@namzu/cli 35.0.0 → 36.1.0

package/dist/chunks/chunk-V7TQR6AR.js

@@ -0,0 +1,818 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  ResidentCleanupUnconfirmedError
+} from "./chunk-UOOQPODR.js";
+import {
+  readIdentity
+} from "./chunk-TIGWWAJI.js";
+import {
+  cliProjectRoot
+} from "./chunk-H6B6AROX.js";
+import {
+  ensurePrivateStateDirectory,
+  publishPrivateJsonIfAbsent
+} from "./chunk-A5UXODFL.js";
+import {
+  DiskResidentAgenda,
+  ProjectDocumentSchema,
+  ResidentConflictError,
+  ResidentHost,
+  SessionPaths,
+  hashedSlugForCwd,
+  isEntityId,
+  resolveNamzuHome,
+  slugForCwd
+} from "./chunk-EWKJGHRO.js";
+import {
+  __name
+} from "./chunk-76FLAFCG.js";
+
+// src/integrations/resident/runner-control.ts
+import { timingSafeEqual } from "node:crypto";
+import { createConnection, createServer } from "node:net";
+var MAX_MESSAGE_BYTES = 4096;
+var MAX_OPEN_SOCKETS = 16;
+var DEFAULT_TIMEOUT_MS = 1500;
+var PHASES = ["starting", "idle", "working", "stopping"];
+function object(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+__name(object, "object");
+function exactKeys(value, keys) {
+  const actual = Object.keys(value);
+  return actual.length === keys.length && actual.every((key) => keys.includes(key));
+}
+__name(exactKeys, "exactKeys");
+function validIdentity(instanceId, token) {
+  return instanceId.length > 0 && instanceId.length <= 256 && token.length > 0 && token.length <= 512;
+}
+__name(validIdentity, "validIdentity");
+function validStatus(value) {
+  return typeof value.pid === "number" && Number.isSafeInteger(value.pid) && value.pid > 0 && typeof value.phase === "string" && PHASES.includes(value.phase) && typeof value.stepsStarted === "number" && Number.isSafeInteger(value.stepsStarted) && value.stepsStarted >= 0;
+}
+__name(validStatus, "validStatus");
+async function createRunnerControlServer(options) {
+  if (!validIdentity(options.instanceId, options.token))
+    throw new Error("Runner control requires a bounded instance identity and secret token.");
+  const expectedToken = Buffer.from(options.token);
+  const sockets = /* @__PURE__ */ new Set();
+  let stopRequested = false;
+  let stopFailed = false;
+  let closing = false;
+  let closePromise;
+  const requestStop = /* @__PURE__ */ __name(() => {
+    if (stopRequested) return;
+    stopRequested = true;
+    try {
+      options.onStop();
+    } catch (error) {
+      stopFailed = true;
+      throw error;
+    }
+  }, "requestStop");
+  const server = createServer((socket) => {
+    socket.on("error", () => {
+    });
+    if (closing || sockets.size >= MAX_OPEN_SOCKETS) {
+      socket.destroy();
+      return;
+    }
+    sockets.add(socket);
+    socket.once("close", () => sockets.delete(socket));
+    const deadline = setTimeout(() => socket.destroy(), DEFAULT_TIMEOUT_MS);
+    socket.once("close", () => clearTimeout(deadline));
+    let buffered = Buffer.alloc(0);
+    let handled = false;
+    socket.on("data", (chunk) => {
+      if (handled || buffered.length + chunk.length > MAX_MESSAGE_BYTES) {
+        socket.destroy();
+        return;
+      }
+      buffered = Buffer.concat([buffered, chunk]);
+      const newline = buffered.indexOf(10);
+      if (newline < 0) return;
+      handled = true;
+      if (newline !== buffered.length - 1) {
+        socket.destroy();
+        return;
+      }
+      try {
+        const request = JSON.parse(buffered.subarray(0, newline).toString("utf8"));
+        if (!object(request) || !exactKeys(request, ["version", "instanceId", "token", "action"]) || request.version !== 1 || request.instanceId !== options.instanceId || typeof request.token !== "string" || request.action !== "status" && request.action !== "stop") {
+          socket.destroy();
+          return;
+        }
+        const token = Buffer.from(request.token);
+        if (token.length !== expectedToken.length || !timingSafeEqual(token, expectedToken)) {
+          socket.destroy();
+          return;
+        }
+        if (request.action === "stop") requestStop();
+        if (stopFailed) throw new Error("Runner stop callback failed.");
+        const state = options.getStatus();
+        if (!object(state) || !validStatus(state)) throw new Error("Invalid runner state.");
+        socket.end(
+          `${JSON.stringify({
+            version: 1,
+            instanceId: options.instanceId,
+            pid: state.pid,
+            phase: stopRequested ? "stopping" : state.phase,
+            stepsStarted: state.stepsStarted,
+            stopRequested
+          })}
+`
+        );
+      } catch {
+        socket.destroy();
+      }
+    });
+  });
+  const close = /* @__PURE__ */ __name(() => {
+    if (closePromise) return closePromise;
+    closing = true;
+    closePromise = new Promise((resolve3, reject) => {
+      server.close((error) => {
+        if (error && error.code !== "ERR_SERVER_NOT_RUNNING")
+          reject(error);
+        else resolve3();
+      });
+      for (const socket of sockets) socket.destroy();
+    });
+    return closePromise;
+  }, "close");
+  await new Promise((resolve3, reject) => {
+    const failed = /* @__PURE__ */ __name((error) => reject(error), "failed");
+    server.once("error", failed);
+    server.listen({ host: "127.0.0.1", port: 0, exclusive: true }, () => {
+      server.removeListener("error", failed);
+      resolve3();
+    });
+  });
+  server.on("error", () => {
+    try {
+      requestStop();
+    } catch {
+    }
+    void close().catch(() => {
+    });
+  });
+  const address = server.address();
+  if (address === null || typeof address === "string") {
+    await close();
+    throw new Error("Runner control did not acquire a loopback port.");
+  }
+  return { port: address.port, close };
+}
+__name(createRunnerControlServer, "createRunnerControlServer");
+function queryRunner(record, action, options = {}) {
+  const timeoutMs = options.timeoutMs ?? DEFAULT_TIMEOUT_MS;
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > 6e4)
+    throw new Error("Runner control timeout must be a whole number from 1 to 60000 milliseconds.");
+  if (!validIdentity(record.instanceId, record.token) || !Number.isSafeInteger(record.port) || (record.port ?? 0) < 1 || (record.port ?? 0) > 65535 || !Number.isSafeInteger(record.pid) || (record.pid ?? 0) < 1 || action !== "status" && action !== "stop")
+    return Promise.resolve({
+      kind: "unresponsive",
+      reason: "Runner control endpoint is unavailable."
+    });
+  return new Promise((resolve3) => {
+    const socket = createConnection({ host: "127.0.0.1", port: record.port });
+    let settled = false;
+    let buffered = Buffer.alloc(0);
+    const finish = /* @__PURE__ */ __name((result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(deadline);
+      socket.destroy();
+      resolve3(result);
+    }, "finish");
+    const unresponsive = /* @__PURE__ */ __name((reason) => finish({ kind: "unresponsive", reason }), "unresponsive");
+    const deadline = setTimeout(() => unresponsive("Runner control response timed out."), timeoutMs);
+    socket.once("error", () => unresponsive("Runner control connection failed."));
+    socket.once("close", () => unresponsive("Runner control closed without a valid response."));
+    socket.once("connect", () => {
+      socket.write(
+        `${JSON.stringify({ version: 1, instanceId: record.instanceId, token: record.token, action })}
+`
+      );
+    });
+    socket.on("data", (chunk) => {
+      if (buffered.length + chunk.length > MAX_MESSAGE_BYTES) {
+        unresponsive("Runner control response exceeded its size limit.");
+        return;
+      }
+      buffered = Buffer.concat([buffered, chunk]);
+      const newline = buffered.indexOf(10);
+      if (newline < 0) return;
+      try {
+        const response = JSON.parse(buffered.subarray(0, newline).toString("utf8"));
+        if (newline !== buffered.length - 1 || !object(response) || !exactKeys(response, [
+          "version",
+          "instanceId",
+          "pid",
+          "phase",
+          "stepsStarted",
+          "stopRequested"
+        ]) || response.version !== 1 || response.instanceId !== record.instanceId || response.pid !== record.pid || !validStatus(response) || typeof response.stopRequested !== "boolean" || response.stopRequested && response.phase !== "stopping" || action === "stop" && !response.stopRequested)
+          throw new Error("Invalid response.");
+        finish({
+          kind: "responsive",
+          instanceId: record.instanceId,
+          pid: response.pid,
+          phase: response.phase,
+          stepsStarted: response.stepsStarted,
+          stopRequested: response.stopRequested
+        });
+      } catch {
+        unresponsive("Runner control returned an invalid response.");
+      }
+    });
+  });
+}
+__name(queryRunner, "queryRunner");
+
+// src/integrations/resident/storage.ts
+import { lstatSync, readFileSync } from "node:fs";
+import { readFile, realpath } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve, sep } from "node:path";
+var MANDATE = "Pursue only objectives explicitly added by this project\u2019s operator. Respect project instructions and current tool permissions.";
+function residentsRootFor(root, slug) {
+  return join(new SessionPaths({ home: root, slug }).projectDir(), "residents");
+}
+__name(residentsRootFor, "residentsRootFor");
+function residentDirectoryFor(root, slug, agentKey) {
+  return new SessionPaths({ home: root, slug }).residentDir(agentKey);
+}
+__name(residentDirectoryFor, "residentDirectoryFor");
+async function findResidentProject(root, projectRoot) {
+  for (const slug of [slugForCwd(projectRoot), hashedSlugForCwd(projectRoot)]) {
+    const file = new SessionPaths({ home: root, slug }).projectFile();
+    let raw;
+    try {
+      const entry = lstatSync(file);
+      if (!entry.isFile() || entry.isSymbolicLink())
+        throw new Error(`${file} must be a regular file, without a symbolic link.`);
+      raw = await readFile(file, "utf8");
+    } catch (error) {
+      if (error.code === "ENOENT") return null;
+      throw error;
+    }
+    const document = ProjectDocumentSchema.parse(JSON.parse(raw));
+    if (document.cwd === projectRoot) return { slug, projectId: document.projectId };
+  }
+  return null;
+}
+__name(findResidentProject, "findResidentProject");
+function validateAgentKey(agentKey) {
+  if (!/^[a-z0-9][a-z0-9_-]{0,63}$/u.test(agentKey)) {
+    throw new Error(
+      "Resident agent key must contain 1\u201364 lowercase letters, digits, underscores or hyphens, starting with a letter or digit."
+    );
+  }
+}
+__name(validateAgentKey, "validateAgentKey");
+function existingDirectory(path) {
+  try {
+    const entry = lstatSync(path);
+    if (!entry.isDirectory() || entry.isSymbolicLink()) {
+      throw new Error(`Resident state must use a real directory: ${path}`);
+    }
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+__name(existingDirectory, "existingDirectory");
+function readBinding(residentsRoot, expected, projectRoot) {
+  const agentRoot = join(residentsRoot, expected.agentKey);
+  if (!existingDirectory(residentsRoot) || !existingDirectory(agentRoot)) return null;
+  const path = join(agentRoot, "binding.json");
+  try {
+    const entry = lstatSync(path);
+    if (!entry.isFile() || entry.isSymbolicLink()) {
+      throw new Error("expected a regular file, without a symbolic link");
+    }
+    const raw = JSON.parse(readFileSync(path, "utf8"));
+    if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+      throw new Error("expected an object");
+    }
+    const value = raw;
+    if (value.version !== 1 || value.tenantId !== expected.tenantId || value.projectId !== expected.projectId || value.agentKey !== expected.agentKey) {
+      throw new Error("version, tenant, project or agent key does not match this resident");
+    }
+    const cwd = value.cwd;
+    if (typeof cwd !== "string" || cwd.includes("\0") || !isAbsolute(cwd) || resolve(cwd) !== cwd) {
+      throw new Error("expected an absolute canonical execution directory");
+    }
+    const withinProject = relative(projectRoot, cwd);
+    if (withinProject === ".." || withinProject.startsWith(`..${sep}`) || isAbsolute(withinProject)) {
+      throw new Error("execution directory is outside the bound project");
+    }
+    return { version: 1, ...expected, cwd };
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw new Error(
+      `${path} is not a valid resident binding: ${error instanceof Error ? error.message : String(error)}. Refusing to replace it.`
+    );
+  }
+}
+__name(readBinding, "readBinding");
+function residentHandle(root, slug, binding) {
+  return {
+    agenda: new DiskResidentAgenda(residentsRootFor(root, slug), binding),
+    cwd: binding.cwd,
+    agentKey: binding.agentKey,
+    artifactsRoot: join(residentDirectoryFor(root, slug, binding.agentKey), "attempts"),
+    projectId: binding.projectId,
+    tenantId: binding.tenantId,
+    root,
+    slug
+  };
+}
+__name(residentHandle, "residentHandle");
+async function lookupResident(cwd, agentKey) {
+  validateAgentKey(agentKey);
+  const root = resolveNamzuHome();
+  const identity = readIdentity(root);
+  if (!identity) return null;
+  const workingDirectory = await realpath(resolve(cwd));
+  const projectRoot = cliProjectRoot(workingDirectory);
+  const project = await findResidentProject(root, projectRoot);
+  if (!project) return null;
+  const binding = readBinding(
+    residentsRootFor(root, project.slug),
+    { tenantId: identity.tenantId, projectId: project.projectId, agentKey },
+    projectRoot
+  );
+  return binding ? residentHandle(root, project.slug, binding) : null;
+}
+__name(lookupResident, "lookupResident");
+async function createResident(cwd, agentKey) {
+  validateAgentKey(agentKey);
+  const workingDirectory = await realpath(resolve(cwd));
+  const { openSessions } = await import("./store-6J2MUGON.js");
+  const sessions = await openSessions(workingDirectory);
+  const projectRoot = cliProjectRoot(workingDirectory);
+  const project = await findResidentProject(sessions.root, projectRoot);
+  if (!project || project.projectId !== sessions.projectId)
+    throw new Error(
+      `The project for ${projectRoot} is not filed under ${join(sessions.root, "projects")}; refusing to place resident state elsewhere.`
+    );
+  const residentsRoot = ensurePrivateStateDirectory(
+    new SessionPaths({ home: sessions.root, slug: project.slug }).projectDir(),
+    "residents"
+  );
+  const agentRoot = ensurePrivateStateDirectory(residentsRoot, agentKey);
+  const expected = { tenantId: sessions.tenantId, projectId: sessions.projectId, agentKey };
+  let binding = readBinding(residentsRoot, expected, projectRoot);
+  if (!binding) {
+    publishPrivateJsonIfAbsent(join(agentRoot, "binding.json"), {
+      version: 1,
+      ...expected,
+      cwd: workingDirectory
+    });
+    binding = readBinding(residentsRoot, expected, projectRoot);
+    if (!binding) throw new Error("Resident binding disappeared while it was being initialized.");
+  }
+  const resident = residentHandle(sessions.root, project.slug, binding);
+  let agenda = await resident.agenda.read();
+  if (!agenda) {
+    try {
+      agenda = await resident.agenda.create(MANDATE);
+    } catch (error) {
+      if (!(error instanceof ResidentConflictError)) throw error;
+      agenda = await resident.agenda.read();
+      if (!agenda) throw error;
+    }
+  }
+  if (agenda.identity !== MANDATE) {
+    throw new Error("Resident agenda mandate does not match the CLI operator mandate.");
+  }
+  ensurePrivateStateDirectory(agentRoot, "attempts");
+  return resident;
+}
+__name(createResident, "createResident");
+
+// src/integrations/resident/runner-store.ts
+import { randomBytes, randomUUID } from "node:crypto";
+import { lstatSync as lstatSync2, readFileSync as readFileSync2, readdirSync } from "node:fs";
+import { isAbsolute as isAbsolute2, join as join2, resolve as resolve2 } from "node:path";
+import { isDeepStrictEqual } from "node:util";
+var UUID = /^[0-9a-f]{8}-(?:[0-9a-f]{4}-){3}[0-9a-f]{12}$/u;
+var REVISION_NAME = /^([1-9][0-9]{0,15})\.json$/u;
+var FIELDS = [
+  "version",
+  "revision",
+  "instanceId",
+  "tenantId",
+  "projectId",
+  "agentKey",
+  "cwd",
+  "mode",
+  "phase",
+  "reservedAt",
+  "maxSteps",
+  "pauseGeneration",
+  "pid",
+  "port",
+  "token",
+  "endedAt",
+  "outcome"
+];
+function integer(value, minimum) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= minimum;
+}
+__name(integer, "integer");
+function canonicalPath(value) {
+  return !value.includes("\0") && isAbsolute2(value) && resolve2(value) === value;
+}
+__name(canonicalPath, "canonicalPath");
+function location(resident) {
+  if (!isEntityId(resident.tenantId, "tenant") || !isEntityId(resident.projectId, "project") || !/^[a-z0-9][a-z0-9_-]{0,63}$/u.test(resident.agentKey) || !/^[A-Za-z0-9-]+$/u.test(resident.slug) || !canonicalPath(resident.root) || !canonicalPath(resident.cwd)) {
+    throw new Error("Invalid resident scope for runner ownership.");
+  }
+  const base = residentDirectoryFor(resident.root, resident.slug, resident.agentKey);
+  if (resident.artifactsRoot !== join2(base, "attempts")) {
+    throw new Error("Resident runner path does not match its bound project and agent.");
+  }
+  return { base, runner: join2(base, "runner"), revisions: join2(base, "runner", "revisions") };
+}
+__name(location, "location");
+function realDirectory(path) {
+  try {
+    const entry = lstatSync2(path);
+    if (!entry.isDirectory() || entry.isSymbolicLink()) {
+      throw new Error(`Resident runner state requires a real directory: ${path}`);
+    }
+    return true;
+  } catch (error) {
+    if (error.code === "ENOENT") return false;
+    throw error;
+  }
+}
+__name(realDirectory, "realDirectory");
+function revisions(resident) {
+  const paths = location(resident);
+  let current = resident.root;
+  if (!realDirectory(current)) return [];
+  for (const segment of [
+    "projects",
+    resident.slug,
+    "residents",
+    resident.agentKey,
+    "runner",
+    "revisions"
+  ]) {
+    current = join2(current, segment);
+    if (!realDirectory(current)) return [];
+  }
+  const numbers = [];
+  for (const entry of readdirSync(paths.revisions, { withFileTypes: true })) {
+    if (/^[1-9][0-9]{0,15}\.json\.candidate\.[0-9a-f-]+$/u.test(entry.name)) continue;
+    const match = REVISION_NAME.exec(entry.name);
+    const revision = match ? Number(match[1]) : Number.NaN;
+    if (!integer(revision, 1) || !entry.isFile() || entry.isSymbolicLink()) {
+      throw new Error(
+        `Invalid resident runner revision entry: ${join2(paths.revisions, entry.name)}`
+      );
+    }
+    numbers.push(revision);
+  }
+  return numbers.sort((left, right) => right - left);
+}
+__name(revisions, "revisions");
+function checked(resident, raw, revision) {
+  if (raw === null || typeof raw !== "object" || Array.isArray(raw)) {
+    throw new Error("Resident runner record must be an object.");
+  }
+  const value = raw;
+  if (Object.keys(value).length !== FIELDS.length || FIELDS.some((field) => !(field in value))) {
+    throw new Error("Resident runner record has missing or unsupported fields.");
+  }
+  if (value.version !== 1 || value.revision !== revision || !integer(value.revision, 1) || typeof value.instanceId !== "string" || !UUID.test(value.instanceId) || value.tenantId !== resident.tenantId || value.projectId !== resident.projectId || value.agentKey !== resident.agentKey || value.cwd !== resident.cwd || value.mode !== "foreground" && value.mode !== "background" || !["reserved", "running", "stopped", "released"].includes(String(value.phase)) || !integer(value.reservedAt, 0) || !integer(value.maxSteps, 1) || !integer(value.pauseGeneration, 0) || value.pid !== null && !integer(value.pid, 1) || value.port !== null && (!integer(value.port, 1) || value.port > 65535) || typeof value.token !== "string" || !/^[0-9a-f]{64}$/u.test(value.token)) {
+    throw new Error("Resident runner version, revision, scope or ownership metadata is invalid.");
+  }
+  const terminal = value.phase === "stopped" || value.phase === "released";
+  if ((terminal ? !integer(value.endedAt, 0) || typeof value.outcome !== "string" || !value.outcome.trim() || value.outcome.length > 8e3 : value.endedAt !== null || value.outcome !== null) || value.phase === "reserved" && (value.pid !== null || value.port !== null) || value.phase === "running" && value.pid === null || value.pid === null && value.port !== null || value.mode === "background" && value.pid !== null && value.port === null) {
+    throw new Error("Resident runner phase and process metadata disagree.");
+  }
+  return Object.freeze(value);
+}
+__name(checked, "checked");
+function readRevision(resident, revision) {
+  const path = join2(location(resident).revisions, `${revision}.json`);
+  try {
+    const entry = lstatSync2(path);
+    if (!entry.isFile() || entry.isSymbolicLink() || entry.size > 64 * 1024) {
+      throw new Error("expected a bounded regular file without a symbolic link");
+    }
+    return checked(resident, JSON.parse(readFileSync2(path, "utf8")), revision);
+  } catch (error) {
+    const detail = error instanceof SyntaxError ? "invalid JSON" : error instanceof Error ? error.message : "unknown read failure";
+    throw new Error(
+      `Cannot read resident runner revision ${path}: ${detail}. Refusing ownership recovery from damaged state.`
+    );
+  }
+}
+__name(readRevision, "readRevision");
+function readRunner(resident) {
+  const head = revisions(resident)[0];
+  return head === void 0 ? null : readRevision(resident, head);
+}
+__name(readRunner, "readRunner");
+function readRunnerInstance(resident, instanceId) {
+  if (!UUID.test(instanceId)) throw new Error("Invalid resident runner instance ID.");
+  for (const revision of revisions(resident)) {
+    const record = readRevision(resident, revision);
+    if (record.instanceId === instanceId) return record;
+  }
+  return null;
+}
+__name(readRunnerInstance, "readRunnerInstance");
+function publish(resident, expected, propose) {
+  const current = readRunner(resident);
+  if (!isDeepStrictEqual(current, expected)) throw new ResidentConflictError();
+  const next = (current?.revision ?? 0) + 1;
+  if (!integer(next, 1)) throw new Error("Resident runner revision overflow.");
+  const record = checked(resident, propose(next), next);
+  const paths = location(resident);
+  if (!realDirectory(paths.base)) throw new Error("Resident binding directory is missing.");
+  const runner = ensurePrivateStateDirectory(paths.base, "runner");
+  const directory = ensurePrivateStateDirectory(runner, "revisions");
+  publishPrivateJsonIfAbsent(join2(directory, `${next}.json`), record);
+  if (!isDeepStrictEqual(readRevision(resident, next), record)) throw new ResidentConflictError();
+  return record;
+}
+__name(publish, "publish");
+function reserveRunner(resident, options) {
+  if (options.mode !== "foreground" && options.mode !== "background" || !integer(options.maxSteps, 1) || !integer(options.pauseGeneration, 0)) {
+    throw new Error("Invalid resident runner invocation limits or mode.");
+  }
+  const current = readRunner(resident);
+  if (current && current.phase !== "stopped" && current.phase !== "released") {
+    throw new ResidentConflictError();
+  }
+  return publish(resident, current, (revision) => ({
+    version: 1,
+    revision,
+    instanceId: randomUUID(),
+    tenantId: resident.tenantId,
+    projectId: resident.projectId,
+    agentKey: resident.agentKey,
+    cwd: resident.cwd,
+    mode: options.mode,
+    phase: "reserved",
+    reservedAt: Date.now(),
+    maxSteps: options.maxSteps,
+    pauseGeneration: options.pauseGeneration,
+    pid: null,
+    port: null,
+    token: randomBytes(32).toString("hex"),
+    endedAt: null,
+    outcome: null
+  }));
+}
+__name(reserveRunner, "reserveRunner");
+function attachRunning(resident, expected, process2) {
+  if (expected.phase !== "reserved") throw new ResidentConflictError();
+  return publish(resident, expected, (revision) => ({
+    ...expected,
+    revision,
+    phase: "running",
+    pid: process2.pid,
+    port: process2.port
+  }));
+}
+__name(attachRunning, "attachRunning");
+function finishRunner(resident, expected, outcome) {
+  if (expected.phase !== "reserved" && expected.phase !== "running") {
+    throw new ResidentConflictError();
+  }
+  return publish(resident, expected, (revision) => ({
+    ...expected,
+    revision,
+    phase: "stopped",
+    endedAt: Date.now(),
+    outcome
+  }));
+}
+__name(finishRunner, "finishRunner");
+function releaseRunner(resident, expected) {
+  if (expected.phase !== "reserved" && expected.phase !== "running") {
+    throw new ResidentConflictError();
+  }
+  return publish(resident, expected, (revision) => ({
+    ...expected,
+    revision,
+    phase: "released",
+    endedAt: Date.now(),
+    outcome: "Operator explicitly released this owner after inspecting stopped executors."
+  }));
+}
+__name(releaseRunner, "releaseRunner");
+function publicRunner(record) {
+  return {
+    version: record.version,
+    revision: record.revision,
+    instanceId: record.instanceId,
+    tenantId: record.tenantId,
+    projectId: record.projectId,
+    agentKey: record.agentKey,
+    cwd: record.cwd,
+    mode: record.mode,
+    phase: record.phase,
+    reservedAt: record.reservedAt,
+    maxSteps: record.maxSteps,
+    pauseGeneration: record.pauseGeneration,
+    pid: record.pid,
+    port: record.port,
+    endedAt: record.endedAt,
+    outcome: record.outcome
+  };
+}
+__name(publicRunner, "publicRunner");
+
+// src/integrations/resident/foreground.ts
+import { setTimeout as sleep } from "node:timers/promises";
+async function runResidentForeground(options) {
+  const { agenda } = options;
+  if (!agenda.executionAt) throw new Error("Resident execution requires atomic admission.");
+  const interval = options.pollIntervalMs ?? 250;
+  if (!Number.isSafeInteger(interval) || interval < 1 || interval > 6e4)
+    throw new Error("Invalid resident control polling interval.");
+  options.signal.throwIfAborted();
+  const initial = await agenda.read();
+  if (!initial) throw new Error("No resident agenda exists here.");
+  const generation = options.expectedPauseGeneration ?? initial.pauseGeneration ?? 0;
+  const controller = new AbortController();
+  const signal = AbortSignal.any([options.signal, controller.signal]);
+  const fence = /* @__PURE__ */ __name((state) => {
+    if (!state) throw new Error("Resident agenda disappeared during execution.");
+    if ((state.pauseGeneration ?? 0) !== generation)
+      controller.abort(new Error("A durable pause request ended this invocation."));
+    return state;
+  }, "fence");
+  const read = /* @__PURE__ */ __name(async () => {
+    await options.checkControl?.();
+    return fence(await agenda.read());
+  }, "read");
+  const guarded = {
+    read,
+    create: /* @__PURE__ */ __name((...args) => agenda.create(...args), "create"),
+    add: /* @__PURE__ */ __name((...args) => agenda.add(...args), "add"),
+    setPaused: /* @__PURE__ */ __name((...args) => agenda.setPaused(...args), "setPaused"),
+    wake: /* @__PURE__ */ __name((...args) => agenda.wake(...args), "wake"),
+    execution: /* @__PURE__ */ __name((id) => agenda.execution(id), "execution"),
+    executionAt: /* @__PURE__ */ __name((id, expected) => {
+      const execution = agenda.executionAt?.(id, expected);
+      if (!execution) throw new Error("Resident atomic admission was removed.");
+      return {
+        read: /* @__PURE__ */ __name(() => execution.read(), "read"),
+        claim: /* @__PURE__ */ __name(async (...args) => {
+          await read();
+          signal.throwIfAborted();
+          return execution.claim(...args);
+        }, "claim"),
+        settle: /* @__PURE__ */ __name((...args) => execution.settle(...args), "settle")
+      };
+    }, "executionAt")
+  };
+  const host = new ResidentHost(
+    guarded,
+    async (...args) => {
+      await read();
+      signal.throwIfAborted();
+      return options.step(...args);
+    },
+    { learning: true }
+  );
+  const monitorStop = new AbortController();
+  let monitorFailure;
+  let lastRevision = initial.revision;
+  const monitor = (async () => {
+    try {
+      while (!monitorStop.signal.aborted) {
+        await sleep(interval, void 0, { signal: monitorStop.signal });
+        const state = await read();
+        if (state.revision !== lastRevision) {
+          lastRevision = state.revision;
+          host.notify();
+        }
+      }
+    } catch (error) {
+      if (!monitorStop.signal.aborted) {
+        monitorFailure = error;
+        controller.abort(error);
+      }
+    }
+  })();
+  try {
+    const result = await host.run({
+      signal,
+      maxSteps: options.maxSteps,
+      ...options.keepAlive !== void 0 ? { keepAlive: options.keepAlive } : {},
+      ...options.maxIdleMs !== void 0 ? { maxIdleMs: options.maxIdleMs } : {}
+    });
+    if (monitorFailure) throw monitorFailure;
+    return result;
+  } finally {
+    monitorStop.abort();
+    await monitor;
+  }
+}
+__name(runResidentForeground, "runResidentForeground");
+
+// src/integrations/resident/owned-runner.ts
+async function runOwnedResident(options) {
+  const { resident } = options;
+  let owner = options.owner;
+  let phase = "starting";
+  let stepsStarted = 0;
+  const controller = new AbortController();
+  const signal = AbortSignal.any([options.signal, controller.signal]);
+  const abort = /* @__PURE__ */ __name(() => {
+    phase = "stopping";
+    controller.abort(new Error("Resident runner stop requested."));
+  }, "abort");
+  const checkControl = /* @__PURE__ */ __name(async () => {
+    const current = readRunner(resident);
+    if (current?.instanceId !== owner.instanceId || current.phase !== "running")
+      throw new Error("Resident runner ownership changed; this invocation is fenced.");
+  }, "checkControl");
+  let server;
+  let outcome = "startup_failed";
+  let cleanupConfirmed = true;
+  try {
+    signal.throwIfAborted();
+    const state = await resident.agenda.read();
+    if (!state || state.paused || (state.pauseGeneration ?? 0) !== owner.pauseGeneration)
+      throw new Error(
+        "Resident admission changed before runner startup. Resume and start a new invocation."
+      );
+    if (state.pursuits.some((p) => p.state.phase === "running"))
+      throw new Error("Inspect and reconcile unresolved work before starting a runner.");
+    server = await createRunnerControlServer({
+      instanceId: owner.instanceId,
+      token: owner.token,
+      getStatus: /* @__PURE__ */ __name(() => ({
+        pid: process.pid,
+        phase: signal.aborted ? "stopping" : phase,
+        stepsStarted
+      }), "getStatus"),
+      onStop: abort
+    });
+    owner = attachRunning(resident, owner, { pid: process.pid, port: server.port });
+    await checkControl();
+    await options.ready?.(publicRunner(owner), signal);
+    signal.throwIfAborted();
+    phase = "idle";
+    const result = await runResidentForeground({
+      agenda: resident.agenda,
+      step: /* @__PURE__ */ __name(async (...args) => {
+        phase = "working";
+        stepsStarted++;
+        try {
+          return await options.step(...args);
+        } catch (error) {
+          if (error instanceof ResidentCleanupUnconfirmedError) cleanupConfirmed = false;
+          throw error;
+        } finally {
+          phase = signal.aborted ? "stopping" : "idle";
+        }
+      }, "step"),
+      signal,
+      maxSteps: owner.maxSteps,
+      maxIdleMs: options.maxIdleMs,
+      keepAlive: options.keepAlive,
+      expectedPauseGeneration: owner.pauseGeneration,
+      checkControl,
+      ...options.pollIntervalMs ? { pollIntervalMs: options.pollIntervalMs } : {}
+    });
+    outcome = result.status;
+    return result;
+  } catch (error) {
+    if (error instanceof ResidentCleanupUnconfirmedError) cleanupConfirmed = false;
+    outcome = signal.aborted ? "cancelled" : "failed";
+    throw error;
+  } finally {
+    phase = "stopping";
+    await server?.close();
+    if (cleanupConfirmed) finishRunner(resident, owner, outcome);
+  }
+}
+__name(runOwnedResident, "runOwnedResident");
+
+export {
+  queryRunner,
+  residentDirectoryFor,
+  lookupResident,
+  createResident,
+  readRunner,
+  readRunnerInstance,
+  reserveRunner,
+  finishRunner,
+  releaseRunner,
+  publicRunner,
+  runOwnedResident
+};
+//# sourceMappingURL=chunk-V7TQR6AR.js.map