@kynver-app/runtime 0.2.41 → 0.2.46
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/cli.js +87 -80
- package/dist/index.js +112 -105
- package/dist/server/dispatch-routing.js +3 -3
- package/dist/server/model-routing.js +3 -3
- package/dist/server/orchestration.js +1 -1
- package/dist/server/worker-policy.js +2 -2
- package/dist/worker-broker/index.js +7 -0
- package/package.json +7 -2
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
var a=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};import{homedir as he}from"node:os";import ye from"node:path";function xr(e){return e==="~"?he():e.startsWith("~/")||e.startsWith("~\\")?ye.join(he(),e.slice(2)):e}function x(e){return ye.resolve(xr(e))}var _=a(()=>{"use strict"});var d=a(()=>{"use strict"});var _r,Qt,Sr,en,G=a(()=>{"use strict";_r=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Qt=new Set(_r),Sr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],en=new Set(Sr)});var z=a(()=>{"use strict";_();d();G()});var q=a(()=>{"use strict";z();_()});var R=a(()=>{"use strict"});var N=a(()=>{"use strict"});var be=a(()=>{"use strict"});var gn,hn,J=a(()=>{"use strict";gn=25*1024*1024*1024,hn=12*1024*1024*1024});var kn,xn,Re=a(()=>{"use strict";J();kn=5*1024*1024*1024,xn=10*1024*1024*1024});var An,wn,X=a(()=>{"use strict";Re();J();An=30*1024*1024*1024,wn=15*1024*1024*1024});var ke=a(()=>{"use strict";d()});import Or from"node:path";var Wn,Z=a(()=>{"use strict";_();ke();Wn=Or.join(".openclaw","harness")});var B=a(()=>{"use strict";v();R();N();D();Z()});var Se=a(()=>{"use strict";v();Z();B();d()});var ee=a(()=>{"use strict";Se();d()});var Ee=a(()=>{"use strict";ee();d()});var Ce=a(()=>{"use strict"});var Oe=a(()=>{"use strict";Ce();d()});var Ae=a(()=>{"use strict"});var we=a(()=>{"use strict";Ae()});var Pe=a(()=>{"use strict";we();d()});var Ie=a(()=>{"use strict"});var Ne=a(()=>{"use strict"});var Ke=a(()=>{"use strict"});var re=a(()=>{"use strict"});var Be=a(()=>{"use strict"});var De=a(()=>{"use strict";re();Be()});var Te=a(()=>{"use strict";Oe();Pe();Ie();Ne();z();Ke();De();re();d()});var Me=a(()=>{"use strict";Te()});var Dr,Tr,We=a(()=>{"use strict";be();v();R();N();D();X();ee();Ee();Me();d();Dr=500*1024*1024,Tr=4*1024*1024*1024});var D=a(()=>{"use strict";We()});import{homedir as Mr}from"node:os";import Wr from"node:path";var Ue,te=a(()=>{"use strict";Ue=Wr.join(Mr(),".kynver",".env")});var Le=a(()=>{"use strict"});var Fe=a(()=>{"use strict";Le()});var $e=a(()=>{"use strict"});var ne=a(()=>{"use strict";Fe();$e()});var He=a(()=>{"use strict"});var je=a(()=>{"use strict";He()});var T=a(()=>{"use strict";te();_();v();ne();je()});var Ye=a(()=>{"use strict";R();R()});var Ve=a(()=>{"use strict";te();ne();T()});var Ge=a(()=>{"use strict";q();R();Ye();v();T();Ve();d();B()});import{existsSync as Vr,mkdirSync as Bs,readFileSync as Gr,writeFileSync as Ds}from"node:fs";import{homedir as zr,totalmem as Ms}from"node:os";import oe from"node:path";function qr(e){return{...e,...e.harnessRoot?.trim()?{harnessRoot:x(e.harnessRoot.trim())}:{},...e.defaultRepo?.trim()?{defaultRepo:x(e.defaultRepo.trim())}:{}}}function S(){if(!Vr(ze))return{};try{return qr(JSON.parse(Gr(ze,"utf8")))}catch{return{}}}var qe,ze,qs,Js,Xs,v=a(()=>{"use strict";q();_();d();R();N();D();X();T();Ge();B();qe=oe.join(zr(),".kynver"),ze=oe.join(qe,"config.json"),qs=oe.join(qe,"credentials");Js=500*1024*1024,Xs=4*1024*1024*1024});var yr=/^claude[-_]/i,br=/^(?:opus|sonnet|haiku)\b/i;function fe(e){let r=e.trim();return yr.test(r)||br.test(r)}function ge(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Y(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Rr(e){return ge(e)?"codex":fe(e)?"claude":(Y(e),"cursor")}function vr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:null:null}function kr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?fe(n)||ge(n)||Y(n)?{lane:t,model:n,provider:Rr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function h(e){let r=typeof e=="string"?e.trim():"";return r?vr(r)??kr(r):null}function V(e){let r=h(e);return r?!!(r.provider&&r.provider!=="cursor"||r.model&&!Y(r.model)):!1}v();var Je={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"unsupported",workerMcpToolsNote:"Codex (and the Hermes openai-codex path) has no per-spawn MCP config + tool allow-list, so a worker's toolset could not be held to the server's capability grant. Workers run without Kynver tools."},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"unsupported",workerMcpToolsNote:"Cursor configures MCP servers per workspace, not per spawn, so a task-bound token could not be scoped to one worker. Workers run without Kynver tools."},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function E(e){return Je[e]}function Xe(){return Object.values(Je)}import{existsSync as Xr}from"node:fs";import{homedir as Zr}from"node:os";import O from"node:path";import{createHash as Ze}from"node:crypto";import{statSync as Jr}from"node:fs";import{spawnSync as Qe}from"node:child_process";function y(e){try{let r=Jr(e),t=`${e}|${r.size}|${r.mtimeMs}`;return Ze("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function C(e){return Ze("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function p(e,r){for(let t of r){let n=process.env[t]?.trim();if(n)return n}return e}function m(e,r,t={}){let n=t.timeoutMs??8e3;try{let o=Qe(e,r,{encoding:"utf8",timeout:n,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(o.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let i=(o.stderr||o.stdout||"").trim(),s=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} probe failed`}}}function M(e,r,t={}){let n=t.timeoutMs??8e3;try{return Qe(e,r,{stdio:"ignore",timeout:n,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} auth probe failed`}}}var Qr="codex";function et(){let e=Zr();return[process.env.CODEX_HOME?.trim()?O.join(O.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,O.join(e,".codex","auth.json"),O.join(e,".config","codex","auth.json")].filter(t=>!!t)}function rt(e){return O.dirname(e)}function tt(e){let r,t;for(let n of et()){if(!Xr(n))continue;r??=n;let o=m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:rt(n)}});if(t??=o,o.ok)return{authPath:n,login:o}}return{authPath:r,login:t??m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function er(e=new Date().toISOString()){let r=p(Qr,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:C("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:n}=tt(r),o=!!t&&n.ok;return{providerId:"codex",ready:o,authSource:"oauth_local",sessionFingerprint:t?y(t):void 0,checkedAt:e,note:o?"Local Codex OAuth session bound on runner":[n.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as nt}from"node:fs";import{homedir as ot}from"node:os";import ie from"node:path";function it(){let e=process.env.HERMES_HOME?.trim(),r=e?ie.resolve(e):ie.join(ot(),".hermes");return ie.join(r,"auth.json")}function W(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=it(),o=nt(n),i=M(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:o?y(n):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,o?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function A(e=new Date().toISOString()){let r=er(e);if(r.ready)return{...r,path:"codex_cli"};let t=W(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}var rr=["low","medium","high"],tr={oauth_local:0,subscription_hermes:0,runner_token:1,api_key_env:2,none:3};function nr(e,r){let t=E(e);return r==="privileged"?t.supportsPrivilegedPlatformActions:r==="low"?t.supportsLowRiskOrchestration:!0}function st(e,r){let t=E(e.providerId),n=E(r.providerId),o=rr.indexOf(t.costTier)-rr.indexOf(n.costTier);if(o!==0)return o;let i=tr[e.binding.authSource]-tr[r.binding.authSource];return i!==0?i:e.providerId.localeCompare(r.providerId)}function se(e){let r=Xe().map(l=>({providerId:l.id,binding:e.inventory.bindings[l.id]})).filter(l=>l.binding.ready&&nr(l.providerId,e.riskClass));if(r.length===0)return null;let n=[...r].sort(st)[0],o="codex";if(n.providerId===o)return{providerId:n.providerId,binding:n.binding};let i=e.inventory.bindings[o],s;return nr(o,e.riskClass)?i.ready||(s=i.note??`${o} not bound`):s=`${e.riskClass} orchestration requires privileged-capable provider`,{providerId:n.providerId,binding:n.binding,escalatedFrom:o,escalatedReason:s}}import{existsSync as at}from"node:fs";import{homedir as lt}from"node:os";import ut from"node:path";var ct="claude";function dt(){let e=lt();return[ut.join(e,".claude",".credentials.json")]}function or(e=new Date().toISOString()){let r=p(ct,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:C("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=dt().find(s=>at(s)),o=M(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(o.ok||!!n);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,o.note,n?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as pt}from"node:fs";import{homedir as mt}from"node:os";import ae from"node:path";var ft="agent";function gt(){let e=mt(),r=[ae.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let t=process.env.LOCALAPPDATA?.trim(),n=process.env.APPDATA?.trim();t&&r.push(ae.join(t,"cursor-agent","auth.json")),n&&r.push(ae.join(n,"cursor","auth.json"))}return r}function ir(e=new Date().toISOString()){let r=p(ft,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:C("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=m(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=gt().find(i=>pt(i)),o=!!n&&t.ok;return{providerId:"cursor",ready:o,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:o?"Local Cursor/Composer OAuth session bound on runner":[t.note,n?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as ht,readFileSync as yt}from"node:fs";import{homedir as bt}from"node:os";import le from"node:path";var Rt=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function vt(){let e=process.env.HERMES_HOME?.trim(),r=e?le.resolve(e):le.join(bt(),".hermes");return le.join(r,".env")}function kt(e){try{let r=yt(e,"utf8"),t=[];for(let n of Rt)new RegExp(`^${n}=`,"m").test(r)&&t.push(n);return t}catch{return[]}}function sr(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=vt(),o=ht(n),i=o?kt(n):[],l=i.some(u=>u.endsWith("_API_KEY"))?"api_key_env":o?"oauth_local":"none",c=t.ok&&o;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:o,authSource:l,sessionFingerprint:o?y(n):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,o?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function ar(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=A(r),n={codex:t,cursor:ir(r),claude:or(r)},o=Object.values(n).filter(i=>i.ready).length;return{generatedAt:r,bindings:n,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:sr(r),hermesOpenAiCodex:W(r),codexAdapterPath:t.path,readyCount:o}}var xt=[/\bprivileged\b/i,/\bproduction\s+db\b/i,/\bdb:push\b/i,/\bmigration\b/i,/\bdeploy\b/i,/\bsecrets?\b/i,/\bstripe\b/i,/\[require-approval\]/i,/\[operator-only\]/i],_t=[/\borchestration\b/i,/\bplan[- ]?progress\b/i,/\bstatus\s+sync\b/i,/\bheartbeat\b/i,/\bboard[- ]?drain\b/i,/\bmaintenance\b/i,/\[orchestration:\s*low-risk\]/i];function ue(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function St(e){let r=ue(e,"executorRef").toLowerCase(),t=ue(e,"title").toLowerCase(),n=ue(e,"description").toLowerCase(),o=`${r}
|
|
1
|
+
var a=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};import{homedir as he}from"node:os";import ye from"node:path";function xr(e){return e==="~"?he():e.startsWith("~/")||e.startsWith("~\\")?ye.join(he(),e.slice(2)):e}function v(e){return ye.resolve(xr(e))}var x=a(()=>{"use strict"});var d=a(()=>{"use strict"});var Sr,Zt,Er,en,G=a(()=>{"use strict";Sr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Zt=new Set(Sr),Er=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],en=new Set(Er)});var q=a(()=>{"use strict";x();d();G()});var z=a(()=>{"use strict";q();x()});var b=a(()=>{"use strict"});var N=a(()=>{"use strict"});var Re=a(()=>{"use strict"});var gn,hn,J=a(()=>{"use strict";gn=25*1024*1024*1024,hn=12*1024*1024*1024});var _n,vn,be=a(()=>{"use strict";J();_n=5*1024*1024*1024,vn=10*1024*1024*1024});var An,wn,X=a(()=>{"use strict";be();J();An=30*1024*1024*1024,wn=15*1024*1024*1024});var _e=a(()=>{"use strict";d()});import Ar from"node:path";var Dn,Q=a(()=>{"use strict";x();_e();Dn=Ar.join(".openclaw","harness")});var K=a(()=>{"use strict";k();b();N();W();Q()});var Se=a(()=>{"use strict";k();Q();K();d()});var ee=a(()=>{"use strict";Se();d()});var Ee=a(()=>{"use strict";ee();d()});var Oe=a(()=>{"use strict"});var Ce=a(()=>{"use strict";Oe();d()});var Ae=a(()=>{"use strict"});var we=a(()=>{"use strict";Ae()});var Pe=a(()=>{"use strict";we();d()});var Ie=a(()=>{"use strict"});var Ne=a(()=>{"use strict"});var Te=a(()=>{"use strict"});var re=a(()=>{"use strict"});var Ke=a(()=>{"use strict"});var We=a(()=>{"use strict";re();Ke()});var Be=a(()=>{"use strict";Ce();Pe();Ie();Ne();q();Te();We();re();d()});var Me=a(()=>{"use strict";Be()});var Br,Mr,De=a(()=>{"use strict";Re();k();b();N();W();X();ee();Ee();Me();d();Br=500*1024*1024,Mr=4*1024*1024*1024});var W=a(()=>{"use strict";De()});import{homedir as Dr}from"node:os";import Ur from"node:path";var Ue,te=a(()=>{"use strict";Ue=Ur.join(Dr(),".kynver",".env")});var Le=a(()=>{"use strict"});var Fe=a(()=>{"use strict";Le()});var $e=a(()=>{"use strict"});var ne=a(()=>{"use strict";Fe();$e()});var He=a(()=>{"use strict"});var je=a(()=>{"use strict";He()});var B=a(()=>{"use strict";te();x();k();ne();je()});var Ye=a(()=>{"use strict";b();b()});var Ve=a(()=>{"use strict";te();ne();B()});var Ge=a(()=>{"use strict";z();b();Ye();k();B();Ve();d();K()});import{existsSync as Gr,mkdirSync as Ks,readFileSync as qr,writeFileSync as Ws}from"node:fs";import{homedir as zr,totalmem as Ms}from"node:os";import oe from"node:path";function Jr(e){return{...e,...e.harnessRoot?.trim()?{harnessRoot:v(e.harnessRoot.trim())}:{},...e.defaultRepo?.trim()?{defaultRepo:v(e.defaultRepo.trim())}:{}}}function S(){if(!Gr(qe))return{};try{return Jr(JSON.parse(qr(qe,"utf8")))}catch{return{}}}var ze,qe,zs,Js,Xs,k=a(()=>{"use strict";z();x();d();b();N();W();X();B();Ge();K();ze=oe.join(zr(),".kynver"),qe=oe.join(ze,"config.json"),zs=oe.join(ze,"credentials");Js=500*1024*1024,Xs=4*1024*1024*1024});var Rr=/^claude[-_]/i,br=/^(?:opus|sonnet|haiku)\b/i;function fe(e){let r=e.trim();return Rr.test(r)||br.test(r)}function ge(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Y(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function kr(e){return ge(e)?"codex":fe(e)?"claude":(Y(e),"cursor")}function _r(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:null:null}function vr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?fe(n)||ge(n)||Y(n)?{lane:t,model:n,provider:kr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function h(e){let r=typeof e=="string"?e.trim():"";return r?_r(r)??vr(r):null}function V(e){let r=h(e);return r?!!(r.provider&&r.provider!=="cursor"||r.model&&!Y(r.model)):!1}k();var Je={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"unsupported",workerMcpToolsNote:"Codex has no per-spawn MCP config path yet wired on this box, so its workers run without Kynver tools. Redirecting CODEX_HOME per worker is the planned route."},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function E(e){return Je[e]}function Xe(){return Object.values(Je)}import{existsSync as Qr}from"node:fs";import{homedir as Zr}from"node:os";import C from"node:path";import{createHash as Qe}from"node:crypto";import{statSync as Xr}from"node:fs";import{spawnSync as Ze}from"node:child_process";function y(e){try{let r=Xr(e),t=`${e}|${r.size}|${r.mtimeMs}`;return Qe("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function O(e){return Qe("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function p(e,r){for(let t of r){let n=process.env[t]?.trim();if(n)return n}return e}function m(e,r,t={}){let n=t.timeoutMs??8e3;try{let o=Ze(e,r,{encoding:"utf8",timeout:n,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(o.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let i=(o.stderr||o.stdout||"").trim(),s=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} probe failed`}}}function M(e,r,t={}){let n=t.timeoutMs??8e3;try{return Ze(e,r,{stdio:"ignore",timeout:n,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} auth probe failed`}}}var et="codex";function rt(){let e=Zr();return[process.env.CODEX_HOME?.trim()?C.join(C.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,C.join(e,".codex","auth.json"),C.join(e,".config","codex","auth.json")].filter(t=>!!t)}function tt(e){return C.dirname(e)}function nt(e){let r,t;for(let n of rt()){if(!Qr(n))continue;r??=n;let o=m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:tt(n)}});if(t??=o,o.ok)return{authPath:n,login:o}}return{authPath:r,login:t??m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function er(e=new Date().toISOString()){let r=p(et,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:O("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:n}=nt(r),o=!!t&&n.ok;return{providerId:"codex",ready:o,authSource:"oauth_local",sessionFingerprint:t?y(t):void 0,checkedAt:e,note:o?"Local Codex OAuth session bound on runner":[n.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as ot}from"node:fs";import{homedir as it}from"node:os";import ie from"node:path";function st(){let e=process.env.HERMES_HOME?.trim(),r=e?ie.resolve(e):ie.join(it(),".hermes");return ie.join(r,"auth.json")}function D(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=st(),o=ot(n),i=M(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:o?y(n):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,o?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function A(e=new Date().toISOString()){let r=er(e);if(r.ready)return{...r,path:"codex_cli"};let t=D(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}var rr=["low","medium","high"],tr={oauth_local:0,subscription_hermes:0,runner_token:1,api_key_env:2,none:3};function nr(e,r){let t=E(e);return r==="privileged"?t.supportsPrivilegedPlatformActions:r==="low"?t.supportsLowRiskOrchestration:!0}function at(e,r){let t=E(e.providerId),n=E(r.providerId),o=rr.indexOf(t.costTier)-rr.indexOf(n.costTier);if(o!==0)return o;let i=tr[e.binding.authSource]-tr[r.binding.authSource];return i!==0?i:e.providerId.localeCompare(r.providerId)}function se(e){let r=Xe().map(l=>({providerId:l.id,binding:e.inventory.bindings[l.id]})).filter(l=>l.binding.ready&&nr(l.providerId,e.riskClass));if(r.length===0)return null;let n=[...r].sort(at)[0],o="codex";if(n.providerId===o)return{providerId:n.providerId,binding:n.binding};let i=e.inventory.bindings[o],s;return nr(o,e.riskClass)?i.ready||(s=i.note??`${o} not bound`):s=`${e.riskClass} orchestration requires privileged-capable provider`,{providerId:n.providerId,binding:n.binding,escalatedFrom:o,escalatedReason:s}}import{existsSync as lt}from"node:fs";import{homedir as ut}from"node:os";import ct from"node:path";var dt="claude";function pt(){let e=ut();return[ct.join(e,".claude",".credentials.json")]}function or(e=new Date().toISOString()){let r=p(dt,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:O("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=pt().find(s=>lt(s)),o=M(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(o.ok||!!n);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,o.note,n?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as mt}from"node:fs";import{homedir as ft}from"node:os";import ae from"node:path";var gt="agent";function ht(){let e=ft(),r=[ae.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let t=process.env.LOCALAPPDATA?.trim(),n=process.env.APPDATA?.trim();t&&r.push(ae.join(t,"cursor-agent","auth.json")),n&&r.push(ae.join(n,"cursor","auth.json"))}return r}function ir(e=new Date().toISOString()){let r=p(gt,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:O("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=m(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=ht().find(i=>mt(i)),o=!!n&&t.ok;return{providerId:"cursor",ready:o,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:o?"Local Cursor/Composer OAuth session bound on runner":[t.note,n?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as yt,readFileSync as Rt}from"node:fs";import{homedir as bt}from"node:os";import le from"node:path";var kt=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function _t(){let e=process.env.HERMES_HOME?.trim(),r=e?le.resolve(e):le.join(bt(),".hermes");return le.join(r,".env")}function vt(e){try{let r=Rt(e,"utf8"),t=[];for(let n of kt)new RegExp(`^${n}=`,"m").test(r)&&t.push(n);return t}catch{return[]}}function sr(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=_t(),o=yt(n),i=o?vt(n):[],l=i.some(u=>u.endsWith("_API_KEY"))?"api_key_env":o?"oauth_local":"none",c=t.ok&&o;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:o,authSource:l,sessionFingerprint:o?y(n):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,o?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function ar(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=A(r),n={codex:t,cursor:ir(r),claude:or(r)},o=Object.values(n).filter(i=>i.ready).length;return{generatedAt:r,bindings:n,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:sr(r),hermesOpenAiCodex:D(r),codexAdapterPath:t.path,readyCount:o}}var xt=[/\bprivileged\b/i,/\bproduction\s+db\b/i,/\bdb:push\b/i,/\bmigration\b/i,/\bdeploy\b/i,/\bsecrets?\b/i,/\bstripe\b/i,/\[require-approval\]/i,/\[operator-only\]/i],St=[/\borchestration\b/i,/\bplan[- ]?progress\b/i,/\bstatus\s+sync\b/i,/\bheartbeat\b/i,/\bboard[- ]?drain\b/i,/\bmaintenance\b/i,/\[orchestration:\s*low-risk\]/i];function ue(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Et(e){let r=ue(e,"executorRef").toLowerCase(),t=ue(e,"title").toLowerCase(),n=ue(e,"description").toLowerCase(),o=`${r}
|
|
2
2
|
${t}
|
|
3
|
-
${n}`;return xt.some(i=>i.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":
|
|
3
|
+
${n}`;return xt.some(i=>i.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":St.some(i=>i.test(o))?"low":"elevated"}function Ot(e){let r=E(e.provider),t=e.escalatedFrom&&e.escalatedReason?`Escalated from ${e.escalatedFrom} (${e.escalatedReason}); using ${r.displayName} (${r.costTier} tier)`:`${r.displayName} selected for ${e.riskClass} orchestration (${r.costTier} tier, auth=${e.authSource})`;return{provider:e.provider,model:e.model,authSource:e.authSource,costTier:r.costTier,riskClass:e.riskClass,costRationale:t,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason}}function Ct(e){let r=e.inventory??ar();return e.codexBinding?{...r,bindings:{...r.bindings,codex:e.codexBinding}}:r}function _(e){let r=Ot({provider:e.providerId,model:e.model,authSource:e.binding.authSource,riskClass:e.riskClass,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason});return{provider:e.providerId,model:e.model,rule:r.routingRule,audit:r}}function lr(e){let r=e.task??{},t=Et(r),n=Ct({inventory:e.inventory,codexBinding:e.codexBinding??(e.inventory?null:A())}),o=e.preferLowCost===!1?null:e.explicitProvider?.trim().toLowerCase(),i=e.explicitModel?.trim()||void 0,s=ce;if(o==="codex"||o==="provider:codex"){let u=n.bindings.codex;if(!u.ready){let g=se({inventory:n,riskClass:t});return _(g?{providerId:g.providerId,binding:g.binding,riskClass:t,routingRule:"orchestration:explicit_codex_unavailable_cost_aware",model:i,escalatedFrom:"codex",escalatedReason:u.note??"codex oauth not bound"}:{providerId:s,binding:n.bindings[s],riskClass:t,routingRule:"orchestration:codex_unavailable_escalate_cursor",model:i,escalatedFrom:"codex",escalatedReason:u.note??"codex oauth not bound"})}return _({providerId:"codex",binding:u,riskClass:t,routingRule:"orchestration:explicit_codex",model:i})}if(o==="cursor"||o==="provider:cursor"){let u=n.bindings.cursor;if(u.ready)return _({providerId:"cursor",binding:u,riskClass:t,routingRule:"orchestration:explicit_cursor",model:i})}if(o==="claude"||o==="provider:claude"){let u=n.bindings.claude;if(u.ready)return _({providerId:"claude",binding:u,riskClass:t,routingRule:"orchestration:explicit_claude",model:i})}let l=se({inventory:n,riskClass:t});if(l)return _({providerId:l.providerId,binding:l.binding,riskClass:t,routingRule:`orchestration:cost_aware_${l.providerId}`,model:i,escalatedFrom:l.escalatedFrom,escalatedReason:l.escalatedReason});let c=n.bindings.codex;return _({providerId:s,binding:n.bindings[s],riskClass:t,routingRule:c.ready?"orchestration:inventory_empty_default_cursor":"orchestration:codex_unavailable_default_cursor",model:i,...c.ready?{}:{escalatedFrom:"codex",escalatedReason:c.note??"codex oauth not bound"}})}G();d();var At="kynver",ur=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],wt=ur.map(e=>`mcp__${At}__${e}`);var U="claude-sonnet-4-6",w="claude-opus-4-8";d();d();var ul=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function It(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var L=It();d();var pe="openai-compatible",Bl=600*1e3;var pr="claude-sonnet-4-6",H="composer-2.5";function f(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Nt(e){if(!e)return;let r=f(e,"workerModelOverride")||f(e,"modelOverride");return r||`${f(e,"title")}
|
|
4
4
|
${f(e,"description")}
|
|
5
|
-
${f(e,"executorRef")}`.match(/\[(?:worker-)?model:\s*([^\]\n]+)\]/i)?.[1]?.trim()||void 0}function
|
|
5
|
+
${f(e,"executorRef")}`.match(/\[(?:worker-)?model:\s*([^\]\n]+)\]/i)?.[1]?.trim()||void 0}function cr(e){return e.toLowerCase()}function j(e=S()){let r=e.defaultModel?.trim();if(r)return r;let t=process.env.KYNVER_DEFAULT_MODEL?.trim();return t||pr}function F(e){let r=(e??"").toLowerCase();return!r||r.includes("composer")||r.includes("cursor")||r.includes("codex")||r.startsWith("gpt-")||r.startsWith("gpt5")?"cursor":/^claude[-_]/i.test(r)||/^(?:opus|sonnet|haiku)\b/i.test(r)?"claude":"cursor"}function Tt(e,r){let t=e.trim().toLowerCase(),n=r?.trim();return t==="cursor"?{model:H,provider:"cursor",rule:n&&n!=="cursor"?"explicit:model_provider_alias_overrode_provider":"explicit:model_provider_alias",requestedModel:e}:t==="claude"||t==="anthropic"?{model:U,provider:"claude",rule:n&&n!=="claude"?"explicit:model_provider_alias_overrode_provider":"explicit:model_provider_alias",requestedModel:e}:null}function dr(e,r){return!!(e.includes("deep")&&e.includes("review")||e.includes("security")||e.includes("plan_author")||e.includes("plan-author")||r.includes("deep review")||r.includes("security review")||e.includes("plan")&&!e.includes("review")&&(e.includes("author")||e.includes("strategy")))}var Kt=new Set(["report_reviewer","deep_reviewer","plan_reviewer"]);function mr(e,r,t){return Kt.has(e)?w:r.includes("review")||/^review[\s:]/.test(t)||t.includes("critique")?w:U}function fr(e){let r=cr(f(e,"executorRef")),t=f(e,"title").toLowerCase(),n=f(e,"priority")||"normal",o=cr(f(e,"roleLane"));if(r.includes("provider:claude")||r.startsWith("claude:")){let s=mr(o,r,t);return{provider:"claude",model:s,rule:s===w?"factory:claude_review":"factory:claude_implementation"}}if(r.includes("provider:codex")||r.startsWith("codex:"))return{provider:"codex",model:L,rule:"lane:codex_orchestration"};if(r.includes("provider:openai")||r.startsWith("openai-compatible:")){let s=h(f(e,"executorRef"));return{provider:pe,...s?.model?{model:s.model}:{},rule:"lane:openai_compatible"}}if(r.includes("cursor")||r.includes("composer")||r.includes("copilot")||o==="implementer"||o==="repair_implementer")return{provider:"cursor",rule:"lane:implementation"};if(r.includes("codex"))return{provider:"codex",model:L,rule:"lane:codex_orchestration"};if(r.includes("landing")||t.startsWith("land:")||t.includes(" merge"))return{provider:"cursor",rule:"lane:landing"};if(r.includes("review")||/^review[\s:]/.test(t)||o.includes("review"))return dr(r,t)||o==="deep_reviewer"?{provider:"cursor",rule:"lane:deep_review"}:{provider:"cursor",rule:"lane:review"};if(dr(r,t)||o==="plan_author")return{provider:"cursor",rule:"lane:planning"};if(n==="critical")return{provider:"cursor",rule:"priority:critical"};if(n==="high")return{provider:"cursor",rule:"priority:high"};if(n==="low")return{provider:"cursor",rule:"priority:low"};let i=j();return{model:i,provider:F(i),rule:"default:global"}}function Wt(e){return e?h(f(e,"executorRef")):null}function Bt(e){let r,t=Wt(e.task),n=e.explicitModel?.trim()?void 0:t?.model?.trim(),o=!e.explicitProvider?.trim()&&t?.provider?.trim()?t.provider.trim():void 0;if(e.explicitModel?.trim()){let l=e.explicitModel.trim(),c=Tt(l,e.explicitProvider);c?r=c:r={model:l,provider:e.explicitProvider?.trim()||F(l),rule:"explicit:cli",requestedModel:l}}else if(n)r={model:n,provider:o||F(n),rule:t?.rule??"executor_ref:model",requestedModel:n};else if(e.task&&$(e.task)){let l=Nt(e.task),c,u;if(l)c=l,u="task:provider_override";else{let g=typeof e.task.roleLane=="string"?e.task.roleLane.toLowerCase():"",me=typeof e.task.executorRef=="string"?e.task.executorRef.toLowerCase():"",yr=typeof e.task.title=="string"?e.task.title.toLowerCase():"";c=mr(g,me,yr),u=c===w?"factory:claude_review":"factory:claude_implementation"}r={model:c,provider:"claude",rule:u,requestedModel:c}}else if(e.task&&Object.keys(e.task).length>0){let l=fr(e.task);r={...l,requestedModel:l.model}}else{let l=j();r={model:l,provider:e.explicitProvider?.trim()||F(l),rule:"default:global",requestedModel:l}}let i=gr({routing:r,task:e.task,explicitProvider:e.explicitProvider,explicitProviderIsOperatorOverride:e.explicitProviderIsOperatorOverride});if(!e.task||Object.keys(e.task).length===0||i.rule==="explicit:model_provider_alias"||i.rule==="explicit:model_provider_alias_overrode_provider"||i.rule==="explicit:cli"||R(i.provider)&&(e.explicitProviderIsOperatorOverride||$(e.task))||i.provider===pe)return i;let s=lr({task:e.task,explicitProvider:e.explicitProvider??i.provider,explicitModel:i.model,inventory:e.orchestrationInventory??void 0});return{provider:s.provider,model:s.provider==="codex"?s.model??i.model??L:i.model,rule:s.rule,requestedModel:i.requestedModel,orchestrationAudit:s.audit}}function Mt(e,r,t){return e||r||t||j()||U}var ce="cursor";var Dt=new Set(["claude","opus","anthropic"]),Ut=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function P(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function R(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Dt.has(r)?!0:r.includes("claude")||r.includes("opus")}function $(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&R(r))return!0;let t=P(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=h(P(e,"executorRef"));if(n?.provider&&R(n.provider)||n?.model&&R(Lt(n.model)))return!0;let o=P(e,"description");if(Ut.some(s=>s.test(o)))return!0;let i=P(e,"title");return!!/\[use-claude-worker\]/i.test(i)}function Lt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Ft(e,r){return{provider:ce,model:H,rule:`policy:cursor_default${r}`,requestedModel:e}}var $t=["explicit:","executor_ref:","factory:","task:"];function Ht(e){return $t.some(r=>e.startsWith(r))}function jt(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||h(P(e,"executorRef"))?.provider?!0:$(e)}function gr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&R(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Ht(r.rule)||jt(t)||!R(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Ft(r.model,o)}function Yt(e){let r=e?.executorRef;return typeof r=="string"?r.trim():""}function hr(e){return e?.trim()||void 0}function Vt(e){let r=Yt(e.task),t=h(r),n=e.explicitProvider?.trim().toLowerCase(),o=hr(e.explicitModel??void 0),i=n||t?.provider,s=o||t?.model,l=n||o?"cli":t?.rule??"none";if(!i&&!s)return{ok:!0};!i&&s&&(/^claude[-_]/i.test(s)||/^(?:opus|sonnet|haiku)\b/i.test(s))&&(i="claude");let c=e.routing.provider,u=hr(e.routing.model),g={provider:c,model:u,rule:e.routing.rule};return i&&i!=="cursor"||r&&V(r)||n&&n!=="cursor"?c==="cursor"?{ok:!1,error:`model_routing_mismatch: requested ${i??"non-cursor"}${s?` model=${s}`:""} (${l}) but routing resolved to cursor (${e.routing.rule})`,requested:{provider:i,model:s,source:l},resolved:g}:s&&u&&s!==u&&!R(c)?{ok:!1,error:`model_routing_mismatch: requested model=${s} (${l}) but routing resolved model=${u} (${e.routing.rule})`,requested:{provider:i,model:s,source:l},resolved:g}:{ok:!0,requested:{provider:i,model:s,source:l},resolved:g}:{ok:!0,resolved:g}}export{H as CURSOR_DEFAULT_MODEL,pr as GLOBAL_DEFAULT_MODEL,Vt as assessDispatchModelGuard,V as executorRefRequestsNonCursorWorker,fr as inferModelRoutingFromTask,h as parseExecutorRefRoutingIntent,j as resolveGlobalDefaultModel,Mt as resolveModelFallback,Bt as resolveWorkerLaunch};
|
|
@@ -1,5 +1,5 @@
|
|
|
1
|
-
var a=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};import{homedir as he}from"node:os";import ye from"node:path";function xr(e){return e==="~"?he():e.startsWith("~/")||e.startsWith("~\\")?ye.join(he(),e.slice(2)):e}function x(e){return ye.resolve(xr(e))}var _=a(()=>{"use strict"});var d=a(()=>{"use strict"});var _r,Qt,Sr,en,G=a(()=>{"use strict";_r=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Qt=new Set(_r),Sr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],en=new Set(Sr)});var z=a(()=>{"use strict";_();d();G()});var q=a(()=>{"use strict";z();_()});var R=a(()=>{"use strict"});var N=a(()=>{"use strict"});var be=a(()=>{"use strict"});var gn,hn,J=a(()=>{"use strict";gn=25*1024*1024*1024,hn=12*1024*1024*1024});var kn,xn,Re=a(()=>{"use strict";J();kn=5*1024*1024*1024,xn=10*1024*1024*1024});var An,wn,X=a(()=>{"use strict";Re();J();An=30*1024*1024*1024,wn=15*1024*1024*1024});var ke=a(()=>{"use strict";d()});import Or from"node:path";var Wn,Z=a(()=>{"use strict";_();ke();Wn=Or.join(".openclaw","harness")});var B=a(()=>{"use strict";v();R();N();D();Z()});var Se=a(()=>{"use strict";v();Z();B();d()});var ee=a(()=>{"use strict";Se();d()});var Ee=a(()=>{"use strict";ee();d()});var Ce=a(()=>{"use strict"});var Oe=a(()=>{"use strict";Ce();d()});var Ae=a(()=>{"use strict"});var we=a(()=>{"use strict";Ae()});var Pe=a(()=>{"use strict";we();d()});var Ie=a(()=>{"use strict"});var Ne=a(()=>{"use strict"});var Ke=a(()=>{"use strict"});var re=a(()=>{"use strict"});var Be=a(()=>{"use strict"});var De=a(()=>{"use strict";re();Be()});var Te=a(()=>{"use strict";Oe();Pe();Ie();Ne();z();Ke();De();re();d()});var Me=a(()=>{"use strict";Te()});var Dr,Tr,We=a(()=>{"use strict";be();v();R();N();D();X();ee();Ee();Me();d();Dr=500*1024*1024,Tr=4*1024*1024*1024});var D=a(()=>{"use strict";We()});import{homedir as Mr}from"node:os";import Wr from"node:path";var Ue,te=a(()=>{"use strict";Ue=Wr.join(Mr(),".kynver",".env")});var Le=a(()=>{"use strict"});var Fe=a(()=>{"use strict";Le()});var $e=a(()=>{"use strict"});var ne=a(()=>{"use strict";Fe();$e()});var He=a(()=>{"use strict"});var je=a(()=>{"use strict";He()});var T=a(()=>{"use strict";te();_();v();ne();je()});var Ye=a(()=>{"use strict";R();R()});var Ve=a(()=>{"use strict";te();ne();T()});var Ge=a(()=>{"use strict";q();R();Ye();v();T();Ve();d();B()});import{existsSync as Vr,mkdirSync as Bs,readFileSync as Gr,writeFileSync as Ds}from"node:fs";import{homedir as zr,totalmem as Ms}from"node:os";import oe from"node:path";function qr(e){return{...e,...e.harnessRoot?.trim()?{harnessRoot:x(e.harnessRoot.trim())}:{},...e.defaultRepo?.trim()?{defaultRepo:x(e.defaultRepo.trim())}:{}}}function S(){if(!Vr(ze))return{};try{return qr(JSON.parse(Gr(ze,"utf8")))}catch{return{}}}var qe,ze,qs,Js,Xs,v=a(()=>{"use strict";q();_();d();R();N();D();X();T();Ge();B();qe=oe.join(zr(),".kynver"),ze=oe.join(qe,"config.json"),qs=oe.join(qe,"credentials");Js=500*1024*1024,Xs=4*1024*1024*1024});var yr=/^claude[-_]/i,br=/^(?:opus|sonnet|haiku)\b/i;function fe(e){let r=e.trim();return yr.test(r)||br.test(r)}function ge(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Y(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Rr(e){return ge(e)?"codex":fe(e)?"claude":(Y(e),"cursor")}function vr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:null:null}function kr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?fe(n)||ge(n)||Y(n)?{lane:t,model:n,provider:Rr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function h(e){let r=typeof e=="string"?e.trim():"";return r?vr(r)??kr(r):null}function V(e){let r=h(e);return r?!!(r.provider&&r.provider!=="cursor"||r.model&&!Y(r.model)):!1}v();var Je={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"unsupported",workerMcpToolsNote:"Codex (and the Hermes openai-codex path) has no per-spawn MCP config + tool allow-list, so a worker's toolset could not be held to the server's capability grant. Workers run without Kynver tools."},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"unsupported",workerMcpToolsNote:"Cursor configures MCP servers per workspace, not per spawn, so a task-bound token could not be scoped to one worker. Workers run without Kynver tools."},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function E(e){return Je[e]}function Xe(){return Object.values(Je)}import{existsSync as Xr}from"node:fs";import{homedir as Zr}from"node:os";import O from"node:path";import{createHash as Ze}from"node:crypto";import{statSync as Jr}from"node:fs";import{spawnSync as Qe}from"node:child_process";function y(e){try{let r=Jr(e),t=`${e}|${r.size}|${r.mtimeMs}`;return Ze("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function C(e){return Ze("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function p(e,r){for(let t of r){let n=process.env[t]?.trim();if(n)return n}return e}function m(e,r,t={}){let n=t.timeoutMs??8e3;try{let o=Qe(e,r,{encoding:"utf8",timeout:n,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(o.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let i=(o.stderr||o.stdout||"").trim(),s=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} probe failed`}}}function M(e,r,t={}){let n=t.timeoutMs??8e3;try{return Qe(e,r,{stdio:"ignore",timeout:n,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} auth probe failed`}}}var Qr="codex";function et(){let e=Zr();return[process.env.CODEX_HOME?.trim()?O.join(O.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,O.join(e,".codex","auth.json"),O.join(e,".config","codex","auth.json")].filter(t=>!!t)}function rt(e){return O.dirname(e)}function tt(e){let r,t;for(let n of et()){if(!Xr(n))continue;r??=n;let o=m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:rt(n)}});if(t??=o,o.ok)return{authPath:n,login:o}}return{authPath:r,login:t??m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function er(e=new Date().toISOString()){let r=p(Qr,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:C("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:n}=tt(r),o=!!t&&n.ok;return{providerId:"codex",ready:o,authSource:"oauth_local",sessionFingerprint:t?y(t):void 0,checkedAt:e,note:o?"Local Codex OAuth session bound on runner":[n.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as nt}from"node:fs";import{homedir as ot}from"node:os";import ie from"node:path";function it(){let e=process.env.HERMES_HOME?.trim(),r=e?ie.resolve(e):ie.join(ot(),".hermes");return ie.join(r,"auth.json")}function W(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=it(),o=nt(n),i=M(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:o?y(n):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,o?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function A(e=new Date().toISOString()){let r=er(e);if(r.ready)return{...r,path:"codex_cli"};let t=W(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}var rr=["low","medium","high"],tr={oauth_local:0,subscription_hermes:0,runner_token:1,api_key_env:2,none:3};function nr(e,r){let t=E(e);return r==="privileged"?t.supportsPrivilegedPlatformActions:r==="low"?t.supportsLowRiskOrchestration:!0}function st(e,r){let t=E(e.providerId),n=E(r.providerId),o=rr.indexOf(t.costTier)-rr.indexOf(n.costTier);if(o!==0)return o;let i=tr[e.binding.authSource]-tr[r.binding.authSource];return i!==0?i:e.providerId.localeCompare(r.providerId)}function se(e){let r=Xe().map(l=>({providerId:l.id,binding:e.inventory.bindings[l.id]})).filter(l=>l.binding.ready&&nr(l.providerId,e.riskClass));if(r.length===0)return null;let n=[...r].sort(st)[0],o="codex";if(n.providerId===o)return{providerId:n.providerId,binding:n.binding};let i=e.inventory.bindings[o],s;return nr(o,e.riskClass)?i.ready||(s=i.note??`${o} not bound`):s=`${e.riskClass} orchestration requires privileged-capable provider`,{providerId:n.providerId,binding:n.binding,escalatedFrom:o,escalatedReason:s}}import{existsSync as at}from"node:fs";import{homedir as lt}from"node:os";import ut from"node:path";var ct="claude";function dt(){let e=lt();return[ut.join(e,".claude",".credentials.json")]}function or(e=new Date().toISOString()){let r=p(ct,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:C("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=dt().find(s=>at(s)),o=M(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(o.ok||!!n);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,o.note,n?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as pt}from"node:fs";import{homedir as mt}from"node:os";import ae from"node:path";var ft="agent";function gt(){let e=mt(),r=[ae.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let t=process.env.LOCALAPPDATA?.trim(),n=process.env.APPDATA?.trim();t&&r.push(ae.join(t,"cursor-agent","auth.json")),n&&r.push(ae.join(n,"cursor","auth.json"))}return r}function ir(e=new Date().toISOString()){let r=p(ft,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:C("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=m(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=gt().find(i=>pt(i)),o=!!n&&t.ok;return{providerId:"cursor",ready:o,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:o?"Local Cursor/Composer OAuth session bound on runner":[t.note,n?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as ht,readFileSync as yt}from"node:fs";import{homedir as bt}from"node:os";import le from"node:path";var Rt=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function vt(){let e=process.env.HERMES_HOME?.trim(),r=e?le.resolve(e):le.join(bt(),".hermes");return le.join(r,".env")}function kt(e){try{let r=yt(e,"utf8"),t=[];for(let n of Rt)new RegExp(`^${n}=`,"m").test(r)&&t.push(n);return t}catch{return[]}}function sr(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=vt(),o=ht(n),i=o?kt(n):[],l=i.some(u=>u.endsWith("_API_KEY"))?"api_key_env":o?"oauth_local":"none",c=t.ok&&o;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:o,authSource:l,sessionFingerprint:o?y(n):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,o?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function ar(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=A(r),n={codex:t,cursor:ir(r),claude:or(r)},o=Object.values(n).filter(i=>i.ready).length;return{generatedAt:r,bindings:n,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:sr(r),hermesOpenAiCodex:W(r),codexAdapterPath:t.path,readyCount:o}}var xt=[/\bprivileged\b/i,/\bproduction\s+db\b/i,/\bdb:push\b/i,/\bmigration\b/i,/\bdeploy\b/i,/\bsecrets?\b/i,/\bstripe\b/i,/\[require-approval\]/i,/\[operator-only\]/i],_t=[/\borchestration\b/i,/\bplan[- ]?progress\b/i,/\bstatus\s+sync\b/i,/\bheartbeat\b/i,/\bboard[- ]?drain\b/i,/\bmaintenance\b/i,/\[orchestration:\s*low-risk\]/i];function ue(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function St(e){let r=ue(e,"executorRef").toLowerCase(),t=ue(e,"title").toLowerCase(),n=ue(e,"description").toLowerCase(),o=`${r}
|
|
1
|
+
var a=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};import{homedir as he}from"node:os";import ye from"node:path";function xr(e){return e==="~"?he():e.startsWith("~/")||e.startsWith("~\\")?ye.join(he(),e.slice(2)):e}function v(e){return ye.resolve(xr(e))}var x=a(()=>{"use strict"});var d=a(()=>{"use strict"});var Sr,Zt,Er,en,G=a(()=>{"use strict";Sr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Zt=new Set(Sr),Er=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],en=new Set(Er)});var q=a(()=>{"use strict";x();d();G()});var z=a(()=>{"use strict";q();x()});var b=a(()=>{"use strict"});var N=a(()=>{"use strict"});var Re=a(()=>{"use strict"});var gn,hn,J=a(()=>{"use strict";gn=25*1024*1024*1024,hn=12*1024*1024*1024});var _n,vn,be=a(()=>{"use strict";J();_n=5*1024*1024*1024,vn=10*1024*1024*1024});var An,wn,X=a(()=>{"use strict";be();J();An=30*1024*1024*1024,wn=15*1024*1024*1024});var _e=a(()=>{"use strict";d()});import Ar from"node:path";var Dn,Q=a(()=>{"use strict";x();_e();Dn=Ar.join(".openclaw","harness")});var K=a(()=>{"use strict";k();b();N();W();Q()});var Se=a(()=>{"use strict";k();Q();K();d()});var ee=a(()=>{"use strict";Se();d()});var Ee=a(()=>{"use strict";ee();d()});var Oe=a(()=>{"use strict"});var Ce=a(()=>{"use strict";Oe();d()});var Ae=a(()=>{"use strict"});var we=a(()=>{"use strict";Ae()});var Pe=a(()=>{"use strict";we();d()});var Ie=a(()=>{"use strict"});var Ne=a(()=>{"use strict"});var Te=a(()=>{"use strict"});var re=a(()=>{"use strict"});var Ke=a(()=>{"use strict"});var We=a(()=>{"use strict";re();Ke()});var Be=a(()=>{"use strict";Ce();Pe();Ie();Ne();q();Te();We();re();d()});var Me=a(()=>{"use strict";Be()});var Br,Mr,De=a(()=>{"use strict";Re();k();b();N();W();X();ee();Ee();Me();d();Br=500*1024*1024,Mr=4*1024*1024*1024});var W=a(()=>{"use strict";De()});import{homedir as Dr}from"node:os";import Ur from"node:path";var Ue,te=a(()=>{"use strict";Ue=Ur.join(Dr(),".kynver",".env")});var Le=a(()=>{"use strict"});var Fe=a(()=>{"use strict";Le()});var $e=a(()=>{"use strict"});var ne=a(()=>{"use strict";Fe();$e()});var He=a(()=>{"use strict"});var je=a(()=>{"use strict";He()});var B=a(()=>{"use strict";te();x();k();ne();je()});var Ye=a(()=>{"use strict";b();b()});var Ve=a(()=>{"use strict";te();ne();B()});var Ge=a(()=>{"use strict";z();b();Ye();k();B();Ve();d();K()});import{existsSync as Gr,mkdirSync as Ks,readFileSync as qr,writeFileSync as Ws}from"node:fs";import{homedir as zr,totalmem as Ms}from"node:os";import oe from"node:path";function Jr(e){return{...e,...e.harnessRoot?.trim()?{harnessRoot:v(e.harnessRoot.trim())}:{},...e.defaultRepo?.trim()?{defaultRepo:v(e.defaultRepo.trim())}:{}}}function S(){if(!Gr(qe))return{};try{return Jr(JSON.parse(qr(qe,"utf8")))}catch{return{}}}var ze,qe,zs,Js,Xs,k=a(()=>{"use strict";z();x();d();b();N();W();X();B();Ge();K();ze=oe.join(zr(),".kynver"),qe=oe.join(ze,"config.json"),zs=oe.join(ze,"credentials");Js=500*1024*1024,Xs=4*1024*1024*1024});var Rr=/^claude[-_]/i,br=/^(?:opus|sonnet|haiku)\b/i;function fe(e){let r=e.trim();return Rr.test(r)||br.test(r)}function ge(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Y(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function kr(e){return ge(e)?"codex":fe(e)?"claude":(Y(e),"cursor")}function _r(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:null:null}function vr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?fe(n)||ge(n)||Y(n)?{lane:t,model:n,provider:kr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function h(e){let r=typeof e=="string"?e.trim():"";return r?_r(r)??vr(r):null}function V(e){let r=h(e);return r?!!(r.provider&&r.provider!=="cursor"||r.model&&!Y(r.model)):!1}k();var Je={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"unsupported",workerMcpToolsNote:"Codex has no per-spawn MCP config path yet wired on this box, so its workers run without Kynver tools. Redirecting CODEX_HOME per worker is the planned route."},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function E(e){return Je[e]}function Xe(){return Object.values(Je)}import{existsSync as Qr}from"node:fs";import{homedir as Zr}from"node:os";import C from"node:path";import{createHash as Qe}from"node:crypto";import{statSync as Xr}from"node:fs";import{spawnSync as Ze}from"node:child_process";function y(e){try{let r=Xr(e),t=`${e}|${r.size}|${r.mtimeMs}`;return Qe("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function O(e){return Qe("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function p(e,r){for(let t of r){let n=process.env[t]?.trim();if(n)return n}return e}function m(e,r,t={}){let n=t.timeoutMs??8e3;try{let o=Ze(e,r,{encoding:"utf8",timeout:n,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(o.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let i=(o.stderr||o.stdout||"").trim(),s=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} probe failed`}}}function M(e,r,t={}){let n=t.timeoutMs??8e3;try{return Ze(e,r,{stdio:"ignore",timeout:n,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(o){return{ok:!1,note:o instanceof Error?o.message:`${e} auth probe failed`}}}var et="codex";function rt(){let e=Zr();return[process.env.CODEX_HOME?.trim()?C.join(C.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,C.join(e,".codex","auth.json"),C.join(e,".config","codex","auth.json")].filter(t=>!!t)}function tt(e){return C.dirname(e)}function nt(e){let r,t;for(let n of rt()){if(!Qr(n))continue;r??=n;let o=m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:tt(n)}});if(t??=o,o.ok)return{authPath:n,login:o}}return{authPath:r,login:t??m(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function er(e=new Date().toISOString()){let r=p(et,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:O("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:n}=nt(r),o=!!t&&n.ok;return{providerId:"codex",ready:o,authSource:"oauth_local",sessionFingerprint:t?y(t):void 0,checkedAt:e,note:o?"Local Codex OAuth session bound on runner":[n.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as ot}from"node:fs";import{homedir as it}from"node:os";import ie from"node:path";function st(){let e=process.env.HERMES_HOME?.trim(),r=e?ie.resolve(e):ie.join(it(),".hermes");return ie.join(r,"auth.json")}function D(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=st(),o=ot(n),i=M(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:o?y(n):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,o?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function A(e=new Date().toISOString()){let r=er(e);if(r.ready)return{...r,path:"codex_cli"};let t=D(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}var rr=["low","medium","high"],tr={oauth_local:0,subscription_hermes:0,runner_token:1,api_key_env:2,none:3};function nr(e,r){let t=E(e);return r==="privileged"?t.supportsPrivilegedPlatformActions:r==="low"?t.supportsLowRiskOrchestration:!0}function at(e,r){let t=E(e.providerId),n=E(r.providerId),o=rr.indexOf(t.costTier)-rr.indexOf(n.costTier);if(o!==0)return o;let i=tr[e.binding.authSource]-tr[r.binding.authSource];return i!==0?i:e.providerId.localeCompare(r.providerId)}function se(e){let r=Xe().map(l=>({providerId:l.id,binding:e.inventory.bindings[l.id]})).filter(l=>l.binding.ready&&nr(l.providerId,e.riskClass));if(r.length===0)return null;let n=[...r].sort(at)[0],o="codex";if(n.providerId===o)return{providerId:n.providerId,binding:n.binding};let i=e.inventory.bindings[o],s;return nr(o,e.riskClass)?i.ready||(s=i.note??`${o} not bound`):s=`${e.riskClass} orchestration requires privileged-capable provider`,{providerId:n.providerId,binding:n.binding,escalatedFrom:o,escalatedReason:s}}import{existsSync as lt}from"node:fs";import{homedir as ut}from"node:os";import ct from"node:path";var dt="claude";function pt(){let e=ut();return[ct.join(e,".claude",".credentials.json")]}function or(e=new Date().toISOString()){let r=p(dt,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:O("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=pt().find(s=>lt(s)),o=M(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(o.ok||!!n);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,o.note,n?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as mt}from"node:fs";import{homedir as ft}from"node:os";import ae from"node:path";var gt="agent";function ht(){let e=ft(),r=[ae.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let t=process.env.LOCALAPPDATA?.trim(),n=process.env.APPDATA?.trim();t&&r.push(ae.join(t,"cursor-agent","auth.json")),n&&r.push(ae.join(n,"cursor","auth.json"))}return r}function ir(e=new Date().toISOString()){let r=p(gt,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:O("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=m(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=ht().find(i=>mt(i)),o=!!n&&t.ok;return{providerId:"cursor",ready:o,authSource:"oauth_local",sessionFingerprint:n?y(n):void 0,checkedAt:e,note:o?"Local Cursor/Composer OAuth session bound on runner":[t.note,n?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as yt,readFileSync as Rt}from"node:fs";import{homedir as bt}from"node:os";import le from"node:path";var kt=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function _t(){let e=process.env.HERMES_HOME?.trim(),r=e?le.resolve(e):le.join(bt(),".hermes");return le.join(r,".env")}function vt(e){try{let r=Rt(e,"utf8"),t=[];for(let n of kt)new RegExp(`^${n}=`,"m").test(r)&&t.push(n);return t}catch{return[]}}function sr(e=new Date().toISOString()){let r=p("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=m(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),n=_t(),o=yt(n),i=o?vt(n):[],l=i.some(u=>u.endsWith("_API_KEY"))?"api_key_env":o?"oauth_local":"none",c=t.ok&&o;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:o,authSource:l,sessionFingerprint:o?y(n):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,o?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function ar(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=A(r),n={codex:t,cursor:ir(r),claude:or(r)},o=Object.values(n).filter(i=>i.ready).length;return{generatedAt:r,bindings:n,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:sr(r),hermesOpenAiCodex:D(r),codexAdapterPath:t.path,readyCount:o}}var xt=[/\bprivileged\b/i,/\bproduction\s+db\b/i,/\bdb:push\b/i,/\bmigration\b/i,/\bdeploy\b/i,/\bsecrets?\b/i,/\bstripe\b/i,/\[require-approval\]/i,/\[operator-only\]/i],St=[/\borchestration\b/i,/\bplan[- ]?progress\b/i,/\bstatus\s+sync\b/i,/\bheartbeat\b/i,/\bboard[- ]?drain\b/i,/\bmaintenance\b/i,/\[orchestration:\s*low-risk\]/i];function ue(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Et(e){let r=ue(e,"executorRef").toLowerCase(),t=ue(e,"title").toLowerCase(),n=ue(e,"description").toLowerCase(),o=`${r}
|
|
2
2
|
${t}
|
|
3
|
-
${n}`;return xt.some(i=>i.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":
|
|
3
|
+
${n}`;return xt.some(i=>i.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":St.some(i=>i.test(o))?"low":"elevated"}function Ot(e){let r=E(e.provider),t=e.escalatedFrom&&e.escalatedReason?`Escalated from ${e.escalatedFrom} (${e.escalatedReason}); using ${r.displayName} (${r.costTier} tier)`:`${r.displayName} selected for ${e.riskClass} orchestration (${r.costTier} tier, auth=${e.authSource})`;return{provider:e.provider,model:e.model,authSource:e.authSource,costTier:r.costTier,riskClass:e.riskClass,costRationale:t,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason}}function Ct(e){let r=e.inventory??ar();return e.codexBinding?{...r,bindings:{...r.bindings,codex:e.codexBinding}}:r}function _(e){let r=Ot({provider:e.providerId,model:e.model,authSource:e.binding.authSource,riskClass:e.riskClass,routingRule:e.routingRule,escalatedFrom:e.escalatedFrom,escalatedReason:e.escalatedReason});return{provider:e.providerId,model:e.model,rule:r.routingRule,audit:r}}function lr(e){let r=e.task??{},t=Et(r),n=Ct({inventory:e.inventory,codexBinding:e.codexBinding??(e.inventory?null:A())}),o=e.preferLowCost===!1?null:e.explicitProvider?.trim().toLowerCase(),i=e.explicitModel?.trim()||void 0,s=ce;if(o==="codex"||o==="provider:codex"){let u=n.bindings.codex;if(!u.ready){let g=se({inventory:n,riskClass:t});return _(g?{providerId:g.providerId,binding:g.binding,riskClass:t,routingRule:"orchestration:explicit_codex_unavailable_cost_aware",model:i,escalatedFrom:"codex",escalatedReason:u.note??"codex oauth not bound"}:{providerId:s,binding:n.bindings[s],riskClass:t,routingRule:"orchestration:codex_unavailable_escalate_cursor",model:i,escalatedFrom:"codex",escalatedReason:u.note??"codex oauth not bound"})}return _({providerId:"codex",binding:u,riskClass:t,routingRule:"orchestration:explicit_codex",model:i})}if(o==="cursor"||o==="provider:cursor"){let u=n.bindings.cursor;if(u.ready)return _({providerId:"cursor",binding:u,riskClass:t,routingRule:"orchestration:explicit_cursor",model:i})}if(o==="claude"||o==="provider:claude"){let u=n.bindings.claude;if(u.ready)return _({providerId:"claude",binding:u,riskClass:t,routingRule:"orchestration:explicit_claude",model:i})}let l=se({inventory:n,riskClass:t});if(l)return _({providerId:l.providerId,binding:l.binding,riskClass:t,routingRule:`orchestration:cost_aware_${l.providerId}`,model:i,escalatedFrom:l.escalatedFrom,escalatedReason:l.escalatedReason});let c=n.bindings.codex;return _({providerId:s,binding:n.bindings[s],riskClass:t,routingRule:c.ready?"orchestration:inventory_empty_default_cursor":"orchestration:codex_unavailable_default_cursor",model:i,...c.ready?{}:{escalatedFrom:"codex",escalatedReason:c.note??"codex oauth not bound"}})}G();d();var At="kynver",ur=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],wt=ur.map(e=>`mcp__${At}__${e}`);var U="claude-sonnet-4-6",w="claude-opus-4-8";d();d();var ul=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function It(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var L=It();d();var pe="openai-compatible",Bl=600*1e3;var pr="claude-sonnet-4-6",H="composer-2.5";function f(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function Nt(e){if(!e)return;let r=f(e,"workerModelOverride")||f(e,"modelOverride");return r||`${f(e,"title")}
|
|
4
4
|
${f(e,"description")}
|
|
5
|
-
${f(e,"executorRef")}`.match(/\[(?:worker-)?model:\s*([^\]\n]+)\]/i)?.[1]?.trim()||void 0}function
|
|
5
|
+
${f(e,"executorRef")}`.match(/\[(?:worker-)?model:\s*([^\]\n]+)\]/i)?.[1]?.trim()||void 0}function cr(e){return e.toLowerCase()}function j(e=S()){let r=e.defaultModel?.trim();if(r)return r;let t=process.env.KYNVER_DEFAULT_MODEL?.trim();return t||pr}function F(e){let r=(e??"").toLowerCase();return!r||r.includes("composer")||r.includes("cursor")||r.includes("codex")||r.startsWith("gpt-")||r.startsWith("gpt5")?"cursor":/^claude[-_]/i.test(r)||/^(?:opus|sonnet|haiku)\b/i.test(r)?"claude":"cursor"}function Tt(e,r){let t=e.trim().toLowerCase(),n=r?.trim();return t==="cursor"?{model:H,provider:"cursor",rule:n&&n!=="cursor"?"explicit:model_provider_alias_overrode_provider":"explicit:model_provider_alias",requestedModel:e}:t==="claude"||t==="anthropic"?{model:U,provider:"claude",rule:n&&n!=="claude"?"explicit:model_provider_alias_overrode_provider":"explicit:model_provider_alias",requestedModel:e}:null}function dr(e,r){return!!(e.includes("deep")&&e.includes("review")||e.includes("security")||e.includes("plan_author")||e.includes("plan-author")||r.includes("deep review")||r.includes("security review")||e.includes("plan")&&!e.includes("review")&&(e.includes("author")||e.includes("strategy")))}var Kt=new Set(["report_reviewer","deep_reviewer","plan_reviewer"]);function mr(e,r,t){return Kt.has(e)?w:r.includes("review")||/^review[\s:]/.test(t)||t.includes("critique")?w:U}function fr(e){let r=cr(f(e,"executorRef")),t=f(e,"title").toLowerCase(),n=f(e,"priority")||"normal",o=cr(f(e,"roleLane"));if(r.includes("provider:claude")||r.startsWith("claude:")){let s=mr(o,r,t);return{provider:"claude",model:s,rule:s===w?"factory:claude_review":"factory:claude_implementation"}}if(r.includes("provider:codex")||r.startsWith("codex:"))return{provider:"codex",model:L,rule:"lane:codex_orchestration"};if(r.includes("provider:openai")||r.startsWith("openai-compatible:")){let s=h(f(e,"executorRef"));return{provider:pe,...s?.model?{model:s.model}:{},rule:"lane:openai_compatible"}}if(r.includes("cursor")||r.includes("composer")||r.includes("copilot")||o==="implementer"||o==="repair_implementer")return{provider:"cursor",rule:"lane:implementation"};if(r.includes("codex"))return{provider:"codex",model:L,rule:"lane:codex_orchestration"};if(r.includes("landing")||t.startsWith("land:")||t.includes(" merge"))return{provider:"cursor",rule:"lane:landing"};if(r.includes("review")||/^review[\s:]/.test(t)||o.includes("review"))return dr(r,t)||o==="deep_reviewer"?{provider:"cursor",rule:"lane:deep_review"}:{provider:"cursor",rule:"lane:review"};if(dr(r,t)||o==="plan_author")return{provider:"cursor",rule:"lane:planning"};if(n==="critical")return{provider:"cursor",rule:"priority:critical"};if(n==="high")return{provider:"cursor",rule:"priority:high"};if(n==="low")return{provider:"cursor",rule:"priority:low"};let i=j();return{model:i,provider:F(i),rule:"default:global"}}function Wt(e){return e?h(f(e,"executorRef")):null}function Bt(e){let r,t=Wt(e.task),n=e.explicitModel?.trim()?void 0:t?.model?.trim(),o=!e.explicitProvider?.trim()&&t?.provider?.trim()?t.provider.trim():void 0;if(e.explicitModel?.trim()){let l=e.explicitModel.trim(),c=Tt(l,e.explicitProvider);c?r=c:r={model:l,provider:e.explicitProvider?.trim()||F(l),rule:"explicit:cli",requestedModel:l}}else if(n)r={model:n,provider:o||F(n),rule:t?.rule??"executor_ref:model",requestedModel:n};else if(e.task&&$(e.task)){let l=Nt(e.task),c,u;if(l)c=l,u="task:provider_override";else{let g=typeof e.task.roleLane=="string"?e.task.roleLane.toLowerCase():"",me=typeof e.task.executorRef=="string"?e.task.executorRef.toLowerCase():"",yr=typeof e.task.title=="string"?e.task.title.toLowerCase():"";c=mr(g,me,yr),u=c===w?"factory:claude_review":"factory:claude_implementation"}r={model:c,provider:"claude",rule:u,requestedModel:c}}else if(e.task&&Object.keys(e.task).length>0){let l=fr(e.task);r={...l,requestedModel:l.model}}else{let l=j();r={model:l,provider:e.explicitProvider?.trim()||F(l),rule:"default:global",requestedModel:l}}let i=gr({routing:r,task:e.task,explicitProvider:e.explicitProvider,explicitProviderIsOperatorOverride:e.explicitProviderIsOperatorOverride});if(!e.task||Object.keys(e.task).length===0||i.rule==="explicit:model_provider_alias"||i.rule==="explicit:model_provider_alias_overrode_provider"||i.rule==="explicit:cli"||R(i.provider)&&(e.explicitProviderIsOperatorOverride||$(e.task))||i.provider===pe)return i;let s=lr({task:e.task,explicitProvider:e.explicitProvider??i.provider,explicitModel:i.model,inventory:e.orchestrationInventory??void 0});return{provider:s.provider,model:s.provider==="codex"?s.model??i.model??L:i.model,rule:s.rule,requestedModel:i.requestedModel,orchestrationAudit:s.audit}}function Mt(e,r,t){return e||r||t||j()||U}var ce="cursor";var Dt=new Set(["claude","opus","anthropic"]),Ut=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function P(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function R(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Dt.has(r)?!0:r.includes("claude")||r.includes("opus")}function $(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&R(r))return!0;let t=P(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=h(P(e,"executorRef"));if(n?.provider&&R(n.provider)||n?.model&&R(Lt(n.model)))return!0;let o=P(e,"description");if(Ut.some(s=>s.test(o)))return!0;let i=P(e,"title");return!!/\[use-claude-worker\]/i.test(i)}function Lt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Ft(e,r){return{provider:ce,model:H,rule:`policy:cursor_default${r}`,requestedModel:e}}var $t=["explicit:","executor_ref:","factory:","task:"];function Ht(e){return $t.some(r=>e.startsWith(r))}function jt(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||h(P(e,"executorRef"))?.provider?!0:$(e)}function gr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&R(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Ht(r.rule)||jt(t)||!R(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Ft(r.model,o)}function Yt(e){let r=e?.executorRef;return typeof r=="string"?r.trim():""}function hr(e){return e?.trim()||void 0}function Vt(e){let r=Yt(e.task),t=h(r),n=e.explicitProvider?.trim().toLowerCase(),o=hr(e.explicitModel??void 0),i=n||t?.provider,s=o||t?.model,l=n||o?"cli":t?.rule??"none";if(!i&&!s)return{ok:!0};!i&&s&&(/^claude[-_]/i.test(s)||/^(?:opus|sonnet|haiku)\b/i.test(s))&&(i="claude");let c=e.routing.provider,u=hr(e.routing.model),g={provider:c,model:u,rule:e.routing.rule};return i&&i!=="cursor"||r&&V(r)||n&&n!=="cursor"?c==="cursor"?{ok:!1,error:`model_routing_mismatch: requested ${i??"non-cursor"}${s?` model=${s}`:""} (${l}) but routing resolved to cursor (${e.routing.rule})`,requested:{provider:i,model:s,source:l},resolved:g}:s&&u&&s!==u&&!R(c)?{ok:!1,error:`model_routing_mismatch: requested model=${s} (${l}) but routing resolved model=${u} (${e.routing.rule})`,requested:{provider:i,model:s,source:l},resolved:g}:{ok:!0,requested:{provider:i,model:s,source:l},resolved:g}:{ok:!0,resolved:g}}export{H as CURSOR_DEFAULT_MODEL,pr as GLOBAL_DEFAULT_MODEL,Vt as assessDispatchModelGuard,V as executorRefRequestsNonCursorWorker,fr as inferModelRoutingFromTask,h as parseExecutorRefRoutingIntent,j as resolveGlobalDefaultModel,Mt as resolveModelFallback,Bt as resolveWorkerLaunch};
|
|
@@ -1 +1 @@
|
|
|
1
|
-
import{existsSync as K}from"node:fs";import{homedir as H}from"node:os";import T from"node:path";import{createHash as _}from"node:crypto";import{statSync as R}from"node:fs";import{spawnSync as x}from"node:child_process";function c(e){try{let t=R(e),o=`${e}|${t.size}|${t.mtimeMs}`;return _("sha256").update(o).digest("hex").slice(0,16)}catch{return}}function u(e){return _("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,t){for(let o of t){let r=process.env[o]?.trim();if(r)return r}return e}function a(e,t,o={}){let r=o.timeoutMs??8e3;try{let n=x(e,t,{encoding:"utf8",timeout:r,env:{...process.env,...o.env,CI:"1",NO_COLOR:"1"}});if(n.status===0)return{ok:!0,note:o.okNote??`${e} ${t.join(" ")}: ok`};let i=(n.stderr||n.stdout||"").trim(),s=o.failPrefix??`${e} ${t.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function h(e,t,o={}){let r=o.timeoutMs??8e3;try{return x(e,t,{stdio:"ignore",timeout:r,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:o.okNote??`${e} authenticated`}:{ok:!1,note:o.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var j="claude";function L(){let e=H();return[T.join(e,".claude",".credentials.json")]}function P(e=new Date().toISOString()){let t=d(j,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:u("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let o=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),r=L().find(s=>K(s)),n=h(t,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=o.ok&&(n.ok||!!r);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:r?c(r):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[o.note,n.note,r?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as M}from"node:fs";import{homedir as D}from"node:os";import p from"node:path";var w="codex";function Y(){let e=D();return[process.env.CODEX_HOME?.trim()?p.join(p.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,p.join(e,".codex","auth.json"),p.join(e,".config","codex","auth.json")].filter(o=>!!o)}function $(e){return p.dirname(e)}function F(e){let t,o;for(let r of Y()){if(!M(r))continue;t??=r;let n=a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:$(r)}});if(o??=n,n.ok)return{authPath:r,login:n}}return{authPath:t,login:o??a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function I(e=new Date().toISOString()){let t=d(w,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:u("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:o,login:r}=F(t),n=!!o&&r.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:o?c(o):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[r.note,o?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as U}from"node:fs";import{homedir as V}from"node:os";import O from"node:path";function X(){let e=process.env.HERMES_HOME?.trim(),t=e?O.resolve(e):O.join(V(),".hermes");return O.join(t,"auth.json")}function f(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),o=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),r=X(),n=U(r),i=h(t,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=o.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?c(r):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[o.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function S(e=new Date().toISOString()){let t=I(e);if(t.ready)return{...t,path:"codex_cli"};let o=f(e);return o.ready?{providerId:"codex",ready:!0,authSource:o.authSource,sessionFingerprint:o.sessionFingerprint,checkedAt:o.checkedAt,note:o.note,path:"hermes_openai_codex",hermesOpenAiCodex:o}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:o,note:[t.note,o.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as W}from"node:fs";import{homedir as G}from"node:os";import g from"node:path";var J="agent";function z(){let e=G(),t=[g.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let o=process.env.LOCALAPPDATA?.trim(),r=process.env.APPDATA?.trim();o&&t.push(g.join(o,"cursor-agent","auth.json")),r&&t.push(g.join(r,"cursor","auth.json"))}return t}function E(e=new Date().toISOString()){let t=d(J,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:u("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let o=a(t,["-v"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),r=z().find(i=>W(i)),n=!!r&&o.ok;return{providerId:"cursor",ready:n,authSource:"oauth_local",sessionFingerprint:r?c(r):void 0,checkedAt:e,note:n?"Local Cursor/Composer OAuth session bound on runner":[o.note,r?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as q,readFileSync as Q}from"node:fs";import{homedir as Z}from"node:os";import C from"node:path";var ee=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function te(){let e=process.env.HERMES_HOME?.trim(),t=e?C.resolve(e):C.join(Z(),".hermes");return C.join(t,".env")}function oe(e){try{let t=Q(e,"utf8"),o=[];for(let r of ee)new RegExp(`^${r}=`,"m").test(t)&&o.push(r);return o}catch{return[]}}function b(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),o=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),r=te(),n=q(r),i=n?oe(r):[],A=i.some(B=>B.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",N=o.ok&&n;return{adapterId:"hermes",cliAvailable:o.ok,profileBound:n,authSource:A,sessionFingerprint:n?c(r):void 0,checkedAt:e,note:N?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[o.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function re(e={}){let t=e.nowIso?.()??new Date().toISOString(),o=S(t),r={codex:o,cursor:E(t),claude:P(t)},n=Object.values(r).filter(i=>i.ready).length;return{generatedAt:t,bindings:r,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:b(t),hermesOpenAiCodex:f(t),codexAdapterPath:o.path,readyCount:n}}var ne={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"unsupported",workerMcpToolsNote:"Codex (and the Hermes openai-codex path) has no per-spawn MCP config + tool allow-list, so a worker's toolset could not be held to the server's capability grant. Workers run without Kynver tools."},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"unsupported",workerMcpToolsNote:"Cursor configures MCP servers per workspace, not per spawn, so a task-bound token could not be scoped to one worker. Workers run without Kynver tools."},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function ie(){return Object.values(ne)}var k=["off","observe","enforce"];function se(e){let t=(e??"off").trim().toLowerCase();return k.includes(t)?t:"off"}function m(e=process.env){return se(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function y(e=process.env){let t=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return t?t==="1"||t==="true"||t==="yes"||t==="on":m(e)==="enforce"}import{createHash as ae}from"node:crypto";function l(e){if(e==null)return null;let t=e.trim();return t.length?t:null}function v(e){let t=l(e.sessionId)??"anonymous",o=l(e.title)??l(e.action)??"foreground",r=ae("sha256").update([l(e.planId)??"",l(e.parentTaskId)??"",o.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${t}:${r}`}function ce(e,t){return e==="enforce"&&t?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function de(e,t=process.env){let o=m(t),r=y(t),n=ce(o,r),i=n==="enforce_harness_task"?v({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return o==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:o,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{v as buildForegroundHarnessIdempotencyKey,re as buildOrchestrationProviderInventory,de as evaluateOrchestrationPolicy,y as isOrchestrationEnforceTasksEnabled,ie as listOrchestrationProviderCapabilities,m as resolveOrchestrationPolicyMode};
|
|
1
|
+
import{existsSync as K}from"node:fs";import{homedir as H}from"node:os";import T from"node:path";import{createHash as _}from"node:crypto";import{statSync as R}from"node:fs";import{spawnSync as x}from"node:child_process";function c(e){try{let t=R(e),r=`${e}|${t.size}|${t.mtimeMs}`;return _("sha256").update(r).digest("hex").slice(0,16)}catch{return}}function u(e){return _("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,t){for(let r of t){let o=process.env[r]?.trim();if(o)return o}return e}function a(e,t,r={}){let o=r.timeoutMs??8e3;try{let n=x(e,t,{encoding:"utf8",timeout:o,env:{...process.env,...r.env,CI:"1",NO_COLOR:"1"}});if(n.status===0)return{ok:!0,note:r.okNote??`${e} ${t.join(" ")}: ok`};let i=(n.stderr||n.stdout||"").trim(),s=r.failPrefix??`${e} ${t.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function h(e,t,r={}){let o=r.timeoutMs??8e3;try{return x(e,t,{stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:r.okNote??`${e} authenticated`}:{ok:!1,note:r.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var j="claude";function L(){let e=H();return[T.join(e,".claude",".credentials.json")]}function P(e=new Date().toISOString()){let t=d(j,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:u("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let r=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=L().find(s=>K(s)),n=h(t,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=r.ok&&(n.ok||!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?c(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[r.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as M}from"node:fs";import{homedir as D}from"node:os";import p from"node:path";var Y="codex";function w(){let e=D();return[process.env.CODEX_HOME?.trim()?p.join(p.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,p.join(e,".codex","auth.json"),p.join(e,".config","codex","auth.json")].filter(r=>!!r)}function $(e){return p.dirname(e)}function F(e){let t,r;for(let o of w()){if(!M(o))continue;t??=o;let n=a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:$(o)}});if(r??=n,n.ok)return{authPath:o,login:n}}return{authPath:t,login:r??a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function E(e=new Date().toISOString()){let t=d(Y,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:u("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:r,login:o}=F(t),n=!!r&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:r?c(r):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,r?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as U}from"node:fs";import{homedir as V}from"node:os";import O from"node:path";function X(){let e=process.env.HERMES_HOME?.trim(),t=e?O.resolve(e):O.join(V(),".hermes");return O.join(t,"auth.json")}function f(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),r=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=X(),n=U(o),i=h(t,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=r.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?c(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[r.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function I(e=new Date().toISOString()){let t=E(e);if(t.ready)return{...t,path:"codex_cli"};let r=f(e);return r.ready?{providerId:"codex",ready:!0,authSource:r.authSource,sessionFingerprint:r.sessionFingerprint,checkedAt:r.checkedAt,note:r.note,path:"hermes_openai_codex",hermesOpenAiCodex:r}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:r,note:[t.note,r.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as W}from"node:fs";import{homedir as G}from"node:os";import g from"node:path";var J="agent";function z(){let e=G(),t=[g.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let r=process.env.LOCALAPPDATA?.trim(),o=process.env.APPDATA?.trim();r&&t.push(g.join(r,"cursor-agent","auth.json")),o&&t.push(g.join(o,"cursor","auth.json"))}return t}function S(e=new Date().toISOString()){let t=d(J,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:u("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let r=a(t,["-v"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=z().find(i=>W(i)),n=!!o&&r.ok;return{providerId:"cursor",ready:n,authSource:"oauth_local",sessionFingerprint:o?c(o):void 0,checkedAt:e,note:n?"Local Cursor/Composer OAuth session bound on runner":[r.note,o?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as q,readFileSync as Q}from"node:fs";import{homedir as Z}from"node:os";import C from"node:path";var ee=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function te(){let e=process.env.HERMES_HOME?.trim(),t=e?C.resolve(e):C.join(Z(),".hermes");return C.join(t,".env")}function re(e){try{let t=Q(e,"utf8"),r=[];for(let o of ee)new RegExp(`^${o}=`,"m").test(t)&&r.push(o);return r}catch{return[]}}function b(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),r=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=te(),n=q(o),i=n?re(o):[],v=i.some(B=>B.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",N=r.ok&&n;return{adapterId:"hermes",cliAvailable:r.ok,profileBound:n,authSource:v,sessionFingerprint:n?c(o):void 0,checkedAt:e,note:N?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[r.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function oe(e={}){let t=e.nowIso?.()??new Date().toISOString(),r=I(t),o={codex:r,cursor:S(t),claude:P(t)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:t,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:b(t),hermesOpenAiCodex:f(t),codexAdapterPath:r.path,readyCount:n}}var ne={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"unsupported",workerMcpToolsNote:"Codex has no per-spawn MCP config path yet wired on this box, so its workers run without Kynver tools. Redirecting CODEX_HOME per worker is the planned route."},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function ie(){return Object.values(ne)}var k=["off","observe","enforce"];function se(e){let t=(e??"off").trim().toLowerCase();return k.includes(t)?t:"off"}function m(e=process.env){return se(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function y(e=process.env){let t=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return t?t==="1"||t==="true"||t==="yes"||t==="on":m(e)==="enforce"}import{createHash as ae}from"node:crypto";function l(e){if(e==null)return null;let t=e.trim();return t.length?t:null}function A(e){let t=l(e.sessionId)??"anonymous",r=l(e.title)??l(e.action)??"foreground",o=ae("sha256").update([l(e.planId)??"",l(e.parentTaskId)??"",r.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${t}:${o}`}function ce(e,t){return e==="enforce"&&t?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function de(e,t=process.env){let r=m(t),o=y(t),n=ce(r,o),i=n==="enforce_harness_task"?A({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return r==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:r,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{A as buildForegroundHarnessIdempotencyKey,oe as buildOrchestrationProviderInventory,de as evaluateOrchestrationPolicy,y as isOrchestrationEnforceTasksEnabled,ie as listOrchestrationProviderCapabilities,m as resolveOrchestrationPolicyMode};
|
|
@@ -1,2 +1,2 @@
|
|
|
1
|
-
var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function $(e){let r=e[
|
|
2
|
-
${n}`,s=Or(e.personaSlug);return!!(r.startsWith(Sr)||r===Er||r.startsWith("daemon-review:")||s&&O.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Ar(r,i)||V(i))||r.startsWith(Cr)&&e.parentTaskId&&s&&O.has(s)||e.planId&&!e.parentTaskId&&s&&O.has(s)&&V(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&O.has(s))}var Pr=/^claude[-_]/i,Ir=/^(?:opus|sonnet|haiku)\b/i;function he(e){let r=e.trim();return Pr.test(r)||Ir.test(r)}function ye(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function ve(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Nr(e){return ye(e)?"codex":he(e)?"claude":(ve(e),"cursor")}function Tr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:null:null}function Dr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?he(n)||ye(n)||ve(n)?{lane:t,model:n,provider:Nr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function A(e){let r=typeof e=="string"?e.trim():"";return r?Tr(r)??Dr(r):null}p();a();var it="kynver",st=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],at=st.map(e=>`mcp__${it}__${e}`);a();a();var La=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function ct(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var ut=ct();a();var tl=600*1e3;var Qe="composer-2.5";var m="cursor",dt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible"};function er(e){let r=e.trim().toLowerCase();return dt[r]??r}var pt=new Set(["claude","opus","anthropic"]),mt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function R(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return pt.has(r)?!0:r.includes("claude")||r.includes("opus")}function ie(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=R(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=A(R(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(ft(n.model)))return!0;let i=R(e,"description");if(mt.some(l=>l.test(i)))return!0;let s=R(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function ft(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function gt(e,r){return{provider:m,model:Qe,rule:`policy:cursor_default${r}`,requestedModel:e}}var ht=["explicit:","executor_ref:","factory:","task:"];function yt(e){return ht.some(r=>e.startsWith(r))}function rr(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||A(R(e,"executorRef"))?.provider?!0:ie(e)}function Ze(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||yt(r.rule)||rr(t)||!u(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return gt(r.model,i)}function vt(e,r=m){let t=e?.trim();return t?er(t):r}function bt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(m)?[...new Set(r.map(t=>u(t)?m:t))]:r.every(t=>u(t))?[m]:r}var Rt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,xt=/\b(npm run build\b|next build\b)\b/i,kt=/\b(vercel (build|deploy|--prod))\b/i,_t=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function se(e){let r=e.trim();return r?_t.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:kt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:xt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:Rt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var M="heavy_verification_token_required";import{spawnSync as Ft}from"node:child_process";a();import{closeSync as wt,existsSync as k,mkdirSync as Pt,openSync as It,readdirSync as ir,readFileSync as Nt,statSync as Tt,unlinkSync as sr,writeFileSync as Dt}from"node:fs";import ce from"node:path";import{mkdirSync as Et}from"node:fs";import{tmpdir as Ct}from"node:os";import U from"node:path";import{homedir as St}from"node:os";import tr from"node:path";function nr(){let e=process.env.KYNVER_STATE_ROOT;return e?tr.resolve(e):tr.join(St(),".kynver","state")}function Ot(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function At(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?U.resolve(e):Ot()?U.join(Ct(),"kynver","state","heavy-verification"):U.join(nr(),"heavy-verification")}function ae(){return U.join(At(),"slots")}function x(){let e=ae();return Et(e,{recursive:!0}),e}var _=120*6e4,or=1;function Kt(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function F(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function L(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?Kt(e,or):or}function Wt(e){return`slot-${e}`}function Bt(e,r=ae()){return ce.join(r,`${e}.json`)}function ue(e){if(!k(e))return null;try{let r=JSON.parse(Nt(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function ar(e,r=_){if(!e||!Y(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function lr(e,r){let t=ue(e);if(t)return ar(t,r);if(!k(e))return!0;try{return Date.now()-Tt(e).mtimeMs>r}catch{return!0}}function Mt(e,r){if(lr(e,r))try{sr(e)}catch{}}function Ut(e){return Pt(e,{recursive:!0}),e}function de(e={}){let r=Ut(e.slotsDir??x()),t=e.staleMs??_,n=0;for(let i of ir(r)){if(!i.endsWith(".json"))continue;let s=ce.join(r,i),l=k(s);Mt(s,t),l&&!k(s)&&(n+=1)}return n}function Lt(e={}){let r=e.slotsDir??x(),t=e.staleMs??_;de({slotsDir:r,staleMs:t});let n=[];for(let i of ir(r)){if(!i.endsWith(".json"))continue;let s=ue(ce.join(r,i));s&&!ar(s,t)&&n.push(s)}return n}function le(e={}){return Lt(e).length}function S(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();de({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=Wt(l),h=Bt(c,t),ur=ue(h);if(lr(h,n))try{sr(h)}catch{}else if(ur||k(h))continue;let dr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let y=It(h,"wx");Dt(y,JSON.stringify(dr,null,2),"utf8"),wt(y);let pr=le({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:pr,maxSlots:i,reason:null}}catch(y){if(y.code==="EEXIST")continue;throw y}}let s=le({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function H(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??_,i=r.maxSlots??L();de({slotsDir:t,staleMs:n});let s=le({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Ht(e){e<=0||Ft(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function cr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=S(e,n);for(;!s.admitted&&Date.now()<i;)Ht(Math.min(t,i-Date.now())),s=S(e,n);return s}function $t(e,r={}){let t=se(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...H(e),slotId:null}};if(F())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...H(e),slotId:null}};let n=r.waitMs??0,i=n>0?cr(e,n,r.pollMs):S(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:M,commandClass:t.commandClass,reason:t.reason??i.reason??M,verificationGate:i}}export{m as DEFAULT_WORKER_PROVIDER,M as HEAVY_VERIFICATION_TOKEN_REQUIRED,j as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,_r as auditReviewWorkerCredentialScope,Rr as auditWorkerEnv,f as buildWorkerSpawnEnv,se as classifyHeavyShellCommand,Ze as enforceCursorWorkerProvider,$t as gateWorkerShellCommand,u as isClaudeFamilyProvider,v as isForbiddenWorkerEnvKey,wr as isHarnessExpertReviewWorker,ge as isNoProdCredentialReviewEnvironment,pe as listForbiddenWorkerEnvKeys,me as listOperatorAllowedWorkerEnvKeys,er as normalizeWorkerProviderName,bt as preferCursorExecutor,vt as resolveConfiguredWorkerProvider,E as scrubWorkerEnv,ie as taskAllowsClaudeWorker,rr as taskExpressesWorkerProviderPreference};
|
|
1
|
+
var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function $(e){let r=e[vr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function R(e,r={}){return gr.has(e)?!0:Rr.has(e)||r.operatorAllow?.has(e)||br.some(t=>e.endsWith(t))?!1:hr.some(t=>e.endsWith(t))}function pe(e){let r=$(e);return Object.keys(e).filter(t=>R(t,{operatorAllow:r})).sort()}function me(e){let r=$(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!R(t,{operatorAllow:r})&&R(t)).sort()}function E(e){let r=$(e),t={...e};for(let n of Object.keys(t))R(n,{operatorAllow:r})&&delete t[n];return t}function kr(e){let r=pe(e),t=me(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var fr,gr,hr,yr,Rr,br,vr,O=o(()=>{"use strict";fr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],gr=new Set(fr),hr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],yr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],Rr=new Set(yr),br=["_PUBLIC_KEY"],vr="KYNVER_WORKER_ENV_ALLOW"});var g=o(()=>{"use strict"});function Y(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict"});var q=o(()=>{"use strict";g();a();O()});var z=o(()=>{"use strict";q();g()});var d=o(()=>{"use strict"});var P=o(()=>{"use strict"});var be=o(()=>{"use strict"});var dn,pn,J=o(()=>{"use strict";dn=25*1024*1024*1024,pn=12*1024*1024*1024});var yn,Rn,ve=o(()=>{"use strict";J();yn=5*1024*1024*1024,Rn=10*1024*1024*1024});var Sn,En,X=o(()=>{"use strict";ve();J();Sn=30*1024*1024*1024,En=15*1024*1024*1024});var _e=o(()=>{"use strict";a()});import Br from"node:path";var Wn,Q=o(()=>{"use strict";g();_e();Wn=Br.join(".openclaw","harness")});var N=o(()=>{"use strict";p();d();P();T();Q()});var Ee=o(()=>{"use strict";p();Q();N();a()});var ee=o(()=>{"use strict";Ee();a()});var Oe=o(()=>{"use strict";ee();a()});var Ce=o(()=>{"use strict"});var Ae=o(()=>{"use strict";Ce();a()});var we=o(()=>{"use strict"});var Pe=o(()=>{"use strict";we()});var Ie=o(()=>{"use strict";Pe();a()});var Ne=o(()=>{"use strict"});var Te=o(()=>{"use strict"});var We=o(()=>{"use strict"});var re=o(()=>{"use strict"});var Ke=o(()=>{"use strict"});var De=o(()=>{"use strict";re();Ke()});var Be=o(()=>{"use strict";Ae();Ie();Ne();Te();q();We();De();re();a()});var Me=o(()=>{"use strict";Be()});var Vr,Yr,Ue=o(()=>{"use strict";be();p();d();P();T();X();ee();Oe();Me();a();Vr=500*1024*1024,Yr=4*1024*1024*1024});var T=o(()=>{"use strict";Ue()});import{homedir as Gr}from"node:os";import qr from"node:path";var Le,te=o(()=>{"use strict";Le=qr.join(Gr(),".kynver",".env")});var Fe=o(()=>{"use strict"});var He=o(()=>{"use strict";Fe()});var $e=o(()=>{"use strict"});var ne=o(()=>{"use strict";He();$e()});var je=o(()=>{"use strict"});var Ve=o(()=>{"use strict";je()});var K=o(()=>{"use strict";te();g();p();ne();Ve()});var Ye=o(()=>{"use strict";d();d()});var Ge=o(()=>{"use strict";te();ne();K()});var qe=o(()=>{"use strict";z();d();Ye();p();K();Ge();a();N()});import{homedir as tt,totalmem as ws}from"node:os";import oe from"node:path";var ze,Fs,Hs,$s,js,p=o(()=>{"use strict";z();g();a();d();P();T();X();K();qe();N();ze=oe.join(tt(),".kynver"),Fs=oe.join(ze,"config.json"),Hs=oe.join(ze,"credentials"),$s=500*1024*1024,js=4*1024*1024*1024});O();O();var j="KYNVER_NO_PROD_DB_CREDENTIALS",_r=["KYNVER_ENV_FILE"],xr=new Set(["1","true","yes","on"]);function ge(e){let r=e[j]?.trim().toLowerCase();return r!==void 0&&xr.has(r)}function f(e,r={}){let t=E(e);if(!r.reviewWorker)return t;let n={...t,[j]:"1"};for(let i of _r)delete n[i];return n}var fe=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Sr(e,r={}){let t=f(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||fe.includes(c)),i=fe.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=ge(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var Er="expert-lane-pr-review:",Or="plan-review-task",Cr="scheduledjob:",C=new Set(["lorentz","dalton","rhea","sentinel"]);function Ar(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function V(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|risk register|signoff|verification|evidence|prove|gate)\b/.test(e)}function wr(e,r){return e.startsWith("factory:")?e.includes("lb")||V(r):!1}function Pr(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
|
|
2
|
+
${n}`,s=Ar(e.personaSlug);return!!(r.startsWith(Er)||r===Or||r.startsWith("daemon-review:")||s&&C.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||wr(r,i)||V(i))||r.startsWith(Cr)&&e.parentTaskId&&s&&C.has(s)||e.planId&&!e.parentTaskId&&s&&C.has(s)&&V(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&C.has(s))}var Ir=/^claude[-_]/i,Nr=/^(?:opus|sonnet|haiku)\b/i;function he(e){let r=e.trim();return Ir.test(r)||Nr.test(r)}function ye(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Re(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Tr(e){return ye(e)?"codex":he(e)?"claude":(Re(e),"cursor")}function Wr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:null:null}function Kr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?he(n)||ye(n)||Re(n)?{lane:t,model:n,provider:Tr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function A(e){let r=typeof e=="string"?e.trim():"";return r?Wr(r)??Kr(r):null}p();a();var st="kynver",Qe=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],at=Qe.map(e=>`mcp__${st}__${e}`);a();a();var $a=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function ct(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var ut=ct();a();var hl=600*1e3;var Ze="composer-2.5";var m="cursor",dt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible"};function rr(e){let r=e.trim().toLowerCase();return dt[r]??r}var pt=new Set(["claude","opus","anthropic"]),mt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function v(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return pt.has(r)?!0:r.includes("claude")||r.includes("opus")}function ie(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=v(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=A(v(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(ft(n.model)))return!0;let i=v(e,"description");if(mt.some(l=>l.test(i)))return!0;let s=v(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function ft(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function gt(e,r){return{provider:m,model:Ze,rule:`policy:cursor_default${r}`,requestedModel:e}}var ht=["explicit:","executor_ref:","factory:","task:"];function yt(e){return ht.some(r=>e.startsWith(r))}function tr(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||A(v(e,"executorRef"))?.provider?!0:ie(e)}function er(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||yt(r.rule)||tr(t)||!u(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return gt(r.model,i)}function Rt(e,r=m){let t=e?.trim();return t?rr(t):r}function bt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(m)?[...new Set(r.map(t=>u(t)?m:t))]:r.every(t=>u(t))?[m]:r}var vt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,kt=/\b(npm run build\b|next build\b)\b/i,_t=/\b(vercel (build|deploy|--prod))\b/i,xt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function se(e){let r=e.trim();return r?xt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:_t.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:kt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:vt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var M="heavy_verification_token_required";import{spawnSync as Ft}from"node:child_process";a();import{closeSync as wt,existsSync as _,mkdirSync as Pt,openSync as It,readdirSync as sr,readFileSync as Nt,statSync as Tt,unlinkSync as ar,writeFileSync as Wt}from"node:fs";import ce from"node:path";import{mkdirSync as Et}from"node:fs";import{tmpdir as Ot}from"node:os";import U from"node:path";import{homedir as St}from"node:os";import nr from"node:path";function or(){let e=process.env.KYNVER_STATE_ROOT;return e?nr.resolve(e):nr.join(St(),".kynver","state")}function Ct(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function At(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?U.resolve(e):Ct()?U.join(Ot(),"kynver","state","heavy-verification"):U.join(or(),"heavy-verification")}function ae(){return U.join(At(),"slots")}function k(){let e=ae();return Et(e,{recursive:!0}),e}var x=120*6e4,ir=1;function Kt(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function F(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function L(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?Kt(e,ir):ir}function Dt(e){return`slot-${e}`}function Bt(e,r=ae()){return ce.join(r,`${e}.json`)}function ue(e){if(!_(e))return null;try{let r=JSON.parse(Nt(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function lr(e,r=x){if(!e||!Y(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function cr(e,r){let t=ue(e);if(t)return lr(t,r);if(!_(e))return!0;try{return Date.now()-Tt(e).mtimeMs>r}catch{return!0}}function Mt(e,r){if(cr(e,r))try{ar(e)}catch{}}function Ut(e){return Pt(e,{recursive:!0}),e}function de(e={}){let r=Ut(e.slotsDir??k()),t=e.staleMs??x,n=0;for(let i of sr(r)){if(!i.endsWith(".json"))continue;let s=ce.join(r,i),l=_(s);Mt(s,t),l&&!_(s)&&(n+=1)}return n}function Lt(e={}){let r=e.slotsDir??k(),t=e.staleMs??x;de({slotsDir:r,staleMs:t});let n=[];for(let i of sr(r)){if(!i.endsWith(".json"))continue;let s=ue(ce.join(r,i));s&&!lr(s,t)&&n.push(s)}return n}function le(e={}){return Lt(e).length}function S(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??k(),n=r.staleMs??x,i=r.maxSlots??L();de({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let c=Dt(l),h=Bt(c,t),dr=ue(h);if(cr(h,n))try{ar(h)}catch{}else if(dr||_(h))continue;let pr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let y=It(h,"wx");Wt(y,JSON.stringify(pr,null,2),"utf8"),wt(y);let mr=le({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:mr,maxSlots:i,reason:null}}catch(y){if(y.code==="EEXIST")continue;throw y}}let s=le({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function H(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??k(),n=r.staleMs??x,i=r.maxSlots??L();de({slotsDir:t,staleMs:n});let s=le({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function Ht(e){e<=0||Ft(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function ur(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=S(e,n);for(;!s.admitted&&Date.now()<i;)Ht(Math.min(t,i-Date.now())),s=S(e,n);return s}function $t(e,r={}){let t=se(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...H(e),slotId:null}};if(F())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...H(e),slotId:null}};let n=r.waitMs??0,i=n>0?ur(e,n,r.pollMs):S(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:M,commandClass:t.commandClass,reason:t.reason??i.reason??M,verificationGate:i}}export{m as DEFAULT_WORKER_PROVIDER,M as HEAVY_VERIFICATION_TOKEN_REQUIRED,j as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Sr as auditReviewWorkerCredentialScope,kr as auditWorkerEnv,f as buildWorkerSpawnEnv,se as classifyHeavyShellCommand,er as enforceCursorWorkerProvider,$t as gateWorkerShellCommand,u as isClaudeFamilyProvider,R as isForbiddenWorkerEnvKey,Pr as isHarnessExpertReviewWorker,ge as isNoProdCredentialReviewEnvironment,pe as listForbiddenWorkerEnvKeys,me as listOperatorAllowedWorkerEnvKeys,rr as normalizeWorkerProviderName,bt as preferCursorExecutor,Rt as resolveConfiguredWorkerProvider,E as scrubWorkerEnv,ie as taskAllowsClaudeWorker,tr as taskExpressesWorkerProviderPreference};
|
|
@@ -0,0 +1,7 @@
|
|
|
1
|
+
import $ from"node:net";import{chmodSync as U,unlinkSync as j}from"node:fs";var k=1,E="KYNVER_WORKER_BROKER_SOCKET",f=1048576,_=1;function g(t){return`${JSON.stringify(t)}
|
|
2
|
+
`}function y(t){let e;try{e=JSON.parse(t)}catch{return{ok:!1,reason:"malformed_request",error:"request was not valid JSON",id:""}}if(!e||typeof e!="object"||Array.isArray(e))return{ok:!1,reason:"malformed_request",error:"request must be a JSON object",id:""};let r=e,o=typeof r.id=="string"?r.id:"";if(r.v!==1)return{ok:!1,reason:"unsupported_protocol",error:"unsupported protocol version (expected 1)",id:o};if(!o)return{ok:!1,reason:"malformed_request",error:"request id must be a non-empty string",id:""};if(r.op==="list_tools")return{ok:!0,request:{v:1,id:o,op:"list_tools"}};if(r.op==="call_tool"){if(typeof r.name!="string"||!r.name)return{ok:!1,reason:"malformed_request",error:"call_tool requires a tool name",id:o};let n=r.args&&typeof r.args=="object"&&!Array.isArray(r.args)?r.args:{};return{ok:!0,request:{v:1,id:o,op:"call_tool",name:r.name,args:n}}}return{ok:!1,reason:"malformed_request",error:"unknown op",id:o}}var b="kynver",l=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],ee=l.map(t=>`mcp__${b}__${t}`),N={"worker.context":["agent_os_context_envelope"],"worker.memory.read":["agent_os_search_memory"],"worker.skills.read":["agent_os_search_skills","agent_os_get_skill"],"worker.progress.report":["agent_os_progress_note"]};function w(t){if(!t||t.length===0)return[...l];let e=new Set;for(let r of t)for(let o of N[r]??[])e.add(o);return l.filter(r=>e.has(r))}var I="X-Kynver-Job-Token",R={agent_os_context_envelope:{name:"agent_os_context_envelope",description:"Fetch the context envelope for YOUR OWN task: goal/plan/task summaries, relevant memory, and recent session context. Optional memoryQuery focuses the memory portion.",inputSchema:{type:"object",properties:{memoryQuery:{type:"string",description:"Focus the memory portion of the envelope."},mode:{type:"string",description:"Envelope mode hint."}},additionalProperties:!1}},agent_os_search_memory:{name:"agent_os_search_memory",description:"Semantic search over the workspace's long-term memory. Returns a bounded top-N of relevant entries.",inputSchema:{type:"object",properties:{query:{type:"string",description:"What to search for."},k:{type:"integer",minimum:1,maximum:20,description:"How many entries to return."}},required:["query"],additionalProperties:!1}},agent_os_search_skills:{name:"agent_os_search_skills",description:"Search the workspace's skill library (bounded, metadata-only index). Use agent_os_get_skill to fetch one full skill by slug.",inputSchema:{type:"object",properties:{query:{type:"string"},limit:{type:"integer",minimum:1,maximum:25}},additionalProperties:!1}},agent_os_get_skill:{name:"agent_os_get_skill",description:"Fetch ONE full skill (including instructions) by slug.",inputSchema:{type:"object",properties:{slug:{type:"string"}},required:["slug"],additionalProperties:!1}},agent_os_progress_note:{name:"agent_os_progress_note",description:"Append a progress or blocker note to YOUR OWN task's journal. kind: 'progress' (default) or 'blocked'.",inputSchema:{type:"object",properties:{note:{type:"string"},kind:{type:"string",enum:["progress","blocked"]},eventKey:{type:"string"}},required:["note"],additionalProperties:!1}}};function K(t){return`/api/agent-os/by-id/${encodeURIComponent(t.agentOsId)}/worker`}async function c(t,e,r){let o=await t.fetchImpl(`${t.apiBaseUrl}${e}`,{method:r?.method??"GET",headers:{[I]:t.token,...r?{"Content-Type":"application/json"}:{}},...r?{body:JSON.stringify(r.body)}:{}});if(!o.ok)throw new Error(`request failed (${o.status})`);return o.json()}function p(t){return typeof t=="string"&&t.trim()?t.trim():void 0}async function h(t,e,r){let o=K(t);switch(e){case"agent_os_context_envelope":{let n=new URLSearchParams({task:t.taskId}),s=p(r.memoryQuery);s&&n.set("memoryQuery",s);let i=p(r.mode);return i&&n.set("mode",i),c(t,`${o}/context-envelope?${n.toString()}`)}case"agent_os_search_memory":{let n=new URLSearchParams({q:String(r.query??"")});return typeof r.k=="number"&&n.set("k",String(r.k)),c(t,`${o}/memory-search?${n.toString()}`)}case"agent_os_search_skills":{let n=new URLSearchParams,s=p(r.query);s&&n.set("q",s),typeof r.limit=="number"&&n.set("limit",String(r.limit));let i=n.toString();return c(t,`${o}/skills${i?`?${i}`:""}`)}case"agent_os_get_skill":return c(t,`${o}/skills/${encodeURIComponent(String(r.slug??""))}`);case"agent_os_progress_note":return c(t,`${o}/progress-note`,{method:"POST",body:{note:String(r.note??""),...r.kind==="blocked"?{kind:"blocked"}:{},...p(r.eventKey)?{eventKey:p(r.eventKey)}:{}}})}}function u(t){return l.includes(t)}import{createHash as C}from"node:crypto";import{chmodSync as A,mkdirSync as q}from"node:fs";import v from"node:os";import m from"node:path";var D=100,S="\\\\.\\pipe\\";function P(t,e){return C("sha256").update(t).digest("hex").slice(0,e)}function L(t){let e=t.platform??process.platform,r=P(t.agentOsId,12),o=P(t.workerKey,16);if(e==="win32")return{socketPath:`${S}kynver-worker-${r}-${o}`,socketDir:null,isNamedPipe:!0,relocated:!1};let n=t.homeDir??v.homedir(),s=m.join(n,".kynver","brokers",r),i=m.join(s,`${o}.sock`);if(Buffer.byteLength(i,"utf8")<=D)return{socketPath:i,socketDir:s,isNamedPipe:!1,relocated:!1};let d=m.join(t.tmpDir??v.tmpdir(),`kynver-brokers-${r}`);return{socketPath:m.join(d,`${o}.sock`),socketDir:d,isNamedPipe:!1,relocated:!0}}function O(t){t.socketDir&&(q(t.socketDir,{recursive:!0,mode:448}),A(t.socketDir,448))}function M(t){return t.startsWith(S)}var W=class t{server;opts;now;fetchImpl;grantedTools;connections=new Set;sockets=new Set;revoked=!1;closed=!1;constructor(e){if(typeof e.identity?.verify!="function")throw new Error("WorkerBroker requires an explicit identity posture (S11) \u2014 see worker-broker/identity.ts");this.opts=e,this.now=e.now??Date.now,this.fetchImpl=e.fetchImpl??fetch,this.grantedTools=w(e.capabilities),this.server=$.createServer(r=>{this.handleConnection(r)}),this.server.on("error",()=>{})}static async start(e){let r=new t(e);if(O(e.address),await new Promise((o,n)=>{r.server.once("error",n),r.server.listen(e.address.socketPath,()=>{r.server.removeListener("error",n),o()})}),!e.address.isNamedPipe)try{U(e.address.socketPath,384)}catch{}return r}get identitySummary(){return this.opts.identity.summary}get toolDescriptors(){return this.grantedTools.filter(u).map(e=>R[e])}async revoke(){this.revoked=!0,await this.close()}async close(){if(!this.closed){this.closed=!0;for(let e of this.sockets)e.destroy();if(this.sockets.clear(),this.connections.clear(),await new Promise(e=>this.server.close(()=>e())),!this.opts.address.isNamedPipe)try{j(this.opts.address.socketPath)}catch{}}}refuse(e,r){this.opts.onRefusal?.(e,r)}async handleConnection(e){this.sockets.add(e),e.on("close",()=>{this.sockets.delete(e),this.connections.delete(e)});for(let n of this.connections)(n.destroyed||n.readableEnded)&&this.connections.delete(n);if(this.connections.size>=1){this.refuse("concurrent_connection","a second concurrent connection was attempted while the worker's own connection was open"),this.write(e,{id:"",ok:!1,reason:"concurrent_connection",error:"worker tools are already in use for this task"}),e.end();return}this.connections.add(e);let r=await this.opts.identity.verify({socket:e,workerPid:this.opts.workerPid});if(!r.ok){this.refuse("identity_refused",r.detail),this.write(e,{id:"",ok:!1,reason:"identity_refused",error:"caller could not be identified as this worker"}),e.end();return}let o="";e.setEncoding("utf8"),e.on("data",n=>{if(o+=n,Buffer.byteLength(o,"utf8")>1048576){this.refuse("request_too_large","request exceeded the line cap"),this.write(e,{id:"",ok:!1,reason:"request_too_large",error:"request exceeded the maximum size"}),e.end();return}let s=o.indexOf(`
|
|
3
|
+
`);for(;s>=0;){let i=o.slice(0,s);o=o.slice(s+1),i.trim()&&this.handleLine(e,i),s=o.indexOf(`
|
|
4
|
+
`)}})}write(e,r){if(!e.destroyed)try{e.write(g(r))}catch{}}async handleLine(e,r){let o=y(r);if(!o.ok){this.refuse(o.reason,o.error),this.write(e,{id:o.id,ok:!1,reason:o.reason,error:o.error});return}let{request:n}=o;if(this.revoked||this.closed){this.refuse("revoked","grant revoked"),this.write(e,{id:n.id,ok:!1,reason:"revoked",error:"worker tools are no longer available for this task"});return}if(this.now()>=this.opts.expiresAt){this.refuse("grant_expired","grant expired"),this.write(e,{id:n.id,ok:!1,reason:"grant_expired",error:"worker tools are no longer available for this task"});return}if(n.op==="list_tools"){this.write(e,{id:n.id,ok:!0,tools:this.toolDescriptors});return}if(!u(n.name)){this.refuse("unknown_tool",n.name),this.write(e,{id:n.id,ok:!1,reason:"unknown_tool",error:`unknown tool: ${n.name}`});return}if(!this.grantedTools.includes(n.name)){this.refuse("capability_not_granted",n.name),this.write(e,{id:n.id,ok:!1,reason:"capability_not_granted",error:`tool not granted for this task: ${n.name}`});return}try{let s=await h({apiBaseUrl:this.opts.apiBaseUrl,agentOsId:this.opts.agentOsId,taskId:this.opts.taskId,token:this.opts.token,fetchImpl:this.fetchImpl},n.name,n.args??{});this.write(e,{id:n.id,ok:!0,result:s})}catch(s){let i=s instanceof Error?s.message:"request failed";this.refuse("upstream_error",i),this.write(e,{id:n.id,ok:!1,reason:"upstream_error",error:i})}}};var x={posture:"scoped",summary:"scoped: per-worker endpoint in an owner-only (0700) directory, one connection at a time. Peer identity is not observed \u2014 another process of the same OS user is not excluded.",verify:async()=>({ok:!0})};function V(){return x}import F from"node:net";var J=6e4,B=class t{socket;pending=new Map;timeoutMs;buffer="";nextId=1;closedReason=null;constructor(e,r){this.socket=e,this.timeoutMs=r,e.setEncoding("utf8"),e.on("data",o=>this.onData(o)),e.on("close",()=>this.failAll("worker tools connection closed")),e.on("error",o=>this.failAll(o.message))}static connect(e,r=J){return new Promise((o,n)=>{let s=F.createConnection(e),i=d=>{s.destroy(),n(d)};s.once("error",i),s.once("connect",()=>{s.removeListener("error",i),o(new t(s,r))})})}onData(e){this.buffer+=e;let r=this.buffer.indexOf(`
|
|
5
|
+
`);for(;r>=0;){let o=this.buffer.slice(0,r);this.buffer=this.buffer.slice(r+1),o.trim()&&this.dispatch(o),r=this.buffer.indexOf(`
|
|
6
|
+
`)}}dispatch(e){let r;try{r=JSON.parse(e)}catch{return}if(!r.id){let n="error"in r?r.error:"worker tools unavailable";this.failAll(n);return}let o=this.pending.get(r.id);o&&(this.pending.delete(r.id),clearTimeout(o.timer),o.resolve(r))}failAll(e){this.closedReason??=e;for(let[r,o]of this.pending)this.pending.delete(r),clearTimeout(o.timer),o.reject(new Error(e))}send(e){if(this.closedReason)return Promise.reject(new Error(this.closedReason));let r=String(this.nextId++);return new Promise((o,n)=>{let s=setTimeout(()=>{this.pending.delete(r),n(new Error("worker tools request timed out"))},this.timeoutMs);s.unref?.(),this.pending.set(r,{resolve:o,reject:n,timer:s}),this.socket.write(`${JSON.stringify({v:1,id:r,...e})}
|
|
7
|
+
`,i=>{i&&(this.pending.delete(r),clearTimeout(s),n(i))})})}async listTools(){let e=await this.send({op:"list_tools"});if(!e.ok)throw new Error(e.error);return"tools"in e?e.tools:[]}async callTool(e,r){let o=await this.send({op:"call_tool",name:e,args:r});return o.ok?{ok:!0,result:"result"in o?o.result:null}:{ok:!1,error:o.error}}close(){this.failAll("worker tools client closed"),this.socket.destroy()}};var a=new Map;function Y(t,e){let r=a.get(t);r&&r.close(),a.set(t,e)}function X(t){return a.get(t)}async function T(t){let e=a.get(t);return e?(a.delete(t),await e.close(),!0):!1}function H(t){T(t).catch(()=>{})}async function Q(){let t=[...a.values()];a.clear(),await Promise.all(t.map(e=>e.close().catch(()=>{})))}function z(){return a.size}export{x as SCOPED_WORKER_BROKER_IDENTITY,_ as WORKER_BROKER_MAX_CONCURRENT_CONNECTIONS,f as WORKER_BROKER_MAX_LINE_BYTES,k as WORKER_BROKER_PROTOCOL_VERSION,E as WORKER_BROKER_SOCKET_ENV,R as WORKER_TOOL_DESCRIPTORS,W as WorkerBroker,B as WorkerBrokerClient,Q as closeAllWorkerBrokers,T as closeWorkerBroker,H as closeWorkerBrokerSync,g as encodeBrokerFrame,O as ensureWorkerBrokerSocketDir,h as executeWorkerTool,X as getWorkerBroker,M as isNamedPipePath,u as isWorkerToolName,y as parseBrokerRequest,Y as registerWorkerBroker,L as resolveWorkerBrokerAddress,V as resolveWorkerBrokerIdentity,z as workerBrokerCount};
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@kynver-app/runtime",
|
|
3
|
-
"version": "0.2.
|
|
3
|
+
"version": "0.2.46",
|
|
4
4
|
"description": "Kynver AgentOS local execution runtime and CLI",
|
|
5
5
|
"type": "module",
|
|
6
6
|
"main": "./dist/index.js",
|
|
@@ -144,6 +144,11 @@
|
|
|
144
144
|
"types": "./dist/node-runtime-policy.d.ts",
|
|
145
145
|
"import": "./dist/node-runtime-policy.js",
|
|
146
146
|
"default": "./dist/node-runtime-policy.js"
|
|
147
|
+
},
|
|
148
|
+
"./worker-broker": {
|
|
149
|
+
"types": "./dist/worker-broker/index.d.ts",
|
|
150
|
+
"import": "./dist/worker-broker/index.js",
|
|
151
|
+
"default": "./dist/worker-broker/index.js"
|
|
147
152
|
}
|
|
148
153
|
},
|
|
149
154
|
"files": [
|
|
@@ -155,7 +160,7 @@
|
|
|
155
160
|
"!dist/**/*.d.ts.map"
|
|
156
161
|
],
|
|
157
162
|
"scripts": {
|
|
158
|
-
"build": "esbuild src/cli.ts src/index.ts src/node-runtime-policy.ts src/local-run-store/index.ts src/worker-persona-catalog.ts src/instruction-bundle/contract.ts src/chat/command-auth-proof.ts src/server/monitor.ts src/server/landing.ts src/server/worker-policy.ts src/server/orchestration.ts src/server/adapter-contract.ts src/server/context-budget-receipt.ts src/server/context-budget.ts src/server/prompt.ts src/server/node-runtime-policy.ts src/server/model-routing.ts src/server/dispatch-routing.ts src/server/db-credentials.ts src/server/heavy-verification.ts src/server/memory-cost.ts src/server/pr-evidence.ts src/server/default-repo.ts src/server/cleanup.ts src/server/repo-search.ts src/server/harness-notice.ts src/server/memory-cost-enforce.ts src/server/wsl-crash-dumps.ts --bundle --platform=node --format=esm --packages=external --outbase=src --outdir=dist --minify && tsc -p tsconfig.json --emitDeclarationOnly && node scripts/chmod-cli-bin.mjs",
|
|
163
|
+
"build": "esbuild src/cli.ts src/index.ts src/node-runtime-policy.ts src/local-run-store/index.ts src/worker-broker/index.ts src/worker-persona-catalog.ts src/instruction-bundle/contract.ts src/chat/command-auth-proof.ts src/server/monitor.ts src/server/landing.ts src/server/worker-policy.ts src/server/orchestration.ts src/server/adapter-contract.ts src/server/context-budget-receipt.ts src/server/context-budget.ts src/server/prompt.ts src/server/node-runtime-policy.ts src/server/model-routing.ts src/server/dispatch-routing.ts src/server/db-credentials.ts src/server/heavy-verification.ts src/server/memory-cost.ts src/server/pr-evidence.ts src/server/default-repo.ts src/server/cleanup.ts src/server/repo-search.ts src/server/harness-notice.ts src/server/memory-cost-enforce.ts src/server/wsl-crash-dumps.ts --bundle --platform=node --format=esm --packages=external --outbase=src --outdir=dist --minify && tsc -p tsconfig.json --emitDeclarationOnly && node scripts/chmod-cli-bin.mjs",
|
|
159
164
|
"typecheck": "tsc -p tsconfig.json --noEmit",
|
|
160
165
|
"test": "vitest run --config vitest.config.ts",
|
|
161
166
|
"prepublishOnly": "node ../../scripts/npm-publish-guard.mjs && npm run build",
|