@kynver-app/runtime 0.2.147 → 0.2.150

package/dist/server/orchestration.js

@@ -1,4 +1,4 @@
-import{existsSync as ie}from"node:fs";import{homedir as se}from"node:os";import ae from"node:path";import{createHash as Y}from"node:crypto";import{statSync as ne}from"node:fs";import{spawnSync as U}from"node:child_process";import{existsSync as M,readFileSync as z}from"node:fs";import p from"node:path";var _=class extends Error{constructor(t){super(`${t} is a batch file that is not a Node CLI shim; it cannot be spawned without a shell. Point the matching KYNVER_*_BIN setting at the real .exe or the CLI's JS entry, or run the daemon inside WSL.`);this.shimPath=t;this.name="UnresolvableWindowsShimError"}shimPath},X=".COM;.EXE;.BAT;.CMD";function q(e){return e.includes("/")||e.includes("\\")}function Q(e){return(e.PATHEXT||X).split(";").map(r=>r.trim().toLowerCase()).filter(r=>r.startsWith("."))}function Z(e){let r=Object.keys(e).find(t=>t.toUpperCase()==="PATH");return r?e[r]??"":""}function ee(e,r={}){let t=r.env??process.env,o=r.exists??M,n=Q(t),i=p.win32.extname(e)!=="",s=a=>i?[a]:n.map(c=>`${a}${c}`);if(q(e)||p.win32.isAbsolute(e))return s(e).find(a=>o(a))??null;for(let a of Z(t).split(";").map(c=>c.trim()).filter(Boolean)){let c=s(p.win32.join(a,e)).find(m=>o(m));if(c)return c}return null}var D=/%~?dp0%?\\?([^"%\r\n]+?\.(?:c|m)?js)\b/i,re=/^\s*SET\s+"?([A-Za-z_]\w*)=([^"\r\n]*)"?\s*$/i;function B(e){return e.replace(/^[\\/]+/,"")}function te(e){let r=e.split(/\r?\n/),t=new Map;for(let i of r){let s=re.exec(i);s&&t.set(s[1].toUpperCase(),s[2])}let o=r.filter(i=>i.includes("%*")).pop();if(!o)return null;let n=D.exec(o);if(n)return B(n[1]);for(let i of o.matchAll(/%([A-Za-z_]\w*)%/g)){let s=t.get(i[1].toUpperCase()),a=s?D.exec(s):null;if(a)return B(a[1])}return null}function oe(e,r={}){if((r.platform??process.platform)!=="win32")return{executable:e,prefixArgs:[],kind:"passthrough"};let o=ee(e,r);if(!o)return{executable:e,prefixArgs:[],kind:"passthrough"};let n=p.win32.extname(o).toLowerCase();if(n!==".cmd"&&n!==".bat")return{executable:o,prefixArgs:[],kind:"exe"};let i=r.readText??(G=>z(G,"utf8")),s=r.exists??M,a;try{a=i(o)}catch{throw new _(o)}let c=te(a);if(!c)throw new _(o);let m=p.win32.dirname(o),K=p.win32.join(m,c);if(!s(K))throw new _(o);let L=p.win32.join(m,"node.exe");return{executable:s(L)?L:r.nodeExecutable??process.execPath,prefixArgs:[K],kind:"node-shim"}}function R(e,r,t={}){let o=oe(e,t);return[o.executable,[...o.prefixArgs,...r]]}function u(e){try{let r=ne(e),t=`${e}|${r.size}|${r.mtimeMs}`;return Y("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function h(e){return Y("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,r){for(let t of r){let o=process.env[t]?.trim();if(o)return o}return e}function l(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r),s=U(n,i,{windowsHide:!0,encoding:"utf8",timeout:o,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(s.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let a=(s.stderr||s.stdout||"").trim(),c=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:a?`${c}: ${a.slice(0,200)}`:c}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function A(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r);return U(n,i,{windowsHide:!0,stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var ce="claude";function le(){let e=se();return[ae.join(e,".claude",".credentials.json")]}function j(e=new Date().toISOString()){let r=d(ce,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:h("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=le().find(s=>ie(s)),n=A(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(n.ok||!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as ue}from"node:fs";import{homedir as de}from"node:os";import S from"node:path";var pe="codex";function fe(){let e=de();return[process.env.CODEX_HOME?.trim()?S.join(S.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,S.join(e,".codex","auth.json"),S.join(e,".config","codex","auth.json")].filter(t=>!!t)}function me(e){return S.dirname(e)}function he(e){let r,t;for(let o of fe()){if(!ue(o))continue;r??=o;let n=l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:me(o)}});if(t??=n,n.ok)return{authPath:o,login:n}}return{authPath:r,login:t??l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function H(e=new Date().toISOString()){let r=d(pe,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:h("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:o}=he(r),n=!!t&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:t?u(t):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as ge}from"node:fs";import{homedir as Ee}from"node:os";import y from"node:path";function _e(){let e=process.env.HERMES_HOME?.trim(),r=e?y.resolve(e):y.join(Ee(),".hermes");return y.join(r,"auth.json")}function x(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=_e(),n=ge(o),i=A(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?u(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function F(e=new Date().toISOString()){let r=H(e);if(r.ready)return{...r,path:"codex_cli"};let t=x(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as be}from"node:fs";import{homedir as ke}from"node:os";import E from"node:path";import{closeSync as Yr,existsSync as Pe,mkdirSync as Ur,openSync as jr,statSync as Hr,unlinkSync as Fr}from"node:fs";var Er=String.raw`"use strict";
+import{existsSync as ie}from"node:fs";import{homedir as se}from"node:os";import ae from"node:path";import{createHash as Y}from"node:crypto";import{statSync as ne}from"node:fs";import{spawnSync as j}from"node:child_process";import{existsSync as M,readFileSync as z}from"node:fs";import p from"node:path";var _=class extends Error{constructor(t){super(`${t} is a batch file that is not a Node CLI shim; it cannot be spawned without a shell. Point the matching KYNVER_*_BIN setting at the real .exe or the CLI's JS entry, or run the daemon inside WSL.`);this.shimPath=t;this.name="UnresolvableWindowsShimError"}shimPath},X=".COM;.EXE;.BAT;.CMD";function q(e){return e.includes("/")||e.includes("\\")}function Q(e){return(e.PATHEXT||X).split(";").map(r=>r.trim().toLowerCase()).filter(r=>r.startsWith("."))}function Z(e){let r=Object.keys(e).find(t=>t.toUpperCase()==="PATH");return r?e[r]??"":""}function ee(e,r={}){let t=r.env??process.env,o=r.exists??M,n=Q(t),i=p.win32.extname(e)!=="",s=a=>i?[a]:n.map(c=>`${a}${c}`);if(q(e)||p.win32.isAbsolute(e))return s(e).find(a=>o(a))??null;for(let a of Z(t).split(";").map(c=>c.trim()).filter(Boolean)){let c=s(p.win32.join(a,e)).find(m=>o(m));if(c)return c}return null}var D=/%~?dp0%?\\?([^"%\r\n]+?\.(?:c|m)?js)\b/i,re=/^\s*SET\s+"?([A-Za-z_]\w*)=([^"\r\n]*)"?\s*$/i;function B(e){return e.replace(/^[\\/]+/,"")}function te(e){let r=e.split(/\r?\n/),t=new Map;for(let i of r){let s=re.exec(i);s&&t.set(s[1].toUpperCase(),s[2])}let o=r.filter(i=>i.includes("%*")).pop();if(!o)return null;let n=D.exec(o);if(n)return B(n[1]);for(let i of o.matchAll(/%([A-Za-z_]\w*)%/g)){let s=t.get(i[1].toUpperCase()),a=s?D.exec(s):null;if(a)return B(a[1])}return null}function oe(e,r={}){if((r.platform??process.platform)!=="win32")return{executable:e,prefixArgs:[],kind:"passthrough"};let o=ee(e,r);if(!o)return{executable:e,prefixArgs:[],kind:"passthrough"};let n=p.win32.extname(o).toLowerCase();if(n!==".cmd"&&n!==".bat")return{executable:o,prefixArgs:[],kind:"exe"};let i=r.readText??(G=>z(G,"utf8")),s=r.exists??M,a;try{a=i(o)}catch{throw new _(o)}let c=te(a);if(!c)throw new _(o);let m=p.win32.dirname(o),K=p.win32.join(m,c);if(!s(K))throw new _(o);let L=p.win32.join(m,"node.exe");return{executable:s(L)?L:r.nodeExecutable??process.execPath,prefixArgs:[K],kind:"node-shim"}}function R(e,r,t={}){let o=oe(e,t);return[o.executable,[...o.prefixArgs,...r]]}function u(e){try{let r=ne(e),t=`${e}|${r.size}|${r.mtimeMs}`;return Y("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function h(e){return Y("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,r){for(let t of r){let o=process.env[t]?.trim();if(o)return o}return e}function l(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r),s=j(n,i,{windowsHide:!0,encoding:"utf8",timeout:o,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(s.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let a=(s.stderr||s.stdout||"").trim(),c=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:a?`${c}: ${a.slice(0,200)}`:c}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function A(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r);return j(n,i,{windowsHide:!0,stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var ce="claude";function le(){let e=se();return[ae.join(e,".claude",".credentials.json")]}function U(e=new Date().toISOString()){let r=d(ce,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:h("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=le().find(s=>ie(s)),n=A(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(n.ok||!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as ue}from"node:fs";import{homedir as de}from"node:os";import S from"node:path";var pe="codex";function fe(){let e=de();return[process.env.CODEX_HOME?.trim()?S.join(S.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,S.join(e,".codex","auth.json"),S.join(e,".config","codex","auth.json")].filter(t=>!!t)}function me(e){return S.dirname(e)}function he(e){let r,t;for(let o of fe()){if(!ue(o))continue;r??=o;let n=l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:me(o)}});if(t??=n,n.ok)return{authPath:o,login:n}}return{authPath:r,login:t??l(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function H(e=new Date().toISOString()){let r=d(pe,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:h("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:o}=he(r),n=!!t&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:t?u(t):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as ge}from"node:fs";import{homedir as Ee}from"node:os";import y from"node:path";function _e(){let e=process.env.HERMES_HOME?.trim(),r=e?y.resolve(e):y.join(Ee(),".hermes");return y.join(r,"auth.json")}function x(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=_e(),n=ge(o),i=A(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?u(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function F(e=new Date().toISOString()){let r=H(e);if(r.ready)return{...r,path:"codex_cli"};let t=x(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as be}from"node:fs";import{homedir as ke}from"node:os";import E from"node:path";import{closeSync as Ur,existsSync as Pe,mkdirSync as Hr,openSync as Fr,statSync as $r,unlinkSync as Wr}from"node:fs";var Er=String.raw`"use strict";
 const cp = require("child_process"), fs = require("fs");
 const argv = process.argv.slice(1);
 const exitFile = argv[0], cmd = argv[1], args = argv.slice(2);
@@ -64,4 +64,4 @@ child.on("error", (e) => {
   if (!child.pid) finish(127, null, String(e && e.message));
 });
 child.on("exit", (code, signal) => finish(code, signal));
-`;import g from"node:path";function v(e=process.platform){return e!=="win32"}var Se=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],vr=new Set(Se);var Oe=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Pr=new Set(Oe);import{existsSync as O,readdirSync as Ce}from"node:fs";import f from"node:path";var Ae=/^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;function xe(e){let t=e.split("-")[0].split(".");if(t.length!==3)return null;let[o,n,i]=t;return!o||!n||!i?null:+`${o}${n.padStart(2,"0")}${i.padStart(2,"0")}`}function ve(e){let r=f.join(e,"versions");if(!O(r))return null;let t=null,o=-1;for(let n of Ce(r,{withFileTypes:!0})){if(!n.isDirectory()||!Ae.test(n.name))continue;let i=xe(n.name);i==null||i<=o||(o=i,t=f.join(r,n.name))}return t}function k(e){let r=e?.trim()||f.join(process.env.LOCALAPPDATA||"","cursor-agent"),t=f.join(r,"node.exe"),o=f.join(r,"index.js");if(O(t)&&O(o))return{nodeExe:t,indexJs:o,versionDir:r};let n=ve(r);if(!n)return null;let i=f.join(n,"node.exe"),s=f.join(n,"index.js");return!O(i)||!O(s)?null:{nodeExe:i,indexJs:s,versionDir:n}}function Re(e,r,t){return{executable:e,prefixArgs:[r],shell:!1,detached:v(),bundledVersionDir:t}}function $(e){if(process.platform==="win32"){let r=/\.(cmd|bat)$/i.test(e),t=/node\.exe$/i.test(e)&&Pe(g.join(g.dirname(e),"index.js"));if(r||t||e==="agent"){let n=r?k(g.dirname(e)):t?{nodeExe:e,indexJs:g.join(g.dirname(e),"index.js"),versionDir:g.dirname(e)}:k();if(n)return Re(n.nodeExe,n.indexJs,n.versionDir);throw new Error("Cursor Agent on Windows has no headless bundled node.exe under %LOCALAPPDATA%\\cursor-agent\\versions\\\u2026. Run `agent login` / update Cursor Agent CLI, use `--provider claude`, or set KYNVER_CURSOR_AGENT_ROOT to the cursor-agent folder.")}}return{executable:e,prefixArgs:[],shell:!1,detached:v()}}import{spawnSync as ye}from"node:child_process";function b(e,r=process.env){try{let t;try{t=$(e)}catch{t={executable:e,prefixArgs:[]}}let o=ye(t.executable,[...t.prefixArgs,"status","--format","json"],{encoding:"utf8",windowsHide:!0,timeout:8e3,env:{...r,CI:"1",NO_COLOR:"1"}});if(o.status!==0)return{ok:!1,note:"agent status: not authenticated"};let n=(o.stdout||"").trim();if(!n)return{ok:!1,note:"agent status: empty response"};let i;try{i=JSON.parse(n)}catch{return{ok:!1,note:"agent status: unparseable response"}}return typeof i=="object"&&i!==null&&i.isAuthenticated===!0?{ok:!0,note:"agent status: authenticated"}:{ok:!1,note:"agent status: not authenticated"}}catch(t){return{ok:!1,note:t instanceof Error?t.message:"agent status probe failed"}}}function I(e=process.env){let r=[],t=e.KYNVER_CURSOR_AUTH_HOME?.trim();t&&(r.push(E.join(t,".config","cursor","auth.json")),r.push(E.join(t,".cursor-agent","auth.json")));let o=ke();if(r.push(E.join(o,".config","cursor","auth.json")),r.push(E.join(o,".cursor-agent","auth.json")),process.platform==="win32"){let n=e.LOCALAPPDATA?.trim(),i=e.APPDATA?.trim();n&&r.push(E.join(n,"cursor-agent","auth.json")),i&&r.push(E.join(i,"cursor","auth.json"))}return r}var Ie="agent";function W(e=new Date().toISOString()){let r=d(Ie,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:h("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=l(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=I().find(a=>be(a)),n=b(r),i=!!o||n.ok,s=t.ok&&i;return{providerId:"cursor",ready:s,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:s?"Local Cursor/Composer OAuth session bound on runner":[t.note,i?void 0:n.note??"no ~/.config/cursor/auth.json or `agent login` session"].filter(Boolean).join("; ")}}import{existsSync as we,readFileSync as Ne}from"node:fs";import{homedir as Te}from"node:os";import w from"node:path";var Ke=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function Le(){let e=process.env.HERMES_HOME?.trim(),r=e?w.resolve(e):w.join(Te(),".hermes");return w.join(r,".env")}function De(e){try{let r=Ne(e,"utf8"),t=[];for(let o of Ke)new RegExp(`^${o}=`,"m").test(r)&&t.push(o);return t}catch{return[]}}function V(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=Le(),n=we(o),i=n?De(o):[],a=i.some(m=>m.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",c=t.ok&&n;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:n,authSource:a,sessionFingerprint:n?u(o):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function Be(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=F(r),o={codex:t,cursor:W(r),claude:j(r)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:r,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:V(r),hermesOpenAiCodex:x(r),codexAdapterPath:t.path,readyCount:n}}var Me={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function Ye(){return Object.values(Me)}var J=["off","observe","enforce"];function Ue(e){let r=(e??"off").trim().toLowerCase();return J.includes(r)?r:"off"}function P(e=process.env){return Ue(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function N(e=process.env){let r=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return r?r==="1"||r==="true"||r==="yes"||r==="on":P(e)==="enforce"}import{createHash as je}from"node:crypto";function C(e){if(e==null)return null;let r=e.trim();return r.length?r:null}function T(e){let r=C(e.sessionId)??"anonymous",t=C(e.title)??C(e.action)??"foreground",o=je("sha256").update([C(e.planId)??"",C(e.parentTaskId)??"",t.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${r}:${o}`}function He(e,r){return e==="enforce"&&r?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function Fe(e,r=process.env){let t=P(r),o=N(r),n=He(t,o),i=n==="enforce_harness_task"?T({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return t==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:t,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{T as buildForegroundHarnessIdempotencyKey,Be as buildOrchestrationProviderInventory,Fe as evaluateOrchestrationPolicy,N as isOrchestrationEnforceTasksEnabled,Ye as listOrchestrationProviderCapabilities,P as resolveOrchestrationPolicyMode};
+`;import g from"node:path";function v(e=process.platform){return e!=="win32"}var Se=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],vr=new Set(Se);var Oe=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Pr=new Set(Oe);import{existsSync as O,readdirSync as Ce}from"node:fs";import f from"node:path";var Ae=/^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;function xe(e){let t=e.split("-")[0].split(".");if(t.length!==3)return null;let[o,n,i]=t;return!o||!n||!i?null:+`${o}${n.padStart(2,"0")}${i.padStart(2,"0")}`}function ve(e){let r=f.join(e,"versions");if(!O(r))return null;let t=null,o=-1;for(let n of Ce(r,{withFileTypes:!0})){if(!n.isDirectory()||!Ae.test(n.name))continue;let i=xe(n.name);i==null||i<=o||(o=i,t=f.join(r,n.name))}return t}function k(e){let r=e?.trim()||f.join(process.env.LOCALAPPDATA||"","cursor-agent"),t=f.join(r,"node.exe"),o=f.join(r,"index.js");if(O(t)&&O(o))return{nodeExe:t,indexJs:o,versionDir:r};let n=ve(r);if(!n)return null;let i=f.join(n,"node.exe"),s=f.join(n,"index.js");return!O(i)||!O(s)?null:{nodeExe:i,indexJs:s,versionDir:n}}function Re(e,r,t){return{executable:e,prefixArgs:[r],shell:!1,detached:v(),bundledVersionDir:t}}function $(e){if(process.platform==="win32"){let r=/\.(cmd|bat)$/i.test(e),t=/node\.exe$/i.test(e)&&Pe(g.join(g.dirname(e),"index.js"));if(r||t||e==="agent"){let n=r?k(g.dirname(e)):t?{nodeExe:e,indexJs:g.join(g.dirname(e),"index.js"),versionDir:g.dirname(e)}:k();if(n)return Re(n.nodeExe,n.indexJs,n.versionDir);throw new Error("Cursor Agent on Windows has no headless bundled node.exe under %LOCALAPPDATA%\\cursor-agent\\versions\\\u2026. Run `agent login` / update Cursor Agent CLI, use `--provider claude`, or set KYNVER_CURSOR_AGENT_ROOT to the cursor-agent folder.")}}return{executable:e,prefixArgs:[],shell:!1,detached:v()}}import{spawnSync as ye}from"node:child_process";function b(e,r=process.env){try{let t;try{t=$(e)}catch{t={executable:e,prefixArgs:[]}}let o=ye(t.executable,[...t.prefixArgs,"status","--format","json"],{encoding:"utf8",windowsHide:!0,timeout:8e3,env:{...r,CI:"1",NO_COLOR:"1"}});if(o.status!==0)return{ok:!1,note:"agent status: not authenticated"};let n=(o.stdout||"").trim();if(!n)return{ok:!1,note:"agent status: empty response"};let i;try{i=JSON.parse(n)}catch{return{ok:!1,note:"agent status: unparseable response"}}return typeof i=="object"&&i!==null&&i.isAuthenticated===!0?{ok:!0,note:"agent status: authenticated"}:{ok:!1,note:"agent status: not authenticated"}}catch(t){return{ok:!1,note:t instanceof Error?t.message:"agent status probe failed"}}}function w(e=process.env){let r=[],t=e.KYNVER_CURSOR_AUTH_HOME?.trim();t&&(r.push(E.join(t,".config","cursor","auth.json")),r.push(E.join(t,".cursor-agent","auth.json")));let o=ke();if(r.push(E.join(o,".config","cursor","auth.json")),r.push(E.join(o,".cursor-agent","auth.json")),process.platform==="win32"){let n=e.LOCALAPPDATA?.trim(),i=e.APPDATA?.trim();n&&r.push(E.join(n,"cursor-agent","auth.json")),i&&r.push(E.join(i,"cursor","auth.json"))}return r}var we="agent";function W(e=new Date().toISOString()){let r=d(we,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:h("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=l(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=w().find(a=>be(a)),n=b(r),i=!!o||n.ok,s=t.ok&&i;return{providerId:"cursor",ready:s,authSource:"oauth_local",sessionFingerprint:o?u(o):void 0,checkedAt:e,note:s?"Local Cursor/Composer OAuth session bound on runner":[t.note,i?void 0:n.note??"no ~/.config/cursor/auth.json or `agent login` session"].filter(Boolean).join("; ")}}import{existsSync as Ie,readFileSync as Ne}from"node:fs";import{homedir as Te}from"node:os";import I from"node:path";var Ke=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function Le(){let e=process.env.HERMES_HOME?.trim(),r=e?I.resolve(e):I.join(Te(),".hermes");return I.join(r,".env")}function De(e){try{let r=Ne(e,"utf8"),t=[];for(let o of Ke)new RegExp(`^${o}=`,"m").test(r)&&t.push(o);return t}catch{return[]}}function V(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=l(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=Le(),n=Ie(o),i=n?De(o):[],a=i.some(m=>m.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",c=t.ok&&n;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:n,authSource:a,sessionFingerprint:n?u(o):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function Be(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=F(r),o={codex:t,cursor:W(r),claude:U(r)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:r,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:V(r),hermesOpenAiCodex:x(r),codexAdapterPath:t.path,readyCount:n}}var Me={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function Ye(){return Object.values(Me)}var J=["off","observe","enforce"];function je(e){let r=(e??"off").trim().toLowerCase();return J.includes(r)?r:"off"}function P(e=process.env){return je(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function N(e=process.env){let r=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return r?r==="1"||r==="true"||r==="yes"||r==="on":P(e)==="enforce"}import{createHash as Ue}from"node:crypto";function C(e){if(e==null)return null;let r=e.trim();return r.length?r:null}function T(e){let r=C(e.sessionId)??"anonymous",t=C(e.title)??C(e.action)??"foreground",o=Ue("sha256").update([C(e.planId)??"",C(e.parentTaskId)??"",t.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${r}:${o}`}function He(e,r){return e==="enforce"&&r?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function Fe(e,r=process.env){let t=P(r),o=N(r),n=He(t,o),i=n==="enforce_harness_task"?T({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return t==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:t,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{T as buildForegroundHarnessIdempotencyKey,Be as buildOrchestrationProviderInventory,Fe as evaluateOrchestrationPolicy,N as isOrchestrationEnforceTasksEnabled,Ye as listOrchestrationProviderCapabilities,P as resolveOrchestrationPolicyMode};

package/dist/server/venice.js

@@ -0,0 +1 @@
+var _="venice",l="https://api.venice.ai/api/v1",c="venice-uncensored-1-2",p="KYNVER_VENICE_API_KEY",u="VENICE_API_KEY",d="KYNVER_VENICE_BASE_URL",f="KYNVER_VENICE_DEFAULT_MODEL",g=["venice","venice-ai","venice_ai","veniceai"];function m(e){return typeof e=="string"&&g.includes(e.trim().toLowerCase())}function b(e=process.env){return e[p]?.trim()||e[u]?.trim()||void 0}function x(e=process.env){return(e[d]?.trim()||l).replace(/\/+$/,"")}function E(e=process.env){return e[f]?.trim()||c}function C(e){return{"content-type":"application/json",authorization:`Bearer ${e}`}}function o(e,...n){if(!e)return"unknown";for(let t of n){let i=e[t];if(typeof i=="boolean")return i}return"unknown"}function V(e){if(!e||typeof e!="object")return null;let n=e;if(typeof n.id!="string"||!n.id.trim())return null;let t=n.model_spec&&typeof n.model_spec=="object"?n.model_spec:{},i=t.capabilities&&typeof t.capabilities=="object"?t.capabilities:void 0,s=typeof n.type=="string"&&n.type?n.type:"text",r=t.availableContextTokens??t.available_context_tokens,a=typeof t.name=="string"&&t.name.trim()?t.name.trim():n.id;return{id:n.id,label:a,type:s,contextTokens:typeof r=="number"&&Number.isFinite(r)?r:null,capabilities:{toolCalling:o(i,"supportsFunctionCalling","supportsToolCalling","supports_function_calling"),vision:o(i,"supportsVision","supports_vision"),streaming:s==="text"?o(i,"supportsStreaming","supports_streaming")!==!1:!1,reasoning:o(i,"supportsReasoning","supports_reasoning")}}}function y(e){let n=e&&typeof e=="object"?e.data:void 0;return Array.isArray(n)?n.map(V).filter(t=>t!==null&&t.type==="text").sort((t,i)=>t.id.localeCompare(i.id)):[]}function I(e,n){return n?n.capabilities.toolCalling===!1?{ok:!1,message:`Venice model "${e}" doesn't support tool calling, so it can answer questions but can't run agent tools. Pick a model marked "tools" for Agent mode.`}:{ok:!0,unverified:n.capabilities.toolCalling==="unknown"}:{ok:!0,unverified:!0}}function k(e,n){return e?.trim()||E(n)}export{p as VENICE_API_KEY_ENV,u as VENICE_API_KEY_ENV_FALLBACK,d as VENICE_BASE_URL_ENV,l as VENICE_DEFAULT_BASE_URL,c as VENICE_DEFAULT_MODEL,f as VENICE_DEFAULT_MODEL_ENV,_ as VENICE_PROVIDER,g as VENICE_PROVIDER_ALIASES,I as assessVeniceToolSupport,C as buildVeniceHeaders,m as isVeniceProviderName,V as parseVeniceModel,y as parseVeniceModelList,b as resolveVeniceApiKey,x as resolveVeniceBaseUrl,E as resolveVeniceDefaultModel,k as veniceModelOrDefault};

package/dist/server/worker-policy.js

@@ -1,4 +1,4 @@
-var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function ie(e){let r=e[Jr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function k(e,r={}){return Vr.has(e)?!0:Gr.has(e)||r.operatorAllow?.has(e)||qr.some(t=>e.endsWith(t))?!1:jr.some(t=>e.endsWith(t))}function we(e){let r=ie(e);return Object.keys(e).filter(t=>k(t,{operatorAllow:r})).sort()}function Pe(e){let r=ie(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!k(t,{operatorAllow:r})&&k(t)).sort()}function N(e){let r=ie(e),t={...e};for(let n of Object.keys(t))k(n,{operatorAllow:r})&&delete t[n];return t}function zr(e){let r=we(e),t=Pe(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var Hr,Vr,jr,Yr,Gr,qr,Jr,D=o(()=>{"use strict";Hr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Vr=new Set(Hr),jr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],Yr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Gr=new Set(Yr),qr=["_PUBLIC_KEY"],Jr="KYNVER_WORKER_ENV_ALLOW"});var f=o(()=>{"use strict"});var Me=o(()=>{"use strict"});function M(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict";Me()});var U=o(()=>{"use strict";f();a();D()});var le=o(()=>{"use strict";U()});var ce=o(()=>{"use strict";U();f();le()});var g=o(()=>{"use strict"});var Be=o(()=>{"use strict";g()});var ue=o(()=>{"use strict";a()});var h=o(()=>{"use strict"});var L=o(()=>{"use strict"});var Ue=o(()=>{"use strict"});var mo,fo,de=o(()=>{"use strict";mo=25*1024*1024*1024,fo=12*1024*1024*1024});var _o,xo,Le=o(()=>{"use strict";de();_o=5*1024*1024*1024,xo=10*1024*1024*1024});var Co,Oo,pe=o(()=>{"use strict";Le();de();Co=30*1024*1024*1024,Oo=15*1024*1024*1024});var Fe=o(()=>{"use strict";a()});import mt from"node:path";var Ko,fe=o(()=>{"use strict";f();Fe();Ko=mt.join(".openclaw","harness")});var $=o(()=>{"use strict";y();h();L();H();fe()});var Ve=o(()=>{"use strict";y();fe();$();a()});var Y=o(()=>{"use strict";Ve();a()});var Ye=o(()=>{"use strict";Y();a()});var Ge=o(()=>{"use strict"});var qe=o(()=>{"use strict";Ge();a()});var Je=o(()=>{"use strict"});var ze=o(()=>{"use strict";Je()});var G=o(()=>{"use strict"});var q,ge,vi,E=o(()=>{"use strict";q="claude-sonnet-5-5",ge="claude-opus-5-5",vi={[q]:"claude-sonnet-4-6",[ge]:"claude-opus-4-8"}});var Xe=o(()=>{"use strict"});var Ze=o(()=>{"use strict"});var Qe=o(()=>{"use strict";ze();a();G();E();Xe();Ze()});var Mi,u=o(()=>{"use strict";Mi=String.raw`"use strict";
+var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function ie(e){let r=e[Jr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function k(e,r={}){return Hr.has(e)?!0:Gr.has(e)||r.operatorAllow?.has(e)||qr.some(t=>e.endsWith(t))?!1:jr.some(t=>e.endsWith(t))}function we(e){let r=ie(e);return Object.keys(e).filter(t=>k(t,{operatorAllow:r})).sort()}function Pe(e){let r=ie(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!k(t,{operatorAllow:r})&&k(t)).sort()}function T(e){let r=ie(e),t={...e};for(let n of Object.keys(t))k(n,{operatorAllow:r})&&delete t[n];return t}function zr(e){let r=we(e),t=Pe(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var Vr,Hr,jr,Yr,Gr,qr,Jr,D=o(()=>{"use strict";Vr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Hr=new Set(Vr),jr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],Yr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Gr=new Set(Yr),qr=["_PUBLIC_KEY"],Jr="KYNVER_WORKER_ENV_ALLOW"});var f=o(()=>{"use strict"});var Me=o(()=>{"use strict"});function M(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict";Me()});var B=o(()=>{"use strict";f();a();D()});var le=o(()=>{"use strict";B()});var ce=o(()=>{"use strict";B();f();le()});var g=o(()=>{"use strict"});var Ue=o(()=>{"use strict";g()});var ue=o(()=>{"use strict";a()});var h=o(()=>{"use strict"});var L=o(()=>{"use strict"});var Be=o(()=>{"use strict"});var fo,go,de=o(()=>{"use strict";fo=25*1024*1024*1024,go=12*1024*1024*1024});var xo,Ro,Le=o(()=>{"use strict";de();xo=5*1024*1024*1024,Ro=10*1024*1024*1024});var Oo,Ao,pe=o(()=>{"use strict";Le();de();Oo=30*1024*1024*1024,Ao=15*1024*1024*1024});var Fe=o(()=>{"use strict";a()});import mt from"node:path";var Mo,fe=o(()=>{"use strict";f();Fe();Mo=mt.join(".openclaw","harness")});var $=o(()=>{"use strict";y();h();L();V();fe()});var He=o(()=>{"use strict";y();fe();$();a()});var Y=o(()=>{"use strict";He();a()});var Ye=o(()=>{"use strict";Y();a()});var Ge=o(()=>{"use strict"});var qe=o(()=>{"use strict";Ge();a()});var Je=o(()=>{"use strict"});var ze=o(()=>{"use strict";Je()});var G=o(()=>{"use strict"});var q,ge,_i,E=o(()=>{"use strict";q="claude-sonnet-5-5",ge="claude-opus-5-5",_i={[q]:"claude-sonnet-4-6",[ge]:"claude-opus-4-8"}});var Xe=o(()=>{"use strict"});var Ze=o(()=>{"use strict"});var Qe=o(()=>{"use strict";ze();a();G();E();Xe();Ze()});var Ui,u=o(()=>{"use strict";Ui=String.raw`"use strict";
 const cp = require("child_process"), fs = require("fs");
 const argv = process.argv.slice(1);
 const exitFile = argv[0], cmd = argv[1], args = argv.slice(2);
@@ -64,5 +64,5 @@ child.on("error", (e) => {
   if (!child.pid) finish(127, null, String(e && e.message));
 });
 child.on("exit", (code, signal) => finish(code, signal));
-`});var er=o(()=>{"use strict";Y();a();u()});var rr=o(()=>{"use strict";G();E()});var tr=o(()=>{"use strict"});var Qi,es,nr=o(()=>{"use strict";U();Qi=10*6e4,es=60*6e4});var or=o(()=>{"use strict"});var he=o(()=>{"use strict"});var ir=o(()=>{"use strict"});var sr=o(()=>{"use strict";he();ir()});var ar=o(()=>{"use strict";qe();Qe();er();u();G();rr();tr();nr();or();sr();he();a()});var lr=o(()=>{"use strict";ar();a()});var Ct,Ot,cr=o(()=>{"use strict";Ue();y();h();L();H();pe();Y();Ye();lr();a();Ct=500*1024*1024,Ot=4*1024*1024*1024});var H=o(()=>{"use strict";cr()});import{homedir as At}from"node:os";import wt from"node:path";var ur,ye=o(()=>{"use strict";ur=wt.join(At(),".kynver",".env")});var dr=o(()=>{"use strict"});var pr=o(()=>{"use strict";dr()});var mr=o(()=>{"use strict"});var fr=o(()=>{"use strict";a()});var ve=o(()=>{"use strict";pr();mr();fr()});var gr=o(()=>{"use strict"});var hr=o(()=>{"use strict";gr()});var J=o(()=>{"use strict";ye();f();y();ve();hr()});var yr=o(()=>{"use strict";h();h()});var vr=o(()=>{"use strict";ye();ve();J()});var _e=o(()=>{"use strict"});var _r=o(()=>{"use strict";ce();h();yr();y();J();vr();ue();_e();$()});function S(e){let r=e.trim().toLowerCase();return Ut[r]??r}var xr,Bt,Ut,z=o(()=>{"use strict";xr=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],Bt=xr.join("|"),Ut={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});var Rr=o(()=>{"use strict";f()});var kr=o(()=>{"use strict";Rr()});var br=o(()=>{"use strict"});var Er=o(()=>{"use strict";br()});import{homedir as Ft,totalmem as Vl}from"node:os";import xe from"node:path";var Sr,lc,cc,uc,dc,y=o(()=>{"use strict";ce();f();le();Be();ue();h();L();H();pe();J();_r();z();$();kr();_e();Er();Sr=xe.join(Ft(),".kynver"),lc=xe.join(Sr,"config.json"),cc=xe.join(Sr,"credentials"),uc=500*1024*1024,dc=4*1024*1024*1024});D();D();var se="KYNVER_NO_PROD_DB_CREDENTIALS",Xr=["KYNVER_ENV_FILE"],Zr=new Set(["1","true","yes","on"]);function Te(e){let r=e[se]?.trim().toLowerCase();return r!==void 0&&Zr.has(r)}function p(e,r={}){let t=N(e);if(!r.reviewWorker)return t;let n={...t,[se]:"1"};for(let i of Xr)delete n[i];return n}var Ie=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Qr(e,r={}){let t=p(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||Ie.includes(c)),i=Ie.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=Te(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var et="expert-lane-pr-review:",rt="plan-review-task",tt="scheduledjob:",W=new Set(["lorentz","dalton","rhea","sentinel"]);function nt(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function ae(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function ot(e,r){return e.startsWith("factory:")?e.includes("lb")||ae(r):!1}function it(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
-${n}`,s=nt(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(et)||r===rt||r.startsWith("daemon-review:")||s&&W.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||ot(r,i)||ae(i))||r.startsWith(tt)&&e.parentTaskId&&s&&W.has(s)||e.planId&&!e.parentTaskId&&s&&W.has(s)&&ae(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&W.has(s))}var st=/^claude[-_]/i,at=/^(?:opus|sonnet|haiku)\b/i;function Ne(e){let r=e.trim();return st.test(r)||at.test(r)}function De(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function We(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Ke(e){return e.trim().toLowerCase().startsWith("gemini-")}function lt(e){return De(e)?"codex":Ne(e)?"claude":Ke(e)?"gemini":(We(e),"cursor")}function ct(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:i,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:i,rule:i?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function ut(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Ne(n)||De(n)||We(n)||Ke(n)?{lane:t,model:n,provider:lt(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function K(e){let r=typeof e=="string"?e.trim():"";return r?ct(r)??ut(r):null}y();g();u();a();u();a();g();E();var Ar="kynver",wr=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Gt=wr.map(e=>`mcp__${Ar}__${e}`);E();u();a();g();u();a();g();var Q="gpt-5.6-sol";var Lu=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||Q;function Jt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||Q}var zt=Jt();u();a();var _d=600*1e3;u();a();g();var $d=600*1e3;var Pr="composer-2.5";z();z();var m="cursor",en=new Set(["claude","opus","anthropic"]),rn=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function A(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function d(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return en.has(r)?!0:r.includes("claude")||r.includes("opus")}function Re(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&d(r))return!0;let t=A(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=K(A(e,"executorRef"));if(n?.provider&&d(n.provider)||n?.model&&d(tn(n.model)))return!0;let i=A(e,"description");if(rn.some(l=>l.test(i)))return!0;let s=A(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function tn(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function nn(e,r){return{provider:m,model:Pr,rule:`policy:cursor_default${r}`,requestedModel:e}}var on=["explicit:","executor_ref:","factory:","task:"];function sn(e){return on.some(r=>e.startsWith(r))}function ke(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||K(A(e,"executorRef"))?.provider?!0:Re(e)}function Ir(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&d(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||sn(r.rule)||ke(t)||!d(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return nn(r.model,i)}function an(e,r=m){let t=e?.trim();return t?S(t):r}function ln(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(m)?[...new Set(r.map(t=>d(t)?m:t))]:r.every(t=>d(t))?[m]:r}var cn=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,un=/\b(npm run build\b|next build\b)\b/i,dn=/\b(vercel (build|deploy|--prod))\b/i,pn=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function be(e){let r=e.trim();return r?pn.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:dn.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:un.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:cn.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var ee="heavy_verification_token_required";import{spawnSync as Pn}from"node:child_process";a();import{closeSync as vn,existsSync as P,mkdirSync as _n,openSync as xn,readdirSync as Wr,readFileSync as Rn,statSync as kn,unlinkSync as Kr,writeFileSync as bn}from"node:fs";import Ce from"node:path";import{mkdirSync as fn}from"node:fs";import{tmpdir as gn}from"node:os";import re from"node:path";import{homedir as mn,tmpdir as dp}from"node:os";import Tr from"node:path";function Nr(){let e=process.env.KYNVER_STATE_ROOT;return e?Tr.resolve(e):Tr.join(mn(),".kynver","state")}function hn(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function yn(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?re.resolve(e):hn()?re.join(gn(),"kynver","state","heavy-verification"):re.join(Nr(),"heavy-verification")}function Ee(){return re.join(yn(),"slots")}function w(){let e=Ee();return fn(e,{recursive:!0}),e}var I=120*6e4,Dr=1;function En(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function ne(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function te(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?En(e,Dr):Dr}function Sn(e){return`slot-${e}`}function Cn(e,r=Ee()){return Ce.join(r,`${e}.json`)}function Oe(e){if(!P(e))return null;try{let r=JSON.parse(Rn(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function Mr(e,r=I){if(!e||!M(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function Br(e,r){let t=Oe(e);if(t)return Mr(t,r);if(!P(e))return!0;try{return Date.now()-kn(e).mtimeMs>r}catch{return!0}}function On(e,r){if(Br(e,r))try{Kr(e)}catch{}}function An(e){return _n(e,{recursive:!0}),e}function Ae(e={}){let r=An(e.slotsDir??w()),t=e.staleMs??I,n=0;for(let i of Wr(r)){if(!i.endsWith(".json"))continue;let s=Ce.join(r,i),l=P(s);On(s,t),l&&!P(s)&&(n+=1)}return n}function wn(e={}){let r=e.slotsDir??w(),t=e.staleMs??I;Ae({slotsDir:r,staleMs:t});let n=[];for(let i of Wr(r)){if(!i.endsWith(".json"))continue;let s=Oe(Ce.join(r,i));s&&!Mr(s,t)&&n.push(s)}return n}function Se(e={}){return wn(e).length}function T(e,r={}){if(ne())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:te(),reason:null};let t=r.slotsDir??w(),n=r.staleMs??I,i=r.maxSlots??te();Ae({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=Sn(l),x=Cn(c,t),Lr=Oe(x);if(Br(x,n))try{Kr(x)}catch{}else if(Lr||P(x))continue;let Fr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let R=xn(x,"wx");bn(R,JSON.stringify(Fr,null,2),"utf8"),vn(R);let $r=Se({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:$r,maxSlots:i,reason:null}}catch(R){if(R.code==="EEXIST")continue;throw R}}let s=Se({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function oe(e,r={}){if(ne())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:te(),reason:null};let t=r.slotsDir??w(),n=r.staleMs??I,i=r.maxSlots??te();Ae({slotsDir:t,staleMs:n});let s=Se({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function In(e){e<=0||Pn(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore",windowsHide:!0})}function Ur(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=T(e,n);for(;!s.admitted&&Date.now()<i;)In(Math.min(t,i-Date.now())),s=T(e,n);return s}function Tn(e,r={}){let t=be(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...oe(e),slotId:null}};if(ne())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...oe(e),slotId:null}};let n=r.waitMs??0,i=n>0?Ur(e,n,r.pollMs):T(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:ee,commandClass:t.commandClass,reason:t.reason??i.reason??ee,verificationGate:i}}export{m as DEFAULT_WORKER_PROVIDER,ee as HEAVY_VERIFICATION_TOKEN_REQUIRED,se as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Qr as auditReviewWorkerCredentialScope,zr as auditWorkerEnv,p as buildWorkerSpawnEnv,be as classifyHeavyShellCommand,Ir as enforceCursorWorkerProvider,Tn as gateWorkerShellCommand,d as isClaudeFamilyProvider,k as isForbiddenWorkerEnvKey,it as isHarnessExpertReviewWorker,Te as isNoProdCredentialReviewEnvironment,we as listForbiddenWorkerEnvKeys,Pe as listOperatorAllowedWorkerEnvKeys,S as normalizeWorkerProviderName,ln as preferCursorExecutor,an as resolveConfiguredWorkerProvider,N as scrubWorkerEnv,Re as taskAllowsClaudeWorker,ke as taskExpressesWorkerProviderPreference};
+`});var er=o(()=>{"use strict";Y();a();u()});var rr=o(()=>{"use strict";G();E()});var tr=o(()=>{"use strict"});var es,rs,nr=o(()=>{"use strict";B();es=10*6e4,rs=60*6e4});var or=o(()=>{"use strict"});var he=o(()=>{"use strict"});var ir=o(()=>{"use strict"});var sr=o(()=>{"use strict";he();ir()});var ar=o(()=>{"use strict";qe();Qe();er();u();G();rr();tr();nr();or();sr();he();a()});var lr=o(()=>{"use strict";ar();a()});var Ct,Ot,cr=o(()=>{"use strict";Be();y();h();L();V();pe();Y();Ye();lr();a();Ct=500*1024*1024,Ot=4*1024*1024*1024});var V=o(()=>{"use strict";cr()});import{homedir as At}from"node:os";import wt from"node:path";var ur,ye=o(()=>{"use strict";ur=wt.join(At(),".kynver",".env")});var dr=o(()=>{"use strict"});var pr=o(()=>{"use strict";dr()});var mr=o(()=>{"use strict"});var fr=o(()=>{"use strict";a()});var ve=o(()=>{"use strict";pr();mr();fr()});var gr=o(()=>{"use strict"});var hr=o(()=>{"use strict";gr()});var J=o(()=>{"use strict";ye();f();y();ve();hr()});var yr=o(()=>{"use strict";h();h()});var vr=o(()=>{"use strict";ye();ve();J()});var _e=o(()=>{"use strict"});var _r=o(()=>{"use strict";ce();h();yr();y();J();vr();ue();_e();$()});function S(e){let r=e.trim().toLowerCase();return Bt[r]??r}var xr,Ut,Bt,z=o(()=>{"use strict";xr=["claude","cursor","codex","gemini","gemini-api","openai-compatible","venice"],Ut=xr.join("|"),Bt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible","venice-ai":"venice",venice_ai:"venice",veniceai:"venice",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});var Rr=o(()=>{"use strict";f()});var kr=o(()=>{"use strict";Rr()});var br=o(()=>{"use strict"});var Er=o(()=>{"use strict";br()});import{homedir as Ft,totalmem as jl}from"node:os";import xe from"node:path";var Sr,cc,uc,dc,pc,y=o(()=>{"use strict";ce();f();le();Ue();ue();h();L();V();pe();J();_r();z();$();kr();_e();Er();Sr=xe.join(Ft(),".kynver"),cc=xe.join(Sr,"config.json"),uc=xe.join(Sr,"credentials"),dc=500*1024*1024,pc=4*1024*1024*1024});D();D();var se="KYNVER_NO_PROD_DB_CREDENTIALS",Xr=["KYNVER_ENV_FILE"],Zr=new Set(["1","true","yes","on"]);function Ne(e){let r=e[se]?.trim().toLowerCase();return r!==void 0&&Zr.has(r)}function p(e,r={}){let t=T(e);if(!r.reviewWorker)return t;let n={...t,[se]:"1"};for(let i of Xr)delete n[i];return n}var Ie=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Qr(e,r={}){let t=p(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||Ie.includes(c)),i=Ie.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=Ne(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var et="expert-lane-pr-review:",rt="plan-review-task",tt="scheduledjob:",W=new Set(["lorentz","dalton","rhea","sentinel"]);function nt(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function ae(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function ot(e,r){return e.startsWith("factory:")?e.includes("lb")||ae(r):!1}function it(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
+${n}`,s=nt(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(et)||r===rt||r.startsWith("daemon-review:")||s&&W.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||ot(r,i)||ae(i))||r.startsWith(tt)&&e.parentTaskId&&s&&W.has(s)||e.planId&&!e.parentTaskId&&s&&W.has(s)&&ae(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&W.has(s))}var st=/^claude[-_]/i,at=/^(?:opus|sonnet|haiku)\b/i;function Te(e){let r=e.trim();return st.test(r)||at.test(r)}function De(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function We(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Ke(e){return e.trim().toLowerCase().startsWith("gemini-")}function lt(e){return De(e)?"codex":Te(e)?"claude":Ke(e)?"gemini":(We(e),"cursor")}function ct(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="venice"||n==="venice-ai"||n==="venice_ai"||n==="veniceai"?{provider:"venice",model:i,rule:"executor_ref:provider_venice"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:i,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:i,rule:i?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function ut(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Te(n)||De(n)||We(n)||Ke(n)?{lane:t,model:n,provider:lt(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function K(e){let r=typeof e=="string"?e.trim():"";return r?ct(r)??ut(r):null}y();g();u();a();u();a();g();E();var Ar="kynver",wr=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],qt=wr.map(e=>`mcp__${Ar}__${e}`);E();u();a();g();u();a();g();var Q="gpt-5.6-sol";var Hu=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||Q;function zt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||Q}var Xt=zt();u();a();var bd=600*1e3;u();a();g();var Yd=600*1e3;var Pr="composer-2.5";z();z();var m="cursor",rn=new Set(["claude","opus","anthropic"]),tn=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function A(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function d(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return rn.has(r)?!0:r.includes("claude")||r.includes("opus")}function Re(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&d(r))return!0;let t=A(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=K(A(e,"executorRef"));if(n?.provider&&d(n.provider)||n?.model&&d(nn(n.model)))return!0;let i=A(e,"description");if(tn.some(l=>l.test(i)))return!0;let s=A(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function nn(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function on(e,r){return{provider:m,model:Pr,rule:`policy:cursor_default${r}`,requestedModel:e}}var sn=["explicit:","executor_ref:","factory:","task:"];function an(e){return sn.some(r=>e.startsWith(r))}function ke(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||K(A(e,"executorRef"))?.provider?!0:Re(e)}function Ir(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&d(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||an(r.rule)||ke(t)||!d(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return on(r.model,i)}function ln(e,r=m){let t=e?.trim();return t?S(t):r}function cn(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(m)?[...new Set(r.map(t=>d(t)?m:t))]:r.every(t=>d(t))?[m]:r}var un=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,dn=/\b(npm run build\b|next build\b)\b/i,pn=/\b(vercel (build|deploy|--prod))\b/i,mn=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function be(e){let r=e.trim();return r?mn.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:pn.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:dn.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:un.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var ee="heavy_verification_token_required";import{spawnSync as In}from"node:child_process";a();import{closeSync as _n,existsSync as P,mkdirSync as xn,openSync as Rn,readdirSync as Wr,readFileSync as kn,statSync as bn,unlinkSync as Kr,writeFileSync as En}from"node:fs";import Ce from"node:path";import{mkdirSync as gn}from"node:fs";import{tmpdir as hn}from"node:os";import re from"node:path";import{homedir as fn,tmpdir as _p}from"node:os";import Nr from"node:path";function Tr(){let e=process.env.KYNVER_STATE_ROOT;return e?Nr.resolve(e):Nr.join(fn(),".kynver","state")}function yn(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function vn(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?re.resolve(e):yn()?re.join(hn(),"kynver","state","heavy-verification"):re.join(Tr(),"heavy-verification")}function Ee(){return re.join(vn(),"slots")}function w(){let e=Ee();return gn(e,{recursive:!0}),e}var I=120*6e4,Dr=1;function Sn(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function ne(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function te(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?Sn(e,Dr):Dr}function Cn(e){return`slot-${e}`}function On(e,r=Ee()){return Ce.join(r,`${e}.json`)}function Oe(e){if(!P(e))return null;try{let r=JSON.parse(kn(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function Mr(e,r=I){if(!e||!M(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function Ur(e,r){let t=Oe(e);if(t)return Mr(t,r);if(!P(e))return!0;try{return Date.now()-bn(e).mtimeMs>r}catch{return!0}}function An(e,r){if(Ur(e,r))try{Kr(e)}catch{}}function wn(e){return xn(e,{recursive:!0}),e}function Ae(e={}){let r=wn(e.slotsDir??w()),t=e.staleMs??I,n=0;for(let i of Wr(r)){if(!i.endsWith(".json"))continue;let s=Ce.join(r,i),l=P(s);An(s,t),l&&!P(s)&&(n+=1)}return n}function Pn(e={}){let r=e.slotsDir??w(),t=e.staleMs??I;Ae({slotsDir:r,staleMs:t});let n=[];for(let i of Wr(r)){if(!i.endsWith(".json"))continue;let s=Oe(Ce.join(r,i));s&&!Mr(s,t)&&n.push(s)}return n}function Se(e={}){return Pn(e).length}function N(e,r={}){if(ne())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:te(),reason:null};let t=r.slotsDir??w(),n=r.staleMs??I,i=r.maxSlots??te();Ae({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=Cn(l),x=On(c,t),Lr=Oe(x);if(Ur(x,n))try{Kr(x)}catch{}else if(Lr||P(x))continue;let Fr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let R=Rn(x,"wx");En(R,JSON.stringify(Fr,null,2),"utf8"),_n(R);let $r=Se({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:$r,maxSlots:i,reason:null}}catch(R){if(R.code==="EEXIST")continue;throw R}}let s=Se({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function oe(e,r={}){if(ne())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:te(),reason:null};let t=r.slotsDir??w(),n=r.staleMs??I,i=r.maxSlots??te();Ae({slotsDir:t,staleMs:n});let s=Se({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Nn(e){e<=0||In(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore",windowsHide:!0})}function Br(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=N(e,n);for(;!s.admitted&&Date.now()<i;)Nn(Math.min(t,i-Date.now())),s=N(e,n);return s}function Tn(e,r={}){let t=be(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...oe(e),slotId:null}};if(ne())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...oe(e),slotId:null}};let n=r.waitMs??0,i=n>0?Br(e,n,r.pollMs):N(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:ee,commandClass:t.commandClass,reason:t.reason??i.reason??ee,verificationGate:i}}export{m as DEFAULT_WORKER_PROVIDER,ee as HEAVY_VERIFICATION_TOKEN_REQUIRED,se as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Qr as auditReviewWorkerCredentialScope,zr as auditWorkerEnv,p as buildWorkerSpawnEnv,be as classifyHeavyShellCommand,Ir as enforceCursorWorkerProvider,Tn as gateWorkerShellCommand,d as isClaudeFamilyProvider,k as isForbiddenWorkerEnvKey,it as isHarnessExpertReviewWorker,Ne as isNoProdCredentialReviewEnvironment,we as listForbiddenWorkerEnvKeys,Pe as listOperatorAllowedWorkerEnvKeys,S as normalizeWorkerProviderName,cn as preferCursorExecutor,ln as resolveConfiguredWorkerProvider,T as scrubWorkerEnv,Re as taskAllowsClaudeWorker,ke as taskExpressesWorkerProviderPreference};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.2.147",
+  "version": "0.2.150",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",
@@ -44,6 +44,11 @@
       "import": "./dist/server/monitor.js",
       "default": "./dist/server/monitor.js"
     },
+    "./venice": {
+      "types": "./dist/server/venice.d.ts",
+      "import": "./dist/server/venice.js",
+      "default": "./dist/server/venice.js"
+    },
     "./server/landing": {
       "types": "./dist/server/landing.d.ts",
       "import": "./dist/server/landing.js",
@@ -186,7 +191,7 @@
     "!dist/**/*.d.ts.map"
   ],
   "scripts": {
-    "build": "esbuild src/provider-terminal-failure.ts src/cli.ts src/daemon-tick-thread.ts src/index.ts src/node-runtime-policy.ts src/local-run-store/index.ts src/worker-broker/index.ts src/worker-persona-catalog.ts src/instruction-bundle/contract.ts src/chat/command-auth-proof.ts src/chat/chat-turn-envelope.ts src/chat/chat-access-change-record.ts src/dispatch-claim-authorization.ts src/desktop-entry.ts src/server/monitor.ts src/server/landing.ts src/server/worker-policy.ts src/server/orchestration.ts src/server/adapter-contract.ts src/server/context-budget-receipt.ts src/server/context-budget.ts src/server/prompt.ts src/server/node-runtime-policy.ts src/server/model-routing.ts src/server/dispatch-routing.ts src/server/db-credentials.ts src/server/heavy-verification.ts src/server/memory-cost.ts src/server/pr-evidence.ts src/server/default-repo.ts src/server/cleanup.ts src/server/repo-search.ts src/server/harness-notice.ts src/server/memory-cost-enforce.ts src/server/wsl-crash-dumps.ts --bundle --platform=node --format=esm --packages=external --outbase=src --outdir=dist --minify && node ../../scripts/package-tsc.mjs -p tsconfig.json --emitDeclarationOnly && node scripts/chmod-cli-bin.mjs",
+    "build": "esbuild src/provider-terminal-failure.ts src/cli.ts src/daemon-tick-thread.ts src/index.ts src/node-runtime-policy.ts src/local-run-store/index.ts src/worker-broker/index.ts src/worker-persona-catalog.ts src/instruction-bundle/contract.ts src/chat/command-auth-proof.ts src/chat/chat-turn-envelope.ts src/chat/chat-access-change-record.ts src/dispatch-claim-authorization.ts src/desktop-entry.ts src/server/monitor.ts src/server/landing.ts src/server/worker-policy.ts src/server/orchestration.ts src/server/adapter-contract.ts src/server/context-budget-receipt.ts src/server/context-budget.ts src/server/prompt.ts src/server/node-runtime-policy.ts src/server/model-routing.ts src/server/venice.ts src/server/dispatch-routing.ts src/server/db-credentials.ts src/server/heavy-verification.ts src/server/memory-cost.ts src/server/pr-evidence.ts src/server/default-repo.ts src/server/cleanup.ts src/server/repo-search.ts src/server/harness-notice.ts src/server/memory-cost-enforce.ts src/server/wsl-crash-dumps.ts --bundle --platform=node --format=esm --packages=external --outbase=src --outdir=dist --minify && node ../../scripts/package-tsc.mjs -p tsconfig.json --emitDeclarationOnly && node scripts/chmod-cli-bin.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run --config vitest.config.ts",
     "prepublishOnly": "node ../../scripts/npm-publish-guard.mjs && npm run build",