@openrig/cli 0.5.16 → 0.6.0

package/node_modules/@openrig/daemon/dist/domain/startup-orchestrator.d.ts

@@ -1,130 +0,0 @@
-import type Database from "better-sqlite3";
-import type { SessionRegistry } from "./session-registry.js";
-import type { EventBus } from "./event-bus.js";
-import type { TmuxAdapter } from "../adapters/tmux.js";
-import type { StartupAction } from "./types.js";
-import type { RuntimeAdapter, NodeBinding, ResolvedStartupFile, ForkSource } from "./runtime-adapter.js";
-import type { ProjectionPlan } from "./projection-planner.js";
-export interface StartupInput {
-    rigId: string;
-    nodeId: string;
-    sessionId: string;
-    binding: NodeBinding;
-    adapter: RuntimeAdapter;
-    plan: ProjectionPlan;
-    resolvedStartupFiles: ResolvedStartupFile[];
-    startupActions: StartupAction[];
-    isRestore: boolean;
-    /** Session name for harness launch (used as --name flag). */
-    sessionName?: string;
-    /** Resume token for restore path. Mutually exclusive with forkSource. */
-    resumeToken?: string;
-    /** Runtime-native type for resumeToken (for example claude_id or codex_id). */
-    resumeType?: string;
-    /**
-     * Fork-source for new-seat-from-prior-conversation path. Mutually
-     * exclusive with resumeToken. v1: kind="native_id" only. The captured
-     * post-fork token (returned by the adapter) is what gets persisted on
-     * the new seat — the parent token is NEVER persisted.
-     */
-    forkSource?: ForkSource;
-    /**
-     * Rebuild-mode artifact set (operator-declared via
-     * `session_source.mode: rebuild`). When set, the orchestrator merges
-     * these artifacts into the post-launch delivery path, fresh-launches
-     * the harness with NO `resumeToken` and NO `forkSource`, and records
-     * `continuityOutcome: "rebuilt"` on the seat. NEVER paired with
-     * `resumeToken` or `forkSource` — rebuild is a distinct creation path.
-     */
-    rebuildArtifacts?: ResolvedStartupFile[];
-    /** Skip harness launch (legacy nodes that already resumed via old helpers). */
-    skipHarnessLaunch?: boolean;
-    /** Allow runtime adapter retry_fresh fallback when native resume data is stale. */
-    allowFreshFallback?: boolean;
-    /** Exact resume must not overwrite the authored fresh-start context with its empty replay plan. */
-    preserveStartupContext?: boolean;
-    /** Continue the same fresh occupant after a prerequisite, without another harness launch. */
-    continueFreshStartup?: boolean;
-    /** Deliberate fresh replacement retains the seat’s durable destination obligations. */
-    includeDurableObligations?: boolean;
-    /** Readiness timeout in ms (default 30000). */
-    readinessTimeoutMs?: number;
-}
-export type StartupResult = {
-    ok: true;
-    startupStatus: "ready";
-    continuityOutcome: "resumed" | "fresh" | "forked" | "rebuilt";
-} | {
-    ok: false;
-    startupStatus: "attention_required" | "failed";
-    errors: string[];
-    evidence?: string;
-};
-interface StartupOrchestratorDeps {
-    db: Database.Database;
-    sessionRegistry: SessionRegistry;
-    eventBus: EventBus;
-    tmuxAdapter: TmuxAdapter;
-    /** Read file content for concrete-hint resolution. */
-    readFile?: (path: string) => string;
-    /** Sleep between paste and submit for tmux-driven TUIs. */
-    sleep?: (ms: number) => Promise<void>;
-}
-/**
- * Drives one node from projected resources to startup_status: ready.
- *
- * Sequence (NS-T05):
- * 1. Mark pending, emit node.startup_pending
- * 2. Project resources (filesystem)
- * 3. Deliver pre-launch files (guidance_merge, skill_install → filesystem)
- * 4. Launch harness via adapter.launchHarness()
- * 5. Wait for harness ready (retry with exponential backoff, 30s timeout)
- * 6. For fresh sessions, inject the built-in identity anchor as the first prompt
- *    and deliver remaining post-launch files (send_text → TUI)
- * 7. Execute after_files actions
- * 8. Execute after_ready actions
- * 9. Persist startup context + resume token
- * 10. Mark ready, emit node.startup_ready
- *
- * Failure leaves startup_status: failed, node visible.
- * The caller creates session + binding first via NodeLauncher,
- * then calls startNode() with the full startup payload.
- */
-export declare class StartupOrchestrator {
-    readonly db: Database.Database;
-    private sessionRegistry;
-    private eventBus;
-    private tmuxAdapter;
-    private sleep;
-    private appliedLaunchStore;
-    constructor(deps: StartupOrchestratorDeps);
-    private readFile;
-    startNode(input: StartupInput): Promise<StartupResult>;
-    /** A failed attempt can continue only when it stopped before sending context.
-     * Any newer pending/ready/failure event consumes that permission, including a
-     * daemon loss during delivery: uncertain delivery is never blindly replayed.
-     */
-    canContinueFresh(nodeId: string, sessionId: string): boolean;
-    /**
-     * Wait for harness readiness with exponential backoff.
-     * Backoff: 1s → 2s → 4s → 8s → 16s (capped), total timeout default 30s.
-     */
-    private waitForReady;
-    private safeReadFile;
-    private fail;
-    private executeActions;
-    private extractSessionIdentityAction;
-    private deliverInitialSessionPrompt;
-    /**
-     * OPR.0.4.7.17 restore-order-correction. Deliver the after_ready send_text
-     * preload action(s) as the single leading turn on a resumed restore, bundling
-     * the first work-triggering send_text post-launch file (guidance/role.md)
-     * behind them so "load skills BEFORE anything else" causally precedes the role
-     * content in one submission. Returns the post-launch files still to deliver
-     * normally (role.md removed once bundled).
-     */
-    private deliverRestorePreloadPrompt;
-    private sendInteractiveText;
-}
-export {};
-//# sourceMappingURL=startup-orchestrator.d.ts.map

package/node_modules/@openrig/daemon/dist/domain/startup-orchestrator.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"startup-orchestrator.d.ts","sourceRoot":"","sources":["../../src/domain/startup-orchestrator.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,QAAQ,MAAM,gBAAgB,CAAC;AAC3C,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/C,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AACvD,OAAO,KAAK,EAAE,aAAa,EAAyB,MAAM,YAAY,CAAC;AACvE,OAAO,KAAK,EACV,cAAc,EAAE,WAAW,EAAE,mBAAmB,EACP,UAAU,EACpD,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AAS9D,MAAM,WAAW,YAAY;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,WAAW,CAAC;IACrB,OAAO,EAAE,cAAc,CAAC;IACxB,IAAI,EAAE,cAAc,CAAC;IACrB,oBAAoB,EAAE,mBAAmB,EAAE,CAAC;IAC5C,cAAc,EAAE,aAAa,EAAE,CAAC;IAChC,SAAS,EAAE,OAAO,CAAC;IACnB,6DAA6D;IAC7D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yEAAyE;IACzE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,+EAA+E;IAC/E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;OAKG;IACH,UAAU,CAAC,EAAE,UAAU,CAAC;IACxB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,mBAAmB,EAAE,CAAC;IACzC,+EAA+E;IAC/E,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,mFAAmF;IACnF,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,mGAAmG;IACnG,sBAAsB,CAAC,EAAE,OAAO,CAAC;IACjC,6FAA6F;IAC7F,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,uFAAuF;IACvF,yBAAyB,CAAC,EAAE,OAAO,CAAC;IACpC,+CAA+C;IAC/C,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,aAAa,EAAE,OAAO,CAAC;IAAC,iBAAiB,EAAE,SAAS,GAAG,OAAO,GAAG,QAAQ,GAAG,SAAS,CAAA;CAAE,GAKnG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,aAAa,EAAE,oBAAoB,GAAG,QAAQ,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvG,UAAU,uBAAuB;IAC/B,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IACtB,eAAe,EAAE,eAAe,CAAC;IACjC,QAAQ,EAAE,QAAQ,CAAC;IACnB,WAAW,EAAE,WAAW,CAAC;IACzB,sDAAsD;IACtD,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAC;IACpC,2DAA2D;IAC3D,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,mBAAmB;IAC9B,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,CAAC;IAC/B,OAAO,CAAC,eAAe,CAAkB;IACzC,OAAO,CAAC,QAAQ,CAAW;IAC3B,OAAO,CAAC,WAAW,CAAc;IACjC,OAAO,CAAC,KAAK,CAAgC;IAC7C,OAAO,CAAC,kBAAkB,CAAgC;gBAE9C,IAAI,EAAE,uBAAuB;IAYzC,OAAO,CAAC,QAAQ,CAA2B;IAErC,SAAS,CAAC,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,aAAa,CAAC;IAiU5D;;;OAGG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,OAAO;IAO5D;;;OAGG;YACW,YAAY;IA6B1B,OAAO,CAAC,YAAY;IAIpB,OAAO,CAAC,IAAI;YAmBE,cAAc;IAyC5B,OAAO,CAAC,4BAA4B;YAOtB,2BAA2B;IA6CzC;;;;;;;OAOG;YACW,2BAA2B;YAmC3B,mBAAmB;CAclC"}

package/node_modules/@openrig/daemon/dist/domain/startup-orchestrator.js

@@ -1,526 +0,0 @@
-import { isAttentionRequiredReadinessCode, resolveConcreteHint } from "./runtime-adapter.js";
-import { issueStartupChallenge } from "./startup-proof.js";
-import { resolveStartupProof } from "./startup-resolver.js";
-import { AppliedLaunchObservationStore } from "./applied-launch-observation-store.js";
-import { RigRepository } from "./rig-repository.js";
-/**
- * Drives one node from projected resources to startup_status: ready.
- *
- * Sequence (NS-T05):
- * 1. Mark pending, emit node.startup_pending
- * 2. Project resources (filesystem)
- * 3. Deliver pre-launch files (guidance_merge, skill_install → filesystem)
- * 4. Launch harness via adapter.launchHarness()
- * 5. Wait for harness ready (retry with exponential backoff, 30s timeout)
- * 6. For fresh sessions, inject the built-in identity anchor as the first prompt
- *    and deliver remaining post-launch files (send_text → TUI)
- * 7. Execute after_files actions
- * 8. Execute after_ready actions
- * 9. Persist startup context + resume token
- * 10. Mark ready, emit node.startup_ready
- *
- * Failure leaves startup_status: failed, node visible.
- * The caller creates session + binding first via NodeLauncher,
- * then calls startNode() with the full startup payload.
- */
-export class StartupOrchestrator {
-    db;
-    sessionRegistry;
-    eventBus;
-    tmuxAdapter;
-    sleep;
-    appliedLaunchStore;
-    constructor(deps) {
-        if (deps.db !== deps.sessionRegistry.db)
-            throw new Error("StartupOrchestrator: sessionRegistry must share the same db handle");
-        if (deps.db !== deps.eventBus.db)
-            throw new Error("StartupOrchestrator: eventBus must share the same db handle");
-        this.db = deps.db;
-        this.sessionRegistry = deps.sessionRegistry;
-        this.eventBus = deps.eventBus;
-        this.tmuxAdapter = deps.tmuxAdapter;
-        this.readFile = deps.readFile ?? (() => "");
-        this.sleep = deps.sleep ?? ((ms) => new Promise((resolve) => setTimeout(resolve, ms)));
-        this.appliedLaunchStore = new AppliedLaunchObservationStore(deps.db);
-    }
-    readFile;
-    async startNode(input) {
-        // #25: launch, restore replay, relaunch, continue and added members deliver
-        // guidance through here, so the rig's managed-block destination is bound once
-        // for the adapter. Handover does not come here: the successor launches directly
-        // and reads the file already written in its cwd.
-        const claudeManagedBlockFile = new RigRepository(this.db).getRigClaudeManagedBlockFile(input.rigId);
-        if (claudeManagedBlockFile)
-            input = { ...input, binding: { ...input.binding, claudeManagedBlockFile } };
-        const errors = [];
-        let continuityOutcome = input.resumeToken
-            ? "resumed"
-            : input.forkSource
-                ? "forked"
-                : input.rebuildArtifacts && input.rebuildArtifacts.length > 0
-                    ? "rebuilt"
-                    : "fresh";
-        let appliedLaunch;
-        const launchGeneration = this.sessionRegistry.currentOccupantTenure(input.nodeId)?.generationUuid;
-        // 1. Mark pending
-        this.sessionRegistry.updateStartupStatus(input.sessionId, "pending");
-        const context = input.isRestore ? "restore" : "fresh_start";
-        let startupProof;
-        try {
-            startupProof = resolveStartupProof(input.startupActions, context);
-        }
-        catch (err) {
-            return this.fail(input, "failed", [`Startup proof selection: ${err.message}`]);
-        }
-        this.eventBus.emit({ type: "node.startup_pending", rigId: input.rigId, nodeId: input.nodeId, startupProof });
-        // 2. Project resources
-        let projectionResult;
-        try {
-            projectionResult = await input.adapter.project(input.plan, input.binding);
-            if (projectionResult.failed.length > 0) {
-                for (const f of projectionResult.failed) {
-                    errors.push(`Projection failed for ${f.effectiveId}: ${f.error}`);
-                }
-                return this.fail(input, "failed", errors);
-            }
-        }
-        catch (err) {
-            errors.push(`Projection error: ${err.message}`);
-            return this.fail(input, "failed", errors);
-        }
-        // 3. Partition startup files by concrete hint: pre-launch (filesystem) vs post-launch (TUI)
-        // Note: new file-building paths (NS-T05+) emit only concrete hints. The auto fallback
-        // is compatibility-only for pre-NS-T05 persisted startup contexts in node_startup_context.
-        //
-        // Rebuild-mode artifacts (when set) are merged in front of resolvedStartupFiles
-        // so the operator's trust-precedence ordering is preserved when the post-launch
-        // delivery loop walks the array. Rebuild artifacts are tagged
-        // appliesOn: ["fresh_start"] by the resolver, which matches the rebuild context.
-        const sourceFiles = input.rebuildArtifacts && input.rebuildArtifacts.length > 0
-            ? [...input.rebuildArtifacts, ...input.resolvedStartupFiles]
-            : input.resolvedStartupFiles;
-        const applicableFiles = sourceFiles.filter((f) => f.appliesOn.includes(context));
-        const preLaunchFiles = [];
-        let postLaunchFiles = [];
-        for (const f of applicableFiles) {
-            const hint = f.deliveryHint === "auto"
-                ? resolveConcreteHint(f.path, this.safeReadFile(f.absolutePath))
-                : f.deliveryHint;
-            if (hint === "send_text") {
-                postLaunchFiles.push(f);
-            }
-            else {
-                preLaunchFiles.push(f);
-            }
-        }
-        // 4. Deliver pre-launch files (filesystem: guidance_merge, skill_install)
-        // Always call even with empty list so adapters can provision runtime-specific config (e.g. context collectors)
-        try {
-            const deliveryResult = await input.adapter.deliverStartup(preLaunchFiles, input.binding);
-            if (deliveryResult.failed.length > 0) {
-                for (const f of deliveryResult.failed) {
-                    errors.push(`Pre-launch file delivery failed: ${f.path}: ${f.error}`);
-                }
-                return this.fail(input, "failed", errors);
-            }
-        }
-        catch (err) {
-            errors.push(`Pre-launch delivery error: ${err.message}`);
-            return this.fail(input, "failed", errors);
-        }
-        // 7. Persist startup context for restore replay
-        if (!input.preserveStartupContext)
-            try {
-                this.db.prepare("INSERT OR REPLACE INTO node_startup_context (node_id, projection_entries_json, resolved_files_json, startup_actions_json, runtime) VALUES (?, ?, ?, ?, ?)").run(input.nodeId, JSON.stringify(input.plan.entries.map((e) => ({ category: e.category, effectiveId: e.effectiveId, sourceSpec: e.sourceSpec, sourcePath: e.sourcePath, resourcePath: e.resourcePath, absolutePath: e.absolutePath, resourceType: e.resourceType, mergeStrategy: e.mergeStrategy, target: e.target }))), JSON.stringify(input.resolvedStartupFiles), JSON.stringify(input.startupActions), input.adapter.runtime);
-            }
-            catch (error) {
-                return this.fail(input, "failed", [`Startup context persistence failed: ${String(error)}`]);
-            }
-        // 5. Launch harness (unless skipped for legacy nodes)
-        if (!input.skipHarnessLaunch) {
-            try {
-                let launchResumeToken = input.resumeToken;
-                let attemptedFreshFallback = false;
-                while (true) {
-                    const launchResult = await input.adapter.launchHarness(input.binding, {
-                        name: input.sessionName ?? input.binding.tmuxSession ?? "",
-                        resumeToken: launchResumeToken,
-                        ...(input.forkSource && !launchResumeToken ? { forkSource: input.forkSource } : {}),
-                    });
-                    if (launchResult.ok) {
-                        appliedLaunch = launchResult.appliedLaunch;
-                        const normalizedResumeToken = launchResult.resumeToken?.trim();
-                        if (normalizedResumeToken) {
-                            try {
-                                this.sessionRegistry.updateResumeToken(input.sessionId, launchResult.resumeType ?? "", normalizedResumeToken, "scrape");
-                            }
-                            catch { /* best-effort */ }
-                        }
-                        break;
-                    }
-                    const shouldRetryFresh = !!launchResumeToken
-                        && input.allowFreshFallback !== false
-                        && launchResult.recovery === "retry_fresh"
-                        && !attemptedFreshFallback;
-                    if (shouldRetryFresh) {
-                        launchResumeToken = undefined;
-                        continuityOutcome = "fresh";
-                        attemptedFreshFallback = true;
-                        continue;
-                    }
-                    // Pod-aware Codex auth-refusal (probe → verifyResumeLaunch →
-                    // recovery: "attention_required"). Surface as attention_required
-                    // startup_status with evidence so restore-orchestrator's per-node
-                    // mapping at lines 867-877 can return RestoreNodeResult with
-                    // status: "attention_required" + attentionEvidence (mirroring the
-                    // legacy mapping at :725-735).
-                    if (launchResult.recovery === "attention_required") {
-                        // Preserve the attempted lineage for later no-input reconciliation,
-                        // but do not certify it: attention also covers runner exits/timeouts.
-                        // retry_fresh already cleared launchResumeToken; ordinary failures
-                        // skip this branch.
-                        const normalizedResumeToken = launchResumeToken?.trim();
-                        const normalizedResumeType = input.resumeType?.trim();
-                        if (normalizedResumeToken && normalizedResumeType) {
-                            try {
-                                this.sessionRegistry.recordResumeAttempt(input.sessionId, normalizedResumeType, normalizedResumeToken);
-                            }
-                            catch { /* best-effort */ }
-                        }
-                        errors.push(`Harness launch requires attention: ${launchResult.error}`);
-                        // isRestore selects context, not native continuity: pod-aware exact
-                        // resume also uses false. Only an actual fresh launch may re-prime.
-                        return this.fail(input, "attention_required", errors, launchResult.evidence, continuityOutcome === "fresh");
-                    }
-                    errors.push(`Harness launch failed: ${launchResult.error}`);
-                    return this.fail(input, "failed", errors);
-                }
-            }
-            catch (err) {
-                errors.push(`Harness launch error: ${err.message}`);
-                return this.fail(input, "failed", errors);
-            }
-        }
-        // A successful new lean launch replaces the occupant's proof boundary even
-        // if readiness later fails. Failed launches and resume/adopt retain history.
-        const isFreshLaunch = continuityOutcome === "fresh" && (!input.skipHarnessLaunch || input.continueFreshStartup === true);
-        const shouldChallenge = isFreshLaunch
-            && input.adapter.runtime !== "terminal" && startupProof.mode === "authenticated";
-        if (isFreshLaunch && !shouldChallenge) {
-            this.eventBus.emit({
-                type: "node.startup_proof_skipped", rigId: input.rigId, nodeId: input.nodeId,
-                reason: input.adapter.runtime === "terminal" ? "terminal" : "not_selected",
-            });
-        }
-        // 6. Wait for harness readiness (retry with exponential backoff, 30s timeout)
-        try {
-            const readiness = await this.waitForReady(input.adapter, input.binding, input.readinessTimeoutMs ?? 30_000);
-            if (!readiness.ready) {
-                if (isAttentionRequiredReadinessCode(readiness.code)) {
-                    errors.push(`Startup requires attention: ${readiness.reason ?? "unknown"}`);
-                    return this.fail(input, "attention_required", errors, undefined, isFreshLaunch);
-                }
-                errors.push(`Readiness timeout after 30s — harness did not become interactive: ${readiness.reason ?? "unknown"}`);
-                return this.fail(input, "failed", errors);
-            }
-        }
-        catch (err) {
-            errors.push(`Readiness check error: ${err.message}`);
-            return this.fail(input, "failed", errors);
-        }
-        // The adapter returned the exact enforcing value it inserted, and readiness
-        // proved this managed launch became live. Persistence is deliberately
-        // best-effort: observation failure yields UNKNOWN, never a failed launch.
-        if (appliedLaunch && launchGeneration) {
-            this.appliedLaunchStore.recordGeneration(launchGeneration, appliedLaunch);
-        }
-        // Issue selected proof only once the runtime can receive its prompt.
-        // Persist ground truth BEFORE delivering any proof prompt.
-        const identityAction = this.extractSessionIdentityAction(input.startupActions, context);
-        const challenge = shouldChallenge
-            ? issueStartupChallenge(this.eventBus, {
-                rigId: input.rigId,
-                nodeId: input.nodeId,
-                contractSource: JSON.stringify(input.resolvedStartupFiles),
-            })
-            : null;
-        // A selected proof still works without a session_identity action: deliver
-        // its standalone prompt after the post-launch contract files below.
-        const consumedActions = new Set();
-        let challengeOnlyPrompt = null;
-        if (continuityOutcome === "fresh" && identityAction) {
-            const initialPrompt = await this.deliverInitialSessionPrompt(input.binding, identityAction, postLaunchFiles, challenge?.promptBlock ?? null, input.includeDurableObligations);
-            if (!initialPrompt.ok) {
-                errors.push(initialPrompt.error);
-                return this.fail(input, "failed", errors);
-            }
-            postLaunchFiles = initialPrompt.remainingFiles;
-        }
-        else if (challenge) {
-            challengeOnlyPrompt = challenge.promptBlock;
-        }
-        // OPR.0.4.7.17 restore-order-correction (qitem-e99624f7). On a resumed
-        // restore the work-triggering guidance/role.md is delivered as a post-launch
-        // send_text file (step 7 below) and starts the seat's first turn at once. An
-        // after_ready send_text "BEFORE you do anything else, load skills" preload
-        // delivered later (step 9) therefore lands AFTER work has begun — the locked
-        // action-before-work contract fails. Fix CAUSALLY, not by widening the send
-        // delay: on restore, bundle the applicable after_ready send_text preload
-        // action(s) IN FRONT of the first send_text post-launch file and deliver them
-        // as the single leading turn — the restore analogue of the fresh
-        // deliverInitialSessionPrompt identity+role.md bundle. Sequencing (not
-        // timing) guarantees the preload precedes the role-triggered work turn; the
-        // bundled actions are marked consumed so step 9 does not re-send them.
-        if (continuityOutcome !== "fresh") {
-            const preloadActions = input.startupActions.filter((a) => !isSessionIdentityAction(a) &&
-                a.type === "send_text" &&
-                a.phase === "after_ready" &&
-                a.appliesOn.includes(context) &&
-                !(input.isRestore && !a.idempotent));
-            if (preloadActions.length > 0) {
-                const preload = await this.deliverRestorePreloadPrompt(input.binding, preloadActions, postLaunchFiles);
-                if (!preload.ok) {
-                    errors.push(preload.error);
-                    return this.fail(input, "failed", errors);
-                }
-                postLaunchFiles = preload.remainingFiles;
-                for (const a of preloadActions)
-                    consumedActions.add(a);
-            }
-        }
-        // 7. Deliver post-launch files (send_text → TUI, now that harness is ready)
-        if (postLaunchFiles.length > 0) {
-            try {
-                const deliveryResult = await input.adapter.deliverStartup(postLaunchFiles, input.binding);
-                if (deliveryResult.failed.length > 0) {
-                    for (const f of deliveryResult.failed) {
-                        errors.push(`Post-launch file delivery failed: ${f.path}: ${f.error}`);
-                    }
-                    return this.fail(input, "failed", errors);
-                }
-            }
-            catch (err) {
-                errors.push(`Post-launch delivery error: ${err.message}`);
-                return this.fail(input, "failed", errors);
-            }
-        }
-        // OPR.0.4.3.06 — deliver the synthesized challenge-only prompt after the
-        // contract files. Best-effort: a failed send leaves oriented `missing`
-        // (honest), it does NOT fail an otherwise-good startup.
-        if (challengeOnlyPrompt && input.binding.tmuxSession) {
-            await this.sendInteractiveText(input.binding.tmuxSession, challengeOnlyPrompt);
-        }
-        // 8. Execute after_files actions
-        const afterFilesResult = await this.executeActions(input, "after_files");
-        if (!afterFilesResult.ok) {
-            return this.fail(input, "failed", afterFilesResult.errors);
-        }
-        // 9. Execute after_ready actions (skipping any preload actions already
-        // delivered ahead of role.md by the restore-order bundling above).
-        const afterReadyResult = await this.executeActions(input, "after_ready", consumedActions);
-        if (!afterReadyResult.ok) {
-            return this.fail(input, "failed", afterReadyResult.errors);
-        }
-        // Delivering the first native prompt can reveal a provider refusal or
-        // interactive gate. A positive attention requirement is not ready.
-        if (postLaunchFiles.length > 0) {
-            try {
-                const readiness = await input.adapter.checkReady(input.binding);
-                if (!readiness.ready && isAttentionRequiredReadinessCode(readiness.code)) {
-                    return this.fail(input, "attention_required", [readiness.reason ?? "The native provider prerequisite failed after context delivery."]);
-                }
-            }
-            catch (error) {
-                return this.fail(input, "attention_required", [`Post-delivery runtime state is unavailable: ${error.message}`]);
-            }
-        }
-        // 8. Mark ready
-        this.sessionRegistry.updateStartupStatus(input.sessionId, "ready", new Date().toISOString());
-        this.eventBus.emit({ type: "node.startup_ready", rigId: input.rigId, nodeId: input.nodeId });
-        return { ok: true, startupStatus: "ready", continuityOutcome };
-    }
-    /** A failed attempt can continue only when it stopped before sending context.
-     * Any newer pending/ready/failure event consumes that permission, including a
-     * daemon loss during delivery: uncertain delivery is never blindly replayed.
-     */
-    canContinueFresh(nodeId, sessionId) {
-        const row = this.db.prepare("SELECT payload FROM events WHERE node_id = ? AND type IN ('node.startup_pending', 'node.startup_ready', 'node.startup_failed') ORDER BY seq DESC LIMIT 1").get(nodeId);
-        if (!row)
-            return false;
-        const event = JSON.parse(row.payload);
-        return event.type === "node.startup_failed" && event.sessionId === sessionId && event.freshContextPending === true;
-    }
-    /**
-     * Wait for harness readiness with exponential backoff.
-     * Backoff: 1s → 2s → 4s → 8s → 16s (capped), total timeout default 30s.
-     */
-    async waitForReady(adapter, binding, timeoutMs = 30_000) {
-        const startTime = Date.now();
-        let delay = 1000; // Start at 1s
-        const maxDelay = 16_000;
-        while (true) {
-            const result = await adapter.checkReady(binding);
-            if (result.ready)
-                return result;
-            if (isAttentionRequiredReadinessCode(result.code)) {
-                return result;
-            }
-            const elapsed = Date.now() - startTime;
-            if (elapsed + delay > timeoutMs) {
-                // One final check before timing out
-                const finalResult = await adapter.checkReady(binding);
-                if (finalResult.ready)
-                    return finalResult;
-                return { ready: false, reason: result.reason ?? "readiness timeout" };
-            }
-            await new Promise((resolve) => setTimeout(resolve, delay));
-            delay = Math.min(delay * 2, maxDelay);
-        }
-    }
-    safeReadFile(path) {
-        try {
-            return this.readFile(path);
-        }
-        catch {
-            return "";
-        }
-    }
-    fail(input, status, errors, evidence, freshContextPending = false) {
-        this.sessionRegistry.updateStartupStatus(input.sessionId, status);
-        this.eventBus.emit({
-            type: "node.startup_failed",
-            rigId: input.rigId,
-            nodeId: input.nodeId,
-            error: errors.join("; "),
-            sessionId: input.sessionId,
-            ...(freshContextPending ? { freshContextPending: true } : {}),
-        });
-        return { ok: false, startupStatus: status, errors, evidence };
-    }
-    async executeActions(input, phase, skip) {
-        const errors = [];
-        const context = input.isRestore ? "restore" : "fresh_start";
-        for (const action of input.startupActions) {
-            if (action.type === "startup_proof")
-                continue; // declaration, never terminal input
-            if (isSessionIdentityAction(action))
-                continue;
-            if (skip?.has(action))
-                continue;
-            // Phase filter
-            if (action.phase !== phase)
-                continue;
-            // appliesOn filter
-            if (!action.appliesOn.includes(context))
-                continue;
-            // Non-idempotent actions skipped on restore (retry-as-restore safety)
-            if (input.isRestore && !action.idempotent)
-                continue;
-            // Execute via tmux
-            try {
-                if (!input.binding.tmuxSession) {
-                    errors.push(`No tmux session for action: ${action.value}`);
-                    continue;
-                }
-                const sendError = await this.sendInteractiveText(input.binding.tmuxSession, action.value);
-                if (sendError) {
-                    errors.push(`Action failed (${action.type}): ${sendError}`);
-                }
-            }
-            catch (err) {
-                errors.push(`Action error (${action.type}): ${err.message}`);
-            }
-        }
-        return errors.length > 0 ? { ok: false, errors } : { ok: true };
-    }
-    extractSessionIdentityAction(actions, context) {
-        return actions.find((action) => isSessionIdentityAction(action) && action.appliesOn.includes(context)) ?? null;
-    }
-    async deliverInitialSessionPrompt(binding, identityAction, postLaunchFiles, challengeBlock, includeDurableObligations = false) {
-        if (!binding.tmuxSession) {
-            return { ok: false, error: "No tmux session for the initial session identity prompt" };
-        }
-        const firstSendTextIndex = postLaunchFiles.findIndex((file) => file.deliveryHint === "send_text");
-        let prompt = identityAction.value;
-        let remainingFiles = postLaunchFiles;
-        if (firstSendTextIndex !== -1) {
-            const firstSendText = postLaunchFiles[firstSendTextIndex];
-            try {
-                const content = this.readFile(firstSendText.absolutePath);
-                if (content.length > 0) {
-                    prompt = `${identityAction.value}\n\n${content}`;
-                    remainingFiles = postLaunchFiles.filter((_, index) => index !== firstSendTextIndex);
-                }
-            }
-            catch {
-                // Fall back to a standalone identity prompt and let the adapter handle
-                // the original startup file using its normal failure semantics.
-            }
-        }
-        if (includeDurableObligations)
-            prompt += `\n\nThis is a fresh conversation. Before choosing work, derive your identity with rig whoami --json and read durable obligations with rig queue list --destination ${binding.tmuxSession} --state pending,in-progress,blocked --limit 10000 --full --json. Report truncation at the limit; a destination row is not permission to claim unrelated work.`;
-        // OPR.0.4.3.06 — the per-launch orientation challenge rides along with the
-        // identity prompt (after the contract) so no extra send is added.
-        if (challengeBlock) {
-            prompt = `${prompt}\n\n${challengeBlock}`;
-        }
-        const sendError = await this.sendInteractiveText(binding.tmuxSession, prompt);
-        if (sendError) {
-            return { ok: false, error: `Initial session identity prompt failed: ${sendError}` };
-        }
-        return { ok: true, remainingFiles };
-    }
-    /**
-     * OPR.0.4.7.17 restore-order-correction. Deliver the after_ready send_text
-     * preload action(s) as the single leading turn on a resumed restore, bundling
-     * the first work-triggering send_text post-launch file (guidance/role.md)
-     * behind them so "load skills BEFORE anything else" causally precedes the role
-     * content in one submission. Returns the post-launch files still to deliver
-     * normally (role.md removed once bundled).
-     */
-    async deliverRestorePreloadPrompt(binding, preloadActions, postLaunchFiles) {
-        if (!binding.tmuxSession) {
-            return { ok: false, error: "No tmux session for the restore preload prompt" };
-        }
-        const parts = preloadActions.map((a) => a.value);
-        let remainingFiles = postLaunchFiles;
-        const firstSendTextIndex = postLaunchFiles.findIndex((file) => file.deliveryHint === "send_text");
-        if (firstSendTextIndex !== -1) {
-            const firstSendText = postLaunchFiles[firstSendTextIndex];
-            try {
-                const content = this.readFile(firstSendText.absolutePath);
-                if (content.length > 0) {
-                    parts.push(content);
-                    remainingFiles = postLaunchFiles.filter((_, index) => index !== firstSendTextIndex);
-                }
-            }
-            catch {
-                // Leave role.md in postLaunchFiles for normal delivery; the preload
-                // still leads as its own turn.
-            }
-        }
-        const sendError = await this.sendInteractiveText(binding.tmuxSession, parts.join("\n\n"));
-        if (sendError) {
-            return { ok: false, error: `Restore preload prompt failed: ${sendError}` };
-        }
-        return { ok: true, remainingFiles };
-    }
-    async sendInteractiveText(tmuxSession, text) {
-        const textResult = await this.tmuxAdapter.sendText(tmuxSession, text);
-        if (!textResult.ok) {
-            return textResult.message ?? "unknown";
-        }
-        await this.sleep(200);
-        const submitResult = await this.tmuxAdapter.sendKeys(tmuxSession, ["C-m"]);
-        if (!submitResult.ok) {
-            return submitResult.message ?? "unknown";
-        }
-        return null;
-    }
-}
-function isSessionIdentityAction(action) {
-    if (action.builtin === "session_identity")
-        return true;
-    return action.type === "send_text" && action.value.startsWith("OpenRig session identity:");
-}
-//# sourceMappingURL=startup-orchestrator.js.map