@kynver-app/runtime 0.2.77 → 0.2.88

package/dist/server/monitor.js

@@ -1,8 +1,8 @@
-var u=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function J(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let t=JSON.parse(r);if(t&&typeof t=="object"&&!Array.isArray(t))return t}catch{return null}return null}function ye(e){let r=e.trim();if(!r)return null;let t=J(r);if(t)return t;let n=[],s=/```(?:json)?\s*([\s\S]*?)```/gi,o;for(;(o=s.exec(r))!==null;){let l=J(o[1]??"");l&&n.push(l)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let l=J(r.slice(i,a+1));l&&n.push(l)}return n.length>0?n[n.length-1]:null}function be(e){let r=e.finalResult??e.final_result;if(r!=null)return typeof r=="string"?ye(r)??(r.trim()||null):r;let t=typeof e.summary=="string"?e.summary.trim():"";if(!t)return null;let n=ye(t);return n||t}var ke=u(()=>{"use strict"});import{existsSync as Lr,mkdirSync as hn,readFileSync as Hr,readdirSync as yn,renameSync as bn,rmSync as kn,statSync as Re,writeFileSync as Rn}from"node:fs";function q(e){console.error(e),process.exit(1)}function X(e){return process.platform!=="win32"?e:{windowsHide:!0,...e}}function I(e){try{return JSON.parse(e)}catch{return null}}function P(e){try{return Re(e).size}catch{return 0}}function N(e){try{return Re(e).mtime.toISOString()}catch{return null}}function xe(e,r){return Lr(e)?Hr(e,"utf8").split(`
+var u=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function J(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let t=JSON.parse(r);if(t&&typeof t=="object"&&!Array.isArray(t))return t}catch{return null}return null}function ke(e){let r=e.trim();if(!r)return null;let t=J(r);if(t)return t;let n=[],s=/```(?:json)?\s*([\s\S]*?)```/gi,o;for(;(o=s.exec(r))!==null;){let l=J(o[1]??"");l&&n.push(l)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let l=J(r.slice(i,a+1));l&&n.push(l)}return n.length>0?n[n.length-1]:null}function be(e){let r=e.finalResult??e.final_result;if(r!=null)return typeof r=="string"?ke(r)??(r.trim()||null):r;let t=typeof e.summary=="string"?e.summary.trim():"";if(!t)return null;let n=ke(t);return n||t}var Re=u(()=>{"use strict"});var xe=u(()=>{"use strict"});import{existsSync as jr,mkdirSync as vn,readFileSync as Yr,readdirSync as En,renameSync as Cn,rmSync as An,statSync as Se,writeFileSync as wn}from"node:fs";function q(e){console.error(e),process.exit(1)}function X(e){return process.platform!=="win32"?e:{windowsHide:!0,...e}}function I(e){try{return JSON.parse(e)}catch{return null}}function P(e){try{return Se(e).size}catch{return 0}}function T(e){try{return Se(e).mtime.toISOString()}catch{return null}}function _e(e,r){return jr(e)?Yr(e,"utf8").split(`
 `).slice(-r).join(`
-`):""}function W(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}function Se(e){let r=null,t=-1/0;for(let n of e){if(!n)continue;let s=Date.parse(n);Number.isFinite(s)&&s>t&&(t=s,r=n)}return r}function Z(e){return Math.max(0,Math.round((Date.now()-e)/1e3))}var p=u(()=>{"use strict"});import{existsSync as $r,readFileSync as jr}from"node:fs";function _e(e){return e==="complete"}function ve(e){return _e(e.lastHeartbeatPhase)?e.terminalFinalResult!==void 0&&e.terminalFinalResult!==null?e.terminalFinalResult:e.lastHeartbeatSummary?.trim()||"completed":null}function Ee(e){let r={heartbeatCount:0,lastHeartbeatAt:null,lastHeartbeatPhase:null,lastHeartbeatSummary:null,terminalFinalResult:null,heartbeatBlocker:null,timestampAnomalies:[],lastBoxResourceSnapshot:null,lastPrEvidence:[]};if(!$r(e))return r;let t=Date.now()+Yr,n=new Date(t).toISOString(),s=jr(e,"utf8").split(`
-`).filter(Boolean);for(let o of s){let i=I(o);if(!i||typeof i!="object"||Array.isArray(i))continue;let a=i;if(r.heartbeatCount++,a.ts){let l=String(a.ts),c=Date.parse(l);Number.isFinite(c)&&c>t?r.timestampAnomalies.push({kind:"future_heartbeat_timestamp",observedAt:l,clampedTo:n}):r.lastHeartbeatAt=l}a.phase!==void 0&&a.phase!==null&&(r.lastHeartbeatPhase=String(a.phase)),a.summary!==void 0&&a.summary!==null&&(r.lastHeartbeatSummary=String(a.summary)),_e(r.lastHeartbeatPhase)&&(r.terminalFinalResult=be(a)),r.heartbeatBlocker=a.blocker?String(a.blocker):null,a.boxResourceSnapshot&&typeof a.boxResourceSnapshot=="object"&&!Array.isArray(a.boxResourceSnapshot)&&(r.lastBoxResourceSnapshot=a.boxResourceSnapshot),Array.isArray(a.prEvidence)&&(r.lastPrEvidence=a.prEvidence.filter(l=>!!l&&typeof l=="object"&&typeof l.prUrl=="string"))}return r}var Yr,Ce=u(()=>{"use strict";ke();p();Yr=6e4});function we(e){return e?(e.split("/").pop()??e).replace(/\.exe$/i,"").toLowerCase():null}function T(e){if(!e)return[];let r=[],t="",n,s=!1;for(let o of e){if(s){t+=o,s=!1;continue}if(o==="\\"){s=!0;continue}if(n){o===n?n=void 0:t+=o;continue}if(o==='"'||o==="'"){n=o;continue}if(/\s/.test(o)){t&&(r.push(t),t="");continue}t+=o}return t&&r.push(t),r}function Oe(e){let r=we(e[0]);return!!(r&&Vr.has(r))}function zr(e){let r=e.trim();return r.includes("/")?r.split("/").pop()??r:r}function Jr(e){if(!e||e.includes("*"))return null;let r=zr(e);return!r||r.includes("/")?null:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(r)?r:null}function Ie(e){return!e||e.includes("/")||e.includes("*")?!1:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(e)}function Q(e){if(!e)return!1;let r=e.trim();return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")}function qr(e){if(!e.startsWith("--glob="))return e;let r=e.slice(7);return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")?`--glob=${r}/**`:e}function Xr(e){let r=[];for(let t=1;t<e.length;t+=1){let n=e[t];if(n){if(n==="--"){r.push(...e.slice(t+1));break}if(n.startsWith("-")){if(n.includes("="))continue;Ae.has(n)&&(t+=1);continue}r.push(n)}}return r}function Zr(e){let r=!1,t=e.map((s,o)=>{let i=qr(s),a=e[o-1];return a&&Ae.has(a)&&s.startsWith("!")&&!s.includes("/")&&!s.endsWith("/**")&&(i=`${s}/**`),i!==s&&(r=!0),i}),n=Xr(t);if(n.length===2){let[s,o]=n;if(Q(o))return{argv:[t[0]??"rg",s,"-g",`${o}/**`,"."],changed:!0};let i=Jr(o);if(i)return{argv:[t[0]??"rg","-g",i,s,"."],changed:!0}}return r&&n.length===1?{argv:[...t,"."],changed:!0}:{argv:t,changed:r}}function Pe(e){for(let r=1;r<e.length;r+=1){let t=e[r];if(t&&(t==="-c"||t==="-lc"||t==="-cl"||/^-[a-zA-Z]*c[a-zA-Z]*$/u.test(t)))return r+1}return-1}function K(e){let r=e.trim();if(!r)return{command:r,wrapped:!1};let t=T(r);if(!t.length)return{command:r,wrapped:!1};let n=we(t[0]);if(!n||!Gr.has(n))return{command:r,wrapped:!1};let s=Pe(t);if(s<0||s>=t.length)return{command:r,wrapped:!1};let o=t.slice(s).join(" ").trim();return o?{command:o,wrapped:!0}:{command:r,wrapped:!1}}function Qr(e,r){let t=e.trim(),n=T(t),s=Pe(n);if(s<0)return r;let o=n.slice(0,s).join(" "),i=r.includes("'")?`"${r.replace(/"/g,'\\"')}"`:`'${r}'`;return`${o} ${i}`}function et(e){let r=e.trim(),t=K(r),n=T(t.command);if(!n.length||!Oe(n))return{segment:r,changed:!1};let s=Zr(n);if(!s.changed)return{segment:r,changed:!1};let o=s.argv.join(" ");return t.wrapped?{segment:Qr(r,o),changed:!0}:{segment:o,changed:!0}}function ee(e){let r=e.trim();if(!r)return{command:r,changed:!1};let t=r.includes("&&")?" && ":r.includes("||")?" || ":"; ",n=r.split(/\s*(?:&&|\|\||;)\s*/u),s=!1,o=n.map(i=>{let a=et(i);return a.changed&&(s=!0),a.segment});return s?{command:o.join(t),changed:!0}:{command:r,changed:!1}}function Ne(e){let r=K(e).command,t=T(r.trim());return t.length&&Oe(t)?!0:/\b(rg|ripgrep)\b/i.test(r)}function We(e){if(!e)return{};let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(|$)/iu);if(r)return{pattern:r[1],target:r[2]?.trim()};let t=e.match(/^search\s+"(.+)"\s+in\s+(.+)$/iu);return t?{pattern:t[1],target:t[2]?.trim()}:{}}function rt(e){let{pattern:r,target:t}=We(e);return r?Q(t)?{kind:"rg_exclude_syntax",pattern:r,target:t}:Ie(t)?{kind:"bad_scope",pattern:r,target:t}:{kind:"not_repo_search",pattern:r,target:t}:{kind:"not_repo_search"}}function tt(e){let{pattern:r,target:t}=We(e);if(!r)return null;if(Q(t)){let n=`${t.trim()}/**`;return{command:`rg "${r}" -g '${n}' .`,changed:!0}}return t&&Ie(t)?{command:`rg -g ${t} "${r}" .`,changed:!0}:null}function nt(e){if(e.kind==="bad_scope"&&e.pattern&&e.target)return`Use \`rg -g '${e.target}' ${e.pattern} .\` from the repo root instead of treating ${e.target} as a folder.`;if(e.kind==="rg_exclude_syntax"&&e.pattern){let r=e.target?`${e.target.trim()}/**`:"!node_modules/**";return`Repo search scope \`${e.target??"!node_modules"}\` is not a valid ripgrep path. Use \`rg "${e.pattern}" -g '${r}' .\` from the repo root (exclude globs need a \`/**\` suffix).`}return e.kind==="no_matches"&&e.pattern?`No matches for "${e.pattern}". Try a broader pattern, drop overly short tokens, or search from the repo root with \`rg "${e.pattern}" .\`.`:null}function ot(e){let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(agent\)|\s*failed|$)/iu);return r?`search "${r[1]}" in ${r[2]?.trim()}`:null}function re(e){let r=e.meta?.trim()||(e.command?ot(e.command):null)||null;if(r){let t=rt(r),n=nt(t);if(n)return n;let s=tt(r);if(s?.changed)return`Repo search used an invalid scope. Retry with: \`${s.command}\`.`}if(e.command&&/\b(rg|ripgrep)\b/i.test(e.command)){let t=ee(e.command);if(t.changed)return`Ripgrep scope may be invalid. Retry with: \`${t.command}\`.`;if(e.exitCode===1)return"Ripgrep returned no matches (exit 1). Try a broader pattern or search from the repo root."}return null}var Vr,Gr,Ae,Te=u(()=>{"use strict";Vr=new Set(["rg","ripgrep","grep"]),Gr=new Set(["bash","sh","dash","zsh"]),Ae=new Set(["-e","--regexp","-f","--file","-m","--max-count","-A","--after-context","-B","--before-context","-C","--context","-g","--glob","--iglob"])});function v(e,r=200){let t=e.replace(/\s+/g," ").trim();return t.length>r?`${t.slice(0,r-1)}\u2026`:t}function at(e){let r=e.trim();if(!r)return null;if(r.startsWith("{"))try{return JSON.parse(r)}catch{}let t=r.indexOf("{"),n=r.lastIndexOf("}");if(t>=0&&n>t)try{return JSON.parse(r.slice(t,n+1))}catch{return null}return null}function E(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function lt(e){let r=e.metadata;if(!E(r))return null;let t=r.vulnerabilities;if(!E(t))return null;let n=o=>typeof t[o]=="number"?t[o]:0,s={info:n("info"),low:n("low"),moderate:n("moderate"),high:n("high"),critical:n("critical"),total:n("total")};return typeof t.total!="number"&&!s.critical&&!s.high&&!s.moderate&&!s.low&&!s.info?null:s}function ut(e){let r=[];e.critical&&r.push(`${e.critical} critical`),e.high&&r.push(`${e.high} high`),e.moderate&&r.push(`${e.moderate} moderate`),e.low&&r.push(`${e.low} low`),e.info&&r.push(`${e.info} info`);let t=r.length?r.join(", "):"see report";return`npm audit: ${e.total} vulnerabilit${e.total===1?"y":"ies"} (${t}) \u2014 remediation required`}function ct(e,r){let t=e.error;if(E(t)){let o=typeof t.summary=="string"?t.summary.trim():"",i=typeof t.code=="string"?t.code.trim():"";if(o)return i?`${i}: ${o}`:o;if(i)return i}let n=typeof e.message=="string"?e.message.trim():"";if(n)return n;let s=r.trim();return s?v(s.split(`
-`).find(Boolean)??s,160):"npm audit failed"}function dt(e){let r=`${e.stdout}
-${e.stderr}`.trim(),t=at(r);if(!t||!E(t)){let s=v(r||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit failed (invalid or missing JSON): ${s}`,parseError:"invalid_json"}}if(E(t.error))return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit command failed: ${ct(t,e.stderr)}`};let n=lt(t);return n?e.exitCode===0&&n.total===0?{kind:"success",exitCode:0,summary:"npm audit: no vulnerabilities reported",audit:n}:{kind:"audit_findings",exitCode:e.exitCode,summary:ut(n),audit:n}:{kind:"command_failure",exitCode:e.exitCode,summary:"npm audit failed: JSON response missing vulnerability metadata",parseError:"missing_metadata"}}function mt(e){return st.test(e)}function ft(e){let r=K(e).command;return Ke.test(e)||Ke.test(r)||Ne(e)}function pt(e){let r=re({command:e.command,exitCode:e.exitCode});if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"ripgrep finished (exit 0)"};if(e.exitCode===1){let n=(e.stderr||e.interleaved).trim();if(n&&it.test(n)){let i=v(n,160);return{kind:"command_failure",exitCode:1,summary:r??`ripgrep failed (exit 1): ${i}`}}let s=ee(e.command),o=s.changed&&!r?` Retry with: \`${s.command}\`.`:"";return{kind:"search_no_matches",exitCode:1,summary:r??`ripgrep: no matches (exit 1).${o} Try a broader pattern or search from the repo root.`}}let t=v(e.interleaved||e.stdout||e.stderr||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:r??`ripgrep failed (exit ${e.exitCode}): ${t}`}}function Ue(e){let r=e.stdout??"",t=e.stderr??"",n=e.interleavedOutput??"";if(mt(e.command)){let i=r.trim()||n.trim()||t.trim();return dt({exitCode:e.exitCode,stdout:i,stderr:t})}if(ft(e.command))return pt({command:e.command,exitCode:e.exitCode,stdout:r,stderr:t,interleaved:n});let s=re({command:e.command,exitCode:e.exitCode});if(s&&e.exitCode!==0)return{kind:"command_failure",exitCode:e.exitCode,summary:s};if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"command succeeded (exit 0)"};let o=v(n||r||t||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`command failed (exit ${e.exitCode}): ${o}`}}var st,Ke,it,Be=u(()=>{"use strict";Te();st=/\bnpm\s+audit\b/i,Ke=/\b(rg|ripgrep)\b/i,it=/\b(error|invalid|unknown|panic|not found)\b/i});function C(e){return typeof e=="string"&&gt.test(e.trim())}function U(e){if(!e||typeof e!="object"||Array.isArray(e))return!1;let r=e;return r.is_error===!0||r.providerTerminalError===!0||typeof r.subtype=="string"&&/^error(?:_|$)/.test(r.subtype)}var gt,B=u(()=>{"use strict";gt=/^(?:provider authentication failed:\s*)?(?:(?:Failed to authenticate|authentication (?:failed|error))(?::\s*[^\n.!?]+)?|OAuth session expired and could not be refreshed)[.!]?$/i});import{existsSync as ht,readFileSync as yt}from"node:fs";function bt(e){let r=e.timestamp_ms;return e.timestamp||e.ts||(r?new Date(r).toISOString():void 0)}function kt(e){if(!e)return null;for(let r of Object.keys(e))if(r.endsWith("ToolCall")){let t=r.slice(0,-8);return t.length?t:r}return null}function Rt(e,r){e.finalResult=r.result||r.subtype||r.terminal_reason||"completed",U(r)&&(e.providerTerminalError=!0,e.error=String(r.result||r.api_error_status||"stream result error"))}function R(e){return typeof e=="number"&&Number.isFinite(e)&&e>=0?e:void 0}function xt(e){let r=e.usage;return r&&typeof r=="object"&&!Array.isArray(r)?r:null}function St(e){if(typeof e.model=="string"&&e.model.trim())return e.model.trim();let r=e.modelUsage;if(r&&typeof r=="object"&&!Array.isArray(r)){let t=Object.keys(r)[0];if(t?.trim())return t.trim()}}function _t(e,r){let t=xt(r);if(!t)return;let n=R(t.input_tokens)??R(t.inputTokens)??R(t.prompt_tokens),s=R(t.output_tokens)??R(t.outputTokens)??R(t.completion_tokens);if(n===void 0&&s===void 0)return;let o=St(r)??e.usage?.model;e.usage={...n!==void 0?{inputTokens:n}:{},...s!==void 0?{outputTokens:s}:{},...o?{model:o}:{}}}function vt(e){if(e.type!=="tool_call"||e.subtype!=="completed")return null;let t=(e.tool_call&&typeof e.tool_call=="object"&&!Array.isArray(e.tool_call)?e.tool_call:null)?.shellToolCall;if(!t||typeof t!="object"||Array.isArray(t))return null;let n=t,s=n.args,o=s&&typeof s=="object"&&!Array.isArray(s)&&typeof s.command=="string"?String(s.command):"",i=n.result;if(!i||typeof i!="object"||Array.isArray(i))return null;let a=i.success??i.failure;if(!a||typeof a!="object"||Array.isArray(a))return null;let l=a,c=typeof l.exitCode=="number"?l.exitCode:0;return{command:o,exitCode:c,stdout:typeof l.stdout=="string"?l.stdout:"",stderr:typeof l.stderr=="string"?l.stderr:"",interleaved:typeof l.interleavedOutput=="string"?l.interleavedOutput:""}}function Et(e,r){r.kind==="success"||r.kind==="search_no_matches"||(e.lastShellOutcome=r)}function De(e){let r={firstEventAt:null,lastEventAt:null,currentTool:null,finalResult:null,error:null,lastShellOutcome:null,usage:null};if(!ht(e))return r;let t=yt(e,"utf8").split(`
-`).filter(Boolean),n=null;for(let s of t){let o=I(s);if(!o||typeof o!="object"||Array.isArray(o))continue;if(o.type==="turn.started"&&(n=null,r.finalResult=null),o.type==="item.completed"){let l=o.item;if(l&&typeof l=="object"&&!Array.isArray(l)){let c=l;c.type==="agent_message"&&typeof c.text=="string"&&c.text.trim()&&(n=c.text)}}o.type==="turn.completed"&&n&&!r.providerTerminalError&&(r.finalResult=n,n=null);let i=bt(o);if(i&&(r.firstEventAt||=i,r.lastEventAt=i),o.type==="stream_event"&&o.event&&typeof o.event=="object"&&o.event.type==="content_block_start"){let l=o.event.content_block;l?.type==="tool_use"&&(r.currentTool=String(l.name||"tool"))}if(o.type==="assistant"&&o.message&&typeof o.message=="object"){let l=o.message.content;if(Array.isArray(l)){let c=l.find(m=>m?.type==="tool_use");c&&(r.currentTool=String(c.name||r.currentTool))}}if(o.type==="tool_call"&&o.subtype==="started"){let l=o.tool_call&&typeof o.tool_call=="object"&&!Array.isArray(o.tool_call)?o.tool_call:void 0,c=kt(l);c&&(r.currentTool=c)}let a=vt(o);if(a&&Et(r,Ue({command:a.command,exitCode:a.exitCode,stdout:a.stdout,stderr:a.stderr,interleavedOutput:a.interleaved})),o.type==="result"&&Rt(r,o),o.type==="turn.failed"){n=null,r.finalResult=null,r.providerTerminalError=!0;let l=o.error;r.error=typeof l?.message=="string"?l.message:"provider turn failed"}_t(r,o)}return r}var Me=u(()=>{"use strict";Be();p();B()});function Fe(e,r=240){let t=e.replace(/\s+/g," ").trim();return t.length>r?`${t.slice(0,r-1)}\u2026`:t}function te(e){let r=(e??"").trim();if(!r)return null;if(C(r))return{blocked:!0,reason:`provider authentication failed: ${Fe(r)}`};for(let t of Ct)if(t.test.test(r))return{blocked:!0,reason:`${t.label}: ${Fe(r)}`};return null}var Ct,Le=u(()=>{"use strict";B();Ct=[{test:/(?:claude provider refuses to spawn: worker prompt is empty after argv assembly|Input must be provided (?:either )?through stdin or as a prompt argument)/i,label:"provider prompt delivery failed"},{test:/\b(?:invalid|unknown|unsupported|unrecognized)\b[^.\n]*\bmodel\b/i,label:"provider rejected the requested model"},{test:/\bmodel\b[^.\n]*\b(?:not\s+(?:found|supported|available|recognized|valid)|is\s+not\s+valid|does\s+not\s+exist)/i,label:"provider rejected the requested model"},{test:/\b(?:did you mean|available models|choose (?:a|one of)|supported models)\b/i,label:"provider rejected the requested model"},{test:/model preflight failed/i,label:"model/provider preflight failed"},{test:/\b(?:command not found|ENOENT|is the .*CLI on PATH|executable not found|no such file or directory)\b/i,label:"provider CLI is missing or not on PATH"},{test:/\bfailed to spawn\b/i,label:"provider failed to spawn the worker process"},{test:/\b(?:not logged in|unauthorized|authentication (?:failed|required)|invalid api key|missing api key|401)\b/i,label:"provider authentication failed"},{test:/\b(?:out of usage|increase limits?|switch to auto|ask your admin to increase your limit|usage limits?|quota exceeded|insufficient_quota|credits? exhausted|billing|payment required)\b/i,label:"provider quota exhausted"}]});function He(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function At(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="boolean"?e:Array.isArray(e)?e.length>0:typeof e=="object"?Object.keys(e).length>0:!0}function wt(e){return!e?.checked||e.headIsAncestorOfBase!==!1?null:He(e.head)}function Ot(e,r,t){let n=["exited_with_changes_salvage"];if((e==="uncommitted"||e==="both")&&n.push(`${r} uncommitted change${r===1?"":"s"} with no final result`),(e==="committed_ahead"||e==="both")&&t){let s=t.length>12?t.slice(0,12):t;n.push(`commit ${s} ahead of base with no final result`)}return n.push("review worktree \u2014 commit, open a PR, or run a salvage worker before discarding"),n.join(": ")}function $e(e){if(e.alive||At(e.finalResult))return null;let r=(e.changedFiles??[]).filter(i=>i.trim()).length,t=He(e.headCommit)??wt(e.gitAncestry),n=r>0,s=!!t;if(!n&&!s)return{kind:"none",salvageable:!1,uncommittedCount:0,headCommit:null,attentionReason:"process exited without a final result"};let o=n&&s?"both":n?"uncommitted":"committed_ahead";return{kind:o,salvageable:!0,uncommittedCount:r,headCommit:t,attentionReason:Ot(o,r,t)}}var je=u(()=>{"use strict"});var x=u(()=>{"use strict"});var It,Fn,Pt,Ln,Ye=u(()=>{"use strict";It=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Fn=new Set(It),Pt=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Ln=new Set(Pt)});import{spawnSync as Ge}from"node:child_process";function Nt(e,r,t={}){let n=Ge("git",r,X({cwd:e,encoding:"utf8"}));if(n.status!==0&&!t.allowFailure){let s=Wt(e,r,n);if(t.throwError)throw new Error(s);q(s)}return n.stdout||""}function Wt(e,r,t){let n=typeof t.stderr=="string"&&t.stderr.trim()||typeof t.stdout=="string"&&t.stdout.trim()||t.error?.message||`exit ${t.status??"unknown"}`;return`git ${r.join(" ")} failed in ${e}: ${n}`}function ze(e){return Nt(e,["status","--short"],{allowFailure:!0}).split(`
-`).map(r=>r.trim()).filter(Boolean)}function A(e,r){try{let t=Ge("git",r,X({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}function Ve(e,r,t){let n=A(e,["merge-base","--is-ancestor",r,t]);return n.status===0?{isAncestor:!0,error:null}:n.status===1?{isAncestor:!1,error:null}:{isAncestor:null,error:n.error||n.stderr||n.stdout||`git exited ${n.status}`}}function Je(e,r="origin/main"){let t=typeof r=="string"?{base:r}:r,n=t.baseCommit?.trim()||t.base?.trim()||"origin/main",s=t.baseCommit?.trim()||null;if(!e)return ne(n,"missing worktree path");let o=A(e,["rev-parse","HEAD"]);if(o.status!==0)return ne(n,o.error||o.stderr||o.stdout||"failed to resolve HEAD");let i;if(s)i=s;else{let f=A(e,["rev-parse",n]);if(f.status!==0)return ne(n,f.error||f.stderr||f.stdout||`failed to resolve ${n}`,o.stdout.trim());i=f.stdout.trim()}let a=o.stdout.trim();if(a===i)return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:!0,headIsAncestorOfBase:!0,relation:"synced"};let l=Ve(e,i,a),c=Ve(e,a,i),m=l.error||c.error||void 0;if(l.isAncestor==null||c.isAncestor==null)return{checked:!1,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:"unknown",...m?{error:m}:{}};let d=l.isAncestor?"ahead":c.isAncestor?"merged":"diverged";return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:d,...m?{error:m}:{}}}function ne(e,r,t=null){return{checked:!1,base:e,head:t,baseHead:null,baseIsAncestorOfHead:null,headIsAncestorOfBase:null,relation:"unknown",error:r}}var D=u(()=>{"use strict";x();p();Ye()});function w(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function Tt(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="boolean"?e:Array.isArray(e)?e.length>0:typeof e=="object"?Object.keys(e).length>0:!0}function Kt(e){if(w(e.headCommit)||w(e.prUrl)||w(e.artifactBundlePath)||w(e.patchPath))return!0;let r=e.gitAncestry;return!!(r?.checked&&r.headIsAncestorOfBase===!1&&w(r.head))}function qe(e){return Tt(e.finalResult)?e.changedFiles.length===0?{blocked:!1}:Kt(e)?{blocked:!0,detail:`Worktree has ${e.changedFiles.length} uncommitted change(s); commit or discard before landing`}:{blocked:!0,reason:"dirty_worktree_no_pr",detail:`Worktree has ${e.changedFiles.length} uncommitted change(s) with no commit or PR; commit, open a PR, or discard before landing`}:{blocked:!1}}function Xe(e){if(e.blocked)return e.detail??e.reason??"dirty_worktree_no_pr"}var Ze=u(()=>{"use strict"});function se(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let t=JSON.parse(r);if(t&&typeof t=="object"&&!Array.isArray(t))return t}catch{return null}return null}function Qe(e){let r=e.targetPrReconciliation??e.target_pr_reconciliation??e.targetPrs??e.target_prs;return Array.isArray(r)?r.length:0}function M(e){let r=e.trim();if(!r)return null;let t=se(r);if(t)return t;let n=[],s=/```(?:json)?\s*([\s\S]*?)```/gi,o;for(;(o=s.exec(r))!==null;){let m=se(o[1]??"");m&&n.push(m)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let m=se(r.slice(i,a+1));m&&n.push(m)}if(n.length===0)return null;let l=n[n.length-1],c=Qe(l);for(let m of n){let d=Qe(m);d>c&&(l=m,c=d)}return l}var ie=u(()=>{"use strict"});function er(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`https://github.com/${r[1]}/pull/${r[2]}`:e.trim()||null}function rr(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`${r[1].toLowerCase()}/pull/${r[2]}`:e.trim().toLowerCase()}function Ut(e){return new Set(e.map(r=>rr(er(r)??r)).filter(Boolean))}function tr(e,r,t){let n=er(e)??e;if(!n)return"unrelated";let s=rr(n);return Ut(r).has(s)?"contract":t?(t.outcome==="skipped"||t.outcome==="blocked")&&t.reason?.trim()?"support":(t.outcome==="merged","unrelated"):"unrelated"}var nr=u(()=>{"use strict"});function S(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function Bt(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="object"?Object.keys(e).length>0:!0}function b(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`https://github.com/${r[1]}/pull/${r[2]}`:S(e)}function F(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`${r[1].toLowerCase()}/pull/${r[2]}`:e.trim().toLowerCase()}function or(e){let r=null;if(typeof e=="string"){let s=M(e);s&&(r=s)}else e&&typeof e=="object"&&!Array.isArray(e)&&(r=e);if(!r)return[];let t=r.targetPrReconciliation??r.target_pr_reconciliation;if(!Array.isArray(t))return[];let n=[];for(let s of t){if(!s||typeof s!="object"||Array.isArray(s))continue;let o=s,i=b(String(o.prUrl??o.pr_url??"")),a=S(o.outcome);!i||a!=="merged"&&a!=="skipped"&&a!=="blocked"||n.push({prUrl:i,outcome:a,mergeCommit:S(o.mergeCommit??o.merge_commit),reason:S(o.reason)})}return n}function sr(e,r){let t=[],n=b(S(e.prUrl)??"");if(n&&t.push(n),r&&typeof r=="object"&&!Array.isArray(r)){let s=r,o=b(String(s.prUrl??s.pr_url??""));o&&t.push(o)}return[...new Set(t)]}function ir(e){let{contract:r,snapshot:t}=e,n=e.finalResult??t.finalResult;if(!r.landingOnly&&r.targetPrUrls.length===0&&!r.repairEnforceOriginalPr)return{blocked:!1};if(!Bt(n))return(r.requiresTargetPrReconciliation??(r.landingOnly||!!r.repairEnforceOriginalPr||r.targetPrUrls.length>0))&&r.targetPrUrls.length>0?{blocked:!0,reason:"missing_target_pr_reconciliation",detail:`Final result required to reconcile target PR(s): ${r.targetPrUrls.join(", ")}`}:{blocked:!1};if(!(r.requiresTargetPrReconciliation??(r.landingOnly||!!r.repairEnforceOriginalPr||r.targetPrUrls.length>0))&&!r.repairEnforceOriginalPr)return{blocked:!1};let o=r.repairEnforceOriginalPr?b(S(r.targetPrUrl)??"")??(r.targetPrUrls.length===1?b(r.targetPrUrls[0]):null):null;if(o){let d=sr(t,n);if(!(n&&typeof n=="object"&&!Array.isArray(n)&&n.supersedesOriginalTargetPr===!0)){for(let y of d)if(y!==o)return{blocked:!0,reason:"duplicate_repair_pr",detail:`Repair worker opened or attached PR ${y} instead of canonical target ${o}`}}let h=or(n).find(y=>y.prUrl===o);if(!h||h.outcome!=="merged"&&!(h.reason?.trim()&&(h.outcome==="skipped"||h.outcome==="blocked")))return{blocked:!0,reason:"missing_repair_target_reconciliation",detail:`Repair worker must reconcile target PR ${o}`}}let i=or(n),a=new Map(i.map(d=>[F(d.prUrl),d])),l=new Set(r.targetPrUrls.map(d=>F(b(d)??d)).filter(Boolean)),c=sr(t,n);if(r.landingOnly)for(let d of c){let f=a.get(F(d)),g=tr(d,r.targetPrUrls,f);if(!(g==="contract"||g==="support"))return l.size>0?{blocked:!0,reason:"unrelated_implementation_pr",detail:`Landing-only worker attached unrelated PR ${d}`}:{blocked:!0,reason:"unrelated_implementation_pr",detail:"Landing-only worker must not open new implementation PRs"}}if(r.targetPrUrls.length===0)return{blocked:!1};let m=[];for(let d of r.targetPrUrls){let f=F(b(d)??d),g=a.get(f);if(!g){m.push(f);continue}g.outcome!=="merged"&&!g.reason?.trim()&&m.push(f)}return m.length>0?{blocked:!0,reason:m.every(d=>a.has(d))?"incomplete_target_pr_landing":"missing_target_pr_reconciliation",detail:`Target PR reconciliation incomplete: ${m.join(", ")}`}:{blocked:!1}}function ar(e){if(e.blocked)return e.detail??e.reason}var lr=u(()=>{"use strict";ie();nr()});function Mt(e){let r=Date.now();if(e.providerTerminalError||U(e.finalResult)||e.finalResult&&e.error?.trim()||C(e.error)||C(e.finalResult)){let s=e.error||(typeof e.finalResult=="string"?e.finalResult:"provider terminal error");return{state:"blocked",reason:te(s)?.reason??`provider terminal error: ${s}`}}if(e.completionBlocker&&!ur(e.completionBlocker))return{state:"blocked",reason:e.completionBlocker};if(e.finalResult){if(e.localOnly&&Lt(e.finalResult))return{state:"done",reason:"local-only worker superseded by merged PR"};let s={finalResult:e.finalResult,changedFiles:e.changedFiles??[],gitAncestry:e.gitAncestry??null,prUrl:e.prUrl??null},o=qe(s);if(o.blocked){let i=Xe(o);return{state:"needs_attention",reason:o.reason?`landing blocked (${o.reason}): ${i}`:`landing blocked: ${i}`}}if(e.landingContract){let i=ir({contract:e.landingContract,snapshot:s,finalResult:e.finalResult}),a=ar(i);if(a)return{state:"needs_attention",reason:i.reason?`landing contract (${i.reason}): ${a}`:`landing contract: ${a}`}}return{state:"done",reason:"final result recorded"}}if(!e.alive){if(Ft(e))return{state:"done",reason:"empty abandoned worker record"};let s=te(e.error);if(s)return{state:"blocked",reason:s.reason};let o=$e({alive:!1,finalResult:null,changedFiles:e.changedFiles,gitAncestry:e.gitAncestry});if(o?.salvageable){let a=e.error?.trim();return{state:"needs_attention",reason:a?`${o.attentionReason} (${a})`:o.attentionReason}}let i=e.error?.trim();return{state:"needs_attention",reason:i?`process exited without a final result: ${i}`:o?.attentionReason??"process exited without a final result"}}if(e.heartbeatBlocker)return{state:"blocked",reason:`worker heartbeat reported blocker: ${e.heartbeatBlocker}`};let t=e.startedAt?Date.parse(e.startedAt):NaN;if(!e.firstEventAt&&e.stdoutBytes===0&&e.heartbeatBytes===0&&Number.isFinite(t)&&r-t>Dt)return{state:"needs_attention",reason:`no first stream event ${Z(t)}s after start`};let n=e.lastActivityAt?Date.parse(e.lastActivityAt):NaN;return Number.isFinite(n)&&r-n>L?{state:"stale",reason:`no log/event/heartbeat activity for ${Z(n)}s`}:{state:"ok",reason:"recent activity"}}function ur(e){let r=e?.trim();return r?/completion acknowledged but board not advanced/i.test(r)&&/task already terminal/i.test(r):!1}function Ft(e){return e.finalResult||e.taskId||e.agentOsId||e.stdoutBytes>0||(e.stderrBytes??0)>0||e.heartbeatBytes>0||e.error?.trim()||(e.changedFiles??[]).some(r=>r.trim())?!1:/empty worker dir|marked abandoned/i.test(e.reconcileReason??"")}function Lt(e){let r=null;if(typeof e=="string"?r=M(e):e&&typeof e=="object"&&!Array.isArray(e)&&(r=e),!r)return!1;let t=r.targetPrReconciliation??r.target_pr_reconciliation;return Array.isArray(t)?t.some(n=>!n||typeof n!="object"||Array.isArray(n)?!1:String(n.outcome??"").trim()==="merged"):!1}function Ht(e,r,t){let n=e.completionSnapshot?.finalResult;return e.completionAckSource==="local-pr-merged-reconcile"&&n!==void 0&&n!==null?n:r||(n??ve(t))}function cr(e,r={}){let t=De(e.stdoutPath),n=Ee(e.heartbeatPath),s=typeof e.completionReportedAt=="string"&&e.completionReportedAt.trim().length>0,o=Ht(e,t.finalResult,n),i=s?!1:W(e.pid),a=P(e.stdoutPath),l=P(e.stderrPath),c=P(e.heartbeatPath),m=ze(e.worktreePath),d=Je(e.worktreePath,{base:r.base,baseCommit:r.baseCommit}),f=Se([t.lastEventAt,n.lastHeartbeatAt,N(e.stdoutPath),N(e.stderrPath),N(e.heartbeatPath)]),g=t.error||!i&&!o&&xe(e.stderrPath,10).trim()||void 0,h=typeof e.completionBlocker=="string"&&e.completionBlocker.trim()?e.completionBlocker.trim():null,y=ur(h)?null:h,Mr=e.repairTargetPrUrl?{landingOnly:!1,targetPrUrls:[e.repairTargetPrUrl],targetPrUrl:e.repairTargetPrUrl,repairEnforceOriginalPr:!0}:null,z=Mt({alive:i,finalResult:o,firstEventAt:t.firstEventAt,stdoutBytes:a,stderrBytes:l,heartbeatBytes:c,lastActivityAt:f,heartbeatBlocker:n.heartbeatBlocker,startedAt:e.startedAt,error:g,providerTerminalError:t.providerTerminalError,changedFiles:m,gitAncestry:d,completionBlocker:y,landingContract:Mr,prUrl:e.repairTargetPrUrl??e.taskPrUrl??null,localOnly:e.localOnly===!0,taskId:e.taskId??null,agentOsId:e.agentOsId??null,reconcileReason:e.reconcileReason??null}),Fr=y||z.state==="blocked"?"blocked":s||z.state==="done"?"done":o?"exited":i?"running":"exited";return{runId:e.runId,worker:e.name,pid:e.pid,alive:i,status:Fr,attention:z,branch:e.branch,worktreePath:e.worktreePath,ownedPaths:e.ownedPaths,stdoutBytes:a,stderrBytes:l,heartbeatBytes:c,firstEventAt:t.firstEventAt,lastEventAt:t.lastEventAt,lastActivityAt:f,currentTool:s?null:t.currentTool,heartbeatCount:n.heartbeatCount,lastHeartbeatAt:n.lastHeartbeatAt,lastHeartbeatPhase:n.lastHeartbeatPhase,lastHeartbeatSummary:n.lastHeartbeatSummary,heartbeatBlocker:n.heartbeatBlocker,timestampAnomalies:n.timestampAnomalies,finalResult:o,error:g,providerTerminalError:t.providerTerminalError,changedFiles:m,gitAncestry:d,instructionPolicyFingerprint:e.instructionPolicyFingerprint??null,instructionPolicyEvidence:e.instructionPolicyEvidence??null,model:e.model??e.orchestrationAudit?.model??null,provider:e.provider??e.orchestrationAudit?.provider??null,usage:t.usage??null,boxKind:e.boxKind??null,boxId:e.boxId??null,runtimeId:e.runtimeId??null,personaSlug:e.personaSlug??null,dispatched:e.dispatched??null,localOnly:e.localOnly??null}}function dr(e){return!!(e.finalResult||e.alive===!1||e.status==="exited"||e.status==="done")}function mr(e){return e.finalResult?e.attention.state==="needs_attention"||e.attention.state==="blocked":!1}var Dt,L,O=u(()=>{"use strict";Ce();Me();B();Le();je();D();Ze();lr();ie();p();Dt=18e4,L=6e5});var hr=u(()=>{"use strict";D()});var ae=u(()=>{"use strict";D();x();hr()});var le=u(()=>{"use strict";p()});var k=u(()=>{"use strict"});var H=u(()=>{"use strict"});var yr=u(()=>{"use strict"});var No,Wo,ue=u(()=>{"use strict";No=25*1024*1024*1024,Wo=12*1024*1024*1024});var Do,Mo,br=u(()=>{"use strict";ue();Do=5*1024*1024*1024,Mo=10*1024*1024*1024});var Yo,Vo,ce=u(()=>{"use strict";br();ue();Yo=30*1024*1024*1024,Vo=15*1024*1024*1024});var kr=u(()=>{"use strict";$();p()});var Rr=u(()=>{"use strict";O()});var zt,Jt,_r=u(()=>{"use strict";yr();_();k();H();j();ce();$();kr();Rr();p();zt=500*1024*1024,Jt=4*1024*1024*1024});var j=u(()=>{"use strict";_r()});import{homedir as Xt}from"node:os";import Zt from"node:path";var vr,fe=u(()=>{"use strict";vr=Zt.join(Xt(),".kynver",".env")});var Er=u(()=>{"use strict"});var Cr=u(()=>{"use strict";Er()});var Ar=u(()=>{"use strict"});var pe=u(()=>{"use strict";Cr();Ar()});var wr=u(()=>{"use strict"});var Or=u(()=>{"use strict";wr()});var Y=u(()=>{"use strict";fe();x();_();pe();Or()});var Ir=u(()=>{"use strict";k();k()});var Pr=u(()=>{"use strict";fe();pe();Y()});var Nr=u(()=>{"use strict";p()});import nn from"node:path";var mi,ge=u(()=>{"use strict";x();Nr();mi=nn.join(".openclaw","harness")});var G=u(()=>{"use strict";_();k();H();j();ge()});var Tr=u(()=>{"use strict";ae();k();Ir();_();Y();Pr();le();G()});var cn,Ni,Kr=u(()=>{"use strict";cn=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],Ni=cn.join("|")});import{homedir as dn,totalmem as Li}from"node:os";import he from"node:path";var Ur,ea,ra,ta,na,_=u(()=>{"use strict";ae();x();le();k();H();j();ce();Y();Tr();Kr();G();Ur=he.join(dn(),".kynver"),ea=he.join(Ur,"config.json"),ra=he.join(Ur,"credentials"),ta=500*1024*1024,na=4*1024*1024*1024});var Br=u(()=>{"use strict";_();ge();G();p()});var $=u(()=>{"use strict";Br();p()});O();var fr="kynver-harness:",$t="@runner:";function pr(e){return e?.trim()?e.trim():null}function jt(e){let r=pr(e);if(!r?.startsWith(fr))return null;let t=r.slice(fr.length),n=t.indexOf($t);return n>=0?t.slice(0,n).trim()||null:t.trim()||null}function gr(e,r){let t=pr(r);return t?jt(e)===t:!1}O();p();function Yt(e){let{worker:r,status:t,taskLease:n}=e,s=n?.leaseOwner??null;if(r.dispatched&&n){if(n.status==="running"&&s&&!gr(s,r.runId))return{health:"orphaned",reason:`task lease held by ${s}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=n.leaseToken?.trim()??"";if(n.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(n.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(t.attention.state==="stale")return{health:"stale",reason:t.attention.reason};let o=t.lastHeartbeatAt?Date.parse(t.lastHeartbeatAt):NaN;return t.alive&&Number.isFinite(o)&&Date.now()-o>L?{health:"stale",reason:`heartbeat older than ${Math.floor(L/1e3)}s`}:t.alive&&r.pid&&!W(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:n?.status==="running"&&!t.alive&&t.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:t.attention.reason||"worker within expected lifecycle bounds"}}$();function Dr(e){return!!e.completionReportedAt?.trim()}O();function mn(e){let{worker:r,status:t}=e,n=[];r.localOnly&&n.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&n.push("missing agentOsId/taskId linkage"),Dr(r)&&n.push("completion already acknowledged"),r.completionBlocker&&n.push(r.completionBlocker),t.heartbeatBlocker&&t.alive&&n.push(`worker heartbeat blocker: ${t.heartbeatBlocker}`),t.attention.state==="blocked"&&n.push(t.attention.reason||"worker attention blocked"),mr(t)&&n.push(t.attention.reason||"landing gate blocked");let s=dr(t),o;return s?t.finalResult?o="final_result":t.alive?o="terminal_status":o="process_exited":n.push("worker has not reached a terminal condition"),{eligible:s&&n.length===0,terminalVerified:s,terminalReason:o,blockers:n}}export{mn as assessAutoCompleteEligibility,Yt as classifyWorkerHealth,cr as computeWorkerStatus};
+`):""}function N(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}function ve(e){let r=null,t=-1/0;for(let n of e){if(!n)continue;let s=Date.parse(n);Number.isFinite(s)&&s>t&&(t=s,r=n)}return r}function Z(e){return Math.max(0,Math.round((Date.now()-e)/1e3))}var f=u(()=>{"use strict";xe()});import{existsSync as Vr,readFileSync as Gr}from"node:fs";function Ee(e){return e==="complete"}function Ce(e){return Ee(e.lastHeartbeatPhase)?e.terminalFinalResult!==void 0&&e.terminalFinalResult!==null?e.terminalFinalResult:e.lastHeartbeatSummary?.trim()||"completed":null}function Ae(e){let r={heartbeatCount:0,lastHeartbeatAt:null,lastHeartbeatPhase:null,lastHeartbeatSummary:null,terminalFinalResult:null,heartbeatBlocker:null,timestampAnomalies:[],lastBoxResourceSnapshot:null,lastPrEvidence:[]};if(!Vr(e))return r;let t=Date.now()+zr,n=new Date(t).toISOString(),s=Gr(e,"utf8").split(`
+`).filter(Boolean);for(let o of s){let i=I(o);if(!i||typeof i!="object"||Array.isArray(i))continue;let a=i;if(r.heartbeatCount++,a.ts){let l=String(a.ts),c=Date.parse(l);Number.isFinite(c)&&c>t?r.timestampAnomalies.push({kind:"future_heartbeat_timestamp",observedAt:l,clampedTo:n}):r.lastHeartbeatAt=l}a.phase!==void 0&&a.phase!==null&&(r.lastHeartbeatPhase=String(a.phase)),a.summary!==void 0&&a.summary!==null&&(r.lastHeartbeatSummary=String(a.summary)),Ee(r.lastHeartbeatPhase)&&(r.terminalFinalResult=be(a)),r.heartbeatBlocker=a.blocker?String(a.blocker):null,a.boxResourceSnapshot&&typeof a.boxResourceSnapshot=="object"&&!Array.isArray(a.boxResourceSnapshot)&&(r.lastBoxResourceSnapshot=a.boxResourceSnapshot),Array.isArray(a.prEvidence)&&(r.lastPrEvidence=a.prEvidence.filter(l=>!!l&&typeof l=="object"&&typeof l.prUrl=="string"))}return r}var zr,we=u(()=>{"use strict";Re();f();zr=6e4});function Ie(e){return e?(e.split("/").pop()??e).replace(/\.exe$/i,"").toLowerCase():null}function K(e){if(!e)return[];let r=[],t="",n,s=!1;for(let o of e){if(s){t+=o,s=!1;continue}if(o==="\\"){s=!0;continue}if(n){o===n?n=void 0:t+=o;continue}if(o==='"'||o==="'"){n=o;continue}if(/\s/.test(o)){t&&(r.push(t),t="");continue}t+=o}return t&&r.push(t),r}function Pe(e){let r=Ie(e[0]);return!!(r&&Jr.has(r))}function Xr(e){let r=e.trim();return r.includes("/")?r.split("/").pop()??r:r}function Zr(e){if(!e||e.includes("*"))return null;let r=Xr(e);return!r||r.includes("/")?null:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(r)?r:null}function Te(e){return!e||e.includes("/")||e.includes("*")?!1:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(e)}function Q(e){if(!e)return!1;let r=e.trim();return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")}function Qr(e){if(!e.startsWith("--glob="))return e;let r=e.slice(7);return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")?`--glob=${r}/**`:e}function et(e){let r=[];for(let t=1;t<e.length;t+=1){let n=e[t];if(n){if(n==="--"){r.push(...e.slice(t+1));break}if(n.startsWith("-")){if(n.includes("="))continue;Oe.has(n)&&(t+=1);continue}r.push(n)}}return r}function rt(e){let r=!1,t=e.map((s,o)=>{let i=Qr(s),a=e[o-1];return a&&Oe.has(a)&&s.startsWith("!")&&!s.includes("/")&&!s.endsWith("/**")&&(i=`${s}/**`),i!==s&&(r=!0),i}),n=et(t);if(n.length===2){let[s,o]=n;if(Q(o))return{argv:[t[0]??"rg",s,"-g",`${o}/**`,"."],changed:!0};let i=Zr(o);if(i)return{argv:[t[0]??"rg","-g",i,s,"."],changed:!0}}return r&&n.length===1?{argv:[...t,"."],changed:!0}:{argv:t,changed:r}}function Ne(e){for(let r=1;r<e.length;r+=1){let t=e[r];if(t&&(t==="-c"||t==="-lc"||t==="-cl"||/^-[a-zA-Z]*c[a-zA-Z]*$/u.test(t)))return r+1}return-1}function W(e){let r=e.trim();if(!r)return{command:r,wrapped:!1};let t=K(r);if(!t.length)return{command:r,wrapped:!1};let n=Ie(t[0]);if(!n||!qr.has(n))return{command:r,wrapped:!1};let s=Ne(t);if(s<0||s>=t.length)return{command:r,wrapped:!1};let o=t.slice(s).join(" ").trim();return o?{command:o,wrapped:!0}:{command:r,wrapped:!1}}function tt(e,r){let t=e.trim(),n=K(t),s=Ne(n);if(s<0)return r;let o=n.slice(0,s).join(" "),i=r.includes("'")?`"${r.replace(/"/g,'\\"')}"`:`'${r}'`;return`${o} ${i}`}function nt(e){let r=e.trim(),t=W(r),n=K(t.command);if(!n.length||!Pe(n))return{segment:r,changed:!1};let s=rt(n);if(!s.changed)return{segment:r,changed:!1};let o=s.argv.join(" ");return t.wrapped?{segment:tt(r,o),changed:!0}:{segment:o,changed:!0}}function ee(e){let r=e.trim();if(!r)return{command:r,changed:!1};let t=r.includes("&&")?" && ":r.includes("||")?" || ":"; ",n=r.split(/\s*(?:&&|\|\||;)\s*/u),s=!1,o=n.map(i=>{let a=nt(i);return a.changed&&(s=!0),a.segment});return s?{command:o.join(t),changed:!0}:{command:r,changed:!1}}function Ke(e){let r=W(e).command,t=K(r.trim());return t.length&&Pe(t)?!0:/\b(rg|ripgrep)\b/i.test(r)}function We(e){if(!e)return{};let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(|$)/iu);if(r)return{pattern:r[1],target:r[2]?.trim()};let t=e.match(/^search\s+"(.+)"\s+in\s+(.+)$/iu);return t?{pattern:t[1],target:t[2]?.trim()}:{}}function ot(e){let{pattern:r,target:t}=We(e);return r?Q(t)?{kind:"rg_exclude_syntax",pattern:r,target:t}:Te(t)?{kind:"bad_scope",pattern:r,target:t}:{kind:"not_repo_search",pattern:r,target:t}:{kind:"not_repo_search"}}function st(e){let{pattern:r,target:t}=We(e);if(!r)return null;if(Q(t)){let n=`${t.trim()}/**`;return{command:`rg "${r}" -g '${n}' .`,changed:!0}}return t&&Te(t)?{command:`rg -g ${t} "${r}" .`,changed:!0}:null}function it(e){if(e.kind==="bad_scope"&&e.pattern&&e.target)return`Use \`rg -g '${e.target}' ${e.pattern} .\` from the repo root instead of treating ${e.target} as a folder.`;if(e.kind==="rg_exclude_syntax"&&e.pattern){let r=e.target?`${e.target.trim()}/**`:"!node_modules/**";return`Repo search scope \`${e.target??"!node_modules"}\` is not a valid ripgrep path. Use \`rg "${e.pattern}" -g '${r}' .\` from the repo root (exclude globs need a \`/**\` suffix).`}return e.kind==="no_matches"&&e.pattern?`No matches for "${e.pattern}". Try a broader pattern, drop overly short tokens, or search from the repo root with \`rg "${e.pattern}" .\`.`:null}function at(e){let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(agent\)|\s*failed|$)/iu);return r?`search "${r[1]}" in ${r[2]?.trim()}`:null}function re(e){let r=e.meta?.trim()||(e.command?at(e.command):null)||null;if(r){let t=ot(r),n=it(t);if(n)return n;let s=st(r);if(s?.changed)return`Repo search used an invalid scope. Retry with: \`${s.command}\`.`}if(e.command&&/\b(rg|ripgrep)\b/i.test(e.command)){let t=ee(e.command);if(t.changed)return`Ripgrep scope may be invalid. Retry with: \`${t.command}\`.`;if(e.exitCode===1)return"Ripgrep returned no matches (exit 1). Try a broader pattern or search from the repo root."}return null}var Jr,qr,Oe,Ue=u(()=>{"use strict";Jr=new Set(["rg","ripgrep","grep"]),qr=new Set(["bash","sh","dash","zsh"]),Oe=new Set(["-e","--regexp","-f","--file","-m","--max-count","-A","--after-context","-B","--before-context","-C","--context","-g","--glob","--iglob"])});function v(e,r=200){let t=e.replace(/\s+/g," ").trim();return t.length>r?`${t.slice(0,r-1)}\u2026`:t}function ct(e){let r=e.trim();if(!r)return null;if(r.startsWith("{"))try{return JSON.parse(r)}catch{}let t=r.indexOf("{"),n=r.lastIndexOf("}");if(t>=0&&n>t)try{return JSON.parse(r.slice(t,n+1))}catch{return null}return null}function E(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function dt(e){let r=e.metadata;if(!E(r))return null;let t=r.vulnerabilities;if(!E(t))return null;let n=o=>typeof t[o]=="number"?t[o]:0,s={info:n("info"),low:n("low"),moderate:n("moderate"),high:n("high"),critical:n("critical"),total:n("total")};return typeof t.total!="number"&&!s.critical&&!s.high&&!s.moderate&&!s.low&&!s.info?null:s}function mt(e){let r=[];e.critical&&r.push(`${e.critical} critical`),e.high&&r.push(`${e.high} high`),e.moderate&&r.push(`${e.moderate} moderate`),e.low&&r.push(`${e.low} low`),e.info&&r.push(`${e.info} info`);let t=r.length?r.join(", "):"see report";return`npm audit: ${e.total} vulnerabilit${e.total===1?"y":"ies"} (${t}) \u2014 remediation required`}function pt(e,r){let t=e.error;if(E(t)){let o=typeof t.summary=="string"?t.summary.trim():"",i=typeof t.code=="string"?t.code.trim():"";if(o)return i?`${i}: ${o}`:o;if(i)return i}let n=typeof e.message=="string"?e.message.trim():"";if(n)return n;let s=r.trim();return s?v(s.split(`
+`).find(Boolean)??s,160):"npm audit failed"}function ft(e){let r=`${e.stdout}
+${e.stderr}`.trim(),t=ct(r);if(!t||!E(t)){let s=v(r||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit failed (invalid or missing JSON): ${s}`,parseError:"invalid_json"}}if(E(t.error))return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit command failed: ${pt(t,e.stderr)}`};let n=dt(t);return n?e.exitCode===0&&n.total===0?{kind:"success",exitCode:0,summary:"npm audit: no vulnerabilities reported",audit:n}:{kind:"audit_findings",exitCode:e.exitCode,summary:mt(n),audit:n}:{kind:"command_failure",exitCode:e.exitCode,summary:"npm audit failed: JSON response missing vulnerability metadata",parseError:"missing_metadata"}}function gt(e){return lt.test(e)}function ht(e){let r=W(e).command;return Be.test(e)||Be.test(r)||Ke(e)}function yt(e){let r=re({command:e.command,exitCode:e.exitCode});if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"ripgrep finished (exit 0)"};if(e.exitCode===1){let n=(e.stderr||e.interleaved).trim();if(n&&ut.test(n)){let i=v(n,160);return{kind:"command_failure",exitCode:1,summary:r??`ripgrep failed (exit 1): ${i}`}}let s=ee(e.command),o=s.changed&&!r?` Retry with: \`${s.command}\`.`:"";return{kind:"search_no_matches",exitCode:1,summary:r??`ripgrep: no matches (exit 1).${o} Try a broader pattern or search from the repo root.`}}let t=v(e.interleaved||e.stdout||e.stderr||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:r??`ripgrep failed (exit ${e.exitCode}): ${t}`}}function De(e){let r=e.stdout??"",t=e.stderr??"",n=e.interleavedOutput??"";if(gt(e.command)){let i=r.trim()||n.trim()||t.trim();return ft({exitCode:e.exitCode,stdout:i,stderr:t})}if(ht(e.command))return yt({command:e.command,exitCode:e.exitCode,stdout:r,stderr:t,interleaved:n});let s=re({command:e.command,exitCode:e.exitCode});if(s&&e.exitCode!==0)return{kind:"command_failure",exitCode:e.exitCode,summary:s};if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"command succeeded (exit 0)"};let o=v(n||r||t||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`command failed (exit ${e.exitCode}): ${o}`}}var lt,Be,ut,Me=u(()=>{"use strict";Ue();lt=/\bnpm\s+audit\b/i,Be=/\b(rg|ripgrep)\b/i,ut=/\b(error|invalid|unknown|panic|not found)\b/i});function C(e){return typeof e=="string"&&kt.test(e.trim())}function U(e){if(!e||typeof e!="object"||Array.isArray(e))return!1;let r=e;return r.is_error===!0||r.providerTerminalError===!0||typeof r.subtype=="string"&&/^error(?:_|$)/.test(r.subtype)}var kt,B=u(()=>{"use strict";kt=/^(?:provider authentication failed:\s*)?(?:(?:Failed to authenticate|authentication (?:failed|error))(?::\s*[^\n.!?]+)?|OAuth session expired and could not be refreshed)[.!]?$/i});import{existsSync as bt,readFileSync as Rt}from"node:fs";function xt(e){let r=e.timestamp_ms;return e.timestamp||e.ts||(r?new Date(r).toISOString():void 0)}function St(e){if(!e)return null;for(let r of Object.keys(e))if(r.endsWith("ToolCall")){let t=r.slice(0,-8);return t.length?t:r}return null}function _t(e,r){e.finalResult=r.result||r.subtype||r.terminal_reason||"completed",U(r)&&(e.providerTerminalError=!0,e.error=String(r.result||r.api_error_status||"stream result error"))}function R(e){return typeof e=="number"&&Number.isFinite(e)&&e>=0?e:void 0}function vt(e){let r=e.usage;return r&&typeof r=="object"&&!Array.isArray(r)?r:null}function Et(e){if(typeof e.model=="string"&&e.model.trim())return e.model.trim();let r=e.modelUsage;if(r&&typeof r=="object"&&!Array.isArray(r)){let t=Object.keys(r)[0];if(t?.trim())return t.trim()}}function Ct(e,r){let t=vt(r);if(!t)return;let n=R(t.input_tokens)??R(t.inputTokens)??R(t.prompt_tokens),s=R(t.output_tokens)??R(t.outputTokens)??R(t.completion_tokens);if(n===void 0&&s===void 0)return;let o=Et(r)??e.usage?.model;e.usage={...n!==void 0?{inputTokens:n}:{},...s!==void 0?{outputTokens:s}:{},...o?{model:o}:{}}}function At(e){if(e.type!=="tool_call"||e.subtype!=="completed")return null;let t=(e.tool_call&&typeof e.tool_call=="object"&&!Array.isArray(e.tool_call)?e.tool_call:null)?.shellToolCall;if(!t||typeof t!="object"||Array.isArray(t))return null;let n=t,s=n.args,o=s&&typeof s=="object"&&!Array.isArray(s)&&typeof s.command=="string"?String(s.command):"",i=n.result;if(!i||typeof i!="object"||Array.isArray(i))return null;let a=i.success??i.failure;if(!a||typeof a!="object"||Array.isArray(a))return null;let l=a,c=typeof l.exitCode=="number"?l.exitCode:0;return{command:o,exitCode:c,stdout:typeof l.stdout=="string"?l.stdout:"",stderr:typeof l.stderr=="string"?l.stderr:"",interleaved:typeof l.interleavedOutput=="string"?l.interleavedOutput:""}}function wt(e,r){r.kind==="success"||r.kind==="search_no_matches"||(e.lastShellOutcome=r)}function Fe(e){let r={firstEventAt:null,lastEventAt:null,currentTool:null,finalResult:null,error:null,lastShellOutcome:null,usage:null};if(!bt(e))return r;let t=Rt(e,"utf8").split(`
+`).filter(Boolean),n=null;for(let s of t){let o=I(s);if(!o||typeof o!="object"||Array.isArray(o))continue;if(o.type==="turn.started"&&(n=null,r.finalResult=null),o.type==="item.completed"){let l=o.item;if(l&&typeof l=="object"&&!Array.isArray(l)){let c=l;c.type==="agent_message"&&typeof c.text=="string"&&c.text.trim()&&(n=c.text)}}o.type==="turn.completed"&&n&&!r.providerTerminalError&&(r.finalResult=n,n=null);let i=xt(o);if(i&&(r.firstEventAt||=i,r.lastEventAt=i),o.type==="stream_event"&&o.event&&typeof o.event=="object"&&o.event.type==="content_block_start"){let l=o.event.content_block;l?.type==="tool_use"&&(r.currentTool=String(l.name||"tool"))}if(o.type==="assistant"&&o.message&&typeof o.message=="object"){let l=o.message.content;if(Array.isArray(l)){let c=l.find(m=>m?.type==="tool_use");c&&(r.currentTool=String(c.name||r.currentTool))}}if(o.type==="tool_call"&&o.subtype==="started"){let l=o.tool_call&&typeof o.tool_call=="object"&&!Array.isArray(o.tool_call)?o.tool_call:void 0,c=St(l);c&&(r.currentTool=c)}let a=At(o);if(a&&wt(r,De({command:a.command,exitCode:a.exitCode,stdout:a.stdout,stderr:a.stderr,interleavedOutput:a.interleaved})),o.type==="result"&&_t(r,o),o.type==="turn.failed"){n=null,r.finalResult=null,r.providerTerminalError=!0;let l=o.error;r.error=typeof l?.message=="string"?l.message:"provider turn failed"}Ct(r,o)}return r}var Le=u(()=>{"use strict";Me();f();B()});function $e(e,r=240){let t=e.replace(/\s+/g," ").trim();return t.length>r?`${t.slice(0,r-1)}\u2026`:t}function te(e){let r=(e??"").trim();if(!r)return null;if(C(r))return{blocked:!0,reason:`provider authentication failed: ${$e(r)}`};for(let t of Ot)if(t.test.test(r))return{blocked:!0,reason:`${t.label}: ${$e(r)}`};return null}var Ot,He=u(()=>{"use strict";B();Ot=[{test:/(?:claude provider refuses to spawn: worker prompt is empty after argv assembly|Input must be provided (?:either )?through stdin or as a prompt argument)/i,label:"provider prompt delivery failed"},{test:/\b(?:invalid|unknown|unsupported|unrecognized)\b[^.\n]*\bmodel\b/i,label:"provider rejected the requested model"},{test:/\bmodel\b[^.\n]*\b(?:not\s+(?:found|supported|available|recognized|valid)|is\s+not\s+valid|does\s+not\s+exist)/i,label:"provider rejected the requested model"},{test:/\b(?:did you mean|available models|choose (?:a|one of)|supported models)\b/i,label:"provider rejected the requested model"},{test:/model preflight failed/i,label:"model/provider preflight failed"},{test:/\b(?:command not found|ENOENT|is the .*CLI on PATH|executable not found|no such file or directory)\b/i,label:"provider CLI is missing or not on PATH"},{test:/\bfailed to spawn\b/i,label:"provider failed to spawn the worker process"},{test:/\b(?:not logged in|unauthorized|authentication (?:failed|required)|invalid api key|missing api key|401)\b/i,label:"provider authentication failed"},{test:/\b(?:out of usage|increase limits?|switch to auto|ask your admin to increase your limit|usage limits?|quota exceeded|insufficient_quota|credits? exhausted|billing|payment required)\b/i,label:"provider quota exhausted"}]});function je(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function It(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="boolean"?e:Array.isArray(e)?e.length>0:typeof e=="object"?Object.keys(e).length>0:!0}function Pt(e){return!e?.checked||e.headIsAncestorOfBase!==!1?null:je(e.head)}function Tt(e,r,t){let n=["exited_with_changes_salvage"];if((e==="uncommitted"||e==="both")&&n.push(`${r} uncommitted change${r===1?"":"s"} with no final result`),(e==="committed_ahead"||e==="both")&&t){let s=t.length>12?t.slice(0,12):t;n.push(`commit ${s} ahead of base with no final result`)}return n.push("review worktree \u2014 commit, open a PR, or run a salvage worker before discarding"),n.join(": ")}function Ye(e){if(e.alive||It(e.finalResult))return null;let r=(e.changedFiles??[]).filter(i=>i.trim()).length,t=je(e.headCommit)??Pt(e.gitAncestry),n=r>0,s=!!t;if(!n&&!s)return{kind:"none",salvageable:!1,uncommittedCount:0,headCommit:null,attentionReason:"process exited without a final result"};let o=n&&s?"both":n?"uncommitted":"committed_ahead";return{kind:o,salvageable:!0,uncommittedCount:r,headCommit:t,attentionReason:Tt(o,r,t)}}var Ve=u(()=>{"use strict"});var x=u(()=>{"use strict"});var Nt,Jn,Kt,qn,Ge=u(()=>{"use strict";Nt=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Jn=new Set(Nt),Kt=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],qn=new Set(Kt)});import{spawnSync as Je}from"node:child_process";function Wt(e,r,t={}){let n=Je("git",r,X({cwd:e,encoding:"utf8"}));if(n.status!==0&&!t.allowFailure){let s=Ut(e,r,n);if(t.throwError)throw new Error(s);q(s)}return n.stdout||""}function Ut(e,r,t){let n=typeof t.stderr=="string"&&t.stderr.trim()||typeof t.stdout=="string"&&t.stdout.trim()||t.error?.message||`exit ${t.status??"unknown"}`;return`git ${r.join(" ")} failed in ${e}: ${n}`}function qe(e){return Wt(e,["status","--short"],{allowFailure:!0}).split(`
+`).map(r=>r.trim()).filter(Boolean)}function A(e,r){try{let t=Je("git",r,X({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}function ze(e,r,t){let n=A(e,["merge-base","--is-ancestor",r,t]);return n.status===0?{isAncestor:!0,error:null}:n.status===1?{isAncestor:!1,error:null}:{isAncestor:null,error:n.error||n.stderr||n.stdout||`git exited ${n.status}`}}function Xe(e,r="origin/main"){let t=typeof r=="string"?{base:r}:r,n=t.baseCommit?.trim()||t.base?.trim()||"origin/main",s=t.baseCommit?.trim()||null;if(!e)return ne(n,"missing worktree path");let o=A(e,["rev-parse","HEAD"]);if(o.status!==0)return ne(n,o.error||o.stderr||o.stdout||"failed to resolve HEAD");let i;if(s)i=s;else{let p=A(e,["rev-parse",n]);if(p.status!==0)return ne(n,p.error||p.stderr||p.stdout||`failed to resolve ${n}`,o.stdout.trim());i=p.stdout.trim()}let a=o.stdout.trim();if(a===i)return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:!0,headIsAncestorOfBase:!0,relation:"synced"};let l=ze(e,i,a),c=ze(e,a,i),m=l.error||c.error||void 0;if(l.isAncestor==null||c.isAncestor==null)return{checked:!1,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:"unknown",...m?{error:m}:{}};let d=l.isAncestor?"ahead":c.isAncestor?"merged":"diverged";return{checked:!0,base:n,head:a,baseHead:i,baseIsAncestorOfHead:l.isAncestor,headIsAncestorOfBase:c.isAncestor,relation:d,...m?{error:m}:{}}}function ne(e,r,t=null){return{checked:!1,base:e,head:t,baseHead:null,baseIsAncestorOfHead:null,headIsAncestorOfBase:null,relation:"unknown",error:r}}var D=u(()=>{"use strict";x();f();Ge()});function w(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function Bt(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="boolean"?e:Array.isArray(e)?e.length>0:typeof e=="object"?Object.keys(e).length>0:!0}function Dt(e){if(w(e.headCommit)||w(e.prUrl)||w(e.artifactBundlePath)||w(e.patchPath))return!0;let r=e.gitAncestry;return!!(r?.checked&&r.headIsAncestorOfBase===!1&&w(r.head))}function Ze(e){return Bt(e.finalResult)?e.changedFiles.length===0?{blocked:!1}:Dt(e)?{blocked:!0,detail:`Worktree has ${e.changedFiles.length} uncommitted change(s); commit or discard before landing`}:{blocked:!0,reason:"dirty_worktree_no_pr",detail:`Worktree has ${e.changedFiles.length} uncommitted change(s) with no commit or PR; commit, open a PR, or discard before landing`}:{blocked:!1}}function Qe(e){if(e.blocked)return e.detail??e.reason??"dirty_worktree_no_pr"}var er=u(()=>{"use strict"});function se(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let t=JSON.parse(r);if(t&&typeof t=="object"&&!Array.isArray(t))return t}catch{return null}return null}function rr(e){let r=e.targetPrReconciliation??e.target_pr_reconciliation??e.targetPrs??e.target_prs;return Array.isArray(r)?r.length:0}function M(e){let r=e.trim();if(!r)return null;let t=se(r);if(t)return t;let n=[],s=/```(?:json)?\s*([\s\S]*?)```/gi,o;for(;(o=s.exec(r))!==null;){let m=se(o[1]??"");m&&n.push(m)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let m=se(r.slice(i,a+1));m&&n.push(m)}if(n.length===0)return null;let l=n[n.length-1],c=rr(l);for(let m of n){let d=rr(m);d>c&&(l=m,c=d)}return l}var ie=u(()=>{"use strict"});function tr(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`https://github.com/${r[1]}/pull/${r[2]}`:e.trim()||null}function nr(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`${r[1].toLowerCase()}/pull/${r[2]}`:e.trim().toLowerCase()}function Mt(e){return new Set(e.map(r=>nr(tr(r)??r)).filter(Boolean))}function or(e,r,t){let n=tr(e)??e;if(!n)return"unrelated";let s=nr(n);return Mt(r).has(s)?"contract":t?(t.outcome==="skipped"||t.outcome==="blocked")&&t.reason?.trim()?"support":(t.outcome==="merged","unrelated"):"unrelated"}var sr=u(()=>{"use strict"});function S(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function Ft(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="object"?Object.keys(e).length>0:!0}function k(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`https://github.com/${r[1]}/pull/${r[2]}`:S(e)}function F(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`${r[1].toLowerCase()}/pull/${r[2]}`:e.trim().toLowerCase()}function ir(e){let r=null;if(typeof e=="string"){let s=M(e);s&&(r=s)}else e&&typeof e=="object"&&!Array.isArray(e)&&(r=e);if(!r)return[];let t=r.targetPrReconciliation??r.target_pr_reconciliation;if(!Array.isArray(t))return[];let n=[];for(let s of t){if(!s||typeof s!="object"||Array.isArray(s))continue;let o=s,i=k(String(o.prUrl??o.pr_url??"")),a=S(o.outcome);!i||a!=="merged"&&a!=="skipped"&&a!=="blocked"||n.push({prUrl:i,outcome:a,mergeCommit:S(o.mergeCommit??o.merge_commit),reason:S(o.reason)})}return n}function ar(e,r){let t=[],n=k(S(e.prUrl)??"");if(n&&t.push(n),r&&typeof r=="object"&&!Array.isArray(r)){let s=r,o=k(String(s.prUrl??s.pr_url??""));o&&t.push(o)}return[...new Set(t)]}function lr(e){let{contract:r,snapshot:t}=e,n=e.finalResult??t.finalResult;if(!r.landingOnly&&r.targetPrUrls.length===0&&!r.repairEnforceOriginalPr)return{blocked:!1};if(!Ft(n))return(r.requiresTargetPrReconciliation??(r.landingOnly||!!r.repairEnforceOriginalPr||r.targetPrUrls.length>0))&&r.targetPrUrls.length>0?{blocked:!0,reason:"missing_target_pr_reconciliation",detail:`Final result required to reconcile target PR(s): ${r.targetPrUrls.join(", ")}`}:{blocked:!1};if(!(r.requiresTargetPrReconciliation??(r.landingOnly||!!r.repairEnforceOriginalPr||r.targetPrUrls.length>0))&&!r.repairEnforceOriginalPr)return{blocked:!1};let o=r.repairEnforceOriginalPr?k(S(r.targetPrUrl)??"")??(r.targetPrUrls.length===1?k(r.targetPrUrls[0]):null):null;if(o){let d=ar(t,n);if(!(n&&typeof n=="object"&&!Array.isArray(n)&&n.supersedesOriginalTargetPr===!0)){for(let y of d)if(y!==o)return{blocked:!0,reason:"duplicate_repair_pr",detail:`Repair worker opened or attached PR ${y} instead of canonical target ${o}`}}let h=ir(n).find(y=>y.prUrl===o);if(!h||h.outcome!=="merged"&&!(h.reason?.trim()&&(h.outcome==="skipped"||h.outcome==="blocked")))return{blocked:!0,reason:"missing_repair_target_reconciliation",detail:`Repair worker must reconcile target PR ${o}`}}let i=ir(n),a=new Map(i.map(d=>[F(d.prUrl),d])),l=new Set(r.targetPrUrls.map(d=>F(k(d)??d)).filter(Boolean)),c=ar(t,n);if(r.landingOnly)for(let d of c){let p=a.get(F(d)),g=or(d,r.targetPrUrls,p);if(!(g==="contract"||g==="support"))return l.size>0?{blocked:!0,reason:"unrelated_implementation_pr",detail:`Landing-only worker attached unrelated PR ${d}`}:{blocked:!0,reason:"unrelated_implementation_pr",detail:"Landing-only worker must not open new implementation PRs"}}if(r.targetPrUrls.length===0)return{blocked:!1};let m=[];for(let d of r.targetPrUrls){let p=F(k(d)??d),g=a.get(p);if(!g){m.push(p);continue}g.outcome!=="merged"&&!g.reason?.trim()&&m.push(p)}return m.length>0?{blocked:!0,reason:m.every(d=>a.has(d))?"incomplete_target_pr_landing":"missing_target_pr_reconciliation",detail:`Target PR reconciliation incomplete: ${m.join(", ")}`}:{blocked:!1}}function ur(e){if(e.blocked)return e.detail??e.reason}var cr=u(()=>{"use strict";ie();sr()});function $t(e){let r=Date.now();if(e.providerTerminalError||U(e.finalResult)||e.finalResult&&e.error?.trim()||C(e.error)||C(e.finalResult)){let s=e.error||(typeof e.finalResult=="string"?e.finalResult:"provider terminal error");return{state:"blocked",reason:te(s)?.reason??`provider terminal error: ${s}`}}if(e.completionBlocker&&!dr(e.completionBlocker))return{state:"blocked",reason:e.completionBlocker};if(e.finalResult){if(e.localOnly&&jt(e.finalResult))return{state:"done",reason:"local-only worker superseded by merged PR"};let s={finalResult:e.finalResult,changedFiles:e.changedFiles??[],gitAncestry:e.gitAncestry??null,prUrl:e.prUrl??null},o=Ze(s);if(o.blocked){let i=Qe(o);return{state:"needs_attention",reason:o.reason?`landing blocked (${o.reason}): ${i}`:`landing blocked: ${i}`}}if(e.landingContract){let i=lr({contract:e.landingContract,snapshot:s,finalResult:e.finalResult}),a=ur(i);if(a)return{state:"needs_attention",reason:i.reason?`landing contract (${i.reason}): ${a}`:`landing contract: ${a}`}}return{state:"done",reason:"final result recorded"}}if(!e.alive){if(Ht(e))return{state:"done",reason:"empty abandoned worker record"};let s=te(e.error);if(s)return{state:"blocked",reason:s.reason};let o=Ye({alive:!1,finalResult:null,changedFiles:e.changedFiles,gitAncestry:e.gitAncestry});if(o?.salvageable){let a=e.error?.trim();return{state:"needs_attention",reason:a?`${o.attentionReason} (${a})`:o.attentionReason}}let i=e.error?.trim();return{state:"needs_attention",reason:i?`process exited without a final result: ${i}`:o?.attentionReason??"process exited without a final result"}}if(e.heartbeatBlocker)return{state:"blocked",reason:`worker heartbeat reported blocker: ${e.heartbeatBlocker}`};let t=e.startedAt?Date.parse(e.startedAt):NaN;if(!e.firstEventAt&&e.stdoutBytes===0&&e.heartbeatBytes===0&&Number.isFinite(t)&&r-t>Lt)return{state:"needs_attention",reason:`no first stream event ${Z(t)}s after start`};let n=e.lastActivityAt?Date.parse(e.lastActivityAt):NaN;return Number.isFinite(n)&&r-n>L?{state:"stale",reason:`no log/event/heartbeat activity for ${Z(n)}s`}:{state:"ok",reason:"recent activity"}}function dr(e){let r=e?.trim();return r?/completion acknowledged but board not advanced/i.test(r)&&/task already terminal/i.test(r):!1}function Ht(e){return e.finalResult||e.taskId||e.agentOsId||e.stdoutBytes>0||(e.stderrBytes??0)>0||e.heartbeatBytes>0||e.error?.trim()||(e.changedFiles??[]).some(r=>r.trim())?!1:/empty worker dir|marked abandoned/i.test(e.reconcileReason??"")}function jt(e){let r=null;if(typeof e=="string"?r=M(e):e&&typeof e=="object"&&!Array.isArray(e)&&(r=e),!r)return!1;let t=r.targetPrReconciliation??r.target_pr_reconciliation;return Array.isArray(t)?t.some(n=>!n||typeof n!="object"||Array.isArray(n)?!1:String(n.outcome??"").trim()==="merged"):!1}function Yt(e,r,t){let n=e.completionSnapshot?.finalResult;return e.completionAckSource==="local-pr-merged-reconcile"&&n!==void 0&&n!==null?n:r||(n??Ce(t))}function mr(e,r={}){let t=Fe(e.stdoutPath),n=Ae(e.heartbeatPath),s=typeof e.completionReportedAt=="string"&&e.completionReportedAt.trim().length>0,o=Yt(e,t.finalResult,n),i=s?!1:N(e.pid),a=P(e.stdoutPath),l=P(e.stderrPath),c=P(e.heartbeatPath),m=qe(e.worktreePath),d=Xe(e.worktreePath,{base:r.base,baseCommit:r.baseCommit}),p=ve([t.lastEventAt,n.lastHeartbeatAt,T(e.stdoutPath),T(e.stderrPath),T(e.heartbeatPath)]),g=t.error||!i&&!o&&_e(e.stderrPath,10).trim()||void 0,h=typeof e.completionBlocker=="string"&&e.completionBlocker.trim()?e.completionBlocker.trim():null,y=dr(h)?null:h,$r=e.repairTargetPrUrl?{landingOnly:!1,targetPrUrls:[e.repairTargetPrUrl],targetPrUrl:e.repairTargetPrUrl,repairEnforceOriginalPr:!0}:null,z=$t({alive:i,finalResult:o,firstEventAt:t.firstEventAt,stdoutBytes:a,stderrBytes:l,heartbeatBytes:c,lastActivityAt:p,heartbeatBlocker:n.heartbeatBlocker,startedAt:e.startedAt,error:g,providerTerminalError:t.providerTerminalError,changedFiles:m,gitAncestry:d,completionBlocker:y,landingContract:$r,prUrl:e.repairTargetPrUrl??e.taskPrUrl??null,localOnly:e.localOnly===!0,taskId:e.taskId??null,agentOsId:e.agentOsId??null,reconcileReason:e.reconcileReason??null}),Hr=y||z.state==="blocked"?"blocked":s||z.state==="done"?"done":o?"exited":i?"running":"exited";return{runId:e.runId,worker:e.name,pid:e.pid,alive:i,status:Hr,attention:z,branch:e.branch,worktreePath:e.worktreePath,ownedPaths:e.ownedPaths,stdoutBytes:a,stderrBytes:l,heartbeatBytes:c,firstEventAt:t.firstEventAt,lastEventAt:t.lastEventAt,lastActivityAt:p,currentTool:s?null:t.currentTool,heartbeatCount:n.heartbeatCount,lastHeartbeatAt:n.lastHeartbeatAt,lastHeartbeatPhase:n.lastHeartbeatPhase,lastHeartbeatSummary:n.lastHeartbeatSummary,heartbeatBlocker:n.heartbeatBlocker,timestampAnomalies:n.timestampAnomalies,finalResult:o,error:g,providerTerminalError:t.providerTerminalError,changedFiles:m,gitAncestry:d,instructionPolicyFingerprint:e.instructionPolicyFingerprint??null,instructionPolicyEvidence:e.instructionPolicyEvidence??null,model:e.model??e.orchestrationAudit?.model??null,provider:e.provider??e.orchestrationAudit?.provider??null,usage:t.usage??null,boxKind:e.boxKind??null,boxId:e.boxId??null,runtimeId:e.runtimeId??null,personaSlug:e.personaSlug??null,dispatched:e.dispatched??null,localOnly:e.localOnly??null}}function pr(e){return!!(e.finalResult||e.alive===!1||e.status==="exited"||e.status==="done")}function fr(e){return e.finalResult?e.attention.state==="needs_attention"||e.attention.state==="blocked":!1}var Lt,L,O=u(()=>{"use strict";we();Le();B();He();Ve();D();er();cr();ie();f();Lt=18e4,L=6e5});var kr=u(()=>{"use strict";D()});var ae=u(()=>{"use strict";D();x();kr()});var le=u(()=>{"use strict";f()});var b=u(()=>{"use strict"});var $=u(()=>{"use strict"});var br=u(()=>{"use strict"});var Lo,$o,ue=u(()=>{"use strict";Lo=25*1024*1024*1024,$o=12*1024*1024*1024});var Go,zo,Rr=u(()=>{"use strict";ue();Go=5*1024*1024*1024,zo=10*1024*1024*1024});var es,rs,ce=u(()=>{"use strict";Rr();ue();es=30*1024*1024*1024,rs=15*1024*1024*1024});var xr=u(()=>{"use strict";H();f()});var Sr=u(()=>{"use strict";O()});var Xt,Zt,Er=u(()=>{"use strict";br();_();b();$();j();ce();H();xr();Sr();f();Xt=500*1024*1024,Zt=4*1024*1024*1024});var j=u(()=>{"use strict";Er()});import{homedir as en}from"node:os";import rn from"node:path";var Cr,pe=u(()=>{"use strict";Cr=rn.join(en(),".kynver",".env")});var Ar=u(()=>{"use strict"});var wr=u(()=>{"use strict";Ar()});var Or=u(()=>{"use strict"});var Ir=u(()=>{"use strict";f()});var fe=u(()=>{"use strict";wr();Or();Ir()});var Pr=u(()=>{"use strict"});var Tr=u(()=>{"use strict";Pr()});var Y=u(()=>{"use strict";pe();x();_();fe();Tr()});var Nr=u(()=>{"use strict";b();b()});var Kr=u(()=>{"use strict";pe();fe();Y()});var ge=u(()=>{"use strict"});var Wr=u(()=>{"use strict";f()});import ln from"node:path";var Ci,he=u(()=>{"use strict";x();Wr();Ci=ln.join(".openclaw","harness")});var G=u(()=>{"use strict";_();b();$();j();he()});var Br=u(()=>{"use strict";ae();b();Nr();_();Y();Kr();le();ge();G()});var fn,zi,Dr=u(()=>{"use strict";fn=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],zi=fn.join("|")});import{homedir as gn,totalmem as ia}from"node:os";import ye from"node:path";var Mr,Ra,xa,Sa,_a,_=u(()=>{"use strict";ae();x();le();b();$();j();ce();Y();Br();Dr();G();ge();Mr=ye.join(gn(),".kynver"),Ra=ye.join(Mr,"config.json"),xa=ye.join(Mr,"credentials"),Sa=500*1024*1024,_a=4*1024*1024*1024});var Fr=u(()=>{"use strict";_();he();G();f()});var H=u(()=>{"use strict";Fr();f()});O();var gr="kynver-harness:",Vt="@runner:";function hr(e){return e?.trim()?e.trim():null}function Gt(e){let r=hr(e);if(!r?.startsWith(gr))return null;let t=r.slice(gr.length),n=t.indexOf(Vt);return n>=0?t.slice(0,n).trim()||null:t.trim()||null}function yr(e,r){let t=hr(r);return t?Gt(e)===t:!1}O();f();function zt(e){let{worker:r,status:t,taskLease:n}=e,s=n?.leaseOwner??null;if(r.dispatched&&n){if(n.status==="running"&&s&&!yr(s,r.runId))return{health:"orphaned",reason:`task lease held by ${s}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=n.leaseToken?.trim()??"";if(n.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(n.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!t.alive&&!t.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(t.attention.state==="stale")return{health:"stale",reason:t.attention.reason};let o=t.lastHeartbeatAt?Date.parse(t.lastHeartbeatAt):NaN;return t.alive&&Number.isFinite(o)&&Date.now()-o>L?{health:"stale",reason:`heartbeat older than ${Math.floor(L/1e3)}s`}:t.alive&&r.pid&&!N(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:n?.status==="running"&&!t.alive&&t.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:t.attention.reason||"worker within expected lifecycle bounds"}}H();function Lr(e){return!!e.completionReportedAt?.trim()}O();function hn(e){let{worker:r,status:t}=e,n=[];r.localOnly&&n.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&n.push("missing agentOsId/taskId linkage"),Lr(r)&&n.push("completion already acknowledged"),r.completionBlocker&&n.push(r.completionBlocker),t.heartbeatBlocker&&t.alive&&n.push(`worker heartbeat blocker: ${t.heartbeatBlocker}`),t.attention.state==="blocked"&&n.push(t.attention.reason||"worker attention blocked"),fr(t)&&n.push(t.attention.reason||"landing gate blocked");let s=pr(t),o;return s?t.finalResult?o="final_result":t.alive?o="terminal_status":o="process_exited":n.push("worker has not reached a terminal condition"),{eligible:s&&n.length===0,terminalVerified:s,terminalReason:o,blockers:n}}export{hn as assessAutoCompleteEligibility,zt as classifyWorkerHealth,mr as computeWorkerStatus};

package/dist/server/orchestration.js

@@ -1 +1 @@
-import{existsSync as K}from"node:fs";import{homedir as H}from"node:os";import T from"node:path";import{createHash as _}from"node:crypto";import{statSync as R}from"node:fs";import{spawnSync as x}from"node:child_process";function c(e){try{let t=R(e),r=`${e}|${t.size}|${t.mtimeMs}`;return _("sha256").update(r).digest("hex").slice(0,16)}catch{return}}function u(e){return _("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,t){for(let r of t){let o=process.env[r]?.trim();if(o)return o}return e}function a(e,t,r={}){let o=r.timeoutMs??8e3;try{let n=x(e,t,{encoding:"utf8",timeout:o,env:{...process.env,...r.env,CI:"1",NO_COLOR:"1"}});if(n.status===0)return{ok:!0,note:r.okNote??`${e} ${t.join(" ")}: ok`};let i=(n.stderr||n.stdout||"").trim(),s=r.failPrefix??`${e} ${t.join(" ")} failed`;return{ok:!1,note:i?`${s}: ${i.slice(0,200)}`:s}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function h(e,t,r={}){let o=r.timeoutMs??8e3;try{return x(e,t,{stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:r.okNote??`${e} authenticated`}:{ok:!1,note:r.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var j="claude";function L(){let e=H();return[T.join(e,".claude",".credentials.json")]}function P(e=new Date().toISOString()){let t=d(j,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:u("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let r=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=L().find(s=>K(s)),n=h(t,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=r.ok&&(n.ok||!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?c(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[r.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as D}from"node:fs";import{homedir as M}from"node:os";import p from"node:path";var Y="codex";function $(){let e=M();return[process.env.CODEX_HOME?.trim()?p.join(p.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,p.join(e,".codex","auth.json"),p.join(e,".config","codex","auth.json")].filter(r=>!!r)}function w(e){return p.dirname(e)}function F(e){let t,r;for(let o of $()){if(!D(o))continue;t??=o;let n=a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:w(o)}});if(r??=n,n.ok)return{authPath:o,login:n}}return{authPath:t,login:r??a(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function I(e=new Date().toISOString()){let t=d(Y,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:u("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:r,login:o}=F(t),n=!!r&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:r?c(r):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,r?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as U}from"node:fs";import{homedir as V}from"node:os";import O from"node:path";function X(){let e=process.env.HERMES_HOME?.trim(),t=e?O.resolve(e):O.join(V(),".hermes");return O.join(t,"auth.json")}function f(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),r=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=X(),n=U(o),i=h(t,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=r.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?c(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[r.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function S(e=new Date().toISOString()){let t=I(e);if(t.ready)return{...t,path:"codex_cli"};let r=f(e);return r.ready?{providerId:"codex",ready:!0,authSource:r.authSource,sessionFingerprint:r.sessionFingerprint,checkedAt:r.checkedAt,note:r.note,path:"hermes_openai_codex",hermesOpenAiCodex:r}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:r,note:[t.note,r.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as W}from"node:fs";import{homedir as G}from"node:os";import g from"node:path";var J="agent";function z(){let e=G(),t=[g.join(e,".config","cursor","auth.json")];if(process.platform==="win32"){let r=process.env.LOCALAPPDATA?.trim(),o=process.env.APPDATA?.trim();r&&t.push(g.join(r,"cursor-agent","auth.json")),o&&t.push(g.join(o,"cursor","auth.json"))}return t}function E(e=new Date().toISOString()){let t=d(J,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:u("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let r=a(t,["-v"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=z().find(i=>W(i)),n=!!o&&r.ok;return{providerId:"cursor",ready:n,authSource:"oauth_local",sessionFingerprint:o?c(o):void 0,checkedAt:e,note:n?"Local Cursor/Composer OAuth session bound on runner":[r.note,o?void 0:"no ~/.config/cursor/auth.json"].filter(Boolean).join("; ")}}import{existsSync as q,readFileSync as Q}from"node:fs";import{homedir as Z}from"node:os";import C from"node:path";var ee=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function te(){let e=process.env.HERMES_HOME?.trim(),t=e?C.resolve(e):C.join(Z(),".hermes");return C.join(t,".env")}function re(e){try{let t=Q(e,"utf8"),r=[];for(let o of ee)new RegExp(`^${o}=`,"m").test(t)&&r.push(o);return r}catch{return[]}}function b(e=new Date().toISOString()){let t=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),r=a(t,["--version"],{okNote:`${t} CLI available`,failPrefix:`${t} CLI not available`}),o=te(),n=q(o),i=n?re(o):[],v=i.some(B=>B.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",N=r.ok&&n;return{adapterId:"hermes",cliAvailable:r.ok,profileBound:n,authSource:v,sessionFingerprint:n?c(o):void 0,checkedAt:e,note:N?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[r.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function oe(e={}){let t=e.nowIso?.()??new Date().toISOString(),r=S(t),o={codex:r,cursor:E(t),claude:P(t)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:t,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:b(t),hermesOpenAiCodex:f(t),codexAdapterPath:r.path,readyCount:n}}var ne={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function ie(){return Object.values(ne)}var k=["off","observe","enforce"];function se(e){let t=(e??"off").trim().toLowerCase();return k.includes(t)?t:"off"}function m(e=process.env){return se(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function y(e=process.env){let t=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return t?t==="1"||t==="true"||t==="yes"||t==="on":m(e)==="enforce"}import{createHash as ae}from"node:crypto";function l(e){if(e==null)return null;let t=e.trim();return t.length?t:null}function A(e){let t=l(e.sessionId)??"anonymous",r=l(e.title)??l(e.action)??"foreground",o=ae("sha256").update([l(e.planId)??"",l(e.parentTaskId)??"",r.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${t}:${o}`}function ce(e,t){return e==="enforce"&&t?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function de(e,t=process.env){let r=m(t),o=y(t),n=ce(r,o),i=n==="enforce_harness_task"?A({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return r==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:r,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{A as buildForegroundHarnessIdempotencyKey,oe as buildOrchestrationProviderInventory,de as evaluateOrchestrationPolicy,y as isOrchestrationEnforceTasksEnabled,ie as listOrchestrationProviderCapabilities,m as resolveOrchestrationPolicyMode};
+import{existsSync as ie}from"node:fs";import{homedir as se}from"node:os";import ae from"node:path";import{createHash as M}from"node:crypto";import{statSync as ne}from"node:fs";import{spawnSync as H}from"node:child_process";import{existsSync as Y,readFileSync as G}from"node:fs";import p from"node:path";var _=class extends Error{constructor(t){super(`${t} is a batch file that is not a Node CLI shim; it cannot be spawned without a shell. Point the matching KYNVER_*_BIN setting at the real .exe or the CLI's JS entry, or run the daemon inside WSL.`);this.shimPath=t;this.name="UnresolvableWindowsShimError"}shimPath},X=".COM;.EXE;.BAT;.CMD";function q(e){return e.includes("/")||e.includes("\\")}function Q(e){return(e.PATHEXT||X).split(";").map(r=>r.trim().toLowerCase()).filter(r=>r.startsWith("."))}function Z(e){let r=Object.keys(e).find(t=>t.toUpperCase()==="PATH");return r?e[r]??"":""}function ee(e,r={}){let t=r.env??process.env,o=r.exists??Y,n=Q(t),i=p.win32.extname(e)!=="",s=a=>i?[a]:n.map(c=>`${a}${c}`);if(q(e)||p.win32.isAbsolute(e))return s(e).find(a=>o(a))??null;for(let a of Z(t).split(";").map(c=>c.trim()).filter(Boolean)){let c=s(p.win32.join(a,e)).find(m=>o(m));if(c)return c}return null}var D=/%~?dp0%?\\?([^"%\r\n]+?\.(?:c|m)?js)\b/i,re=/^\s*SET\s+"?([A-Za-z_]\w*)=([^"\r\n]*)"?\s*$/i;function B(e){return e.replace(/^[\\/]+/,"")}function te(e){let r=e.split(/\r?\n/),t=new Map;for(let i of r){let s=re.exec(i);s&&t.set(s[1].toUpperCase(),s[2])}let o=r.filter(i=>i.includes("%*")).pop();if(!o)return null;let n=D.exec(o);if(n)return B(n[1]);for(let i of o.matchAll(/%([A-Za-z_]\w*)%/g)){let s=t.get(i[1].toUpperCase()),a=s?D.exec(s):null;if(a)return B(a[1])}return null}function oe(e,r={}){if((r.platform??process.platform)!=="win32")return{executable:e,prefixArgs:[],kind:"passthrough"};let o=ee(e,r);if(!o)return{executable:e,prefixArgs:[],kind:"passthrough"};let n=p.win32.extname(o).toLowerCase();if(n!==".cmd"&&n!==".bat")return{executable:o,prefixArgs:[],kind:"exe"};let i=r.readText??(z=>G(z,"utf8")),s=r.exists??Y,a;try{a=i(o)}catch{throw new _(o)}let c=te(a);if(!c)throw new _(o);let m=p.win32.dirname(o),K=p.win32.join(m,c);if(!s(K))throw new _(o);let L=p.win32.join(m,"node.exe");return{executable:s(L)?L:r.nodeExecutable??process.execPath,prefixArgs:[K],kind:"node-shim"}}function R(e,r,t={}){let o=oe(e,t);return[o.executable,[...o.prefixArgs,...r]]}function l(e){try{let r=ne(e),t=`${e}|${r.size}|${r.mtimeMs}`;return M("sha256").update(t).digest("hex").slice(0,16)}catch{return}}function h(e){return M("sha256").update(`env:${e}`).digest("hex").slice(0,16)}function d(e,r){for(let t of r){let o=process.env[t]?.trim();if(o)return o}return e}function u(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r),s=H(n,i,{windowsHide:!0,encoding:"utf8",timeout:o,env:{...process.env,...t.env,CI:"1",NO_COLOR:"1"}});if(s.status===0)return{ok:!0,note:t.okNote??`${e} ${r.join(" ")}: ok`};let a=(s.stderr||s.stdout||"").trim(),c=t.failPrefix??`${e} ${r.join(" ")} failed`;return{ok:!1,note:a?`${c}: ${a.slice(0,200)}`:c}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} probe failed`}}}function A(e,r,t={}){let o=t.timeoutMs??8e3;try{let[n,i]=R(e,r);return H(n,i,{windowsHide:!0,stdio:"ignore",timeout:o,env:{...process.env,CI:"1",NO_COLOR:"1"}}).status===0?{ok:!0,note:t.okNote??`${e} authenticated`}:{ok:!1,note:t.failNote??`${e} not authenticated`}}catch(n){return{ok:!1,note:n instanceof Error?n.message:`${e} auth probe failed`}}}var ce="claude";function ue(){let e=se();return[ae.join(e,".claude",".credentials.json")]}function U(e=new Date().toISOString()){let r=d(ce,["KYNVER_CLAUDE_BIN","CLAUDE_BIN"]);if(process.env.ANTHROPIC_API_KEY?.trim())return{providerId:"claude",ready:!1,authSource:"api_key_env",sessionFingerprint:h("ANTHROPIC_API_KEY"),checkedAt:e,note:"ANTHROPIC_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `claude` CLI login (OAuth) for harness workers"};let t=u(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=ue().find(s=>ie(s)),n=A(r,["auth","status"],{okNote:"claude auth status: authenticated",failNote:"claude auth status: not authenticated"}),i=t.ok&&(n.ok||!!o);return{providerId:"claude",ready:i,authSource:"oauth_local",sessionFingerprint:o?l(o):void 0,checkedAt:e,note:i?"Local Claude Code OAuth session bound on runner":[t.note,n.note,o?void 0:"no ~/.claude/.credentials.json"].filter(Boolean).join("; ")}}import{existsSync as le}from"node:fs";import{homedir as de}from"node:os";import S from"node:path";var pe="codex";function fe(){let e=de();return[process.env.CODEX_HOME?.trim()?S.join(S.resolve(process.env.CODEX_HOME.trim()),"auth.json"):null,S.join(e,".codex","auth.json"),S.join(e,".config","codex","auth.json")].filter(t=>!!t)}function me(e){return S.dirname(e)}function he(e){let r,t;for(let o of fe()){if(!le(o))continue;r??=o;let n=u(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status",env:{CODEX_HOME:me(o)}});if(t??=n,n.ok)return{authPath:o,login:n}}return{authPath:r,login:t??u(e,["login","status"],{okNote:"codex login status: authenticated",failPrefix:"codex login status"})}}function j(e=new Date().toISOString()){let r=d(pe,["KYNVER_CODEX_BIN","CODEX_BIN"]);if(process.env.CODEX_API_KEY?.trim())return{providerId:"codex",ready:!0,authSource:"api_key_env",sessionFingerprint:h("CODEX_API_KEY"),checkedAt:e,note:"CODEX_API_KEY present (env binding \u2014 cloud credits path, no token stored in Kynver)"};let{authPath:t,login:o}=he(r),n=!!t&&o.ok;return{providerId:"codex",ready:n,authSource:"oauth_local",sessionFingerprint:t?l(t):void 0,checkedAt:e,note:n?"Local Codex OAuth session bound on runner":[o.note,t?void 0:"no Codex auth store found"].filter(Boolean).join("; ")}}import{existsSync as ge}from"node:fs";import{homedir as Ee}from"node:os";import y from"node:path";function _e(){let e=process.env.HERMES_HOME?.trim(),r=e?y.resolve(e):y.join(Ee(),".hermes");return y.join(r,"auth.json")}function x(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=u(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=_e(),n=ge(o),i=A(r,["auth","status","openai-codex"],{okNote:"hermes openai-codex: logged in",failNote:"hermes openai-codex: not logged in"}),s=t.ok&&i.ok;return{path:"hermes_openai_codex",ready:s,authSource:s?"subscription_hermes":"none",sessionFingerprint:n?l(o):void 0,checkedAt:e,note:s?"Hermes openai-codex subscription session bound (ChatGPT Codex OAuth)":[t.note,i.note,n?void 0:"no ~/.hermes/auth.json"].filter(Boolean).join("; ")}}function $(e=new Date().toISOString()){let r=j(e);if(r.ready)return{...r,path:"codex_cli"};let t=x(e);return t.ready?{providerId:"codex",ready:!0,authSource:t.authSource,sessionFingerprint:t.sessionFingerprint,checkedAt:t.checkedAt,note:t.note,path:"hermes_openai_codex",hermesOpenAiCodex:t}:{providerId:"codex",ready:!1,authSource:"none",checkedAt:e,path:"none",hermesOpenAiCodex:t,note:[r.note,t.note].filter(Boolean).join("; ")||"Codex CLI and Hermes openai-codex unavailable"}}import{existsSync as be}from"node:fs";import{homedir as ke}from"node:os";import E from"node:path";import{closeSync as Dr,existsSync as Pe,mkdirSync as Br,openSync as Yr,statSync as Mr,unlinkSync as Hr}from"node:fs";import g from"node:path";function v(e=process.platform){return e!=="win32"}var Se=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Ar=new Set(Se);var Oe=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],xr=new Set(Oe);import{existsSync as O,readdirSync as Ce}from"node:fs";import f from"node:path";var Ae=/^\d{4}\.\d{1,2}\.\d{1,2}-[a-f0-9]+$/i;function xe(e){let t=e.split("-")[0].split(".");if(t.length!==3)return null;let[o,n,i]=t;return!o||!n||!i?null:+`${o}${n.padStart(2,"0")}${i.padStart(2,"0")}`}function ve(e){let r=f.join(e,"versions");if(!O(r))return null;let t=null,o=-1;for(let n of Ce(r,{withFileTypes:!0})){if(!n.isDirectory()||!Ae.test(n.name))continue;let i=xe(n.name);i==null||i<=o||(o=i,t=f.join(r,n.name))}return t}function k(e){let r=e?.trim()||f.join(process.env.LOCALAPPDATA||"","cursor-agent"),t=f.join(r,"node.exe"),o=f.join(r,"index.js");if(O(t)&&O(o))return{nodeExe:t,indexJs:o,versionDir:r};let n=ve(r);if(!n)return null;let i=f.join(n,"node.exe"),s=f.join(n,"index.js");return!O(i)||!O(s)?null:{nodeExe:i,indexJs:s,versionDir:n}}function Re(e,r,t){return{executable:e,prefixArgs:[r],shell:!1,detached:v(),bundledVersionDir:t}}function F(e){if(process.platform==="win32"){let r=/\.(cmd|bat)$/i.test(e),t=/node\.exe$/i.test(e)&&Pe(g.join(g.dirname(e),"index.js"));if(r||t||e==="agent"){let n=r?k(g.dirname(e)):t?{nodeExe:e,indexJs:g.join(g.dirname(e),"index.js"),versionDir:g.dirname(e)}:k();if(n)return Re(n.nodeExe,n.indexJs,n.versionDir);throw new Error("Cursor Agent on Windows has no headless bundled node.exe under %LOCALAPPDATA%\\cursor-agent\\versions\\\u2026. Run `agent login` / update Cursor Agent CLI, use `--provider claude`, or set KYNVER_CURSOR_AGENT_ROOT to the cursor-agent folder.")}}return{executable:e,prefixArgs:[],shell:!1,detached:v()}}import{spawnSync as ye}from"node:child_process";function b(e,r=process.env){try{let t;try{t=F(e)}catch{t={executable:e,prefixArgs:[]}}let o=ye(t.executable,[...t.prefixArgs,"status","--format","json"],{encoding:"utf8",windowsHide:!0,timeout:8e3,env:{...r,CI:"1",NO_COLOR:"1"}});if(o.status!==0)return{ok:!1,note:"agent status: not authenticated"};let n=(o.stdout||"").trim();if(!n)return{ok:!1,note:"agent status: empty response"};let i;try{i=JSON.parse(n)}catch{return{ok:!1,note:"agent status: unparseable response"}}return typeof i=="object"&&i!==null&&i.isAuthenticated===!0?{ok:!0,note:"agent status: authenticated"}:{ok:!1,note:"agent status: not authenticated"}}catch(t){return{ok:!1,note:t instanceof Error?t.message:"agent status probe failed"}}}function I(e=process.env){let r=[],t=e.KYNVER_CURSOR_AUTH_HOME?.trim();t&&(r.push(E.join(t,".config","cursor","auth.json")),r.push(E.join(t,".cursor-agent","auth.json")));let o=ke();if(r.push(E.join(o,".config","cursor","auth.json")),r.push(E.join(o,".cursor-agent","auth.json")),process.platform==="win32"){let n=e.LOCALAPPDATA?.trim(),i=e.APPDATA?.trim();n&&r.push(E.join(n,"cursor-agent","auth.json")),i&&r.push(E.join(i,"cursor","auth.json"))}return r}var Ie="agent";function V(e=new Date().toISOString()){let r=d(Ie,["KYNVER_CURSOR_AGENT_BIN","CURSOR_AGENT_BIN"]);if(process.env.CURSOR_API_KEY?.trim())return{providerId:"cursor",ready:!1,authSource:"api_key_env",sessionFingerprint:h("CURSOR_API_KEY"),checkedAt:e,note:"CURSOR_API_KEY present but scrubbed from worker env (deployment secret) \u2014 use `agent login` (OAuth) for harness workers"};let t=u(r,["-v"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=I().find(a=>be(a)),n=b(r),i=!!o||n.ok,s=t.ok&&i;return{providerId:"cursor",ready:s,authSource:"oauth_local",sessionFingerprint:o?l(o):void 0,checkedAt:e,note:s?"Local Cursor/Composer OAuth session bound on runner":[t.note,i?void 0:n.note??"no ~/.config/cursor/auth.json or `agent login` session"].filter(Boolean).join("; ")}}import{existsSync as Ne,readFileSync as Te}from"node:fs";import{homedir as we}from"node:os";import N from"node:path";var Ke=["OPENAI_API_KEY","ANTHROPIC_API_KEY","KYNVER_API_KEY","KYNVER_BASE_URL"];function Le(){let e=process.env.HERMES_HOME?.trim(),r=e?N.resolve(e):N.join(we(),".hermes");return N.join(r,".env")}function De(e){try{let r=Te(e,"utf8"),t=[];for(let o of Ke)new RegExp(`^${o}=`,"m").test(r)&&t.push(o);return t}catch{return[]}}function W(e=new Date().toISOString()){let r=d("hermes",["KYNVER_HERMES_BIN","HERMES_BIN"]),t=u(r,["--version"],{okNote:`${r} CLI available`,failPrefix:`${r} CLI not available`}),o=Le(),n=Ne(o),i=n?De(o):[],a=i.some(m=>m.endsWith("_API_KEY"))?"api_key_env":n?"oauth_local":"none",c=t.ok&&n;return{adapterId:"hermes",cliAvailable:t.ok,profileBound:n,authSource:a,sessionFingerprint:n?l(o):void 0,checkedAt:e,note:c?`Hermes profile bound (${i.length?`keys: ${i.join(", ")}`:"no API keys detected"})`:[t.note,n?void 0:"no ~/.hermes/.env"].filter(Boolean).join("; ")}}function Be(e={}){let r=e.nowIso?.()??new Date().toISOString(),t=$(r),o={codex:t,cursor:V(r),claude:U(r)},n=Object.values(o).filter(i=>i.ready).length;return{generatedAt:r,bindings:o,cloudApiCredits:{anthropicApiKey:!!process.env.ANTHROPIC_API_KEY?.trim(),openaiApiKey:!!process.env.OPENAI_API_KEY?.trim(),codexApiKey:!!process.env.CODEX_API_KEY?.trim()},workerEndpoint:{baseUrlConfigured:!!process.env.KYNVER_WORKER_BASE_URL?.trim(),apiKeyConfigured:!!process.env.KYNVER_WORKER_API_KEY?.trim()},hermes:W(r),hermesOpenAiCodex:x(r),codexAdapterPath:t.path,readyCount:n}}var Ye={codex:{id:"codex",displayName:"Codex (BYO OAuth / Hermes openai-codex)",costTier:"low",authSources:["oauth_local","api_key_env","subscription_hermes"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!1,workerMcpTools:"supported"},cursor:{id:"cursor",displayName:"Cursor / Composer",costTier:"medium",authSources:["oauth_local","api_key_env"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"},claude:{id:"claude",displayName:"Claude Code",costTier:"high",authSources:["oauth_local"],supportsLowRiskOrchestration:!0,supportsPrivilegedPlatformActions:!0,workerMcpTools:"supported"}};function Me(){return Object.values(Ye)}var J=["off","observe","enforce"];function He(e){let r=(e??"off").trim().toLowerCase();return J.includes(r)?r:"off"}function P(e=process.env){return He(e.KYNVER_ORCHESTRATION_POLICY_MODE)}function T(e=process.env){let r=e.KYNVER_ORCHESTRATION_ENFORCE_TASKS?.trim().toLowerCase();return r?r==="1"||r==="true"||r==="yes"||r==="on":P(e)==="enforce"}import{createHash as Ue}from"node:crypto";function C(e){if(e==null)return null;let r=e.trim();return r.length?r:null}function w(e){let r=C(e.sessionId)??"anonymous",t=C(e.title)??C(e.action)??"foreground",o=Ue("sha256").update([C(e.planId)??"",C(e.parentTaskId)??"",t.toLowerCase()].join("|")).digest("hex").slice(0,16);return`hermes-foreground:${r}:${o}`}function je(e,r){return e==="enforce"&&r?"enforce_harness_task":e==="observe"?"observe_bypass":"allow_local"}function $e(e,r=process.env){let t=P(r),o=T(r),n=je(t,o),i=n==="enforce_harness_task"?w({sessionId:e.sessionId,planId:e.planId,parentTaskId:e.parentTaskId,title:e.title,action:e.action}):null,s;return t==="off"?s="Orchestration policy off \u2014 local foreground path allowed.":n==="observe_bypass"?s=`Observe mode: ${e.action} bypass logged; local fallback preserved.`:n==="enforce_harness_task"?s=`Enforce mode: ${e.action} must create linked harness AgentTask (${i}).`:s="Local foreground path allowed.",{mode:t,decision:n,idempotencyKey:i,bypassLogged:n==="observe_bypass",reason:s}}export{w as buildForegroundHarnessIdempotencyKey,Be as buildOrchestrationProviderInventory,$e as evaluateOrchestrationPolicy,T as isOrchestrationEnforceTasksEnabled,Me as listOrchestrationProviderCapabilities,P as resolveOrchestrationPolicyMode};

package/dist/server/worker-policy.js

@@ -1,2 +1,2 @@
-var i=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function G(e){let r=e[Cr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function v(e,r={}){return kr.has(e)?!0:Sr.has(e)||r.operatorAllow?.has(e)||Or.some(t=>e.endsWith(t))?!1:xr.some(t=>e.endsWith(t))}function ye(e){let r=G(e);return Object.keys(e).filter(t=>v(t,{operatorAllow:r})).sort()}function ve(e){let r=G(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!v(t,{operatorAllow:r})&&v(t)).sort()}function C(e){let r=G(e),t={...e};for(let n of Object.keys(t))v(n,{operatorAllow:r})&&delete t[n];return t}function Ar(e){let r=ye(e),t=ve(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var br,kr,xr,Er,Sr,Or,Cr,A=i(()=>{"use strict";br=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],kr=new Set(br),xr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],Er=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Sr=new Set(Er),Or=["_PUBLIC_KEY"],Cr="KYNVER_WORKER_ENV_ALLOW"});var g=i(()=>{"use strict"});function J(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=i(()=>{"use strict"});var I=i(()=>{"use strict";g();a();A()});var Se=i(()=>{"use strict";I()});var Q=i(()=>{"use strict";I();g();Se()});var Z=i(()=>{"use strict";a()});var m=i(()=>{"use strict"});var N=i(()=>{"use strict"});var Oe=i(()=>{"use strict"});var In,Nn,ee=i(()=>{"use strict";In=25*1024*1024*1024,Nn=12*1024*1024*1024});var Dn,Bn,Ce=i(()=>{"use strict";ee();Dn=5*1024*1024*1024,Bn=10*1024*1024*1024});var Vn,jn,re=i(()=>{"use strict";Ce();ee();Vn=30*1024*1024*1024,jn=15*1024*1024*1024});var we=i(()=>{"use strict";a()});import jr from"node:path";var eo,te=i(()=>{"use strict";g();we();eo=jr.join(".openclaw","harness")});var W=i(()=>{"use strict";f();m();N();K();te()});var Ne=i(()=>{"use strict";f();te();W();a()});var oe=i(()=>{"use strict";Ne();a()});var Te=i(()=>{"use strict";oe();a()});var We=i(()=>{"use strict"});var Ke=i(()=>{"use strict";We();a()});var Me=i(()=>{"use strict"});var De=i(()=>{"use strict";Me()});var D=i(()=>{"use strict"});var Be=i(()=>{"use strict";De();a();D()});var Ue=i(()=>{"use strict";D()});var Le=i(()=>{"use strict"});var Fe=i(()=>{"use strict"});var ie=i(()=>{"use strict"});var $e=i(()=>{"use strict"});var He=i(()=>{"use strict";ie();$e()});var Ve=i(()=>{"use strict";Ke();Be();D();Ue();Le();I();Fe();He();ie();a()});var je=i(()=>{"use strict";Ve()});var rt,tt,Ye=i(()=>{"use strict";Oe();f();m();N();K();re();oe();Te();je();a();rt=500*1024*1024,tt=4*1024*1024*1024});var K=i(()=>{"use strict";Ye()});import{homedir as nt}from"node:os";import ot from"node:path";var Ge,se=i(()=>{"use strict";Ge=ot.join(nt(),".kynver",".env")});var qe=i(()=>{"use strict"});var ze=i(()=>{"use strict";qe()});var Je=i(()=>{"use strict"});var ae=i(()=>{"use strict";ze();Je()});var Xe=i(()=>{"use strict"});var Qe=i(()=>{"use strict";Xe()});var B=i(()=>{"use strict";se();g();f();ae();Qe()});var Ze=i(()=>{"use strict";m();m()});var er=i(()=>{"use strict";se();ae();B()});var rr=i(()=>{"use strict";Q();m();Ze();f();B();er();Z();W()});function _(e){let r=e.trim().toLowerCase();return mt[r]??r}var tr,pt,mt,U=i(()=>{"use strict";tr=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],pt=tr.join("|"),mt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});import{homedir as gt,totalmem as ra}from"node:os";import le from"node:path";var nr,fa,ga,ha,ya,f=i(()=>{"use strict";Q();g();Z();m();N();K();re();B();rr();U();W();nr=le.join(gt(),".kynver"),fa=le.join(nr,"config.json"),ga=le.join(nr,"credentials"),ha=500*1024*1024,ya=4*1024*1024*1024});A();A();var q="KYNVER_NO_PROD_DB_CREDENTIALS",wr=["KYNVER_ENV_FILE"],Pr=new Set(["1","true","yes","on"]);function _e(e){let r=e[q]?.trim().toLowerCase();return r!==void 0&&Pr.has(r)}function p(e,r={}){let t=C(e);if(!r.reviewWorker)return t;let n={...t,[q]:"1"};for(let o of wr)delete n[o];return n}var Re=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Ir(e,r={}){let t=p(e,r),n=Object.keys(t).filter(c=>c.endsWith("_SECRET")||c.endsWith("_API_KEY")||Re.includes(c)),o=Re.every(c=>t[c]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=_e(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:o,envFilePointerStripped:s,safe:o&&n.length===0&&s&&(!r.reviewWorker||l)}}var Nr="expert-lane-pr-review:",Tr="plan-review-task",Wr="scheduledjob:",w=new Set(["lorentz","dalton","rhea","sentinel"]);function Kr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function z(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function Mr(e,r){return e.startsWith("factory:")?e.includes("lb")||z(r):!1}function Dr(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),o=`${t}
-${n}`,s=Kr(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(Nr)||r===Tr||r.startsWith("daemon-review:")||s&&w.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Mr(r,o)||z(o))||r.startsWith(Wr)&&e.parentTaskId&&s&&w.has(s)||e.planId&&!e.parentTaskId&&s&&w.has(s)&&z(o)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&w.has(s))}var Br=/^claude[-_]/i,Ur=/^(?:opus|sonnet|haiku)\b/i;function be(e){let r=e.trim();return Br.test(r)||Ur.test(r)}function ke(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function xe(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Ee(e){return e.trim().toLowerCase().startsWith("gemini-")}function Lr(e){return ke(e)?"codex":be(e)?"claude":Ee(e)?"gemini":(xe(e),"cursor")}function Fr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),o=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:o,rule:o?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:o,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:o,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:o,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:o,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:o,rule:o?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function $r(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(o=>o.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?be(n)||ke(n)||xe(n)||Ee(n)?{lane:t,model:n,provider:Lr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function P(e){let r=typeof e=="string"?e.trim():"";return r?Fr(r)??$r(r):null}f();a();var sr="kynver",ar=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Rt=ar.map(e=>`mcp__${sr}__${e}`);a();a();var hl=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5";function bt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5"}var kt=bt();a();var $l=600*1e3;a();var rc=600*1e3;var lr="composer-2.5";U();U();var d="cursor",Ot=new Set(["claude","opus","anthropic"]),Ct=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function k(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function u(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Ot.has(r)?!0:r.includes("claude")||r.includes("opus")}function ce(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&u(r))return!0;let t=k(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=P(k(e,"executorRef"));if(n?.provider&&u(n.provider)||n?.model&&u(At(n.model)))return!0;let o=k(e,"description");if(Ct.some(l=>l.test(o)))return!0;let s=k(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function At(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function wt(e,r){return{provider:d,model:lr,rule:`policy:cursor_default${r}`,requestedModel:e}}var Pt=["explicit:","executor_ref:","factory:","task:"];function It(e){return Pt.some(r=>e.startsWith(r))}function ue(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||P(k(e,"executorRef"))?.provider?!0:ce(e)}function cr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&u(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||It(r.rule)||ue(t)||!u(r.provider))return r;let o=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return wt(r.model,o)}function Nt(e,r=d){let t=e?.trim();return t?_(t):r}function Tt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(d)?[...new Set(r.map(t=>u(t)?d:t))]:r.every(t=>u(t))?[d]:r}var Wt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,Kt=/\b(npm run build\b|next build\b)\b/i,Mt=/\b(vercel (build|deploy|--prod))\b/i,Dt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function de(e){let r=e.trim();return r?Dt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:Mt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:Kt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:Wt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var $="heavy_verification_token_required";import{spawnSync as rn}from"node:child_process";a();import{closeSync as Ht,existsSync as E,mkdirSync as Vt,openSync as jt,readdirSync as mr,readFileSync as Yt,statSync as Gt,unlinkSync as fr,writeFileSync as qt}from"node:fs";import fe from"node:path";import{mkdirSync as Ut}from"node:fs";import{tmpdir as Lt}from"node:os";import H from"node:path";import{homedir as Bt}from"node:os";import ur from"node:path";function dr(){let e=process.env.KYNVER_STATE_ROOT;return e?ur.resolve(e):ur.join(Bt(),".kynver","state")}function Ft(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function $t(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?H.resolve(e):Ft()?H.join(Lt(),"kynver","state","heavy-verification"):H.join(dr(),"heavy-verification")}function pe(){return H.join($t(),"slots")}function x(){let e=pe();return Ut(e,{recursive:!0}),e}var S=120*6e4,pr=1;function zt(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function j(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function V(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?zt(e,pr):pr}function Jt(e){return`slot-${e}`}function Xt(e,r=pe()){return fe.join(r,`${e}.json`)}function ge(e){if(!E(e))return null;try{let r=JSON.parse(Yt(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function gr(e,r=S){if(!e||!J(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function hr(e,r){let t=ge(e);if(t)return gr(t,r);if(!E(e))return!0;try{return Date.now()-Gt(e).mtimeMs>r}catch{return!0}}function Qt(e,r){if(hr(e,r))try{fr(e)}catch{}}function Zt(e){return Vt(e,{recursive:!0}),e}function he(e={}){let r=Zt(e.slotsDir??x()),t=e.staleMs??S,n=0;for(let o of mr(r)){if(!o.endsWith(".json"))continue;let s=fe.join(r,o),l=E(s);Qt(s,t),l&&!E(s)&&(n+=1)}return n}function en(e={}){let r=e.slotsDir??x(),t=e.staleMs??S;he({slotsDir:r,staleMs:t});let n=[];for(let o of mr(r)){if(!o.endsWith(".json"))continue;let s=ge(fe.join(r,o));s&&!gr(s,t)&&n.push(s)}return n}function me(e={}){return en(e).length}function O(e,r={}){if(j())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:V(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??S,o=r.maxSlots??V();he({slotsDir:t,staleMs:n});for(let l=0;l<o;l+=1){let c=Jt(l),h=Xt(c,t),vr=ge(h);if(hr(h,n))try{fr(h)}catch{}else if(vr||E(h))continue;let Rr={slotId:c,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let y=jt(h,"wx");qt(y,JSON.stringify(Rr,null,2),"utf8"),Ht(y);let _r=me({slotsDir:t,staleMs:n});return{admitted:!0,slotId:c,activeSlots:_r,maxSlots:o,reason:null}}catch(y){if(y.code==="EEXIST")continue;throw y}}let s=me({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:o,reason:`heavy verification at capacity (${s}/${o} slots)`}}function Y(e,r={}){if(j())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:V(),reason:null};let t=r.slotsDir??x(),n=r.staleMs??S,o=r.maxSlots??V();he({slotsDir:t,staleMs:n});let s=me({slotsDir:t,staleMs:n}),l=s<o;return{admitted:l,slotId:null,activeSlots:s,maxSlots:o,reason:l?null:`heavy verification at capacity (${s}/${o} slots); waiting for ${e}`}}function tn(e){e<=0||rn(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function yr(e,r,t=2e3,n={}){let o=Date.now()+Math.max(0,r),s=O(e,n);for(;!s.admitted&&Date.now()<o;)tn(Math.min(t,o-Date.now())),s=O(e,n);return s}function nn(e,r={}){let t=de(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...Y(e),slotId:null}};if(j())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...Y(e),slotId:null}};let n=r.waitMs??0,o=n>0?yr(e,n,r.pollMs):O(e);return o.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:o}:{allowed:!1,outcome:$,commandClass:t.commandClass,reason:t.reason??o.reason??$,verificationGate:o}}export{d as DEFAULT_WORKER_PROVIDER,$ as HEAVY_VERIFICATION_TOKEN_REQUIRED,q as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Ir as auditReviewWorkerCredentialScope,Ar as auditWorkerEnv,p as buildWorkerSpawnEnv,de as classifyHeavyShellCommand,cr as enforceCursorWorkerProvider,nn as gateWorkerShellCommand,u as isClaudeFamilyProvider,v as isForbiddenWorkerEnvKey,Dr as isHarnessExpertReviewWorker,_e as isNoProdCredentialReviewEnvironment,ye as listForbiddenWorkerEnvKeys,ve as listOperatorAllowedWorkerEnvKeys,_ as normalizeWorkerProviderName,Tt as preferCursorExecutor,Nt as resolveConfiguredWorkerProvider,C as scrubWorkerEnv,ce as taskAllowsClaudeWorker,ue as taskExpressesWorkerProviderPreference};
+var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function J(e){let r=e[Tr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function _(e,r={}){return Or.has(e)?!0:Pr.has(e)||r.operatorAllow?.has(e)||Ir.some(t=>e.endsWith(t))?!1:Ar.some(t=>e.endsWith(t))}function _e(e){let r=J(e);return Object.keys(e).filter(t=>_(t,{operatorAllow:r})).sort()}function ke(e){let r=J(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!_(t,{operatorAllow:r})&&_(t)).sort()}function A(e){let r=J(e),t={...e};for(let n of Object.keys(t))_(n,{operatorAllow:r})&&delete t[n];return t}function Nr(e){let r=_e(e),t=ke(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var Cr,Or,Ar,wr,Pr,Ir,Tr,w=o(()=>{"use strict";Cr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Or=new Set(Cr),Ar=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],wr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Pr=new Set(wr),Ir=["_PUBLIC_KEY"],Tr="KYNVER_WORKER_ENV_ALLOW"});var g=o(()=>{"use strict"});var Ae=o(()=>{"use strict"});function Q(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict";Ae()});var T=o(()=>{"use strict";g();a();w()});var we=o(()=>{"use strict";T()});var ee=o(()=>{"use strict";T();g();we()});var re=o(()=>{"use strict";a()});var m=o(()=>{"use strict"});var N=o(()=>{"use strict"});var Pe=o(()=>{"use strict"});var Hn,Vn,te=o(()=>{"use strict";Hn=25*1024*1024*1024,Vn=12*1024*1024*1024});var Jn,zn,Ie=o(()=>{"use strict";te();Jn=5*1024*1024*1024,zn=10*1024*1024*1024});var to,no,ne=o(()=>{"use strict";Ie();te();to=30*1024*1024*1024,no=15*1024*1024*1024});var Ne=o(()=>{"use strict";a()});import zr from"node:path";var mo,oe=o(()=>{"use strict";g();Ne();mo=zr.join(".openclaw","harness")});var W=o(()=>{"use strict";f();m();N();D();oe()});var De=o(()=>{"use strict";f();oe();W();a()});var se=o(()=>{"use strict";De();a()});var Me=o(()=>{"use strict";se();a()});var Ue=o(()=>{"use strict"});var Be=o(()=>{"use strict";Ue();a()});var Le=o(()=>{"use strict"});var Fe=o(()=>{"use strict";Le()});var U=o(()=>{"use strict"});var $e=o(()=>{"use strict";Fe();a();U()});var He=o(()=>{"use strict";U()});var Ve=o(()=>{"use strict"});var je=o(()=>{"use strict"});var ae=o(()=>{"use strict"});var Ye=o(()=>{"use strict"});var Ge=o(()=>{"use strict";ae();Ye()});var qe=o(()=>{"use strict";Be();$e();U();He();Ve();T();je();Ge();ae();a()});var Je=o(()=>{"use strict";qe()});var at,lt,ze=o(()=>{"use strict";Pe();f();m();N();D();ne();se();Me();Je();a();at=500*1024*1024,lt=4*1024*1024*1024});var D=o(()=>{"use strict";ze()});import{homedir as ut}from"node:os";import ct from"node:path";var Xe,le=o(()=>{"use strict";Xe=ct.join(ut(),".kynver",".env")});var Qe=o(()=>{"use strict"});var Ze=o(()=>{"use strict";Qe()});var er=o(()=>{"use strict"});var rr=o(()=>{"use strict";a()});var ue=o(()=>{"use strict";Ze();er();rr()});var tr=o(()=>{"use strict"});var nr=o(()=>{"use strict";tr()});var B=o(()=>{"use strict";le();g();f();ue();nr()});var or=o(()=>{"use strict";m();m()});var ir=o(()=>{"use strict";le();ue();B()});var ce=o(()=>{"use strict"});var sr=o(()=>{"use strict";ee();m();or();f();B();ir();re();ce();W()});function k(e){let r=e.trim().toLowerCase();return Rt[r]??r}var ar,vt,Rt,L=o(()=>{"use strict";ar=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],vt=ar.join("|"),Rt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});import{homedir as kt,totalmem as ba}from"node:os";import de from"node:path";var lr,Da,Ma,Ua,Ba,f=o(()=>{"use strict";ee();g();re();m();N();D();ne();B();sr();L();W();ce();lr=de.join(kt(),".kynver"),Da=de.join(lr,"config.json"),Ma=de.join(lr,"credentials"),Ua=500*1024*1024,Ba=4*1024*1024*1024});w();w();var z="KYNVER_NO_PROD_DB_CREDENTIALS",Kr=["KYNVER_ENV_FILE"],Wr=new Set(["1","true","yes","on"]);function xe(e){let r=e[z]?.trim().toLowerCase();return r!==void 0&&Wr.has(r)}function d(e,r={}){let t=A(e);if(!r.reviewWorker)return t;let n={...t,[z]:"1"};for(let i of Kr)delete n[i];return n}var be=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Dr(e,r={}){let t=d(e,r),n=Object.keys(t).filter(u=>u.endsWith("_SECRET")||u.endsWith("_API_KEY")||be.includes(u)),i=be.every(u=>t[u]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=xe(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var Mr="expert-lane-pr-review:",Ur="plan-review-task",Br="scheduledjob:",P=new Set(["lorentz","dalton","rhea","sentinel"]);function Lr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function X(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function Fr(e,r){return e.startsWith("factory:")?e.includes("lb")||X(r):!1}function $r(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
+${n}`,s=Lr(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(Mr)||r===Ur||r.startsWith("daemon-review:")||s&&P.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Fr(r,i)||X(i))||r.startsWith(Br)&&e.parentTaskId&&s&&P.has(s)||e.planId&&!e.parentTaskId&&s&&P.has(s)&&X(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&P.has(s))}var Hr=/^claude[-_]/i,Vr=/^(?:opus|sonnet|haiku)\b/i;function Ee(e){let r=e.trim();return Hr.test(r)||Vr.test(r)}function Se(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Ce(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Oe(e){return e.trim().toLowerCase().startsWith("gemini-")}function jr(e){return Se(e)?"codex":Ee(e)?"claude":Oe(e)?"gemini":(Ce(e),"cursor")}function Yr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:i,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:i,rule:i?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function Gr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Ee(n)||Se(n)||Ce(n)||Oe(n)?{lane:t,model:n,provider:jr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function I(e){let r=typeof e=="string"?e.trim():"";return r?Yr(r)??Gr(r):null}f();a();a();var dr="kynver",pr=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Ot=pr.map(e=>`mcp__${dr}__${e}`);a();a();var su=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5";function wt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5"}var Pt=wt();a();var Nu=600*1e3;a();var Gu=600*1e3;var mr="composer-2.5";L();L();var p="cursor",Kt=new Set(["claude","opus","anthropic"]),Wt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function x(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function c(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Kt.has(r)?!0:r.includes("claude")||r.includes("opus")}function pe(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&c(r))return!0;let t=x(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=I(x(e,"executorRef"));if(n?.provider&&c(n.provider)||n?.model&&c(Dt(n.model)))return!0;let i=x(e,"description");if(Wt.some(l=>l.test(i)))return!0;let s=x(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function Dt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Mt(e,r){return{provider:p,model:mr,rule:`policy:cursor_default${r}`,requestedModel:e}}var Ut=["explicit:","executor_ref:","factory:","task:"];function Bt(e){return Ut.some(r=>e.startsWith(r))}function me(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||I(x(e,"executorRef"))?.provider?!0:pe(e)}function fr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&c(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Bt(r.rule)||me(t)||!c(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Mt(r.model,i)}function Lt(e,r=p){let t=e?.trim();return t?k(t):r}function Ft(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(p)?[...new Set(r.map(t=>c(t)?p:t))]:r.every(t=>c(t))?[p]:r}var $t=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,Ht=/\b(npm run build\b|next build\b)\b/i,Vt=/\b(vercel (build|deploy|--prod))\b/i,jt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function fe(e){let r=e.trim();return r?jt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:Vt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:Ht.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:$t.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var V="heavy_verification_token_required";import{spawnSync as cn}from"node:child_process";a();import{closeSync as Xt,existsSync as S,mkdirSync as Qt,openSync as Zt,readdirSync as vr,readFileSync as en,statSync as rn,unlinkSync as Rr,writeFileSync as tn}from"node:fs";import ye from"node:path";import{mkdirSync as Gt}from"node:fs";import{tmpdir as qt}from"node:os";import j from"node:path";import{homedir as Yt,tmpdir as vc}from"node:os";import gr from"node:path";function hr(){let e=process.env.KYNVER_STATE_ROOT;return e?gr.resolve(e):gr.join(Yt(),".kynver","state")}function Jt(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function zt(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?j.resolve(e):Jt()?j.join(qt(),"kynver","state","heavy-verification"):j.join(hr(),"heavy-verification")}function ge(){return j.join(zt(),"slots")}function E(){let e=ge();return Gt(e,{recursive:!0}),e}var C=120*6e4,yr=1;function nn(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function G(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function Y(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?nn(e,yr):yr}function on(e){return`slot-${e}`}function sn(e,r=ge()){return ye.join(r,`${e}.json`)}function ve(e){if(!S(e))return null;try{let r=JSON.parse(en(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function _r(e,r=C){if(!e||!Q(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function kr(e,r){let t=ve(e);if(t)return _r(t,r);if(!S(e))return!0;try{return Date.now()-rn(e).mtimeMs>r}catch{return!0}}function an(e,r){if(kr(e,r))try{Rr(e)}catch{}}function ln(e){return Qt(e,{recursive:!0}),e}function Re(e={}){let r=ln(e.slotsDir??E()),t=e.staleMs??C,n=0;for(let i of vr(r)){if(!i.endsWith(".json"))continue;let s=ye.join(r,i),l=S(s);an(s,t),l&&!S(s)&&(n+=1)}return n}function un(e={}){let r=e.slotsDir??E(),t=e.staleMs??C;Re({slotsDir:r,staleMs:t});let n=[];for(let i of vr(r)){if(!i.endsWith(".json"))continue;let s=ve(ye.join(r,i));s&&!_r(s,t)&&n.push(s)}return n}function he(e={}){return un(e).length}function O(e,r={}){if(G())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Y(),reason:null};let t=r.slotsDir??E(),n=r.staleMs??C,i=r.maxSlots??Y();Re({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let u=on(l),v=sn(u,t),xr=ve(v);if(kr(v,n))try{Rr(v)}catch{}else if(xr||S(v))continue;let Er={slotId:u,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let R=Zt(v,"wx");tn(R,JSON.stringify(Er,null,2),"utf8"),Xt(R);let Sr=he({slotsDir:t,staleMs:n});return{admitted:!0,slotId:u,activeSlots:Sr,maxSlots:i,reason:null}}catch(R){if(R.code==="EEXIST")continue;throw R}}let s=he({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function q(e,r={}){if(G())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Y(),reason:null};let t=r.slotsDir??E(),n=r.staleMs??C,i=r.maxSlots??Y();Re({slotsDir:t,staleMs:n});let s=he({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function dn(e){e<=0||cn(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore",windowsHide:!0})}function br(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=O(e,n);for(;!s.admitted&&Date.now()<i;)dn(Math.min(t,i-Date.now())),s=O(e,n);return s}function pn(e,r={}){let t=fe(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...q(e),slotId:null}};if(G())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...q(e),slotId:null}};let n=r.waitMs??0,i=n>0?br(e,n,r.pollMs):O(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:V,commandClass:t.commandClass,reason:t.reason??i.reason??V,verificationGate:i}}export{p as DEFAULT_WORKER_PROVIDER,V as HEAVY_VERIFICATION_TOKEN_REQUIRED,z as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Dr as auditReviewWorkerCredentialScope,Nr as auditWorkerEnv,d as buildWorkerSpawnEnv,fe as classifyHeavyShellCommand,fr as enforceCursorWorkerProvider,pn as gateWorkerShellCommand,c as isClaudeFamilyProvider,_ as isForbiddenWorkerEnvKey,$r as isHarnessExpertReviewWorker,xe as isNoProdCredentialReviewEnvironment,_e as listForbiddenWorkerEnvKeys,ke as listOperatorAllowedWorkerEnvKeys,k as normalizeWorkerProviderName,Ft as preferCursorExecutor,Lt as resolveConfiguredWorkerProvider,A as scrubWorkerEnv,pe as taskAllowsClaudeWorker,me as taskExpressesWorkerProviderPreference};

package/dist/worker-broker/index.js

@@ -1,7 +1,7 @@
-import J from"node:net";import{chmodSync as Y,unlinkSync as X}from"node:fs";var u=1,E="KYNVER_WORKER_BROKER_SOCKET",_=1048576,y=1;function h(o){return`${JSON.stringify(o)}
-`}function R(o){let e;try{e=JSON.parse(o)}catch{return{ok:!1,reason:"malformed_request",error:"request was not valid JSON",id:""}}if(!e||typeof e!="object"||Array.isArray(e))return{ok:!1,reason:"malformed_request",error:"request must be a JSON object",id:""};let r=e,t=typeof r.id=="string"?r.id:"";if(r.v!==1)return{ok:!1,reason:"unsupported_protocol",error:"unsupported protocol version (expected 1)",id:t};if(!t)return{ok:!1,reason:"malformed_request",error:"request id must be a non-empty string",id:""};if(r.op==="list_tools")return{ok:!0,request:{v:1,id:t,op:"list_tools"}};if(r.op==="call_tool"){if(typeof r.name!="string"||!r.name)return{ok:!1,reason:"malformed_request",error:"call_tool requires a tool name",id:t};let n=r.args&&typeof r.args=="object"&&!Array.isArray(r.args)?r.args:{};return{ok:!0,request:{v:1,id:t,op:"call_tool",name:r.name,args:n}}}return{ok:!1,reason:"malformed_request",error:"unknown op",id:t}}var A="kynver",c=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],ce=c.map(o=>`mcp__${A}__${o}`),L={"worker.context":["agent_os_context_envelope"],"worker.memory.read":["agent_os_search_memory"],"worker.skills.read":["agent_os_search_skills","agent_os_get_skill"],"worker.progress.report":["agent_os_progress_note"]};function S(o){if(!o||o.length===0)return[...c];let e=new Set;for(let r of o)for(let t of L[r]??[])e.add(t);return c.filter(r=>e.has(r))}var M="X-Kynver-Job-Token",O={agent_os_context_envelope:{name:"agent_os_context_envelope",description:"Fetch the context envelope for YOUR OWN task: goal/plan/task summaries, relevant memory, and recent session context. Optional memoryQuery focuses the memory portion.",inputSchema:{type:"object",properties:{memoryQuery:{type:"string",description:"Focus the memory portion of the envelope."},mode:{type:"string",description:"Envelope mode hint."}},additionalProperties:!1}},agent_os_search_memory:{name:"agent_os_search_memory",description:"Semantic search over the workspace's long-term memory. Returns a bounded top-N of relevant entries.",inputSchema:{type:"object",properties:{query:{type:"string",description:"What to search for."},k:{type:"integer",minimum:1,maximum:20,description:"How many entries to return."}},required:["query"],additionalProperties:!1}},agent_os_search_skills:{name:"agent_os_search_skills",description:"Search the workspace's skill library (bounded, metadata-only index). Use agent_os_get_skill to fetch one full skill by slug.",inputSchema:{type:"object",properties:{query:{type:"string"},limit:{type:"integer",minimum:1,maximum:25}},additionalProperties:!1}},agent_os_get_skill:{name:"agent_os_get_skill",description:"Fetch ONE full skill (including instructions) by slug.",inputSchema:{type:"object",properties:{slug:{type:"string"}},required:["slug"],additionalProperties:!1}},agent_os_progress_note:{name:"agent_os_progress_note",description:"Append a progress or blocker note to YOUR OWN task's journal. kind: 'progress' (default) or 'blocked'.",inputSchema:{type:"object",properties:{note:{type:"string"},kind:{type:"string",enum:["progress","blocked"]},eventKey:{type:"string"}},required:["note"],additionalProperties:!1}}};function q(o){return`/api/agent-os/by-id/${encodeURIComponent(o.agentOsId)}/worker`}async function l(o,e,r){let t=await o.fetchImpl(`${o.apiBaseUrl}${e}`,{method:r?.method??"GET",headers:{[M]:o.token,...r?{"Content-Type":"application/json"}:{}},...r?{body:JSON.stringify(r.body)}:{}});if(!t.ok)throw new Error(`request failed (${t.status})`);return t.json()}function p(o){return typeof o=="string"&&o.trim()?o.trim():void 0}async function W(o,e,r){let t=q(o);switch(e){case"agent_os_context_envelope":{let n=new URLSearchParams({task:o.taskId}),s=p(r.memoryQuery);s&&n.set("memoryQuery",s);let i=p(r.mode);return i&&n.set("mode",i),l(o,`${t}/context-envelope?${n.toString()}`)}case"agent_os_search_memory":{let n=new URLSearchParams({q:String(r.query??"")});return typeof r.k=="number"&&n.set("k",String(r.k)),l(o,`${t}/memory-search?${n.toString()}`)}case"agent_os_search_skills":{let n=new URLSearchParams,s=p(r.query);s&&n.set("q",s),typeof r.limit=="number"&&n.set("limit",String(r.limit));let i=n.toString();return l(o,`${t}/skills${i?`?${i}`:""}`)}case"agent_os_get_skill":return l(o,`${t}/skills/${encodeURIComponent(String(r.slug??""))}`);case"agent_os_progress_note":return l(o,`${t}/progress-note`,{method:"POST",body:{note:String(r.note??""),...r.kind==="blocked"?{kind:"blocked"}:{},...p(r.eventKey)?{eventKey:p(r.eventKey)}:{}}})}}function k(o){return c.includes(o)}import{createHash as D}from"node:crypto";import{chmodSync as $,mkdirSync as j}from"node:fs";import x from"node:os";import f from"node:path";var U=100,P="\\\\.\\pipe\\";function T(o,e){return D("sha256").update(o).digest("hex").slice(0,e)}function V(o){let e=o.platform??process.platform,r=T(o.agentOsId,12),t=T(o.workerKey,16);if(e==="win32")return{socketPath:`${P}kynver-worker-${r}-${t}`,socketDir:null,isNamedPipe:!0,relocated:!1};let n=o.homeDir??x.homedir(),s=f.join(n,".kynver","brokers",r),i=f.join(s,`${t}.sock`);if(Buffer.byteLength(i,"utf8")<=U)return{socketPath:i,socketDir:s,isNamedPipe:!1,relocated:!1};let d=f.join(o.tmpDir??x.tmpdir(),`kynver-brokers-${r}`);return{socketPath:f.join(d,`${t}.sock`),socketDir:d,isNamedPipe:!1,relocated:!0}}function w(o){o.socketDir&&(j(o.socketDir,{recursive:!0,mode:448}),$(o.socketDir,448))}function F(o){return o.startsWith(P)}var v=class o{server;opts;now;fetchImpl;grantedTools;connections=new Set;sockets=new Set;revoked=!1;closed=!1;constructor(e){if(typeof e.identity?.verify!="function")throw new Error("WorkerBroker requires an explicit identity posture (S11) \u2014 see worker-broker/identity.ts");this.opts=e,this.now=e.now??Date.now,this.fetchImpl=e.fetchImpl??fetch,this.grantedTools=S(e.capabilities),this.server=J.createServer(r=>{this.handleConnection(r)}),this.server.on("error",()=>{})}static async start(e){let r=new o(e);if(w(e.address),await new Promise((t,n)=>{r.server.once("error",n),r.server.listen(e.address.socketPath,()=>{r.server.removeListener("error",n),t()})}),!e.address.isNamedPipe)try{Y(e.address.socketPath,384)}catch{}return r}get identitySummary(){return this.opts.identity.summary}get toolDescriptors(){return this.grantedTools.filter(k).map(e=>O[e])}async revoke(){this.revoked=!0,await this.close()}async close(){if(!this.closed){this.closed=!0;for(let e of this.sockets)e.destroy();if(this.sockets.clear(),this.connections.clear(),await new Promise(e=>this.server.close(()=>e())),!this.opts.address.isNamedPipe)try{X(this.opts.address.socketPath)}catch{}}}refuse(e,r){this.opts.onRefusal?.(e,r)}async handleConnection(e){this.sockets.add(e),e.on("close",()=>{this.sockets.delete(e),this.connections.delete(e)});for(let n of this.connections)(n.destroyed||n.readableEnded)&&this.connections.delete(n);if(this.connections.size>=1){this.refuse("concurrent_connection","a second concurrent connection was attempted while the worker's own connection was open"),this.write(e,{id:"",ok:!1,reason:"concurrent_connection",error:"worker tools are already in use for this task"}),e.end();return}this.connections.add(e);let r=await this.opts.identity.verify({socket:e,workerPid:this.opts.workerPid});if(!r.ok){this.refuse("identity_refused",r.detail),this.write(e,{id:"",ok:!1,reason:"identity_refused",error:"caller could not be identified as this worker"}),e.end();return}let t="";e.setEncoding("utf8"),e.on("data",n=>{if(t+=n,Buffer.byteLength(t,"utf8")>1048576){this.refuse("request_too_large","request exceeded the line cap"),this.write(e,{id:"",ok:!1,reason:"request_too_large",error:"request exceeded the maximum size"}),e.end();return}let s=t.indexOf(`
+import Y from"node:net";import{chmodSync as H,unlinkSync as X}from"node:fs";var u=1,x="KYNVER_WORKER_BROKER_SOCKET",g=1048576,_=1;function y(o){return`${JSON.stringify(o)}
+`}function h(o){let e;try{e=JSON.parse(o)}catch{return{ok:!1,reason:"malformed_request",error:"request was not valid JSON",id:""}}if(!e||typeof e!="object"||Array.isArray(e))return{ok:!1,reason:"malformed_request",error:"request must be a JSON object",id:""};let r=e,t=typeof r.id=="string"?r.id:"";if(r.v!==1)return{ok:!1,reason:"unsupported_protocol",error:"unsupported protocol version (expected 1)",id:t};if(!t)return{ok:!1,reason:"malformed_request",error:"request id must be a non-empty string",id:""};if(r.op==="list_tools")return{ok:!0,request:{v:1,id:t,op:"list_tools"}};if(r.op==="call_tool"){if(typeof r.name!="string"||!r.name)return{ok:!1,reason:"malformed_request",error:"call_tool requires a tool name",id:t};let n=r.args&&typeof r.args=="object"&&!Array.isArray(r.args)?r.args:{};return{ok:!0,request:{v:1,id:t,op:"call_tool",name:r.name,args:n}}}return{ok:!1,reason:"malformed_request",error:"unknown op",id:t}}var A="kynver",l=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],ce=l.map(o=>`mcp__${A}__${o}`),M={"worker.context":["agent_os_context_envelope"],"worker.memory.read":["agent_os_search_memory"],"worker.skills.read":["agent_os_search_skills","agent_os_get_skill"],"worker.progress.report":["agent_os_progress_note"]};function E(o){if(!o||o.length===0)return[...l];let e=new Set;for(let r of o)for(let t of M[r]??[])e.add(t);return l.filter(r=>e.has(r))}var L="X-Kynver-Job-Token",R={agent_os_context_envelope:{name:"agent_os_context_envelope",description:"Fetch the context envelope for YOUR OWN task: goal/plan/task summaries, relevant memory, and recent session context. Optional memoryQuery focuses the memory portion.",inputSchema:{type:"object",properties:{memoryQuery:{type:"string",description:"Focus the memory portion of the envelope."},mode:{type:"string",description:"Envelope mode hint."}},additionalProperties:!1}},agent_os_search_memory:{name:"agent_os_search_memory",description:"Semantic search over the workspace's long-term memory. Returns a bounded top-N of relevant entries.",inputSchema:{type:"object",properties:{query:{type:"string",description:"What to search for."},k:{type:"integer",minimum:1,maximum:20,description:"How many entries to return."}},required:["query"],additionalProperties:!1}},agent_os_search_skills:{name:"agent_os_search_skills",description:"Search the workspace's skill library (bounded, metadata-only index). Use agent_os_get_skill to fetch one full skill by slug.",inputSchema:{type:"object",properties:{query:{type:"string"},limit:{type:"integer",minimum:1,maximum:25}},additionalProperties:!1}},agent_os_get_skill:{name:"agent_os_get_skill",description:"Fetch ONE full skill (including instructions) by slug.",inputSchema:{type:"object",properties:{slug:{type:"string"}},required:["slug"],additionalProperties:!1}},agent_os_progress_note:{name:"agent_os_progress_note",description:"Append a progress or blocker note to YOUR OWN task's journal. kind: 'progress' (default) or 'blocked'.",inputSchema:{type:"object",properties:{note:{type:"string"},kind:{type:"string",enum:["progress","blocked"]},eventKey:{type:"string"}},required:["note"],additionalProperties:!1}}};function D(o){return`/api/agent-os/by-id/${encodeURIComponent(o.agentOsId)}/worker`}async function c(o,e,r){let t=await o.fetchImpl(`${o.apiBaseUrl}${e}`,{method:r?.method??"GET",headers:{[L]:o.token,...r?{"Content-Type":"application/json"}:{}},...r?{body:JSON.stringify(r.body)}:{}});if(!t.ok)throw new Error(`request failed (${t.status})`);return t.json()}function p(o){return typeof o=="string"&&o.trim()?o.trim():void 0}async function O(o,e,r){let t=D(o);switch(e){case"agent_os_context_envelope":{let n=new URLSearchParams({task:o.taskId}),s=p(r.memoryQuery);s&&n.set("memoryQuery",s);let i=p(r.mode);return i&&n.set("mode",i),c(o,`${t}/context-envelope?${n.toString()}`)}case"agent_os_search_memory":{let n=new URLSearchParams({q:String(r.query??"")});return typeof r.k=="number"&&n.set("k",String(r.k)),c(o,`${t}/memory-search?${n.toString()}`)}case"agent_os_search_skills":{let n=new URLSearchParams,s=p(r.query);s&&n.set("q",s),typeof r.limit=="number"&&n.set("limit",String(r.limit));let i=n.toString();return c(o,`${t}/skills${i?`?${i}`:""}`)}case"agent_os_get_skill":return c(o,`${t}/skills/${encodeURIComponent(String(r.slug??""))}`);case"agent_os_progress_note":return c(o,`${t}/progress-note`,{method:"POST",body:{note:String(r.note??""),...r.kind==="blocked"?{kind:"blocked"}:{},...p(r.eventKey)?{eventKey:p(r.eventKey)}:{}}})}}function k(o){return l.includes(o)}import{createHash as q}from"node:crypto";import{chmodSync as $,mkdirSync as U}from"node:fs";import v from"node:os";import J from"node:path";var j=100,P="\\\\.\\pipe\\";function B(o,e){return q("sha256").update(o).digest("hex").slice(0,e)}function V(o){let e=o.platform??process.platform,r=B(o.agentOsId,12),t=B(o.workerKey,16);if(e==="win32")return{socketPath:`${P}kynver-worker-${r}-${t}`,socketDir:null,isNamedPipe:!0,relocated:!1};let n=J.posix,s=o.homeDir??v.homedir(),i=n.join(s,".kynver","brokers",r),d=n.join(i,`${t}.sock`);if(Buffer.byteLength(d,"utf8")<=j)return{socketPath:d,socketDir:i,isNamedPipe:!1,relocated:!1};let T=n.join(o.tmpDir??v.tmpdir(),`kynver-brokers-${r}`);return{socketPath:n.join(T,`${t}.sock`),socketDir:T,isNamedPipe:!1,relocated:!0}}function S(o){o.socketDir&&(U(o.socketDir,{recursive:!0,mode:448}),$(o.socketDir,448))}function F(o){return o.startsWith(P)}var W=class o{server;opts;now;fetchImpl;grantedTools;connections=new Set;sockets=new Set;revoked=!1;closed=!1;constructor(e){if(typeof e.identity?.verify!="function")throw new Error("WorkerBroker requires an explicit identity posture (S11) \u2014 see worker-broker/identity.ts");this.opts=e,this.now=e.now??Date.now,this.fetchImpl=e.fetchImpl??fetch,this.grantedTools=E(e.capabilities),this.server=Y.createServer(r=>{this.handleConnection(r)}),this.server.on("error",()=>{})}static async start(e){let r=new o(e);if(S(e.address),await new Promise((t,n)=>{r.server.once("error",n),r.server.listen(e.address.socketPath,()=>{r.server.removeListener("error",n),t()})}),!e.address.isNamedPipe)try{H(e.address.socketPath,384)}catch{}return r}get identitySummary(){return this.opts.identity.summary}get toolDescriptors(){return this.grantedTools.filter(k).map(e=>R[e])}async revoke(){this.revoked=!0,await this.close()}async close(){if(!this.closed){this.closed=!0;for(let e of this.sockets)e.destroy();if(this.sockets.clear(),this.connections.clear(),await new Promise(e=>this.server.close(()=>e())),!this.opts.address.isNamedPipe)try{X(this.opts.address.socketPath)}catch{}}}refuse(e,r){this.opts.onRefusal?.(e,r)}async handleConnection(e){this.sockets.add(e),e.on("close",()=>{this.sockets.delete(e),this.connections.delete(e)});for(let n of this.connections)(n.destroyed||n.readableEnded)&&this.connections.delete(n);if(this.connections.size>=1){this.refuse("concurrent_connection","a second concurrent connection was attempted while the worker's own connection was open"),this.write(e,{id:"",ok:!1,reason:"concurrent_connection",error:"worker tools are already in use for this task"}),e.end();return}this.connections.add(e);let r=await this.opts.identity.verify({socket:e,workerPid:this.opts.workerPid});if(!r.ok){this.refuse("identity_refused",r.detail),this.write(e,{id:"",ok:!1,reason:"identity_refused",error:"caller could not be identified as this worker"}),e.end();return}let t="";e.setEncoding("utf8"),e.on("data",n=>{if(t+=n,Buffer.byteLength(t,"utf8")>1048576){this.refuse("request_too_large","request exceeded the line cap"),this.write(e,{id:"",ok:!1,reason:"request_too_large",error:"request exceeded the maximum size"}),e.end();return}let s=t.indexOf(`
 `);for(;s>=0;){let i=t.slice(0,s);t=t.slice(s+1),i.trim()&&this.handleLine(e,i),s=t.indexOf(`
-`)}})}write(e,r){if(!e.destroyed)try{e.write(h(r))}catch{}}async handleLine(e,r){let t=R(r);if(!t.ok){this.refuse(t.reason,t.error),this.write(e,{id:t.id,ok:!1,reason:t.reason,error:t.error});return}let{request:n}=t;if(this.revoked||this.closed){this.refuse("revoked","grant revoked"),this.write(e,{id:n.id,ok:!1,reason:"revoked",error:"worker tools are no longer available for this task"});return}if(this.now()>=this.opts.expiresAt){this.refuse("grant_expired","grant expired"),this.write(e,{id:n.id,ok:!1,reason:"grant_expired",error:"worker tools are no longer available for this task"});return}if(n.op==="list_tools"){this.write(e,{id:n.id,ok:!0,tools:this.toolDescriptors});return}if(!k(n.name)){this.refuse("unknown_tool",n.name),this.write(e,{id:n.id,ok:!1,reason:"unknown_tool",error:`unknown tool: ${n.name}`});return}if(!this.grantedTools.includes(n.name)){this.refuse("capability_not_granted",n.name),this.write(e,{id:n.id,ok:!1,reason:"capability_not_granted",error:`tool not granted for this task: ${n.name}`});return}try{let s=await W({apiBaseUrl:this.opts.apiBaseUrl,agentOsId:this.opts.agentOsId,taskId:this.opts.taskId,token:this.opts.token,fetchImpl:this.fetchImpl},n.name,n.args??{});this.write(e,{id:n.id,ok:!0,result:s})}catch(s){let i=s instanceof Error?s.message:"request failed";this.refuse("upstream_error",i),this.write(e,{id:n.id,ok:!1,reason:"upstream_error",error:i})}}};var b={posture:"scoped",summary:"scoped: per-worker endpoint in an owner-only (0700) directory, one connection at a time. Peer identity is not observed \u2014 another process of the same OS user is not excluded.",verify:async()=>({ok:!0})};function H(){return b}import z from"node:net";var Q=6e4,B=class o{socket;pending=new Map;timeoutMs;buffer="";nextId=1;closedReason=null;constructor(e,r){this.socket=e,this.timeoutMs=r,e.setEncoding("utf8"),e.on("data",t=>this.onData(t)),e.on("close",()=>this.failAll("worker tools connection closed")),e.on("error",t=>this.failAll(t.message))}static connect(e,r=Q){return new Promise((t,n)=>{let s=z.createConnection(e),i=d=>{s.destroy(),n(d)};s.once("error",i),s.once("connect",()=>{s.removeListener("error",i),t(new o(s,r))})})}onData(e){this.buffer+=e;let r=this.buffer.indexOf(`
+`)}})}write(e,r){if(!e.destroyed)try{e.write(y(r))}catch{}}async handleLine(e,r){let t=h(r);if(!t.ok){this.refuse(t.reason,t.error),this.write(e,{id:t.id,ok:!1,reason:t.reason,error:t.error});return}let{request:n}=t;if(this.revoked||this.closed){this.refuse("revoked","grant revoked"),this.write(e,{id:n.id,ok:!1,reason:"revoked",error:"worker tools are no longer available for this task"});return}if(this.now()>=this.opts.expiresAt){this.refuse("grant_expired","grant expired"),this.write(e,{id:n.id,ok:!1,reason:"grant_expired",error:"worker tools are no longer available for this task"});return}if(n.op==="list_tools"){this.write(e,{id:n.id,ok:!0,tools:this.toolDescriptors});return}if(!k(n.name)){this.refuse("unknown_tool",n.name),this.write(e,{id:n.id,ok:!1,reason:"unknown_tool",error:`unknown tool: ${n.name}`});return}if(!this.grantedTools.includes(n.name)){this.refuse("capability_not_granted",n.name),this.write(e,{id:n.id,ok:!1,reason:"capability_not_granted",error:`tool not granted for this task: ${n.name}`});return}try{let s=await O({apiBaseUrl:this.opts.apiBaseUrl,agentOsId:this.opts.agentOsId,taskId:this.opts.taskId,token:this.opts.token,fetchImpl:this.fetchImpl},n.name,n.args??{});this.write(e,{id:n.id,ok:!0,result:s})}catch(s){let i=s instanceof Error?s.message:"request failed";this.refuse("upstream_error",i),this.write(e,{id:n.id,ok:!1,reason:"upstream_error",error:i})}}};var b={posture:"scoped",summary:"scoped: per-worker endpoint in an owner-only (0700) directory, one connection at a time. Peer identity is not observed \u2014 another process of the same OS user is not excluded.",verify:async()=>({ok:!0})};function z(){return b}import G from"node:net";var Q=6e4,w=class o{socket;pending=new Map;timeoutMs;buffer="";nextId=1;closedReason=null;constructor(e,r){this.socket=e,this.timeoutMs=r,e.setEncoding("utf8"),e.on("data",t=>this.onData(t)),e.on("close",()=>this.failAll("worker tools connection closed")),e.on("error",t=>this.failAll(t.message))}static connect(e,r=Q){return new Promise((t,n)=>{let s=G.createConnection(e),i=d=>{s.destroy(),n(d)};s.once("error",i),s.once("connect",()=>{s.removeListener("error",i),t(new o(s,r))})})}onData(e){this.buffer+=e;let r=this.buffer.indexOf(`
 `);for(;r>=0;){let t=this.buffer.slice(0,r);this.buffer=this.buffer.slice(r+1),t.trim()&&this.dispatch(t),r=this.buffer.indexOf(`
 `)}}dispatch(e){let r;try{r=JSON.parse(e)}catch{return}if(!r.id){let n="error"in r?r.error:"worker tools unavailable";this.failAll(n);return}let t=this.pending.get(r.id);t&&(this.pending.delete(r.id),clearTimeout(t.timer),t.resolve(r))}failAll(e){this.closedReason??=e;for(let[r,t]of this.pending)this.pending.delete(r),clearTimeout(t.timer),t.reject(new Error(e))}send(e){if(this.closedReason)return Promise.reject(new Error(this.closedReason));let r=String(this.nextId++);return new Promise((t,n)=>{let s=setTimeout(()=>{this.pending.delete(r),n(new Error("worker tools request timed out"))},this.timeoutMs);s.unref?.(),this.pending.set(r,{resolve:t,reject:n,timer:s}),this.socket.write(`${JSON.stringify({v:1,id:r,...e})}
-`,i=>{i&&(this.pending.delete(r),clearTimeout(s),n(i))})})}async listTools(){let e=await this.send({op:"list_tools"});if(!e.ok)throw new Error(e.error);return"tools"in e?e.tools:[]}async callTool(e,r){let t=await this.send({op:"call_tool",name:e,args:r});return t.ok?{ok:!0,result:"result"in t?t.result:null}:{ok:!1,error:t.error}}close(){this.failAll("worker tools client closed"),this.socket.destroy()}};import ee from"node:path";import{existsSync as Te,mkdirSync as Pe,readFileSync as G,readdirSync as be,renameSync as Ie,rmSync as Ne,statSync as Ke,writeFileSync as Ce}from"node:fs";function Z(o){console.error(o),process.exit(1)}function I(o,e){try{return JSON.parse(G(o,"utf8"))}catch(r){if(arguments.length>1)return e;Z(`failed to read ${o}: ${r.message}`)}}function N(o){if(!o)return!1;try{return process.kill(o,0),!0}catch{return!1}}var a=new Map,m=new Map;function g(o){clearInterval(m.get(o)),m.delete(o)}function re(o,e){if(g(o),!a.has(o))return;let r=setInterval(()=>{(I(ee.join(o,"worker.json"),null)?.completionReportedAt||!N(e))&&C(o)},1e3);r.unref(),m.set(o,r)}function oe(o,e){g(o);let r=a.get(o);r&&r.close(),a.set(o,e)}function te(o){return a.get(o)}async function K(o){g(o);let e=a.get(o);return e?(a.delete(o),await e.close(),!0):!1}function C(o){K(o).catch(()=>{})}async function ne(){for(let e of m.keys())g(e);let o=[...a.values()];a.clear(),await Promise.all(o.map(e=>e.close().catch(()=>{})))}function se(){return a.size}export{b as SCOPED_WORKER_BROKER_IDENTITY,y as WORKER_BROKER_MAX_CONCURRENT_CONNECTIONS,_ as WORKER_BROKER_MAX_LINE_BYTES,u as WORKER_BROKER_PROTOCOL_VERSION,E as WORKER_BROKER_SOCKET_ENV,O as WORKER_TOOL_DESCRIPTORS,v as WorkerBroker,B as WorkerBrokerClient,re as bindWorkerBrokerLifetime,ne as closeAllWorkerBrokers,K as closeWorkerBroker,C as closeWorkerBrokerSync,h as encodeBrokerFrame,w as ensureWorkerBrokerSocketDir,W as executeWorkerTool,te as getWorkerBroker,F as isNamedPipePath,k as isWorkerToolName,R as parseBrokerRequest,oe as registerWorkerBroker,V as resolveWorkerBrokerAddress,H as resolveWorkerBrokerIdentity,se as workerBrokerCount};
+`,i=>{i&&(this.pending.delete(r),clearTimeout(s),n(i))})})}async listTools(){let e=await this.send({op:"list_tools"});if(!e.ok)throw new Error(e.error);return"tools"in e?e.tools:[]}async callTool(e,r){let t=await this.send({op:"call_tool",name:e,args:r});return t.ok?{ok:!0,result:"result"in t?t.result:null}:{ok:!1,error:t.error}}close(){this.failAll("worker tools client closed"),this.socket.destroy()}};import re from"node:path";import{existsSync as Ke,mkdirSync as Ce,readFileSync as Z,readdirSync as Ae,renameSync as Me,rmSync as Le,statSync as De,writeFileSync as qe}from"node:fs";function ee(o){console.error(o),process.exit(1)}function N(o,e){try{return JSON.parse(Z(o,"utf8"))}catch(r){if(arguments.length>1)return e;ee(`failed to read ${o}: ${r.message}`)}}function I(o){if(!o)return!1;try{return process.kill(o,0),!0}catch{return!1}}var a=new Map,m=new Map;function f(o){clearInterval(m.get(o)),m.delete(o)}function oe(o,e){if(f(o),!a.has(o))return;let r=setInterval(()=>{(N(re.join(o,"worker.json"),null)?.completionReportedAt||!I(e))&&C(o)},1e3);r.unref(),m.set(o,r)}function te(o,e){f(o);let r=a.get(o);r&&r.close(),a.set(o,e)}function ne(o){return a.get(o)}async function K(o){f(o);let e=a.get(o);return e?(a.delete(o),await e.close(),!0):!1}function C(o){K(o).catch(()=>{})}async function se(){for(let e of m.keys())f(e);let o=[...a.values()];a.clear(),await Promise.all(o.map(e=>e.close().catch(()=>{})))}function ie(){return a.size}export{b as SCOPED_WORKER_BROKER_IDENTITY,_ as WORKER_BROKER_MAX_CONCURRENT_CONNECTIONS,g as WORKER_BROKER_MAX_LINE_BYTES,u as WORKER_BROKER_PROTOCOL_VERSION,x as WORKER_BROKER_SOCKET_ENV,R as WORKER_TOOL_DESCRIPTORS,W as WorkerBroker,w as WorkerBrokerClient,oe as bindWorkerBrokerLifetime,se as closeAllWorkerBrokers,K as closeWorkerBroker,C as closeWorkerBrokerSync,y as encodeBrokerFrame,S as ensureWorkerBrokerSocketDir,O as executeWorkerTool,ne as getWorkerBroker,F as isNamedPipePath,k as isWorkerToolName,h as parseBrokerRequest,te as registerWorkerBroker,V as resolveWorkerBrokerAddress,z as resolveWorkerBrokerIdentity,ie as workerBrokerCount};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.2.77",
+  "version": "0.2.88",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",
@@ -14,6 +14,11 @@
       "import": "./dist/index.js",
       "default": "./dist/index.js"
     },
+    "./desktop-entry": {
+      "types": "./dist/desktop-entry.d.ts",
+      "import": "./dist/desktop-entry.js",
+      "default": "./dist/desktop-entry.js"
+    },
     "./local-run-store": {
       "types": "./dist/local-run-store/index.d.ts",
       "import": "./dist/local-run-store/index.js",
@@ -140,6 +145,11 @@
       "import": "./dist/server/wsl-crash-dumps.js",
       "default": "./dist/server/wsl-crash-dumps.js"
     },
+    "./dispatch-claim-authorization": {
+      "types": "./dist/dispatch-claim-authorization.d.ts",
+      "import": "./dist/dispatch-claim-authorization.js",
+      "default": "./dist/dispatch-claim-authorization.js"
+    },
     "./chat/command-auth-proof": {
       "types": "./dist/chat/command-auth-proof.d.ts",
       "import": "./dist/chat/command-auth-proof.js",
@@ -165,7 +175,7 @@
     "!dist/**/*.d.ts.map"
   ],
   "scripts": {
-    "build": "esbuild src/provider-terminal-failure.ts src/cli.ts src/index.ts src/node-runtime-policy.ts src/local-run-store/index.ts src/worker-broker/index.ts src/worker-persona-catalog.ts src/instruction-bundle/contract.ts src/chat/command-auth-proof.ts src/server/monitor.ts src/server/landing.ts src/server/worker-policy.ts src/server/orchestration.ts src/server/adapter-contract.ts src/server/context-budget-receipt.ts src/server/context-budget.ts src/server/prompt.ts src/server/node-runtime-policy.ts src/server/model-routing.ts src/server/dispatch-routing.ts src/server/db-credentials.ts src/server/heavy-verification.ts src/server/memory-cost.ts src/server/pr-evidence.ts src/server/default-repo.ts src/server/cleanup.ts src/server/repo-search.ts src/server/harness-notice.ts src/server/memory-cost-enforce.ts src/server/wsl-crash-dumps.ts --bundle --platform=node --format=esm --packages=external --outbase=src --outdir=dist --minify && tsc -p tsconfig.json --emitDeclarationOnly && node scripts/chmod-cli-bin.mjs",
+    "build": "esbuild src/provider-terminal-failure.ts src/cli.ts src/index.ts src/node-runtime-policy.ts src/local-run-store/index.ts src/worker-broker/index.ts src/worker-persona-catalog.ts src/instruction-bundle/contract.ts src/chat/command-auth-proof.ts src/dispatch-claim-authorization.ts src/desktop-entry.ts src/server/monitor.ts src/server/landing.ts src/server/worker-policy.ts src/server/orchestration.ts src/server/adapter-contract.ts src/server/context-budget-receipt.ts src/server/context-budget.ts src/server/prompt.ts src/server/node-runtime-policy.ts src/server/model-routing.ts src/server/dispatch-routing.ts src/server/db-credentials.ts src/server/heavy-verification.ts src/server/memory-cost.ts src/server/pr-evidence.ts src/server/default-repo.ts src/server/cleanup.ts src/server/repo-search.ts src/server/harness-notice.ts src/server/memory-cost-enforce.ts src/server/wsl-crash-dumps.ts --bundle --platform=node --format=esm --packages=external --outbase=src --outdir=dist --minify && tsc -p tsconfig.json --emitDeclarationOnly && node scripts/chmod-cli-bin.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "vitest run --config vitest.config.ts",
     "prepublishOnly": "node ../../scripts/npm-publish-guard.mjs && npm run build",
@@ -192,6 +202,9 @@
     "url": "https://github.com/Totalsolutionsync/kynver-feedback/issues"
   },
   "homepage": "https://www.kynver.com/help/runtime-setup",
+  "dependencies": {
+    "@modelcontextprotocol/sdk": "^1.29.0"
+  },
   "devDependencies": {
     "@types/node": "^24.0.0",
     "esbuild": "^0.28.1",