@kynver-app/runtime 0.2.53 → 0.2.54

package/dist/cli.js

@@ -3,7 +3,7 @@ var _C=Object.defineProperty;var D=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(
 `),PC(t,e)}catch(n){try{IC(t,{force:!0})}catch{}throw n}}function C(e){return String(e||"").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"")||"worker"}function Sm(e){return C(`${new Date().toISOString().replace(/[-:]/g,"").replace(/\..+/,"Z")}-${e}`)}function Le(e){return String(e).replace(/\/+$/,"")}function xi(e){return String(e||"").replace(/\s+/g," ").trim()}function Ei(e){try{return vm(e).size}catch{return 0}}function Pi(e){try{return vm(e).mtime.toISOString()}catch{return null}}function Ii(e,r){return xC(e)?hc(e,"utf8").split(`
 `).slice(-r).join(`
 `):""}function wm(e){return e?hc(bm.resolve(e),"utf8"):""}function xt(e){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,e)}function Zr(e){return new Promise(r=>setTimeout(r,e))}function G(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}function hr(e,r){try{process.kill(-e,r)}catch{process.kill(e,r)}}function _m(e){let r=null,t=-1/0;for(let n of e){if(!n)continue;let o=Date.parse(n);Number.isFinite(o)&&o>t&&(t=o,r=n)}return r}function kc(e){return Math.max(0,Math.round((Date.now()-e)/1e3))}var x=D(()=>{"use strict"});function BC(e){let r=e[WC];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function FC(e,r={}){return NC.has(e)?!0:UC.has(e)||r.operatorAllow?.has(e)||LC.some(t=>e.endsWith(t))?!1:DC.some(t=>e.endsWith(t))}function yc(e){let r=BC(e),t={...e};for(let n of Object.keys(t))FC(n,{operatorAllow:r})&&delete t[n];return t}var TC,NC,DC,MC,UC,LC,WC,Rc=D(()=>{"use strict";TC=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],NC=new Set(TC),DC=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],MC=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],UC=new Set(MC),LC=["_PUBLIC_KEY"],WC="KYNVER_WORKER_ENV_ALLOW"});import{existsSync as KC,statSync as HC}from"node:fs";import{spawnSync as xm}from"node:child_process";function se(e,r,t={}){let n=xm("git",r,me({cwd:e,encoding:"utf8"}));if(n.status!==0&&!t.allowFailure){let o=$C(e,r,n);if(t.throwError)throw new Error(o);He(o)}return n.stdout||""}function $C(e,r,t){let n=typeof t.stderr=="string"&&t.stderr.trim()||typeof t.stdout=="string"&&t.stdout.trim()||t.error?.message||`exit ${t.status??"unknown"}`;return`git ${r.join(" ")} failed in ${e}: ${n}`}function jC(e){let r=e.trim();if(!r)return"git repo path is empty";let t=Fe(r);if(!KC(t))return t===r?`git repo path does not exist: ${t}`:`git repo path does not exist: ${t} (from ${r})`;try{if(!HC(t).isDirectory())return`git repo path is not a directory: ${t}`}catch(n){return`git repo path is not readable: ${t} (${n.message})`}return null}function Em(e){let r=jC(e);r&&He(r),se(Fe(e.trim()),["rev-parse","--show-toplevel"])}function xo(e){return se(e,["status","--short"],{allowFailure:!0}).split(`
-`).map(r=>r.trim()).filter(Boolean)}function ee(e,r){try{let t=xm("git",r,me({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}function Cm(e,r,t){let n=ee(e,["merge-base","--is-ancestor",r,t]);return n.status===0?{isAncestor:!0,error:null}:n.status===1?{isAncestor:!1,error:null}:{isAncestor:null,error:n.error||n.stderr||n.stdout||`git exited ${n.status}`}}function Oi(e,r="origin/main"){let t=typeof r=="string"?{base:r}:r,n=t.baseCommit?.trim()||t.base?.trim()||"origin/main",o=t.baseCommit?.trim()||null;if(!e)return vc(n,"missing worktree path");let s=ee(e,["rev-parse","HEAD"]);if(s.status!==0)return vc(n,s.error||s.stderr||s.stdout||"failed to resolve HEAD");let i;if(o)i=o;else{let p=ee(e,["rev-parse",n]);if(p.status!==0)return vc(n,p.error||p.stderr||p.stdout||`failed to resolve ${n}`,s.stdout.trim());i=p.stdout.trim()}let a=s.stdout.trim();if(a===i)return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:!0,headIsAncestorOfBase:!0,relation:"synced"};let l=Cm(e,i,a),c=Cm(e,a,i),u=l.error||c.error||void 0;if(l.isAncestor==null||c.isAncestor==null)return{checked:!1,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:"unknown",...u?{error:u}:{}};let d=l.isAncestor?"ahead":c.isAncestor?"merged":"diverged";return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:d,...u?{error:u}:{}}}function vc(e,r,t=null){return{checked:!1,base:e,head:t,baseHead:null,baseIsAncestorOfHead:null,headIsAncestorOfBase:null,relation:"unknown",error:r}}var we=D(()=>{"use strict";Ke();x();Rc()});import{existsSync as Sc,readFileSync as Im}from"node:fs";import{homedir as VC}from"node:os";import Ir from"node:path";import{fileURLToPath as GC}from"node:url";function JC(e){let r=Ir.join(e,"package.json");if(!Sc(r))return null;try{let t=JSON.parse(Im(r,"utf8"));return typeof t.name=="string"?t.name.trim():null}catch{return null}}function qC(e){return JC(e)==="kynver"}function Pm(e){let r=Ir.resolve(e);if(!Sc(r))return null;let t=ee(r,["rev-parse","--show-toplevel"]);if(t.status!==0)return null;let n=t.stdout.trim();return n.length?Ir.resolve(n):null}function zC(e=import.meta.url){let r=Ir.dirname(GC(e));for(let t=0;t<8;t+=1){let n=Ir.join(r,"package.json");if(Sc(n))try{if(JSON.parse(Im(n,"utf8")).name==="@kynver-app/runtime")return r}catch{}let o=Ir.dirname(r);if(o===r)break;r=o}return null}function bc(e,r,t,n,o){if(!t)return;let s=Ir.resolve(t);e.has(s)||(o?.requireMonorepo??!0)&&!qC(s)||(e.add(s),r.push({repo:s,source:n}))}function Om(e){let r=e?.cwd??process.cwd(),t=new Set,n=[];bc(t,n,Pm(r),"cwd_git",{requireMonorepo:!1});let o=zC(e?.runtimeModuleUrl??import.meta.url);o&&bc(t,n,Pm(o),"runtime_checkout");let s=VC();for(let i of YC)bc(t,n,Fe(Ir.join(s,i)),"well_known_path");return n}function dn(e){return Om(e)[0]??null}function XC(e){let r=Ir.resolve(e).replace(/\\/g,"/");return r.includes("/.kynver/harness/worktrees/")||r.includes("/.openclaw/harness/worktrees/")||r.includes("/kynver-harness/")||r.includes("/openclaw/harness/worktrees/")}function pn(e){let r=Om(e);return r.find(n=>!XC(n.repo))??r[0]??null}var YC,Eo=D(()=>{"use strict";we();Ke();YC=["Kynver","repos/Kynver","repos/kynver-source-main","code/Kynver","projects/Kynver"]});function et(e){let r=(e??"").trim().toLowerCase();return r==="ghost"||r==="forge"||r==="box"?r:r.includes("forge")?"forge":r.includes("ghost")||r.includes("openclaw")?"ghost":"box"}function Ai(e,r){return e[r]?.trim()||null}function Am(e){let r=e?.split(":")[0]?.trim();return r?et(r):null}function _e(e=process.env,r={}){let t=[],n=Am(r.boxId),o=Am(Ai(e,"KYNVER_BOX_ID")),s=r.boxKind?.trim();if(s)return n&&n!==et(s)&&t.push(`config.boxId=${r.boxId} conflicts with boxKind=${s}; using explicit boxKind=${s}`),{boxKind:et(s),source:"config",slugInferenceBlocked:!1,warnings:t};let i=Ai(e,"KYNVER_BOX_KIND");if(i)return o&&o!==et(i)&&t.push(`KYNVER_BOX_ID=${Ai(e,"KYNVER_BOX_ID")} conflicts with KYNVER_BOX_KIND=${i}; using explicit KYNVER_BOX_KIND=${i}`),{boxKind:et(i),source:"env",slugInferenceBlocked:!1,warnings:t};if(n)return{boxKind:n,source:"config",slugInferenceBlocked:!1,warnings:t};if(o)return{boxKind:o,source:"env",slugInferenceBlocked:!1,warnings:t};let a=Ai(e,"KYNVER_AGENT_OS_SLUG");return a&&t.push(`KYNVER_AGENT_OS_SLUG=${a} is a workspace slug, not box identity \u2014 operators set boxKind via \`kynver setup --box-kind forge|ghost\` or KYNVER_BOX_KIND; customers default to box`),{boxKind:"box",source:"default",slugInferenceBlocked:!!a,warnings:t}}function $e(e={},r=process.env){return _e(r,e).boxKind}var Ce=D(()=>{"use strict"});function Po(e,r){return e==="forge"?4:Math.max(1,r)}function lr(e,r){return e==="forge"?Math.min(Math.max(1,r),4):Math.max(1,r)}function mn(e,r){return e==="forge"&&r>4}var fn=D(()=>{"use strict"});import{readFileSync as QC}from"node:fs";import Tm from"node:os";function Io(e){if(e!==void 0){let r=e.match(/^MemAvailable:\s+(\d+)\s*kB/m);return r?Number(r[1])*1024:Tm.freemem()}if(process.platform==="linux")try{let t=QC("/proc/meminfo","utf8").match(/^MemAvailable:\s+(\d+)\s*kB/m);if(t)return Number(t[1])*1024}catch{}return Tm.freemem()}var Ti=D(()=>{"use strict"});import{existsSync as ZC,readFileSync as ex,statfsSync as rx}from"node:fs";function wc(){if(process.platform!=="linux")return!1;for(let e of["/proc/sys/kernel/osrelease","/proc/version"])try{if(!ZC(e))continue;let r=ex(e,"utf8");if(/microsoft|wsl/i.test(r))return!0}catch{}return!1}function Nm(e={}){if(!(e.forceWsl===void 0?wc():e.forceWsl))return null;let t=e.wslHostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||gn,n=e.wslHostFreeWarnBytes??tx,o=e.wslHostFreeCriticalBytes??nx,s=e.statfs??rx,i;try{i=s(t)}catch(g){return{ok:!1,path:t,freeBytes:0,totalBytes:0,usedPercent:100,warnBelowBytes:n,criticalBelowBytes:o,reason:`Windows host disk probe failed at ${t}: ${g.message}`,probeError:g.message}}let a=Number(i.bavail)*Number(i.bsize),l=Number(i.blocks)*Number(i.bsize),c=l>0?(l-a)/l*100:100,u=a<n,d=a<o,p=!u&&!d,f=(a/(1024*1024*1024)).toFixed(1),m=null;return p||(m=`Windows host disk ${t} at ${d?"critical":"warning"}: ${f} GiB free (<${(d?o:n)/1024/1024/1024} GiB); WSL VHDX cannot grow safely. ${ox()}`),{ok:p,path:t,freeBytes:a,totalBytes:l,usedPercent:c,warnBelowBytes:n,criticalBelowBytes:o,reason:m,probeError:null}}function ox(){return"Recovery: 1) free Windows C: (empty Recycle Bin / Storage Sense / clear %TEMP% and %LOCALAPPDATA%\\Temp\\wsl-crashes); 2) shut down WSL (`wsl --shutdown`) then compact the VHDX (`Optimize-VHD` or `diskpart compact vdisk`); 3) clear local node_modules / .next / harness worktrees before restarting workers; 4) disable recurring dumps via `%USERPROFILE%/.wslconfig` (`maxCrashDumpCount=-1`) or `kynver wsl-crashes --execute`. Full runbook: docs/runbooks/wsl-disk-pressure.md."}var tx,nx,gn,_c=D(()=>{"use strict";tx=25*1024*1024*1024,nx=12*1024*1024*1024,gn="/mnt/c"});import{execFileSync as Dm}from"node:child_process";import{existsSync as Di,readFileSync as Mm,readdirSync as sx,statSync as ix}from"node:fs";import Cc from"node:path";function Ni(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)?n:r}function Um(){let e=process.env.KYNVER_WSL_WIN_USER?.trim();if(e)return e;try{let n=Dm("cmd.exe",["/c","echo","%USERNAME%"],{encoding:"utf8",timeout:5e3,stdio:["ignore","pipe","ignore"]}).trim();if(n&&n!=="%USERNAME%"&&!n.includes("%"))return n}catch{}let r=process.env.USER?.trim()||process.env.LOGNAME?.trim(),t=process.env.KYNVER_WSL_HOST_MOUNT?.trim()||gn;return r&&Di(Cc.join(t,"Users",r))?r:null}function dx(e={}){let r=e.crashDumpDir?.trim()||process.env.KYNVER_WSL_CRASH_DUMP_DIR?.trim();if(r)return r;let t=e.hostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||gn,n=e.windowsUser??Um();return n?`${t.replace(/\\/g,"/").replace(/\/$/,"")}/Users/${n}/AppData/Local/Temp/wsl-crashes`:null}function px(e){let r=/^wsl-crash-\d+-(\d+)-(.+)-(\d+)\.dmp$/i.exec(e);if(!r)return{executableHint:null,signal:null,pid:null};let t=Number(r[1]),n=r[2]??"",o=Number(r[3]),s=n.split("_").filter(Boolean);return{executableHint:s.length>0?s[s.length-1]:null,signal:Number.isFinite(o)?o:null,pid:Number.isFinite(t)?t:null}}function mx(){try{if(Di("/proc/sys/kernel/core_pattern"))return Mm("/proc/sys/kernel/core_pattern","utf8").trim()}catch{}try{return Dm("sysctl",["-n","kernel.core_pattern"],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()||null}catch{return null}}function fx(e){return!!(e&&/wsl-capture-crash/i.test(e))}function gx(e,r=gn){let t=Cc.join(r,"Users",e,".wslconfig");if(!Di(t))return{maxCrashDumpCount:null,crashDumpFolder:null};let n;try{n=Mm(t,"utf8")}catch{return null}let o=null,s=null;for(let i of n.split(/\r?\n/)){let a=i.replace(/#.*$/,"").trim();if(!a||a.startsWith("["))continue;let l=a.indexOf("=");if(l<0)continue;let c=a.slice(0,l).trim().toLowerCase(),u=a.slice(l+1).trim();if(c==="maxcrashdumpcount"){let d=Number(u);o=Number.isFinite(d)?d:null}else c==="crashdumpfolder"&&(s=u.replace(/^["']|["']$/g,"")||null)}return{maxCrashDumpCount:o,crashDumpFolder:s}}function hx(e){if(!Di(e))return[];let r=sx(e,{withFileTypes:!0}),t=[];for(let n of r){if(!n.isFile()||!n.name.toLowerCase().endsWith(".dmp"))continue;let o=Cc.join(e,n.name);try{let s=ix(o),i=px(n.name);t.push({name:n.name,path:o,bytes:s.size,mtimeMs:s.mtimeMs,executableHint:i.executableHint,signal:i.signal,pid:i.pid})}catch{}}return t.sort((n,o)=>o.mtimeMs-n.mtimeMs),t}function rt(e={}){if(!(e.forceWsl===void 0?wc():e.forceWsl))return null;let t=e.hostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||gn,n=e.windowsUser??Um(),o=e.warnBelowBytes??Ni("KYNVER_WSL_CRASH_DUMP_WARN_BYTES",ax),s=e.criticalBelowBytes??Ni("KYNVER_WSL_CRASH_DUMP_CRITICAL_BYTES",lx),i=e.warnCount??Ni("KYNVER_WSL_CRASH_DUMP_WARN_COUNT",cx),a=e.criticalCount??Ni("KYNVER_WSL_CRASH_DUMP_CRITICAL_COUNT",ux),l=(e.readCorePattern??mx)(),c=fx(l),u=null;n&&(u=(e.readWslConfig??gx)(n,t));let d=u?.maxCrashDumpCount??null,p=d===-1,f=dx({hostMount:t,windowsUser:n,crashDumpDir:e.crashDumpDir});if(!f)return{ok:!0,path:null,windowsUser:n,dumpCount:0,totalBytes:0,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:[],executables:[],corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:null,probeError:"windows_user_unresolved"};let m;try{m=(e.listDumps??hx)(f)}catch(j){return{ok:!1,path:f,windowsUser:n,dumpCount:0,totalBytes:0,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:[],executables:[],corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:`WSL crash dump probe failed at ${f}: ${j.message}`,probeError:j.message}}let g=m.reduce((j,N)=>j+N.bytes,0),y=m.length,R=[...new Set(m.map(j=>j.executableHint).filter(j=>!!j))],h=g>=s,k=g>=o,S=y>=a,I=y>=i,_=!(h||S||k||I),F=null;if(!_){let j=h||S?"critical":"warning",N=(g/1024**3).toFixed(1),fe=R.length>0?R.join(", "):"unknown";F=`WSL crash dumps ${j}: ${y} file(s), ${N} GiB at ${f} (executables: ${fe}). `+kx({wslCaptureEnabled:c,dumpsDisabledInWslConfig:p})}return{ok:_,path:f,windowsUser:n,dumpCount:y,totalBytes:g,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:m,executables:R,corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:F,probeError:null}}function kx(e={}){let r=["Recovery:","1) run `kynver wsl-crashes --execute` or scripts/cleanup-wsl-crashes.ps1 to prune old .dmp files;"];return e.dumpsDisabledInWslConfig||r.push("2) add `[wsl2]\\nmaxCrashDumpCount=-1` to %USERPROFILE%/.wslconfig then `wsl --shutdown` to disable future dumps;"),e.wslCaptureEnabled&&r.push("3) investigate crashing executables (node OOM/SIGBUS often follows Windows C: pressure \u2014 see docs/runbooks/wsl-disk-pressure.md);"),r.push("full runbook: docs/runbooks/wsl-disk-pressure.md."),r.join(" ")}var ax,lx,cx,ux,Oo=D(()=>{"use strict";_c();ax=5*1024*1024*1024,lx=10*1024*1024*1024,cx=2,ux=4});import{statfsSync as yx}from"node:fs";function kr(e={}){let r=e.diskPath?.trim()||"/",t=e.diskFreeWarnBytes??Rx,n=e.diskFreeCriticalBytes??vx,o=e.diskMaxUsedPercent??bx,s=e.diskHardMaxUsedPercent??Sx,i=yx(r),a=Number(i.bavail)*Number(i.bsize),l=Number(i.blocks)*Number(i.bsize),c=l>0?(l-a)/l*100:100,u=a<t,d=a<n,p=a<t*2,f=p&&c>o,m=p&&c>s,g=!u&&!d&&!f&&!m,y=e.skipWslHostCheck?null:Nm(e.wslHost),R=e.skipWslCrashDumpCheck?null:rt(e.wslCrashDumps),h=g&&(y?y.ok:!0)&&(R?R.ok:!0),k=null;return h||(k=[d?`free space below critical ${n} bytes`:null,u?`free space below warning ${t} bytes`:null,m?`used percent above hard cap ${s}%`:null,f?`used percent above cap ${o}%`:null,y&&!y.ok?y.reason:null,R&&!R.ok?R.reason:null].filter(Boolean).join("; ")),wx({ok:h,path:r,freeBytes:a,totalBytes:l,usedPercent:c,warnBelowBytes:t,criticalBelowBytes:n,maxUsedPercent:o,hardMaxUsedPercent:s,reason:k,wslHost:y,wslCrashDumps:R?{ok:R.ok,path:R.path,dumpCount:R.dumpCount,totalBytes:R.totalBytes,executables:R.executables,wslCaptureEnabled:R.wslCaptureEnabled,dumpsDisabledInWslConfig:R.dumpsDisabledInWslConfig,reason:R.reason,probeError:R.probeError}:null})}function wx(e){let r=process.env.KYNVER_DISPATCH_DISK_GATE_FORCE?.trim().toLowerCase();return r?r==="ok"||r==="open"||r==="none"?e.ok?e:{...e,ok:!0,reason:`disk gate forced open by KYNVER_DISPATCH_DISK_GATE_FORCE (suppressed: ${e.reason??"no reason"})`}:r==="block"||r==="pressured"?{...e,ok:!1,reason:`disk gate forced closed by KYNVER_DISPATCH_DISK_GATE_FORCE${e.reason?` (underlying: ${e.reason})`:""}`}:e:e}var Rx,vx,bx,Sx,Ao=D(()=>{"use strict";Oo();_c();Rx=30*1024*1024*1024,vx=15*1024*1024*1024,bx=80,Sx=90});import{existsSync as Or,mkdirSync as _x,readdirSync as Mi,renameSync as Lm,statSync as Cx}from"node:fs";import Ar from"node:path";function Bm(e){try{return Cx(e).isDirectory()}catch{return!1}}function xx(e){if(!Or(e))return!0;for(let r of Wm){let t=Ar.join(e,r);if(Or(t)&&(!Bm(t)||Mi(t).length>0))return!1}return!0}function Ex(e){let r=Ar.join(e,"runs");if(!Or(r)||!Bm(r))return!1;for(let t of Mi(r,{withFileTypes:!0})){if(!t.isDirectory()||t.name==="runs")continue;let n=Ar.join(r,t.name,"run.json");if(P(n,void 0)?.id)return!0}return!1}function Px(e){let r=Ar.join(e,"runs");if(!Or(r))return!1;for(let t of Mi(r,{withFileTypes:!0})){if(!t.isDirectory())continue;if(P(Ar.join(r,t.name,"run.json"),void 0)?.boxKind==="ghost")return!0}return!1}function Ix(e){let r=Ar.join(e,"ghost");return Or(r)?!Or(Ar.join(r,"runs")):Px(e)}function Fm(e){return Ex(e.sharedRoot)?xx(e.forgeRoot)?Ix(e.sharedRoot)?{action:"blocked",blocker:"Forge legacy harness migration blocked: Ghost pool is co-hosted on this host (ghost namespace or ghost-attributed runs under ~/.kynver/harness). Drain in-flight Ghost runs from the shared root, or get operator sign-off for a fresh Forge cutover before enabling box-scoped isolation."}:{action:"migrate"}:{action:"none"}:{action:"none"}}function Km(e,r){_x(r,{recursive:!0});for(let t of Wm){let n=Ar.join(e,t),o=Ar.join(r,t);if(Or(n)){if(Or(o)&&Mi(o).length>0)throw new Error(`Forge legacy harness migration failed: ${o} is not empty`);if(Or(o)){Lm(n,o);continue}Lm(n,o)}}}var Wm,Hm=D(()=>{"use strict";x();Wm=["runs","worktrees"]});import{existsSync as De}from"node:fs";import{homedir as Ox}from"node:os";import xe from"node:path";function xc(e=process.env){return e.HOME?.trim()||Ox()}function Ec(e=process.env){return xe.join(xc(e),".kynver","harness")}function Ui(e){let r=xe.resolve(Fe(e.trim()));for(;Ax.has(xe.basename(r));)r=xe.dirname(r);return r}function Tx(e,r=process.env){return xe.join(Ec(r),e)}function Nx(e=process.env){let r=Ec(e);if(De(xe.join(r,"runs")))return!0;if(De(r)&&!De(xe.join(r,"ghost"))&&!De(xe.join(r,"forge")))return De(r);let t=xe.join(xc(e),$m);return De(t)}function Li(e){let r=e.env??process.env,t=r.KYNVER_HARNESS_ROOT?.trim()||r.OPUS_HARNESS_ROOT?.trim();if(t)return{harnessRoot:Ui(t),source:"env"};let n=e.configuredHarnessRoot?.trim();if(n)return{harnessRoot:Ui(n),source:"config"};let o=Tx(e.boxKind,r);if(De(xe.join(o,"runs"))||De(o)&&!Dx(o))return{harnessRoot:o,source:"box_scoped"};let i=Ec(r);if(e.boxKind==="forge"){let a=Fm({sharedRoot:i,forgeRoot:o});if(a.action==="blocked")return{harnessRoot:o,source:"box_scoped",migrationBlocker:a.blocker};if(a.action==="migrate")return e.allowForgeLegacyMigration!==!1&&Km(i,o),{harnessRoot:o,source:"legacy_migrated"}}if(e.boxKind==="ghost"&&Nx(r)){if(De(xe.join(i,"runs")))return{harnessRoot:i,source:"legacy_shared"};if(De(i)&&!De(xe.join(i,"ghost"))&&!De(xe.join(i,"forge")))return{harnessRoot:i,source:"legacy_shared"};let l=xe.join(xc(r),$m);if(De(l))return{harnessRoot:l,source:"legacy_shared"}}return{harnessRoot:o,source:"box_scoped"}}function Dx(e){if(!De(e))return!0;for(let r of["runs","worktrees"]){let t=xe.join(e,r);if(De(t))return!1}return!0}var $m,Ax,Pc=D(()=>{"use strict";Ke();Hm();$m=xe.join(".openclaw","harness");Ax=new Set(["runs","worktrees"])});import jm from"node:os";function Wi(e){return e?.trim()?e.trim():null}function Mx(e,r){let t=r.trim().toLowerCase()||"host";return`${e}-${t}`.replace(/[^a-z0-9._-]+/g,"-")}function Ux(e){return e.KYNVER_DISPATCH_STRICT_IDENTITY==="1"||e.KYNVER_DISPATCH_STRICT_IDENTITY==="true"||e.KYNVER_DAEMON_STRICT_IDENTITY==="1"||e.KYNVER_DAEMON_STRICT_IDENTITY==="true"}function ze(e=v(),r=process.env,t={}){let n=_e(r,e),o=[...n.warnings],s=[],i=!!(e.boxKind?.trim()||Wi(r.KYNVER_BOX_KIND)),a=t.strict===!0||Ux(r);if((t.requireExplicitBoxKind||a)&&!i&&s.push("boxKind is not persisted in ~/.kynver/config.json and KYNVER_BOX_KIND is unset \u2014 run `kynver setup` (customers: boxKind=box) or `kynver setup --box-kind forge|ghost` for operator pools before dispatch"),n.slugInferenceBlocked&&!i){let g="ambiguous box identity: KYNVER_AGENT_OS_SLUG is set without KYNVER_BOX_KIND or config.boxKind";a||t.requireExplicitBoxKind?s.push(g):o.push(`${g} \u2014 defaulting box kind to box (customer), not forge/ghost`)}let l=Wi(e.runnerId),c=Wi(r.KYNVER_RUNTIME_ID)??Wi(r.OPENCLAW_RUNTIME_ID),u=l??c??Mx(n.boxKind,jm.hostname()),d=l?"config":c?"env":"derived";d==="derived"&&o.push(`runnerId not persisted \u2014 using derived id "${u}"; run \`kynver setup --box-kind ${n.boxKind}\` to persist runner identity`);let p=hn({config:e,env:r,totalMemBytes:jm.totalmem()}),f=lr(n.boxKind,p.configuredMaxWorkers??Po(n.boxKind,p.autoCap)),m=Li({boxKind:n.boxKind,configuredHarnessRoot:e.harnessRoot,env:r});return m.migrationBlocker&&s.push(m.migrationBlocker),s.length>0?{ok:!1,identity:null,errors:s,warnings:o}:{ok:!0,identity:{boxKind:n.boxKind,boxKindSource:n.source,runnerId:u,runnerIdSource:d,maxConcurrentWorkers:f,workerCapSource:p.workerCapSource,harnessRoot:m.harnessRoot,harnessRootSource:m.source},errors:s,warnings:o}}var Et=D(()=>{"use strict";A();Ce();fn();To();Pc()});import Ic from"node:path";function Ee(e){return Ui(e)}function ge(){let e=process.env.KYNVER_HARNESS_ROOT||process.env.OPUS_HARNESS_ROOT;if(e)return Ee(e);let r=v(),t=r.harnessRoot?.trim();if(t)return Ee(t);let n=ze(r,process.env);return n.identity?n.identity.harnessRoot:Li({boxKind:"forge",configuredHarnessRoot:null}).harnessRoot}function je(e){return Ic.join(Ee(e),"runs")}function tt(e){return Ic.join(Ee(e),"worktrees")}function kn(){let e=ge();return{harnessRoot:e,runsDir:je(e),worktreesDir:tt(e)}}function Tr(e,r){return Ic.join(e,C(r))}var Pe=D(()=>{"use strict";A();Pc();Et();x()});import{existsSync as Bi,readdirSync as Lx,statSync as Wx}from"node:fs";import Pt from"node:path";function re(){return kn()}function $(e){let{runsDir:r}=re(),t=Pt.join(Tr(r,C(e)),"run.json");return Bi(t)||He(`run '${e}' not found`),P(t)}function ne(){let{runsDir:e}=re();return Vm(e)}function Fi(e){return Vm(je(e))}function Bx(e){try{return Wx(e).isDirectory()}catch{return!1}}function Vm(e){if(!Bi(e))return[];let r=[];for(let t of Lx(e,{withFileTypes:!0})){if(t.name==="runs")continue;let n=Pt.join(e,t.name);if(!Bx(n))continue;let o=P(Pt.join(n,"run.json"),void 0);o?.id&&r.push(o)}return r}function Ie(e,r){let{runsDir:t}=re(),n=Pt.join(Tr(t,C(e)),"run.json"),o=Pt.join(Tr(t,C(e)),"workers",C(r),"worker.json");return Bi(o)||(Bi(n)||He(`run '${e}' not found`),He(`worker '${r}' not found in run '${e}'`)),P(o)}function We(e){let{runsDir:r}=re();de(Pt.join(Tr(r,e.id),"run.json"),e)}function Y(e,r){let{runsDir:t}=re();de(Pt.join(Tr(t,e),"workers",r.name,"worker.json"),r)}function T(e){let{harnessRoot:r}=re();return No(r,e)}function No(e,r){return Tr(je(e),C(r))}var M=D(()=>{"use strict";Pe();x()});import{existsSync as Fx,readdirSync as Kx}from"node:fs";import Hx from"node:path";function Oe(e){let r=new Set;for(let n of Object.keys(e.workers||{}))r.add(C(n));let t=Hx.join(T(e.id),"workers");if(!Fx(t))return[...r];for(let n of Kx(t,{withFileTypes:!0}))n.isDirectory()&&r.add(C(n.name));return[...r]}var It=D(()=>{"use strict";M();x()});function Oc(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let t=JSON.parse(r);if(t&&typeof t=="object"&&!Array.isArray(t))return t}catch{return null}return null}function Gm(e){let r=e.trim();if(!r)return null;let t=Oc(r);if(t)return t;let n=[],o=/```(?:json)?\s*([\s\S]*?)```/gi,s;for(;(s=o.exec(r))!==null;){let l=Oc(s[1]??"");l&&n.push(l)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let l=Oc(r.slice(i,a+1));l&&n.push(l)}return n.length>0?n[n.length-1]:null}function Ym(e){let r=e.finalResult??e.final_result;if(r!=null)return typeof r=="string"?Gm(r)??(r.trim()||null):r;let t=typeof e.summary=="string"?e.summary.trim():"";if(!t)return null;let n=Gm(t);return n||t}var Jm=D(()=>{"use strict"});import{existsSync as $x,readFileSync as jx}from"node:fs";function qm(e){return e==="complete"}function Nr(e){return qm(e.lastHeartbeatPhase)?e.terminalFinalResult!==void 0&&e.terminalFinalResult!==null?e.terminalFinalResult:e.lastHeartbeatSummary?.trim()||"completed":null}function ve(e){let r={heartbeatCount:0,lastHeartbeatAt:null,lastHeartbeatPhase:null,lastHeartbeatSummary:null,terminalFinalResult:null,heartbeatBlocker:null,timestampAnomalies:[],lastBoxResourceSnapshot:null,lastPrEvidence:[]};if(!$x(e))return r;let t=Date.now()+Vx,n=new Date(t).toISOString(),o=jx(e,"utf8").split(`
+`).map(r=>r.trim()).filter(Boolean)}function ee(e,r){try{let t=xm("git",r,me({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}function Cm(e,r,t){let n=ee(e,["merge-base","--is-ancestor",r,t]);return n.status===0?{isAncestor:!0,error:null}:n.status===1?{isAncestor:!1,error:null}:{isAncestor:null,error:n.error||n.stderr||n.stdout||`git exited ${n.status}`}}function Oi(e,r="origin/main"){let t=typeof r=="string"?{base:r}:r,n=t.baseCommit?.trim()||t.base?.trim()||"origin/main",o=t.baseCommit?.trim()||null;if(!e)return vc(n,"missing worktree path");let s=ee(e,["rev-parse","HEAD"]);if(s.status!==0)return vc(n,s.error||s.stderr||s.stdout||"failed to resolve HEAD");let i;if(o)i=o;else{let p=ee(e,["rev-parse",n]);if(p.status!==0)return vc(n,p.error||p.stderr||p.stdout||`failed to resolve ${n}`,s.stdout.trim());i=p.stdout.trim()}let a=s.stdout.trim();if(a===i)return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:!0,headIsAncestorOfBase:!0,relation:"synced"};let l=Cm(e,i,a),c=Cm(e,a,i),u=l.error||c.error||void 0;if(l.isAncestor==null||c.isAncestor==null)return{checked:!1,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:"unknown",...u?{error:u}:{}};let d=l.isAncestor?"ahead":c.isAncestor?"merged":"diverged";return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:d,...u?{error:u}:{}}}function vc(e,r,t=null){return{checked:!1,base:e,head:t,baseHead:null,baseIsAncestorOfHead:null,headIsAncestorOfBase:null,relation:"unknown",error:r}}var we=D(()=>{"use strict";Ke();x();Rc()});import{existsSync as Sc,readFileSync as Im}from"node:fs";import{homedir as VC}from"node:os";import Ir from"node:path";import{fileURLToPath as GC}from"node:url";function JC(e){let r=Ir.join(e,"package.json");if(!Sc(r))return null;try{let t=JSON.parse(Im(r,"utf8"));return typeof t.name=="string"?t.name.trim():null}catch{return null}}function qC(e){return JC(e)==="kynver"}function Pm(e){let r=Ir.resolve(e);if(!Sc(r))return null;let t=ee(r,["rev-parse","--show-toplevel"]);if(t.status!==0)return null;let n=t.stdout.trim();return n.length?Ir.resolve(n):null}function zC(e=import.meta.url){let r=Ir.dirname(GC(e));for(let t=0;t<8;t+=1){let n=Ir.join(r,"package.json");if(Sc(n))try{if(JSON.parse(Im(n,"utf8")).name==="@kynver-app/runtime")return r}catch{}let o=Ir.dirname(r);if(o===r)break;r=o}return null}function bc(e,r,t,n,o){if(!t)return;let s=Ir.resolve(t);e.has(s)||(o?.requireMonorepo??!0)&&!qC(s)||(e.add(s),r.push({repo:s,source:n}))}function Om(e){let r=e?.cwd??process.cwd(),t=new Set,n=[];bc(t,n,Pm(r),"cwd_git",{requireMonorepo:!1});let o=zC(e?.runtimeModuleUrl??import.meta.url);o&&bc(t,n,Pm(o),"runtime_checkout");let s=VC();for(let i of YC)bc(t,n,Fe(Ir.join(s,i)),"well_known_path");return n}function dn(e){return Om(e)[0]??null}function XC(e){let r=Ir.resolve(e).replace(/\\/g,"/");return r.includes("/.kynver/harness/worktrees/")||r.includes("/.openclaw/harness/worktrees/")||r.includes("/kynver-harness/")||r.includes("/openclaw/harness/worktrees/")}function pn(e){let r=Om(e);return r.find(n=>!XC(n.repo))??r[0]??null}var YC,Eo=D(()=>{"use strict";we();Ke();YC=["Kynver","repos/Kynver","repos/kynver-source-main","code/Kynver","projects/Kynver"]});function et(e){let r=(e??"").trim().toLowerCase();return r==="ghost"||r==="forge"||r==="box"?r:r.includes("forge")?"forge":r.includes("ghost")||r.includes("openclaw")?"ghost":"box"}function Ai(e,r){return e[r]?.trim()||null}function Am(e){let r=e?.split(":")[0]?.trim();return r?et(r):null}function _e(e=process.env,r={}){let t=[],n=Am(r.boxId),o=Am(Ai(e,"KYNVER_BOX_ID")),s=r.boxKind?.trim();if(s)return n&&n!==et(s)&&t.push(`config.boxId=${r.boxId} conflicts with boxKind=${s}; using explicit boxKind=${s}`),{boxKind:et(s),source:"config",slugInferenceBlocked:!1,warnings:t};let i=Ai(e,"KYNVER_BOX_KIND");if(i)return o&&o!==et(i)&&t.push(`KYNVER_BOX_ID=${Ai(e,"KYNVER_BOX_ID")} conflicts with KYNVER_BOX_KIND=${i}; using explicit KYNVER_BOX_KIND=${i}`),{boxKind:et(i),source:"env",slugInferenceBlocked:!1,warnings:t};if(n)return{boxKind:n,source:"config",slugInferenceBlocked:!1,warnings:t};if(o)return{boxKind:o,source:"env",slugInferenceBlocked:!1,warnings:t};let a=Ai(e,"KYNVER_AGENT_OS_SLUG");return a&&t.push(`KYNVER_AGENT_OS_SLUG=${a} is a workspace slug, not box identity \u2014 operators set boxKind via \`kynver setup --box-kind forge|ghost\` or KYNVER_BOX_KIND; customers default to box`),{boxKind:"box",source:"default",slugInferenceBlocked:!!a,warnings:t}}function $e(e={},r=process.env){return _e(r,e).boxKind}var Ce=D(()=>{"use strict"});function Po(e,r){return e==="forge"?4:Math.max(1,r)}function lr(e,r){return e==="forge"?Math.min(Math.max(1,r),4):Math.max(1,r)}function mn(e,r){return e==="forge"&&r>4}var fn=D(()=>{"use strict"});import{readFileSync as QC}from"node:fs";import Tm from"node:os";function Io(e){if(e!==void 0){let r=e.match(/^MemAvailable:\s+(\d+)\s*kB/m);return r?Number(r[1])*1024:Tm.freemem()}if(process.platform==="linux")try{let t=QC("/proc/meminfo","utf8").match(/^MemAvailable:\s+(\d+)\s*kB/m);if(t)return Number(t[1])*1024}catch{}return Tm.freemem()}var Ti=D(()=>{"use strict"});import{existsSync as ZC,readFileSync as ex,statfsSync as rx}from"node:fs";function wc(){if(process.platform!=="linux")return!1;for(let e of["/proc/sys/kernel/osrelease","/proc/version"])try{if(!ZC(e))continue;let r=ex(e,"utf8");if(/microsoft|wsl/i.test(r))return!0}catch{}return!1}function Nm(e={}){if(!(e.forceWsl===void 0?wc():e.forceWsl))return null;let t=e.wslHostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||gn,n=e.wslHostFreeWarnBytes??tx,o=e.wslHostFreeCriticalBytes??nx,s=e.statfs??rx,i;try{i=s(t)}catch(g){return{ok:!1,path:t,freeBytes:0,totalBytes:0,usedPercent:100,warnBelowBytes:n,criticalBelowBytes:o,reason:`Windows host disk probe failed at ${t}: ${g.message}`,probeError:g.message}}let a=Number(i.bavail)*Number(i.bsize),l=Number(i.blocks)*Number(i.bsize),c=l>0?(l-a)/l*100:100,u=a<n,d=a<o,p=!u&&!d,f=(a/(1024*1024*1024)).toFixed(1),m=null;return p||(m=`Windows host disk ${t} at ${d?"critical":"warning"}: ${f} GiB free (<${(d?o:n)/1024/1024/1024} GiB); WSL VHDX cannot grow safely. ${ox()}`),{ok:p,path:t,freeBytes:a,totalBytes:l,usedPercent:c,warnBelowBytes:n,criticalBelowBytes:o,reason:m,probeError:null}}function ox(){return"Recovery: 1) free Windows C: (empty Recycle Bin / Storage Sense / clear %TEMP% and %LOCALAPPDATA%\\Temp\\wsl-crashes); 2) shut down WSL (`wsl --shutdown`) then compact the VHDX (`Optimize-VHD` or `diskpart compact vdisk`); 3) clear local node_modules / .next / harness worktrees before restarting workers; 4) disable recurring dumps via `%USERPROFILE%/.wslconfig` (`maxCrashDumpCount=-1`) or `kynver wsl-crashes --execute`. More help: https://www.kynver.com/help."}var tx,nx,gn,_c=D(()=>{"use strict";tx=25*1024*1024*1024,nx=12*1024*1024*1024,gn="/mnt/c"});import{execFileSync as Dm}from"node:child_process";import{existsSync as Di,readFileSync as Mm,readdirSync as sx,statSync as ix}from"node:fs";import Cc from"node:path";function Ni(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)?n:r}function Um(){let e=process.env.KYNVER_WSL_WIN_USER?.trim();if(e)return e;try{let n=Dm("cmd.exe",["/c","echo","%USERNAME%"],{encoding:"utf8",timeout:5e3,stdio:["ignore","pipe","ignore"]}).trim();if(n&&n!=="%USERNAME%"&&!n.includes("%"))return n}catch{}let r=process.env.USER?.trim()||process.env.LOGNAME?.trim(),t=process.env.KYNVER_WSL_HOST_MOUNT?.trim()||gn;return r&&Di(Cc.join(t,"Users",r))?r:null}function dx(e={}){let r=e.crashDumpDir?.trim()||process.env.KYNVER_WSL_CRASH_DUMP_DIR?.trim();if(r)return r;let t=e.hostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||gn,n=e.windowsUser??Um();return n?`${t.replace(/\\/g,"/").replace(/\/$/,"")}/Users/${n}/AppData/Local/Temp/wsl-crashes`:null}function px(e){let r=/^wsl-crash-\d+-(\d+)-(.+)-(\d+)\.dmp$/i.exec(e);if(!r)return{executableHint:null,signal:null,pid:null};let t=Number(r[1]),n=r[2]??"",o=Number(r[3]),s=n.split("_").filter(Boolean);return{executableHint:s.length>0?s[s.length-1]:null,signal:Number.isFinite(o)?o:null,pid:Number.isFinite(t)?t:null}}function mx(){try{if(Di("/proc/sys/kernel/core_pattern"))return Mm("/proc/sys/kernel/core_pattern","utf8").trim()}catch{}try{return Dm("sysctl",["-n","kernel.core_pattern"],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()||null}catch{return null}}function fx(e){return!!(e&&/wsl-capture-crash/i.test(e))}function gx(e,r=gn){let t=Cc.join(r,"Users",e,".wslconfig");if(!Di(t))return{maxCrashDumpCount:null,crashDumpFolder:null};let n;try{n=Mm(t,"utf8")}catch{return null}let o=null,s=null;for(let i of n.split(/\r?\n/)){let a=i.replace(/#.*$/,"").trim();if(!a||a.startsWith("["))continue;let l=a.indexOf("=");if(l<0)continue;let c=a.slice(0,l).trim().toLowerCase(),u=a.slice(l+1).trim();if(c==="maxcrashdumpcount"){let d=Number(u);o=Number.isFinite(d)?d:null}else c==="crashdumpfolder"&&(s=u.replace(/^["']|["']$/g,"")||null)}return{maxCrashDumpCount:o,crashDumpFolder:s}}function hx(e){if(!Di(e))return[];let r=sx(e,{withFileTypes:!0}),t=[];for(let n of r){if(!n.isFile()||!n.name.toLowerCase().endsWith(".dmp"))continue;let o=Cc.join(e,n.name);try{let s=ix(o),i=px(n.name);t.push({name:n.name,path:o,bytes:s.size,mtimeMs:s.mtimeMs,executableHint:i.executableHint,signal:i.signal,pid:i.pid})}catch{}}return t.sort((n,o)=>o.mtimeMs-n.mtimeMs),t}function rt(e={}){if(!(e.forceWsl===void 0?wc():e.forceWsl))return null;let t=e.hostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||gn,n=e.windowsUser??Um(),o=e.warnBelowBytes??Ni("KYNVER_WSL_CRASH_DUMP_WARN_BYTES",ax),s=e.criticalBelowBytes??Ni("KYNVER_WSL_CRASH_DUMP_CRITICAL_BYTES",lx),i=e.warnCount??Ni("KYNVER_WSL_CRASH_DUMP_WARN_COUNT",cx),a=e.criticalCount??Ni("KYNVER_WSL_CRASH_DUMP_CRITICAL_COUNT",ux),l=(e.readCorePattern??mx)(),c=fx(l),u=null;n&&(u=(e.readWslConfig??gx)(n,t));let d=u?.maxCrashDumpCount??null,p=d===-1,f=dx({hostMount:t,windowsUser:n,crashDumpDir:e.crashDumpDir});if(!f)return{ok:!0,path:null,windowsUser:n,dumpCount:0,totalBytes:0,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:[],executables:[],corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:null,probeError:"windows_user_unresolved"};let m;try{m=(e.listDumps??hx)(f)}catch(j){return{ok:!1,path:f,windowsUser:n,dumpCount:0,totalBytes:0,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:[],executables:[],corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:`WSL crash dump probe failed at ${f}: ${j.message}`,probeError:j.message}}let g=m.reduce((j,N)=>j+N.bytes,0),y=m.length,R=[...new Set(m.map(j=>j.executableHint).filter(j=>!!j))],h=g>=s,k=g>=o,S=y>=a,I=y>=i,_=!(h||S||k||I),F=null;if(!_){let j=h||S?"critical":"warning",N=(g/1024**3).toFixed(1),fe=R.length>0?R.join(", "):"unknown";F=`WSL crash dumps ${j}: ${y} file(s), ${N} GiB at ${f} (executables: ${fe}). `+kx({wslCaptureEnabled:c,dumpsDisabledInWslConfig:p})}return{ok:_,path:f,windowsUser:n,dumpCount:y,totalBytes:g,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:m,executables:R,corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:F,probeError:null}}function kx(e={}){let r=["Recovery:","1) run `kynver wsl-crashes --execute` or scripts/cleanup-wsl-crashes.ps1 to prune old .dmp files;"];return e.dumpsDisabledInWslConfig||r.push("2) add `[wsl2]\\nmaxCrashDumpCount=-1` to %USERPROFILE%/.wslconfig then `wsl --shutdown` to disable future dumps;"),e.wslCaptureEnabled&&r.push("3) investigate crashing executables (node OOM/SIGBUS often follows Windows C: pressure);"),r.push("More help: https://www.kynver.com/help."),r.join(" ")}var ax,lx,cx,ux,Oo=D(()=>{"use strict";_c();ax=5*1024*1024*1024,lx=10*1024*1024*1024,cx=2,ux=4});import{statfsSync as yx}from"node:fs";function kr(e={}){let r=e.diskPath?.trim()||"/",t=e.diskFreeWarnBytes??Rx,n=e.diskFreeCriticalBytes??vx,o=e.diskMaxUsedPercent??bx,s=e.diskHardMaxUsedPercent??Sx,i=yx(r),a=Number(i.bavail)*Number(i.bsize),l=Number(i.blocks)*Number(i.bsize),c=l>0?(l-a)/l*100:100,u=a<t,d=a<n,p=a<t*2,f=p&&c>o,m=p&&c>s,g=!u&&!d&&!f&&!m,y=e.skipWslHostCheck?null:Nm(e.wslHost),R=e.skipWslCrashDumpCheck?null:rt(e.wslCrashDumps),h=g&&(y?y.ok:!0)&&(R?R.ok:!0),k=null;return h||(k=[d?`free space below critical ${n} bytes`:null,u?`free space below warning ${t} bytes`:null,m?`used percent above hard cap ${s}%`:null,f?`used percent above cap ${o}%`:null,y&&!y.ok?y.reason:null,R&&!R.ok?R.reason:null].filter(Boolean).join("; ")),wx({ok:h,path:r,freeBytes:a,totalBytes:l,usedPercent:c,warnBelowBytes:t,criticalBelowBytes:n,maxUsedPercent:o,hardMaxUsedPercent:s,reason:k,wslHost:y,wslCrashDumps:R?{ok:R.ok,path:R.path,dumpCount:R.dumpCount,totalBytes:R.totalBytes,executables:R.executables,wslCaptureEnabled:R.wslCaptureEnabled,dumpsDisabledInWslConfig:R.dumpsDisabledInWslConfig,reason:R.reason,probeError:R.probeError}:null})}function wx(e){let r=process.env.KYNVER_DISPATCH_DISK_GATE_FORCE?.trim().toLowerCase();return r?r==="ok"||r==="open"||r==="none"?e.ok?e:{...e,ok:!0,reason:`disk gate forced open by KYNVER_DISPATCH_DISK_GATE_FORCE (suppressed: ${e.reason??"no reason"})`}:r==="block"||r==="pressured"?{...e,ok:!1,reason:`disk gate forced closed by KYNVER_DISPATCH_DISK_GATE_FORCE${e.reason?` (underlying: ${e.reason})`:""}`}:e:e}var Rx,vx,bx,Sx,Ao=D(()=>{"use strict";Oo();_c();Rx=30*1024*1024*1024,vx=15*1024*1024*1024,bx=80,Sx=90});import{existsSync as Or,mkdirSync as _x,readdirSync as Mi,renameSync as Lm,statSync as Cx}from"node:fs";import Ar from"node:path";function Bm(e){try{return Cx(e).isDirectory()}catch{return!1}}function xx(e){if(!Or(e))return!0;for(let r of Wm){let t=Ar.join(e,r);if(Or(t)&&(!Bm(t)||Mi(t).length>0))return!1}return!0}function Ex(e){let r=Ar.join(e,"runs");if(!Or(r)||!Bm(r))return!1;for(let t of Mi(r,{withFileTypes:!0})){if(!t.isDirectory()||t.name==="runs")continue;let n=Ar.join(r,t.name,"run.json");if(P(n,void 0)?.id)return!0}return!1}function Px(e){let r=Ar.join(e,"runs");if(!Or(r))return!1;for(let t of Mi(r,{withFileTypes:!0})){if(!t.isDirectory())continue;if(P(Ar.join(r,t.name,"run.json"),void 0)?.boxKind==="ghost")return!0}return!1}function Ix(e){let r=Ar.join(e,"ghost");return Or(r)?!Or(Ar.join(r,"runs")):Px(e)}function Fm(e){return Ex(e.sharedRoot)?xx(e.forgeRoot)?Ix(e.sharedRoot)?{action:"blocked",blocker:"Forge legacy harness migration blocked: Ghost pool is co-hosted on this host (ghost namespace or ghost-attributed runs under ~/.kynver/harness). Drain in-flight Ghost runs from the shared root, or get operator sign-off for a fresh Forge cutover before enabling box-scoped isolation."}:{action:"migrate"}:{action:"none"}:{action:"none"}}function Km(e,r){_x(r,{recursive:!0});for(let t of Wm){let n=Ar.join(e,t),o=Ar.join(r,t);if(Or(n)){if(Or(o)&&Mi(o).length>0)throw new Error(`Forge legacy harness migration failed: ${o} is not empty`);if(Or(o)){Lm(n,o);continue}Lm(n,o)}}}var Wm,Hm=D(()=>{"use strict";x();Wm=["runs","worktrees"]});import{existsSync as De}from"node:fs";import{homedir as Ox}from"node:os";import xe from"node:path";function xc(e=process.env){return e.HOME?.trim()||Ox()}function Ec(e=process.env){return xe.join(xc(e),".kynver","harness")}function Ui(e){let r=xe.resolve(Fe(e.trim()));for(;Ax.has(xe.basename(r));)r=xe.dirname(r);return r}function Tx(e,r=process.env){return xe.join(Ec(r),e)}function Nx(e=process.env){let r=Ec(e);if(De(xe.join(r,"runs")))return!0;if(De(r)&&!De(xe.join(r,"ghost"))&&!De(xe.join(r,"forge")))return De(r);let t=xe.join(xc(e),$m);return De(t)}function Li(e){let r=e.env??process.env,t=r.KYNVER_HARNESS_ROOT?.trim()||r.OPUS_HARNESS_ROOT?.trim();if(t)return{harnessRoot:Ui(t),source:"env"};let n=e.configuredHarnessRoot?.trim();if(n)return{harnessRoot:Ui(n),source:"config"};let o=Tx(e.boxKind,r);if(De(xe.join(o,"runs"))||De(o)&&!Dx(o))return{harnessRoot:o,source:"box_scoped"};let i=Ec(r);if(e.boxKind==="forge"){let a=Fm({sharedRoot:i,forgeRoot:o});if(a.action==="blocked")return{harnessRoot:o,source:"box_scoped",migrationBlocker:a.blocker};if(a.action==="migrate")return e.allowForgeLegacyMigration!==!1&&Km(i,o),{harnessRoot:o,source:"legacy_migrated"}}if(e.boxKind==="ghost"&&Nx(r)){if(De(xe.join(i,"runs")))return{harnessRoot:i,source:"legacy_shared"};if(De(i)&&!De(xe.join(i,"ghost"))&&!De(xe.join(i,"forge")))return{harnessRoot:i,source:"legacy_shared"};let l=xe.join(xc(r),$m);if(De(l))return{harnessRoot:l,source:"legacy_shared"}}return{harnessRoot:o,source:"box_scoped"}}function Dx(e){if(!De(e))return!0;for(let r of["runs","worktrees"]){let t=xe.join(e,r);if(De(t))return!1}return!0}var $m,Ax,Pc=D(()=>{"use strict";Ke();Hm();$m=xe.join(".openclaw","harness");Ax=new Set(["runs","worktrees"])});import jm from"node:os";function Wi(e){return e?.trim()?e.trim():null}function Mx(e,r){let t=r.trim().toLowerCase()||"host";return`${e}-${t}`.replace(/[^a-z0-9._-]+/g,"-")}function Ux(e){return e.KYNVER_DISPATCH_STRICT_IDENTITY==="1"||e.KYNVER_DISPATCH_STRICT_IDENTITY==="true"||e.KYNVER_DAEMON_STRICT_IDENTITY==="1"||e.KYNVER_DAEMON_STRICT_IDENTITY==="true"}function ze(e=v(),r=process.env,t={}){let n=_e(r,e),o=[...n.warnings],s=[],i=!!(e.boxKind?.trim()||Wi(r.KYNVER_BOX_KIND)),a=t.strict===!0||Ux(r);if((t.requireExplicitBoxKind||a)&&!i&&s.push("boxKind is not persisted in ~/.kynver/config.json and KYNVER_BOX_KIND is unset \u2014 run `kynver setup` (customers: boxKind=box) or `kynver setup --box-kind forge|ghost` for operator pools before dispatch"),n.slugInferenceBlocked&&!i){let g="ambiguous box identity: KYNVER_AGENT_OS_SLUG is set without KYNVER_BOX_KIND or config.boxKind";a||t.requireExplicitBoxKind?s.push(g):o.push(`${g} \u2014 defaulting box kind to box (customer), not forge/ghost`)}let l=Wi(e.runnerId),c=Wi(r.KYNVER_RUNTIME_ID)??Wi(r.OPENCLAW_RUNTIME_ID),u=l??c??Mx(n.boxKind,jm.hostname()),d=l?"config":c?"env":"derived";d==="derived"&&o.push(`runnerId not persisted \u2014 using derived id "${u}"; run \`kynver setup --box-kind ${n.boxKind}\` to persist runner identity`);let p=hn({config:e,env:r,totalMemBytes:jm.totalmem()}),f=lr(n.boxKind,p.configuredMaxWorkers??Po(n.boxKind,p.autoCap)),m=Li({boxKind:n.boxKind,configuredHarnessRoot:e.harnessRoot,env:r});return m.migrationBlocker&&s.push(m.migrationBlocker),s.length>0?{ok:!1,identity:null,errors:s,warnings:o}:{ok:!0,identity:{boxKind:n.boxKind,boxKindSource:n.source,runnerId:u,runnerIdSource:d,maxConcurrentWorkers:f,workerCapSource:p.workerCapSource,harnessRoot:m.harnessRoot,harnessRootSource:m.source},errors:s,warnings:o}}var Et=D(()=>{"use strict";A();Ce();fn();To();Pc()});import Ic from"node:path";function Ee(e){return Ui(e)}function ge(){let e=process.env.KYNVER_HARNESS_ROOT||process.env.OPUS_HARNESS_ROOT;if(e)return Ee(e);let r=v(),t=r.harnessRoot?.trim();if(t)return Ee(t);let n=ze(r,process.env);return n.identity?n.identity.harnessRoot:Li({boxKind:"forge",configuredHarnessRoot:null}).harnessRoot}function je(e){return Ic.join(Ee(e),"runs")}function tt(e){return Ic.join(Ee(e),"worktrees")}function kn(){let e=ge();return{harnessRoot:e,runsDir:je(e),worktreesDir:tt(e)}}function Tr(e,r){return Ic.join(e,C(r))}var Pe=D(()=>{"use strict";A();Pc();Et();x()});import{existsSync as Bi,readdirSync as Lx,statSync as Wx}from"node:fs";import Pt from"node:path";function re(){return kn()}function $(e){let{runsDir:r}=re(),t=Pt.join(Tr(r,C(e)),"run.json");return Bi(t)||He(`run '${e}' not found`),P(t)}function ne(){let{runsDir:e}=re();return Vm(e)}function Fi(e){return Vm(je(e))}function Bx(e){try{return Wx(e).isDirectory()}catch{return!1}}function Vm(e){if(!Bi(e))return[];let r=[];for(let t of Lx(e,{withFileTypes:!0})){if(t.name==="runs")continue;let n=Pt.join(e,t.name);if(!Bx(n))continue;let o=P(Pt.join(n,"run.json"),void 0);o?.id&&r.push(o)}return r}function Ie(e,r){let{runsDir:t}=re(),n=Pt.join(Tr(t,C(e)),"run.json"),o=Pt.join(Tr(t,C(e)),"workers",C(r),"worker.json");return Bi(o)||(Bi(n)||He(`run '${e}' not found`),He(`worker '${r}' not found in run '${e}'`)),P(o)}function We(e){let{runsDir:r}=re();de(Pt.join(Tr(r,e.id),"run.json"),e)}function Y(e,r){let{runsDir:t}=re();de(Pt.join(Tr(t,e),"workers",r.name,"worker.json"),r)}function T(e){let{harnessRoot:r}=re();return No(r,e)}function No(e,r){return Tr(je(e),C(r))}var M=D(()=>{"use strict";Pe();x()});import{existsSync as Fx,readdirSync as Kx}from"node:fs";import Hx from"node:path";function Oe(e){let r=new Set;for(let n of Object.keys(e.workers||{}))r.add(C(n));let t=Hx.join(T(e.id),"workers");if(!Fx(t))return[...r];for(let n of Kx(t,{withFileTypes:!0}))n.isDirectory()&&r.add(C(n.name));return[...r]}var It=D(()=>{"use strict";M();x()});function Oc(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let t=JSON.parse(r);if(t&&typeof t=="object"&&!Array.isArray(t))return t}catch{return null}return null}function Gm(e){let r=e.trim();if(!r)return null;let t=Oc(r);if(t)return t;let n=[],o=/```(?:json)?\s*([\s\S]*?)```/gi,s;for(;(s=o.exec(r))!==null;){let l=Oc(s[1]??"");l&&n.push(l)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let l=Oc(r.slice(i,a+1));l&&n.push(l)}return n.length>0?n[n.length-1]:null}function Ym(e){let r=e.finalResult??e.final_result;if(r!=null)return typeof r=="string"?Gm(r)??(r.trim()||null):r;let t=typeof e.summary=="string"?e.summary.trim():"";if(!t)return null;let n=Gm(t);return n||t}var Jm=D(()=>{"use strict"});import{existsSync as $x,readFileSync as jx}from"node:fs";function qm(e){return e==="complete"}function Nr(e){return qm(e.lastHeartbeatPhase)?e.terminalFinalResult!==void 0&&e.terminalFinalResult!==null?e.terminalFinalResult:e.lastHeartbeatSummary?.trim()||"completed":null}function ve(e){let r={heartbeatCount:0,lastHeartbeatAt:null,lastHeartbeatPhase:null,lastHeartbeatSummary:null,terminalFinalResult:null,heartbeatBlocker:null,timestampAnomalies:[],lastBoxResourceSnapshot:null,lastPrEvidence:[]};if(!$x(e))return r;let t=Date.now()+Vx,n=new Date(t).toISOString(),o=jx(e,"utf8").split(`
 `).filter(Boolean);for(let s of o){let i=un(s);if(!i||typeof i!="object"||Array.isArray(i))continue;let a=i;if(r.heartbeatCount++,a.ts){let l=String(a.ts),c=Date.parse(l);Number.isFinite(c)&&c>t?r.timestampAnomalies.push({kind:"future_heartbeat_timestamp",observedAt:l,clampedTo:n}):r.lastHeartbeatAt=l}a.phase!==void 0&&a.phase!==null&&(r.lastHeartbeatPhase=String(a.phase)),a.summary!==void 0&&a.summary!==null&&(r.lastHeartbeatSummary=String(a.summary)),qm(r.lastHeartbeatPhase)&&(r.terminalFinalResult=Ym(a)),r.heartbeatBlocker=a.blocker?String(a.blocker):null,a.boxResourceSnapshot&&typeof a.boxResourceSnapshot=="object"&&!Array.isArray(a.boxResourceSnapshot)&&(r.lastBoxResourceSnapshot=a.boxResourceSnapshot),Array.isArray(a.prEvidence)&&(r.lastPrEvidence=a.prEvidence.filter(l=>!!l&&typeof l=="object"&&typeof l.prUrl=="string"))}return r}var Vx,nt=D(()=>{"use strict";Jm();x();Vx=6e4});function Xm(e){return e?(e.split("/").pop()??e).replace(/\.exe$/i,"").toLowerCase():null}function Ki(e){if(!e)return[];let r=[],t="",n,o=!1;for(let s of e){if(o){t+=s,o=!1;continue}if(s==="\\"){o=!0;continue}if(n){s===n?n=void 0:t+=s;continue}if(s==='"'||s==="'"){n=s;continue}if(/\s/.test(s)){t&&(r.push(t),t="");continue}t+=s}return t&&r.push(t),r}function Qm(e){let r=Xm(e[0]);return!!(r&&Gx.has(r))}function Jx(e){let r=e.trim();return r.includes("/")?r.split("/").pop()??r:r}function qx(e){if(!e||e.includes("*"))return null;let r=Jx(e);return!r||r.includes("/")?null:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(r)?r:null}function Zm(e){return!e||e.includes("/")||e.includes("*")?!1:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(e)}function Ac(e){if(!e)return!1;let r=e.trim();return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")}function zx(e){if(!e.startsWith("--glob="))return e;let r=e.slice(7);return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")?`--glob=${r}/**`:e}function Xx(e){let r=[];for(let t=1;t<e.length;t+=1){let n=e[t];if(n){if(n==="--"){r.push(...e.slice(t+1));break}if(n.startsWith("-")){if(n.includes("="))continue;zm.has(n)&&(t+=1);continue}r.push(n)}}return r}function Qx(e){let r=!1,t=e.map((o,s)=>{let i=zx(o),a=e[s-1];return a&&zm.has(a)&&o.startsWith("!")&&!o.includes("/")&&!o.endsWith("/**")&&(i=`${o}/**`),i!==o&&(r=!0),i}),n=Xx(t);if(n.length===2){let[o,s]=n;if(Ac(s))return{argv:[t[0]??"rg",o,"-g",`${s}/**`,"."],changed:!0};let i=qx(s);if(i)return{argv:[t[0]??"rg","-g",i,o,"."],changed:!0}}return r&&n.length===1?{argv:[...t,"."],changed:!0}:{argv:t,changed:r}}function ef(e){for(let r=1;r<e.length;r+=1){let t=e[r];if(t&&(t==="-c"||t==="-lc"||t==="-cl"||/^-[a-zA-Z]*c[a-zA-Z]*$/u.test(t)))return r+1}return-1}function Hi(e){let r=e.trim();if(!r)return{command:r,wrapped:!1};let t=Ki(r);if(!t.length)return{command:r,wrapped:!1};let n=Xm(t[0]);if(!n||!Yx.has(n))return{command:r,wrapped:!1};let o=ef(t);if(o<0||o>=t.length)return{command:r,wrapped:!1};let s=t.slice(o).join(" ").trim();return s?{command:s,wrapped:!0}:{command:r,wrapped:!1}}function Zx(e,r){let t=e.trim(),n=Ki(t),o=ef(n);if(o<0)return r;let s=n.slice(0,o).join(" "),i=r.includes("'")?`"${r.replace(/"/g,'\\"')}"`:`'${r}'`;return`${s} ${i}`}function eE(e){let r=e.trim(),t=Hi(r),n=Ki(t.command);if(!n.length||!Qm(n))return{segment:r,changed:!1};let o=Qx(n);if(!o.changed)return{segment:r,changed:!1};let s=o.argv.join(" ");return t.wrapped?{segment:Zx(r,s),changed:!0}:{segment:s,changed:!0}}function Tc(e){let r=e.trim();if(!r)return{command:r,changed:!1};let t=r.includes("&&")?" && ":r.includes("||")?" || ":"; ",n=r.split(/\s*(?:&&|\|\||;)\s*/u),o=!1,s=n.map(i=>{let a=eE(i);return a.changed&&(o=!0),a.segment});return o?{command:s.join(t),changed:!0}:{command:r,changed:!1}}function rf(e){let r=Hi(e).command,t=Ki(r.trim());return t.length&&Qm(t)?!0:/\b(rg|ripgrep)\b/i.test(r)}function tf(e){if(!e)return{};let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(|$)/iu);if(r)return{pattern:r[1],target:r[2]?.trim()};let t=e.match(/^search\s+"(.+)"\s+in\s+(.+)$/iu);return t?{pattern:t[1],target:t[2]?.trim()}:{}}function rE(e){let{pattern:r,target:t}=tf(e);return r?Ac(t)?{kind:"rg_exclude_syntax",pattern:r,target:t}:Zm(t)?{kind:"bad_scope",pattern:r,target:t}:{kind:"not_repo_search",pattern:r,target:t}:{kind:"not_repo_search"}}function tE(e){let{pattern:r,target:t}=tf(e);if(!r)return null;if(Ac(t)){let n=`${t.trim()}/**`;return{command:`rg "${r}" -g '${n}' .`,changed:!0}}return t&&Zm(t)?{command:`rg -g ${t} "${r}" .`,changed:!0}:null}function nE(e){if(e.kind==="bad_scope"&&e.pattern&&e.target)return`Use \`rg -g '${e.target}' ${e.pattern} .\` from the repo root instead of treating ${e.target} as a folder.`;if(e.kind==="rg_exclude_syntax"&&e.pattern){let r=e.target?`${e.target.trim()}/**`:"!node_modules/**";return`Repo search scope \`${e.target??"!node_modules"}\` is not a valid ripgrep path. Use \`rg "${e.pattern}" -g '${r}' .\` from the repo root (exclude globs need a \`/**\` suffix).`}return e.kind==="no_matches"&&e.pattern?`No matches for "${e.pattern}". Try a broader pattern, drop overly short tokens, or search from the repo root with \`rg "${e.pattern}" .\`.`:null}function oE(e){let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(agent\)|\s*failed|$)/iu);return r?`search "${r[1]}" in ${r[2]?.trim()}`:null}function Nc(e){let r=e.meta?.trim()||(e.command?oE(e.command):null)||null;if(r){let t=rE(r),n=nE(t);if(n)return n;let o=tE(r);if(o?.changed)return`Repo search used an invalid scope. Retry with: \`${o.command}\`.`}if(e.command&&/\b(rg|ripgrep)\b/i.test(e.command)){let t=Tc(e.command);if(t.changed)return`Ripgrep scope may be invalid. Retry with: \`${t.command}\`.`;if(e.exitCode===1)return"Ripgrep returned no matches (exit 1). Try a broader pattern or search from the repo root."}return null}var Gx,Yx,zm,nf=D(()=>{"use strict";Gx=new Set(["rg","ripgrep","grep"]),Yx=new Set(["bash","sh","dash","zsh"]),zm=new Set(["-e","--regexp","-f","--file","-m","--max-count","-A","--after-context","-B","--before-context","-C","--context","-g","--glob","--iglob"])});function Do(e,r=200){let t=e.replace(/\s+/g," ").trim();return t.length>r?`${t.slice(0,r-1)}\u2026`:t}function aE(e){let r=e.trim();if(!r)return null;if(r.startsWith("{"))try{return JSON.parse(r)}catch{}let t=r.indexOf("{"),n=r.lastIndexOf("}");if(t>=0&&n>t)try{return JSON.parse(r.slice(t,n+1))}catch{return null}return null}function Mo(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function lE(e){let r=e.metadata;if(!Mo(r))return null;let t=r.vulnerabilities;if(!Mo(t))return null;let n=s=>typeof t[s]=="number"?t[s]:0,o={info:n("info"),low:n("low"),moderate:n("moderate"),high:n("high"),critical:n("critical"),total:n("total")};return typeof t.total!="number"&&!o.critical&&!o.high&&!o.moderate&&!o.low&&!o.info?null:o}function cE(e){let r=[];e.critical&&r.push(`${e.critical} critical`),e.high&&r.push(`${e.high} high`),e.moderate&&r.push(`${e.moderate} moderate`),e.low&&r.push(`${e.low} low`),e.info&&r.push(`${e.info} info`);let t=r.length?r.join(", "):"see report";return`npm audit: ${e.total} vulnerabilit${e.total===1?"y":"ies"} (${t}) \u2014 remediation required`}function uE(e,r){let t=e.error;if(Mo(t)){let s=typeof t.summary=="string"?t.summary.trim():"",i=typeof t.code=="string"?t.code.trim():"";if(s)return i?`${i}: ${s}`:s;if(i)return i}let n=typeof e.message=="string"?e.message.trim():"";if(n)return n;let o=r.trim();return o?Do(o.split(`
 `).find(Boolean)??o,160):"npm audit failed"}function dE(e){let r=`${e.stdout}
 ${e.stderr}`.trim(),t=aE(r);if(!t||!Mo(t)){let o=Do(r||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit failed (invalid or missing JSON): ${o}`,parseError:"invalid_json"}}if(Mo(t.error))return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit command failed: ${uE(t,e.stderr)}`};let n=lE(t);return n?e.exitCode===0&&n.total===0?{kind:"success",exitCode:0,summary:"npm audit: no vulnerabilities reported",audit:n}:{kind:"audit_findings",exitCode:e.exitCode,summary:cE(n),audit:n}:{kind:"command_failure",exitCode:e.exitCode,summary:"npm audit failed: JSON response missing vulnerability metadata",parseError:"missing_metadata"}}function pE(e){return sE.test(e)}function mE(e){let r=Hi(e).command;return of.test(e)||of.test(r)||rf(e)}function fE(e){let r=Nc({command:e.command,exitCode:e.exitCode});if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"ripgrep finished (exit 0)"};if(e.exitCode===1){let n=(e.stderr||e.interleaved).trim();if(n&&iE.test(n)){let i=Do(n,160);return{kind:"command_failure",exitCode:1,summary:r??`ripgrep failed (exit 1): ${i}`}}let o=Tc(e.command),s=o.changed&&!r?` Retry with: \`${o.command}\`.`:"";return{kind:"search_no_matches",exitCode:1,summary:r??`ripgrep: no matches (exit 1).${s} Try a broader pattern or search from the repo root.`}}let t=Do(e.interleaved||e.stdout||e.stderr||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:r??`ripgrep failed (exit ${e.exitCode}): ${t}`}}function Dc(e){let r=e.stdout??"",t=e.stderr??"",n=e.interleavedOutput??"";if(pE(e.command)){let i=r.trim()||n.trim()||t.trim();return dE({exitCode:e.exitCode,stdout:i,stderr:t})}if(mE(e.command))return fE({command:e.command,exitCode:e.exitCode,stdout:r,stderr:t,interleaved:n});let o=Nc({command:e.command,exitCode:e.exitCode});if(o&&e.exitCode!==0)return{kind:"command_failure",exitCode:e.exitCode,summary:o};if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"command succeeded (exit 0)"};let s=Do(n||r||t||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`command failed (exit ${e.exitCode}): ${s}`}}var sE,of,iE,sf=D(()=>{"use strict";nf();sE=/\bnpm\s+audit\b/i,of=/\b(rg|ripgrep)\b/i,iE=/\b(error|invalid|unknown|panic|not found)\b/i});import{existsSync as gE,readFileSync as hE}from"node:fs";function kE(e){let r=e.timestamp_ms;return e.timestamp||e.ts||(r?new Date(r).toISOString():void 0)}function af(e){if(!e)return null;for(let r of Object.keys(e))if(r.endsWith("ToolCall")){let t=r.slice(0,-8);return t.length?t:r}return null}function yE(e,r){e.finalResult=r.result||r.subtype||r.terminal_reason||"completed",r.is_error&&(e.error=String(r.result||r.api_error_status||"stream result error"))}function yn(e){return typeof e=="number"&&Number.isFinite(e)&&e>=0?e:void 0}function RE(e){let r=e.usage;return r&&typeof r=="object"&&!Array.isArray(r)?r:null}function vE(e){if(typeof e.model=="string"&&e.model.trim())return e.model.trim();let r=e.modelUsage;if(r&&typeof r=="object"&&!Array.isArray(r)){let t=Object.keys(r)[0];if(t?.trim())return t.trim()}}function bE(e,r){let t=RE(r);if(!t)return;let n=yn(t.input_tokens)??yn(t.inputTokens)??yn(t.prompt_tokens),o=yn(t.output_tokens)??yn(t.outputTokens)??yn(t.completion_tokens);if(n===void 0&&o===void 0)return;let s=vE(r)??e.usage?.model;e.usage={...n!==void 0?{inputTokens:n}:{},...o!==void 0?{outputTokens:o}:{},...s?{model:s}:{}}}function lf(e){if(e.type!=="tool_call"||e.subtype!=="completed")return null;let t=(e.tool_call&&typeof e.tool_call=="object"&&!Array.isArray(e.tool_call)?e.tool_call:null)?.shellToolCall;if(!t||typeof t!="object"||Array.isArray(t))return null;let n=t,o=n.args,s=o&&typeof o=="object"&&!Array.isArray(o)&&typeof o.command=="string"?String(o.command):"",i=n.result;if(!i||typeof i!="object"||Array.isArray(i))return null;let a=i.success??i.failure;if(!a||typeof a!="object"||Array.isArray(a))return null;let l=a,c=typeof l.exitCode=="number"?l.exitCode:0;return{command:s,exitCode:c,stdout:typeof l.stdout=="string"?l.stdout:"",stderr:typeof l.stderr=="string"?l.stderr:"",interleaved:typeof l.interleavedOutput=="string"?l.interleavedOutput:""}}function SE(e,r){r.kind==="success"||r.kind==="search_no_matches"||(e.lastShellOutcome=r)}function Rn(e){let r={firstEventAt:null,lastEventAt:null,currentTool:null,finalResult:null,error:null,lastShellOutcome:null,usage:null};if(!gE(e))return r;let t=hE(e,"utf8").split(`
@@ -111,7 +111,7 @@ ${n}`,s=mN(e.personaSlug);return!!(r.startsWith(uN)||r===dN||r.startsWith("daemo
 `);a.trim()&&(Mv(t,a.endsWith(`
 `)?a:`${a}
 `),n=!0)}let o={capturedAt:new Date(e.now??Date.now()).toISOString(),skipReason:e.skipReason,runId:e.indexed.runId,workerName:e.indexed.workerName,worktreePath:e.indexed.worktreePath,taskId:e.indexed.worker.taskId,agentOsId:e.indexed.worker.agentOsId,branch:e.indexed.worker.branch,completionBlocker:e.indexed.worker.completionBlocker,finalResult:e.status.finalResult,changedFiles:e.status.changedFiles,gitAncestry:e.status.gitAncestry,prUrl:e.status.prUrl??null,...n?{patchPath:t}:{}};return Mv(wl.join(r,"evidence.json"),`${JSON.stringify(o,null,2)}
-`),o}var tL=new Set(["completion_blocked","dirty_worktree","pr_or_unmerged_commits","landing_blocked"]);function nL(e){return!tL.has(e.skipReason)||Jr(e.indexed,e.now)?!1:Wv({harnessRoot:e.harnessRoot,runId:e.indexed.runId,workerName:e.indexed.workerName})?!0:e.writeSalvageEvidence?(Bv({harnessRoot:e.harnessRoot,indexed:e.indexed,skipReason:e.skipReason,status:e.status,now:e.now}),!0):!1}function oL(e){let{indexed:r,worktreesAgeMs:t,terminalWorktreesAgeMs:n}=e;return r&&(Yr.has(r.run.status)||e.liveness&&Fd(r,e.liveness)||e.liveness&&he(Wd(r,e.liveness))&&!Jr(r))?n:t}function sL(e){return!e.indexed||e.includeOrphans&&e.worktreesAgeMs<=0?0:oL(e)}function iL(e,r){if(e.harnessRoot?.trim())return _l.resolve(e.harnessRoot);let t=r.worker.workerDir;if(!t)return null;let n=`${_l.sep}runs${_l.sep}`,o=t.indexOf(n);return o<0?null:t.slice(0,o+n.length-1)}function Fv(e){let{indexed:r,includeOrphans:t,worktreesAgeMs:n,ageMs:o,orphanSafety:s,worktreeRemovalGuard:i}=e,a=e.now??Date.now();if(!r)return t?s??null:"orphan_without_flag";let l=sL(e);if(n<=0&&!t&&l<=0)return"worktrees_disabled";if(l>0&&o<l)return"below_age_threshold";if(Jr(r,a))return"active_worker";let c=Wd(r,e.liveness),u=iL(e,r),d=m=>u&&nL({indexed:r,harnessRoot:u,skipReason:m,status:c,now:a,writeSalvageEvidence:e.writeSalvageEvidence===!0})?null:m;if(Dv(r,c)){let m=d("completion_blocked");if(m)return m}if(Ld(r,e.liveness?.gitStatusCache)){let m=d("dirty_worktree");if(m)return m}let p=e.liveness?.gitRevCache?.countAheadOfMain(e.worktreePath);if(p!=null&&p>0){let m=d("pr_or_unmerged_commits");if(m)return m}if(Nv(r,e.liveness,a)||!he(c))return"run_still_active";if(ti(c)){let m=d("pr_or_unmerged_commits");if(m)return m}if(nr(c.changedFiles).length>0){let m=d("dirty_worktree");if(m)return m}if(bn({finalResult:c.finalResult,changedFiles:c.changedFiles,gitAncestry:c.gitAncestry,prUrl:rn(c.finalResult)}).blocked){let m=d("landing_blocked");if(m)return m}if(i&&e.worktreePath){let m=i({worktreePath:e.worktreePath,indexed:!!r,runId:r?.runId,worker:r?.workerName});if(m)return m.detail?{reason:m.reason,detail:m.detail}:m.reason}return null}function Kd(e){let{indexed:r,nodeModulesAgeMs:t,ageMs:n,worktreePath:o,activeWorktreePaths:s,diskPressure:i}=e;return!i&&n<t?"below_age_threshold":s.has(_l.resolve(o))||r&&Jr(r)?"active_worker":r&&Ld(r,e.gitStatusCache)?"dirty_worktree":null}function Kv(e){return Kd(e)}var Hv=new Set(["active_worker","run_still_active","completion_blocked","landing_blocked"]);function $v(e,r){let t=[],n=new Set,o=(s,i,a)=>{let l=`${s}\0${i}`;n.has(l)||t.length>=24||(n.add(l),t.push({path:s,reason:i,...a?{detail:a}:{}}))};for(let s of r)Hv.has(s.reason)&&o(s.path,s.reason,s.detail);for(let s of e)!s.skipped||!s.skipReason||Hv.has(s.skipReason)&&o(s.path,s.skipReason);return t}import{existsSync as Yv,readdirSync as Jv,statSync as cL}from"node:fs";import qv from"node:path";M();Pe();import jv from"node:path";x();function lL(e,r){return Sl(e,r)}function Vv(e,r=Date.now()){let t=new Set,n=new Set;for(let o of e){for(let s of Fi(o)){let i=!1;for(let a of Object.keys(s.workers||{})){let l=P(jv.join(No(o,s.id),"workers",C(a),"worker.json"),void 0);if(!l?.worktreePath)continue;let c=jv.resolve(l.worktreePath);lL(l,r)&&(i=!0,t.add(c))}i&&n.add(`${o}\0${s.id}`)}for(let s of Rv(o))n.add(s)}return{activeWorktreePaths:t,liveRunKeys:n}}function Gv(e,r,t,n){return t?n.has(`${r}\0${t}`):!1}x();function uL(e,r){try{let t=cL(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function dL(e,r){let t=qv.join(e,"runs",r,"run.json");return Yv(t)?P(t,null):null}function zv(e){try{return Jv(e).length===0}catch{return!1}}function Xv(e){let{harnessRoot:r,runId:t,runPath:n,ageMs:o,runDirectoriesAgeMs:s,activeGuards:i}=e;if(Gv(n,r,t,i.liveRunKeys)||!zv(n))return"run_still_active";let a=dL(r,t);return a&&!Yr.has(a.status)&&!Qt(a)?"run_still_active":s>0&&o<s?"below_age_threshold":null}function Qv(e){if(!Yv(e.worktreesDir))return[];let r=[],t;try{t=Jv(e.worktreesDir,{withFileTypes:!0})}catch{return[]}for(let n of t){if(!n.isDirectory())continue;let o=n.name;if(e.runIdFilter&&o!==e.runIdFilter)continue;let s=qv.join(e.worktreesDir,o);zv(s)&&r.push({kind:"remove_run_directory",path:s,bytes:null,harnessRoot:e.harnessRoot,runId:o,ageMs:uL(s,e.now)})}return r}we();import{existsSync as $d,rmSync as cb}from"node:fs";import{execFileSync as pL}from"node:child_process";import{existsSync as Zv,readdirSync as mL,statSync as fL}from"node:fs";import gL from"node:path";var hL=2500;function kL(e,r=hL){if(!Zv(e))return 0;try{let n=pL("du",["-sb",e],{encoding:"utf8",timeout:r,stdio:["ignore","pipe","ignore"]}).trim().split(/\s+/)[0],o=Number(n);return Number.isFinite(o)&&o>=0?o:null}catch{return null}}function qr(e,r=5e4){if(!Zv(e))return 0;let t=kL(e);if(t!==null)return t;let n=0,o=0,s=[e];for(;s.length>0;){let i=s.pop(),a;try{a=mL(i)}catch{continue}for(let l of a){if(o++>r)return null;let c=gL.join(i,l),u;try{u=fL(c)}catch{continue}u.isDirectory()?s.push(c):n+=u.size}}return n}import{existsSync as bL,rmSync as SL}from"node:fs";Pe();import{lstatSync as yL,readdirSync as RL}from"node:fs";function eb(e){try{let r=yL(e),t=typeof process.getuid=="function"?process.getuid():null,n=typeof process.getgid=="function"?process.getgid():null,o=t!==null&&(r.uid!==t||n!==null&&r.gid!==n);return{uid:r.uid,gid:r.gid,foreign:o}}catch{return null}}function rb(e,r=32){let t=eb(e);if(!t)return!1;if(t.foreign)return!0;try{let n=RL(e),o=0;for(let s of n){if(o>=r)break;let i=`${e.replace(/\/$/,"")}/${s}`,a=eb(i);if(o+=1,a?.foreign)return!0}}catch{}return!1}import{spawnSync as vL}from"node:child_process";import ob from"node:path";import or from"node:path";function tb(e,r,t,n){let o=or.resolve(e),s=`${or.sep}${n}`,i=o.endsWith(s)?o:null;if(!i)return"path_outside_harness";let a=or.relative(t,i);if(a.startsWith("..")||or.isAbsolute(a))return"path_outside_harness";let l=a.split(or.sep);return l.length<3||l[l.length-1]!==n||!o.startsWith(or.resolve(r))?"path_outside_harness":null}function Cl(e,r,t){return tb(e,r,t,"node_modules")}function xl(e,r,t){return tb(e,r,t,".next")}function El(e,r,t){let n=or.resolve(e),o=or.relative(t,n);return o.startsWith("..")||or.isAbsolute(o)||o.split(or.sep).length<3||!n.startsWith(or.resolve(r))?"path_outside_harness":null}function nb(e,r,t){let n=or.resolve(e);return Cl(n,r,t)===null||xl(n,r,t)===null||El(n,r,t)===null}function ib(){let e=(process.env.KYNVER_CLEANUP_PRIVILEGED??"auto").trim().toLowerCase();return e==="0"||e==="false"||e==="off"||e==="no"?"off":e==="1"||e==="true"||e==="force"||e==="yes"?"force":"auto"}function sb(e){let r=vL("sudo",["-n",...e],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});return{ok:r.status===0,stderr:`${r.stderr??""}${r.stdout??""}`.trim()}}function ab(e,r,t){if(!nb(e,r,t))return{ok:!1,error:"path is not an allowed harness generated cache"};let n=typeof process.getuid=="function"?process.getuid():null,o=typeof process.getgid=="function"?process.getgid():null;if(n===null||o===null)return{ok:!1,error:"privileged reclaim requires POSIX uid/gid"};let s=sb(["chown","-R",`${n}:${o}`,ob.resolve(e)]);if(s.ok)return{ok:!0,method:"chown_then_rm"};let i=sb(["rm","-rf",ob.resolve(e)]);return i.ok?{ok:!0,method:"sudo_rm"}:{ok:!1,error:s.stderr||i.stderr||"sudo -n failed (password required or not permitted)"}}var Hd="Root-owned harness caches require operator reclaim: configure passwordless sudo for chown/rm under ~/.kynver/harness/worktrees, or run `node scripts/reclaim-harness-root-owned-cache.mjs --execute` as the harness owner with sudo available. See docs/runbooks/harness-root-owned-cache-reclaim.md.";function wL(e){let r=e?.code;return r==="EACCES"||r==="EPERM"}function lb(e,r,t={}){if(!bL(e.path))return{executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.harnessRoot,o=n?tt(n):null,i=e.bytes??qr(e.path)??void 0,a=t.removePath??SL,l=t.hasForeignOwnedEntry??rb;try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i}}catch(c){if(!wL(c)||!n||!o)return{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let u=l(e.path),d=ib();if(!(d==="force"||d==="auto"&&u))return u?{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; ${Hd}`}:{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let f=ab(e.path,n,o);if(f.ok&&f.method==="sudo_rm")return{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0};if(f.ok)try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0}}catch(m){return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${m.message}; privileged chown succeeded but rm still failed`}}return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; privileged reclaim failed: ${f.error}; ${Hd}`}}}function jd(e){let r=e.harnessRoot;return!r||!hv(e.path,r)?null:{...e,executed:!1,skipped:!0,skipReason:"run_metadata_protected"}}function Vd(e,r){let t=jd(e);if(t)return t;let n=lb(e,r);return{...e,bytes:n.bytes??e.bytes,executed:n.executed,skipped:n.skipped,skipReason:n.skipReason,error:n.error}}function ub(e,r){return Vd(e,r)}function db(e,r){return Vd(e,r)}function pb(e,r){return Vd(e,r)}function mb(e,r){let t=jd(e);if(t)return t;if(!$d(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};try{let n=e.bytes??qr(e.path);return cb(e.path,{recursive:!0,force:!0}),{...e,bytes:n,executed:!0,skipped:!1}}catch(n){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:n.message}}}function fb(e,r){let t=jd(e);if(t)return t;if(!$d(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.repo;try{let o=e.bytes??qr(e.path);return n&&se(n,["worktree","remove","--force",e.path],{allowFailure:!0}),$d(e.path)&&cb(e.path,{recursive:!0,force:!0}),{...e,bytes:o,executed:!0,skipped:!1}}catch(o){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:o.message}}}import{existsSync as Pl,readdirSync as Il,statSync as _L}from"node:fs";import Cr from"node:path";function Gd(e,r){try{let t=_L(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function hb(e,r){let t=Cr.relative(r,e);return t===""||!t.startsWith("..")&&!Cr.isAbsolute(t)}function gb(e,r,t,n){let o=[];for(let s of Ud){if(s===".next")continue;let i=Cr.join(e,s);if(!Pl(i))continue;let a=Cr.resolve(i);t.has(a)||hb(a,r.harnessRoot)&&(t.add(a),o.push({kind:"remove_build_cache",path:a,bytes:null,runId:n.runId,worker:n.worker,repo:n.repo,ageMs:Gd(a,r.now)}))}return o}function kb(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||r.push(...gb(n.worktreePath,e,t,{runId:n.runId,worker:n.workerName,repo:n.run.repo}));if(!e.includeOrphans||!Pl(e.worktreesDir))return r;for(let n of Il(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory())continue;let o=Cr.join(e.worktreesDir,n.name);for(let s of Il(o,{withFileTypes:!0})){if(!s.isDirectory())continue;let i=Cr.join(o,s.name);r.push(...gb(i,e,t,{runId:n.name,worker:s.name}))}}return r}function yb(e){let r=e.worktreesAgeMs>0||e.includeOrphans,t=e.includeOrphans;if(!r&&!t)return[];let n=[],o=new Set;if(r)for(let i of e.index.values()){if(e.runIdFilter&&i.runId!==e.runIdFilter)continue;let a=i.worktreePath;Pl(a)&&(o.has(a)||(o.add(a),n.push({kind:"remove_worktree",path:a,bytes:null,runId:i.runId,worker:i.workerName,repo:i.run.repo,ageMs:Gd(a,e.now)})))}if(!t||!Pl(e.worktreesDir))return n;let s=new Set;for(let i of e.index.values())s.add(Cr.resolve(i.worktreePath));for(let i of Il(e.worktreesDir,{withFileTypes:!0})){if(!i.isDirectory()||e.runIdFilter&&i.name!==e.runIdFilter)continue;let a=Cr.join(e.worktreesDir,i.name),l;try{l=Il(a,{withFileTypes:!0})}catch{continue}for(let c of l){if(!c.isDirectory())continue;let u=Cr.resolve(Cr.join(a,c.name));o.has(u)||s.has(u)||hb(u,e.harnessRoot)&&(o.add(u),n.push({kind:"remove_worktree",path:u,bytes:null,runId:i.name,worker:c.name,ageMs:Gd(u,e.now)}))}}return n}import{existsSync as bb,readdirSync as Rb,statSync as CL}from"node:fs";import ao from"node:path";var xL=[{dirName:"node_modules",kind:"remove_node_modules"},{dirName:".next",kind:"remove_next_cache"}];function EL(e,r){try{let t=CL(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function PL(e,r){let t=ao.relative(r,e);return t===""||!t.startsWith("..")&&!ao.isAbsolute(t)}function IL(e,r,t,n,o,s){if(!bb(n))return;let i=ao.resolve(n);r.has(i)||PL(i,t.harnessRoot)&&(r.add(i),e.push({kind:o,path:i,bytes:null,harnessRoot:t.harnessRoot,runId:s.runId,worker:s.worker,repo:s.repo,ageMs:EL(i,t.now)}))}function vb(e,r,t,n,o){for(let s of xL)IL(e,r,t,ao.join(n,s.dirName),s.kind,o)}function Sb(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||vb(r,t,e,n.worktreePath,{runId:n.runId,worker:n.workerName,repo:n.run.repo});if(!e.includeOrphans||!bb(e.worktreesDir))return r;for(let n of Rb(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory()||e.runIdFilter&&n.name!==e.runIdFilter)continue;let o=ao.join(e.worktreesDir,n.name),s;try{s=Rb(o,{withFileTypes:!0})}catch{continue}for(let i of s){if(!i.isDirectory())continue;let a=ao.join(o,i.name);vb(r,t,e,a,{runId:n.name,worker:i.name})}}return r}we();import{existsSync as wb,statSync as OL}from"node:fs";import xr from"node:path";function AL(e,r){try{let t=OL(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function TL(e){let r=[],t=null;for(let n of e.split(`
+`),o}var tL=new Set(["completion_blocked","dirty_worktree","pr_or_unmerged_commits","landing_blocked"]);function nL(e){return!tL.has(e.skipReason)||Jr(e.indexed,e.now)?!1:Wv({harnessRoot:e.harnessRoot,runId:e.indexed.runId,workerName:e.indexed.workerName})?!0:e.writeSalvageEvidence?(Bv({harnessRoot:e.harnessRoot,indexed:e.indexed,skipReason:e.skipReason,status:e.status,now:e.now}),!0):!1}function oL(e){let{indexed:r,worktreesAgeMs:t,terminalWorktreesAgeMs:n}=e;return r&&(Yr.has(r.run.status)||e.liveness&&Fd(r,e.liveness)||e.liveness&&he(Wd(r,e.liveness))&&!Jr(r))?n:t}function sL(e){return!e.indexed||e.includeOrphans&&e.worktreesAgeMs<=0?0:oL(e)}function iL(e,r){if(e.harnessRoot?.trim())return _l.resolve(e.harnessRoot);let t=r.worker.workerDir;if(!t)return null;let n=`${_l.sep}runs${_l.sep}`,o=t.indexOf(n);return o<0?null:t.slice(0,o+n.length-1)}function Fv(e){let{indexed:r,includeOrphans:t,worktreesAgeMs:n,ageMs:o,orphanSafety:s,worktreeRemovalGuard:i}=e,a=e.now??Date.now();if(!r)return t?s??null:"orphan_without_flag";let l=sL(e);if(n<=0&&!t&&l<=0)return"worktrees_disabled";if(l>0&&o<l)return"below_age_threshold";if(Jr(r,a))return"active_worker";let c=Wd(r,e.liveness),u=iL(e,r),d=m=>u&&nL({indexed:r,harnessRoot:u,skipReason:m,status:c,now:a,writeSalvageEvidence:e.writeSalvageEvidence===!0})?null:m;if(Dv(r,c)){let m=d("completion_blocked");if(m)return m}if(Ld(r,e.liveness?.gitStatusCache)){let m=d("dirty_worktree");if(m)return m}let p=e.liveness?.gitRevCache?.countAheadOfMain(e.worktreePath);if(p!=null&&p>0){let m=d("pr_or_unmerged_commits");if(m)return m}if(Nv(r,e.liveness,a)||!he(c))return"run_still_active";if(ti(c)){let m=d("pr_or_unmerged_commits");if(m)return m}if(nr(c.changedFiles).length>0){let m=d("dirty_worktree");if(m)return m}if(bn({finalResult:c.finalResult,changedFiles:c.changedFiles,gitAncestry:c.gitAncestry,prUrl:rn(c.finalResult)}).blocked){let m=d("landing_blocked");if(m)return m}if(i&&e.worktreePath){let m=i({worktreePath:e.worktreePath,indexed:!!r,runId:r?.runId,worker:r?.workerName});if(m)return m.detail?{reason:m.reason,detail:m.detail}:m.reason}return null}function Kd(e){let{indexed:r,nodeModulesAgeMs:t,ageMs:n,worktreePath:o,activeWorktreePaths:s,diskPressure:i}=e;return!i&&n<t?"below_age_threshold":s.has(_l.resolve(o))||r&&Jr(r)?"active_worker":r&&Ld(r,e.gitStatusCache)?"dirty_worktree":null}function Kv(e){return Kd(e)}var Hv=new Set(["active_worker","run_still_active","completion_blocked","landing_blocked"]);function $v(e,r){let t=[],n=new Set,o=(s,i,a)=>{let l=`${s}\0${i}`;n.has(l)||t.length>=24||(n.add(l),t.push({path:s,reason:i,...a?{detail:a}:{}}))};for(let s of r)Hv.has(s.reason)&&o(s.path,s.reason,s.detail);for(let s of e)!s.skipped||!s.skipReason||Hv.has(s.skipReason)&&o(s.path,s.skipReason);return t}import{existsSync as Yv,readdirSync as Jv,statSync as cL}from"node:fs";import qv from"node:path";M();Pe();import jv from"node:path";x();function lL(e,r){return Sl(e,r)}function Vv(e,r=Date.now()){let t=new Set,n=new Set;for(let o of e){for(let s of Fi(o)){let i=!1;for(let a of Object.keys(s.workers||{})){let l=P(jv.join(No(o,s.id),"workers",C(a),"worker.json"),void 0);if(!l?.worktreePath)continue;let c=jv.resolve(l.worktreePath);lL(l,r)&&(i=!0,t.add(c))}i&&n.add(`${o}\0${s.id}`)}for(let s of Rv(o))n.add(s)}return{activeWorktreePaths:t,liveRunKeys:n}}function Gv(e,r,t,n){return t?n.has(`${r}\0${t}`):!1}x();function uL(e,r){try{let t=cL(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function dL(e,r){let t=qv.join(e,"runs",r,"run.json");return Yv(t)?P(t,null):null}function zv(e){try{return Jv(e).length===0}catch{return!1}}function Xv(e){let{harnessRoot:r,runId:t,runPath:n,ageMs:o,runDirectoriesAgeMs:s,activeGuards:i}=e;if(Gv(n,r,t,i.liveRunKeys)||!zv(n))return"run_still_active";let a=dL(r,t);return a&&!Yr.has(a.status)&&!Qt(a)?"run_still_active":s>0&&o<s?"below_age_threshold":null}function Qv(e){if(!Yv(e.worktreesDir))return[];let r=[],t;try{t=Jv(e.worktreesDir,{withFileTypes:!0})}catch{return[]}for(let n of t){if(!n.isDirectory())continue;let o=n.name;if(e.runIdFilter&&o!==e.runIdFilter)continue;let s=qv.join(e.worktreesDir,o);zv(s)&&r.push({kind:"remove_run_directory",path:s,bytes:null,harnessRoot:e.harnessRoot,runId:o,ageMs:uL(s,e.now)})}return r}we();import{existsSync as $d,rmSync as cb}from"node:fs";import{execFileSync as pL}from"node:child_process";import{existsSync as Zv,readdirSync as mL,statSync as fL}from"node:fs";import gL from"node:path";var hL=2500;function kL(e,r=hL){if(!Zv(e))return 0;try{let n=pL("du",["-sb",e],{encoding:"utf8",timeout:r,stdio:["ignore","pipe","ignore"]}).trim().split(/\s+/)[0],o=Number(n);return Number.isFinite(o)&&o>=0?o:null}catch{return null}}function qr(e,r=5e4){if(!Zv(e))return 0;let t=kL(e);if(t!==null)return t;let n=0,o=0,s=[e];for(;s.length>0;){let i=s.pop(),a;try{a=mL(i)}catch{continue}for(let l of a){if(o++>r)return null;let c=gL.join(i,l),u;try{u=fL(c)}catch{continue}u.isDirectory()?s.push(c):n+=u.size}}return n}import{existsSync as bL,rmSync as SL}from"node:fs";Pe();import{lstatSync as yL,readdirSync as RL}from"node:fs";function eb(e){try{let r=yL(e),t=typeof process.getuid=="function"?process.getuid():null,n=typeof process.getgid=="function"?process.getgid():null,o=t!==null&&(r.uid!==t||n!==null&&r.gid!==n);return{uid:r.uid,gid:r.gid,foreign:o}}catch{return null}}function rb(e,r=32){let t=eb(e);if(!t)return!1;if(t.foreign)return!0;try{let n=RL(e),o=0;for(let s of n){if(o>=r)break;let i=`${e.replace(/\/$/,"")}/${s}`,a=eb(i);if(o+=1,a?.foreign)return!0}}catch{}return!1}import{spawnSync as vL}from"node:child_process";import ob from"node:path";import or from"node:path";function tb(e,r,t,n){let o=or.resolve(e),s=`${or.sep}${n}`,i=o.endsWith(s)?o:null;if(!i)return"path_outside_harness";let a=or.relative(t,i);if(a.startsWith("..")||or.isAbsolute(a))return"path_outside_harness";let l=a.split(or.sep);return l.length<3||l[l.length-1]!==n||!o.startsWith(or.resolve(r))?"path_outside_harness":null}function Cl(e,r,t){return tb(e,r,t,"node_modules")}function xl(e,r,t){return tb(e,r,t,".next")}function El(e,r,t){let n=or.resolve(e),o=or.relative(t,n);return o.startsWith("..")||or.isAbsolute(o)||o.split(or.sep).length<3||!n.startsWith(or.resolve(r))?"path_outside_harness":null}function nb(e,r,t){let n=or.resolve(e);return Cl(n,r,t)===null||xl(n,r,t)===null||El(n,r,t)===null}function ib(){let e=(process.env.KYNVER_CLEANUP_PRIVILEGED??"auto").trim().toLowerCase();return e==="0"||e==="false"||e==="off"||e==="no"?"off":e==="1"||e==="true"||e==="force"||e==="yes"?"force":"auto"}function sb(e){let r=vL("sudo",["-n",...e],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});return{ok:r.status===0,stderr:`${r.stderr??""}${r.stdout??""}`.trim()}}function ab(e,r,t){if(!nb(e,r,t))return{ok:!1,error:"path is not an allowed harness generated cache"};let n=typeof process.getuid=="function"?process.getuid():null,o=typeof process.getgid=="function"?process.getgid():null;if(n===null||o===null)return{ok:!1,error:"privileged reclaim requires POSIX uid/gid"};let s=sb(["chown","-R",`${n}:${o}`,ob.resolve(e)]);if(s.ok)return{ok:!0,method:"chown_then_rm"};let i=sb(["rm","-rf",ob.resolve(e)]);return i.ok?{ok:!0,method:"sudo_rm"}:{ok:!1,error:s.stderr||i.stderr||"sudo -n failed (password required or not permitted)"}}var Hd="Root-owned harness caches require operator reclaim: configure passwordless sudo for chown/rm under ~/.kynver/harness/worktrees, or remove them as the harness owner with sudo available. More help: https://www.kynver.com/help.";function wL(e){let r=e?.code;return r==="EACCES"||r==="EPERM"}function lb(e,r,t={}){if(!bL(e.path))return{executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.harnessRoot,o=n?tt(n):null,i=e.bytes??qr(e.path)??void 0,a=t.removePath??SL,l=t.hasForeignOwnedEntry??rb;try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i}}catch(c){if(!wL(c)||!n||!o)return{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let u=l(e.path),d=ib();if(!(d==="force"||d==="auto"&&u))return u?{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; ${Hd}`}:{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let f=ab(e.path,n,o);if(f.ok&&f.method==="sudo_rm")return{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0};if(f.ok)try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0}}catch(m){return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${m.message}; privileged chown succeeded but rm still failed`}}return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; privileged reclaim failed: ${f.error}; ${Hd}`}}}function jd(e){let r=e.harnessRoot;return!r||!hv(e.path,r)?null:{...e,executed:!1,skipped:!0,skipReason:"run_metadata_protected"}}function Vd(e,r){let t=jd(e);if(t)return t;let n=lb(e,r);return{...e,bytes:n.bytes??e.bytes,executed:n.executed,skipped:n.skipped,skipReason:n.skipReason,error:n.error}}function ub(e,r){return Vd(e,r)}function db(e,r){return Vd(e,r)}function pb(e,r){return Vd(e,r)}function mb(e,r){let t=jd(e);if(t)return t;if(!$d(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};try{let n=e.bytes??qr(e.path);return cb(e.path,{recursive:!0,force:!0}),{...e,bytes:n,executed:!0,skipped:!1}}catch(n){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:n.message}}}function fb(e,r){let t=jd(e);if(t)return t;if(!$d(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.repo;try{let o=e.bytes??qr(e.path);return n&&se(n,["worktree","remove","--force",e.path],{allowFailure:!0}),$d(e.path)&&cb(e.path,{recursive:!0,force:!0}),{...e,bytes:o,executed:!0,skipped:!1}}catch(o){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:o.message}}}import{existsSync as Pl,readdirSync as Il,statSync as _L}from"node:fs";import Cr from"node:path";function Gd(e,r){try{let t=_L(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function hb(e,r){let t=Cr.relative(r,e);return t===""||!t.startsWith("..")&&!Cr.isAbsolute(t)}function gb(e,r,t,n){let o=[];for(let s of Ud){if(s===".next")continue;let i=Cr.join(e,s);if(!Pl(i))continue;let a=Cr.resolve(i);t.has(a)||hb(a,r.harnessRoot)&&(t.add(a),o.push({kind:"remove_build_cache",path:a,bytes:null,runId:n.runId,worker:n.worker,repo:n.repo,ageMs:Gd(a,r.now)}))}return o}function kb(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||r.push(...gb(n.worktreePath,e,t,{runId:n.runId,worker:n.workerName,repo:n.run.repo}));if(!e.includeOrphans||!Pl(e.worktreesDir))return r;for(let n of Il(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory())continue;let o=Cr.join(e.worktreesDir,n.name);for(let s of Il(o,{withFileTypes:!0})){if(!s.isDirectory())continue;let i=Cr.join(o,s.name);r.push(...gb(i,e,t,{runId:n.name,worker:s.name}))}}return r}function yb(e){let r=e.worktreesAgeMs>0||e.includeOrphans,t=e.includeOrphans;if(!r&&!t)return[];let n=[],o=new Set;if(r)for(let i of e.index.values()){if(e.runIdFilter&&i.runId!==e.runIdFilter)continue;let a=i.worktreePath;Pl(a)&&(o.has(a)||(o.add(a),n.push({kind:"remove_worktree",path:a,bytes:null,runId:i.runId,worker:i.workerName,repo:i.run.repo,ageMs:Gd(a,e.now)})))}if(!t||!Pl(e.worktreesDir))return n;let s=new Set;for(let i of e.index.values())s.add(Cr.resolve(i.worktreePath));for(let i of Il(e.worktreesDir,{withFileTypes:!0})){if(!i.isDirectory()||e.runIdFilter&&i.name!==e.runIdFilter)continue;let a=Cr.join(e.worktreesDir,i.name),l;try{l=Il(a,{withFileTypes:!0})}catch{continue}for(let c of l){if(!c.isDirectory())continue;let u=Cr.resolve(Cr.join(a,c.name));o.has(u)||s.has(u)||hb(u,e.harnessRoot)&&(o.add(u),n.push({kind:"remove_worktree",path:u,bytes:null,runId:i.name,worker:c.name,ageMs:Gd(u,e.now)}))}}return n}import{existsSync as bb,readdirSync as Rb,statSync as CL}from"node:fs";import ao from"node:path";var xL=[{dirName:"node_modules",kind:"remove_node_modules"},{dirName:".next",kind:"remove_next_cache"}];function EL(e,r){try{let t=CL(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function PL(e,r){let t=ao.relative(r,e);return t===""||!t.startsWith("..")&&!ao.isAbsolute(t)}function IL(e,r,t,n,o,s){if(!bb(n))return;let i=ao.resolve(n);r.has(i)||PL(i,t.harnessRoot)&&(r.add(i),e.push({kind:o,path:i,bytes:null,harnessRoot:t.harnessRoot,runId:s.runId,worker:s.worker,repo:s.repo,ageMs:EL(i,t.now)}))}function vb(e,r,t,n,o){for(let s of xL)IL(e,r,t,ao.join(n,s.dirName),s.kind,o)}function Sb(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||vb(r,t,e,n.worktreePath,{runId:n.runId,worker:n.workerName,repo:n.run.repo});if(!e.includeOrphans||!bb(e.worktreesDir))return r;for(let n of Rb(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory()||e.runIdFilter&&n.name!==e.runIdFilter)continue;let o=ao.join(e.worktreesDir,n.name),s;try{s=Rb(o,{withFileTypes:!0})}catch{continue}for(let i of s){if(!i.isDirectory())continue;let a=ao.join(o,i.name);vb(r,t,e,a,{runId:n.name,worker:i.name})}}return r}we();import{existsSync as wb,statSync as OL}from"node:fs";import xr from"node:path";function AL(e,r){try{let t=OL(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function TL(e){let r=[],t=null;for(let n of e.split(`
 `)){if(!n.trim())continue;let[o,...s]=n.split(" "),i=s.join(" ");if(o==="worktree"){t&&r.push(t),t={path:i};continue}t&&(o==="branch"&&(t.branch=i),o==="HEAD"&&(t.head=i),o==="bare"&&(t.bare=!0))}return t&&r.push(t),r}function NL(e,r){let t=xr.relative(xr.resolve(r),xr.resolve(e));return t!==""&&!t.startsWith("..")&&!xr.isAbsolute(t)}var DL=200;function _b(e){if(!e.includeOrphans||!wb(e.worktreesDir))return[];let r=new Set;for(let s of e.index.values())s.run.repo&&r.add(xr.resolve(s.run.repo));let t=new Set;for(let s of e.index.values())t.add(xr.resolve(s.worktreePath));let n=[],o=new Set;for(let s of r){let i=0,a;try{a=se(s,["worktree","list","--porcelain"],{allowFailure:!0})}catch{continue}let l=TL(a);for(let c of l){if(i>=DL)break;let u=xr.resolve(c.path);if(u===xr.resolve(s)||!NL(u,e.worktreesDir)||t.has(u)||o.has(u)||!wb(u))continue;let p=xr.relative(e.worktreesDir,u).split(xr.sep),f=p[0],m=p[1]??"unknown";o.add(u),i+=1,n.push({kind:"remove_worktree",path:u,bytes:null,runId:f,worker:m,repo:s,ageMs:AL(u,e.now)})}}return n}M();x();import oi from"node:path";function Cb(e,r){let t=oi.resolve(r),n=new Map;for(let[o,s]of e){let i=s.harnessRoot?oi.resolve(s.harnessRoot):null;i&&i!==t||n.set(o,s)}return n}function xb(e){let r=new Map;for(let t of Fi(e))for(let n of Object.keys(t.workers||{})){let o=oi.join(No(e,t.id),"workers",C(n),"worker.json"),s=P(o,void 0);s?.worktreePath&&r.set(oi.resolve(s.worktreePath),{harnessRoot:e,worktreePath:oi.resolve(s.worktreePath),runId:t.id,workerName:n,run:t,worker:s})}return r}function si(e){let r=process.env[e];return r==="1"||r==="true"||r==="yes"}function tn(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)&&n>=0?n:r}function qd(e={}){let r=e.execute===!0||e.execute!==!1&&si("KYNVER_CLEANUP_EXECUTE"),t=e.finalizeStaleRuns!==!1&&!si("KYNVER_CLEANUP_SKIP_FINALIZE"),n=e.nodeModulesAgeMs??tn("KYNVER_CLEANUP_NODE_MODULES_AGE_MS",216e5),o=e.scanDependencyCaches??(e.nodeModulesAgeMs!==void 0||process.env.KYNVER_CLEANUP_NODE_MODULES_AGE_MS!=null),s=e.worktreesAgeMs??tn("KYNVER_CLEANUP_WORKTREES_AGE_MS",0),i=e.terminalWorktreesAgeMs??tn("KYNVER_CLEANUP_TERMINAL_WORKTREES_AGE_MS",216e5),a=e.runDirectoriesAgeMs??tn("KYNVER_CLEANUP_RUN_DIRECTORIES_AGE_MS",36e5),l=e.maxActionsPerSweep??tn("KYNVER_CLEANUP_MAX_ACTIONS_PER_SWEEP",120),c=e.includeOrphans===!0||si("KYNVER_CLEANUP_INCLUDE_ORPHANS"),d=si("KYNVER_CLEANUP_SCOPE_ALL")||process.env.KYNVER_CLEANUP_SCOPE==="all"?e.runIdFilter:e.runIdFilter??(process.env.KYNVER_CLEANUP_RUN_ID||void 0),p=e.accountBytes!==!1&&!si("KYNVER_CLEANUP_SKIP_BYTE_ACCOUNTING"),f=tn("KYNVER_CLEANUP_STORAGE_ENTRY_CAP",2e3),m=e.storagePerRunEntryCap!==void 0?e.storagePerRunEntryCap:p&&f>0?f:null,g=tn("KYNVER_CLEANUP_BYTE_ENTRY_CAP",2e3),y=e.byteAccountingEntryCap??(Number.isFinite(g)&&g>0?Math.floor(g):2e3);return{execute:r,finalizeStaleRuns:t,scanDependencyCaches:o,nodeModulesAgeMs:n,worktreesAgeMs:s>0?s:0,terminalWorktreesAgeMs:i>=0?i:0,runDirectoriesAgeMs:a>=0?a:0,maxActionsPerSweep:Number.isFinite(l)&&l>0?Math.floor(l):120,includeOrphans:c,runIdFilter:d?String(d):void 0,accountBytes:p,storagePerRunEntryCap:m,byteAccountingEntryCap:y}}function Ob(e){let r=process.env.KYNVER_CLEANUP_SCOPE==="all",t=Number(process.env.KYNVER_CLEANUP_WORKTREES_AGE_MS),n=r?Number.isFinite(t)&&t>0?t:6048e5:Number.isFinite(t)&&t>0?t:0;return qd({runIdFilter:r?void 0:e,worktreesAgeMs:n,terminalWorktreesAgeMs:r?216e5:void 0,runDirectoriesAgeMs:r?36e5:void 0,includeOrphans:r?!0:void 0,finalizeStaleRuns:!0,accountBytes:!0,scanDependencyCaches:!0})}we();import{existsSync as zd,statSync as ML}from"node:fs";import Ol from"node:path";x();var UL=1800*1e3;function Ab(e){let r=e.now??Date.now(),t=e.heartbeatFreshMs??UL;if(!zd(e.worktreePath))return null;if(e.runId&&e.workerName){let c=Ol.join(e.harnessRoot,"runs",e.runId,"workers",e.workerName),u=P(Ol.join(c,"worker.json"),void 0);if(u&&Bd(u,r,t))return"active_worker";if(!u){let d=Ol.join(c,"heartbeat.jsonl");if(zd(d))try{let p=r-ML(d).mtimeMs;if(Number.isFinite(p)&&p>=0&&p<t)return"active_worker"}catch{}}}let n=Ol.join(e.worktreePath,".git");if(!zd(n))return null;let o=ee(e.worktreePath,["status","--porcelain"]);if(o.status!==0)return"pr_or_unmerged_commits";let s=o.stdout.split(`
 `).map(c=>c.trim()).filter(c=>c.length>0);if(nr(s).length>0)return"dirty_worktree";let i=ee(e.worktreePath,["rev-list","--count","@{u}..HEAD"]);if(i.status===0){let c=Number(i.stdout.trim());if(Number.isFinite(c)&&c>0)return"pr_or_unmerged_commits"}let a=ee(e.worktreePath,["rev-list","--count","origin/main..HEAD"]);if(a.status!==0)return i.status!==0?"pr_or_unmerged_commits":null;let l=Number(a.stdout.trim());return Number.isFinite(l)&&l>0?"pr_or_unmerged_commits":null}Pe();import{existsSync as LL,readdirSync as Tb,statSync as WL}from"node:fs";import BL from"node:path";function Nb(e={}){let r=Ee(e.harnessRoot??ge()),t=tt(r),n=e.now??Date.now(),o=new Date(n).toISOString();if(!LL(t))return{harnessRoot:r,worktreesDir:t,worktreesBytes:0,runCount:0,workerCount:0,oldestRunAt:null,scannedAt:o};let s=0,i=0,a=0,l=null,c;try{c=Tb(t,{withFileTypes:!0})}catch{return{harnessRoot:r,worktreesDir:t,worktreesBytes:null,runCount:0,workerCount:0,oldestRunAt:null,scannedAt:o}}for(let u of c){if(!u.isDirectory())continue;i+=1;let d=BL.join(t,u.name);try{let p=WL(d);l=l===null?p.mtimeMs:Math.min(l,p.mtimeMs)}catch{}try{for(let p of Tb(d,{withFileTypes:!0}))p.isDirectory()&&(a+=1)}catch{}if(s!==null&&e.perRunEntryCap!==null){let p=e.perRunEntryCap??5e4;if(p<=0)s=null;else{let f=qr(d,p);f===null?s=null:s+=f}}}return{harnessRoot:r,worktreesDir:t,worktreesBytes:s,runCount:i,workerCount:a,oldestRunAt:l===null?null:new Date(l).toISOString(),scannedAt:o}}Pe();import{existsSync as FL}from"node:fs";import{homedir as KL}from"node:os";import Db from"node:path";var HL=["/var/tmp/kynver-harness",Db.join(KL(),".openclaw","harness")];function Xd(e,r,t){if(!t?.trim())return;let n=Ee(t.trim());e.has(n)||(e.add(n),r.push(n))}function $L(e){return e.scanWellKnown!=null?e.scanWellKnown:process.env.VITEST==="true"?!1:process.env.KYNVER_CLEANUP_SCAN_WELL_KNOWN!=="0"&&!["0","false","no"].includes((process.env.KYNVER_CLEANUP_SCAN_WELL_KNOWN??"").toLowerCase())}function Mb(e={}){let r=new Set,t=[];Xd(r,t,e.harnessRoot??ge());let n=process.env.KYNVER_CLEANUP_EXTRA_ROOTS?.split(",").map(o=>o.trim()).filter(Boolean);for(let o of n??[])Xd(r,t,o);if($L(e))for(let o of HL){let s=Db.resolve(o);!r.has(s)&&FL(s)&&Xd(r,t,s)}return t}Ao();function jL(e){let r=process.env[e];return r==="1"||r==="true"||r==="yes"}function VL(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)?n:r}function Ub(e={}){let r=e.diskPath?.trim()||process.env.KYNVER_DISK_GUARD_PATH?.trim()||"/",t=VL("KYNVER_DISK_GUARD_MAX_USED_PERCENT",75),n=kr({...e,diskPath:r,diskMaxUsedPercent:e.diskMaxUsedPercent??t}),o=!n.ok||n.usedPercent>=t,s=process.env.KYNVER_CLEANUP_DISK_PRESSURE_FORCE?.trim().toLowerCase();return s==="none"||s==="off"||s==="0"?o=!1:(s==="pressured"||s==="on"||s==="1")&&(o=!0),{diskGate:n,pressured:o,maxUsedPercent:t}}function Lb(e,r){if(!r.pressured)return e;let t=e.execute||!jL("KYNVER_CLEANUP_DRY_RUN_ON_PRESSURE");return{...e,execute:t,nodeModulesAgeMs:0,runIdFilter:void 0,includeOrphans:!0,terminalWorktreesAgeMs:0,runDirectoriesAgeMs:0,worktreesAgeMs:e.worktreesAgeMs>0?e.worktreesAgeMs:6048e5,diskPressure:!0,diskGate:r.diskGate}}Oo();import{unlinkSync as GL}from"node:fs";function Al(e){let r=process.env[e];return r==="1"||r==="true"||r==="yes"}function Wb(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)?n:r}function YL(e,r,t){return e.length===0?[]:t?[...e]:e.length<=r?[]:e.slice(r)}function Tl(e={}){let r=e.execute===!0||Al("KYNVER_WSL_CRASH_DUMP_EXECUTE")||Al("KYNVER_CLEANUP_EXECUTE"),t=e.purgeAll===!0||Al("KYNVER_WSL_CRASH_DUMP_PURGE_ALL"),n=Math.max(0,e.keepNewest??Wb("KYNVER_WSL_CRASH_DUMP_KEEP_NEWEST",t?0:1)),o=rt({forceWsl:e.forceWsl});if(!o?.path)return{observation:o,execute:r,keepNewest:n,removed:[],removedBytes:0,skipped:o?.probeError?[{path:o.path??"(unresolved)",reason:o.probeError}]:[]};let s=YL(o.dumps,n,t),i=[],a=[],l=0;for(let c of s){if(!r){a.push({path:c.path,reason:"dry_run"});continue}try{GL(c.path),i.push({path:c.path,bytes:c.bytes,name:c.name}),l+=c.bytes}catch(u){a.push({path:c.path,reason:u.message})}}return{observation:o,execute:r,keepNewest:n,removed:i,removedBytes:l,skipped:a}}function Bb(e){return e?Al("KYNVER_WSL_CRASH_DUMP_CLEANUP")||!e.ok?!0:e.dumpCount>Wb("KYNVER_WSL_CRASH_DUMP_KEEP_NEWEST",1):!1}Oo();function sr(e,r){if(process.env.KYNVER_CLEANUP_QUIET==="1")return;let t=r?`: ${r}`:"";console.error(`[kynver cleanup] ${e}${t}`)}we();var Nl=class{aheadOfMain=new Map;countAheadOfMain(r,t="origin/main"){let n=`${r}\0${t}`;if(this.aheadOfMain.has(n))return this.aheadOfMain.get(n)??null;let o=ee(r,["rev-list","--count",`${t}..HEAD`]);if(o.status!==0)return this.aheadOfMain.set(n,null),null;let s=Number(o.stdout.trim()),i=Number.isFinite(s)?s:null;return this.aheadOfMain.set(n,i),i}};import{spawnSync as JL}from"node:child_process";import{existsSync as qL}from"node:fs";import zL from"node:path";var XL=5e3;function QL(e,r){if(!qL(zL.join(e,".git")))return{status:null,stdout:"",stderr:"",error:"not_a_git_repo"};try{let t=JL("git",r,{cwd:e,encoding:"utf8",timeout:XL}),n=t.error?.message?.includes("ETIMEDOUT")===!0;return{status:n?null:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:n?"git_timeout":t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}function Fb(e){let r=QL(e,["status","--short"]);return r.error==="not_a_git_repo"?[]:r.error==="git_timeout"||r.status!==0?null:r.stdout.split(`
 `).map(t=>t.trim()).filter(Boolean)}var Dl=class{cache=new Map;porcelain(r){let t=r,n=this.cache.get(t);if(n!==void 0)return n;let o=Fb(t)??[];return this.cache.set(t,o),o}};var Ml=class{cache=new Map;derive(r){let t=this.cache.get(r.id);if(t!==void 0)return t;let n=Qt(r);return this.cache.set(r.id,n),n}};function ZL(e){let r={};for(let t of e)r[t.kind]=(r[t.kind]??0)+1;return r}function Kb(e,r={}){let t=r.maxSampleActions??12,n=r.maxSampleSkips??8;return{harnessRoot:e.harnessRoot,scanRoots:e.scanRoots,dryRun:e.dryRun,execute:e.execute,scannedAt:e.scannedAt,finalizedRuns:e.finalizedRuns.length,actionCount:e.actions.length,actionKinds:ZL(e.actions),totals:e.totals,...e.storage?{storage:e.storage}:{},...e.preservedLivePaths?.length?{preservedLivePaths:e.preservedLivePaths}:{},...e.removedRunDirectories!=null?{removedRunDirectories:e.removedRunDirectories}:{},sampleActions:e.actions.slice(0,t).map(o=>({kind:o.kind,path:o.path,...o.skipReason?{skipReason:o.skipReason}:{},...o.bytes!=null?{bytes:o.bytes}:{},...o.runId?{runId:o.runId}:{},...o.worker?{worker:o.worker}:{}})),sampleSkips:e.skips.slice(0,n)}}function eW(e={}){let r=e.harnessRoot?Ee(e.harnessRoot):ge(),t=Mb({harnessRoot:r}),n=e.now??Date.now();return{harnessRoot:r,scanRoots:t,now:n}}function rW(e){return typeof e=="string"?{reason:e}:e}function lo(e,r,t,n){e.push({path:r,reason:t,...n?{detail:n}:{}})}function Ul(e,r,t){return!r||e.bytes!=null?e:{...e,bytes:qr(e.path,t)}}function Hb(e,r){let t={};for(let n of r)t[n.reason]=(t[n.reason]??0)+1;for(let n of e)n.skipReason&&(t[n.skipReason]=(t[n.skipReason]??0)+1);return t}function tW(e,r){return e.kind==="remove_next_cache"?db(e,r):ub(e,r)}function nW(e,r,t){return e.kind==="remove_next_cache"?xl(e.path,r,t):Cl(e.path,r,t)}function oW(e){let r=new Map;for(let t of e)for(let[n,o]of xb(t))r.set(n,o);return r}function $b(e,r){return e.runId&&e.worker?ir.join(r,e.runId,e.worker):ir.resolve(e.path,"..")}function Qd(e={}){let r=qd(e),t=Ub();r=Lb(r,t);let n=eW(e);sr("scan",`${n.scanRoots.length} harness root(s)`);let o=Vv(n.scanRoots,n.now),s=r.finalizeStaleRuns?Qs().map(N=>({runId:N.runId,from:N.from,to:N.to})):[];s.length>0&&sr("finalize",`${s.length} stale run(s) marked terminal`),sr("index","building worktree index");let i=oW(n.scanRoots);sr("index",`${i.size} indexed worktree(s)`);let a={runTerminalCache:new Ml,gitStatusCache:new Dl,gitRevCache:new Nl},l=[],c=[],u=new Set,d=r.maxActionsPerSweep,p=()=>c.length>=d;for(let N of n.scanRoots){if(p())break;sr("root",N);let fe=ir.join(N,"worktrees"),Te=Cb(i,N),Se={harnessRoot:N,worktreesDir:fe,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,runIdFilter:r.runIdFilter,index:Te,now:n.now},K=r.scanDependencyCaches?Sb(Se):[];sr("dependency",r.scanDependencyCaches?`${K.length} cache candidate(s) at ${N}`:"skipped (worktree-only sweep)");let q=0;for(let ae of K){if(p())break;q+=1,q%50===0&&sr("dependency",`${q}/${K.length} evaluated`);let le=ir.resolve(ae.path);if(u.has(le))continue;u.add(le);let L={...ae,path:le},Ne=nW(L,N,fe);if(Ne){lo(l,L.path,Ne),c.push({...L,executed:!1,skipped:!0,skipReason:Ne});continue}let Q=$b(L,fe),Er=Te.get(ir.resolve(Q))??null,qe=Kd({indexed:Er,includeOrphans:!0,nodeModulesAgeMs:r.nodeModulesAgeMs,ageMs:L.ageMs,worktreePath:Q,activeWorktreePaths:o.activeWorktreePaths,diskPressure:r.diskPressure,gitStatusCache:a.gitStatusCache});if(qe){lo(l,L.path,qe),c.push({...L,executed:!1,skipped:!0,skipReason:qe});continue}c.push(tW(Ul(L,r.accountBytes,r.byteAccountingEntryCap),r.execute))}if(r.scanDependencyCaches)for(let ae of kb(Se)){if(p())break;let le=ir.resolve(ae.path);if(u.has(le))continue;u.add(le);let L={...ae,path:le},Ne=El(L.path,N,fe);if(Ne){lo(l,L.path,Ne),c.push({...L,executed:!1,skipped:!0,skipReason:Ne});continue}let Q=$b(L,fe),Er=Te.get(ir.resolve(Q))??null,qe=Kv({indexed:Er,includeOrphans:!0,nodeModulesAgeMs:r.nodeModulesAgeMs,ageMs:L.ageMs,worktreePath:Q,activeWorktreePaths:o.activeWorktreePaths,diskPressure:r.diskPressure,gitStatusCache:a.gitStatusCache});if(qe){lo(l,L.path,qe),c.push({...L,executed:!1,skipped:!0,skipReason:qe});continue}c.push(pb(Ul(L,r.accountBytes,r.byteAccountingEntryCap),r.execute))}let z=[...yb(Se),..._b(Se)];sr("worktrees",`${z.length} candidate(s) at ${N}`);let Je=new Set,Re=0;for(let ae of z){if(p())break;Re+=1,Re%50===0&&sr("worktrees",`${Re}/${z.length} evaluated`);let le=ir.resolve(ae.path);if(Je.has(le))continue;Je.add(le);let L={...ae,path:le},Ne=Te.get(ir.resolve(L.path))??null,Q=Ne?null:Ab({worktreePath:L.path,harnessRoot:N,runId:L.runId,workerName:L.worker,now:n.now}),Er=Fv({indexed:Ne,worktreePath:ir.resolve(L.path),includeOrphans:r.includeOrphans,worktreesAgeMs:r.worktreesAgeMs,terminalWorktreesAgeMs:r.terminalWorktreesAgeMs,ageMs:L.ageMs,orphanSafety:Q,worktreeRemovalGuard:e.worktreeRemovalGuard,liveness:a,now:n.now,harnessRoot:N,writeSalvageEvidence:r.execute});if(Er){let{reason:qe,detail:dc}=rW(Er);lo(l,L.path,qe,dc),c.push({...L,executed:!1,skipped:!0,skipReason:qe});continue}c.push(fb(Ul(L,r.accountBytes,r.byteAccountingEntryCap),r.execute))}if(!p()&&r.runDirectoriesAgeMs>=0)for(let ae of Qv({harnessRoot:N,worktreesDir:fe,runDirectoriesAgeMs:r.runDirectoriesAgeMs,runIdFilter:r.runIdFilter,activeGuards:o,now:n.now})){if(p())break;let le=ir.resolve(ae.path);if(u.has(le))continue;u.add(le);let L={...ae,path:le},Ne=L.runId??ir.basename(le),Q=Xv({harnessRoot:N,runId:Ne,runPath:le,ageMs:L.ageMs,runDirectoriesAgeMs:r.runDirectoriesAgeMs,activeGuards:o});if(Q){lo(l,L.path,Q),c.push({...L,executed:!1,skipped:!0,skipReason:Q});continue}c.push(mb(Ul(L,r.accountBytes,r.byteAccountingEntryCap),r.execute))}}let f=0,m=0,g=0,y=0,R=0,h=0;for(let N of c)N.bytes&&(f+=N.bytes),!N.skipped&&!N.executed&&N.bytes&&(g+=N.bytes),N.executed?(R+=1,y+=N.bytes??0,N.kind==="remove_run_directory"&&(m+=1)):N.skipped&&(h+=1,N.skipReason==="dry_run"&&N.bytes&&(g+=N.bytes));let k=r.accountBytes?Nb({harnessRoot:n.harnessRoot,now:n.now,perRunEntryCap:r.storagePerRunEntryCap}):void 0,S=rt(),I=r.execute&&Bb(S),E=I?Tl({execute:!0}):null,_=S?{observed:!0,execute:I,dumpCount:S.dumpCount,totalBytes:S.totalBytes,removedCount:E?.removed.length??0,removedBytes:E?.removedBytes??0,executables:S.executables,path:S.path,reason:S.reason}:void 0;E&&E.removed.length>0&&(y+=E.removedBytes,R+=E.removed.length,sr("wsl-crashes",`removed ${E.removed.length} dump(s), ${E.removedBytes} bytes`)),sr("complete",`${c.length} action(s), ${h} skipped, ${R} removed`);let F=$v(c,l),j=Kb({harnessRoot:n.harnessRoot,scanRoots:n.scanRoots,dryRun:!r.execute,execute:r.execute,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,diskPressure:r.diskPressure,diskGate:r.diskGate?{ok:r.diskGate.ok,path:r.diskGate.path,freeBytes:r.diskGate.freeBytes,usedPercent:r.diskGate.usedPercent,reason:r.diskGate.reason}:void 0,scannedAt:new Date(n.now).toISOString(),finalizedRuns:s,actions:c,skips:l,totals:{candidateBytes:f,reclaimableBytes:g,removedBytes:y,removedPaths:R,skippedPaths:h,skipReasons:Hb(c,l)},...k?{storage:k}:{},...F.length>0?{preservedLivePaths:F}:{},...m>0?{removedRunDirectories:m}:{},..._?{wslCrashDumps:_}:{}});return{harnessRoot:n.harnessRoot,scanRoots:n.scanRoots,dryRun:!r.execute,execute:r.execute,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,diskPressure:r.diskPressure,diskGate:r.diskGate?{ok:r.diskGate.ok,path:r.diskGate.path,freeBytes:r.diskGate.freeBytes,usedPercent:r.diskGate.usedPercent,reason:r.diskGate.reason}:void 0,scannedAt:new Date(n.now).toISOString(),finalizedRuns:s,actions:c,skips:l,totals:{candidateBytes:f,reclaimableBytes:g,removedBytes:y,removedPaths:R,skippedPaths:h,skipReasons:Hb(c,l)},...k?{storage:k}:{},...F.length>0?{preservedLivePaths:F}:{},...m>0?{removedRunDirectories:m}:{},..._?{wslCrashDumps:_}:{},compactSummary:j}}function jb(e){let r=Ob(e);return Qd({execute:r.execute,finalizeStaleRuns:r.finalizeStaleRuns,accountBytes:r.accountBytes,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,runIdFilter:r.runIdFilter})}function Vb(){return process.env.KYNVER_PIPELINE_CLEANUP!=="0"}import{readFile as mW}from"node:fs/promises";import{homedir as fW}from"node:os";import nn from"node:path";Eo();import{existsSync as Gb,readFileSync as sW}from"node:fs";import Wl from"node:path";var Jb={"@kynver-app/runtime":"0.1.83","@kynver-app/openclaw-agent-os":"0.1.43","@kynver-app/mcp-agent-os":"0.3.34"},qb=Object.keys(Jb),Ll={"@kynver-app/runtime":"Kynver runtime","@kynver-app/openclaw-agent-os":"OpenClaw AgentOS plugin","@kynver-app/mcp-agent-os":"AgentOS MCP server"},iW={"@kynver-app/runtime":"packages/kynver-runtime/package.json","@kynver-app/openclaw-agent-os":"packages/kynver-openclaw-agent-os/package.json","@kynver-app/mcp-agent-os":"packages/kynver-mcp-agent-os/package.json"};function Yb(e){let r=e.trim().split("-")[0]?.split("+")[0];if(!r)return null;let t=r.split(".");if(t.length<1||t.length>3)return null;let n=t.map(o=>Number.parseInt(o,10));if(n.some(o=>!Number.isFinite(o)||o<0))return null;for(;n.length<3;)n.push(0);return[n[0],n[1],n[2]]}function Bl(e,r){let t=Yb(e),n=Yb(r);if(!t||!n)return 0;for(let o=0;o<3;o+=1){if(t[o]>n[o])return 1;if(t[o]<n[o])return-1}return 0}function zb(e,r){return Bl(e,r)>=0}function aW(e){let r=null;for(let t of e)(!r||Bl(t,r)>0)&&(r=t);return r}function lW(e){try{let r=JSON.parse(sW(e,"utf8"));return typeof r.version=="string"&&r.version.trim()?r.version.trim():null}catch{return null}}function cW(e,r){let t=[r,process.env.KYNVER_REPO,e].filter(o=>!!o?.trim());for(let o of t){let s=Wl.resolve(o);if(Gb(Wl.join(s,"packages/kynver-runtime/package.json"))&&Gb(Wl.join(s,"package.json")))return s}return dn({cwd:e})?.repo??null}function Xb(e={}){let r=e.cwd??process.cwd(),t=cW(r,e.repoRoot);if(!t)return{};let n={};for(let o of qb){let s=Wl.join(t,iW[o]),i=lW(s);i&&(n[o]={version:i,source:"repo",path:s})}return n}function uW(e){return e==="@kynver-app/runtime"?["npm run kynver:build","npm run kynver"]:[`npm run build -w ${e}`]}function dW(e){let{packageName:r,minimumVersion:t,effectiveVersion:n,effectiveSource:o,repoVersion:s}=e,i=[];return s&&zb(s,t)?(i.push(`Use the monorepo checkout (${s}) instead of a stale npm install: ${uW(r).join("; ")}.`),i.push("Do not publish npm packages or wait on an operator release."),i):(n?i.push(`Upgrade ${r} from ${n} to >= ${t} (npm install -g ${r}@latest or align OpenClaw npm prefix).`):i.push(`Install ${r} >= ${t} before running memory-heavy AgentOS paths.`),r==="@kynver-app/runtime"&&i.push("Repo-source alternative: npm run kynver:build && npm run kynver"),o==="installed"&&s&&i.push(`Repo checkout reports ${s}; rebuild/link repo source if you develop from the monorepo.`),i)}function pW(e){if(e.length===0)return{version:null,source:"unknown"};let r=aW(e.map(n=>n.version));if(!r)return{version:null,source:"unknown"};let t=e.find(n=>n.version===r)??e[0];return{version:t.version,source:t.source}}function Qb(e={}){let r=e.undetectedPolicy??"skip",t=(l,c)=>l?typeof l=="string"?{version:l,source:c}:l:null,n=qb.map(l=>{let c=Jb[l],u=[],d=t(e.installed?.[l],"installed"),p=t(e.repo?.[l],"repo"),f=t(e.self?.[l],"self");d&&u.push(d),p&&u.push(p),f&&u.push(f);let{version:m,source:g}=pW(u),y=p?.version??null,R=!!m,h=!R&&r==="skip",k=R?zb(m,c):h,S=k?[]:dW({packageName:l,minimumVersion:c,effectiveVersion:m,effectiveSource:g,repoVersion:y}),I=h?`${Ll[l]} is not installed \u2014 memory-cost minimum ${c} applies when this package is present.`:k?`${Ll[l]} ${m} meets memory-cost minimum ${c} (${g}).`:`${Ll[l]} is below memory-cost minimum ${c}`+(m?` (effective ${m} via ${g})`:" (no version detected)")+".";return{packageName:l,displayName:Ll[l],minimumVersion:c,effectiveVersion:m,effectiveSource:g,ok:k,skipped:h,summary:I,remediation:S}}),o=n.filter(l=>!l.ok),s=n.filter(l=>l.effectiveVersion).length,i=o.length===0,a=i?s===0?"No managed AgentOS packages detected \u2014 memory-cost version guard has nothing to enforce.":s===n.length?"All managed AgentOS packages meet memory-cost minimum versions.":`Detected AgentOS packages meet memory-cost minimum versions (${s}/${n.length} present).`:`Memory-cost package guard blocked ${o.length} stale package(s): ${o.map(l=>`${l.packageName} < ${l.minimumVersion}`).join("; ")}.`;return{ok:i,summary:a,packages:n}}var Zd=class extends Error{result;constructor(r){let t=[r.summary,...r.packages.filter(n=>!n.ok).flatMap(n=>[`- ${n.summary}`,...n.remediation.map(o=>`  \u2192 ${o}`)])];super(t.join(`
@@ -133,7 +133,7 @@ ${a}`)}let o=t.join(`
 `)}),a={passed:i.passed,worktree:t,steps:i.steps};console.log(n?JSON.stringify(a,null,2):i.passed?"local plan verify passed":"local plan verify failed"),i.passed||process.exit(1)}async function Ow(e){let r=V(e.plan?String(e.plan):void 0,"plan");if(e.local===!0||e.local==="true"){CF(e);return}let n=v().agentOsSlug;n||(console.error("requires agentOsSlug in ~/.kynver/config.json for verify (session route)"),process.exit(1));let o=U(e.baseUrl?String(e.baseUrl):void 0),s=process.env.KYNVER_API_KEY,i={"Content-Type":"application/json"};s&&(i.Authorization=`Bearer ${s}`);let a=`${o}/api/agent-os/${encodeURIComponent(n)}/plans/${encodeURIComponent(r)}/verify`,l=await fetch(a,{method:"POST",headers:i,body:JSON.stringify({worktreePath:e.worktree?String(e.worktree):void 0,taskId:e.task?String(e.task):void 0,humanOverride:e.humanOverride===!0||e.humanOverride==="true"})}),c=await l.text(),u=null;try{u=JSON.parse(c)}catch{u=c}l.ok||(console.error(JSON.stringify({httpStatus:l.status,response:u},null,2)),process.exit(1)),console.log(JSON.stringify(u,null,2))}import xF from"node:path";x();function Aw(e){let r=xF.resolve(V(e.worktree?String(e.worktree):void 0,"worktree")),t=e.json===!0||e.json==="true"||e.emitJson===!0||e.emitJson==="true",n=[],o=e.command;if(Array.isArray(o))for(let a of o)n.push(String(a));else typeof o=="string"&&n.push(o);let s=ic(r,n.length?n:Dp,{waitForAdmissionMs:e.waitForAdmissionMs?Number(e.waitForAdmissionMs):void 0,timeoutMs:e.timeoutMs?Number(e.timeoutMs):void 0}),i={passed:s.passed,worktree:r,steps:s.steps.map(a=>({command:a.command,ok:a.result.ok,exitCode:a.result.exitCode,admitted:a.result.admitted,wrappedWithSystemd:a.result.wrappedWithSystemd,nodeOptionsFlag:a.result.nodeOptionsFlag,admission:a.result.admission,verificationGate:a.result.verificationGate,stderr:a.result.stderr.slice(0,4e3)}))};if(t)console.log(JSON.stringify(i,null,2));else{console.log(s.passed?"harness verify passed":"harness verify failed");for(let a of i.steps)console.log(`  ${a.ok?"\u2713":"\u2717"} ${a.command} (exit ${a.exitCode}, systemd=${a.wrappedWithSystemd})`),!a.ok&&a.stderr&&console.log(`    ${a.stderr.split(`
 `)[0]}`)}process.exit(s.passed?0:1)}A();import{readFileSync as EF}from"node:fs";x();var PF=["create","add_version","update_metadata"],IF=["approval_guard","auth","network","server","tool_interruption"];function OF(e){let r=e.bodyFile?String(e.bodyFile):void 0;if(r)return{body:EF(r,"utf8"),bodyPathHint:r};let t=e.body?String(e.body):void 0;if(t)return{body:t};throw new Error("requires --body-file PATH or --body TEXT")}async function Tw(e){let r=V(e.operation?String(e.operation):void 0,"operation");if(!PF.includes(r))throw new Error(`invalid --operation ${r}`);let t=r,n=v(),o=V(e.slug?String(e.slug):n.agentOsSlug,"slug (or agentOsSlug in ~/.kynver/config.json)"),s=V(e.title?String(e.title):void 0,"title"),{body:i,bodyPathHint:a}=OF(e);a&&Gs(a)&&console.warn(JSON.stringify({warning:"/tmp-only body path is not durable; AgentOS persistence requires outbox or successful API write",bodyPathHint:a}));let l={operation:t,agentOsSlug:o,title:s,body:i,bodyPathHint:a,summary:e.summary?String(e.summary):void 0,planId:e.plan?String(e.plan):void 0,planSlug:e.planSlug?String(e.planSlug):void 0,changeSummary:e.changeSummary?String(e.changeSummary):void 0,author:e.author?String(e.author):void 0,model:e.model?String(e.model):void 0,maxRetries:e.maxRetries?Number(e.maxRetries):void 0,immediateFailure:AF(e)},c=await qs(l);console.log(JSON.stringify(c,null,2)),c.userStatus==="failed and needs action"&&process.exit(1)}function AF(e){let r=e.failureKind?String(e.failureKind):void 0;if(!r)return;if(!IF.includes(r))throw new Error(`invalid --failure-kind ${r}`);let t=e.failureMessage?String(e.failureMessage):`immediate failure (${r})`;return{kind:r,message:t}}async function Nw(){let e=oo();console.log(JSON.stringify({count:e.length,items:e},null,2))}async function Dw(e){let r=e.max?Number(e.max):void 0,t=e.id?String(e.id):void 0,n=await yd({max:r,outboxId:t});console.log(JSON.stringify(n,null,2)),n.failed>0&&process.exit(1)}function Mw(e){let r=e.execute===!0||e.execute==="true",t=e.skipFinalize===!0||e.skipFinalize==="true",n=e.accountBytes===!0||e.accountBytes==="true",o=e.compact===!0||e.compact==="true",s=e.nodeModulesAgeMs,i=s!=null&&s!=="",a=i?Number(s):void 0,l=e.worktreesAgeMs?Number(e.worktreesAgeMs):0,c=e.includeOrphans===!0||e.includeOrphans==="true",u=e.harnessRoot?String(e.harnessRoot):void 0,d=Qd({execute:r,finalizeStaleRuns:!t,accountBytes:n,scanDependencyCaches:i,nodeModulesAgeMs:a!==void 0&&Number.isFinite(a)?a:i?216e5:void 0,worktreesAgeMs:Number.isFinite(l)?l:0,includeOrphans:c,harnessRoot:u});o&&d.compactSummary?console.log(JSON.stringify(d.compactSummary,null,2)):console.log(JSON.stringify(d,null,2)),r&&d.totals.removedPaths===0&&d.actions.length===0&&(process.exitCode=0)}Oo();function Uw(e){let r=e.execute===!0||e.execute==="true",t=e.json===!0||e.json==="true",n=e["purge-all"]===!0||e["purge-all"]==="true",o=e["keep-newest"]?Number(e["keep-newest"]):void 0;if(r||n){let a=Tl({execute:r,purgeAll:n,keepNewest:o}),l={...a,observation:a.observation?{...a.observation,dumps:a.observation.dumps.map(c=>({name:c.name,bytes:c.bytes,executableHint:c.executableHint,mtimeMs:c.mtimeMs}))}:null};console.log(JSON.stringify(l,null,t?2:0));return}let s=rt(),i=s?{...s,dumps:s.dumps.map(a=>({name:a.name,bytes:a.bytes,executableHint:a.executableHint,mtimeMs:a.mtimeMs}))}:{skipped:!0,reason:"not_wsl"};console.log(JSON.stringify(i,null,t?2:0))}function zr(e,r=2400){if(e==null)return;let n=(typeof e=="string"?e:JSON.stringify(e,null,2)).trim();if(n)return n.length<=r?n:`${n.slice(0,r-1).trimEnd()}\u2026`}function ac(e){let r=[],t=typeof e.monitorId=="string"?e.monitorId:void 0;if(r.push(t?`Harness monitor tick \xB7 ${e.runId} (${t})`:`Harness monitor tick \xB7 ${e.runId}`),!e.workers.length)return r.push("No workers in scope for this poll."),{primary:r.join(`
 `),diagnostic:zr(e)};for(let i of e.workers){let a=i.autoComplete.eligible?"eligible for auto-complete":"not auto-completing",l=i.autoComplete.blockers.length>0?` (${i.autoComplete.blockers.slice(0,2).join("; ")})`:"";r.push(`\u2022 ${i.worker}: ${i.workerStatus}, ${i.health}${i.healthReason?` \u2014 ${i.healthReason}`:""}; ${a}${l}`),i.taskStatus&&r.push(`  Board task: ${i.taskStatus}${i.leaseOwner?` (lease: ${i.leaseOwner})`:""}`)}let n=e.autoCompleted?.filter(i=>i.outcome==="completed"&&i.ok)??[],o=e.autoCompleted?.filter(i=>!i.ok&&i.outcome!=="skipped")??[];n.length&&r.push(`Auto-completed: ${n.map(i=>i.worker).join(", ")} \u2014 AgentOS completion should be posted.`),o.length&&r.push(`Auto-complete blocked: ${o.map(i=>`${i.worker}${i.reason?` (${i.reason})`:""}`).join("; ")}`),e.leaseRenewal?.failed?.length&&r.push(`Lease renew failed for: ${e.leaseRenewal.failed.map(i=>i.worker).join(", ")}`);let s=e.workers.length>0&&e.workers.every(i=>i.autoComplete.terminalVerified)&&(e.autoCompleted?.every(i=>i.ok||i.outcome==="skipped")??!0);return r.push(s?"Next: monitor loop should stop \u2014 all workers terminal and handled.":"Next: monitor will poll again until workers are terminal-verified or max time elapses."),{primary:r.join(`
-`),diagnostic:zr(e)}}import KF from"node:path";M();ie();x();ie();x();function Lw(e){let{worker:r,status:t,taskLease:n}=e,o=n?.leaseOwner??null;if(r.dispatched&&n){if(n.status==="running"&&o&&!Ou(o,r.runId))return{health:"orphaned",reason:`task lease held by ${o}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=n.leaseToken?.trim()??"";if(n.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(n.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(t.attention.state==="stale")return{health:"stale",reason:t.attention.reason};let s=t.lastHeartbeatAt?Date.parse(t.lastHeartbeatAt):NaN;return t.alive&&Number.isFinite(s)&&Date.now()-s>_n?{health:"stale",reason:`heartbeat older than ${Math.floor(_n/1e3)}s`}:t.alive&&r.pid&&!G(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:n?.status==="running"&&!t.alive&&t.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:t.attention.reason||"worker within expected lifecycle bounds"}}Pe();x();import{existsSync as Ww,mkdirSync as WF,readdirSync as BF,unlinkSync as FF}from"node:fs";import Mp from"node:path";function Bw(){let{harnessRoot:e}=kn(),r=Mp.join(e,"monitors");return WF(r,{recursive:!0}),r}function bo(e,r){return r?`${C(e)}--${C(r)}`:C(e)}function Up(e){return Mp.join(Bw(),`${e}.json`)}function So(e){return P(Up(e),void 0)}function wo(e){de(Up(e.monitorId),e)}function Fw(e){let r=Up(e);return Ww(r)?(FF(r),!0):!1}function Kw(){let e=Bw();if(!Ww(e))return[];let r=[];for(let t of BF(e)){if(!t.endsWith(".json"))continue;let n=P(Mp.join(e,t),void 0);n?.monitorId&&r.push({monitorId:n.monitorId,runId:n.runId,workerName:n.workerName,agentOsId:n.agentOsId,pid:n.pid,alive:n.pid?G(n.pid):!1,startedAt:n.startedAt,pollMs:n.pollMs,logPath:n.logPath})}return r.sort((t,n)=>t.startedAt.localeCompare(n.startedAt))}ie();function Lp(e){let{worker:r,status:t}=e,n=[];r.localOnly&&n.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&n.push("missing agentOsId/taskId linkage"),ja(r)&&n.push("completion already acknowledged"),r.completionBlocker&&n.push(r.completionBlocker),t.heartbeatBlocker&&t.alive&&n.push(`worker heartbeat blocker: ${t.heartbeatBlocker}`),t.attention.state==="blocked"&&n.push(t.attention.reason||"worker attention blocked"),Cn(t)&&n.push(t.attention.reason||"landing gate blocked");let o=he(t),s;return o?t.finalResult?s="final_result":t.alive?s="terminal_status":s="process_exited":n.push("worker has not reached a terminal condition"),{eligible:o&&n.length===0,terminalVerified:o,terminalReason:s,blockers:n}}function Hw(e,r){return P(KF.join(T(e),"workers",C(r),"worker.json"),void 0)}function $w(e,r){let t=$(e),n=Object.keys(t.workers||{});if(!r)return n;let o=C(r);return n.filter(s=>C(s)===o)}function jw(e,r){let t=$(e.runId),n=W(e,{base:t.base,baseCommit:t.baseCommit}),o=e.taskId?r.get(e.taskId)??null:null,s=Lw({worker:e,status:n,taskLease:o}),i=Lp({worker:e,status:n});return{runId:e.runId,worker:e.name,health:s.health,healthReason:s.reason,workerStatus:n.status,attentionState:n.attention.state,attentionReason:n.attention.reason,alive:n.alive,taskId:e.taskId,leaseOwner:o?.leaseOwner??void 0,taskStatus:o?.status,autoComplete:i,status:n}}async function gi(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=e.agentOsId?String(e.agentOsId):void 0,o=$(r),s=$w(r,t),i=[];for(let m of s){let g=Hw(r,m);g&&i.push(g)}let a=n||i.map(m=>m.agentOsId).find(m=>typeof m=="string"&&m.trim())||void 0,l=i.map(m=>m.taskId).filter(m=>!!m),c=await Jn({agentOsId:a,taskIds:l,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0}),u=i.map(m=>jw(m,c)),d;a&&e.renewLeases!==!1&&e.renewLeases!=="false"&&(d=await Fa(r,{...e,agentOsId:a}));let p=[];if(e.autoComplete===!0||e.autoComplete==="true")for(let m of u){if(!m.autoComplete.eligible){p.push({worker:m.worker,outcome:"skipped",ok:!1,reason:m.autoComplete.blockers.join("; ")||"not eligible"});continue}let g=await Zn({run:r,name:m.worker,...a?{agentOsId:a}:{},...e.baseUrl?{baseUrl:String(e.baseUrl)}:{},...e.secret?{secret:String(e.secret)}:{}});p.push({worker:m.worker,outcome:g.outcome,ok:g.outcome==="completed",reason:g.reason})}return{runId:r,agentOsId:a,workers:u,leaseRenewal:d,autoCompleted:p}}function Vw(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=$w(r,t),o=[];for(let s of n){let i=Hw(r,s);i&&o.push(jw(i,new Map))}return{runId:r,workers:o,autoCompleted:[]}}function Wp(){return Kw()}function Gw(e){let r=String(e.run||"");V(r,"--run");let t=bo(r,e.name?String(e.name):void 0),n=So(t);if(!n)return{monitorId:t,stopped:!1};if(n.pid&&G(n.pid))try{process.kill(n.pid,"SIGTERM")}catch{}return n.stoppedAt=new Date().toISOString(),wo(n),Fw(t),{monitorId:t,stopped:!0,pid:n.pid}}async function Bp(e){let r=String(e.run||""),t=String(e.name||"");V(r,"--run"),V(t,"--name");let n=Ie(r,t),o=$(r),s=W(n,{base:o.base,baseCommit:o.baseCommit}),i=Lp({worker:n,status:s});if(!i.eligible){console.log(JSON.stringify({runId:r,worker:t,outcome:"blocked",blockers:i.blockers,terminalVerified:i.terminalVerified},null,2)),process.exitCode=1;return}let a=await Zn({...e,run:r,name:t});console.log(JSON.stringify(a,null,2)),a.outcome!=="completed"&&a.outcome!=="blocked"&&(process.exitCode=1)}x();var HF=5e3,$F=360*60*1e3;async function Yw(e){let r=String(e.monitorId||""),t=Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):HF,n=Number(e.maxTotalMs)>0?Math.floor(Number(e.maxTotalMs)):$F,o=Date.now();for(;Date.now()-o<=n;){let s=r?So(r):void 0;if(s?.stoppedAt)break;let i=await gi({...e,autoComplete:e.autoComplete??!0,renewLeases:e.renewLeases??!0}),a=ac({monitorId:r,phase:"tick",...i});if(console.log(a.primary),a.diagnostic&&console.error(`[monitor diagnostic] ${a.diagnostic}`),i.workers.length>0&&i.workers.every(c=>c.autoComplete.terminalVerified&&(c.autoComplete.eligible||c.autoComplete.blockers.some(u=>u.includes("already acknowledged"))))&&i.autoCompleted.every(c=>c.ok||c.outcome==="skipped")){r&&s&&(s.stoppedAt=new Date().toISOString(),wo(s));break}xt(t)}}x();Pe();import{spawn as jF}from"node:child_process";import{closeSync as Jw,existsSync as VF,openSync as GF}from"node:fs";import YF from"node:path";function qw(e){let r=e.nodeExecutable??process.execPath,t=Gn({importMetaUrl:import.meta.url,explicitCliPath:e.cliPath,nodeExecutable:r});if(!t)return;let n=t.cliPath;if(!VF(n))return;let o=bo(e.runId,e.workerName),{harnessRoot:s}=kn(),i=YF.join(s,"monitors",`${o}.log`),a;try{a=GF(i,"a")}catch{a=void 0}let l=e.pollMs??5e3,c=[...t.argsPrefix,"monitor","run-loop","--run",e.runId,"--monitor-id",o,"--poll-ms",String(l),"--auto-complete","true","--renew-leases","true"];e.workerName&&c.push("--name",e.workerName),e.agentOsId&&c.push("--agent-os-id",e.agentOsId),e.baseUrl&&c.push("--base-url",e.baseUrl),e.secret&&c.push("--secret",e.secret);let u=["ignore",a??"ignore",a??"ignore"];try{let d=jF(t.command,c,me({detached:!0,stdio:u,env:process.env}));a!==void 0&&Jw(a),d.unref();let p={monitorId:o,runId:e.runId,workerName:e.workerName,agentOsId:e.agentOsId,pid:d.pid,startedAt:new Date().toISOString(),pollMs:l,logPath:i};return wo(p),{monitorId:o,pid:d.pid,logPath:i,session:p}}catch{if(a!==void 0)try{Jw(a)}catch{}return}}x();async function zw(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=bo(r,t),o=So(n);if(o?.pid&&!o.stoppedAt)return{monitorId:n,session:o,spawned:!1,pid:o.pid};let s=qw({runId:r,workerName:t,agentOsId:e.agentOsId?String(e.agentOsId):void 0,pollMs:Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):void 0,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0});if(!s)throw new Error("failed to spawn monitor sidecar (cli.js missing or spawn error)");return{monitorId:n,session:s.session,spawned:!0,pid:s.pid}}async function Xw(e){if(String(e.run||"")){let t=e.tick===!0||e.tick==="true"?await gi({...e,autoComplete:!1}):Vw(e);console.log(JSON.stringify(t,null,2));return}console.log(JSON.stringify({monitors:Wp()},null,2))}function Qw(e){console.log(JSON.stringify(Gw(e),null,2))}function Zw(){console.log(JSON.stringify({monitors:Wp()},null,2))}async function e_(e){await Yw(e)}async function r_(e){let r=await gi(e);console.log(JSON.stringify(r,null,2))}function JF(e){let r={};for(let[t,n]of Object.entries(e))n?.version&&(r[t]={version:n.version,source:"installed",path:n.path});return r}async function qF(e={}){let[r,t]=await Promise.all([Fl(),Promise.resolve(Xb({cwd:e.cwd,repoRoot:e.repoRoot}))]),n={},o=e.selfPackageName==="@kynver-app/runtime"&&e.selfVersion?e.selfVersion:Ve;return n["@kynver-app/runtime"]={version:o,source:"self"},e.selfPackageName&&e.selfVersion&&e.selfPackageName!=="@kynver-app/runtime"&&(n[e.selfPackageName]={version:e.selfVersion,source:"self"}),{installed:JF(r),repo:t,self:n,undetectedPolicy:"skip"}}async function t_(e={}){let r=await qF(e);return Zb(r)}function n_(e,r){return e?e==="daemon"||e==="start"||e==="worker"||e==="monitor"||e==="run"&&(r==="dispatch"||r==="sweep"||r==="reconcile"||r==="unblock")||e==="cron"&&r==="tick":!1}x();function zF(e){let r=e.trim();return r?ai().find(n=>n.name===r&&n.status!=="completed")??null:null}function o_(e){let r=String(V(String(e.name||""),"--name")),t=zF(r);console.log(JSON.stringify({runId:t?.id??null,name:r,status:t?.status??null,effectiveStatus:t?.effectiveStatus??null},null,2))}M();ie();x();A();import XF from"node:path";function hi(e,r,t,n,o,s){return{runId:e,worker:r,taskId:t,agentOsId:n,leaseOwner:o,action:"skipped",reason:s}}async function QF(e){let r=U(e.baseUrl?String(e.baseUrl):void 0),t=e.agentOsId?String(e.agentOsId).trim():null,n=e.dryRun===!0||e.dryRun==="true",o=[],s=[],i=[];for(let a of ne())for(let l of Object.keys(a.workers??{})){let c=XF.join(T(a.id),"workers",C(l),"worker.json"),u=P(c,void 0);if(!u){s.push(hi(a.id,l,"","","","worker.json missing"));continue}let d=u.taskId??"",p=u.agentOsId??"",f=u.leaseOwner??"";if(!u.dispatched||!d||!p||!f){s.push(hi(a.id,l,d,p,f,"not a fully-leased dispatched worker"));continue}if(t&&p!==t)continue;if(u.completionReportedAt){s.push(hi(a.id,l,d,p,f,"completion already reported"));continue}let m=W(u);if(m.finalResult){s.push(hi(a.id,l,d,p,f,"has final result \u2014 let pipeline tick complete it"));continue}if(m.alive){s.push(hi(a.id,l,d,p,f,"worker process is still alive"));continue}if(n){o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"released",reason:"dry-run: would release dead dispatched worker lease"});continue}try{let g=await X(e.secret?String(e.secret):void 0,p,{baseUrl:r}),y=`${r}/api/agent-os/by-id/${encodeURIComponent(p)}/tasks/${encodeURIComponent(d)}/release`,R=await te(y,g,{agentOsId:p,leaseOwner:f,...u.leaseToken?.trim()?{leaseToken:u.leaseToken.trim()}:{}},{agentOsId:p,baseUrl:r});R.ok===!0||R.response?.ok===!0?o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"released",reason:"dead dispatched worker lease released; task requeued"}):s.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"skipped",reason:`release returned ok:false (likely owner mismatch or already released): HTTP ${R.status}`})}catch(g){i.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"error",reason:g.message})}}return{dryRun:n,released:o,skipped:s,errors:i}}async function s_(e){let r=await QF(e),t={ok:r.errors.length===0,dryRun:r.dryRun,released:r.released.length,skipped:r.skipped.length,errors:r.errors.length,details:r};console.log(JSON.stringify(t,null,2)),r.errors.length>0&&process.exit(1)}na();import g_ from"node:path";Ke();A();import{accessSync as ZF,constants as eK,existsSync as Kp,readFileSync as rK}from"node:fs";import{homedir as lc}from"node:os";import cc from"node:path";import{spawnSync as tK}from"node:child_process";Pe();function Fp(e,r){try{let t=tK(e,r,{encoding:"utf8"}),n=(t.stdout||"").trim(),o=(t.stderr||"").trim();return{ok:t.status===0,stdout:n,stderr:o,error:t.error?.message}}catch(t){return{ok:!1,stdout:"",stderr:"",error:t.message}}}function i_(e){let r=e?.trim();if(r)return r.length<=12?`${r}\u2026`:`${r.slice(0,12)}\u2026`}function nK(e){if(!Kp(e))return!1;try{return ZF(e,eK.W_OK),!0}catch{return!1}}var a_={packageVersion:()=>Ve,commandOnPath:e=>Fp(process.platform==="win32"?"where":"which",[e]),kynverVersion:e=>Fp(e,["--version"]),loadConfig:()=>v(),configFilePath:()=>cc.join(lc(),".kynver","config.json"),credentialsFilePath:()=>cc.join(lc(),".kynver","credentials"),readCredentials:()=>{let e=cc.join(lc(),".kynver","credentials");if(!Kp(e))return{hasApiKey:!1};try{let r=JSON.parse(rK(e,"utf8"));return{hasApiKey:!!r.apiKey?.trim(),runnerTokenPrefix:i_(r.runnerToken),runnerTokenAgentOsId:r.runnerTokenAgentOsId}}catch{return{hasApiKey:!1}}},envSnapshot:()=>({kynverApiUrl:process.env.KYNVER_API_URL?.trim()||void 0,openclawCronFireBaseUrl:process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||void 0,kynverRunnerTokenPrefix:i_(process.env.KYNVER_RUNNER_TOKEN),kynverRuntimeSecret:!!process.env.KYNVER_RUNTIME_SECRET?.trim(),openclawCronSecret:!!process.env.OPENCLAW_CRON_SECRET?.trim(),kynverHarnessRoot:process.env.KYNVER_HARNESS_ROOT?.trim()||void 0,opusHarnessRoot:process.env.OPUS_HARNESS_ROOT?.trim()||void 0,kynverSchedulerProvider:process.env.KYNVER_SCHEDULER_PROVIDER?.trim()||void 0,openclawCronStorePath:!!(process.env.KYNVER_CRON_STORE_PATH?.trim()||process.env.OPENCLAW_CRON_STORE_PATH?.trim()),kynverCronDaemonPrimary:va(),qstashTokenPresent:!!process.env.QSTASH_TOKEN?.trim(),kynverHostedDeployment:(()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"})()}),harnessRoot:()=>ge(),legacyOpenclawHarnessRoot:()=>cc.join(lc(),".openclaw","harness"),pathExists:e=>Kp(e),pathWritable:e=>nK(e),ghAuthToken:()=>Fp("gh",["auth","token"]),deployEvidenceNeedsGithub:()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return!(e==="1"||e==="true"||e==="yes")}};function l_(e,r){return e.kynverSchedulerProvider==="openclaw-cron"||r.deploymentSchedulerProvider==="openclaw-cron"}function oK(e,r){return e.kynverSchedulerProvider==="kynver-cron"||r.deploymentSchedulerProvider==="kynver-cron"}function c_(e){return!!e.openclawCronStorePath}function sK(e,r){return e.kynverSchedulerProvider==="qstash"||r.deploymentSchedulerProvider==="qstash"}function u_(e,r){let t={schedulerProvider:e.kynverSchedulerProvider??null,deploymentSchedulerProvider:r.deploymentSchedulerProvider??null,openclawCronStorePath:!!e.openclawCronStorePath,kynverCronDaemonPrimary:!!e.kynverCronDaemonPrimary},n=!!r.agentOsId?.trim()&&!!r.apiBaseUrl?.trim()&&r.hasScopedRunnerToken;if(sK(e,r)&&!l_(e,r)){let u=e.kynverSchedulerProvider==="qstash"?"KYNVER_SCHEDULER_PROVIDER=qstash on this host":"deploymentSchedulerProvider=qstash in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler cut over to QStash (${u})`,details:t}}if(oK(e,r)&&!l_(e,r)){if(c_(e)&&e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let u=e.kynverSchedulerProvider==="kynver-cron"?"KYNVER_SCHEDULER_PROVIDER=kynver-cron on this host":"deploymentSchedulerProvider=kynver-cron in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler owned by Kynver Cron (${u})`,details:t}}if(c_(e)){if(e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let u=[];return e.openclawCronStorePath&&u.push("KYNVER_CRON_STORE_PATH or OPENCLAW_CRON_STORE_PATH set (local cron store)"),{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Local cron store without daemon tick (${u.join("; ")})`,remediation:"Run `kynver daemon` with KYNVER_CRON_SECRET + KYNVER_API_URL (or KYNVER_CRON_FIRE_BASE_URL) so the daemon-owned cron tick fires schedules. On hosted deploys use QStash (KYNVER_SCHEDULER_PROVIDER=qstash). Legacy OpenClaw cron env aliases still work during cutover.",details:t}}let o=e.kynverSchedulerProvider==="openclaw-cron",s=r.deploymentSchedulerProvider==="openclaw-cron",i=e.kynverSchedulerProvider==="qstash",a=!!e.qstashTokenPresent||!!e.kynverHostedDeployment,l=a&&!n,c=l&&e.kynverSchedulerProvider==="openclaw-cron";return s&&!o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"deploymentSchedulerProvider=openclaw-cron in ~/.kynver/config.json \u2014 migrate to kynver-cron or qstash",remediation:'Run `kynver scheduler attest-cutover` or set deploymentSchedulerProvider to "kynver-cron" or "qstash" in ~/.kynver/config.json.',details:t}:n&&o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 dispatch is owned by kynver daemon; unset the OpenClaw override",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:n?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:i?"Runner override qstash present; hosted dispatch still owned by kynver daemon pipeline-tick":"Hosted dispatch owned by kynver daemon (pipeline-tick \u2192 operator/tick); no OpenClaw cron on runner",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 hosted dispatch still depends on the OpenClaw local-cron adapter",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,hostedDeployment:a}}:c?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment has KYNVER_SCHEDULER_PROVIDER=openclaw-cron \u2014 AgentOS scheduled ticks should use QStash or kynver-cron",remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server (or kynver-cron for Kynver-owned local scheduling). User runners use `kynver daemon` for dispatch and should not set a scheduler provider.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:l&&e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"QSTASH_TOKEN present; hosted scheduler auto-selects qstash (explicit KYNVER_SCHEDULER_PROVIDER=qstash optional)",details:{schedulerProvider:null,qstashTokenPresent:!0,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment with no QSTASH_TOKEN and no KYNVER_SCHEDULER_PROVIDER \u2014 kynver-cron is an in-process stub here and will NOT fire; no firing scheduler is configured",remediation:"Set QSTASH_TOKEN + KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server for hosted AgentOS schedules. Only use kynver-cron when a `kynver daemon` (or local cron store) actually owns firing on this box.",details:{schedulerProvider:null,resolvedFallback:"none",qstashTokenPresent:!1,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&e.kynverSchedulerProvider&&e.kynverSchedulerProvider!=="qstash"&&e.kynverSchedulerProvider!=="kynver-cron"?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Hosted deployment without QSTASH_TOKEN (KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}) \u2014 use qstash or kynver-cron`,remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server, or kynver-cron for Kynver-owned local scheduling. User runners use `kynver daemon` for dispatch.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}`,details:{schedulerProvider:e.kynverSchedulerProvider??null}}:{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"No KYNVER_SCHEDULER_PROVIDER on runner (expected) \u2014 finish runner setup so daemon pipeline-tick owns dispatch",details:{schedulerProvider:null,dispatchPath:"kynver-daemon-pipeline-tick-pending"}}}cr();qo();Mt();ea();Vc();function d_(e,r={}){let t=En(),n=ra(e,t),o=[],s=r.envFilePath??be,i=ta(e,{envFilePath:s,systemdUnitActive:r.systemdUnitActive});if(o.push({id:"daemon_supervision_owner",ok:!!e.daemonSupervisionOwner||i.effectivelyConfigured,summary:e.daemonSupervisionOwner?`daemonSupervisionOwner=${e.daemonSupervisionOwner} (${t})`:i.owner?`daemonSupervisionOwner inferred as ${i.owner} from healthy supervision signals \u2014 run \`kynver setup\` to persist`:"daemonSupervisionOwner unset \u2014 run `kynver setup` to persist Kynver-owned restart policy",remediation:e.daemonSupervisionOwner||i.effectivelyConfigured?e.daemonSupervisionOwner?void 0:"Run `kynver setup` or `kynver doctor runtime-takeover --remediate` to persist daemonSupervisionOwner.":"Run `kynver setup` (or `kynver bootstrap`) on this box."}),o.push({id:"daemon_present_signal",ok:i.daemonPresentSignal||i.systemdUnitActive,summary:i.systemdUnitActive?"systemd user unit active \u2014 local daemon supervision is healthy":i.daemonPresentSignal?`KYNVER_CRON_DAEMON_PRESENT=1 (persisted in ${s})`:`KYNVER_CRON_DAEMON_PRESENT not set in persisted env (${s})`,remediation:i.daemonPresentSignal||i.systemdUnitActive?void 0:"Run `kynver setup` or `kynver start` once to write ~/.kynver/.env supervision keys."}),n==="systemd"){let l=Pn();o.push({id:"systemd_user_unit",ok:l,summary:l?"systemd user unit present (~/.config/systemd/user/kynver-cron-daemon.service)":"daemonSupervisionOwner=systemd but user unit missing",remediation:l?void 0:"Run `kynver start --install-systemd` or `kynver cron install --install-systemd`."})}let a=$c(t,n);return o.push({id:"supervision_guidance",ok:!0,summary:a[0]??"Kynver keeper supervises daemon restarts by default."}),o}qo();Mt();function p_(e){let r=e.loadConfig(),t=En(),n=ra(r,t),s=d_(r,{systemdUnitActive:e.systemdDaemonActive}).map(i=>({id:i.id,label:i.id.replace(/_/g," "),status:i.ok?"pass":i.id==="daemon_supervision_owner"||i.id==="daemon_present_signal"?"warn":"fail",summary:i.summary,remediation:i.remediation}));return s.push({id:"daemon_keeper_default",label:"Kynver keeper owns in-process restarts",status:n==="keeper"||n==="systemd"?"pass":"warn",summary:n==="systemd"?"systemd persists the keeper parent \u2014 Hermes/OpenClaw cron is not required to restart the daemon":"`kynver start` / `kynver daemon` run the keeper by default (opt out with --no-supervise only when an external supervisor owns restarts)",details:{owner:n,hostKind:t}}),{id:"daemon_supervision",label:"Daemon restart supervision",checks:s}}function m_(e){if(e.envGithubToken)return{viable:!0,source:"env",summary:"GITHUB_TOKEN present for GitHub commit-status evidence"};if(e.envGhToken)return{viable:!0,source:"env",summary:"GH_TOKEN present for GitHub commit-status evidence"};let r=e.ghAuthToken();return r.ok&&r.stdout.trim().length>0?{viable:!0,source:"gh-cli",summary:"GitHub CLI authenticated (`gh auth login`) for commit-status evidence"}:{viable:!1,source:"missing",summary:"No GITHUB_TOKEN/GH_TOKEN and `gh auth token` unavailable"}}function f_(e,r){let t=e.commandOnPath("vercel"),n=t.ok,o=!!process.env.VERCEL_TOKEN?.trim(),s=m_(r),i=e.deployEvidenceNeedsGithub?.()??!0,a=[{id:"vercel_global_cli_absent",label:"Global Vercel CLI not installed",status:n?"warn":"pass",summary:n?`Global Vercel CLI on PATH (${t.stdout||"vercel"}) \u2014 Vercel is decommissioned; nothing should call it`:"No global Vercel CLI on PATH",remediation:n?"Uninstall the global Vercel CLI (`npm uninstall -g vercel`) \u2014 Vercel was decommissioned in the 2026-08 Railway cutover; deploy evidence comes from production /api/version + GitHub.":void 0,details:{path:n&&t.stdout||null}}];return i?a.push({id:"github_token_for_deploy_evidence",label:"GitHub token for deploy evidence",status:s.viable?"pass":"warn",summary:s.viable?s.summary:"No GitHub auth \u2014 deploy-evidence lookups (commit status, production /api/version ancestry compare) need GITHUB_TOKEN/GH_TOKEN or `gh auth login`",remediation:s.viable?void 0:"Export GITHUB_TOKEN (or GH_TOKEN) or run `gh auth login` for PR commit-status and ancestry lookups.",details:{source:s.source}}):a.push({id:"github_token_for_deploy_evidence",label:"GitHub token for deploy evidence",status:"pass",summary:"Skipped \u2014 no enabled workflow on this host requires GitHub deploy evidence",details:{skipped:!0,reason:"workflow_not_enabled"}}),a.push({id:"vercel_token_absent",label:"No stale VERCEL_TOKEN",status:o?"warn":"pass",summary:o?"VERCEL_TOKEN is set but obsolete \u2014 Vercel is decommissioned; nothing reads it":"VERCEL_TOKEN not set (Vercel decommissioned)",remediation:o?"Revoke the token in the Vercel dashboard and remove VERCEL_TOKEN from this host's environment.":void 0,details:{vercelTokenPresent:o}}),{id:"deploy_evidence",label:"Deploy evidence (Railway era)",checks:a}}function iK(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function aK(e){let r=e.packageVersion(),t=e.commandOnPath("kynver"),n=t.ok&&t.stdout.length>0,o=n?t.stdout.split(/\r?\n/)[0]?.trim():void 0,s=o?B(o):void 0,i=[{id:"cli_running_version",label:"Running @kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${r}`,details:{version:r}},{id:"cli_on_path",label:"kynver executable on PATH",status:n?"pass":"warn",summary:n?`Found ${s}`:"kynver not found on PATH (invoked via node/npx?)",remediation:n?void 0:"Install globally (`npm i -g @kynver-app/runtime`) or invoke via `npx @kynver-app/runtime`.",details:{path:s}}];if(n&&o){let a=e.kynverVersion(o),l=a.stdout.replace(/^kynver\s+/i,"").trim()||void 0,c=a.ok&&(!l||l===r);i.push({id:"cli_installed_version",label:"Installed kynver CLI version matches running package",status:c?"pass":"warn",summary:a.ok&&l?c?`Installed ${l}`:`Installed ${l} differs from running ${r}`:a.error?`Could not read installed version (${a.error})`:a.stderr||"Could not read installed version",remediation:c?void 0:"Reinstall or rebuild @kynver-app/runtime so PATH kynver matches the harness worktree version.",details:{installedVersion:l,runningVersion:r,path:s}})}return{id:"cli_package",label:"CLI / package",checks:i}}function lK(e){let r=e.configFilePath(),t=B(r),n=e.pathExists(r),o=e.loadConfig(),s=[{id:"config_file",label:"~/.kynver/config.json present",status:n?"pass":"fail",summary:n?`Found ${t}`:`Missing ${t}`,remediation:n?void 0:"Run `kynver setup --api-base-url <url> --agent-os-id <id> --repo <path>`.",details:{configPath:t}}];if(n){let i=o.apiBaseUrl?.trim(),a=o.agentOsId?.trim(),l=Ze({config:o}),c=l?os(l):null,u=Wg(l);s.push({id:"config_api_base_url",label:"Default API base URL",status:i?"pass":"warn",summary:i??"Not set in config (KYNVER_API_URL / --base-url required per command)",remediation:i?void 0:"Set `apiBaseUrl` via `kynver setup --api-base-url https://\u2026`.",details:{apiBaseUrl:i??null}},{id:"config_agent_os_id",label:"Default AgentOS id",status:a?"pass":"warn",summary:a??"Not set (pass --agent-os-id on daemon/dispatch/worker commands)",remediation:a?void 0:"Set `agentOsId` via `kynver setup --agent-os-id <uuid>`.",details:{agentOsId:a??null,agentOsSlug:o.agentOsSlug??null}},{id:"config_default_repo",label:"Default repo path",status:u.status,summary:l?l.persistedInConfig?`${c.defaultRepo} (config)`:`${c.defaultRepo} (${l.source}, not persisted in ~/.kynver/config.json)`:"Not set in ~/.kynver/config.json (`kynver run create` requires --repo)",remediation:u.remediation,details:{defaultRepo:c?.defaultRepo??null,source:c?.source??null,persistedInConfig:c?.persistedInConfig??!1,harnessRoot:o.harnessRoot?ar(o.harnessRoot):null}})}return{id:"user_config",label:"User config (~/.kynver)",checks:s}}function cK(e){let t=e.loadConfig().agentOsId?.trim(),n=e.readCredentials(),o=e.envSnapshot(),s=e.credentialsFilePath(),i=B(s),a=o.kynverRunnerTokenPrefix,l=n.runnerTokenPrefix,c=n.runnerTokenAgentOsId,u=!!l&&(!t||!c||c===t),d=!!a?.startsWith("krc1.")||u&&l?.startsWith("krc1.");return{id:"runner_token",label:"Runner token readiness",checks:[{id:"runner_token_scoped",label:"Scoped runner token (krc1.*) ready",status:d?"pass":"fail",summary:d?a?"KYNVER_RUNNER_TOKEN is set (scoped prefix shown)":`Saved scoped token for agentOsId ${c??t??"(unknown)"}`:"No scoped runner token for the configured AgentOS workspace",remediation:d?void 0:"Run `kynver login` then `kynver runner credential --agent-os-id <id>` (or `kynver setup` with API key).",details:{source:a?"env":l?"credentials":"none",tokenPrefix:a??(u?l:void 0),agentOsId:t??c??null,credentialsPath:i}},{id:"runner_token_agent_os_match",label:"Saved runner token matches configured agentOsId",status:!l||!t||!c||c===t?"pass":"warn",summary:!l||!c?"No saved token agentOsId to compare":t?c===t?"Saved token scoped to configured agentOsId":`Saved token is for ${c}, config expects ${t}`:"Config agentOsId unset \u2014 token scope not validated against config",remediation:l&&t&&c&&c!==t?"`kynver runner credential --agent-os-id <configured-id>` to mint a workspace-bound token.":void 0,details:{configuredAgentOsId:t??null,savedAgentOsId:c??null}},{id:"runner_api_key_for_refresh",label:"API key available for token refresh",status:n.hasApiKey||process.env.KYNVER_API_KEY?.trim()?"pass":"warn",summary:n.hasApiKey||process.env.KYNVER_API_KEY?"KYNVER API key present for runner credential mint/refresh":"No API key \u2014 401 callback recovery cannot auto-mint a replacement token",remediation:n.hasApiKey||process.env.KYNVER_API_KEY?void 0:"Run `kynver login --api-key \u2026`.",details:{credentialsPath:i,hasApiKey:n.hasApiKey||!!process.env.KYNVER_API_KEY}}]}}function uK(e){return f_(e,{envGithubToken:!!process.env.GITHUB_TOKEN?.trim(),envGhToken:!!process.env.GH_TOKEN?.trim(),ghAuthToken:()=>e.ghAuthToken()})}function dK(e){let r=e.harnessRoot(),t=g_.join(r,"runs"),n=g_.join(r,"worktrees"),o=ar(r),s=ar(t),i=ar(n),a=e.pathExists(t),l=e.pathExists(n);return{id:"harness_dirs",label:"Harness / daemon directories",checks:[{id:"harness_root",label:"Harness root resolved",status:"pass",summary:o,details:{harnessRoot:o}},{id:"harness_runs_dir",label:"Runs directory ready",status:a&&e.pathWritable(t)?"pass":"warn",summary:a?e.pathWritable(t)?`Writable ${s}`:`Exists but not writable: ${s}`:`Will be created on first run: ${s}`,remediation:a&&!e.pathWritable(t)?`Fix permissions on ${s} or set KYNVER_HARNESS_ROOT to a writable path.`:void 0,details:{runsDir:s,exists:a,writable:e.pathWritable(t)}},{id:"harness_worktrees_dir",label:"Worktrees directory ready",status:l&&e.pathWritable(n)?"pass":"warn",summary:l?e.pathWritable(n)?`Writable ${i}`:`Exists but not writable: ${i}`:`Will be created on first worker: ${i}`,remediation:l&&!e.pathWritable(n)?`Fix permissions on ${i}.`:void 0,details:{worktreesDir:i,exists:l,writable:e.pathWritable(n)}}]}}function pK(e){let r=e.loadConfig(),t=e.envSnapshot(),n=t.kynverApiUrl??r.apiBaseUrl?.trim()??t.openclawCronFireBaseUrl,o=!t.kynverApiUrl&&!r.apiBaseUrl&&!!t.openclawCronFireBaseUrl,s=t.openclawCronSecret||t.kynverRuntimeSecret,i=t.kynverRunnerTokenPrefix?.startsWith("krc1."),l=e.readCredentials().runnerTokenPrefix?.startsWith("krc1.");return{id:"callback_auth",label:"Callback auth / config",checks:[{id:"callback_base_url",label:"Callback base URL configured",status:n?o?"warn":"pass":"fail",summary:n?o?`Using legacy OPENCLAW_CRON_FIRE_BASE_URL (${n})`:n:"No KYNVER_API_URL, config apiBaseUrl, or legacy OpenClaw base URL",remediation:n?o?"Migrate to KYNVER_API_URL or `kynver setup --api-base-url` and drop OPENCLAW_CRON_FIRE_BASE_URL.":void 0:"Set KYNVER_API_URL or run `kynver setup --api-base-url https://\u2026`.",details:{source:t.kynverApiUrl?"KYNVER_API_URL":r.apiBaseUrl?"config.apiBaseUrl":t.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL":"none",baseUrl:n??null}},{id:"callback_auth_mode",label:"Callback auth uses scoped runner token",status:i||l?"pass":s?"warn":"fail",summary:i?"KYNVER_RUNNER_TOKEN scoped token will be sent as X-Kynver-Runner-Token":l?"Saved krc1.* token in ~/.kynver/credentials":s?"Deployment-level KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET in use (legacy headers)":"No callback secret configured",remediation:i||l?void 0:"Mint a scoped token: `kynver runner credential --agent-os-id <id>`. Avoid shared OPENCLAW_CRON_SECRET on user runners.",details:{mode:i||l?"scoped":s?"legacy_global_secret":"missing",legacyHeadersWhenNotScoped:["X-OpenClaw-Cron-Secret","X-Kynver-Runtime-Secret"]}}]}}function mK(e){let r=e.envSnapshot(),t=e.loadConfig(),n=e.readCredentials(),o=e.harnessRoot(),s=e.legacyOpenclawHarnessRoot(),i=ar(o),a=ar(s),l=r.opusHarnessRoot?ar(r.opusHarnessRoot):null,c=o===s&&e.pathExists(s),u=t.agentOsId?.trim(),d=r.kynverRunnerTokenPrefix,p=n.runnerTokenPrefix,f=n.runnerTokenAgentOsId,m=!!p&&(!u||!f||f===u),g=!!d?.startsWith("krc1.")||m&&!!p?.startsWith("krc1.");return{id:"openclaw_hotspots",label:"OpenClaw dependency hotspots",checks:[{id:"hotspot_legacy_harness_root",label:"Legacy ~/.openclaw/harness still active",status:c?"warn":"pass",summary:c?`Harness root is legacy ${a}`:r.opusHarnessRoot?`OPUS_HARNESS_ROOT override in use (${l})`:`Using ${i}`,remediation:c?"Set KYNVER_HARNESS_ROOT=~/.kynver/harness (or run setup), migrate artifacts, retire OPUS_HARNESS_ROOT.":r.opusHarnessRoot?"Prefer KYNVER_HARNESS_ROOT over OPUS_HARNESS_ROOT.":void 0,details:{harnessRoot:i,legacyRoot:a,opusHarnessRoot:l}},{id:"hotspot_openclaw_env_secrets",label:"OpenClaw deployment secrets in runner env",status:r.openclawCronSecret||r.openclawCronFireBaseUrl?"warn":"pass",summary:r.openclawCronSecret||r.openclawCronFireBaseUrl?[r.openclawCronSecret?"OPENCLAW_CRON_SECRET set":null,r.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL set":null].filter(Boolean).join("; "):"No OpenClaw cron env overrides on this runner",remediation:r.openclawCronSecret||r.openclawCronFireBaseUrl?"Move to KYNVER_API_URL + scoped runner tokens; unset OpenClaw cron env on user-hosted runners.":void 0},u_(r,{agentOsId:u??null,apiBaseUrl:t.apiBaseUrl?.trim()??r.kynverApiUrl??null,hasScopedRunnerToken:g,deploymentSchedulerProvider:t.deploymentSchedulerProvider==="qstash"||t.deploymentSchedulerProvider==="kynver-cron"||t.deploymentSchedulerProvider==="openclaw-cron"?t.deploymentSchedulerProvider:void 0}),{id:"hotspot_lease_source_names",label:"Harness lease/completion source names",status:"pass",summary:"Runtime uses kynver-harness:* lease owners and completion source kynver-harness (OpenClaw names retired in runtime)",details:{leaseOwnerPattern:"kynver-harness:<runId>",completionSource:"kynver-harness",note:"OpenClaw adapter remains optional in packages/kynver-openclaw-agent-os only"}}]}}function h_(e=a_){let r=[aK(e),lK(e),cK(e),uK(e),dK(e),pK(e),p_(e),mK(e)],t=iK(r),n=t.fail===0,o=n?t.warn>0?`Ready with ${t.warn} warning(s) \u2014 review remediation before retiring OpenClaw as primary runtime agent.`:"Ready \u2014 Kynver runtime can serve as primary runtime agent on this host.":`${t.fail} blocking check(s) \u2014 fix failures before OpenClaw takeover.`;return{command:"doctor runtime-takeover",ready:n,summary:o,counts:t,sections:r}}function k_(e={}){let r=[];if(e.remediate===!0||e.remediate==="true"){let n=Tn();n.updated?r.push(`Remediated config fields: ${n.fields.join(", ")}`):r.push("Config backfill: no unambiguous legacy fields to persist"),n.skippedAmbiguous.length>0&&r.push(`Skipped ambiguous identity: ${n.skippedAmbiguous.join("; ")}`)}if(e.remediateDefaultRepo===!0){let n=ss();if(!n.ok){console.error(n.reason??"defaultRepo remediation failed"),n.remediation&&console.error(n.remediation),process.exitCode=1;return}n.remediated?r.push(`Remediated defaultRepo \u2192 ${n.resolved?.defaultRepo??"unknown"}`):r.push(`defaultRepo already persisted (${n.resolved?.defaultRepo??"unknown"})`)}let t=h_();r.length>0&&(t.notes=[...t.notes??[],...r]),console.log(JSON.stringify(t,null,2)),t.ready||(process.exitCode=1)}A();import{existsSync as Co,readFileSync as O_}from"node:fs";import{homedir as vK}from"node:os";import Jp from"node:path";import{spawnSync as A_}from"node:child_process";we();var y_="24.11.0",ki=">=24.11.0";function Hp(e){let r=e.trim().replace(/^v/,""),t=/^(\d+)\.(\d+)\.(\d+)$/.exec(r);return t?{major:Number(t[1]),minor:Number(t[2]),patch:Number(t[3])}:null}function R_(e,r){return e.major!==r.major?e.major-r.major:e.minor!==r.minor?e.minor-r.minor:e.patch-r.patch}function fK(e){let r=e.trim().split(/\s+/),t=null,n=null;for(let o of r)if(o.startsWith(">="))t=Hp(o.slice(2));else if(o.startsWith("<")){let s=o.slice(1);n=Hp(s)??(/^\d+$/.test(s)?{major:Number(s),minor:0,patch:0}:null)}if(!t)throw new Error(`Unsupported node policy range: ${e}`);return{floor:t,below:n}}function _o(e,r=ki){let{floor:t,below:n}=fK(r),o=Hp(e);if(!o)return{status:"invalid_version",currentVersion:e.trim(),requiredRange:r,remediation:`Node version could not be parsed as X.Y.Z (prereleases are unsupported). Install Node ${y_} or a later release within the supported range.`};let s=`${o.major}.${o.minor}.${o.patch}`;return R_(o,t)<0?{status:"upgrade_required",currentVersion:s,requiredRange:r,remediation:`Upgrade Node to >=${y_}. See docs/runbooks/node-24-fleet-migration.md for the per-host procedure.`}:n&&R_(o,n)>=0?{status:"unsupported_major",currentVersion:s,requiredRange:r,remediation:`Node ${o.major}.x is newer than this artifact's qualified range (${r}). Use a qualified Node major or wait for the next runtime qualification.`}:{status:"compatible",currentVersion:s,requiredRange:r,remediation:null}}Ke();import w_ from"node:os";Ke();var Vp={agentOsId:"<WORKSPACE_ID>",agentOsSlug:"<WORKSPACE_SLUG>",boxId:"<BOX_ID>",runnerId:"<RUNNER_ID>",tokenAgentOsId:"<WORKSPACE_ID>",configAgentOsId:"<WORKSPACE_ID>"},b_=new Set(Object.keys(Vp));function gK(e){return e.startsWith("~")&&(e.length===1||e[1]==="/"||e[1]==="\\")?e.includes("/.kynver/")||e.includes("daemon-heartbeat"):e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e)||e.includes("/Users/")||e.includes("/home/")||e.includes("\\Users\\")}function $p(e,r,t){if(typeof e=="string"&&t&&b_.has(t)&&e.trim()){r.set(e.trim(),Vp[t]??"<WORKSPACE_ID>");return}if(Array.isArray(e)){for(let n of e)$p(n,r);return}if(e&&typeof e=="object")for(let[n,o]of Object.entries(e))$p(o,r,n)}function v_(e,r){let t=e;for(let[n,o]of r)n&&(t=t.split(n).join(o));return t}function jp(e,r,t){if(typeof e=="string"){let n=v_(e,r);return t&&b_.has(t)?Vp[t]??"<WORKSPACE_ID>":(gK(n)&&(n=v_(ar(n),r)),n)}if(Array.isArray(e))return e.map(n=>jp(n,r));if(e&&typeof e=="object"){let n={};for(let[o,s]of Object.entries(e))n[o]=jp(s,r,o);return n}return e}function S_(e){let r=new Map;return $p(e,r),jp(e,r)}var hK="Totalsolutionsync/kynver-feedback",yi="https://github.com/Totalsolutionsync/kynver-feedback",__=`${yi}/issues`,kK=`${yi}/issues/new/choose`,Gp=`${yi}/issues/new?template=install_bug.yml`,Yp=`${yi}/issues/new?template=product_bug.yml`,yK="https://www.kynver.com/help/bug-reports",C_=!1;function RK(){return{autoSubmit:C_,meaning:"kynver report-bug does NOT send anything to Kynver or GitHub. It only runs doctor locally and prints a draft. The bug is reported only after a human or agent manually creates a public GitHub issue.",destinationAfterIssueCreated:__,githubRepo:hK,installTemplateUrl:Gp,productTemplateUrl:Yp,triage:"Kynver operators watch github.com/Totalsolutionsync/kynver-feedback/issues. There is no in-app admin queue for these reports."}}function x_(){let e=RK();return{repoUrl:yi,issuesUrl:__,newIssueUrl:kK,installTemplateUrl:Gp,productTemplateUrl:Yp,helpUrl:yK,cliCommand:"kynver report-bug --json",instructions:[e.meaning,"Install/runtime problems: open installTemplateUrl and paste issueBodyDraft.","Other product bugs: open productTemplateUrl instead.","Do not paste API keys, runner tokens (krc1.*), or .env secrets. Workspace ids, box ids, and home paths are redacted in this draft by default.","Account access gating (403) is not a bug \u2014 use https://www.kynver.com/agent-os/early-access."].join(" "),agentSteps:["Run `kynver report-bug --json` on the user's machine. Read `submission.autoSubmit` (always false) \u2014 do not tell the user the report was sent.","Read `issueBodyDraft` and `submission.installTemplateUrl` / `submission.productTemplateUrl`.","Create the GitHub issue yourself OR hand the user the draft + URL to paste manually.",'Install/runtime bugs: `gh issue create --repo Totalsolutionsync/kynver-feedback --title "[install] <short summary>" --body-file <draft.txt>` (requires GitHub auth on the machine).',"After the issue exists, the report lives at submission.destinationAfterIssueCreated \u2014 Kynver triages from GitHub Issues, not from this CLI.","If GitHub auth is unavailable, show the user issueBodyDraft and newIssueUrl; the report is not filed until they submit the GitHub form."],submission:e}}function E_(e){let r=x_(),t=r.submission,n={runtimeVersion:Ve,nodeVersion:process.version,platform:process.platform,arch:process.arch},o=[e.message?.trim()?`## Summary
+`),diagnostic:zr(e)}}import KF from"node:path";M();ie();x();ie();x();function Lw(e){let{worker:r,status:t,taskLease:n}=e,o=n?.leaseOwner??null;if(r.dispatched&&n){if(n.status==="running"&&o&&!Ou(o,r.runId))return{health:"orphaned",reason:`task lease held by ${o}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=n.leaseToken?.trim()??"";if(n.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(n.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(t.attention.state==="stale")return{health:"stale",reason:t.attention.reason};let s=t.lastHeartbeatAt?Date.parse(t.lastHeartbeatAt):NaN;return t.alive&&Number.isFinite(s)&&Date.now()-s>_n?{health:"stale",reason:`heartbeat older than ${Math.floor(_n/1e3)}s`}:t.alive&&r.pid&&!G(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:n?.status==="running"&&!t.alive&&t.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:t.attention.reason||"worker within expected lifecycle bounds"}}Pe();x();import{existsSync as Ww,mkdirSync as WF,readdirSync as BF,unlinkSync as FF}from"node:fs";import Mp from"node:path";function Bw(){let{harnessRoot:e}=kn(),r=Mp.join(e,"monitors");return WF(r,{recursive:!0}),r}function bo(e,r){return r?`${C(e)}--${C(r)}`:C(e)}function Up(e){return Mp.join(Bw(),`${e}.json`)}function So(e){return P(Up(e),void 0)}function wo(e){de(Up(e.monitorId),e)}function Fw(e){let r=Up(e);return Ww(r)?(FF(r),!0):!1}function Kw(){let e=Bw();if(!Ww(e))return[];let r=[];for(let t of BF(e)){if(!t.endsWith(".json"))continue;let n=P(Mp.join(e,t),void 0);n?.monitorId&&r.push({monitorId:n.monitorId,runId:n.runId,workerName:n.workerName,agentOsId:n.agentOsId,pid:n.pid,alive:n.pid?G(n.pid):!1,startedAt:n.startedAt,pollMs:n.pollMs,logPath:n.logPath})}return r.sort((t,n)=>t.startedAt.localeCompare(n.startedAt))}ie();function Lp(e){let{worker:r,status:t}=e,n=[];r.localOnly&&n.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&n.push("missing agentOsId/taskId linkage"),ja(r)&&n.push("completion already acknowledged"),r.completionBlocker&&n.push(r.completionBlocker),t.heartbeatBlocker&&t.alive&&n.push(`worker heartbeat blocker: ${t.heartbeatBlocker}`),t.attention.state==="blocked"&&n.push(t.attention.reason||"worker attention blocked"),Cn(t)&&n.push(t.attention.reason||"landing gate blocked");let o=he(t),s;return o?t.finalResult?s="final_result":t.alive?s="terminal_status":s="process_exited":n.push("worker has not reached a terminal condition"),{eligible:o&&n.length===0,terminalVerified:o,terminalReason:s,blockers:n}}function Hw(e,r){return P(KF.join(T(e),"workers",C(r),"worker.json"),void 0)}function $w(e,r){let t=$(e),n=Object.keys(t.workers||{});if(!r)return n;let o=C(r);return n.filter(s=>C(s)===o)}function jw(e,r){let t=$(e.runId),n=W(e,{base:t.base,baseCommit:t.baseCommit}),o=e.taskId?r.get(e.taskId)??null:null,s=Lw({worker:e,status:n,taskLease:o}),i=Lp({worker:e,status:n});return{runId:e.runId,worker:e.name,health:s.health,healthReason:s.reason,workerStatus:n.status,attentionState:n.attention.state,attentionReason:n.attention.reason,alive:n.alive,taskId:e.taskId,leaseOwner:o?.leaseOwner??void 0,taskStatus:o?.status,autoComplete:i,status:n}}async function gi(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=e.agentOsId?String(e.agentOsId):void 0,o=$(r),s=$w(r,t),i=[];for(let m of s){let g=Hw(r,m);g&&i.push(g)}let a=n||i.map(m=>m.agentOsId).find(m=>typeof m=="string"&&m.trim())||void 0,l=i.map(m=>m.taskId).filter(m=>!!m),c=await Jn({agentOsId:a,taskIds:l,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0}),u=i.map(m=>jw(m,c)),d;a&&e.renewLeases!==!1&&e.renewLeases!=="false"&&(d=await Fa(r,{...e,agentOsId:a}));let p=[];if(e.autoComplete===!0||e.autoComplete==="true")for(let m of u){if(!m.autoComplete.eligible){p.push({worker:m.worker,outcome:"skipped",ok:!1,reason:m.autoComplete.blockers.join("; ")||"not eligible"});continue}let g=await Zn({run:r,name:m.worker,...a?{agentOsId:a}:{},...e.baseUrl?{baseUrl:String(e.baseUrl)}:{},...e.secret?{secret:String(e.secret)}:{}});p.push({worker:m.worker,outcome:g.outcome,ok:g.outcome==="completed",reason:g.reason})}return{runId:r,agentOsId:a,workers:u,leaseRenewal:d,autoCompleted:p}}function Vw(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=$w(r,t),o=[];for(let s of n){let i=Hw(r,s);i&&o.push(jw(i,new Map))}return{runId:r,workers:o,autoCompleted:[]}}function Wp(){return Kw()}function Gw(e){let r=String(e.run||"");V(r,"--run");let t=bo(r,e.name?String(e.name):void 0),n=So(t);if(!n)return{monitorId:t,stopped:!1};if(n.pid&&G(n.pid))try{process.kill(n.pid,"SIGTERM")}catch{}return n.stoppedAt=new Date().toISOString(),wo(n),Fw(t),{monitorId:t,stopped:!0,pid:n.pid}}async function Bp(e){let r=String(e.run||""),t=String(e.name||"");V(r,"--run"),V(t,"--name");let n=Ie(r,t),o=$(r),s=W(n,{base:o.base,baseCommit:o.baseCommit}),i=Lp({worker:n,status:s});if(!i.eligible){console.log(JSON.stringify({runId:r,worker:t,outcome:"blocked",blockers:i.blockers,terminalVerified:i.terminalVerified},null,2)),process.exitCode=1;return}let a=await Zn({...e,run:r,name:t});console.log(JSON.stringify(a,null,2)),a.outcome!=="completed"&&a.outcome!=="blocked"&&(process.exitCode=1)}x();var HF=5e3,$F=360*60*1e3;async function Yw(e){let r=String(e.monitorId||""),t=Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):HF,n=Number(e.maxTotalMs)>0?Math.floor(Number(e.maxTotalMs)):$F,o=Date.now();for(;Date.now()-o<=n;){let s=r?So(r):void 0;if(s?.stoppedAt)break;let i=await gi({...e,autoComplete:e.autoComplete??!0,renewLeases:e.renewLeases??!0}),a=ac({monitorId:r,phase:"tick",...i});if(console.log(a.primary),a.diagnostic&&console.error(`[monitor diagnostic] ${a.diagnostic}`),i.workers.length>0&&i.workers.every(c=>c.autoComplete.terminalVerified&&(c.autoComplete.eligible||c.autoComplete.blockers.some(u=>u.includes("already acknowledged"))))&&i.autoCompleted.every(c=>c.ok||c.outcome==="skipped")){r&&s&&(s.stoppedAt=new Date().toISOString(),wo(s));break}xt(t)}}x();Pe();import{spawn as jF}from"node:child_process";import{closeSync as Jw,existsSync as VF,openSync as GF}from"node:fs";import YF from"node:path";function qw(e){let r=e.nodeExecutable??process.execPath,t=Gn({importMetaUrl:import.meta.url,explicitCliPath:e.cliPath,nodeExecutable:r});if(!t)return;let n=t.cliPath;if(!VF(n))return;let o=bo(e.runId,e.workerName),{harnessRoot:s}=kn(),i=YF.join(s,"monitors",`${o}.log`),a;try{a=GF(i,"a")}catch{a=void 0}let l=e.pollMs??5e3,c=[...t.argsPrefix,"monitor","run-loop","--run",e.runId,"--monitor-id",o,"--poll-ms",String(l),"--auto-complete","true","--renew-leases","true"];e.workerName&&c.push("--name",e.workerName),e.agentOsId&&c.push("--agent-os-id",e.agentOsId),e.baseUrl&&c.push("--base-url",e.baseUrl),e.secret&&c.push("--secret",e.secret);let u=["ignore",a??"ignore",a??"ignore"];try{let d=jF(t.command,c,me({detached:!0,stdio:u,env:process.env}));a!==void 0&&Jw(a),d.unref();let p={monitorId:o,runId:e.runId,workerName:e.workerName,agentOsId:e.agentOsId,pid:d.pid,startedAt:new Date().toISOString(),pollMs:l,logPath:i};return wo(p),{monitorId:o,pid:d.pid,logPath:i,session:p}}catch{if(a!==void 0)try{Jw(a)}catch{}return}}x();async function zw(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=bo(r,t),o=So(n);if(o?.pid&&!o.stoppedAt)return{monitorId:n,session:o,spawned:!1,pid:o.pid};let s=qw({runId:r,workerName:t,agentOsId:e.agentOsId?String(e.agentOsId):void 0,pollMs:Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):void 0,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0});if(!s)throw new Error("failed to spawn monitor sidecar (cli.js missing or spawn error)");return{monitorId:n,session:s.session,spawned:!0,pid:s.pid}}async function Xw(e){if(String(e.run||"")){let t=e.tick===!0||e.tick==="true"?await gi({...e,autoComplete:!1}):Vw(e);console.log(JSON.stringify(t,null,2));return}console.log(JSON.stringify({monitors:Wp()},null,2))}function Qw(e){console.log(JSON.stringify(Gw(e),null,2))}function Zw(){console.log(JSON.stringify({monitors:Wp()},null,2))}async function e_(e){await Yw(e)}async function r_(e){let r=await gi(e);console.log(JSON.stringify(r,null,2))}function JF(e){let r={};for(let[t,n]of Object.entries(e))n?.version&&(r[t]={version:n.version,source:"installed",path:n.path});return r}async function qF(e={}){let[r,t]=await Promise.all([Fl(),Promise.resolve(Xb({cwd:e.cwd,repoRoot:e.repoRoot}))]),n={},o=e.selfPackageName==="@kynver-app/runtime"&&e.selfVersion?e.selfVersion:Ve;return n["@kynver-app/runtime"]={version:o,source:"self"},e.selfPackageName&&e.selfVersion&&e.selfPackageName!=="@kynver-app/runtime"&&(n[e.selfPackageName]={version:e.selfVersion,source:"self"}),{installed:JF(r),repo:t,self:n,undetectedPolicy:"skip"}}async function t_(e={}){let r=await qF(e);return Zb(r)}function n_(e,r){return e?e==="daemon"||e==="start"||e==="worker"||e==="monitor"||e==="run"&&(r==="dispatch"||r==="sweep"||r==="reconcile"||r==="unblock")||e==="cron"&&r==="tick":!1}x();function zF(e){let r=e.trim();return r?ai().find(n=>n.name===r&&n.status!=="completed")??null:null}function o_(e){let r=String(V(String(e.name||""),"--name")),t=zF(r);console.log(JSON.stringify({runId:t?.id??null,name:r,status:t?.status??null,effectiveStatus:t?.effectiveStatus??null},null,2))}M();ie();x();A();import XF from"node:path";function hi(e,r,t,n,o,s){return{runId:e,worker:r,taskId:t,agentOsId:n,leaseOwner:o,action:"skipped",reason:s}}async function QF(e){let r=U(e.baseUrl?String(e.baseUrl):void 0),t=e.agentOsId?String(e.agentOsId).trim():null,n=e.dryRun===!0||e.dryRun==="true",o=[],s=[],i=[];for(let a of ne())for(let l of Object.keys(a.workers??{})){let c=XF.join(T(a.id),"workers",C(l),"worker.json"),u=P(c,void 0);if(!u){s.push(hi(a.id,l,"","","","worker.json missing"));continue}let d=u.taskId??"",p=u.agentOsId??"",f=u.leaseOwner??"";if(!u.dispatched||!d||!p||!f){s.push(hi(a.id,l,d,p,f,"not a fully-leased dispatched worker"));continue}if(t&&p!==t)continue;if(u.completionReportedAt){s.push(hi(a.id,l,d,p,f,"completion already reported"));continue}let m=W(u);if(m.finalResult){s.push(hi(a.id,l,d,p,f,"has final result \u2014 let pipeline tick complete it"));continue}if(m.alive){s.push(hi(a.id,l,d,p,f,"worker process is still alive"));continue}if(n){o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"released",reason:"dry-run: would release dead dispatched worker lease"});continue}try{let g=await X(e.secret?String(e.secret):void 0,p,{baseUrl:r}),y=`${r}/api/agent-os/by-id/${encodeURIComponent(p)}/tasks/${encodeURIComponent(d)}/release`,R=await te(y,g,{agentOsId:p,leaseOwner:f,...u.leaseToken?.trim()?{leaseToken:u.leaseToken.trim()}:{}},{agentOsId:p,baseUrl:r});R.ok===!0||R.response?.ok===!0?o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"released",reason:"dead dispatched worker lease released; task requeued"}):s.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"skipped",reason:`release returned ok:false (likely owner mismatch or already released): HTTP ${R.status}`})}catch(g){i.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"error",reason:g.message})}}return{dryRun:n,released:o,skipped:s,errors:i}}async function s_(e){let r=await QF(e),t={ok:r.errors.length===0,dryRun:r.dryRun,released:r.released.length,skipped:r.skipped.length,errors:r.errors.length,details:r};console.log(JSON.stringify(t,null,2)),r.errors.length>0&&process.exit(1)}na();import g_ from"node:path";Ke();A();import{accessSync as ZF,constants as eK,existsSync as Kp,readFileSync as rK}from"node:fs";import{homedir as lc}from"node:os";import cc from"node:path";import{spawnSync as tK}from"node:child_process";Pe();function Fp(e,r){try{let t=tK(e,r,{encoding:"utf8"}),n=(t.stdout||"").trim(),o=(t.stderr||"").trim();return{ok:t.status===0,stdout:n,stderr:o,error:t.error?.message}}catch(t){return{ok:!1,stdout:"",stderr:"",error:t.message}}}function i_(e){let r=e?.trim();if(r)return r.length<=12?`${r}\u2026`:`${r.slice(0,12)}\u2026`}function nK(e){if(!Kp(e))return!1;try{return ZF(e,eK.W_OK),!0}catch{return!1}}var a_={packageVersion:()=>Ve,commandOnPath:e=>Fp(process.platform==="win32"?"where":"which",[e]),kynverVersion:e=>Fp(e,["--version"]),loadConfig:()=>v(),configFilePath:()=>cc.join(lc(),".kynver","config.json"),credentialsFilePath:()=>cc.join(lc(),".kynver","credentials"),readCredentials:()=>{let e=cc.join(lc(),".kynver","credentials");if(!Kp(e))return{hasApiKey:!1};try{let r=JSON.parse(rK(e,"utf8"));return{hasApiKey:!!r.apiKey?.trim(),runnerTokenPrefix:i_(r.runnerToken),runnerTokenAgentOsId:r.runnerTokenAgentOsId}}catch{return{hasApiKey:!1}}},envSnapshot:()=>({kynverApiUrl:process.env.KYNVER_API_URL?.trim()||void 0,openclawCronFireBaseUrl:process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||void 0,kynverRunnerTokenPrefix:i_(process.env.KYNVER_RUNNER_TOKEN),kynverRuntimeSecret:!!process.env.KYNVER_RUNTIME_SECRET?.trim(),openclawCronSecret:!!process.env.OPENCLAW_CRON_SECRET?.trim(),kynverHarnessRoot:process.env.KYNVER_HARNESS_ROOT?.trim()||void 0,opusHarnessRoot:process.env.OPUS_HARNESS_ROOT?.trim()||void 0,kynverSchedulerProvider:process.env.KYNVER_SCHEDULER_PROVIDER?.trim()||void 0,openclawCronStorePath:!!(process.env.KYNVER_CRON_STORE_PATH?.trim()||process.env.OPENCLAW_CRON_STORE_PATH?.trim()),kynverCronDaemonPrimary:va(),qstashTokenPresent:!!process.env.QSTASH_TOKEN?.trim(),kynverHostedDeployment:(()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"})()}),harnessRoot:()=>ge(),legacyOpenclawHarnessRoot:()=>cc.join(lc(),".openclaw","harness"),pathExists:e=>Kp(e),pathWritable:e=>nK(e),ghAuthToken:()=>Fp("gh",["auth","token"]),deployEvidenceNeedsGithub:()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return!(e==="1"||e==="true"||e==="yes")}};function l_(e,r){return e.kynverSchedulerProvider==="openclaw-cron"||r.deploymentSchedulerProvider==="openclaw-cron"}function oK(e,r){return e.kynverSchedulerProvider==="kynver-cron"||r.deploymentSchedulerProvider==="kynver-cron"}function c_(e){return!!e.openclawCronStorePath}function sK(e,r){return e.kynverSchedulerProvider==="qstash"||r.deploymentSchedulerProvider==="qstash"}function u_(e,r){let t={schedulerProvider:e.kynverSchedulerProvider??null,deploymentSchedulerProvider:r.deploymentSchedulerProvider??null,openclawCronStorePath:!!e.openclawCronStorePath,kynverCronDaemonPrimary:!!e.kynverCronDaemonPrimary},n=!!r.agentOsId?.trim()&&!!r.apiBaseUrl?.trim()&&r.hasScopedRunnerToken;if(sK(e,r)&&!l_(e,r)){let u=e.kynverSchedulerProvider==="qstash"?"KYNVER_SCHEDULER_PROVIDER=qstash on this host":"deploymentSchedulerProvider=qstash in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler cut over to QStash (${u})`,details:t}}if(oK(e,r)&&!l_(e,r)){if(c_(e)&&e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let u=e.kynverSchedulerProvider==="kynver-cron"?"KYNVER_SCHEDULER_PROVIDER=kynver-cron on this host":"deploymentSchedulerProvider=kynver-cron in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler owned by Kynver Cron (${u})`,details:t}}if(c_(e)){if(e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let u=[];return e.openclawCronStorePath&&u.push("KYNVER_CRON_STORE_PATH or OPENCLAW_CRON_STORE_PATH set (local cron store)"),{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Local cron store without daemon tick (${u.join("; ")})`,remediation:"Run `kynver daemon` with KYNVER_CRON_SECRET + KYNVER_API_URL (or KYNVER_CRON_FIRE_BASE_URL) so the daemon-owned cron tick fires schedules. On hosted deploys use QStash (KYNVER_SCHEDULER_PROVIDER=qstash). Legacy OpenClaw cron env aliases still work during cutover.",details:t}}let o=e.kynverSchedulerProvider==="openclaw-cron",s=r.deploymentSchedulerProvider==="openclaw-cron",i=e.kynverSchedulerProvider==="qstash",a=!!e.qstashTokenPresent||!!e.kynverHostedDeployment,l=a&&!n,c=l&&e.kynverSchedulerProvider==="openclaw-cron";return s&&!o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"deploymentSchedulerProvider=openclaw-cron in ~/.kynver/config.json \u2014 migrate to kynver-cron or qstash",remediation:'Run `kynver scheduler attest-cutover` or set deploymentSchedulerProvider to "kynver-cron" or "qstash" in ~/.kynver/config.json.',details:t}:n&&o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 dispatch is owned by kynver daemon; unset the OpenClaw override",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:n?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:i?"Runner override qstash present; hosted dispatch still owned by kynver daemon pipeline-tick":"Hosted dispatch owned by kynver daemon (pipeline-tick \u2192 operator/tick); no OpenClaw cron on runner",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 hosted dispatch still depends on the OpenClaw local-cron adapter",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,hostedDeployment:a}}:c?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment has KYNVER_SCHEDULER_PROVIDER=openclaw-cron \u2014 AgentOS scheduled ticks should use QStash or kynver-cron",remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server (or kynver-cron for Kynver-owned local scheduling). User runners use `kynver daemon` for dispatch and should not set a scheduler provider.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:l&&e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"QSTASH_TOKEN present; hosted scheduler auto-selects qstash (explicit KYNVER_SCHEDULER_PROVIDER=qstash optional)",details:{schedulerProvider:null,qstashTokenPresent:!0,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment with no QSTASH_TOKEN and no KYNVER_SCHEDULER_PROVIDER \u2014 kynver-cron is an in-process stub here and will NOT fire; no firing scheduler is configured",remediation:"Set QSTASH_TOKEN + KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server for hosted AgentOS schedules. Only use kynver-cron when a `kynver daemon` (or local cron store) actually owns firing on this box.",details:{schedulerProvider:null,resolvedFallback:"none",qstashTokenPresent:!1,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&e.kynverSchedulerProvider&&e.kynverSchedulerProvider!=="qstash"&&e.kynverSchedulerProvider!=="kynver-cron"?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Hosted deployment without QSTASH_TOKEN (KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}) \u2014 use qstash or kynver-cron`,remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server, or kynver-cron for Kynver-owned local scheduling. User runners use `kynver daemon` for dispatch.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}`,details:{schedulerProvider:e.kynverSchedulerProvider??null}}:{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"No KYNVER_SCHEDULER_PROVIDER on runner (expected) \u2014 finish runner setup so daemon pipeline-tick owns dispatch",details:{schedulerProvider:null,dispatchPath:"kynver-daemon-pipeline-tick-pending"}}}cr();qo();Mt();ea();Vc();function d_(e,r={}){let t=En(),n=ra(e,t),o=[],s=r.envFilePath??be,i=ta(e,{envFilePath:s,systemdUnitActive:r.systemdUnitActive});if(o.push({id:"daemon_supervision_owner",ok:!!e.daemonSupervisionOwner||i.effectivelyConfigured,summary:e.daemonSupervisionOwner?`daemonSupervisionOwner=${e.daemonSupervisionOwner} (${t})`:i.owner?`daemonSupervisionOwner inferred as ${i.owner} from healthy supervision signals \u2014 run \`kynver setup\` to persist`:"daemonSupervisionOwner unset \u2014 run `kynver setup` to persist Kynver-owned restart policy",remediation:e.daemonSupervisionOwner||i.effectivelyConfigured?e.daemonSupervisionOwner?void 0:"Run `kynver setup` or `kynver doctor runtime-takeover --remediate` to persist daemonSupervisionOwner.":"Run `kynver setup` (or `kynver bootstrap`) on this box."}),o.push({id:"daemon_present_signal",ok:i.daemonPresentSignal||i.systemdUnitActive,summary:i.systemdUnitActive?"systemd user unit active \u2014 local daemon supervision is healthy":i.daemonPresentSignal?`KYNVER_CRON_DAEMON_PRESENT=1 (persisted in ${s})`:`KYNVER_CRON_DAEMON_PRESENT not set in persisted env (${s})`,remediation:i.daemonPresentSignal||i.systemdUnitActive?void 0:"Run `kynver setup` or `kynver start` once to write ~/.kynver/.env supervision keys."}),n==="systemd"){let l=Pn();o.push({id:"systemd_user_unit",ok:l,summary:l?"systemd user unit present (~/.config/systemd/user/kynver-cron-daemon.service)":"daemonSupervisionOwner=systemd but user unit missing",remediation:l?void 0:"Run `kynver start --install-systemd` or `kynver cron install --install-systemd`."})}let a=$c(t,n);return o.push({id:"supervision_guidance",ok:!0,summary:a[0]??"Kynver keeper supervises daemon restarts by default."}),o}qo();Mt();function p_(e){let r=e.loadConfig(),t=En(),n=ra(r,t),s=d_(r,{systemdUnitActive:e.systemdDaemonActive}).map(i=>({id:i.id,label:i.id.replace(/_/g," "),status:i.ok?"pass":i.id==="daemon_supervision_owner"||i.id==="daemon_present_signal"?"warn":"fail",summary:i.summary,remediation:i.remediation}));return s.push({id:"daemon_keeper_default",label:"Kynver keeper owns in-process restarts",status:n==="keeper"||n==="systemd"?"pass":"warn",summary:n==="systemd"?"systemd persists the keeper parent \u2014 Hermes/OpenClaw cron is not required to restart the daemon":"`kynver start` / `kynver daemon` run the keeper by default (opt out with --no-supervise only when an external supervisor owns restarts)",details:{owner:n,hostKind:t}}),{id:"daemon_supervision",label:"Daemon restart supervision",checks:s}}function m_(e){if(e.envGithubToken)return{viable:!0,source:"env",summary:"GITHUB_TOKEN present for GitHub commit-status evidence"};if(e.envGhToken)return{viable:!0,source:"env",summary:"GH_TOKEN present for GitHub commit-status evidence"};let r=e.ghAuthToken();return r.ok&&r.stdout.trim().length>0?{viable:!0,source:"gh-cli",summary:"GitHub CLI authenticated (`gh auth login`) for commit-status evidence"}:{viable:!1,source:"missing",summary:"No GITHUB_TOKEN/GH_TOKEN and `gh auth token` unavailable"}}function f_(e,r){let t=e.commandOnPath("vercel"),n=t.ok,o=!!process.env.VERCEL_TOKEN?.trim(),s=m_(r),i=e.deployEvidenceNeedsGithub?.()??!0,a=[{id:"vercel_global_cli_absent",label:"Global Vercel CLI not installed",status:n?"warn":"pass",summary:n?`Global Vercel CLI on PATH (${t.stdout||"vercel"}) \u2014 Vercel is decommissioned; nothing should call it`:"No global Vercel CLI on PATH",remediation:n?"Uninstall the global Vercel CLI (`npm uninstall -g vercel`) \u2014 Vercel was decommissioned in the 2026-08 Railway cutover; deploy evidence comes from production /api/version + GitHub.":void 0,details:{path:n&&t.stdout||null}}];return i?a.push({id:"github_token_for_deploy_evidence",label:"GitHub token for deploy evidence",status:s.viable?"pass":"warn",summary:s.viable?s.summary:"No GitHub auth \u2014 deploy-evidence lookups (commit status, production /api/version ancestry compare) need GITHUB_TOKEN/GH_TOKEN or `gh auth login`",remediation:s.viable?void 0:"Export GITHUB_TOKEN (or GH_TOKEN) or run `gh auth login` for PR commit-status and ancestry lookups.",details:{source:s.source}}):a.push({id:"github_token_for_deploy_evidence",label:"GitHub token for deploy evidence",status:"pass",summary:"Skipped \u2014 no enabled workflow on this host requires GitHub deploy evidence",details:{skipped:!0,reason:"workflow_not_enabled"}}),a.push({id:"vercel_token_absent",label:"No stale VERCEL_TOKEN",status:o?"warn":"pass",summary:o?"VERCEL_TOKEN is set but obsolete \u2014 Vercel is decommissioned; nothing reads it":"VERCEL_TOKEN not set (Vercel decommissioned)",remediation:o?"Revoke the token in the Vercel dashboard and remove VERCEL_TOKEN from this host's environment.":void 0,details:{vercelTokenPresent:o}}),{id:"deploy_evidence",label:"Deploy evidence (Railway era)",checks:a}}function iK(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function aK(e){let r=e.packageVersion(),t=e.commandOnPath("kynver"),n=t.ok&&t.stdout.length>0,o=n?t.stdout.split(/\r?\n/)[0]?.trim():void 0,s=o?B(o):void 0,i=[{id:"cli_running_version",label:"Running @kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${r}`,details:{version:r}},{id:"cli_on_path",label:"kynver executable on PATH",status:n?"pass":"warn",summary:n?`Found ${s}`:"kynver not found on PATH (invoked via node/npx?)",remediation:n?void 0:"Install globally (`npm i -g @kynver-app/runtime`) or invoke via `npx @kynver-app/runtime`.",details:{path:s}}];if(n&&o){let a=e.kynverVersion(o),l=a.stdout.replace(/^kynver\s+/i,"").trim()||void 0,c=a.ok&&(!l||l===r);i.push({id:"cli_installed_version",label:"Installed kynver CLI version matches running package",status:c?"pass":"warn",summary:a.ok&&l?c?`Installed ${l}`:`Installed ${l} differs from running ${r}`:a.error?`Could not read installed version (${a.error})`:a.stderr||"Could not read installed version",remediation:c?void 0:"Reinstall or rebuild @kynver-app/runtime so PATH kynver matches the harness worktree version.",details:{installedVersion:l,runningVersion:r,path:s}})}return{id:"cli_package",label:"CLI / package",checks:i}}function lK(e){let r=e.configFilePath(),t=B(r),n=e.pathExists(r),o=e.loadConfig(),s=[{id:"config_file",label:"~/.kynver/config.json present",status:n?"pass":"fail",summary:n?`Found ${t}`:`Missing ${t}`,remediation:n?void 0:"Run `kynver setup --api-base-url <url> --agent-os-id <id> --repo <path>`.",details:{configPath:t}}];if(n){let i=o.apiBaseUrl?.trim(),a=o.agentOsId?.trim(),l=Ze({config:o}),c=l?os(l):null,u=Wg(l);s.push({id:"config_api_base_url",label:"Default API base URL",status:i?"pass":"warn",summary:i??"Not set in config (KYNVER_API_URL / --base-url required per command)",remediation:i?void 0:"Set `apiBaseUrl` via `kynver setup --api-base-url https://\u2026`.",details:{apiBaseUrl:i??null}},{id:"config_agent_os_id",label:"Default AgentOS id",status:a?"pass":"warn",summary:a??"Not set (pass --agent-os-id on daemon/dispatch/worker commands)",remediation:a?void 0:"Set `agentOsId` via `kynver setup --agent-os-id <uuid>`.",details:{agentOsId:a??null,agentOsSlug:o.agentOsSlug??null}},{id:"config_default_repo",label:"Default repo path",status:u.status,summary:l?l.persistedInConfig?`${c.defaultRepo} (config)`:`${c.defaultRepo} (${l.source}, not persisted in ~/.kynver/config.json)`:"Not set in ~/.kynver/config.json (`kynver run create` requires --repo)",remediation:u.remediation,details:{defaultRepo:c?.defaultRepo??null,source:c?.source??null,persistedInConfig:c?.persistedInConfig??!1,harnessRoot:o.harnessRoot?ar(o.harnessRoot):null}})}return{id:"user_config",label:"User config (~/.kynver)",checks:s}}function cK(e){let t=e.loadConfig().agentOsId?.trim(),n=e.readCredentials(),o=e.envSnapshot(),s=e.credentialsFilePath(),i=B(s),a=o.kynverRunnerTokenPrefix,l=n.runnerTokenPrefix,c=n.runnerTokenAgentOsId,u=!!l&&(!t||!c||c===t),d=!!a?.startsWith("krc1.")||u&&l?.startsWith("krc1.");return{id:"runner_token",label:"Runner token readiness",checks:[{id:"runner_token_scoped",label:"Scoped runner token (krc1.*) ready",status:d?"pass":"fail",summary:d?a?"KYNVER_RUNNER_TOKEN is set (scoped prefix shown)":`Saved scoped token for agentOsId ${c??t??"(unknown)"}`:"No scoped runner token for the configured AgentOS workspace",remediation:d?void 0:"Run `kynver login` then `kynver runner credential --agent-os-id <id>` (or `kynver setup` with API key).",details:{source:a?"env":l?"credentials":"none",tokenPrefix:a??(u?l:void 0),agentOsId:t??c??null,credentialsPath:i}},{id:"runner_token_agent_os_match",label:"Saved runner token matches configured agentOsId",status:!l||!t||!c||c===t?"pass":"warn",summary:!l||!c?"No saved token agentOsId to compare":t?c===t?"Saved token scoped to configured agentOsId":`Saved token is for ${c}, config expects ${t}`:"Config agentOsId unset \u2014 token scope not validated against config",remediation:l&&t&&c&&c!==t?"`kynver runner credential --agent-os-id <configured-id>` to mint a workspace-bound token.":void 0,details:{configuredAgentOsId:t??null,savedAgentOsId:c??null}},{id:"runner_api_key_for_refresh",label:"API key available for token refresh",status:n.hasApiKey||process.env.KYNVER_API_KEY?.trim()?"pass":"warn",summary:n.hasApiKey||process.env.KYNVER_API_KEY?"KYNVER API key present for runner credential mint/refresh":"No API key \u2014 401 callback recovery cannot auto-mint a replacement token",remediation:n.hasApiKey||process.env.KYNVER_API_KEY?void 0:"Run `kynver login --api-key \u2026`.",details:{credentialsPath:i,hasApiKey:n.hasApiKey||!!process.env.KYNVER_API_KEY}}]}}function uK(e){return f_(e,{envGithubToken:!!process.env.GITHUB_TOKEN?.trim(),envGhToken:!!process.env.GH_TOKEN?.trim(),ghAuthToken:()=>e.ghAuthToken()})}function dK(e){let r=e.harnessRoot(),t=g_.join(r,"runs"),n=g_.join(r,"worktrees"),o=ar(r),s=ar(t),i=ar(n),a=e.pathExists(t),l=e.pathExists(n);return{id:"harness_dirs",label:"Harness / daemon directories",checks:[{id:"harness_root",label:"Harness root resolved",status:"pass",summary:o,details:{harnessRoot:o}},{id:"harness_runs_dir",label:"Runs directory ready",status:a&&e.pathWritable(t)?"pass":"warn",summary:a?e.pathWritable(t)?`Writable ${s}`:`Exists but not writable: ${s}`:`Will be created on first run: ${s}`,remediation:a&&!e.pathWritable(t)?`Fix permissions on ${s} or set KYNVER_HARNESS_ROOT to a writable path.`:void 0,details:{runsDir:s,exists:a,writable:e.pathWritable(t)}},{id:"harness_worktrees_dir",label:"Worktrees directory ready",status:l&&e.pathWritable(n)?"pass":"warn",summary:l?e.pathWritable(n)?`Writable ${i}`:`Exists but not writable: ${i}`:`Will be created on first worker: ${i}`,remediation:l&&!e.pathWritable(n)?`Fix permissions on ${i}.`:void 0,details:{worktreesDir:i,exists:l,writable:e.pathWritable(n)}}]}}function pK(e){let r=e.loadConfig(),t=e.envSnapshot(),n=t.kynverApiUrl??r.apiBaseUrl?.trim()??t.openclawCronFireBaseUrl,o=!t.kynverApiUrl&&!r.apiBaseUrl&&!!t.openclawCronFireBaseUrl,s=t.openclawCronSecret||t.kynverRuntimeSecret,i=t.kynverRunnerTokenPrefix?.startsWith("krc1."),l=e.readCredentials().runnerTokenPrefix?.startsWith("krc1.");return{id:"callback_auth",label:"Callback auth / config",checks:[{id:"callback_base_url",label:"Callback base URL configured",status:n?o?"warn":"pass":"fail",summary:n?o?`Using legacy OPENCLAW_CRON_FIRE_BASE_URL (${n})`:n:"No KYNVER_API_URL, config apiBaseUrl, or legacy OpenClaw base URL",remediation:n?o?"Migrate to KYNVER_API_URL or `kynver setup --api-base-url` and drop OPENCLAW_CRON_FIRE_BASE_URL.":void 0:"Set KYNVER_API_URL or run `kynver setup --api-base-url https://\u2026`.",details:{source:t.kynverApiUrl?"KYNVER_API_URL":r.apiBaseUrl?"config.apiBaseUrl":t.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL":"none",baseUrl:n??null}},{id:"callback_auth_mode",label:"Callback auth uses scoped runner token",status:i||l?"pass":s?"warn":"fail",summary:i?"KYNVER_RUNNER_TOKEN scoped token will be sent as X-Kynver-Runner-Token":l?"Saved krc1.* token in ~/.kynver/credentials":s?"Deployment-level KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET in use (legacy headers)":"No callback secret configured",remediation:i||l?void 0:"Mint a scoped token: `kynver runner credential --agent-os-id <id>`. Avoid shared OPENCLAW_CRON_SECRET on user runners.",details:{mode:i||l?"scoped":s?"legacy_global_secret":"missing",legacyHeadersWhenNotScoped:["X-OpenClaw-Cron-Secret","X-Kynver-Runtime-Secret"]}}]}}function mK(e){let r=e.envSnapshot(),t=e.loadConfig(),n=e.readCredentials(),o=e.harnessRoot(),s=e.legacyOpenclawHarnessRoot(),i=ar(o),a=ar(s),l=r.opusHarnessRoot?ar(r.opusHarnessRoot):null,c=o===s&&e.pathExists(s),u=t.agentOsId?.trim(),d=r.kynverRunnerTokenPrefix,p=n.runnerTokenPrefix,f=n.runnerTokenAgentOsId,m=!!p&&(!u||!f||f===u),g=!!d?.startsWith("krc1.")||m&&!!p?.startsWith("krc1.");return{id:"openclaw_hotspots",label:"OpenClaw dependency hotspots",checks:[{id:"hotspot_legacy_harness_root",label:"Legacy ~/.openclaw/harness still active",status:c?"warn":"pass",summary:c?`Harness root is legacy ${a}`:r.opusHarnessRoot?`OPUS_HARNESS_ROOT override in use (${l})`:`Using ${i}`,remediation:c?"Set KYNVER_HARNESS_ROOT=~/.kynver/harness (or run setup), migrate artifacts, retire OPUS_HARNESS_ROOT.":r.opusHarnessRoot?"Prefer KYNVER_HARNESS_ROOT over OPUS_HARNESS_ROOT.":void 0,details:{harnessRoot:i,legacyRoot:a,opusHarnessRoot:l}},{id:"hotspot_openclaw_env_secrets",label:"OpenClaw deployment secrets in runner env",status:r.openclawCronSecret||r.openclawCronFireBaseUrl?"warn":"pass",summary:r.openclawCronSecret||r.openclawCronFireBaseUrl?[r.openclawCronSecret?"OPENCLAW_CRON_SECRET set":null,r.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL set":null].filter(Boolean).join("; "):"No OpenClaw cron env overrides on this runner",remediation:r.openclawCronSecret||r.openclawCronFireBaseUrl?"Move to KYNVER_API_URL + scoped runner tokens; unset OpenClaw cron env on user-hosted runners.":void 0},u_(r,{agentOsId:u??null,apiBaseUrl:t.apiBaseUrl?.trim()??r.kynverApiUrl??null,hasScopedRunnerToken:g,deploymentSchedulerProvider:t.deploymentSchedulerProvider==="qstash"||t.deploymentSchedulerProvider==="kynver-cron"||t.deploymentSchedulerProvider==="openclaw-cron"?t.deploymentSchedulerProvider:void 0}),{id:"hotspot_lease_source_names",label:"Harness lease/completion source names",status:"pass",summary:"Runtime uses kynver-harness:* lease owners and completion source kynver-harness (OpenClaw names retired in runtime)",details:{leaseOwnerPattern:"kynver-harness:<runId>",completionSource:"kynver-harness",note:"OpenClaw adapter remains optional in packages/kynver-openclaw-agent-os only"}}]}}function h_(e=a_){let r=[aK(e),lK(e),cK(e),uK(e),dK(e),pK(e),p_(e),mK(e)],t=iK(r),n=t.fail===0,o=n?t.warn>0?`Ready with ${t.warn} warning(s) \u2014 review remediation before retiring OpenClaw as primary runtime agent.`:"Ready \u2014 Kynver runtime can serve as primary runtime agent on this host.":`${t.fail} blocking check(s) \u2014 fix failures before OpenClaw takeover.`;return{command:"doctor runtime-takeover",ready:n,summary:o,counts:t,sections:r}}function k_(e={}){let r=[];if(e.remediate===!0||e.remediate==="true"){let n=Tn();n.updated?r.push(`Remediated config fields: ${n.fields.join(", ")}`):r.push("Config backfill: no unambiguous legacy fields to persist"),n.skippedAmbiguous.length>0&&r.push(`Skipped ambiguous identity: ${n.skippedAmbiguous.join("; ")}`)}if(e.remediateDefaultRepo===!0){let n=ss();if(!n.ok){console.error(n.reason??"defaultRepo remediation failed"),n.remediation&&console.error(n.remediation),process.exitCode=1;return}n.remediated?r.push(`Remediated defaultRepo \u2192 ${n.resolved?.defaultRepo??"unknown"}`):r.push(`defaultRepo already persisted (${n.resolved?.defaultRepo??"unknown"})`)}let t=h_();r.length>0&&(t.notes=[...t.notes??[],...r]),console.log(JSON.stringify(t,null,2)),t.ready||(process.exitCode=1)}A();import{existsSync as Co,readFileSync as O_}from"node:fs";import{homedir as vK}from"node:os";import Jp from"node:path";import{spawnSync as A_}from"node:child_process";we();var y_="24.11.0",ki=">=24.11.0";function Hp(e){let r=e.trim().replace(/^v/,""),t=/^(\d+)\.(\d+)\.(\d+)$/.exec(r);return t?{major:Number(t[1]),minor:Number(t[2]),patch:Number(t[3])}:null}function R_(e,r){return e.major!==r.major?e.major-r.major:e.minor!==r.minor?e.minor-r.minor:e.patch-r.patch}function fK(e){let r=e.trim().split(/\s+/),t=null,n=null;for(let o of r)if(o.startsWith(">="))t=Hp(o.slice(2));else if(o.startsWith("<")){let s=o.slice(1);n=Hp(s)??(/^\d+$/.test(s)?{major:Number(s),minor:0,patch:0}:null)}if(!t)throw new Error(`Unsupported node policy range: ${e}`);return{floor:t,below:n}}function _o(e,r=ki){let{floor:t,below:n}=fK(r),o=Hp(e);if(!o)return{status:"invalid_version",currentVersion:e.trim(),requiredRange:r,remediation:`Node version could not be parsed as X.Y.Z (prereleases are unsupported). Install Node ${y_} or a later release within the supported range.`};let s=`${o.major}.${o.minor}.${o.patch}`;return R_(o,t)<0?{status:"upgrade_required",currentVersion:s,requiredRange:r,remediation:`Upgrade Node to >=${y_}.`}:n&&R_(o,n)>=0?{status:"unsupported_major",currentVersion:s,requiredRange:r,remediation:`Node ${o.major}.x is newer than this artifact's qualified range (${r}). Use a qualified Node major or wait for the next runtime qualification.`}:{status:"compatible",currentVersion:s,requiredRange:r,remediation:null}}Ke();import w_ from"node:os";Ke();var Vp={agentOsId:"<WORKSPACE_ID>",agentOsSlug:"<WORKSPACE_SLUG>",boxId:"<BOX_ID>",runnerId:"<RUNNER_ID>",tokenAgentOsId:"<WORKSPACE_ID>",configAgentOsId:"<WORKSPACE_ID>"},b_=new Set(Object.keys(Vp));function gK(e){return e.startsWith("~")&&(e.length===1||e[1]==="/"||e[1]==="\\")?e.includes("/.kynver/")||e.includes("daemon-heartbeat"):e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e)||e.includes("/Users/")||e.includes("/home/")||e.includes("\\Users\\")}function $p(e,r,t){if(typeof e=="string"&&t&&b_.has(t)&&e.trim()){r.set(e.trim(),Vp[t]??"<WORKSPACE_ID>");return}if(Array.isArray(e)){for(let n of e)$p(n,r);return}if(e&&typeof e=="object")for(let[n,o]of Object.entries(e))$p(o,r,n)}function v_(e,r){let t=e;for(let[n,o]of r)n&&(t=t.split(n).join(o));return t}function jp(e,r,t){if(typeof e=="string"){let n=v_(e,r);return t&&b_.has(t)?Vp[t]??"<WORKSPACE_ID>":(gK(n)&&(n=v_(ar(n),r)),n)}if(Array.isArray(e))return e.map(n=>jp(n,r));if(e&&typeof e=="object"){let n={};for(let[o,s]of Object.entries(e))n[o]=jp(s,r,o);return n}return e}function S_(e){let r=new Map;return $p(e,r),jp(e,r)}var hK="Totalsolutionsync/kynver-feedback",yi="https://github.com/Totalsolutionsync/kynver-feedback",__=`${yi}/issues`,kK=`${yi}/issues/new/choose`,Gp=`${yi}/issues/new?template=install_bug.yml`,Yp=`${yi}/issues/new?template=product_bug.yml`,yK="https://www.kynver.com/help/bug-reports",C_=!1;function RK(){return{autoSubmit:C_,meaning:"kynver report-bug does NOT send anything to Kynver or GitHub. It only runs doctor locally and prints a draft. The bug is reported only after a human or agent manually creates a public GitHub issue.",destinationAfterIssueCreated:__,githubRepo:hK,installTemplateUrl:Gp,productTemplateUrl:Yp,triage:"Kynver operators watch github.com/Totalsolutionsync/kynver-feedback/issues. There is no in-app admin queue for these reports."}}function x_(){let e=RK();return{repoUrl:yi,issuesUrl:__,newIssueUrl:kK,installTemplateUrl:Gp,productTemplateUrl:Yp,helpUrl:yK,cliCommand:"kynver report-bug --json",instructions:[e.meaning,"Install/runtime problems: open installTemplateUrl and paste issueBodyDraft.","Other product bugs: open productTemplateUrl instead.","Do not paste API keys, runner tokens (krc1.*), or .env secrets. Workspace ids, box ids, and home paths are redacted in this draft by default.","Account access gating (403) is not a bug \u2014 use https://www.kynver.com/agent-os/early-access."].join(" "),agentSteps:["Run `kynver report-bug --json` on the user's machine. Read `submission.autoSubmit` (always false) \u2014 do not tell the user the report was sent.","Read `issueBodyDraft` and `submission.installTemplateUrl` / `submission.productTemplateUrl`.","Create the GitHub issue yourself OR hand the user the draft + URL to paste manually.",'Install/runtime bugs: `gh issue create --repo Totalsolutionsync/kynver-feedback --title "[install] <short summary>" --body-file <draft.txt>` (requires GitHub auth on the machine).',"After the issue exists, the report lives at submission.destinationAfterIssueCreated \u2014 Kynver triages from GitHub Issues, not from this CLI.","If GitHub auth is unavailable, show the user issueBodyDraft and newIssueUrl; the report is not filed until they submit the GitHub form."],submission:e}}function E_(e){let r=x_(),t=r.submission,n={runtimeVersion:Ve,nodeVersion:process.version,platform:process.platform,arch:process.arch},o=[e.message?.trim()?`## Summary
 ${e.message.trim()}
 `:void 0,"## Environment",`- @kynver-app/runtime: ${n.runtimeVersion}`,`- Node.js: ${n.nodeVersion}`,`- OS: ${w_.type()} ${w_.release()} (${n.platform}/${n.arch})`,"","## Diagnostics","Paste output of `kynver doctor runner-install` below (workspace ids and home paths redacted):","```json",e.doctorReport?JSON.stringify(S_(e.doctorReport),null,2):"(run `kynver doctor runner-install` and paste JSON here)","```","","_Draft from `kynver report-bug` \u2014 not submitted automatically. Paste into a new GitHub issue at:",`${Gp} (install/runtime) or ${Yp} (other).`,"Remove any secrets before posting publicly._"].filter(s=>s!==void 0);return{guide:r,submission:t,environment:n,doctorReport:e.doctorReport,issueBodyDraft:o.join(`
 `)}}function P_(){let e=x_();return{newIssueUrl:e.newIssueUrl,installTemplateUrl:e.installTemplateUrl,cliCommand:e.cliCommand,helpUrl:e.helpUrl,autoSubmit:C_,submissionNote:e.submission.meaning}}var T_=Jp.join(vK(),".kynver"),Ele=Jp.join(T_,"config.json"),sn=Jp.join(T_,"credentials"),I_=(()=>{let e=process.env.KYNVER_DAEMON_STALL_MS?.trim(),r=e?parseInt(e,10):NaN;return Number.isFinite(r)&&r>0?r:900*1e3})();function bK(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function on(e){return e.checks.some(r=>r.status==="fail")}function N_(e){try{let r=A_(process.platform==="win32"?"where":"which",[e],{encoding:"utf8",timeout:3e3});return r.status===0&&!!r.stdout?.trim()}catch{return!1}}function SK(){if(!Co(sn))return{hasApiKey:!1};try{let e=JSON.parse(O_(sn,"utf8"));return{hasApiKey:!!e.apiKey?.trim(),runnerToken:e.runnerToken?.trim()||void 0,runnerTokenAgentOsId:e.runnerTokenAgentOsId?.trim()||void 0}}catch{return{hasApiKey:!1}}}function wK(){let e=N_("kynver"),r=_o(process.versions.node);return{id:"stage_1_install",label:"Stage 1 \u2014 Install",checks:[{id:"install_package_version",label:"@kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${Ve} is running`,details:{version:Ve}},{id:"install_node_runtime_policy",label:"Node runtime policy (report-only)",status:r.status==="compatible"?"pass":"warn",summary:r.status==="compatible"?`Node ${r.currentVersion} satisfies ${r.requiredRange}`:`Node ${r.currentVersion} \u2192 ${r.status} against ${r.requiredRange} (advisory during rollout)`,remediation:r.remediation??void 0,details:{status:r.status,requiredRange:r.requiredRange}},{id:"install_on_path",label:"kynver executable on PATH",status:e?"pass":"warn",summary:e?"kynver found on PATH \u2014 global install confirmed":"kynver not on PATH \u2014 running via node/npx (fine for first-timers)",remediation:e?void 0:"Install globally for a shorter command: `npm install -g @kynver-app/runtime`",details:{onPath:e}}]}}function _K(e,r){return{id:"stage_2_login",label:"Stage 2 \u2014 Device Login",checks:[{id:"login_credentials_file",label:"Credentials file present",status:Co(sn)?"pass":"fail",summary:Co(sn)?`${B(sn)} exists`:`${B(sn)} missing \u2014 not logged in`,remediation:Co(sn)?void 0:r?`kynver login --api-base-url ${r}`:"kynver login --api-base-url https://your-kynver-site"},{id:"login_api_key",label:"API key present",status:e.hasApiKey?"pass":"fail",summary:e.hasApiKey?"API key found in credentials":"No API key \u2014 device login not completed",remediation:e.hasApiKey?void 0:r?`kynver login --api-base-url ${r}`:"kynver login --api-base-url https://your-kynver-site"}]}}function CK(e,r,t=v(),n=process.env){let o=t.boxKind?.trim()||n.KYNVER_BOX_KIND?.trim()||"";return{id:"stage_3_workspace",label:"Stage 3 \u2014 Workspace Binding",checks:[{id:"workspace_api_base_url",label:"API base URL configured",status:r?"pass":"fail",summary:r?`apiBaseUrl = ${r}`:"apiBaseUrl not set \u2014 bootstrap required",remediation:r?void 0:"kynver bootstrap --api-base-url https://your-kynver-site",details:{apiBaseUrl:r??null}},{id:"workspace_agent_os_id",label:"AgentOS workspace bound",status:e?"pass":"fail",summary:e?`Workspace ${e} bound`:"agentOsId not set \u2014 workspace not bound",remediation:e?void 0:r?`kynver bootstrap --api-base-url ${r}`:"kynver bootstrap --api-base-url https://your-kynver-site",details:{agentOsId:e??null}},{id:"workspace_box_kind",label:"Box identity (boxKind) configured",status:o?"pass":"fail",summary:o?`boxKind = ${o}`:"boxKind not set \u2014 the daemon refuses to start without it",remediation:o?void 0:"kynver setup   (persists boxKind=box for customer installs; operators: --box-kind forge|ghost)",details:{boxKind:o||null}}]}}function xK(e){let r=v(),t=Ze({config:r}),n=!!t?.repo,o=!!t?.persistedInConfig,s=[{id:"repo_configured",label:"Default repo configured",status:n?"pass":"fail",summary:n?o?`${B(t.repo)} (from config)`:`${B(t.repo)} (discovered \u2014 not persisted yet)`:"No default repo \u2014 kynver start requires --repo or a configured path",remediation:n?o?void 0:"kynver config ensure-default-repo":"kynver setup --repo /path/to/your/repo",details:{defaultRepo:t?.repo??null,source:t?.source??null,persistedInConfig:o}}];return n&&!o&&s.push({id:"repo_persisted",label:"Default repo persisted in ~/.kynver/config.json",status:"warn",summary:`Repo discovered via ${t?.source} but not saved to config \u2014 may not survive env changes`,remediation:"kynver config ensure-default-repo"}),n&&s.push(PK(t.repo,EK(t.repo))),{id:"stage_4_repo",label:"Stage 4 \u2014 Repo Selection",checks:s}}function EK(e){let r=o=>ee(e,["rev-parse","--verify","--quiet",`${o}^{commit}`]).status===0;if(r("origin/main"))return{originMainOk:!0,remoteHead:null,remoteHeadOk:!1};let t=ee(e,["symbolic-ref","--quiet","refs/remotes/origin/HEAD"]),n=t.status===0&&t.stdout.trim().replace(/^refs\/remotes\//,"")||null;return{originMainOk:!1,remoteHead:n,remoteHeadOk:n?r(n):!1}}function PK(e,r){return r.originMainOk?{id:"repo_base_ref",label:"Repo base ref (origin/main) resolvable",status:"pass",summary:`git rev-parse origin/main succeeds in ${B(e)}`,details:{baseRef:"origin/main"}}:r.remoteHeadOk&&r.remoteHead?{id:"repo_base_ref",label:"Repo base ref (origin/main) resolvable",status:"warn",summary:`origin/main not found \u2014 runs will fall back to the remote default branch ${r.remoteHead}`,remediation:"Fine as-is; to pin a different base, pass --base or set KYNVER_RUN_BASE_REF",details:{baseRef:r.remoteHead,fallback:!0}}:{id:"repo_base_ref",label:"Repo base ref (origin/main) resolvable",status:"fail",summary:`Neither origin/main nor a remote default branch resolves in ${B(e)} \u2014 new runs cannot be created`,remediation:`git -C ${e} fetch origin  (then \`git -C ${e} remote set-head origin -a\` if the default branch is not main)`,details:{baseRef:null,remoteHead:r.remoteHead}}}function IK(e,r){let t=e.runnerToken,n=!!t?.startsWith("krc1."),o=e.runnerTokenAgentOsId,s=!r||!o||o===r,i=[{id:"credential_scoped_token",label:"Scoped runner token (krc1.*) present",status:n?"pass":"fail",summary:n?`Scoped token present (krc1.\u2026 for ${o??r??"workspace"})`:t?"Runner token present but not a krc1.* scoped token \u2014 re-mint required":"No runner token \u2014 mint one with `kynver runner credential`",remediation:n?void 0:r?`kynver runner credential --agent-os-id ${r}`:"kynver runner credential --agent-os-id <your-agent-os-id>",details:{hasToken:!!t,isScoped:n,tokenAgentOsId:o??null}}];return n&&!s&&i.push({id:"credential_workspace_match",label:"Runner token matches configured workspace",status:"warn",summary:`Token is for workspace ${o}, config expects ${r}`,remediation:r?`kynver runner credential --agent-os-id ${r}`:void 0,details:{tokenAgentOsId:o??null,configAgentOsId:r??null}}),{id:"stage_5_credential",label:"Stage 5 \u2014 Runner Credential",checks:i}}function OK(e){if(!e)return{id:"stage_6_daemon",label:"Stage 6 \u2014 Supervised Daemon",checks:[{id:"daemon_workspace_required",label:"Workspace required for daemon liveness check",status:"warn",summary:"agentOsId not set \u2014 cannot locate heartbeat file; complete stage 3 first"}]};let r=ua(e),t=Co(r),n=!1,o=null,s=null;if(t)try{let a=JSON.parse(O_(r,"utf8"));a.observedAt&&(o=Date.now()-new Date(a.observedAt).getTime(),n=o<I_),s=a.pid??null}catch{}let i=[{id:"daemon_running",label:"Daemon running (heartbeat present)",status:t?"pass":"warn",summary:t?`Heartbeat file found: ${B(r)}`:`No heartbeat file at ${B(r)} \u2014 daemon not started`,remediation:t?void 0:"kynver start",details:{heartbeatPath:B(r),exists:t}}];return t&&i.push({id:"daemon_heartbeat_fresh",label:"Daemon heartbeat fresh",status:n?"pass":"warn",summary:n?`Last beat ${Math.round((o??0)/1e3)}s ago (pid ${s??"?"})`:o!==null?`Heartbeat is ${Math.round(o/6e4)}m old \u2014 daemon may be stalled`:"Cannot parse heartbeat timestamp",remediation:n?void 0:"kynver start  # keeper will respawn the daemon",details:{ageMs:o,stallThresholdMs:I_,pid:s}}),{id:"stage_6_daemon",label:"Stage 6 \u2014 Supervised Daemon",checks:i}}var AK={cursor:["agent"],codex:["codex","hermes"],claude:["claude"]},TK={cursor:"Install the Cursor Agent CLI (https://cursor.com/docs/cli/headless), then `agent login` (or set CURSOR_API_KEY). Windows PowerShell: `irm 'https://cursor.com/install?win32=true' | iex`",codex:"Install the Codex CLI (https://developers.openai.com/codex/) and run `codex login`, or install `hermes` with the openai-codex provider",claude:"Install Claude Code (`npm install -g @anthropic-ai/claude-code`), then `claude login`"};function NK(e=v()){let r=(e.workerProvider?.trim()||"cursor").toLowerCase(),t=AK[r]??[],n=t.length>0,o=t.find(i=>N_(i))??null,s=null;if(o)try{let i=A_(o,["--version"],{encoding:"utf8",timeout:5e3});s=i.status===0?{ok:!0,detail:(i.stdout||i.stderr||"").trim().split(`
@@ -154,5 +154,5 @@ Blockers:`);for(let n of t.blockers)console.log(`  ! ${n}`);process.exitCode=1;r
 `)}function RH(e){let r=e.resourceGate,t=[];if(t.push(`Worker slots ${r.activeWorkers}/${r.maxConcurrentWorkers} \xB7 available ${r.slotsAvailable}`),e.workers.length===0)return t.push("No active or attention workers."),t.join(`
 `);for(let n of e.workers)t.push(kH(n));return t.join(`
 `)}function vH(e){if(!e.taskId)return"missing --task <id>";if(!e.taskFound||e.workers.length===0)return`No harness worker found for task ${e.taskId}`;let r=e.workers[0];return[`task ${e.taskId}`,`${r.runId}/${r.worker}`,r.status,r.attention,r.leaseOwner?`lease=${r.leaseOwner}`:null,r.model?`model=${r.model}`:null,r.currentTask?`tool=${lm(r.currentTask)}`:null,r.completionBlocker??r.heartbeatBlocker??r.attentionReason??null].filter(n=>!!n).join(" \xB7 ")}function mC(e){return e.mode==="workers"?RH(e):e.mode==="task"?vH(e):yH(e)}function bH(e){return e.full===!0||e.full==="true"?"full":e.json===!0||e.json==="true"?"json":e.workers===!0||e.workers==="true"?"workers":typeof e.task=="string"&&e.task.trim()?"task":"compact"}function fC(e){let r=bH(e);if(r==="full"){let n=am({mode:"full"});console.log(JSON.stringify(n,null,2));return}let t=am({mode:r,taskId:typeof e.task=="string"?e.task:void 0});if(r==="json"){console.log(JSON.stringify(t,null,2));return}console.log(mC(t))}A();function gC(e){return{Authorization:`Bearer ${e}`,"Content-Type":"application/json"}}async function hC(e){let r=await e.text();try{return JSON.parse(r)}catch{return{error:r||`HTTP ${e.status}`}}}function kC(e){let r=typeof e.agentOsId=="string"?e.agentOsId.trim():"",t=v().agentOsId?.trim()??"",n=r||t;return n||(console.error("No AgentOS workspace configured \u2014 pass --agent-os-id or run `kynver setup`."),process.exit(1)),n}async function yC(e){let r=kC(e),t=U(typeof e.baseUrl=="string"?e.baseUrl:void 0),n=Z();n||(console.error("Not logged in \u2014 run `kynver login` first."),process.exit(1));let o=`${t}/api/agent-os/by-id/${encodeURIComponent(r)}/runtime-chat/primary`,s=await fetch(o,{headers:gC(n)}),i=await hC(s);s.ok||(console.error(typeof i.error=="string"?i.error:`HTTP ${s.status}`),process.exit(1));let a=typeof i.chatPrimaryBoxId=="string"&&i.chatPrimaryBoxId.trim()?i.chatPrimaryBoxId.trim():null,l=Gl();if(e.json===!0){console.log(JSON.stringify({agentOsId:r,chatPrimaryBoxId:a,thisBoxId:l},null,2));return}console.log(`agentOsId: ${r}`),console.log(`chatPrimaryBoxId: ${a??"(unset \u2014 will auto-elect on first claim)"}`),console.log(`thisBoxId: ${l}${a&&a===l?" (primary)":""}`)}async function RC(e){let r=kC(e),t=U(typeof e.baseUrl=="string"?e.baseUrl:void 0),n=Z();n||(console.error("Not logged in \u2014 run `kynver login` first."),process.exit(1));let o;e.clear===!0?o=null:typeof e.boxId=="string"&&e.boxId.trim()?o=e.boxId.trim():o=Gl();let s=`${t}/api/agent-os/by-id/${encodeURIComponent(r)}/runtime-chat/primary`,i=await fetch(s,{method:"PATCH",headers:gC(n),body:JSON.stringify({boxId:o})}),a=await hC(i);i.ok||(console.error(typeof a.error=="string"?a.error:`HTTP ${i.status}`),process.exit(1));let l=typeof a.chatPrimaryBoxId=="string"&&a.chatPrimaryBoxId.trim()?a.chatPrimaryBoxId.trim():null;if(e.json===!0){console.log(JSON.stringify({ok:!0,agentOsId:r,chatPrimaryBoxId:l},null,2));return}console.log(l?`Chat primary set to ${l} for ${r}`:`Chat primary cleared for ${r} (next claim will auto-elect)`)}function _H(e){if(e==="doctor"||e==="report-bug")return;let r=process.env.KYNVER_NODE_POLICY_TEST_VERSION?.trim()||process.versions.node,t=_o(r,ki);t.status!=="compatible"&&(console.error([`kynver requires Node ${t.requiredRange}; this host is running Node ${t.currentVersion} (${t.status}).`,t.remediation??"","Run `kynver doctor node-runtime` for a full report. Diagnostic commands remain available."].filter(Boolean).join(`
-`)),process.exit(1))}function cm(e){return e==="help"||e==="--help"||e==="-h"}var CH=["help","login","bootstrap","start","setup","status","daemon","cleanup","wsl-crashes","chat-primary status","chat-primary set","runner credential","runner credential mint","runner credential status","runner credential list","runner credential revoke","runner credential rotate","run create","run list","run resolve","run status","run dispatch","run sweep","run reconcile","run unblock","worker start","worker list","worker status","worker tail","worker stop","worker complete","worker discard-disposable","worker auto-complete","plan progress","plan verify","plan persist","plan outbox list","plan outbox drain","harness verify","monitor start","monitor status","monitor stop","monitor list","monitor tick","monitor auto-complete","monitor run-loop","config ensure-default-repo","doctor runner-install","doctor node-runtime","doctor local-store","doctor context-envelope","doctor runtime-takeover","report-bug","scheduler cutover-check","scheduler attest-cutover","cron install","cron verify","cron status","cron tick","lane tick","lane tick landing-maintainer","board contract"];function Que(){return[...CH]}var xH=["run","worker","plan","runner","harness","monitor","doctor","config","scheduler","cron","lane","board","chat-primary"];function EH(e){return e!==void 0&&xH.includes(e)}function um(e,r){let t=[e,r].filter(Boolean).join(" ");console.error(`unknown command: ${t||"(none)"}`),dm(1)}function dm(e=0){(e===0?console.log:console.error)(["Usage:","  kynver login [--api-key KEY] [--api-base-url URL]   (omit --api-key to authorize in the browser)","  kynver bootstrap [--api-base-url URL] [--api-key KEY] [--repo PATH]   (login + setup + runner credential in one shot)","  kynver start [--repo PATH] [--api-base-url URL] [--run RUN_ID] [--interval-ms MS] [--chat-oauth] [--install-systemd]   (bring your agent online: bootstrap if needed + run + keeper-supervised daemon; --install-systemd enables Linux user unit)","  kynver chat-primary status [--agent-os-id ID] [--json]   (show sticky chat primary box for this workspace)","  kynver chat-primary set [--box-id ID] [--agent-os-id ID] [--clear] [--json]   (set sticky chat primary; omit --box-id to use this box)","  kynver runner credential [mint] [--agent-os-id ID] [--base-url URL]   (default: mint new scoped token)","  kynver runner credential status [--agent-os-id ID]   (show local token state; no server call)","  kynver runner credential list [--agent-os-id ID] [--base-url URL]   (list active credentials on server)","  kynver runner credential revoke --token-id ID [--agent-os-id AOS_ID] [--base-url URL]","  kynver runner credential rotate --token-id ID [--agent-os-id AOS_ID] [--base-url URL]   (revoke old + mint new; saves to ~/.kynver/credentials)","  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind box|forge|ghost] [--box-id box:my-laptop] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor] [--chat-oauth]","  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS] [--stall-ms MS] [--no-supervise]","  kynver status [--compact] [--workers] [--task TASK_ID] [--json] [--full]  # factory-wide harness summary","  kynver run list","  kynver run resolve --name RUN_NAME","  kynver run status --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands","  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--target-task-id TASK_ID] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--provider claude|cursor|codex] [--model claude-opus-4-8] [--disk-path /] [--reconcile-stale-blockers]","  kynver run sweep --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--grace-ms MS]",'  kynver worker start --run RUN_ID --name worker --task "..." [--owned path[,path]] [--model MODEL] [--provider claude|cursor] [--agent-os-id AOS_ID] [--task-id TASK_ID] [--wait] [--emit-json]',"  kynver worker list --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands","  kynver worker status --run RUN_ID --name worker","  kynver worker tail --run RUN_ID --name worker [--lines 40] [--raw]","  kynver worker stop --run RUN_ID --name worker","  kynver worker complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--task-id TASK_ID] [--base-url URL] [--secret SECRET]","  kynver worker discard-disposable --run RUN_ID --name worker --path scripts/helper.mjs[,other]","  kynver worker auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--poll-ms 5000] [--max-total-ms 21600000] [--complete-attempts 3] [--complete-backoff-ms 5000] [--base-url URL] [--secret SECRET]","  kynver run reconcile","  kynver run unblock [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET] [--dry-run]","  kynver plan progress --plan PLAN_ID --row ROW_KEY --role ROLE --status STATUS [--task TASK_ID] [--note NOTE] [--evidence type:value] [--agent-os-id AOS_ID]","  kynver plan verify --plan PLAN_ID [--worktree PATH] [--task TASK_ID] [--human-override] [--local]","  kynver harness verify --worktree PATH [--command CMD] [--json] [--wait-for-admission-ms MS] [--timeout-ms MS]","  kynver plan persist --operation create|add_version|update_metadata --title TITLE (--body-file PATH | --body TEXT) [--slug SLUG] [--plan PLAN_ID] [--summary TEXT] [--failure-kind approval_guard|auth|network|server|tool_interruption]","  kynver plan outbox list","  kynver plan outbox drain [--max N] [--id OUTBOX_ID]","  kynver cleanup [--execute] [--compact] [--node-modules-age-ms MS] [--worktrees-age-ms MS] [--harness-root PATH] [--include-orphans] [--skip-finalize] [--account-bytes]","  kynver wsl-crashes [--json] [--execute] [--purge-all] [--keep-newest N]","    --include-orphans also scans whole worktree directories (<harnessRoot>/worktrees/<runId>/<workerId>/) that no run/worker.json references; orphans pass salvage gates (recent heartbeat, dirty git, ahead of origin/main) before removal.","    Dry-run defaults to fast scan (no byte accounting). Pass --account-bytes for reclaimable byte totals. Pass --compact for a bounded operator summary (no full action list).","  kynver monitor start --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS]","  kynver monitor status [--run RUN_ID] [--name worker] [--tick]","  kynver monitor stop --run RUN_ID [--name worker]","  kynver monitor list","  kynver monitor tick --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--auto-complete] [--renew-leases]","  kynver monitor auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET]","  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]","  kynver config ensure-default-repo [--json]","  kynver doctor runner-install   (BYOC M0.3 \u2014 six-stage lifecycle health check for new users)","  kynver doctor node-runtime     (Node 24 migration \u2014 report-only host runtime classification, JSON)","  kynver doctor local-store [--no-probe]  (durable-harness D0 \u2014 local-run-store openability, flags, quarantine history, JSON; default probe creates the store db if absent)","  kynver doctor context-envelope [--slug SLUG] [--agent-os-id ID] [--task-id TASK_ID] [--base-url URL]","  kynver doctor runtime-takeover [--remediate] [--remediate-default-repo]","  kynver report-bug [--json] [--message TEXT] [--skip-doctor]  (bug-report guide + GitHub issue draft)","  kynver scheduler cutover-check [--json]","  kynver scheduler attest-cutover [--json]","  kynver cron install [--dry-run] [--json] [--install-systemd] [--confirm-qstash-removal] [--skip-watchdog] [--skip-test-fire] [--agent-os-id ID] [--api-base-url URL] [--run RUN_ID]","  kynver cron verify [--json]","  kynver cron status [--json]","  kynver cron tick [--agent-os-id AOS_ID] [--json]","  kynver lane tick landing-maintainer [--fleet] [--repo OWNER/NAME] [--land-script PATH] [--agent-os-id AOS_ID] [--execute] [--json]","  kynver board contract [--agent-os-id ID] [--base-url URL] [--since ISO] [--limit N]"].join(`
+`)),process.exit(1))}function cm(e){return e==="help"||e==="--help"||e==="-h"}var CH=["help","login","bootstrap","start","setup","status","daemon","cleanup","wsl-crashes","chat-primary status","chat-primary set","runner credential","runner credential mint","runner credential status","runner credential list","runner credential revoke","runner credential rotate","run create","run list","run resolve","run status","run dispatch","run sweep","run reconcile","run unblock","worker start","worker list","worker status","worker tail","worker stop","worker complete","worker discard-disposable","worker auto-complete","plan progress","plan verify","plan persist","plan outbox list","plan outbox drain","harness verify","monitor start","monitor status","monitor stop","monitor list","monitor tick","monitor auto-complete","monitor run-loop","config ensure-default-repo","doctor runner-install","doctor node-runtime","doctor local-store","doctor context-envelope","doctor runtime-takeover","report-bug","scheduler cutover-check","scheduler attest-cutover","cron install","cron verify","cron status","cron tick","lane tick","lane tick landing-maintainer","board contract"];function Que(){return[...CH]}var xH=["run","worker","plan","runner","harness","monitor","doctor","config","scheduler","cron","lane","board","chat-primary"];function EH(e){return e!==void 0&&xH.includes(e)}function um(e,r){let t=[e,r].filter(Boolean).join(" ");console.error(`unknown command: ${t||"(none)"}`),dm(1)}function dm(e=0){(e===0?console.log:console.error)(["Usage:","  kynver login [--api-key KEY] [--api-base-url URL]   (omit --api-key to authorize in the browser)","  kynver bootstrap [--api-base-url URL] [--api-key KEY] [--repo PATH]   (login + setup + runner credential in one shot)","  kynver start [--repo PATH] [--api-base-url URL] [--run RUN_ID] [--interval-ms MS] [--chat-oauth] [--install-systemd]   (bring your agent online: bootstrap if needed + run + keeper-supervised daemon; --install-systemd enables Linux user unit)","  kynver chat-primary status [--agent-os-id ID] [--json]   (show sticky chat primary box for this workspace)","  kynver chat-primary set [--box-id ID] [--agent-os-id ID] [--clear] [--json]   (set sticky chat primary; omit --box-id to use this box)","  kynver runner credential [mint] [--agent-os-id ID] [--base-url URL]   (default: mint new scoped token)","  kynver runner credential status [--agent-os-id ID]   (show local token state; no server call)","  kynver runner credential list [--agent-os-id ID] [--base-url URL]   (list active credentials on server)","  kynver runner credential revoke --token-id ID [--agent-os-id AOS_ID] [--base-url URL]","  kynver runner credential rotate --token-id ID [--agent-os-id AOS_ID] [--base-url URL]   (revoke old + mint new; saves to ~/.kynver/credentials)","  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind box|forge|ghost] [--box-id box:my-laptop] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor] [--chat-oauth]","  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS] [--stall-ms MS] [--no-supervise]","  kynver status [--compact] [--workers] [--task TASK_ID] [--json] [--full]  # factory-wide harness summary","  kynver run list","  kynver run resolve --name RUN_NAME","  kynver run status --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands","  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--target-task-id TASK_ID] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--provider claude|cursor|codex] [--model claude-opus-4-8] [--disk-path /] [--reconcile-stale-blockers]","  kynver run sweep --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--grace-ms MS]",'  kynver worker start --run RUN_ID --name worker --task "..." [--owned path[,path]] [--model MODEL] [--provider claude|cursor] [--agent-os-id AOS_ID] [--task-id TASK_ID] [--wait] [--emit-json]',"  kynver worker list --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands","  kynver worker status --run RUN_ID --name worker","  kynver worker tail --run RUN_ID --name worker [--lines 40] [--raw]","  kynver worker stop --run RUN_ID --name worker","  kynver worker complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--task-id TASK_ID] [--base-url URL] [--secret SECRET]","  kynver worker discard-disposable --run RUN_ID --name worker --path path/to/file[,other]","  kynver worker auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--poll-ms 5000] [--max-total-ms 21600000] [--complete-attempts 3] [--complete-backoff-ms 5000] [--base-url URL] [--secret SECRET]","  kynver run reconcile","  kynver run unblock [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET] [--dry-run]","  kynver plan progress --plan PLAN_ID --row ROW_KEY --role ROLE --status STATUS [--task TASK_ID] [--note NOTE] [--evidence type:value] [--agent-os-id AOS_ID]","  kynver plan verify --plan PLAN_ID [--worktree PATH] [--task TASK_ID] [--human-override] [--local]","  kynver harness verify --worktree PATH [--command CMD] [--json] [--wait-for-admission-ms MS] [--timeout-ms MS]","  kynver plan persist --operation create|add_version|update_metadata --title TITLE (--body-file PATH | --body TEXT) [--slug SLUG] [--plan PLAN_ID] [--summary TEXT] [--failure-kind approval_guard|auth|network|server|tool_interruption]","  kynver plan outbox list","  kynver plan outbox drain [--max N] [--id OUTBOX_ID]","  kynver cleanup [--execute] [--compact] [--node-modules-age-ms MS] [--worktrees-age-ms MS] [--harness-root PATH] [--include-orphans] [--skip-finalize] [--account-bytes]","  kynver wsl-crashes [--json] [--execute] [--purge-all] [--keep-newest N]","    --include-orphans also scans whole worktree directories (<harnessRoot>/worktrees/<runId>/<workerId>/) that no run/worker.json references; orphans pass salvage gates (recent heartbeat, dirty git, ahead of origin/main) before removal.","    Dry-run defaults to fast scan (no byte accounting). Pass --account-bytes for reclaimable byte totals. Pass --compact for a bounded operator summary (no full action list).","  kynver monitor start --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS]","  kynver monitor status [--run RUN_ID] [--name worker] [--tick]","  kynver monitor stop --run RUN_ID [--name worker]","  kynver monitor list","  kynver monitor tick --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--auto-complete] [--renew-leases]","  kynver monitor auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET]","  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]","  kynver config ensure-default-repo [--json]","  kynver doctor runner-install   (BYOC M0.3 \u2014 six-stage lifecycle health check for new users)","  kynver doctor node-runtime     (Node 24 migration \u2014 report-only host runtime classification, JSON)","  kynver doctor local-store [--no-probe]  (durable-harness D0 \u2014 local-run-store openability, flags, quarantine history, JSON; default probe creates the store db if absent)","  kynver doctor context-envelope [--slug SLUG] [--agent-os-id ID] [--task-id TASK_ID] [--base-url URL]","  kynver doctor runtime-takeover [--remediate] [--remediate-default-repo]","  kynver report-bug [--json] [--message TEXT] [--skip-doctor]  (bug-report guide + GitHub issue draft)","  kynver scheduler cutover-check [--json]","  kynver scheduler attest-cutover [--json]","  kynver cron install [--dry-run] [--json] [--install-systemd] [--confirm-qstash-removal] [--skip-watchdog] [--skip-test-fire] [--agent-os-id ID] [--api-base-url URL] [--run RUN_ID]","  kynver cron verify [--json]","  kynver cron status [--json]","  kynver cron tick [--agent-os-id AOS_ID] [--json]","  kynver lane tick landing-maintainer [--fleet] [--repo OWNER/NAME] [--land-script PATH] [--agent-os-id AOS_ID] [--execute] [--json]","  kynver board contract [--agent-os-id ID] [--base-url URL] [--since ISO] [--limit N]"].join(`
 `)),process.exit(e)}async function PH(e=process.argv.slice(2)){if(lg(e,import.meta.url,"kynver"))return;if(e.length===0||cm(e[0]))return dm(0);_H(e[0]);let r=e.shift(),t,n;if(EH(r)&&(t=e.shift()),n=e,t&&cm(t)||n.some(cm))return dm(0);let o=ts(n),{runsDir:s,worktreesDir:i}=re();if(vC(s,{recursive:!0}),vC(i,{recursive:!0}),r==="daemon"&&Bn(),n_(r,t)){let a,l=o.run?String(o.run).trim():"";if(l)try{a=$(l).repo}catch{a=void 0}await t_({repoRoot:a,cwd:a})}if(r==="login")return void await rg(o);if(r==="bootstrap")return void await la(o);if(r==="report-bug")return void await j_(o);if(r==="start")return void await hw(o);if(r==="runner"&&t==="credential"){let a=n[0]&&!n[0].startsWith("--")?n.shift():void 0,l=ts(n);if(!a||a==="mint")return void await zf(l);if(a==="status")return void eg(l);if(a==="list")return void await Xf(l);if(a==="revoke")return void await Qf(l);if(a==="rotate")return void await Zf(l);um("runner credential",a)}if(r==="setup")return void await aa(o);if(r==="chat-primary"&&t==="status")return void await yC(o);if(r==="chat-primary"&&t==="set")return void await RC(o);if(r==="status")return fC(o);if(r==="daemon")return ha(o)?void await ka(o):void await Yl(o);if(r==="plan"&&t==="progress")return void await Iw(o);if(r==="plan"&&t==="verify")return void await Ow(o);if(r==="harness"&&t==="verify")return Aw(o);if(r==="plan"&&t==="persist")return void await Tw(o);if(r==="plan"&&t==="outbox"){let a=n.shift();if(a==="list")return void await Nw();if(a==="drain")return void await Dw(ts(n));um("plan",`outbox ${a??""}`.trim())}if(r==="cleanup")return Mw(o);if(r==="wsl-crashes")return Uw(o);if(r==="config"&&t==="ensure-default-repo")return Lg(o.json===!0);if(r==="doctor"&&!t)return console.error("Running `kynver doctor runner-install` (default). Other reports: node-runtime, local-store, context-envelope, runtime-takeover."),void await zp();if(r==="doctor"&&t==="runner-install")return void await zp();if(r==="doctor"&&t==="node-runtime")return M_();if(r==="doctor"&&t==="local-store")return L_(o);if(r==="doctor"&&t==="context-envelope")return void await $_(o);if(r==="doctor"&&t==="runtime-takeover")return k_(o);if(r==="scheduler"&&t==="cutover-check")return J_(o.json===!0);if(r==="scheduler"&&t==="attest-cutover")return q_(o.json===!0);if(r==="cron"&&t==="install")return void await Q_(o);if(r==="cron"&&t==="verify")return void await Z_(o);if(r==="cron"&&t==="status")return void await z_(o.json===!0);if(r==="cron"&&t==="tick")return void await X_(o);if(r==="lane"&&t==="tick"){let a=n.shift();return void await aC(ts(n),a)}if(r==="board"&&t==="contract")return void await V_(o);if(r==="run"&&t==="create")return void Jl(o);if(r==="run"&&t==="list")return jS();if(r==="run"&&t==="resolve")return o_(o);if(r==="run"&&t==="status")return rR(o);if(r==="run"&&t==="dispatch")return void await Xt(o);if(r==="run"&&t==="sweep")return void await ri(o);if(r==="run"&&t==="reconcile")return Cv();if(r==="run"&&t==="unblock")return void await s_(o);if(r==="worker"&&t==="start")return void await hR(o);if(r==="worker"&&t==="list")return zy(o);if(r==="worker"&&t==="status")return Jy(o);if(r==="worker"&&t==="tail")return tR(o);if(r==="worker"&&t==="stop")return nR(o);if(r==="worker"&&t==="complete")return void await ad(o);if(r==="worker"&&t==="discard-disposable")return kw(o);if(r==="worker"&&t==="auto-complete")return void await iR(o);if(r==="monitor"&&t==="start"){let a=await zw(o);console.log(JSON.stringify(a,null,2));return}if(r==="monitor"&&t==="status")return void await Xw(o);if(r==="monitor"&&t==="stop")return Qw(o);if(r==="monitor"&&t==="list")return Zw();if(r==="monitor"&&t==="tick")return void await r_(o);if(r==="monitor"&&t==="auto-complete")return void await Bp(o);if(r==="monitor"&&t==="run-loop")return void await e_(o);um(r,t)}function bC(e){let r=e?.trim();if(!r||r==="-")return null;try{return SH.native(r)}catch{return null}}var IH=bC(process.argv[1])===bC(wH(import.meta.url));IH&&PH().catch(e=>{HS(e)&&(console.error($S(e)),process.exit(e.exitCode)),console.error(e),process.exit(1)});export{CH as KNOWN_CLI_VERBS,xH as TWO_TOKEN_CLI_SCOPES,Que as listKnownCliVerbs,PH as main,dm as usage};