:"provider_unavailable"});continue}if(r.cache?.reserve?.(m,f,n())===!1){d.skipped.push({...m,reason:"budget_exhausted"});continue}d.attempted+=1;let w=b.collect(m.subject,t);if(w==null){d.skipped.push({...m,reason:"collect_failed"});continue}d.collected+=1;let E={provider:m.provider,kind:m.kind,subject:m.subject,payload:w,observedAt:n().toISOString(),collectorVersion:b.version};d.items.push(E),r.cache?.set(f,E,n())}return d}B();O();import WM from"node:path";B();O();import Tv from"node:path";var TM="provider-evidence-wanted.json",NM="provider-evidence-cache.json",DM=600*1e3;function Nv(e){return Tv.join(N(e),TM)}function MM(e){return Tv.join(N(e),NM)}function Dv(e){if(!Array.isArray(e))return[];let r=[];for(let t of e){if(!t||typeof t!="object"||Array.isArray(t))continue;let n=t,o=typeof n.provider=="string"?n.provider.trim():"",s=typeof n.kind=="string"?n.kind.trim():"",i=typeof n.subject=="string"?n.subject.trim():"";!o||!s||!i||r.push({provider:o,kind:s,subject:i})}return r}function Mv(e){let r=I(Nv(e),null);return Dv(r?.wanted)}function Wv(e,r){ue(Nv(e),{savedAt:new Date().toISOString(),wanted:r})}function Lv(e,r={}){let t=r.ttlMs??DM,n=MM(e),s={...I(n,null)?.items??{}},i=!1;return{get(l,c){let u=s[l];if(!u)return null;let d=Date.parse(u.observedAt);return!Number.isFinite(d)||c.getTime()-d>t?(delete s[l],i=!0,null):u},set(l,c){s[l]=c,i=!0},flush(){i&&(ue(n,{savedAt:new Date().toISOString(),items:s}),i=!1)}}}function Bv(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let r=e.providerEvidenceWanted;return Array.isArray(r)?Dv(r):null}var LM="provider-evidence-shared-cache.json",BM=6e4,UM=1,FM=1;function _u(e,r){let t=process.env[e];if(!t)return r;let n=Number.parseInt(t,10);return Number.isFinite(n)&&n>=0?n:r}function KM(){return WM.join(le().harnessRoot,LM)}function HM(e){let r=e.toUpperCase().replace(/[^A-Z0-9]+/g,"_"),t=e==="github"?UM:FM;return _u(`KYNVER_PROVIDER_EVIDENCE_${r}_PER_MINUTE`,_u("KYNVER_PROVIDER_EVIDENCE_LIVE_COLLECTS_PER_MINUTE",t))}function Uv(){return _u("KYNVER_PROVIDER_EVIDENCE_SHARED_CACHE_TTL_MS",BM)}function $M(e){return Math.floor(e.getTime()/6e4)*6e4}function jM(e){return`${e.provider}:${e.kind}`}function Fv(e,r={}){let t=Lv(e,{ttlMs:r.ttlMs??Uv()}),n=r.file??KM(),o=I(n,null),s={...o?.items??{}},i={...o?.budget??{}},a=r.ttlMs??Uv(),l=!1;return{get(u,d){let p=t.get(u,d);if(p)return p;let m=s[u];if(!m)return null;let f=Date.parse(m.observedAt);return!Number.isFinite(f)||d.getTime()-f>a?(delete s[u],l=!0,null):(t.set(u,m,d),m)},set(u,d,p){t.set(u,d,p),s[u]=d,l=!0},reserve(u,d,p){let m=HM(u.provider);if(m===0)return!0;let f=jM(u),y=$M(p),k=i[f];return!k||k.windowStartMs!==y?(i[f]={windowStartMs:y,used:1},l=!0,!0):k.used>=m?!1:(k.used+=1,l=!0,!0)},flush(){t.flush(),l&&(ue(n,{savedAt:new Date().toISOString(),items:s,budget:i}),l=!1)}}}O();B();import Kv from"node:path";var Hv="mesh-cron-lease.json";function $v(e){let r=I(Kv.join(N(e),Hv),null);return Jh(e,r)??r}function jv(e,r){let t={...r,updatedAt:new Date().toISOString()};ue(Kv.join(N(e),Hv),t),qh(e,t)}function Vv(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let r=e.response;if(!r||typeof r!="object"||Array.isArray(r))return null;let t=r.meshLiveness;if(!t||typeof t!="object"||Array.isArray(t))return null;let n=t.cronLease;if(!n||typeof n!="object"||Array.isArray(n))return null;let o=n;return{leaseToken:typeof o.leaseToken=="string"?o.leaseToken:null,holderBoxId:typeof o.holderBoxId=="string"?o.holderBoxId:null,authorized:o.authorized===!0,updatedAt:new Date().toISOString()}}function Gv(e){let r=wh(),t=Lr(e?.env??process.env),n=(e?.now??(()=>new Date))().getTime(),o={};if(t.flags.dispatchReceipts!=="off"){Object.assign(o,Wh());let s=Mh({nowMs:n,hasLiveWorker:e?.hasLiveWorker});o["dispatchReceipts.strandedClaimCandidates"]=s.strandedClaimCandidates,t.flags.dispatchReceipts==="enforce"&&Object.assign(o,Ky())}return t.flags.planOutbox!=="off"&&Object.assign(o,Kk()),t.flags.admission!=="off"&&(Object.assign(o,Fh()),t.flags.admission==="enforce"&&Object.assign(o,jh())),(t.flags.keeper!=="off"||t.flags.meshLease!=="off"||t.flags.quota!=="off")&&Object.assign(o,ek()),{contractVersion:1,observedAt:new Date(n).toISOString(),state:r.state,schemaVersion:r.schemaVersion,recovered:r.recovered,unavailableClass:r.reason?r.reason.split(":")[0]??null:null,flags:t.flags,flagSources:t.sources,flagWarningCount:t.warnings.length,divergenceCounters:o}}H();import{createHash as Yv}from"node:crypto";import{access as VM,mkdir as YQ,readFile as qv,rename as qQ,writeFile as JQ}from"node:fs/promises";import{constants as GM}from"node:fs";import{homedir as Eu}from"node:os";import Ee from"node:path";var YM=/^(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)$/i,qM=/^[A-Za-z0-9._:-]{8,128}$/;function JM(){return process.env.KYNVER_MCP_UPDATE_INVENTORY_FILE?.trim()||Ee.join(Eu(),".kynver","mcp-installations.json")}function zM(e){return e==="openclaw"?process.env.KYNVER_OPENCLAW_NPM_ROOT?.trim()||Ee.join(Eu(),".openclaw","npm"):process.env.KYNVER_NPM_GLOBAL_ROOT?.trim()||process.env.NPM_CONFIG_PREFIX?.trim()||Ee.join(Eu(),".npm-global")}function XM(e){let r=Ee.resolve(e);if(Ee.basename(r)!=="node_modules")return r;let t=Ee.dirname(r);return Ee.basename(t)==="lib"?Ee.dirname(t):t}function QM(e,r){return[Ee.join(e,"lib","node_modules",r,"package.json"),Ee.join(e,"node_modules",r,"package.json")]}async function ZM(e){try{return await VM(e,GM.R_OK),!0}catch{return!1}}async function eW(e=JM()){let r;try{r=JSON.parse(await qv(e,"utf8"))}catch{return[]}if(r.version!==1||!Array.isArray(r.installations)||r.installations.length>100)throw new Error("invalid MCP installation inventory");return r.installations.map(t=>{if(!t||!qM.test(t.inventoryKey)||!YM.test(t.packageName)||!["kynver","openclaw"].includes(t.prefix))throw new Error("invalid adopted MCP installation");if(t.packageName.includes("..")||t.packageName.includes("%"))throw new Error("invalid adopted MCP package identity");if(t.connectionId&&t.connectionId.length>128)throw new Error("invalid connection identity");if(t.binName&&!/^[A-Za-z0-9._-]{1,80}$/.test(t.binName))throw new Error("invalid MCP bin name");let n=t.envAllowlist??[];if(!Array.isArray(n)||n.length>32||n.some(o=>!/^[A-Z][A-Z0-9_]{1,80}$/.test(o)))throw new Error("invalid MCP environment allow-list");return{...t,envAllowlist:[...new Set(n)],lifecycle:t.lifecycle??"runtime_stdio"}})}function rW(e,r,t){if(typeof e.bin=="string")return Ee.join(t,e.bin);if(!e.bin||typeof e.bin!="object"||Array.isArray(e.bin))return null;let n=e.bin,o=r.binName??(Object.keys(n).length===1?Object.keys(n)[0]:void 0),s=o?n[o]:null;return typeof s=="string"&&!Ee.isAbsolute(s)&&!s.split(/[\\/]/).includes("..")?Ee.join(t,s):null}function tW(e){return Yv("sha256").update(JSON.stringify({inventoryKey:e.inventoryKey,connectionId:e.connectionId,packageName:e.packageName,managerKind:e.managerKind,sourceKind:e.sourceKind,installedVersion:e.installedVersion,nodeVersion:e.nodeVersion,policyChannel:e.policyChannel,executionConfigDigest:e.executionConfigDigest,capabilities:[...e.capabilities].sort()})).digest("hex")}async function nW(e){let r=[];for(let t of e){let n=XM(zM(t.prefix)),o=(await Promise.all(QM(n,t.packageName).map(async m=>({candidate:m,ok:await ZM(m)})))).find(m=>m.ok)?.candidate;if(!o)continue;let s=JSON.parse(await qv(o,"utf8"));if(s.name!==t.packageName||typeof s.version!="string"||!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(s.version))continue;let i=Ee.dirname(o),a=rW(s,t,i),l=t.packageName==="@kynver-app/runtime",c=t.lifecycle??"runtime_stdio",u=Yv("sha256").update(JSON.stringify({prefix:n,binName:t.binName??null,envAllowlist:[...t.envAllowlist??[]].sort(),lifecycle:c})).digest("hex"),d=l?[]:c==="runtime_stdio"&&a?["update","restart","rollback","verify_mcp"]:["update","rollback"],p={inventoryKey:t.inventoryKey,connectionId:t.connectionId??null,packageName:t.packageName,managerKind:"npm_global",sourceKind:"configured_stdio",installedVersion:s.version,nodeVersion:process.versions.node,policyChannel:"latest",executionConfigDigest:u,capabilities:d};r.push({report:{...p,displayName:t.displayName?.trim()||t.packageName,inventoryFingerprint:tW(p),capabilityExplanation:l?"Runtime self-update requires a supervisor-owned durable handoff and is not enabled by this adapter.":c==="runtime_stdio"&&a?"The authorized runtime can install, start, and verify this configured stdio package.":"The package can be installed, but its external supervisor must restart and verify it."},local:{prefix:n,packageJsonPath:o,packageDir:i,binPath:a,envAllowlist:t.envAllowlist??[],lifecycle:c}})}return r}async function Jv(){return nW(await eW())}import{createHash as oW,createHmac as sW,timingSafeEqual as iW}from"node:crypto";function Cu(e){let r=e.trim().split(".");return r.length!==3||r[0]!=="krc1"||!r[1]||!r[2]?null:{tokenId:r[1],tokenHash:oW("sha256").update(`krc1.${r[1]}.${r[2]}`,"utf8").digest("hex")}}function zv(e,r,t){let n=Cu(r);if(!n||e.algorithm!=="hmac-sha256-runner-v1"||e.keyId!==n.tokenId)return!1;let o=Date.parse(e.claims.expiresAt);if(e.claims.version!==1||e.claims.agentOsId!==t||!Number.isFinite(o)||o<=Date.now()||o>Date.now()+10*6e4||![null,"installing","restarting","verifying"].includes(e.claims.resumePhase))return!1;let s=sW("sha256",Buffer.from(n.tokenHash,"hex")).update(JSON.stringify(e.claims),"utf8").digest(),i=Buffer.from(e.signature,"base64url");return i.length===s.length&&iW(i,s)}ea();Rr();import{createHash as aW}from"node:crypto";import{access as Pu,mkdtemp as lW,readFile as rb,rm as cW}from"node:fs/promises";import{constants as Au}from"node:fs";import{tmpdir as uW}from"node:os";import Rn from"node:path";import{spawn as dW}from"node:child_process";import{Client as pW}from"@modelcontextprotocol/sdk/client/index.js";import{StdioClientTransport as mW}from"@modelcontextprotocol/sdk/client/stdio.js";var Iu="https://registry.npmjs.org",Xv=512*1024,Ou=2*6e4,fW=2e4;function tb(){return"npm"}function Qv(e,r){return Buffer.byteLength(e)>=Xv?e:(e+r.toString("utf8")).slice(0,Xv)}function gW(e){let r=process.env.KYNVER_MCP_UPDATE_NPM_CACHE?.trim(),t=r&&Rn.isAbsolute(r)?r:e,n={PATH:process.env.PATH,SystemRoot:process.env.SystemRoot,TEMP:process.env.TEMP,TMP:process.env.TMP,npm_config_registry:Iu,npm_config_audit:"false",npm_config_fund:"false",npm_config_update_notifier:"false",npm_config_cache:t};return Object.fromEntries(Object.entries(n).filter(o=>typeof o[1]=="string"))}async function nb(e,r,t=Ou,n){return new Promise((o,s)=>{let i,a;try{[i,a]=pe(e,r)}catch(m){s(m);return}let l=dW(i,a,{shell:!1,windowsHide:!0,detached:ce(),env:gW(n),stdio:["ignore","pipe","pipe"]}),c="",u="",d=!1;l.stdout.on("data",m=>{c=Qv(c,m)}),l.stderr.on("data",m=>{u=Qv(u,m)});let p=setTimeout(()=>{d=!0,l.pid&&De(l.pid,"SIGKILL")},t);l.once("error",m=>{clearTimeout(p),s(m)}),l.once("close",m=>{clearTimeout(p),d?s(new Error("process_timeout")):o({code:m,stdout:c,stderr:u})})})}function hW(e,r){let[t,n]=r.split("-",2);return!n||!["sha256","sha384","sha512"].includes(t)?!1:aW(t).update(e).digest("base64")===n}async function kW(e,r,t,n){let o=await nb(tb(),["pack",`${e}@${r}`,"--json","--pack-destination",n,`--registry=${Iu}`,"--ignore-scripts"],Ou,Rn.join(n,"npm-cache"));if(o.code!==0)throw new Error("artifact_download_failed");let s;try{s=JSON.parse(o.stdout)}catch{throw new Error("artifact_receipt_invalid")}let i=s[0]?.filename;if(typeof i!="string"||Rn.basename(i)!==i)throw new Error("artifact_receipt_invalid");let a=Rn.join(n,i);if(!hW(await rb(a),t))throw new Error("artifact_integrity_mismatch");return a}async function yW(e,r,t){if((await nb(tb(),["install","--global","--prefix",e,r,`--registry=${Iu}`,"--no-audit","--fund=false"],Ou,t)).code!==0)throw new Error("package_install_failed")}async function ob(e){let r=JSON.parse(await rb(e.local.packageJsonPath,"utf8"));if(r.name!==e.report.packageName||typeof r.version!="string")throw new Error("installed_identity_mismatch");return r.version}function RW(e){let r={};for(let t of["PATH","SystemRoot","TEMP","TMP",...e]){let n=process.env[t];n!==void 0&&(r[t]=n)}return r}async function Zv(e){if(!e.local.binPath)throw new Error("mcp_binary_missing");await Pu(e.local.binPath,Au.X_OK).catch(async()=>Pu(e.local.binPath,Au.R_OK));let r=new mW({command:e.local.binPath,args:[],env:RW(e.local.envAllowlist),stderr:"pipe"}),t=new pW({name:"kynver-managed-update-verifier",version:"1.0.0"}),n;try{await Promise.race([t.connect(r),new Promise((s,i)=>{n=setTimeout(()=>i(new Error("mcp_handshake_timeout")),fW)})]);let o=await t.listTools();return{toolCount:Array.isArray(o.tools)?o.tools.length:0}}finally{n&&clearTimeout(n),await t.close().catch(()=>{})}}async function eb(e,r,t,n,o){let s=await lW(Rn.join(uW(),"kynver-mcp-update-"));try{let i=await kW(r,t,n,s);if(await o(),await yW(e.local.prefix,i,Rn.join(s,"npm-cache")),await ob(e)!==t)throw new Error("installed_version_mismatch")}finally{await cW(s,{recursive:!0,force:!0})}}async function sb(e,r,t,n={}){if(typeof process.getuid=="function"&&process.getuid()===0)throw new Error("root_execution_refused");if(e.report.inventoryKey!==r.inventoryKey||e.report.inventoryFingerprint!==r.inventoryFingerprint||e.report.packageName!==r.packageName)throw new Error("local_inventory_mismatch");if(r.packageName==="@kynver-app/runtime")throw new Error("runtime_self_update_requires_supervisor");await t("preflight"),await Pu(e.local.prefix,Au.W_OK).catch(()=>{throw new Error("npm_prefix_not_writable")});let o=await ob(e),s=r.resumePhase!==null&&o===r.targetVersion,i=s&&n.recoveryVerifiedTargetInstalled===!0;if(!i&&o!==r.installedVersion&&!s)throw new Error("installed_version_changed");try{if(i?await t("installing"):(await eb(e,r.packageName,r.targetVersion,r.targetIntegrity,async()=>{await t("installing"),await n.beforePackageMutation?.()}),await n.onTargetInstalled?.()),e.local.lifecycle!=="runtime_stdio")return{outcome:"manual_restart_required",observedVersion:r.targetVersion,handshakeVerified:!1,toolCount:null,failureCode:"external_supervisor_restart_required"};await t("restarting"),await t("verifying");let a=await Zv(e);return{outcome:"succeeded",observedVersion:r.targetVersion,handshakeVerified:!0,toolCount:a.toolCount}}catch(a){let l=a instanceof Error?a.message:"update_failed";if(l==="progress_rejected")throw a;if(!r.rollbackIntegrity)return{outcome:"failed",observedVersion:null,handshakeVerified:!1,toolCount:null,failureCode:l};await n.beforePackageMutation?.();try{if(await eb(e,r.packageName,r.installedVersion,r.rollbackIntegrity,async()=>{await n.beforePackageMutation?.()}),e.local.lifecycle==="runtime_stdio"){let c=await Zv(e);return{outcome:"rollback_succeeded",observedVersion:r.installedVersion,handshakeVerified:!0,toolCount:c.toolCount,failureCode:l}}return{outcome:"manual_restart_required",observedVersion:r.installedVersion,handshakeVerified:!1,toolCount:null,failureCode:l}}catch(c){if(c instanceof Error&&c.message==="progress_rejected")throw c;return{outcome:"rollback_failed",observedVersion:null,handshakeVerified:!1,toolCount:null,failureCode:l}}}}import{randomBytes as Du}from"node:crypto";import{mkdir as Mu,readFile as Wu,rename as CW,rm as qi,stat as PW,writeFile as ub}from"node:fs/promises";import At from"node:path";import{createHmac as vW,timingSafeEqual as bW}from"node:crypto";import{mkdir as SW,readFile as wW,rename as xW,writeFile as _W}from"node:fs/promises";import{homedir as EW}from"node:os";import Tu from"node:path";function Nu(){return process.env.KYNVER_MCP_UPDATE_STATE_ROOT?.trim()||Tu.join(EW(),".kynver","state","mcp-updates")}function ib(e){if(!/^[A-Za-z0-9_-]{8,128}$/.test(e))throw new Error("invalid update operation identity");return Tu.join(Nu(),`${e}.json`)}function ab(e,r){let t=Cu(r);return t?vW("sha256",Buffer.from(t.tokenHash,"hex")).update(JSON.stringify(e),"utf8").digest("base64url"):null}async function lb(e,r){try{let t=JSON.parse(await wW(ib(e),"utf8"));if(t.version!==2||t.operationId!==e||typeof t.integrityMac!="string")return null;let{integrityMac:n,...o}=t,s=ab(o,r);if(!s)return null;let i=Buffer.from(n,"utf8"),a=Buffer.from(s,"utf8");return i.length!==a.length||!bW(i,a)?null:t}catch{return null}}async function cb(e,r){let t=ab(e,r);if(!t)throw new Error("invalid_runner_credential_for_receipt");let n=ib(e.operationId);await SW(Tu.dirname(n),{recursive:!0,mode:448});let o=`${n}.${process.pid}.tmp`;await _W(o,`${JSON.stringify({...e,integrityMac:t},null,2)}
+`).map(t=>t.trim()).filter(Boolean)}var ji=class{cache=new Map;porcelain(r){let t=r,n=this.cache.get(t);if(n!==void 0)return n;let o=mv(t)??[];return this.cache.set(t,o),o}};var Vi=class{cache=new Map;derive(r){let t=this.cache.get(r.id);if(t!==void 0)return t;let n=St(r);return this.cache.set(r.id,n),n}};function nM(e){let r={};for(let t of e)r[t.kind]=(r[t.kind]??0)+1;return r}function fv(e,r={}){let t=r.maxSampleActions??12,n=r.maxSampleSkips??8;return{harnessRoot:e.harnessRoot,scanRoots:e.scanRoots,dryRun:e.dryRun,execute:e.execute,scannedAt:e.scannedAt,finalizedRuns:e.finalizedRuns.length,actionCount:e.actions.length,actionKinds:nM(e.actions),totals:e.totals,...e.storage?{storage:e.storage}:{},...e.preservedLivePaths?.length?{preservedLivePaths:e.preservedLivePaths}:{},...e.removedRunDirectories!=null?{removedRunDirectories:e.removedRunDirectories}:{},sampleActions:e.actions.slice(0,t).map(o=>({kind:o.kind,path:o.path,...o.skipReason?{skipReason:o.skipReason}:{},...o.bytes!=null?{bytes:o.bytes}:{},...o.runId?{runId:o.runId}:{},...o.worker?{worker:o.worker}:{}})),sampleSkips:e.skips.slice(0,n)}}function oM(e={}){let r=e.harnessRoot?he(e.harnessRoot):Be(),t=av({harnessRoot:r}),n=e.now??Date.now();return{harnessRoot:r,scanRoots:t,now:n}}function sM(e){return typeof e=="string"?{reason:e}:e}function hn(e,r,t,n){e.push({path:r,reason:t,...n?{detail:n}:{}})}function Gi(e,r,t){return!r||e.bytes!=null?e:{...e,bytes:Kr(e.path,t)}}function gv(e,r){let t={};for(let n of r)t[n.reason]=(t[n.reason]??0)+1;for(let n of e)n.skipReason&&(t[n.skipReason]=(t[n.skipReason]??0)+1);return t}function iM(e,r){return e.kind==="remove_next_cache"?WR(e,r):MR(e,r)}function aM(e,r,t){return e.kind==="remove_next_cache"?Bi(e.path,r,t):Li(e.path,r,t)}function lM(e){let r=new Map;for(let t of e)for(let[n,o]of XR(t))r.set(n,o);return r}function hv(e,r){return e.runId&&e.worker?Ge.join(r,e.runId,e.worker):Ge.resolve(e.path,"..")}function kv(e){return e.indexed?!1:hu({harnessRoot:e.harnessRoot,runId:e.candidate.runId,workerName:e.candidate.worker,now:e.now})}function cM(e={}){let r=fu(e),t=lv();r=cv(r,t);let n=oM(e);Ve("scan",`${n.scanRoots.length} harness root(s)`);let o=hR(n.scanRoots,n.now),s=r.finalizeStaleRuns?Ao().map(C=>({runId:C.runId,from:C.from,to:C.to})):[];s.length>0&&Ve("finalize",`${s.length} stale run(s) marked terminal`),Ve("index","building worktree index");let i=lM(n.scanRoots);Ve("index",`${i.size} indexed worktree(s)`);let a={runTerminalCache:new Vi,gitStatusCache:new ji,gitRevCache:new $i},l=[],c=[],u=new Set,d=r.maxActionsPerSweep,p=()=>c.length>=d;for(let C of n.scanRoots){if(p())break;Ve("root",C);let re=Ge.join(C,"worktrees"),ke=zR(i,C),Ye={harnessRoot:C,worktreesDir:re,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,runIdFilter:r.runIdFilter,index:ke,now:n.now},gr=r.scanDependencyCaches?YR(Ye):[];Ve("dependency",r.scanDependencyCaches?`${gr.length} cache candidate(s) at ${C}`:"skipped (worktree-only sweep)");let Hr=0;for(let F of gr){if(p())break;Hr+=1,Hr%50===0&&Ve("dependency",`${Hr}/${gr.length} evaluated`);let D=Ge.resolve(F.path);if(u.has(D))continue;u.add(D);let M={...F,path:D},ie=aM(M,C,re);if(ie){hn(l,M.path,ie),c.push({...M,executed:!1,skipped:!0,skipReason:ie});continue}let ye=hv(M,re),Re=ke.get(Ge.resolve(ye))??null,hr=kv({candidate:M,indexed:Re,harnessRoot:C,now:n.now}),V=au({indexed:Re,includeOrphans:!0,nodeModulesAgeMs:r.nodeModulesAgeMs,ageMs:M.ageMs,worktreePath:ye,activeWorktreePaths:o.activeWorktreePaths,workerFilesystemLive:hr,diskPressure:r.diskPressure,gitStatusCache:a.gitStatusCache});if(V){hn(l,M.path,V),c.push({...M,executed:!1,skipped:!0,skipReason:V});continue}c.push(iM(Gi(M,r.accountBytes,r.byteAccountingEntryCap),r.execute))}if(r.scanDependencyCaches)for(let F of HR(Ye)){if(p())break;let D=Ge.resolve(F.path);if(u.has(D))continue;u.add(D);let M={...F,path:D},ie=Ui(M.path,C,re);if(ie){hn(l,M.path,ie),c.push({...M,executed:!1,skipped:!0,skipReason:ie});continue}let ye=hv(M,re),Re=ke.get(Ge.resolve(ye))??null,hr=kv({candidate:M,indexed:Re,harnessRoot:C,now:n.now}),V=pR({indexed:Re,includeOrphans:!0,nodeModulesAgeMs:r.nodeModulesAgeMs,ageMs:M.ageMs,worktreePath:ye,activeWorktreePaths:o.activeWorktreePaths,workerFilesystemLive:hr,diskPressure:r.diskPressure,gitStatusCache:a.gitStatusCache});if(V){hn(l,M.path,V),c.push({...M,executed:!1,skipped:!0,skipReason:V});continue}c.push(LR(Gi(M,r.accountBytes,r.byteAccountingEntryCap),r.execute))}let j=[...$R(Ye),...JR(Ye)];Ve("worktrees",`${j.length} candidate(s) at ${C}`);let T=new Set,te=0;for(let F of j){if(p())break;te+=1,te%50===0&&Ve("worktrees",`${te}/${j.length} evaluated`);let D=Ge.resolve(F.path);if(T.has(D))continue;T.add(D);let M={...F,path:D},ie=ke.get(Ge.resolve(M.path))??null,ye=ie?null:nv({worktreePath:M.path,harnessRoot:C,runId:M.runId,workerName:M.worker,now:n.now}),Re=dR({indexed:ie,worktreePath:Ge.resolve(M.path),includeOrphans:r.includeOrphans,worktreesAgeMs:r.worktreesAgeMs,terminalWorktreesAgeMs:r.terminalWorktreesAgeMs,ageMs:M.ageMs,orphanSafety:ye,worktreeRemovalGuard:e.worktreeRemovalGuard,liveness:a,now:n.now,harnessRoot:C,writeSalvageEvidence:r.execute});if(Re){let{reason:hr,detail:V}=sM(Re);hn(l,M.path,hr,V),c.push({...M,executed:!1,skipped:!0,skipReason:hr});continue}c.push(UR(Gi(M,r.accountBytes,r.byteAccountingEntryCap),r.execute))}if(!p()&&r.runDirectoriesAgeMs>=0)for(let F of wR({harnessRoot:C,worktreesDir:re,runDirectoriesAgeMs:r.runDirectoriesAgeMs,runIdFilter:r.runIdFilter,activeGuards:o,now:n.now})){if(p())break;let D=Ge.resolve(F.path);if(u.has(D))continue;u.add(D);let M={...F,path:D},ie=M.runId??Ge.basename(D),ye=SR({harnessRoot:C,runId:ie,runPath:D,ageMs:M.ageMs,runDirectoriesAgeMs:r.runDirectoriesAgeMs,activeGuards:o});if(ye){hn(l,M.path,ye),c.push({...M,executed:!1,skipped:!0,skipReason:ye});continue}c.push(BR(Gi(M,r.accountBytes,r.byteAccountingEntryCap),r.execute))}}let m=0,f=0,y=0,k=0,b=0,g=0;for(let C of c)C.bytes&&(m+=C.bytes),!C.skipped&&!C.executed&&C.bytes&&(y+=C.bytes),C.executed?(b+=1,k+=C.bytes??0,C.kind==="remove_run_directory"&&(f+=1)):C.skipped&&(g+=1,C.skipReason==="dry_run"&&C.bytes&&(y+=C.bytes));let h=r.accountBytes?sv({harnessRoot:n.harnessRoot,now:n.now,perRunEntryCap:r.storagePerRunEntryCap}):void 0,w=Lt(),E=r.execute&&pv(w),S=E?dv({execute:!0}):null,_=w?{observed:!0,execute:E,dumpCount:w.dumpCount,totalBytes:w.totalBytes,removedCount:S?.removed.length??0,removedBytes:S?.removedBytes??0,executables:w.executables,path:w.path,reason:w.reason}:void 0;S&&S.removed.length>0&&(k+=S.removedBytes,b+=S.removed.length,Ve("wsl-crashes",`removed ${S.removed.length} dump(s), ${S.removedBytes} bytes`)),Ve("complete",`${c.length} action(s), ${g} skipped, ${b} removed`);let K=fR(c,l),$=fv({harnessRoot:n.harnessRoot,scanRoots:n.scanRoots,dryRun:!r.execute,execute:r.execute,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,diskPressure:r.diskPressure,diskGate:r.diskGate?{ok:r.diskGate.ok,path:r.diskGate.path,freeBytes:r.diskGate.freeBytes,usedPercent:r.diskGate.usedPercent,reason:r.diskGate.reason}:void 0,scannedAt:new Date(n.now).toISOString(),finalizedRuns:s,actions:c,skips:l,totals:{candidateBytes:m,reclaimableBytes:y,removedBytes:k,removedPaths:b,skippedPaths:g,skipReasons:gv(c,l)},...h?{storage:h}:{},...K.length>0?{preservedLivePaths:K}:{},...f>0?{removedRunDirectories:f}:{},..._?{wslCrashDumps:_}:{}});return{harnessRoot:n.harnessRoot,scanRoots:n.scanRoots,dryRun:!r.execute,execute:r.execute,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,diskPressure:r.diskPressure,diskGate:r.diskGate?{ok:r.diskGate.ok,path:r.diskGate.path,freeBytes:r.diskGate.freeBytes,usedPercent:r.diskGate.usedPercent,reason:r.diskGate.reason}:void 0,scannedAt:new Date(n.now).toISOString(),finalizedRuns:s,actions:c,skips:l,totals:{candidateBytes:m,reclaimableBytes:y,removedBytes:k,removedPaths:b,skippedPaths:g,skipReasons:gv(c,l)},...h?{storage:h}:{},...K.length>0?{preservedLivePaths:K}:{},...f>0?{removedRunDirectories:f}:{},..._?{wslCrashDumps:_}:{},compactSummary:$}}function yv(e){let r=rv(e);return cM({execute:r.execute,finalizeStaleRuns:r.finalizeStaleRuns,accountBytes:r.accountBytes,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,runIdFilter:r.runIdFilter})}function Rv(){return process.env.KYNVER_PIPELINE_CLEANUP!=="0"}import{readFile as dM}from"node:fs/promises";import{homedir as pM}from"node:os";import Pt from"node:path";En();var uM={"@kynver-app/runtime":"0.1.83","@kynver-app/openclaw-agent-os":"0.1.43","@kynver-app/mcp-agent-os":"0.3.34"},n9=Object.keys(uM);function vv(e){let r=e.trim().split("-")[0]?.split("+")[0];if(!r)return null;let t=r.split(".");if(t.length<1||t.length>3)return null;let n=t.map(o=>Number.parseInt(o,10));if(n.some(o=>!Number.isFinite(o)||o<0))return null;for(;n.length<3;)n.push(0);return[n[0],n[1],n[2]]}function bv(e,r){let t=vv(e),n=vv(r);if(!t||!n)return 0;for(let o=0;o<3;o+=1){if(t[o]>n[o])return 1;if(t[o]<n[o])return-1}return 0}var mM=["@kynver-app/runtime","@kynver-app/openclaw-agent-os","@kynver-app/mcp-agent-os"];function kn(e){let r=e?.trim();return r||null}function fM(e){return[...new Set(e.filter(r=>!!r))]}function gM(){let e=pM(),r=kn(process.env.KYNVER_OPENCLAW_NPM_ROOT)??kn(process.env.OPENCLAW_NPM_ROOT)??Pt.join(e,".openclaw","npm"),t=kn(process.env.KYNVER_NPM_GLOBAL_ROOT)??kn(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT)??(kn(process.env.NPM_CONFIG_PREFIX)?Pt.join(kn(process.env.NPM_CONFIG_PREFIX),"lib","node_modules"):Pt.join(e,".npm-global","lib","node_modules"));return fM([Pt.join(r,"lib","node_modules"),Pt.join(r,"node_modules"),t.endsWith("node_modules")?t:Pt.join(t,"lib","node_modules")])}async function hM(e){try{let r=JSON.parse(await dM(e,"utf8"));return typeof r.version=="string"&&r.version.trim()?r.version.trim():null}catch{return null}}function kM(e){let r=gM(),t=new Set,n=[];for(let o of r){let s=Pt.join(o,e,"package.json");t.has(s)||(t.add(s),n.push(s))}return n}async function Sv(e=new Date().toISOString()){let r={};for(let t of mM){let n=null;for(let o of kM(t)){let s=await hM(o);s&&(!n||bv(s,n.version)>0)&&(n={version:s,path:o})}n&&(r[t]={version:n.version,observedAt:e,path:n.path})}return r}import{spawnSync as yM}from"node:child_process";var RM=1e4,vM=4*1024*1024,wv=(e,r,t)=>{try{let n=yM(e,r,{windowsHide:!0,encoding:"utf8",stdio:["ignore","pipe","pipe"],timeout:t?.timeoutMs??RM,maxBuffer:vM});return{ok:n.status===0,stdout:typeof n.stdout=="string"?n.stdout:"",stderr:typeof n.stderr=="string"?n.stderr:""}}catch(n){return{ok:!1,stdout:"",stderr:n instanceof Error?n.message:String(n)}}};function Yi(e,r,t){return`${e} ${r} ${t}`}function yu(e){let r=e.lastIndexOf("@");if(r<=0||r===e.length-1)return null;let t=e.slice(0,r),n=e.slice(r+1);return!/^[^/\s]+\/[^/\s]+$/.test(t)||!/^[0-9a-f]{7,40}$/i.test(n)?null:{repo:t,sha:n}}function xv(e){let r=e.trim().match(/[/:]([^/]+\/[^/]+)\/(?:pull|pulls|merge_requests|pull-requests)\/(\d+)/i);if(!r)return null;let t=Number(r[2]);return!Number.isFinite(t)||t<=0?null:{repo:r[1],number:t}}var bM=8e3,SM=30,wM=100,xM=400,_M=3600*1e3,Ru=0;function bu(){return Date.now()<Ru}function EM(e){let r=`${e.stdout}
+${e.stderr}`.toLowerCase();return r.includes("api rate limit exceeded")||r.includes("rate limit exceeded")||r.includes("secondary rate limit")}function _v(e){EM(e)&&(Ru=Math.max(Ru,Date.now()+_M))}function vu(e,r){if(bu())return null;let t=e("gh",["api",...r]);if(!t.ok||!t.stdout.trim())return _v(t),null;try{return JSON.parse(t.stdout)}catch{return null}}function CM(e,r,t,n){if(bu())return null;let o=e("gh",["pr","view",String(t),"--repo",r,"--json",n.join(",")]);if(!o.ok||!o.stdout.trim())return _v(o),null;try{return JSON.parse(o.stdout)}catch{return null}}function Su(e){return bu()?!1:process.env.GITHUB_TOKEN?.trim()||process.env.GH_TOKEN?.trim()?!0:e("gh",["auth","token"]).ok}function yn(e){return e&&typeof e=="object"&&!Array.isArray(e)?e:null}function PM(e){return Array.isArray(e)?e.map(r=>yn(r)).filter(r=>r!==null).slice(0,SM).map(r=>({context:r.context??null,state:r.state??null,target_url:r.target_url??null,description:r.description??null})):[]}function AM(e,r,t){let n=vu(e,[`repos/${r}/commits/${t}/status`]);return n?{state:n.state??null,statuses:PM(n.statuses)}:null}var Ev={provider:"github",kind:"pr_snapshot",version:"2",isAvailable:Su,collect(e,r){let t=xv(e);if(!t)return null;let n=CM(r,t.repo,t.number,["url","title","body","author","state","isDraft","mergedAt","mergeCommit","mergeable","headRefName","headRefOid","headRepositoryOwner","statusCheckRollup","files"]);if(!n)return null;let o=yn(n.author),s=yn(n.mergeCommit),i=yn(n.headRepositoryOwner),a=typeof n.body=="string"?n.body.slice(0,bM):null,l=Array.isArray(n.statusCheckRollup)?n.statusCheckRollup.map(u=>yn(u)).filter(u=>u!==null).slice(0,wM).map(u=>({name:u.name??u.context??null,status:u.status??u.state??null,conclusion:u.conclusion??null,workflowName:u.workflowName??null,detailsUrl:u.detailsUrl??null})):[],c=Array.isArray(n.files)?n.files.map(u=>yn(u)).map(u=>typeof u?.path=="string"?u.path.trim():"").filter(Boolean).slice(0,xM):[];return{pull:{html_url:n.url??null,title:n.title??null,body:a,user:{login:o?.login??null},state:typeof n.state=="string"?n.state.toLowerCase():null,draft:n.isDraft??null,merged:!!n.mergedAt,merged_at:n.mergedAt??null,merge_commit_sha:s?.oid??null,mergeable:null,mergeable_state:n.mergeable??null,head:{sha:n.headRefOid??null,ref:n.headRefName??null,repo:{owner:{login:i?.login??null}}}},checkRuns:l,combinedStatus:{state:null,statuses:[]},changedFiles:c}}},Cv={provider:"github",kind:"commit_status",version:"1",isAvailable:Su,collect(e,r){let t=yu(e);return t?AM(r,t.repo,t.sha):null}},Pv={provider:"github",kind:"branch_reachability",version:"1",isAvailable:Su,collect(e,r){let t=yu(e);if(!t)return null;let n=vu(r,[`repos/${t.repo}`]),o=typeof n?.default_branch=="string"&&n.default_branch.trim()?n.default_branch.trim():null;if(!o)return null;let s=vu(r,[`repos/${t.repo}/compare/${encodeURIComponent(o)}...${t.sha}`]);if(!s)return null;let i=typeof s.status=="string"?s.status:null;return{defaultBranch:o,compareStatus:i,reachable:i==="identical"||i==="behind"}}};var xu=[];function wu(e){xu.some(r=>r.provider===e.provider&&r.kind===e.kind)||xu.push(e)}function Av(e,r){return xu.find(t=>t.provider===e&&t.kind===r)??null}function Iv(){wu(Ev),wu(Cv),wu(Pv)}var IM=1,OM=25e3;function Ov(e,r={}){Iv();let t=r.run??wv,n=r.now??(()=>new Date),o=r.maxSubjects??IM,s=Date.now()+(r.deadlineMs??OM),i=new Set,a=e.filter(m=>{let f=Yi(m.provider,m.kind,m.subject);return i.has(f)?!1:(i.add(f),!0)}),l=a.length>0?Math.floor(n().getTime()/6e4)%a.length:0,u=a.map((m,f)=>a[(l+f)%a.length]).slice(0,o),d={attempted:0,collected:0,cached:0,items:[],skipped:[]},p=new Map;for(let m of u){let f=Yi(m.provider,m.kind,m.subject),y=n(),k=r.cache?.get(f,y)??null;if(k){d.cached+=1,d.collected+=1,d.items.push(k);continue}if(Date.now()>s){d.skipped.push({...m,reason:"budget_exhausted"});continue}let b=Av(m.provider,m.kind);if(!b){d.skipped.push({...m,reason:"no_recipe"});continue}let g=`${b.provider} ${b.kind}`,h=p.get(g);if(h===void 0&&(h=b.isAvailable(t),p.set(g,h)),!h){d.skipped.push({...m,reason:"provider_unavailable"});continue}if(r.cache?.reserve?.(m,f,n())===!1){d.skipped.push({...m,reason:"budget_exhausted"});continue}d.attempted+=1;let w=b.collect(m.subject,t);if(w==null){d.skipped.push({...m,reason:"collect_failed"});continue}d.collected+=1;let E={provider:m.provider,kind:m.kind,subject:m.subject,payload:w,observedAt:n().toISOString(),collectorVersion:b.version};d.items.push(E),r.cache?.set(f,E,n())}return d}B();O();import WM from"node:path";B();O();import Tv from"node:path";var TM="provider-evidence-wanted.json",NM="provider-evidence-cache.json",DM=600*1e3;function Nv(e){return Tv.join(N(e),TM)}function MM(e){return Tv.join(N(e),NM)}function Dv(e){if(!Array.isArray(e))return[];let r=[];for(let t of e){if(!t||typeof t!="object"||Array.isArray(t))continue;let n=t,o=typeof n.provider=="string"?n.provider.trim():"",s=typeof n.kind=="string"?n.kind.trim():"",i=typeof n.subject=="string"?n.subject.trim():"";!o||!s||!i||r.push({provider:o,kind:s,subject:i})}return r}function Mv(e){let r=I(Nv(e),null);return Dv(r?.wanted)}function Wv(e,r){ue(Nv(e),{savedAt:new Date().toISOString(),wanted:r})}function Lv(e,r={}){let t=r.ttlMs??DM,n=MM(e),s={...I(n,null)?.items??{}},i=!1;return{get(l,c){let u=s[l];if(!u)return null;let d=Date.parse(u.observedAt);return!Number.isFinite(d)||c.getTime()-d>t?(delete s[l],i=!0,null):u},set(l,c){s[l]=c,i=!0},flush(){i&&(ue(n,{savedAt:new Date().toISOString(),items:s}),i=!1)}}}function Bv(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let r=e.providerEvidenceWanted;return Array.isArray(r)?Dv(r):null}var LM="provider-evidence-shared-cache.json",BM=6e4,UM=1,FM=1;function _u(e,r){let t=process.env[e];if(!t)return r;let n=Number.parseInt(t,10);return Number.isFinite(n)&&n>=0?n:r}function KM(){return WM.join(le().harnessRoot,LM)}function HM(e){let r=e.toUpperCase().replace(/[^A-Z0-9]+/g,"_"),t=e==="github"?UM:FM;return _u(`KYNVER_PROVIDER_EVIDENCE_${r}_PER_MINUTE`,_u("KYNVER_PROVIDER_EVIDENCE_LIVE_COLLECTS_PER_MINUTE",t))}function Uv(){return _u("KYNVER_PROVIDER_EVIDENCE_SHARED_CACHE_TTL_MS",BM)}function $M(e){return Math.floor(e.getTime()/6e4)*6e4}function jM(e){return`${e.provider}:${e.kind}`}function Fv(e,r={}){let t=Lv(e,{ttlMs:r.ttlMs??Uv()}),n=r.file??KM(),o=I(n,null),s={...o?.items??{}},i={...o?.budget??{}},a=r.ttlMs??Uv(),l=!1;return{get(u,d){let p=t.get(u,d);if(p)return p;let m=s[u];if(!m)return null;let f=Date.parse(m.observedAt);return!Number.isFinite(f)||d.getTime()-f>a?(delete s[u],l=!0,null):(t.set(u,m,d),m)},set(u,d,p){t.set(u,d,p),s[u]=d,l=!0},reserve(u,d,p){let m=HM(u.provider);if(m===0)return!0;let f=jM(u),y=$M(p),k=i[f];return!k||k.windowStartMs!==y?(i[f]={windowStartMs:y,used:1},l=!0,!0):k.used>=m?!1:(k.used+=1,l=!0,!0)},flush(){t.flush(),l&&(ue(n,{savedAt:new Date().toISOString(),items:s,budget:i}),l=!1)}}}O();B();import Kv from"node:path";var Hv="mesh-cron-lease.json";function $v(e){let r=I(Kv.join(N(e),Hv),null);return Jh(e,r)??r}function jv(e,r){let t={...r,updatedAt:new Date().toISOString()};ue(Kv.join(N(e),Hv),t),qh(e,t)}function Vv(e){if(!e||typeof e!="object"||Array.isArray(e))return null;let r=e.response;if(!r||typeof r!="object"||Array.isArray(r))return null;let t=r.meshLiveness;if(!t||typeof t!="object"||Array.isArray(t))return null;let n=t.cronLease;if(!n||typeof n!="object"||Array.isArray(n))return null;let o=n;return{leaseToken:typeof o.leaseToken=="string"?o.leaseToken:null,holderBoxId:typeof o.holderBoxId=="string"?o.holderBoxId:null,authorized:o.authorized===!0,updatedAt:new Date().toISOString()}}function Gv(e){let r=wh(),t=Lr(e?.env??process.env),n=(e?.now??(()=>new Date))().getTime(),o={};if(t.flags.dispatchReceipts!=="off"){Object.assign(o,Wh());let s=Mh({nowMs:n,hasLiveWorker:e?.hasLiveWorker});o["dispatchReceipts.strandedClaimCandidates"]=s.strandedClaimCandidates,t.flags.dispatchReceipts==="enforce"&&Object.assign(o,Ky())}return t.flags.planOutbox!=="off"&&Object.assign(o,Kk()),t.flags.admission!=="off"&&(Object.assign(o,Fh()),t.flags.admission==="enforce"&&Object.assign(o,jh())),(t.flags.keeper!=="off"||t.flags.meshLease!=="off"||t.flags.quota!=="off")&&Object.assign(o,ek()),{contractVersion:1,observedAt:new Date(n).toISOString(),state:r.state,schemaVersion:r.schemaVersion,recovered:r.recovered,unavailableClass:r.reason?r.reason.split(":")[0]??null:null,flags:t.flags,flagSources:t.sources,flagWarningCount:t.warnings.length,divergenceCounters:o}}H();import{createHash as Yv}from"node:crypto";import{access as VM,mkdir as Y9,readFile as qv,rename as q9,writeFile as J9}from"node:fs/promises";import{constants as GM}from"node:fs";import{homedir as Eu}from"node:os";import Ee from"node:path";var YM=/^(?:@[a-z0-9][a-z0-9._-]*\/[a-z0-9][a-z0-9._-]*|[a-z0-9][a-z0-9._-]*)$/i,qM=/^[A-Za-z0-9._:-]{8,128}$/;function JM(){return process.env.KYNVER_MCP_UPDATE_INVENTORY_FILE?.trim()||Ee.join(Eu(),".kynver","mcp-installations.json")}function zM(e){return e==="openclaw"?process.env.KYNVER_OPENCLAW_NPM_ROOT?.trim()||Ee.join(Eu(),".openclaw","npm"):process.env.KYNVER_NPM_GLOBAL_ROOT?.trim()||process.env.NPM_CONFIG_PREFIX?.trim()||Ee.join(Eu(),".npm-global")}function XM(e){let r=Ee.resolve(e);if(Ee.basename(r)!=="node_modules")return r;let t=Ee.dirname(r);return Ee.basename(t)==="lib"?Ee.dirname(t):t}function QM(e,r){return[Ee.join(e,"lib","node_modules",r,"package.json"),Ee.join(e,"node_modules",r,"package.json")]}async function ZM(e){try{return await VM(e,GM.R_OK),!0}catch{return!1}}async function eW(e=JM()){let r;try{r=JSON.parse(await qv(e,"utf8"))}catch{return[]}if(r.version!==1||!Array.isArray(r.installations)||r.installations.length>100)throw new Error("invalid MCP installation inventory");return r.installations.map(t=>{if(!t||!qM.test(t.inventoryKey)||!YM.test(t.packageName)||!["kynver","openclaw"].includes(t.prefix))throw new Error("invalid adopted MCP installation");if(t.packageName.includes("..")||t.packageName.includes("%"))throw new Error("invalid adopted MCP package identity");if(t.connectionId&&t.connectionId.length>128)throw new Error("invalid connection identity");if(t.binName&&!/^[A-Za-z0-9._-]{1,80}$/.test(t.binName))throw new Error("invalid MCP bin name");let n=t.envAllowlist??[];if(!Array.isArray(n)||n.length>32||n.some(o=>!/^[A-Z][A-Z0-9_]{1,80}$/.test(o)))throw new Error("invalid MCP environment allow-list");return{...t,envAllowlist:[...new Set(n)],lifecycle:t.lifecycle??"runtime_stdio"}})}function rW(e,r,t){if(typeof e.bin=="string")return Ee.join(t,e.bin);if(!e.bin||typeof e.bin!="object"||Array.isArray(e.bin))return null;let n=e.bin,o=r.binName??(Object.keys(n).length===1?Object.keys(n)[0]:void 0),s=o?n[o]:null;return typeof s=="string"&&!Ee.isAbsolute(s)&&!s.split(/[\\/]/).includes("..")?Ee.join(t,s):null}function tW(e){return Yv("sha256").update(JSON.stringify({inventoryKey:e.inventoryKey,connectionId:e.connectionId,packageName:e.packageName,managerKind:e.managerKind,sourceKind:e.sourceKind,installedVersion:e.installedVersion,nodeVersion:e.nodeVersion,policyChannel:e.policyChannel,executionConfigDigest:e.executionConfigDigest,capabilities:[...e.capabilities].sort()})).digest("hex")}async function nW(e){let r=[];for(let t of e){let n=XM(zM(t.prefix)),o=(await Promise.all(QM(n,t.packageName).map(async m=>({candidate:m,ok:await ZM(m)})))).find(m=>m.ok)?.candidate;if(!o)continue;let s=JSON.parse(await qv(o,"utf8"));if(s.name!==t.packageName||typeof s.version!="string"||!/^\d+\.\d+\.\d+(?:-[0-9A-Za-z.-]+)?$/.test(s.version))continue;let i=Ee.dirname(o),a=rW(s,t,i),l=t.packageName==="@kynver-app/runtime",c=t.lifecycle??"runtime_stdio",u=Yv("sha256").update(JSON.stringify({prefix:n,binName:t.binName??null,envAllowlist:[...t.envAllowlist??[]].sort(),lifecycle:c})).digest("hex"),d=l?[]:c==="runtime_stdio"&&a?["update","restart","rollback","verify_mcp"]:["update","rollback"],p={inventoryKey:t.inventoryKey,connectionId:t.connectionId??null,packageName:t.packageName,managerKind:"npm_global",sourceKind:"configured_stdio",installedVersion:s.version,nodeVersion:process.versions.node,policyChannel:"latest",executionConfigDigest:u,capabilities:d};r.push({report:{...p,displayName:t.displayName?.trim()||t.packageName,inventoryFingerprint:tW(p),capabilityExplanation:l?"Runtime self-update requires a supervisor-owned durable handoff and is not enabled by this adapter.":c==="runtime_stdio"&&a?"The authorized runtime can install, start, and verify this configured stdio package.":"The package can be installed, but its external supervisor must restart and verify it."},local:{prefix:n,packageJsonPath:o,packageDir:i,binPath:a,envAllowlist:t.envAllowlist??[],lifecycle:c}})}return r}async function Jv(){return nW(await eW())}import{createHash as oW,createHmac as sW,timingSafeEqual as iW}from"node:crypto";function Cu(e){let r=e.trim().split(".");return r.length!==3||r[0]!=="krc1"||!r[1]||!r[2]?null:{tokenId:r[1],tokenHash:oW("sha256").update(`krc1.${r[1]}.${r[2]}`,"utf8").digest("hex")}}function zv(e,r,t){let n=Cu(r);if(!n||e.algorithm!=="hmac-sha256-runner-v1"||e.keyId!==n.tokenId)return!1;let o=Date.parse(e.claims.expiresAt);if(e.claims.version!==1||e.claims.agentOsId!==t||!Number.isFinite(o)||o<=Date.now()||o>Date.now()+10*6e4||![null,"installing","restarting","verifying"].includes(e.claims.resumePhase))return!1;let s=sW("sha256",Buffer.from(n.tokenHash,"hex")).update(JSON.stringify(e.claims),"utf8").digest(),i=Buffer.from(e.signature,"base64url");return i.length===s.length&&iW(i,s)}ea();Rr();import{createHash as aW}from"node:crypto";import{access as Pu,mkdtemp as lW,readFile as rb,rm as cW}from"node:fs/promises";import{constants as Au}from"node:fs";import{tmpdir as uW}from"node:os";import Rn from"node:path";import{spawn as dW}from"node:child_process";import{Client as pW}from"@modelcontextprotocol/sdk/client/index.js";import{StdioClientTransport as mW}from"@modelcontextprotocol/sdk/client/stdio.js";var Iu="https://registry.npmjs.org",Xv=512*1024,Ou=2*6e4,fW=2e4;function tb(){return"npm"}function Qv(e,r){return Buffer.byteLength(e)>=Xv?e:(e+r.toString("utf8")).slice(0,Xv)}function gW(e){let r=process.env.KYNVER_MCP_UPDATE_NPM_CACHE?.trim(),t=r&&Rn.isAbsolute(r)?r:e,n={PATH:process.env.PATH,SystemRoot:process.env.SystemRoot,TEMP:process.env.TEMP,TMP:process.env.TMP,npm_config_registry:Iu,npm_config_audit:"false",npm_config_fund:"false",npm_config_update_notifier:"false",npm_config_cache:t};return Object.fromEntries(Object.entries(n).filter(o=>typeof o[1]=="string"))}async function nb(e,r,t=Ou,n){return new Promise((o,s)=>{let i,a;try{[i,a]=pe(e,r)}catch(m){s(m);return}let l=dW(i,a,{shell:!1,windowsHide:!0,detached:ce(),env:gW(n),stdio:["ignore","pipe","pipe"]}),c="",u="",d=!1;l.stdout.on("data",m=>{c=Qv(c,m)}),l.stderr.on("data",m=>{u=Qv(u,m)});let p=setTimeout(()=>{d=!0,l.pid&&De(l.pid,"SIGKILL")},t);l.once("error",m=>{clearTimeout(p),s(m)}),l.once("close",m=>{clearTimeout(p),d?s(new Error("process_timeout")):o({code:m,stdout:c,stderr:u})})})}function hW(e,r){let[t,n]=r.split("-",2);return!n||!["sha256","sha384","sha512"].includes(t)?!1:aW(t).update(e).digest("base64")===n}async function kW(e,r,t,n){let o=await nb(tb(),["pack",`${e}@${r}`,"--json","--pack-destination",n,`--registry=${Iu}`,"--ignore-scripts"],Ou,Rn.join(n,"npm-cache"));if(o.code!==0)throw new Error("artifact_download_failed");let s;try{s=JSON.parse(o.stdout)}catch{throw new Error("artifact_receipt_invalid")}let i=s[0]?.filename;if(typeof i!="string"||Rn.basename(i)!==i)throw new Error("artifact_receipt_invalid");let a=Rn.join(n,i);if(!hW(await rb(a),t))throw new Error("artifact_integrity_mismatch");return a}async function yW(e,r,t){if((await nb(tb(),["install","--global","--prefix",e,r,`--registry=${Iu}`,"--no-audit","--fund=false"],Ou,t)).code!==0)throw new Error("package_install_failed")}async function ob(e){let r=JSON.parse(await rb(e.local.packageJsonPath,"utf8"));if(r.name!==e.report.packageName||typeof r.version!="string")throw new Error("installed_identity_mismatch");return r.version}function RW(e){let r={};for(let t of["PATH","SystemRoot","TEMP","TMP",...e]){let n=process.env[t];n!==void 0&&(r[t]=n)}return r}async function Zv(e){if(!e.local.binPath)throw new Error("mcp_binary_missing");await Pu(e.local.binPath,Au.X_OK).catch(async()=>Pu(e.local.binPath,Au.R_OK));let r=new mW({command:e.local.binPath,args:[],env:RW(e.local.envAllowlist),stderr:"pipe"}),t=new pW({name:"kynver-managed-update-verifier",version:"1.0.0"}),n;try{await Promise.race([t.connect(r),new Promise((s,i)=>{n=setTimeout(()=>i(new Error("mcp_handshake_timeout")),fW)})]);let o=await t.listTools();return{toolCount:Array.isArray(o.tools)?o.tools.length:0}}finally{n&&clearTimeout(n),await t.close().catch(()=>{})}}async function eb(e,r,t,n,o){let s=await lW(Rn.join(uW(),"kynver-mcp-update-"));try{let i=await kW(r,t,n,s);if(await o(),await yW(e.local.prefix,i,Rn.join(s,"npm-cache")),await ob(e)!==t)throw new Error("installed_version_mismatch")}finally{await cW(s,{recursive:!0,force:!0})}}async function sb(e,r,t,n={}){if(typeof process.getuid=="function"&&process.getuid()===0)throw new Error("root_execution_refused");if(e.report.inventoryKey!==r.inventoryKey||e.report.inventoryFingerprint!==r.inventoryFingerprint||e.report.packageName!==r.packageName)throw new Error("local_inventory_mismatch");if(r.packageName==="@kynver-app/runtime")throw new Error("runtime_self_update_requires_supervisor");await t("preflight"),await Pu(e.local.prefix,Au.W_OK).catch(()=>{throw new Error("npm_prefix_not_writable")});let o=await ob(e),s=r.resumePhase!==null&&o===r.targetVersion,i=s&&n.recoveryVerifiedTargetInstalled===!0;if(!i&&o!==r.installedVersion&&!s)throw new Error("installed_version_changed");try{if(i?await t("installing"):(await eb(e,r.packageName,r.targetVersion,r.targetIntegrity,async()=>{await t("installing"),await n.beforePackageMutation?.()}),await n.onTargetInstalled?.()),e.local.lifecycle!=="runtime_stdio")return{outcome:"manual_restart_required",observedVersion:r.targetVersion,handshakeVerified:!1,toolCount:null,failureCode:"external_supervisor_restart_required"};await t("restarting"),await t("verifying");let a=await Zv(e);return{outcome:"succeeded",observedVersion:r.targetVersion,handshakeVerified:!0,toolCount:a.toolCount}}catch(a){let l=a instanceof Error?a.message:"update_failed";if(l==="progress_rejected")throw a;if(!r.rollbackIntegrity)return{outcome:"failed",observedVersion:null,handshakeVerified:!1,toolCount:null,failureCode:l};await n.beforePackageMutation?.();try{if(await eb(e,r.packageName,r.installedVersion,r.rollbackIntegrity,async()=>{await n.beforePackageMutation?.()}),e.local.lifecycle==="runtime_stdio"){let c=await Zv(e);return{outcome:"rollback_succeeded",observedVersion:r.installedVersion,handshakeVerified:!0,toolCount:c.toolCount,failureCode:l}}return{outcome:"manual_restart_required",observedVersion:r.installedVersion,handshakeVerified:!1,toolCount:null,failureCode:l}}catch(c){if(c instanceof Error&&c.message==="progress_rejected")throw c;return{outcome:"rollback_failed",observedVersion:null,handshakeVerified:!1,toolCount:null,failureCode:l}}}}import{randomBytes as Du}from"node:crypto";import{mkdir as Mu,readFile as Wu,rename as CW,rm as qi,stat as PW,writeFile as ub}from"node:fs/promises";import At from"node:path";import{createHmac as vW,timingSafeEqual as bW}from"node:crypto";import{mkdir as SW,readFile as wW,rename as xW,writeFile as _W}from"node:fs/promises";import{homedir as EW}from"node:os";import Tu from"node:path";function Nu(){return process.env.KYNVER_MCP_UPDATE_STATE_ROOT?.trim()||Tu.join(EW(),".kynver","state","mcp-updates")}function ib(e){if(!/^[A-Za-z0-9_-]{8,128}$/.test(e))throw new Error("invalid update operation identity");return Tu.join(Nu(),`${e}.json`)}function ab(e,r){let t=Cu(r);return t?vW("sha256",Buffer.from(t.tokenHash,"hex")).update(JSON.stringify(e),"utf8").digest("base64url"):null}async function lb(e,r){try{let t=JSON.parse(await wW(ib(e),"utf8"));if(t.version!==2||t.operationId!==e||typeof t.integrityMac!="string")return null;let{integrityMac:n,...o}=t,s=ab(o,r);if(!s)return null;let i=Buffer.from(n,"utf8"),a=Buffer.from(s,"utf8");return i.length!==a.length||!bW(i,a)?null:t}catch{return null}}async function cb(e,r){let t=ab(e,r);if(!t)throw new Error("invalid_runner_credential_for_receipt");let n=ib(e.operationId);await SW(Tu.dirname(n),{recursive:!0,mode:448});let o=`${n}.${process.pid}.tmp`;await _W(o,`${JSON.stringify({...e,integrityMac:t},null,2)}
 `,{mode:384}),await xW(o,n)}var AW="host-mutation.lock";function db(){return At.join(Nu(),AW)}async function pb(){try{let e=JSON.parse(await Wu(At.join(db(),"owner.json"),"utf8"));return!Number.isSafeInteger(e.pid)||typeof e.acquiredAt!="string"?null:{holder:e.holder==="desktop_update"?"desktop_update":"mcp_update",pid:e.pid,acquiredAt:e.acquiredAt,alive:mb(e.pid)}}catch{return null}}function mb(e){if(!Number.isSafeInteger(e)||e<=0)return!0;try{return process.kill(e,0),!0}catch(r){return r.code==="EPERM"}}async function IW(e){try{return await PW(e),!0}catch(r){if(r.code==="ENOENT")return!1;throw r}}async function fb(){return OW("mcp_update")}async function OW(e){let r=db(),t=`${r}.reclaiming`;await Mu(At.dirname(r),{recursive:!0,mode:448});let n=!1;try{if(await IW(t))return null;for(let o=0;o<2;o+=1)try{await Mu(r,{mode:448});let s={pid:process.pid,nonce:Du(18).toString("base64url"),acquiredAt:new Date().toISOString(),holder:e};return await ub(At.join(r,"owner.json"),JSON.stringify(s),{mode:384}),n&&(await qi(t,{recursive:!0,force:!0}),n=!1),{release:async()=>{try{let i=JSON.parse(await Wu(At.join(r,"owner.json"),"utf8"));i.pid===s.pid&&i.nonce===s.nonce&&await qi(r,{recursive:!0,force:!0})}catch{}}}}catch(s){if(s.code!=="EEXIST")throw s;if(!n)try{await Mu(t,{mode:448}),n=!0,await ub(At.join(t,"owner.json"),JSON.stringify({pid:process.pid,nonce:Du(18).toString("base64url"),acquiredAt:new Date().toISOString()}),{mode:384})}catch(l){if(l.code==="EEXIST")return null;throw l}let i=null;try{i=JSON.parse(await Wu(At.join(r,"owner.json"),"utf8"))}catch{return null}if(mb(i.pid))return null;let a=`${r}.stale-${process.pid}-${Du(8).toString("hex")}`;await CW(r,a),await qi(a,{recursive:!0,force:!0})}return null}finally{n&&await qi(t,{recursive:!0,force:!0})}}function Ji(e,r,t){return`${e}/api/agent-os/by-id/${encodeURIComponent(r)}/mcp-updates/${t}`}function TW(e){if(!e||typeof e!="object")return null;let r=e.claim;if(!r||typeof r!="object"||r.waitingForIdle!==!1)return null;let t=r.command;return t&&typeof t=="object"?t:null}function gb(e,r){let t=r.claims;return e.inventoryKey===t.inventoryKey&&e.packageName===t.packageName&&e.installedVersion===t.installedVersion&&e.targetVersion===t.targetVersion&&e.targetIntegrity===t.targetIntegrity&&e.rollbackIntegrity===t.rollbackIntegrity&&e.item.report.inventoryKey===t.inventoryKey&&e.item.report.packageName===t.packageName}function NW(e,r){return{inventoryKey:r.claims.inventoryKey,packageName:r.claims.packageName,installedVersion:r.claims.installedVersion,targetVersion:r.claims.targetVersion,targetIntegrity:r.claims.targetIntegrity,rollbackIntegrity:r.claims.rollbackIntegrity,verifiedTargetInstalled:!1,item:e}}async function hb(e){let r=Q(e.baseUrl),t=await Jv();if(t.length===0)return{ok:!0,stage:"not_configured"};let n=await ft(Ji(r,e.agentOsId,"inventory"),e.secret,{items:t.map(s=>s.report)});if(!n.ok)return{ok:!1,stage:"inventory",status:n.status};let o=await fb();if(!o){let s=await pb();return{ok:!0,stage:"host_mutation_busy",...s?{heldBy:s.holder}:{}}}try{let s=await ft(Ji(r,e.agentOsId,"claim"),e.secret,{activeOwnedSessions:e.activeOwnedSessions});if(!s.ok)return{ok:!1,stage:"claim",status:s.status};let i=TW(s.response);if(!i)return{ok:!0,stage:"idle"};if(!zv(i,e.secret,e.agentOsId))return{ok:!1,stage:"command_auth"};let a=await lb(i.claims.operationId,e.secret);if(a?.terminal&&a.attempt===i.claims.attempt&&a.nonce===i.claims.nonce)return{ok:!0,stage:"already_completed",outcome:a.outcome};let l,c;if(i.claims.resumePhase!==null){if(!a||!gb(a.recovery,i))return{ok:!1,stage:"recovery_receipt_invalid"};c=a.recovery,l={...c.item,report:{...c.item.report,inventoryFingerprint:i.claims.inventoryFingerprint}}}else{let g=t.find(h=>h.report.inventoryKey===i.claims.inventoryKey);if(!g||g.report.inventoryFingerprint!==i.claims.inventoryFingerprint)return{ok:!1,stage:"inventory_changed"};l=g,c=a&&gb(a.recovery,i)?a.recovery:NW(g,i)}let u=a?.acceptedAt??new Date().toISOString(),d=async(g,h,w)=>{await cb({version:2,operationId:i.claims.operationId,attempt:i.claims.attempt,nonce:i.claims.nonce,acceptedAt:u,phase:g,terminal:h,...w?{outcome:w}:{},recovery:c},e.secret)};await d(a?.attempt===i.claims.attempt?a.phase:"claimed",!1);let p="claimed",m=async g=>{if(!(await ft(Ji(r,e.agentOsId,`operations/${encodeURIComponent(i.claims.operationId)}/events`),e.secret,{attempt:i.claims.attempt,fenceToken:i.claims.fenceToken,phase:g})).ok)throw new Error("progress_rejected");p=g,await d(g,!1)},f=g=>m(g),y=()=>m(p),k;try{k=await sb(l,i.claims,f,{recoveryVerifiedTargetInstalled:c.verifiedTargetInstalled,beforePackageMutation:y,onTargetInstalled:async()=>{c={...c,verifiedTargetInstalled:!0},await d("target_installed",!1)}})}catch(g){k={outcome:"failed",observedVersion:null,handshakeVerified:!1,toolCount:null,failureCode:g instanceof Error?g.message:"update_failed"}}let b=await ft(Ji(r,e.agentOsId,`operations/${encodeURIComponent(i.claims.operationId)}/complete`),e.secret,{attempt:i.claims.attempt,fenceToken:i.claims.fenceToken,...k});return b.ok?(await d(k.outcome,!0,k.outcome),{ok:k.outcome==="succeeded",stage:"complete",outcome:k.outcome}):{ok:!1,stage:"complete",status:b.status,outcome:k.outcome}}finally{await o.release()}}function DW(){let e=process.env.KYNVER_PIPELINE_SWEEP_ENABLED;return e?e==="1"||e.toLowerCase()==="true":!1}async function MW(e,r){let t=q(e),n=[],o=Math.max(0,Number.parseInt(process.env.KYNVER_PIPELINE_COMPLETION_REPLAY_MAX_DEEP_CHECKS_PER_TICK??"0",10)||0),s=0;for(let i of Object.keys(t.workers||{})){let a=I(kb.join(N(t.id),"workers",x(i),"worker.json"),void 0);if(!a?.taskId||a.localOnly||Yr(a))continue;if(co(a)){n.push({worker:i,ok:!0,taskId:a.taskId??null,skipped:!0});continue}if(s>=o)break;s++;let l=J(a);if(!we(l))continue;let c=Ut({alive:l.alive,finalResult:l.finalResult,changedFiles:l.changedFiles,gitAncestry:l.gitAncestry});if(!a.dispatched&&!l.finalResult&&!c?.salvageable)continue;let u=await xo({run:e,name:i,agentOsId:String(r.agentOsId||a.agentOsId||""),...r});n.push({worker:i,ok:u.ok,taskId:a.taskId??null})}return n}async function WW(e,r,t,n,o){let s=Q(n.baseUrl?String(n.baseUrl):void 0),i=await ee(n.secret?String(n.secret):void 0,e,{baseUrl:s}),a=`${s}/api/agent-os/by-id/${encodeURIComponent(e)}/operator/tick`,l=await Sv(),c=Is(r),u=null;try{let E=Mv(r);if(E.length>0){let S=Fv(r);u=Ov(E,{cache:S}),S.flush?.()}else u=null}catch{u=null}try{if(Ur()!=="off"){let E=$t();Uh({liveWorkers:E}),$h({liveWorkers:E})}else Lh()}catch{}let d=({runId:E,workerName:S})=>{try{let{runsDir:_}=le(),K=kb.join(Pr(_,x(E)),"workers",x(S),"worker.json"),$=I(K,null);return $?Yr($):!1}catch{return!1}};await $y({agentOsId:e,baseUrl:s,secret:i,hasLiveWorker:d});let p=null;try{p=Gv({hasLiveWorker:d})}catch{p=null}let m=null;try{m=sd({control:Dt(e),supervisor:cd(),inFlightWorkers:$t().length})}catch{m=null}let f=$v(r),y=qu(),k=await X(a,i,{agentOsId:e,runId:r,ingestHarness:!0,harnessBoardSnapshot:Pc(r),resourceGate:t,boxResourceSnapshot:Zy(t,{harnessRunId:r,boxKind:br(U())}),packageVersions:l,...o?{harnessCleanup:o}:{},runnerPresence:He({runId:r}),activeHarnessWorkers:c,...f?.leaseToken?{meshCronLeaseToken:f.leaseToken}:{},...p?{localRunStore:p}:{},...m?{runtimeControlAck:m}:{},...y?{daemonEventLoop:y}:{},...u&&u.items.length>0?{providerEvidence:u.items}:{}},{agentOsId:e,baseUrl:s}),b=Bv(k.response);if(b)try{Wv(r,b)}catch{}let g=Vv(k);if(g)try{jv(r,g)}catch{}let h=_h(k);h&&Eh(e,h);let w=td(k);return w&&od(e,w),{ok:k.ok,httpStatus:k.status,response:k.response,...u?{providerEvidence:{attempted:u.attempted,collected:u.collected,skipped:u.skipped.length}}:{}}}async function yb(e){let r=String(yr(String(e.run||""),"--run")),t=String(yr(String(e.agentOsId||""),"--agent-os-id")),n=e.execute!==!1&&e.execute!=="false";Pc(r);let o=await Ns(t,e),s=Ts(o),i=Hn({runId:r,configuredMaxWorkersOverride:s}),a=Rv()?yv(r):void 0,l=await WW(t,r,i,e,a),c;if(n)try{let C=Q(e.baseUrl?String(e.baseUrl):void 0),re=await ee(e.secret?String(e.secret):void 0,t,{baseUrl:C});c=await hb({agentOsId:t,secret:re,baseUrl:C,activeOwnedSessions:$t().length})}catch(C){c={ok:!1,stage:"cycle",error:C instanceof Error?C.message:"update cycle failed"}}let u=ch(r,l),d=await ug(r,e),p=await MW(r,e);p.some(C=>C.ok&&!C.skipped)&&Jy();let m=Hn({runId:r,configuredMaxWorkersOverride:s}),f=Uy(),y=await tR(r,e),k=by(m,l),b=k.maxStarts,g=Dt(t),h=id(g);h&&(b=0);let w=DW()?await eR({run:r,agentOsId:t,pipeline:!0,...e}):{ok:!0,skipped:!0,reason:"pipeline_sweep_disabled"},E=null,S=0,_=vy(l),K=b;if(n&&K>0&&_.length>0){let C=Math.min(K,_.length),re=await Kc({...e,run:r,agentOsId:t,targetTaskIds:_.join(",")},C),ke=pn(re);S+=ke,K=Math.max(0,K-ke),E={exactTargetTaskIds:_,exact:re,startedCount:S}}if(n&&K>0){let C=await Kc({...e,run:r,agentOsId:t},K),re=pn(C);S+=re,E=E&&typeof E=="object"?{...E,broad:C,startedCount:S}:C}else!n||b<=0?E||(E={ok:!0,skipped:!0,reason:h??(n?m.reason??"no slots or queued work":"execute disabled"),maxStarts:0,dispatchAdvice:k,..._.length?{exactTargetTaskIds:_,exactOnly:!0}:{}}):E&&typeof E=="object"&&(E={...E,broadSkipped:!0,startedCount:S});let $=!k.underutilized&&b===0&&p.length===0&&S===0;return{runId:r,agentOsId:t,execute:n,resourceGate:i,dispatchResourceGate:m,leaseRenewal:d,completedWorkers:p,staleReconcile:f,harnessCleanup:a,planProgressSync:y,completionAckSync:u,operatorTick:l,mcpUpdates:c,sweep:w,dispatchAdvice:k,dispatch:E,idle:$,runtimeControl:g?{desiredState:g.desiredState,policyVersion:g.policyVersion}:null}}xn();jt();xn();function Rb(e){return jo(Dt(e))!=="stopped"?null:$t().length}function vb(e){if(!e||typeof e!="object")return!1;let r=e;return r.type==="tick"&&typeof r.id=="number"&&typeof r.agentOsId=="string"&&!!r.args&&typeof r.args=="object"}function LW(e){e&&(Xy({admission:e.admission,ownerKind:e.ownerKind}),ld(e.ownerKind))}async function BW(e,r={}){try{e.instructionBundle&&zu(e.instructionBundle.bundle,e.instructionBundle.source),Yu(e.eventLoopReport);let t=await(r.runTick??yb)(e.args),n=(r.countInFlightWorkers??Rb)(e.agentOsId);return{type:"result",id:e.id,ok:!0,tick:JSON.parse(JSON.stringify(t)),inFlightWorkers:n}}catch(t){return{type:"result",id:e.id,ok:!1,error:t instanceof Error?t.message:String(t)}}}function bb(e,r,t={}){LW(r);let n=Promise.resolve();e.on("message",o=>{vb(o)&&(n=n.then(async()=>{e.postMessage(await BW(o,t))}))})}Sb?bb(Sb,UW):(console.error(JSON.stringify({event:"daemon_tick_thread_misuse",error:"must run as a worker thread"})),process.exitCode=1);