@neotx/core 0.1.0-alpha.0

package/dist/index.js

@@ -0,0 +1,3190 @@
+// src/agents/loader.ts
+import { readFile } from "fs/promises";
+import path from "path";
+import { parse as parseYaml } from "yaml";
+
+// src/agents/schema.ts
+import { z } from "zod";
+var agentModelSchema = z.enum(["opus", "sonnet", "haiku"]);
+var agentToolSchema = z.enum([
+  "Read",
+  "Write",
+  "Edit",
+  "Bash",
+  "Glob",
+  "Grep",
+  "Agent",
+  "WebSearch",
+  "WebFetch",
+  "NotebookEdit"
+]);
+var agentToolEntrySchema = z.union([agentToolSchema, z.literal("$inherited")]);
+var agentSandboxSchema = z.enum(["writable", "readonly"]);
+var agentConfigSchema = z.object({
+  name: z.string(),
+  extends: z.string().optional(),
+  description: z.string().optional(),
+  model: agentModelSchema.optional(),
+  tools: z.array(agentToolEntrySchema).optional(),
+  prompt: z.string().optional(),
+  promptAppend: z.string().optional(),
+  sandbox: agentSandboxSchema.optional(),
+  maxTurns: z.number().optional(),
+  mcpServers: z.array(z.string()).optional()
+});
+
+// src/agents/loader.ts
+async function loadAgentFile(filePath) {
+  let raw;
+  try {
+    raw = await readFile(filePath, "utf-8");
+  } catch {
+    throw new Error(`Agent file not found: ${filePath}`);
+  }
+  let parsed;
+  try {
+    parsed = parseYaml(raw);
+  } catch (err) {
+    throw new Error(
+      `Invalid YAML in agent file ${filePath}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  const result = agentConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    const issues = result.error.issues.map((i) => `  - ${i.path.join(".")}: ${i.message}`).join("\n");
+    throw new Error(`Invalid agent config in ${filePath}:
+${issues}`);
+  }
+  const config = result.data;
+  if (config.prompt?.endsWith(".md")) {
+    const promptPath = path.resolve(path.dirname(filePath), config.prompt);
+    try {
+      config.prompt = await readFile(promptPath, "utf-8");
+    } catch {
+      throw new Error(`Prompt file not found: ${promptPath} (referenced in ${filePath})`);
+    }
+  }
+  return config;
+}
+
+// src/agents/registry.ts
+import { readdir } from "fs/promises";
+import path2 from "path";
+
+// src/agents/resolver.ts
+function resolveAgent(config, builtIns) {
+  const extendsName = config.extends ?? (builtIns.has(config.name) && config.extends === void 0 ? config.name : void 0);
+  const isExtending = extendsName !== void 0;
+  if (isExtending) {
+    const base = builtIns.get(extendsName);
+    if (!base) {
+      throw new Error(
+        `Agent "${config.name}" extends "${extendsName}", but no built-in agent with that name exists.`
+      );
+    }
+    let tools2;
+    if (config.tools) {
+      if (config.tools.includes("$inherited")) {
+        const baseTols = base.tools ?? [];
+        const newTools = config.tools.filter((t) => t !== "$inherited");
+        tools2 = [...baseTols, ...newTools];
+      } else {
+        tools2 = config.tools;
+      }
+    } else {
+      tools2 = base.tools ?? [];
+    }
+    let prompt2;
+    if (config.prompt) {
+      prompt2 = config.prompt;
+    } else {
+      prompt2 = base.prompt ?? "";
+    }
+    if (config.promptAppend) {
+      prompt2 = `${prompt2}
+
+${config.promptAppend}`;
+    }
+    const definition2 = {
+      description: config.description ?? base.description ?? "",
+      prompt: prompt2,
+      tools: tools2,
+      model: config.model ?? base.model ?? "sonnet"
+    };
+    return {
+      name: config.name,
+      definition: definition2,
+      sandbox: config.sandbox ?? base.sandbox ?? "readonly",
+      ...config.maxTurns !== void 0 ? { maxTurns: config.maxTurns } : base.maxTurns !== void 0 ? { maxTurns: base.maxTurns } : {},
+      source: config.name === extendsName && !config.extends ? "built-in" : "extended"
+    };
+  }
+  if (!config.description) {
+    throw new Error(
+      `Agent "${config.name}" has no "extends" and no "description". Add a 'description' field to the agent YAML.`
+    );
+  }
+  if (!config.model) {
+    throw new Error(
+      `Agent "${config.name}" has no "extends" and no "model". Add a 'model' field (e.g., 'claude-sonnet-4-20250514').`
+    );
+  }
+  if (!config.tools) {
+    throw new Error(
+      `Agent "${config.name}" has no "extends" and no "tools". Add a 'tools' array to the agent YAML.`
+    );
+  }
+  if (!config.sandbox) {
+    throw new Error(
+      `Agent "${config.name}" has no "extends" and no "sandbox". Add a 'sandbox' field ('full' or 'permissive').`
+    );
+  }
+  if (!config.prompt) {
+    throw new Error(
+      `Agent "${config.name}" has no "extends" and no "prompt". Add a 'prompt' field or 'promptFile' reference.`
+    );
+  }
+  const tools = config.tools.filter((t) => t !== "$inherited");
+  let prompt = config.prompt;
+  if (config.promptAppend) {
+    prompt = `${prompt}
+
+${config.promptAppend}`;
+  }
+  const definition = {
+    description: config.description,
+    prompt,
+    tools,
+    model: config.model
+  };
+  return {
+    name: config.name,
+    definition,
+    sandbox: config.sandbox,
+    ...config.maxTurns !== void 0 ? { maxTurns: config.maxTurns } : {},
+    source: "custom"
+  };
+}
+
+// src/agents/registry.ts
+var AgentRegistry = class {
+  builtInDir;
+  customDir;
+  agents = /* @__PURE__ */ new Map();
+  constructor(builtInDir, customDir) {
+    this.builtInDir = builtInDir;
+    this.customDir = customDir;
+  }
+  async load() {
+    this.agents.clear();
+    const builtInConfigs = await loadAgentsFromDir(this.builtInDir);
+    const builtInMap = /* @__PURE__ */ new Map();
+    for (const config of builtInConfigs) {
+      builtInMap.set(config.name, config);
+    }
+    for (const config of builtInConfigs) {
+      const resolved = resolveAgent(config, builtInMap);
+      this.agents.set(config.name, { ...resolved, source: "built-in" });
+    }
+    if (this.customDir) {
+      let customConfigs;
+      try {
+        customConfigs = await loadAgentsFromDir(this.customDir);
+      } catch {
+        customConfigs = [];
+      }
+      for (const config of customConfigs) {
+        const resolved = resolveAgent(config, builtInMap);
+        this.agents.set(config.name, resolved);
+      }
+    }
+  }
+  get(name) {
+    return this.agents.get(name);
+  }
+  list() {
+    return [...this.agents.values()];
+  }
+  has(name) {
+    return this.agents.has(name);
+  }
+};
+async function loadAgentsFromDir(dir) {
+  const entries = await readdir(dir);
+  const ymlFiles = entries.filter((f) => f.endsWith(".yml") || f.endsWith(".yaml"));
+  const configs = [];
+  for (const file of ymlFiles) {
+    const config = await loadAgentFile(path2.join(dir, file));
+    configs.push(config);
+  }
+  return configs;
+}
+
+// src/concurrency/queue.ts
+var PRIORITY_ORDER = {
+  critical: 0,
+  high: 1,
+  medium: 2,
+  low: 3
+};
+var PriorityQueue = class {
+  items = [];
+  maxSize;
+  insertionCounter = 0;
+  constructor(maxSize) {
+    this.maxSize = maxSize;
+  }
+  enqueue(value, priority) {
+    if (this.items.length === 0) {
+      this.insertionCounter = 0;
+    }
+    if (this.items.length >= this.maxSize) {
+      throw new Error(`Queue full (${this.maxSize} items). Cannot enqueue.`);
+    }
+    const item = {
+      value,
+      priority,
+      insertionOrder: this.insertionCounter++
+    };
+    let inserted = false;
+    for (let i = 0; i < this.items.length; i++) {
+      const existing = this.items[i];
+      if (existing && this.comparePriority(item, existing) < 0) {
+        this.items.splice(i, 0, item);
+        inserted = true;
+        break;
+      }
+    }
+    if (!inserted) {
+      this.items.push(item);
+    }
+  }
+  dequeue() {
+    const item = this.items.shift();
+    return item?.value;
+  }
+  peek() {
+    return this.items[0]?.value;
+  }
+  get size() {
+    return this.items.length;
+  }
+  get isEmpty() {
+    return this.items.length === 0;
+  }
+  remove(predicate) {
+    const index = this.items.findIndex((entry) => predicate(entry.value));
+    if (index === -1) return false;
+    this.items.splice(index, 1);
+    return true;
+  }
+  /** Dequeue the first item matching the predicate (respects priority order). */
+  dequeueWhere(predicate) {
+    const index = this.items.findIndex((entry) => predicate(entry.value));
+    if (index === -1) return void 0;
+    const removed = this.items.splice(index, 1)[0];
+    if (!removed) return void 0;
+    return removed.value;
+  }
+  /** Compare by priority first, then by insertion order (FIFO within same priority). */
+  comparePriority(a, b) {
+    const priorityDiff = PRIORITY_ORDER[a.priority] - PRIORITY_ORDER[b.priority];
+    if (priorityDiff !== 0) return priorityDiff;
+    return a.insertionOrder - b.insertionOrder;
+  }
+};
+
+// src/concurrency/semaphore.ts
+var Semaphore = class {
+  maxSessions;
+  maxPerRepo;
+  queue;
+  callbacks;
+  // sessionId → repo
+  activeSessions = /* @__PURE__ */ new Map();
+  // repo → count
+  repoCounts = /* @__PURE__ */ new Map();
+  constructor(config, callbacks = {}) {
+    this.maxSessions = config.maxSessions;
+    this.maxPerRepo = config.maxPerRepo;
+    this.queue = new PriorityQueue(config.queueMax ?? 50);
+    this.callbacks = callbacks;
+  }
+  /**
+   * Acquire a slot. Blocks (via promise) if at capacity.
+   * Throws if the queue is full.
+   */
+  async acquire(repo, sessionId, priority = "medium", signal) {
+    if (signal?.aborted) {
+      throw signal.reason ?? new DOMException("The operation was aborted.", "AbortError");
+    }
+    if (this.canAcquire(repo)) {
+      this.allocate(repo, sessionId);
+      return;
+    }
+    return new Promise((resolve4, reject) => {
+      const entry = {
+        sessionId,
+        repo,
+        resolve: resolve4,
+        reject,
+        enqueuedAt: Date.now()
+      };
+      this.queue.enqueue(entry, priority);
+      this.callbacks.onEnqueue?.(sessionId, repo, this.queue.size);
+      if (signal) {
+        const onAbort = () => {
+          this.queue.remove((e) => e === entry);
+          reject(signal.reason ?? new DOMException("The operation was aborted.", "AbortError"));
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
+        entry._cleanupAbort = () => signal.removeEventListener("abort", onAbort);
+      }
+    });
+  }
+  /** Release a slot and process the next waiting entry. */
+  release(sessionId) {
+    const repo = this.activeSessions.get(sessionId);
+    if (!repo) return;
+    this.activeSessions.delete(sessionId);
+    const count = this.repoCounts.get(repo) ?? 0;
+    if (count <= 1) {
+      this.repoCounts.delete(repo);
+    } else {
+      this.repoCounts.set(repo, count - 1);
+    }
+    this.processQueue();
+  }
+  /** Non-blocking attempt to acquire a slot. Returns true if successful. */
+  tryAcquire(repo, sessionId) {
+    if (!this.canAcquire(repo)) return false;
+    this.allocate(repo, sessionId);
+    return true;
+  }
+  /** Total number of active slots. */
+  activeCount() {
+    return this.activeSessions.size;
+  }
+  /** Number of active slots for a specific repo. */
+  activeCountForRepo(repo) {
+    return this.repoCounts.get(repo) ?? 0;
+  }
+  /** Can a slot be acquired for this repo without blocking? */
+  isAvailable(repo) {
+    return this.canAcquire(repo);
+  }
+  /** Current queue depth. */
+  queueDepth() {
+    return this.queue.size;
+  }
+  canAcquire(repo) {
+    if (this.activeSessions.size >= this.maxSessions) return false;
+    const repoCount = this.repoCounts.get(repo) ?? 0;
+    return repoCount < this.maxPerRepo;
+  }
+  allocate(repo, sessionId) {
+    this.activeSessions.set(sessionId, repo);
+    this.repoCounts.set(repo, (this.repoCounts.get(repo) ?? 0) + 1);
+  }
+  processQueue() {
+    const entry = this.queue.dequeueWhere((e) => this.canAcquire(e.repo));
+    if (!entry) return;
+    this.allocate(entry.repo, entry.sessionId);
+    entry._cleanupAbort?.();
+    const waitedMs = Date.now() - entry.enqueuedAt;
+    this.callbacks.onDequeue?.(entry.sessionId, entry.repo, waitedMs);
+    entry.resolve();
+  }
+};
+
+// src/config.ts
+import { existsSync } from "fs";
+import { mkdir, readFile as readFile2, writeFile } from "fs/promises";
+import path4 from "path";
+import { parse as parseYaml2, stringify as stringifyYaml } from "yaml";
+import { z as z2 } from "zod";
+
+// src/paths.ts
+import { homedir } from "os";
+import path3 from "path";
+function getDataDir() {
+  return path3.join(homedir(), ".neo");
+}
+function getJournalsDir() {
+  return path3.join(getDataDir(), "journals");
+}
+function getRunsDir() {
+  return path3.join(getDataDir(), "runs");
+}
+function toRepoSlug(repo) {
+  const raw = repo.name ?? path3.basename(repo.path);
+  return raw.toLowerCase().replace(/[^a-z0-9._-]/g, "-").replace(/-+/g, "-").replace(/^-|-$/g, "");
+}
+function getRepoRunsDir(repoSlug) {
+  return path3.join(getRunsDir(), repoSlug);
+}
+function getRunDispatchPath(repoSlug, runId) {
+  return path3.join(getRepoRunsDir(repoSlug), `${runId}.dispatch.json`);
+}
+function getRunLogPath(repoSlug, runId) {
+  return path3.join(getRepoRunsDir(repoSlug), `${runId}.log`);
+}
+function getSupervisorsDir() {
+  return path3.join(getDataDir(), "supervisors");
+}
+function getSupervisorDir(name) {
+  return path3.join(getSupervisorsDir(), name);
+}
+function getSupervisorStatePath(name) {
+  return path3.join(getSupervisorDir(name), "state.json");
+}
+function getSupervisorMemoryPath(name) {
+  return path3.join(getSupervisorDir(name), "memory.md");
+}
+function getSupervisorActivityPath(name) {
+  return path3.join(getSupervisorDir(name), "activity.jsonl");
+}
+function getSupervisorInboxPath(name) {
+  return path3.join(getSupervisorDir(name), "inbox.jsonl");
+}
+function getSupervisorEventsPath(name) {
+  return path3.join(getSupervisorDir(name), "events.jsonl");
+}
+function getSupervisorLockPath(name) {
+  return path3.join(getSupervisorDir(name), "daemon.lock");
+}
+
+// src/config.ts
+var httpMcpServerSchema = z2.object({
+  type: z2.literal("http"),
+  url: z2.string(),
+  headers: z2.record(z2.string(), z2.string()).optional()
+});
+var stdioMcpServerSchema = z2.object({
+  type: z2.literal("stdio"),
+  command: z2.string(),
+  args: z2.array(z2.string()).optional(),
+  env: z2.record(z2.string(), z2.string()).optional()
+});
+var mcpServerConfigSchema = z2.discriminatedUnion("type", [
+  httpMcpServerSchema,
+  stdioMcpServerSchema
+]);
+var repoConfigSchema = z2.object({
+  path: z2.string(),
+  name: z2.string().optional(),
+  defaultBranch: z2.string().default("main"),
+  branchPrefix: z2.string().default("feat"),
+  pushRemote: z2.string().default("origin"),
+  autoCreatePr: z2.boolean().default(false),
+  prBaseBranch: z2.string().optional()
+});
+var globalConfigSchema = z2.object({
+  repos: z2.array(repoConfigSchema).default([]),
+  concurrency: z2.object({
+    maxSessions: z2.number().default(5),
+    maxPerRepo: z2.number().default(2),
+    queueMax: z2.number().default(50)
+  }).default({ maxSessions: 5, maxPerRepo: 2, queueMax: 50 }),
+  budget: z2.object({
+    dailyCapUsd: z2.number().default(500),
+    alertThresholdPct: z2.number().default(80)
+  }).default({ dailyCapUsd: 500, alertThresholdPct: 80 }),
+  recovery: z2.object({
+    maxRetries: z2.number().default(3),
+    backoffBaseMs: z2.number().default(3e4)
+  }).default({ maxRetries: 3, backoffBaseMs: 3e4 }),
+  sessions: z2.object({
+    initTimeoutMs: z2.number().default(12e4),
+    maxDurationMs: z2.number().default(36e5)
+  }).default({ initTimeoutMs: 12e4, maxDurationMs: 36e5 }),
+  webhooks: z2.array(
+    z2.object({
+      url: z2.string().url(),
+      events: z2.array(z2.string()).optional(),
+      secret: z2.string().optional(),
+      timeoutMs: z2.number().default(5e3)
+    })
+  ).default([]),
+  supervisor: z2.object({
+    port: z2.number().default(7777),
+    secret: z2.string().optional(),
+    idleIntervalMs: z2.number().default(6e4),
+    heartbeatTimeoutMs: z2.number().default(3e5),
+    maxConsecutiveFailures: z2.number().default(3),
+    maxEventsPerSec: z2.number().default(10),
+    dailyCapUsd: z2.number().default(50),
+    instructions: z2.string().optional()
+  }).default({
+    port: 7777,
+    idleIntervalMs: 6e4,
+    heartbeatTimeoutMs: 3e5,
+    maxConsecutiveFailures: 3,
+    maxEventsPerSec: 10,
+    dailyCapUsd: 50
+  }),
+  mcpServers: z2.record(z2.string(), mcpServerConfigSchema).optional(),
+  claudeCodePath: z2.string().optional(),
+  idempotency: z2.object({
+    enabled: z2.boolean().default(true),
+    key: z2.enum(["metadata", "prompt"]).default("metadata"),
+    ttlMs: z2.number().default(36e5)
+  }).optional()
+});
+var neoConfigSchema = globalConfigSchema;
+var DEFAULT_GLOBAL_CONFIG = {
+  repos: [],
+  concurrency: {
+    maxSessions: 5,
+    maxPerRepo: 2,
+    queueMax: 50
+  },
+  budget: {
+    dailyCapUsd: 500,
+    alertThresholdPct: 80
+  }
+};
+function parseYamlFile(raw, filePath) {
+  try {
+    return parseYaml2(raw);
+  } catch (err) {
+    throw new Error(
+      `Invalid YAML in ${filePath}: ${err instanceof Error ? err.message : String(err)}. Check YAML syntax at the indicated line.`
+    );
+  }
+}
+function formatZodErrors(issues, filePath) {
+  const formatted = issues.map((i) => `  - ${i.path.join(".")}: ${i.message}`).join("\n");
+  return `Invalid config in ${filePath}:
+${formatted}`;
+}
+async function loadConfig(configPath) {
+  let raw;
+  try {
+    raw = await readFile2(configPath, "utf-8");
+  } catch {
+    throw new Error(`Config file not found: ${configPath}. Run 'neo init' to get started.`);
+  }
+  const parsed = parseYamlFile(raw, configPath);
+  const result = neoConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new Error(formatZodErrors(result.error.issues, configPath));
+  }
+  return result.data;
+}
+async function loadGlobalConfig() {
+  const configPath = path4.join(getDataDir(), "config.yml");
+  if (!existsSync(configPath)) {
+    await mkdir(getDataDir(), { recursive: true });
+    await writeFile(configPath, stringifyYaml(DEFAULT_GLOBAL_CONFIG), "utf-8");
+    return globalConfigSchema.parse(DEFAULT_GLOBAL_CONFIG);
+  }
+  const raw = await readFile2(configPath, "utf-8");
+  const parsed = parseYamlFile(raw, configPath);
+  const result = globalConfigSchema.safeParse(parsed);
+  if (!result.success) {
+    throw new Error(formatZodErrors(result.error.issues, configPath));
+  }
+  return result.data;
+}
+async function addRepoToGlobalConfig(repo) {
+  const config = await loadGlobalConfig();
+  const resolvedPath = path4.resolve(repo.path);
+  const parsed = repoConfigSchema.parse({ ...repo, path: resolvedPath });
+  const existing = config.repos.findIndex((r) => path4.resolve(r.path) === resolvedPath);
+  if (existing >= 0) {
+    config.repos[existing] = parsed;
+  } else {
+    config.repos.push(parsed);
+  }
+  const configPath = path4.join(getDataDir(), "config.yml");
+  await writeFile(configPath, stringifyYaml(config), "utf-8");
+}
+async function removeRepoFromGlobalConfig(pathOrName) {
+  const config = await loadGlobalConfig();
+  const resolvedPath = path4.resolve(pathOrName);
+  const initialLength = config.repos.length;
+  config.repos = config.repos.filter(
+    (r) => path4.resolve(r.path) !== resolvedPath && r.name !== pathOrName && toRepoSlug(r) !== pathOrName
+  );
+  if (config.repos.length === initialLength) return false;
+  const configPath = path4.join(getDataDir(), "config.yml");
+  await writeFile(configPath, stringifyYaml(config), "utf-8");
+  return true;
+}
+async function listReposFromGlobalConfig() {
+  const config = await loadGlobalConfig();
+  return config.repos;
+}
+
+// src/cost/journal.ts
+import { appendFile, mkdir as mkdir2, readFile as readFile3 } from "fs/promises";
+import path5 from "path";
+var CostJournal = class {
+  dir;
+  dirCreated = false;
+  dayCache = null;
+  constructor(options) {
+    this.dir = options.dir;
+  }
+  async append(entry) {
+    await this.ensureDir();
+    const file = this.fileForDate(new Date(entry.timestamp));
+    await appendFile(file, `${JSON.stringify(entry)}
+`, "utf-8");
+    this.dayCache = null;
+  }
+  async getDayTotal(date) {
+    const d = date ?? /* @__PURE__ */ new Date();
+    const dayKey = toDateKey(d);
+    if (this.dayCache?.key === dayKey) {
+      return this.dayCache.total;
+    }
+    const file = this.fileForDate(d);
+    let total = 0;
+    try {
+      const content = await readFile3(file, "utf-8");
+      for (const line of content.split("\n")) {
+        if (!line.trim()) continue;
+        const entry = JSON.parse(line);
+        if (toDateKey(new Date(entry.timestamp)) === dayKey) {
+          total += entry.costUsd;
+        }
+      }
+    } catch (error) {
+      if (error.code !== "ENOENT") throw error;
+    }
+    this.dayCache = { key: dayKey, total };
+    return total;
+  }
+  fileForDate(date) {
+    const yyyy = date.getUTCFullYear();
+    const mm = String(date.getUTCMonth() + 1).padStart(2, "0");
+    return path5.join(this.dir, `cost-${yyyy}-${mm}.jsonl`);
+  }
+  async ensureDir() {
+    if (this.dirCreated) return;
+    await mkdir2(this.dir, { recursive: true });
+    this.dirCreated = true;
+  }
+};
+function toDateKey(date) {
+  return date.toISOString().slice(0, 10);
+}
+
+// src/events/emitter.ts
+import { EventEmitter } from "events";
+var NeoEventEmitter = class {
+  emitter = new EventEmitter();
+  emit(event) {
+    this.safeEmit(event.type, event);
+    this.safeEmit("*", event);
+  }
+  on(eventType, listener) {
+    this.emitter.on(eventType, listener);
+    return this;
+  }
+  off(eventType, listener) {
+    this.emitter.off(eventType, listener);
+    return this;
+  }
+  once(eventType, listener) {
+    this.emitter.once(eventType, listener);
+    return this;
+  }
+  removeAllListeners(eventType) {
+    this.emitter.removeAllListeners(eventType);
+    return this;
+  }
+  safeEmit(eventType, event) {
+    try {
+      this.emitter.emit(eventType, event);
+    } catch (error) {
+      if (eventType !== "error") {
+        try {
+          this.emitter.emit("error", error);
+        } catch {
+        }
+      }
+    }
+  }
+};
+
+// src/events/journal.ts
+import { appendFile as appendFile2, mkdir as mkdir3 } from "fs/promises";
+import path6 from "path";
+var EventJournal = class {
+  dir;
+  dirCreated = false;
+  constructor(options) {
+    this.dir = options.dir;
+  }
+  async append(event) {
+    await this.ensureDir();
+    const file = this.fileForDate(new Date(event.timestamp));
+    await appendFile2(file, `${JSON.stringify(event)}
+`, "utf-8");
+  }
+  fileForDate(date) {
+    const yyyy = date.getUTCFullYear();
+    const mm = String(date.getUTCMonth() + 1).padStart(2, "0");
+    return path6.join(this.dir, `events-${yyyy}-${mm}.jsonl`);
+  }
+  async ensureDir() {
+    if (this.dirCreated) return;
+    await mkdir3(this.dir, { recursive: true });
+    this.dirCreated = true;
+  }
+};
+
+// src/events/webhook.ts
+import { createHmac } from "crypto";
+var WebhookDispatcher = class {
+  webhooks;
+  constructor(webhooks) {
+    this.webhooks = webhooks;
+  }
+  dispatch(event) {
+    if (event.type === "gate:waiting") return;
+    for (const webhook of this.webhooks) {
+      if (!matchesFilter(event.type, webhook.events)) continue;
+      const payload = {
+        version: 1,
+        event: toSerializable(event),
+        source: "neo",
+        deliveredAt: (/* @__PURE__ */ new Date()).toISOString()
+      };
+      const body = JSON.stringify(payload);
+      const headers = {
+        "Content-Type": "application/json"
+      };
+      if (webhook.secret) {
+        headers["X-Neo-Signature"] = sign(body, webhook.secret);
+      }
+      fetch(webhook.url, {
+        method: "POST",
+        headers,
+        body,
+        signal: AbortSignal.timeout(webhook.timeoutMs)
+      }).catch(() => {
+      });
+    }
+  }
+};
+function matchesFilter(eventType, filters) {
+  if (!filters || filters.length === 0) return true;
+  return filters.some((f) => {
+    if (f.endsWith(":*")) return eventType.startsWith(f.slice(0, -1));
+    return f === eventType;
+  });
+}
+function sign(body, secret) {
+  return createHmac("sha256", secret).update(body).digest("hex");
+}
+function toSerializable(event) {
+  const obj = {};
+  for (const [key, value] of Object.entries(event)) {
+    if (typeof value !== "function") {
+      obj[key] = value;
+    }
+  }
+  return obj;
+}
+
+// src/isolation/git.ts
+import { execFile } from "child_process";
+import { resolve } from "path";
+import { promisify } from "util";
+
+// src/isolation/git-mutex.ts
+var locks = /* @__PURE__ */ new Map();
+async function withGitLock(repoPath, fn) {
+  const previous = locks.get(repoPath) ?? Promise.resolve();
+  let releaseLock;
+  const current = new Promise((resolve4) => {
+    releaseLock = resolve4;
+  });
+  locks.set(repoPath, current);
+  await previous;
+  try {
+    return await fn();
+  } finally {
+    releaseLock?.();
+    if (locks.get(repoPath) === current) {
+      locks.delete(repoPath);
+    }
+  }
+}
+
+// src/isolation/git.ts
+var execFileAsync = promisify(execFile);
+var GIT_TIMEOUT = 6e4;
+async function git(repoPath, args) {
+  const { stdout } = await execFileAsync("git", args, {
+    cwd: resolve(repoPath),
+    timeout: GIT_TIMEOUT
+  });
+  return stdout.trim();
+}
+async function createBranch(repoPath, branch, baseBranch) {
+  await withGitLock(repoPath, () => git(repoPath, ["branch", branch, baseBranch]));
+}
+async function pushBranch(repoPath, branch, remote) {
+  await withGitLock(repoPath, () => git(repoPath, ["push", remote, branch]));
+}
+async function fetchRemote(repoPath, remote) {
+  await withGitLock(repoPath, () => git(repoPath, ["fetch", remote]));
+}
+async function deleteBranch(repoPath, branch) {
+  await withGitLock(repoPath, () => git(repoPath, ["branch", "-D", branch]));
+}
+async function getCurrentBranch(repoPath) {
+  return withGitLock(repoPath, () => git(repoPath, ["rev-parse", "--abbrev-ref", "HEAD"]));
+}
+function getBranchName(config, runId) {
+  const prefix = config.branchPrefix ?? "feat";
+  const sanitized = runId.toLowerCase().replace(/[^a-z0-9-]/g, "-");
+  return `${prefix}/run-${sanitized}`;
+}
+
+// src/isolation/sandbox.ts
+import { resolve as resolve2 } from "path";
+var WRITE_TOOLS = /* @__PURE__ */ new Set(["Write", "Edit", "NotebookEdit"]);
+function buildSandboxConfig(agent, worktreePath) {
+  const isWritable = agent.sandbox === "writable";
+  const absWorktree = worktreePath ? resolve2(worktreePath) : void 0;
+  const allowedTools = isWritable ? agent.definition.tools : agent.definition.tools.filter((t) => !WRITE_TOOLS.has(t));
+  const readablePaths = absWorktree ? [absWorktree] : [];
+  const writablePaths = isWritable && absWorktree ? [absWorktree] : [];
+  return {
+    allowedTools,
+    readablePaths,
+    writablePaths,
+    writable: isWritable
+  };
+}
+
+// src/isolation/worktree.ts
+import { execFile as execFile2 } from "child_process";
+import { existsSync as existsSync2 } from "fs";
+import { readdir as readdir2, rm } from "fs/promises";
+import { resolve as resolve3 } from "path";
+import { promisify as promisify2 } from "util";
+var execFileAsync2 = promisify2(execFile2);
+var GIT_TIMEOUT2 = 6e4;
+async function createWorktree(options) {
+  const repoPath = resolve3(options.repoPath);
+  const worktreeDir = resolve3(options.worktreeDir);
+  await withGitLock(repoPath, async () => {
+    await execFileAsync2(
+      "git",
+      ["worktree", "add", "-b", options.branch, worktreeDir, options.baseBranch],
+      { cwd: repoPath, timeout: GIT_TIMEOUT2 }
+    );
+  });
+  await execFileAsync2("git", ["config", "core.hooksPath", "/dev/null"], {
+    cwd: worktreeDir,
+    timeout: GIT_TIMEOUT2
+  });
+  return { path: worktreeDir, branch: options.branch, repoPath };
+}
+async function removeWorktree(worktreePath) {
+  const absPath = resolve3(worktreePath);
+  if (!existsSync2(absPath)) {
+    return;
+  }
+  const repoPath = await findRepoForWorktree(absPath);
+  if (repoPath) {
+    await withGitLock(repoPath, async () => {
+      try {
+        await execFileAsync2("git", ["worktree", "remove", absPath, "--force"], {
+          cwd: repoPath,
+          timeout: GIT_TIMEOUT2
+        });
+      } catch {
+        await rm(absPath, { recursive: true, force: true });
+        await execFileAsync2("git", ["worktree", "prune"], {
+          cwd: repoPath,
+          timeout: GIT_TIMEOUT2
+        }).catch(() => {
+        });
+      }
+      await execFileAsync2("git", ["update-index", "--refresh"], {
+        cwd: repoPath,
+        timeout: GIT_TIMEOUT2
+      }).catch(() => {
+      });
+    });
+  } else {
+    await rm(absPath, { recursive: true, force: true });
+  }
+}
+async function listWorktrees(repoPath) {
+  const absRepoPath = resolve3(repoPath);
+  const { stdout } = await execFileAsync2("git", ["worktree", "list", "--porcelain"], {
+    cwd: absRepoPath,
+    timeout: GIT_TIMEOUT2
+  });
+  const worktrees = [];
+  let current;
+  for (const line of stdout.split("\n")) {
+    if (line.startsWith("worktree ")) {
+      if (current) {
+        worktrees.push({ ...current, repoPath: absRepoPath });
+      }
+      current = { path: line.slice(9), branch: "" };
+    } else if (line.startsWith("branch ") && current) {
+      current.branch = line.slice(7).replace("refs/heads/", "");
+    }
+  }
+  if (current) {
+    worktrees.push({ ...current, repoPath: absRepoPath });
+  }
+  return worktrees;
+}
+async function cleanupOrphanedWorktrees(worktreeBaseDir) {
+  const absBase = resolve3(worktreeBaseDir);
+  if (!existsSync2(absBase)) {
+    return;
+  }
+  const entries = await readdir2(absBase, { withFileTypes: true });
+  for (const entry of entries) {
+    if (!entry.isDirectory()) continue;
+    const worktreePath = resolve3(absBase, entry.name);
+    await removeWorktree(worktreePath);
+  }
+}
+async function findRepoForWorktree(worktreePath) {
+  try {
+    const { stdout } = await execFileAsync2("git", ["rev-parse", "--git-common-dir"], {
+      cwd: worktreePath,
+      timeout: GIT_TIMEOUT2
+    });
+    const gitCommonDir = resolve3(worktreePath, stdout.trim());
+    return resolve3(gitCommonDir, "..");
+  } catch {
+    return void 0;
+  }
+}
+
+// src/middleware/audit-log.ts
+import { appendFile as appendFile3, mkdir as mkdir4 } from "fs/promises";
+import path7 from "path";
+var DEFAULT_FLUSH_INTERVAL_MS = 500;
+var DEFAULT_FLUSH_SIZE = 20;
+function auditLog(options) {
+  const {
+    dir,
+    includeInput = true,
+    includeOutput = false,
+    flushIntervalMs = DEFAULT_FLUSH_INTERVAL_MS,
+    flushSize = DEFAULT_FLUSH_SIZE
+  } = options;
+  let dirCreated = false;
+  const buffers = /* @__PURE__ */ new Map();
+  let flushTimer;
+  async function ensureDir() {
+    if (!dirCreated) {
+      await mkdir4(dir, { recursive: true });
+      dirCreated = true;
+    }
+  }
+  async function flushAll() {
+    if (buffers.size === 0) return;
+    await ensureDir();
+    const writes = [];
+    for (const [sessionId, lines] of buffers) {
+      const filePath = path7.join(dir, `${sessionId}.jsonl`);
+      writes.push(appendFile3(filePath, lines.join(""), "utf-8"));
+    }
+    buffers.clear();
+    await Promise.all(writes);
+  }
+  async function flushSession(sessionId) {
+    const lines = buffers.get(sessionId);
+    if (!lines || lines.length === 0) return;
+    await ensureDir();
+    const filePath = path7.join(dir, `${sessionId}.jsonl`);
+    await appendFile3(filePath, lines.join(""), "utf-8");
+    buffers.delete(sessionId);
+  }
+  return {
+    name: "audit-log",
+    on: "PostToolUse",
+    async flush() {
+      await flushAll();
+      if (flushTimer !== void 0) {
+        clearInterval(flushTimer);
+        flushTimer = void 0;
+      }
+    },
+    async handler(event, context) {
+      const entry = {
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        sessionId: event.sessionId,
+        agent: context.agent,
+        toolName: event.toolName
+      };
+      if (includeInput && event.input !== void 0) {
+        entry.input = event.input;
+      }
+      if (includeOutput && event.output !== void 0) {
+        entry.output = event.output;
+      }
+      const sessionId = event.sessionId;
+      let lines = buffers.get(sessionId);
+      if (!lines) {
+        lines = [];
+        buffers.set(sessionId, lines);
+      }
+      lines.push(`${JSON.stringify(entry)}
+`);
+      if (lines.length >= flushSize) {
+        await flushSession(sessionId);
+      }
+      if (flushTimer === void 0 && flushIntervalMs > 0) {
+        flushTimer = setInterval(() => {
+          void flushAll();
+        }, flushIntervalMs);
+        if (typeof flushTimer === "object" && "unref" in flushTimer) {
+          flushTimer.unref();
+        }
+      }
+      return { decision: "async", asyncTimeout: 5e3 };
+    }
+  };
+}
+
+// src/middleware/budget-guard.ts
+function budgetGuard() {
+  return {
+    name: "budget-guard",
+    on: "PreToolUse",
+    async handler(_event, context) {
+      const costToday = context.get("costToday");
+      const budgetCapUsd = context.get("budgetCapUsd");
+      if (costToday !== void 0 && budgetCapUsd !== void 0 && costToday >= budgetCapUsd) {
+        return {
+          decision: "block",
+          reason: "Daily budget exceeded"
+        };
+      }
+      return { decision: "pass" };
+    }
+  };
+}
+
+// src/middleware/chain.ts
+function matchesTool(match, toolName) {
+  if (match === void 0) return true;
+  if (toolName === void 0) return false;
+  if (Array.isArray(match)) return match.includes(toolName);
+  return match === toolName;
+}
+function buildMiddlewareChain(middleware) {
+  return {
+    async execute(event, context) {
+      let lastAsync;
+      for (const mw of middleware) {
+        if (mw.on !== event.hookEvent) continue;
+        if (!matchesTool(mw.match, event.toolName)) continue;
+        const result = await mw.handler(event, context);
+        switch (result.decision) {
+          case "block":
+            return result;
+          case "async":
+            lastAsync = result;
+            break;
+          case "pass":
+            break;
+        }
+      }
+      return lastAsync ?? { decision: "pass" };
+    }
+  };
+}
+function buildSDKHooks(chain, context, middleware = []) {
+  function makeCallback(hookEvent) {
+    return async (input) => {
+      const event = {
+        hookEvent,
+        sessionId: input.session_id,
+        toolName: "tool_name" in input ? input.tool_name : void 0,
+        input: "tool_input" in input ? input.tool_input : void 0,
+        output: "tool_response" in input ? String(input.tool_response) : void 0,
+        message: "message" in input ? input.message : void 0
+      };
+      const result = await chain.execute(event, context);
+      switch (result.decision) {
+        case "block":
+          return { decision: "block", reason: result.reason };
+        case "async":
+          return { async: true, asyncTimeout: result.asyncTimeout };
+        case "pass":
+          return {};
+      }
+    };
+  }
+  const usedEvents = new Set(middleware.map((mw) => mw.on));
+  const allEvents = ["PreToolUse", "PostToolUse", "Notification"];
+  const hooks = {};
+  for (const hookEvent of allEvents) {
+    if (middleware.length === 0 || usedEvents.has(hookEvent)) {
+      hooks[hookEvent] = [{ hooks: [makeCallback(hookEvent)] }];
+    }
+  }
+  return hooks;
+}
+
+// src/middleware/loop-detection.ts
+function loopDetection(options) {
+  const { threshold } = options;
+  const commandHistory = /* @__PURE__ */ new Map();
+  return {
+    name: "loop-detection",
+    on: "PreToolUse",
+    match: "Bash",
+    cleanup(sessionId) {
+      commandHistory.delete(sessionId);
+    },
+    async handler(event) {
+      const sessionId = event.sessionId;
+      const command = event.input && typeof event.input === "object" && "command" in event.input ? String(event.input.command) : "";
+      if (!command) return { decision: "pass" };
+      if (!commandHistory.has(sessionId)) {
+        commandHistory.set(sessionId, /* @__PURE__ */ new Map());
+      }
+      const sessionHistory = commandHistory.get(sessionId) ?? /* @__PURE__ */ new Map();
+      const count = (sessionHistory.get(command) ?? 0) + 1;
+      sessionHistory.set(command, count);
+      if (count >= threshold) {
+        return {
+          decision: "block",
+          reason: `Loop detected: you have run this exact command ${String(count)} times. STOP and escalate \u2014 do not retry the same approach.`
+        };
+      }
+      return { decision: "pass" };
+    }
+  };
+}
+
+// src/orchestrator.ts
+import { randomUUID } from "crypto";
+import { existsSync as existsSync4 } from "fs";
+import { mkdir as mkdir5, readdir as readdir4, readFile as readFile5, writeFile as writeFile2 } from "fs/promises";
+import path9 from "path";
+
+// src/runner/output-parser.ts
+function extractJson(raw) {
+  try {
+    return JSON.parse(raw);
+  } catch {
+  }
+  const codeBlockRegex = /```(?:json)?\s*\n?([\s\S]*?)```/;
+  const match = raw.match(codeBlockRegex);
+  if (match?.[1]) {
+    try {
+      return JSON.parse(match[1].trim());
+    } catch {
+    }
+  }
+  return void 0;
+}
+function parseOutput(raw, schema) {
+  if (!schema) {
+    return { rawOutput: raw };
+  }
+  const extracted = extractJson(raw);
+  if (extracted === void 0) {
+    return {
+      rawOutput: raw,
+      parseError: "Failed to extract JSON from output"
+    };
+  }
+  const result = schema.safeParse(extracted);
+  if (!result.success) {
+    return {
+      rawOutput: raw,
+      parseError: `Schema validation failed: ${result.error.message}`
+    };
+  }
+  return {
+    rawOutput: raw,
+    output: result.data
+  };
+}
+
+// src/runner/session.ts
+function isInitMessage(msg) {
+  return msg.type === "system" && msg.subtype === "init";
+}
+function isResultMessage(msg) {
+  return msg.type === "result";
+}
+function checkAborted(signal) {
+  if (signal.aborted) {
+    const reason = signal.reason;
+    throw reason instanceof Error ? reason : new Error(String(reason));
+  }
+}
+function toSessionError(error, isTimeout, sessionId) {
+  if (error instanceof SessionError) return error;
+  const message = error instanceof Error ? error.message : String(error);
+  return new SessionError(message, isTimeout ? "timeout" : "unknown", sessionId);
+}
+async function runSession(options) {
+  const { agent, prompt, worktreePath, sandboxConfig, initTimeoutMs, maxDurationMs, onEvent } = options;
+  const startTime = Date.now();
+  let sessionId = "";
+  const abortController = new AbortController();
+  const initTimer = setTimeout(() => {
+    abortController.abort(new Error("Session init timeout exceeded"));
+  }, initTimeoutMs);
+  const maxDurationTimer = setTimeout(() => {
+    abortController.abort(new Error("Session max duration exceeded"));
+  }, maxDurationMs);
+  try {
+    const sdk = await import("@anthropic-ai/claude-agent-sdk");
+    const queryOptions = {
+      // Always pass cwd: worktree for writable agents, repo root for readonly.
+      // Without this, readonly agents default to process.cwd() and may write to main tree.
+      cwd: worktreePath ?? options.repoPath,
+      maxTurns: agent.maxTurns,
+      allowedTools: sandboxConfig.allowedTools
+    };
+    if (options.resumeSessionId) {
+      queryOptions.resume = options.resumeSessionId;
+    }
+    if (options.mcpServers?.length) {
+      queryOptions.mcpServers = options.mcpServers;
+    }
+    let output = "";
+    let costUsd = 0;
+    let turnCount = 0;
+    const stream = sdk.query({ prompt, options: queryOptions });
+    for await (const message of stream) {
+      checkAborted(abortController.signal);
+      const msg = message;
+      if (isInitMessage(msg)) {
+        sessionId = msg.session_id;
+        clearTimeout(initTimer);
+        onEvent?.({ type: "session:start", sessionId });
+      }
+      if (isResultMessage(msg)) {
+        output = msg.result ?? "";
+        costUsd = msg.total_cost_usd ?? 0;
+        turnCount = msg.num_turns ?? 0;
+        sessionId = msg.session_id ?? sessionId;
+        if (msg.subtype !== "success") {
+          throw new SessionError(
+            `Session ended with error: ${msg.subtype}`,
+            msg.subtype,
+            sessionId
+          );
+        }
+      }
+    }
+    const sessionResult = {
+      sessionId,
+      output,
+      costUsd,
+      durationMs: Date.now() - startTime,
+      turnCount
+    };
+    onEvent?.({ type: "session:complete", sessionId, result: sessionResult });
+    return sessionResult;
+  } catch (error) {
+    const errorSessionId = sessionId || "unknown";
+    const sessionError = toSessionError(error, abortController.signal.aborted, errorSessionId);
+    onEvent?.({ type: "session:fail", sessionId: errorSessionId, error: sessionError.message });
+    throw sessionError;
+  } finally {
+    clearTimeout(initTimer);
+    clearTimeout(maxDurationTimer);
+  }
+}
+var SessionError = class extends Error {
+  constructor(message, errorType, sessionId) {
+    super(message);
+    this.errorType = errorType;
+    this.sessionId = sessionId;
+    this.name = "SessionError";
+  }
+};
+
+// src/runner/recovery.ts
+var DEFAULT_NON_RETRYABLE = ["error_max_turns", "budget_exceeded"];
+function getStrategy(attempt) {
+  switch (attempt) {
+    case 1:
+      return "normal";
+    case 2:
+      return "resume";
+    default:
+      return "fresh";
+  }
+}
+function sleep(ms) {
+  return new Promise((resolve4) => setTimeout(resolve4, ms));
+}
+function isNonRetryable(error, nonRetryable) {
+  return error instanceof SessionError && nonRetryable.includes(error.errorType);
+}
+function updateSessionId(error, current) {
+  if (error instanceof SessionError && error.sessionId !== "unknown") {
+    return error.sessionId;
+  }
+  return current;
+}
+function buildFinalError(error, maxRetries) {
+  if (error instanceof Error) {
+    return new Error(`Recovery failed after ${maxRetries} attempts. Last error: ${error.message}`, {
+      cause: error
+    });
+  }
+  return new Error(`Recovery failed after ${maxRetries} attempts`);
+}
+async function runWithRecovery(options) {
+  const {
+    maxRetries,
+    backoffBaseMs,
+    nonRetryable = DEFAULT_NON_RETRYABLE,
+    onAttempt,
+    ...rest
+  } = options;
+  let lastSessionId;
+  for (let attempt = 1; attempt <= maxRetries; attempt++) {
+    const strategy = getStrategy(attempt);
+    onAttempt?.(attempt, strategy);
+    try {
+      const result = await runSession({
+        ...rest,
+        resumeSessionId: strategy === "resume" ? lastSessionId : void 0
+      });
+      return result;
+    } catch (error) {
+      lastSessionId = updateSessionId(error, lastSessionId);
+      if (isNonRetryable(error, nonRetryable)) throw error;
+      if (attempt === maxRetries) throw buildFinalError(error, maxRetries);
+      if (getStrategy(attempt + 1) === "fresh") {
+        lastSessionId = void 0;
+      }
+      await sleep(backoffBaseMs * attempt);
+    }
+  }
+  throw new Error("Recovery failed: unreachable");
+}
+
+// src/workflows/registry.ts
+import { existsSync as existsSync3 } from "fs";
+import { readdir as readdir3 } from "fs/promises";
+import path8 from "path";
+
+// src/workflows/loader.ts
+import { readFile as readFile4 } from "fs/promises";
+import { parse } from "yaml";
+import { z as z3 } from "zod";
+var workflowStepDefSchema = z3.object({
+  type: z3.literal("step").optional().default("step"),
+  agent: z3.string(),
+  dependsOn: z3.array(z3.string()).optional(),
+  prompt: z3.string().optional(),
+  sandbox: z3.enum(["writable", "readonly"]).optional(),
+  maxTurns: z3.number().int().positive().optional(),
+  mcpServers: z3.array(z3.string()).optional(),
+  recovery: z3.object({
+    maxRetries: z3.number().int().nonnegative().optional(),
+    nonRetryable: z3.array(z3.string()).optional()
+  }).optional(),
+  condition: z3.string().optional()
+});
+var workflowGateDefSchema = z3.object({
+  type: z3.literal("gate"),
+  dependsOn: z3.array(z3.string()).optional(),
+  description: z3.string(),
+  timeout: z3.string().optional(),
+  autoApprove: z3.boolean().optional()
+});
+var workflowHeaderSchema = z3.object({
+  name: z3.string().min(1),
+  description: z3.string().optional(),
+  steps: z3.record(z3.string(), z3.unknown())
+});
+function parseStepEntry(stepName, stepValue) {
+  const obj = stepValue;
+  const schema = obj.type === "gate" ? workflowGateDefSchema : workflowStepDefSchema;
+  const result = schema.safeParse(stepValue);
+  if (result.success) {
+    return { step: result.data, errors: [] };
+  }
+  return {
+    step: stepValue,
+    errors: result.error.issues.map(
+      (i) => `  - steps.${stepName}.${i.path.join(".")}: ${i.message}`
+    )
+  };
+}
+function parseSteps(rawSteps, filePath) {
+  if (Object.keys(rawSteps).length === 0) {
+    throw new Error(
+      `Invalid workflow definition in ${filePath}:
+  - steps: Workflow must have at least one step`
+    );
+  }
+  const steps = {};
+  const errors = [];
+  for (const [name, value] of Object.entries(rawSteps)) {
+    const { step, errors: stepErrors } = parseStepEntry(name, value);
+    if (stepErrors.length > 0) {
+      errors.push(...stepErrors);
+    } else {
+      steps[name] = step;
+    }
+  }
+  if (errors.length > 0) {
+    throw new Error(`Invalid workflow definition in ${filePath}:
+${errors.join("\n")}`);
+  }
+  return steps;
+}
+async function loadWorkflow(filePath) {
+  const content = await readFile4(filePath, "utf-8");
+  const raw = parse(content);
+  const headerResult = workflowHeaderSchema.safeParse(raw);
+  if (!headerResult.success) {
+    const issues = headerResult.error.issues.map((i) => `  - ${i.path.join(".")}: ${i.message}`).join("\n");
+    throw new Error(`Invalid workflow definition in ${filePath}:
+${issues}`);
+  }
+  const { name, description, steps: rawSteps } = headerResult.data;
+  const steps = parseSteps(rawSteps, filePath);
+  return { name, description, steps };
+}
+
+// src/workflows/registry.ts
+var WorkflowRegistry = class {
+  builtInDir;
+  customDir;
+  workflows = /* @__PURE__ */ new Map();
+  constructor(builtInDir, customDir) {
+    this.builtInDir = builtInDir;
+    this.customDir = customDir;
+  }
+  async load() {
+    await this.loadFromDir(this.builtInDir);
+    if (this.customDir) {
+      await this.loadFromDir(this.customDir);
+    }
+  }
+  get(name) {
+    return this.workflows.get(name);
+  }
+  list() {
+    return [...this.workflows.values()];
+  }
+  has(name) {
+    return this.workflows.has(name);
+  }
+  async loadFromDir(dir) {
+    if (!existsSync3(dir)) return;
+    const files = await readdir3(dir);
+    for (const file of files) {
+      if (!file.endsWith(".yml") && !file.endsWith(".yaml")) continue;
+      const filePath = path8.join(dir, file);
+      const workflow = await loadWorkflow(filePath);
+      this.workflows.set(workflow.name, workflow);
+    }
+  }
+};
+
+// src/orchestrator.ts
+var MAX_PROMPT_SIZE = 100 * 1024;
+var MAX_METADATA_DEPTH = 5;
+var SHUTDOWN_TIMEOUT_MS = 5 * 60 * 1e3;
+var WORKTREES_DIR = ".neo/worktrees";
+var textEncoder = new TextEncoder();
+var Orchestrator = class extends NeoEventEmitter {
+  config;
+  semaphore;
+  userMiddleware;
+  workflows = /* @__PURE__ */ new Map();
+  registeredAgents = /* @__PURE__ */ new Map();
+  _activeSessions = /* @__PURE__ */ new Map();
+  idempotencyCache = /* @__PURE__ */ new Map();
+  abortControllers = /* @__PURE__ */ new Map();
+  repoIndex = /* @__PURE__ */ new Map();
+  createdRunDirs = /* @__PURE__ */ new Set();
+  journalDir;
+  builtInWorkflowDir;
+  customWorkflowDir;
+  costJournal = null;
+  eventJournal = null;
+  webhookDispatcher = null;
+  _paused = false;
+  _costToday = 0;
+  _startedAt = 0;
+  _drainResolve = null;
+  constructor(config, options = {}) {
+    super();
+    this.config = config;
+    this.userMiddleware = options.middleware ?? [];
+    this.journalDir = options.journalDir ?? getJournalsDir();
+    this.builtInWorkflowDir = options.builtInWorkflowDir;
+    this.customWorkflowDir = options.customWorkflowDir;
+    for (const repo of config.repos) {
+      const resolvedPath = path9.resolve(repo.path);
+      const normalizedRepo = { ...repo, path: resolvedPath };
+      this.repoIndex.set(resolvedPath, normalizedRepo);
+    }
+    this.semaphore = new Semaphore(
+      {
+        maxSessions: config.concurrency.maxSessions,
+        maxPerRepo: config.concurrency.maxPerRepo,
+        queueMax: config.concurrency.queueMax
+      },
+      {
+        onEnqueue: (sessionId, repo, position) => {
+          this.emit({
+            type: "queue:enqueue",
+            sessionId,
+            repo,
+            position,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          });
+        },
+        onDequeue: (sessionId, repo, waitedMs) => {
+          this.emit({
+            type: "queue:dequeue",
+            sessionId,
+            repo,
+            waitedMs,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          });
+        }
+      }
+    );
+  }
+  // ─── Registration ──────────────────────────────────────
+  registerWorkflow(definition) {
+    this.workflows.set(definition.name, definition);
+  }
+  registerAgent(agent) {
+    this.registeredAgents.set(agent.name, agent);
+  }
+  // ─── Dispatch ──────────────────────────────────────────
+  async dispatch(input) {
+    const idempotencyKey = this.preDispatchChecks(input);
+    const ctx = this.buildDispatchContext(input);
+    const abortController = new AbortController();
+    this.abortControllers.set(ctx.sessionId, abortController);
+    await this.semaphore.acquire(
+      input.repo,
+      ctx.sessionId,
+      input.priority ?? "medium",
+      abortController.signal
+    );
+    ctx.activeSession.status = "running";
+    const stepResult = await this.executeStep(ctx);
+    return this.finalizeDispatch(ctx, stepResult, idempotencyKey);
+  }
+  // ─── Control ───────────────────────────────────────────
+  pause() {
+    this._paused = true;
+  }
+  resume() {
+    this._paused = false;
+  }
+  async kill(sessionId) {
+    const controller = this.abortControllers.get(sessionId);
+    if (controller) {
+      controller.abort(new Error("Session killed"));
+    }
+    this._activeSessions.delete(sessionId);
+    this.abortControllers.delete(sessionId);
+    this.semaphore.release(sessionId);
+  }
+  async drain() {
+    this._paused = true;
+    if (this._activeSessions.size === 0) return;
+    return new Promise((resolve4) => {
+      this._drainResolve = resolve4;
+    });
+  }
+  // ─── Getters ───────────────────────────────────────────
+  get status() {
+    return {
+      paused: this._paused,
+      activeSessions: [...this._activeSessions.values()],
+      queueDepth: this.semaphore.queueDepth(),
+      costToday: this._costToday,
+      budgetCapUsd: this.config.budget.dailyCapUsd,
+      budgetRemainingPct: this.computeBudgetRemainingPct(),
+      uptime: this._startedAt > 0 ? Date.now() - this._startedAt : 0
+    };
+  }
+  get activeSessions() {
+    return [...this._activeSessions.values()];
+  }
+  // ─── Lifecycle ─────────────────────────────────────────
+  async start() {
+    this._startedAt = Date.now();
+    this.costJournal = new CostJournal({ dir: this.journalDir });
+    this.eventJournal = new EventJournal({ dir: this.journalDir });
+    if (this.config.webhooks.length > 0) {
+      this.webhookDispatcher = new WebhookDispatcher(this.config.webhooks);
+    }
+    this._costToday = await this.costJournal.getDayTotal();
+    if (this.builtInWorkflowDir) {
+      const registry = new WorkflowRegistry(this.builtInWorkflowDir, this.customWorkflowDir);
+      await registry.load();
+      for (const workflow of registry.list()) {
+        this.registerWorkflow(workflow);
+      }
+    }
+    await this.recoverOrphanedRuns();
+    for (const repo of this.config.repos) {
+      const worktreeBase = path9.join(repo.path, WORKTREES_DIR);
+      await cleanupOrphanedWorktrees(worktreeBase).catch(() => {
+      });
+    }
+  }
+  async shutdown() {
+    this._paused = true;
+    if (this._activeSessions.size > 0) {
+      await Promise.race([
+        this.drain(),
+        new Promise((resolve4) => setTimeout(resolve4, SHUTDOWN_TIMEOUT_MS))
+      ]);
+    }
+    for (const mw of this.userMiddleware) {
+      if ("flush" in mw && typeof mw.flush === "function") {
+        await mw.flush();
+      }
+      if ("cleanup" in mw && typeof mw.cleanup === "function") {
+        for (const session of this._activeSessions.values()) {
+          mw.cleanup(session.sessionId);
+        }
+      }
+    }
+    this.emit({
+      type: "orchestrator:shutdown",
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  // ─── Emit override (journal events) ───────────────────
+  emit(event) {
+    super.emit(event);
+    if (this.eventJournal) {
+      this.eventJournal.append(event).catch(() => {
+      });
+    }
+    if (this.webhookDispatcher) {
+      this.webhookDispatcher.dispatch(event);
+    }
+  }
+  // ─── Static middleware factories ───────────────────────
+  static middleware = {
+    loopDetection: (options) => loopDetection(options),
+    auditLog: (options) => auditLog(options),
+    budgetGuard: () => budgetGuard()
+  };
+  // ─── Private: Dispatch phases ──────────────────────────
+  preDispatchChecks(input) {
+    this.validateInput(input);
+    const idempotencyKey = this.computeIdempotencyKey(input);
+    if (idempotencyKey) {
+      this.evictExpiredIdempotencyEntries();
+      const cached = this.idempotencyCache.get(idempotencyKey);
+      if (cached && cached.expiresAt > Date.now()) {
+        throw new Error(
+          `Duplicate dispatch rejected: runId '${input.runId ?? "auto-generated"}' already exists. Each dispatch must use a unique runId.`
+        );
+      }
+    }
+    if (this._paused) {
+      throw new Error(
+        "Dispatch rejected: orchestrator is paused. Call orchestrator.resume() before dispatching."
+      );
+    }
+    return idempotencyKey;
+  }
+  buildDispatchContext(input) {
+    const runId = input.runId ?? randomUUID();
+    const sessionId = randomUUID();
+    const workflow = this.workflows.get(input.workflow);
+    if (!workflow) {
+      const available = [...this.workflows.keys()].join(", ") || "none";
+      throw new Error(
+        `Workflow "${input.workflow}" not found. Available workflows: ${available}. Check the workflow name or register it first.`
+      );
+    }
+    const [stepName, stepDef] = this.getFirstStep(workflow, input);
+    const agent = this.resolveStepAgent(stepDef, workflow.name);
+    const repoConfig = this.resolveRepo(input.repo);
+    const activeSession = {
+      sessionId,
+      runId,
+      workflow: input.workflow,
+      step: stepName,
+      agent: agent.name,
+      repo: input.repo,
+      status: "queued",
+      startedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    this._activeSessions.set(sessionId, activeSession);
+    return {
+      input,
+      runId,
+      sessionId,
+      startedAt: Date.now(),
+      stepName,
+      stepDef,
+      agent,
+      repoConfig,
+      activeSession
+    };
+  }
+  async executeStep(ctx) {
+    const { input, runId, sessionId, startedAt, agent, repoConfig, activeSession } = ctx;
+    let worktreePath;
+    try {
+      if (agent.sandbox === "writable") {
+        const branchName = getBranchName(repoConfig, runId);
+        const worktreeDir = path9.join(input.repo, WORKTREES_DIR, runId);
+        const info = await createWorktree({
+          repoPath: input.repo,
+          branch: branchName,
+          baseBranch: repoConfig.defaultBranch,
+          worktreeDir
+        });
+        worktreePath = info.path;
+        activeSession.worktreePath = worktreePath;
+      }
+      const stepResult = await this.runAgentSession(ctx, worktreePath);
+      this.emitCostEvents(sessionId, stepResult.costUsd, ctx);
+      this.emitSessionComplete(ctx, stepResult);
+      return stepResult;
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      this.emitSessionFail(ctx, errorMsg);
+      return {
+        status: "failure",
+        sessionId,
+        costUsd: 0,
+        durationMs: Date.now() - startedAt,
+        agent: agent.name,
+        startedAt: activeSession.startedAt,
+        completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+        error: errorMsg,
+        attempt: 1
+      };
+    } finally {
+      this.semaphore.release(sessionId);
+      this._activeSessions.delete(sessionId);
+      this.abortControllers.delete(sessionId);
+      if (this._activeSessions.size === 0 && this._drainResolve) {
+        this._drainResolve();
+        this._drainResolve = null;
+      }
+    }
+  }
+  async runAgentSession(ctx, worktreePath) {
+    const { input, runId, sessionId, stepName, stepDef, agent, activeSession } = ctx;
+    const sandboxConfig = buildSandboxConfig(agent, worktreePath);
+    const chain = buildMiddlewareChain(this.userMiddleware);
+    const middlewareContext = this.buildMiddlewareContext(
+      runId,
+      input.workflow,
+      stepName,
+      agent.name,
+      input.repo
+    );
+    const hooks = buildSDKHooks(chain, middlewareContext, this.userMiddleware);
+    this.emit({
+      type: "session:start",
+      sessionId,
+      runId,
+      workflow: input.workflow,
+      step: stepName,
+      agent: agent.name,
+      repo: input.repo,
+      metadata: input.metadata,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const recoveryOpts = stepDef.recovery;
+    const sessionResult = await runWithRecovery({
+      agent,
+      prompt: stepDef.prompt ?? input.prompt,
+      repoPath: input.repo,
+      sandboxConfig,
+      hooks,
+      initTimeoutMs: this.config.sessions.initTimeoutMs,
+      maxDurationMs: this.config.sessions.maxDurationMs,
+      maxRetries: recoveryOpts?.maxRetries ?? this.config.recovery.maxRetries,
+      backoffBaseMs: this.config.recovery.backoffBaseMs,
+      ...worktreePath ? { worktreePath } : {},
+      ...recoveryOpts?.nonRetryable ? { nonRetryable: recoveryOpts.nonRetryable } : {},
+      onAttempt: (attempt, strategy) => {
+        if (attempt > 1) {
+          this.emit({
+            type: "session:fail",
+            sessionId,
+            runId,
+            error: `Retrying with strategy: ${strategy}`,
+            attempt: attempt - 1,
+            maxRetries: recoveryOpts?.maxRetries ?? this.config.recovery.maxRetries,
+            willRetry: true,
+            metadata: input.metadata,
+            timestamp: (/* @__PURE__ */ new Date()).toISOString()
+          });
+        }
+      }
+    });
+    const parsed = parseOutput(sessionResult.output);
+    return {
+      status: "success",
+      sessionId: sessionResult.sessionId,
+      output: parsed.output ?? parsed.rawOutput,
+      rawOutput: sessionResult.output,
+      costUsd: sessionResult.costUsd,
+      durationMs: sessionResult.durationMs,
+      agent: agent.name,
+      startedAt: activeSession.startedAt,
+      completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      attempt: 1
+    };
+  }
+  async finalizeDispatch(ctx, stepResult, idempotencyKey) {
+    const { input, runId, stepName, repoConfig, activeSession } = ctx;
+    const taskResult = {
+      runId,
+      workflow: input.workflow,
+      repo: input.repo,
+      status: stepResult.status === "success" ? "success" : "failure",
+      steps: { [stepName]: stepResult },
+      branch: stepResult.status === "success" && activeSession.worktreePath ? getBranchName(repoConfig, runId) : void 0,
+      costUsd: stepResult.costUsd,
+      durationMs: Date.now() - ctx.startedAt,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+      metadata: input.metadata
+    };
+    await this.persistRun({
+      version: 1,
+      runId,
+      workflow: input.workflow,
+      repo: input.repo,
+      prompt: input.prompt,
+      branch: taskResult.branch,
+      status: taskResult.status === "success" ? "completed" : "failed",
+      steps: taskResult.steps,
+      createdAt: activeSession.startedAt,
+      updatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      metadata: input.metadata
+    });
+    if (idempotencyKey) {
+      const ttl = this.config.idempotency?.ttlMs ?? 36e5;
+      this.idempotencyCache.set(idempotencyKey, {
+        result: taskResult,
+        expiresAt: Date.now() + ttl
+      });
+    }
+    return taskResult;
+  }
+  // ─── Private: Event helpers ────────────────────────────
+  emitCostEvents(sessionId, sessionCost, ctx) {
+    this._costToday += sessionCost;
+    if (this.costJournal) {
+      const costEntry = {
+        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+        runId: ctx.runId,
+        workflow: ctx.input.workflow,
+        step: ctx.stepName,
+        sessionId,
+        agent: ctx.agent.name,
+        costUsd: sessionCost,
+        models: {},
+        durationMs: Date.now() - ctx.startedAt,
+        repo: ctx.input.repo
+      };
+      this.costJournal.append(costEntry).catch(() => {
+      });
+    }
+    this.emit({
+      type: "cost:update",
+      sessionId,
+      sessionCost,
+      todayTotal: this._costToday,
+      budgetRemainingPct: this.computeBudgetRemainingPct(),
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+    const utilizationPct = this._costToday / this.config.budget.dailyCapUsd * 100;
+    if (utilizationPct >= this.config.budget.alertThresholdPct) {
+      this.emit({
+        type: "budget:alert",
+        todayTotal: this._costToday,
+        capUsd: this.config.budget.dailyCapUsd,
+        utilizationPct,
+        timestamp: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    }
+  }
+  emitSessionComplete(ctx, stepResult) {
+    this.emit({
+      type: "session:complete",
+      sessionId: ctx.sessionId,
+      runId: ctx.runId,
+      status: "success",
+      costUsd: stepResult.costUsd,
+      durationMs: stepResult.durationMs,
+      output: stepResult.output,
+      metadata: ctx.input.metadata,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  emitSessionFail(ctx, errorMsg) {
+    this.emit({
+      type: "session:fail",
+      sessionId: ctx.sessionId,
+      runId: ctx.runId,
+      error: errorMsg,
+      attempt: 1,
+      maxRetries: this.config.recovery.maxRetries,
+      willRetry: false,
+      metadata: ctx.input.metadata,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  // ─── Private: Input validation ─────────────────────────
+  validateInput(input) {
+    if (!input.prompt || input.prompt.trim().length === 0) {
+      throw new Error("Validation error: prompt must be a non-empty string");
+    }
+    if (textEncoder.encode(input.prompt).length > MAX_PROMPT_SIZE) {
+      throw new Error(
+        `Validation error: prompt exceeds maximum size of ${String(MAX_PROMPT_SIZE)} bytes`
+      );
+    }
+    if (!existsSync4(input.repo)) {
+      throw new Error(`Validation error: repo path does not exist: ${input.repo}`);
+    }
+    if (!this.workflows.has(input.workflow)) {
+      throw new Error(`Validation error: workflow "${input.workflow}" not found in registry`);
+    }
+    if (input.metadata !== void 0) {
+      if (!isPlainObject(input.metadata)) {
+        throw new Error("Validation error: metadata must be a plain object");
+      }
+      if (objectDepth(input.metadata) > MAX_METADATA_DEPTH) {
+        throw new Error(
+          `Validation error: metadata exceeds maximum nesting depth of ${String(MAX_METADATA_DEPTH)}`
+        );
+      }
+    }
+    const resumeOptions = [input.step, input.from, input.retry].filter(Boolean);
+    if (resumeOptions.length > 1) {
+      throw new Error("Validation error: step, from, and retry are mutually exclusive");
+    }
+  }
+  // ─── Private: Helpers ──────────────────────────────────
+  evictExpiredIdempotencyEntries() {
+    const now = Date.now();
+    for (const [key, entry] of this.idempotencyCache) {
+      if (entry.expiresAt <= now) {
+        this.idempotencyCache.delete(key);
+      }
+    }
+  }
+  computeIdempotencyKey(input) {
+    const idempotency = this.config.idempotency;
+    if (!idempotency?.enabled) return null;
+    const key = idempotency.key ?? "metadata";
+    if (key === "prompt") {
+      return `${input.workflow}:${input.repo}:${input.prompt}`;
+    }
+    return `${input.workflow}:${input.repo}:${JSON.stringify(input.metadata ?? {})}`;
+  }
+  getFirstStep(workflow, input) {
+    if (input.step) {
+      const step = workflow.steps[input.step];
+      if (!step || step.type === "gate") {
+        throw new Error(
+          `Step "${input.step}" not found in workflow "${workflow.name}" or is a gate step. Check the step name in the workflow definition.`
+        );
+      }
+      return [input.step, step];
+    }
+    for (const [name, step] of Object.entries(workflow.steps)) {
+      if (step.type === "gate") continue;
+      const stepDef = step;
+      if (!stepDef.dependsOn || stepDef.dependsOn.length === 0) {
+        return [name, stepDef];
+      }
+    }
+    const entries = Object.entries(workflow.steps);
+    const first = entries[0];
+    if (!first) {
+      throw new Error(`Workflow "${workflow.name}" has no steps`);
+    }
+    return [first[0], first[1]];
+  }
+  resolveStepAgent(step, workflowName) {
+    const agent = this.registeredAgents.get(step.agent);
+    if (!agent) {
+      throw new Error(
+        `Agent "${step.agent}" required by workflow "${workflowName}" not found in registry. Register the agent or check the workflow definition.`
+      );
+    }
+    return agent;
+  }
+  resolveRepo(repoPath) {
+    const repo = this.repoIndex.get(path9.resolve(repoPath));
+    if (repo) return repo;
+    return {
+      path: repoPath,
+      defaultBranch: "main",
+      branchPrefix: "feat",
+      pushRemote: "origin",
+      autoCreatePr: false
+    };
+  }
+  buildMiddlewareContext(runId, workflow, step, agent, repo) {
+    const store = /* @__PURE__ */ new Map();
+    return {
+      runId,
+      workflow,
+      step,
+      agent,
+      repo,
+      get: ((key) => {
+        if (key === "costToday") return this._costToday;
+        if (key === "budgetCapUsd") return this.config.budget.dailyCapUsd;
+        return store.get(key);
+      }),
+      set: ((key, value) => {
+        store.set(key, value);
+      })
+    };
+  }
+  computeBudgetRemainingPct() {
+    const cap = this.config.budget.dailyCapUsd;
+    if (cap <= 0) return 0;
+    return Math.max(0, (cap - this._costToday) / cap * 100);
+  }
+  // ─── Private: Run persistence ──────────────────────────
+  async persistRun(run) {
+    try {
+      const slug = toRepoSlug({ path: run.repo });
+      const runsDir = getRepoRunsDir(slug);
+      if (!this.createdRunDirs.has(runsDir)) {
+        await mkdir5(runsDir, { recursive: true });
+        this.createdRunDirs.add(runsDir);
+      }
+      const filePath = path9.join(runsDir, `${run.runId}.json`);
+      await writeFile2(filePath, JSON.stringify(run, null, 2), "utf-8");
+    } catch {
+    }
+  }
+  async recoverOrphanedRuns() {
+    const runsDir = getRunsDir();
+    if (!existsSync4(runsDir)) return;
+    try {
+      const entries = await readdir4(runsDir, { withFileTypes: true });
+      const jsonFiles = [];
+      for (const entry of entries) {
+        if (entry.isDirectory()) {
+          const subDir = path9.join(runsDir, entry.name);
+          const subFiles = await readdir4(subDir);
+          for (const f of subFiles) {
+            if (f.endsWith(".json")) jsonFiles.push(path9.join(subDir, f));
+          }
+        } else if (entry.name.endsWith(".json")) {
+          jsonFiles.push(path9.join(runsDir, entry.name));
+        }
+      }
+      for (const filePath of jsonFiles) {
+        const content = await readFile5(filePath, "utf-8");
+        const run = JSON.parse(content);
+        if (run.status === "running") {
+          run.status = "failed";
+          run.updatedAt = (/* @__PURE__ */ new Date()).toISOString();
+          await writeFile2(filePath, JSON.stringify(run, null, 2), "utf-8");
+        }
+      }
+    } catch {
+    }
+  }
+};
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function objectDepth(obj, current = 0) {
+  if (!isPlainObject(obj)) return current;
+  let max = current + 1;
+  for (const value of Object.values(obj)) {
+    const depth = objectDepth(value, current + 1);
+    if (depth > max) max = depth;
+  }
+  return max;
+}
+
+// src/supervisor/schemas.ts
+import { z as z4 } from "zod";
+var supervisorDaemonStateSchema = z4.object({
+  pid: z4.number(),
+  tmuxSession: z4.string(),
+  sessionId: z4.string(),
+  port: z4.number(),
+  cwd: z4.string(),
+  startedAt: z4.string(),
+  lastHeartbeat: z4.string().optional(),
+  heartbeatCount: z4.number().default(0),
+  totalCostUsd: z4.number().default(0),
+  todayCostUsd: z4.number().default(0),
+  costResetDate: z4.string().optional(),
+  status: z4.enum(["running", "draining", "stopped"]).default("running")
+});
+var webhookIncomingEventSchema = z4.object({
+  id: z4.string().optional(),
+  source: z4.string().optional(),
+  event: z4.string().optional(),
+  payload: z4.record(z4.string(), z4.unknown()).optional(),
+  receivedAt: z4.string(),
+  processedAt: z4.string().optional()
+});
+var inboxMessageSchema = z4.object({
+  id: z4.string(),
+  from: z4.enum(["tui", "api", "external"]),
+  text: z4.string(),
+  timestamp: z4.string(),
+  processedAt: z4.string().optional()
+});
+var activityEntrySchema = z4.object({
+  id: z4.string(),
+  type: z4.enum([
+    "heartbeat",
+    "decision",
+    "action",
+    "error",
+    "event",
+    "message",
+    "thinking",
+    "plan",
+    "dispatch",
+    "tool_use"
+  ]),
+  summary: z4.string(),
+  detail: z4.unknown().optional(),
+  timestamp: z4.string()
+});
+
+// src/supervisor/activity-log.ts
+import { randomUUID as randomUUID2 } from "crypto";
+import { appendFile as appendFile4, readFile as readFile6, rename, stat } from "fs/promises";
+import path10 from "path";
+var ACTIVITY_FILE = "activity.jsonl";
+var MAX_SIZE_BYTES = 10 * 1024 * 1024;
+var ActivityLog = class {
+  filePath;
+  dir;
+  constructor(dir) {
+    this.dir = dir;
+    this.filePath = path10.join(dir, ACTIVITY_FILE);
+  }
+  /**
+   * Append a structured entry to the activity log.
+   * Rotates the file if it exceeds MAX_SIZE_BYTES.
+   */
+  async append(entry) {
+    await this.checkRotation();
+    const line = `${JSON.stringify(entry)}
+`;
+    await appendFile4(this.filePath, line, "utf-8");
+  }
+  /**
+   * Create and append a new entry with auto-generated id and timestamp.
+   */
+  async log(type, summary, detail) {
+    await this.append({
+      id: randomUUID2(),
+      type,
+      summary,
+      detail,
+      timestamp: (/* @__PURE__ */ new Date()).toISOString()
+    });
+  }
+  /**
+   * Read the last N entries from the activity log.
+   */
+  async tail(n) {
+    let content;
+    try {
+      content = await readFile6(this.filePath, "utf-8");
+    } catch {
+      return [];
+    }
+    const lines = content.trim().split("\n").filter(Boolean);
+    const lastLines = lines.slice(-n);
+    const entries = [];
+    for (const line of lastLines) {
+      try {
+        entries.push(JSON.parse(line));
+      } catch {
+      }
+    }
+    return entries;
+  }
+  async checkRotation() {
+    try {
+      const stats = await stat(this.filePath);
+      if (stats.size > MAX_SIZE_BYTES) {
+        const timestamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+        const rotatedPath = path10.join(this.dir, `activity-${timestamp}.jsonl`);
+        await rename(this.filePath, rotatedPath);
+      }
+    } catch {
+    }
+  }
+};
+
+// src/supervisor/daemon.ts
+import { randomUUID as randomUUID4 } from "crypto";
+import { existsSync as existsSync5 } from "fs";
+import { mkdir as mkdir6, readFile as readFile10, rm as rm2, writeFile as writeFile6 } from "fs/promises";
+import { homedir as homedir3 } from "os";
+import path13 from "path";
+
+// src/supervisor/event-queue.ts
+import { watch } from "fs";
+import { readFile as readFile7, writeFile as writeFile3 } from "fs/promises";
+var EventQueue = class {
+  queue = [];
+  seenIds = /* @__PURE__ */ new Set();
+  maxSeenIds = 1e3;
+  maxEventsPerSec;
+  eventCountThisSecond = 0;
+  currentSecond = 0;
+  watchers = [];
+  fileOffsets = /* @__PURE__ */ new Map();
+  /** Resolve function to wake up the heartbeat loop when an event arrives */
+  wakeUp = null;
+  constructor(options) {
+    this.maxEventsPerSec = options.maxEventsPerSec;
+  }
+  /**
+   * Push an event into the queue. Applies dedup and rate limiting.
+   */
+  push(event) {
+    const id = this.getEventId(event);
+    if (id && this.seenIds.has(id)) return false;
+    const now = Math.floor(Date.now() / 1e3);
+    if (now !== this.currentSecond) {
+      this.currentSecond = now;
+      this.eventCountThisSecond = 0;
+    }
+    if (this.eventCountThisSecond >= this.maxEventsPerSec) return false;
+    this.eventCountThisSecond++;
+    if (id) {
+      this.seenIds.add(id);
+      if (this.seenIds.size > this.maxSeenIds) {
+        const first = this.seenIds.values().next().value;
+        if (first) this.seenIds.delete(first);
+      }
+    }
+    this.queue.push(event);
+    this.wakeUp?.();
+    return true;
+  }
+  /**
+   * Drain all queued events and return them. Clears the queue.
+   */
+  drain() {
+    const events = [...this.queue];
+    this.queue.length = 0;
+    return events;
+  }
+  size() {
+    return this.queue.length;
+  }
+  /**
+   * Start watching inbox.jsonl and events.jsonl for new entries.
+   * New lines are parsed and pushed into the queue.
+   */
+  startWatching(inboxPath, eventsPath) {
+    this.watchJsonlFile(inboxPath, "message");
+    this.watchJsonlFile(eventsPath, "webhook");
+  }
+  stopWatching() {
+    for (const w of this.watchers) w.close();
+    this.watchers = [];
+    this.fileOffsets.clear();
+  }
+  /**
+   * Replay unprocessed events from disk on startup.
+   */
+  async replayUnprocessed(inboxPath, eventsPath) {
+    await this.replayFile(inboxPath, "message");
+    await this.replayFile(eventsPath, "webhook");
+  }
+  /**
+   * Returns a promise that resolves when a new event arrives or timeout is reached.
+   */
+  waitForEvent(timeoutMs) {
+    if (this.queue.length > 0) return Promise.resolve();
+    return new Promise((resolve4) => {
+      const timer = setTimeout(() => {
+        this.wakeUp = null;
+        resolve4();
+      }, timeoutMs);
+      this.wakeUp = () => {
+        clearTimeout(timer);
+        this.wakeUp = null;
+        resolve4();
+      };
+    });
+  }
+  /**
+   * Interrupt any pending waitForEvent — used during shutdown.
+   */
+  interrupt() {
+    this.wakeUp?.();
+  }
+  getEventId(event) {
+    if (event.kind === "webhook") return event.data.id;
+    if (event.kind === "message") return event.data.id;
+    if (event.kind === "run_complete") return `run:${event.runId}`;
+    return void 0;
+  }
+  watchJsonlFile(filePath, kind) {
+    try {
+      const watcher = watch(filePath, () => {
+        this.readNewLines(filePath, kind).catch(() => {
+        });
+      });
+      this.watchers.push(watcher);
+    } catch {
+    }
+  }
+  async readNewLines(filePath, kind) {
+    let content;
+    try {
+      content = await readFile7(filePath, "utf-8");
+    } catch {
+      return;
+    }
+    const offset = this.fileOffsets.get(filePath) ?? 0;
+    if (content.length <= offset) return;
+    const newContent = content.slice(offset);
+    this.fileOffsets.set(filePath, content.length);
+    const lines = newContent.trim().split("\n").filter(Boolean);
+    for (const line of lines) {
+      try {
+        const parsed = JSON.parse(line);
+        if (parsed.processedAt) continue;
+        if (kind === "webhook") {
+          this.push({ kind: "webhook", data: parsed });
+        } else {
+          this.push({ kind: "message", data: parsed });
+        }
+      } catch {
+      }
+    }
+  }
+  async replayFile(filePath, kind) {
+    let content;
+    try {
+      content = await readFile7(filePath, "utf-8");
+    } catch {
+      return;
+    }
+    this.fileOffsets.set(filePath, content.length);
+    const lines = content.trim().split("\n").filter(Boolean);
+    const unprocessed = [];
+    for (const line of lines) {
+      try {
+        const parsed = JSON.parse(line);
+        if (parsed.processedAt) continue;
+        if (kind === "webhook") {
+          this.push({ kind: "webhook", data: parsed });
+        } else {
+          this.push({ kind: "message", data: parsed });
+        }
+        unprocessed.push(line);
+      } catch {
+      }
+    }
+  }
+  /**
+   * Mark events as processed by rewriting the source files.
+   */
+  async markProcessed(inboxPath, eventsPath, events) {
+    const now = (/* @__PURE__ */ new Date()).toISOString();
+    for (const event of events) {
+      if (event.kind === "webhook") {
+        await this.markInFile(eventsPath, event.data.receivedAt, now);
+      } else if (event.kind === "message") {
+        await this.markInFile(inboxPath, event.data.timestamp, now);
+      }
+    }
+  }
+  async markInFile(filePath, matchTimestamp, processedAt) {
+    try {
+      const content = await readFile7(filePath, "utf-8");
+      const lines = content.split("\n");
+      let changed = false;
+      const updated = lines.map((line) => {
+        if (!line.trim()) return line;
+        try {
+          const parsed = JSON.parse(line);
+          if ((parsed.receivedAt === matchTimestamp || parsed.timestamp === matchTimestamp) && !parsed.processedAt) {
+            parsed.processedAt = processedAt;
+            changed = true;
+            return JSON.stringify(parsed);
+          }
+        } catch {
+        }
+        return line;
+      });
+      if (changed) {
+        await writeFile3(filePath, updated.join("\n"), "utf-8");
+        this.fileOffsets.set(filePath, updated.join("\n").length);
+      }
+    } catch {
+    }
+  }
+};
+
+// src/supervisor/heartbeat.ts
+import { randomUUID as randomUUID3 } from "crypto";
+import { readFile as readFile9, writeFile as writeFile5 } from "fs/promises";
+import { homedir as homedir2 } from "os";
+import path12 from "path";
+
+// src/supervisor/memory.ts
+import { readFile as readFile8, writeFile as writeFile4 } from "fs/promises";
+import path11 from "path";
+var MEMORY_FILE = "memory.md";
+var MAX_SIZE_KB = 10;
+async function loadMemory(dir) {
+  try {
+    return await readFile8(path11.join(dir, MEMORY_FILE), "utf-8");
+  } catch {
+    return "";
+  }
+}
+async function saveMemory(dir, content) {
+  await writeFile4(path11.join(dir, MEMORY_FILE), content, "utf-8");
+}
+function extractMemoryFromResponse(response) {
+  const match = /<memory>([\s\S]*?)<\/memory>/i.exec(response);
+  if (!match?.[1]) return null;
+  const content = match[1].trim();
+  if (content.startsWith("{")) {
+    try {
+      JSON.parse(content);
+      return content;
+    } catch {
+    }
+  }
+  return content;
+}
+function checkMemorySize(content) {
+  const sizeKB = Buffer.byteLength(content, "utf-8") / 1024;
+  return { ok: sizeKB <= MAX_SIZE_KB, sizeKB: Math.round(sizeKB * 10) / 10 };
+}
+
+// src/supervisor/prompt-builder.ts
+function buildHeartbeatPrompt(opts) {
+  const sections = [];
+  sections.push(`You are the neo autonomous supervisor (heartbeat #${opts.heartbeatCount}).
+You orchestrate developer agents across repositories. You make decisions autonomously.
+
+Your job:
+1. Process any incoming events (webhooks, user messages, run completions)
+2. Decide what actions to take (dispatch agents, check status, respond to users)
+3. Update your memory with relevant context for future heartbeats
+4. If nothing to do, simply acknowledge and wait
+
+Available commands (via bash):
+  neo run <agent> --prompt "..." [--repo <path>]   dispatch an agent
+  neo runs --short [--all]                         check recent runs
+  neo cost --short [--all]                         check budget
+  neo agents                                       list available agents
+
+IMPORTANT: Always include a <memory>...</memory> block at the end of your response with your updated memory.`);
+  if (opts.customInstructions) {
+    sections.push(`## Custom instructions
+${opts.customInstructions}`);
+  }
+  if (opts.repos.length > 0) {
+    const repoList = opts.repos.map((r) => `- ${r.path} (branch: ${r.defaultBranch})`).join("\n");
+    sections.push(`## Registered repositories
+${repoList}`);
+  } else {
+    sections.push("## Registered repositories\n(none \u2014 run 'neo init' in a repo to register it)");
+  }
+  if (opts.mcpServerNames.length > 0) {
+    const mcpList = opts.mcpServerNames.map((n) => `- ${n}`).join("\n");
+    sections.push(
+      `## Available integrations (MCP)
+${mcpList}
+
+You can use these tools directly to query external systems.`
+    );
+  }
+  sections.push(
+    `## Budget status
+- Today: $${opts.budgetStatus.todayUsd.toFixed(2)} / $${opts.budgetStatus.capUsd.toFixed(2)} (${opts.budgetStatus.remainingPct.toFixed(0)}% remaining)`
+  );
+  if (opts.activeRuns.length > 0) {
+    sections.push(`## Active runs
+${opts.activeRuns.map((r) => `- ${r}`).join("\n")}`);
+  }
+  if (opts.events.length > 0) {
+    const eventDescriptions = opts.events.map(formatEvent);
+    sections.push(`## Pending events (${opts.events.length})
+${eventDescriptions.join("\n\n")}`);
+  } else {
+    sections.push(
+      "## Pending events\nNo new events. This is an idle heartbeat \u2014 check on active runs if any, or wait."
+    );
+  }
+  sections.push(buildMemorySection(opts.memory, opts.memorySizeKB));
+  return sections.join("\n\n---\n\n");
+}
+function buildMemorySection(memory, memorySizeKB) {
+  const schema = `{
+  "activeWork": ["description of current task 1", ...],
+  "blockers": ["what is stuck and why", ...],
+  "repoNotes": { "/path/to/repo": "relevant context about this repo" },
+  "recentDecisions": [{ "date": "YYYY-MM-DD", "decision": "what you decided", "outcome": "result" }],
+  "trackerSync": { "ticket-id": "last known status" },
+  "notes": "free-form context that doesn't fit elsewhere"
+}`;
+  if (!memory) {
+    return `## Your current memory
+(empty \u2014 this is your first heartbeat, initialize your memory)
+
+Your memory MUST be a JSON object inside \`<memory>...</memory>\` tags:
+\`\`\`
+${schema}
+\`\`\`
+Keep under 8KB. Prune old decisions (keep last 10).`;
+  }
+  const sizeWarning = memorySizeKB > 8 ? "\n\n**Memory is over 8KB \u2014 condense it. Remove old decisions, summarize notes.**" : "";
+  return `## Your current memory (${memorySizeKB}KB)${sizeWarning}
+${memory}
+
+Remember: update your memory as a JSON object inside \`<memory>...</memory>\` tags.
+Schema: ${schema}`;
+}
+function formatEvent(event) {
+  switch (event.kind) {
+    case "webhook":
+      return `**Webhook** [${event.data.source ?? "unknown"}] ${event.data.event ?? ""}
+\`\`\`json
+${JSON.stringify(event.data.payload ?? {}, null, 2).slice(0, 2e3)}
+\`\`\``;
+    case "message":
+      return `**Message from ${event.data.from}**: ${event.data.text}`;
+    case "run_complete":
+      return `**Run completed**: ${event.runId} (check with \`neo runs\`)`;
+  }
+}
+
+// src/supervisor/heartbeat.ts
+var HeartbeatLoop = class {
+  stopping = false;
+  consecutiveFailures = 0;
+  activeAbort = null;
+  config;
+  supervisorDir;
+  statePath;
+  sessionId;
+  eventQueue;
+  activityLog;
+  customInstructions;
+  constructor(options) {
+    this.config = options.config;
+    this.supervisorDir = options.supervisorDir;
+    this.statePath = options.statePath;
+    this.sessionId = options.sessionId;
+    this.eventQueue = options.eventQueue;
+    this.activityLog = options.activityLog;
+  }
+  async start() {
+    this.customInstructions = await this.loadInstructions();
+    await this.activityLog.log("heartbeat", "Supervisor heartbeat loop started");
+    while (!this.stopping) {
+      try {
+        await this.runHeartbeat();
+        this.consecutiveFailures = 0;
+      } catch (error) {
+        this.consecutiveFailures++;
+        const msg = error instanceof Error ? error.message : String(error);
+        await this.activityLog.log("error", `Heartbeat failed: ${msg}`, { error: msg });
+        if (this.consecutiveFailures >= this.config.supervisor.maxConsecutiveFailures) {
+          const backoffMs = Math.min(
+            this.config.supervisor.idleIntervalMs * 2 ** (this.consecutiveFailures - this.config.supervisor.maxConsecutiveFailures),
+            15 * 60 * 1e3
+            // max 15 minutes
+          );
+          await this.activityLog.log(
+            "error",
+            `Circuit breaker: backing off ${Math.round(backoffMs / 1e3)}s after ${this.consecutiveFailures} failures`
+          );
+          await this.sleep(backoffMs);
+          continue;
+        }
+      }
+      if (this.stopping) break;
+      await this.eventQueue.waitForEvent(this.config.supervisor.idleIntervalMs);
+    }
+    await this.activityLog.log("heartbeat", "Supervisor heartbeat loop stopped");
+  }
+  stop() {
+    this.stopping = true;
+    this.activeAbort?.abort(new Error("Supervisor shutting down"));
+    this.eventQueue.interrupt();
+  }
+  async runHeartbeat() {
+    const startTime = Date.now();
+    const heartbeatId = randomUUID3();
+    const state = await this.readState();
+    const today = (/* @__PURE__ */ new Date()).toISOString().slice(0, 10);
+    const todayCost = state?.costResetDate === today ? state.todayCostUsd ?? 0 : 0;
+    if (todayCost >= this.config.supervisor.dailyCapUsd) {
+      await this.activityLog.log(
+        "error",
+        `Supervisor daily budget exceeded ($${todayCost.toFixed(2)} / $${this.config.supervisor.dailyCapUsd}). Skipping heartbeat.`
+      );
+      await this.sleep(this.config.supervisor.idleIntervalMs);
+      return;
+    }
+    const events = this.eventQueue.drain();
+    const memory = await loadMemory(this.supervisorDir);
+    const memoryCheck = checkMemorySize(memory);
+    const mcpServerNames = this.config.mcpServers ? Object.keys(this.config.mcpServers) : [];
+    const prompt = buildHeartbeatPrompt({
+      repos: this.config.repos,
+      memory,
+      memorySizeKB: memoryCheck.sizeKB,
+      events,
+      budgetStatus: {
+        todayUsd: todayCost,
+        capUsd: this.config.supervisor.dailyCapUsd,
+        remainingPct: (this.config.supervisor.dailyCapUsd - todayCost) / this.config.supervisor.dailyCapUsd * 100
+      },
+      activeRuns: [],
+      // TODO: read from persisted runs
+      heartbeatCount: state?.heartbeatCount ?? 0,
+      mcpServerNames,
+      customInstructions: this.customInstructions
+    });
+    await this.activityLog.log("heartbeat", `Heartbeat #${state?.heartbeatCount ?? 0} starting`, {
+      heartbeatId,
+      eventCount: events.length,
+      triggeredBy: events.map((e) => e.kind)
+    });
+    const abortController = new AbortController();
+    this.activeAbort = abortController;
+    const timeout = setTimeout(() => {
+      abortController.abort(new Error("Heartbeat timeout exceeded"));
+    }, this.config.supervisor.heartbeatTimeoutMs);
+    let output = "";
+    let costUsd = 0;
+    let turnCount = 0;
+    try {
+      const sdk = await import("@anthropic-ai/claude-agent-sdk");
+      const queryOptions = {
+        cwd: homedir2(),
+        maxTurns: 50,
+        allowedTools: ["Bash", "Read"],
+        permissionMode: "bypassPermissions",
+        allowDangerouslySkipPermissions: true
+      };
+      if (this.config.mcpServers) {
+        queryOptions.mcpServers = this.config.mcpServers;
+      }
+      const stream = sdk.query({ prompt, options: queryOptions });
+      for await (const message of stream) {
+        if (abortController.signal.aborted) break;
+        const msg = message;
+        if (msg.type === "system" && msg.subtype === "init") {
+          this.sessionId = msg.session_id;
+        }
+        if (msg.type === "result") {
+          output = msg.result ?? "";
+          costUsd = msg.total_cost_usd ?? 0;
+          turnCount = msg.num_turns ?? 0;
+        }
+        await this.logStreamMessage(msg, heartbeatId);
+      }
+    } finally {
+      clearTimeout(timeout);
+      this.activeAbort = null;
+    }
+    const newMemory = extractMemoryFromResponse(output);
+    if (newMemory) {
+      await saveMemory(this.supervisorDir, newMemory);
+    }
+    const durationMs = Date.now() - startTime;
+    await this.updateState({
+      sessionId: this.sessionId,
+      lastHeartbeat: (/* @__PURE__ */ new Date()).toISOString(),
+      heartbeatCount: (state?.heartbeatCount ?? 0) + 1,
+      totalCostUsd: (state?.totalCostUsd ?? 0) + costUsd,
+      todayCostUsd: todayCost + costUsd,
+      costResetDate: today
+    });
+    await this.activityLog.log(
+      "heartbeat",
+      `Heartbeat #${(state?.heartbeatCount ?? 0) + 1} complete`,
+      {
+        heartbeatId,
+        costUsd,
+        durationMs,
+        turnCount,
+        memoryUpdated: !!newMemory,
+        responseSummary: output.slice(0, 500)
+      }
+    );
+  }
+  async readState() {
+    try {
+      const raw = await readFile9(this.statePath, "utf-8");
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  async updateState(updates) {
+    try {
+      const raw = await readFile9(this.statePath, "utf-8");
+      const state = JSON.parse(raw);
+      Object.assign(state, updates);
+      await writeFile5(this.statePath, JSON.stringify(state, null, 2), "utf-8");
+    } catch {
+    }
+  }
+  /**
+   * Load custom instructions from SUPERVISOR.md.
+   * Resolution order:
+   * 1. Explicit path via `supervisor.instructions` in config
+   * 2. Default: ~/.neo/SUPERVISOR.md
+   */
+  async loadInstructions() {
+    const candidates = [];
+    if (this.config.supervisor.instructions) {
+      candidates.push(path12.resolve(this.config.supervisor.instructions));
+    }
+    candidates.push(path12.join(getDataDir(), "SUPERVISOR.md"));
+    for (const filePath of candidates) {
+      try {
+        const content = await readFile9(filePath, "utf-8");
+        await this.activityLog.log("event", `Loaded custom instructions from ${filePath}`);
+        return content;
+      } catch {
+      }
+    }
+    return void 0;
+  }
+  /** Route a single SDK stream message to the appropriate log handler. */
+  async logStreamMessage(msg, heartbeatId) {
+    if (msg.type !== "assistant") return;
+    if (!msg.subtype) {
+      await this.logContentBlocks(msg, heartbeatId);
+    } else if (msg.subtype === "tool_use") {
+      await this.logToolUse(msg, heartbeatId);
+    } else if (msg.subtype === "tool_result") {
+      await this.logToolResult(msg, heartbeatId);
+    }
+  }
+  /** Log thinking and plan blocks from assistant content. */
+  async logContentBlocks(msg, heartbeatId) {
+    const content = msg.message?.content;
+    if (!content) return;
+    for (const block of content) {
+      if (block.type === "thinking" && block.thinking) {
+        await this.activityLog.log("thinking", block.thinking.slice(0, 500), { heartbeatId });
+      }
+      if (block.type === "text" && block.text) {
+        await this.activityLog.log("plan", block.text.slice(0, 500), { heartbeatId });
+        break;
+      }
+    }
+  }
+  /** Log tool use events — distinguish MCP tools from built-in tools. */
+  async logToolUse(msg, heartbeatId) {
+    const toolName = String(msg.tool ?? "unknown");
+    const isMcp = toolName.startsWith("mcp__");
+    await this.activityLog.log(
+      isMcp ? "tool_use" : "action",
+      isMcp ? toolName : `Tool use: ${toolName}`,
+      { heartbeatId, tool: toolName, input: msg.input }
+    );
+  }
+  /** Detect agent dispatches from bash tool results. */
+  async logToolResult(msg, heartbeatId) {
+    const result = String(msg.result ?? "");
+    const runMatch = /Run\s+(\S+)\s+dispatched/i.exec(result);
+    if (runMatch) {
+      await this.activityLog.log("dispatch", `Agent dispatched: ${runMatch[1]}`, {
+        heartbeatId,
+        runId: runMatch[1]
+      });
+    }
+  }
+  sleep(ms) {
+    return new Promise((resolve4) => setTimeout(resolve4, ms));
+  }
+};
+
+// src/supervisor/webhook-server.ts
+import { timingSafeEqual } from "crypto";
+import { appendFile as appendFile5 } from "fs/promises";
+import { createServer } from "http";
+var MAX_BODY_SIZE = 1024 * 1024;
+var WebhookServer = class {
+  server = null;
+  port;
+  secret;
+  eventsPath;
+  onEvent;
+  getHealth;
+  constructor(options) {
+    this.port = options.port;
+    this.secret = options.secret;
+    this.eventsPath = options.eventsPath;
+    this.onEvent = options.onEvent;
+    this.getHealth = options.getHealth;
+  }
+  async start() {
+    return new Promise((resolve4, reject) => {
+      this.server = createServer((req, res) => {
+        this.handleRequest(req, res).catch((err) => {
+          this.sendJson(res, 500, { error: "Internal server error", detail: String(err) });
+        });
+      });
+      this.server.on("error", reject);
+      this.server.listen(this.port, () => {
+        resolve4();
+      });
+    });
+  }
+  async stop() {
+    return new Promise((resolve4) => {
+      if (!this.server) {
+        resolve4();
+        return;
+      }
+      this.server.close(() => resolve4());
+    });
+  }
+  async handleRequest(req, res) {
+    const url = req.url ?? "/";
+    if (req.method === "GET" && url === "/health") {
+      this.sendJson(res, 200, this.getHealth());
+      return;
+    }
+    if (req.method === "POST" && url === "/webhook") {
+      await this.handleWebhook(req, res);
+      return;
+    }
+    this.sendJson(res, 404, { error: "Not found" });
+  }
+  async handleWebhook(req, res) {
+    if (this.secret) {
+      const provided = req.headers["x-neo-secret"];
+      if (!provided) {
+        this.sendJson(res, 401, { error: "Missing X-Neo-Secret header" });
+        return;
+      }
+      const expected = Buffer.from(this.secret, "utf-8");
+      const actual = Buffer.from(provided, "utf-8");
+      if (expected.length !== actual.length || !timingSafeEqual(expected, actual)) {
+        this.sendJson(res, 403, { error: "Invalid secret" });
+        return;
+      }
+    }
+    const body = await this.readBody(req);
+    if (body === null) {
+      this.sendJson(res, 413, { error: "Payload too large (max 1MB)" });
+      return;
+    }
+    let parsed;
+    try {
+      parsed = JSON.parse(body);
+    } catch {
+      this.sendJson(res, 400, { error: "Invalid JSON" });
+      return;
+    }
+    const event = {
+      id: typeof parsed.id === "string" ? parsed.id : void 0,
+      source: typeof parsed.source === "string" ? parsed.source : void 0,
+      event: typeof parsed.event === "string" ? parsed.event : void 0,
+      payload: parsed.payload ?? parsed,
+      receivedAt: (/* @__PURE__ */ new Date()).toISOString()
+    };
+    await appendFile5(this.eventsPath, `${JSON.stringify(event)}
+`, "utf-8");
+    this.onEvent(event);
+    this.sendJson(res, 200, { ok: true, id: event.id });
+  }
+  readBody(req) {
+    return new Promise((resolve4) => {
+      const chunks = [];
+      let size = 0;
+      req.on("data", (chunk) => {
+        size += chunk.length;
+        if (size > MAX_BODY_SIZE) {
+          resolve4(null);
+          req.destroy();
+          return;
+        }
+        chunks.push(chunk);
+      });
+      req.on("end", () => {
+        resolve4(Buffer.concat(chunks).toString("utf-8"));
+      });
+      req.on("error", () => resolve4(null));
+    });
+  }
+  sendJson(res, status, data) {
+    res.writeHead(status, { "Content-Type": "application/json" });
+    res.end(JSON.stringify(data));
+  }
+};
+
+// src/supervisor/daemon.ts
+var SupervisorDaemon = class {
+  name;
+  config;
+  dir;
+  webhookServer = null;
+  eventQueue = null;
+  heartbeatLoop = null;
+  activityLog = null;
+  sessionId = "";
+  constructor(options) {
+    this.name = options.name;
+    this.config = options.config;
+    this.dir = getSupervisorDir(options.name);
+  }
+  async start() {
+    await mkdir6(this.dir, { recursive: true });
+    const lockPath = path13.join(this.dir, "daemon.lock");
+    if (existsSync5(lockPath)) {
+      const lockPid = await this.readLockPid(lockPath);
+      if (lockPid && this.isProcessAlive(lockPid)) {
+        throw new Error(
+          `Supervisor "${this.name}" already running (PID ${lockPid}). Use --kill first.`
+        );
+      }
+      await rm2(lockPath, { force: true });
+    }
+    const tempLock = `${lockPath}.${process.pid}`;
+    await writeFile6(tempLock, String(process.pid), "utf-8");
+    const { rename: rename2 } = await import("fs/promises");
+    await rename2(tempLock, lockPath);
+    const existingState = await this.readState();
+    if (existingState?.sessionId && existingState.status !== "stopped") {
+      this.sessionId = existingState.sessionId;
+    } else {
+      this.sessionId = randomUUID4();
+    }
+    this.activityLog = new ActivityLog(this.dir);
+    this.eventQueue = new EventQueue({
+      maxEventsPerSec: this.config.supervisor.maxEventsPerSec
+    });
+    const inboxPath = path13.join(this.dir, "inbox.jsonl");
+    const eventsPath = path13.join(this.dir, "events.jsonl");
+    await this.eventQueue.replayUnprocessed(inboxPath, eventsPath);
+    this.eventQueue.startWatching(inboxPath, eventsPath);
+    this.webhookServer = new WebhookServer({
+      port: this.config.supervisor.port,
+      secret: this.config.supervisor.secret,
+      eventsPath,
+      onEvent: (event) => {
+        this.eventQueue?.push({ kind: "webhook", data: event });
+      },
+      getHealth: () => this.getHealthInfo()
+    });
+    await this.webhookServer.start();
+    await this.writeState({
+      pid: process.pid,
+      tmuxSession: `neo-${this.name}`,
+      sessionId: this.sessionId,
+      port: this.config.supervisor.port,
+      cwd: homedir3(),
+      startedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      lastHeartbeat: existingState?.lastHeartbeat,
+      heartbeatCount: existingState?.heartbeatCount ?? 0,
+      totalCostUsd: existingState?.totalCostUsd ?? 0,
+      todayCostUsd: existingState?.todayCostUsd ?? 0,
+      costResetDate: existingState?.costResetDate,
+      status: "running"
+    });
+    const shutdown = () => {
+      this.stop().catch(console.error);
+    };
+    process.on("SIGTERM", shutdown);
+    process.on("SIGINT", shutdown);
+    await this.activityLog.log(
+      "event",
+      `Supervisor "${this.name}" started on port ${this.config.supervisor.port}`
+    );
+    const statePath = path13.join(this.dir, "state.json");
+    this.heartbeatLoop = new HeartbeatLoop({
+      config: this.config,
+      supervisorDir: this.dir,
+      statePath,
+      sessionId: this.sessionId,
+      eventQueue: this.eventQueue,
+      activityLog: this.activityLog
+    });
+    await this.heartbeatLoop.start();
+  }
+  async stop() {
+    this.heartbeatLoop?.stop();
+    this.eventQueue?.stopWatching();
+    if (this.webhookServer) {
+      await this.webhookServer.stop();
+    }
+    const state = await this.readState();
+    if (state) {
+      state.status = "stopped";
+      await this.writeState(state);
+    }
+    const lockPath = path13.join(this.dir, "daemon.lock");
+    await rm2(lockPath, { force: true });
+    if (this.activityLog) {
+      await this.activityLog.log("event", `Supervisor "${this.name}" stopped`);
+    }
+  }
+  getHealthInfo() {
+    return {
+      status: "ok",
+      name: this.name,
+      pid: process.pid,
+      uptime: process.uptime(),
+      sessionId: this.sessionId,
+      port: this.config.supervisor.port
+    };
+  }
+  async readState() {
+    const statePath = path13.join(this.dir, "state.json");
+    try {
+      const raw = await readFile10(statePath, "utf-8");
+      return JSON.parse(raw);
+    } catch {
+      return null;
+    }
+  }
+  async writeState(state) {
+    const statePath = path13.join(this.dir, "state.json");
+    await writeFile6(statePath, JSON.stringify(state, null, 2), "utf-8");
+  }
+  async readLockPid(lockPath) {
+    try {
+      const raw = await readFile10(lockPath, "utf-8");
+      const pid = Number.parseInt(raw.trim(), 10);
+      return Number.isNaN(pid) ? null : pid;
+    } catch {
+      return null;
+    }
+  }
+  isProcessAlive(pid) {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+};
+
+// src/index.ts
+var VERSION = "0.1.0";
+export {
+  ActivityLog,
+  AgentRegistry,
+  CostJournal,
+  EventJournal,
+  EventQueue,
+  HeartbeatLoop,
+  NeoEventEmitter,
+  Orchestrator,
+  Semaphore,
+  SessionError,
+  SupervisorDaemon,
+  VERSION,
+  WebhookDispatcher,
+  WebhookServer,
+  WorkflowRegistry,
+  activityEntrySchema,
+  addRepoToGlobalConfig,
+  agentConfigSchema,
+  agentModelSchema,
+  agentSandboxSchema,
+  agentToolEntrySchema,
+  agentToolSchema,
+  auditLog,
+  budgetGuard,
+  buildHeartbeatPrompt,
+  buildMiddlewareChain,
+  buildSDKHooks,
+  buildSandboxConfig,
+  checkMemorySize,
+  cleanupOrphanedWorktrees,
+  createBranch,
+  createWorktree,
+  deleteBranch,
+  extractMemoryFromResponse,
+  fetchRemote,
+  getBranchName,
+  getCurrentBranch,
+  getDataDir,
+  getJournalsDir,
+  getRepoRunsDir,
+  getRunDispatchPath,
+  getRunLogPath,
+  getRunsDir,
+  getSupervisorActivityPath,
+  getSupervisorDir,
+  getSupervisorEventsPath,
+  getSupervisorInboxPath,
+  getSupervisorLockPath,
+  getSupervisorMemoryPath,
+  getSupervisorStatePath,
+  getSupervisorsDir,
+  globalConfigSchema,
+  inboxMessageSchema,
+  listReposFromGlobalConfig,
+  listWorktrees,
+  loadAgentFile,
+  loadConfig,
+  loadGlobalConfig,
+  loadMemory,
+  loadWorkflow,
+  loopDetection,
+  matchesFilter,
+  mcpServerConfigSchema,
+  neoConfigSchema,
+  parseOutput,
+  pushBranch,
+  removeRepoFromGlobalConfig,
+  removeWorktree,
+  repoConfigSchema,
+  resolveAgent,
+  runSession,
+  runWithRecovery,
+  saveMemory,
+  supervisorDaemonStateSchema,
+  supervisorDaemonStateSchema as supervisorStateSchema,
+  toRepoSlug,
+  webhookIncomingEventSchema,
+  withGitLock,
+  workflowGateDefSchema,
+  workflowStepDefSchema
+};
+//# sourceMappingURL=index.js.map