npm - @kynver-app/runtime - Versions diffs - 0.2.28 → 0.2.29 - Mend

@kynver-app/runtime 0.2.28 → 0.2.29

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (6) hide show

package/dist/cli.js +67 -67
package/dist/index.js +81 -81
package/dist/server/model-routing.js +3 -3
package/dist/server/orchestration.js +1 -1
package/dist/server/worker-policy.js +2 -2
package/package.json +1 -1

package/dist/server/model-routing.js CHANGED Viewed

@@ -1,5 +1,5 @@
-var a=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};var d=a(()=>{"use strict"});var Rr,Yt,vr,Vt,V=a(()=>{"use strict";Rr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Yt=new Set(Rr),vr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],Vt=new Set(vr)});var G=a(()=>{"use strict";d();V()});var E=a(()=>{"use strict"});var z=a(()=>{"use strict";G();E()});var R=a(()=>{"use strict"});var I=a(()=>{"use strict"});var ge=a(()=>{"use strict"});var ln,cn,q=a(()=>{"use strict";ln=25*1024*1024*1024,cn=12*1024*1024*1024});var fn,gn,he=a(()=>{"use strict";q();fn=5*1024*1024*1024,gn=10*1024*1024*1024});var kn,xn,J=a(()=>{"use strict";he();q();kn=30*1024*1024*1024,xn=15*1024*1024*1024});var be=a(()=>{"use strict";d()});import _r from"node:path";var In,X=a(()=>{"use strict";E();be();In=_r.join(".openclaw","harness")});var K=a(()=>{"use strict";v();R();I();B();X()});var ke=a(()=>{"use strict";v();X();K();d()});var Q=a(()=>{"use strict";ke();d()});var xe=a(()=>{"use strict";Q();d()});var _e=a(()=>{"use strict"});var Se=a(()=>{"use strict";_e();d()});var Ee=a(()=>{"use strict"});var Ce=a(()=>{"use strict";Ee()});var Oe=a(()=>{"use strict";Ce();d()});var Ae=a(()=>{"use strict"});var we=a(()=>{"use strict"});var Pe=a(()=>{"use strict"});var ee=a(()=>{"use strict"});var Ie=a(()=>{"use strict"});var Ne=a(()=>{"use strict";ee();Ie()});var Ke=a(()=>{"use strict";Se();Oe();Ae();we();G();Pe();Ne();ee();d()});var Be=a(()=>{"use strict";Ke()});var Ir,Nr,De=a(()=>{"use strict";ge();v();R();I();B();J();Q();xe();Be();d();Ir=500*1024*1024,Nr=4*1024*1024*1024});var B=a(()=>{"use strict";De()});import{homedir as Kr}from"node:os";import Br from"node:path";var Te,re=a(()=>{"use strict";Te=Br.join(Kr(),".kynver",".env")});var We=a(()=>{"use strict"});var Me=a(()=>{"use strict";We()});var Ue=a(()=>{"use strict"});var te=a(()=>{"use strict";Me();Ue()});var Le=a(()=>{"use strict"});var Fe=a(()=>{"use strict";Le()});var D=a(()=>{"use strict";re();E();v();te();Fe()});var $e=a(()=>{"use strict";R();R()});var He=a(()=>{"use strict";re();te();D()});var je=a(()=>{"use strict";z();R();$e();v();D();He();d();K()});import{existsSync as $r,mkdirSync as As,readFileSync as Hr,writeFileSync as ws}from"node:fs";import{homedir as jr,totalmem as Is}from"node:os";import ne from"node:path";function x(){if(!$r(Ye))return{};try{return JSON.parse(Hr(Ye,"utf8"))}catch{return{}}}var Ve,Ye,Hs,js,Ys,v=a(()=>{"use strict";z();E();d();R();I();B();J();D();je();K();Ve=ne.join(jr(),".kynver"),Ye=ne.join(Ve,"config.json"),Hs=ne.join(Ve,"credentials");js=500*1024*1024,Ys=4*1024*1024*1024});var fr=/^claude[-_]/i,gr=/^(?:opus|sonnet|haiku)\b/i;function pe(e){let r=e.trim();return fr.test(r)||gr.test(r)}function fe(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function j(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function hr(e){return fe(e)?"codex":pe(e)?"claude":(j(e),"cursor")}function yr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:null:null}function br(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?pe(n)||fe(n)||j(n)?{lane:t,model:n,provider:hr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function h(e){let r=typeof e=="string"?e.trim():"";return r?yr(r)??br(r):null}function Y(e){let r=h(e);return r?!!(r.provider&&r.provider!=="cursor"||r.model&&!j(r.model)):!1}v();var Ge={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0}};function _(e){return Ge[e]}function ze(){return Object.values(Ge)}import{existsSync as Vr}from"node:fs";import{homedir as Gr}from"node:os";import C from"node:path";import{createHash as qe}from"node:crypto";import{statSync as Yr}from"node:fs";import{spawnSync as Je}from"node:child_process";function y(e){try{let r=Yr(e),t=`${e}|${r.size}|${r.mtimeMs}`;return qe("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function S(e){return qe("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function m(e,r){for(let t of r){let n=process.env[t]?.trim();if(n)return n}return e}function p(e,r,t={}){let n=t.timeoutMs??8e3;try{let o=Je(e,r,{encoding:"utf8",timeout:n,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(o.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let i=(o.stderr||o.stdout||"").trim(),s=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} probe failed`}}}function T(e,r,t={}){let n=t.timeoutMs??8e3;try{return Je(e,r,{stdio:"ignore",timeout:n,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} auth probe failed`}}}var zr="codex";function qr(){let e=Gr();return[process.env.CODEX_HOME?.trim()?C.join(C.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,C.join(e,".codex","auth.json"),C.join(e,".config","codex","auth.json")].filter(t=>!!t)}function Jr(e){return C.dirname(e)}function Xr(e){let r,t;for(let n of qr()){if(!Vr(n))continue;r??=n;let o=p(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:Jr(n)}});if(t??=o,o.ok)return{authPath:n,login:o}}return{authPath:r,login:t??p(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function Xe(e=new Date().toISOString()){let r=m(zr,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:S("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:n}=Xr(r),o=!!t&&n.ok;return{providerId:"codex",ready:o,authSource:"oauth_local",sessionFingerprint:t?y(t):void 0,checkedAt:e,note:o?"Local Codex OAuth session bound on runner":[n.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as Zr}from"node:fs";import{homedir as Qr}from"node:os";import oe from"node:path";function et(){let e=process.env.HERMES_HOME?.trim(),r=e?oe.resolve(e):oe.join(Qr(),".hermes");return oe.join(r,"auth.json")}function W(e=new Date().toISOString()){let r=m("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=p(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=et(),o=Zr(n),i=T(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:o?y(n):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,o?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function O(e=new Date().toISOString()){let r=Xe(e);if(r.ready)return{...r,path:"codex_cli"};let t=W(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}var Ze=["low","medium","high"],Qe={oauth_local:0,subscription_hermes:0,runner_token:1,api_key_env:2,none:3};function er(e,r){let t=_(e);return r==="privileged"?t.supportsPrivilegedPlatformActions:r==="low"?t.supportsLowRiskOrchestration:!0}function rt(e,r){let t=_(e.providerId),n=_(r.providerId),o=Ze.indexOf(t.costTier)-Ze.indexOf(n.costTier);if(o!==0)return o;let i=Qe[e.binding.authSource]-Qe[r.binding.authSource];return i!==0?i:e.providerId.localeCompare(r.providerId)}function ie(e){let r=ze().map(l=>({providerId:l.id,binding:e.inventory.bindings[l.id]})).filter(l=>l.binding.ready&&er(l.providerId,e.riskClass));if(r.length===0)return null;let n=[...r].sort(rt)[0],o="codex";if(n.providerId===o)return{providerId:n.providerId,binding:n.binding};let i=e.inventory.bindings[o],s;return er(o,e.riskClass)?i.ready||(s=i.note??`${o} not bound`):s=`${e.riskClass} orchestration requires privileged-capable provider`,{providerId:n.providerId,binding:n.binding,escalatedFrom:o,escalatedReason:s}}import{existsSync as tt}from"node:fs";import{homedir as nt}from"node:os";import ot from"node:path";var it="claude";function st(){let e=nt();return[ot.join(e,".claude",".credentials.json")]}function rr(e=new Date().toISOString()){let r=m(it,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:S("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=p(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=st().find(s=>tt(s)),o=T(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(o.ok||!!n);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,o.note,n?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as at}from"node:fs";import{homedir as lt}from"node:os";import se from"node:path";var ct="agent";function ut(){let e=lt(),r=[se.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let t=process.env.LOCALAPPDATA?.trim(),n=process.env.APPDATA?.trim();t&&r.push(se.join(t,"cursor-agent","auth.json")),n&&r.push(se.join(n,"cursor","auth.json"))}return r}function tr(e=new Date().toISOString()){let r=m(ct,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:S("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=p(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=ut().find(i=>at(i)),o=!!n&&t.ok;return{providerId:"cursor",ready:o,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:o?"Local Cursor/Composer OAuth session bound on runner":[t.note,n?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as dt,readFileSync as mt}from"node:fs";import{homedir as pt}from"node:os";import ae from"node:path";var ft=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function gt(){let e=process.env.HERMES_HOME?.trim(),r=e?ae.resolve(e):ae.join(pt(),".hermes");return ae.join(r,".env")}function ht(e){try{let r=mt(e,"utf8"),t=[];for(let n of ft)new RegExp(`^${n}=`,"m").test(r)&&t.push(n);return t}catch{return[]}}function nr(e=new Date().toISOString()){let r=m("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=p(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=gt(),o=dt(n),i=o?ht(n):[],l=i.some(c=>c.endsWith("_API_KEY"))?"api_key_env":o?"oauth_local":"none",u=t.ok&&o;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:o,authSource:l,sessionFingerprint:o?y(n):void 0,checkedAt:e,note:u?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,o?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function or(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=O(r),n={codex:t,cursor:tr(r),claude:rr(r)},o=Object.values(n).filter(i=>i.ready).length;return{generatedAt:r,bindings:n,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:nr(r),hermesOpenAiCodex:W(r),codexAdapterPath:t.path,readyCount:o}}var yt=[/\bprivileged\b/i,/\bproduction\s+db\b/i,/\bdb:push\b/i,/\bmigration\b/i,/\bdeploy\b/i,/\bsecrets?\b/i,/\bstripe\b/i,/\[require-approval\]/i,/\[operator-only\]/i],bt=[/\borchestration\b/i,/\bplan[- ]?progress\b/i,/\bstatus\s+sync\b/i,/\bheartbeat\b/i,/\bboard[- ]?drain\b/i,/\bmaintenance\b/i,/\[orchestration:\s*low-risk\]/i];function le(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Rt(e){let r=le(e,"executorRef").toLowerCase(),t=le(e,"title").toLowerCase(),n=le(e,"description").toLowerCase(),o=`${r}
+var a=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};var d=a(()=>{"use strict"});var Rr,Yt,vr,Vt,V=a(()=>{"use strict";Rr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Yt=new Set(Rr),vr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],Vt=new Set(vr)});var G=a(()=>{"use strict";d();V()});var E=a(()=>{"use strict"});var z=a(()=>{"use strict";G();E()});var R=a(()=>{"use strict"});var I=a(()=>{"use strict"});var ge=a(()=>{"use strict"});var ln,cn,q=a(()=>{"use strict";ln=25*1024*1024*1024,cn=12*1024*1024*1024});var fn,gn,he=a(()=>{"use strict";q();fn=5*1024*1024*1024,gn=10*1024*1024*1024});var kn,xn,J=a(()=>{"use strict";he();q();kn=30*1024*1024*1024,xn=15*1024*1024*1024});var be=a(()=>{"use strict";d()});import _r from"node:path";var In,X=a(()=>{"use strict";E();be();In=_r.join(".openclaw","harness")});var K=a(()=>{"use strict";v();R();I();B();X()});var ke=a(()=>{"use strict";v();X();K();d()});var Q=a(()=>{"use strict";ke();d()});var xe=a(()=>{"use strict";Q();d()});var _e=a(()=>{"use strict"});var Se=a(()=>{"use strict";_e();d()});var Ee=a(()=>{"use strict"});var Ce=a(()=>{"use strict";Ee()});var Oe=a(()=>{"use strict";Ce();d()});var Ae=a(()=>{"use strict"});var we=a(()=>{"use strict"});var Pe=a(()=>{"use strict"});var ee=a(()=>{"use strict"});var Ie=a(()=>{"use strict"});var Ne=a(()=>{"use strict";ee();Ie()});var Ke=a(()=>{"use strict";Se();Oe();Ae();we();G();Pe();Ne();ee();d()});var Be=a(()=>{"use strict";Ke()});var Ir,Nr,De=a(()=>{"use strict";ge();v();R();I();B();J();Q();xe();Be();d();Ir=500*1024*1024,Nr=4*1024*1024*1024});var B=a(()=>{"use strict";De()});import{homedir as Kr}from"node:os";import Br from"node:path";var Te,re=a(()=>{"use strict";Te=Br.join(Kr(),".kynver",".env")});var Me=a(()=>{"use strict"});var We=a(()=>{"use strict";Me()});var Ue=a(()=>{"use strict"});var te=a(()=>{"use strict";We();Ue()});var Le=a(()=>{"use strict"});var Fe=a(()=>{"use strict";Le()});var D=a(()=>{"use strict";re();E();v();te();Fe()});var $e=a(()=>{"use strict";R();R()});var He=a(()=>{"use strict";re();te();D()});var je=a(()=>{"use strict";z();R();$e();v();D();He();d();K()});import{existsSync as $r,mkdirSync as As,readFileSync as Hr,writeFileSync as ws}from"node:fs";import{homedir as jr,totalmem as Is}from"node:os";import ne from"node:path";function x(){if(!$r(Ye))return{};try{return JSON.parse(Hr(Ye,"utf8"))}catch{return{}}}var Ve,Ye,Hs,js,Ys,v=a(()=>{"use strict";z();E();d();R();I();B();J();D();je();K();Ve=ne.join(jr(),".kynver"),Ye=ne.join(Ve,"config.json"),Hs=ne.join(Ve,"credentials");js=500*1024*1024,Ys=4*1024*1024*1024});var fr=/^claude[-_]/i,gr=/^(?:opus|sonnet|haiku)\b/i;function me(e){let r=e.trim();return fr.test(r)||gr.test(r)}function fe(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function j(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function hr(e){return fe(e)?"codex":me(e)?"claude":(j(e),"cursor")}function yr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:null:null}function br(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?me(n)||fe(n)||j(n)?{lane:t,model:n,provider:hr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function h(e){let r=typeof e=="string"?e.trim():"";return r?yr(r)??br(r):null}function Y(e){let r=h(e);return r?!!(r.provider&&r.provider!=="cursor"||r.model&&!j(r.model)):!1}v();var Ge={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"unsupported",workerMcpToolsNote:"Codex (and the Hermes openai-codex path) has no per-spawn MCP config + tool allow-list, so a worker's toolset could not be held to the server's capability grant. Workers run without Kynver tools."},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"unsupported",workerMcpToolsNote:"Cursor configures MCP servers per workspace, not per spawn, so a task-bound token could not be scoped to one worker. Workers run without Kynver tools."},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function _(e){return Ge[e]}function ze(){return Object.values(Ge)}import{existsSync as Vr}from"node:fs";import{homedir as Gr}from"node:os";import C from"node:path";import{createHash as qe}from"node:crypto";import{statSync as Yr}from"node:fs";import{spawnSync as Je}from"node:child_process";function y(e){try{let r=Yr(e),t=`${e}|${r.size}|${r.mtimeMs}`;return qe("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function S(e){return qe("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function p(e,r){for(let t of r){let n=process.env[t]?.trim();if(n)return n}return e}function m(e,r,t={}){let n=t.timeoutMs??8e3;try{let o=Je(e,r,{encoding:"utf8",timeout:n,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(o.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let i=(o.stderr||o.stdout||"").trim(),s=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} probe failed`}}}function T(e,r,t={}){let n=t.timeoutMs??8e3;try{return Je(e,r,{stdio:"ignore",timeout:n,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} auth probe failed`}}}var zr="codex";function qr(){let e=Gr();return[process.env.CODEX_HOME?.trim()?C.join(C.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,C.join(e,".codex","auth.json"),C.join(e,".config","codex","auth.json")].filter(t=>!!t)}function Jr(e){return C.dirname(e)}function Xr(e){let r,t;for(let n of qr()){if(!Vr(n))continue;r??=n;let o=m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:Jr(n)}});if(t??=o,o.ok)return{authPath:n,login:o}}return{authPath:r,login:t??m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function Xe(e=new Date().toISOString()){let r=p(zr,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:S("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:n}=Xr(r),o=!!t&&n.ok;return{providerId:"codex",ready:o,authSource:"oauth_local",sessionFingerprint:t?y(t):void 0,checkedAt:e,note:o?"Local Codex OAuth session bound on runner":[n.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as Zr}from"node:fs";import{homedir as Qr}from"node:os";import oe from"node:path";function et(){let e=process.env.HERMES_HOME?.trim(),r=e?oe.resolve(e):oe.join(Qr(),".hermes");return oe.join(r,"auth.json")}function M(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=et(),o=Zr(n),i=T(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:o?y(n):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,o?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function O(e=new Date().toISOString()){let r=Xe(e);if(r.ready)return{...r,path:"codex_cli"};let t=M(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}var Ze=["low","medium","high"],Qe={oauth_local:0,subscription_hermes:0,runner_token:1,api_key_env:2,none:3};function er(e,r){let t=_(e);return r==="privileged"?t.supportsPrivilegedPlatformActions:r==="low"?t.supportsLowRiskOrchestration:!0}function rt(e,r){let t=_(e.providerId),n=_(r.providerId),o=Ze.indexOf(t.costTier)-Ze.indexOf(n.costTier);if(o!==0)return o;let i=Qe[e.binding.authSource]-Qe[r.binding.authSource];return i!==0?i:e.providerId.localeCompare(r.providerId)}function ie(e){let r=ze().map(l=>({providerId:l.id,binding:e.inventory.bindings[l.id]})).filter(l=>l.binding.ready&&er(l.providerId,e.riskClass));if(r.length===0)return null;let n=[...r].sort(rt)[0],o="codex";if(n.providerId===o)return{providerId:n.providerId,binding:n.binding};let i=e.inventory.bindings[o],s;return er(o,e.riskClass)?i.ready||(s=i.note??`${o} not bound`):s=`${e.riskClass} orchestration requires privileged-capable provider`,{providerId:n.providerId,binding:n.binding,escalatedFrom:o,escalatedReason:s}}import{existsSync as tt}from"node:fs";import{homedir as nt}from"node:os";import ot from"node:path";var it="claude";function st(){let e=nt();return[ot.join(e,".claude",".credentials.json")]}function rr(e=new Date().toISOString()){let r=p(it,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:S("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=st().find(s=>tt(s)),o=T(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(o.ok||!!n);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,o.note,n?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as at}from"node:fs";import{homedir as lt}from"node:os";import se from"node:path";var ct="agent";function ut(){let e=lt(),r=[se.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let t=process.env.LOCALAPPDATA?.trim(),n=process.env.APPDATA?.trim();t&&r.push(se.join(t,"cursor-agent","auth.json")),n&&r.push(se.join(n,"cursor","auth.json"))}return r}function tr(e=new Date().toISOString()){let r=p(ct,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:S("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=m(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=ut().find(i=>at(i)),o=!!n&&t.ok;return{providerId:"cursor",ready:o,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:o?"Local Cursor/Composer OAuth session bound on runner":[t.note,n?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as dt,readFileSync as pt}from"node:fs";import{homedir as mt}from"node:os";import ae from"node:path";var ft=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function gt(){let e=process.env.HERMES_HOME?.trim(),r=e?ae.resolve(e):ae.join(mt(),".hermes");return ae.join(r,".env")}function ht(e){try{let r=pt(e,"utf8"),t=[];for(let n of ft)new RegExp(`^${n}=`,"m").test(r)&&t.push(n);return t}catch{return[]}}function nr(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=gt(),o=dt(n),i=o?ht(n):[],l=i.some(c=>c.endsWith("_API_KEY"))?"api_key_env":o?"oauth_local":"none",u=t.ok&&o;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:o,authSource:l,sessionFingerprint:o?y(n):void 0,checkedAt:e,note:u?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,o?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function or(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=O(r),n={codex:t,cursor:tr(r),claude:rr(r)},o=Object.values(n).filter(i=>i.ready).length;return{generatedAt:r,bindings:n,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:nr(r),hermesOpenAiCodex:M(r),codexAdapterPath:t.path,readyCount:o}}var yt=[/\bprivileged\b/i,/\bproduction\s+db\b/i,/\bdb:push\b/i,/\bmigration\b/i,/\bdeploy\b/i,/\bsecrets?\b/i,/\bstripe\b/i,/\[require-approval\]/i,/\[operator-only\]/i],bt=[/\borchestration\b/i,/\bplan[- ]?progress\b/i,/\bstatus\s+sync\b/i,/\bheartbeat\b/i,/\bboard[- ]?drain\b/i,/\bmaintenance\b/i,/\[orchestration:\s*low-risk\]/i];function le(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Rt(e){let r=le(e,"executorRef").toLowerCase(),t=le(e,"title").toLowerCase(),n=le(e,"description").toLowerCase(),o=`${r}
 ${t}
-${n}`;return yt.some(i=>i.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":bt.some(i=>i.test(o))?"low":"elevated"}function vt(e){let r=_(e.provider),t=e.escalatedFrom&&e.escalatedReason?`Escalated from ${e.escalatedFrom} (${e.escalatedReason}); using ${r.displayName} (${r.costTier} tier)`:`${r.displayName} selected for ${e.riskClass} orchestration (${r.costTier} tier, auth=${e.authSource})`;return{provider:e.provider,model:e.model,authSource:e.authSource,costTier:r.costTier,riskClass:e.riskClass,costRationale:t,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason}}function kt(e){let r=e.inventory??or();return e.codexBinding?{...r,bindings:{...r.bindings,codex:e.codexBinding}}:r}function k(e){let r=vt({provider:e.providerId,model:e.model,authSource:e.binding.authSource,riskClass:e.riskClass,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason});return{provider:e.providerId,model:e.model,rule:r.routingRule,audit:r}}function ir(e){let r=e.task??{},t=Rt(r),n=kt({inventory:e.inventory,codexBinding:e.codexBinding??(e.inventory?null:O())}),o=e.preferLowCost===!1?null:e.explicitProvider?.trim().toLowerCase(),i=e.explicitModel?.trim()||void 0,s=ce;if(o==="codex"||o==="provider:codex"){let c=n.bindings.codex;if(!c.ready){let g=ie({inventory:n,riskClass:t});return k(g?{providerId:g.providerId,binding:g.binding,riskClass:t,routingRule:"orchestration:explicit_codex_unavailable_cost_aware",model:i,escalatedFrom:"codex",escalatedReason:c.note??"codex oauth not bound"}:{providerId:s,binding:n.bindings[s],riskClass:t,routingRule:"orchestration:codex_unavailable_escalate_cursor",model:i,escalatedFrom:"codex",escalatedReason:c.note??"codex oauth not bound"})}return k({providerId:"codex",binding:c,riskClass:t,routingRule:"orchestration:explicit_codex",model:i})}if(o==="cursor"||o==="provider:cursor"){let c=n.bindings.cursor;if(c.ready)return k({providerId:"cursor",binding:c,riskClass:t,routingRule:"orchestration:explicit_cursor",model:i})}if(o==="claude"||o==="provider:claude"){let c=n.bindings.claude;if(c.ready)return k({providerId:"claude",binding:c,riskClass:t,routingRule:"orchestration:explicit_claude",model:i})}let l=ie({inventory:n,riskClass:t});if(l)return k({providerId:l.providerId,binding:l.binding,riskClass:t,routingRule:`orchestration:cost_aware_${l.providerId}`,model:i,escalatedFrom:l.escalatedFrom,escalatedReason:l.escalatedReason});let u=n.bindings.codex;return k({providerId:s,binding:n.bindings[s],riskClass:t,routingRule:u.ready?"orchestration:inventory_empty_default_cursor":"orchestration:codex_unavailable_default_cursor",model:i,...u.ready?{}:{escalatedFrom:"codex",escalatedReason:u.note??"codex oauth not bound"}})}V();d();var xt="kynver",_t=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],St=_t.map(e=>`mcp__${xt}__${e}`);var M="claude-sonnet-4-6",A="claude-opus-4-8";d();d();var el=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function Ct(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var U=Ct();d();var de="openai-compatible",hl=600*1e3;var lr="claude-sonnet-4-6",$="composer-2.5";function f(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Ot(e){if(!e)return;let r=f(e,"workerModelOverride")||f(e,"modelOverride");return r||`${f(e,"title")}
+${n}`;return yt.some(i=>i.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":bt.some(i=>i.test(o))?"low":"elevated"}function vt(e){let r=_(e.provider),t=e.escalatedFrom&&e.escalatedReason?`Escalated from ${e.escalatedFrom} (${e.escalatedReason}); using ${r.displayName} (${r.costTier} tier)`:`${r.displayName} selected for ${e.riskClass} orchestration (${r.costTier} tier, auth=${e.authSource})`;return{provider:e.provider,model:e.model,authSource:e.authSource,costTier:r.costTier,riskClass:e.riskClass,costRationale:t,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason}}function kt(e){let r=e.inventory??or();return e.codexBinding?{...r,bindings:{...r.bindings,codex:e.codexBinding}}:r}function k(e){let r=vt({provider:e.providerId,model:e.model,authSource:e.binding.authSource,riskClass:e.riskClass,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason});return{provider:e.providerId,model:e.model,rule:r.routingRule,audit:r}}function ir(e){let r=e.task??{},t=Rt(r),n=kt({inventory:e.inventory,codexBinding:e.codexBinding??(e.inventory?null:O())}),o=e.preferLowCost===!1?null:e.explicitProvider?.trim().toLowerCase(),i=e.explicitModel?.trim()||void 0,s=ce;if(o==="codex"||o==="provider:codex"){let c=n.bindings.codex;if(!c.ready){let g=ie({inventory:n,riskClass:t});return k(g?{providerId:g.providerId,binding:g.binding,riskClass:t,routingRule:"orchestration:explicit_codex_unavailable_cost_aware",model:i,escalatedFrom:"codex",escalatedReason:c.note??"codex oauth not bound"}:{providerId:s,binding:n.bindings[s],riskClass:t,routingRule:"orchestration:codex_unavailable_escalate_cursor",model:i,escalatedFrom:"codex",escalatedReason:c.note??"codex oauth not bound"})}return k({providerId:"codex",binding:c,riskClass:t,routingRule:"orchestration:explicit_codex",model:i})}if(o==="cursor"||o==="provider:cursor"){let c=n.bindings.cursor;if(c.ready)return k({providerId:"cursor",binding:c,riskClass:t,routingRule:"orchestration:explicit_cursor",model:i})}if(o==="claude"||o==="provider:claude"){let c=n.bindings.claude;if(c.ready)return k({providerId:"claude",binding:c,riskClass:t,routingRule:"orchestration:explicit_claude",model:i})}let l=ie({inventory:n,riskClass:t});if(l)return k({providerId:l.providerId,binding:l.binding,riskClass:t,routingRule:`orchestration:cost_aware_${l.providerId}`,model:i,escalatedFrom:l.escalatedFrom,escalatedReason:l.escalatedReason});let u=n.bindings.codex;return k({providerId:s,binding:n.bindings[s],riskClass:t,routingRule:u.ready?"orchestration:inventory_empty_default_cursor":"orchestration:codex_unavailable_default_cursor",model:i,...u.ready?{}:{escalatedFrom:"codex",escalatedReason:u.note??"codex oauth not bound"}})}V();d();var xt="kynver",_t=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],St=_t.map(e=>`mcp__${xt}__${e}`);var W="claude-sonnet-4-6",A="claude-opus-4-8";d();d();var el=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function Ct(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var U=Ct();d();var de="openai-compatible",hl=600*1e3;var lr="claude-sonnet-4-6",$="composer-2.5";function f(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Ot(e){if(!e)return;let r=f(e,"workerModelOverride")||f(e,"modelOverride");return r||`${f(e,"title")}
 ${f(e,"description")}
-${f(e,"executorRef")}`.match(/\[(?:worker-)?model:\s*([^\]\n]+)\]/i)?.[1]?.trim()||void 0}function sr(e){return e.toLowerCase()}function H(e=x()){let r=e.defaultModel?.trim();if(r)return r;let t=process.env.KYNVER_DEFAULT_MODEL?.trim();return t||lr}function L(e){let r=(e??"").toLowerCase();return!r||r.includes("composer")||r.includes("cursor")||r.includes("codex")||r.startsWith("gpt-")||r.startsWith("gpt5")?"cursor":/^claude[-_]/i.test(r)||/^(?:opus|sonnet|haiku)\b/i.test(r)?"claude":"cursor"}function At(e,r){let t=e.trim().toLowerCase(),n=r?.trim();return t==="cursor"?{model:$,provider:"cursor",rule:n&&n!=="cursor"?"explicit:model_provider_alias_overrode_provider":"explicit:model_provider_alias",requestedModel:e}:t==="claude"||t==="anthropic"?{model:M,provider:"claude",rule:n&&n!=="claude"?"explicit:model_provider_alias_overrode_provider":"explicit:model_provider_alias",requestedModel:e}:null}function ar(e,r){return!!(e.includes("deep")&&e.includes("review")||e.includes("security")||e.includes("plan_author")||e.includes("plan-author")||r.includes("deep review")||r.includes("security review")||e.includes("plan")&&!e.includes("review")&&(e.includes("author")||e.includes("strategy")))}var wt=new Set(["report_reviewer","deep_reviewer","plan_reviewer"]);function cr(e,r,t){return wt.has(e)?A:r.includes("review")||/^review[\s:]/.test(t)||t.includes("critique")?A:M}function ur(e){let r=sr(f(e,"executorRef")),t=f(e,"title").toLowerCase(),n=f(e,"priority")||"normal",o=sr(f(e,"roleLane"));if(r.includes("provider:claude")||r.startsWith("claude:")){let s=cr(o,r,t);return{provider:"claude",model:s,rule:s===A?"factory:claude_review":"factory:claude_implementation"}}if(r.includes("provider:codex")||r.startsWith("codex:"))return{provider:"codex",model:U,rule:"lane:codex_orchestration"};if(r.includes("provider:openai")||r.startsWith("openai-compatible:")){let s=h(f(e,"executorRef"));return{provider:de,...s?.model?{model:s.model}:{},rule:"lane:openai_compatible"}}if(r.includes("cursor")||r.includes("composer")||r.includes("copilot")||o==="implementer"||o==="repair_implementer")return{provider:"cursor",rule:"lane:implementation"};if(r.includes("codex"))return{provider:"codex",model:U,rule:"lane:codex_orchestration"};if(r.includes("landing")||t.startsWith("land:")||t.includes(" merge"))return{provider:"cursor",rule:"lane:landing"};if(r.includes("review")||/^review[\s:]/.test(t)||o.includes("review"))return ar(r,t)||o==="deep_reviewer"?{provider:"cursor",rule:"lane:deep_review"}:{provider:"cursor",rule:"lane:review"};if(ar(r,t)||o==="plan_author")return{provider:"cursor",rule:"lane:planning"};if(n==="critical")return{provider:"cursor",rule:"priority:critical"};if(n==="high")return{provider:"cursor",rule:"priority:high"};if(n==="low")return{provider:"cursor",rule:"priority:low"};let i=H();return{model:i,provider:L(i),rule:"default:global"}}function Pt(e){return e?h(f(e,"executorRef")):null}function It(e){let r,t=Pt(e.task),n=e.explicitModel?.trim()?void 0:t?.model?.trim(),o=!e.explicitProvider?.trim()&&t?.provider?.trim()?t.provider.trim():void 0;if(e.explicitModel?.trim()){let l=e.explicitModel.trim(),u=At(l,e.explicitProvider);u?r=u:r={model:l,provider:e.explicitProvider?.trim()||L(l),rule:"explicit:cli",requestedModel:l}}else if(n)r={model:n,provider:o||L(n),rule:t?.rule??"executor_ref:model",requestedModel:n};else if(e.task&&F(e.task)){let l=Ot(e.task),u,c;if(l)u=l,c="task:provider_override";else{let g=typeof e.task.roleLane=="string"?e.task.roleLane.toLowerCase():"",me=typeof e.task.executorRef=="string"?e.task.executorRef.toLowerCase():"",pr=typeof e.task.title=="string"?e.task.title.toLowerCase():"";u=cr(g,me,pr),c=u===A?"factory:claude_review":"factory:claude_implementation"}r={model:u,provider:"claude",rule:c,requestedModel:u}}else if(e.task&&Object.keys(e.task).length>0){let l=ur(e.task);r={...l,requestedModel:l.model}}else{let l=H();r={model:l,provider:e.explicitProvider?.trim()||L(l),rule:"default:global",requestedModel:l}}let i=dr({routing:r,task:e.task,explicitProvider:e.explicitProvider,explicitProviderIsOperatorOverride:e.explicitProviderIsOperatorOverride});if(!e.task||Object.keys(e.task).length===0||i.rule==="explicit:model_provider_alias"||i.rule==="explicit:model_provider_alias_overrode_provider"||i.rule==="explicit:cli"||b(i.provider)&&(e.explicitProviderIsOperatorOverride||F(e.task))||i.provider===de)return i;let s=ir({task:e.task,explicitProvider:e.explicitProvider??i.provider,explicitModel:i.model,inventory:e.orchestrationInventory??void 0});return{provider:s.provider,model:s.provider==="codex"?s.model??i.model??U:i.model,rule:s.rule,requestedModel:i.requestedModel,orchestrationAudit:s.audit}}function Nt(e,r,t){return e||r||t||H()||M}var ce="cursor";var Kt=new Set(["claude","opus","anthropic"]),Bt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function w(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function b(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Kt.has(r)?!0:r.includes("claude")||r.includes("opus")}function F(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&b(r))return!0;let t=w(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=h(w(e,"executorRef"));if(n?.provider&&b(n.provider)||n?.model&&b(Dt(n.model)))return!0;let o=w(e,"description");if(Bt.some(s=>s.test(o)))return!0;let i=w(e,"title");return!!/\[use-claude-worker\]/i.test(i)}function Dt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Tt(e,r){return{provider:ce,model:$,rule:`policy:cursor_default${r}`,requestedModel:e}}var Wt=["explicit:","executor_ref:","factory:","task:"];function Mt(e){return Wt.some(r=>e.startsWith(r))}function Ut(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||h(w(e,"executorRef"))?.provider?!0:F(e)}function dr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&b(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Mt(r.rule)||Ut(t)||!b(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Tt(r.model,o)}function Lt(e){let r=e?.executorRef;return typeof r=="string"?r.trim():""}function mr(e){return e?.trim()||void 0}function Ft(e){let r=Lt(e.task),t=h(r),n=e.explicitProvider?.trim().toLowerCase(),o=mr(e.explicitModel??void 0),i=n||t?.provider,s=o||t?.model,l=n||o?"cli":t?.rule??"none";if(!i&&!s)return{ok:!0};!i&&s&&(/^claude[-_]/i.test(s)||/^(?:opus|sonnet|haiku)\b/i.test(s))&&(i="claude");let u=e.routing.provider,c=mr(e.routing.model),g={provider:u,model:c,rule:e.routing.rule};return i&&i!=="cursor"||r&&Y(r)||n&&n!=="cursor"?u==="cursor"?{ok:!1,error:`model_routing_mismatch: requested ${i??"non-cursor"}${s?` model=${s}`:""} (${l}) but routing resolved to cursor (${e.routing.rule})`,requested:{provider:i,model:s,source:l},resolved:g}:s&&c&&s!==c&&!b(u)?{ok:!1,error:`model_routing_mismatch: requested model=${s} (${l}) but routing resolved model=${c} (${e.routing.rule})`,requested:{provider:i,model:s,source:l},resolved:g}:{ok:!0,requested:{provider:i,model:s,source:l},resolved:g}:{ok:!0,resolved:g}}export{$ as CURSOR_DEFAULT_MODEL,lr as GLOBAL_DEFAULT_MODEL,Ft as assessDispatchModelGuard,Y as executorRefRequestsNonCursorWorker,ur as inferModelRoutingFromTask,h as parseExecutorRefRoutingIntent,H as resolveGlobalDefaultModel,Nt as resolveModelFallback,It as resolveWorkerLaunch};
+${f(e,"executorRef")}`.match(/\[(?:worker-)?model:\s*([^\]\n]+)\]/i)?.[1]?.trim()||void 0}function sr(e){return e.toLowerCase()}function H(e=x()){let r=e.defaultModel?.trim();if(r)return r;let t=process.env.KYNVER_DEFAULT_MODEL?.trim();return t||lr}function L(e){let r=(e??"").toLowerCase();return!r||r.includes("composer")||r.includes("cursor")||r.includes("codex")||r.startsWith("gpt-")||r.startsWith("gpt5")?"cursor":/^claude[-_]/i.test(r)||/^(?:opus|sonnet|haiku)\b/i.test(r)?"claude":"cursor"}function At(e,r){let t=e.trim().toLowerCase(),n=r?.trim();return t==="cursor"?{model:$,provider:"cursor",rule:n&&n!=="cursor"?"explicit:model_provider_alias_overrode_provider":"explicit:model_provider_alias",requestedModel:e}:t==="claude"||t==="anthropic"?{model:W,provider:"claude",rule:n&&n!=="claude"?"explicit:model_provider_alias_overrode_provider":"explicit:model_provider_alias",requestedModel:e}:null}function ar(e,r){return!!(e.includes("deep")&&e.includes("review")||e.includes("security")||e.includes("plan_author")||e.includes("plan-author")||r.includes("deep review")||r.includes("security review")||e.includes("plan")&&!e.includes("review")&&(e.includes("author")||e.includes("strategy")))}var wt=new Set(["report_reviewer","deep_reviewer","plan_reviewer"]);function cr(e,r,t){return wt.has(e)?A:r.includes("review")||/^review[\s:]/.test(t)||t.includes("critique")?A:W}function ur(e){let r=sr(f(e,"executorRef")),t=f(e,"title").toLowerCase(),n=f(e,"priority")||"normal",o=sr(f(e,"roleLane"));if(r.includes("provider:claude")||r.startsWith("claude:")){let s=cr(o,r,t);return{provider:"claude",model:s,rule:s===A?"factory:claude_review":"factory:claude_implementation"}}if(r.includes("provider:codex")||r.startsWith("codex:"))return{provider:"codex",model:U,rule:"lane:codex_orchestration"};if(r.includes("provider:openai")||r.startsWith("openai-compatible:")){let s=h(f(e,"executorRef"));return{provider:de,...s?.model?{model:s.model}:{},rule:"lane:openai_compatible"}}if(r.includes("cursor")||r.includes("composer")||r.includes("copilot")||o==="implementer"||o==="repair_implementer")return{provider:"cursor",rule:"lane:implementation"};if(r.includes("codex"))return{provider:"codex",model:U,rule:"lane:codex_orchestration"};if(r.includes("landing")||t.startsWith("land:")||t.includes(" merge"))return{provider:"cursor",rule:"lane:landing"};if(r.includes("review")||/^review[\s:]/.test(t)||o.includes("review"))return ar(r,t)||o==="deep_reviewer"?{provider:"cursor",rule:"lane:deep_review"}:{provider:"cursor",rule:"lane:review"};if(ar(r,t)||o==="plan_author")return{provider:"cursor",rule:"lane:planning"};if(n==="critical")return{provider:"cursor",rule:"priority:critical"};if(n==="high")return{provider:"cursor",rule:"priority:high"};if(n==="low")return{provider:"cursor",rule:"priority:low"};let i=H();return{model:i,provider:L(i),rule:"default:global"}}function Pt(e){return e?h(f(e,"executorRef")):null}function It(e){let r,t=Pt(e.task),n=e.explicitModel?.trim()?void 0:t?.model?.trim(),o=!e.explicitProvider?.trim()&&t?.provider?.trim()?t.provider.trim():void 0;if(e.explicitModel?.trim()){let l=e.explicitModel.trim(),u=At(l,e.explicitProvider);u?r=u:r={model:l,provider:e.explicitProvider?.trim()||L(l),rule:"explicit:cli",requestedModel:l}}else if(n)r={model:n,provider:o||L(n),rule:t?.rule??"executor_ref:model",requestedModel:n};else if(e.task&&F(e.task)){let l=Ot(e.task),u,c;if(l)u=l,c="task:provider_override";else{let g=typeof e.task.roleLane=="string"?e.task.roleLane.toLowerCase():"",pe=typeof e.task.executorRef=="string"?e.task.executorRef.toLowerCase():"",mr=typeof e.task.title=="string"?e.task.title.toLowerCase():"";u=cr(g,pe,mr),c=u===A?"factory:claude_review":"factory:claude_implementation"}r={model:u,provider:"claude",rule:c,requestedModel:u}}else if(e.task&&Object.keys(e.task).length>0){let l=ur(e.task);r={...l,requestedModel:l.model}}else{let l=H();r={model:l,provider:e.explicitProvider?.trim()||L(l),rule:"default:global",requestedModel:l}}let i=dr({routing:r,task:e.task,explicitProvider:e.explicitProvider,explicitProviderIsOperatorOverride:e.explicitProviderIsOperatorOverride});if(!e.task||Object.keys(e.task).length===0||i.rule==="explicit:model_provider_alias"||i.rule==="explicit:model_provider_alias_overrode_provider"||i.rule==="explicit:cli"||b(i.provider)&&(e.explicitProviderIsOperatorOverride||F(e.task))||i.provider===de)return i;let s=ir({task:e.task,explicitProvider:e.explicitProvider??i.provider,explicitModel:i.model,inventory:e.orchestrationInventory??void 0});return{provider:s.provider,model:s.provider==="codex"?s.model??i.model??U:i.model,rule:s.rule,requestedModel:i.requestedModel,orchestrationAudit:s.audit}}function Nt(e,r,t){return e||r||t||H()||W}var ce="cursor";var Kt=new Set(["claude","opus","anthropic"]),Bt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function w(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function b(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Kt.has(r)?!0:r.includes("claude")||r.includes("opus")}function F(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&b(r))return!0;let t=w(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=h(w(e,"executorRef"));if(n?.provider&&b(n.provider)||n?.model&&b(Dt(n.model)))return!0;let o=w(e,"description");if(Bt.some(s=>s.test(o)))return!0;let i=w(e,"title");return!!/\[use-claude-worker\]/i.test(i)}function Dt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Tt(e,r){return{provider:ce,model:$,rule:`policy:cursor_default${r}`,requestedModel:e}}var Mt=["explicit:","executor_ref:","factory:","task:"];function Wt(e){return Mt.some(r=>e.startsWith(r))}function Ut(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||h(w(e,"executorRef"))?.provider?!0:F(e)}function dr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&b(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Wt(r.rule)||Ut(t)||!b(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Tt(r.model,o)}function Lt(e){let r=e?.executorRef;return typeof r=="string"?r.trim():""}function pr(e){return e?.trim()||void 0}function Ft(e){let r=Lt(e.task),t=h(r),n=e.explicitProvider?.trim().toLowerCase(),o=pr(e.explicitModel??void 0),i=n||t?.provider,s=o||t?.model,l=n||o?"cli":t?.rule??"none";if(!i&&!s)return{ok:!0};!i&&s&&(/^claude[-_]/i.test(s)||/^(?:opus|sonnet|haiku)\b/i.test(s))&&(i="claude");let u=e.routing.provider,c=pr(e.routing.model),g={provider:u,model:c,rule:e.routing.rule};return i&&i!=="cursor"||r&&Y(r)||n&&n!=="cursor"?u==="cursor"?{ok:!1,error:`model_routing_mismatch: requested ${i??"non-cursor"}${s?` model=${s}`:""} (${l}) but routing resolved to cursor (${e.routing.rule})`,requested:{provider:i,model:s,source:l},resolved:g}:s&&c&&s!==c&&!b(u)?{ok:!1,error:`model_routing_mismatch: requested model=${s} (${l}) but routing resolved model=${c} (${e.routing.rule})`,requested:{provider:i,model:s,source:l},resolved:g}:{ok:!0,requested:{provider:i,model:s,source:l},resolved:g}:{ok:!0,resolved:g}}export{$ as CURSOR_DEFAULT_MODEL,lr as GLOBAL_DEFAULT_MODEL,Ft as assessDispatchModelGuard,Y as executorRefRequestsNonCursorWorker,ur as inferModelRoutingFromTask,h as parseExecutorRefRoutingIntent,H as resolveGlobalDefaultModel,Nt as resolveModelFallback,It as resolveWorkerLaunch};

package/dist/server/orchestration.js CHANGED Viewed

	@@ -1 +1 @@
1	- import{existsSync as K}from"node:fs";import{homedir as H}from"node:os";import j from"node:path";import{createHash as _}from"node:crypto";import{statSync as R}from"node:fs";import{spawnSync as x}from"node:child_process";function c(e){try{let t=R(e),r=`${e}\|${t.size}\|${t.mtimeMs}`;return _("sha256").update(r).digest("hex").slice(0,16)}catch{return}}function u(e){return _("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,t){for(let r of t){let o=process.env[r]?.trim();if(o)return o}return e}function a(e,t,r={}){let o=r.timeoutMs??8e3;try{let n=x(e,t,{encoding:"utf8",timeout:o,env:{...process.env,...r.env,CI:"1",NO_COLOR:"1"}});if(n.status===0)return{ok:!0,note:r.okNote??`${e} ${t.join(" ")}: ok`};let i=(n.stderr\|\|n.stdout\|\|"").trim(),s=r.failPrefix??`${e} ${t.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function h(e,t,r={}){let o=r.timeoutMs??8e3;try{return x(e,t,{stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:r.okNote??`${e} authenticated`}:{ok:!1,note:r.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var T="claude";function L(){let e=H();return[j.join(e,".claude",".credentials.json")]}function P(e=new Date().toISOString()){let t=d(T,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:u("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let r=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=L().find(s=>K(s)),n=h(t,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=r.ok&&(n.ok\|\|!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?c(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[r.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as D}from"node:fs";import{homedir as Y}from"node:os";import p from"node:path";var M="codex";function $(){let e=Y();return[process.env.CODEX_HOME?.trim()?p.join(p.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,p.join(e,".codex","auth.json"),p.join(e,".config","codex","auth.json")].filter(r=>!!r)}function F(e){return p.dirname(e)}function w(e){let t,r;for(let o of $()){if(!D(o))continue;t??=o;let n=a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:F(o)}});if(r??=n,n.ok)return{authPath:o,login:n}}return{authPath:t,login:r??a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function I(e=new Date().toISOString()){let t=d(M,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:u("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:r,login:o}=w(t),n=!!r&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:r?c(r):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,r?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as U}from"node:fs";import{homedir as V}from"node:os";import O from"node:path";function X(){let e=process.env.HERMES_HOME?.trim(),t=e?O.resolve(e):O.join(V(),".hermes");return O.join(t,"auth.json")}function f(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),r=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=X(),n=U(o),i=h(t,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=r.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?c(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[r.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function S(e=new Date().toISOString()){let t=I(e);if(t.ready)return{...t,path:"codex_cli"};let r=f(e);return r.ready?{providerId:"codex",ready:!0,authSource:r.authSource,sessionFingerprint:r.sessionFingerprint,checkedAt:r.checkedAt,note:r.note,path:"hermes_openai_codex",hermesOpenAiCodex:r}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:r,note:[t.note,r.note].filter(Boolean).join("; ")\|\|"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as W}from"node:fs";import{homedir as G}from"node:os";import g from"node:path";var J="agent";function z(){let e=G(),t=[g.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let r=process.env.LOCALAPPDATA?.trim(),o=process.env.APPDATA?.trim();r&&t.push(g.join(r,"cursor-agent","auth.json")),o&&t.push(g.join(o,"cursor","auth.json"))}return t}function E(e=new Date().toISOString()){let t=d(J,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:u("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let r=a(t,["-v"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=z().find(i=>W(i)),n=!!o&&r.ok;return{providerId:"cursor",ready:n,authSource:"oauth_local",sessionFingerprint:o?c(o):void 0,checkedAt:e,note:n?"Local Cursor/Composer OAuth session bound on runner":[r.note,o?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as q,readFileSync as Q}from"node:fs";import{homedir as Z}from"node:os";import C from"node:path";var ee=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function te(){let e=process.env.HERMES_HOME?.trim(),t=e?C.resolve(e):C.join(Z(),".hermes");return C.join(t,".env")}function re(e){try{let t=Q(e,"utf8"),r=[];for(let o of ee)new RegExp(`^${o}=`,"m").test(t)&&r.push(o);return r}catch{return[]}}function b(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),r=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=te(),n=q(o),i=n?re(o):[],v=i.some(B=>B.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",N=r.ok&&n;return{adapterId:"hermes",cliAvailable:r.ok,profileBound:n,authSource:v,sessionFingerprint:n?c(o):void 0,checkedAt:e,note:N?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[r.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function oe(e={}){let t=e.nowIso?.()??new Date().toISOString(),r=S(t),o={codex:r,cursor:E(t),claude:P(t)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:t,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:b(t),hermesOpenAiCodex:f(t),codexAdapterPath:r.path,readyCount:n}}var ne={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0}};function ie(){return Object.values(ne)}var k=["off","observe","enforce"];function se(e){let t=(e??"off").trim().toLowerCase();return k.includes(t)?t:"off"}function m(e=process.env){return se(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function y(e=process.env){let t=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return t?t==="1"\|\|t==="true"\|\|t==="yes"\|\|t==="on":m(e)==="enforce"}import{createHash as ae}from"node:crypto";function l(e){if(e==null)return null;let t=e.trim();return t.length?t:null}function A(e){let t=l(e.sessionId)??"anonymous",r=l(e.title)??l(e.action)??"foreground",o=ae("sha256").update([l(e.planId)??"",l(e.parentTaskId)??"",r.toLowerCase()].join("\|")).digest("hex").slice(0,16);return`hermes-foreground:${t}:${o}`}function ce(e,t){return e==="enforce"&&t?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function de(e,t=process.env){let r=m(t),o=y(t),n=ce(r,o),i=n==="enforce_harness_task"?A({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return r==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:r,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{A as buildForegroundHarnessIdempotencyKey,oe as buildOrchestrationProviderInventory,de as evaluateOrchestrationPolicy,y as isOrchestrationEnforceTasksEnabled,ie as listOrchestrationProviderCapabilities,m as resolveOrchestrationPolicyMode};
1	+ import{existsSync as K}from"node:fs";import{homedir as H}from"node:os";import T from"node:path";import{createHash as _}from"node:crypto";import{statSync as R}from"node:fs";import{spawnSync as x}from"node:child_process";function c(e){try{let t=R(e),o=`${e}\|${t.size}\|${t.mtimeMs}`;return _("sha256").update(o).digest("hex").slice(0,16)}catch{return}}function u(e){return _("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,t){for(let o of t){let r=process.env[o]?.trim();if(r)return r}return e}function a(e,t,o={}){let r=o.timeoutMs??8e3;try{let n=x(e,t,{encoding:"utf8",timeout:r,env:{...process.env,...o.env,CI:"1",NO_COLOR:"1"}});if(n.status===0)return{ok:!0,note:o.okNote??`${e} ${t.join(" ")}: ok`};let i=(n.stderr\|\|n.stdout\|\|"").trim(),s=o.failPrefix??`${e} ${t.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function h(e,t,o={}){let r=o.timeoutMs??8e3;try{return x(e,t,{stdio:"ignore",timeout:r,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:o.okNote??`${e} authenticated`}:{ok:!1,note:o.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var j="claude";function L(){let e=H();return[T.join(e,".claude",".credentials.json")]}function P(e=new Date().toISOString()){let t=d(j,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:u("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let o=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),r=L().find(s=>K(s)),n=h(t,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=o.ok&&(n.ok\|\|!!r);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:r?c(r):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[o.note,n.note,r?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as M}from"node:fs";import{homedir as D}from"node:os";import p from"node:path";var w="codex";function Y(){let e=D();return[process.env.CODEX_HOME?.trim()?p.join(p.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,p.join(e,".codex","auth.json"),p.join(e,".config","codex","auth.json")].filter(o=>!!o)}function $(e){return p.dirname(e)}function F(e){let t,o;for(let r of Y()){if(!M(r))continue;t??=r;let n=a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:$(r)}});if(o??=n,n.ok)return{authPath:r,login:n}}return{authPath:t,login:o??a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function I(e=new Date().toISOString()){let t=d(w,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:u("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:o,login:r}=F(t),n=!!o&&r.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:o?c(o):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[r.note,o?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as U}from"node:fs";import{homedir as V}from"node:os";import O from"node:path";function X(){let e=process.env.HERMES_HOME?.trim(),t=e?O.resolve(e):O.join(V(),".hermes");return O.join(t,"auth.json")}function f(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),o=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),r=X(),n=U(r),i=h(t,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=o.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?c(r):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[o.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function S(e=new Date().toISOString()){let t=I(e);if(t.ready)return{...t,path:"codex_cli"};let o=f(e);return o.ready?{providerId:"codex",ready:!0,authSource:o.authSource,sessionFingerprint:o.sessionFingerprint,checkedAt:o.checkedAt,note:o.note,path:"hermes_openai_codex",hermesOpenAiCodex:o}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:o,note:[t.note,o.note].filter(Boolean).join("; ")\|\|"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as W}from"node:fs";import{homedir as G}from"node:os";import g from"node:path";var J="agent";function z(){let e=G(),t=[g.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let o=process.env.LOCALAPPDATA?.trim(),r=process.env.APPDATA?.trim();o&&t.push(g.join(o,"cursor-agent","auth.json")),r&&t.push(g.join(r,"cursor","auth.json"))}return t}function E(e=new Date().toISOString()){let t=d(J,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:u("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let o=a(t,["-v"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),r=z().find(i=>W(i)),n=!!r&&o.ok;return{providerId:"cursor",ready:n,authSource:"oauth_local",sessionFingerprint:r?c(r):void 0,checkedAt:e,note:n?"Local Cursor/Composer OAuth session bound on runner":[o.note,r?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as q,readFileSync as Q}from"node:fs";import{homedir as Z}from"node:os";import C from"node:path";var ee=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function te(){let e=process.env.HERMES_HOME?.trim(),t=e?C.resolve(e):C.join(Z(),".hermes");return C.join(t,".env")}function oe(e){try{let t=Q(e,"utf8"),o=[];for(let r of ee)new RegExp(`^${r}=`,"m").test(t)&&o.push(r);return o}catch{return[]}}function b(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),o=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),r=te(),n=q(r),i=n?oe(r):[],A=i.some(B=>B.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",N=o.ok&&n;return{adapterId:"hermes",cliAvailable:o.ok,profileBound:n,authSource:A,sessionFingerprint:n?c(r):void 0,checkedAt:e,note:N?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[o.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function re(e={}){let t=e.nowIso?.()??new Date().toISOString(),o=S(t),r={codex:o,cursor:E(t),claude:P(t)},n=Object.values(r).filter(i=>i.ready).length;return{generatedAt:t,bindings:r,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:b(t),hermesOpenAiCodex:f(t),codexAdapterPath:o.path,readyCount:n}}var ne={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"unsupported",workerMcpToolsNote:"Codex (and the Hermes openai-codex path) has no per-spawn MCP config + tool allow-list, so a worker's toolset could not be held to the server's capability grant. Workers run without Kynver tools."},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"unsupported",workerMcpToolsNote:"Cursor configures MCP servers per workspace, not per spawn, so a task-bound token could not be scoped to one worker. Workers run without Kynver tools."},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function ie(){return Object.values(ne)}var k=["off","observe","enforce"];function se(e){let t=(e??"off").trim().toLowerCase();return k.includes(t)?t:"off"}function m(e=process.env){return se(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function y(e=process.env){let t=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return t?t==="1"\|\|t==="true"\|\|t==="yes"\|\|t==="on":m(e)==="enforce"}import{createHash as ae}from"node:crypto";function l(e){if(e==null)return null;let t=e.trim();return t.length?t:null}function v(e){let t=l(e.sessionId)??"anonymous",o=l(e.title)??l(e.action)??"foreground",r=ae("sha256").update([l(e.planId)??"",l(e.parentTaskId)??"",o.toLowerCase()].join("\|")).digest("hex").slice(0,16);return`hermes-foreground:${t}:${r}`}function ce(e,t){return e==="enforce"&&t?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function de(e,t=process.env){let o=m(t),r=y(t),n=ce(o,r),i=n==="enforce_harness_task"?v({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return o==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:o,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{v as buildForegroundHarnessIdempotencyKey,re as buildOrchestrationProviderInventory,de as evaluateOrchestrationPolicy,y as isOrchestrationEnforceTasksEnabled,ie as listOrchestrationProviderCapabilities,m as resolveOrchestrationPolicyMode};

package/dist/server/worker-policy.js CHANGED Viewed

@@ -1,2 +1,2 @@
-var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function $(e){let r=e[vr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function y(e,r={}){return pr.has(e)?!0:hr.has(e)||r.operatorAllow?.has(e)||yr.some(t=>e.endsWith(t))?!1:fr.some(t=>e.endsWith(t))}function de(e){let r=$(e);return Object.keys(e).filter(t=>y(t,{operatorAllow:r})).sort()}function me(e){let r=$(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!y(t,{operatorAllow:r})&&y(t)).sort()}function E(e){let r=$(e),t={...e};for(let n of Object.keys(t))y(n,{operatorAllow:r})&&delete t[n];return t}function br(e){let r=de(e),t=me(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var mr,pr,fr,gr,hr,yr,vr,C=o(()=>{"use strict";mr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],pr=new Set(mr),fr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],gr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],hr=new Set(gr),yr=["_PUBLIC_KEY"],vr="KYNVER_WORKER_ENV_ALLOW"});function Y(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict"});var G=o(()=>{"use strict";a();C()});var v=o(()=>{"use strict"});var z=o(()=>{"use strict";G();v()});var d=o(()=>{"use strict"});var P=o(()=>{"use strict"});var ve=o(()=>{"use strict"});var un,dn,q=o(()=>{"use strict";un=25*1024*1024*1024,dn=12*1024*1024*1024});var hn,yn,be=o(()=>{"use strict";q();hn=5*1024*1024*1024,yn=10*1024*1024*1024});var _n,Sn,J=o(()=>{"use strict";be();q();_n=30*1024*1024*1024,Sn=15*1024*1024*1024});var xe=o(()=>{"use strict";a()});import Kr from"node:path";var Dn,X=o(()=>{"use strict";v();xe();Dn=Kr.join(".openclaw","harness")});var N=o(()=>{"use strict";m();d();P();D();X()});var Se=o(()=>{"use strict";m();X();N();a()});var Z=o(()=>{"use strict";Se();a()});var Ee=o(()=>{"use strict";Z();a()});var Ce=o(()=>{"use strict"});var Oe=o(()=>{"use strict";Ce();a()});var Ae=o(()=>{"use strict"});var we=o(()=>{"use strict";Ae()});var Pe=o(()=>{"use strict";we();a()});var Ie=o(()=>{"use strict"});var Ne=o(()=>{"use strict"});var De=o(()=>{"use strict"});var ee=o(()=>{"use strict"});var Te=o(()=>{"use strict"});var Ke=o(()=>{"use strict";ee();Te()});var We=o(()=>{"use strict";Oe();Pe();Ie();Ne();G();De();Ke();ee();a()});var Be=o(()=>{"use strict";We()});var $r,jr,Me=o(()=>{"use strict";ve();m();d();P();D();J();Z();Ee();Be();a();$r=500*1024*1024,jr=4*1024*1024*1024});var D=o(()=>{"use strict";Me()});import{homedir as Vr}from"node:os";import Yr from"node:path";var Ue,re=o(()=>{"use strict";Ue=Yr.join(Vr(),".kynver",".env")});var Le=o(()=>{"use strict"});var Fe=o(()=>{"use strict";Le()});var He=o(()=>{"use strict"});var te=o(()=>{"use strict";Fe();He()});var $e=o(()=>{"use strict"});var je=o(()=>{"use strict";$e()});var K=o(()=>{"use strict";re();v();m();te();je()});var Ve=o(()=>{"use strict";d();d()});var Ye=o(()=>{"use strict";re();te();K()});var Ge=o(()=>{"use strict";z();d();Ve();m();K();Ye();a();N()});import{homedir as et,totalmem as ws}from"node:os";import ne from"node:path";var ze,Fs,Hs,$s,js,m=o(()=>{"use strict";z();v();a();d();P();D();J();K();Ge();N();ze=ne.join(et(),".kynver"),Fs=ne.join(ze,"config.json"),Hs=ne.join(ze,"credentials"),$s=500*1024*1024,js=4*1024*1024*1024});C();C();var j="KYNVER_NO_PROD_DB_CREDENTIALS",Rr=["KYNVER_ENV_FILE"],xr=new Set(["1","true","yes","on"]);function fe(e){let r=e[j]?.trim().toLowerCase();return r!==void 0&&xr.has(r)}function f(e,r={}){let t=E(e);if(!r.reviewWorker)return t;let n={...t,[j]:"1"};for(let i of Rr)delete n[i];return n}var pe=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function kr(e,r={}){let t=f(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||pe.includes(c)),i=pe.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=fe(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var _r="expert-lane-pr-review:",Sr="plan-review-task",Er="scheduledjob:",O=new Set(["lorentz","dalton","rhea","sentinel"]);function Cr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function V(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|risk register|signoff|verification|evidence|prove|gate)\b/.test(e)}function Or(e,r){return e.startsWith("factory:")?e.includes("lb")||V(r):!1}function Ar(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
-${n}`,s=Cr(e.personaSlug);return!!(r.startsWith(_r)||r===Sr||r.startsWith("daemon-review:")||s&&O.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Or(r,i)||V(i))||r.startsWith(Er)&&e.parentTaskId&&s&&O.has(s)||e.planId&&!e.parentTaskId&&s&&O.has(s)&&V(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&O.has(s))}var wr=/^claude[-_]/i,Pr=/^(?:opus|sonnet|haiku)\b/i;function ge(e){let r=e.trim();return wr.test(r)||Pr.test(r)}function he(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function ye(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Ir(e){return he(e)?"codex":ge(e)?"claude":(ye(e),"cursor")}function Nr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:null:null}function Dr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?ge(n)||he(n)||ye(n)?{lane:t,model:n,provider:Ir(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function A(e){let r=typeof e=="string"?e.trim():"";return r?Nr(r)??Dr(r):null}m();a();var ot="kynver",it=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],st=it.map(e=>`mcp__${ot}__${e}`);a();a();var La=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function lt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var ct=lt();a();var tl=600*1e3;var Xe="composer-2.5";var p="cursor",ut={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible"};function Ze(e){let r=e.trim().toLowerCase();return ut[r]??r}var dt=new Set(["claude","opus","anthropic"]),mt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function R(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return dt.has(r)?!0:r.includes("claude")||r.includes("opus")}function oe(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=R(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=A(R(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(pt(n.model)))return!0;let i=R(e,"description");if(mt.some(l=>l.test(i)))return!0;let s=R(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function pt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function ft(e,r){return{provider:p,model:Xe,rule:`policy:cursor_default${r}`,requestedModel:e}}var gt=["explicit:","executor_ref:","factory:","task:"];function ht(e){return gt.some(r=>e.startsWith(r))}function er(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||A(R(e,"executorRef"))?.provider?!0:oe(e)}function Qe(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||ht(r.rule)||er(t)||!u(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return ft(r.model,i)}function yt(e,r=p){let t=e?.trim();return t?Ze(t):r}function vt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(p)?[...new Set(r.map(t=>u(t)?p:t))]:r.every(t=>u(t))?[p]:r}var bt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,Rt=/\b(npm run build\b|next build\b)\b/i,xt=/\b(vercel (build|deploy|--prod))\b/i,kt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function ie(e){let r=e.trim();return r?kt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:xt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:Rt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:bt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var M="heavy_verification_token_required";import{spawnSync as Lt}from"node:child_process";a();import{closeSync as At,existsSync as k,mkdirSync as wt,openSync as Pt,readdirSync as or,readFileSync as It,statSync as Nt,unlinkSync as ir,writeFileSync as Dt}from"node:fs";import le from"node:path";import{mkdirSync as St}from"node:fs";import{tmpdir as Et}from"node:os";import U from"node:path";import{homedir as _t}from"node:os";import rr from"node:path";function tr(){let e=process.env.KYNVER_STATE_ROOT;return e?rr.resolve(e):rr.join(_t(),".kynver","state")}function Ct(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function Ot(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?U.resolve(e):Ct()?U.join(Et(),"kynver","state","heavy-verification"):U.join(tr(),"heavy-verification")}function se(){return U.join(Ot(),"slots")}function x(){let e=se();return St(e,{recursive:!0}),e}var _=120*6e4,nr=1;function Tt(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function F(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function L(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?Tt(e,nr):nr}function Kt(e){return`slot-${e}`}function Wt(e,r=se()){return le.join(r,`${e}.json`)}function ce(e){if(!k(e))return null;try{let r=JSON.parse(It(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function sr(e,r=_){if(!e||!Y(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function ar(e,r){let t=ce(e);if(t)return sr(t,r);if(!k(e))return!0;try{return Date.now()-Nt(e).mtimeMs>r}catch{return!0}}function Bt(e,r){if(ar(e,r))try{ir(e)}catch{}}function Mt(e){return wt(e,{recursive:!0}),e}function ue(e={}){let r=Mt(e.slotsDir??x()),t=e.staleMs??_,n=0;for(let i of or(r)){if(!i.endsWith(".json"))continue;let s=le.join(r,i),l=k(s);Bt(s,t),l&&!k(s)&&(n+=1)}return n}function Ut(e={}){let r=e.slotsDir??x(),t=e.staleMs??_;ue({slotsDir:r,staleMs:t});let n=[];for(let i of or(r)){if(!i.endsWith(".json"))continue;let s=ce(le.join(r,i));s&&!sr(s,t)&&n.push(s)}return n}function ae(e={}){return Ut(e).length}function S(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();ue({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=Kt(l),g=Wt(c,t),cr=ce(g);if(ar(g,n))try{ir(g)}catch{}else if(cr||k(g))continue;let ur={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let h=Pt(g,"wx");Dt(h,JSON.stringify(ur,null,2),"utf8"),At(h);let dr=ae({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:dr,maxSlots:i,reason:null}}catch(h){if(h.code==="EEXIST")continue;throw h}}let s=ae({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function H(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();ue({slotsDir:t,staleMs:n});let s=ae({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Ft(e){e<=0||Lt(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function lr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=S(e,n);for(;!s.admitted&&Date.now()<i;)Ft(Math.min(t,i-Date.now())),s=S(e,n);return s}function Ht(e,r={}){let t=ie(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...H(e),slotId:null}};if(F())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...H(e),slotId:null}};let n=r.waitMs??0,i=n>0?lr(e,n,r.pollMs):S(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:M,commandClass:t.commandClass,reason:t.reason??i.reason??M,verificationGate:i}}export{p as DEFAULT_WORKER_PROVIDER,M as HEAVY_VERIFICATION_TOKEN_REQUIRED,j as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,kr as auditReviewWorkerCredentialScope,br as auditWorkerEnv,f as buildWorkerSpawnEnv,ie as classifyHeavyShellCommand,Qe as enforceCursorWorkerProvider,Ht as gateWorkerShellCommand,u as isClaudeFamilyProvider,y as isForbiddenWorkerEnvKey,Ar as isHarnessExpertReviewWorker,fe as isNoProdCredentialReviewEnvironment,de as listForbiddenWorkerEnvKeys,me as listOperatorAllowedWorkerEnvKeys,Ze as normalizeWorkerProviderName,vt as preferCursorExecutor,yt as resolveConfiguredWorkerProvider,E as scrubWorkerEnv,oe as taskAllowsClaudeWorker,er as taskExpressesWorkerProviderPreference};
+var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function $(e){let r=e[vr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function y(e,r={}){return mr.has(e)?!0:hr.has(e)||r.operatorAllow?.has(e)||yr.some(t=>e.endsWith(t))?!1:fr.some(t=>e.endsWith(t))}function de(e){let r=$(e);return Object.keys(e).filter(t=>y(t,{operatorAllow:r})).sort()}function pe(e){let r=$(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!y(t,{operatorAllow:r})&&y(t)).sort()}function E(e){let r=$(e),t={...e};for(let n of Object.keys(t))y(n,{operatorAllow:r})&&delete t[n];return t}function br(e){let r=de(e),t=pe(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var pr,mr,fr,gr,hr,yr,vr,C=o(()=>{"use strict";pr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],mr=new Set(pr),fr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],gr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],hr=new Set(gr),yr=["_PUBLIC_KEY"],vr="KYNVER_WORKER_ENV_ALLOW"});function Y(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict"});var G=o(()=>{"use strict";a();C()});var v=o(()=>{"use strict"});var z=o(()=>{"use strict";G();v()});var d=o(()=>{"use strict"});var P=o(()=>{"use strict"});var ve=o(()=>{"use strict"});var un,dn,q=o(()=>{"use strict";un=25*1024*1024*1024,dn=12*1024*1024*1024});var hn,yn,be=o(()=>{"use strict";q();hn=5*1024*1024*1024,yn=10*1024*1024*1024});var _n,Sn,J=o(()=>{"use strict";be();q();_n=30*1024*1024*1024,Sn=15*1024*1024*1024});var xe=o(()=>{"use strict";a()});import Kr from"node:path";var Tn,X=o(()=>{"use strict";v();xe();Tn=Kr.join(".openclaw","harness")});var N=o(()=>{"use strict";p();d();P();T();X()});var Se=o(()=>{"use strict";p();X();N();a()});var Z=o(()=>{"use strict";Se();a()});var Ee=o(()=>{"use strict";Z();a()});var Ce=o(()=>{"use strict"});var Oe=o(()=>{"use strict";Ce();a()});var Ae=o(()=>{"use strict"});var we=o(()=>{"use strict";Ae()});var Pe=o(()=>{"use strict";we();a()});var Ie=o(()=>{"use strict"});var Ne=o(()=>{"use strict"});var Te=o(()=>{"use strict"});var ee=o(()=>{"use strict"});var De=o(()=>{"use strict"});var Ke=o(()=>{"use strict";ee();De()});var We=o(()=>{"use strict";Oe();Pe();Ie();Ne();G();Te();Ke();ee();a()});var Be=o(()=>{"use strict";We()});var $r,jr,Me=o(()=>{"use strict";ve();p();d();P();T();J();Z();Ee();Be();a();$r=500*1024*1024,jr=4*1024*1024*1024});var T=o(()=>{"use strict";Me()});import{homedir as Vr}from"node:os";import Yr from"node:path";var Ue,re=o(()=>{"use strict";Ue=Yr.join(Vr(),".kynver",".env")});var Le=o(()=>{"use strict"});var Fe=o(()=>{"use strict";Le()});var He=o(()=>{"use strict"});var te=o(()=>{"use strict";Fe();He()});var $e=o(()=>{"use strict"});var je=o(()=>{"use strict";$e()});var K=o(()=>{"use strict";re();v();p();te();je()});var Ve=o(()=>{"use strict";d();d()});var Ye=o(()=>{"use strict";re();te();K()});var Ge=o(()=>{"use strict";z();d();Ve();p();K();Ye();a();N()});import{homedir as et,totalmem as ws}from"node:os";import ne from"node:path";var ze,Fs,Hs,$s,js,p=o(()=>{"use strict";z();v();a();d();P();T();J();K();Ge();N();ze=ne.join(et(),".kynver"),Fs=ne.join(ze,"config.json"),Hs=ne.join(ze,"credentials"),$s=500*1024*1024,js=4*1024*1024*1024});C();C();var j="KYNVER_NO_PROD_DB_CREDENTIALS",Rr=["KYNVER_ENV_FILE"],xr=new Set(["1","true","yes","on"]);function fe(e){let r=e[j]?.trim().toLowerCase();return r!==void 0&&xr.has(r)}function f(e,r={}){let t=E(e);if(!r.reviewWorker)return t;let n={...t,[j]:"1"};for(let i of Rr)delete n[i];return n}var me=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function kr(e,r={}){let t=f(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||me.includes(c)),i=me.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=fe(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var _r="expert-lane-pr-review:",Sr="plan-review-task",Er="scheduledjob:",O=new Set(["lorentz","dalton","rhea","sentinel"]);function Cr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function V(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|risk register|signoff|verification|evidence|prove|gate)\b/.test(e)}function Or(e,r){return e.startsWith("factory:")?e.includes("lb")||V(r):!1}function Ar(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
+${n}`,s=Cr(e.personaSlug);return!!(r.startsWith(_r)||r===Sr||r.startsWith("daemon-review:")||s&&O.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Or(r,i)||V(i))||r.startsWith(Er)&&e.parentTaskId&&s&&O.has(s)||e.planId&&!e.parentTaskId&&s&&O.has(s)&&V(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&O.has(s))}var wr=/^claude[-_]/i,Pr=/^(?:opus|sonnet|haiku)\b/i;function ge(e){let r=e.trim();return wr.test(r)||Pr.test(r)}function he(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function ye(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Ir(e){return he(e)?"codex":ge(e)?"claude":(ye(e),"cursor")}function Nr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:null:null}function Tr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?ge(n)||he(n)||ye(n)?{lane:t,model:n,provider:Ir(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function A(e){let r=typeof e=="string"?e.trim():"";return r?Nr(r)??Tr(r):null}p();a();var ot="kynver",it=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],st=it.map(e=>`mcp__${ot}__${e}`);a();a();var La=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function lt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var ct=lt();a();var tl=600*1e3;var Xe="composer-2.5";var m="cursor",ut={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible"};function Ze(e){let r=e.trim().toLowerCase();return ut[r]??r}var dt=new Set(["claude","opus","anthropic"]),pt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function R(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return dt.has(r)?!0:r.includes("claude")||r.includes("opus")}function oe(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=R(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=A(R(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(mt(n.model)))return!0;let i=R(e,"description");if(pt.some(l=>l.test(i)))return!0;let s=R(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function mt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function ft(e,r){return{provider:m,model:Xe,rule:`policy:cursor_default${r}`,requestedModel:e}}var gt=["explicit:","executor_ref:","factory:","task:"];function ht(e){return gt.some(r=>e.startsWith(r))}function er(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||A(R(e,"executorRef"))?.provider?!0:oe(e)}function Qe(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||ht(r.rule)||er(t)||!u(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return ft(r.model,i)}function yt(e,r=m){let t=e?.trim();return t?Ze(t):r}function vt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(m)?[...new Set(r.map(t=>u(t)?m:t))]:r.every(t=>u(t))?[m]:r}var bt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,Rt=/\b(npm run build\b|next build\b)\b/i,xt=/\b(vercel (build|deploy|--prod))\b/i,kt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function ie(e){let r=e.trim();return r?kt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:xt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:Rt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:bt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var M="heavy_verification_token_required";import{spawnSync as Lt}from"node:child_process";a();import{closeSync as At,existsSync as k,mkdirSync as wt,openSync as Pt,readdirSync as or,readFileSync as It,statSync as Nt,unlinkSync as ir,writeFileSync as Tt}from"node:fs";import le from"node:path";import{mkdirSync as St}from"node:fs";import{tmpdir as Et}from"node:os";import U from"node:path";import{homedir as _t}from"node:os";import rr from"node:path";function tr(){let e=process.env.KYNVER_STATE_ROOT;return e?rr.resolve(e):rr.join(_t(),".kynver","state")}function Ct(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function Ot(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?U.resolve(e):Ct()?U.join(Et(),"kynver","state","heavy-verification"):U.join(tr(),"heavy-verification")}function se(){return U.join(Ot(),"slots")}function x(){let e=se();return St(e,{recursive:!0}),e}var _=120*6e4,nr=1;function Dt(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function F(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function L(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?Dt(e,nr):nr}function Kt(e){return`slot-${e}`}function Wt(e,r=se()){return le.join(r,`${e}.json`)}function ce(e){if(!k(e))return null;try{let r=JSON.parse(It(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function sr(e,r=_){if(!e||!Y(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function ar(e,r){let t=ce(e);if(t)return sr(t,r);if(!k(e))return!0;try{return Date.now()-Nt(e).mtimeMs>r}catch{return!0}}function Bt(e,r){if(ar(e,r))try{ir(e)}catch{}}function Mt(e){return wt(e,{recursive:!0}),e}function ue(e={}){let r=Mt(e.slotsDir??x()),t=e.staleMs??_,n=0;for(let i of or(r)){if(!i.endsWith(".json"))continue;let s=le.join(r,i),l=k(s);Bt(s,t),l&&!k(s)&&(n+=1)}return n}function Ut(e={}){let r=e.slotsDir??x(),t=e.staleMs??_;ue({slotsDir:r,staleMs:t});let n=[];for(let i of or(r)){if(!i.endsWith(".json"))continue;let s=ce(le.join(r,i));s&&!sr(s,t)&&n.push(s)}return n}function ae(e={}){return Ut(e).length}function S(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();ue({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=Kt(l),g=Wt(c,t),cr=ce(g);if(ar(g,n))try{ir(g)}catch{}else if(cr||k(g))continue;let ur={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let h=Pt(g,"wx");Tt(h,JSON.stringify(ur,null,2),"utf8"),At(h);let dr=ae({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:dr,maxSlots:i,reason:null}}catch(h){if(h.code==="EEXIST")continue;throw h}}let s=ae({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function H(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();ue({slotsDir:t,staleMs:n});let s=ae({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Ft(e){e<=0||Lt(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function lr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=S(e,n);for(;!s.admitted&&Date.now()<i;)Ft(Math.min(t,i-Date.now())),s=S(e,n);return s}function Ht(e,r={}){let t=ie(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...H(e),slotId:null}};if(F())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...H(e),slotId:null}};let n=r.waitMs??0,i=n>0?lr(e,n,r.pollMs):S(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:M,commandClass:t.commandClass,reason:t.reason??i.reason??M,verificationGate:i}}export{m as DEFAULT_WORKER_PROVIDER,M as HEAVY_VERIFICATION_TOKEN_REQUIRED,j as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,kr as auditReviewWorkerCredentialScope,br as auditWorkerEnv,f as buildWorkerSpawnEnv,ie as classifyHeavyShellCommand,Qe as enforceCursorWorkerProvider,Ht as gateWorkerShellCommand,u as isClaudeFamilyProvider,y as isForbiddenWorkerEnvKey,Ar as isHarnessExpertReviewWorker,fe as isNoProdCredentialReviewEnvironment,de as listForbiddenWorkerEnvKeys,pe as listOperatorAllowedWorkerEnvKeys,Ze as normalizeWorkerProviderName,vt as preferCursorExecutor,yt as resolveConfiguredWorkerProvider,E as scrubWorkerEnv,oe as taskAllowsClaudeWorker,er as taskExpressesWorkerProviderPreference};

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.2.28",
+  "version": "0.2.29",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",