@kynver-app/runtime 0.2.59 → 0.2.62

package/dist/server/worker-policy.js

@@ -1,2 +1,2 @@
-var i=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function H(e){let r=e[kr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function v(e,r={}){return yr.has(e)?!0:_r.has(e)||r.operatorAllow?.has(e)||br.some(t=>e.endsWith(t))?!1:vr.some(t=>e.endsWith(t))}function pe(e){let r=H(e);return Object.keys(e).filter(t=>v(t,{operatorAllow:r})).sort()}function me(e){let r=H(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!v(t,{operatorAllow:r})&&v(t)).sort()}function O(e){let r=H(e),t={...e};for(let n of Object.keys(t))v(n,{operatorAllow:r})&&delete t[n];return t}function xr(e){let r=pe(e),t=me(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var hr,yr,vr,Rr,_r,br,kr,C=i(()=>{"use strict";hr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],yr=new Set(hr),vr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],Rr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],_r=new Set(Rr),br=["_PUBLIC_KEY"],kr="KYNVER_WORKER_ENV_ALLOW"});var g=i(()=>{"use strict"});function Y(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=i(()=>{"use strict"});var q=i(()=>{"use strict";g();a();C()});var z=i(()=>{"use strict";q();g()});var p=i(()=>{"use strict"});var P=i(()=>{"use strict"});var _e=i(()=>{"use strict"});var gn,hn,J=i(()=>{"use strict";gn=25*1024*1024*1024,hn=12*1024*1024*1024});var bn,kn,be=i(()=>{"use strict";J();bn=5*1024*1024*1024,kn=10*1024*1024*1024});var An,wn,X=i(()=>{"use strict";be();J();An=30*1024*1024*1024,wn=15*1024*1024*1024});var xe=i(()=>{"use strict";a()});import Ur from"node:path";var Bn,Q=i(()=>{"use strict";g();xe();Bn=Ur.join(".openclaw","harness")});var N=i(()=>{"use strict";m();p();P();T();Q()});var Oe=i(()=>{"use strict";m();Q();N();a()});var ee=i(()=>{"use strict";Oe();a()});var Ce=i(()=>{"use strict";ee();a()});var Ae=i(()=>{"use strict"});var we=i(()=>{"use strict";Ae();a()});var Pe=i(()=>{"use strict"});var Ie=i(()=>{"use strict";Pe()});var Ne=i(()=>{"use strict";Ie();a()});var Te=i(()=>{"use strict"});var We=i(()=>{"use strict"});var Ke=i(()=>{"use strict"});var re=i(()=>{"use strict"});var Me=i(()=>{"use strict"});var De=i(()=>{"use strict";re();Me()});var Be=i(()=>{"use strict";we();Ne();Te();We();q();Ke();De();re();a()});var Ue=i(()=>{"use strict";Be()});var Gr,qr,Le=i(()=>{"use strict";_e();m();p();P();T();X();ee();Ce();Ue();a();Gr=500*1024*1024,qr=4*1024*1024*1024});var T=i(()=>{"use strict";Le()});import{homedir as zr}from"node:os";import Jr from"node:path";var Fe,te=i(()=>{"use strict";Fe=Jr.join(zr(),".kynver",".env")});var $e=i(()=>{"use strict"});var He=i(()=>{"use strict";$e()});var je=i(()=>{"use strict"});var ne=i(()=>{"use strict";He();je()});var Ve=i(()=>{"use strict"});var Ye=i(()=>{"use strict";Ve()});var K=i(()=>{"use strict";te();g();m();ne();Ye()});var Ge=i(()=>{"use strict";p();p()});var qe=i(()=>{"use strict";te();ne();K()});var ze=i(()=>{"use strict";z();p();Ge();m();K();qe();a();N()});import{homedir as ot,totalmem as Ts}from"node:os";import oe from"node:path";var Je,Vs,Ys,Gs,qs,m=i(()=>{"use strict";z();g();a();p();P();T();X();K();ze();N();Je=oe.join(ot(),".kynver"),Vs=oe.join(Je,"config.json"),Ys=oe.join(Je,"credentials"),Gs=500*1024*1024,qs=4*1024*1024*1024});C();C();var j="KYNVER_NO_PROD_DB_CREDENTIALS",Er=["KYNVER_ENV_FILE"],Sr=new Set(["1","true","yes","on"]);function ge(e){let r=e[j]?.trim().toLowerCase();return r!==void 0&&Sr.has(r)}function d(e,r={}){let t=O(e);if(!r.reviewWorker)return t;let n={...t,[j]:"1"};for(let o of Er)delete n[o];return n}var fe=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Or(e,r={}){let t=d(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||fe.includes(c)),o=fe.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=ge(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:o,envFilePointerStripped:s,safe:o&&n.length===0&&s&&(!r.reviewWorker||l)}}var Cr="expert-lane-pr-review:",Ar="plan-review-task",wr="scheduledjob:",A=new Set(["lorentz","dalton","rhea","sentinel"]);function Pr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function V(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|risk register|signoff|verification|evidence|prove|gate)\b/.test(e)}function Ir(e,r){return e.startsWith("factory:")?e.includes("lb")||V(r):!1}function Nr(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),o=`${t}
-${n}`,s=Pr(e.personaSlug);return!!(r.startsWith(Cr)||r===Ar||r.startsWith("daemon-review:")||s&&A.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Ir(r,o)||V(o))||r.startsWith(wr)&&e.parentTaskId&&s&&A.has(s)||e.planId&&!e.parentTaskId&&s&&A.has(s)&&V(o)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&A.has(s))}var Tr=/^claude[-_]/i,Wr=/^(?:opus|sonnet|haiku)\b/i;function he(e){let r=e.trim();return Tr.test(r)||Wr.test(r)}function ye(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function ve(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Re(e){return e.trim().toLowerCase().startsWith("gemini-")}function Kr(e){return ye(e)?"codex":he(e)?"claude":Re(e)?"gemini":(ve(e),"cursor")}function Mr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:o,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:o,rule:o?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function Dr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?he(n)||ye(n)||ve(n)||Re(n)?{lane:t,model:n,provider:Kr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function w(e){let r=typeof e=="string"?e.trim():"";return r?Mr(r)??Dr(r):null}m();a();var Ze="kynver",er=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],lt=er.map(e=>`mcp__${Ze}__${e}`);a();a();var Ga=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function ut(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var dt=ut();a();var Rl=600*1e3;a();var Nl=600*1e3;var rr="composer-2.5";var f="cursor",gt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"};function nr(e){let r=e.trim().toLowerCase();return gt[r]??r}var ht=new Set(["claude","opus","anthropic"]),yt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function b(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return ht.has(r)?!0:r.includes("claude")||r.includes("opus")}function ie(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=b(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=w(b(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(vt(n.model)))return!0;let o=b(e,"description");if(yt.some(l=>l.test(o)))return!0;let s=b(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function vt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Rt(e,r){return{provider:f,model:rr,rule:`policy:cursor_default${r}`,requestedModel:e}}var _t=["explicit:","executor_ref:","factory:","task:"];function bt(e){return _t.some(r=>e.startsWith(r))}function or(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||w(b(e,"executorRef"))?.provider?!0:ie(e)}function tr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||bt(r.rule)||or(t)||!u(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Rt(r.model,o)}function kt(e,r=f){let t=e?.trim();return t?nr(t):r}function xt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(f)?[...new Set(r.map(t=>u(t)?f:t))]:r.every(t=>u(t))?[f]:r}var Et=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,St=/\b(npm run build\b|next build\b)\b/i,Ot=/\b(vercel (build|deploy|--prod))\b/i,Ct=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function se(e){let r=e.trim();return r?Ct.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:Ot.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:St.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:Et.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var B="heavy_verification_token_required";import{spawnSync as Vt}from"node:child_process";a();import{closeSync as Tt,existsSync as x,mkdirSync as Wt,openSync as Kt,readdirSync as lr,readFileSync as Mt,statSync as Dt,unlinkSync as cr,writeFileSync as Bt}from"node:fs";import ce from"node:path";import{mkdirSync as wt}from"node:fs";import{tmpdir as Pt}from"node:os";import U from"node:path";import{homedir as At}from"node:os";import ir from"node:path";function sr(){let e=process.env.KYNVER_STATE_ROOT;return e?ir.resolve(e):ir.join(At(),".kynver","state")}function It(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function Nt(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?U.resolve(e):It()?U.join(Pt(),"kynver","state","heavy-verification"):U.join(sr(),"heavy-verification")}function ae(){return U.join(Nt(),"slots")}function k(){let e=ae();return wt(e,{recursive:!0}),e}var E=120*6e4,ar=1;function Ut(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function F(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function L(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?Ut(e,ar):ar}function Lt(e){return`slot-${e}`}function Ft(e,r=ae()){return ce.join(r,`${e}.json`)}function ue(e){if(!x(e))return null;try{let r=JSON.parse(Mt(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function ur(e,r=E){if(!e||!Y(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function dr(e,r){let t=ue(e);if(t)return ur(t,r);if(!x(e))return!0;try{return Date.now()-Dt(e).mtimeMs>r}catch{return!0}}function $t(e,r){if(dr(e,r))try{cr(e)}catch{}}function Ht(e){return Wt(e,{recursive:!0}),e}function de(e={}){let r=Ht(e.slotsDir??k()),t=e.staleMs??E,n=0;for(let o of lr(r)){if(!o.endsWith(".json"))continue;let s=ce.join(r,o),l=x(s);$t(s,t),l&&!x(s)&&(n+=1)}return n}function jt(e={}){let r=e.slotsDir??k(),t=e.staleMs??E;de({slotsDir:r,staleMs:t});let n=[];for(let o of lr(r)){if(!o.endsWith(".json"))continue;let s=ue(ce.join(r,o));s&&!ur(s,t)&&n.push(s)}return n}function le(e={}){return jt(e).length}function S(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??k(),n=r.staleMs??E,o=r.maxSlots??L();de({slotsDir:t,staleMs:n});for(let l=0;l<o;l+=1){let c=Lt(l),h=Ft(c,t),mr=ue(h);if(dr(h,n))try{cr(h)}catch{}else if(mr||x(h))continue;let fr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let y=Kt(h,"wx");Bt(y,JSON.stringify(fr,null,2),"utf8"),Tt(y);let gr=le({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:gr,maxSlots:o,reason:null}}catch(y){if(y.code==="EEXIST")continue;throw y}}let s=le({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:o,reason:`heavy verification at capacity (${s}/${o} slots)`}}function $(e,r={}){if(F())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:L(),reason:null};let t=r.slotsDir??k(),n=r.staleMs??E,o=r.maxSlots??L();de({slotsDir:t,staleMs:n});let s=le({slotsDir:t,staleMs:n}),l=s<o;return{admitted:l,slotId:null,activeSlots:s,maxSlots:o,reason:l?null:`heavy verification at capacity (${s}/${o} slots); waiting for ${e}`}}function Yt(e){e<=0||Vt(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function pr(e,r,t=2e3,n={}){let o=Date.now()+Math.max(0,r),s=S(e,n);for(;!s.admitted&&Date.now()<o;)Yt(Math.min(t,o-Date.now())),s=S(e,n);return s}function Gt(e,r={}){let t=se(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...$(e),slotId:null}};if(F())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...$(e),slotId:null}};let n=r.waitMs??0,o=n>0?pr(e,n,r.pollMs):S(e);return o.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:o}:{allowed:!1,outcome:B,commandClass:t.commandClass,reason:t.reason??o.reason??B,verificationGate:o}}export{f as DEFAULT_WORKER_PROVIDER,B as HEAVY_VERIFICATION_TOKEN_REQUIRED,j as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Or as auditReviewWorkerCredentialScope,xr as auditWorkerEnv,d as buildWorkerSpawnEnv,se as classifyHeavyShellCommand,tr as enforceCursorWorkerProvider,Gt as gateWorkerShellCommand,u as isClaudeFamilyProvider,v as isForbiddenWorkerEnvKey,Nr as isHarnessExpertReviewWorker,ge as isNoProdCredentialReviewEnvironment,pe as listForbiddenWorkerEnvKeys,me as listOperatorAllowedWorkerEnvKeys,nr as normalizeWorkerProviderName,xt as preferCursorExecutor,kt as resolveConfiguredWorkerProvider,O as scrubWorkerEnv,ie as taskAllowsClaudeWorker,or as taskExpressesWorkerProviderPreference};
+var i=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function j(e){let r=e[Er];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function v(e,r={}){return Rr.has(e)?!0:kr.has(e)||r.operatorAllow?.has(e)||xr.some(t=>e.endsWith(t))?!1:_r.some(t=>e.endsWith(t))}function ge(e){let r=j(e);return Object.keys(e).filter(t=>v(t,{operatorAllow:r})).sort()}function he(e){let r=j(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!v(t,{operatorAllow:r})&&v(t)).sort()}function C(e){let r=j(e),t={...e};for(let n of Object.keys(t))v(n,{operatorAllow:r})&&delete t[n];return t}function Sr(e){let r=ge(e),t=he(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var vr,Rr,_r,br,kr,xr,Er,A=i(()=>{"use strict";vr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Rr=new Set(vr),_r=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],br=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],kr=new Set(br),xr=["_PUBLIC_KEY"],Er="KYNVER_WORKER_ENV_ALLOW"});var g=i(()=>{"use strict"});function q(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=i(()=>{"use strict"});var J=i(()=>{"use strict";g();a();A()});var X=i(()=>{"use strict";J();g()});var m=i(()=>{"use strict"});var I=i(()=>{"use strict"});var xe=i(()=>{"use strict"});var Rn,_n,Q=i(()=>{"use strict";Rn=25*1024*1024*1024,_n=12*1024*1024*1024});var Sn,On,Ee=i(()=>{"use strict";Q();Sn=5*1024*1024*1024,On=10*1024*1024*1024});var Nn,Tn,Z=i(()=>{"use strict";Ee();Q();Nn=30*1024*1024*1024,Tn=15*1024*1024*1024});var Oe=i(()=>{"use strict";a()});import Fr from"node:path";var $n,ee=i(()=>{"use strict";g();Oe();$n=Fr.join(".openclaw","harness")});var T=i(()=>{"use strict";f();m();I();W();ee()});var we=i(()=>{"use strict";f();ee();T();a()});var te=i(()=>{"use strict";we();a()});var Pe=i(()=>{"use strict";te();a()});var Ie=i(()=>{"use strict"});var Ne=i(()=>{"use strict";Ie();a()});var Te=i(()=>{"use strict"});var We=i(()=>{"use strict";Te()});var Ke=i(()=>{"use strict";We();a()});var Me=i(()=>{"use strict"});var De=i(()=>{"use strict"});var Be=i(()=>{"use strict"});var ne=i(()=>{"use strict"});var Ue=i(()=>{"use strict"});var Le=i(()=>{"use strict";ne();Ue()});var Fe=i(()=>{"use strict";Ne();Ke();Me();De();J();Be();Le();ne();a()});var $e=i(()=>{"use strict";Fe()});var zr,Jr,He=i(()=>{"use strict";xe();f();m();I();W();Z();te();Pe();$e();a();zr=500*1024*1024,Jr=4*1024*1024*1024});var W=i(()=>{"use strict";He()});import{homedir as Xr}from"node:os";import Qr from"node:path";var Ve,oe=i(()=>{"use strict";Ve=Qr.join(Xr(),".kynver",".env")});var je=i(()=>{"use strict"});var Ye=i(()=>{"use strict";je()});var Ge=i(()=>{"use strict"});var ie=i(()=>{"use strict";Ye();Ge()});var qe=i(()=>{"use strict"});var ze=i(()=>{"use strict";qe()});var M=i(()=>{"use strict";oe();g();f();ie();ze()});var Je=i(()=>{"use strict";m();m()});var Xe=i(()=>{"use strict";oe();ie();M()});var Qe=i(()=>{"use strict";X();m();Je();f();M();Xe();a();T()});function _(e){let r=e.trim().toLowerCase();return at[r]??r}var Ze,st,at,D=i(()=>{"use strict";Ze=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],st=Ze.join("|"),at={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});import{homedir as ct,totalmem as Bs}from"node:os";import se from"node:path";var er,Xs,Qs,Zs,ea,f=i(()=>{"use strict";X();g();a();m();I();W();Z();M();Qe();D();T();er=se.join(ct(),".kynver"),Xs=se.join(er,"config.json"),Qs=se.join(er,"credentials"),Zs=500*1024*1024,ea=4*1024*1024*1024});A();A();var Y="KYNVER_NO_PROD_DB_CREDENTIALS",Or=["KYNVER_ENV_FILE"],Cr=new Set(["1","true","yes","on"]);function ve(e){let r=e[Y]?.trim().toLowerCase();return r!==void 0&&Cr.has(r)}function p(e,r={}){let t=C(e);if(!r.reviewWorker)return t;let n={...t,[Y]:"1"};for(let o of Or)delete n[o];return n}var ye=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Ar(e,r={}){let t=p(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||ye.includes(c)),o=ye.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=ve(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:o,envFilePointerStripped:s,safe:o&&n.length===0&&s&&(!r.reviewWorker||l)}}var wr="expert-lane-pr-review:",Pr="plan-review-task",Ir="scheduledjob:",w=new Set(["lorentz","dalton","rhea","sentinel"]);function Nr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function G(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|risk register|signoff|verification|evidence|prove|gate)\b/.test(e)}function Tr(e,r){return e.startsWith("factory:")?e.includes("lb")||G(r):!1}function Wr(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),o=`${t}
+${n}`,s=Nr(e.personaSlug);return!!(r.startsWith(wr)||r===Pr||r.startsWith("daemon-review:")||s&&w.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Tr(r,o)||G(o))||r.startsWith(Ir)&&e.parentTaskId&&s&&w.has(s)||e.planId&&!e.parentTaskId&&s&&w.has(s)&&G(o)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&w.has(s))}var Kr=/^claude[-_]/i,Mr=/^(?:opus|sonnet|haiku)\b/i;function Re(e){let r=e.trim();return Kr.test(r)||Mr.test(r)}function _e(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function be(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function ke(e){return e.trim().toLowerCase().startsWith("gemini-")}function Dr(e){return _e(e)?"codex":Re(e)?"claude":ke(e)?"gemini":(be(e),"cursor")}function Br(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:o,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:o,rule:o?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function Ur(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Re(n)||_e(n)||be(n)||ke(n)?{lane:t,model:n,provider:Dr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function P(e){let r=typeof e=="string"?e.trim():"";return r?Br(r)??Ur(r):null}f();a();var nr="kynver",or=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],mt=or.map(e=>`mcp__${nr}__${e}`);a();a();var Za=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function gt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var ht=gt();a();var Sl=600*1e3;a();var Bl=600*1e3;var ir="composer-2.5";D();D();var d="cursor",_t=new Set(["claude","opus","anthropic"]),bt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function k(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return _t.has(r)?!0:r.includes("claude")||r.includes("opus")}function ae(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=k(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=P(k(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(kt(n.model)))return!0;let o=k(e,"description");if(bt.some(l=>l.test(o)))return!0;let s=k(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function kt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function xt(e,r){return{provider:d,model:ir,rule:`policy:cursor_default${r}`,requestedModel:e}}var Et=["explicit:","executor_ref:","factory:","task:"];function St(e){return Et.some(r=>e.startsWith(r))}function le(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||P(k(e,"executorRef"))?.provider?!0:ae(e)}function sr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||St(r.rule)||le(t)||!u(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return xt(r.model,o)}function Ot(e,r=d){let t=e?.trim();return t?_(t):r}function Ct(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(d)?[...new Set(r.map(t=>u(t)?d:t))]:r.every(t=>u(t))?[d]:r}var At=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,wt=/\b(npm run build\b|next build\b)\b/i,Pt=/\b(vercel (build|deploy|--prod))\b/i,It=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function ce(e){let r=e.trim();return r?It.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:Pt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:wt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:At.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var L="heavy_verification_token_required";import{spawnSync as zt}from"node:child_process";a();import{closeSync as Dt,existsSync as E,mkdirSync as Bt,openSync as Ut,readdirSync as ur,readFileSync as Lt,statSync as Ft,unlinkSync as dr,writeFileSync as $t}from"node:fs";import pe from"node:path";import{mkdirSync as Tt}from"node:fs";import{tmpdir as Wt}from"node:os";import F from"node:path";import{homedir as Nt}from"node:os";import ar from"node:path";function lr(){let e=process.env.KYNVER_STATE_ROOT;return e?ar.resolve(e):ar.join(Nt(),".kynver","state")}function Kt(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function Mt(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?F.resolve(e):Kt()?F.join(Wt(),"kynver","state","heavy-verification"):F.join(lr(),"heavy-verification")}function ue(){return F.join(Mt(),"slots")}function x(){let e=ue();return Tt(e,{recursive:!0}),e}var S=120*6e4,cr=1;function Ht(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function H(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function $(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?Ht(e,cr):cr}function Vt(e){return`slot-${e}`}function jt(e,r=ue()){return pe.join(r,`${e}.json`)}function me(e){if(!E(e))return null;try{let r=JSON.parse(Lt(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function pr(e,r=S){if(!e||!q(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function mr(e,r){let t=me(e);if(t)return pr(t,r);if(!E(e))return!0;try{return Date.now()-Ft(e).mtimeMs>r}catch{return!0}}function Yt(e,r){if(mr(e,r))try{dr(e)}catch{}}function Gt(e){return Bt(e,{recursive:!0}),e}function fe(e={}){let r=Gt(e.slotsDir??x()),t=e.staleMs??S,n=0;for(let o of ur(r)){if(!o.endsWith(".json"))continue;let s=pe.join(r,o),l=E(s);Yt(s,t),l&&!E(s)&&(n+=1)}return n}function qt(e={}){let r=e.slotsDir??x(),t=e.staleMs??S;fe({slotsDir:r,staleMs:t});let n=[];for(let o of ur(r)){if(!o.endsWith(".json"))continue;let s=me(pe.join(r,o));s&&!pr(s,t)&&n.push(s)}return n}function de(e={}){return qt(e).length}function O(e,r={}){if(H())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:$(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??S,o=r.maxSlots??$();fe({slotsDir:t,staleMs:n});for(let l=0;l<o;l+=1){let c=Vt(l),h=jt(c,t),gr=me(h);if(mr(h,n))try{dr(h)}catch{}else if(gr||E(h))continue;let hr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let y=Ut(h,"wx");$t(y,JSON.stringify(hr,null,2),"utf8"),Dt(y);let yr=de({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:yr,maxSlots:o,reason:null}}catch(y){if(y.code==="EEXIST")continue;throw y}}let s=de({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:o,reason:`heavy verification at capacity (${s}/${o} slots)`}}function V(e,r={}){if(H())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:$(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??S,o=r.maxSlots??$();fe({slotsDir:t,staleMs:n});let s=de({slotsDir:t,staleMs:n}),l=s<o;return{admitted:l,slotId:null,activeSlots:s,maxSlots:o,reason:l?null:`heavy verification at capacity (${s}/${o} slots); waiting for ${e}`}}function Jt(e){e<=0||zt(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function fr(e,r,t=2e3,n={}){let o=Date.now()+Math.max(0,r),s=O(e,n);for(;!s.admitted&&Date.now()<o;)Jt(Math.min(t,o-Date.now())),s=O(e,n);return s}function Xt(e,r={}){let t=ce(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...V(e),slotId:null}};if(H())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...V(e),slotId:null}};let n=r.waitMs??0,o=n>0?fr(e,n,r.pollMs):O(e);return o.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:o}:{allowed:!1,outcome:L,commandClass:t.commandClass,reason:t.reason??o.reason??L,verificationGate:o}}export{d as DEFAULT_WORKER_PROVIDER,L as HEAVY_VERIFICATION_TOKEN_REQUIRED,Y as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Ar as auditReviewWorkerCredentialScope,Sr as auditWorkerEnv,p as buildWorkerSpawnEnv,ce as classifyHeavyShellCommand,sr as enforceCursorWorkerProvider,Xt as gateWorkerShellCommand,u as isClaudeFamilyProvider,v as isForbiddenWorkerEnvKey,Wr as isHarnessExpertReviewWorker,ve as isNoProdCredentialReviewEnvironment,ge as listForbiddenWorkerEnvKeys,he as listOperatorAllowedWorkerEnvKeys,_ as normalizeWorkerProviderName,Ct as preferCursorExecutor,Ot as resolveConfiguredWorkerProvider,C as scrubWorkerEnv,ae as taskAllowsClaudeWorker,le as taskExpressesWorkerProviderPreference};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.2.59",
+  "version": "0.2.62",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",