@kynver-app/runtime 0.2.36 → 0.2.37

package/dist/server/worker-policy.js

@@ -1,2 +1,2 @@
-var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function $(e){let r=e[vr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function y(e,r={}){return mr.has(e)?!0:hr.has(e)||r.operatorAllow?.has(e)||yr.some(t=>e.endsWith(t))?!1:fr.some(t=>e.endsWith(t))}function de(e){let r=$(e);return Object.keys(e).filter(t=>y(t,{operatorAllow:r})).sort()}function pe(e){let r=$(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!y(t,{operatorAllow:r})&&y(t)).sort()}function E(e){let r=$(e),t={...e};for(let n of Object.keys(t))y(n,{operatorAllow:r})&&delete t[n];return t}function br(e){let r=de(e),t=pe(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var pr,mr,fr,gr,hr,yr,vr,C=o(()=>{"use strict";pr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],mr=new Set(pr),fr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],gr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],hr=new Set(gr),yr=["_PUBLIC_KEY"],vr="KYNVER_WORKER_ENV_ALLOW"});function Y(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict"});var G=o(()=>{"use strict";a();C()});var v=o(()=>{"use strict"});var z=o(()=>{"use strict";G();v()});var d=o(()=>{"use strict"});var P=o(()=>{"use strict"});var ve=o(()=>{"use strict"});var un,dn,q=o(()=>{"use strict";un=25*1024*1024*1024,dn=12*1024*1024*1024});var hn,yn,be=o(()=>{"use strict";q();hn=5*1024*1024*1024,yn=10*1024*1024*1024});var _n,Sn,J=o(()=>{"use strict";be();q();_n=30*1024*1024*1024,Sn=15*1024*1024*1024});var xe=o(()=>{"use strict";a()});import Kr from"node:path";var Tn,X=o(()=>{"use strict";v();xe();Tn=Kr.join(".openclaw","harness")});var N=o(()=>{"use strict";p();d();P();T();X()});var Se=o(()=>{"use strict";p();X();N();a()});var Z=o(()=>{"use strict";Se();a()});var Ee=o(()=>{"use strict";Z();a()});var Ce=o(()=>{"use strict"});var Oe=o(()=>{"use strict";Ce();a()});var Ae=o(()=>{"use strict"});var we=o(()=>{"use strict";Ae()});var Pe=o(()=>{"use strict";we();a()});var Ie=o(()=>{"use strict"});var Ne=o(()=>{"use strict"});var Te=o(()=>{"use strict"});var ee=o(()=>{"use strict"});var De=o(()=>{"use strict"});var Ke=o(()=>{"use strict";ee();De()});var We=o(()=>{"use strict";Oe();Pe();Ie();Ne();G();Te();Ke();ee();a()});var Be=o(()=>{"use strict";We()});var $r,jr,Me=o(()=>{"use strict";ve();p();d();P();T();J();Z();Ee();Be();a();$r=500*1024*1024,jr=4*1024*1024*1024});var T=o(()=>{"use strict";Me()});import{homedir as Vr}from"node:os";import Yr from"node:path";var Ue,re=o(()=>{"use strict";Ue=Yr.join(Vr(),".kynver",".env")});var Le=o(()=>{"use strict"});var Fe=o(()=>{"use strict";Le()});var He=o(()=>{"use strict"});var te=o(()=>{"use strict";Fe();He()});var $e=o(()=>{"use strict"});var je=o(()=>{"use strict";$e()});var K=o(()=>{"use strict";re();v();p();te();je()});var Ve=o(()=>{"use strict";d();d()});var Ye=o(()=>{"use strict";re();te();K()});var Ge=o(()=>{"use strict";z();d();Ve();p();K();Ye();a();N()});import{homedir as et,totalmem as ws}from"node:os";import ne from"node:path";var ze,Fs,Hs,$s,js,p=o(()=>{"use strict";z();v();a();d();P();T();J();K();Ge();N();ze=ne.join(et(),".kynver"),Fs=ne.join(ze,"config.json"),Hs=ne.join(ze,"credentials"),$s=500*1024*1024,js=4*1024*1024*1024});C();C();var j="KYNVER_NO_PROD_DB_CREDENTIALS",Rr=["KYNVER_ENV_FILE"],xr=new Set(["1","true","yes","on"]);function fe(e){let r=e[j]?.trim().toLowerCase();return r!==void 0&&xr.has(r)}function f(e,r={}){let t=E(e);if(!r.reviewWorker)return t;let n={...t,[j]:"1"};for(let i of Rr)delete n[i];return n}var me=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function kr(e,r={}){let t=f(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||me.includes(c)),i=me.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=fe(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var _r="expert-lane-pr-review:",Sr="plan-review-task",Er="scheduledjob:",O=new Set(["lorentz","dalton","rhea","sentinel"]);function Cr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function V(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|risk register|signoff|verification|evidence|prove|gate)\b/.test(e)}function Or(e,r){return e.startsWith("factory:")?e.includes("lb")||V(r):!1}function Ar(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
-${n}`,s=Cr(e.personaSlug);return!!(r.startsWith(_r)||r===Sr||r.startsWith("daemon-review:")||s&&O.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Or(r,i)||V(i))||r.startsWith(Er)&&e.parentTaskId&&s&&O.has(s)||e.planId&&!e.parentTaskId&&s&&O.has(s)&&V(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&O.has(s))}var wr=/^claude[-_]/i,Pr=/^(?:opus|sonnet|haiku)\b/i;function ge(e){let r=e.trim();return wr.test(r)||Pr.test(r)}function he(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function ye(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Ir(e){return he(e)?"codex":ge(e)?"claude":(ye(e),"cursor")}function Nr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:null:null}function Tr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?ge(n)||he(n)||ye(n)?{lane:t,model:n,provider:Ir(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function A(e){let r=typeof e=="string"?e.trim():"";return r?Nr(r)??Tr(r):null}p();a();var ot="kynver",it=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],st=it.map(e=>`mcp__${ot}__${e}`);a();a();var La=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function lt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var ct=lt();a();var tl=600*1e3;var Xe="composer-2.5";var m="cursor",ut={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible"};function Ze(e){let r=e.trim().toLowerCase();return ut[r]??r}var dt=new Set(["claude","opus","anthropic"]),pt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function R(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return dt.has(r)?!0:r.includes("claude")||r.includes("opus")}function oe(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=R(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=A(R(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(mt(n.model)))return!0;let i=R(e,"description");if(pt.some(l=>l.test(i)))return!0;let s=R(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function mt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function ft(e,r){return{provider:m,model:Xe,rule:`policy:cursor_default${r}`,requestedModel:e}}var gt=["explicit:","executor_ref:","factory:","task:"];function ht(e){return gt.some(r=>e.startsWith(r))}function er(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||A(R(e,"executorRef"))?.provider?!0:oe(e)}function Qe(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||ht(r.rule)||er(t)||!u(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return ft(r.model,i)}function yt(e,r=m){let t=e?.trim();return t?Ze(t):r}function vt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(m)?[...new Set(r.map(t=>u(t)?m:t))]:r.every(t=>u(t))?[m]:r}var bt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,Rt=/\b(npm run build\b|next build\b)\b/i,xt=/\b(vercel (build|deploy|--prod))\b/i,kt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function ie(e){let r=e.trim();return r?kt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:xt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:Rt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:bt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var M="heavy_verification_token_required";import{spawnSync as Lt}from"node:child_process";a();import{closeSync as At,existsSync as k,mkdirSync as wt,openSync as Pt,readdirSync as or,readFileSync as It,statSync as Nt,unlinkSync as ir,writeFileSync as Tt}from"node:fs";import le from"node:path";import{mkdirSync as St}from"node:fs";import{tmpdir as Et}from"node:os";import U from"node:path";import{homedir as _t}from"node:os";import rr from"node:path";function tr(){let e=process.env.KYNVER_STATE_ROOT;return e?rr.resolve(e):rr.join(_t(),".kynver","state")}function Ct(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function Ot(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?U.resolve(e):Ct()?U.join(Et(),"kynver","state","heavy-verification"):U.join(tr(),"heavy-verification")}function se(){return U.join(Ot(),"slots")}function x(){let e=se();return St(e,{recursive:!0}),e}var _=120*6e4,nr=1;function Dt(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function F(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function L(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?Dt(e,nr):nr}function Kt(e){return`slot-${e}`}function Wt(e,r=se()){return le.join(r,`${e}.json`)}function ce(e){if(!k(e))return null;try{let r=JSON.parse(It(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function sr(e,r=_){if(!e||!Y(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function ar(e,r){let t=ce(e);if(t)return sr(t,r);if(!k(e))return!0;try{return Date.now()-Nt(e).mtimeMs>r}catch{return!0}}function Bt(e,r){if(ar(e,r))try{ir(e)}catch{}}function Mt(e){return wt(e,{recursive:!0}),e}function ue(e={}){let r=Mt(e.slotsDir??x()),t=e.staleMs??_,n=0;for(let i of or(r)){if(!i.endsWith(".json"))continue;let s=le.join(r,i),l=k(s);Bt(s,t),l&&!k(s)&&(n+=1)}return n}function Ut(e={}){let r=e.slotsDir??x(),t=e.staleMs??_;ue({slotsDir:r,staleMs:t});let n=[];for(let i of or(r)){if(!i.endsWith(".json"))continue;let s=ce(le.join(r,i));s&&!sr(s,t)&&n.push(s)}return n}function ae(e={}){return Ut(e).length}function S(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();ue({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=Kt(l),g=Wt(c,t),cr=ce(g);if(ar(g,n))try{ir(g)}catch{}else if(cr||k(g))continue;let ur={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let h=Pt(g,"wx");Tt(h,JSON.stringify(ur,null,2),"utf8"),At(h);let dr=ae({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:dr,maxSlots:i,reason:null}}catch(h){if(h.code==="EEXIST")continue;throw h}}let s=ae({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function H(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();ue({slotsDir:t,staleMs:n});let s=ae({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Ft(e){e<=0||Lt(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function lr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=S(e,n);for(;!s.admitted&&Date.now()<i;)Ft(Math.min(t,i-Date.now())),s=S(e,n);return s}function Ht(e,r={}){let t=ie(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...H(e),slotId:null}};if(F())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...H(e),slotId:null}};let n=r.waitMs??0,i=n>0?lr(e,n,r.pollMs):S(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:M,commandClass:t.commandClass,reason:t.reason??i.reason??M,verificationGate:i}}export{m as DEFAULT_WORKER_PROVIDER,M as HEAVY_VERIFICATION_TOKEN_REQUIRED,j as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,kr as auditReviewWorkerCredentialScope,br as auditWorkerEnv,f as buildWorkerSpawnEnv,ie as classifyHeavyShellCommand,Qe as enforceCursorWorkerProvider,Ht as gateWorkerShellCommand,u as isClaudeFamilyProvider,y as isForbiddenWorkerEnvKey,Ar as isHarnessExpertReviewWorker,fe as isNoProdCredentialReviewEnvironment,de as listForbiddenWorkerEnvKeys,pe as listOperatorAllowedWorkerEnvKeys,Ze as normalizeWorkerProviderName,vt as preferCursorExecutor,yt as resolveConfiguredWorkerProvider,E as scrubWorkerEnv,oe as taskAllowsClaudeWorker,er as taskExpressesWorkerProviderPreference};
+var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function $(e){let r=e[br];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function v(e,r={}){return fr.has(e)?!0:yr.has(e)||r.operatorAllow?.has(e)||vr.some(t=>e.endsWith(t))?!1:gr.some(t=>e.endsWith(t))}function pe(e){let r=$(e);return Object.keys(e).filter(t=>v(t,{operatorAllow:r})).sort()}function me(e){let r=$(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!v(t,{operatorAllow:r})&&v(t)).sort()}function E(e){let r=$(e),t={...e};for(let n of Object.keys(t))v(n,{operatorAllow:r})&&delete t[n];return t}function Rr(e){let r=pe(e),t=me(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var mr,fr,gr,hr,yr,vr,br,C=o(()=>{"use strict";mr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],fr=new Set(mr),gr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],hr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],yr=new Set(hr),vr=["_PUBLIC_KEY"],br="KYNVER_WORKER_ENV_ALLOW"});var g=o(()=>{"use strict"});function Y(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict"});var z=o(()=>{"use strict";g();a();C()});var q=o(()=>{"use strict";z();g()});var d=o(()=>{"use strict"});var P=o(()=>{"use strict"});var be=o(()=>{"use strict"});var dn,pn,J=o(()=>{"use strict";dn=25*1024*1024*1024,pn=12*1024*1024*1024});var yn,vn,Re=o(()=>{"use strict";J();yn=5*1024*1024*1024,vn=10*1024*1024*1024});var Sn,En,X=o(()=>{"use strict";Re();J();Sn=30*1024*1024*1024,En=15*1024*1024*1024});var ke=o(()=>{"use strict";a()});import Kr from"node:path";var Dn,Q=o(()=>{"use strict";g();ke();Dn=Kr.join(".openclaw","harness")});var N=o(()=>{"use strict";p();d();P();T();Q()});var Ee=o(()=>{"use strict";p();Q();N();a()});var ee=o(()=>{"use strict";Ee();a()});var Ce=o(()=>{"use strict";ee();a()});var Oe=o(()=>{"use strict"});var Ae=o(()=>{"use strict";Oe();a()});var we=o(()=>{"use strict"});var Pe=o(()=>{"use strict";we()});var Ie=o(()=>{"use strict";Pe();a()});var Ne=o(()=>{"use strict"});var Te=o(()=>{"use strict"});var De=o(()=>{"use strict"});var re=o(()=>{"use strict"});var Ke=o(()=>{"use strict"});var We=o(()=>{"use strict";re();Ke()});var Be=o(()=>{"use strict";Ae();Ie();Ne();Te();z();De();We();re();a()});var Me=o(()=>{"use strict";Be()});var $r,jr,Ue=o(()=>{"use strict";be();p();d();P();T();X();ee();Ce();Me();a();$r=500*1024*1024,jr=4*1024*1024*1024});var T=o(()=>{"use strict";Ue()});import{homedir as Vr}from"node:os";import Yr from"node:path";var Le,te=o(()=>{"use strict";Le=Yr.join(Vr(),".kynver",".env")});var Fe=o(()=>{"use strict"});var He=o(()=>{"use strict";Fe()});var $e=o(()=>{"use strict"});var ne=o(()=>{"use strict";He();$e()});var je=o(()=>{"use strict"});var Ve=o(()=>{"use strict";je()});var K=o(()=>{"use strict";te();g();p();ne();Ve()});var Ye=o(()=>{"use strict";d();d()});var Ge=o(()=>{"use strict";te();ne();K()});var ze=o(()=>{"use strict";q();d();Ye();p();K();Ge();a();N()});import{homedir as et,totalmem as ws}from"node:os";import oe from"node:path";var qe,Fs,Hs,$s,js,p=o(()=>{"use strict";q();g();a();d();P();T();X();K();ze();N();qe=oe.join(et(),".kynver"),Fs=oe.join(qe,"config.json"),Hs=oe.join(qe,"credentials"),$s=500*1024*1024,js=4*1024*1024*1024});C();C();var j="KYNVER_NO_PROD_DB_CREDENTIALS",xr=["KYNVER_ENV_FILE"],kr=new Set(["1","true","yes","on"]);function ge(e){let r=e[j]?.trim().toLowerCase();return r!==void 0&&kr.has(r)}function f(e,r={}){let t=E(e);if(!r.reviewWorker)return t;let n={...t,[j]:"1"};for(let i of xr)delete n[i];return n}var fe=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function _r(e,r={}){let t=f(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||fe.includes(c)),i=fe.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=ge(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var Sr="expert-lane-pr-review:",Er="plan-review-task",Cr="scheduledjob:",O=new Set(["lorentz","dalton","rhea","sentinel"]);function Or(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function V(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|risk register|signoff|verification|evidence|prove|gate)\b/.test(e)}function Ar(e,r){return e.startsWith("factory:")?e.includes("lb")||V(r):!1}function wr(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
+${n}`,s=Or(e.personaSlug);return!!(r.startsWith(Sr)||r===Er||r.startsWith("daemon-review:")||s&&O.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Ar(r,i)||V(i))||r.startsWith(Cr)&&e.parentTaskId&&s&&O.has(s)||e.planId&&!e.parentTaskId&&s&&O.has(s)&&V(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&O.has(s))}var Pr=/^claude[-_]/i,Ir=/^(?:opus|sonnet|haiku)\b/i;function he(e){let r=e.trim();return Pr.test(r)||Ir.test(r)}function ye(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function ve(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Nr(e){return ye(e)?"codex":he(e)?"claude":(ve(e),"cursor")}function Tr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:null:null}function Dr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?he(n)||ye(n)||ve(n)?{lane:t,model:n,provider:Nr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function A(e){let r=typeof e=="string"?e.trim():"";return r?Tr(r)??Dr(r):null}p();a();var ot="kynver",it=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],st=it.map(e=>`mcp__${ot}__${e}`);a();a();var La=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function lt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var ct=lt();a();var tl=600*1e3;var Qe="composer-2.5";var m="cursor",ut={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible"};function er(e){let r=e.trim().toLowerCase();return ut[r]??r}var dt=new Set(["claude","opus","anthropic"]),pt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function R(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return dt.has(r)?!0:r.includes("claude")||r.includes("opus")}function ie(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=R(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=A(R(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(mt(n.model)))return!0;let i=R(e,"description");if(pt.some(l=>l.test(i)))return!0;let s=R(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function mt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function ft(e,r){return{provider:m,model:Qe,rule:`policy:cursor_default${r}`,requestedModel:e}}var gt=["explicit:","executor_ref:","factory:","task:"];function ht(e){return gt.some(r=>e.startsWith(r))}function rr(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||A(R(e,"executorRef"))?.provider?!0:ie(e)}function Ze(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||ht(r.rule)||rr(t)||!u(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return ft(r.model,i)}function yt(e,r=m){let t=e?.trim();return t?er(t):r}function vt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(m)?[...new Set(r.map(t=>u(t)?m:t))]:r.every(t=>u(t))?[m]:r}var bt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,Rt=/\b(npm run build\b|next build\b)\b/i,xt=/\b(vercel (build|deploy|--prod))\b/i,kt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function se(e){let r=e.trim();return r?kt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:xt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:Rt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:bt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var M="heavy_verification_token_required";import{spawnSync as Lt}from"node:child_process";a();import{closeSync as At,existsSync as k,mkdirSync as wt,openSync as Pt,readdirSync as ir,readFileSync as It,statSync as Nt,unlinkSync as sr,writeFileSync as Tt}from"node:fs";import ce from"node:path";import{mkdirSync as St}from"node:fs";import{tmpdir as Et}from"node:os";import U from"node:path";import{homedir as _t}from"node:os";import tr from"node:path";function nr(){let e=process.env.KYNVER_STATE_ROOT;return e?tr.resolve(e):tr.join(_t(),".kynver","state")}function Ct(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function Ot(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?U.resolve(e):Ct()?U.join(Et(),"kynver","state","heavy-verification"):U.join(nr(),"heavy-verification")}function ae(){return U.join(Ot(),"slots")}function x(){let e=ae();return St(e,{recursive:!0}),e}var _=120*6e4,or=1;function Dt(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function F(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function L(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?Dt(e,or):or}function Kt(e){return`slot-${e}`}function Wt(e,r=ae()){return ce.join(r,`${e}.json`)}function ue(e){if(!k(e))return null;try{let r=JSON.parse(It(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function ar(e,r=_){if(!e||!Y(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function lr(e,r){let t=ue(e);if(t)return ar(t,r);if(!k(e))return!0;try{return Date.now()-Nt(e).mtimeMs>r}catch{return!0}}function Bt(e,r){if(lr(e,r))try{sr(e)}catch{}}function Mt(e){return wt(e,{recursive:!0}),e}function de(e={}){let r=Mt(e.slotsDir??x()),t=e.staleMs??_,n=0;for(let i of ir(r)){if(!i.endsWith(".json"))continue;let s=ce.join(r,i),l=k(s);Bt(s,t),l&&!k(s)&&(n+=1)}return n}function Ut(e={}){let r=e.slotsDir??x(),t=e.staleMs??_;de({slotsDir:r,staleMs:t});let n=[];for(let i of ir(r)){if(!i.endsWith(".json"))continue;let s=ue(ce.join(r,i));s&&!ar(s,t)&&n.push(s)}return n}function le(e={}){return Ut(e).length}function S(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();de({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=Kt(l),h=Wt(c,t),ur=ue(h);if(lr(h,n))try{sr(h)}catch{}else if(ur||k(h))continue;let dr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let y=Pt(h,"wx");Tt(y,JSON.stringify(dr,null,2),"utf8"),At(y);let pr=le({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:pr,maxSlots:i,reason:null}}catch(y){if(y.code==="EEXIST")continue;throw y}}let s=le({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function H(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();de({slotsDir:t,staleMs:n});let s=le({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Ft(e){e<=0||Lt(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function cr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=S(e,n);for(;!s.admitted&&Date.now()<i;)Ft(Math.min(t,i-Date.now())),s=S(e,n);return s}function Ht(e,r={}){let t=se(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...H(e),slotId:null}};if(F())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...H(e),slotId:null}};let n=r.waitMs??0,i=n>0?cr(e,n,r.pollMs):S(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:M,commandClass:t.commandClass,reason:t.reason??i.reason??M,verificationGate:i}}export{m as DEFAULT_WORKER_PROVIDER,M as HEAVY_VERIFICATION_TOKEN_REQUIRED,j as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,_r as auditReviewWorkerCredentialScope,Rr as auditWorkerEnv,f as buildWorkerSpawnEnv,se as classifyHeavyShellCommand,Ze as enforceCursorWorkerProvider,Ht as gateWorkerShellCommand,u as isClaudeFamilyProvider,v as isForbiddenWorkerEnvKey,wr as isHarnessExpertReviewWorker,ge as isNoProdCredentialReviewEnvironment,pe as listForbiddenWorkerEnvKeys,me as listOperatorAllowedWorkerEnvKeys,er as normalizeWorkerProviderName,vt as preferCursorExecutor,yt as resolveConfiguredWorkerProvider,E as scrubWorkerEnv,ie as taskAllowsClaudeWorker,rr as taskExpressesWorkerProviderPreference};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.2.36",
+  "version": "0.2.37",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",