@kynver-app/runtime 0.2.94 → 0.2.99

package/dist/server/worker-policy.js

@@ -1,2 +1,2 @@
-var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function J(e){let r=e[Nr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function _(e,r={}){return Or.has(e)?!0:Pr.has(e)||r.operatorAllow?.has(e)||Ir.some(t=>e.endsWith(t))?!1:Ar.some(t=>e.endsWith(t))}function _e(e){let r=J(e);return Object.keys(e).filter(t=>_(t,{operatorAllow:r})).sort()}function ke(e){let r=J(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!_(t,{operatorAllow:r})&&_(t)).sort()}function A(e){let r=J(e),t={...e};for(let n of Object.keys(t))_(n,{operatorAllow:r})&&delete t[n];return t}function Tr(e){let r=_e(e),t=ke(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var Cr,Or,Ar,wr,Pr,Ir,Nr,w=o(()=>{"use strict";Cr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Or=new Set(Cr),Ar=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],wr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Pr=new Set(wr),Ir=["_PUBLIC_KEY"],Nr="KYNVER_WORKER_ENV_ALLOW"});var g=o(()=>{"use strict"});var Ae=o(()=>{"use strict"});function Q(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict";Ae()});var N=o(()=>{"use strict";g();a();w()});var we=o(()=>{"use strict";N()});var ee=o(()=>{"use strict";N();g();we()});var re=o(()=>{"use strict";a()});var m=o(()=>{"use strict"});var T=o(()=>{"use strict"});var Pe=o(()=>{"use strict"});var Hn,Vn,te=o(()=>{"use strict";Hn=25*1024*1024*1024,Vn=12*1024*1024*1024});var Jn,zn,Ie=o(()=>{"use strict";te();Jn=5*1024*1024*1024,zn=10*1024*1024*1024});var to,no,ne=o(()=>{"use strict";Ie();te();to=30*1024*1024*1024,no=15*1024*1024*1024});var Te=o(()=>{"use strict";a()});import zr from"node:path";var mo,oe=o(()=>{"use strict";g();Te();mo=zr.join(".openclaw","harness")});var K=o(()=>{"use strict";f();m();T();D();oe()});var De=o(()=>{"use strict";f();oe();K();a()});var se=o(()=>{"use strict";De();a()});var Me=o(()=>{"use strict";se();a()});var Ue=o(()=>{"use strict"});var Be=o(()=>{"use strict";Ue();a()});var Le=o(()=>{"use strict"});var Fe=o(()=>{"use strict";Le()});var U=o(()=>{"use strict"});var $e=o(()=>{"use strict";Fe();a();U()});var He=o(()=>{"use strict";U()});var Ve=o(()=>{"use strict"});var je=o(()=>{"use strict"});var ae=o(()=>{"use strict"});var Ye=o(()=>{"use strict"});var Ge=o(()=>{"use strict";ae();Ye()});var qe=o(()=>{"use strict";Be();$e();U();He();Ve();N();je();Ge();ae();a()});var Je=o(()=>{"use strict";qe()});var at,lt,ze=o(()=>{"use strict";Pe();f();m();T();D();ne();se();Me();Je();a();at=500*1024*1024,lt=4*1024*1024*1024});var D=o(()=>{"use strict";ze()});import{homedir as ut}from"node:os";import ct from"node:path";var Xe,le=o(()=>{"use strict";Xe=ct.join(ut(),".kynver",".env")});var Qe=o(()=>{"use strict"});var Ze=o(()=>{"use strict";Qe()});var er=o(()=>{"use strict"});var rr=o(()=>{"use strict";a()});var ue=o(()=>{"use strict";Ze();er();rr()});var tr=o(()=>{"use strict"});var nr=o(()=>{"use strict";tr()});var B=o(()=>{"use strict";le();g();f();ue();nr()});var or=o(()=>{"use strict";m();m()});var ir=o(()=>{"use strict";le();ue();B()});var ce=o(()=>{"use strict"});var sr=o(()=>{"use strict";ee();m();or();f();B();ir();re();ce();K()});function k(e){let r=e.trim().toLowerCase();return Rt[r]??r}var ar,vt,Rt,L=o(()=>{"use strict";ar=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],vt=ar.join("|"),Rt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});import{homedir as kt,totalmem as xa}from"node:os";import de from"node:path";var lr,Da,Ma,Ua,Ba,f=o(()=>{"use strict";ee();g();re();m();T();D();ne();B();sr();L();K();ce();lr=de.join(kt(),".kynver"),Da=de.join(lr,"config.json"),Ma=de.join(lr,"credentials"),Ua=500*1024*1024,Ba=4*1024*1024*1024});w();w();var z="KYNVER_NO_PROD_DB_CREDENTIALS",Wr=["KYNVER_ENV_FILE"],Kr=new Set(["1","true","yes","on"]);function be(e){let r=e[z]?.trim().toLowerCase();return r!==void 0&&Kr.has(r)}function d(e,r={}){let t=A(e);if(!r.reviewWorker)return t;let n={...t,[z]:"1"};for(let i of Wr)delete n[i];return n}var xe=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Dr(e,r={}){let t=d(e,r),n=Object.keys(t).filter(u=>u.endsWith("_SECRET")||u.endsWith("_API_KEY")||xe.includes(u)),i=xe.every(u=>t[u]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=be(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var Mr="expert-lane-pr-review:",Ur="plan-review-task",Br="scheduledjob:",P=new Set(["lorentz","dalton","rhea","sentinel"]);function Lr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function X(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function Fr(e,r){return e.startsWith("factory:")?e.includes("lb")||X(r):!1}function $r(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
-${n}`,s=Lr(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(Mr)||r===Ur||r.startsWith("daemon-review:")||s&&P.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Fr(r,i)||X(i))||r.startsWith(Br)&&e.parentTaskId&&s&&P.has(s)||e.planId&&!e.parentTaskId&&s&&P.has(s)&&X(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&P.has(s))}var Hr=/^claude[-_]/i,Vr=/^(?:opus|sonnet|haiku)\b/i;function Ee(e){let r=e.trim();return Hr.test(r)||Vr.test(r)}function Se(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Ce(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Oe(e){return e.trim().toLowerCase().startsWith("gemini-")}function jr(e){return Se(e)?"codex":Ee(e)?"claude":Oe(e)?"gemini":(Ce(e),"cursor")}function Yr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:i,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:i,rule:i?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function Gr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Ee(n)||Se(n)||Ce(n)||Oe(n)?{lane:t,model:n,provider:jr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function I(e){let r=typeof e=="string"?e.trim():"";return r?Yr(r)??Gr(r):null}f();a();a();var dr="kynver",pr=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Ot=pr.map(e=>`mcp__${dr}__${e}`);a();a();var su=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5";function wt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5"}var Pt=wt();a();var Du=600*1e3;a();var zu=600*1e3;var mr="composer-2.5";L();L();var p="cursor",Wt=new Set(["claude","opus","anthropic"]),Kt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function b(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function c(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Wt.has(r)?!0:r.includes("claude")||r.includes("opus")}function pe(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&c(r))return!0;let t=b(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=I(b(e,"executorRef"));if(n?.provider&&c(n.provider)||n?.model&&c(Dt(n.model)))return!0;let i=b(e,"description");if(Kt.some(l=>l.test(i)))return!0;let s=b(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function Dt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Mt(e,r){return{provider:p,model:mr,rule:`policy:cursor_default${r}`,requestedModel:e}}var Ut=["explicit:","executor_ref:","factory:","task:"];function Bt(e){return Ut.some(r=>e.startsWith(r))}function me(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||I(b(e,"executorRef"))?.provider?!0:pe(e)}function fr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&c(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Bt(r.rule)||me(t)||!c(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Mt(r.model,i)}function Lt(e,r=p){let t=e?.trim();return t?k(t):r}function Ft(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(p)?[...new Set(r.map(t=>c(t)?p:t))]:r.every(t=>c(t))?[p]:r}var $t=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,Ht=/\b(npm run build\b|next build\b)\b/i,Vt=/\b(vercel (build|deploy|--prod))\b/i,jt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function fe(e){let r=e.trim();return r?jt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:Vt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:Ht.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:$t.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var V="heavy_verification_token_required";import{spawnSync as cn}from"node:child_process";a();import{closeSync as Xt,existsSync as S,mkdirSync as Qt,openSync as Zt,readdirSync as vr,readFileSync as en,statSync as rn,unlinkSync as Rr,writeFileSync as tn}from"node:fs";import ye from"node:path";import{mkdirSync as Gt}from"node:fs";import{tmpdir as qt}from"node:os";import j from"node:path";import{homedir as Yt,tmpdir as kc}from"node:os";import gr from"node:path";function hr(){let e=process.env.KYNVER_STATE_ROOT;return e?gr.resolve(e):gr.join(Yt(),".kynver","state")}function Jt(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function zt(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?j.resolve(e):Jt()?j.join(qt(),"kynver","state","heavy-verification"):j.join(hr(),"heavy-verification")}function ge(){return j.join(zt(),"slots")}function E(){let e=ge();return Gt(e,{recursive:!0}),e}var C=120*6e4,yr=1;function nn(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function G(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function Y(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?nn(e,yr):yr}function on(e){return`slot-${e}`}function sn(e,r=ge()){return ye.join(r,`${e}.json`)}function ve(e){if(!S(e))return null;try{let r=JSON.parse(en(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function _r(e,r=C){if(!e||!Q(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function kr(e,r){let t=ve(e);if(t)return _r(t,r);if(!S(e))return!0;try{return Date.now()-rn(e).mtimeMs>r}catch{return!0}}function an(e,r){if(kr(e,r))try{Rr(e)}catch{}}function ln(e){return Qt(e,{recursive:!0}),e}function Re(e={}){let r=ln(e.slotsDir??E()),t=e.staleMs??C,n=0;for(let i of vr(r)){if(!i.endsWith(".json"))continue;let s=ye.join(r,i),l=S(s);an(s,t),l&&!S(s)&&(n+=1)}return n}function un(e={}){let r=e.slotsDir??E(),t=e.staleMs??C;Re({slotsDir:r,staleMs:t});let n=[];for(let i of vr(r)){if(!i.endsWith(".json"))continue;let s=ve(ye.join(r,i));s&&!_r(s,t)&&n.push(s)}return n}function he(e={}){return un(e).length}function O(e,r={}){if(G())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Y(),reason:null};let t=r.slotsDir??E(),n=r.staleMs??C,i=r.maxSlots??Y();Re({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let u=on(l),v=sn(u,t),br=ve(v);if(kr(v,n))try{Rr(v)}catch{}else if(br||S(v))continue;let Er={slotId:u,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let R=Zt(v,"wx");tn(R,JSON.stringify(Er,null,2),"utf8"),Xt(R);let Sr=he({slotsDir:t,staleMs:n});return{admitted:!0,slotId:u,activeSlots:Sr,maxSlots:i,reason:null}}catch(R){if(R.code==="EEXIST")continue;throw R}}let s=he({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function q(e,r={}){if(G())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Y(),reason:null};let t=r.slotsDir??E(),n=r.staleMs??C,i=r.maxSlots??Y();Re({slotsDir:t,staleMs:n});let s=he({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function dn(e){e<=0||cn(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore",windowsHide:!0})}function xr(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=O(e,n);for(;!s.admitted&&Date.now()<i;)dn(Math.min(t,i-Date.now())),s=O(e,n);return s}function pn(e,r={}){let t=fe(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...q(e),slotId:null}};if(G())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...q(e),slotId:null}};let n=r.waitMs??0,i=n>0?xr(e,n,r.pollMs):O(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:V,commandClass:t.commandClass,reason:t.reason??i.reason??V,verificationGate:i}}export{p as DEFAULT_WORKER_PROVIDER,V as HEAVY_VERIFICATION_TOKEN_REQUIRED,z as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Dr as auditReviewWorkerCredentialScope,Tr as auditWorkerEnv,d as buildWorkerSpawnEnv,fe as classifyHeavyShellCommand,fr as enforceCursorWorkerProvider,pn as gateWorkerShellCommand,c as isClaudeFamilyProvider,_ as isForbiddenWorkerEnvKey,$r as isHarnessExpertReviewWorker,be as isNoProdCredentialReviewEnvironment,_e as listForbiddenWorkerEnvKeys,ke as listOperatorAllowedWorkerEnvKeys,k as normalizeWorkerProviderName,Ft as preferCursorExecutor,Lt as resolveConfiguredWorkerProvider,A as scrubWorkerEnv,pe as taskAllowsClaudeWorker,me as taskExpressesWorkerProviderPreference};
+var o=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};function J(e){let r=e[Nr];return r?new Set(r.split(/[\s,]+/).map(t=>t.trim()).filter(Boolean)):new Set}function _(e,r={}){return Or.has(e)?!0:Pr.has(e)||r.operatorAllow?.has(e)||Ir.some(t=>e.endsWith(t))?!1:Ar.some(t=>e.endsWith(t))}function _e(e){let r=J(e);return Object.keys(e).filter(t=>_(t,{operatorAllow:r})).sort()}function ke(e){let r=J(e);return r.size===0?[]:Object.keys(e).filter(t=>r.has(t)&&!_(t,{operatorAllow:r})&&_(t)).sort()}function A(e){let r=J(e),t={...e};for(let n of Object.keys(t))_(n,{operatorAllow:r})&&delete t[n];return t}function Tr(e){let r=_e(e),t=ke(e);return{forbiddenPresent:r,safe:r.length===0,...t.length?{operatorAllowedActive:t}:{}}}var Cr,Or,Ar,wr,Pr,Ir,Nr,w=o(()=>{"use strict";Cr=["ANTHROPIC_API_KEY","ANALYST_API_KEY","RECRUITER_API_KEY","AUTH_SECRET","NEXTAUTH_SECRET","DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL","REDIS_URL","GOOGLE_CLIENT_SECRET","GITHUB_CLIENT_SECRET","KYNVER_API_KEY","KYNVER_SERVICE_SECRET","KYNVER_RUNTIME_SECRET","KYNVER_CRON_SECRET","OPENCLAW_CRON_SECRET","QSTASH_TOKEN","QSTASH_CURRENT_SIGNING_KEY","QSTASH_NEXT_SIGNING_KEY","TOOL_SECRETS_KEK","TOOL_EXECUTOR_DISPATCH_SECRET","CLOUDFLARE_API_TOKEN","STRIPE_SECRET_KEY","STRIPE_WEBHOOK_SECRET","STRIPE_IDENTITY_WEBHOOK_SECRET","VOYAGE_API_KEY","PERPLEXITY_API_KEY","FRED_API_KEY","FMP_API_KEY","CURSOR_API_KEY","MEMORY_CONTENT_KEK","LLM_BYOK_KEK","KYNVER_COMMAND_AUTH_KEY","KYNVER_INSTRUCTION_BUNDLE_KEY","KYNVER_MEMORY_LEDGER_KEY","KYNVER_JWKS_PRIVATE_KEY_JWK"],Or=new Set(Cr),Ar=["_SECRET","_API_KEY","_KEK","_KEY","_TOKEN","_PASSWORD","_PASSPHRASE","_SALT"],wr=["GITHUB_TOKEN","GH_TOKEN","CLAUDE_CODE_OAUTH_TOKEN","CODEX_API_KEY","GEMINI_API_KEY"],Pr=new Set(wr),Ir=["_PUBLIC_KEY"],Nr="KYNVER_WORKER_ENV_ALLOW"});var g=o(()=>{"use strict"});var Ae=o(()=>{"use strict"});function Q(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}var a=o(()=>{"use strict";Ae()});var N=o(()=>{"use strict";g();a();w()});var we=o(()=>{"use strict";N()});var ee=o(()=>{"use strict";N();g();we()});var re=o(()=>{"use strict";a()});var m=o(()=>{"use strict"});var T=o(()=>{"use strict"});var Pe=o(()=>{"use strict"});var Hn,Vn,te=o(()=>{"use strict";Hn=25*1024*1024*1024,Vn=12*1024*1024*1024});var Jn,zn,Ie=o(()=>{"use strict";te();Jn=5*1024*1024*1024,zn=10*1024*1024*1024});var to,no,ne=o(()=>{"use strict";Ie();te();to=30*1024*1024*1024,no=15*1024*1024*1024});var Te=o(()=>{"use strict";a()});import zr from"node:path";var mo,oe=o(()=>{"use strict";g();Te();mo=zr.join(".openclaw","harness")});var K=o(()=>{"use strict";f();m();T();D();oe()});var De=o(()=>{"use strict";f();oe();K();a()});var se=o(()=>{"use strict";De();a()});var Me=o(()=>{"use strict";se();a()});var Ue=o(()=>{"use strict"});var Be=o(()=>{"use strict";Ue();a()});var Le=o(()=>{"use strict"});var Fe=o(()=>{"use strict";Le()});var U=o(()=>{"use strict"});var $e=o(()=>{"use strict";Fe();a();U()});var He=o(()=>{"use strict";U()});var Ve=o(()=>{"use strict"});var je=o(()=>{"use strict"});var ae=o(()=>{"use strict"});var Ye=o(()=>{"use strict"});var Ge=o(()=>{"use strict";ae();Ye()});var qe=o(()=>{"use strict";Be();$e();U();He();Ve();N();je();Ge();ae();a()});var Je=o(()=>{"use strict";qe()});var at,lt,ze=o(()=>{"use strict";Pe();f();m();T();D();ne();se();Me();Je();a();at=500*1024*1024,lt=4*1024*1024*1024});var D=o(()=>{"use strict";ze()});import{homedir as ut}from"node:os";import ct from"node:path";var Xe,le=o(()=>{"use strict";Xe=ct.join(ut(),".kynver",".env")});var Qe=o(()=>{"use strict"});var Ze=o(()=>{"use strict";Qe()});var er=o(()=>{"use strict"});var rr=o(()=>{"use strict";a()});var ue=o(()=>{"use strict";Ze();er();rr()});var tr=o(()=>{"use strict"});var nr=o(()=>{"use strict";tr()});var B=o(()=>{"use strict";le();g();f();ue();nr()});var or=o(()=>{"use strict";m();m()});var ir=o(()=>{"use strict";le();ue();B()});var ce=o(()=>{"use strict"});var sr=o(()=>{"use strict";ee();m();or();f();B();ir();re();ce();K()});function k(e){let r=e.trim().toLowerCase();return Rt[r]??r}var ar,vt,Rt,L=o(()=>{"use strict";ar=["claude","cursor","codex","gemini","gemini-api","openai-compatible"],vt=ar.join("|"),Rt={anthropic:"claude",opus:"claude",openai:"openai-compatible",openai_compatible:"openai-compatible","openai-compat":"openai-compatible",chatgpt:"codex",gpt:"codex","openai-api":"openai-compatible",openai_api:"openai-compatible",google:"gemini",gemini_cli:"gemini",gemini_api:"gemini-api","google-api":"gemini-api",google_api:"gemini-api"}});import{homedir as kt,totalmem as ba}from"node:os";import de from"node:path";var lr,Da,Ma,Ua,Ba,f=o(()=>{"use strict";ee();g();re();m();T();D();ne();B();sr();L();K();ce();lr=de.join(kt(),".kynver"),Da=de.join(lr,"config.json"),Ma=de.join(lr,"credentials"),Ua=500*1024*1024,Ba=4*1024*1024*1024});w();w();var z="KYNVER_NO_PROD_DB_CREDENTIALS",Wr=["KYNVER_ENV_FILE"],Kr=new Set(["1","true","yes","on"]);function xe(e){let r=e[z]?.trim().toLowerCase();return r!==void 0&&Kr.has(r)}function d(e,r={}){let t=A(e);if(!r.reviewWorker)return t;let n={...t,[z]:"1"};for(let i of Wr)delete n[i];return n}var be=["DATABASE_URL","PRODUCTION_DATABASE_URL","KYNVER_PRODUCTION_DATABASE_URL"];function Dr(e,r={}){let t=d(e,r),n=Object.keys(t).filter(u=>u.endsWith("_SECRET")||u.endsWith("_API_KEY")||be.includes(u)),i=be.every(u=>t[u]===void 0),s=r.reviewWorker?t.KYNVER_ENV_FILE===void 0:!0,l=xe(t);return{reviewMode:!!r.reviewWorker,noProdFlagPresent:r.reviewWorker?l:!0,forbiddenKeysAfterScrub:n.sort(),productionDbKeysAbsent:i,envFilePointerStripped:s,safe:i&&n.length===0&&s&&(!r.reviewWorker||l)}}var Mr="expert-lane-pr-review:",Ur="plan-review-task",Br="scheduledjob:",P=new Set(["lorentz","dalton","rhea","sentinel"]);function Lr(e){if(!e)return null;let r=e.trim().toLowerCase();return r.length?r:null}function X(e){return/\b(deep[- ]?review|plan review|review .*plan|security review|red[- ]team|lb\d+|runtime verification)\b/.test(e)}function Fr(e,r){return e.startsWith("factory:")?e.includes("lb")||X(r):!1}function $r(e){let r=(e.executorRef??"").toLowerCase(),t=(e.title??"").toLowerCase(),n=(e.description??"").toLowerCase(),i=`${t}
+${n}`,s=Lr(e.personaSlug);return r.startsWith("harness-lane:blocked-lane-unblock:")||r==="lane:over_attempt_recovery"||r.startsWith("next-action-fix:")||r.startsWith("next-action-landing:")||r.startsWith("code-work-lane-chain:release:")?!1:!!(r.startsWith(Mr)||r===Ur||r.startsWith("daemon-review:")||s&&P.has(s)&&(r.includes("evidence")||r.includes("validate")||r.includes("review")||Fr(r,i)||X(i))||r.startsWith(Br)&&e.parentTaskId&&s&&P.has(s)||e.planId&&!e.parentTaskId&&s&&P.has(s)&&X(i)||t.includes("expert pr review")||e.parentTaskId&&(t.startsWith("review:")||t.includes("review required")||t.includes("runtime review"))&&s&&P.has(s))}var Hr=/^claude[-_]/i,Vr=/^(?:opus|sonnet|haiku)\b/i;function Ee(e){let r=e.trim();return Hr.test(r)||Vr.test(r)}function Se(e){let r=e.trim().toLowerCase();return r.startsWith("gpt-")||r.startsWith("gpt5")||r.includes("codex")}function Ce(e){let r=e.trim().toLowerCase();return r.includes("composer")||r.includes("cursor")}function Oe(e){return e.trim().toLowerCase().startsWith("gemini-")}function jr(e){return Se(e)?"codex":Ee(e)?"claude":Oe(e)?"gemini":(Ce(e),"cursor")}function Yr(e){if(!e.startsWith("provider:"))return null;let r=e.slice(9),t=r.indexOf(":"),n=(t>=0?r.slice(0,t):r).trim().toLowerCase(),i=t>=0&&r.slice(t+1).trim()||void 0;return n?n==="claude"||n==="opus"||n==="anthropic"?{provider:"claude",model:i,rule:i?"executor_ref:provider_claude_model":"executor_ref:provider_claude"}:n==="codex"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-compatible"||n==="openai"||n==="openai_compatible"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="chatgpt"||n==="gpt"?{provider:"codex",model:i,rule:"executor_ref:provider_codex"}:n==="openai-api"||n==="openai_api"?{provider:"openai-compatible",model:i,rule:"executor_ref:provider_openai_compatible"}:n==="cursor"||n==="composer"?{provider:"cursor",model:i,rule:"executor_ref:provider_cursor"}:n==="gemini-api"||n==="gemini_api"||n==="google-api"?{provider:"gemini-api",model:i,rule:"executor_ref:provider_gemini_api"}:n==="gemini"||n==="google"||n==="gemini_cli"?{provider:"gemini",model:i,rule:i?"executor_ref:provider_gemini_model":"executor_ref:provider_gemini"}:null:null}function Gr(e){if(!e.startsWith("harness-lane:"))return null;let r=e.split(":").map(i=>i.trim()).filter(Boolean);if(r.length<2)return null;let t=r[1],n=r.slice(2).join(":");return n?Ee(n)||Se(n)||Ce(n)||Oe(n)?{lane:t,model:n,provider:jr(n),rule:"executor_ref:harness_lane_model"}:{lane:t,rule:"executor_ref:harness_lane"}:{lane:t,rule:"executor_ref:harness_lane"}}function I(e){let r=typeof e=="string"?e.trim():"";return r?Yr(r)??Gr(r):null}f();a();a();var dr="kynver",pr=["agent_os_context_envelope","agent_os_search_memory","agent_os_search_skills","agent_os_get_skill","agent_os_progress_note"],Ot=pr.map(e=>`mcp__${dr}__${e}`);a();a();var su=process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5";function wt(){return process.env.KYNVER_CODEX_DEFAULT_MODEL?.trim()||"gpt-5.5"}var Pt=wt();a();var Du=600*1e3;a();var zu=600*1e3;var mr="composer-2.5";L();L();var p="cursor",Wt=new Set(["claude","opus","anthropic"]),Kt=[/\[worker-provider:\s*claude\]/i,/\[use-claude-worker\]/i,/\[operator-worker-provider:\s*claude\]/i];function x(e,r){let t=e[r];return typeof t=="string"?t.trim():""}function c(e){if(!e?.trim())return!1;let r=e.trim().toLowerCase();return Wt.has(r)?!0:r.includes("claude")||r.includes("opus")}function pe(e){if(!e)return!1;let r=e.workerProviderOverride;if(typeof r=="string"&&c(r))return!0;let t=x(e,"executorRef").toLowerCase();if(t==="provider:claude"||t.startsWith("provider:claude:")||t.includes("claude-worker-override")||t.includes("operator-claude"))return!0;let n=I(x(e,"executorRef"));if(n?.provider&&c(n.provider)||n?.model&&c(Dt(n.model)))return!0;let i=x(e,"description");if(Kt.some(l=>l.test(i)))return!0;let s=x(e,"title");return!!/\[use-claude-worker\]/i.test(s)}function Dt(e){let r=e.trim().toLowerCase();return/^claude[-_]/.test(r)||/^(?:opus|sonnet|haiku)\b/.test(r)?"claude":r}function Mt(e,r){return{provider:p,model:mr,rule:`policy:cursor_default${r}`,requestedModel:e}}var Ut=["explicit:","executor_ref:","factory:","task:"];function Bt(e){return Ut.some(r=>e.startsWith(r))}function me(e){if(!e)return!1;let r=e.workerProviderOverride;return typeof r=="string"&&r.trim()||I(x(e,"executorRef"))?.provider?!0:pe(e)}function fr(e){let{routing:r,task:t}=e,n=e.explicitProvider?.trim().toLowerCase();if(e.explicitProviderIsOperatorOverride&&c(n))return{...r,provider:"claude",rule:r.rule.startsWith("explicit:")?r.rule:"explicit:operator_provider"};if(n||Bt(r.rule)||me(t)||!c(r.provider))return r;let i=r.rule&&r.rule!=="default:global"?`:${r.rule.replace(/:/g,"_")}`:"";return Mt(r.model,i)}function Lt(e,r=p){let t=e?.trim();return t?k(t):r}function Ft(e){let r=[...new Set(e.map(t=>t.trim().toLowerCase()).filter(Boolean))];return r.includes(p)?[...new Set(r.map(t=>c(t)?p:t))]:r.every(t=>c(t))?[p]:r}var $t=/\b(npm run typecheck|tsc\b[^|&;]*--noEmit|node scripts\/verify-pr-local\.mjs|kynver (harness )?verify)\b/i,Ht=/\b(npm run build\b|next build\b)\b/i,Vt=/\b(vercel (build|deploy|--prod))\b/i,jt=/\b(openai|anthropic|perplexity|voyage)\b.*\b(api|cli)\b|\b(paid|billable)[-_ ]?compute\b/i;function fe(e){let r=e.trim();return r?jt.test(r)?{heavy:!0,commandClass:"paid_compute",reason:"paid external compute requires heavy-verification token and operator approval"}:Vt.test(r)?{heavy:!0,commandClass:"vercel_verify",reason:"Vercel build/deploy verification requires heavy-verification token"}:Ht.test(r)?{heavy:!0,commandClass:"full_build",reason:"full app build requires heavy-verification token"}:$t.test(r)?{heavy:!0,commandClass:"full_typecheck",reason:"full repo typecheck requires heavy-verification token"}:{heavy:!1,commandClass:"allowed",reason:null}:{heavy:!1,commandClass:"allowed",reason:null}}var V="heavy_verification_token_required";import{spawnSync as cn}from"node:child_process";a();import{closeSync as Xt,existsSync as S,mkdirSync as Qt,openSync as Zt,readdirSync as vr,readFileSync as en,statSync as rn,unlinkSync as Rr,writeFileSync as tn}from"node:fs";import ye from"node:path";import{mkdirSync as Gt}from"node:fs";import{tmpdir as qt}from"node:os";import j from"node:path";import{homedir as Yt,tmpdir as kc}from"node:os";import gr from"node:path";function hr(){let e=process.env.KYNVER_STATE_ROOT;return e?gr.resolve(e):gr.join(Yt(),".kynver","state")}function Jt(){return!!(process.env.VERCEL||process.env.VERCEL_ENV||process.env.AWS_LAMBDA_FUNCTION_NAME||process.env.AWS_EXECUTION_ENV)}function zt(){let e=process.env.KYNVER_HEAVY_VERIFICATION_STATE_ROOT;return e?j.resolve(e):Jt()?j.join(qt(),"kynver","state","heavy-verification"):j.join(hr(),"heavy-verification")}function ge(){return j.join(zt(),"slots")}function E(){let e=ge();return Gt(e,{recursive:!0}),e}var C=120*6e4,yr=1;function nn(e,r){let t=Number(e);return!Number.isFinite(t)||t<=0?r:Math.floor(t)}function G(){let e=process.env.KYNVER_HEAVY_VERIFICATION_SKIP?.trim().toLowerCase();return e==="1"||e==="true"||e==="yes"}function Y(){let e=process.env.KYNVER_HEAVY_VERIFICATION_MAX_CONCURRENT;return e?nn(e,yr):yr}function on(e){return`slot-${e}`}function sn(e,r=ge()){return ye.join(r,`${e}.json`)}function ve(e){if(!S(e))return null;try{let r=JSON.parse(en(e,"utf8"));if(typeof r.slotId=="string"&&typeof r.pid=="number"&&typeof r.acquiredAt=="string"&&typeof r.command=="string")return r}catch{return null}return null}function _r(e,r=C){if(!e||!Q(e.pid))return!0;let t=Date.parse(e.acquiredAt);return Number.isNaN(t)?!0:Date.now()-t>r}function kr(e,r){let t=ve(e);if(t)return _r(t,r);if(!S(e))return!0;try{return Date.now()-rn(e).mtimeMs>r}catch{return!0}}function an(e,r){if(kr(e,r))try{Rr(e)}catch{}}function ln(e){return Qt(e,{recursive:!0}),e}function Re(e={}){let r=ln(e.slotsDir??E()),t=e.staleMs??C,n=0;for(let i of vr(r)){if(!i.endsWith(".json"))continue;let s=ye.join(r,i),l=S(s);an(s,t),l&&!S(s)&&(n+=1)}return n}function un(e={}){let r=e.slotsDir??E(),t=e.staleMs??C;Re({slotsDir:r,staleMs:t});let n=[];for(let i of vr(r)){if(!i.endsWith(".json"))continue;let s=ve(ye.join(r,i));s&&!_r(s,t)&&n.push(s)}return n}function he(e={}){return un(e).length}function O(e,r={}){if(G())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Y(),reason:null};let t=r.slotsDir??E(),n=r.staleMs??C,i=r.maxSlots??Y();Re({slotsDir:t,staleMs:n});for(let l=0;l<i;l+=1){let u=on(l),v=sn(u,t),xr=ve(v);if(kr(v,n))try{Rr(v)}catch{}else if(xr||S(v))continue;let Er={slotId:u,pid:process.pid,acquiredAt:new Date().toISOString(),command:e};try{let R=Zt(v,"wx");tn(R,JSON.stringify(Er,null,2),"utf8"),Xt(R);let Sr=he({slotsDir:t,staleMs:n});return{admitted:!0,slotId:u,activeSlots:Sr,maxSlots:i,reason:null}}catch(R){if(R.code==="EEXIST")continue;throw R}}let s=he({slotsDir:t,staleMs:n});return{admitted:!1,slotId:null,activeSlots:s,maxSlots:i,reason:`heavy verification at capacity (${s}/${i} slots)`}}function q(e,r={}){if(G())return{admitted:!0,slotId:null,activeSlots:0,maxSlots:Y(),reason:null};let t=r.slotsDir??E(),n=r.staleMs??C,i=r.maxSlots??Y();Re({slotsDir:t,staleMs:n});let s=he({slotsDir:t,staleMs:n}),l=s<i;return{admitted:l,slotId:null,activeSlots:s,maxSlots:i,reason:l?null:`heavy verification at capacity (${s}/${i} slots); waiting for ${e}`}}function dn(e){e<=0||cn(process.execPath,["-e",`const d=Date.now()+${Math.floor(e)};while(Date.now()<d);`],{stdio:"ignore",windowsHide:!0})}function br(e,r,t=2e3,n={}){let i=Date.now()+Math.max(0,r),s=O(e,n);for(;!s.admitted&&Date.now()<i;)dn(Math.min(t,i-Date.now())),s=O(e,n);return s}function pn(e,r={}){let t=fe(e);if(!t.heavy)return{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:"command does not require heavy-verification token",verificationGate:{...q(e),slotId:null}};if(G())return{allowed:!0,outcome:"heavy_verification_skipped",commandClass:t.commandClass,reason:"KYNVER_HEAVY_VERIFICATION_SKIP bypasses gate",verificationGate:{...q(e),slotId:null}};let n=r.waitMs??0,i=n>0?br(e,n,r.pollMs):O(e);return i.admitted?{allowed:!0,outcome:"allowed",commandClass:t.commandClass,reason:t.reason??"heavy-verification token acquired",verificationGate:i}:{allowed:!1,outcome:V,commandClass:t.commandClass,reason:t.reason??i.reason??V,verificationGate:i}}export{p as DEFAULT_WORKER_PROVIDER,V as HEAVY_VERIFICATION_TOKEN_REQUIRED,z as KYNVER_NO_PROD_DB_CREDENTIALS_ENV,Dr as auditReviewWorkerCredentialScope,Tr as auditWorkerEnv,d as buildWorkerSpawnEnv,fe as classifyHeavyShellCommand,fr as enforceCursorWorkerProvider,pn as gateWorkerShellCommand,c as isClaudeFamilyProvider,_ as isForbiddenWorkerEnvKey,$r as isHarnessExpertReviewWorker,xe as isNoProdCredentialReviewEnvironment,_e as listForbiddenWorkerEnvKeys,ke as listOperatorAllowedWorkerEnvKeys,k as normalizeWorkerProviderName,Ft as preferCursorExecutor,Lt as resolveConfiguredWorkerProvider,A as scrubWorkerEnv,pe as taskAllowsClaudeWorker,me as taskExpressesWorkerProviderPreference};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kynver-app/runtime",
-  "version": "0.2.94",
+  "version": "0.2.99",
   "description": "Kynver AgentOS local execution runtime and CLI",
   "type": "module",
   "main": "./dist/index.js",