@kynver-app/runtime 0.2.53 → 0.2.54

package/dist/index.js

@@ -2,7 +2,7 @@ var XE=Object.defineProperty;var D=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(
 `),iP(t,e)}catch(n){try{aP(t,{force:!0})}catch{}throw n}}function w(e){return String(e||"").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"")||"worker"}function gh(e){return w(`${new Date().toISOString().replace(/[-:]/g,"").replace(/\..+/,"Z")}-${e}`)}function He(e){return String(e).replace(/\/+$/,"")}function ba(e){return String(e||"").replace(/\s+/g," ").trim()}function Sa(e){try{return mh(e).size}catch{return 0}}function _a(e){try{return mh(e).mtime.toISOString()}catch{return null}}function Ca(e,r){return oP(e)?td(e,"utf8").split(`
 `).slice(-r).join(`
 `):""}function hh(e){return e?td(fh.resolve(e),"utf8"):""}function Bt(e){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,e)}function gt(e){return new Promise(r=>setTimeout(r,e))}function G(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}function Cr(e,r){try{process.kill(-e,r)}catch{process.kill(e,r)}}function kh(e){let r=null,t=-1/0;for(let n of e){if(!n)continue;let o=Date.parse(n);Number.isFinite(o)&&o>t&&(t=o,r=n)}return r}function nd(e){return Math.max(0,Math.round((Date.now()-e)/1e3))}var x=D(()=>{"use strict"});function od(e){let r=e[gP];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function ps(e,r={}){return uP.has(e)?!0:mP.has(e)||r.operatorAllow?.has(e)||fP.some(t=>e.endsWith(t))?!1:dP.some(t=>e.endsWith(t))}function Rh(e){let r=od(e);return Object.keys(e).filter(t=>ps(t,{operatorAllow:r})).sort()}function vh(e){let r=od(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!ps(t,{operatorAllow:r})&&ps(t)).sort()}function ms(e){let r=od(e),t={...e};for(let n of Object.keys(t))ps(n,{operatorAllow:r})&&delete t[n];return t}function hP(e){let r=Rh(e),t=vh(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}function bh(e){return ms(e)}var yh,uP,dP,pP,mP,fP,gP,wa=D(()=>{"use strict";yh=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],uP=new Set(yh),dP=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],pP=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY"],mP=new Set(pP),fP=["_PUBLIC_KEY"],gP="KYNVER_WORKER_ENV_ALLOW"});import{existsSync as kP,statSync as yP}from"node:fs";import{spawnSync as _h}from"node:child_process";function ie(e,r,t={}){let n=_h("git",r,fe({cwd:e,encoding:"utf8"}));if(n.status!==0&&!t.allowFailure){let o=RP(e,r,n);if(t.throwError)throw new Error(o);Je(o)}return n.stdout||""}function RP(e,r,t){let n=typeof t.stderr=="string"&&t.stderr.trim()||typeof t.stdout=="string"&&t.stdout.trim()||t.error?.message||`exit ${t.status??"unknown"}`;return`git ${r.join(" ")} failed in ${e}: ${n}`}function vP(e){let r=e.trim();if(!r)return"git repo path is empty";let t=Ge(r);if(!kP(t))return t===r?`git repo path does not exist: ${t}`:`git repo path does not exist: ${t} (from ${r})`;try{if(!yP(t).isDirectory())return`git repo path is not a directory: ${t}`}catch(n){return`git repo path is not readable: ${t} (${n.message})`}return null}function Ch(e){let r=vP(e);r&&Je(r),ie(Ge(e.trim()),["rev-parse","--show-toplevel"])}function fs(e){return ie(e,["status","--short"],{allowFailure:!0}).split(`
-`).map(r=>r.trim()).filter(Boolean)}function ee(e,r){try{let t=_h("git",r,fe({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}function Sh(e,r,t){let n=ee(e,["merge-base","--is-ancestor",r,t]);return n.status===0?{isAncestor:!0,error:null}:n.status===1?{isAncestor:!1,error:null}:{isAncestor:null,error:n.error||n.stderr||n.stdout||`git exited ${n.status}`}}function xa(e,r="origin/main"){let t=typeof r=="string"?{base:r}:r,n=t.baseCommit?.trim()||t.base?.trim()||"origin/main",o=t.baseCommit?.trim()||null;if(!e)return sd(n,"missing worktree path");let s=ee(e,["rev-parse","HEAD"]);if(s.status!==0)return sd(n,s.error||s.stderr||s.stdout||"failed to resolve HEAD");let i;if(o)i=o;else{let p=ee(e,["rev-parse",n]);if(p.status!==0)return sd(n,p.error||p.stderr||p.stdout||`failed to resolve ${n}`,s.stdout.trim());i=p.stdout.trim()}let a=s.stdout.trim();if(a===i)return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:!0,headIsAncestorOfBase:!0,relation:"synced"};let l=Sh(e,i,a),c=Sh(e,a,i),u=l.error||c.error||void 0;if(l.isAncestor==null||c.isAncestor==null)return{checked:!1,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:"unknown",...u?{error:u}:{}};let d=l.isAncestor?"ahead":c.isAncestor?"merged":"diverged";return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:d,...u?{error:u}:{}}}function sd(e,r,t=null){return{checked:!1,base:e,head:t,baseHead:null,baseIsAncestorOfHead:null,headIsAncestorOfBase:null,relation:"unknown",error:r}}var Ee=D(()=>{"use strict";Ye();x();wa()});import{existsSync as ld,readFileSync as wh}from"node:fs";import{homedir as bP}from"node:os";import Hr from"node:path";import{fileURLToPath as SP}from"node:url";function CP(e){let r=Hr.join(e,"package.json");if(!ld(r))return null;try{let t=JSON.parse(wh(r,"utf8"));return typeof t.name=="string"?t.name.trim():null}catch{return null}}function xh(e){return CP(e)==="kynver"}function ad(e){let r=Hr.resolve(e);if(!ld(r))return null;let t=ee(r,["rev-parse","--show-toplevel"]);if(t.status!==0)return null;let n=t.stdout.trim();return n.length?Hr.resolve(n):null}function wP(e=import.meta.url){let r=Hr.dirname(SP(e));for(let t=0;t<8;t+=1){let n=Hr.join(r,"package.json");if(ld(n))try{if(JSON.parse(wh(n,"utf8")).name==="@kynver-app/runtime")return r}catch{}let o=Hr.dirname(r);if(o===r)break;r=o}return null}function id(e,r,t,n,o){if(!t)return;let s=Hr.resolve(t);e.has(s)||(o?.requireMonorepo??!0)&&!xh(s)||(e.add(s),r.push({repo:s,source:n}))}function cd(e){let r=e?.cwd??process.cwd(),t=new Set,n=[];id(t,n,ad(r),"cwd_git",{requireMonorepo:!1});let o=wP(e?.runtimeModuleUrl??import.meta.url);o&&id(t,n,ad(o),"runtime_checkout");let s=bP();for(let i of _P)id(t,n,Ge(Hr.join(s,i)),"well_known_path");return n}function Ft(e){return cd(e)[0]??null}function Eh(e){let r=Hr.resolve(e).replace(/\\/g,"/");return r.includes("/.kynver/harness/worktrees/")||r.includes("/.openclaw/harness/worktrees/")||r.includes("/kynver-harness/")||r.includes("/openclaw/harness/worktrees/")}function Ht(e){let r=cd(e);return r.find(n=>!Eh(n.repo))??r[0]??null}var _P,Vn=D(()=>{"use strict";Ee();Ye();_P=["Kynver","repos/Kynver","repos/kynver-source-main","code/Kynver","projects/Kynver"]});function ht(e){let r=(e??"").trim().toLowerCase();return r==="ghost"||r==="forge"||r==="box"?r:r.includes("forge")?"forge":r.includes("ghost")||r.includes("openclaw")?"ghost":"box"}function Ia(e,r){return e[r]?.trim()||null}function Ah(e){let r=e?.split(":")[0]?.trim();return r?ht(r):null}function _e(e=process.env,r={}){let t=[],n=Ah(r.boxId),o=Ah(Ia(e,"KYNVER_BOX_ID")),s=r.boxKind?.trim();if(s)return n&&n!==ht(s)&&t.push(`config.boxId=${r.boxId} conflicts with boxKind=${s}; using explicit boxKind=${s}`),{boxKind:ht(s),source:"config",slugInferenceBlocked:!1,warnings:t};let i=Ia(e,"KYNVER_BOX_KIND");if(i)return o&&o!==ht(i)&&t.push(`KYNVER_BOX_ID=${Ia(e,"KYNVER_BOX_ID")} conflicts with KYNVER_BOX_KIND=${i}; using explicit KYNVER_BOX_KIND=${i}`),{boxKind:ht(i),source:"env",slugInferenceBlocked:!1,warnings:t};if(n)return{boxKind:n,source:"config",slugInferenceBlocked:!1,warnings:t};if(o)return{boxKind:o,source:"env",slugInferenceBlocked:!1,warnings:t};let a=Ia(e,"KYNVER_AGENT_OS_SLUG");return a&&t.push(`KYNVER_AGENT_OS_SLUG=${a} is a workspace slug, not box identity \u2014 operators set boxKind via \`kynver setup --box-kind forge|ghost\` or KYNVER_BOX_KIND; customers default to box`),{boxKind:"box",source:"default",slugInferenceBlocked:!!a,warnings:t}}function qe(e={},r=process.env){return _e(r,e).boxKind}var Pe=D(()=>{"use strict"});function ks(e,r){return e==="forge"?4:Math.max(1,r)}function fr(e,r){return e==="forge"?Math.min(Math.max(1,r),4):Math.max(1,r)}function Yn(e,r){return e==="forge"&&r>4}var Jn=D(()=>{"use strict"});import{readFileSync as jP}from"node:fs";import Ih from"node:os";function qn(e){if(e!==void 0){let r=e.match(/^MemAvailable:\s+(\d+)\s*kB/m);return r?Number(r[1])*1024:Ih.freemem()}if(process.platform==="linux")try{let t=jP("/proc/meminfo","utf8").match(/^MemAvailable:\s+(\d+)\s*kB/m);if(t)return Number(t[1])*1024}catch{}return Ih.freemem()}var Ta=D(()=>{"use strict"});import{existsSync as VP,readFileSync as GP,statfsSync as YP}from"node:fs";function Na(){if(process.platform!=="linux")return!1;for(let e of["/proc/sys/kernel/osrelease","/proc/version"])try{if(!VP(e))continue;let r=GP(e,"utf8");if(/microsoft|wsl/i.test(r))return!0}catch{}return!1}function yd(e={}){if(!(e.forceWsl===void 0?Na():e.forceWsl))return null;let t=e.wslHostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||$t,n=e.wslHostFreeWarnBytes??Th,o=e.wslHostFreeCriticalBytes??Nh,s=e.statfs??YP,i;try{i=s(t)}catch(g){return{ok:!1,path:t,freeBytes:0,totalBytes:0,usedPercent:100,warnBelowBytes:n,criticalBelowBytes:o,reason:`Windows host disk probe failed at ${t}: ${g.message}`,probeError:g.message}}let a=Number(i.bavail)*Number(i.bsize),l=Number(i.blocks)*Number(i.bsize),c=l>0?(l-a)/l*100:100,u=a<n,d=a<o,p=!u&&!d,f=(a/(1024*1024*1024)).toFixed(1),m=null;return p||(m=`Windows host disk ${t} at ${d?"critical":"warning"}: ${f} GiB free (<${(d?o:n)/1024/1024/1024} GiB); WSL VHDX cannot grow safely. ${Dh()}`),{ok:p,path:t,freeBytes:a,totalBytes:l,usedPercent:c,warnBelowBytes:n,criticalBelowBytes:o,reason:m,probeError:null}}function Dh(){return"Recovery: 1) free Windows C: (empty Recycle Bin / Storage Sense / clear %TEMP% and %LOCALAPPDATA%\\Temp\\wsl-crashes); 2) shut down WSL (`wsl --shutdown`) then compact the VHDX (`Optimize-VHD` or `diskpart compact vdisk`); 3) clear local node_modules / .next / harness worktrees before restarting workers; 4) disable recurring dumps via `%USERPROFILE%/.wslconfig` (`maxCrashDumpCount=-1`) or `kynver wsl-crashes --execute`. Full runbook: docs/runbooks/wsl-disk-pressure.md."}var Th,Nh,$t,Da=D(()=>{"use strict";Th=25*1024*1024*1024,Nh=12*1024*1024*1024,$t="/mnt/c"});import{execFileSync as Mh}from"node:child_process";import{existsSync as Ua,readFileSync as Uh,readdirSync as JP,statSync as qP}from"node:fs";import Rd from"node:path";function Ma(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)?n:r}function vd(){let e=process.env.KYNVER_WSL_WIN_USER?.trim();if(e)return e;try{let n=Mh("cmd.exe",["/c","echo","%USERNAME%"],{encoding:"utf8",timeout:5e3,stdio:["ignore","pipe","ignore"]}).trim();if(n&&n!=="%USERNAME%"&&!n.includes("%"))return n}catch{}let r=process.env.USER?.trim()||process.env.LOGNAME?.trim(),t=process.env.KYNVER_WSL_HOST_MOUNT?.trim()||$t;return r&&Ua(Rd.join(t,"Users",r))?r:null}function Bh(e={}){let r=e.crashDumpDir?.trim()||process.env.KYNVER_WSL_CRASH_DUMP_DIR?.trim();if(r)return r;let t=e.hostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||$t,n=e.windowsUser??vd();return n?`${t.replace(/\\/g,"/").replace(/\/$/,"")}/Users/${n}/AppData/Local/Temp/wsl-crashes`:null}function Fh(e){let r=/^wsl-crash-\d+-(\d+)-(.+)-(\d+)\.dmp$/i.exec(e);if(!r)return{executableHint:null,signal:null,pid:null};let t=Number(r[1]),n=r[2]??"",o=Number(r[3]),s=n.split("_").filter(Boolean);return{executableHint:s.length>0?s[s.length-1]:null,signal:Number.isFinite(o)?o:null,pid:Number.isFinite(t)?t:null}}function Hh(){try{if(Ua("/proc/sys/kernel/core_pattern"))return Uh("/proc/sys/kernel/core_pattern","utf8").trim()}catch{}try{return Mh("sysctl",["-n","kernel.core_pattern"],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()||null}catch{return null}}function QP(e){return!!(e&&/wsl-capture-crash/i.test(e))}function Kh(e,r=$t){let t=Rd.join(r,"Users",e,".wslconfig");if(!Ua(t))return{maxCrashDumpCount:null,crashDumpFolder:null};let n;try{n=Uh(t,"utf8")}catch{return null}let o=null,s=null;for(let i of n.split(/\r?\n/)){let a=i.replace(/#.*$/,"").trim();if(!a||a.startsWith("["))continue;let l=a.indexOf("=");if(l<0)continue;let c=a.slice(0,l).trim().toLowerCase(),u=a.slice(l+1).trim();if(c==="maxcrashdumpcount"){let d=Number(u);o=Number.isFinite(d)?d:null}else c==="crashdumpfolder"&&(s=u.replace(/^["']|["']$/g,"")||null)}return{maxCrashDumpCount:o,crashDumpFolder:s}}function ZP(e){if(!Ua(e))return[];let r=JP(e,{withFileTypes:!0}),t=[];for(let n of r){if(!n.isFile()||!n.name.toLowerCase().endsWith(".dmp"))continue;let o=Rd.join(e,n.name);try{let s=qP(o),i=Fh(n.name);t.push({name:n.name,path:o,bytes:s.size,mtimeMs:s.mtimeMs,executableHint:i.executableHint,signal:i.signal,pid:i.pid})}catch{}}return t.sort((n,o)=>o.mtimeMs-n.mtimeMs),t}function Kr(e={}){if(!(e.forceWsl===void 0?Na():e.forceWsl))return null;let t=e.hostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||$t,n=e.windowsUser??vd(),o=e.warnBelowBytes??Ma("KYNVER_WSL_CRASH_DUMP_WARN_BYTES",Lh),s=e.criticalBelowBytes??Ma("KYNVER_WSL_CRASH_DUMP_CRITICAL_BYTES",Wh),i=e.warnCount??Ma("KYNVER_WSL_CRASH_DUMP_WARN_COUNT",zP),a=e.criticalCount??Ma("KYNVER_WSL_CRASH_DUMP_CRITICAL_COUNT",XP),l=(e.readCorePattern??Hh)(),c=QP(l),u=null;n&&(u=(e.readWslConfig??Kh)(n,t));let d=u?.maxCrashDumpCount??null,p=d===-1,f=Bh({hostMount:t,windowsUser:n,crashDumpDir:e.crashDumpDir});if(!f)return{ok:!0,path:null,windowsUser:n,dumpCount:0,totalBytes:0,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:[],executables:[],corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:null,probeError:"windows_user_unresolved"};let m;try{m=(e.listDumps??ZP)(f)}catch(j){return{ok:!1,path:f,windowsUser:n,dumpCount:0,totalBytes:0,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:[],executables:[],corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:`WSL crash dump probe failed at ${f}: ${j.message}`,probeError:j.message}}let g=m.reduce((j,N)=>j+N.bytes,0),y=m.length,R=[...new Set(m.map(j=>j.executableHint).filter(j=>!!j))],h=g>=s,k=g>=o,S=y>=a,O=y>=i,C=!(h||S||k||O),F=null;if(!C){let j=h||S?"critical":"warning",N=(g/1024**3).toFixed(1),ye=R.length>0?R.join(", "):"unknown";F=`WSL crash dumps ${j}: ${y} file(s), ${N} GiB at ${f} (executables: ${ye}). `+$h({wslCaptureEnabled:c,dumpsDisabledInWslConfig:p})}return{ok:C,path:f,windowsUser:n,dumpCount:y,totalBytes:g,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:m,executables:R,corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:F,probeError:null}}function $h(e={}){let r=["Recovery:","1) run `kynver wsl-crashes --execute` or scripts/cleanup-wsl-crashes.ps1 to prune old .dmp files;"];return e.dumpsDisabledInWslConfig||r.push("2) add `[wsl2]\\nmaxCrashDumpCount=-1` to %USERPROFILE%/.wslconfig then `wsl --shutdown` to disable future dumps;"),e.wslCaptureEnabled&&r.push("3) investigate crashing executables (node OOM/SIGBUS often follows Windows C: pressure \u2014 see docs/runbooks/wsl-disk-pressure.md);"),r.push("full runbook: docs/runbooks/wsl-disk-pressure.md."),r.join(" ")}var Lh,Wh,zP,XP,zn=D(()=>{"use strict";Da();Lh=5*1024*1024*1024,Wh=10*1024*1024*1024,zP=2,XP=4});import{statfsSync as eO}from"node:fs";function gr(e={}){let r=e.diskPath?.trim()||"/",t=e.diskFreeWarnBytes??rO,n=e.diskFreeCriticalBytes??tO,o=e.diskMaxUsedPercent??nO,s=e.diskHardMaxUsedPercent??oO,i=eO(r),a=Number(i.bavail)*Number(i.bsize),l=Number(i.blocks)*Number(i.bsize),c=l>0?(l-a)/l*100:100,u=a<t,d=a<n,p=a<t*2,f=p&&c>o,m=p&&c>s,g=!u&&!d&&!f&&!m,y=e.skipWslHostCheck?null:yd(e.wslHost),R=e.skipWslCrashDumpCheck?null:Kr(e.wslCrashDumps),h=g&&(y?y.ok:!0)&&(R?R.ok:!0),k=null;return h||(k=[d?`free space below critical ${n} bytes`:null,u?`free space below warning ${t} bytes`:null,m?`used percent above hard cap ${s}%`:null,f?`used percent above cap ${o}%`:null,y&&!y.ok?y.reason:null,R&&!R.ok?R.reason:null].filter(Boolean).join("; ")),sO({ok:h,path:r,freeBytes:a,totalBytes:l,usedPercent:c,warnBelowBytes:t,criticalBelowBytes:n,maxUsedPercent:o,hardMaxUsedPercent:s,reason:k,wslHost:y,wslCrashDumps:R?{ok:R.ok,path:R.path,dumpCount:R.dumpCount,totalBytes:R.totalBytes,executables:R.executables,wslCaptureEnabled:R.wslCaptureEnabled,dumpsDisabledInWslConfig:R.dumpsDisabledInWslConfig,reason:R.reason,probeError:R.probeError}:null})}function sO(e){let r=process.env.KYNVER_DISPATCH_DISK_GATE_FORCE?.trim().toLowerCase();return r?r==="ok"||r==="open"||r==="none"?e.ok?e:{...e,ok:!0,reason:`disk gate forced open by KYNVER_DISPATCH_DISK_GATE_FORCE (suppressed: ${e.reason??"no reason"})`}:r==="block"||r==="pressured"?{...e,ok:!1,reason:`disk gate forced closed by KYNVER_DISPATCH_DISK_GATE_FORCE${e.reason?` (underlying: ${e.reason})`:""}`}:e:e}var rO,tO,nO,oO,Xn=D(()=>{"use strict";zn();Da();rO=30*1024*1024*1024,tO=15*1024*1024*1024,nO=80,oO=90});import{existsSync as $r,mkdirSync as iO,readdirSync as La,renameSync as jh,statSync as aO}from"node:fs";import jr from"node:path";function Gh(e){try{return aO(e).isDirectory()}catch{return!1}}function lO(e){if(!$r(e))return!0;for(let r of Vh){let t=jr.join(e,r);if($r(t)&&(!Gh(t)||La(t).length>0))return!1}return!0}function cO(e){let r=jr.join(e,"runs");if(!$r(r)||!Gh(r))return!1;for(let t of La(r,{withFileTypes:!0})){if(!t.isDirectory()||t.name==="runs")continue;let n=jr.join(r,t.name,"run.json");if(P(n,void 0)?.id)return!0}return!1}function uO(e){let r=jr.join(e,"runs");if(!$r(r))return!1;for(let t of La(r,{withFileTypes:!0})){if(!t.isDirectory())continue;if(P(jr.join(r,t.name,"run.json"),void 0)?.boxKind==="ghost")return!0}return!1}function dO(e){let r=jr.join(e,"ghost");return $r(r)?!$r(jr.join(r,"runs")):uO(e)}function Yh(e){return cO(e.sharedRoot)?lO(e.forgeRoot)?dO(e.sharedRoot)?{action:"blocked",blocker:"Forge legacy harness migration blocked: Ghost pool is co-hosted on this host (ghost namespace or ghost-attributed runs under ~/.kynver/harness). Drain in-flight Ghost runs from the shared root, or get operator sign-off for a fresh Forge cutover before enabling box-scoped isolation."}:{action:"migrate"}:{action:"none"}:{action:"none"}}function Jh(e,r){iO(r,{recursive:!0});for(let t of Vh){let n=jr.join(e,t),o=jr.join(r,t);if($r(n)){if($r(o)&&La(o).length>0)throw new Error(`Forge legacy harness migration failed: ${o} is not empty`);if($r(o)){jh(n,o);continue}jh(n,o)}}}var Vh,qh=D(()=>{"use strict";x();Vh=["runs","worktrees"]});import{existsSync as Me}from"node:fs";import{homedir as pO}from"node:os";import Oe from"node:path";function bd(e=process.env){return e.HOME?.trim()||pO()}function Sd(e=process.env){return Oe.join(bd(e),".kynver","harness")}function Wa(e){let r=Oe.resolve(Ge(e.trim()));for(;mO.has(Oe.basename(r));)r=Oe.dirname(r);return r}function fO(e,r=process.env){return Oe.join(Sd(r),e)}function gO(e=process.env){let r=Sd(e);if(Me(Oe.join(r,"runs")))return!0;if(Me(r)&&!Me(Oe.join(r,"ghost"))&&!Me(Oe.join(r,"forge")))return Me(r);let t=Oe.join(bd(e),zh);return Me(t)}function Ba(e){let r=e.env??process.env,t=r.KYNVER_HARNESS_ROOT?.trim()||r.OPUS_HARNESS_ROOT?.trim();if(t)return{harnessRoot:Wa(t),source:"env"};let n=e.configuredHarnessRoot?.trim();if(n)return{harnessRoot:Wa(n),source:"config"};let o=fO(e.boxKind,r);if(Me(Oe.join(o,"runs"))||Me(o)&&!hO(o))return{harnessRoot:o,source:"box_scoped"};let i=Sd(r);if(e.boxKind==="forge"){let a=Yh({sharedRoot:i,forgeRoot:o});if(a.action==="blocked")return{harnessRoot:o,source:"box_scoped",migrationBlocker:a.blocker};if(a.action==="migrate")return e.allowForgeLegacyMigration!==!1&&Jh(i,o),{harnessRoot:o,source:"legacy_migrated"}}if(e.boxKind==="ghost"&&gO(r)){if(Me(Oe.join(i,"runs")))return{harnessRoot:i,source:"legacy_shared"};if(Me(i)&&!Me(Oe.join(i,"ghost"))&&!Me(Oe.join(i,"forge")))return{harnessRoot:i,source:"legacy_shared"};let l=Oe.join(bd(r),zh);if(Me(l))return{harnessRoot:l,source:"legacy_shared"}}return{harnessRoot:o,source:"box_scoped"}}function hO(e){if(!Me(e))return!0;for(let r of["runs","worktrees"]){let t=Oe.join(e,r);if(Me(t))return!1}return!0}var zh,mO,_d=D(()=>{"use strict";Ye();qh();zh=Oe.join(".openclaw","harness");mO=new Set(["runs","worktrees"])});import Xh from"node:os";function Fa(e){return e?.trim()?e.trim():null}function kO(e,r){let t=r.trim().toLowerCase()||"host";return`${e}-${t}`.replace(/[^a-z0-9._-]+/g,"-")}function yO(e){return e.KYNVER_DISPATCH_STRICT_IDENTITY==="1"||e.KYNVER_DISPATCH_STRICT_IDENTITY==="true"||e.KYNVER_DAEMON_STRICT_IDENTITY==="1"||e.KYNVER_DAEMON_STRICT_IDENTITY==="true"}function tr(e=v(),r=process.env,t={}){let n=_e(r,e),o=[...n.warnings],s=[],i=!!(e.boxKind?.trim()||Fa(r.KYNVER_BOX_KIND)),a=t.strict===!0||yO(r);if((t.requireExplicitBoxKind||a)&&!i&&s.push("boxKind is not persisted in ~/.kynver/config.json and KYNVER_BOX_KIND is unset \u2014 run `kynver setup` (customers: boxKind=box) or `kynver setup --box-kind forge|ghost` for operator pools before dispatch"),n.slugInferenceBlocked&&!i){let g="ambiguous box identity: KYNVER_AGENT_OS_SLUG is set without KYNVER_BOX_KIND or config.boxKind";a||t.requireExplicitBoxKind?s.push(g):o.push(`${g} \u2014 defaulting box kind to box (customer), not forge/ghost`)}let l=Fa(e.runnerId),c=Fa(r.KYNVER_RUNTIME_ID)??Fa(r.OPENCLAW_RUNTIME_ID),u=l??c??kO(n.boxKind,Xh.hostname()),d=l?"config":c?"env":"derived";d==="derived"&&o.push(`runnerId not persisted \u2014 using derived id "${u}"; run \`kynver setup --box-kind ${n.boxKind}\` to persist runner identity`);let p=Qn({config:e,env:r,totalMemBytes:Xh.totalmem()}),f=fr(n.boxKind,p.configuredMaxWorkers??ks(n.boxKind,p.autoCap)),m=Ba({boxKind:n.boxKind,configuredHarnessRoot:e.harnessRoot,env:r});return m.migrationBlocker&&s.push(m.migrationBlocker),s.length>0?{ok:!1,identity:null,errors:s,warnings:o}:{ok:!0,identity:{boxKind:n.boxKind,boxKindSource:n.source,runnerId:u,runnerIdSource:d,maxConcurrentWorkers:f,workerCapSource:p.workerCapSource,harnessRoot:m.harnessRoot,harnessRootSource:m.source},errors:s,warnings:o}}var jt=D(()=>{"use strict";A();Pe();Jn();ys();_d()});import Cd from"node:path";function Re(e){return Wa(e)}function ge(){let e=process.env.KYNVER_HARNESS_ROOT||process.env.OPUS_HARNESS_ROOT;if(e)return Re(e);let r=v(),t=r.harnessRoot?.trim();if(t)return Re(t);let n=tr(r,process.env);return n.identity?n.identity.harnessRoot:Ba({boxKind:"forge",configuredHarnessRoot:null}).harnessRoot}function Ue(e){return Cd.join(Re(e),"runs")}function Vr(e){return Cd.join(Re(e),"worktrees")}function Vt(){let e=ge();return{harnessRoot:e,runsDir:Ue(e),worktreesDir:Vr(e)}}function Gr(e,r){return Cd.join(e,w(r))}var Ce=D(()=>{"use strict";A();_d();jt();x()});import{existsSync as Ha,readdirSync as RO,statSync as vO}from"node:fs";import Gt from"node:path";function re(){return Vt()}function $(e){let{runsDir:r}=re(),t=Gt.join(Gr(r,w(e)),"run.json");return Ha(t)||Je(`run '${e}' not found`),P(t)}function ne(){let{runsDir:e}=re();return Qh(e)}function Ka(e){return Qh(Ue(e))}function bO(e){try{return vO(e).isDirectory()}catch{return!1}}function Qh(e){if(!Ha(e))return[];let r=[];for(let t of RO(e,{withFileTypes:!0})){if(t.name==="runs")continue;let n=Gt.join(e,t.name);if(!bO(n))continue;let o=P(Gt.join(n,"run.json"),void 0);o?.id&&r.push(o)}return r}function Ae(e,r){let{runsDir:t}=re(),n=Gt.join(Gr(t,w(e)),"run.json"),o=Gt.join(Gr(t,w(e)),"workers",w(r),"worker.json");return Ha(o)||(Ha(n)||Je(`run '${e}' not found`),Je(`worker '${r}' not found in run '${e}'`)),P(o)}function Ke(e){let{runsDir:r}=re();ue(Gt.join(Gr(r,e.id),"run.json"),e)}function Y(e,r){let{runsDir:t}=re();ue(Gt.join(Gr(t,e),"workers",r.name,"worker.json"),r)}function T(e){let{harnessRoot:r}=re();return Rs(r,e)}function Rs(e,r){return Gr(Ue(e),w(r))}var M=D(()=>{"use strict";Ce();x()});import{existsSync as SO,readdirSync as _O}from"node:fs";import CO from"node:path";function Ie(e){let r=new Set;for(let n of Object.keys(e.workers||{}))r.add(w(n));let t=CO.join(T(e.id),"workers");if(!SO(t))return[...r];for(let n of _O(t,{withFileTypes:!0}))n.isDirectory()&&r.add(w(n.name));return[...r]}var Yt=D(()=>{"use strict";M();x()});function wd(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let t=JSON.parse(r);if(t&&typeof t=="object"&&!Array.isArray(t))return t}catch{return null}return null}function Zh(e){let r=e.trim();if(!r)return null;let t=wd(r);if(t)return t;let n=[],o=/```(?:json)?\s*([\s\S]*?)```/gi,s;for(;(s=o.exec(r))!==null;){let l=wd(s[1]??"");l&&n.push(l)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let l=wd(r.slice(i,a+1));l&&n.push(l)}return n.length>0?n[n.length-1]:null}function ek(e){let r=e.finalResult??e.final_result;if(r!=null)return typeof r=="string"?Zh(r)??(r.trim()||null):r;let t=typeof e.summary=="string"?e.summary.trim():"";if(!t)return null;let n=Zh(t);return n||t}var rk=D(()=>{"use strict"});import{existsSync as wO,readFileSync as xO}from"node:fs";function xd(e){return e==="complete"}function wr(e){return xd(e.lastHeartbeatPhase)?e.terminalFinalResult!==void 0&&e.terminalFinalResult!==null?e.terminalFinalResult:e.lastHeartbeatSummary?.trim()||"completed":null}function ve(e){let r={heartbeatCount:0,lastHeartbeatAt:null,lastHeartbeatPhase:null,lastHeartbeatSummary:null,terminalFinalResult:null,heartbeatBlocker:null,timestampAnomalies:[],lastBoxResourceSnapshot:null,lastPrEvidence:[]};if(!wO(e))return r;let t=Date.now()+EO,n=new Date(t).toISOString(),o=xO(e,"utf8").split(`
+`).map(r=>r.trim()).filter(Boolean)}function ee(e,r){try{let t=_h("git",r,fe({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}function Sh(e,r,t){let n=ee(e,["merge-base","--is-ancestor",r,t]);return n.status===0?{isAncestor:!0,error:null}:n.status===1?{isAncestor:!1,error:null}:{isAncestor:null,error:n.error||n.stderr||n.stdout||`git exited ${n.status}`}}function xa(e,r="origin/main"){let t=typeof r=="string"?{base:r}:r,n=t.baseCommit?.trim()||t.base?.trim()||"origin/main",o=t.baseCommit?.trim()||null;if(!e)return sd(n,"missing worktree path");let s=ee(e,["rev-parse","HEAD"]);if(s.status!==0)return sd(n,s.error||s.stderr||s.stdout||"failed to resolve HEAD");let i;if(o)i=o;else{let p=ee(e,["rev-parse",n]);if(p.status!==0)return sd(n,p.error||p.stderr||p.stdout||`failed to resolve ${n}`,s.stdout.trim());i=p.stdout.trim()}let a=s.stdout.trim();if(a===i)return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:!0,headIsAncestorOfBase:!0,relation:"synced"};let l=Sh(e,i,a),c=Sh(e,a,i),u=l.error||c.error||void 0;if(l.isAncestor==null||c.isAncestor==null)return{checked:!1,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:"unknown",...u?{error:u}:{}};let d=l.isAncestor?"ahead":c.isAncestor?"merged":"diverged";return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:d,...u?{error:u}:{}}}function sd(e,r,t=null){return{checked:!1,base:e,head:t,baseHead:null,baseIsAncestorOfHead:null,headIsAncestorOfBase:null,relation:"unknown",error:r}}var Ee=D(()=>{"use strict";Ye();x();wa()});import{existsSync as ld,readFileSync as wh}from"node:fs";import{homedir as bP}from"node:os";import Hr from"node:path";import{fileURLToPath as SP}from"node:url";function CP(e){let r=Hr.join(e,"package.json");if(!ld(r))return null;try{let t=JSON.parse(wh(r,"utf8"));return typeof t.name=="string"?t.name.trim():null}catch{return null}}function xh(e){return CP(e)==="kynver"}function ad(e){let r=Hr.resolve(e);if(!ld(r))return null;let t=ee(r,["rev-parse","--show-toplevel"]);if(t.status!==0)return null;let n=t.stdout.trim();return n.length?Hr.resolve(n):null}function wP(e=import.meta.url){let r=Hr.dirname(SP(e));for(let t=0;t<8;t+=1){let n=Hr.join(r,"package.json");if(ld(n))try{if(JSON.parse(wh(n,"utf8")).name==="@kynver-app/runtime")return r}catch{}let o=Hr.dirname(r);if(o===r)break;r=o}return null}function id(e,r,t,n,o){if(!t)return;let s=Hr.resolve(t);e.has(s)||(o?.requireMonorepo??!0)&&!xh(s)||(e.add(s),r.push({repo:s,source:n}))}function cd(e){let r=e?.cwd??process.cwd(),t=new Set,n=[];id(t,n,ad(r),"cwd_git",{requireMonorepo:!1});let o=wP(e?.runtimeModuleUrl??import.meta.url);o&&id(t,n,ad(o),"runtime_checkout");let s=bP();for(let i of _P)id(t,n,Ge(Hr.join(s,i)),"well_known_path");return n}function Ft(e){return cd(e)[0]??null}function Eh(e){let r=Hr.resolve(e).replace(/\\/g,"/");return r.includes("/.kynver/harness/worktrees/")||r.includes("/.openclaw/harness/worktrees/")||r.includes("/kynver-harness/")||r.includes("/openclaw/harness/worktrees/")}function Ht(e){let r=cd(e);return r.find(n=>!Eh(n.repo))??r[0]??null}var _P,Vn=D(()=>{"use strict";Ee();Ye();_P=["Kynver","repos/Kynver","repos/kynver-source-main","code/Kynver","projects/Kynver"]});function ht(e){let r=(e??"").trim().toLowerCase();return r==="ghost"||r==="forge"||r==="box"?r:r.includes("forge")?"forge":r.includes("ghost")||r.includes("openclaw")?"ghost":"box"}function Ia(e,r){return e[r]?.trim()||null}function Ah(e){let r=e?.split(":")[0]?.trim();return r?ht(r):null}function _e(e=process.env,r={}){let t=[],n=Ah(r.boxId),o=Ah(Ia(e,"KYNVER_BOX_ID")),s=r.boxKind?.trim();if(s)return n&&n!==ht(s)&&t.push(`config.boxId=${r.boxId} conflicts with boxKind=${s}; using explicit boxKind=${s}`),{boxKind:ht(s),source:"config",slugInferenceBlocked:!1,warnings:t};let i=Ia(e,"KYNVER_BOX_KIND");if(i)return o&&o!==ht(i)&&t.push(`KYNVER_BOX_ID=${Ia(e,"KYNVER_BOX_ID")} conflicts with KYNVER_BOX_KIND=${i}; using explicit KYNVER_BOX_KIND=${i}`),{boxKind:ht(i),source:"env",slugInferenceBlocked:!1,warnings:t};if(n)return{boxKind:n,source:"config",slugInferenceBlocked:!1,warnings:t};if(o)return{boxKind:o,source:"env",slugInferenceBlocked:!1,warnings:t};let a=Ia(e,"KYNVER_AGENT_OS_SLUG");return a&&t.push(`KYNVER_AGENT_OS_SLUG=${a} is a workspace slug, not box identity \u2014 operators set boxKind via \`kynver setup --box-kind forge|ghost\` or KYNVER_BOX_KIND; customers default to box`),{boxKind:"box",source:"default",slugInferenceBlocked:!!a,warnings:t}}function qe(e={},r=process.env){return _e(r,e).boxKind}var Pe=D(()=>{"use strict"});function ks(e,r){return e==="forge"?4:Math.max(1,r)}function fr(e,r){return e==="forge"?Math.min(Math.max(1,r),4):Math.max(1,r)}function Yn(e,r){return e==="forge"&&r>4}var Jn=D(()=>{"use strict"});import{readFileSync as jP}from"node:fs";import Ih from"node:os";function qn(e){if(e!==void 0){let r=e.match(/^MemAvailable:\s+(\d+)\s*kB/m);return r?Number(r[1])*1024:Ih.freemem()}if(process.platform==="linux")try{let t=jP("/proc/meminfo","utf8").match(/^MemAvailable:\s+(\d+)\s*kB/m);if(t)return Number(t[1])*1024}catch{}return Ih.freemem()}var Ta=D(()=>{"use strict"});import{existsSync as VP,readFileSync as GP,statfsSync as YP}from"node:fs";function Na(){if(process.platform!=="linux")return!1;for(let e of["/proc/sys/kernel/osrelease","/proc/version"])try{if(!VP(e))continue;let r=GP(e,"utf8");if(/microsoft|wsl/i.test(r))return!0}catch{}return!1}function yd(e={}){if(!(e.forceWsl===void 0?Na():e.forceWsl))return null;let t=e.wslHostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||$t,n=e.wslHostFreeWarnBytes??Th,o=e.wslHostFreeCriticalBytes??Nh,s=e.statfs??YP,i;try{i=s(t)}catch(g){return{ok:!1,path:t,freeBytes:0,totalBytes:0,usedPercent:100,warnBelowBytes:n,criticalBelowBytes:o,reason:`Windows host disk probe failed at ${t}: ${g.message}`,probeError:g.message}}let a=Number(i.bavail)*Number(i.bsize),l=Number(i.blocks)*Number(i.bsize),c=l>0?(l-a)/l*100:100,u=a<n,d=a<o,p=!u&&!d,f=(a/(1024*1024*1024)).toFixed(1),m=null;return p||(m=`Windows host disk ${t} at ${d?"critical":"warning"}: ${f} GiB free (<${(d?o:n)/1024/1024/1024} GiB); WSL VHDX cannot grow safely. ${Dh()}`),{ok:p,path:t,freeBytes:a,totalBytes:l,usedPercent:c,warnBelowBytes:n,criticalBelowBytes:o,reason:m,probeError:null}}function Dh(){return"Recovery: 1) free Windows C: (empty Recycle Bin / Storage Sense / clear %TEMP% and %LOCALAPPDATA%\\Temp\\wsl-crashes); 2) shut down WSL (`wsl --shutdown`) then compact the VHDX (`Optimize-VHD` or `diskpart compact vdisk`); 3) clear local node_modules / .next / harness worktrees before restarting workers; 4) disable recurring dumps via `%USERPROFILE%/.wslconfig` (`maxCrashDumpCount=-1`) or `kynver wsl-crashes --execute`. More help: https://www.kynver.com/help."}var Th,Nh,$t,Da=D(()=>{"use strict";Th=25*1024*1024*1024,Nh=12*1024*1024*1024,$t="/mnt/c"});import{execFileSync as Mh}from"node:child_process";import{existsSync as Ua,readFileSync as Uh,readdirSync as JP,statSync as qP}from"node:fs";import Rd from"node:path";function Ma(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)?n:r}function vd(){let e=process.env.KYNVER_WSL_WIN_USER?.trim();if(e)return e;try{let n=Mh("cmd.exe",["/c","echo","%USERNAME%"],{encoding:"utf8",timeout:5e3,stdio:["ignore","pipe","ignore"]}).trim();if(n&&n!=="%USERNAME%"&&!n.includes("%"))return n}catch{}let r=process.env.USER?.trim()||process.env.LOGNAME?.trim(),t=process.env.KYNVER_WSL_HOST_MOUNT?.trim()||$t;return r&&Ua(Rd.join(t,"Users",r))?r:null}function Bh(e={}){let r=e.crashDumpDir?.trim()||process.env.KYNVER_WSL_CRASH_DUMP_DIR?.trim();if(r)return r;let t=e.hostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||$t,n=e.windowsUser??vd();return n?`${t.replace(/\\/g,"/").replace(/\/$/,"")}/Users/${n}/AppData/Local/Temp/wsl-crashes`:null}function Fh(e){let r=/^wsl-crash-\d+-(\d+)-(.+)-(\d+)\.dmp$/i.exec(e);if(!r)return{executableHint:null,signal:null,pid:null};let t=Number(r[1]),n=r[2]??"",o=Number(r[3]),s=n.split("_").filter(Boolean);return{executableHint:s.length>0?s[s.length-1]:null,signal:Number.isFinite(o)?o:null,pid:Number.isFinite(t)?t:null}}function Hh(){try{if(Ua("/proc/sys/kernel/core_pattern"))return Uh("/proc/sys/kernel/core_pattern","utf8").trim()}catch{}try{return Mh("sysctl",["-n","kernel.core_pattern"],{encoding:"utf8",timeout:2e3,stdio:["ignore","pipe","ignore"]}).trim()||null}catch{return null}}function QP(e){return!!(e&&/wsl-capture-crash/i.test(e))}function Kh(e,r=$t){let t=Rd.join(r,"Users",e,".wslconfig");if(!Ua(t))return{maxCrashDumpCount:null,crashDumpFolder:null};let n;try{n=Uh(t,"utf8")}catch{return null}let o=null,s=null;for(let i of n.split(/\r?\n/)){let a=i.replace(/#.*$/,"").trim();if(!a||a.startsWith("["))continue;let l=a.indexOf("=");if(l<0)continue;let c=a.slice(0,l).trim().toLowerCase(),u=a.slice(l+1).trim();if(c==="maxcrashdumpcount"){let d=Number(u);o=Number.isFinite(d)?d:null}else c==="crashdumpfolder"&&(s=u.replace(/^["']|["']$/g,"")||null)}return{maxCrashDumpCount:o,crashDumpFolder:s}}function ZP(e){if(!Ua(e))return[];let r=JP(e,{withFileTypes:!0}),t=[];for(let n of r){if(!n.isFile()||!n.name.toLowerCase().endsWith(".dmp"))continue;let o=Rd.join(e,n.name);try{let s=qP(o),i=Fh(n.name);t.push({name:n.name,path:o,bytes:s.size,mtimeMs:s.mtimeMs,executableHint:i.executableHint,signal:i.signal,pid:i.pid})}catch{}}return t.sort((n,o)=>o.mtimeMs-n.mtimeMs),t}function Kr(e={}){if(!(e.forceWsl===void 0?Na():e.forceWsl))return null;let t=e.hostMount?.trim()||process.env.KYNVER_WSL_HOST_MOUNT?.trim()||$t,n=e.windowsUser??vd(),o=e.warnBelowBytes??Ma("KYNVER_WSL_CRASH_DUMP_WARN_BYTES",Lh),s=e.criticalBelowBytes??Ma("KYNVER_WSL_CRASH_DUMP_CRITICAL_BYTES",Wh),i=e.warnCount??Ma("KYNVER_WSL_CRASH_DUMP_WARN_COUNT",zP),a=e.criticalCount??Ma("KYNVER_WSL_CRASH_DUMP_CRITICAL_COUNT",XP),l=(e.readCorePattern??Hh)(),c=QP(l),u=null;n&&(u=(e.readWslConfig??Kh)(n,t));let d=u?.maxCrashDumpCount??null,p=d===-1,f=Bh({hostMount:t,windowsUser:n,crashDumpDir:e.crashDumpDir});if(!f)return{ok:!0,path:null,windowsUser:n,dumpCount:0,totalBytes:0,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:[],executables:[],corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:null,probeError:"windows_user_unresolved"};let m;try{m=(e.listDumps??ZP)(f)}catch(j){return{ok:!1,path:f,windowsUser:n,dumpCount:0,totalBytes:0,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:[],executables:[],corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:`WSL crash dump probe failed at ${f}: ${j.message}`,probeError:j.message}}let g=m.reduce((j,N)=>j+N.bytes,0),y=m.length,R=[...new Set(m.map(j=>j.executableHint).filter(j=>!!j))],h=g>=s,k=g>=o,S=y>=a,O=y>=i,C=!(h||S||k||O),F=null;if(!C){let j=h||S?"critical":"warning",N=(g/1024**3).toFixed(1),ye=R.length>0?R.join(", "):"unknown";F=`WSL crash dumps ${j}: ${y} file(s), ${N} GiB at ${f} (executables: ${ye}). `+$h({wslCaptureEnabled:c,dumpsDisabledInWslConfig:p})}return{ok:C,path:f,windowsUser:n,dumpCount:y,totalBytes:g,warnBelowBytes:o,criticalBelowBytes:s,warnCount:i,criticalCount:a,dumps:m,executables:R,corePattern:l,wslCaptureEnabled:c,maxCrashDumpCount:d,dumpsDisabledInWslConfig:p,reason:F,probeError:null}}function $h(e={}){let r=["Recovery:","1) run `kynver wsl-crashes --execute` or scripts/cleanup-wsl-crashes.ps1 to prune old .dmp files;"];return e.dumpsDisabledInWslConfig||r.push("2) add `[wsl2]\\nmaxCrashDumpCount=-1` to %USERPROFILE%/.wslconfig then `wsl --shutdown` to disable future dumps;"),e.wslCaptureEnabled&&r.push("3) investigate crashing executables (node OOM/SIGBUS often follows Windows C: pressure);"),r.push("More help: https://www.kynver.com/help."),r.join(" ")}var Lh,Wh,zP,XP,zn=D(()=>{"use strict";Da();Lh=5*1024*1024*1024,Wh=10*1024*1024*1024,zP=2,XP=4});import{statfsSync as eO}from"node:fs";function gr(e={}){let r=e.diskPath?.trim()||"/",t=e.diskFreeWarnBytes??rO,n=e.diskFreeCriticalBytes??tO,o=e.diskMaxUsedPercent??nO,s=e.diskHardMaxUsedPercent??oO,i=eO(r),a=Number(i.bavail)*Number(i.bsize),l=Number(i.blocks)*Number(i.bsize),c=l>0?(l-a)/l*100:100,u=a<t,d=a<n,p=a<t*2,f=p&&c>o,m=p&&c>s,g=!u&&!d&&!f&&!m,y=e.skipWslHostCheck?null:yd(e.wslHost),R=e.skipWslCrashDumpCheck?null:Kr(e.wslCrashDumps),h=g&&(y?y.ok:!0)&&(R?R.ok:!0),k=null;return h||(k=[d?`free space below critical ${n} bytes`:null,u?`free space below warning ${t} bytes`:null,m?`used percent above hard cap ${s}%`:null,f?`used percent above cap ${o}%`:null,y&&!y.ok?y.reason:null,R&&!R.ok?R.reason:null].filter(Boolean).join("; ")),sO({ok:h,path:r,freeBytes:a,totalBytes:l,usedPercent:c,warnBelowBytes:t,criticalBelowBytes:n,maxUsedPercent:o,hardMaxUsedPercent:s,reason:k,wslHost:y,wslCrashDumps:R?{ok:R.ok,path:R.path,dumpCount:R.dumpCount,totalBytes:R.totalBytes,executables:R.executables,wslCaptureEnabled:R.wslCaptureEnabled,dumpsDisabledInWslConfig:R.dumpsDisabledInWslConfig,reason:R.reason,probeError:R.probeError}:null})}function sO(e){let r=process.env.KYNVER_DISPATCH_DISK_GATE_FORCE?.trim().toLowerCase();return r?r==="ok"||r==="open"||r==="none"?e.ok?e:{...e,ok:!0,reason:`disk gate forced open by KYNVER_DISPATCH_DISK_GATE_FORCE (suppressed: ${e.reason??"no reason"})`}:r==="block"||r==="pressured"?{...e,ok:!1,reason:`disk gate forced closed by KYNVER_DISPATCH_DISK_GATE_FORCE${e.reason?` (underlying: ${e.reason})`:""}`}:e:e}var rO,tO,nO,oO,Xn=D(()=>{"use strict";zn();Da();rO=30*1024*1024*1024,tO=15*1024*1024*1024,nO=80,oO=90});import{existsSync as $r,mkdirSync as iO,readdirSync as La,renameSync as jh,statSync as aO}from"node:fs";import jr from"node:path";function Gh(e){try{return aO(e).isDirectory()}catch{return!1}}function lO(e){if(!$r(e))return!0;for(let r of Vh){let t=jr.join(e,r);if($r(t)&&(!Gh(t)||La(t).length>0))return!1}return!0}function cO(e){let r=jr.join(e,"runs");if(!$r(r)||!Gh(r))return!1;for(let t of La(r,{withFileTypes:!0})){if(!t.isDirectory()||t.name==="runs")continue;let n=jr.join(r,t.name,"run.json");if(P(n,void 0)?.id)return!0}return!1}function uO(e){let r=jr.join(e,"runs");if(!$r(r))return!1;for(let t of La(r,{withFileTypes:!0})){if(!t.isDirectory())continue;if(P(jr.join(r,t.name,"run.json"),void 0)?.boxKind==="ghost")return!0}return!1}function dO(e){let r=jr.join(e,"ghost");return $r(r)?!$r(jr.join(r,"runs")):uO(e)}function Yh(e){return cO(e.sharedRoot)?lO(e.forgeRoot)?dO(e.sharedRoot)?{action:"blocked",blocker:"Forge legacy harness migration blocked: Ghost pool is co-hosted on this host (ghost namespace or ghost-attributed runs under ~/.kynver/harness). Drain in-flight Ghost runs from the shared root, or get operator sign-off for a fresh Forge cutover before enabling box-scoped isolation."}:{action:"migrate"}:{action:"none"}:{action:"none"}}function Jh(e,r){iO(r,{recursive:!0});for(let t of Vh){let n=jr.join(e,t),o=jr.join(r,t);if($r(n)){if($r(o)&&La(o).length>0)throw new Error(`Forge legacy harness migration failed: ${o} is not empty`);if($r(o)){jh(n,o);continue}jh(n,o)}}}var Vh,qh=D(()=>{"use strict";x();Vh=["runs","worktrees"]});import{existsSync as Me}from"node:fs";import{homedir as pO}from"node:os";import Oe from"node:path";function bd(e=process.env){return e.HOME?.trim()||pO()}function Sd(e=process.env){return Oe.join(bd(e),".kynver","harness")}function Wa(e){let r=Oe.resolve(Ge(e.trim()));for(;mO.has(Oe.basename(r));)r=Oe.dirname(r);return r}function fO(e,r=process.env){return Oe.join(Sd(r),e)}function gO(e=process.env){let r=Sd(e);if(Me(Oe.join(r,"runs")))return!0;if(Me(r)&&!Me(Oe.join(r,"ghost"))&&!Me(Oe.join(r,"forge")))return Me(r);let t=Oe.join(bd(e),zh);return Me(t)}function Ba(e){let r=e.env??process.env,t=r.KYNVER_HARNESS_ROOT?.trim()||r.OPUS_HARNESS_ROOT?.trim();if(t)return{harnessRoot:Wa(t),source:"env"};let n=e.configuredHarnessRoot?.trim();if(n)return{harnessRoot:Wa(n),source:"config"};let o=fO(e.boxKind,r);if(Me(Oe.join(o,"runs"))||Me(o)&&!hO(o))return{harnessRoot:o,source:"box_scoped"};let i=Sd(r);if(e.boxKind==="forge"){let a=Yh({sharedRoot:i,forgeRoot:o});if(a.action==="blocked")return{harnessRoot:o,source:"box_scoped",migrationBlocker:a.blocker};if(a.action==="migrate")return e.allowForgeLegacyMigration!==!1&&Jh(i,o),{harnessRoot:o,source:"legacy_migrated"}}if(e.boxKind==="ghost"&&gO(r)){if(Me(Oe.join(i,"runs")))return{harnessRoot:i,source:"legacy_shared"};if(Me(i)&&!Me(Oe.join(i,"ghost"))&&!Me(Oe.join(i,"forge")))return{harnessRoot:i,source:"legacy_shared"};let l=Oe.join(bd(r),zh);if(Me(l))return{harnessRoot:l,source:"legacy_shared"}}return{harnessRoot:o,source:"box_scoped"}}function hO(e){if(!Me(e))return!0;for(let r of["runs","worktrees"]){let t=Oe.join(e,r);if(Me(t))return!1}return!0}var zh,mO,_d=D(()=>{"use strict";Ye();qh();zh=Oe.join(".openclaw","harness");mO=new Set(["runs","worktrees"])});import Xh from"node:os";function Fa(e){return e?.trim()?e.trim():null}function kO(e,r){let t=r.trim().toLowerCase()||"host";return`${e}-${t}`.replace(/[^a-z0-9._-]+/g,"-")}function yO(e){return e.KYNVER_DISPATCH_STRICT_IDENTITY==="1"||e.KYNVER_DISPATCH_STRICT_IDENTITY==="true"||e.KYNVER_DAEMON_STRICT_IDENTITY==="1"||e.KYNVER_DAEMON_STRICT_IDENTITY==="true"}function tr(e=v(),r=process.env,t={}){let n=_e(r,e),o=[...n.warnings],s=[],i=!!(e.boxKind?.trim()||Fa(r.KYNVER_BOX_KIND)),a=t.strict===!0||yO(r);if((t.requireExplicitBoxKind||a)&&!i&&s.push("boxKind is not persisted in ~/.kynver/config.json and KYNVER_BOX_KIND is unset \u2014 run `kynver setup` (customers: boxKind=box) or `kynver setup --box-kind forge|ghost` for operator pools before dispatch"),n.slugInferenceBlocked&&!i){let g="ambiguous box identity: KYNVER_AGENT_OS_SLUG is set without KYNVER_BOX_KIND or config.boxKind";a||t.requireExplicitBoxKind?s.push(g):o.push(`${g} \u2014 defaulting box kind to box (customer), not forge/ghost`)}let l=Fa(e.runnerId),c=Fa(r.KYNVER_RUNTIME_ID)??Fa(r.OPENCLAW_RUNTIME_ID),u=l??c??kO(n.boxKind,Xh.hostname()),d=l?"config":c?"env":"derived";d==="derived"&&o.push(`runnerId not persisted \u2014 using derived id "${u}"; run \`kynver setup --box-kind ${n.boxKind}\` to persist runner identity`);let p=Qn({config:e,env:r,totalMemBytes:Xh.totalmem()}),f=fr(n.boxKind,p.configuredMaxWorkers??ks(n.boxKind,p.autoCap)),m=Ba({boxKind:n.boxKind,configuredHarnessRoot:e.harnessRoot,env:r});return m.migrationBlocker&&s.push(m.migrationBlocker),s.length>0?{ok:!1,identity:null,errors:s,warnings:o}:{ok:!0,identity:{boxKind:n.boxKind,boxKindSource:n.source,runnerId:u,runnerIdSource:d,maxConcurrentWorkers:f,workerCapSource:p.workerCapSource,harnessRoot:m.harnessRoot,harnessRootSource:m.source},errors:s,warnings:o}}var jt=D(()=>{"use strict";A();Pe();Jn();ys();_d()});import Cd from"node:path";function Re(e){return Wa(e)}function ge(){let e=process.env.KYNVER_HARNESS_ROOT||process.env.OPUS_HARNESS_ROOT;if(e)return Re(e);let r=v(),t=r.harnessRoot?.trim();if(t)return Re(t);let n=tr(r,process.env);return n.identity?n.identity.harnessRoot:Ba({boxKind:"forge",configuredHarnessRoot:null}).harnessRoot}function Ue(e){return Cd.join(Re(e),"runs")}function Vr(e){return Cd.join(Re(e),"worktrees")}function Vt(){let e=ge();return{harnessRoot:e,runsDir:Ue(e),worktreesDir:Vr(e)}}function Gr(e,r){return Cd.join(e,w(r))}var Ce=D(()=>{"use strict";A();_d();jt();x()});import{existsSync as Ha,readdirSync as RO,statSync as vO}from"node:fs";import Gt from"node:path";function re(){return Vt()}function $(e){let{runsDir:r}=re(),t=Gt.join(Gr(r,w(e)),"run.json");return Ha(t)||Je(`run '${e}' not found`),P(t)}function ne(){let{runsDir:e}=re();return Qh(e)}function Ka(e){return Qh(Ue(e))}function bO(e){try{return vO(e).isDirectory()}catch{return!1}}function Qh(e){if(!Ha(e))return[];let r=[];for(let t of RO(e,{withFileTypes:!0})){if(t.name==="runs")continue;let n=Gt.join(e,t.name);if(!bO(n))continue;let o=P(Gt.join(n,"run.json"),void 0);o?.id&&r.push(o)}return r}function Ae(e,r){let{runsDir:t}=re(),n=Gt.join(Gr(t,w(e)),"run.json"),o=Gt.join(Gr(t,w(e)),"workers",w(r),"worker.json");return Ha(o)||(Ha(n)||Je(`run '${e}' not found`),Je(`worker '${r}' not found in run '${e}'`)),P(o)}function Ke(e){let{runsDir:r}=re();ue(Gt.join(Gr(r,e.id),"run.json"),e)}function Y(e,r){let{runsDir:t}=re();ue(Gt.join(Gr(t,e),"workers",r.name,"worker.json"),r)}function T(e){let{harnessRoot:r}=re();return Rs(r,e)}function Rs(e,r){return Gr(Ue(e),w(r))}var M=D(()=>{"use strict";Ce();x()});import{existsSync as SO,readdirSync as _O}from"node:fs";import CO from"node:path";function Ie(e){let r=new Set;for(let n of Object.keys(e.workers||{}))r.add(w(n));let t=CO.join(T(e.id),"workers");if(!SO(t))return[...r];for(let n of _O(t,{withFileTypes:!0}))n.isDirectory()&&r.add(w(n.name));return[...r]}var Yt=D(()=>{"use strict";M();x()});function wd(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let t=JSON.parse(r);if(t&&typeof t=="object"&&!Array.isArray(t))return t}catch{return null}return null}function Zh(e){let r=e.trim();if(!r)return null;let t=wd(r);if(t)return t;let n=[],o=/```(?:json)?\s*([\s\S]*?)```/gi,s;for(;(s=o.exec(r))!==null;){let l=wd(s[1]??"");l&&n.push(l)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let l=wd(r.slice(i,a+1));l&&n.push(l)}return n.length>0?n[n.length-1]:null}function ek(e){let r=e.finalResult??e.final_result;if(r!=null)return typeof r=="string"?Zh(r)??(r.trim()||null):r;let t=typeof e.summary=="string"?e.summary.trim():"";if(!t)return null;let n=Zh(t);return n||t}var rk=D(()=>{"use strict"});import{existsSync as wO,readFileSync as xO}from"node:fs";function xd(e){return e==="complete"}function wr(e){return xd(e.lastHeartbeatPhase)?e.terminalFinalResult!==void 0&&e.terminalFinalResult!==null?e.terminalFinalResult:e.lastHeartbeatSummary?.trim()||"completed":null}function ve(e){let r={heartbeatCount:0,lastHeartbeatAt:null,lastHeartbeatPhase:null,lastHeartbeatSummary:null,terminalFinalResult:null,heartbeatBlocker:null,timestampAnomalies:[],lastBoxResourceSnapshot:null,lastPrEvidence:[]};if(!wO(e))return r;let t=Date.now()+EO,n=new Date(t).toISOString(),o=xO(e,"utf8").split(`
 `).filter(Boolean);for(let s of o){let i=jn(s);if(!i||typeof i!="object"||Array.isArray(i))continue;let a=i;if(r.heartbeatCount++,a.ts){let l=String(a.ts),c=Date.parse(l);Number.isFinite(c)&&c>t?r.timestampAnomalies.push({kind:"future_heartbeat_timestamp",observedAt:l,clampedTo:n}):r.lastHeartbeatAt=l}a.phase!==void 0&&a.phase!==null&&(r.lastHeartbeatPhase=String(a.phase)),a.summary!==void 0&&a.summary!==null&&(r.lastHeartbeatSummary=String(a.summary)),xd(r.lastHeartbeatPhase)&&(r.terminalFinalResult=ek(a)),r.heartbeatBlocker=a.blocker?String(a.blocker):null,a.boxResourceSnapshot&&typeof a.boxResourceSnapshot=="object"&&!Array.isArray(a.boxResourceSnapshot)&&(r.lastBoxResourceSnapshot=a.boxResourceSnapshot),Array.isArray(a.prEvidence)&&(r.lastPrEvidence=a.prEvidence.filter(l=>!!l&&typeof l=="object"&&typeof l.prUrl=="string"))}return r}var EO,Yr=D(()=>{"use strict";rk();x();EO=6e4});function nk(e){return e?(e.split("/").pop()??e).replace(/\.exe$/i,"").toLowerCase():null}function $a(e){if(!e)return[];let r=[],t="",n,o=!1;for(let s of e){if(o){t+=s,o=!1;continue}if(s==="\\"){o=!0;continue}if(n){s===n?n=void 0:t+=s;continue}if(s==='"'||s==="'"){n=s;continue}if(/\s/.test(s)){t&&(r.push(t),t="");continue}t+=s}return t&&r.push(t),r}function ok(e){let r=nk(e[0]);return!!(r&&PO.has(r))}function IO(e){let r=e.trim();return r.includes("/")?r.split("/").pop()??r:r}function TO(e){if(!e||e.includes("*"))return null;let r=IO(e);return!r||r.includes("/")?null:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(r)?r:null}function Ed(e){return!e||e.includes("/")||e.includes("*")?!1:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(e)}function ja(e){if(!e)return!1;let r=e.trim();return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")}function NO(e){if(!e.startsWith("--glob="))return e;let r=e.slice(7);return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")?`--glob=${r}/**`:e}function DO(e){let r=[];for(let t=1;t<e.length;t+=1){let n=e[t];if(n){if(n==="--"){r.push(...e.slice(t+1));break}if(n.startsWith("-")){if(n.includes("="))continue;tk.has(n)&&(t+=1);continue}r.push(n)}}return r}function sk(e){let r=!1,t=e.map((o,s)=>{let i=NO(o),a=e[s-1];return a&&tk.has(a)&&o.startsWith("!")&&!o.includes("/")&&!o.endsWith("/**")&&(i=`${o}/**`),i!==o&&(r=!0),i}),n=DO(t);if(n.length===2){let[o,s]=n;if(ja(s))return{argv:[t[0]??"rg",o,"-g",`${s}/**`,"."],changed:!0};let i=TO(s);if(i)return{argv:[t[0]??"rg","-g",i,o,"."],changed:!0}}return r&&n.length===1?{argv:[...t,"."],changed:!0}:{argv:t,changed:r}}function ik(e){for(let r=1;r<e.length;r+=1){let t=e[r];if(t&&(t==="-c"||t==="-lc"||t==="-cl"||/^-[a-zA-Z]*c[a-zA-Z]*$/u.test(t)))return r+1}return-1}function vs(e){let r=e.trim();if(!r)return{command:r,wrapped:!1};let t=$a(r);if(!t.length)return{command:r,wrapped:!1};let n=nk(t[0]);if(!n||!OO.has(n))return{command:r,wrapped:!1};let o=ik(t);if(o<0||o>=t.length)return{command:r,wrapped:!1};let s=t.slice(o).join(" ").trim();return s?{command:s,wrapped:!0}:{command:r,wrapped:!1}}function MO(e,r){let t=e.trim(),n=$a(t),o=ik(n);if(o<0)return r;let s=n.slice(0,o).join(" "),i=r.includes("'")?`"${r.replace(/"/g,'\\"')}"`:`'${r}'`;return`${s} ${i}`}function UO(e){let r=e.trim(),t=vs(r),n=$a(t.command);if(!n.length||!ok(n))return{segment:r,changed:!1};let o=sk(n);if(!o.changed)return{segment:r,changed:!1};let s=o.argv.join(" ");return t.wrapped?{segment:MO(r,s),changed:!0}:{segment:s,changed:!0}}function bs(e){let r=e.trim();if(!r)return{command:r,changed:!1};let t=r.includes("&&")?" && ":r.includes("||")?" || ":"; ",n=r.split(/\s*(?:&&|\|\||;)\s*/u),o=!1,s=n.map(i=>{let a=UO(i);return a.changed&&(o=!0),a.segment});return o?{command:s.join(t),changed:!0}:{command:r,changed:!1}}function Pd(e){let r=vs(e).command,t=$a(r.trim());return t.length&&ok(t)?!0:/\b(rg|ripgrep)\b/i.test(r)}function LO(e){if(e.exitCode!==void 0&&e.exitCode!==1||!Pd(e.command))return!1;let r=(e.stderr??e.interleaved??"").trim();if(r&&AO.test(r)||bs(e.command).changed)return!1;let n=Id(e.command);if(n){let o=Ad(n);if(o.kind==="bad_scope"||o.kind==="rg_exclude_syntax")return!1}return!0}function Od(e){if(!e)return{};let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(|$)/iu);if(r)return{pattern:r[1],target:r[2]?.trim()};let t=e.match(/^search\s+"(.+)"\s+in\s+(.+)$/iu);return t?{pattern:t[1],target:t[2]?.trim()}:{}}function Ad(e){let{pattern:r,target:t}=Od(e);return r?ja(t)?{kind:"rg_exclude_syntax",pattern:r,target:t}:Ed(t)?{kind:"bad_scope",pattern:r,target:t}:{kind:"not_repo_search",pattern:r,target:t}:{kind:"not_repo_search"}}function ak(e){let{pattern:r,target:t}=Od(e);if(!r)return null;if(ja(t)){let n=`${t.trim()}/**`;return{command:`rg "${r}" -g '${n}' .`,changed:!0}}return t&&Ed(t)?{command:`rg -g ${t} "${r}" .`,changed:!0}:null}function lk(e){if(e.kind==="bad_scope"&&e.pattern&&e.target)return`Use \`rg -g '${e.target}' ${e.pattern} .\` from the repo root instead of treating ${e.target} as a folder.`;if(e.kind==="rg_exclude_syntax"&&e.pattern){let r=e.target?`${e.target.trim()}/**`:"!node_modules/**";return`Repo search scope \`${e.target??"!node_modules"}\` is not a valid ripgrep path. Use \`rg "${e.pattern}" -g '${r}' .\` from the repo root (exclude globs need a \`/**\` suffix).`}return e.kind==="no_matches"&&e.pattern?`No matches for "${e.pattern}". Try a broader pattern, drop overly short tokens, or search from the repo root with \`rg "${e.pattern}" .\`.`:null}function Id(e){let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(agent\)|\s*failed|$)/iu);return r?`search "${r[1]}" in ${r[2]?.trim()}`:null}function Va(e){let r=e.meta?.trim()||(e.command?Id(e.command):null)||null;if(r){let t=Ad(r),n=lk(t);if(n)return n;let o=ak(r);if(o?.changed)return`Repo search used an invalid scope. Retry with: \`${o.command}\`.`}if(e.command&&/\b(rg|ripgrep)\b/i.test(e.command)){let t=bs(e.command);if(t.changed)return`Ripgrep scope may be invalid. Retry with: \`${t.command}\`.`;if(e.exitCode===1)return"Ripgrep returned no matches (exit 1). Try a broader pattern or search from the repo root."}return null}var PO,OO,AO,tk,Td=D(()=>{"use strict";PO=new Set(["rg","ripgrep","grep"]),OO=new Set(["bash","sh","dash","zsh"]),AO=/\b(error|invalid|unknown|panic|not found)\b/i,tk=new Set(["-e","--regexp","-f","--file","-m","--max-count","-A","--after-context","-B","--before-context","-C","--context","-g","--glob","--iglob"])});function Ss(e,r=200){let t=e.replace(/\s+/g," ").trim();return t.length>r?`${t.slice(0,r-1)}\u2026`:t}function FO(e){let r=e.trim();if(!r)return null;if(r.startsWith("{"))try{return JSON.parse(r)}catch{}let t=r.indexOf("{"),n=r.lastIndexOf("}");if(t>=0&&n>t)try{return JSON.parse(r.slice(t,n+1))}catch{return null}return null}function _s(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function uk(e){let r=e.metadata;if(!_s(r))return null;let t=r.vulnerabilities;if(!_s(t))return null;let n=s=>typeof t[s]=="number"?t[s]:0,o={info:n("info"),low:n("low"),moderate:n("moderate"),high:n("high"),critical:n("critical"),total:n("total")};return typeof t.total!="number"&&!o.critical&&!o.high&&!o.moderate&&!o.low&&!o.info?null:o}function HO(e){let r=[];e.critical&&r.push(`${e.critical} critical`),e.high&&r.push(`${e.high} high`),e.moderate&&r.push(`${e.moderate} moderate`),e.low&&r.push(`${e.low} low`),e.info&&r.push(`${e.info} info`);let t=r.length?r.join(", "):"see report";return`npm audit: ${e.total} vulnerabilit${e.total===1?"y":"ies"} (${t}) \u2014 remediation required`}function KO(e,r){let t=e.error;if(_s(t)){let s=typeof t.summary=="string"?t.summary.trim():"",i=typeof t.code=="string"?t.code.trim():"";if(s)return i?`${i}: ${s}`:s;if(i)return i}let n=typeof e.message=="string"?e.message.trim():"";if(n)return n;let o=r.trim();return o?Ss(o.split(`
 `).find(Boolean)??o,160):"npm audit failed"}function dk(e){let r=`${e.stdout}
 ${e.stderr}`.trim(),t=FO(r);if(!t||!_s(t)){let o=Ss(r||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit failed (invalid or missing JSON): ${o}`,parseError:"invalid_json"}}if(_s(t.error))return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit command failed: ${KO(t,e.stderr)}`};let n=uk(t);return n?e.exitCode===0&&n.total===0?{kind:"success",exitCode:0,summary:"npm audit: no vulnerabilities reported",audit:n}:{kind:"audit_findings",exitCode:e.exitCode,summary:HO(n),audit:n}:{kind:"command_failure",exitCode:e.exitCode,summary:"npm audit failed: JSON response missing vulnerability metadata",parseError:"missing_metadata"}}function $O(e){return WO.test(e)}function jO(e){let r=vs(e).command;return ck.test(e)||ck.test(r)||Pd(e)}function VO(e){let r=Va({command:e.command,exitCode:e.exitCode});if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"ripgrep finished (exit 0)"};if(e.exitCode===1){let n=(e.stderr||e.interleaved).trim();if(n&&BO.test(n)){let i=Ss(n,160);return{kind:"command_failure",exitCode:1,summary:r??`ripgrep failed (exit 1): ${i}`}}let o=bs(e.command),s=o.changed&&!r?` Retry with: \`${o.command}\`.`:"";return{kind:"search_no_matches",exitCode:1,summary:r??`ripgrep: no matches (exit 1).${s} Try a broader pattern or search from the repo root.`}}let t=Ss(e.interleaved||e.stdout||e.stderr||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:r??`ripgrep failed (exit ${e.exitCode}): ${t}`}}function Ga(e){let r=e.stdout??"",t=e.stderr??"",n=e.interleavedOutput??"";if($O(e.command)){let i=r.trim()||n.trim()||t.trim();return dk({exitCode:e.exitCode,stdout:i,stderr:t})}if(jO(e.command))return VO({command:e.command,exitCode:e.exitCode,stdout:r,stderr:t,interleaved:n});let o=Va({command:e.command,exitCode:e.exitCode});if(o&&e.exitCode!==0)return{kind:"command_failure",exitCode:e.exitCode,summary:o};if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"command succeeded (exit 0)"};let s=Ss(n||r||t||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`command failed (exit ${e.exitCode}): ${s}`}}var WO,ck,BO,Nd=D(()=>{"use strict";Td();WO=/\bnpm\s+audit\b/i,ck=/\b(rg|ripgrep)\b/i,BO=/\b(error|invalid|unknown|panic|not found)\b/i});import{existsSync as GO,readFileSync as YO}from"node:fs";function JO(e){let r=e.timestamp_ms;return e.timestamp||e.ts||(r?new Date(r).toISOString():void 0)}function pk(e){if(!e)return null;for(let r of Object.keys(e))if(r.endsWith("ToolCall")){let t=r.slice(0,-8);return t.length?t:r}return null}function qO(e,r){e.finalResult=r.result||r.subtype||r.terminal_reason||"completed",r.is_error&&(e.error=String(r.result||r.api_error_status||"stream result error"))}function Zn(e){return typeof e=="number"&&Number.isFinite(e)&&e>=0?e:void 0}function zO(e){let r=e.usage;return r&&typeof r=="object"&&!Array.isArray(r)?r:null}function XO(e){if(typeof e.model=="string"&&e.model.trim())return e.model.trim();let r=e.modelUsage;if(r&&typeof r=="object"&&!Array.isArray(r)){let t=Object.keys(r)[0];if(t?.trim())return t.trim()}}function QO(e,r){let t=zO(r);if(!t)return;let n=Zn(t.input_tokens)??Zn(t.inputTokens)??Zn(t.prompt_tokens),o=Zn(t.output_tokens)??Zn(t.outputTokens)??Zn(t.completion_tokens);if(n===void 0&&o===void 0)return;let s=XO(r)??e.usage?.model;e.usage={...n!==void 0?{inputTokens:n}:{},...o!==void 0?{outputTokens:o}:{},...s?{model:s}:{}}}function mk(e){if(e.type!=="tool_call"||e.subtype!=="completed")return null;let t=(e.tool_call&&typeof e.tool_call=="object"&&!Array.isArray(e.tool_call)?e.tool_call:null)?.shellToolCall;if(!t||typeof t!="object"||Array.isArray(t))return null;let n=t,o=n.args,s=o&&typeof o=="object"&&!Array.isArray(o)&&typeof o.command=="string"?String(o.command):"",i=n.result;if(!i||typeof i!="object"||Array.isArray(i))return null;let a=i.success??i.failure;if(!a||typeof a!="object"||Array.isArray(a))return null;let l=a,c=typeof l.exitCode=="number"?l.exitCode:0;return{command:s,exitCode:c,stdout:typeof l.stdout=="string"?l.stdout:"",stderr:typeof l.stderr=="string"?l.stderr:"",interleaved:typeof l.interleavedOutput=="string"?l.interleavedOutput:""}}function ZO(e,r){r.kind==="success"||r.kind==="search_no_matches"||(e.lastShellOutcome=r)}function kt(e){let r={firstEventAt:null,lastEventAt:null,currentTool:null,finalResult:null,error:null,lastShellOutcome:null,usage:null};if(!GO(e))return r;let t=YO(e,"utf8").split(`
@@ -123,7 +123,7 @@ ${r}`}var _S={"kynver-harness":{adapterId:"kynver-harness",displayName:"Kynver H
 `);a.trim()&&(JS(t,a.endsWith(`
 `)?a:`${a}
 `),n=!0)}let o={capturedAt:new Date(e.now??Date.now()).toISOString(),skipReason:e.skipReason,runId:e.indexed.runId,workerName:e.indexed.workerName,worktreePath:e.indexed.worktreePath,taskId:e.indexed.worker.taskId,agentOsId:e.indexed.worker.agentOsId,branch:e.indexed.worker.branch,completionBlocker:e.indexed.worker.completionBlocker,finalResult:e.status.finalResult,changedFiles:e.status.changedFiles,gitAncestry:e.status.gitAncestry,prUrl:e.status.prUrl??null,...n?{patchPath:t}:{}};return JS($c.join(r,"evidence.json"),`${JSON.stringify(o,null,2)}
-`),o}var nB=new Set(["completion_blocked","dirty_worktree","pr_or_unmerged_commits","landing_blocked"]);function oB(e){return!nB.has(e.skipReason)||dt(e.indexed,e.now)?!1:XS({harnessRoot:e.harnessRoot,runId:e.indexed.runId,workerName:e.indexed.workerName})?!0:e.writeSalvageEvidence?(QS({harnessRoot:e.harnessRoot,indexed:e.indexed,skipReason:e.skipReason,status:e.status,now:e.now}),!0):!1}function sB(e){let{indexed:r,worktreesAgeMs:t,terminalWorktreesAgeMs:n}=e;return r&&(lt.has(r.run.status)||e.liveness&&Rf(r,e.liveness)||e.liveness&&he(kf(r,e.liveness))&&!dt(r))?n:t}function iB(e){return!e.indexed||e.includeOrphans&&e.worktreesAgeMs<=0?0:sB(e)}function aB(e,r){if(e.harnessRoot?.trim())return jc.resolve(e.harnessRoot);let t=r.worker.workerDir;if(!t)return null;let n=`${jc.sep}runs${jc.sep}`,o=t.indexOf(n);return o<0?null:t.slice(0,o+n.length-1)}function ZS(e){let{indexed:r,includeOrphans:t,worktreesAgeMs:n,ageMs:o,orphanSafety:s,worktreeRemovalGuard:i}=e,a=e.now??Date.now();if(!r)return t?s??null:"orphan_without_flag";let l=iB(e);if(n<=0&&!t&&l<=0)return"worktrees_disabled";if(l>0&&o<l)return"below_age_threshold";if(dt(r,a))return"active_worker";let c=kf(r,e.liveness),u=aB(e,r),d=m=>u&&oB({indexed:r,harnessRoot:u,skipReason:m,status:c,now:a,writeSalvageEvidence:e.writeSalvageEvidence===!0})?null:m;if(YS(r,c)){let m=d("completion_blocked");if(m)return m}if(hf(r,e.liveness?.gitStatusCache)){let m=d("dirty_worktree");if(m)return m}let p=e.liveness?.gitRevCache?.countAheadOfMain(e.worktreePath);if(p!=null&&p>0){let m=d("pr_or_unmerged_commits");if(m)return m}if(GS(r,e.liveness,a)||!he(c))return"run_still_active";if(Wi(c)){let m=d("pr_or_unmerged_commits");if(m)return m}if(cr(c.changedFiles).length>0){let m=d("dirty_worktree");if(m)return m}if(qt({finalResult:c.finalResult,changedFiles:c.changedFiles,gitAncestry:c.gitAncestry,prUrl:En(c.finalResult)}).blocked){let m=d("landing_blocked");if(m)return m}if(i&&e.worktreePath){let m=i({worktreePath:e.worktreePath,indexed:!!r,runId:r?.runId,worker:r?.workerName});if(m)return m.detail?{reason:m.reason,detail:m.detail}:m.reason}return null}function vf(e){let{indexed:r,nodeModulesAgeMs:t,ageMs:n,worktreePath:o,activeWorktreePaths:s,diskPressure:i}=e;return!i&&n<t?"below_age_threshold":s.has(jc.resolve(o))||r&&dt(r)?"active_worker":r&&hf(r,e.gitStatusCache)?"dirty_worktree":null}function e_(e){return vf(e)}var Fi=216e5,Hi=6048e5,Vc=216e5,Gc=36e5,Yc=120;var r_=new Set(["active_worker","run_still_active","completion_blocked","landing_blocked"]);function t_(e,r){let t=[],n=new Set,o=(s,i,a)=>{let l=`${s}\0${i}`;n.has(l)||t.length>=24||(n.add(l),t.push({path:s,reason:i,...a?{detail:a}:{}}))};for(let s of r)r_.has(s.reason)&&o(s.path,s.reason,s.detail);for(let s of e)!s.skipped||!s.skipReason||r_.has(s.skipReason)&&o(s.path,s.skipReason);return t}import{existsSync as i_,readdirSync as a_,statSync as uB}from"node:fs";import l_ from"node:path";M();Ce();import n_ from"node:path";x();function cB(e,r){return Kc(e,r)}function o_(e,r=Date.now()){let t=new Set,n=new Set;for(let o of e){for(let s of Ka(o)){let i=!1;for(let a of Object.keys(s.workers||{})){let l=P(n_.join(Rs(o,s.id),"workers",w(a),"worker.json"),void 0);if(!l?.worktreePath)continue;let c=n_.resolve(l.worktreePath);cB(l,r)&&(i=!0,t.add(c))}i&&n.add(`${o}\0${s.id}`)}for(let s of af(o))n.add(s)}return{activeWorktreePaths:t,liveRunKeys:n}}function s_(e,r,t,n){return t?n.has(`${r}\0${t}`):!1}x();function dB(e,r){try{let t=uB(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function pB(e,r){let t=l_.join(e,"runs",r,"run.json");return i_(t)?P(t,null):null}function c_(e){try{return a_(e).length===0}catch{return!1}}function u_(e){let{harnessRoot:r,runId:t,runPath:n,ageMs:o,runDirectoriesAgeMs:s,activeGuards:i}=e;if(s_(n,r,t,i.liveRunKeys)||!c_(n))return"run_still_active";let a=pB(r,t);return a&&!lt.has(a.status)&&!Cn(a)?"run_still_active":s>0&&o<s?"below_age_threshold":null}function d_(e){if(!i_(e.worktreesDir))return[];let r=[],t;try{t=a_(e.worktreesDir,{withFileTypes:!0})}catch{return[]}for(let n of t){if(!n.isDirectory())continue;let o=n.name;if(e.runIdFilter&&o!==e.runIdFilter)continue;let s=l_.join(e.worktreesDir,o);c_(s)&&r.push({kind:"remove_run_directory",path:s,bytes:null,harnessRoot:e.harnessRoot,runId:o,ageMs:dB(s,e.now)})}return r}Ee();import{existsSync as Sf,rmSync as b_}from"node:fs";import{existsSync as hB,rmSync as kB}from"node:fs";Ce();import{lstatSync as mB,readdirSync as fB}from"node:fs";function p_(e){try{let r=mB(e),t=typeof process.getuid=="function"?process.getuid():null,n=typeof process.getgid=="function"?process.getgid():null,o=t!==null&&(r.uid!==t||n!==null&&r.gid!==n);return{uid:r.uid,gid:r.gid,foreign:o}}catch{return null}}function m_(e,r=32){let t=p_(e);if(!t)return!1;if(t.foreign)return!0;try{let n=fB(e),o=0;for(let s of n){if(o>=r)break;let i=`${e.replace(/\/$/,"")}/${s}`,a=p_(i);if(o+=1,a?.foreign)return!0}}catch{}return!1}import{spawnSync as gB}from"node:child_process";import h_ from"node:path";import ur from"node:path";function f_(e,r,t,n){let o=ur.resolve(e),s=`${ur.sep}${n}`,i=o.endsWith(s)?o:null;if(!i)return"path_outside_harness";let a=ur.relative(t,i);if(a.startsWith("..")||ur.isAbsolute(a))return"path_outside_harness";let l=a.split(ur.sep);return l.length<3||l[l.length-1]!==n||!o.startsWith(ur.resolve(r))?"path_outside_harness":null}function Jc(e,r,t){return f_(e,r,t,"node_modules")}function qc(e,r,t){return f_(e,r,t,".next")}function zc(e,r,t){let n=ur.resolve(e),o=ur.relative(t,n);return o.startsWith("..")||ur.isAbsolute(o)||o.split(ur.sep).length<3||!n.startsWith(ur.resolve(r))?"path_outside_harness":null}function g_(e,r,t){let n=ur.resolve(e);return Jc(n,r,t)===null||qc(n,r,t)===null||zc(n,r,t)===null}function y_(){let e=(process.env.KYNVER_CLEANUP_PRIVILEGED??"auto").trim().toLowerCase();return e==="0"||e==="false"||e==="off"||e==="no"?"off":e==="1"||e==="true"||e==="force"||e==="yes"?"force":"auto"}function k_(e){let r=gB("sudo",["-n",...e],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});return{ok:r.status===0,stderr:`${r.stderr??""}${r.stdout??""}`.trim()}}function R_(e,r,t){if(!g_(e,r,t))return{ok:!1,error:"path is not an allowed harness generated cache"};let n=typeof process.getuid=="function"?process.getuid():null,o=typeof process.getgid=="function"?process.getgid():null;if(n===null||o===null)return{ok:!1,error:"privileged reclaim requires POSIX uid/gid"};let s=k_(["chown","-R",`${n}:${o}`,h_.resolve(e)]);if(s.ok)return{ok:!0,method:"chown_then_rm"};let i=k_(["rm","-rf",h_.resolve(e)]);return i.ok?{ok:!0,method:"sudo_rm"}:{ok:!1,error:s.stderr||i.stderr||"sudo -n failed (password required or not permitted)"}}var bf="Root-owned harness caches require operator reclaim: configure passwordless sudo for chown/rm under ~/.kynver/harness/worktrees, or run `node scripts/reclaim-harness-root-owned-cache.mjs --execute` as the harness owner with sudo available. See docs/runbooks/harness-root-owned-cache-reclaim.md.";function yB(e){let r=e?.code;return r==="EACCES"||r==="EPERM"}function v_(e,r,t={}){if(!hB(e.path))return{executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.harnessRoot,o=n?Vr(n):null,i=e.bytes??ut(e.path)??void 0,a=t.removePath??kB,l=t.hasForeignOwnedEntry??m_;try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i}}catch(c){if(!yB(c)||!n||!o)return{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let u=l(e.path),d=y_();if(!(d==="force"||d==="auto"&&u))return u?{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; ${bf}`}:{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let f=R_(e.path,n,o);if(f.ok&&f.method==="sudo_rm")return{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0};if(f.ok)try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0}}catch(m){return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${m.message}; privileged chown succeeded but rm still failed`}}return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; privileged reclaim failed: ${f.error}; ${bf}`}}}function _f(e){let r=e.harnessRoot;return!r||!tf(e.path,r)?null:{...e,executed:!1,skipped:!0,skipReason:"run_metadata_protected"}}function Cf(e,r){let t=_f(e);if(t)return t;let n=v_(e,r);return{...e,bytes:n.bytes??e.bytes,executed:n.executed,skipped:n.skipped,skipReason:n.skipReason,error:n.error}}function S_(e,r){return Cf(e,r)}function __(e,r){return Cf(e,r)}function C_(e,r){return Cf(e,r)}function w_(e,r){let t=_f(e);if(t)return t;if(!Sf(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};try{let n=e.bytes??ut(e.path);return b_(e.path,{recursive:!0,force:!0}),{...e,bytes:n,executed:!0,skipped:!1}}catch(n){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:n.message}}}function x_(e,r){let t=_f(e);if(t)return t;if(!Sf(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.repo;try{let o=e.bytes??ut(e.path);return n&&ie(n,["worktree","remove","--force",e.path],{allowFailure:!0}),Sf(e.path)&&b_(e.path,{recursive:!0,force:!0}),{...e,bytes:o,executed:!0,skipped:!1}}catch(o){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:o.message}}}import{existsSync as Xc,readdirSync as Qc,statSync as RB}from"node:fs";import Ur from"node:path";function wf(e,r){try{let t=RB(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function P_(e,r){let t=Ur.relative(r,e);return t===""||!t.startsWith("..")&&!Ur.isAbsolute(t)}function E_(e,r,t,n){let o=[];for(let s of Hc){if(s===".next")continue;let i=Ur.join(e,s);if(!Xc(i))continue;let a=Ur.resolve(i);t.has(a)||P_(a,r.harnessRoot)&&(t.add(a),o.push({kind:"remove_build_cache",path:a,bytes:null,runId:n.runId,worker:n.worker,repo:n.repo,ageMs:wf(a,r.now)}))}return o}function O_(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||r.push(...E_(n.worktreePath,e,t,{runId:n.runId,worker:n.workerName,repo:n.run.repo}));if(!e.includeOrphans||!Xc(e.worktreesDir))return r;for(let n of Qc(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory())continue;let o=Ur.join(e.worktreesDir,n.name);for(let s of Qc(o,{withFileTypes:!0})){if(!s.isDirectory())continue;let i=Ur.join(o,s.name);r.push(...E_(i,e,t,{runId:n.name,worker:s.name}))}}return r}function A_(e){let r=e.worktreesAgeMs>0||e.includeOrphans,t=e.includeOrphans;if(!r&&!t)return[];let n=[],o=new Set;if(r)for(let i of e.index.values()){if(e.runIdFilter&&i.runId!==e.runIdFilter)continue;let a=i.worktreePath;Xc(a)&&(o.has(a)||(o.add(a),n.push({kind:"remove_worktree",path:a,bytes:null,runId:i.runId,worker:i.workerName,repo:i.run.repo,ageMs:wf(a,e.now)})))}if(!t||!Xc(e.worktreesDir))return n;let s=new Set;for(let i of e.index.values())s.add(Ur.resolve(i.worktreePath));for(let i of Qc(e.worktreesDir,{withFileTypes:!0})){if(!i.isDirectory()||e.runIdFilter&&i.name!==e.runIdFilter)continue;let a=Ur.join(e.worktreesDir,i.name),l;try{l=Qc(a,{withFileTypes:!0})}catch{continue}for(let c of l){if(!c.isDirectory())continue;let u=Ur.resolve(Ur.join(a,c.name));o.has(u)||s.has(u)||P_(u,e.harnessRoot)&&(o.add(u),n.push({kind:"remove_worktree",path:u,bytes:null,runId:i.name,worker:c.name,ageMs:wf(u,e.now)}))}}return n}import{existsSync as N_,readdirSync as I_,statSync as vB}from"node:fs";import Yo from"node:path";var bB=[{dirName:"node_modules",kind:"remove_node_modules"},{dirName:".next",kind:"remove_next_cache"}];function SB(e,r){try{let t=vB(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function _B(e,r){let t=Yo.relative(r,e);return t===""||!t.startsWith("..")&&!Yo.isAbsolute(t)}function CB(e,r,t,n,o,s){if(!N_(n))return;let i=Yo.resolve(n);r.has(i)||_B(i,t.harnessRoot)&&(r.add(i),e.push({kind:o,path:i,bytes:null,harnessRoot:t.harnessRoot,runId:s.runId,worker:s.worker,repo:s.repo,ageMs:SB(i,t.now)}))}function T_(e,r,t,n,o){for(let s of bB)CB(e,r,t,Yo.join(n,s.dirName),s.kind,o)}function D_(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||T_(r,t,e,n.worktreePath,{runId:n.runId,worker:n.workerName,repo:n.run.repo});if(!e.includeOrphans||!N_(e.worktreesDir))return r;for(let n of I_(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory()||e.runIdFilter&&n.name!==e.runIdFilter)continue;let o=Yo.join(e.worktreesDir,n.name),s;try{s=I_(o,{withFileTypes:!0})}catch{continue}for(let i of s){if(!i.isDirectory())continue;let a=Yo.join(o,i.name);T_(r,t,e,a,{runId:n.name,worker:i.name})}}return r}Ee();import{existsSync as M_,statSync as wB}from"node:fs";import Lr from"node:path";function xB(e,r){try{let t=wB(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function EB(e){let r=[],t=null;for(let n of e.split(`
+`),o}var nB=new Set(["completion_blocked","dirty_worktree","pr_or_unmerged_commits","landing_blocked"]);function oB(e){return!nB.has(e.skipReason)||dt(e.indexed,e.now)?!1:XS({harnessRoot:e.harnessRoot,runId:e.indexed.runId,workerName:e.indexed.workerName})?!0:e.writeSalvageEvidence?(QS({harnessRoot:e.harnessRoot,indexed:e.indexed,skipReason:e.skipReason,status:e.status,now:e.now}),!0):!1}function sB(e){let{indexed:r,worktreesAgeMs:t,terminalWorktreesAgeMs:n}=e;return r&&(lt.has(r.run.status)||e.liveness&&Rf(r,e.liveness)||e.liveness&&he(kf(r,e.liveness))&&!dt(r))?n:t}function iB(e){return!e.indexed||e.includeOrphans&&e.worktreesAgeMs<=0?0:sB(e)}function aB(e,r){if(e.harnessRoot?.trim())return jc.resolve(e.harnessRoot);let t=r.worker.workerDir;if(!t)return null;let n=`${jc.sep}runs${jc.sep}`,o=t.indexOf(n);return o<0?null:t.slice(0,o+n.length-1)}function ZS(e){let{indexed:r,includeOrphans:t,worktreesAgeMs:n,ageMs:o,orphanSafety:s,worktreeRemovalGuard:i}=e,a=e.now??Date.now();if(!r)return t?s??null:"orphan_without_flag";let l=iB(e);if(n<=0&&!t&&l<=0)return"worktrees_disabled";if(l>0&&o<l)return"below_age_threshold";if(dt(r,a))return"active_worker";let c=kf(r,e.liveness),u=aB(e,r),d=m=>u&&oB({indexed:r,harnessRoot:u,skipReason:m,status:c,now:a,writeSalvageEvidence:e.writeSalvageEvidence===!0})?null:m;if(YS(r,c)){let m=d("completion_blocked");if(m)return m}if(hf(r,e.liveness?.gitStatusCache)){let m=d("dirty_worktree");if(m)return m}let p=e.liveness?.gitRevCache?.countAheadOfMain(e.worktreePath);if(p!=null&&p>0){let m=d("pr_or_unmerged_commits");if(m)return m}if(GS(r,e.liveness,a)||!he(c))return"run_still_active";if(Wi(c)){let m=d("pr_or_unmerged_commits");if(m)return m}if(cr(c.changedFiles).length>0){let m=d("dirty_worktree");if(m)return m}if(qt({finalResult:c.finalResult,changedFiles:c.changedFiles,gitAncestry:c.gitAncestry,prUrl:En(c.finalResult)}).blocked){let m=d("landing_blocked");if(m)return m}if(i&&e.worktreePath){let m=i({worktreePath:e.worktreePath,indexed:!!r,runId:r?.runId,worker:r?.workerName});if(m)return m.detail?{reason:m.reason,detail:m.detail}:m.reason}return null}function vf(e){let{indexed:r,nodeModulesAgeMs:t,ageMs:n,worktreePath:o,activeWorktreePaths:s,diskPressure:i}=e;return!i&&n<t?"below_age_threshold":s.has(jc.resolve(o))||r&&dt(r)?"active_worker":r&&hf(r,e.gitStatusCache)?"dirty_worktree":null}function e_(e){return vf(e)}var Fi=216e5,Hi=6048e5,Vc=216e5,Gc=36e5,Yc=120;var r_=new Set(["active_worker","run_still_active","completion_blocked","landing_blocked"]);function t_(e,r){let t=[],n=new Set,o=(s,i,a)=>{let l=`${s}\0${i}`;n.has(l)||t.length>=24||(n.add(l),t.push({path:s,reason:i,...a?{detail:a}:{}}))};for(let s of r)r_.has(s.reason)&&o(s.path,s.reason,s.detail);for(let s of e)!s.skipped||!s.skipReason||r_.has(s.skipReason)&&o(s.path,s.skipReason);return t}import{existsSync as i_,readdirSync as a_,statSync as uB}from"node:fs";import l_ from"node:path";M();Ce();import n_ from"node:path";x();function cB(e,r){return Kc(e,r)}function o_(e,r=Date.now()){let t=new Set,n=new Set;for(let o of e){for(let s of Ka(o)){let i=!1;for(let a of Object.keys(s.workers||{})){let l=P(n_.join(Rs(o,s.id),"workers",w(a),"worker.json"),void 0);if(!l?.worktreePath)continue;let c=n_.resolve(l.worktreePath);cB(l,r)&&(i=!0,t.add(c))}i&&n.add(`${o}\0${s.id}`)}for(let s of af(o))n.add(s)}return{activeWorktreePaths:t,liveRunKeys:n}}function s_(e,r,t,n){return t?n.has(`${r}\0${t}`):!1}x();function dB(e,r){try{let t=uB(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function pB(e,r){let t=l_.join(e,"runs",r,"run.json");return i_(t)?P(t,null):null}function c_(e){try{return a_(e).length===0}catch{return!1}}function u_(e){let{harnessRoot:r,runId:t,runPath:n,ageMs:o,runDirectoriesAgeMs:s,activeGuards:i}=e;if(s_(n,r,t,i.liveRunKeys)||!c_(n))return"run_still_active";let a=pB(r,t);return a&&!lt.has(a.status)&&!Cn(a)?"run_still_active":s>0&&o<s?"below_age_threshold":null}function d_(e){if(!i_(e.worktreesDir))return[];let r=[],t;try{t=a_(e.worktreesDir,{withFileTypes:!0})}catch{return[]}for(let n of t){if(!n.isDirectory())continue;let o=n.name;if(e.runIdFilter&&o!==e.runIdFilter)continue;let s=l_.join(e.worktreesDir,o);c_(s)&&r.push({kind:"remove_run_directory",path:s,bytes:null,harnessRoot:e.harnessRoot,runId:o,ageMs:dB(s,e.now)})}return r}Ee();import{existsSync as Sf,rmSync as b_}from"node:fs";import{existsSync as hB,rmSync as kB}from"node:fs";Ce();import{lstatSync as mB,readdirSync as fB}from"node:fs";function p_(e){try{let r=mB(e),t=typeof process.getuid=="function"?process.getuid():null,n=typeof process.getgid=="function"?process.getgid():null,o=t!==null&&(r.uid!==t||n!==null&&r.gid!==n);return{uid:r.uid,gid:r.gid,foreign:o}}catch{return null}}function m_(e,r=32){let t=p_(e);if(!t)return!1;if(t.foreign)return!0;try{let n=fB(e),o=0;for(let s of n){if(o>=r)break;let i=`${e.replace(/\/$/,"")}/${s}`,a=p_(i);if(o+=1,a?.foreign)return!0}}catch{}return!1}import{spawnSync as gB}from"node:child_process";import h_ from"node:path";import ur from"node:path";function f_(e,r,t,n){let o=ur.resolve(e),s=`${ur.sep}${n}`,i=o.endsWith(s)?o:null;if(!i)return"path_outside_harness";let a=ur.relative(t,i);if(a.startsWith("..")||ur.isAbsolute(a))return"path_outside_harness";let l=a.split(ur.sep);return l.length<3||l[l.length-1]!==n||!o.startsWith(ur.resolve(r))?"path_outside_harness":null}function Jc(e,r,t){return f_(e,r,t,"node_modules")}function qc(e,r,t){return f_(e,r,t,".next")}function zc(e,r,t){let n=ur.resolve(e),o=ur.relative(t,n);return o.startsWith("..")||ur.isAbsolute(o)||o.split(ur.sep).length<3||!n.startsWith(ur.resolve(r))?"path_outside_harness":null}function g_(e,r,t){let n=ur.resolve(e);return Jc(n,r,t)===null||qc(n,r,t)===null||zc(n,r,t)===null}function y_(){let e=(process.env.KYNVER_CLEANUP_PRIVILEGED??"auto").trim().toLowerCase();return e==="0"||e==="false"||e==="off"||e==="no"?"off":e==="1"||e==="true"||e==="force"||e==="yes"?"force":"auto"}function k_(e){let r=gB("sudo",["-n",...e],{encoding:"utf8",stdio:["ignore","pipe","pipe"]});return{ok:r.status===0,stderr:`${r.stderr??""}${r.stdout??""}`.trim()}}function R_(e,r,t){if(!g_(e,r,t))return{ok:!1,error:"path is not an allowed harness generated cache"};let n=typeof process.getuid=="function"?process.getuid():null,o=typeof process.getgid=="function"?process.getgid():null;if(n===null||o===null)return{ok:!1,error:"privileged reclaim requires POSIX uid/gid"};let s=k_(["chown","-R",`${n}:${o}`,h_.resolve(e)]);if(s.ok)return{ok:!0,method:"chown_then_rm"};let i=k_(["rm","-rf",h_.resolve(e)]);return i.ok?{ok:!0,method:"sudo_rm"}:{ok:!1,error:s.stderr||i.stderr||"sudo -n failed (password required or not permitted)"}}var bf="Root-owned harness caches require operator reclaim: configure passwordless sudo for chown/rm under ~/.kynver/harness/worktrees, or remove them as the harness owner with sudo available. More help: https://www.kynver.com/help.";function yB(e){let r=e?.code;return r==="EACCES"||r==="EPERM"}function v_(e,r,t={}){if(!hB(e.path))return{executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.harnessRoot,o=n?Vr(n):null,i=e.bytes??ut(e.path)??void 0,a=t.removePath??kB,l=t.hasForeignOwnedEntry??m_;try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i}}catch(c){if(!yB(c)||!n||!o)return{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let u=l(e.path),d=y_();if(!(d==="force"||d==="auto"&&u))return u?{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; ${bf}`}:{executed:!1,skipped:!0,skipReason:"remove_failed",error:c.message};let f=R_(e.path,n,o);if(f.ok&&f.method==="sudo_rm")return{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0};if(f.ok)try{return a(e.path,{recursive:!0,force:!0}),{executed:!0,skipped:!1,bytes:i,privilegedReclaim:!0}}catch(m){return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${m.message}; privileged chown succeeded but rm still failed`}}return{executed:!1,skipped:!0,skipReason:"foreign_owner",error:`${c.message}; privileged reclaim failed: ${f.error}; ${bf}`}}}function _f(e){let r=e.harnessRoot;return!r||!tf(e.path,r)?null:{...e,executed:!1,skipped:!0,skipReason:"run_metadata_protected"}}function Cf(e,r){let t=_f(e);if(t)return t;let n=v_(e,r);return{...e,bytes:n.bytes??e.bytes,executed:n.executed,skipped:n.skipped,skipReason:n.skipReason,error:n.error}}function S_(e,r){return Cf(e,r)}function __(e,r){return Cf(e,r)}function C_(e,r){return Cf(e,r)}function w_(e,r){let t=_f(e);if(t)return t;if(!Sf(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};try{let n=e.bytes??ut(e.path);return b_(e.path,{recursive:!0,force:!0}),{...e,bytes:n,executed:!0,skipped:!1}}catch(n){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:n.message}}}function x_(e,r){let t=_f(e);if(t)return t;if(!Sf(e.path))return{...e,executed:!1,skipped:!0,skipReason:"missing_worktree"};if(!r)return{...e,executed:!1,skipped:!0,skipReason:"dry_run"};let n=e.repo;try{let o=e.bytes??ut(e.path);return n&&ie(n,["worktree","remove","--force",e.path],{allowFailure:!0}),Sf(e.path)&&b_(e.path,{recursive:!0,force:!0}),{...e,bytes:o,executed:!0,skipped:!1}}catch(o){return{...e,executed:!1,skipped:!0,skipReason:"remove_failed",error:o.message}}}import{existsSync as Xc,readdirSync as Qc,statSync as RB}from"node:fs";import Ur from"node:path";function wf(e,r){try{let t=RB(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function P_(e,r){let t=Ur.relative(r,e);return t===""||!t.startsWith("..")&&!Ur.isAbsolute(t)}function E_(e,r,t,n){let o=[];for(let s of Hc){if(s===".next")continue;let i=Ur.join(e,s);if(!Xc(i))continue;let a=Ur.resolve(i);t.has(a)||P_(a,r.harnessRoot)&&(t.add(a),o.push({kind:"remove_build_cache",path:a,bytes:null,runId:n.runId,worker:n.worker,repo:n.repo,ageMs:wf(a,r.now)}))}return o}function O_(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||r.push(...E_(n.worktreePath,e,t,{runId:n.runId,worker:n.workerName,repo:n.run.repo}));if(!e.includeOrphans||!Xc(e.worktreesDir))return r;for(let n of Qc(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory())continue;let o=Ur.join(e.worktreesDir,n.name);for(let s of Qc(o,{withFileTypes:!0})){if(!s.isDirectory())continue;let i=Ur.join(o,s.name);r.push(...E_(i,e,t,{runId:n.name,worker:s.name}))}}return r}function A_(e){let r=e.worktreesAgeMs>0||e.includeOrphans,t=e.includeOrphans;if(!r&&!t)return[];let n=[],o=new Set;if(r)for(let i of e.index.values()){if(e.runIdFilter&&i.runId!==e.runIdFilter)continue;let a=i.worktreePath;Xc(a)&&(o.has(a)||(o.add(a),n.push({kind:"remove_worktree",path:a,bytes:null,runId:i.runId,worker:i.workerName,repo:i.run.repo,ageMs:wf(a,e.now)})))}if(!t||!Xc(e.worktreesDir))return n;let s=new Set;for(let i of e.index.values())s.add(Ur.resolve(i.worktreePath));for(let i of Qc(e.worktreesDir,{withFileTypes:!0})){if(!i.isDirectory()||e.runIdFilter&&i.name!==e.runIdFilter)continue;let a=Ur.join(e.worktreesDir,i.name),l;try{l=Qc(a,{withFileTypes:!0})}catch{continue}for(let c of l){if(!c.isDirectory())continue;let u=Ur.resolve(Ur.join(a,c.name));o.has(u)||s.has(u)||P_(u,e.harnessRoot)&&(o.add(u),n.push({kind:"remove_worktree",path:u,bytes:null,runId:i.name,worker:c.name,ageMs:wf(u,e.now)}))}}return n}import{existsSync as N_,readdirSync as I_,statSync as vB}from"node:fs";import Yo from"node:path";var bB=[{dirName:"node_modules",kind:"remove_node_modules"},{dirName:".next",kind:"remove_next_cache"}];function SB(e,r){try{let t=vB(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function _B(e,r){let t=Yo.relative(r,e);return t===""||!t.startsWith("..")&&!Yo.isAbsolute(t)}function CB(e,r,t,n,o,s){if(!N_(n))return;let i=Yo.resolve(n);r.has(i)||_B(i,t.harnessRoot)&&(r.add(i),e.push({kind:o,path:i,bytes:null,harnessRoot:t.harnessRoot,runId:s.runId,worker:s.worker,repo:s.repo,ageMs:SB(i,t.now)}))}function T_(e,r,t,n,o){for(let s of bB)CB(e,r,t,Yo.join(n,s.dirName),s.kind,o)}function D_(e){let r=[],t=new Set;for(let n of e.index.values())e.runIdFilter&&n.runId!==e.runIdFilter||T_(r,t,e,n.worktreePath,{runId:n.runId,worker:n.workerName,repo:n.run.repo});if(!e.includeOrphans||!N_(e.worktreesDir))return r;for(let n of I_(e.worktreesDir,{withFileTypes:!0})){if(!n.isDirectory()||e.runIdFilter&&n.name!==e.runIdFilter)continue;let o=Yo.join(e.worktreesDir,n.name),s;try{s=I_(o,{withFileTypes:!0})}catch{continue}for(let i of s){if(!i.isDirectory())continue;let a=Yo.join(o,i.name);T_(r,t,e,a,{runId:n.name,worker:i.name})}}return r}Ee();import{existsSync as M_,statSync as wB}from"node:fs";import Lr from"node:path";function xB(e,r){try{let t=wB(e).mtimeMs;return Math.max(0,r-t)}catch{return 0}}function EB(e){let r=[],t=null;for(let n of e.split(`
 `)){if(!n.trim())continue;let[o,...s]=n.split(" "),i=s.join(" ");if(o==="worktree"){t&&r.push(t),t={path:i};continue}t&&(o==="branch"&&(t.branch=i),o==="HEAD"&&(t.head=i),o==="bare"&&(t.bare=!0))}return t&&r.push(t),r}function PB(e,r){let t=Lr.relative(Lr.resolve(r),Lr.resolve(e));return t!==""&&!t.startsWith("..")&&!Lr.isAbsolute(t)}var OB=200;function U_(e){if(!e.includeOrphans||!M_(e.worktreesDir))return[];let r=new Set;for(let s of e.index.values())s.run.repo&&r.add(Lr.resolve(s.run.repo));let t=new Set;for(let s of e.index.values())t.add(Lr.resolve(s.worktreePath));let n=[],o=new Set;for(let s of r){let i=0,a;try{a=ie(s,["worktree","list","--porcelain"],{allowFailure:!0})}catch{continue}let l=EB(a);for(let c of l){if(i>=OB)break;let u=Lr.resolve(c.path);if(u===Lr.resolve(s)||!PB(u,e.worktreesDir)||t.has(u)||o.has(u)||!M_(u))continue;let p=Lr.relative(e.worktreesDir,u).split(Lr.sep),f=p[0],m=p[1]??"unknown";o.add(u),i+=1,n.push({kind:"remove_worktree",path:u,bytes:null,runId:f,worker:m,repo:s,ageMs:xB(u,e.now)})}}return n}M();x();import Ki from"node:path";function L_(e,r){let t=Ki.resolve(r),n=new Map;for(let[o,s]of e){let i=s.harnessRoot?Ki.resolve(s.harnessRoot):null;i&&i!==t||n.set(o,s)}return n}function W_(e){let r=new Map;for(let t of Ka(e))for(let n of Object.keys(t.workers||{})){let o=Ki.join(Rs(e,t.id),"workers",w(n),"worker.json"),s=P(o,void 0);s?.worktreePath&&r.set(Ki.resolve(s.worktreePath),{harnessRoot:e,worktreePath:Ki.resolve(s.worktreePath),runId:t.id,workerName:n,run:t,worker:s})}return r}function $i(e){let r=process.env[e];return r==="1"||r==="true"||r==="yes"}function Pn(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)&&n>=0?n:r}function xf(e={}){let r=e.execute===!0||e.execute!==!1&&$i("KYNVER_CLEANUP_EXECUTE"),t=e.finalizeStaleRuns!==!1&&!$i("KYNVER_CLEANUP_SKIP_FINALIZE"),n=e.nodeModulesAgeMs??Pn("KYNVER_CLEANUP_NODE_MODULES_AGE_MS",216e5),o=e.scanDependencyCaches??(e.nodeModulesAgeMs!==void 0||process.env.KYNVER_CLEANUP_NODE_MODULES_AGE_MS!=null),s=e.worktreesAgeMs??Pn("KYNVER_CLEANUP_WORKTREES_AGE_MS",0),i=e.terminalWorktreesAgeMs??Pn("KYNVER_CLEANUP_TERMINAL_WORKTREES_AGE_MS",216e5),a=e.runDirectoriesAgeMs??Pn("KYNVER_CLEANUP_RUN_DIRECTORIES_AGE_MS",36e5),l=e.maxActionsPerSweep??Pn("KYNVER_CLEANUP_MAX_ACTIONS_PER_SWEEP",120),c=e.includeOrphans===!0||$i("KYNVER_CLEANUP_INCLUDE_ORPHANS"),d=$i("KYNVER_CLEANUP_SCOPE_ALL")||process.env.KYNVER_CLEANUP_SCOPE==="all"?e.runIdFilter:e.runIdFilter??(process.env.KYNVER_CLEANUP_RUN_ID||void 0),p=e.accountBytes!==!1&&!$i("KYNVER_CLEANUP_SKIP_BYTE_ACCOUNTING"),f=Pn("KYNVER_CLEANUP_STORAGE_ENTRY_CAP",2e3),m=e.storagePerRunEntryCap!==void 0?e.storagePerRunEntryCap:p&&f>0?f:null,g=Pn("KYNVER_CLEANUP_BYTE_ENTRY_CAP",2e3),y=e.byteAccountingEntryCap??(Number.isFinite(g)&&g>0?Math.floor(g):2e3);return{execute:r,finalizeStaleRuns:t,scanDependencyCaches:o,nodeModulesAgeMs:n,worktreesAgeMs:s>0?s:0,terminalWorktreesAgeMs:i>=0?i:0,runDirectoriesAgeMs:a>=0?a:0,maxActionsPerSweep:Number.isFinite(l)&&l>0?Math.floor(l):120,includeOrphans:c,runIdFilter:d?String(d):void 0,accountBytes:p,storagePerRunEntryCap:m,byteAccountingEntryCap:y}}function B_(e){let r=process.env.KYNVER_CLEANUP_SCOPE==="all",t=Number(process.env.KYNVER_CLEANUP_WORKTREES_AGE_MS),n=r?Number.isFinite(t)&&t>0?t:6048e5:Number.isFinite(t)&&t>0?t:0;return xf({runIdFilter:r?void 0:e,worktreesAgeMs:n,terminalWorktreesAgeMs:r?216e5:void 0,runDirectoriesAgeMs:r?36e5:void 0,includeOrphans:r?!0:void 0,finalizeStaleRuns:!0,accountBytes:!0,scanDependencyCaches:!0})}Ee();import{existsSync as Ef,statSync as AB}from"node:fs";import Zc from"node:path";x();var IB=1800*1e3;function Pf(e){let r=e.now??Date.now(),t=e.heartbeatFreshMs??IB;if(!Ef(e.worktreePath))return null;if(e.runId&&e.workerName){let c=Zc.join(e.harnessRoot,"runs",e.runId,"workers",e.workerName),u=P(Zc.join(c,"worker.json"),void 0);if(u&&yf(u,r,t))return"active_worker";if(!u){let d=Zc.join(c,"heartbeat.jsonl");if(Ef(d))try{let p=r-AB(d).mtimeMs;if(Number.isFinite(p)&&p>=0&&p<t)return"active_worker"}catch{}}}let n=Zc.join(e.worktreePath,".git");if(!Ef(n))return null;let o=ee(e.worktreePath,["status","--porcelain"]);if(o.status!==0)return"pr_or_unmerged_commits";let s=o.stdout.split(`
 `).map(c=>c.trim()).filter(c=>c.length>0);if(cr(s).length>0)return"dirty_worktree";let i=ee(e.worktreePath,["rev-list","--count","@{u}..HEAD"]);if(i.status===0){let c=Number(i.stdout.trim());if(Number.isFinite(c)&&c>0)return"pr_or_unmerged_commits"}let a=ee(e.worktreePath,["rev-list","--count","origin/main..HEAD"]);if(a.status!==0)return i.status!==0?"pr_or_unmerged_commits":null;let l=Number(a.stdout.trim());return Number.isFinite(l)&&l>0?"pr_or_unmerged_commits":null}Ce();import{existsSync as TB}from"node:fs";import{homedir as NB}from"node:os";import F_ from"node:path";var DB=["/var/tmp/kynver-harness",F_.join(NB(),".openclaw","harness")];function Of(e,r,t){if(!t?.trim())return;let n=Re(t.trim());e.has(n)||(e.add(n),r.push(n))}function MB(e){return e.scanWellKnown!=null?e.scanWellKnown:process.env.VITEST==="true"?!1:process.env.KYNVER_CLEANUP_SCAN_WELL_KNOWN!=="0"&&!["0","false","no"].includes((process.env.KYNVER_CLEANUP_SCAN_WELL_KNOWN??"").toLowerCase())}function H_(e={}){let r=new Set,t=[];Of(r,t,e.harnessRoot??ge());let n=process.env.KYNVER_CLEANUP_EXTRA_ROOTS?.split(",").map(o=>o.trim()).filter(Boolean);for(let o of n??[])Of(r,t,o);if(MB(e))for(let o of DB){let s=F_.resolve(o);!r.has(s)&&TB(s)&&Of(r,t,s)}return t}Xn();function UB(e){let r=process.env[e];return r==="1"||r==="true"||r==="yes"}function LB(e,r){let t=process.env[e];if(!t)return r;let n=Number(t);return Number.isFinite(n)?n:r}function K_(e={}){let r=e.diskPath?.trim()||process.env.KYNVER_DISK_GUARD_PATH?.trim()||"/",t=LB("KYNVER_DISK_GUARD_MAX_USED_PERCENT",75),n=gr({...e,diskPath:r,diskMaxUsedPercent:e.diskMaxUsedPercent??t}),o=!n.ok||n.usedPercent>=t,s=process.env.KYNVER_CLEANUP_DISK_PRESSURE_FORCE?.trim().toLowerCase();return s==="none"||s==="off"||s==="0"?o=!1:(s==="pressured"||s==="on"||s==="1")&&(o=!0),{diskGate:n,pressured:o,maxUsedPercent:t}}function $_(e,r){if(!r.pressured)return e;let t=e.execute||!UB("KYNVER_CLEANUP_DRY_RUN_ON_PRESSURE");return{...e,execute:t,nodeModulesAgeMs:0,runIdFilter:void 0,includeOrphans:!0,terminalWorktreesAgeMs:0,runDirectoriesAgeMs:0,worktreesAgeMs:e.worktreesAgeMs>0?e.worktreesAgeMs:6048e5,diskPressure:!0,diskGate:r.diskGate}}zn();function dr(e,r){if(process.env.KYNVER_CLEANUP_QUIET==="1")return;let t=r?`: ${r}`:"";console.error(`[kynver cleanup] ${e}${t}`)}Ee();var eu=class{aheadOfMain=new Map;countAheadOfMain(r,t="origin/main"){let n=`${r}\0${t}`;if(this.aheadOfMain.has(n))return this.aheadOfMain.get(n)??null;let o=ee(r,["rev-list","--count",`${t}..HEAD`]);if(o.status!==0)return this.aheadOfMain.set(n,null),null;let s=Number(o.stdout.trim()),i=Number.isFinite(s)?s:null;return this.aheadOfMain.set(n,i),i}};import{spawnSync as WB}from"node:child_process";import{existsSync as BB}from"node:fs";import FB from"node:path";var HB=5e3;function KB(e,r){if(!BB(FB.join(e,".git")))return{status:null,stdout:"",stderr:"",error:"not_a_git_repo"};try{let t=WB("git",r,{cwd:e,encoding:"utf8",timeout:HB}),n=t.error?.message?.includes("ETIMEDOUT")===!0;return{status:n?null:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:n?"git_timeout":t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}function j_(e){let r=KB(e,["status","--short"]);return r.error==="not_a_git_repo"?[]:r.error==="git_timeout"||r.status!==0?null:r.stdout.split(`
 `).map(t=>t.trim()).filter(Boolean)}var ru=class{cache=new Map;porcelain(r){let t=r,n=this.cache.get(t);if(n!==void 0)return n;let o=j_(t)??[];return this.cache.set(t,o),o}};var tu=class{cache=new Map;derive(r){let t=this.cache.get(r.id);if(t!==void 0)return t;let n=Cn(r);return this.cache.set(r.id,n),n}};function $B(e){let r={};for(let t of e)r[t.kind]=(r[t.kind]??0)+1;return r}function V_(e,r={}){let t=r.maxSampleActions??12,n=r.maxSampleSkips??8;return{harnessRoot:e.harnessRoot,scanRoots:e.scanRoots,dryRun:e.dryRun,execute:e.execute,scannedAt:e.scannedAt,finalizedRuns:e.finalizedRuns.length,actionCount:e.actions.length,actionKinds:$B(e.actions),totals:e.totals,...e.storage?{storage:e.storage}:{},...e.preservedLivePaths?.length?{preservedLivePaths:e.preservedLivePaths}:{},...e.removedRunDirectories!=null?{removedRunDirectories:e.removedRunDirectories}:{},sampleActions:e.actions.slice(0,t).map(o=>({kind:o.kind,path:o.path,...o.skipReason?{skipReason:o.skipReason}:{},...o.bytes!=null?{bytes:o.bytes}:{},...o.runId?{runId:o.runId}:{},...o.worker?{worker:o.worker}:{}})),sampleSkips:e.skips.slice(0,n)}}function jB(e={}){let r=e.harnessRoot?Re(e.harnessRoot):ge(),t=H_({harnessRoot:r}),n=e.now??Date.now();return{harnessRoot:r,scanRoots:t,now:n}}function VB(e){return typeof e=="string"?{reason:e}:e}function Jo(e,r,t,n){e.push({path:r,reason:t,...n?{detail:n}:{}})}function nu(e,r,t){return!r||e.bytes!=null?e:{...e,bytes:ut(e.path,t)}}function G_(e,r){let t={};for(let n of r)t[n.reason]=(t[n.reason]??0)+1;for(let n of e)n.skipReason&&(t[n.skipReason]=(t[n.skipReason]??0)+1);return t}function GB(e,r){return e.kind==="remove_next_cache"?__(e,r):S_(e,r)}function YB(e,r,t){return e.kind==="remove_next_cache"?qc(e.path,r,t):Jc(e.path,r,t)}function JB(e){let r=new Map;for(let t of e)for(let[n,o]of W_(t))r.set(n,o);return r}function Y_(e,r){return e.runId&&e.worker?pr.join(r,e.runId,e.worker):pr.resolve(e.path,"..")}function ou(e={}){let r=xf(e),t=K_();r=$_(r,t);let n=jB(e);dr("scan",`${n.scanRoots.length} harness root(s)`);let o=o_(n.scanRoots,n.now),s=r.finalizeStaleRuns?Ui().map(N=>({runId:N.runId,from:N.from,to:N.to})):[];s.length>0&&dr("finalize",`${s.length} stale run(s) marked terminal`),dr("index","building worktree index");let i=JB(n.scanRoots);dr("index",`${i.size} indexed worktree(s)`);let a={runTerminalCache:new tu,gitStatusCache:new ru,gitRevCache:new eu},l=[],c=[],u=new Set,d=r.maxActionsPerSweep,p=()=>c.length>=d;for(let N of n.scanRoots){if(p())break;dr("root",N);let ye=pr.join(N,"worktrees"),Ne=L_(i,N),xe={harnessRoot:N,worktreesDir:ye,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,runIdFilter:r.runIdFilter,index:Ne,now:n.now},H=r.scanDependencyCaches?D_(xe):[];dr("dependency",r.scanDependencyCaches?`${H.length} cache candidate(s) at ${N}`:"skipped (worktree-only sweep)");let z=0;for(let le of H){if(p())break;z+=1,z%50===0&&dr("dependency",`${z}/${H.length} evaluated`);let ce=pr.resolve(le.path);if(u.has(ce))continue;u.add(ce);let W={...le,path:ce},De=YB(W,N,ye);if(De){Jo(l,W.path,De),c.push({...W,executed:!1,skipped:!0,skipReason:De});continue}let Q=Y_(W,ye),Br=Ne.get(pr.resolve(Q))??null,rr=vf({indexed:Br,includeOrphans:!0,nodeModulesAgeMs:r.nodeModulesAgeMs,ageMs:W.ageMs,worktreePath:Q,activeWorktreePaths:o.activeWorktreePaths,diskPressure:r.diskPressure,gitStatusCache:a.gitStatusCache});if(rr){Jo(l,W.path,rr),c.push({...W,executed:!1,skipped:!0,skipReason:rr});continue}c.push(GB(nu(W,r.accountBytes,r.byteAccountingEntryCap),r.execute))}if(r.scanDependencyCaches)for(let le of O_(xe)){if(p())break;let ce=pr.resolve(le.path);if(u.has(ce))continue;u.add(ce);let W={...le,path:ce},De=zc(W.path,N,ye);if(De){Jo(l,W.path,De),c.push({...W,executed:!1,skipped:!0,skipReason:De});continue}let Q=Y_(W,ye),Br=Ne.get(pr.resolve(Q))??null,rr=e_({indexed:Br,includeOrphans:!0,nodeModulesAgeMs:r.nodeModulesAgeMs,ageMs:W.ageMs,worktreePath:Q,activeWorktreePaths:o.activeWorktreePaths,diskPressure:r.diskPressure,gitStatusCache:a.gitStatusCache});if(rr){Jo(l,W.path,rr),c.push({...W,executed:!1,skipped:!0,skipReason:rr});continue}c.push(C_(nu(W,r.accountBytes,r.byteAccountingEntryCap),r.execute))}let X=[...A_(xe),...U_(xe)];dr("worktrees",`${X.length} candidate(s) at ${N}`);let er=new Set,Se=0;for(let le of X){if(p())break;Se+=1,Se%50===0&&dr("worktrees",`${Se}/${X.length} evaluated`);let ce=pr.resolve(le.path);if(er.has(ce))continue;er.add(ce);let W={...le,path:ce},De=Ne.get(pr.resolve(W.path))??null,Q=De?null:Pf({worktreePath:W.path,harnessRoot:N,runId:W.runId,workerName:W.worker,now:n.now}),Br=ZS({indexed:De,worktreePath:pr.resolve(W.path),includeOrphans:r.includeOrphans,worktreesAgeMs:r.worktreesAgeMs,terminalWorktreesAgeMs:r.terminalWorktreesAgeMs,ageMs:W.ageMs,orphanSafety:Q,worktreeRemovalGuard:e.worktreeRemovalGuard,liveness:a,now:n.now,harnessRoot:N,writeSalvageEvidence:r.execute});if(Br){let{reason:rr,detail:zu}=VB(Br);Jo(l,W.path,rr,zu),c.push({...W,executed:!1,skipped:!0,skipReason:rr});continue}c.push(x_(nu(W,r.accountBytes,r.byteAccountingEntryCap),r.execute))}if(!p()&&r.runDirectoriesAgeMs>=0)for(let le of d_({harnessRoot:N,worktreesDir:ye,runDirectoriesAgeMs:r.runDirectoriesAgeMs,runIdFilter:r.runIdFilter,activeGuards:o,now:n.now})){if(p())break;let ce=pr.resolve(le.path);if(u.has(ce))continue;u.add(ce);let W={...le,path:ce},De=W.runId??pr.basename(ce),Q=u_({harnessRoot:N,runId:De,runPath:ce,ageMs:W.ageMs,runDirectoriesAgeMs:r.runDirectoriesAgeMs,activeGuards:o});if(Q){Jo(l,W.path,Q),c.push({...W,executed:!1,skipped:!0,skipReason:Q});continue}c.push(w_(nu(W,r.accountBytes,r.byteAccountingEntryCap),r.execute))}}let f=0,m=0,g=0,y=0,R=0,h=0;for(let N of c)N.bytes&&(f+=N.bytes),!N.skipped&&!N.executed&&N.bytes&&(g+=N.bytes),N.executed?(R+=1,y+=N.bytes??0,N.kind==="remove_run_directory"&&(m+=1)):N.skipped&&(h+=1,N.skipReason==="dry_run"&&N.bytes&&(g+=N.bytes));let k=r.accountBytes?ff({harnessRoot:n.harnessRoot,now:n.now,perRunEntryCap:r.storagePerRunEntryCap}):void 0,S=Kr(),O=r.execute&&Lm(S),E=O?Ai({execute:!0}):null,C=S?{observed:!0,execute:O,dumpCount:S.dumpCount,totalBytes:S.totalBytes,removedCount:E?.removed.length??0,removedBytes:E?.removedBytes??0,executables:S.executables,path:S.path,reason:S.reason}:void 0;E&&E.removed.length>0&&(y+=E.removedBytes,R+=E.removed.length,dr("wsl-crashes",`removed ${E.removed.length} dump(s), ${E.removedBytes} bytes`)),dr("complete",`${c.length} action(s), ${h} skipped, ${R} removed`);let F=t_(c,l),j=V_({harnessRoot:n.harnessRoot,scanRoots:n.scanRoots,dryRun:!r.execute,execute:r.execute,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,diskPressure:r.diskPressure,diskGate:r.diskGate?{ok:r.diskGate.ok,path:r.diskGate.path,freeBytes:r.diskGate.freeBytes,usedPercent:r.diskGate.usedPercent,reason:r.diskGate.reason}:void 0,scannedAt:new Date(n.now).toISOString(),finalizedRuns:s,actions:c,skips:l,totals:{candidateBytes:f,reclaimableBytes:g,removedBytes:y,removedPaths:R,skippedPaths:h,skipReasons:G_(c,l)},...k?{storage:k}:{},...F.length>0?{preservedLivePaths:F}:{},...m>0?{removedRunDirectories:m}:{},...C?{wslCrashDumps:C}:{}});return{harnessRoot:n.harnessRoot,scanRoots:n.scanRoots,dryRun:!r.execute,execute:r.execute,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,diskPressure:r.diskPressure,diskGate:r.diskGate?{ok:r.diskGate.ok,path:r.diskGate.path,freeBytes:r.diskGate.freeBytes,usedPercent:r.diskGate.usedPercent,reason:r.diskGate.reason}:void 0,scannedAt:new Date(n.now).toISOString(),finalizedRuns:s,actions:c,skips:l,totals:{candidateBytes:f,reclaimableBytes:g,removedBytes:y,removedPaths:R,skippedPaths:h,skipReasons:G_(c,l)},...k?{storage:k}:{},...F.length>0?{preservedLivePaths:F}:{},...m>0?{removedRunDirectories:m}:{},...C?{wslCrashDumps:C}:{},compactSummary:j}}function Af(e){let r=B_(e);return ou({execute:r.execute,finalizeStaleRuns:r.finalizeStaleRuns,accountBytes:r.accountBytes,nodeModulesAgeMs:r.nodeModulesAgeMs,worktreesAgeMs:r.worktreesAgeMs,includeOrphans:r.includeOrphans,runIdFilter:r.runIdFilter})}function If(){return process.env.KYNVER_PIPELINE_CLEANUP!=="0"}A();import{mkdirSync as FE,realpathSync as Xj}from"node:fs";import{fileURLToPath as Qj}from"node:url";A();x();qd();import zB from"node:os";function qB(e){return(e.accessibleItems??[]).filter(r=>r.access?.isOwner).map(r=>({id:typeof r.agentOs?.id=="string"?r.agentOs.id:"",slug:typeof r.agentOs?.slug=="string"?r.agentOs.slug.trim():""})).filter(r=>r.slug)}function J_(e){if(!e)return null;let r=qB(e),t=typeof e.primarySlug=="string"?e.primarySlug.trim():"",n=typeof e.primaryAgentOsId=="string"?e.primaryAgentOsId.trim():"";if(r.length>0){if(n){let s=r.find(i=>i.id===n);if(s)return s}if(t){let s=r.find(i=>i.slug===t);if(s)return s}return r[0]??null}if(Array.isArray(e.accessibleItems)&&e.accessibleItems.length>0)return null;if(n&&t)return{id:n,slug:t};if(!t)return null;let o=e.items?.find(s=>s.slug===t);return o?.id&&o.slug?{id:o.id,slug:o.slug}:{id:"",slug:t}}function XB(e){let r=(typeof e.apiBaseUrl=="string"?e.apiBaseUrl:void 0)||(typeof e.baseUrl=="string"?e.baseUrl:void 0)||process.env.KYNVER_API_URL||v().apiBaseUrl;return r?He(String(r)):void 0}function z_(e){return`${e?He(e):"https://www.kynver.com"}/agent-os/early-access`}function q_(e){return["This account does not have Agentic OS access yet \u2014 access is admin-approved.",`Request access at ${z_(e)} .`,"Once your account is approved, it will work here as-is: just re-run `kynver bootstrap`."].join(`
@@ -164,7 +164,7 @@ ${e.diagnostic}`:e.primary}function f$(e){let r=[`Harness ${e.scope} ${e.action}
 `).slice(-3).join(" ")}`),r.push("Next: retry on the runner host or inspect harness logs.");let n=Mu(e.stdout);return{primary:r.join(`
 `),diagnostic:ae(n??{stdout:e.stdout,stderr:e.stderr})}}function mx(e){if(!e.ok)return f$(e);let r=Mu(e.stdout);if(r===null){let t=e.stdout.trim()||e.stderr.trim()||"(no output)";return{primary:`Harness ${e.scope} ${e.action} finished.
 ${t.slice(0,800)}`,diagnostic:ae({stdout:e.stdout,stderr:e.stderr})}}if(e.scope==="worker"&&e.action==="start"&&Wu(r))return fg(r);if(e.scope==="worker"&&e.action==="status")return ia(r);if(e.scope==="worker"&&e.action==="complete")return Lu(r);if(e.scope==="monitor"&&(e.action==="tick"||e.action==="run-loop"))return cs(r);if(e.scope==="monitor"&&e.action==="auto-complete"){let t=r;if(t.outcome&&t.worker&&t.runId)return Uu(r);if(Array.isArray(t.blockers))return{primary:[`Monitor auto-complete blocked \xB7 ${t.runId??"run"} / ${t.worker??"worker"}`,`Blockers: ${t.blockers.join("; ")}`,"Next: resolve blockers on the runner, then retry auto-complete."].join(`
-`),diagnostic:ae(r)}}if(e.scope==="run"&&e.action==="status"){let t=r.workers;return Array.isArray(t)&&t.length===1?ia(t[0]):{primary:`Harness run status \xB7 ${r.runId??"run"} (${Array.isArray(t)?t.length:0} workers).`,diagnostic:ae(r)}}return{primary:`Harness ${e.scope} ${e.action} completed successfully on the runner.`,diagnostic:ae(r)}}import y$ from"node:path";M();oe();x();oe();x();function Bu(e){let{worker:r,status:t,taskLease:n}=e,o=n?.leaseOwner??null;if(r.dispatched&&n){if(n.status==="running"&&o&&!Ap(o,r.runId))return{health:"orphaned",reason:`task lease held by ${o}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=n.leaseToken?.trim()??"";if(n.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(n.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(t.attention.state==="stale")return{health:"stale",reason:t.attention.reason};let s=t.lastHeartbeatAt?Date.parse(t.lastHeartbeatAt):NaN;return t.alive&&Number.isFinite(s)&&Date.now()-s>no?{health:"stale",reason:`heartbeat older than ${Math.floor(no/1e3)}s`}:t.alive&&r.pid&&!G(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:n?.status==="running"&&!t.alive&&t.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:t.attention.reason||"worker within expected lifecycle bounds"}}Ce();x();import{existsSync as fx,mkdirSync as g$,readdirSync as h$,unlinkSync as k$}from"node:fs";import hg from"node:path";function gx(){let{harnessRoot:e}=Vt(),r=hg.join(e,"monitors");return g$(r,{recursive:!0}),r}function Nn(e,r){return r?`${w(e)}--${w(r)}`:w(e)}function kg(e){return hg.join(gx(),`${e}.json`)}function Dn(e){return P(kg(e),void 0)}function Mn(e){ue(kg(e.monitorId),e)}function yg(e){let r=kg(e);return fx(r)?(k$(r),!0):!1}function hx(){let e=gx();if(!fx(e))return[];let r=[];for(let t of h$(e)){if(!t.endsWith(".json"))continue;let n=P(hg.join(e,t),void 0);n?.monitorId&&r.push({monitorId:n.monitorId,runId:n.runId,workerName:n.workerName,agentOsId:n.agentOsId,pid:n.pid,alive:n.pid?G(n.pid):!1,startedAt:n.startedAt,pollMs:n.pollMs,logPath:n.logPath})}return r.sort((t,n)=>t.startedAt.localeCompare(n.startedAt))}oe();function aa(e){let{worker:r,status:t}=e,n=[];r.localOnly&&n.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&n.push("missing agentOsId/taskId linkage"),jl(r)&&n.push("completion already acknowledged"),r.completionBlocker&&n.push(r.completionBlocker),t.heartbeatBlocker&&t.alive&&n.push(`worker heartbeat blocker: ${t.heartbeatBlocker}`),t.attention.state==="blocked"&&n.push(t.attention.reason||"worker attention blocked"),Xt(t)&&n.push(t.attention.reason||"landing gate blocked");let o=he(t),s;return o?t.finalResult?s="final_result":t.alive?s="terminal_status":s="process_exited":n.push("worker has not reached a terminal condition"),{eligible:o&&n.length===0,terminalVerified:o,terminalReason:s,blockers:n}}function kx(e,r){return P(y$.join(T(e),"workers",w(r),"worker.json"),void 0)}function yx(e,r){let t=$(e),n=Object.keys(t.workers||{});if(!r)return n;let o=w(r);return n.filter(s=>w(s)===o)}function Rx(e,r){let t=$(e.runId),n=L(e,{base:t.base,baseCommit:t.baseCommit}),o=e.taskId?r.get(e.taskId)??null:null,s=Bu({worker:e,status:n,taskLease:o}),i=aa({worker:e,status:n});return{runId:e.runId,worker:e.name,health:s.health,healthReason:s.reason,workerStatus:n.status,attentionState:n.attention.state,attentionReason:n.attention.reason,alive:n.alive,taskId:e.taskId,leaseOwner:o?.leaseOwner??void 0,taskStatus:o?.status,autoComplete:i,status:n}}async function Un(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=e.agentOsId?String(e.agentOsId):void 0,o=$(r),s=yx(r,t),i=[];for(let m of s){let g=kx(r,m);g&&i.push(g)}let a=n||i.map(m=>m.agentOsId).find(m=>typeof m=="string"&&m.trim())||void 0,l=i.map(m=>m.taskId).filter(m=>!!m),c=await Eo({agentOsId:a,taskIds:l,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0}),u=i.map(m=>Rx(m,c)),d;a&&e.renewLeases!==!1&&e.renewLeases!=="false"&&(d=await Ul(r,{...e,agentOsId:a}));let p=[];if(e.autoComplete===!0||e.autoComplete==="true")for(let m of u){if(!m.autoComplete.eligible){p.push({worker:m.worker,outcome:"skipped",ok:!1,reason:m.autoComplete.blockers.join("; ")||"not eligible"});continue}let g=await Rn({run:r,name:m.worker,...a?{agentOsId:a}:{},...e.baseUrl?{baseUrl:String(e.baseUrl)}:{},...e.secret?{secret:String(e.secret)}:{}});p.push({worker:m.worker,outcome:g.outcome,ok:g.outcome==="completed",reason:g.reason})}return{runId:r,agentOsId:a,workers:u,leaseRenewal:d,autoCompleted:p}}function Fu(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=yx(r,t),o=[];for(let s of n){let i=kx(r,s);i&&o.push(Rx(i,new Map))}return{runId:r,workers:o,autoCompleted:[]}}function la(){return hx()}function Rg(e){let r=String(e.run||"");V(r,"--run");let t=Nn(r,e.name?String(e.name):void 0),n=Dn(t);if(!n)return{monitorId:t,stopped:!1};if(n.pid&&G(n.pid))try{process.kill(n.pid,"SIGTERM")}catch{}return n.stoppedAt=new Date().toISOString(),Mn(n),yg(t),{monitorId:t,stopped:!0,pid:n.pid}}async function Hu(e){let r=String(e.run||""),t=String(e.name||"");V(r,"--run"),V(t,"--name");let n=Ae(r,t),o=$(r),s=L(n,{base:o.base,baseCommit:o.baseCommit}),i=aa({worker:n,status:s});if(!i.eligible){console.log(JSON.stringify({runId:r,worker:t,outcome:"blocked",blockers:i.blockers,terminalVerified:i.terminalVerified},null,2)),process.exitCode=1;return}let a=await Rn({...e,run:r,name:t});console.log(JSON.stringify(a,null,2)),a.outcome!=="completed"&&a.outcome!=="blocked"&&(process.exitCode=1)}x();var R$=5e3,v$=360*60*1e3;async function vg(e){let r=String(e.monitorId||""),t=Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):R$,n=Number(e.maxTotalMs)>0?Math.floor(Number(e.maxTotalMs)):v$,o=Date.now();for(;Date.now()-o<=n;){let s=r?Dn(r):void 0;if(s?.stoppedAt)break;let i=await Un({...e,autoComplete:e.autoComplete??!0,renewLeases:e.renewLeases??!0}),a=cs({monitorId:r,phase:"tick",...i});if(console.log(a.primary),a.diagnostic&&console.error(`[monitor diagnostic] ${a.diagnostic}`),i.workers.length>0&&i.workers.every(c=>c.autoComplete.terminalVerified&&(c.autoComplete.eligible||c.autoComplete.blockers.some(u=>u.includes("already acknowledged"))))&&i.autoCompleted.every(c=>c.ok||c.outcome==="skipped")){r&&s&&(s.stoppedAt=new Date().toISOString(),Mn(s));break}Bt(t)}}x();Ce();import{spawn as b$}from"node:child_process";import{closeSync as vx,existsSync as S$,openSync as _$}from"node:fs";import C$ from"node:path";function Ku(e){let r=e.nodeExecutable??process.execPath,t=Co({importMetaUrl:import.meta.url,explicitCliPath:e.cliPath,nodeExecutable:r});if(!t)return;let n=t.cliPath;if(!S$(n))return;let o=Nn(e.runId,e.workerName),{harnessRoot:s}=Vt(),i=C$.join(s,"monitors",`${o}.log`),a;try{a=_$(i,"a")}catch{a=void 0}let l=e.pollMs??5e3,c=[...t.argsPrefix,"monitor","run-loop","--run",e.runId,"--monitor-id",o,"--poll-ms",String(l),"--auto-complete","true","--renew-leases","true"];e.workerName&&c.push("--name",e.workerName),e.agentOsId&&c.push("--agent-os-id",e.agentOsId),e.baseUrl&&c.push("--base-url",e.baseUrl),e.secret&&c.push("--secret",e.secret);let u=["ignore",a??"ignore",a??"ignore"];try{let d=b$(t.command,c,fe({detached:!0,stdio:u,env:process.env}));a!==void 0&&vx(a),d.unref();let p={monitorId:o,runId:e.runId,workerName:e.workerName,agentOsId:e.agentOsId,pid:d.pid,startedAt:new Date().toISOString(),pollMs:l,logPath:i};return Mn(p),{monitorId:o,pid:d.pid,logPath:i,session:p}}catch{if(a!==void 0)try{vx(a)}catch{}return}}x();async function bx(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=Nn(r,t),o=Dn(n);if(o?.pid&&!o.stoppedAt)return{monitorId:n,session:o,spawned:!1,pid:o.pid};let s=Ku({runId:r,workerName:t,agentOsId:e.agentOsId?String(e.agentOsId):void 0,pollMs:Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):void 0,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0});if(!s)throw new Error("failed to spawn monitor sidecar (cli.js missing or spawn error)");return{monitorId:n,session:s.session,spawned:!0,pid:s.pid}}async function Sx(e){if(String(e.run||"")){let t=e.tick===!0||e.tick==="true"?await Un({...e,autoComplete:!1}):Fu(e);console.log(JSON.stringify(t,null,2));return}console.log(JSON.stringify({monitors:la()},null,2))}function _x(e){console.log(JSON.stringify(Rg(e),null,2))}function Cx(){console.log(JSON.stringify({monitors:la()},null,2))}async function wx(e){await vg(e)}async function xx(e){let r=await Un(e);console.log(JSON.stringify(r,null,2))}M();oe();x();A();import w$ from"node:path";function ca(e,r,t,n,o,s){return{runId:e,worker:r,taskId:t,agentOsId:n,leaseOwner:o,action:"skipped",reason:s}}async function x$(e){let r=U(e.baseUrl?String(e.baseUrl):void 0),t=e.agentOsId?String(e.agentOsId).trim():null,n=e.dryRun===!0||e.dryRun==="true",o=[],s=[],i=[];for(let a of ne())for(let l of Object.keys(a.workers??{})){let c=w$.join(T(a.id),"workers",w(l),"worker.json"),u=P(c,void 0);if(!u){s.push(ca(a.id,l,"","","","worker.json missing"));continue}let d=u.taskId??"",p=u.agentOsId??"",f=u.leaseOwner??"";if(!u.dispatched||!d||!p||!f){s.push(ca(a.id,l,d,p,f,"not a fully-leased dispatched worker"));continue}if(t&&p!==t)continue;if(u.completionReportedAt){s.push(ca(a.id,l,d,p,f,"completion already reported"));continue}let m=L(u);if(m.finalResult){s.push(ca(a.id,l,d,p,f,"has final result \u2014 let pipeline tick complete it"));continue}if(m.alive){s.push(ca(a.id,l,d,p,f,"worker process is still alive"));continue}if(n){o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"released",reason:"dry-run: would release dead dispatched worker lease"});continue}try{let g=await J(e.secret?String(e.secret):void 0,p,{baseUrl:r}),y=`${r}/api/agent-os/by-id/${encodeURIComponent(p)}/tasks/${encodeURIComponent(d)}/release`,R=await te(y,g,{agentOsId:p,leaseOwner:f,...u.leaseToken?.trim()?{leaseToken:u.leaseToken.trim()}:{}},{agentOsId:p,baseUrl:r});R.ok===!0||R.response?.ok===!0?o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"released",reason:"dead dispatched worker lease released; task requeued"}):s.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"skipped",reason:`release returned ok:false (likely owner mismatch or already released): HTTP ${R.status}`})}catch(g){i.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"error",reason:g.message})}}return{dryRun:n,released:o,skipped:s,errors:i}}async function Ex(e){let r=await x$(e),t={ok:r.errors.length===0,dryRun:r.dryRun,released:r.released.length,skipped:r.skipped.length,errors:r.errors.length,details:r};console.log(JSON.stringify(t,null,2)),r.errors.length>0&&process.exit(1)}il();import Lx from"node:path";Ye();A();import{accessSync as E$,constants as P$,existsSync as Sg,readFileSync as O$}from"node:fs";import{homedir as $u}from"node:os";import ju from"node:path";import{spawnSync as A$}from"node:child_process";Ce();function bg(e,r){try{let t=A$(e,r,{encoding:"utf8"}),n=(t.stdout||"").trim(),o=(t.stderr||"").trim();return{ok:t.status===0,stdout:n,stderr:o,error:t.error?.message}}catch(t){return{ok:!1,stdout:"",stderr:"",error:t.message}}}function Px(e){let r=e?.trim();if(r)return r.length<=12?`${r}\u2026`:`${r.slice(0,12)}\u2026`}function I$(e){if(!Sg(e))return!1;try{return E$(e,P$.W_OK),!0}catch{return!1}}var Ox={packageVersion:()=>Fe,commandOnPath:e=>bg(process.platform==="win32"?"where":"which",[e]),kynverVersion:e=>bg(e,["--version"]),loadConfig:()=>v(),configFilePath:()=>ju.join($u(),".kynver","config.json"),credentialsFilePath:()=>ju.join($u(),".kynver","credentials"),readCredentials:()=>{let e=ju.join($u(),".kynver","credentials");if(!Sg(e))return{hasApiKey:!1};try{let r=JSON.parse(O$(e,"utf8"));return{hasApiKey:!!r.apiKey?.trim(),runnerTokenPrefix:Px(r.runnerToken),runnerTokenAgentOsId:r.runnerTokenAgentOsId}}catch{return{hasApiKey:!1}}},envSnapshot:()=>({kynverApiUrl:process.env.KYNVER_API_URL?.trim()||void 0,openclawCronFireBaseUrl:process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||void 0,kynverRunnerTokenPrefix:Px(process.env.KYNVER_RUNNER_TOKEN),kynverRuntimeSecret:!!process.env.KYNVER_RUNTIME_SECRET?.trim(),openclawCronSecret:!!process.env.OPENCLAW_CRON_SECRET?.trim(),kynverHarnessRoot:process.env.KYNVER_HARNESS_ROOT?.trim()||void 0,opusHarnessRoot:process.env.OPUS_HARNESS_ROOT?.trim()||void 0,kynverSchedulerProvider:process.env.KYNVER_SCHEDULER_PROVIDER?.trim()||void 0,openclawCronStorePath:!!(process.env.KYNVER_CRON_STORE_PATH?.trim()||process.env.OPENCLAW_CRON_STORE_PATH?.trim()),kynverCronDaemonPrimary:uu(),qstashTokenPresent:!!process.env.QSTASH_TOKEN?.trim(),kynverHostedDeployment:(()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"})()}),harnessRoot:()=>ge(),legacyOpenclawHarnessRoot:()=>ju.join($u(),".openclaw","harness"),pathExists:e=>Sg(e),pathWritable:e=>I$(e),ghAuthToken:()=>bg("gh",["auth","token"]),deployEvidenceNeedsGithub:()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return!(e==="1"||e==="true"||e==="yes")}};function Ax(e,r){return e.kynverSchedulerProvider==="openclaw-cron"||r.deploymentSchedulerProvider==="openclaw-cron"}function T$(e,r){return e.kynverSchedulerProvider==="kynver-cron"||r.deploymentSchedulerProvider==="kynver-cron"}function Ix(e){return!!e.openclawCronStorePath}function N$(e,r){return e.kynverSchedulerProvider==="qstash"||r.deploymentSchedulerProvider==="qstash"}function Tx(e,r){let t={schedulerProvider:e.kynverSchedulerProvider??null,deploymentSchedulerProvider:r.deploymentSchedulerProvider??null,openclawCronStorePath:!!e.openclawCronStorePath,kynverCronDaemonPrimary:!!e.kynverCronDaemonPrimary},n=!!r.agentOsId?.trim()&&!!r.apiBaseUrl?.trim()&&r.hasScopedRunnerToken;if(N$(e,r)&&!Ax(e,r)){let u=e.kynverSchedulerProvider==="qstash"?"KYNVER_SCHEDULER_PROVIDER=qstash on this host":"deploymentSchedulerProvider=qstash in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler cut over to QStash (${u})`,details:t}}if(T$(e,r)&&!Ax(e,r)){if(Ix(e)&&e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let u=e.kynverSchedulerProvider==="kynver-cron"?"KYNVER_SCHEDULER_PROVIDER=kynver-cron on this host":"deploymentSchedulerProvider=kynver-cron in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler owned by Kynver Cron (${u})`,details:t}}if(Ix(e)){if(e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let u=[];return e.openclawCronStorePath&&u.push("KYNVER_CRON_STORE_PATH or OPENCLAW_CRON_STORE_PATH set (local cron store)"),{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Local cron store without daemon tick (${u.join("; ")})`,remediation:"Run `kynver daemon` with KYNVER_CRON_SECRET + KYNVER_API_URL (or KYNVER_CRON_FIRE_BASE_URL) so the daemon-owned cron tick fires schedules. On hosted deploys use QStash (KYNVER_SCHEDULER_PROVIDER=qstash). Legacy OpenClaw cron env aliases still work during cutover.",details:t}}let o=e.kynverSchedulerProvider==="openclaw-cron",s=r.deploymentSchedulerProvider==="openclaw-cron",i=e.kynverSchedulerProvider==="qstash",a=!!e.qstashTokenPresent||!!e.kynverHostedDeployment,l=a&&!n,c=l&&e.kynverSchedulerProvider==="openclaw-cron";return s&&!o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"deploymentSchedulerProvider=openclaw-cron in ~/.kynver/config.json \u2014 migrate to kynver-cron or qstash",remediation:'Run `kynver scheduler attest-cutover` or set deploymentSchedulerProvider to "kynver-cron" or "qstash" in ~/.kynver/config.json.',details:t}:n&&o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 dispatch is owned by kynver daemon; unset the OpenClaw override",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:n?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:i?"Runner override qstash present; hosted dispatch still owned by kynver daemon pipeline-tick":"Hosted dispatch owned by kynver daemon (pipeline-tick \u2192 operator/tick); no OpenClaw cron on runner",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 hosted dispatch still depends on the OpenClaw local-cron adapter",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,hostedDeployment:a}}:c?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment has KYNVER_SCHEDULER_PROVIDER=openclaw-cron \u2014 AgentOS scheduled ticks should use QStash or kynver-cron",remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server (or kynver-cron for Kynver-owned local scheduling). User runners use `kynver daemon` for dispatch and should not set a scheduler provider.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:l&&e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"QSTASH_TOKEN present; hosted scheduler auto-selects qstash (explicit KYNVER_SCHEDULER_PROVIDER=qstash optional)",details:{schedulerProvider:null,qstashTokenPresent:!0,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment with no QSTASH_TOKEN and no KYNVER_SCHEDULER_PROVIDER \u2014 kynver-cron is an in-process stub here and will NOT fire; no firing scheduler is configured",remediation:"Set QSTASH_TOKEN + KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server for hosted AgentOS schedules. Only use kynver-cron when a `kynver daemon` (or local cron store) actually owns firing on this box.",details:{schedulerProvider:null,resolvedFallback:"none",qstashTokenPresent:!1,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&e.kynverSchedulerProvider&&e.kynverSchedulerProvider!=="qstash"&&e.kynverSchedulerProvider!=="kynver-cron"?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Hosted deployment without QSTASH_TOKEN (KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}) \u2014 use qstash or kynver-cron`,remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server, or kynver-cron for Kynver-owned local scheduling. User runners use `kynver daemon` for dispatch.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}`,details:{schedulerProvider:e.kynverSchedulerProvider??null}}:{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"No KYNVER_SCHEDULER_PROVIDER on runner (expected) \u2014 finish runner setup so daemon pipeline-tick owns dispatch",details:{schedulerProvider:null,dispatchPath:"kynver-daemon-pipeline-tick-pending"}}}hr();Ms();tn();nl();Yd();function Nx(e,r={}){let t=lo(),n=ol(e,t),o=[],s=r.envFilePath??we,i=sl(e,{envFilePath:s,systemdUnitActive:r.systemdUnitActive});if(o.push({id:"daemon_supervision_owner",ok:!!e.daemonSupervisionOwner||i.effectivelyConfigured,summary:e.daemonSupervisionOwner?`daemonSupervisionOwner=${e.daemonSupervisionOwner} (${t})`:i.owner?`daemonSupervisionOwner inferred as ${i.owner} from healthy supervision signals \u2014 run \`kynver setup\` to persist`:"daemonSupervisionOwner unset \u2014 run `kynver setup` to persist Kynver-owned restart policy",remediation:e.daemonSupervisionOwner||i.effectivelyConfigured?e.daemonSupervisionOwner?void 0:"Run `kynver setup` or `kynver doctor runtime-takeover --remediate` to persist daemonSupervisionOwner.":"Run `kynver setup` (or `kynver bootstrap`) on this box."}),o.push({id:"daemon_present_signal",ok:i.daemonPresentSignal||i.systemdUnitActive,summary:i.systemdUnitActive?"systemd user unit active \u2014 local daemon supervision is healthy":i.daemonPresentSignal?`KYNVER_CRON_DAEMON_PRESENT=1 (persisted in ${s})`:`KYNVER_CRON_DAEMON_PRESENT not set in persisted env (${s})`,remediation:i.daemonPresentSignal||i.systemdUnitActive?void 0:"Run `kynver setup` or `kynver start` once to write ~/.kynver/.env supervision keys."}),n==="systemd"){let l=co();o.push({id:"systemd_user_unit",ok:l,summary:l?"systemd user unit present (~/.config/systemd/user/kynver-cron-daemon.service)":"daemonSupervisionOwner=systemd but user unit missing",remediation:l?void 0:"Run `kynver start --install-systemd` or `kynver cron install --install-systemd`."})}let a=Vd(t,n);return o.push({id:"supervision_guidance",ok:!0,summary:a[0]??"Kynver keeper supervises daemon restarts by default."}),o}Ms();tn();function Dx(e){let r=e.loadConfig(),t=lo(),n=ol(r,t),s=Nx(r,{systemdUnitActive:e.systemdDaemonActive}).map(i=>({id:i.id,label:i.id.replace(/_/g," "),status:i.ok?"pass":i.id==="daemon_supervision_owner"||i.id==="daemon_present_signal"?"warn":"fail",summary:i.summary,remediation:i.remediation}));return s.push({id:"daemon_keeper_default",label:"Kynver keeper owns in-process restarts",status:n==="keeper"||n==="systemd"?"pass":"warn",summary:n==="systemd"?"systemd persists the keeper parent \u2014 Hermes/OpenClaw cron is not required to restart the daemon":"`kynver start` / `kynver daemon` run the keeper by default (opt out with --no-supervise only when an external supervisor owns restarts)",details:{owner:n,hostKind:t}}),{id:"daemon_supervision",label:"Daemon restart supervision",checks:s}}function Mx(e){if(e.envGithubToken)return{viable:!0,source:"env",summary:"GITHUB_TOKEN present for GitHub commit-status evidence"};if(e.envGhToken)return{viable:!0,source:"env",summary:"GH_TOKEN present for GitHub commit-status evidence"};let r=e.ghAuthToken();return r.ok&&r.stdout.trim().length>0?{viable:!0,source:"gh-cli",summary:"GitHub CLI authenticated (`gh auth login`) for commit-status evidence"}:{viable:!1,source:"missing",summary:"No GITHUB_TOKEN/GH_TOKEN and `gh auth token` unavailable"}}function Ux(e,r){let t=e.commandOnPath("vercel"),n=t.ok,o=!!process.env.VERCEL_TOKEN?.trim(),s=Mx(r),i=e.deployEvidenceNeedsGithub?.()??!0,a=[{id:"vercel_global_cli_absent",label:"Global Vercel CLI not installed",status:n?"warn":"pass",summary:n?`Global Vercel CLI on PATH (${t.stdout||"vercel"}) \u2014 Vercel is decommissioned; nothing should call it`:"No global Vercel CLI on PATH",remediation:n?"Uninstall the global Vercel CLI (`npm uninstall -g vercel`) \u2014 Vercel was decommissioned in the 2026-08 Railway cutover; deploy evidence comes from production /api/version + GitHub.":void 0,details:{path:n&&t.stdout||null}}];return i?a.push({id:"github_token_for_deploy_evidence",label:"GitHub token for deploy evidence",status:s.viable?"pass":"warn",summary:s.viable?s.summary:"No GitHub auth \u2014 deploy-evidence lookups (commit status, production /api/version ancestry compare) need GITHUB_TOKEN/GH_TOKEN or `gh auth login`",remediation:s.viable?void 0:"Export GITHUB_TOKEN (or GH_TOKEN) or run `gh auth login` for PR commit-status and ancestry lookups.",details:{source:s.source}}):a.push({id:"github_token_for_deploy_evidence",label:"GitHub token for deploy evidence",status:"pass",summary:"Skipped \u2014 no enabled workflow on this host requires GitHub deploy evidence",details:{skipped:!0,reason:"workflow_not_enabled"}}),a.push({id:"vercel_token_absent",label:"No stale VERCEL_TOKEN",status:o?"warn":"pass",summary:o?"VERCEL_TOKEN is set but obsolete \u2014 Vercel is decommissioned; nothing reads it":"VERCEL_TOKEN not set (Vercel decommissioned)",remediation:o?"Revoke the token in the Vercel dashboard and remove VERCEL_TOKEN from this host's environment.":void 0,details:{vercelTokenPresent:o}}),{id:"deploy_evidence",label:"Deploy evidence (Railway era)",checks:a}}function D$(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function M$(e){let r=e.packageVersion(),t=e.commandOnPath("kynver"),n=t.ok&&t.stdout.length>0,o=n?t.stdout.split(/\r?\n/)[0]?.trim():void 0,s=o?B(o):void 0,i=[{id:"cli_running_version",label:"Running @kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${r}`,details:{version:r}},{id:"cli_on_path",label:"kynver executable on PATH",status:n?"pass":"warn",summary:n?`Found ${s}`:"kynver not found on PATH (invoked via node/npx?)",remediation:n?void 0:"Install globally (`npm i -g @kynver-app/runtime`) or invoke via `npx @kynver-app/runtime`.",details:{path:s}}];if(n&&o){let a=e.kynverVersion(o),l=a.stdout.replace(/^kynver\s+/i,"").trim()||void 0,c=a.ok&&(!l||l===r);i.push({id:"cli_installed_version",label:"Installed kynver CLI version matches running package",status:c?"pass":"warn",summary:a.ok&&l?c?`Installed ${l}`:`Installed ${l} differs from running ${r}`:a.error?`Could not read installed version (${a.error})`:a.stderr||"Could not read installed version",remediation:c?void 0:"Reinstall or rebuild @kynver-app/runtime so PATH kynver matches the harness worktree version.",details:{installedVersion:l,runningVersion:r,path:s}})}return{id:"cli_package",label:"CLI / package",checks:i}}function U$(e){let r=e.configFilePath(),t=B(r),n=e.pathExists(r),o=e.loadConfig(),s=[{id:"config_file",label:"~/.kynver/config.json present",status:n?"pass":"fail",summary:n?`Found ${t}`:`Missing ${t}`,remediation:n?void 0:"Run `kynver setup --api-base-url <url> --agent-os-id <id> --repo <path>`.",details:{configPath:t}}];if(n){let i=o.apiBaseUrl?.trim(),a=o.agentOsId?.trim(),l=Ze({config:o}),c=l?Ho(l):null,u=sC(l);s.push({id:"config_api_base_url",label:"Default API base URL",status:i?"pass":"warn",summary:i??"Not set in config (KYNVER_API_URL / --base-url required per command)",remediation:i?void 0:"Set `apiBaseUrl` via `kynver setup --api-base-url https://\u2026`.",details:{apiBaseUrl:i??null}},{id:"config_agent_os_id",label:"Default AgentOS id",status:a?"pass":"warn",summary:a??"Not set (pass --agent-os-id on daemon/dispatch/worker commands)",remediation:a?void 0:"Set `agentOsId` via `kynver setup --agent-os-id <uuid>`.",details:{agentOsId:a??null,agentOsSlug:o.agentOsSlug??null}},{id:"config_default_repo",label:"Default repo path",status:u.status,summary:l?l.persistedInConfig?`${c.defaultRepo} (config)`:`${c.defaultRepo} (${l.source}, not persisted in ~/.kynver/config.json)`:"Not set in ~/.kynver/config.json (`kynver run create` requires --repo)",remediation:u.remediation,details:{defaultRepo:c?.defaultRepo??null,source:c?.source??null,persistedInConfig:c?.persistedInConfig??!1,harnessRoot:o.harnessRoot?mr(o.harnessRoot):null}})}return{id:"user_config",label:"User config (~/.kynver)",checks:s}}function L$(e){let t=e.loadConfig().agentOsId?.trim(),n=e.readCredentials(),o=e.envSnapshot(),s=e.credentialsFilePath(),i=B(s),a=o.kynverRunnerTokenPrefix,l=n.runnerTokenPrefix,c=n.runnerTokenAgentOsId,u=!!l&&(!t||!c||c===t),d=!!a?.startsWith("krc1.")||u&&l?.startsWith("krc1.");return{id:"runner_token",label:"Runner token readiness",checks:[{id:"runner_token_scoped",label:"Scoped runner token (krc1.*) ready",status:d?"pass":"fail",summary:d?a?"KYNVER_RUNNER_TOKEN is set (scoped prefix shown)":`Saved scoped token for agentOsId ${c??t??"(unknown)"}`:"No scoped runner token for the configured AgentOS workspace",remediation:d?void 0:"Run `kynver login` then `kynver runner credential --agent-os-id <id>` (or `kynver setup` with API key).",details:{source:a?"env":l?"credentials":"none",tokenPrefix:a??(u?l:void 0),agentOsId:t??c??null,credentialsPath:i}},{id:"runner_token_agent_os_match",label:"Saved runner token matches configured agentOsId",status:!l||!t||!c||c===t?"pass":"warn",summary:!l||!c?"No saved token agentOsId to compare":t?c===t?"Saved token scoped to configured agentOsId":`Saved token is for ${c}, config expects ${t}`:"Config agentOsId unset \u2014 token scope not validated against config",remediation:l&&t&&c&&c!==t?"`kynver runner credential --agent-os-id <configured-id>` to mint a workspace-bound token.":void 0,details:{configuredAgentOsId:t??null,savedAgentOsId:c??null}},{id:"runner_api_key_for_refresh",label:"API key available for token refresh",status:n.hasApiKey||process.env.KYNVER_API_KEY?.trim()?"pass":"warn",summary:n.hasApiKey||process.env.KYNVER_API_KEY?"KYNVER API key present for runner credential mint/refresh":"No API key \u2014 401 callback recovery cannot auto-mint a replacement token",remediation:n.hasApiKey||process.env.KYNVER_API_KEY?void 0:"Run `kynver login --api-key \u2026`.",details:{credentialsPath:i,hasApiKey:n.hasApiKey||!!process.env.KYNVER_API_KEY}}]}}function W$(e){return Ux(e,{envGithubToken:!!process.env.GITHUB_TOKEN?.trim(),envGhToken:!!process.env.GH_TOKEN?.trim(),ghAuthToken:()=>e.ghAuthToken()})}function B$(e){let r=e.harnessRoot(),t=Lx.join(r,"runs"),n=Lx.join(r,"worktrees"),o=mr(r),s=mr(t),i=mr(n),a=e.pathExists(t),l=e.pathExists(n);return{id:"harness_dirs",label:"Harness / daemon directories",checks:[{id:"harness_root",label:"Harness root resolved",status:"pass",summary:o,details:{harnessRoot:o}},{id:"harness_runs_dir",label:"Runs directory ready",status:a&&e.pathWritable(t)?"pass":"warn",summary:a?e.pathWritable(t)?`Writable ${s}`:`Exists but not writable: ${s}`:`Will be created on first run: ${s}`,remediation:a&&!e.pathWritable(t)?`Fix permissions on ${s} or set KYNVER_HARNESS_ROOT to a writable path.`:void 0,details:{runsDir:s,exists:a,writable:e.pathWritable(t)}},{id:"harness_worktrees_dir",label:"Worktrees directory ready",status:l&&e.pathWritable(n)?"pass":"warn",summary:l?e.pathWritable(n)?`Writable ${i}`:`Exists but not writable: ${i}`:`Will be created on first worker: ${i}`,remediation:l&&!e.pathWritable(n)?`Fix permissions on ${i}.`:void 0,details:{worktreesDir:i,exists:l,writable:e.pathWritable(n)}}]}}function F$(e){let r=e.loadConfig(),t=e.envSnapshot(),n=t.kynverApiUrl??r.apiBaseUrl?.trim()??t.openclawCronFireBaseUrl,o=!t.kynverApiUrl&&!r.apiBaseUrl&&!!t.openclawCronFireBaseUrl,s=t.openclawCronSecret||t.kynverRuntimeSecret,i=t.kynverRunnerTokenPrefix?.startsWith("krc1."),l=e.readCredentials().runnerTokenPrefix?.startsWith("krc1.");return{id:"callback_auth",label:"Callback auth / config",checks:[{id:"callback_base_url",label:"Callback base URL configured",status:n?o?"warn":"pass":"fail",summary:n?o?`Using legacy OPENCLAW_CRON_FIRE_BASE_URL (${n})`:n:"No KYNVER_API_URL, config apiBaseUrl, or legacy OpenClaw base URL",remediation:n?o?"Migrate to KYNVER_API_URL or `kynver setup --api-base-url` and drop OPENCLAW_CRON_FIRE_BASE_URL.":void 0:"Set KYNVER_API_URL or run `kynver setup --api-base-url https://\u2026`.",details:{source:t.kynverApiUrl?"KYNVER_API_URL":r.apiBaseUrl?"config.apiBaseUrl":t.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL":"none",baseUrl:n??null}},{id:"callback_auth_mode",label:"Callback auth uses scoped runner token",status:i||l?"pass":s?"warn":"fail",summary:i?"KYNVER_RUNNER_TOKEN scoped token will be sent as X-Kynver-Runner-Token":l?"Saved krc1.* token in ~/.kynver/credentials":s?"Deployment-level KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET in use (legacy headers)":"No callback secret configured",remediation:i||l?void 0:"Mint a scoped token: `kynver runner credential --agent-os-id <id>`. Avoid shared OPENCLAW_CRON_SECRET on user runners.",details:{mode:i||l?"scoped":s?"legacy_global_secret":"missing",legacyHeadersWhenNotScoped:["X-OpenClaw-Cron-Secret","X-Kynver-Runtime-Secret"]}}]}}function H$(e){let r=e.envSnapshot(),t=e.loadConfig(),n=e.readCredentials(),o=e.harnessRoot(),s=e.legacyOpenclawHarnessRoot(),i=mr(o),a=mr(s),l=r.opusHarnessRoot?mr(r.opusHarnessRoot):null,c=o===s&&e.pathExists(s),u=t.agentOsId?.trim(),d=r.kynverRunnerTokenPrefix,p=n.runnerTokenPrefix,f=n.runnerTokenAgentOsId,m=!!p&&(!u||!f||f===u),g=!!d?.startsWith("krc1.")||m&&!!p?.startsWith("krc1.");return{id:"openclaw_hotspots",label:"OpenClaw dependency hotspots",checks:[{id:"hotspot_legacy_harness_root",label:"Legacy ~/.openclaw/harness still active",status:c?"warn":"pass",summary:c?`Harness root is legacy ${a}`:r.opusHarnessRoot?`OPUS_HARNESS_ROOT override in use (${l})`:`Using ${i}`,remediation:c?"Set KYNVER_HARNESS_ROOT=~/.kynver/harness (or run setup), migrate artifacts, retire OPUS_HARNESS_ROOT.":r.opusHarnessRoot?"Prefer KYNVER_HARNESS_ROOT over OPUS_HARNESS_ROOT.":void 0,details:{harnessRoot:i,legacyRoot:a,opusHarnessRoot:l}},{id:"hotspot_openclaw_env_secrets",label:"OpenClaw deployment secrets in runner env",status:r.openclawCronSecret||r.openclawCronFireBaseUrl?"warn":"pass",summary:r.openclawCronSecret||r.openclawCronFireBaseUrl?[r.openclawCronSecret?"OPENCLAW_CRON_SECRET set":null,r.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL set":null].filter(Boolean).join("; "):"No OpenClaw cron env overrides on this runner",remediation:r.openclawCronSecret||r.openclawCronFireBaseUrl?"Move to KYNVER_API_URL + scoped runner tokens; unset OpenClaw cron env on user-hosted runners.":void 0},Tx(r,{agentOsId:u??null,apiBaseUrl:t.apiBaseUrl?.trim()??r.kynverApiUrl??null,hasScopedRunnerToken:g,deploymentSchedulerProvider:t.deploymentSchedulerProvider==="qstash"||t.deploymentSchedulerProvider==="kynver-cron"||t.deploymentSchedulerProvider==="openclaw-cron"?t.deploymentSchedulerProvider:void 0}),{id:"hotspot_lease_source_names",label:"Harness lease/completion source names",status:"pass",summary:"Runtime uses kynver-harness:* lease owners and completion source kynver-harness (OpenClaw names retired in runtime)",details:{leaseOwnerPattern:"kynver-harness:<runId>",completionSource:"kynver-harness",note:"OpenClaw adapter remains optional in packages/kynver-openclaw-agent-os only"}}]}}function Wx(e=Ox){let r=[M$(e),U$(e),L$(e),W$(e),B$(e),F$(e),Dx(e),H$(e)],t=D$(r),n=t.fail===0,o=n?t.warn>0?`Ready with ${t.warn} warning(s) \u2014 review remediation before retiring OpenClaw as primary runtime agent.`:"Ready \u2014 Kynver runtime can serve as primary runtime agent on this host.":`${t.fail} blocking check(s) \u2014 fix failures before OpenClaw takeover.`;return{command:"doctor runtime-takeover",ready:n,summary:o,counts:t,sections:r}}function Bx(e={}){let r=[];if(e.remediate===!0||e.remediate==="true"){let n=fo();n.updated?r.push(`Remediated config fields: ${n.fields.join(", ")}`):r.push("Config backfill: no unambiguous legacy fields to persist"),n.skippedAmbiguous.length>0&&r.push(`Skipped ambiguous identity: ${n.skippedAmbiguous.join("; ")}`)}if(e.remediateDefaultRepo===!0){let n=Vi();if(!n.ok){console.error(n.reason??"defaultRepo remediation failed"),n.remediation&&console.error(n.remediation),process.exitCode=1;return}n.remediated?r.push(`Remediated defaultRepo \u2192 ${n.resolved?.defaultRepo??"unknown"}`):r.push(`defaultRepo already persisted (${n.resolved?.defaultRepo??"unknown"})`)}let t=Wx();r.length>0&&(t.notes=[...t.notes??[],...r]),console.log(JSON.stringify(t,null,2)),t.ready||(process.exitCode=1)}A();import{existsSync as ds,readFileSync as Xx}from"node:fs";import{homedir as q$}from"node:os";import Ag from"node:path";import{spawnSync as Qx}from"node:child_process";Ee();var _g="24.11.0",us=">=24.11.0",K$=">=24.11.0 <25";function Cg(e){let r=e.trim().replace(/^v/,""),t=/^(\d+)\.(\d+)\.(\d+)$/.exec(r);return t?{major:Number(t[1]),minor:Number(t[2]),patch:Number(t[3])}:null}function Fx(e,r){return e.major!==r.major?e.major-r.major:e.minor!==r.minor?e.minor-r.minor:e.patch-r.patch}function $$(e){let r=e.trim().split(/\s+/),t=null,n=null;for(let o of r)if(o.startsWith(">="))t=Cg(o.slice(2));else if(o.startsWith("<")){let s=o.slice(1);n=Cg(s)??(/^\d+$/.test(s)?{major:Number(s),minor:0,patch:0}:null)}if(!t)throw new Error(`Unsupported node policy range: ${e}`);return{floor:t,below:n}}function Ln(e,r=us){let{floor:t,below:n}=$$(r),o=Cg(e);if(!o)return{status:"invalid_version",currentVersion:e.trim(),requiredRange:r,remediation:`Node version could not be parsed as X.Y.Z (prereleases are unsupported). Install Node ${_g} or a later release within the supported range.`};let s=`${o.major}.${o.minor}.${o.patch}`;return Fx(o,t)<0?{status:"upgrade_required",currentVersion:s,requiredRange:r,remediation:`Upgrade Node to >=${_g}. See docs/runbooks/node-24-fleet-migration.md for the per-host procedure.`}:n&&Fx(o,n)>=0?{status:"unsupported_major",currentVersion:s,requiredRange:r,remediation:`Node ${o.major}.x is newer than this artifact's qualified range (${r}). Use a qualified Node major or wait for the next runtime qualification.`}:{status:"compatible",currentVersion:s,requiredRange:r,remediation:null}}Ye();import jx from"node:os";Ye();var Eg={agentOsId:"<WORKSPACE_ID>",agentOsSlug:"<WORKSPACE_SLUG>",boxId:"<BOX_ID>",runnerId:"<RUNNER_ID>",tokenAgentOsId:"<WORKSPACE_ID>",configAgentOsId:"<WORKSPACE_ID>"},Kx=new Set(Object.keys(Eg));function j$(e){return e.startsWith("~")&&(e.length===1||e[1]==="/"||e[1]==="\\")?e.includes("/.kynver/")||e.includes("daemon-heartbeat"):e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e)||e.includes("/Users/")||e.includes("/home/")||e.includes("\\Users\\")}function wg(e,r,t){if(typeof e=="string"&&t&&Kx.has(t)&&e.trim()){r.set(e.trim(),Eg[t]??"<WORKSPACE_ID>");return}if(Array.isArray(e)){for(let n of e)wg(n,r);return}if(e&&typeof e=="object")for(let[n,o]of Object.entries(e))wg(o,r,n)}function Hx(e,r){let t=e;for(let[n,o]of r)n&&(t=t.split(n).join(o));return t}function xg(e,r,t){if(typeof e=="string"){let n=Hx(e,r);return t&&Kx.has(t)?Eg[t]??"<WORKSPACE_ID>":(j$(n)&&(n=Hx(mr(n),r)),n)}if(Array.isArray(e))return e.map(n=>xg(n,r));if(e&&typeof e=="object"){let n={};for(let[o,s]of Object.entries(e))n[o]=xg(s,r,o);return n}return e}function $x(e){let r=new Map;return wg(e,r),xg(e,r)}var V$="Totalsolutionsync/kynver-feedback",ua="https://github.com/Totalsolutionsync/kynver-feedback",Vx=`${ua}/issues`,G$=`${ua}/issues/new/choose`,Pg=`${ua}/issues/new?template=install_bug.yml`,Og=`${ua}/issues/new?template=product_bug.yml`,Y$="https://www.kynver.com/help/bug-reports",Gx=!1;function J$(){return{autoSubmit:Gx,meaning:"kynver report-bug does NOT send anything to Kynver or GitHub. It only runs doctor locally and prints a draft. The bug is reported only after a human or agent manually creates a public GitHub issue.",destinationAfterIssueCreated:Vx,githubRepo:V$,installTemplateUrl:Pg,productTemplateUrl:Og,triage:"Kynver operators watch github.com/Totalsolutionsync/kynver-feedback/issues. There is no in-app admin queue for these reports."}}function Yx(){let e=J$();return{repoUrl:ua,issuesUrl:Vx,newIssueUrl:G$,installTemplateUrl:Pg,productTemplateUrl:Og,helpUrl:Y$,cliCommand:"kynver report-bug --json",instructions:[e.meaning,"Install/runtime problems: open installTemplateUrl and paste issueBodyDraft.","Other product bugs: open productTemplateUrl instead.","Do not paste API keys, runner tokens (krc1.*), or .env secrets. Workspace ids, box ids, and home paths are redacted in this draft by default.","Account access gating (403) is not a bug \u2014 use https://www.kynver.com/agent-os/early-access."].join(" "),agentSteps:["Run `kynver report-bug --json` on the user's machine. Read `submission.autoSubmit` (always false) \u2014 do not tell the user the report was sent.","Read `issueBodyDraft` and `submission.installTemplateUrl` / `submission.productTemplateUrl`.","Create the GitHub issue yourself OR hand the user the draft + URL to paste manually.",'Install/runtime bugs: `gh issue create --repo Totalsolutionsync/kynver-feedback --title "[install] <short summary>" --body-file <draft.txt>` (requires GitHub auth on the machine).',"After the issue exists, the report lives at submission.destinationAfterIssueCreated \u2014 Kynver triages from GitHub Issues, not from this CLI.","If GitHub auth is unavailable, show the user issueBodyDraft and newIssueUrl; the report is not filed until they submit the GitHub form."],submission:e}}function Jx(e){let r=Yx(),t=r.submission,n={runtimeVersion:Fe,nodeVersion:process.version,platform:process.platform,arch:process.arch},o=[e.message?.trim()?`## Summary
+`),diagnostic:ae(r)}}if(e.scope==="run"&&e.action==="status"){let t=r.workers;return Array.isArray(t)&&t.length===1?ia(t[0]):{primary:`Harness run status \xB7 ${r.runId??"run"} (${Array.isArray(t)?t.length:0} workers).`,diagnostic:ae(r)}}return{primary:`Harness ${e.scope} ${e.action} completed successfully on the runner.`,diagnostic:ae(r)}}import y$ from"node:path";M();oe();x();oe();x();function Bu(e){let{worker:r,status:t,taskLease:n}=e,o=n?.leaseOwner??null;if(r.dispatched&&n){if(n.status==="running"&&o&&!Ap(o,r.runId))return{health:"orphaned",reason:`task lease held by ${o}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=n.leaseToken?.trim()??"";if(n.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(n.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(t.attention.state==="stale")return{health:"stale",reason:t.attention.reason};let s=t.lastHeartbeatAt?Date.parse(t.lastHeartbeatAt):NaN;return t.alive&&Number.isFinite(s)&&Date.now()-s>no?{health:"stale",reason:`heartbeat older than ${Math.floor(no/1e3)}s`}:t.alive&&r.pid&&!G(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:n?.status==="running"&&!t.alive&&t.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:t.attention.reason||"worker within expected lifecycle bounds"}}Ce();x();import{existsSync as fx,mkdirSync as g$,readdirSync as h$,unlinkSync as k$}from"node:fs";import hg from"node:path";function gx(){let{harnessRoot:e}=Vt(),r=hg.join(e,"monitors");return g$(r,{recursive:!0}),r}function Nn(e,r){return r?`${w(e)}--${w(r)}`:w(e)}function kg(e){return hg.join(gx(),`${e}.json`)}function Dn(e){return P(kg(e),void 0)}function Mn(e){ue(kg(e.monitorId),e)}function yg(e){let r=kg(e);return fx(r)?(k$(r),!0):!1}function hx(){let e=gx();if(!fx(e))return[];let r=[];for(let t of h$(e)){if(!t.endsWith(".json"))continue;let n=P(hg.join(e,t),void 0);n?.monitorId&&r.push({monitorId:n.monitorId,runId:n.runId,workerName:n.workerName,agentOsId:n.agentOsId,pid:n.pid,alive:n.pid?G(n.pid):!1,startedAt:n.startedAt,pollMs:n.pollMs,logPath:n.logPath})}return r.sort((t,n)=>t.startedAt.localeCompare(n.startedAt))}oe();function aa(e){let{worker:r,status:t}=e,n=[];r.localOnly&&n.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&n.push("missing agentOsId/taskId linkage"),jl(r)&&n.push("completion already acknowledged"),r.completionBlocker&&n.push(r.completionBlocker),t.heartbeatBlocker&&t.alive&&n.push(`worker heartbeat blocker: ${t.heartbeatBlocker}`),t.attention.state==="blocked"&&n.push(t.attention.reason||"worker attention blocked"),Xt(t)&&n.push(t.attention.reason||"landing gate blocked");let o=he(t),s;return o?t.finalResult?s="final_result":t.alive?s="terminal_status":s="process_exited":n.push("worker has not reached a terminal condition"),{eligible:o&&n.length===0,terminalVerified:o,terminalReason:s,blockers:n}}function kx(e,r){return P(y$.join(T(e),"workers",w(r),"worker.json"),void 0)}function yx(e,r){let t=$(e),n=Object.keys(t.workers||{});if(!r)return n;let o=w(r);return n.filter(s=>w(s)===o)}function Rx(e,r){let t=$(e.runId),n=L(e,{base:t.base,baseCommit:t.baseCommit}),o=e.taskId?r.get(e.taskId)??null:null,s=Bu({worker:e,status:n,taskLease:o}),i=aa({worker:e,status:n});return{runId:e.runId,worker:e.name,health:s.health,healthReason:s.reason,workerStatus:n.status,attentionState:n.attention.state,attentionReason:n.attention.reason,alive:n.alive,taskId:e.taskId,leaseOwner:o?.leaseOwner??void 0,taskStatus:o?.status,autoComplete:i,status:n}}async function Un(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=e.agentOsId?String(e.agentOsId):void 0,o=$(r),s=yx(r,t),i=[];for(let m of s){let g=kx(r,m);g&&i.push(g)}let a=n||i.map(m=>m.agentOsId).find(m=>typeof m=="string"&&m.trim())||void 0,l=i.map(m=>m.taskId).filter(m=>!!m),c=await Eo({agentOsId:a,taskIds:l,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0}),u=i.map(m=>Rx(m,c)),d;a&&e.renewLeases!==!1&&e.renewLeases!=="false"&&(d=await Ul(r,{...e,agentOsId:a}));let p=[];if(e.autoComplete===!0||e.autoComplete==="true")for(let m of u){if(!m.autoComplete.eligible){p.push({worker:m.worker,outcome:"skipped",ok:!1,reason:m.autoComplete.blockers.join("; ")||"not eligible"});continue}let g=await Rn({run:r,name:m.worker,...a?{agentOsId:a}:{},...e.baseUrl?{baseUrl:String(e.baseUrl)}:{},...e.secret?{secret:String(e.secret)}:{}});p.push({worker:m.worker,outcome:g.outcome,ok:g.outcome==="completed",reason:g.reason})}return{runId:r,agentOsId:a,workers:u,leaseRenewal:d,autoCompleted:p}}function Fu(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=yx(r,t),o=[];for(let s of n){let i=kx(r,s);i&&o.push(Rx(i,new Map))}return{runId:r,workers:o,autoCompleted:[]}}function la(){return hx()}function Rg(e){let r=String(e.run||"");V(r,"--run");let t=Nn(r,e.name?String(e.name):void 0),n=Dn(t);if(!n)return{monitorId:t,stopped:!1};if(n.pid&&G(n.pid))try{process.kill(n.pid,"SIGTERM")}catch{}return n.stoppedAt=new Date().toISOString(),Mn(n),yg(t),{monitorId:t,stopped:!0,pid:n.pid}}async function Hu(e){let r=String(e.run||""),t=String(e.name||"");V(r,"--run"),V(t,"--name");let n=Ae(r,t),o=$(r),s=L(n,{base:o.base,baseCommit:o.baseCommit}),i=aa({worker:n,status:s});if(!i.eligible){console.log(JSON.stringify({runId:r,worker:t,outcome:"blocked",blockers:i.blockers,terminalVerified:i.terminalVerified},null,2)),process.exitCode=1;return}let a=await Rn({...e,run:r,name:t});console.log(JSON.stringify(a,null,2)),a.outcome!=="completed"&&a.outcome!=="blocked"&&(process.exitCode=1)}x();var R$=5e3,v$=360*60*1e3;async function vg(e){let r=String(e.monitorId||""),t=Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):R$,n=Number(e.maxTotalMs)>0?Math.floor(Number(e.maxTotalMs)):v$,o=Date.now();for(;Date.now()-o<=n;){let s=r?Dn(r):void 0;if(s?.stoppedAt)break;let i=await Un({...e,autoComplete:e.autoComplete??!0,renewLeases:e.renewLeases??!0}),a=cs({monitorId:r,phase:"tick",...i});if(console.log(a.primary),a.diagnostic&&console.error(`[monitor diagnostic] ${a.diagnostic}`),i.workers.length>0&&i.workers.every(c=>c.autoComplete.terminalVerified&&(c.autoComplete.eligible||c.autoComplete.blockers.some(u=>u.includes("already acknowledged"))))&&i.autoCompleted.every(c=>c.ok||c.outcome==="skipped")){r&&s&&(s.stoppedAt=new Date().toISOString(),Mn(s));break}Bt(t)}}x();Ce();import{spawn as b$}from"node:child_process";import{closeSync as vx,existsSync as S$,openSync as _$}from"node:fs";import C$ from"node:path";function Ku(e){let r=e.nodeExecutable??process.execPath,t=Co({importMetaUrl:import.meta.url,explicitCliPath:e.cliPath,nodeExecutable:r});if(!t)return;let n=t.cliPath;if(!S$(n))return;let o=Nn(e.runId,e.workerName),{harnessRoot:s}=Vt(),i=C$.join(s,"monitors",`${o}.log`),a;try{a=_$(i,"a")}catch{a=void 0}let l=e.pollMs??5e3,c=[...t.argsPrefix,"monitor","run-loop","--run",e.runId,"--monitor-id",o,"--poll-ms",String(l),"--auto-complete","true","--renew-leases","true"];e.workerName&&c.push("--name",e.workerName),e.agentOsId&&c.push("--agent-os-id",e.agentOsId),e.baseUrl&&c.push("--base-url",e.baseUrl),e.secret&&c.push("--secret",e.secret);let u=["ignore",a??"ignore",a??"ignore"];try{let d=b$(t.command,c,fe({detached:!0,stdio:u,env:process.env}));a!==void 0&&vx(a),d.unref();let p={monitorId:o,runId:e.runId,workerName:e.workerName,agentOsId:e.agentOsId,pid:d.pid,startedAt:new Date().toISOString(),pollMs:l,logPath:i};return Mn(p),{monitorId:o,pid:d.pid,logPath:i,session:p}}catch{if(a!==void 0)try{vx(a)}catch{}return}}x();async function bx(e){let r=String(e.run||"");V(r,"--run");let t=e.name?String(e.name):void 0,n=Nn(r,t),o=Dn(n);if(o?.pid&&!o.stoppedAt)return{monitorId:n,session:o,spawned:!1,pid:o.pid};let s=Ku({runId:r,workerName:t,agentOsId:e.agentOsId?String(e.agentOsId):void 0,pollMs:Number(e.pollMs)>0?Math.floor(Number(e.pollMs)):void 0,baseUrl:e.baseUrl?String(e.baseUrl):void 0,secret:e.secret?String(e.secret):void 0});if(!s)throw new Error("failed to spawn monitor sidecar (cli.js missing or spawn error)");return{monitorId:n,session:s.session,spawned:!0,pid:s.pid}}async function Sx(e){if(String(e.run||"")){let t=e.tick===!0||e.tick==="true"?await Un({...e,autoComplete:!1}):Fu(e);console.log(JSON.stringify(t,null,2));return}console.log(JSON.stringify({monitors:la()},null,2))}function _x(e){console.log(JSON.stringify(Rg(e),null,2))}function Cx(){console.log(JSON.stringify({monitors:la()},null,2))}async function wx(e){await vg(e)}async function xx(e){let r=await Un(e);console.log(JSON.stringify(r,null,2))}M();oe();x();A();import w$ from"node:path";function ca(e,r,t,n,o,s){return{runId:e,worker:r,taskId:t,agentOsId:n,leaseOwner:o,action:"skipped",reason:s}}async function x$(e){let r=U(e.baseUrl?String(e.baseUrl):void 0),t=e.agentOsId?String(e.agentOsId).trim():null,n=e.dryRun===!0||e.dryRun==="true",o=[],s=[],i=[];for(let a of ne())for(let l of Object.keys(a.workers??{})){let c=w$.join(T(a.id),"workers",w(l),"worker.json"),u=P(c,void 0);if(!u){s.push(ca(a.id,l,"","","","worker.json missing"));continue}let d=u.taskId??"",p=u.agentOsId??"",f=u.leaseOwner??"";if(!u.dispatched||!d||!p||!f){s.push(ca(a.id,l,d,p,f,"not a fully-leased dispatched worker"));continue}if(t&&p!==t)continue;if(u.completionReportedAt){s.push(ca(a.id,l,d,p,f,"completion already reported"));continue}let m=L(u);if(m.finalResult){s.push(ca(a.id,l,d,p,f,"has final result \u2014 let pipeline tick complete it"));continue}if(m.alive){s.push(ca(a.id,l,d,p,f,"worker process is still alive"));continue}if(n){o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"released",reason:"dry-run: would release dead dispatched worker lease"});continue}try{let g=await J(e.secret?String(e.secret):void 0,p,{baseUrl:r}),y=`${r}/api/agent-os/by-id/${encodeURIComponent(p)}/tasks/${encodeURIComponent(d)}/release`,R=await te(y,g,{agentOsId:p,leaseOwner:f,...u.leaseToken?.trim()?{leaseToken:u.leaseToken.trim()}:{}},{agentOsId:p,baseUrl:r});R.ok===!0||R.response?.ok===!0?o.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"released",reason:"dead dispatched worker lease released; task requeued"}):s.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"skipped",reason:`release returned ok:false (likely owner mismatch or already released): HTTP ${R.status}`})}catch(g){i.push({runId:a.id,worker:l,taskId:d,agentOsId:p,leaseOwner:f,action:"error",reason:g.message})}}return{dryRun:n,released:o,skipped:s,errors:i}}async function Ex(e){let r=await x$(e),t={ok:r.errors.length===0,dryRun:r.dryRun,released:r.released.length,skipped:r.skipped.length,errors:r.errors.length,details:r};console.log(JSON.stringify(t,null,2)),r.errors.length>0&&process.exit(1)}il();import Lx from"node:path";Ye();A();import{accessSync as E$,constants as P$,existsSync as Sg,readFileSync as O$}from"node:fs";import{homedir as $u}from"node:os";import ju from"node:path";import{spawnSync as A$}from"node:child_process";Ce();function bg(e,r){try{let t=A$(e,r,{encoding:"utf8"}),n=(t.stdout||"").trim(),o=(t.stderr||"").trim();return{ok:t.status===0,stdout:n,stderr:o,error:t.error?.message}}catch(t){return{ok:!1,stdout:"",stderr:"",error:t.message}}}function Px(e){let r=e?.trim();if(r)return r.length<=12?`${r}\u2026`:`${r.slice(0,12)}\u2026`}function I$(e){if(!Sg(e))return!1;try{return E$(e,P$.W_OK),!0}catch{return!1}}var Ox={packageVersion:()=>Fe,commandOnPath:e=>bg(process.platform==="win32"?"where":"which",[e]),kynverVersion:e=>bg(e,["--version"]),loadConfig:()=>v(),configFilePath:()=>ju.join($u(),".kynver","config.json"),credentialsFilePath:()=>ju.join($u(),".kynver","credentials"),readCredentials:()=>{let e=ju.join($u(),".kynver","credentials");if(!Sg(e))return{hasApiKey:!1};try{let r=JSON.parse(O$(e,"utf8"));return{hasApiKey:!!r.apiKey?.trim(),runnerTokenPrefix:Px(r.runnerToken),runnerTokenAgentOsId:r.runnerTokenAgentOsId}}catch{return{hasApiKey:!1}}},envSnapshot:()=>({kynverApiUrl:process.env.KYNVER_API_URL?.trim()||void 0,openclawCronFireBaseUrl:process.env.OPENCLAW_CRON_FIRE_BASE_URL?.trim()||void 0,kynverRunnerTokenPrefix:Px(process.env.KYNVER_RUNNER_TOKEN),kynverRuntimeSecret:!!process.env.KYNVER_RUNTIME_SECRET?.trim(),openclawCronSecret:!!process.env.OPENCLAW_CRON_SECRET?.trim(),kynverHarnessRoot:process.env.KYNVER_HARNESS_ROOT?.trim()||void 0,opusHarnessRoot:process.env.OPUS_HARNESS_ROOT?.trim()||void 0,kynverSchedulerProvider:process.env.KYNVER_SCHEDULER_PROVIDER?.trim()||void 0,openclawCronStorePath:!!(process.env.KYNVER_CRON_STORE_PATH?.trim()||process.env.OPENCLAW_CRON_STORE_PATH?.trim()),kynverCronDaemonPrimary:uu(),qstashTokenPresent:!!process.env.QSTASH_TOKEN?.trim(),kynverHostedDeployment:(()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"})()}),harnessRoot:()=>ge(),legacyOpenclawHarnessRoot:()=>ju.join($u(),".openclaw","harness"),pathExists:e=>Sg(e),pathWritable:e=>I$(e),ghAuthToken:()=>bg("gh",["auth","token"]),deployEvidenceNeedsGithub:()=>{let e=process.env.KYNVER_HOSTED_DEPLOYMENT?.trim().toLowerCase();return!(e==="1"||e==="true"||e==="yes")}};function Ax(e,r){return e.kynverSchedulerProvider==="openclaw-cron"||r.deploymentSchedulerProvider==="openclaw-cron"}function T$(e,r){return e.kynverSchedulerProvider==="kynver-cron"||r.deploymentSchedulerProvider==="kynver-cron"}function Ix(e){return!!e.openclawCronStorePath}function N$(e,r){return e.kynverSchedulerProvider==="qstash"||r.deploymentSchedulerProvider==="qstash"}function Tx(e,r){let t={schedulerProvider:e.kynverSchedulerProvider??null,deploymentSchedulerProvider:r.deploymentSchedulerProvider??null,openclawCronStorePath:!!e.openclawCronStorePath,kynverCronDaemonPrimary:!!e.kynverCronDaemonPrimary},n=!!r.agentOsId?.trim()&&!!r.apiBaseUrl?.trim()&&r.hasScopedRunnerToken;if(N$(e,r)&&!Ax(e,r)){let u=e.kynverSchedulerProvider==="qstash"?"KYNVER_SCHEDULER_PROVIDER=qstash on this host":"deploymentSchedulerProvider=qstash in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler cut over to QStash (${u})`,details:t}}if(T$(e,r)&&!Ax(e,r)){if(Ix(e)&&e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let u=e.kynverSchedulerProvider==="kynver-cron"?"KYNVER_SCHEDULER_PROVIDER=kynver-cron on this host":"deploymentSchedulerProvider=kynver-cron in ~/.kynver/config.json";return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`AgentOS scheduler owned by Kynver Cron (${u})`,details:t}}if(Ix(e)){if(e.kynverCronDaemonPrimary&&n)return{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"Kynver Cron local store present; `kynver daemon` owns schedule fires (kynver-cron tick loop)",details:{...t,dispatchPath:"kynver-daemon-cron-tick",kynverCronDaemonPrimary:!0}};let u=[];return e.openclawCronStorePath&&u.push("KYNVER_CRON_STORE_PATH or OPENCLAW_CRON_STORE_PATH set (local cron store)"),{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Local cron store without daemon tick (${u.join("; ")})`,remediation:"Run `kynver daemon` with KYNVER_CRON_SECRET + KYNVER_API_URL (or KYNVER_CRON_FIRE_BASE_URL) so the daemon-owned cron tick fires schedules. On hosted deploys use QStash (KYNVER_SCHEDULER_PROVIDER=qstash). Legacy OpenClaw cron env aliases still work during cutover.",details:t}}let o=e.kynverSchedulerProvider==="openclaw-cron",s=r.deploymentSchedulerProvider==="openclaw-cron",i=e.kynverSchedulerProvider==="qstash",a=!!e.qstashTokenPresent||!!e.kynverHostedDeployment,l=a&&!n,c=l&&e.kynverSchedulerProvider==="openclaw-cron";return s&&!o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"deploymentSchedulerProvider=openclaw-cron in ~/.kynver/config.json \u2014 migrate to kynver-cron or qstash",remediation:'Run `kynver scheduler attest-cutover` or set deploymentSchedulerProvider to "kynver-cron" or "qstash" in ~/.kynver/config.json.',details:t}:n&&o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 dispatch is owned by kynver daemon; unset the OpenClaw override",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:n?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:i?"Runner override qstash present; hosted dispatch still owned by kynver daemon pipeline-tick":"Hosted dispatch owned by kynver daemon (pipeline-tick \u2192 operator/tick); no OpenClaw cron on runner",details:{schedulerProvider:e.kynverSchedulerProvider??null,dispatchPath:"kynver-daemon-pipeline-tick",hostedDeployment:a}}:o?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"KYNVER_SCHEDULER_PROVIDER=openclaw-cron on this runner \u2014 hosted dispatch still depends on the OpenClaw local-cron adapter",remediation:"Unset KYNVER_SCHEDULER_PROVIDER on user runners (or set kynver-cron). Use `kynver daemon` (pipeline-tick \u2192 operator/tick). On the Kynver server set KYNVER_SCHEDULER_PROVIDER=qstash when QStash is configured.",details:{schedulerProvider:e.kynverSchedulerProvider??null,hostedDeployment:a}}:c?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment has KYNVER_SCHEDULER_PROVIDER=openclaw-cron \u2014 AgentOS scheduled ticks should use QStash or kynver-cron",remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server (or kynver-cron for Kynver-owned local scheduling). User runners use `kynver daemon` for dispatch and should not set a scheduler provider.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:l&&e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"QSTASH_TOKEN present; hosted scheduler auto-selects qstash (explicit KYNVER_SCHEDULER_PROVIDER=qstash optional)",details:{schedulerProvider:null,qstashTokenPresent:!0,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&!e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:"Hosted deployment with no QSTASH_TOKEN and no KYNVER_SCHEDULER_PROVIDER \u2014 kynver-cron is an in-process stub here and will NOT fire; no firing scheduler is configured",remediation:"Set QSTASH_TOKEN + KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server for hosted AgentOS schedules. Only use kynver-cron when a `kynver daemon` (or local cron store) actually owns firing on this box.",details:{schedulerProvider:null,resolvedFallback:"none",qstashTokenPresent:!1,hostedDeployment:a}}:l&&!e.qstashTokenPresent&&e.kynverSchedulerProvider&&e.kynverSchedulerProvider!=="qstash"&&e.kynverSchedulerProvider!=="kynver-cron"?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"warn",summary:`Hosted deployment without QSTASH_TOKEN (KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}) \u2014 use qstash or kynver-cron`,remediation:"Set QSTASH_TOKEN and KYNVER_SCHEDULER_PROVIDER=qstash on the Kynver server, or kynver-cron for Kynver-owned local scheduling. User runners use `kynver daemon` for dispatch.",details:{schedulerProvider:e.kynverSchedulerProvider??null,qstashTokenPresent:e.qstashTokenPresent??!1,hostedDeployment:a}}:e.kynverSchedulerProvider?{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:`KYNVER_SCHEDULER_PROVIDER=${e.kynverSchedulerProvider}`,details:{schedulerProvider:e.kynverSchedulerProvider??null}}:{id:"hotspot_openclaw_scheduler",label:"Scheduler provider (runtime daemon vs OpenClaw cron)",status:"pass",summary:"No KYNVER_SCHEDULER_PROVIDER on runner (expected) \u2014 finish runner setup so daemon pipeline-tick owns dispatch",details:{schedulerProvider:null,dispatchPath:"kynver-daemon-pipeline-tick-pending"}}}hr();Ms();tn();nl();Yd();function Nx(e,r={}){let t=lo(),n=ol(e,t),o=[],s=r.envFilePath??we,i=sl(e,{envFilePath:s,systemdUnitActive:r.systemdUnitActive});if(o.push({id:"daemon_supervision_owner",ok:!!e.daemonSupervisionOwner||i.effectivelyConfigured,summary:e.daemonSupervisionOwner?`daemonSupervisionOwner=${e.daemonSupervisionOwner} (${t})`:i.owner?`daemonSupervisionOwner inferred as ${i.owner} from healthy supervision signals \u2014 run \`kynver setup\` to persist`:"daemonSupervisionOwner unset \u2014 run `kynver setup` to persist Kynver-owned restart policy",remediation:e.daemonSupervisionOwner||i.effectivelyConfigured?e.daemonSupervisionOwner?void 0:"Run `kynver setup` or `kynver doctor runtime-takeover --remediate` to persist daemonSupervisionOwner.":"Run `kynver setup` (or `kynver bootstrap`) on this box."}),o.push({id:"daemon_present_signal",ok:i.daemonPresentSignal||i.systemdUnitActive,summary:i.systemdUnitActive?"systemd user unit active \u2014 local daemon supervision is healthy":i.daemonPresentSignal?`KYNVER_CRON_DAEMON_PRESENT=1 (persisted in ${s})`:`KYNVER_CRON_DAEMON_PRESENT not set in persisted env (${s})`,remediation:i.daemonPresentSignal||i.systemdUnitActive?void 0:"Run `kynver setup` or `kynver start` once to write ~/.kynver/.env supervision keys."}),n==="systemd"){let l=co();o.push({id:"systemd_user_unit",ok:l,summary:l?"systemd user unit present (~/.config/systemd/user/kynver-cron-daemon.service)":"daemonSupervisionOwner=systemd but user unit missing",remediation:l?void 0:"Run `kynver start --install-systemd` or `kynver cron install --install-systemd`."})}let a=Vd(t,n);return o.push({id:"supervision_guidance",ok:!0,summary:a[0]??"Kynver keeper supervises daemon restarts by default."}),o}Ms();tn();function Dx(e){let r=e.loadConfig(),t=lo(),n=ol(r,t),s=Nx(r,{systemdUnitActive:e.systemdDaemonActive}).map(i=>({id:i.id,label:i.id.replace(/_/g," "),status:i.ok?"pass":i.id==="daemon_supervision_owner"||i.id==="daemon_present_signal"?"warn":"fail",summary:i.summary,remediation:i.remediation}));return s.push({id:"daemon_keeper_default",label:"Kynver keeper owns in-process restarts",status:n==="keeper"||n==="systemd"?"pass":"warn",summary:n==="systemd"?"systemd persists the keeper parent \u2014 Hermes/OpenClaw cron is not required to restart the daemon":"`kynver start` / `kynver daemon` run the keeper by default (opt out with --no-supervise only when an external supervisor owns restarts)",details:{owner:n,hostKind:t}}),{id:"daemon_supervision",label:"Daemon restart supervision",checks:s}}function Mx(e){if(e.envGithubToken)return{viable:!0,source:"env",summary:"GITHUB_TOKEN present for GitHub commit-status evidence"};if(e.envGhToken)return{viable:!0,source:"env",summary:"GH_TOKEN present for GitHub commit-status evidence"};let r=e.ghAuthToken();return r.ok&&r.stdout.trim().length>0?{viable:!0,source:"gh-cli",summary:"GitHub CLI authenticated (`gh auth login`) for commit-status evidence"}:{viable:!1,source:"missing",summary:"No GITHUB_TOKEN/GH_TOKEN and `gh auth token` unavailable"}}function Ux(e,r){let t=e.commandOnPath("vercel"),n=t.ok,o=!!process.env.VERCEL_TOKEN?.trim(),s=Mx(r),i=e.deployEvidenceNeedsGithub?.()??!0,a=[{id:"vercel_global_cli_absent",label:"Global Vercel CLI not installed",status:n?"warn":"pass",summary:n?`Global Vercel CLI on PATH (${t.stdout||"vercel"}) \u2014 Vercel is decommissioned; nothing should call it`:"No global Vercel CLI on PATH",remediation:n?"Uninstall the global Vercel CLI (`npm uninstall -g vercel`) \u2014 Vercel was decommissioned in the 2026-08 Railway cutover; deploy evidence comes from production /api/version + GitHub.":void 0,details:{path:n&&t.stdout||null}}];return i?a.push({id:"github_token_for_deploy_evidence",label:"GitHub token for deploy evidence",status:s.viable?"pass":"warn",summary:s.viable?s.summary:"No GitHub auth \u2014 deploy-evidence lookups (commit status, production /api/version ancestry compare) need GITHUB_TOKEN/GH_TOKEN or `gh auth login`",remediation:s.viable?void 0:"Export GITHUB_TOKEN (or GH_TOKEN) or run `gh auth login` for PR commit-status and ancestry lookups.",details:{source:s.source}}):a.push({id:"github_token_for_deploy_evidence",label:"GitHub token for deploy evidence",status:"pass",summary:"Skipped \u2014 no enabled workflow on this host requires GitHub deploy evidence",details:{skipped:!0,reason:"workflow_not_enabled"}}),a.push({id:"vercel_token_absent",label:"No stale VERCEL_TOKEN",status:o?"warn":"pass",summary:o?"VERCEL_TOKEN is set but obsolete \u2014 Vercel is decommissioned; nothing reads it":"VERCEL_TOKEN not set (Vercel decommissioned)",remediation:o?"Revoke the token in the Vercel dashboard and remove VERCEL_TOKEN from this host's environment.":void 0,details:{vercelTokenPresent:o}}),{id:"deploy_evidence",label:"Deploy evidence (Railway era)",checks:a}}function D$(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function M$(e){let r=e.packageVersion(),t=e.commandOnPath("kynver"),n=t.ok&&t.stdout.length>0,o=n?t.stdout.split(/\r?\n/)[0]?.trim():void 0,s=o?B(o):void 0,i=[{id:"cli_running_version",label:"Running @kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${r}`,details:{version:r}},{id:"cli_on_path",label:"kynver executable on PATH",status:n?"pass":"warn",summary:n?`Found ${s}`:"kynver not found on PATH (invoked via node/npx?)",remediation:n?void 0:"Install globally (`npm i -g @kynver-app/runtime`) or invoke via `npx @kynver-app/runtime`.",details:{path:s}}];if(n&&o){let a=e.kynverVersion(o),l=a.stdout.replace(/^kynver\s+/i,"").trim()||void 0,c=a.ok&&(!l||l===r);i.push({id:"cli_installed_version",label:"Installed kynver CLI version matches running package",status:c?"pass":"warn",summary:a.ok&&l?c?`Installed ${l}`:`Installed ${l} differs from running ${r}`:a.error?`Could not read installed version (${a.error})`:a.stderr||"Could not read installed version",remediation:c?void 0:"Reinstall or rebuild @kynver-app/runtime so PATH kynver matches the harness worktree version.",details:{installedVersion:l,runningVersion:r,path:s}})}return{id:"cli_package",label:"CLI / package",checks:i}}function U$(e){let r=e.configFilePath(),t=B(r),n=e.pathExists(r),o=e.loadConfig(),s=[{id:"config_file",label:"~/.kynver/config.json present",status:n?"pass":"fail",summary:n?`Found ${t}`:`Missing ${t}`,remediation:n?void 0:"Run `kynver setup --api-base-url <url> --agent-os-id <id> --repo <path>`.",details:{configPath:t}}];if(n){let i=o.apiBaseUrl?.trim(),a=o.agentOsId?.trim(),l=Ze({config:o}),c=l?Ho(l):null,u=sC(l);s.push({id:"config_api_base_url",label:"Default API base URL",status:i?"pass":"warn",summary:i??"Not set in config (KYNVER_API_URL / --base-url required per command)",remediation:i?void 0:"Set `apiBaseUrl` via `kynver setup --api-base-url https://\u2026`.",details:{apiBaseUrl:i??null}},{id:"config_agent_os_id",label:"Default AgentOS id",status:a?"pass":"warn",summary:a??"Not set (pass --agent-os-id on daemon/dispatch/worker commands)",remediation:a?void 0:"Set `agentOsId` via `kynver setup --agent-os-id <uuid>`.",details:{agentOsId:a??null,agentOsSlug:o.agentOsSlug??null}},{id:"config_default_repo",label:"Default repo path",status:u.status,summary:l?l.persistedInConfig?`${c.defaultRepo} (config)`:`${c.defaultRepo} (${l.source}, not persisted in ~/.kynver/config.json)`:"Not set in ~/.kynver/config.json (`kynver run create` requires --repo)",remediation:u.remediation,details:{defaultRepo:c?.defaultRepo??null,source:c?.source??null,persistedInConfig:c?.persistedInConfig??!1,harnessRoot:o.harnessRoot?mr(o.harnessRoot):null}})}return{id:"user_config",label:"User config (~/.kynver)",checks:s}}function L$(e){let t=e.loadConfig().agentOsId?.trim(),n=e.readCredentials(),o=e.envSnapshot(),s=e.credentialsFilePath(),i=B(s),a=o.kynverRunnerTokenPrefix,l=n.runnerTokenPrefix,c=n.runnerTokenAgentOsId,u=!!l&&(!t||!c||c===t),d=!!a?.startsWith("krc1.")||u&&l?.startsWith("krc1.");return{id:"runner_token",label:"Runner token readiness",checks:[{id:"runner_token_scoped",label:"Scoped runner token (krc1.*) ready",status:d?"pass":"fail",summary:d?a?"KYNVER_RUNNER_TOKEN is set (scoped prefix shown)":`Saved scoped token for agentOsId ${c??t??"(unknown)"}`:"No scoped runner token for the configured AgentOS workspace",remediation:d?void 0:"Run `kynver login` then `kynver runner credential --agent-os-id <id>` (or `kynver setup` with API key).",details:{source:a?"env":l?"credentials":"none",tokenPrefix:a??(u?l:void 0),agentOsId:t??c??null,credentialsPath:i}},{id:"runner_token_agent_os_match",label:"Saved runner token matches configured agentOsId",status:!l||!t||!c||c===t?"pass":"warn",summary:!l||!c?"No saved token agentOsId to compare":t?c===t?"Saved token scoped to configured agentOsId":`Saved token is for ${c}, config expects ${t}`:"Config agentOsId unset \u2014 token scope not validated against config",remediation:l&&t&&c&&c!==t?"`kynver runner credential --agent-os-id <configured-id>` to mint a workspace-bound token.":void 0,details:{configuredAgentOsId:t??null,savedAgentOsId:c??null}},{id:"runner_api_key_for_refresh",label:"API key available for token refresh",status:n.hasApiKey||process.env.KYNVER_API_KEY?.trim()?"pass":"warn",summary:n.hasApiKey||process.env.KYNVER_API_KEY?"KYNVER API key present for runner credential mint/refresh":"No API key \u2014 401 callback recovery cannot auto-mint a replacement token",remediation:n.hasApiKey||process.env.KYNVER_API_KEY?void 0:"Run `kynver login --api-key \u2026`.",details:{credentialsPath:i,hasApiKey:n.hasApiKey||!!process.env.KYNVER_API_KEY}}]}}function W$(e){return Ux(e,{envGithubToken:!!process.env.GITHUB_TOKEN?.trim(),envGhToken:!!process.env.GH_TOKEN?.trim(),ghAuthToken:()=>e.ghAuthToken()})}function B$(e){let r=e.harnessRoot(),t=Lx.join(r,"runs"),n=Lx.join(r,"worktrees"),o=mr(r),s=mr(t),i=mr(n),a=e.pathExists(t),l=e.pathExists(n);return{id:"harness_dirs",label:"Harness / daemon directories",checks:[{id:"harness_root",label:"Harness root resolved",status:"pass",summary:o,details:{harnessRoot:o}},{id:"harness_runs_dir",label:"Runs directory ready",status:a&&e.pathWritable(t)?"pass":"warn",summary:a?e.pathWritable(t)?`Writable ${s}`:`Exists but not writable: ${s}`:`Will be created on first run: ${s}`,remediation:a&&!e.pathWritable(t)?`Fix permissions on ${s} or set KYNVER_HARNESS_ROOT to a writable path.`:void 0,details:{runsDir:s,exists:a,writable:e.pathWritable(t)}},{id:"harness_worktrees_dir",label:"Worktrees directory ready",status:l&&e.pathWritable(n)?"pass":"warn",summary:l?e.pathWritable(n)?`Writable ${i}`:`Exists but not writable: ${i}`:`Will be created on first worker: ${i}`,remediation:l&&!e.pathWritable(n)?`Fix permissions on ${i}.`:void 0,details:{worktreesDir:i,exists:l,writable:e.pathWritable(n)}}]}}function F$(e){let r=e.loadConfig(),t=e.envSnapshot(),n=t.kynverApiUrl??r.apiBaseUrl?.trim()??t.openclawCronFireBaseUrl,o=!t.kynverApiUrl&&!r.apiBaseUrl&&!!t.openclawCronFireBaseUrl,s=t.openclawCronSecret||t.kynverRuntimeSecret,i=t.kynverRunnerTokenPrefix?.startsWith("krc1."),l=e.readCredentials().runnerTokenPrefix?.startsWith("krc1.");return{id:"callback_auth",label:"Callback auth / config",checks:[{id:"callback_base_url",label:"Callback base URL configured",status:n?o?"warn":"pass":"fail",summary:n?o?`Using legacy OPENCLAW_CRON_FIRE_BASE_URL (${n})`:n:"No KYNVER_API_URL, config apiBaseUrl, or legacy OpenClaw base URL",remediation:n?o?"Migrate to KYNVER_API_URL or `kynver setup --api-base-url` and drop OPENCLAW_CRON_FIRE_BASE_URL.":void 0:"Set KYNVER_API_URL or run `kynver setup --api-base-url https://\u2026`.",details:{source:t.kynverApiUrl?"KYNVER_API_URL":r.apiBaseUrl?"config.apiBaseUrl":t.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL":"none",baseUrl:n??null}},{id:"callback_auth_mode",label:"Callback auth uses scoped runner token",status:i||l?"pass":s?"warn":"fail",summary:i?"KYNVER_RUNNER_TOKEN scoped token will be sent as X-Kynver-Runner-Token":l?"Saved krc1.* token in ~/.kynver/credentials":s?"Deployment-level KYNVER_RUNTIME_SECRET / OPENCLAW_CRON_SECRET in use (legacy headers)":"No callback secret configured",remediation:i||l?void 0:"Mint a scoped token: `kynver runner credential --agent-os-id <id>`. Avoid shared OPENCLAW_CRON_SECRET on user runners.",details:{mode:i||l?"scoped":s?"legacy_global_secret":"missing",legacyHeadersWhenNotScoped:["X-OpenClaw-Cron-Secret","X-Kynver-Runtime-Secret"]}}]}}function H$(e){let r=e.envSnapshot(),t=e.loadConfig(),n=e.readCredentials(),o=e.harnessRoot(),s=e.legacyOpenclawHarnessRoot(),i=mr(o),a=mr(s),l=r.opusHarnessRoot?mr(r.opusHarnessRoot):null,c=o===s&&e.pathExists(s),u=t.agentOsId?.trim(),d=r.kynverRunnerTokenPrefix,p=n.runnerTokenPrefix,f=n.runnerTokenAgentOsId,m=!!p&&(!u||!f||f===u),g=!!d?.startsWith("krc1.")||m&&!!p?.startsWith("krc1.");return{id:"openclaw_hotspots",label:"OpenClaw dependency hotspots",checks:[{id:"hotspot_legacy_harness_root",label:"Legacy ~/.openclaw/harness still active",status:c?"warn":"pass",summary:c?`Harness root is legacy ${a}`:r.opusHarnessRoot?`OPUS_HARNESS_ROOT override in use (${l})`:`Using ${i}`,remediation:c?"Set KYNVER_HARNESS_ROOT=~/.kynver/harness (or run setup), migrate artifacts, retire OPUS_HARNESS_ROOT.":r.opusHarnessRoot?"Prefer KYNVER_HARNESS_ROOT over OPUS_HARNESS_ROOT.":void 0,details:{harnessRoot:i,legacyRoot:a,opusHarnessRoot:l}},{id:"hotspot_openclaw_env_secrets",label:"OpenClaw deployment secrets in runner env",status:r.openclawCronSecret||r.openclawCronFireBaseUrl?"warn":"pass",summary:r.openclawCronSecret||r.openclawCronFireBaseUrl?[r.openclawCronSecret?"OPENCLAW_CRON_SECRET set":null,r.openclawCronFireBaseUrl?"OPENCLAW_CRON_FIRE_BASE_URL set":null].filter(Boolean).join("; "):"No OpenClaw cron env overrides on this runner",remediation:r.openclawCronSecret||r.openclawCronFireBaseUrl?"Move to KYNVER_API_URL + scoped runner tokens; unset OpenClaw cron env on user-hosted runners.":void 0},Tx(r,{agentOsId:u??null,apiBaseUrl:t.apiBaseUrl?.trim()??r.kynverApiUrl??null,hasScopedRunnerToken:g,deploymentSchedulerProvider:t.deploymentSchedulerProvider==="qstash"||t.deploymentSchedulerProvider==="kynver-cron"||t.deploymentSchedulerProvider==="openclaw-cron"?t.deploymentSchedulerProvider:void 0}),{id:"hotspot_lease_source_names",label:"Harness lease/completion source names",status:"pass",summary:"Runtime uses kynver-harness:* lease owners and completion source kynver-harness (OpenClaw names retired in runtime)",details:{leaseOwnerPattern:"kynver-harness:<runId>",completionSource:"kynver-harness",note:"OpenClaw adapter remains optional in packages/kynver-openclaw-agent-os only"}}]}}function Wx(e=Ox){let r=[M$(e),U$(e),L$(e),W$(e),B$(e),F$(e),Dx(e),H$(e)],t=D$(r),n=t.fail===0,o=n?t.warn>0?`Ready with ${t.warn} warning(s) \u2014 review remediation before retiring OpenClaw as primary runtime agent.`:"Ready \u2014 Kynver runtime can serve as primary runtime agent on this host.":`${t.fail} blocking check(s) \u2014 fix failures before OpenClaw takeover.`;return{command:"doctor runtime-takeover",ready:n,summary:o,counts:t,sections:r}}function Bx(e={}){let r=[];if(e.remediate===!0||e.remediate==="true"){let n=fo();n.updated?r.push(`Remediated config fields: ${n.fields.join(", ")}`):r.push("Config backfill: no unambiguous legacy fields to persist"),n.skippedAmbiguous.length>0&&r.push(`Skipped ambiguous identity: ${n.skippedAmbiguous.join("; ")}`)}if(e.remediateDefaultRepo===!0){let n=Vi();if(!n.ok){console.error(n.reason??"defaultRepo remediation failed"),n.remediation&&console.error(n.remediation),process.exitCode=1;return}n.remediated?r.push(`Remediated defaultRepo \u2192 ${n.resolved?.defaultRepo??"unknown"}`):r.push(`defaultRepo already persisted (${n.resolved?.defaultRepo??"unknown"})`)}let t=Wx();r.length>0&&(t.notes=[...t.notes??[],...r]),console.log(JSON.stringify(t,null,2)),t.ready||(process.exitCode=1)}A();import{existsSync as ds,readFileSync as Xx}from"node:fs";import{homedir as q$}from"node:os";import Ag from"node:path";import{spawnSync as Qx}from"node:child_process";Ee();var _g="24.11.0",us=">=24.11.0",K$=">=24.11.0 <25";function Cg(e){let r=e.trim().replace(/^v/,""),t=/^(\d+)\.(\d+)\.(\d+)$/.exec(r);return t?{major:Number(t[1]),minor:Number(t[2]),patch:Number(t[3])}:null}function Fx(e,r){return e.major!==r.major?e.major-r.major:e.minor!==r.minor?e.minor-r.minor:e.patch-r.patch}function $$(e){let r=e.trim().split(/\s+/),t=null,n=null;for(let o of r)if(o.startsWith(">="))t=Cg(o.slice(2));else if(o.startsWith("<")){let s=o.slice(1);n=Cg(s)??(/^\d+$/.test(s)?{major:Number(s),minor:0,patch:0}:null)}if(!t)throw new Error(`Unsupported node policy range: ${e}`);return{floor:t,below:n}}function Ln(e,r=us){let{floor:t,below:n}=$$(r),o=Cg(e);if(!o)return{status:"invalid_version",currentVersion:e.trim(),requiredRange:r,remediation:`Node version could not be parsed as X.Y.Z (prereleases are unsupported). Install Node ${_g} or a later release within the supported range.`};let s=`${o.major}.${o.minor}.${o.patch}`;return Fx(o,t)<0?{status:"upgrade_required",currentVersion:s,requiredRange:r,remediation:`Upgrade Node to >=${_g}.`}:n&&Fx(o,n)>=0?{status:"unsupported_major",currentVersion:s,requiredRange:r,remediation:`Node ${o.major}.x is newer than this artifact's qualified range (${r}). Use a qualified Node major or wait for the next runtime qualification.`}:{status:"compatible",currentVersion:s,requiredRange:r,remediation:null}}Ye();import jx from"node:os";Ye();var Eg={agentOsId:"<WORKSPACE_ID>",agentOsSlug:"<WORKSPACE_SLUG>",boxId:"<BOX_ID>",runnerId:"<RUNNER_ID>",tokenAgentOsId:"<WORKSPACE_ID>",configAgentOsId:"<WORKSPACE_ID>"},Kx=new Set(Object.keys(Eg));function j$(e){return e.startsWith("~")&&(e.length===1||e[1]==="/"||e[1]==="\\")?e.includes("/.kynver/")||e.includes("daemon-heartbeat"):e.startsWith("/")||/^[A-Za-z]:[\\/]/.test(e)||e.includes("/Users/")||e.includes("/home/")||e.includes("\\Users\\")}function wg(e,r,t){if(typeof e=="string"&&t&&Kx.has(t)&&e.trim()){r.set(e.trim(),Eg[t]??"<WORKSPACE_ID>");return}if(Array.isArray(e)){for(let n of e)wg(n,r);return}if(e&&typeof e=="object")for(let[n,o]of Object.entries(e))wg(o,r,n)}function Hx(e,r){let t=e;for(let[n,o]of r)n&&(t=t.split(n).join(o));return t}function xg(e,r,t){if(typeof e=="string"){let n=Hx(e,r);return t&&Kx.has(t)?Eg[t]??"<WORKSPACE_ID>":(j$(n)&&(n=Hx(mr(n),r)),n)}if(Array.isArray(e))return e.map(n=>xg(n,r));if(e&&typeof e=="object"){let n={};for(let[o,s]of Object.entries(e))n[o]=xg(s,r,o);return n}return e}function $x(e){let r=new Map;return wg(e,r),xg(e,r)}var V$="Totalsolutionsync/kynver-feedback",ua="https://github.com/Totalsolutionsync/kynver-feedback",Vx=`${ua}/issues`,G$=`${ua}/issues/new/choose`,Pg=`${ua}/issues/new?template=install_bug.yml`,Og=`${ua}/issues/new?template=product_bug.yml`,Y$="https://www.kynver.com/help/bug-reports",Gx=!1;function J$(){return{autoSubmit:Gx,meaning:"kynver report-bug does NOT send anything to Kynver or GitHub. It only runs doctor locally and prints a draft. The bug is reported only after a human or agent manually creates a public GitHub issue.",destinationAfterIssueCreated:Vx,githubRepo:V$,installTemplateUrl:Pg,productTemplateUrl:Og,triage:"Kynver operators watch github.com/Totalsolutionsync/kynver-feedback/issues. There is no in-app admin queue for these reports."}}function Yx(){let e=J$();return{repoUrl:ua,issuesUrl:Vx,newIssueUrl:G$,installTemplateUrl:Pg,productTemplateUrl:Og,helpUrl:Y$,cliCommand:"kynver report-bug --json",instructions:[e.meaning,"Install/runtime problems: open installTemplateUrl and paste issueBodyDraft.","Other product bugs: open productTemplateUrl instead.","Do not paste API keys, runner tokens (krc1.*), or .env secrets. Workspace ids, box ids, and home paths are redacted in this draft by default.","Account access gating (403) is not a bug \u2014 use https://www.kynver.com/agent-os/early-access."].join(" "),agentSteps:["Run `kynver report-bug --json` on the user's machine. Read `submission.autoSubmit` (always false) \u2014 do not tell the user the report was sent.","Read `issueBodyDraft` and `submission.installTemplateUrl` / `submission.productTemplateUrl`.","Create the GitHub issue yourself OR hand the user the draft + URL to paste manually.",'Install/runtime bugs: `gh issue create --repo Totalsolutionsync/kynver-feedback --title "[install] <short summary>" --body-file <draft.txt>` (requires GitHub auth on the machine).',"After the issue exists, the report lives at submission.destinationAfterIssueCreated \u2014 Kynver triages from GitHub Issues, not from this CLI.","If GitHub auth is unavailable, show the user issueBodyDraft and newIssueUrl; the report is not filed until they submit the GitHub form."],submission:e}}function Jx(e){let r=Yx(),t=r.submission,n={runtimeVersion:Fe,nodeVersion:process.version,platform:process.platform,arch:process.arch},o=[e.message?.trim()?`## Summary
 ${e.message.trim()}
 `:void 0,"## Environment",`- @kynver-app/runtime: ${n.runtimeVersion}`,`- Node.js: ${n.nodeVersion}`,`- OS: ${jx.type()} ${jx.release()} (${n.platform}/${n.arch})`,"","## Diagnostics","Paste output of `kynver doctor runner-install` below (workspace ids and home paths redacted):","```json",e.doctorReport?JSON.stringify($x(e.doctorReport),null,2):"(run `kynver doctor runner-install` and paste JSON here)","```","","_Draft from `kynver report-bug` \u2014 not submitted automatically. Paste into a new GitHub issue at:",`${Pg} (install/runtime) or ${Og} (other).`,"Remove any secrets before posting publicly._"].filter(s=>s!==void 0);return{guide:r,submission:t,environment:n,doctorReport:e.doctorReport,issueBodyDraft:o.join(`
 `)}}function qx(){let e=Yx();return{newIssueUrl:e.newIssueUrl,installTemplateUrl:e.installTemplateUrl,cliCommand:e.cliCommand,helpUrl:e.helpUrl,autoSubmit:Gx,submissionNote:e.submission.meaning}}var Zx=Ag.join(q$(),".kynver"),upe=Ag.join(Zx,"config.json"),Bn=Ag.join(Zx,"credentials"),zx=(()=>{let e=process.env.KYNVER_DAEMON_STALL_MS?.trim(),r=e?parseInt(e,10):NaN;return Number.isFinite(r)&&r>0?r:900*1e3})();function z$(e){let r={pass:0,warn:0,fail:0};for(let t of e)for(let n of t.checks)r[n.status]+=1;return r}function Wn(e){return e.checks.some(r=>r.status==="fail")}function eE(e){try{let r=Qx(process.platform==="win32"?"where":"which",[e],{encoding:"utf8",timeout:3e3});return r.status===0&&!!r.stdout?.trim()}catch{return!1}}function X$(){if(!ds(Bn))return{hasApiKey:!1};try{let e=JSON.parse(Xx(Bn,"utf8"));return{hasApiKey:!!e.apiKey?.trim(),runnerToken:e.runnerToken?.trim()||void 0,runnerTokenAgentOsId:e.runnerTokenAgentOsId?.trim()||void 0}}catch{return{hasApiKey:!1}}}function Q$(){let e=eE("kynver"),r=Ln(process.versions.node);return{id:"stage_1_install",label:"Stage 1 \u2014 Install",checks:[{id:"install_package_version",label:"@kynver-app/runtime version",status:"pass",summary:`@kynver-app/runtime ${Fe} is running`,details:{version:Fe}},{id:"install_node_runtime_policy",label:"Node runtime policy (report-only)",status:r.status==="compatible"?"pass":"warn",summary:r.status==="compatible"?`Node ${r.currentVersion} satisfies ${r.requiredRange}`:`Node ${r.currentVersion} \u2192 ${r.status} against ${r.requiredRange} (advisory during rollout)`,remediation:r.remediation??void 0,details:{status:r.status,requiredRange:r.requiredRange}},{id:"install_on_path",label:"kynver executable on PATH",status:e?"pass":"warn",summary:e?"kynver found on PATH \u2014 global install confirmed":"kynver not on PATH \u2014 running via node/npx (fine for first-timers)",remediation:e?void 0:"Install globally for a shorter command: `npm install -g @kynver-app/runtime`",details:{onPath:e}}]}}function Z$(e,r){return{id:"stage_2_login",label:"Stage 2 \u2014 Device Login",checks:[{id:"login_credentials_file",label:"Credentials file present",status:ds(Bn)?"pass":"fail",summary:ds(Bn)?`${B(Bn)} exists`:`${B(Bn)} missing \u2014 not logged in`,remediation:ds(Bn)?void 0:r?`kynver login --api-base-url ${r}`:"kynver login --api-base-url https://your-kynver-site"},{id:"login_api_key",label:"API key present",status:e.hasApiKey?"pass":"fail",summary:e.hasApiKey?"API key found in credentials":"No API key \u2014 device login not completed",remediation:e.hasApiKey?void 0:r?`kynver login --api-base-url ${r}`:"kynver login --api-base-url https://your-kynver-site"}]}}function ej(e,r,t=v(),n=process.env){let o=t.boxKind?.trim()||n.KYNVER_BOX_KIND?.trim()||"";return{id:"stage_3_workspace",label:"Stage 3 \u2014 Workspace Binding",checks:[{id:"workspace_api_base_url",label:"API base URL configured",status:r?"pass":"fail",summary:r?`apiBaseUrl = ${r}`:"apiBaseUrl not set \u2014 bootstrap required",remediation:r?void 0:"kynver bootstrap --api-base-url https://your-kynver-site",details:{apiBaseUrl:r??null}},{id:"workspace_agent_os_id",label:"AgentOS workspace bound",status:e?"pass":"fail",summary:e?`Workspace ${e} bound`:"agentOsId not set \u2014 workspace not bound",remediation:e?void 0:r?`kynver bootstrap --api-base-url ${r}`:"kynver bootstrap --api-base-url https://your-kynver-site",details:{agentOsId:e??null}},{id:"workspace_box_kind",label:"Box identity (boxKind) configured",status:o?"pass":"fail",summary:o?`boxKind = ${o}`:"boxKind not set \u2014 the daemon refuses to start without it",remediation:o?void 0:"kynver setup   (persists boxKind=box for customer installs; operators: --box-kind forge|ghost)",details:{boxKind:o||null}}]}}function rj(e){let r=v(),t=Ze({config:r}),n=!!t?.repo,o=!!t?.persistedInConfig,s=[{id:"repo_configured",label:"Default repo configured",status:n?"pass":"fail",summary:n?o?`${B(t.repo)} (from config)`:`${B(t.repo)} (discovered \u2014 not persisted yet)`:"No default repo \u2014 kynver start requires --repo or a configured path",remediation:n?o?void 0:"kynver config ensure-default-repo":"kynver setup --repo /path/to/your/repo",details:{defaultRepo:t?.repo??null,source:t?.source??null,persistedInConfig:o}}];return n&&!o&&s.push({id:"repo_persisted",label:"Default repo persisted in ~/.kynver/config.json",status:"warn",summary:`Repo discovered via ${t?.source} but not saved to config \u2014 may not survive env changes`,remediation:"kynver config ensure-default-repo"}),n&&s.push(nj(t.repo,tj(t.repo))),{id:"stage_4_repo",label:"Stage 4 \u2014 Repo Selection",checks:s}}function tj(e){let r=o=>ee(e,["rev-parse","--verify","--quiet",`${o}^{commit}`]).status===0;if(r("origin/main"))return{originMainOk:!0,remoteHead:null,remoteHeadOk:!1};let t=ee(e,["symbolic-ref","--quiet","refs/remotes/origin/HEAD"]),n=t.status===0&&t.stdout.trim().replace(/^refs\/remotes\//,"")||null;return{originMainOk:!1,remoteHead:n,remoteHeadOk:n?r(n):!1}}function nj(e,r){return r.originMainOk?{id:"repo_base_ref",label:"Repo base ref (origin/main) resolvable",status:"pass",summary:`git rev-parse origin/main succeeds in ${B(e)}`,details:{baseRef:"origin/main"}}:r.remoteHeadOk&&r.remoteHead?{id:"repo_base_ref",label:"Repo base ref (origin/main) resolvable",status:"warn",summary:`origin/main not found \u2014 runs will fall back to the remote default branch ${r.remoteHead}`,remediation:"Fine as-is; to pin a different base, pass --base or set KYNVER_RUN_BASE_REF",details:{baseRef:r.remoteHead,fallback:!0}}:{id:"repo_base_ref",label:"Repo base ref (origin/main) resolvable",status:"fail",summary:`Neither origin/main nor a remote default branch resolves in ${B(e)} \u2014 new runs cannot be created`,remediation:`git -C ${e} fetch origin  (then \`git -C ${e} remote set-head origin -a\` if the default branch is not main)`,details:{baseRef:null,remoteHead:r.remoteHead}}}function oj(e,r){let t=e.runnerToken,n=!!t?.startsWith("krc1."),o=e.runnerTokenAgentOsId,s=!r||!o||o===r,i=[{id:"credential_scoped_token",label:"Scoped runner token (krc1.*) present",status:n?"pass":"fail",summary:n?`Scoped token present (krc1.\u2026 for ${o??r??"workspace"})`:t?"Runner token present but not a krc1.* scoped token \u2014 re-mint required":"No runner token \u2014 mint one with `kynver runner credential`",remediation:n?void 0:r?`kynver runner credential --agent-os-id ${r}`:"kynver runner credential --agent-os-id <your-agent-os-id>",details:{hasToken:!!t,isScoped:n,tokenAgentOsId:o??null}}];return n&&!s&&i.push({id:"credential_workspace_match",label:"Runner token matches configured workspace",status:"warn",summary:`Token is for workspace ${o}, config expects ${r}`,remediation:r?`kynver runner credential --agent-os-id ${r}`:void 0,details:{tokenAgentOsId:o??null,configAgentOsId:r??null}}),{id:"stage_5_credential",label:"Stage 5 \u2014 Runner Credential",checks:i}}function sj(e){if(!e)return{id:"stage_6_daemon",label:"Stage 6 \u2014 Supervised Daemon",checks:[{id:"daemon_workspace_required",label:"Workspace required for daemon liveness check",status:"warn",summary:"agentOsId not set \u2014 cannot locate heartbeat file; complete stage 3 first"}]};let r=iu(e),t=ds(r),n=!1,o=null,s=null;if(t)try{let a=JSON.parse(Xx(r,"utf8"));a.observedAt&&(o=Date.now()-new Date(a.observedAt).getTime(),n=o<zx),s=a.pid??null}catch{}let i=[{id:"daemon_running",label:"Daemon running (heartbeat present)",status:t?"pass":"warn",summary:t?`Heartbeat file found: ${B(r)}`:`No heartbeat file at ${B(r)} \u2014 daemon not started`,remediation:t?void 0:"kynver start",details:{heartbeatPath:B(r),exists:t}}];return t&&i.push({id:"daemon_heartbeat_fresh",label:"Daemon heartbeat fresh",status:n?"pass":"warn",summary:n?`Last beat ${Math.round((o??0)/1e3)}s ago (pid ${s??"?"})`:o!==null?`Heartbeat is ${Math.round(o/6e4)}m old \u2014 daemon may be stalled`:"Cannot parse heartbeat timestamp",remediation:n?void 0:"kynver start  # keeper will respawn the daemon",details:{ageMs:o,stallThresholdMs:zx,pid:s}}),{id:"stage_6_daemon",label:"Stage 6 \u2014 Supervised Daemon",checks:i}}var ij={cursor:["agent"],codex:["codex","hermes"],claude:["claude"]},aj={cursor:"Install the Cursor Agent CLI (https://cursor.com/docs/cli/headless), then `agent login` (or set CURSOR_API_KEY). Windows PowerShell: `irm 'https://cursor.com/install?win32=true' | iex`",codex:"Install the Codex CLI (https://developers.openai.com/codex/) and run `codex login`, or install `hermes` with the openai-codex provider",claude:"Install Claude Code (`npm install -g @anthropic-ai/claude-code`), then `claude login`"};function lj(e=v()){let r=(e.workerProvider?.trim()||"cursor").toLowerCase(),t=ij[r]??[],n=t.length>0,o=t.find(i=>eE(i))??null,s=null;if(o)try{let i=Qx(o,["--version"],{encoding:"utf8",timeout:5e3});s=i.status===0?{ok:!0,detail:(i.stdout||i.stderr||"").trim().split(`
@@ -185,6 +185,6 @@ Blockers:`);for(let n of t.blockers)console.log(`  ! ${n}`);process.exitCode=1;r
 `)}function Jj(e){let r=e.resourceGate,t=[];if(t.push(`Worker slots ${r.activeWorkers}/${r.maxConcurrentWorkers} \xB7 available ${r.slotsAvailable}`),e.workers.length===0)return t.push("No active or attention workers."),t.join(`
 `);for(let n of e.workers)t.push(Gj(n));return t.join(`
 `)}function qj(e){if(!e.taskId)return"missing --task <id>";if(!e.taskFound||e.workers.length===0)return`No harness worker found for task ${e.taskId}`;let r=e.workers[0];return[`task ${e.taskId}`,`${r.runId}/${r.worker}`,r.status,r.attention,r.leaseOwner?`lease=${r.leaseOwner}`:null,r.model?`model=${r.model}`:null,r.currentTask?`tool=${jg(r.currentTask)}`:null,r.completionBlocker??r.heartbeatBlocker??r.attentionReason??null].filter(n=>!!n).join(" \xB7 ")}function NE(e){return e.mode==="workers"?Jj(e):e.mode==="task"?qj(e):Yj(e)}function zj(e){return e.full===!0||e.full==="true"?"full":e.json===!0||e.json==="true"?"json":e.workers===!0||e.workers==="true"?"workers":typeof e.task=="string"&&e.task.trim()?"task":"compact"}function DE(e){let r=zj(e);if(r==="full"){let n=$g({mode:"full"});console.log(JSON.stringify(n,null,2));return}let t=$g({mode:r,taskId:typeof e.task=="string"?e.task:void 0});if(r==="json"){console.log(JSON.stringify(t,null,2));return}console.log(NE(t))}A();function ME(e){return{Authorization:`Bearer ${e}`,"Content-Type":"application/json"}}async function UE(e){let r=await e.text();try{return JSON.parse(r)}catch{return{error:r||`HTTP ${e.status}`}}}function LE(e){let r=typeof e.agentOsId=="string"?e.agentOsId.trim():"",t=v().agentOsId?.trim()??"",n=r||t;return n||(console.error("No AgentOS workspace configured \u2014 pass --agent-os-id or run `kynver setup`."),process.exit(1)),n}async function WE(e){let r=LE(e),t=U(typeof e.baseUrl=="string"?e.baseUrl:void 0),n=Z();n||(console.error("Not logged in \u2014 run `kynver login` first."),process.exit(1));let o=`${t}/api/agent-os/by-id/${encodeURIComponent(r)}/runtime-chat/primary`,s=await fetch(o,{headers:ME(n)}),i=await UE(s);s.ok||(console.error(typeof i.error=="string"?i.error:`HTTP ${s.status}`),process.exit(1));let a=typeof i.chatPrimaryBoxId=="string"&&i.chatPrimaryBoxId.trim()?i.chatPrimaryBoxId.trim():null,l=Ru();if(e.json===!0){console.log(JSON.stringify({agentOsId:r,chatPrimaryBoxId:a,thisBoxId:l},null,2));return}console.log(`agentOsId: ${r}`),console.log(`chatPrimaryBoxId: ${a??"(unset \u2014 will auto-elect on first claim)"}`),console.log(`thisBoxId: ${l}${a&&a===l?" (primary)":""}`)}async function BE(e){let r=LE(e),t=U(typeof e.baseUrl=="string"?e.baseUrl:void 0),n=Z();n||(console.error("Not logged in \u2014 run `kynver login` first."),process.exit(1));let o;e.clear===!0?o=null:typeof e.boxId=="string"&&e.boxId.trim()?o=e.boxId.trim():o=Ru();let s=`${t}/api/agent-os/by-id/${encodeURIComponent(r)}/runtime-chat/primary`,i=await fetch(s,{method:"PATCH",headers:ME(n),body:JSON.stringify({boxId:o})}),a=await UE(i);i.ok||(console.error(typeof a.error=="string"?a.error:`HTTP ${i.status}`),process.exit(1));let l=typeof a.chatPrimaryBoxId=="string"&&a.chatPrimaryBoxId.trim()?a.chatPrimaryBoxId.trim():null;if(e.json===!0){console.log(JSON.stringify({ok:!0,agentOsId:r,chatPrimaryBoxId:l},null,2));return}console.log(l?`Chat primary set to ${l} for ${r}`:`Chat primary cleared for ${r} (next claim will auto-elect)`)}function Zj(e){if(e==="doctor"||e==="report-bug")return;let r=process.env.KYNVER_NODE_POLICY_TEST_VERSION?.trim()||process.versions.node,t=Ln(r,us);t.status!=="compatible"&&(console.error([`kynver requires Node ${t.requiredRange}; this host is running Node ${t.currentVersion} (${t.status}).`,t.remediation??"","Run `kynver doctor node-runtime` for a full report. Diagnostic commands remain available."].filter(Boolean).join(`
-`)),process.exit(1))}function Vg(e){return e==="help"||e==="--help"||e==="-h"}var eV=["run","worker","plan","runner","harness","monitor","doctor","config","scheduler","cron","lane","board","chat-primary"];function rV(e){return e!==void 0&&eV.includes(e)}function Gg(e,r){let t=[e,r].filter(Boolean).join(" ");console.error(`unknown command: ${t||"(none)"}`),Gu(1)}function Gu(e=0){(e===0?console.log:console.error)(["Usage:","  kynver login [--api-key KEY] [--api-base-url URL]   (omit --api-key to authorize in the browser)","  kynver bootstrap [--api-base-url URL] [--api-key KEY] [--repo PATH]   (login + setup + runner credential in one shot)","  kynver start [--repo PATH] [--api-base-url URL] [--run RUN_ID] [--interval-ms MS] [--chat-oauth] [--install-systemd]   (bring your agent online: bootstrap if needed + run + keeper-supervised daemon; --install-systemd enables Linux user unit)","  kynver chat-primary status [--agent-os-id ID] [--json]   (show sticky chat primary box for this workspace)","  kynver chat-primary set [--box-id ID] [--agent-os-id ID] [--clear] [--json]   (set sticky chat primary; omit --box-id to use this box)","  kynver runner credential [mint] [--agent-os-id ID] [--base-url URL]   (default: mint new scoped token)","  kynver runner credential status [--agent-os-id ID]   (show local token state; no server call)","  kynver runner credential list [--agent-os-id ID] [--base-url URL]   (list active credentials on server)","  kynver runner credential revoke --token-id ID [--agent-os-id AOS_ID] [--base-url URL]","  kynver runner credential rotate --token-id ID [--agent-os-id AOS_ID] [--base-url URL]   (revoke old + mint new; saves to ~/.kynver/credentials)","  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind box|forge|ghost] [--box-id box:my-laptop] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor] [--chat-oauth]","  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS] [--stall-ms MS] [--no-supervise]","  kynver status [--compact] [--workers] [--task TASK_ID] [--json] [--full]  # factory-wide harness summary","  kynver run list","  kynver run resolve --name RUN_NAME","  kynver run status --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands","  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--target-task-id TASK_ID] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--provider claude|cursor|codex] [--model claude-opus-4-8] [--disk-path /] [--reconcile-stale-blockers]","  kynver run sweep --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--grace-ms MS]",'  kynver worker start --run RUN_ID --name worker --task "..." [--owned path[,path]] [--model MODEL] [--provider claude|cursor] [--agent-os-id AOS_ID] [--task-id TASK_ID] [--wait] [--emit-json]',"  kynver worker list --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands","  kynver worker status --run RUN_ID --name worker","  kynver worker tail --run RUN_ID --name worker [--lines 40] [--raw]","  kynver worker stop --run RUN_ID --name worker","  kynver worker complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--task-id TASK_ID] [--base-url URL] [--secret SECRET]","  kynver worker discard-disposable --run RUN_ID --name worker --path scripts/helper.mjs[,other]","  kynver worker auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--poll-ms 5000] [--max-total-ms 21600000] [--complete-attempts 3] [--complete-backoff-ms 5000] [--base-url URL] [--secret SECRET]","  kynver run reconcile","  kynver run unblock [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET] [--dry-run]","  kynver plan progress --plan PLAN_ID --row ROW_KEY --role ROLE --status STATUS [--task TASK_ID] [--note NOTE] [--evidence type:value] [--agent-os-id AOS_ID]","  kynver plan verify --plan PLAN_ID [--worktree PATH] [--task TASK_ID] [--human-override] [--local]","  kynver harness verify --worktree PATH [--command CMD] [--json] [--wait-for-admission-ms MS] [--timeout-ms MS]","  kynver plan persist --operation create|add_version|update_metadata --title TITLE (--body-file PATH | --body TEXT) [--slug SLUG] [--plan PLAN_ID] [--summary TEXT] [--failure-kind approval_guard|auth|network|server|tool_interruption]","  kynver plan outbox list","  kynver plan outbox drain [--max N] [--id OUTBOX_ID]","  kynver cleanup [--execute] [--compact] [--node-modules-age-ms MS] [--worktrees-age-ms MS] [--harness-root PATH] [--include-orphans] [--skip-finalize] [--account-bytes]","  kynver wsl-crashes [--json] [--execute] [--purge-all] [--keep-newest N]","    --include-orphans also scans whole worktree directories (<harnessRoot>/worktrees/<runId>/<workerId>/) that no run/worker.json references; orphans pass salvage gates (recent heartbeat, dirty git, ahead of origin/main) before removal.","    Dry-run defaults to fast scan (no byte accounting). Pass --account-bytes for reclaimable byte totals. Pass --compact for a bounded operator summary (no full action list).","  kynver monitor start --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS]","  kynver monitor status [--run RUN_ID] [--name worker] [--tick]","  kynver monitor stop --run RUN_ID [--name worker]","  kynver monitor list","  kynver monitor tick --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--auto-complete] [--renew-leases]","  kynver monitor auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET]","  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]","  kynver config ensure-default-repo [--json]","  kynver doctor runner-install   (BYOC M0.3 \u2014 six-stage lifecycle health check for new users)","  kynver doctor node-runtime     (Node 24 migration \u2014 report-only host runtime classification, JSON)","  kynver doctor local-store [--no-probe]  (durable-harness D0 \u2014 local-run-store openability, flags, quarantine history, JSON; default probe creates the store db if absent)","  kynver doctor context-envelope [--slug SLUG] [--agent-os-id ID] [--task-id TASK_ID] [--base-url URL]","  kynver doctor runtime-takeover [--remediate] [--remediate-default-repo]","  kynver report-bug [--json] [--message TEXT] [--skip-doctor]  (bug-report guide + GitHub issue draft)","  kynver scheduler cutover-check [--json]","  kynver scheduler attest-cutover [--json]","  kynver cron install [--dry-run] [--json] [--install-systemd] [--confirm-qstash-removal] [--skip-watchdog] [--skip-test-fire] [--agent-os-id ID] [--api-base-url URL] [--run RUN_ID]","  kynver cron verify [--json]","  kynver cron status [--json]","  kynver cron tick [--agent-os-id AOS_ID] [--json]","  kynver lane tick landing-maintainer [--fleet] [--repo OWNER/NAME] [--land-script PATH] [--agent-os-id AOS_ID] [--execute] [--json]","  kynver board contract [--agent-os-id ID] [--base-url URL] [--since ISO] [--limit N]"].join(`
+`)),process.exit(1))}function Vg(e){return e==="help"||e==="--help"||e==="-h"}var eV=["run","worker","plan","runner","harness","monitor","doctor","config","scheduler","cron","lane","board","chat-primary"];function rV(e){return e!==void 0&&eV.includes(e)}function Gg(e,r){let t=[e,r].filter(Boolean).join(" ");console.error(`unknown command: ${t||"(none)"}`),Gu(1)}function Gu(e=0){(e===0?console.log:console.error)(["Usage:","  kynver login [--api-key KEY] [--api-base-url URL]   (omit --api-key to authorize in the browser)","  kynver bootstrap [--api-base-url URL] [--api-key KEY] [--repo PATH]   (login + setup + runner credential in one shot)","  kynver start [--repo PATH] [--api-base-url URL] [--run RUN_ID] [--interval-ms MS] [--chat-oauth] [--install-systemd]   (bring your agent online: bootstrap if needed + run + keeper-supervised daemon; --install-systemd enables Linux user unit)","  kynver chat-primary status [--agent-os-id ID] [--json]   (show sticky chat primary box for this workspace)","  kynver chat-primary set [--box-id ID] [--agent-os-id ID] [--clear] [--json]   (set sticky chat primary; omit --box-id to use this box)","  kynver runner credential [mint] [--agent-os-id ID] [--base-url URL]   (default: mint new scoped token)","  kynver runner credential status [--agent-os-id ID]   (show local token state; no server call)","  kynver runner credential list [--agent-os-id ID] [--base-url URL]   (list active credentials on server)","  kynver runner credential revoke --token-id ID [--agent-os-id AOS_ID] [--base-url URL]","  kynver runner credential rotate --token-id ID [--agent-os-id AOS_ID] [--base-url URL]   (revoke old + mint new; saves to ~/.kynver/credentials)","  kynver setup [--api-base-url URL] [--agent-os-id ID] [--agent-os-slug SLUG] [--box-kind box|forge|ghost] [--box-id box:my-laptop] [--repo PATH] [--discover-repo] [--max-workers N] [--provider claude|cursor] [--chat-oauth]","  kynver daemon --run RUN_ID --agent-os-id AOS_ID [--execute] [--interval-ms MS] [--stall-ms MS] [--no-supervise]","  kynver status [--compact] [--workers] [--task TASK_ID] [--json] [--full]  # factory-wide harness summary","  kynver run list","  kynver run resolve --name RUN_NAME","  kynver run status --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands","  kynver run dispatch --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--execute] [--lane any|implementation|review|landing] [--target-task-id TASK_ID] [--executor harness] [--max-starts 1] [--lease-ms MS] [--owned path[,path]] [--provider claude|cursor|codex] [--model claude-opus-4-8] [--disk-path /] [--reconcile-stale-blockers]","  kynver run sweep --run RUN_ID --agent-os-id AOS_ID [--base-url URL] [--secret SECRET] [--grace-ms MS]",'  kynver worker start --run RUN_ID --name worker --task "..." [--owned path[,path]] [--model MODEL] [--provider claude|cursor] [--agent-os-id AOS_ID] [--task-id TASK_ID] [--wait] [--emit-json]',"  kynver worker list --run RUN_ID [--full]  # defaults to compact shallow map with drill-down commands","  kynver worker status --run RUN_ID --name worker","  kynver worker tail --run RUN_ID --name worker [--lines 40] [--raw]","  kynver worker stop --run RUN_ID --name worker","  kynver worker complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--task-id TASK_ID] [--base-url URL] [--secret SECRET]","  kynver worker discard-disposable --run RUN_ID --name worker --path path/to/file[,other]","  kynver worker auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--poll-ms 5000] [--max-total-ms 21600000] [--complete-attempts 3] [--complete-backoff-ms 5000] [--base-url URL] [--secret SECRET]","  kynver run reconcile","  kynver run unblock [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET] [--dry-run]","  kynver plan progress --plan PLAN_ID --row ROW_KEY --role ROLE --status STATUS [--task TASK_ID] [--note NOTE] [--evidence type:value] [--agent-os-id AOS_ID]","  kynver plan verify --plan PLAN_ID [--worktree PATH] [--task TASK_ID] [--human-override] [--local]","  kynver harness verify --worktree PATH [--command CMD] [--json] [--wait-for-admission-ms MS] [--timeout-ms MS]","  kynver plan persist --operation create|add_version|update_metadata --title TITLE (--body-file PATH | --body TEXT) [--slug SLUG] [--plan PLAN_ID] [--summary TEXT] [--failure-kind approval_guard|auth|network|server|tool_interruption]","  kynver plan outbox list","  kynver plan outbox drain [--max N] [--id OUTBOX_ID]","  kynver cleanup [--execute] [--compact] [--node-modules-age-ms MS] [--worktrees-age-ms MS] [--harness-root PATH] [--include-orphans] [--skip-finalize] [--account-bytes]","  kynver wsl-crashes [--json] [--execute] [--purge-all] [--keep-newest N]","    --include-orphans also scans whole worktree directories (<harnessRoot>/worktrees/<runId>/<workerId>/) that no run/worker.json references; orphans pass salvage gates (recent heartbeat, dirty git, ahead of origin/main) before removal.","    Dry-run defaults to fast scan (no byte accounting). Pass --account-bytes for reclaimable byte totals. Pass --compact for a bounded operator summary (no full action list).","  kynver monitor start --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS]","  kynver monitor status [--run RUN_ID] [--name worker] [--tick]","  kynver monitor stop --run RUN_ID [--name worker]","  kynver monitor list","  kynver monitor tick --run RUN_ID [--name worker] [--agent-os-id AOS_ID] [--auto-complete] [--renew-leases]","  kynver monitor auto-complete --run RUN_ID --name worker [--agent-os-id AOS_ID] [--base-url URL] [--secret SECRET]","  kynver monitor run-loop --run RUN_ID --monitor-id ID [--name worker] [--agent-os-id AOS_ID] [--poll-ms MS] [--auto-complete] [--renew-leases]","  kynver config ensure-default-repo [--json]","  kynver doctor runner-install   (BYOC M0.3 \u2014 six-stage lifecycle health check for new users)","  kynver doctor node-runtime     (Node 24 migration \u2014 report-only host runtime classification, JSON)","  kynver doctor local-store [--no-probe]  (durable-harness D0 \u2014 local-run-store openability, flags, quarantine history, JSON; default probe creates the store db if absent)","  kynver doctor context-envelope [--slug SLUG] [--agent-os-id ID] [--task-id TASK_ID] [--base-url URL]","  kynver doctor runtime-takeover [--remediate] [--remediate-default-repo]","  kynver report-bug [--json] [--message TEXT] [--skip-doctor]  (bug-report guide + GitHub issue draft)","  kynver scheduler cutover-check [--json]","  kynver scheduler attest-cutover [--json]","  kynver cron install [--dry-run] [--json] [--install-systemd] [--confirm-qstash-removal] [--skip-watchdog] [--skip-test-fire] [--agent-os-id ID] [--api-base-url URL] [--run RUN_ID]","  kynver cron verify [--json]","  kynver cron status [--json]","  kynver cron tick [--agent-os-id AOS_ID] [--json]","  kynver lane tick landing-maintainer [--fleet] [--repo OWNER/NAME] [--land-script PATH] [--agent-os-id AOS_ID] [--execute] [--json]","  kynver board contract [--agent-os-id ID] [--base-url URL] [--since ISO] [--limit N]"].join(`
 `)),process.exit(e)}async function KE(e=process.argv.slice(2)){if(dh(e,import.meta.url,"kynver"))return;if(e.length===0||Vg(e[0]))return Gu(0);Zj(e[0]);let r=e.shift(),t,n;if(rV(r)&&(t=e.shift()),n=e,t&&Vg(t)||n.some(Vg))return Gu(0);let o=yo(n),{runsDir:s,worktreesDir:i}=re();if(FE(s,{recursive:!0}),FE(i,{recursive:!0}),r==="daemon"&&qo(),kd(r,t)){let a,l=o.run?String(o.run).trim():"";if(l)try{a=$(l).repo}catch{a=void 0}await hd({repoRoot:a,cwd:a})}if(r==="login")return void await sy(o);if(r==="bootstrap")return void await su(o);if(r==="report-bug")return void await uE(o);if(r==="start")return void await Vw(o);if(r==="runner"&&t==="credential"){let a=n[0]&&!n[0].startsWith("--")?n.shift():void 0,l=yo(n);if(!a||a==="mint")return void await ey(l);if(a==="status")return void oy(l);if(a==="list")return void await ry(l);if(a==="revoke")return void await ty(l);if(a==="rotate")return void await ny(l);Gg("runner credential",a)}if(r==="setup")return void await dl(o);if(r==="chat-primary"&&t==="status")return void await WE(o);if(r==="chat-primary"&&t==="set")return void await BE(o);if(r==="status")return DE(o);if(r==="daemon")return lu(o)?void await cu(o):void await Xi(o);if(r==="plan"&&t==="progress")return void await nx(o);if(r==="plan"&&t==="verify")return void await ox(o);if(r==="harness"&&t==="verify")return sx(o);if(r==="plan"&&t==="persist")return void await ix(o);if(r==="plan"&&t==="outbox"){let a=n.shift();if(a==="list")return void await ax();if(a==="drain")return void await lx(yo(n));Gg("plan",`outbox ${a??""}`.trim())}if(r==="cleanup")return cx(o);if(r==="wsl-crashes")return ux(o);if(r==="config"&&t==="ensure-default-repo")return oC(o.json===!0);if(r==="doctor"&&!t)return console.error("Running `kynver doctor runner-install` (default). Other reports: node-runtime, local-store, context-envelope, runtime-takeover."),void await Tg();if(r==="doctor"&&t==="runner-install")return void await Tg();if(r==="doctor"&&t==="node-runtime")return rE();if(r==="doctor"&&t==="local-store")return nE(o);if(r==="doctor"&&t==="context-envelope")return void await cE(o);if(r==="doctor"&&t==="runtime-takeover")return Bx(o);if(r==="scheduler"&&t==="cutover-check")return fE(o.json===!0);if(r==="scheduler"&&t==="attest-cutover")return gE(o.json===!0);if(r==="cron"&&t==="install")return void await yE(o);if(r==="cron"&&t==="verify")return void await RE(o);if(r==="cron"&&t==="status")return void await hE(o.json===!0);if(r==="cron"&&t==="tick")return void await kE(o);if(r==="lane"&&t==="tick"){let a=n.shift();return void await EE(yo(n),a)}if(r==="board"&&t==="contract")return void await dE(o);if(r==="run"&&t==="create")return void Li(o);if(r==="run"&&t==="list")return pf();if(r==="run"&&t==="resolve")return mf(o);if(r==="run"&&t==="status")return ym(o);if(r==="run"&&t==="dispatch")return void await Ot(o);if(r==="run"&&t==="sweep")return void await Go(o);if(r==="run"&&t==="reconcile")return uf();if(r==="run"&&t==="unblock")return void await Ex(o);if(r==="worker"&&t==="start")return void await xm(o);if(r==="worker"&&t==="list")return Zv(o);if(r==="worker"&&t==="status")return km(o);if(r==="worker"&&t==="tail")return Rm(o);if(r==="worker"&&t==="stop")return vm(o);if(r==="worker"&&t==="complete")return void await mc(o);if(r==="worker"&&t==="discard-disposable")return Gw(o);if(r==="worker"&&t==="auto-complete")return void await bm(o);if(r==="monitor"&&t==="start"){let a=await bx(o);console.log(JSON.stringify(a,null,2));return}if(r==="monitor"&&t==="status")return void await Sx(o);if(r==="monitor"&&t==="stop")return _x(o);if(r==="monitor"&&t==="list")return Cx();if(r==="monitor"&&t==="tick")return void await xx(o);if(r==="monitor"&&t==="auto-complete")return void await Hu(o);if(r==="monitor"&&t==="run-loop")return void await wx(o);Gg(r,t)}function HE(e){let r=e?.trim();if(!r||r==="-")return null;try{return Xj.native(r)}catch{return null}}var tV=HE(process.argv[1])===HE(Qj(import.meta.url));tV&&KE().catch(e=>{HS(e)&&(console.error(KS(e)),process.exit(e.exitCode)),console.error(e),process.exit(1)});var nV="https://api.vercel.com";function oV(e){let r=e?.trim();return r||process.env.VERCEL_TOKEN?.trim()||null}function $E(e){return(e??"").trim().toUpperCase()}function sV(e){if(typeof e!="string"||!e.trim())return null;let r=e.trim();return r.startsWith("http")?r:`https://${r}`}async function Yg(e,r={}){let t=e.trim();if(!t)return{ok:!1,readyState:null,previewUrl:null,error:"missing deployment id or URL"};let n=oV(r.token);if(!n)return{ok:!1,readyState:null,previewUrl:null,error:"VERCEL_TOKEN not configured"};let o=r.teamId?.trim()||process.env.VERCEL_TEAM_ID?.trim(),s=o?`?teamId=${encodeURIComponent(o)}`:"",i=r.fetchImpl??fetch;try{let a=await i(`${nV}/v13/deployments/${encodeURIComponent(t)}${s}`,{headers:{Authorization:`Bearer ${n}`}});if(!a.ok){let u=await a.text();return{ok:!1,readyState:null,previewUrl:null,error:`Vercel API ${a.status}: ${u.slice(0,200)}`}}let l=await a.json();return{ok:!0,readyState:$E(l.readyState??l.state)||null,previewUrl:sV(l.url),error:null}}catch(a){return{ok:!1,readyState:null,previewUrl:null,error:a instanceof Error?a.message:"Vercel API fetch failed"}}}function Jg(e,r){let t=$E(e);return t==="READY"?"ready":t==="ERROR"||t==="CANCELED"?"error":t==="BUILDING"||t==="QUEUED"||t==="INITIALIZING"||r?"building":"error"}var jE=/(^|\.)vercel\.app$/i,VE=/^dpl_[a-z0-9]+$/i;function Yu(e){let r=e.trim();if(!r||/vercel\.com/i.test(r))return!1;if(VE.test(r))return!0;try{let t=new URL(r.startsWith("http")?r:`https://${r}`);return jE.test(t.hostname)}catch{return!1}}function iV(e){let r=e.trim();if(!r)return null;try{return new URL(r)}catch{return null}}function aV(e){let r=e.pathname.split("/").filter(Boolean);if(r.length<3)return null;let t=r[r.length-1]?.trim();return!t||t==="deployments"?null:t}function lV(e){let r=e.pathname.split("/").filter(Boolean),t=r.indexOf("deployments");return t<0||t>=r.length-1?null:r[t+1]?.trim()||null}function Fn(e){let r={kind:"unknown",previewUrl:null,inspectTarget:null,deploymentId:null},t=e.trim();if(!t)return r;if(/^dpl_[a-z0-9]+$/i.test(t))return{kind:"deployment_id",previewUrl:null,inspectTarget:t,deploymentId:t};let n=iV(t);if(!n)return r;if(jE.test(n.hostname)){let o=n.origin;return{kind:"deployment_host",previewUrl:o,inspectTarget:o,deploymentId:null}}if(n.hostname==="vercel.com"||n.hostname.endsWith(".vercel.com")){let o=lV(n)??aV(n);return{kind:"dashboard",previewUrl:null,inspectTarget:o&&VE.test(o)?o:null,deploymentId:o}}return r}function GE(e){return Fn(e).kind==="dashboard"}var cV=/vercel/i;function qg(e){let r=typeof e=="string"?e.trim().toLowerCase():"";return r==="success"?"success":r==="pending"?"pending":r==="failure"?"failure":r==="error"?"error":"unknown"}function zg(e){let r=typeof e=="string"?e.trim():"";return!!(r&&cV.test(r))}function ma(e){let t=(Array.isArray(e)?e:[]).filter(l=>zg(l.context));if(t.length===0)return null;let n=l=>l==="failure"||l==="error"?0:l==="pending"?1:l==="success"?2:1,o=null,s=1/0;for(let l of t){let c=n(qg(l.state));c<s&&(o=l,s=c)}if(!o)return null;let i=typeof o.target_url=="string"&&o.target_url.trim()?o.target_url.trim():null,a=i?Fn(i):null;return{context:String(o.context??"Vercel").trim(),state:qg(o.state),targetUrl:i,description:typeof o.description=="string"&&o.description.trim()?o.description.trim():null,deploymentId:a?.deploymentId??null,previewUrl:a?.previewUrl??null,dashboardUrl:a?.kind==="dashboard"?i:null}}function uV(e){return e==="success"?"ready":e==="pending"?"building":e==="failure"||e==="error"?"error":"unavailable"}function Ju(e){return e.filter(Boolean).join("; ")}function Xg(e){let r=typeof e=="string"?e.trim():"";if(!r)return{target:null,classified:null,reason:"missing target_url"};let t=Fn(r);return t.inspectTarget&&Yu(t.inspectTarget)?{target:t.inspectTarget,classified:t,reason:null}:t.kind==="dashboard"?{target:null,classified:t,reason:t.deploymentId?"dashboard deployment id is not API-inspectable; trust GitHub Vercel status":"dashboard URL is not valid for Vercel API lookup"}:{target:null,classified:t,reason:"unrecognized Vercel URL"}}function Qg(e,r={}){let t=r.observedAt??new Date().toISOString(),n=ma(e);if(!n)return{status:"not_run",previewUrl:null,deploymentUrl:null,summary:"No Vercel GitHub status context on commit",observedAt:t,inspectSkipped:!0,inspectReason:"no_vercel_status_context",githubState:null,vercelContext:null};let o=uV(n.state),s=n.previewUrl??n.dashboardUrl,i=n.previewUrl??n.dashboardUrl;return{status:o,previewUrl:s,deploymentUrl:i,summary:Ju([`GitHub ${n.context}=${n.state}`,n.description??"",n.dashboardUrl?"dashboard target_url (API lookup skipped)":""]),observedAt:t,inspectSkipped:!0,inspectReason:n.dashboardUrl&&n.state==="success"?"trusted_github_status_dashboard_url":n.dashboardUrl?"dashboard_url_not_api_inspectable":"github_status_only",githubState:n.state,vercelContext:n.context}}async function YE(e){let r=e.observedAt??new Date().toISOString(),t=Qg(e.statuses??[],{observedAt:r}),n=ma(e.statuses??[]);if(!n)return t;if(n.state==="success")return{...t,inspectSkipped:!0,inspectReason:n.dashboardUrl?"trusted_github_status_dashboard_url":"trusted_github_status"};if(!e.allowInspect)return{...t,inspectSkipped:!0,inspectReason:"api_lookup_disabled"};let{target:o,reason:s}=Xg(n.targetUrl);if(!o)return{...t,inspectSkipped:!0,inspectReason:s??"not_api_inspectable",summary:Ju([t.summary??"",s??"skipped Vercel API lookup"])};let a=await(e.runInspect??Yg)(o),l=new Date().toISOString();if(!a.ok&&a.error?.includes("VERCEL_TOKEN"))return{status:"unavailable",previewUrl:t.previewUrl,deploymentUrl:t.deploymentUrl,summary:"VERCEL_TOKEN not configured for API fallback",observedAt:l,inspectSkipped:!0,inspectReason:"vercel_token_missing",githubState:n.state,vercelContext:n.context};if(!a.ok)return{status:n.state==="pending"?"building":"error",previewUrl:t.previewUrl,deploymentUrl:o.startsWith("http")?o:t.deploymentUrl,summary:Ju([`Vercel API lookup ${o} failed`,a.error??""]),observedAt:l,inspectSkipped:!1,inspectReason:null,githubState:n.state,vercelContext:n.context};let c=Jg(a.readyState,n.state==="pending"),u=a.previewUrl??(o.startsWith("http")?o:t.previewUrl);return{status:c,previewUrl:u,deploymentUrl:u??t.deploymentUrl,summary:Ju([`Vercel API ${o}=${a.readyState??"unknown"}`,c==="ready"?"preview ready":""]),observedAt:l,inspectSkipped:!1,inspectReason:null,githubState:n.state,vercelContext:n.context}}function fa(e,r){let t=e[r];return typeof t=="string"&&t.trim().length>0?t.trim():null}function Zg(e){let r=Date.parse(e);return Number.isFinite(r)?r:null}function eh(e,r=Date.now()){if(!e||typeof e!="object")return{ok:!1,code:"missing_job_id",detail:"envelope must be a non-null object"};let t=e,n=fa(t,"jobId");if(!n)return{ok:!1,code:"missing_job_id",detail:"jobId is required"};let o=fa(t,"agentOsId");if(!o)return{ok:!1,code:"missing_agent_os_id",detail:"agentOsId is required"};let s=fa(t,"taskId");if(!s)return{ok:!1,code:"missing_task_id",detail:"taskId is required"};let i=fa(t,"issuedAt");if(!i)return{ok:!1,code:"missing_issued_at",detail:"issuedAt is required"};let a=fa(t,"expiresAt");if(!a)return{ok:!1,code:"missing_expires_at",detail:"expiresAt is required"};if(!Zg(i)||!Zg(a))return{ok:!1,code:"malformed_dates",detail:"issuedAt and expiresAt must be valid ISO 8601 strings"};if(Zg(a)<=r)return{ok:!1,code:"job_expired",detail:`job envelope expired at ${a} (now=${new Date(r).toISOString()})`};let c=t.toolPolicy;if(!c||typeof c!="object")return{ok:!1,code:"missing_tool_policy",detail:"toolPolicy is required"};let u=c,d=Array.isArray(u.allowedToolsets)?u.allowedToolsets.filter(m=>typeof m=="string"):null;if(!d)return{ok:!1,code:"missing_tool_policy",detail:"toolPolicy.allowedToolsets must be an array"};let p=u.allowPrivilegedPlatformActions===!0,f=typeof t.runnerIdHint=="string"&&t.runnerIdHint.trim()?t.runnerIdHint.trim():null;return{ok:!0,envelope:{jobId:n,agentOsId:o,taskId:s,issuedAt:i,expiresAt:a,toolPolicy:{allowedToolsets:d,allowPrivilegedPlatformActions:p},runnerIdHint:f}}}var dV=new Set(["hermes-cli","kynver-cli","bash","read-only"]);function pV(e,r){if(e.KYNVER_BYOC_ENTITLED==="1"||e.KYNVER_BYOC_ENTITLED==="true")return!0;let t=e.KYNVER_RUNNER_CREDENTIAL_AGENT_OS_ID?.trim();return!!(t&&t===r)}function mV(e){if(e.allowPrivilegedPlatformActions)return{ok:!1,detail:"allowPrivilegedPlatformActions=true is not permitted on local BYO Codex runners; privileged operations require a platform-managed executor"};let r=e.allowedToolsets.filter(t=>!dV.has(t));return r.length>0?{ok:!1,detail:`toolsets not permitted on local BYO runners: ${r.join(", ")}`}:{ok:!0,detail:"tool policy accepted"}}function fV(e,r={}){let t=r.nowMs??Date.now(),n=r.env??process.env,o=new Date(t).toISOString(),s=eh(e,t),i=$e({env:n}),a=i.runnerId??"(unknown)",l=r.codexAdapter??Ar(o);function c(m){return{jobId:m?.jobId??"(invalid)",agentOsId:m?.agentOsId??"(invalid)",taskId:m?.taskId??"(invalid)",runnerId:a,runnerIdHint:m?.runnerIdHint??null,codexPath:l.path,codexReady:l.ready,sessionFingerprint:l.sessionFingerprint,toolsetsRequested:m?.toolPolicy.allowedToolsets??[],privilegedRequested:m?.toolPolicy.allowPrivilegedPlatformActions??!1,checkedAt:o}}if(!s.ok)return{passed:!1,code:s.code==="job_expired"?"job_expired":"malformed_envelope",detail:s.detail,evidence:c()};let u=s.envelope,d=c(u);if(!i.runnerId)return{passed:!1,code:"missing_runner",detail:"runner identity could not be resolved (KYNVER_RUNTIME_ID / HOSTNAME not set)",evidence:d};if(u.runnerIdHint&&u.runnerIdHint!==a)return{passed:!1,code:"wrong_workspace",detail:`job targets runner "${u.runnerIdHint}" but this runner is "${a}"`,evidence:d};let p=(n.KYNVER_AGENT_OS_ID??n.OPENCLAW_AGENT_OS_ID??"").trim();if(p&&p!==u.agentOsId)return{passed:!1,code:"wrong_workspace",detail:`job is for workspace "${u.agentOsId}" but this runner is bound to "${p}"`,evidence:d};if(!l.ready)return{passed:!1,code:"missing_codex_auth",detail:l.note??"Codex CLI and Hermes openai-codex are both unavailable on this runner",evidence:d};if(!pV(n,u.agentOsId))return{passed:!1,code:"missing_entitlement",detail:"BYO compute entitlement not active for this runner. Complete the workspace entitlement flow or set KYNVER_BYOC_ENTITLED=1 for testing.",evidence:d};let f=mV(u.toolPolicy);return f.ok?{passed:!0,envelope:u,evidence:d}:{passed:!1,code:"unauthorized_tool_policy",detail:f.detail,evidence:d}}function gV(e){let r={missing_runner:"Set KYNVER_RUNTIME_ID or HOSTNAME on this machine, or re-run `kynver setup`.",missing_codex_auth:"Authenticate with `codex login` or `hermes auth login openai-codex`, or set CODEX_API_KEY.",wrong_workspace:"Ensure this runner is configured for the correct AgentOS workspace (KYNVER_AGENT_OS_ID).",malformed_envelope:"The job envelope from the control plane is malformed (missing field or bad dates). This is a server-side dispatch issue \u2014 retry; if it persists, report the jobId to the platform team.",job_expired:"The job envelope has expired. The control plane will re-issue on the next dispatch tick.",missing_entitlement:"Complete the BYO compute entitlement flow in the Kynver workspace settings.",unauthorized_tool_policy:"Remove privileged tool requests or use a platform-managed executor for privileged operations."};return[`[byoc-m6] golden path check failed: ${e.code}`,`Detail: ${e.detail}`,`Remediation: ${r[e.code]}`,`Runner: ${e.evidence.runnerId}`,`Workspace: ${e.evidence.agentOsId}`,`Codex: path=${e.evidence.codexPath} ready=${e.evidence.codexReady}`].join(`
 `)}var ga="runtime-memory-envelope.v1",qu="runtime-memory-envelope.v2",hV=[ga,qu];function kV(e){if(!e)return!1;let r=e.trim().toLowerCase();return r==="1"||r==="true"||r==="yes"||r==="on"}function yV(e){if(e===void 0)return!1;let r=e.trim().toLowerCase();return r==="0"||r==="false"||r==="no"||r==="off"}function JE(){return kV(process.env.KYNVER_RUNTIME_ENVELOPE_V2)}function RV(){let e=process.env.KYNVER_RUNTIME_ENVELOPE_V2;return yV(e)?{schemaVersion:ga,v2WriterEnabled:!1,effectiveSource:"env_explicit_off"}:JE()?{schemaVersion:qu,v2WriterEnabled:!0,effectiveSource:"env_explicit_on"}:{schemaVersion:ga,v2WriterEnabled:!1,effectiveSource:"default_off"}}function vV(e){return e===ga||e===qu}x();export{ga as AGENT_RUNTIME_ENVELOPE_SCHEMA_VERSION,hV as AGENT_RUNTIME_ENVELOPE_SCHEMA_VERSIONS,qu as AGENT_RUNTIME_ENVELOPE_SCHEMA_VERSION_V2,Rt as CODEX_DEFAULT_MODEL,yl as CURSOR_DEFAULT_MODEL,Ll as DEFAULT_DISPATCH_LEASE_MS,Du as DEFAULT_HARNESS_VERIFY_COMMANDS,Ou as DEFAULT_HEAVY_VERIFICATION_MAX_CONCURRENT,Yc as DEFAULT_MAX_ACTIONS_PER_SWEEP,Fi as DEFAULT_NODE_MODULES_AGE_MS,Gc as DEFAULT_RUN_DIRECTORIES_AGE_MS,Vc as DEFAULT_TERMINAL_WORKTREES_AGE_MS,nr as DEFAULT_WORKER_PROVIDER,Hi as DEFAULT_WORKTREES_AGE_MS,Wh as DEFAULT_WSL_CRASH_DUMP_CRITICAL_BYTES,Lh as DEFAULT_WSL_CRASH_DUMP_WARN_BYTES,Nh as DEFAULT_WSL_HOST_CRITICAL_FREE_BYTES,$t as DEFAULT_WSL_HOST_MOUNT,Th as DEFAULT_WSL_HOST_WARN_FREE_BYTES,sn as EMBEDDED_INSTRUCTION_BUNDLE,dy as EMBEDDED_INSTRUCTION_BUNDLE_VERSION,yh as FORBIDDEN_WORKER_ENV_KEYS,oR as GLOBAL_DEFAULT_MODEL,Hc as HARNESS_BUILD_CACHE_RELATIVE_PATHS,na as HEAVY_VERIFICATION_TOKEN_REQUIRED,Pl as HERMES_OPENAI_CODEX_DEFAULT_MODEL,gS as INSTRUCTION_BUNDLE_REFRESH_TTL_MS,_g as KYNVER_NODE_PATCH_FLOOR,hp as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,dd as MEMORY_COST_MANAGED_PACKAGES,ud as MEMORY_COST_PACKAGE_MIN_VERSIONS,sL as MEMORY_LANE_PREVIEW_CHARS,gs as MemoryCostPackageVersionGuardError,Gm as OPENAI_CODEX_PROVIDER,Tr as OPENAI_COMPATIBLE_PROVIDER,Zy as OPENAI_COMPATIBLE_SYSTEM_PROMPT,IL as ORCHESTRATION_ACTION_KINDS,TL as ORCHESTRATION_POLICY_DECISIONS,Ym as ORCHESTRATION_POLICY_MODES,xo as OpenAiCompatibleConfigError,Fe as PACKAGE_VERSION,pS as PINNED_INSTRUCTION_BUNDLE_PUBLIC_KEYS,K$ as PRIVATE_ROOT_NODE_RANGE,us as PUBLISHED_NODE_RANGE,_l as ProductionDatabaseCredentialBlockedError,Iy as REVIEW_WORKER_EXTRA_FORBIDDEN_ENV_KEYS,eN as RUNTIME_CONTEXT_BUDGET_RECEIPT_SCHEMA_VERSION,Tp as RUNTIME_CONTEXT_BUDGET_RECEIPT_V2_SCHEMA_VERSION,sN as RUNTIME_PROMPT_ENFORCEMENT,Ko as RUN_METADATA_ACTIVE_SIGNAL_MS,DS as TERMINAL_WORKER_ARCHIVE_AGE_MS,wL as TRANSIENT_OPENAI_CODEX_ERROR_CLASSES,ml as WORKER_PERSONA_CATALOG,$L as applyProductionDatabaseToProcess,Wc as archiveTerminalWorkerMetadata,fd as assertMemoryCostPackageVersionGuard,kp as assertProductionDatabaseResolutionAllowed,aa as assessAutoCompleteEligibility,In as assessBuildAdmission,Ep as assessDispatchModelGuard,Jt as assessExitedWorkerSalvage,ls as assessHeavyVerificationGate,Pf as assessOrphanWorktreeSafety,jp as assessPrHandoffRequirement,qt as assessWorkerLanding,Ld as assessWorkerLandingContract,mT as auditReviewWorkerCredentialScope,hP as auditWorkerEnv,Rn as autoCompleteWorker,bm as autoCompleteWorkerCli,Ii as buildBoxResourceSnapshotFromGate,cL as buildChatMemoryShadowPreview,Jy as buildCodexExecArgv,Bl as buildContextBudgetReceiptV2,aS as buildDispatchTaskText,qm as buildForegroundHarnessIdempotencyKey,jy as buildHermesOpenAiCodexChatArgv,lL as buildLegacyChatMemorySection,gd as buildMemoryCostPackageGuardInput,Ng as buildNodeRuntimeDoctorReport,eR as buildOpenAiCompatibleChatRequest,rR as buildOpenAiCompatibleRunnerConfig,mp as buildOrchestrationProviderInventory,Hl as buildPrompt,oN as buildPromptWithReceipt,jo as buildRunListRows,ji as buildRuntimeIdentity,Za as buildSystemdRunArgv,ir as buildWorkerSpawnEnv,Lo as canonicalJsonStringify,ct as canonicalWorkerDir,uS as chatMemoriesToPreviewItems,Iu as classifyHeavyShellCommand,dk as classifyNpmAuditOutcome,RS as classifyOpenAiCodexError,Oy as classifyOrchestrationRisk,Ad as classifyRepoSearchMeta,Ga as classifyShellCommandOutcome,Fn as classifyVercelUrl,Bu as classifyWorkerHealth,Ai as cleanupWslCrashDumps,_p as codexProvider,af as collectFilesystemLiveRunKeys,YE as collectVercelEvidence,Py as compareProviderCandidates,hs as compareSemver,mc as completeWorker,Ck as computeAttention,uL as computeInstructionBundleVersion,L as computeWorkerStatus,ra as countActiveHeavyVerificationSlots,Li as createRun,po as defaultBoxId,Bm as deriveInstructionBundleKeyId,oo as deriveRunStatus,Va as diagnoseRepoSearchFailure,Ft as discoverDefaultRepo,cd as discoverDefaultRepoCandidates,Ht as discoverDefaultRepoForPersistence,Nc as discoverProductionDbEnvFilePaths,Ot as dispatchRun,wc as drainPlanOutbox,sp as enforceCursorWorkerProvider,hd as enforceMemoryCostPackageGuardAtStartup,Vm as ensureInstructionBundle,ql as ensurePrReadyHandoff,Np as estimateTokensFromChars,$P as evaluateMemoryCostPackageGuardAtStartup,Oa as evaluateMemoryCostPackageVersionGuard,Ln as evaluateNodeRuntimePolicy,UL as evaluateOrchestrationPolicy,Qg as evidenceFromGitHubVercelStatus,op as executorRefRequestsNonCursorWorker,xS as expandHomePath,_L as extractOpenAiCompatibleCompletion,Ec as extractPlanOutboxFromTask,$p as extractPrUrlFromText,Od as extractSearchMeta,Id as extractSearchMetaFromToolLine,yR as finalizeReceiptTotals,Uu as formatAutoCompleteOutcomeNotice,cS as formatContextPreviewMemoryBlock,SS as formatCronJobDeliveryFailure,gV as formatGoldenPathFailureNotice,mx as formatHarnessToolReadable,nL as formatHeartbeatLine,DP as formatMemoryCostPackageGuardError,cs as formatMonitorTickNotice,bS as formatOpenAiCodexFailureNotice,xc as formatPlanOutboxHandoffBlock,lk as formatRepoSearchGuidance,Ho as formatResolvedDefaultRepo,Lu as formatWorkerCompleteNotice,ia as formatWorkerStatusNotice,Tu as gateWorkerShellCommand,dI as getActiveInstructionBundle,Qr as getActiveInstructionBundleSource,yt as getActiveInstructionBundleVersion,PL as getAdapterContextContract,Vt as getHarnessPaths,Fu as getMonitorStatus,Zr as getOrchestrationProviderCapability,fl as getPersonaDefaultRoleLane,gy as getPersonaDispatchLane,ep as getWorkerPersonaCatalogEntry,ad as gitRepoRoot,Ue as harnessRunsDir,ff as harnessStorageSnapshot,Vr as harnessWorktreesDir,Bo as hasNestedRunsSegment,st as hashPlanBody,bp as hermesCodexProvider,iR as inferModelRoutingFromTask,Km as instructionBundleCachePath,Jr as isActiveHarnessWorker,vV as isAgentRuntimeEnvelopeSchemaVersion,or as isClaudeFamilyProvider,GE as isDashboardVercelUrl,oL as isEngagementRequiredSkip,he as isFinishedWorkerStatus,ps as isForbiddenWorkerEnvKey,gf as isGeneratedHarnessPath,ni as isHarnessExpertReviewWorker,tf as isHarnessRunMetadataPath,Eh as isHarnessWorktreeRepo,is as isHeavyVerificationGateSkipped,Yu as isInspectableVercelTarget,hI as isKnownWorkerPersonaSlug,xh as isKynverMonorepoRoot,Xt as isLandingBlockedWorkerStatus,Vs as isNoProdCredentialReviewEnvironment,Jm as isOrchestrationEnforceTasksEnabled,If as isPipelineCleanupEnabled,ja as isRgExcludeScopeTarget,tN as isRuntimeContextBudgetReceiptV2,Wo as isSignedInstructionBundleShape,Ed as isSingleFileSearchTarget,io as isSystemdRunAvailable,xd as isTerminalHeartbeatPhase,zg as isVercelStatusContext,Na as isWslHost,px as joinHarnessNotice,Wd as landingContractAttentionReason,cg as listActiveHeavyVerificationSlots,OL as listAdapterContextContracts,Rh as listForbiddenWorkerEnvKeys,la as listMonitors,vh as listOperatorAllowedWorkerEnvKeys,ip as listOrchestrationProviderCapabilities,vn as listOutboxItems,pf as listRuns,df as listRunsCli,jm as loadInstructionBundleCache,v as loadUserConfig,KE as main,wu as mergeNodeOptionsForBuildCheck,ak as metaToNormalizedRgCommand,Ty as normalizeCursorModelAlias,Re as normalizeHarnessRoot,bs as normalizeRepoSearchCommand,sk as normalizeRgArgv,So as normalizeWorkerProviderName,gr as observeRunnerDiskGate,Kr as observeWslCrashDumps,yd as observeWslHostDisk,wp as openAiCompatibleProvider,AL as orchestrationAuditForWorkerJson,yo as parseArgs,eA as parseClaudeStream,Pr as parseExecutorRefRoutingIntent,kt as parseHarnessStream,ve as parseHeartbeat,_n as parseRawEd25519Key,Fh as parseWslCrashDumpFilename,Uc as persistDefaultRepo,ci as persistExitedWorkerHandoffCapture,Uo as persistPlan,ma as pickVercelStatusContext,Ro as postJson,MI as preferCursorExecutor,Cl as preflightClaudeModel,cn as preflightCodexModel,un as preflightCursorModel,wl as preflightOpenAiCompatibleModel,bl as probeClaudeOAuthBinding,ap as probeCodexOAuthBinding,Sl as probeCursorOAuthBinding,pp as probeHermesCliAdapter,js as probeHermesOpenAiCodexBinding,aT as probeOrchestrationProviderBinding,md as probeRepoPackageVersions,cp as providerCapableForRisk,P as readJson,Hh as readKernelCorePattern,qn as readMemAvailableBytes,PS as readProductionDbKeysFromEnvFile,Kh as readWslConfigCrashDumpSettings,ta as reclaimStaleHeavyVerificationSlots,Fc as reconcileLocalOnlyMergedPrAttention,uf as reconcileRunsCli,$o as reconcileStaleWorkers,Bc as reconcileWorkerMetadata,gW as reconcileWorkerMetadataCli,Ic as redactHarness,at as redactProviderErrorText,as as releaseHeavyVerificationSlot,zL as remediateDefaultRepo,Lc as repairMissingRunMetadata,YL as repairNestedRunsPath,U as resolveBaseUrl,BA as resolveBoxKindFromEnv,pl as resolveBundlePersona,aI as resolveCallbackSecret,J as resolveCallbackSecretWithMint,Ar as resolveCodexOrchestrationAdapter,Ks as resolveConfiguredWorkerProvider,Ze as resolveDefaultRepo,Mc as resolveDefaultRepoForPersistence,li as resolveExitedWorkerFinalResult,Nl as resolveGlobalDefaultModel,ge as resolveHarnessRoot,$S as resolveHarnessRunByName,mf as resolveHarnessRunCli,os as resolveHeavyVerificationMaxConcurrent,Fm as resolveInstructionBundlePublicKey,Er as resolveInstructionText,xp as resolveModelFallback,vS as resolveOpenAiCodexRetryBudget,Il as resolveOpenAiCompatibleDefaultModel,Qy as resolveOpenAiCompatibleEndpoint,Ac as resolveOrchestrationPolicyMode,gp as resolveOrchestrationRouting,an as resolvePolicyThreshold,OS as resolveProductionDatabaseUrl,dc as resolveRunTargetArg,RV as resolveRuntimeEnvelopeWriterConfig,Xg as resolveVercelInspectTarget,ef as resolveWorkerJsonPath,Qs as resolveWorkerLaunch,br as resolveWorkerTargetArgs,gm as resolveWorkerUsagePayload,Bh as resolveWslCrashDumpDir,vd as resolveWslWindowsUsername,Nu as runBoundedBuildCheck,Xi as runDaemon,xn as runDirHasActiveRetentionSignals,ou as runHarnessCleanup,oa as runHarnessVerifyCommands,Un as runMonitorTick,Af as runPipelineHarnessCleanup,ym as runStatus,JE as runtimeEnvelopeV2Enabled,Mi as safeDatabaseUrlHint,CS as sanitizeOrchestrationAudit,$m as saveInstructionBundleCache,ke as saveUserConfig,bh as scrubClaudeEnv,ms as scrubWorkerEnv,vt as sectionReceiptFromMarkdown,vl as selectCheapestCapableProvider,pd as semverAtLeast,Zd as setActiveInstructionBundle,Lm as shouldAutoCleanupWslCrashDumps,kd as shouldEnforceMemoryCostPackageGuardCli,LO as shouldTreatRgNoMatchAsSuccess,Sm as spawnCompletionSidecar,Ku as spawnMonitorSidecar,gc as spawnWorkerProcess,xm as startWorker,vm as stopWorker,Dd as summarizeEvent,uk as summarizeNpmAuditReport,fk as summarizeShellToolCallEvent,$h as summarizeWslCrashDumpRecoverySteps,Dh as summarizeWslRecoverySteps,Go as sweepRun,Rm as tailWorker,Hs as taskAllowsClaudeWorker,Sy as taskExpressesWorkerProviderPreference,wr as terminalFinalResultFromHeartbeat,Tn as tryAcquireHeavyVerificationSlot,ko as tryResolveBaseUrl,ul as tryResolveCallbackSecretWithMint,vs as unwrapShellWrapperCommand,rN as upgradeReceiptToV2,Gu as usage,eh as validateJobEnvelope,lM as validateOwnedPaths,um as validateRepo,fi as validateRunId,cM as validateTailLines,Nv as validateWorkerName,mS as verifyInstructionBundleSignatureWithKey,fV as verifyLocalCodexGoldenPath,Hm as verifySignedInstructionBundle,Au as waitForHeavyVerificationSlot,sf as workerDirHasActiveRetentionSignals,kI as workerPersonaLandingSlugs,rp as workerPersonaReviewSlugs,km as workerStatus,ue as writeJson,Pi as writeOutboxItem};