@kynver-app/runtime 0.2.8 → 0.2.13

package/dist/server/memory-cost-enforce.js

@@ -1,2 +1,2 @@
-import{readFile as ge}from"node:fs/promises";import{homedir as de}from"node:os";import l from"node:path";import{existsSync as T,readFileSync as se}from"node:fs";import d from"node:path";import{existsSync as P,readFileSync as I}from"node:fs";import{homedir as Z}from"node:os";import a from"node:path";import{fileURLToPath as q}from"node:url";import{spawnSync as X}from"node:child_process";function M(e){return process.platform!=="win32"?e:{windowsHide:!0,...e}}var z=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY"],be=new Set(z);function b(e,r){try{let t=X("git",r,M({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}import{homedir as x}from"node:os";import w from"node:path";function Q(e){return e==="~"?x():e.startsWith("~/")||e.startsWith("~\\")?w.join(x(),e.slice(2)):e}function N(e){return w.resolve(Q(e))}var ee=["Kynver","repos/Kynver","repos/kynver-source-main","code/Kynver","projects/Kynver"];function re(e){let r=a.join(e,"package.json");if(!P(r))return null;try{let t=JSON.parse(I(r,"utf8"));return typeof t.name=="string"?t.name.trim():null}catch{return null}}function te(e){return re(e)==="kynver"}function O(e){let r=a.resolve(e);if(!P(r))return null;let t=b(r,["rev-parse","--show-toplevel"]);if(t.status!==0)return null;let n=t.stdout.trim();return n.length?a.resolve(n):null}function ne(e=import.meta.url){let r=a.dirname(q(e));for(let t=0;t<8;t+=1){let n=a.join(r,"package.json");if(P(n))try{if(JSON.parse(I(n,"utf8")).name==="@kynver-app/runtime")return r}catch{}let o=a.dirname(r);if(o===r)break;r=o}return null}function v(e,r,t,n){if(!t)return;let o=a.resolve(t);e.has(o)||te(o)&&(e.add(o),r.push({repo:o,source:n}))}function oe(e){let r=e?.cwd??process.cwd(),t=new Set,n=[];v(t,n,O(r),"cwd_git");let o=ne(e?.runtimeModuleUrl??import.meta.url);o&&v(t,n,O(o),"runtime_checkout");let i=Z();for(let s of ee)v(t,n,N(a.join(i,s)),"well_known_path");return n}function V(e){return oe(e)[0]??null}var D={"@kynver-app/runtime":"0.1.83","@kynver-app/openclaw-agent-os":"0.1.43","@kynver-app/mcp-agent-os":"0.3.34"},$=Object.keys(D),E={"@kynver-app/runtime":"Kynver runtime","@kynver-app/openclaw-agent-os":"OpenClaw AgentOS plugin","@kynver-app/mcp-agent-os":"AgentOS MCP server"},ie={"@kynver-app/runtime":"packages/kynver-runtime/package.json","@kynver-app/openclaw-agent-os":"packages/kynver-openclaw-agent-os/package.json","@kynver-app/mcp-agent-os":"packages/kynver-mcp-agent-os/package.json"};function G(e){let r=e.trim().split("-")[0]?.split("+")[0];if(!r)return null;let t=r.split(".");if(t.length<1||t.length>3)return null;let n=t.map(o=>Number.parseInt(o,10));if(n.some(o=>!Number.isFinite(o)||o<0))return null;for(;n.length<3;)n.push(0);return[n[0],n[1],n[2]]}function f(e,r){let t=G(e),n=G(r);if(!t||!n)return 0;for(let o=0;o<3;o+=1){if(t[o]>n[o])return 1;if(t[o]<n[o])return-1}return 0}function K(e,r){return f(e,r)>=0}function ae(e){let r=null;for(let t of e)(!r||f(t,r)>0)&&(r=t);return r}function ce(e){try{let r=JSON.parse(se(e,"utf8"));return typeof r.version=="string"&&r.version.trim()?r.version.trim():null}catch{return null}}function ue(e,r){let t=[r,process.env.KYNVER_REPO,e].filter(o=>!!o?.trim());for(let o of t){let i=d.resolve(o);if(T(d.join(i,"packages/kynver-runtime/package.json"))&&T(d.join(i,"package.json")))return i}return V({cwd:e})?.repo??null}function j(e={}){let r=e.cwd??process.cwd(),t=ue(r,e.repoRoot);if(!t)return{};let n={};for(let o of $){let i=d.join(t,ie[o]),s=ce(i);s&&(n[o]={version:s,source:"repo",path:i})}return n}function le(e){return e==="@kynver-app/runtime"?["npm run kynver:build","npm run kynver"]:[`npm run build -w ${e}`]}function pe(e){let{packageName:r,minimumVersion:t,effectiveVersion:n,effectiveSource:o,repoVersion:i}=e,s=[];return i&&K(i,t)?(s.push(`Use the monorepo checkout (${i}) instead of a stale npm install: ${le(r).join("; ")}.`),s.push("Do not publish npm packages or wait on an operator release."),s):(n?s.push(`Upgrade ${r} from ${n} to >= ${t} (npm install -g ${r}@latest or align OpenClaw npm prefix).`):s.push(`Install ${r} >= ${t} before running memory-heavy AgentOS paths.`),r==="@kynver-app/runtime"&&s.push("Repo-source alternative: npm run kynver:build && npm run kynver"),o==="installed"&&i&&s.push(`Repo checkout reports ${i}; rebuild/link repo source if you develop from the monorepo.`),s)}function me(e){if(e.length===0)return{version:null,source:"unknown"};let r=ae(e.map(n=>n.version));if(!r)return{version:null,source:"unknown"};let t=e.find(n=>n.version===r)??e[0];return{version:t.version,source:t.source}}function C(e={}){let r=(s,c)=>s?typeof s=="string"?{version:s,source:c}:s:null,t=$.map(s=>{let c=D[s],m=[],_=r(e.installed?.[s],"installed"),y=r(e.repo?.[s],"repo"),A=r(e.self?.[s],"self");_&&m.push(_),y&&m.push(y),A&&m.push(A);let{version:u,source:g}=me(m),B=y?.version??null,k=u?K(u,c):!1,J=k?[]:pe({packageName:s,minimumVersion:c,effectiveVersion:u,effectiveSource:g,repoVersion:B}),W=k?`${E[s]} ${u} meets memory-cost minimum ${c} (${g}).`:`${E[s]} is below memory-cost minimum ${c}`+(u?` (effective ${u} via ${g})`:" (no version detected)")+".";return{packageName:s,displayName:E[s],minimumVersion:c,effectiveVersion:u,effectiveSource:g,ok:k,summary:W,remediation:J}}),n=t.filter(s=>!s.ok),o=n.length===0,i=o?"All managed AgentOS packages meet memory-cost minimum versions.":`Memory-cost package guard blocked ${n.length} stale package(s): ${n.map(s=>`${s.packageName} < ${s.minimumVersion}`).join("; ")}.`;return{ok:o,summary:i,packages:t}}var R=class extends Error{result;constructor(r){let t=[r.summary,...r.packages.filter(n=>!n.ok).flatMap(n=>[`- ${n.summary}`,...n.remediation.map(o=>`  \u2192 ${o}`)])];super(t.join(`
-`)),this.name="MemoryCostPackageVersionGuardError",this.result=r}};function Y(e={}){let r=C(e);if(!r.ok)throw new R(r);return r}var fe=["@kynver-app/runtime","@kynver-app/openclaw-agent-os","@kynver-app/mcp-agent-os"];function p(e){let r=e?.trim();return r||null}function ye(e){return[...new Set(e.filter(r=>!!r))]}function ke(){let e=de(),r=p(process.env.KYNVER_OPENCLAW_NPM_ROOT)??p(process.env.OPENCLAW_NPM_ROOT)??l.join(e,".openclaw","npm"),t=p(process.env.KYNVER_NPM_GLOBAL_ROOT)??p(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT)??(p(process.env.NPM_CONFIG_PREFIX)?l.join(p(process.env.NPM_CONFIG_PREFIX),"lib","node_modules"):l.join(e,".npm-global","lib","node_modules"));return ye([l.join(r,"lib","node_modules"),l.join(r,"node_modules"),t.endsWith("node_modules")?t:l.join(t,"lib","node_modules")])}async function ve(e){try{let r=JSON.parse(await ge(e,"utf8"));return typeof r.version=="string"&&r.version.trim()?r.version.trim():null}catch{return null}}function Pe(e){let r=ke(),t=new Set,n=[];for(let o of r){let i=l.join(o,e,"package.json");t.has(i)||(t.add(i),n.push(i))}return n}async function L(e=new Date().toISOString()){let r={};for(let t of fe){let n=null;for(let o of Pe(t)){let i=await ve(o);i&&(!n||f(i,n.version)>0)&&(n={version:i,path:o})}n&&(r[t]={version:n.version,observedAt:e,path:n.path})}return r}import{existsSync as Ee,readFileSync as Re}from"node:fs";import{dirname as S,join as U}from"node:path";import{fileURLToPath as F}from"node:url";function Ce(e){let r=S(F(e));for(let t=0;t<6;t+=1){if(Ee(U(r,"package.json")))return r;let n=S(r);if(n===r)break;r=n}throw new Error(`package.json not found above ${S(F(e))}`)}function Se(e=import.meta.url){let r=U(Ce(e),"package.json"),t=JSON.parse(Re(r,"utf8"));if(typeof t.version!="string"||!t.version.trim())throw new Error(`Missing package.json version at ${r}`);return t.version}var H=Se();function he(e){let r={};for(let[t,n]of Object.entries(e))n?.version&&(r[t]={version:n.version,source:"installed",path:n.path});return r}async function h(e={}){let[r,t]=await Promise.all([L(),Promise.resolve(j({cwd:e.cwd,repoRoot:e.repoRoot}))]),n={},o=e.selfPackageName==="@kynver-app/runtime"&&e.selfVersion?e.selfVersion:H;return n["@kynver-app/runtime"]={version:o,source:"self"},e.selfPackageName&&e.selfVersion&&e.selfPackageName!=="@kynver-app/runtime"&&(n[e.selfPackageName]={version:e.selfVersion,source:"self"}),{installed:he(r),repo:t,self:n}}async function _e(e={}){let r=await h(e);return C(r)}async function Ae(e={}){let r=await h(e);return Y(r)}export{h as buildMemoryCostPackageGuardInput,Ae as enforceMemoryCostPackageGuardAtStartup,_e as evaluateMemoryCostPackageGuardAtStartup};
+import{readFile as ge}from"node:fs/promises";import{homedir as fe}from"node:os";import l from"node:path";import{existsSync as V,readFileSync as ie}from"node:fs";import g from"node:path";import{existsSync as v,readFileSync as I}from"node:fs";import{homedir as q}from"node:os";import a from"node:path";import{fileURLToPath as ee}from"node:url";import{spawnSync as Q}from"node:child_process";function M(e){return process.platform!=="win32"?e:{windowsHide:!0,...e}}var z=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Ne=new Set(z);var X=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN"],we=new Set(X);function O(e,r){try{let t=Q("git",r,M({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||"",stderr:t.stderr||"",error:t.error?t.error.message:null}}catch(t){return{status:null,stdout:"",stderr:"",error:t.message}}}import{homedir as N}from"node:os";import w from"node:path";function Z(e){return e==="~"?N():e.startsWith("~/")||e.startsWith("~\\")?w.join(N(),e.slice(2)):e}function b(e){return w.resolve(Z(e))}var re=["Kynver","repos/Kynver","repos/kynver-source-main","code/Kynver","projects/Kynver"];function te(e){let r=a.join(e,"package.json");if(!v(r))return null;try{let t=JSON.parse(I(r,"utf8"));return typeof t.name=="string"?t.name.trim():null}catch{return null}}function ne(e){return te(e)==="kynver"}function x(e){let r=a.resolve(e);if(!v(r))return null;let t=O(r,["rev-parse","--show-toplevel"]);if(t.status!==0)return null;let n=t.stdout.trim();return n.length?a.resolve(n):null}function oe(e=import.meta.url){let r=a.dirname(ee(e));for(let t=0;t<8;t+=1){let n=a.join(r,"package.json");if(v(n))try{if(JSON.parse(I(n,"utf8")).name==="@kynver-app/runtime")return r}catch{}let o=a.dirname(r);if(o===r)break;r=o}return null}function k(e,r,t,n){if(!t)return;let o=a.resolve(t);e.has(o)||ne(o)&&(e.add(o),r.push({repo:o,source:n}))}function se(e){let r=e?.cwd??process.cwd(),t=new Set,n=[];k(t,n,x(r),"cwd_git");let o=oe(e?.runtimeModuleUrl??import.meta.url);o&&k(t,n,x(o),"runtime_checkout");let i=q();for(let s of re)k(t,n,b(a.join(i,s)),"well_known_path");return n}function T(e){return se(e)[0]??null}var G={"@kynver-app/runtime":"0.1.83","@kynver-app/openclaw-agent-os":"0.1.43","@kynver-app/mcp-agent-os":"0.3.34"},D=Object.keys(G),P={"@kynver-app/runtime":"Kynver runtime","@kynver-app/openclaw-agent-os":"OpenClaw AgentOS plugin","@kynver-app/mcp-agent-os":"AgentOS MCP server"},ae={"@kynver-app/runtime":"packages/kynver-runtime/package.json","@kynver-app/openclaw-agent-os":"packages/kynver-openclaw-agent-os/package.json","@kynver-app/mcp-agent-os":"packages/kynver-mcp-agent-os/package.json"};function K(e){let r=e.trim().split("-")[0]?.split("+")[0];if(!r)return null;let t=r.split(".");if(t.length<1||t.length>3)return null;let n=t.map(o=>Number.parseInt(o,10));if(n.some(o=>!Number.isFinite(o)||o<0))return null;for(;n.length<3;)n.push(0);return[n[0],n[1],n[2]]}function f(e,r){let t=K(e),n=K(r);if(!t||!n)return 0;for(let o=0;o<3;o+=1){if(t[o]>n[o])return 1;if(t[o]<n[o])return-1}return 0}function $(e,r){return f(e,r)>=0}function ce(e){let r=null;for(let t of e)(!r||f(t,r)>0)&&(r=t);return r}function ue(e){try{let r=JSON.parse(ie(e,"utf8"));return typeof r.version=="string"&&r.version.trim()?r.version.trim():null}catch{return null}}function le(e,r){let t=[r,process.env.KYNVER_REPO,e].filter(o=>!!o?.trim());for(let o of t){let i=g.resolve(o);if(V(g.join(i,"packages/kynver-runtime/package.json"))&&V(g.join(i,"package.json")))return i}return T({cwd:e})?.repo??null}function Y(e={}){let r=e.cwd??process.cwd(),t=le(r,e.repoRoot);if(!t)return{};let n={};for(let o of D){let i=g.join(t,ae[o]),s=ue(i);s&&(n[o]={version:s,source:"repo",path:i})}return n}function pe(e){return e==="@kynver-app/runtime"?["npm run kynver:build","npm run kynver"]:[`npm run build -w ${e}`]}function me(e){let{packageName:r,minimumVersion:t,effectiveVersion:n,effectiveSource:o,repoVersion:i}=e,s=[];return i&&$(i,t)?(s.push(`Use the monorepo checkout (${i}) instead of a stale npm install: ${pe(r).join("; ")}.`),s.push("Do not publish npm packages or wait on an operator release."),s):(n?s.push(`Upgrade ${r} from ${n} to >= ${t} (npm install -g ${r}@latest or align OpenClaw npm prefix).`):s.push(`Install ${r} >= ${t} before running memory-heavy AgentOS paths.`),r==="@kynver-app/runtime"&&s.push("Repo-source alternative: npm run kynver:build && npm run kynver"),o==="installed"&&i&&s.push(`Repo checkout reports ${i}; rebuild/link repo source if you develop from the monorepo.`),s)}function de(e){if(e.length===0)return{version:null,source:"unknown"};let r=ce(e.map(n=>n.version));if(!r)return{version:null,source:"unknown"};let t=e.find(n=>n.version===r)??e[0];return{version:t.version,source:t.source}}function R(e={}){let r=(s,c)=>s?typeof s=="string"?{version:s,source:c}:s:null,t=D.map(s=>{let c=G[s],m=[],A=r(e.installed?.[s],"installed"),y=r(e.repo?.[s],"repo"),h=r(e.self?.[s],"self");A&&m.push(A),y&&m.push(y),h&&m.push(h);let{version:u,source:d}=de(m),F=y?.version??null,E=u?$(u,c):!1,B=E?[]:me({packageName:s,minimumVersion:c,effectiveVersion:u,effectiveSource:d,repoVersion:F}),J=E?`${P[s]} ${u} meets memory-cost minimum ${c} (${d}).`:`${P[s]} is below memory-cost minimum ${c}`+(u?` (effective ${u} via ${d})`:" (no version detected)")+".";return{packageName:s,displayName:P[s],minimumVersion:c,effectiveVersion:u,effectiveSource:d,ok:E,summary:J,remediation:B}}),n=t.filter(s=>!s.ok),o=n.length===0,i=o?"All managed AgentOS packages meet memory-cost minimum versions.":`Memory-cost package guard blocked ${n.length} stale package(s): ${n.map(s=>`${s.packageName} < ${s.minimumVersion}`).join("; ")}.`;return{ok:o,summary:i,packages:t}}var _=class extends Error{result;constructor(r){let t=[r.summary,...r.packages.filter(n=>!n.ok).flatMap(n=>[`- ${n.summary}`,...n.remediation.map(o=>`  \u2192 ${o}`)])];super(t.join(`
+`)),this.name="MemoryCostPackageVersionGuardError",this.result=r}};function L(e={}){let r=R(e);if(!r.ok)throw new _(r);return r}var ye=["@kynver-app/runtime","@kynver-app/openclaw-agent-os","@kynver-app/mcp-agent-os"];function p(e){let r=e?.trim();return r||null}function Ee(e){return[...new Set(e.filter(r=>!!r))]}function ke(){let e=fe(),r=p(process.env.KYNVER_OPENCLAW_NPM_ROOT)??p(process.env.OPENCLAW_NPM_ROOT)??l.join(e,".openclaw","npm"),t=p(process.env.KYNVER_NPM_GLOBAL_ROOT)??p(process.env.KYNVER_NPM_GLOBAL_MODULES_ROOT)??(p(process.env.NPM_CONFIG_PREFIX)?l.join(p(process.env.NPM_CONFIG_PREFIX),"lib","node_modules"):l.join(e,".npm-global","lib","node_modules"));return Ee([l.join(r,"lib","node_modules"),l.join(r,"node_modules"),t.endsWith("node_modules")?t:l.join(t,"lib","node_modules")])}async function ve(e){try{let r=JSON.parse(await ge(e,"utf8"));return typeof r.version=="string"&&r.version.trim()?r.version.trim():null}catch{return null}}function Pe(e){let r=ke(),t=new Set,n=[];for(let o of r){let i=l.join(o,e,"package.json");t.has(i)||(t.add(i),n.push(i))}return n}async function j(e=new Date().toISOString()){let r={};for(let t of ye){let n=null;for(let o of Pe(t)){let i=await ve(o);i&&(!n||f(i,n.version)>0)&&(n={version:i,path:o})}n&&(r[t]={version:n.version,observedAt:e,path:n.path})}return r}import{existsSync as _e,readFileSync as Re}from"node:fs";import{dirname as S,join as W}from"node:path";import{fileURLToPath as U}from"node:url";function Se(e){let r=S(U(e));for(let t=0;t<6;t+=1){if(_e(W(r,"package.json")))return r;let n=S(r);if(n===r)break;r=n}throw new Error(`package.json not found above ${S(U(e))}`)}function Ce(e=import.meta.url){let r=W(Se(e),"package.json"),t=JSON.parse(Re(r,"utf8"));if(typeof t.version!="string"||!t.version.trim())throw new Error(`Missing package.json version at ${r}`);return t.version}var H=Ce();function Ae(e){let r={};for(let[t,n]of Object.entries(e))n?.version&&(r[t]={version:n.version,source:"installed",path:n.path});return r}async function C(e={}){let[r,t]=await Promise.all([j(),Promise.resolve(Y({cwd:e.cwd,repoRoot:e.repoRoot}))]),n={},o=e.selfPackageName==="@kynver-app/runtime"&&e.selfVersion?e.selfVersion:H;return n["@kynver-app/runtime"]={version:o,source:"self"},e.selfPackageName&&e.selfVersion&&e.selfPackageName!=="@kynver-app/runtime"&&(n[e.selfPackageName]={version:e.selfVersion,source:"self"}),{installed:Ae(r),repo:t,self:n}}async function he(e={}){let r=await C(e);return R(r)}async function Me(e={}){let r=await C(e);return L(r)}export{C as buildMemoryCostPackageGuardInput,Me as enforceMemoryCostPackageGuardAtStartup,he as evaluateMemoryCostPackageGuardAtStartup};

package/dist/server/memory-cost.js

@@ -1,2 +1,2 @@
-var P=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY"],I=new Set(P);var f={"@kynver-app/runtime":"0.1.83","@kynver-app/openclaw-agent-os":"0.1.43","@kynver-app/mcp-agent-os":"0.3.34"},_=Object.keys(f),g={"@kynver-app/runtime":"Kynver runtime","@kynver-app/openclaw-agent-os":"OpenClaw AgentOS plugin","@kynver-app/mcp-agent-os":"AgentOS MCP server"};function E(n){let e=n.trim().split("-")[0]?.split("+")[0];if(!e)return null;let o=e.split(".");if(o.length<1||o.length>3)return null;let t=o.map(s=>Number.parseInt(s,10));if(t.some(s=>!Number.isFinite(s)||s<0))return null;for(;t.length<3;)t.push(0);return[t[0],t[1],t[2]]}function y(n,e){let o=E(n),t=E(e);if(!o||!t)return 0;for(let s=0;s<3;s+=1){if(o[s]>t[s])return 1;if(o[s]<t[s])return-1}return 0}function S(n,e){return y(n,e)>=0}function M(n){let e=null;for(let o of n)(!e||y(o,e)>0)&&(e=o);return e}function b(n){return n==="@kynver-app/runtime"?["npm run kynver:build","npm run kynver"]:[`npm run build -w ${n}`]}function x(n){let{packageName:e,minimumVersion:o,effectiveVersion:t,effectiveSource:s,repoVersion:i}=n,r=[];return i&&S(i,o)?(r.push(`Use the monorepo checkout (${i}) instead of a stale npm install: ${b(e).join("; ")}.`),r.push("Do not publish npm packages or wait on an operator release."),r):(t?r.push(`Upgrade ${e} from ${t} to >= ${o} (npm install -g ${e}@latest or align OpenClaw npm prefix).`):r.push(`Install ${e} >= ${o} before running memory-heavy AgentOS paths.`),e==="@kynver-app/runtime"&&r.push("Repo-source alternative: npm run kynver:build && npm run kynver"),s==="installed"&&i&&r.push(`Repo checkout reports ${i}; rebuild/link repo source if you develop from the monorepo.`),r)}function O(n){if(n.length===0)return{version:null,source:"unknown"};let e=M(n.map(t=>t.version));if(!e)return{version:null,source:"unknown"};let o=n.find(t=>t.version===e)??n[0];return{version:o.version,source:o.source}}function R(n={}){let e=(r,a)=>r?typeof r=="string"?{version:r,source:a}:r:null,o=_.map(r=>{let a=f[r],c=[],k=e(n.installed?.[r],"installed"),m=e(n.repo?.[r],"repo"),v=e(n.self?.[r],"self");k&&c.push(k),m&&c.push(m),v&&c.push(v);let{version:u,source:l}=O(c),h=m?.version??null,d=u?S(u,a):!1,C=d?[]:x({packageName:r,minimumVersion:a,effectiveVersion:u,effectiveSource:l,repoVersion:h}),A=d?`${g[r]} ${u} meets memory-cost minimum ${a} (${l}).`:`${g[r]} is below memory-cost minimum ${a}`+(u?` (effective ${u} via ${l})`:" (no version detected)")+".";return{packageName:r,displayName:g[r],minimumVersion:a,effectiveVersion:u,effectiveSource:l,ok:d,summary:A,remediation:C}}),t=o.filter(r=>!r.ok),s=t.length===0,i=s?"All managed AgentOS packages meet memory-cost minimum versions.":`Memory-cost package guard blocked ${t.length} stale package(s): ${t.map(r=>`${r.packageName} < ${r.minimumVersion}`).join("; ")}.`;return{ok:s,summary:i,packages:o}}var p=class extends Error{result;constructor(e){let o=[e.summary,...e.packages.filter(t=>!t.ok).flatMap(t=>[`- ${t.summary}`,...t.remediation.map(s=>`  \u2192 ${s}`)])];super(o.join(`
-`)),this.name="MemoryCostPackageVersionGuardError",this.result=e}};function w(n={}){let e=R(n);if(!e.ok)throw new p(e);return e}export{f as MEMORY_COST_PACKAGE_MIN_VERSIONS,p as MemoryCostPackageVersionGuardError,w as assertMemoryCostPackageVersionGuard,y as compareSemver,R as evaluateMemoryCostPackageVersionGuard};
+var C=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],K=new Set(C);var P=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN"],I=new Set(P);var f={"@kynver-app/runtime":"0.1.83","@kynver-app/openclaw-agent-os":"0.1.43","@kynver-app/mcp-agent-os":"0.3.34"},O=Object.keys(f),g={"@kynver-app/runtime":"Kynver runtime","@kynver-app/openclaw-agent-os":"OpenClaw AgentOS plugin","@kynver-app/mcp-agent-os":"AgentOS MCP server"};function _(n){let e=n.trim().split("-")[0]?.split("+")[0];if(!e)return null;let o=e.split(".");if(o.length<1||o.length>3)return null;let t=o.map(s=>Number.parseInt(s,10));if(t.some(s=>!Number.isFinite(s)||s<0))return null;for(;t.length<3;)t.push(0);return[t[0],t[1],t[2]]}function E(n,e){let o=_(n),t=_(e);if(!o||!t)return 0;for(let s=0;s<3;s+=1){if(o[s]>t[s])return 1;if(o[s]<t[s])return-1}return 0}function R(n,e){return E(n,e)>=0}function M(n){let e=null;for(let o of n)(!e||E(o,e)>0)&&(e=o);return e}function N(n){return n==="@kynver-app/runtime"?["npm run kynver:build","npm run kynver"]:[`npm run build -w ${n}`]}function x(n){let{packageName:e,minimumVersion:o,effectiveVersion:t,effectiveSource:s,repoVersion:i}=n,r=[];return i&&R(i,o)?(r.push(`Use the monorepo checkout (${i}) instead of a stale npm install: ${N(e).join("; ")}.`),r.push("Do not publish npm packages or wait on an operator release."),r):(t?r.push(`Upgrade ${e} from ${t} to >= ${o} (npm install -g ${e}@latest or align OpenClaw npm prefix).`):r.push(`Install ${e} >= ${o} before running memory-heavy AgentOS paths.`),e==="@kynver-app/runtime"&&r.push("Repo-source alternative: npm run kynver:build && npm run kynver"),s==="installed"&&i&&r.push(`Repo checkout reports ${i}; rebuild/link repo source if you develop from the monorepo.`),r)}function b(n){if(n.length===0)return{version:null,source:"unknown"};let e=M(n.map(t=>t.version));if(!e)return{version:null,source:"unknown"};let o=n.find(t=>t.version===e)??n[0];return{version:o.version,source:o.source}}function k(n={}){let e=(r,a)=>r?typeof r=="string"?{version:r,source:a}:r:null,o=O.map(r=>{let a=f[r],u=[],y=e(n.installed?.[r],"installed"),d=e(n.repo?.[r],"repo"),S=e(n.self?.[r],"self");y&&u.push(y),d&&u.push(d),S&&u.push(S);let{version:c,source:l}=b(u),v=d?.version??null,m=c?R(c,a):!1,A=m?[]:x({packageName:r,minimumVersion:a,effectiveVersion:c,effectiveSource:l,repoVersion:v}),h=m?`${g[r]} ${c} meets memory-cost minimum ${a} (${l}).`:`${g[r]} is below memory-cost minimum ${a}`+(c?` (effective ${c} via ${l})`:" (no version detected)")+".";return{packageName:r,displayName:g[r],minimumVersion:a,effectiveVersion:c,effectiveSource:l,ok:m,summary:h,remediation:A}}),t=o.filter(r=>!r.ok),s=t.length===0,i=s?"All managed AgentOS packages meet memory-cost minimum versions.":`Memory-cost package guard blocked ${t.length} stale package(s): ${t.map(r=>`${r.packageName} < ${r.minimumVersion}`).join("; ")}.`;return{ok:s,summary:i,packages:o}}var p=class extends Error{result;constructor(e){let o=[e.summary,...e.packages.filter(t=>!t.ok).flatMap(t=>[`- ${t.summary}`,...t.remediation.map(s=>`  \u2192 ${s}`)])];super(o.join(`
+`)),this.name="MemoryCostPackageVersionGuardError",this.result=e}};function w(n={}){let e=k(n);if(!e.ok)throw new p(e);return e}export{f as MEMORY_COST_PACKAGE_MIN_VERSIONS,p as MemoryCostPackageVersionGuardError,w as assertMemoryCostPackageVersionGuard,E as compareSemver,k as evaluateMemoryCostPackageVersionGuard};

package/dist/server/monitor.js

@@ -1,8 +1,8 @@
-var l=(e,r,n)=>()=>{if(n)throw n[0];try{return e&&(r=e(e=0)),r}catch(t){throw n=[t],t}};function j(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let n=JSON.parse(r);if(n&&typeof n=="object"&&!Array.isArray(n))return n}catch{return null}return null}function ue(e){let r=e.trim();if(!r)return null;let n=j(r);if(n)return n;let t=[],o=/```(?:json)?\s*([\s\S]*?)```/gi,s;for(;(s=o.exec(r))!==null;){let u=j(s[1]??"");u&&t.push(u)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let u=j(r.slice(i,a+1));u&&t.push(u)}return t.length>0?t[t.length-1]:null}function ce(e){let r=e.finalResult??e.final_result;if(r!=null)return typeof r=="string"?ue(r)??(r.trim()||null):r;let n=typeof e.summary=="string"?e.summary.trim():"";if(!n)return null;let t=ue(n);return t||n}var de=l(()=>{"use strict"});import{existsSync as Nr,mkdirSync as nt,readFileSync as Wr,readdirSync as tt,renameSync as ot,rmSync as st,statSync as me,writeFileSync as it}from"node:fs";function fe(e){console.error(e),process.exit(1)}function Y(e){return process.platform!=="win32"?e:{windowsHide:!0,...e}}function A(e){try{return JSON.parse(e)}catch{return null}}function w(e){try{return me(e).size}catch{return 0}}function O(e){try{return me(e).mtime.toISOString()}catch{return null}}function pe(e,r){return Nr(e)?Wr(e,"utf8").split(`
+var l=(e,r,n)=>()=>{if(n)throw n[0];try{return e&&(r=e(e=0)),r}catch(t){throw n=[t],t}};function j(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let n=JSON.parse(r);if(n&&typeof n=="object"&&!Array.isArray(n))return n}catch{return null}return null}function ue(e){let r=e.trim();if(!r)return null;let n=j(r);if(n)return n;let t=[],o=/```(?:json)?\s*([\s\S]*?)```/gi,s;for(;(s=o.exec(r))!==null;){let u=j(s[1]??"");u&&t.push(u)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let u=j(r.slice(i,a+1));u&&t.push(u)}return t.length>0?t[t.length-1]:null}function ce(e){let r=e.finalResult??e.final_result;if(r!=null)return typeof r=="string"?ue(r)??(r.trim()||null):r;let n=typeof e.summary=="string"?e.summary.trim():"";if(!n)return null;let t=ue(n);return t||n}var de=l(()=>{"use strict"});import{existsSync as Nr,mkdirSync as tt,readFileSync as Wr,readdirSync as ot,renameSync as st,rmSync as it,statSync as me,writeFileSync as at}from"node:fs";function fe(e){console.error(e),process.exit(1)}function Y(e){return process.platform!=="win32"?e:{windowsHide:!0,...e}}function A(e){try{return JSON.parse(e)}catch{return null}}function O(e){try{return me(e).size}catch{return 0}}function w(e){try{return me(e).mtime.toISOString()}catch{return null}}function pe(e,r){return Nr(e)?Wr(e,"utf8").split(`
 `).slice(-r).join(`
-`):""}function I(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}function ge(e){let r=null,n=-1/0;for(let t of e){if(!t)continue;let o=Date.parse(t);Number.isFinite(o)&&o>n&&(n=o,r=t)}return r}function V(e){return Math.max(0,Math.round((Date.now()-e)/1e3))}var p=l(()=>{"use strict"});import{existsSync as Br,readFileSync as Tr}from"node:fs";function he(e){return e==="complete"}function ye(e){return he(e.lastHeartbeatPhase)?e.terminalFinalResult!==void 0&&e.terminalFinalResult!==null?e.terminalFinalResult:e.lastHeartbeatSummary?.trim()||"completed":null}function be(e){let r={heartbeatCount:0,lastHeartbeatAt:null,lastHeartbeatPhase:null,lastHeartbeatSummary:null,terminalFinalResult:null,heartbeatBlocker:null,timestampAnomalies:[],lastBoxResourceSnapshot:null,lastPrEvidence:[]};if(!Br(e))return r;let n=Date.now()+Ur,t=new Date(n).toISOString(),o=Tr(e,"utf8").split(`
-`).filter(Boolean);for(let s of o){let i=A(s);if(!i||typeof i!="object"||Array.isArray(i))continue;let a=i;if(r.heartbeatCount++,a.ts){let u=String(a.ts),m=Date.parse(u);Number.isFinite(m)&&m>n?r.timestampAnomalies.push({kind:"future_heartbeat_timestamp",observedAt:u,clampedTo:t}):r.lastHeartbeatAt=u}a.phase!==void 0&&a.phase!==null&&(r.lastHeartbeatPhase=String(a.phase)),a.summary!==void 0&&a.summary!==null&&(r.lastHeartbeatSummary=String(a.summary)),he(r.lastHeartbeatPhase)&&(r.terminalFinalResult=ce(a)),r.heartbeatBlocker=a.blocker?String(a.blocker):null,a.boxResourceSnapshot&&typeof a.boxResourceSnapshot=="object"&&!Array.isArray(a.boxResourceSnapshot)&&(r.lastBoxResourceSnapshot=a.boxResourceSnapshot),Array.isArray(a.prEvidence)&&(r.lastPrEvidence=a.prEvidence.filter(u=>!!u&&typeof u=="object"&&typeof u.prUrl=="string"))}return r}var Ur,ke=l(()=>{"use strict";de();p();Ur=6e4});function xe(e){return e?(e.split("/").pop()??e).replace(/\.exe$/i,"").toLowerCase():null}function P(e){if(!e)return[];let r=[],n="",t,o=!1;for(let s of e){if(o){n+=s,o=!1;continue}if(s==="\\"){o=!0;continue}if(t){s===t?t=void 0:n+=s;continue}if(s==='"'||s==="'"){t=s;continue}if(/\s/.test(s)){n&&(r.push(n),n="");continue}n+=s}return n&&r.push(n),r}function Se(e){let r=xe(e[0]);return!!(r&&Kr.has(r))}function Mr(e){let r=e.trim();return r.includes("/")?r.split("/").pop()??r:r}function Fr(e){if(!e||e.includes("*"))return null;let r=Mr(e);return!r||r.includes("/")?null:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(r)?r:null}function _e(e){return!e||e.includes("/")||e.includes("*")?!1:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(e)}function G(e){if(!e)return!1;let r=e.trim();return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")}function Hr(e){if(!e.startsWith("--glob="))return e;let r=e.slice(7);return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")?`--glob=${r}/**`:e}function $r(e){let r=[];for(let n=1;n<e.length;n+=1){let t=e[n];if(t){if(t==="--"){r.push(...e.slice(n+1));break}if(t.startsWith("-")){if(t.includes("="))continue;Re.has(t)&&(n+=1);continue}r.push(t)}}return r}function Lr(e){let r=!1,n=e.map((o,s)=>{let i=Hr(o),a=e[s-1];return a&&Re.has(a)&&o.startsWith("!")&&!o.includes("/")&&!o.endsWith("/**")&&(i=`${o}/**`),i!==o&&(r=!0),i}),t=$r(n);if(t.length===2){let[o,s]=t;if(G(s))return{argv:[n[0]??"rg",o,"-g",`${s}/**`,"."],changed:!0};let i=Fr(s);if(i)return{argv:[n[0]??"rg","-g",i,o,"."],changed:!0}}return r&&t.length===1?{argv:[...n,"."],changed:!0}:{argv:n,changed:r}}function ve(e){for(let r=1;r<e.length;r+=1){let n=e[r];if(n&&(n==="-c"||n==="-lc"||n==="-cl"||/^-[a-zA-Z]*c[a-zA-Z]*$/u.test(n)))return r+1}return-1}function N(e){let r=e.trim();if(!r)return{command:r,wrapped:!1};let n=P(r);if(!n.length)return{command:r,wrapped:!1};let t=xe(n[0]);if(!t||!Dr.has(t))return{command:r,wrapped:!1};let o=ve(n);if(o<0||o>=n.length)return{command:r,wrapped:!1};let s=n.slice(o).join(" ").trim();return s?{command:s,wrapped:!0}:{command:r,wrapped:!1}}function jr(e,r){let n=e.trim(),t=P(n),o=ve(t);if(o<0)return r;let s=t.slice(0,o).join(" "),i=r.includes("'")?`"${r.replace(/"/g,'\\"')}"`:`'${r}'`;return`${s} ${i}`}function Yr(e){let r=e.trim(),n=N(r),t=P(n.command);if(!t.length||!Se(t))return{segment:r,changed:!1};let o=Lr(t);if(!o.changed)return{segment:r,changed:!1};let s=o.argv.join(" ");return n.wrapped?{segment:jr(r,s),changed:!0}:{segment:s,changed:!0}}function z(e){let r=e.trim();if(!r)return{command:r,changed:!1};let n=r.includes("&&")?" && ":r.includes("||")?" || ":"; ",t=r.split(/\s*(?:&&|\|\||;)\s*/u),o=!1,s=t.map(i=>{let a=Yr(i);return a.changed&&(o=!0),a.segment});return o?{command:s.join(n),changed:!0}:{command:r,changed:!1}}function Ee(e){let r=N(e).command,n=P(r.trim());return n.length&&Se(n)?!0:/\b(rg|ripgrep)\b/i.test(r)}function Ce(e){if(!e)return{};let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(|$)/iu);if(r)return{pattern:r[1],target:r[2]?.trim()};let n=e.match(/^search\s+"(.+)"\s+in\s+(.+)$/iu);return n?{pattern:n[1],target:n[2]?.trim()}:{}}function Vr(e){let{pattern:r,target:n}=Ce(e);return r?G(n)?{kind:"rg_exclude_syntax",pattern:r,target:n}:_e(n)?{kind:"bad_scope",pattern:r,target:n}:{kind:"not_repo_search",pattern:r,target:n}:{kind:"not_repo_search"}}function Gr(e){let{pattern:r,target:n}=Ce(e);if(!r)return null;if(G(n)){let t=`${n.trim()}/**`;return{command:`rg "${r}" -g '${t}' .`,changed:!0}}return n&&_e(n)?{command:`rg -g ${n} "${r}" .`,changed:!0}:null}function zr(e){if(e.kind==="bad_scope"&&e.pattern?.includes("agent-os-land-pr")&&e.target==="package.json")return"Search package.json with a glob from the repo root: `rg -g package.json agent-os-land-pr .` \u2014 or run `node scripts/agent-os-land-pr.mjs <pr-url>` directly.";if(e.kind==="bad_scope"&&e.pattern&&e.target)return`Use \`rg -g '${e.target}' ${e.pattern} .\` from the repo root instead of treating ${e.target} as a folder.`;if(e.kind==="rg_exclude_syntax"&&e.pattern){let r=e.target?`${e.target.trim()}/**`:"!node_modules/**";return`Repo search scope \`${e.target??"!node_modules"}\` is not a valid ripgrep path. Use \`rg "${e.pattern}" -g '${r}' .\` from the repo root (exclude globs need a \`/**\` suffix).`}return e.kind==="no_matches"&&e.pattern?`No matches for "${e.pattern}". Try a broader pattern, drop overly short tokens, or search from the repo root with \`rg "${e.pattern}" .\`.`:null}function Jr(e){let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(agent\)|\s*failed|$)/iu);return r?`search "${r[1]}" in ${r[2]?.trim()}`:null}function J(e){let r=e.meta?.trim()||(e.command?Jr(e.command):null)||null;if(r){let n=Vr(r),t=zr(n);if(t)return t;let o=Gr(r);if(o?.changed)return`Repo search used an invalid scope. Retry with: \`${o.command}\`.`}if(e.command&&/\b(rg|ripgrep)\b/i.test(e.command)){let n=z(e.command);if(n.changed)return`Ripgrep scope may be invalid. Retry with: \`${n.command}\`.`;if(e.exitCode===1)return"Ripgrep returned no matches (exit 1). Try a broader pattern or search from the repo root."}return null}var Kr,Dr,Re,Ae=l(()=>{"use strict";Kr=new Set(["rg","ripgrep","grep"]),Dr=new Set(["bash","sh","dash","zsh"]),Re=new Set(["-e","--regexp","-f","--file","-m","--max-count","-A","--after-context","-B","--before-context","-C","--context","-g","--glob","--iglob"])});function S(e,r=200){let n=e.replace(/\s+/g," ").trim();return n.length>r?`${n.slice(0,r-1)}\u2026`:n}function Zr(e){let r=e.trim();if(!r)return null;if(r.startsWith("{"))try{return JSON.parse(r)}catch{}let n=r.indexOf("{"),t=r.lastIndexOf("}");if(n>=0&&t>n)try{return JSON.parse(r.slice(n,t+1))}catch{return null}return null}function _(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function Qr(e){let r=e.metadata;if(!_(r))return null;let n=r.vulnerabilities;if(!_(n))return null;let t=s=>typeof n[s]=="number"?n[s]:0,o={info:t("info"),low:t("low"),moderate:t("moderate"),high:t("high"),critical:t("critical"),total:t("total")};return typeof n.total!="number"&&!o.critical&&!o.high&&!o.moderate&&!o.low&&!o.info?null:o}function en(e){let r=[];e.critical&&r.push(`${e.critical} critical`),e.high&&r.push(`${e.high} high`),e.moderate&&r.push(`${e.moderate} moderate`),e.low&&r.push(`${e.low} low`),e.info&&r.push(`${e.info} info`);let n=r.length?r.join(", "):"see report";return`npm audit: ${e.total} vulnerabilit${e.total===1?"y":"ies"} (${n}) \u2014 remediation required`}function rn(e,r){let n=e.error;if(_(n)){let s=typeof n.summary=="string"?n.summary.trim():"",i=typeof n.code=="string"?n.code.trim():"";if(s)return i?`${i}: ${s}`:s;if(i)return i}let t=typeof e.message=="string"?e.message.trim():"";if(t)return t;let o=r.trim();return o?S(o.split(`
+`):""}function I(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}function ge(e){let r=null,n=-1/0;for(let t of e){if(!t)continue;let o=Date.parse(t);Number.isFinite(o)&&o>n&&(n=o,r=t)}return r}function V(e){return Math.max(0,Math.round((Date.now()-e)/1e3))}var p=l(()=>{"use strict"});import{existsSync as Kr,readFileSync as Tr}from"node:fs";function he(e){return e==="complete"}function ye(e){return he(e.lastHeartbeatPhase)?e.terminalFinalResult!==void 0&&e.terminalFinalResult!==null?e.terminalFinalResult:e.lastHeartbeatSummary?.trim()||"completed":null}function be(e){let r={heartbeatCount:0,lastHeartbeatAt:null,lastHeartbeatPhase:null,lastHeartbeatSummary:null,terminalFinalResult:null,heartbeatBlocker:null,timestampAnomalies:[],lastBoxResourceSnapshot:null,lastPrEvidence:[]};if(!Kr(e))return r;let n=Date.now()+Br,t=new Date(n).toISOString(),o=Tr(e,"utf8").split(`
+`).filter(Boolean);for(let s of o){let i=A(s);if(!i||typeof i!="object"||Array.isArray(i))continue;let a=i;if(r.heartbeatCount++,a.ts){let u=String(a.ts),m=Date.parse(u);Number.isFinite(m)&&m>n?r.timestampAnomalies.push({kind:"future_heartbeat_timestamp",observedAt:u,clampedTo:t}):r.lastHeartbeatAt=u}a.phase!==void 0&&a.phase!==null&&(r.lastHeartbeatPhase=String(a.phase)),a.summary!==void 0&&a.summary!==null&&(r.lastHeartbeatSummary=String(a.summary)),he(r.lastHeartbeatPhase)&&(r.terminalFinalResult=ce(a)),r.heartbeatBlocker=a.blocker?String(a.blocker):null,a.boxResourceSnapshot&&typeof a.boxResourceSnapshot=="object"&&!Array.isArray(a.boxResourceSnapshot)&&(r.lastBoxResourceSnapshot=a.boxResourceSnapshot),Array.isArray(a.prEvidence)&&(r.lastPrEvidence=a.prEvidence.filter(u=>!!u&&typeof u=="object"&&typeof u.prUrl=="string"))}return r}var Br,ke=l(()=>{"use strict";de();p();Br=6e4});function xe(e){return e?(e.split("/").pop()??e).replace(/\.exe$/i,"").toLowerCase():null}function P(e){if(!e)return[];let r=[],n="",t,o=!1;for(let s of e){if(o){n+=s,o=!1;continue}if(s==="\\"){o=!0;continue}if(t){s===t?t=void 0:n+=s;continue}if(s==='"'||s==="'"){t=s;continue}if(/\s/.test(s)){n&&(r.push(n),n="");continue}n+=s}return n&&r.push(n),r}function Se(e){let r=xe(e[0]);return!!(r&&Ur.has(r))}function Mr(e){let r=e.trim();return r.includes("/")?r.split("/").pop()??r:r}function Fr(e){if(!e||e.includes("*"))return null;let r=Mr(e);return!r||r.includes("/")?null:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(r)?r:null}function _e(e){return!e||e.includes("/")||e.includes("*")?!1:/\.(?:json|md|mjs|cjs|js|ts|tsx|yaml|yml)$/iu.test(e)}function G(e){if(!e)return!1;let r=e.trim();return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")}function Hr(e){if(!e.startsWith("--glob="))return e;let r=e.slice(7);return r.startsWith("!")&&!r.includes("/")&&!r.endsWith("/**")?`--glob=${r}/**`:e}function Lr(e){let r=[];for(let n=1;n<e.length;n+=1){let t=e[n];if(t){if(t==="--"){r.push(...e.slice(n+1));break}if(t.startsWith("-")){if(t.includes("="))continue;Re.has(t)&&(n+=1);continue}r.push(t)}}return r}function $r(e){let r=!1,n=e.map((o,s)=>{let i=Hr(o),a=e[s-1];return a&&Re.has(a)&&o.startsWith("!")&&!o.includes("/")&&!o.endsWith("/**")&&(i=`${o}/**`),i!==o&&(r=!0),i}),t=Lr(n);if(t.length===2){let[o,s]=t;if(G(s))return{argv:[n[0]??"rg",o,"-g",`${s}/**`,"."],changed:!0};let i=Fr(s);if(i)return{argv:[n[0]??"rg","-g",i,o,"."],changed:!0}}return r&&t.length===1?{argv:[...n,"."],changed:!0}:{argv:n,changed:r}}function ve(e){for(let r=1;r<e.length;r+=1){let n=e[r];if(n&&(n==="-c"||n==="-lc"||n==="-cl"||/^-[a-zA-Z]*c[a-zA-Z]*$/u.test(n)))return r+1}return-1}function N(e){let r=e.trim();if(!r)return{command:r,wrapped:!1};let n=P(r);if(!n.length)return{command:r,wrapped:!1};let t=xe(n[0]);if(!t||!Dr.has(t))return{command:r,wrapped:!1};let o=ve(n);if(o<0||o>=n.length)return{command:r,wrapped:!1};let s=n.slice(o).join(" ").trim();return s?{command:s,wrapped:!0}:{command:r,wrapped:!1}}function jr(e,r){let n=e.trim(),t=P(n),o=ve(t);if(o<0)return r;let s=t.slice(0,o).join(" "),i=r.includes("'")?`"${r.replace(/"/g,'\\"')}"`:`'${r}'`;return`${s} ${i}`}function Yr(e){let r=e.trim(),n=N(r),t=P(n.command);if(!t.length||!Se(t))return{segment:r,changed:!1};let o=$r(t);if(!o.changed)return{segment:r,changed:!1};let s=o.argv.join(" ");return n.wrapped?{segment:jr(r,s),changed:!0}:{segment:s,changed:!0}}function z(e){let r=e.trim();if(!r)return{command:r,changed:!1};let n=r.includes("&&")?" && ":r.includes("||")?" || ":"; ",t=r.split(/\s*(?:&&|\|\||;)\s*/u),o=!1,s=t.map(i=>{let a=Yr(i);return a.changed&&(o=!0),a.segment});return o?{command:s.join(n),changed:!0}:{command:r,changed:!1}}function Ee(e){let r=N(e).command,n=P(r.trim());return n.length&&Se(n)?!0:/\b(rg|ripgrep)\b/i.test(r)}function Ce(e){if(!e)return{};let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(|$)/iu);if(r)return{pattern:r[1],target:r[2]?.trim()};let n=e.match(/^search\s+"(.+)"\s+in\s+(.+)$/iu);return n?{pattern:n[1],target:n[2]?.trim()}:{}}function Vr(e){let{pattern:r,target:n}=Ce(e);return r?G(n)?{kind:"rg_exclude_syntax",pattern:r,target:n}:_e(n)?{kind:"bad_scope",pattern:r,target:n}:{kind:"not_repo_search",pattern:r,target:n}:{kind:"not_repo_search"}}function Gr(e){let{pattern:r,target:n}=Ce(e);if(!r)return null;if(G(n)){let t=`${n.trim()}/**`;return{command:`rg "${r}" -g '${t}' .`,changed:!0}}return n&&_e(n)?{command:`rg -g ${n} "${r}" .`,changed:!0}:null}function zr(e){if(e.kind==="bad_scope"&&e.pattern?.includes("agent-os-land-pr")&&e.target==="package.json")return"Search package.json with a glob from the repo root: `rg -g package.json agent-os-land-pr .` \u2014 or run `node scripts/agent-os-land-pr.mjs <pr-url>` directly.";if(e.kind==="bad_scope"&&e.pattern&&e.target)return`Use \`rg -g '${e.target}' ${e.pattern} .\` from the repo root instead of treating ${e.target} as a folder.`;if(e.kind==="rg_exclude_syntax"&&e.pattern){let r=e.target?`${e.target.trim()}/**`:"!node_modules/**";return`Repo search scope \`${e.target??"!node_modules"}\` is not a valid ripgrep path. Use \`rg "${e.pattern}" -g '${r}' .\` from the repo root (exclude globs need a \`/**\` suffix).`}return e.kind==="no_matches"&&e.pattern?`No matches for "${e.pattern}". Try a broader pattern, drop overly short tokens, or search from the repo root with \`rg "${e.pattern}" .\`.`:null}function Jr(e){let r=e.match(/search\s+"(.+)"\s+in\s+([^()]+?)(?:\s*\(agent\)|\s*failed|$)/iu);return r?`search "${r[1]}" in ${r[2]?.trim()}`:null}function J(e){let r=e.meta?.trim()||(e.command?Jr(e.command):null)||null;if(r){let n=Vr(r),t=zr(n);if(t)return t;let o=Gr(r);if(o?.changed)return`Repo search used an invalid scope. Retry with: \`${o.command}\`.`}if(e.command&&/\b(rg|ripgrep)\b/i.test(e.command)){let n=z(e.command);if(n.changed)return`Ripgrep scope may be invalid. Retry with: \`${n.command}\`.`;if(e.exitCode===1)return"Ripgrep returned no matches (exit 1). Try a broader pattern or search from the repo root."}return null}var Ur,Dr,Re,Ae=l(()=>{"use strict";Ur=new Set(["rg","ripgrep","grep"]),Dr=new Set(["bash","sh","dash","zsh"]),Re=new Set(["-e","--regexp","-f","--file","-m","--max-count","-A","--after-context","-B","--before-context","-C","--context","-g","--glob","--iglob"])});function S(e,r=200){let n=e.replace(/\s+/g," ").trim();return n.length>r?`${n.slice(0,r-1)}\u2026`:n}function Zr(e){let r=e.trim();if(!r)return null;if(r.startsWith("{"))try{return JSON.parse(r)}catch{}let n=r.indexOf("{"),t=r.lastIndexOf("}");if(n>=0&&t>n)try{return JSON.parse(r.slice(n,t+1))}catch{return null}return null}function _(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}function Qr(e){let r=e.metadata;if(!_(r))return null;let n=r.vulnerabilities;if(!_(n))return null;let t=s=>typeof n[s]=="number"?n[s]:0,o={info:t("info"),low:t("low"),moderate:t("moderate"),high:t("high"),critical:t("critical"),total:t("total")};return typeof n.total!="number"&&!o.critical&&!o.high&&!o.moderate&&!o.low&&!o.info?null:o}function en(e){let r=[];e.critical&&r.push(`${e.critical} critical`),e.high&&r.push(`${e.high} high`),e.moderate&&r.push(`${e.moderate} moderate`),e.low&&r.push(`${e.low} low`),e.info&&r.push(`${e.info} info`);let n=r.length?r.join(", "):"see report";return`npm audit: ${e.total} vulnerabilit${e.total===1?"y":"ies"} (${n}) \u2014 remediation required`}function rn(e,r){let n=e.error;if(_(n)){let s=typeof n.summary=="string"?n.summary.trim():"",i=typeof n.code=="string"?n.code.trim():"";if(s)return i?`${i}: ${s}`:s;if(i)return i}let t=typeof e.message=="string"?e.message.trim():"";if(t)return t;let o=r.trim();return o?S(o.split(`
 `).find(Boolean)??o,160):"npm audit failed"}function nn(e){let r=`${e.stdout}
-${e.stderr}`.trim(),n=Zr(r);if(!n||!_(n)){let o=S(r||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit failed (invalid or missing JSON): ${o}`,parseError:"invalid_json"}}if(_(n.error))return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit command failed: ${rn(n,e.stderr)}`};let t=Qr(n);return t?e.exitCode===0&&t.total===0?{kind:"success",exitCode:0,summary:"npm audit: no vulnerabilities reported",audit:t}:{kind:"audit_findings",exitCode:e.exitCode,summary:en(t),audit:t}:{kind:"command_failure",exitCode:e.exitCode,summary:"npm audit failed: JSON response missing vulnerability metadata",parseError:"missing_metadata"}}function tn(e){return qr.test(e)}function on(e){let r=N(e).command;return we.test(e)||we.test(r)||Ee(e)}function sn(e){let r=J({command:e.command,exitCode:e.exitCode});if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"ripgrep finished (exit 0)"};if(e.exitCode===1){let t=(e.stderr||e.interleaved).trim();if(t&&Xr.test(t)){let i=S(t,160);return{kind:"command_failure",exitCode:1,summary:r??`ripgrep failed (exit 1): ${i}`}}let o=z(e.command),s=o.changed&&!r?` Retry with: \`${o.command}\`.`:"";return{kind:"search_no_matches",exitCode:1,summary:r??`ripgrep: no matches (exit 1).${s} Try a broader pattern or search from the repo root.`}}let n=S(e.interleaved||e.stdout||e.stderr||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:r??`ripgrep failed (exit ${e.exitCode}): ${n}`}}function Oe(e){let r=e.stdout??"",n=e.stderr??"",t=e.interleavedOutput??"";if(tn(e.command)){let i=r.trim()||t.trim()||n.trim();return nn({exitCode:e.exitCode,stdout:i,stderr:n})}if(on(e.command))return sn({command:e.command,exitCode:e.exitCode,stdout:r,stderr:n,interleaved:t});let o=J({command:e.command,exitCode:e.exitCode});if(o&&e.exitCode!==0)return{kind:"command_failure",exitCode:e.exitCode,summary:o};if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"command succeeded (exit 0)"};let s=S(t||r||n||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`command failed (exit ${e.exitCode}): ${s}`}}var qr,we,Xr,Ie=l(()=>{"use strict";Ae();qr=/\bnpm\s+audit\b/i,we=/\b(rg|ripgrep)\b/i,Xr=/\b(error|invalid|unknown|panic|not found)\b/i});import{existsSync as an,readFileSync as ln}from"node:fs";function un(e){let r=e.timestamp_ms;return e.timestamp||e.ts||(r?new Date(r).toISOString():void 0)}function cn(e){if(!e)return null;for(let r of Object.keys(e))if(r.endsWith("ToolCall")){let n=r.slice(0,-8);return n.length?n:r}return null}function dn(e,r){e.finalResult=r.result||r.subtype||r.terminal_reason||"completed",r.is_error&&(e.error=String(r.result||r.api_error_status||"stream result error"))}function mn(e){if(e.type!=="tool_call"||e.subtype!=="completed")return null;let n=(e.tool_call&&typeof e.tool_call=="object"&&!Array.isArray(e.tool_call)?e.tool_call:null)?.shellToolCall;if(!n||typeof n!="object"||Array.isArray(n))return null;let t=n,o=t.args,s=o&&typeof o=="object"&&!Array.isArray(o)&&typeof o.command=="string"?String(o.command):"",i=t.result;if(!i||typeof i!="object"||Array.isArray(i))return null;let a=i.success??i.failure;if(!a||typeof a!="object"||Array.isArray(a))return null;let u=a,m=typeof u.exitCode=="number"?u.exitCode:0;return{command:s,exitCode:m,stdout:typeof u.stdout=="string"?u.stdout:"",stderr:typeof u.stderr=="string"?u.stderr:"",interleaved:typeof u.interleavedOutput=="string"?u.interleavedOutput:""}}function fn(e,r){r.kind==="success"||r.kind==="search_no_matches"||(e.lastShellOutcome=r)}function Pe(e){let r={firstEventAt:null,lastEventAt:null,currentTool:null,finalResult:null,error:null,lastShellOutcome:null};if(!an(e))return r;let n=ln(e,"utf8").split(`
-`).filter(Boolean);for(let t of n){let o=A(t);if(!o)continue;let s=un(o);if(s&&(r.firstEventAt||=s,r.lastEventAt=s),o.type==="stream_event"&&o.event&&typeof o.event=="object"&&o.event.type==="content_block_start"){let a=o.event.content_block;a?.type==="tool_use"&&(r.currentTool=String(a.name||"tool"))}if(o.type==="assistant"&&o.message&&typeof o.message=="object"){let a=o.message.content;if(Array.isArray(a)){let u=a.find(m=>m?.type==="tool_use");u&&(r.currentTool=String(u.name||r.currentTool))}}if(o.type==="tool_call"&&o.subtype==="started"){let a=o.tool_call&&typeof o.tool_call=="object"&&!Array.isArray(o.tool_call)?o.tool_call:void 0,u=cn(a);u&&(r.currentTool=u)}let i=mn(o);i&&fn(r,Oe({command:i.command,exitCode:i.exitCode,stdout:i.stdout,stderr:i.stderr,interleavedOutput:i.interleaved})),o.type==="result"&&dn(r,o)}return r}var Ne=l(()=>{"use strict";Ie();p()});function gn(e,r=240){let n=e.replace(/\s+/g," ").trim();return n.length>r?`${n.slice(0,r-1)}\u2026`:n}function We(e){let r=(e??"").trim();if(!r)return null;for(let n of pn)if(n.test.test(r))return{blocked:!0,reason:`${n.label}: ${gn(r)}`};return null}var pn,Be=l(()=>{"use strict";pn=[{test:/\b(?:invalid|unknown|unsupported|unrecognized)\b[^.\n]*\bmodel\b/i,label:"provider rejected the requested model"},{test:/\bmodel\b[^.\n]*\b(?:not\s+(?:found|supported|available|recognized|valid)|is\s+not\s+valid|does\s+not\s+exist)/i,label:"provider rejected the requested model"},{test:/\b(?:did you mean|available models|choose (?:a|one of)|supported models)\b/i,label:"provider rejected the requested model"},{test:/model preflight failed/i,label:"model/provider preflight failed"},{test:/\b(?:command not found|ENOENT|is the .*CLI on PATH|executable not found|no such file or directory)\b/i,label:"provider CLI is missing or not on PATH"},{test:/\bfailed to spawn\b/i,label:"provider failed to spawn the worker process"},{test:/\b(?:not logged in|unauthorized|authentication (?:failed|required)|invalid api key|missing api key|401)\b/i,label:"provider authentication failed"},{test:/\b(?:out of usage|increase limits?|switch to auto|ask your admin to increase your limit|usage limits?|quota exceeded|insufficient_quota|credits? exhausted|billing|payment required)\b/i,label:"provider quota exhausted"}]});function Te(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function hn(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="boolean"?e:Array.isArray(e)?e.length>0:typeof e=="object"?Object.keys(e).length>0:!0}function yn(e){return!e?.checked||e.headIsAncestorOfBase!==!1?null:Te(e.head)}function bn(e,r,n){let t=["exited_with_changes_salvage"];if((e==="uncommitted"||e==="both")&&t.push(`${r} uncommitted change${r===1?"":"s"} with no final result`),(e==="committed_ahead"||e==="both")&&n){let o=n.length>12?n.slice(0,12):n;t.push(`commit ${o} ahead of base with no final result`)}return t.push("review worktree \u2014 commit, open a PR, or run a salvage worker before discarding"),t.join(": ")}function Ue(e){if(e.alive||hn(e.finalResult))return null;let r=(e.changedFiles??[]).filter(i=>i.trim()).length,n=Te(e.headCommit)??yn(e.gitAncestry),t=r>0,o=!!n;if(!t&&!o)return{kind:"none",salvageable:!1,uncommittedCount:0,headCommit:null,attentionReason:"process exited without a final result"};let s=t&&o?"both":t?"uncommitted":"committed_ahead";return{kind:s,salvageable:!0,uncommittedCount:r,headCommit:n,attentionReason:bn(s,r,n)}}var Ke=l(()=>{"use strict"});var kn,St,De=l(()=>{"use strict";kn=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY"],St=new Set(kn)});import{spawnSync as Fe}from"node:child_process";function Rn(e,r,n={}){let t=Fe("git",r,Y({cwd:e,encoding:"utf8"}));if(t.status!==0&&!n.allowFailure){let o=`git ${r.join(" ")} failed: ${t.stderr||t.stdout}`;if(n.throwError)throw new Error(o);fe(o)}return t.stdout||""}function He(e){return Rn(e,["status","--short"],{allowFailure:!0}).split(`
-`).map(r=>r.trim()).filter(Boolean)}function W(e,r){try{let n=Fe("git",r,Y({cwd:e,encoding:"utf8"}));return{status:n.status,stdout:n.stdout||"",stderr:n.stderr||"",error:n.error?n.error.message:null}}catch(n){return{status:null,stdout:"",stderr:"",error:n.message}}}function Me(e,r,n){let t=W(e,["merge-base","--is-ancestor",r,n]);return t.status===0?{isAncestor:!0,error:null}:t.status===1?{isAncestor:!1,error:null}:{isAncestor:null,error:t.error||t.stderr||t.stdout||`git exited ${t.status}`}}function $e(e,r="origin/main"){let n=typeof r=="string"?{base:r}:r,t=n.baseCommit?.trim()||n.base?.trim()||"origin/main",o=n.baseCommit?.trim()||null;if(!e)return q(t,"missing worktree path");let s=W(e,["rev-parse","HEAD"]);if(s.status!==0)return q(t,s.error||s.stderr||s.stdout||"failed to resolve HEAD");let i;if(o)i=o;else{let f=W(e,["rev-parse",t]);if(f.status!==0)return q(t,f.error||f.stderr||f.stdout||`failed to resolve ${t}`,s.stdout.trim());i=f.stdout.trim()}let a=s.stdout.trim();if(a===i)return{checked:!0,base:t,head:a,baseHead:i,baseIsAncestorOfHead:!0,headIsAncestorOfBase:!0,relation:"synced"};let u=Me(e,i,a),m=Me(e,a,i),d=u.error||m.error||void 0;if(u.isAncestor==null||m.isAncestor==null)return{checked:!1,base:t,head:a,baseHead:i,baseIsAncestorOfHead:u.isAncestor,headIsAncestorOfBase:m.isAncestor,relation:"unknown",...d?{error:d}:{}};let c=u.isAncestor?"ahead":m.isAncestor?"merged":"diverged";return{checked:!0,base:t,head:a,baseHead:i,baseIsAncestorOfHead:u.isAncestor,headIsAncestorOfBase:m.isAncestor,relation:c,...d?{error:d}:{}}}function q(e,r,n=null){return{checked:!1,base:e,head:n,baseHead:null,baseIsAncestorOfHead:null,headIsAncestorOfBase:null,relation:"unknown",error:r}}var X=l(()=>{"use strict";p();De()});function v(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function xn(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="boolean"?e:Array.isArray(e)?e.length>0:typeof e=="object"?Object.keys(e).length>0:!0}function Sn(e){if(v(e.headCommit)||v(e.prUrl)||v(e.artifactBundlePath)||v(e.patchPath))return!0;let r=e.gitAncestry;return!!(r?.checked&&r.headIsAncestorOfBase===!1&&v(r.head))}function Le(e){return xn(e.finalResult)?e.changedFiles.length===0?{blocked:!1}:Sn(e)?{blocked:!0,detail:`Worktree has ${e.changedFiles.length} uncommitted change(s); commit or discard before landing`}:{blocked:!0,reason:"dirty_worktree_no_pr",detail:`Worktree has ${e.changedFiles.length} uncommitted change(s) with no commit or PR; commit, open a PR, or discard before landing`}:{blocked:!1}}function je(e){if(e.blocked)return e.detail??e.reason??"dirty_worktree_no_pr"}var Ye=l(()=>{"use strict"});function Z(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let n=JSON.parse(r);if(n&&typeof n=="object"&&!Array.isArray(n))return n}catch{return null}return null}function Ve(e){let r=e.targetPrReconciliation??e.target_pr_reconciliation??e.targetPrs??e.target_prs;return Array.isArray(r)?r.length:0}function B(e){let r=e.trim();if(!r)return null;let n=Z(r);if(n)return n;let t=[],o=/```(?:json)?\s*([\s\S]*?)```/gi,s;for(;(s=o.exec(r))!==null;){let d=Z(s[1]??"");d&&t.push(d)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let d=Z(r.slice(i,a+1));d&&t.push(d)}if(t.length===0)return null;let u=t[t.length-1],m=Ve(u);for(let d of t){let c=Ve(d);c>m&&(u=d,m=c)}return u}var Q=l(()=>{"use strict"});function Ge(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`https://github.com/${r[1]}/pull/${r[2]}`:e.trim()||null}function ze(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`${r[1].toLowerCase()}/pull/${r[2]}`:e.trim().toLowerCase()}function _n(e){return new Set(e.map(r=>ze(Ge(r)??r)).filter(Boolean))}function Je(e,r,n){let t=Ge(e)??e;if(!t)return"unrelated";let o=ze(t);return _n(r).has(o)?"contract":n?(n.outcome==="skipped"||n.outcome==="blocked")&&n.reason?.trim()?"support":(n.outcome==="merged","unrelated"):"unrelated"}var qe=l(()=>{"use strict"});function R(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function vn(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="object"?Object.keys(e).length>0:!0}function b(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`https://github.com/${r[1]}/pull/${r[2]}`:R(e)}function T(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`${r[1].toLowerCase()}/pull/${r[2]}`:e.trim().toLowerCase()}function Xe(e){let r=null;if(typeof e=="string"){let o=B(e);o&&(r=o)}else e&&typeof e=="object"&&!Array.isArray(e)&&(r=e);if(!r)return[];let n=r.targetPrReconciliation??r.target_pr_reconciliation;if(!Array.isArray(n))return[];let t=[];for(let o of n){if(!o||typeof o!="object"||Array.isArray(o))continue;let s=o,i=b(String(s.prUrl??s.pr_url??"")),a=R(s.outcome);!i||a!=="merged"&&a!=="skipped"&&a!=="blocked"||t.push({prUrl:i,outcome:a,mergeCommit:R(s.mergeCommit??s.merge_commit),reason:R(s.reason)})}return t}function Ze(e,r){let n=[],t=b(R(e.prUrl)??"");if(t&&n.push(t),r&&typeof r=="object"&&!Array.isArray(r)){let o=r,s=b(String(o.prUrl??o.pr_url??""));s&&n.push(s)}return[...new Set(n)]}function Qe(e){let{contract:r,snapshot:n}=e,t=e.finalResult??n.finalResult;if(!r.landingOnly&&r.targetPrUrls.length===0&&!r.repairEnforceOriginalPr)return{blocked:!1};if(!vn(t))return(r.requiresTargetPrReconciliation??(r.landingOnly||!!r.repairEnforceOriginalPr||r.targetPrUrls.length>0))&&r.targetPrUrls.length>0?{blocked:!0,reason:"missing_target_pr_reconciliation",detail:`Final result required to reconcile target PR(s): ${r.targetPrUrls.join(", ")}`}:{blocked:!1};if(!(r.requiresTargetPrReconciliation??(r.landingOnly||!!r.repairEnforceOriginalPr||r.targetPrUrls.length>0))&&!r.repairEnforceOriginalPr)return{blocked:!1};let s=r.repairEnforceOriginalPr?b(R(r.targetPrUrl)??"")??(r.targetPrUrls.length===1?b(r.targetPrUrls[0]):null):null;if(s){let c=Ze(n,t);if(!(t&&typeof t=="object"&&!Array.isArray(t)&&t.supersedesOriginalTargetPr===!0)){for(let y of c)if(y!==s)return{blocked:!0,reason:"duplicate_repair_pr",detail:`Repair worker opened or attached PR ${y} instead of canonical target ${s}`}}let h=Xe(t).find(y=>y.prUrl===s);if(!h||h.outcome!=="merged"&&!(h.reason?.trim()&&(h.outcome==="skipped"||h.outcome==="blocked")))return{blocked:!0,reason:"missing_repair_target_reconciliation",detail:`Repair worker must reconcile target PR ${s}`}}let i=Xe(t),a=new Map(i.map(c=>[T(c.prUrl),c])),u=new Set(r.targetPrUrls.map(c=>T(b(c)??c)).filter(Boolean)),m=Ze(n,t);if(r.landingOnly)for(let c of m){let f=a.get(T(c)),g=Je(c,r.targetPrUrls,f);if(!(g==="contract"||g==="support"))return u.size>0?{blocked:!0,reason:"unrelated_implementation_pr",detail:`Landing-only worker attached unrelated PR ${c}`}:{blocked:!0,reason:"unrelated_implementation_pr",detail:"Landing-only worker must not open new implementation PRs"}}if(r.targetPrUrls.length===0)return{blocked:!1};let d=[];for(let c of r.targetPrUrls){let f=T(b(c)??c),g=a.get(f);if(!g){d.push(f);continue}g.outcome!=="merged"&&!g.reason?.trim()&&d.push(f)}return d.length>0?{blocked:!0,reason:d.every(c=>a.has(c))?"incomplete_target_pr_landing":"missing_target_pr_reconciliation",detail:`Target PR reconciliation incomplete: ${d.join(", ")}`}:{blocked:!1}}function er(e){if(e.blocked)return e.detail??e.reason}var rr=l(()=>{"use strict";Q();qe()});function Cn(e){let r=Date.now();if(e.completionBlocker&&!nr(e.completionBlocker))return{state:"blocked",reason:e.completionBlocker};if(e.finalResult){if(e.localOnly&&wn(e.finalResult))return{state:"done",reason:"local-only worker superseded by merged PR"};let o={finalResult:e.finalResult,changedFiles:e.changedFiles??[],gitAncestry:e.gitAncestry??null,prUrl:e.prUrl??null},s=Le(o);if(s.blocked){let i=je(s);return{state:"needs_attention",reason:s.reason?`landing blocked (${s.reason}): ${i}`:`landing blocked: ${i}`}}if(e.landingContract){let i=Qe({contract:e.landingContract,snapshot:o,finalResult:e.finalResult}),a=er(i);if(a)return{state:"needs_attention",reason:i.reason?`landing contract (${i.reason}): ${a}`:`landing contract: ${a}`}}return{state:"done",reason:"final result recorded"}}if(!e.alive){if(An(e))return{state:"done",reason:"empty abandoned worker record"};let o=We(e.error);if(o)return{state:"blocked",reason:o.reason};let s=Ue({alive:!1,finalResult:null,changedFiles:e.changedFiles,gitAncestry:e.gitAncestry});if(s?.salvageable){let a=e.error?.trim();return{state:"needs_attention",reason:a?`${s.attentionReason} (${a})`:s.attentionReason}}let i=e.error?.trim();return{state:"needs_attention",reason:i?`process exited without a final result: ${i}`:s?.attentionReason??"process exited without a final result"}}if(e.heartbeatBlocker)return{state:"blocked",reason:`worker heartbeat reported blocker: ${e.heartbeatBlocker}`};let n=e.startedAt?Date.parse(e.startedAt):NaN;if(!e.firstEventAt&&e.stdoutBytes===0&&e.heartbeatBytes===0&&Number.isFinite(n)&&r-n>En)return{state:"needs_attention",reason:`no first stream event ${V(n)}s after start`};let t=e.lastActivityAt?Date.parse(e.lastActivityAt):NaN;return Number.isFinite(t)&&r-t>U?{state:"stale",reason:`no log/event/heartbeat activity for ${V(t)}s`}:{state:"ok",reason:"recent activity"}}function nr(e){let r=e?.trim();return r?/completion acknowledged but board not advanced/i.test(r)&&/task already terminal/i.test(r):!1}function An(e){return e.finalResult||e.taskId||e.agentOsId||e.stdoutBytes>0||(e.stderrBytes??0)>0||e.heartbeatBytes>0||e.error?.trim()||(e.changedFiles??[]).some(r=>r.trim())?!1:/empty worker dir|marked abandoned/i.test(e.reconcileReason??"")}function wn(e){let r=null;if(typeof e=="string"?r=B(e):e&&typeof e=="object"&&!Array.isArray(e)&&(r=e),!r)return!1;let n=r.targetPrReconciliation??r.target_pr_reconciliation;return Array.isArray(n)?n.some(t=>!t||typeof t!="object"||Array.isArray(t)?!1:String(t.outcome??"").trim()==="merged"):!1}function On(e,r,n){let t=e.completionSnapshot?.finalResult;return e.completionAckSource==="local-pr-merged-reconcile"&&t!==void 0&&t!==null?t:r||(t??ye(n))}function tr(e,r={}){let n=Pe(e.stdoutPath),t=be(e.heartbeatPath),o=typeof e.completionReportedAt=="string"&&e.completionReportedAt.trim().length>0,s=On(e,n.finalResult,t),i=o?!1:I(e.pid),a=w(e.stdoutPath),u=w(e.stderrPath),m=w(e.heartbeatPath),d=He(e.worktreePath),c=$e(e.worktreePath,{base:r.base,baseCommit:r.baseCommit}),f=ge([n.lastEventAt,t.lastHeartbeatAt,O(e.stdoutPath),O(e.stderrPath),O(e.heartbeatPath)]),g=n.error||!i&&!s&&pe(e.stderrPath,10).trim()||void 0,h=typeof e.completionBlocker=="string"&&e.completionBlocker.trim()?e.completionBlocker.trim():null,y=nr(h)?null:h,Ir=e.repairTargetPrUrl?{landingOnly:!1,targetPrUrls:[e.repairTargetPrUrl],targetPrUrl:e.repairTargetPrUrl,repairEnforceOriginalPr:!0}:null,L=Cn({alive:i,finalResult:s,firstEventAt:n.firstEventAt,stdoutBytes:a,stderrBytes:u,heartbeatBytes:m,lastActivityAt:f,heartbeatBlocker:t.heartbeatBlocker,startedAt:e.startedAt,error:g,changedFiles:d,gitAncestry:c,completionBlocker:y,landingContract:Ir,prUrl:e.repairTargetPrUrl??e.taskPrUrl??null,localOnly:e.localOnly===!0,taskId:e.taskId??null,agentOsId:e.agentOsId??null,reconcileReason:e.reconcileReason??null}),Pr=y||L.state==="blocked"?"blocked":o||L.state==="done"?"done":s?"exited":i?"running":"exited";return{runId:e.runId,worker:e.name,pid:e.pid,alive:i,status:Pr,attention:L,branch:e.branch,worktreePath:e.worktreePath,ownedPaths:e.ownedPaths,stdoutBytes:a,stderrBytes:u,heartbeatBytes:m,firstEventAt:n.firstEventAt,lastEventAt:n.lastEventAt,lastActivityAt:f,currentTool:o?null:n.currentTool,heartbeatCount:t.heartbeatCount,lastHeartbeatAt:t.lastHeartbeatAt,lastHeartbeatPhase:t.lastHeartbeatPhase,lastHeartbeatSummary:t.lastHeartbeatSummary,heartbeatBlocker:t.heartbeatBlocker,timestampAnomalies:t.timestampAnomalies,finalResult:s,error:g,changedFiles:d,gitAncestry:c,instructionPolicyFingerprint:e.instructionPolicyFingerprint??null,instructionPolicyEvidence:e.instructionPolicyEvidence??null,model:e.model??e.orchestrationAudit?.model??null,provider:e.provider??e.orchestrationAudit?.provider??null,boxKind:e.boxKind??null,boxId:e.boxId??null,runtimeId:e.runtimeId??null,personaSlug:e.personaSlug??null,dispatched:e.dispatched??null,localOnly:e.localOnly??null}}function or(e){return!!(e.finalResult||e.alive===!1||e.status==="exited"||e.status==="done")}function sr(e){return e.finalResult?e.attention.state==="needs_attention"||e.attention.state==="blocked":!1}var En,U,E=l(()=>{"use strict";ke();Ne();Be();Ke();X();Ye();rr();Q();p();En=18e4,U=6e5});var C=l(()=>{"use strict"});var ee=l(()=>{"use strict";X();C()});var k=l(()=>{"use strict"});var K=l(()=>{"use strict"});var ur=l(()=>{"use strict"});var oo,so,re=l(()=>{"use strict";oo=25*1024*1024*1024,so=12*1024*1024*1024});var co,mo,cr=l(()=>{"use strict";re();co=5*1024*1024*1024,mo=10*1024*1024*1024});var bo,ko,ne=l(()=>{"use strict";cr();re();bo=30*1024*1024*1024,ko=15*1024*1024*1024});var dr=l(()=>{"use strict";D();p()});var mr=l(()=>{"use strict";E()});var Un,Kn,gr=l(()=>{"use strict";ur();x();k();K();M();ne();D();dr();mr();p();Un=500*1024*1024,Kn=4*1024*1024*1024});var M=l(()=>{"use strict";gr()});import{homedir as Mn}from"node:os";import Fn from"node:path";var hr,se=l(()=>{"use strict";hr=Fn.join(Mn(),".kynver",".env")});var yr=l(()=>{"use strict"});var br=l(()=>{"use strict";yr()});var kr=l(()=>{"use strict"});var ie=l(()=>{"use strict";br();kr()});var Rr=l(()=>{"use strict"});var xr=l(()=>{"use strict";Rr()});var F=l(()=>{"use strict";se();C();x();ie();xr()});var Sr=l(()=>{"use strict";k();k()});var _r=l(()=>{"use strict";se();ie();F()});var vr=l(()=>{"use strict";p()});import Yn from"node:path";var Ms,ae=l(()=>{"use strict";C();vr();Ms=Yn.join(".openclaw","harness")});var $=l(()=>{"use strict";x();k();K();M();ae()});var Cr=l(()=>{"use strict";ee();k();Sr();x();F();_r();p();$()});import{homedir as Xn,totalmem as di}from"node:os";import le from"node:path";var Ar,_i,vi,Ei,Ci,x=l(()=>{"use strict";ee();C();p();k();K();M();ne();F();Cr();$();Ar=le.join(Xn(),".kynver"),_i=le.join(Ar,"config.json"),vi=le.join(Ar,"credentials"),Ei=500*1024*1024,Ci=4*1024*1024*1024});var wr=l(()=>{"use strict";x();ae();$();p()});var D=l(()=>{"use strict";wr();p()});E();var ir="kynver-harness:",In="@runner:";function ar(e){return e?.trim()?e.trim():null}function Pn(e){let r=ar(e);if(!r?.startsWith(ir))return null;let n=r.slice(ir.length),t=n.indexOf(In);return t>=0?n.slice(0,t).trim()||null:n.trim()||null}function lr(e,r){let n=ar(r);return n?Pn(e)===n:!1}E();p();function Nn(e){let{worker:r,status:n,taskLease:t}=e,o=t?.leaseOwner??null;if(r.dispatched&&t){if(t.status==="running"&&o&&!lr(o,r.runId))return{health:"orphaned",reason:`task lease held by ${o}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=t.leaseToken?.trim()??"";if(t.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(t.status==="running"&&!n.alive&&!n.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!n.alive&&!n.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(n.attention.state==="stale")return{health:"stale",reason:n.attention.reason};let s=n.lastHeartbeatAt?Date.parse(n.lastHeartbeatAt):NaN;return n.alive&&Number.isFinite(s)&&Date.now()-s>U?{health:"stale",reason:`heartbeat older than ${Math.floor(U/1e3)}s`}:n.alive&&r.pid&&!I(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:t?.status==="running"&&!n.alive&&n.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:n.attention.reason||"worker within expected lifecycle bounds"}}D();function Or(e){return!!e.completionReportedAt?.trim()}E();function Zn(e){let{worker:r,status:n}=e,t=[];r.localOnly&&t.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&t.push("missing agentOsId/taskId linkage"),Or(r)&&t.push("completion already acknowledged"),r.completionBlocker&&t.push(r.completionBlocker),n.heartbeatBlocker&&n.alive&&t.push(`worker heartbeat blocker: ${n.heartbeatBlocker}`),n.attention.state==="blocked"&&t.push(n.attention.reason||"worker attention blocked"),sr(n)&&t.push(n.attention.reason||"landing gate blocked");let o=or(n),s;return o?n.finalResult?s="final_result":n.alive?s="terminal_status":s="process_exited":t.push("worker has not reached a terminal condition"),{eligible:o&&t.length===0,terminalVerified:o,terminalReason:s,blockers:t}}export{Zn as assessAutoCompleteEligibility,Nn as classifyWorkerHealth,tr as computeWorkerStatus};
+${e.stderr}`.trim(),n=Zr(r);if(!n||!_(n)){let o=S(r||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit failed (invalid or missing JSON): ${o}`,parseError:"invalid_json"}}if(_(n.error))return{kind:"command_failure",exitCode:e.exitCode,summary:`npm audit command failed: ${rn(n,e.stderr)}`};let t=Qr(n);return t?e.exitCode===0&&t.total===0?{kind:"success",exitCode:0,summary:"npm audit: no vulnerabilities reported",audit:t}:{kind:"audit_findings",exitCode:e.exitCode,summary:en(t),audit:t}:{kind:"command_failure",exitCode:e.exitCode,summary:"npm audit failed: JSON response missing vulnerability metadata",parseError:"missing_metadata"}}function tn(e){return qr.test(e)}function on(e){let r=N(e).command;return Oe.test(e)||Oe.test(r)||Ee(e)}function sn(e){let r=J({command:e.command,exitCode:e.exitCode});if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"ripgrep finished (exit 0)"};if(e.exitCode===1){let t=(e.stderr||e.interleaved).trim();if(t&&Xr.test(t)){let i=S(t,160);return{kind:"command_failure",exitCode:1,summary:r??`ripgrep failed (exit 1): ${i}`}}let o=z(e.command),s=o.changed&&!r?` Retry with: \`${o.command}\`.`:"";return{kind:"search_no_matches",exitCode:1,summary:r??`ripgrep: no matches (exit 1).${s} Try a broader pattern or search from the repo root.`}}let n=S(e.interleaved||e.stdout||e.stderr||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:r??`ripgrep failed (exit ${e.exitCode}): ${n}`}}function we(e){let r=e.stdout??"",n=e.stderr??"",t=e.interleavedOutput??"";if(tn(e.command)){let i=r.trim()||t.trim()||n.trim();return nn({exitCode:e.exitCode,stdout:i,stderr:n})}if(on(e.command))return sn({command:e.command,exitCode:e.exitCode,stdout:r,stderr:n,interleaved:t});let o=J({command:e.command,exitCode:e.exitCode});if(o&&e.exitCode!==0)return{kind:"command_failure",exitCode:e.exitCode,summary:o};if(e.exitCode===0)return{kind:"success",exitCode:0,summary:"command succeeded (exit 0)"};let s=S(t||r||n||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:`command failed (exit ${e.exitCode}): ${s}`}}var qr,Oe,Xr,Ie=l(()=>{"use strict";Ae();qr=/\bnpm\s+audit\b/i,Oe=/\b(rg|ripgrep)\b/i,Xr=/\b(error|invalid|unknown|panic|not found)\b/i});import{existsSync as an,readFileSync as ln}from"node:fs";function un(e){let r=e.timestamp_ms;return e.timestamp||e.ts||(r?new Date(r).toISOString():void 0)}function cn(e){if(!e)return null;for(let r of Object.keys(e))if(r.endsWith("ToolCall")){let n=r.slice(0,-8);return n.length?n:r}return null}function dn(e,r){e.finalResult=r.result||r.subtype||r.terminal_reason||"completed",r.is_error&&(e.error=String(r.result||r.api_error_status||"stream result error"))}function mn(e){if(e.type!=="tool_call"||e.subtype!=="completed")return null;let n=(e.tool_call&&typeof e.tool_call=="object"&&!Array.isArray(e.tool_call)?e.tool_call:null)?.shellToolCall;if(!n||typeof n!="object"||Array.isArray(n))return null;let t=n,o=t.args,s=o&&typeof o=="object"&&!Array.isArray(o)&&typeof o.command=="string"?String(o.command):"",i=t.result;if(!i||typeof i!="object"||Array.isArray(i))return null;let a=i.success??i.failure;if(!a||typeof a!="object"||Array.isArray(a))return null;let u=a,m=typeof u.exitCode=="number"?u.exitCode:0;return{command:s,exitCode:m,stdout:typeof u.stdout=="string"?u.stdout:"",stderr:typeof u.stderr=="string"?u.stderr:"",interleaved:typeof u.interleavedOutput=="string"?u.interleavedOutput:""}}function fn(e,r){r.kind==="success"||r.kind==="search_no_matches"||(e.lastShellOutcome=r)}function Pe(e){let r={firstEventAt:null,lastEventAt:null,currentTool:null,finalResult:null,error:null,lastShellOutcome:null};if(!an(e))return r;let n=ln(e,"utf8").split(`
+`).filter(Boolean);for(let t of n){let o=A(t);if(!o)continue;let s=un(o);if(s&&(r.firstEventAt||=s,r.lastEventAt=s),o.type==="stream_event"&&o.event&&typeof o.event=="object"&&o.event.type==="content_block_start"){let a=o.event.content_block;a?.type==="tool_use"&&(r.currentTool=String(a.name||"tool"))}if(o.type==="assistant"&&o.message&&typeof o.message=="object"){let a=o.message.content;if(Array.isArray(a)){let u=a.find(m=>m?.type==="tool_use");u&&(r.currentTool=String(u.name||r.currentTool))}}if(o.type==="tool_call"&&o.subtype==="started"){let a=o.tool_call&&typeof o.tool_call=="object"&&!Array.isArray(o.tool_call)?o.tool_call:void 0,u=cn(a);u&&(r.currentTool=u)}let i=mn(o);i&&fn(r,we({command:i.command,exitCode:i.exitCode,stdout:i.stdout,stderr:i.stderr,interleavedOutput:i.interleaved})),o.type==="result"&&dn(r,o)}return r}var Ne=l(()=>{"use strict";Ie();p()});function gn(e,r=240){let n=e.replace(/\s+/g," ").trim();return n.length>r?`${n.slice(0,r-1)}\u2026`:n}function We(e){let r=(e??"").trim();if(!r)return null;for(let n of pn)if(n.test.test(r))return{blocked:!0,reason:`${n.label}: ${gn(r)}`};return null}var pn,Ke=l(()=>{"use strict";pn=[{test:/\b(?:invalid|unknown|unsupported|unrecognized)\b[^.\n]*\bmodel\b/i,label:"provider rejected the requested model"},{test:/\bmodel\b[^.\n]*\b(?:not\s+(?:found|supported|available|recognized|valid)|is\s+not\s+valid|does\s+not\s+exist)/i,label:"provider rejected the requested model"},{test:/\b(?:did you mean|available models|choose (?:a|one of)|supported models)\b/i,label:"provider rejected the requested model"},{test:/model preflight failed/i,label:"model/provider preflight failed"},{test:/\b(?:command not found|ENOENT|is the .*CLI on PATH|executable not found|no such file or directory)\b/i,label:"provider CLI is missing or not on PATH"},{test:/\bfailed to spawn\b/i,label:"provider failed to spawn the worker process"},{test:/\b(?:not logged in|unauthorized|authentication (?:failed|required)|invalid api key|missing api key|401)\b/i,label:"provider authentication failed"},{test:/\b(?:out of usage|increase limits?|switch to auto|ask your admin to increase your limit|usage limits?|quota exceeded|insufficient_quota|credits? exhausted|billing|payment required)\b/i,label:"provider quota exhausted"}]});function Te(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function hn(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="boolean"?e:Array.isArray(e)?e.length>0:typeof e=="object"?Object.keys(e).length>0:!0}function yn(e){return!e?.checked||e.headIsAncestorOfBase!==!1?null:Te(e.head)}function bn(e,r,n){let t=["exited_with_changes_salvage"];if((e==="uncommitted"||e==="both")&&t.push(`${r} uncommitted change${r===1?"":"s"} with no final result`),(e==="committed_ahead"||e==="both")&&n){let o=n.length>12?n.slice(0,12):n;t.push(`commit ${o} ahead of base with no final result`)}return t.push("review worktree \u2014 commit, open a PR, or run a salvage worker before discarding"),t.join(": ")}function Be(e){if(e.alive||hn(e.finalResult))return null;let r=(e.changedFiles??[]).filter(i=>i.trim()).length,n=Te(e.headCommit)??yn(e.gitAncestry),t=r>0,o=!!n;if(!t&&!o)return{kind:"none",salvageable:!1,uncommittedCount:0,headCommit:null,attentionReason:"process exited without a final result"};let s=t&&o?"both":t?"uncommitted":"committed_ahead";return{kind:s,salvageable:!0,uncommittedCount:r,headCommit:n,attentionReason:bn(s,r,n)}}var Ue=l(()=>{"use strict"});var kn,_t,Rn,vt,De=l(()=>{"use strict";kn=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],_t=new Set(kn),Rn=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN"],vt=new Set(Rn)});import{spawnSync as Fe}from"node:child_process";function xn(e,r,n={}){let t=Fe("git",r,Y({cwd:e,encoding:"utf8"}));if(t.status!==0&&!n.allowFailure){let o=`git ${r.join(" ")} failed: ${t.stderr||t.stdout}`;if(n.throwError)throw new Error(o);fe(o)}return t.stdout||""}function He(e){return xn(e,["status","--short"],{allowFailure:!0}).split(`
+`).map(r=>r.trim()).filter(Boolean)}function W(e,r){try{let n=Fe("git",r,Y({cwd:e,encoding:"utf8"}));return{status:n.status,stdout:n.stdout||"",stderr:n.stderr||"",error:n.error?n.error.message:null}}catch(n){return{status:null,stdout:"",stderr:"",error:n.message}}}function Me(e,r,n){let t=W(e,["merge-base","--is-ancestor",r,n]);return t.status===0?{isAncestor:!0,error:null}:t.status===1?{isAncestor:!1,error:null}:{isAncestor:null,error:t.error||t.stderr||t.stdout||`git exited ${t.status}`}}function Le(e,r="origin/main"){let n=typeof r=="string"?{base:r}:r,t=n.baseCommit?.trim()||n.base?.trim()||"origin/main",o=n.baseCommit?.trim()||null;if(!e)return q(t,"missing worktree path");let s=W(e,["rev-parse","HEAD"]);if(s.status!==0)return q(t,s.error||s.stderr||s.stdout||"failed to resolve HEAD");let i;if(o)i=o;else{let f=W(e,["rev-parse",t]);if(f.status!==0)return q(t,f.error||f.stderr||f.stdout||`failed to resolve ${t}`,s.stdout.trim());i=f.stdout.trim()}let a=s.stdout.trim();if(a===i)return{checked:!0,base:t,head:a,baseHead:i,baseIsAncestorOfHead:!0,headIsAncestorOfBase:!0,relation:"synced"};let u=Me(e,i,a),m=Me(e,a,i),d=u.error||m.error||void 0;if(u.isAncestor==null||m.isAncestor==null)return{checked:!1,base:t,head:a,baseHead:i,baseIsAncestorOfHead:u.isAncestor,headIsAncestorOfBase:m.isAncestor,relation:"unknown",...d?{error:d}:{}};let c=u.isAncestor?"ahead":m.isAncestor?"merged":"diverged";return{checked:!0,base:t,head:a,baseHead:i,baseIsAncestorOfHead:u.isAncestor,headIsAncestorOfBase:m.isAncestor,relation:c,...d?{error:d}:{}}}function q(e,r,n=null){return{checked:!1,base:e,head:n,baseHead:null,baseIsAncestorOfHead:null,headIsAncestorOfBase:null,relation:"unknown",error:r}}var X=l(()=>{"use strict";p();De()});function v(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function Sn(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="boolean"?e:Array.isArray(e)?e.length>0:typeof e=="object"?Object.keys(e).length>0:!0}function _n(e){if(v(e.headCommit)||v(e.prUrl)||v(e.artifactBundlePath)||v(e.patchPath))return!0;let r=e.gitAncestry;return!!(r?.checked&&r.headIsAncestorOfBase===!1&&v(r.head))}function $e(e){return Sn(e.finalResult)?e.changedFiles.length===0?{blocked:!1}:_n(e)?{blocked:!0,detail:`Worktree has ${e.changedFiles.length} uncommitted change(s); commit or discard before landing`}:{blocked:!0,reason:"dirty_worktree_no_pr",detail:`Worktree has ${e.changedFiles.length} uncommitted change(s) with no commit or PR; commit, open a PR, or discard before landing`}:{blocked:!1}}function je(e){if(e.blocked)return e.detail??e.reason??"dirty_worktree_no_pr"}var Ye=l(()=>{"use strict"});function Z(e){let r=e.trim();if(!r.startsWith("{"))return null;try{let n=JSON.parse(r);if(n&&typeof n=="object"&&!Array.isArray(n))return n}catch{return null}return null}function Ve(e){let r=e.targetPrReconciliation??e.target_pr_reconciliation??e.targetPrs??e.target_prs;return Array.isArray(r)?r.length:0}function K(e){let r=e.trim();if(!r)return null;let n=Z(r);if(n)return n;let t=[],o=/```(?:json)?\s*([\s\S]*?)```/gi,s;for(;(s=o.exec(r))!==null;){let d=Z(s[1]??"");d&&t.push(d)}let i=r.indexOf("{"),a=r.lastIndexOf("}");if(i>=0&&a>i){let d=Z(r.slice(i,a+1));d&&t.push(d)}if(t.length===0)return null;let u=t[t.length-1],m=Ve(u);for(let d of t){let c=Ve(d);c>m&&(u=d,m=c)}return u}var Q=l(()=>{"use strict"});function Ge(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`https://github.com/${r[1]}/pull/${r[2]}`:e.trim()||null}function ze(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`${r[1].toLowerCase()}/pull/${r[2]}`:e.trim().toLowerCase()}function vn(e){return new Set(e.map(r=>ze(Ge(r)??r)).filter(Boolean))}function Je(e,r,n){let t=Ge(e)??e;if(!t)return"unrelated";let o=ze(t);return vn(r).has(o)?"contract":n?(n.outcome==="skipped"||n.outcome==="blocked")&&n.reason?.trim()?"support":(n.outcome==="merged","unrelated"):"unrelated"}var qe=l(()=>{"use strict"});function R(e){if(typeof e!="string")return null;let r=e.trim();return r.length?r:null}function En(e){return e==null?!1:typeof e=="string"?e.trim().length>0:typeof e=="object"?Object.keys(e).length>0:!0}function b(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`https://github.com/${r[1]}/pull/${r[2]}`:R(e)}function T(e){let r=e.trim().match(/github\.com\/([^/]+\/[^/]+)\/(?:pull|pulls)\/(\d+)/i);return r?`${r[1].toLowerCase()}/pull/${r[2]}`:e.trim().toLowerCase()}function Xe(e){let r=null;if(typeof e=="string"){let o=K(e);o&&(r=o)}else e&&typeof e=="object"&&!Array.isArray(e)&&(r=e);if(!r)return[];let n=r.targetPrReconciliation??r.target_pr_reconciliation;if(!Array.isArray(n))return[];let t=[];for(let o of n){if(!o||typeof o!="object"||Array.isArray(o))continue;let s=o,i=b(String(s.prUrl??s.pr_url??"")),a=R(s.outcome);!i||a!=="merged"&&a!=="skipped"&&a!=="blocked"||t.push({prUrl:i,outcome:a,mergeCommit:R(s.mergeCommit??s.merge_commit),reason:R(s.reason)})}return t}function Ze(e,r){let n=[],t=b(R(e.prUrl)??"");if(t&&n.push(t),r&&typeof r=="object"&&!Array.isArray(r)){let o=r,s=b(String(o.prUrl??o.pr_url??""));s&&n.push(s)}return[...new Set(n)]}function Qe(e){let{contract:r,snapshot:n}=e,t=e.finalResult??n.finalResult;if(!r.landingOnly&&r.targetPrUrls.length===0&&!r.repairEnforceOriginalPr)return{blocked:!1};if(!En(t))return(r.requiresTargetPrReconciliation??(r.landingOnly||!!r.repairEnforceOriginalPr||r.targetPrUrls.length>0))&&r.targetPrUrls.length>0?{blocked:!0,reason:"missing_target_pr_reconciliation",detail:`Final result required to reconcile target PR(s): ${r.targetPrUrls.join(", ")}`}:{blocked:!1};if(!(r.requiresTargetPrReconciliation??(r.landingOnly||!!r.repairEnforceOriginalPr||r.targetPrUrls.length>0))&&!r.repairEnforceOriginalPr)return{blocked:!1};let s=r.repairEnforceOriginalPr?b(R(r.targetPrUrl)??"")??(r.targetPrUrls.length===1?b(r.targetPrUrls[0]):null):null;if(s){let c=Ze(n,t);if(!(t&&typeof t=="object"&&!Array.isArray(t)&&t.supersedesOriginalTargetPr===!0)){for(let y of c)if(y!==s)return{blocked:!0,reason:"duplicate_repair_pr",detail:`Repair worker opened or attached PR ${y} instead of canonical target ${s}`}}let h=Xe(t).find(y=>y.prUrl===s);if(!h||h.outcome!=="merged"&&!(h.reason?.trim()&&(h.outcome==="skipped"||h.outcome==="blocked")))return{blocked:!0,reason:"missing_repair_target_reconciliation",detail:`Repair worker must reconcile target PR ${s}`}}let i=Xe(t),a=new Map(i.map(c=>[T(c.prUrl),c])),u=new Set(r.targetPrUrls.map(c=>T(b(c)??c)).filter(Boolean)),m=Ze(n,t);if(r.landingOnly)for(let c of m){let f=a.get(T(c)),g=Je(c,r.targetPrUrls,f);if(!(g==="contract"||g==="support"))return u.size>0?{blocked:!0,reason:"unrelated_implementation_pr",detail:`Landing-only worker attached unrelated PR ${c}`}:{blocked:!0,reason:"unrelated_implementation_pr",detail:"Landing-only worker must not open new implementation PRs"}}if(r.targetPrUrls.length===0)return{blocked:!1};let d=[];for(let c of r.targetPrUrls){let f=T(b(c)??c),g=a.get(f);if(!g){d.push(f);continue}g.outcome!=="merged"&&!g.reason?.trim()&&d.push(f)}return d.length>0?{blocked:!0,reason:d.every(c=>a.has(c))?"incomplete_target_pr_landing":"missing_target_pr_reconciliation",detail:`Target PR reconciliation incomplete: ${d.join(", ")}`}:{blocked:!1}}function er(e){if(e.blocked)return e.detail??e.reason}var rr=l(()=>{"use strict";Q();qe()});function An(e){let r=Date.now();if(e.completionBlocker&&!nr(e.completionBlocker))return{state:"blocked",reason:e.completionBlocker};if(e.finalResult){if(e.localOnly&&wn(e.finalResult))return{state:"done",reason:"local-only worker superseded by merged PR"};let o={finalResult:e.finalResult,changedFiles:e.changedFiles??[],gitAncestry:e.gitAncestry??null,prUrl:e.prUrl??null},s=$e(o);if(s.blocked){let i=je(s);return{state:"needs_attention",reason:s.reason?`landing blocked (${s.reason}): ${i}`:`landing blocked: ${i}`}}if(e.landingContract){let i=Qe({contract:e.landingContract,snapshot:o,finalResult:e.finalResult}),a=er(i);if(a)return{state:"needs_attention",reason:i.reason?`landing contract (${i.reason}): ${a}`:`landing contract: ${a}`}}return{state:"done",reason:"final result recorded"}}if(!e.alive){if(On(e))return{state:"done",reason:"empty abandoned worker record"};let o=We(e.error);if(o)return{state:"blocked",reason:o.reason};let s=Be({alive:!1,finalResult:null,changedFiles:e.changedFiles,gitAncestry:e.gitAncestry});if(s?.salvageable){let a=e.error?.trim();return{state:"needs_attention",reason:a?`${s.attentionReason} (${a})`:s.attentionReason}}let i=e.error?.trim();return{state:"needs_attention",reason:i?`process exited without a final result: ${i}`:s?.attentionReason??"process exited without a final result"}}if(e.heartbeatBlocker)return{state:"blocked",reason:`worker heartbeat reported blocker: ${e.heartbeatBlocker}`};let n=e.startedAt?Date.parse(e.startedAt):NaN;if(!e.firstEventAt&&e.stdoutBytes===0&&e.heartbeatBytes===0&&Number.isFinite(n)&&r-n>Cn)return{state:"needs_attention",reason:`no first stream event ${V(n)}s after start`};let t=e.lastActivityAt?Date.parse(e.lastActivityAt):NaN;return Number.isFinite(t)&&r-t>B?{state:"stale",reason:`no log/event/heartbeat activity for ${V(t)}s`}:{state:"ok",reason:"recent activity"}}function nr(e){let r=e?.trim();return r?/completion acknowledged but board not advanced/i.test(r)&&/task already terminal/i.test(r):!1}function On(e){return e.finalResult||e.taskId||e.agentOsId||e.stdoutBytes>0||(e.stderrBytes??0)>0||e.heartbeatBytes>0||e.error?.trim()||(e.changedFiles??[]).some(r=>r.trim())?!1:/empty worker dir|marked abandoned/i.test(e.reconcileReason??"")}function wn(e){let r=null;if(typeof e=="string"?r=K(e):e&&typeof e=="object"&&!Array.isArray(e)&&(r=e),!r)return!1;let n=r.targetPrReconciliation??r.target_pr_reconciliation;return Array.isArray(n)?n.some(t=>!t||typeof t!="object"||Array.isArray(t)?!1:String(t.outcome??"").trim()==="merged"):!1}function In(e,r,n){let t=e.completionSnapshot?.finalResult;return e.completionAckSource==="local-pr-merged-reconcile"&&t!==void 0&&t!==null?t:r||(t??ye(n))}function tr(e,r={}){let n=Pe(e.stdoutPath),t=be(e.heartbeatPath),o=typeof e.completionReportedAt=="string"&&e.completionReportedAt.trim().length>0,s=In(e,n.finalResult,t),i=o?!1:I(e.pid),a=O(e.stdoutPath),u=O(e.stderrPath),m=O(e.heartbeatPath),d=He(e.worktreePath),c=Le(e.worktreePath,{base:r.base,baseCommit:r.baseCommit}),f=ge([n.lastEventAt,t.lastHeartbeatAt,w(e.stdoutPath),w(e.stderrPath),w(e.heartbeatPath)]),g=n.error||!i&&!s&&pe(e.stderrPath,10).trim()||void 0,h=typeof e.completionBlocker=="string"&&e.completionBlocker.trim()?e.completionBlocker.trim():null,y=nr(h)?null:h,Ir=e.repairTargetPrUrl?{landingOnly:!1,targetPrUrls:[e.repairTargetPrUrl],targetPrUrl:e.repairTargetPrUrl,repairEnforceOriginalPr:!0}:null,$=An({alive:i,finalResult:s,firstEventAt:n.firstEventAt,stdoutBytes:a,stderrBytes:u,heartbeatBytes:m,lastActivityAt:f,heartbeatBlocker:t.heartbeatBlocker,startedAt:e.startedAt,error:g,changedFiles:d,gitAncestry:c,completionBlocker:y,landingContract:Ir,prUrl:e.repairTargetPrUrl??e.taskPrUrl??null,localOnly:e.localOnly===!0,taskId:e.taskId??null,agentOsId:e.agentOsId??null,reconcileReason:e.reconcileReason??null}),Pr=y||$.state==="blocked"?"blocked":o||$.state==="done"?"done":s?"exited":i?"running":"exited";return{runId:e.runId,worker:e.name,pid:e.pid,alive:i,status:Pr,attention:$,branch:e.branch,worktreePath:e.worktreePath,ownedPaths:e.ownedPaths,stdoutBytes:a,stderrBytes:u,heartbeatBytes:m,firstEventAt:n.firstEventAt,lastEventAt:n.lastEventAt,lastActivityAt:f,currentTool:o?null:n.currentTool,heartbeatCount:t.heartbeatCount,lastHeartbeatAt:t.lastHeartbeatAt,lastHeartbeatPhase:t.lastHeartbeatPhase,lastHeartbeatSummary:t.lastHeartbeatSummary,heartbeatBlocker:t.heartbeatBlocker,timestampAnomalies:t.timestampAnomalies,finalResult:s,error:g,changedFiles:d,gitAncestry:c,instructionPolicyFingerprint:e.instructionPolicyFingerprint??null,instructionPolicyEvidence:e.instructionPolicyEvidence??null,model:e.model??e.orchestrationAudit?.model??null,provider:e.provider??e.orchestrationAudit?.provider??null,boxKind:e.boxKind??null,boxId:e.boxId??null,runtimeId:e.runtimeId??null,personaSlug:e.personaSlug??null,dispatched:e.dispatched??null,localOnly:e.localOnly??null}}function or(e){return!!(e.finalResult||e.alive===!1||e.status==="exited"||e.status==="done")}function sr(e){return e.finalResult?e.attention.state==="needs_attention"||e.attention.state==="blocked":!1}var Cn,B,E=l(()=>{"use strict";ke();Ne();Ke();Ue();X();Ye();rr();Q();p();Cn=18e4,B=6e5});var C=l(()=>{"use strict"});var ee=l(()=>{"use strict";X();C()});var k=l(()=>{"use strict"});var U=l(()=>{"use strict"});var ur=l(()=>{"use strict"});var io,ao,re=l(()=>{"use strict";io=25*1024*1024*1024,ao=12*1024*1024*1024});var fo,po,cr=l(()=>{"use strict";re();fo=5*1024*1024*1024,po=10*1024*1024*1024});var Ro,xo,ne=l(()=>{"use strict";cr();re();Ro=30*1024*1024*1024,xo=15*1024*1024*1024});var dr=l(()=>{"use strict";D();p()});var mr=l(()=>{"use strict";E()});var Un,Dn,gr=l(()=>{"use strict";ur();x();k();U();M();ne();D();dr();mr();p();Un=500*1024*1024,Dn=4*1024*1024*1024});var M=l(()=>{"use strict";gr()});import{homedir as Fn}from"node:os";import Hn from"node:path";var hr,se=l(()=>{"use strict";hr=Hn.join(Fn(),".kynver",".env")});var yr=l(()=>{"use strict"});var br=l(()=>{"use strict";yr()});var kr=l(()=>{"use strict"});var ie=l(()=>{"use strict";br();kr()});var Rr=l(()=>{"use strict"});var xr=l(()=>{"use strict";Rr()});var F=l(()=>{"use strict";se();C();x();ie();xr()});var Sr=l(()=>{"use strict";k();k()});var _r=l(()=>{"use strict";se();ie();F()});var vr=l(()=>{"use strict";p()});import Vn from"node:path";var Hs,ae=l(()=>{"use strict";C();vr();Hs=Vn.join(".openclaw","harness")});var L=l(()=>{"use strict";x();k();U();M();ae()});var Cr=l(()=>{"use strict";ee();k();Sr();x();F();_r();p();L()});import{homedir as Zn,totalmem as fi}from"node:os";import le from"node:path";var Ar,Ei,Ci,Ai,Oi,x=l(()=>{"use strict";ee();C();p();k();U();M();ne();F();Cr();L();Ar=le.join(Zn(),".kynver"),Ei=le.join(Ar,"config.json"),Ci=le.join(Ar,"credentials"),Ai=500*1024*1024,Oi=4*1024*1024*1024});var Or=l(()=>{"use strict";x();ae();L();p()});var D=l(()=>{"use strict";Or();p()});E();var ir="kynver-harness:",Pn="@runner:";function ar(e){return e?.trim()?e.trim():null}function Nn(e){let r=ar(e);if(!r?.startsWith(ir))return null;let n=r.slice(ir.length),t=n.indexOf(Pn);return t>=0?n.slice(0,t).trim()||null:n.trim()||null}function lr(e,r){let n=ar(r);return n?Nn(e)===n:!1}E();p();function Wn(e){let{worker:r,status:n,taskLease:t}=e,o=t?.leaseOwner??null;if(r.dispatched&&t){if(t.status==="running"&&o&&!lr(o,r.runId))return{health:"orphaned",reason:`task lease held by ${o}, expected harness run ${r.runId}`};let i=r.leaseToken?.trim()??"",a=t.leaseToken?.trim()??"";if(t.status==="running"&&i&&a&&i!==a)return{health:"orphaned",reason:"task leaseToken superseded on board \u2014 completion replay would fail"};if(t.status==="running"&&!n.alive&&!n.finalResult)return{health:"orphaned",reason:"board task running but worker process is not alive"}}if(r.status==="running"&&!n.alive&&!n.finalResult)return{health:"orphaned",reason:"worker.json still running but process is dead"};if(n.attention.state==="stale")return{health:"stale",reason:n.attention.reason};let s=n.lastHeartbeatAt?Date.parse(n.lastHeartbeatAt):NaN;return n.alive&&Number.isFinite(s)&&Date.now()-s>B?{health:"stale",reason:`heartbeat older than ${Math.floor(B/1e3)}s`}:n.alive&&r.pid&&!I(r.pid)?{health:"orphaned",reason:"pid recorded but process is not alive"}:t?.status==="running"&&!n.alive&&n.finalResult?{health:"healthy",reason:"finished worker awaiting completion replay"}:{health:"healthy",reason:n.attention.reason||"worker within expected lifecycle bounds"}}D();function wr(e){return!!e.completionReportedAt?.trim()}E();function Qn(e){let{worker:r,status:n}=e,t=[];r.localOnly&&t.push("local-only worker (no board linkage)"),(!r.agentOsId||!r.taskId)&&t.push("missing agentOsId/taskId linkage"),wr(r)&&t.push("completion already acknowledged"),r.completionBlocker&&t.push(r.completionBlocker),n.heartbeatBlocker&&n.alive&&t.push(`worker heartbeat blocker: ${n.heartbeatBlocker}`),n.attention.state==="blocked"&&t.push(n.attention.reason||"worker attention blocked"),sr(n)&&t.push(n.attention.reason||"landing gate blocked");let o=or(n),s;return o?n.finalResult?s="final_result":n.alive?s="terminal_status":s="process_exited":t.push("worker has not reached a terminal condition"),{eligible:o&&t.length===0,terminalVerified:o,terminalReason:s,blockers:t}}export{Qn as assessAutoCompleteEligibility,Wn as classifyWorkerHealth,tr as computeWorkerStatus};

package/dist/server/worker-policy.d.ts

@@ -1,4 +1,4 @@
-export { auditWorkerEnv, scrubWorkerEnv, listForbiddenWorkerEnvKeys, isForbiddenWorkerEnvKey, } from "../worker-env.js";
+export { auditWorkerEnv, scrubWorkerEnv, listForbiddenWorkerEnvKeys, listOperatorAllowedWorkerEnvKeys, isForbiddenWorkerEnvKey, } from "../worker-env.js";
 export { auditReviewWorkerCredentialScope, buildWorkerSpawnEnv, isNoProdCredentialReviewEnvironment, KYNVER_NO_PROD_DB_CREDENTIALS_ENV, } from "../security-review-environment.js";
 export { isHarnessExpertReviewWorker } from "../harness-expert-review.js";
 export { DEFAULT_WORKER_PROVIDER, resolveConfiguredWorkerProvider, isClaudeFamilyProvider, taskAllowsClaudeWorker, enforceCursorWorkerProvider, preferCursorExecutor, type EnforceCursorWorkerProviderInput, } from "../worker-provider-policy.js";

package/dist/server/worker-policy.js

@@ -1 +1 @@
-var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function U(e){return lr.has(e)?!0:cr.some(r=>e.endsWith(r))}function le(e){return Object.keys(e).filter(U).sort()}function S(e){let r={...e};for(let t of Object.keys(r))U(t)&&delete r[t];return r}function ur(e){let r=le(e);return{forbiddenPresent:r,safe:r.length===0}}var ar,lr,cr,_=o(()=>{"use strict";ar=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY"],lr=new Set(ar),cr=["_SECRET","_API_KEY"]});function H(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict"});var j=o(()=>{"use strict";a();_()});var y=o(()=>{"use strict"});var V=o(()=>{"use strict";j();y()});var m=o(()=>{"use strict"});var E=o(()=>{"use strict"});var ge=o(()=>{"use strict"});var Yt,Gt,Y=o(()=>{"use strict";Yt=25*1024*1024*1024,Gt=12*1024*1024*1024});var Qt,Zt,he=o(()=>{"use strict";Y();Qt=5*1024*1024*1024,Zt=10*1024*1024*1024});var sn,an,G=o(()=>{"use strict";he();Y();sn=30*1024*1024*1024,an=15*1024*1024*1024});var ve=o(()=>{"use strict";a()});import _r from"node:path";var hn,z=o(()=>{"use strict";y();ve();hn=_r.join(".openclaw","harness")});var O=o(()=>{"use strict";p();m();E();A();z()});var Re=o(()=>{"use strict";p();z();O();a()});var J=o(()=>{"use strict";Re();a()});var ke=o(()=>{"use strict";J();a()});var Se=o(()=>{"use strict"});var _e=o(()=>{"use strict";Se();a()});var Ee=o(()=>{"use strict"});var Ce=o(()=>{"use strict";Ee()});var Oe=o(()=>{"use strict";Ce();a()});var Ae=o(()=>{"use strict"});var Ie=o(()=>{"use strict"});var we=o(()=>{"use strict"});var X=o(()=>{"use strict"});var Pe=o(()=>{"use strict"});var Ne=o(()=>{"use strict";X();Pe()});var De=o(()=>{"use strict";_e();Oe();Ae();Ie();j();we();Ne();X();a()});var Be=o(()=>{"use strict";De()});var Nr,Dr,Te=o(()=>{"use strict";ge();p();m();E();A();G();J();ke();Be();a();Nr=500*1024*1024,Dr=4*1024*1024*1024});var A=o(()=>{"use strict";Te()});import{homedir as Br}from"node:os";import Tr from"node:path";var We,Q=o(()=>{"use strict";We=Tr.join(Br(),".kynver",".env")});var Ke=o(()=>{"use strict"});var Me=o(()=>{"use strict";Ke()});var Ue=o(()=>{"use strict"});var Z=o(()=>{"use strict";Me();Ue()});var Fe=o(()=>{"use strict"});var Le=o(()=>{"use strict";Fe()});var w=o(()=>{"use strict";Q();y();p();Z();Le()});var He=o(()=>{"use strict";m();m()});var $e=o(()=>{"use strict";Q();Z();w()});var je=o(()=>{"use strict";V();m();He();p();w();$e();a();O()});import{homedir as $r,totalmem as ms}from"node:os";import ee from"node:path";var Ve,_s,Es,Cs,Os,p=o(()=>{"use strict";V();y();a();m();E();A();G();w();je();O();Ve=ee.join($r(),".kynver"),_s=ee.join(Ve,"config.json"),Es=ee.join(Ve,"credentials"),Cs=500*1024*1024,Os=4*1024*1024*1024});_();_();var F="KYNVER_NO_PROD_DB_CREDENTIALS",dr=["KYNVER_ENV_FILE"],mr=new Set(["1","true","yes","on"]);function ue(e){let r=e[F]?.trim().toLowerCase();return r!==void 0&&mr.has(r)}function h(e,r={}){let t=S(e);if(!r.reviewWorker)return t;let n={...t,[F]:"1"};for(let i of dr)delete n[i];return n}var ce=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function pr(e,r={}){let t=h(e,r),n=Object.keys(t).filter(u=>u.endsWith("_SECRET")||u.endsWith("_API_KEY")||ce.includes(u)),i=ce.every(u=>t[u]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=ue(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var fr="expert-lane-pr-review:",gr="plan-review-task",hr="scheduledjob:";function de(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function yr(e){let r=(e.executorRef??"").toLowerCase();if(r.startsWith(fr)||r===gr||r.startsWith("daemon-review:"))return!0;if(r.startsWith(hr)&&e.parentTaskId){let n=de(e.personaSlug);if(n==="lorentz"||n==="dalton")return!0}let t=(e.title??"").toLowerCase();if(t.includes("expert pr review"))return!0;if(e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))){let n=de(e.personaSlug);if(n==="lorentz"||n==="dalton")return!0}return!1}var vr=/^claude[-_]/i,br=/^(?:opus|sonnet|haiku)\b/i;function me(e){let r=e.trim();return vr.test(r)||br.test(r)}function pe(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function fe(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function xr(e){return pe(e)?"codex":me(e)?"claude":(fe(e),"cursor")}function Rr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:null:null}function kr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?me(n)||pe(n)||fe(n)?{lane:t,model:n,provider:xr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function L(e){let r=typeof e=="string"?e.trim():"";return r?Rr(r)??kr(r):null}p();a();a();a();var Ra=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function zr(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var qr=zr();var ze="composer-2.5";var d="cursor",Jr=new Set(["claude","opus","anthropic"]),Xr=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function D(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function c(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Jr.has(r)?!0:r.includes("claude")||r.includes("opus")}function re(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&c(r))return!0;let t=D(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=L(D(e,"executorRef"));if(n?.provider&&c(n.provider)||n?.model&&c(Qr(n.model)))return!0;let i=D(e,"description");if(Xr.some(l=>l.test(i)))return!0;let s=D(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function Qr(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Zr(e,r){return{provider:d,model:ze,rule:`policy:cursor_default${r}`,requestedModel:e}}function qe(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&c(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(re(t)||r.rule==="explicit:cli"&&c(r.provider)||!c(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Zr(r.model,i)}function et(e,r=d){let t=e?.trim();return t?c(t)?d:t==="codex"?"codex":t:r}function rt(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(d)?[...new Set(r.map(t=>c(t)?d:t))]:r.every(t=>c(t))?[d]:r}var tt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,nt=/\b(npm run build\b|next build\b)\b/i,ot=/\b(vercel (build|deploy|--prod))\b/i,it=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function te(e){let r=e.trim();return r?it.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:ot.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:nt.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:tt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var B="heavy_verification_token_required";import{spawnSync as St}from"node:child_process";a();import{closeSync as dt,existsSync as x,mkdirSync as mt,openSync as pt,readdirSync as Ze,readFileSync as ft,statSync as gt,unlinkSync as er,writeFileSync as ht}from"node:fs";import ie from"node:path";import{mkdirSync as at}from"node:fs";import{tmpdir as lt}from"node:os";import T from"node:path";import{homedir as st}from"node:os";import Je from"node:path";function Xe(){let e=process.env.KYNVER_STATE_ROOT;return e?Je.resolve(e):Je.join(st(),".kynver","state")}function ct(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function ut(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?T.resolve(e):ct()?T.join(lt(),"kynver","state","heavy-verification"):T.join(Xe(),"heavy-verification")}function ne(){return T.join(ut(),"slots")}function b(){let e=ne();return at(e,{recursive:!0}),e}var R=120*6e4,Qe=1;function yt(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function K(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function W(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?yt(e,Qe):Qe}function vt(e){return`slot-${e}`}function bt(e,r=ne()){return ie.join(r,`${e}.json`)}function se(e){if(!x(e))return null;try{let r=JSON.parse(ft(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function rr(e,r=R){if(!e||!H(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function tr(e,r){let t=se(e);if(t)return rr(t,r);if(!x(e))return!0;try{return Date.now()-gt(e).mtimeMs>r}catch{return!0}}function xt(e,r){if(tr(e,r))try{er(e)}catch{}}function Rt(e){return mt(e,{recursive:!0}),e}function ae(e={}){let r=Rt(e.slotsDir??b()),t=e.staleMs??R,n=0;for(let i of Ze(r)){if(!i.endsWith(".json"))continue;let s=ie.join(r,i),l=x(s);xt(s,t),l&&!x(s)&&(n+=1)}return n}function kt(e={}){let r=e.slotsDir??b(),t=e.staleMs??R;ae({slotsDir:r,staleMs:t});let n=[];for(let i of Ze(r)){if(!i.endsWith(".json"))continue;let s=se(ie.join(r,i));s&&!rr(s,t)&&n.push(s)}return n}function oe(e={}){return kt(e).length}function k(e,r={}){if(K())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:W(),reason:null};let t=r.slotsDir??b(),n=r.staleMs??R,i=r.maxSlots??W();ae({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let u=vt(l),f=bt(u,t),or=se(f);if(tr(f,n))try{er(f)}catch{}else if(or||x(f))continue;let ir={slotId:u,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let g=pt(f,"wx");ht(g,JSON.stringify(ir,null,2),"utf8"),dt(g);let sr=oe({slotsDir:t,staleMs:n});return{admitted:!0,slotId:u,activeSlots:sr,maxSlots:i,reason:null}}catch(g){if(g.code==="EEXIST")continue;throw g}}let s=oe({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function M(e,r={}){if(K())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:W(),reason:null};let t=r.slotsDir??b(),n=r.staleMs??R,i=r.maxSlots??W();ae({slotsDir:t,staleMs:n});let s=oe({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function _t(e){e<=0||St(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function nr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=k(e,n);for(;!s.admitted&&Date.now()<i;)_t(Math.min(t,i-Date.now())),s=k(e,n);return s}function Et(e,r={}){let t=te(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...M(e),slotId:null}};if(K())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...M(e),slotId:null}};let n=r.waitMs??0,i=n>0?nr(e,n,r.pollMs):k(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:B,commandClass:t.commandClass,reason:t.reason??i.reason??B,verificationGate:i}}export{d as DEFAULT_WORKER_PROVIDER,B as HEAVY_VERIFICATION_TOKEN_REQUIRED,F as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,pr as auditReviewWorkerCredentialScope,ur as auditWorkerEnv,h as buildWorkerSpawnEnv,te as classifyHeavyShellCommand,qe as enforceCursorWorkerProvider,Et as gateWorkerShellCommand,c as isClaudeFamilyProvider,U as isForbiddenWorkerEnvKey,yr as isHarnessExpertReviewWorker,ue as isNoProdCredentialReviewEnvironment,le as listForbiddenWorkerEnvKeys,rt as preferCursorExecutor,et as resolveConfiguredWorkerProvider,S as scrubWorkerEnv,re as taskAllowsClaudeWorker};
+var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function L(e){let r=e[gr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function h(e,r={}){return ur.has(e)?!0:pr.has(e)||r.operatorAllow?.has(e)||fr.some(t=>e.endsWith(t))?!1:dr.some(t=>e.endsWith(t))}function ce(e){let r=L(e);return Object.keys(e).filter(t=>h(t,{operatorAllow:r})).sort()}function ue(e){let r=L(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!h(t,{operatorAllow:r})&&h(t)).sort()}function S(e){let r=L(e),t={...e};for(let n of Object.keys(t))h(n,{operatorAllow:r})&&delete t[n];return t}function hr(e){let r=ce(e),t=ue(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var cr,ur,dr,mr,pr,fr,gr,E=o(()=>{"use strict";cr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],ur=new Set(cr),dr=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],mr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN"],pr=new Set(mr),fr=["_PUBLIC_KEY"],gr="KYNVER_WORKER_ENV_ALLOW"});function $(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict"});var V=o(()=>{"use strict";a();E()});var v=o(()=>{"use strict"});var Y=o(()=>{"use strict";V();v()});var m=o(()=>{"use strict"});var C=o(()=>{"use strict"});var ye=o(()=>{"use strict"});var Qt,Zt,G=o(()=>{"use strict";Qt=25*1024*1024*1024,Zt=12*1024*1024*1024});var on,sn,ve=o(()=>{"use strict";G();on=5*1024*1024*1024,sn=10*1024*1024*1024});var mn,pn,z=o(()=>{"use strict";ve();G();mn=30*1024*1024*1024,pn=15*1024*1024*1024});var Re=o(()=>{"use strict";a()});import Ir from"node:path";var kn,J=o(()=>{"use strict";v();Re();kn=Ir.join(".openclaw","harness")});var A=o(()=>{"use strict";p();m();C();w();J()});var _e=o(()=>{"use strict";p();J();A();a()});var X=o(()=>{"use strict";_e();a()});var Se=o(()=>{"use strict";X();a()});var Ee=o(()=>{"use strict"});var Ce=o(()=>{"use strict";Ee();a()});var Oe=o(()=>{"use strict"});var Ae=o(()=>{"use strict";Oe()});var we=o(()=>{"use strict";Ae();a()});var Ie=o(()=>{"use strict"});var Pe=o(()=>{"use strict"});var Ne=o(()=>{"use strict"});var Q=o(()=>{"use strict"});var De=o(()=>{"use strict"});var Be=o(()=>{"use strict";Q();De()});var Te=o(()=>{"use strict";Ce();we();Ie();Pe();V();Ne();Be();Q();a()});var We=o(()=>{"use strict";Te()});var Ur,Mr,Ke=o(()=>{"use strict";ye();p();m();C();w();z();X();Se();We();a();Ur=500*1024*1024,Mr=4*1024*1024*1024});var w=o(()=>{"use strict";Ke()});import{homedir as Lr}from"node:os";import Fr from"node:path";var Ue,Z=o(()=>{"use strict";Ue=Fr.join(Lr(),".kynver",".env")});var Me=o(()=>{"use strict"});var Le=o(()=>{"use strict";Me()});var Fe=o(()=>{"use strict"});var ee=o(()=>{"use strict";Le();Fe()});var He=o(()=>{"use strict"});var $e=o(()=>{"use strict";He()});var P=o(()=>{"use strict";Z();v();p();ee();$e()});var je=o(()=>{"use strict";m();m()});var Ve=o(()=>{"use strict";Z();ee();P()});var Ye=o(()=>{"use strict";Y();m();je();p();P();Ve();a();A()});import{homedir as Jr,totalmem as vs}from"node:os";import re from"node:path";var Ge,Is,Ps,Ns,Ds,p=o(()=>{"use strict";Y();v();a();m();C();w();z();P();Ye();A();Ge=re.join(Jr(),".kynver"),Is=re.join(Ge,"config.json"),Ps=re.join(Ge,"credentials"),Ns=500*1024*1024,Ds=4*1024*1024*1024});E();E();var F="KYNVER_NO_PROD_DB_CREDENTIALS",yr=["KYNVER_ENV_FILE"],vr=new Set(["1","true","yes","on"]);function me(e){let r=e[F]?.trim().toLowerCase();return r!==void 0&&vr.has(r)}function y(e,r={}){let t=S(e);if(!r.reviewWorker)return t;let n={...t,[F]:"1"};for(let i of yr)delete n[i];return n}var de=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function br(e,r={}){let t=y(e,r),n=Object.keys(t).filter(u=>u.endsWith("_SECRET")||u.endsWith("_API_KEY")||de.includes(u)),i=de.every(u=>t[u]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=me(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var Rr="expert-lane-pr-review:",xr="plan-review-task",kr="scheduledjob:";function pe(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function _r(e){let r=(e.executorRef??"").toLowerCase();if(r.startsWith(Rr)||r===xr||r.startsWith("daemon-review:"))return!0;if(r.startsWith(kr)&&e.parentTaskId){let n=pe(e.personaSlug);if(n==="lorentz"||n==="dalton")return!0}let t=(e.title??"").toLowerCase();if(t.includes("expert pr review"))return!0;if(e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))){let n=pe(e.personaSlug);if(n==="lorentz"||n==="dalton")return!0}return!1}var Sr=/^claude[-_]/i,Er=/^(?:opus|sonnet|haiku)\b/i;function fe(e){let r=e.trim();return Sr.test(r)||Er.test(r)}function ge(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function he(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Cr(e){return ge(e)?"codex":fe(e)?"claude":(he(e),"cursor")}function Or(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:null:null}function Ar(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?fe(n)||ge(n)||he(n)?{lane:t,model:n,provider:Cr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function H(e){let r=typeof e=="string"?e.trim():"";return r?Or(r)??Ar(r):null}p();a();a();a();var Oa=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4";function et(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.4"}var rt=et();var qe="composer-2.5";var d="cursor",tt=new Set(["claude","opus","anthropic"]),nt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function B(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function c(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return tt.has(r)?!0:r.includes("claude")||r.includes("opus")}function te(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&c(r))return!0;let t=B(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=H(B(e,"executorRef"));if(n?.provider&&c(n.provider)||n?.model&&c(ot(n.model)))return!0;let i=B(e,"description");if(nt.some(l=>l.test(i)))return!0;let s=B(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function ot(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function it(e,r){return{provider:d,model:qe,rule:`policy:cursor_default${r}`,requestedModel:e}}function Xe(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&c(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(te(t)||r.rule==="explicit:cli"&&c(r.provider)||!c(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return it(r.model,i)}function st(e,r=d){let t=e?.trim();return t?c(t)?d:t==="codex"?"codex":t:r}function at(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(d)?[...new Set(r.map(t=>c(t)?d:t))]:r.every(t=>c(t))?[d]:r}var lt=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,ct=/\b(npm run build\b|next build\b)\b/i,ut=/\b(vercel (build|deploy|--prod))\b/i,dt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function ne(e){let r=e.trim();return r?dt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:ut.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:ct.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:lt.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var T="heavy_verification_token_required";import{spawnSync as wt}from"node:child_process";a();import{closeSync as yt,existsSync as x,mkdirSync as vt,openSync as bt,readdirSync as rr,readFileSync as Rt,statSync as xt,unlinkSync as tr,writeFileSync as kt}from"node:fs";import se from"node:path";import{mkdirSync as pt}from"node:fs";import{tmpdir as ft}from"node:os";import W from"node:path";import{homedir as mt}from"node:os";import Qe from"node:path";function Ze(){let e=process.env.KYNVER_STATE_ROOT;return e?Qe.resolve(e):Qe.join(mt(),".kynver","state")}function gt(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function ht(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?W.resolve(e):gt()?W.join(ft(),"kynver","state","heavy-verification"):W.join(Ze(),"heavy-verification")}function oe(){return W.join(ht(),"slots")}function R(){let e=oe();return pt(e,{recursive:!0}),e}var k=120*6e4,er=1;function _t(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function U(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function K(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?_t(e,er):er}function St(e){return`slot-${e}`}function Et(e,r=oe()){return se.join(r,`${e}.json`)}function ae(e){if(!x(e))return null;try{let r=JSON.parse(Rt(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function nr(e,r=k){if(!e||!$(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function or(e,r){let t=ae(e);if(t)return nr(t,r);if(!x(e))return!0;try{return Date.now()-xt(e).mtimeMs>r}catch{return!0}}function Ct(e,r){if(or(e,r))try{tr(e)}catch{}}function Ot(e){return vt(e,{recursive:!0}),e}function le(e={}){let r=Ot(e.slotsDir??R()),t=e.staleMs??k,n=0;for(let i of rr(r)){if(!i.endsWith(".json"))continue;let s=se.join(r,i),l=x(s);Ct(s,t),l&&!x(s)&&(n+=1)}return n}function At(e={}){let r=e.slotsDir??R(),t=e.staleMs??k;le({slotsDir:r,staleMs:t});let n=[];for(let i of rr(r)){if(!i.endsWith(".json"))continue;let s=ae(se.join(r,i));s&&!nr(s,t)&&n.push(s)}return n}function ie(e={}){return At(e).length}function _(e,r={}){if(U())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:K(),reason:null};let t=r.slotsDir??R(),n=r.staleMs??k,i=r.maxSlots??K();le({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let u=St(l),f=Et(u,t),sr=ae(f);if(or(f,n))try{tr(f)}catch{}else if(sr||x(f))continue;let ar={slotId:u,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let g=bt(f,"wx");kt(g,JSON.stringify(ar,null,2),"utf8"),yt(g);let lr=ie({slotsDir:t,staleMs:n});return{admitted:!0,slotId:u,activeSlots:lr,maxSlots:i,reason:null}}catch(g){if(g.code==="EEXIST")continue;throw g}}let s=ie({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function M(e,r={}){if(U())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:K(),reason:null};let t=r.slotsDir??R(),n=r.staleMs??k,i=r.maxSlots??K();le({slotsDir:t,staleMs:n});let s=ie({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function It(e){e<=0||wt(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore"})}function ir(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=_(e,n);for(;!s.admitted&&Date.now()<i;)It(Math.min(t,i-Date.now())),s=_(e,n);return s}function Pt(e,r={}){let t=ne(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...M(e),slotId:null}};if(U())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...M(e),slotId:null}};let n=r.waitMs??0,i=n>0?ir(e,n,r.pollMs):_(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:T,commandClass:t.commandClass,reason:t.reason??i.reason??T,verificationGate:i}}export{d as DEFAULT_WORKER_PROVIDER,T as HEAVY_VERIFICATION_TOKEN_REQUIRED,F as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,br as auditReviewWorkerCredentialScope,hr as auditWorkerEnv,y as buildWorkerSpawnEnv,ne as classifyHeavyShellCommand,Xe as enforceCursorWorkerProvider,Pt as gateWorkerShellCommand,c as isClaudeFamilyProvider,h as isForbiddenWorkerEnvKey,_r as isHarnessExpertReviewWorker,me as isNoProdCredentialReviewEnvironment,ce as listForbiddenWorkerEnvKeys,ue as listOperatorAllowedWorkerEnvKeys,at as preferCursorExecutor,st as resolveConfiguredWorkerProvider,S as scrubWorkerEnv,te as taskAllowsClaudeWorker};

package/dist/worker-env.d.ts

@@ -1,14 +1,51 @@
 /**
  * Worker spawn env scrub — harness workers must not inherit host deployment secrets.
+ *
+ * §7.8 hardening (kernel-plan H8 phase 1, verified leaks 2026-07-19): the
+ * original denylist stopped at `_SECRET`/`_API_KEY`, letting `MEMORY_CONTENT_KEK`,
+ * `LLM_BYOK_KEK`, `KYNVER_COMMAND_AUTH_KEY`, `KYNVER_INSTRUCTION_BUNDLE_KEY`,
+ * and `KYNVER_MEMORY_LEDGER_KEY` reach worker children. The suffix net now
+ * covers the secret-shaped families (`_KEK`, `_KEY`, `_TOKEN`, `_PASSWORD`,
+ * `_PASSPHRASE`, `_SALT`) with EXPLICIT allows for the keys workers
+ * legitimately need — pass-through is a documented decision, never an
+ * accident:
+ *
+ *  - `GITHUB_TOKEN` / `GH_TOKEN`: git-push + `gh` credential-helper auth for
+ *    the worker's own branch pushes.
+ *  - `CLAUDE_CODE_OAUTH_TOKEN`: the worker CLI's own auth on boxes that use
+ *    env-based OAuth instead of the credentials file (same trust domain as
+ *    `~/.claude` — it is the worker's credential, not a deployment secret).
+ *  - `*_PUBLIC_KEY`: public verification material (command-auth /
+ *    instruction-bundle / ledger pins), safe by definition.
+ *
+ * Operator escape hatch: `KYNVER_WORKER_ENV_ALLOW` on the host (comma- or
+ * whitespace-separated key names) allows additional suffix-matched keys
+ * through when a box workflow needs one — it can NEVER re-admit a key on the
+ * exact forbidden list below (those are known deployment secrets).
  */
-/** Exact env keys that must never reach a worker child process. */
-export declare const FORBIDDEN_WORKER_ENV_KEYS: readonly ["ANTHROPIC_API_KEY", "ANALYST_API_KEY", "RECRUITER_API_KEY", "AUTH_SECRET", "NEXTAUTH_SECRET", "DATABASE_URL", "PRODUCTION_DATABASE_URL", "KYNVER_PRODUCTION_DATABASE_URL", "REDIS_URL", "GOOGLE_CLIENT_SECRET", "GITHUB_CLIENT_SECRET", "KYNVER_API_KEY", "KYNVER_SERVICE_SECRET", "KYNVER_RUNTIME_SECRET", "KYNVER_CRON_SECRET", "OPENCLAW_CRON_SECRET", "QSTASH_TOKEN", "QSTASH_CURRENT_SIGNING_KEY", "QSTASH_NEXT_SIGNING_KEY", "TOOL_SECRETS_KEK", "TOOL_EXECUTOR_DISPATCH_SECRET", "CLOUDFLARE_API_TOKEN", "STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET", "STRIPE_IDENTITY_WEBHOOK_SECRET", "VOYAGE_API_KEY", "PERPLEXITY_API_KEY", "FRED_API_KEY", "FMP_API_KEY", "CURSOR_API_KEY"];
-export declare function isForbiddenWorkerEnvKey(key: string): boolean;
+/** Exact env keys that must never reach a worker child process (not overridable). */
+export declare const FORBIDDEN_WORKER_ENV_KEYS: readonly ["ANTHROPIC_API_KEY", "ANALYST_API_KEY", "RECRUITER_API_KEY", "AUTH_SECRET", "NEXTAUTH_SECRET", "DATABASE_URL", "PRODUCTION_DATABASE_URL", "KYNVER_PRODUCTION_DATABASE_URL", "REDIS_URL", "GOOGLE_CLIENT_SECRET", "GITHUB_CLIENT_SECRET", "KYNVER_API_KEY", "KYNVER_SERVICE_SECRET", "KYNVER_RUNTIME_SECRET", "KYNVER_CRON_SECRET", "OPENCLAW_CRON_SECRET", "QSTASH_TOKEN", "QSTASH_CURRENT_SIGNING_KEY", "QSTASH_NEXT_SIGNING_KEY", "TOOL_SECRETS_KEK", "TOOL_EXECUTOR_DISPATCH_SECRET", "CLOUDFLARE_API_TOKEN", "STRIPE_SECRET_KEY", "STRIPE_WEBHOOK_SECRET", "STRIPE_IDENTITY_WEBHOOK_SECRET", "VOYAGE_API_KEY", "PERPLEXITY_API_KEY", "FRED_API_KEY", "FMP_API_KEY", "CURSOR_API_KEY", "MEMORY_CONTENT_KEK", "LLM_BYOK_KEK", "KYNVER_COMMAND_AUTH_KEY", "KYNVER_INSTRUCTION_BUNDLE_KEY", "KYNVER_MEMORY_LEDGER_KEY", "KYNVER_JWKS_PRIVATE_KEY_JWK"];
+/** Suffix-matched keys workers legitimately need — explicit decisions, see module doc. */
+export declare const ALLOWED_WORKER_ENV_KEYS: readonly ["GITHUB_TOKEN", "GH_TOKEN", "CLAUDE_CODE_OAUTH_TOKEN"];
+/** Host env var naming extra suffix-matched keys to allow through (comma/whitespace separated). */
+export declare const KYNVER_WORKER_ENV_ALLOW = "KYNVER_WORKER_ENV_ALLOW";
+export declare function isForbiddenWorkerEnvKey(key: string, opts?: {
+    operatorAllow?: ReadonlySet<string>;
+}): boolean;
 export declare function listForbiddenWorkerEnvKeys(env: NodeJS.ProcessEnv): string[];
+/**
+ * §7.8 review A3 — audit visibility for the escape hatch: the operator-allow
+ * entries that are PRESENT in this env and would be scrubbed without the
+ * hatch (key names only, never values). An armed hatch must be visible on
+ * audit surfaces, not silently absent from the forbidden list.
+ */
+export declare function listOperatorAllowedWorkerEnvKeys(env: NodeJS.ProcessEnv): string[];
 export declare function scrubWorkerEnv(env: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
 export interface WorkerEnvAudit {
     forbiddenPresent: string[];
     safe: boolean;
+    /** Present (non-empty) only when the KYNVER_WORKER_ENV_ALLOW hatch is armed for live keys. */
+    operatorAllowedActive?: string[];
 }
 export declare function auditWorkerEnv(env: NodeJS.ProcessEnv): WorkerEnvAudit;
 /** @deprecated Use {@link scrubWorkerEnv} — kept for existing imports from git.ts */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.2.8",
+  "version": "0.2.13",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",