@loompad/cli 0.1.0 → 1.1.1

package/dist/daemon/runner.js

@@ -0,0 +1,612 @@
+/**
+ * Runner — a member's always-on Loom daemon that takes goals from the team hub
+ * (Loom Teams, Phase 5; docs/teams-architecture.md D67–D78).
+ *
+ * A runner is a normal Loom daemon in runner mode. It registers one of its
+ * owner's devices as a runner (D74) and claims jobs from the hub (D71):
+ *   start     a new goal on this machine
+ *   continue  a goal moved here mid-run (its branches on refs/loom/run/<id>/*)
+ *   fix       make the owner's goal PR green while they're away (D69)
+ *   return    hand a goal back to the owner's laptop (D76 "Bring back")
+ *   land      the owner clicked Land on a goal that lives here
+ *
+ * Each goal gets a fresh clone as its own project (D70). The runner process
+ * runs with a scrubbed environment; with Docker, the claimed job runs in a
+ * container instead (`loom runner exec`). A job stays claimed, heartbeating a
+ * progress snapshot, until its goal lands, fails or moves on (D76).
+ */
+import { execFile } from "../core/process.js";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { writeProjectConfig, loomHome } from "../core/registry.js";
+import { logbook } from "../core/logbook.js";
+import { isTerminal, taskSummary } from "../core/orchestra.js";
+import { openFromTeam, sealForTeam } from "../core/team-crypto.js";
+import { loadPolicy } from "../core/team-policy.js";
+export const DEFAULT_RUNNER = { enabled: false, shared: false, capacity: 1, isolation: "auto", kinds: [] };
+export function runnerConfigPath() {
+    return path.join(loomHome(), "runner.json");
+}
+export function readRunnerConfig() {
+    try {
+        return { ...DEFAULT_RUNNER, ...JSON.parse(fs.readFileSync(runnerConfigPath(), "utf8")) };
+    }
+    catch {
+        return { ...DEFAULT_RUNNER };
+    }
+}
+export function writeRunnerConfig(c) {
+    fs.mkdirSync(loomHome(), { recursive: true });
+    fs.writeFileSync(runnerConfigPath(), JSON.stringify(c, null, 2), { mode: 0o600 });
+}
+/** The runner's GitHub token lives beside its config, 0600, and never goes through the hub (D77). */
+export function runnerTokenPath() {
+    return path.join(loomHome(), "runner-token");
+}
+export function readRunnerToken() {
+    try {
+        return fs.readFileSync(runnerTokenPath(), "utf8").trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function writeRunnerToken(token) {
+    fs.mkdirSync(loomHome(), { recursive: true });
+    fs.writeFileSync(runnerTokenPath(), token.trim() + "\n", { mode: 0o600 });
+}
+// ── the environment agents inherit (D70) ──
+/** Variables agents need: model API keys, GitHub for pushing, Loom's own. */
+const KEEP = /^(ANTHROPIC_API_KEY|OPENAI_API_KEY|GEMINI_API_KEY|GOOGLE_API_KEY|XAI_API_KEY|OPENROUTER_API_KEY|GH_TOKEN|GITHUB_TOKEN|LOOM_[A-Z0-9_]+)$/;
+const SECRETISH = /(SECRET|PASSWORD|PASSWD|PRIVATE|TOKEN|_KEY$|^KEY$|API_KEY|CREDENTIAL|DATABASE_URL|_DSN$|SESSION|COOKIE|AWS_|AZURE_|GCP_|GOOGLE_APPLICATION)/i;
+/**
+ * What stays in a runner's environment: everything that isn't secret-shaped,
+ * plus the agent keys and GitHub token it's meant to have. A box someone also
+ * uses for production work doesn't hand its secrets to agents.
+ */
+export function scrubEnv(env) {
+    const out = {};
+    const removed = [];
+    for (const [k, v] of Object.entries(env)) {
+        if (KEEP.test(k) || !SECRETISH.test(k))
+            out[k] = v;
+        else
+            removed.push(k);
+    }
+    return { env: out, removed: removed.sort() };
+}
+/** The container a job runs in when Docker is available (D70). Agent logins mount read-only. */
+export function dockerCommand(opts) {
+    const home = opts.home ?? os.homedir();
+    const mounts = [".claude", ".codex", ".config/opencode", ".gemini", ".grok"]
+        .filter((d) => fs.existsSync(path.join(home, d)))
+        .flatMap((d) => ["-v", `${path.join(home, d)}:/home/loom/${d}:ro`]);
+    return [
+        "run", "--rm", "--name", `loom-job-${opts.jobId}`,
+        "-v", `${opts.jobHome}:/loom`,
+        ...mounts,
+        "-e", "LOOM_HOME=/loom",
+        ...["ANTHROPIC_API_KEY", "OPENAI_API_KEY", "GEMINI_API_KEY", "XAI_API_KEY", "GH_TOKEN"].flatMap((k) => ["-e", k]),
+        opts.image,
+        "loom", "runner", "exec", "--job", opts.jobId, "--team", opts.teamId,
+    ];
+}
+export function progressOf(run, fallbackGoal = "") {
+    return {
+        runId: run?.id ?? null,
+        goal: (run?.goal ?? fallbackGoal).split("\n")[0].slice(0, 200),
+        status: run?.status ?? "preparing",
+        tasks: run ? run.tasks.map(taskSummary) : [],
+        costUsd: run ? Math.round(run.costUsd * 100) / 100 : 0,
+        landing: run?.landing ?? null,
+        ...(run?.question ? { question: run.question.slice(0, 300) } : {}),
+        at: Date.now(),
+    };
+}
+export function crewProgress(id, name, goal, runId) {
+    return { runId, goal: (goal?.text ?? "").split("\n")[0].slice(0, 200), status: goal?.status ?? "preparing",
+        tasks: goal?.cards.map(card => ({ id: card.id, title: card.title, status: card.stage, worker: card.builder })) ?? [],
+        costUsd: goal?.costUsd ?? 0, landing: null, crew: { id, name, ...(goal?.pr ? { pr: goal.pr.url } : {}) },
+        ...(goal?.question ? { question: goal.question.text.slice(0, 300) } : {}), at: Date.now() };
+}
+const TICK_MS = 15_000;
+const BEAT_MS = 60_000;
+/** A goal of the owner's needing a CI fix, owner offline this long: the runner takes it (D69). */
+const OWNER_AWAY_MS = 15 * 60_000;
+function git(args, cwd) {
+    return new Promise((resolve, reject) => {
+        execFile("git", args, { cwd, timeout: 300_000, maxBuffer: 16 * 1024 * 1024 }, (err, out, errOut) => err ? reject(new Error(String(errOut || err.message).trim())) : resolve(String(out)));
+    });
+}
+export class Runner {
+    deps;
+    active = new Map();
+    timer = null;
+    claiming = false;
+    registered = null;
+    autoFixed = new Set();
+    lastError = null;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    get running() {
+        return Boolean(this.timer);
+    }
+    async start() {
+        if (this.timer)
+            return;
+        if (this.deps.exec)
+            return this.execOne(this.deps.exec);
+        await this.register();
+        this.timer = setInterval(() => void this.tick().catch((e) => this.fail(e)), TICK_MS);
+        this.timer.unref?.();
+        void this.tick().catch((e) => this.fail(e));
+    }
+    async stop() {
+        if (this.timer)
+            clearInterval(this.timer);
+        this.timer = null;
+    }
+    fail(e) {
+        this.lastError = e instanceof Error ? e.message : String(e);
+        logbook.warn("runner", "runner tick failed", this.lastError);
+    }
+    async register() {
+        const hub = this.deps.hub();
+        const device = this.deps.deviceId();
+        if (!hub || !device)
+            return null;
+        const c = this.deps.config();
+        this.registered = await hub.registerRunner({ deviceId: device, kinds: await this.deps.kinds(), shared: c.shared, capacity: c.capacity });
+        return this.registered;
+    }
+    /** A hub event: a job appeared, changed, or was cancelled. */
+    onJob(teamId, job) {
+        const mine = this.active.get(job.id);
+        if (mine && job.state === "cancelled")
+            void this.cancel(mine);
+        if (job.state === "queued")
+            void this.tick().catch((e) => this.fail(e));
+        void teamId;
+    }
+    /** Claim what we can, beat for what we hold, finish what's done, look for goals to rescue. */
+    async tick() {
+        const hub = this.deps.hub();
+        const device = this.deps.deviceId();
+        if (!hub || !device)
+            return;
+        if (!this.registered)
+            await this.register();
+        for (const a of [...this.active.values()])
+            await this.checkDone(a).catch((e) => this.fail(e));
+        for (const a of this.active.values()) {
+            if (Date.now() - a.lastBeat > BEAT_MS)
+                await this.beat(a).catch(() => { });
+        }
+        await this.rescueOwnGoals().catch((e) => this.fail(e));
+        if (this.claiming)
+            return;
+        this.claiming = true;
+        try {
+            const cap = this.deps.config().capacity;
+            for (const teamId of this.deps.teams()) {
+                for (;;) {
+                    const job = await hub.claimJob(teamId, device, this.goalCount() >= cap);
+                    if (!job)
+                        break;
+                    await this.execute(teamId, job);
+                }
+            }
+        }
+        finally {
+            this.claiming = false;
+        }
+    }
+    /** Goals being worked on (return/land jobs are instant and don't count). */
+    goalCount() {
+        return [...this.active.values()].filter((a) => a.job.kind === "start" || a.job.kind === "continue" || a.job.kind === "fix").length;
+    }
+    /** Inside a container: the dispatcher claimed this job; run it here, then exit (D70). */
+    async execOne(x) {
+        const hub = this.deps.hub();
+        if (!hub)
+            throw new Error("runner exec: not signed in");
+        const job = (await hub.jobs(x.teamId)).find((j) => j.id === x.jobId);
+        if (!job || job.state !== "claimed")
+            throw new Error(`runner exec: job ${x.jobId} isn't claimed`);
+        await this.execute(x.teamId, job, { inline: true });
+        this.timer = setInterval(() => {
+            void this.tick().catch((e) => this.fail(e));
+            if (!this.active.has(x.jobId)) {
+                if (this.timer)
+                    clearInterval(this.timer);
+                this.timer = null;
+                x.done(true);
+            }
+        }, TICK_MS);
+    }
+    dockerOk = null;
+    /** D70: Docker per goal when it's running (auto), always (docker), or never (inline). */
+    async useDocker() {
+        const mode = this.deps.config().isolation;
+        if (mode === "inline")
+            return false;
+        if (!this.dockerOk || Date.now() - this.dockerOk.at > 5 * 60_000) {
+            const ok = await new Promise((resolve) => execFile("docker", ["info", "--format", "{{.ServerVersion}}"], { timeout: 10_000 }, (err) => resolve(!err)));
+            this.dockerOk = { ok, at: Date.now() };
+        }
+        if (mode === "docker" && !this.dockerOk.ok)
+            throw new Error("isolation is docker, but Docker isn't running on this runner");
+        return this.dockerOk.ok;
+    }
+    /** Hand a claimed goal to its own container; it heartbeats and finishes the job itself. */
+    async dispatchDocker(teamId, job) {
+        const jobHome = path.join(loomHome(), "runner", "jobs", job.id);
+        fs.mkdirSync(jobHome, { recursive: true, mode: 0o700 });
+        fs.copyFileSync(this.deps.statePath(), path.join(jobHome, "team.json"));
+        if (readRunnerToken())
+            fs.copyFileSync(runnerTokenPath(), path.join(jobHome, "runner-token"));
+        fs.writeFileSync(path.join(jobHome, "runner.json"), JSON.stringify({ ...this.deps.config(), enabled: false, isolation: "inline" }));
+        const args = dockerCommand({ jobId: job.id, teamId, image: this.deps.config().image ?? "loom-runner", jobHome });
+        const a = { job, teamId, payload: {}, rt: null, dir: jobHome, runId: null, lastBeat: Date.now() };
+        this.active.set(job.id, a);
+        execFile("docker", args, { maxBuffer: 64 * 1024 * 1024 }, (err) => {
+            this.active.delete(job.id);
+            fs.rmSync(jobHome, { recursive: true, force: true });
+            if (err) {
+                const hub = this.deps.hub();
+                const device = this.deps.deviceId();
+                if (hub && device)
+                    void hub.finishJob(teamId, job.id, device, { state: "failed", error: `container: ${err.message.slice(0, 300)}` }).catch(() => { });
+            }
+        });
+    }
+    /** Run one claimed job. */
+    async execute(teamId, job, opts = {}) {
+        const payload = (openFromTeam(this.deps.keys(teamId), job.sealed) ?? {});
+        const a = { job, teamId, payload, rt: null, dir: null, runId: null, lastBeat: 0 };
+        try {
+            if (job.kind === "return" || job.kind === "land")
+                return await this.instant(a);
+            if (!opts.inline && (await this.useDocker()))
+                return await this.dispatchDocker(teamId, job);
+            this.active.set(job.id, a);
+            await this.beat(a);
+            await this.prepare(a);
+            const rt = a.rt;
+            // Someone else's goal: only when the repo's reviewed policy allows shared runners (D68).
+            if (job.userId !== this.deps.userId()) {
+                const policy = await loadPolicy(rt.info.dir);
+                if (!policy.runners.shared)
+                    throw new Error(`${job.repo}'s loom.team.json doesn't allow shared runners (runners.shared)`);
+            }
+            if (payload.crew) {
+                if (job.kind !== "start" || !payload.goal)
+                    throw new Error("runner crews need a start job and goal");
+                // Only map the sender's roster IDs to locally installed kinds. Sender
+                // executable paths, options, hooks and permission settings are ignored.
+                const roster = rt.config.agents;
+                const teammates = payload.crew.teammates.map(seat => {
+                    const kind = payload.crew.agents.find(agent => agent.id === seat.agent)?.kind;
+                    const agent = roster.find(agent => agent.kind === kind);
+                    if (!agent)
+                        throw new Error(`runner has no installed ${kind ?? seat.agent} agent`);
+                    return { id: seat.id, role: seat.role, agent: agent.id, ...(seat.charter ? { charter: seat.charter } : {}) };
+                });
+                const crew = rt.crews.create({ name: payload.crew.name, teammates, planApproval: true, play: payload.crew.play,
+                    maxParallel: payload.crew.maxParallel, budgetUsd: payload.crew.budgetUsd });
+                a.crewId = crew.id;
+                const goal = await rt.crews.goal(crew.id, payload.goal, payload.crew.play);
+                a.runId = rt.crews.coordination(crew.id).id;
+                a.unsub = rt.log.onEvent(event => {
+                    if (event.kind === "crew" && event.payload.crewId === crew.id)
+                        void this.beat(a).then(() => this.checkDone(a)).catch(error => this.fail(error));
+                });
+                void goal;
+                await this.beat(a);
+                return;
+            }
+            let run;
+            if (job.kind === "continue") {
+                if (!a.payload.record)
+                    throw new Error("a continue job needs the run record");
+                run = await rt.orchestra.importRun(a.payload.record, { from: a.payload.from ?? job.github });
+            }
+            else if (job.kind === "fix") {
+                if (!a.payload.pr || !a.payload.branch)
+                    throw new Error("a fix job needs the PR and its branch");
+                run = await rt.orchestra.start({
+                    goal: a.payload.goal ?? `Make PR #${a.payload.pr} green: its required checks are failing. Find the cause in \`gh pr checks ${a.payload.pr}\` / \`gh run view <id> --log-failed\`, fix it with the smallest change, and finish.`,
+                    ...(a.payload.orchestrator ? { orchestrator: a.payload.orchestrator } : {}),
+                    ...(a.payload.workers?.length ? { workers: a.payload.workers } : {}),
+                    from: { branch: a.payload.branch, pr: a.payload.pr, url: a.payload.url ?? "", owner: job.github, ...(a.payload.ownerRunId ? { ownerRunId: a.payload.ownerRunId } : {}) },
+                });
+            }
+            else {
+                if (!a.payload.goal)
+                    throw new Error("a start job needs a goal");
+                run = await rt.orchestra.start({
+                    goal: a.payload.goal,
+                    ...(a.payload.orchestrator ? { orchestrator: a.payload.orchestrator } : {}),
+                    ...(a.payload.workers?.length ? { workers: a.payload.workers } : {}),
+                    ...(a.payload.plan ? { plan: true } : {}),
+                });
+            }
+            a.runId = run.id;
+            let debounce = null;
+            // a heartbeat the hub didn't take (it was slow, the network blinked) is sent again
+            // shortly — otherwise the job's progress (its PR, its status) waits for the next
+            // event or the minute's beat, and the team sees a goal stuck short of where it is
+            const report = (delayMs) => {
+                if (debounce)
+                    return;
+                debounce = setTimeout(() => {
+                    debounce = null;
+                    void this.beat(a).then(() => this.checkDone(a)).catch(() => { if (this.active.has(a.job.id))
+                        report(5_000); });
+                }, delayMs);
+                debounce.unref?.();
+            };
+            a.unsub = rt.log.onEvent((e) => {
+                if (e.kind !== "orchestra" || e.payload.runId !== run.id)
+                    return;
+                report(1000);
+            });
+            await this.beat(a);
+        }
+        catch (e) {
+            await this.finish(a, "failed", undefined, e instanceof Error ? e.message : String(e));
+        }
+    }
+    /** return and land: act on a goal this runner holds, answer at once. */
+    async instant(a) {
+        const hub = this.deps.hub();
+        const device = this.deps.deviceId();
+        const holder = [...this.active.values()].find((x) => x.runId && x.runId === a.payload.runId);
+        try {
+            if (!holder?.rt || !holder.runId)
+                throw new Error(`this runner doesn't hold goal ${a.payload.runId ?? "?"}`);
+            if (holder.job.userId !== a.job.userId)
+                throw new Error("only the goal's owner can control this runner job");
+            if (a.payload.crewAction) {
+                const action = a.payload.crewAction;
+                if (!holder.crewId || action.jobId !== holder.job.id)
+                    throw new Error("crew job does not match this held goal");
+                const crews = holder.rt.crews, id = holder.crewId;
+                if (action.action === "approve")
+                    crews.approve(id);
+                else if (action.action === "say")
+                    await crews.say(id, action.text ?? "", action.to);
+                else if (action.action === "pause")
+                    crews.pause(id);
+                else if (action.action === "resume")
+                    crews.resume(id);
+                else if (action.action === "stop")
+                    await crews.stop(id);
+                else if (action.action === "pick")
+                    await crews.pick(id, action.to ?? "");
+                else
+                    throw new Error("unsupported crew control");
+                await hub.finishJob(a.teamId, a.job.id, device, { state: "done" });
+                await this.beat(holder);
+                return;
+            }
+            if (holder.crewId)
+                throw new Error("crew PRs require human review and merge; use a crew control action");
+            if (a.job.kind === "land") {
+                const l = await this.deps.landing(holder.rt).land(holder.runId);
+                await hub.finishJob(a.teamId, a.job.id, device, { state: "done", result: this.seal(a.teamId, { landing: l }) });
+                await this.beat(holder);
+                return;
+            }
+            const { record } = await holder.rt.orchestra.moveOut(holder.runId, a.payload.from ?? `${a.job.github}'s laptop`);
+            await hub.finishJob(a.teamId, a.job.id, device, { state: "done", result: this.seal(a.teamId, { record }) });
+            await this.finish(holder, "done", { moved: true, to: a.payload.from ?? "the owner's laptop" });
+        }
+        catch (e) {
+            await hub.finishJob(a.teamId, a.job.id, device, { state: "failed", error: e instanceof Error ? e.message : String(e) }).catch(() => { });
+        }
+    }
+    /** A fresh clone of the job's repo, opened as its own project (D70). */
+    async prepare(a) {
+        const base = path.join(loomHome(), "runner", "work", a.job.id);
+        const name = a.job.repo.split("/")[1];
+        const dir = path.join(base, name);
+        fs.mkdirSync(base, { recursive: true });
+        const url = this.deps.cloneUrl?.(a.job.repo) ?? `https://github.com/${a.job.repo}.git`;
+        await git(["clone", "-q", url, dir], base);
+        await git(["config", "loom.repo", a.job.repo], dir);
+        await git(["config", "user.name", `${this.deps.github() ?? "loom"} (runner)`], dir);
+        await git(["config", "user.email", `${this.deps.github() ?? "loom"}@users.noreply.github.com`], dir);
+        await git(["remote", "set-head", "origin", "--auto"], dir).catch(() => { });
+        if (readRunnerToken()) {
+            // push with the runner's own fine-grained token (D77), never baked into the remote URL
+            await git(["config", "credential.helper", `!f() { echo username=x-access-token; echo "password=$(cat '${runnerTokenPath()}')"; }; f`], dir);
+        }
+        const kinds = await this.deps.kinds();
+        const c = this.deps.config();
+        writeProjectConfig(dir, {
+            name: `${name} · runner`,
+            agents: kinds.map((k, i) => ({ id: k, kind: k, role: i === 0 ? "orchestrator" : "worker" })),
+            brain: { extractor: "off", ...(a.payload.nativeCrew ? { continuity: true } : {}) },
+            git: { delivery: "pr" },
+            ...{ runner: { job: a.job.id, owner: a.job.github, label: c.label ?? os.hostname() } },
+        });
+        a.dir = base;
+        a.rt = await this.deps.openProject(dir, `${name} (runner · ${a.job.github})`);
+        a.rt.runnerMode = true;
+        await this.deps.share(a.rt, a.teamId);
+        a.rt.teamPolicy = await loadPolicy(dir);
+    }
+    seal(teamId, value) {
+        const keys = this.deps.keys(teamId);
+        return sealForTeam(keys[keys.length - 1], value);
+    }
+    /** Heartbeat the job with a progress snapshot. */
+    async beat(a) {
+        const hub = this.deps.hub();
+        const device = this.deps.deviceId();
+        if (!hub || !device)
+            return;
+        const run = a.runId ? a.rt?.orchestra.get(a.runId) : undefined;
+        const crew = a.crewId ? a.rt?.crews.get(a.crewId) : undefined;
+        const progress = crew ? crewProgress(crew.id, crew.name, crew.state.goal, a.runId) : progressOf(run, a.payload.goal ?? a.payload.record?.goal);
+        await hub.heartbeatJob(a.teamId, a.job.id, device, this.seal(a.teamId, progress));
+        a.lastBeat = Date.now();
+    }
+    /** D76: a job is done when its goal lands, fails, or moves on. */
+    async checkDone(a) {
+        if (!a.rt || !a.runId || a.finishing)
+            return;
+        if (a.crewId) {
+            const crew = a.rt.crews.get(a.crewId), goal = crew.state.goal;
+            if (!goal || crew.busy)
+                return;
+            if (["failed", "stopped"].includes(goal.status))
+                return this.finish(a, "failed", crewProgress(crew.id, crew.name, goal, a.runId), goal.error ?? goal.status);
+            if (goal.status !== "completed")
+                return;
+            a.finishing = true;
+            if (goal.recovery || goal.deliveryError)
+                return this.finish(a, "failed", undefined, goal.recovery ?? goal.deliveryError);
+            if (!goal.pr) {
+                try {
+                    await a.rt.crews.deliver(crew.id);
+                }
+                catch (error) {
+                    return this.finish(a, "failed", undefined, error.message);
+                }
+            }
+            return this.finish(a, "done", crewProgress(crew.id, crew.name, goal, a.runId));
+        }
+        const run = a.rt.orchestra.get(a.runId);
+        if (!run)
+            return;
+        const l = run.landing;
+        if (run.status === "moved")
+            return this.finish(a, "done", { moved: true });
+        if (run.status === "failed" || run.status === "aborted")
+            return this.finish(a, "failed", progressOf(run), run.error ?? run.status);
+        if (!isTerminal(run.status))
+            return;
+        if (run.from && l?.returned)
+            return this.finish(a, "done", progressOf(run)); // a fix, handed back
+        if (!l && run.delivered && !run.delivered.prUrl)
+            return this.finish(a, "done", progressOf(run)); // delivered without a PR
+        if (!l && run.deliveryError)
+            return this.finish(a, "failed", progressOf(run), run.deliveryError);
+        if (l && (l.state === "merged" || l.state === "closed"))
+            return this.finish(a, "done", progressOf(run));
+    }
+    async finish(a, state, result, error) {
+        a.finishing = true;
+        const hub = this.deps.hub();
+        const device = this.deps.deviceId();
+        this.active.delete(a.job.id);
+        a.unsub?.();
+        if (hub && device) {
+            await hub
+                .finishJob(a.teamId, a.job.id, device, { state, ...(result ? { result: this.seal(a.teamId, result) } : {}), ...(error ? { error } : {}) })
+                .catch((e) => logbook.warn("runner", `couldn't finish job ${a.job.id}`, String(e)));
+        }
+        await this.cleanup(a);
+    }
+    /** The goal is over here: its branches are pushed; the clone goes (D70). */
+    async cleanup(a) {
+        if (a.crewId && a.rt) {
+            const goal = a.rt.crews.get(a.crewId).state.goal;
+            if (goal && (!goal.pr || goal.status !== "completed" || a.payload.nativeCrew)) {
+                // Failed/uncertain turns may leave uncommitted edits and card refs.
+                // Keep their whole repository and native bindings for inspection.
+                if (!goal.pr)
+                    await git(["push", "-q", "origin", `${goal.branch}:refs/loom/crew/${goal.id}/main`], goal.dir).catch(() => { });
+                await this.deps.closeProject(a.rt);
+                return;
+            }
+            await a.rt.crews.remove(a.crewId);
+        }
+        const run = a.runId ? a.rt?.orchestra.get(a.runId) : undefined;
+        if (run && a.rt && run.status === "failed" && !run.delivered) {
+            // a failed goal's work isn't thrown away: keep it on its hidden ref for whoever looks next
+            await git(["push", "-q", "-f", "origin", `${run.branch}:refs/loom/run/${run.id}/main`], run.dir).catch(() => { });
+        }
+        if (a.rt)
+            await this.deps.closeProject(a.rt).catch(() => { });
+        // Windows can retain a child's working-directory handle briefly after
+        // shutdown. Retry transient locks without blocking the daemon's event loop.
+        if (a.dir)
+            await fs.promises.rm(a.dir, { recursive: true, force: true, maxRetries: 10, retryDelay: 100 });
+    }
+    async cancel(a) {
+        if (a.rt && a.crewId)
+            await a.rt.crews.stop(a.crewId);
+        else if (a.rt && a.runId)
+            await a.rt.orchestra.abort(a.runId, "the job was cancelled").catch(() => { });
+        this.active.delete(a.job.id);
+        a.unsub?.();
+        await this.cleanup(a);
+    }
+    /**
+     * D69: the owner's goal needs a CI fix and the owner has been away 15+
+     * minutes — ask for it as a job for this runner, like an Adopt.
+     */
+    async rescueOwnGoals() {
+        const hub = this.deps.hub();
+        const me = this.deps.github();
+        const device = this.deps.deviceId();
+        if (!hub || !me || !device)
+            return;
+        for (const teamId of this.deps.teams()) {
+            const feed = this.deps.feed(teamId);
+            const presence = this.deps.presence(teamId);
+            const lastSeen = Math.max(0, ...presence.filter((p) => p.github === me && p.deviceId !== device).map((p) => p.ts));
+            for (const e of feed) {
+                if (e.type !== "goal_needs_someone" || e.github !== me || e.deviceId === device)
+                    continue;
+                const pr = Number(e.meta.pr);
+                const key = `${teamId}:${e.repo}#${pr}`;
+                if (!pr || this.autoFixed.has(key))
+                    continue;
+                const later = feed.filter((x) => x.id > e.id && Number(x.meta.pr ?? x.meta.number) === pr);
+                if (later.some((x) => ["goal_adopted", "goal_returned", "goal_landed", "pr_merged", "pr_closed"].includes(x.type)))
+                    continue;
+                if (Date.now() - Math.max(lastSeen, e.ts) < (this.deps.awayMs ?? OWNER_AWAY_MS))
+                    continue;
+                this.autoFixed.add(key);
+                await hub.createJob(teamId, {
+                    repo: e.repo,
+                    kind: "fix",
+                    target: device,
+                    deviceId: device,
+                    sealed: this.seal(teamId, {
+                        pr,
+                        url: String(e.meta.url ?? ""),
+                        branch: String(e.meta.branch ?? ""),
+                        ownerRunId: String(e.meta.runId ?? ""),
+                        from: "your runner (you were away)",
+                    }),
+                });
+                logbook.info("runner", `taking PR #${pr} while ${me} is away`);
+            }
+        }
+    }
+    status() {
+        return {
+            running: this.running,
+            registered: this.registered,
+            config: this.deps.config(),
+            token: Boolean(readRunnerToken()),
+            active: [...this.active.values()].map((a) => ({
+                jobId: a.job.id,
+                kind: a.job.kind,
+                repo: a.job.repo,
+                owner: a.job.github,
+                runId: a.runId,
+                project: a.rt?.info.id ?? null,
+            })),
+            lastError: this.lastError,
+        };
+    }
+}
+//# sourceMappingURL=runner.js.map