@orcha-ai/runtime-bridge 0.1.29 → 0.1.31

package/.env.example

@@ -9,6 +9,7 @@ ORCHA_RUNTIME_NODE_NAME=Workstation A
 ORCHA_RUNTIME_DEFAULT_TARGET=codex
 ORCHA_RUNTIME_RECONNECT_MS=3000
 ORCHA_RUNTIME_CONNECT_TIMEOUT_MS=10000
+ORCHA_RUNTIME_HEARTBEAT_INTERVAL_MS=15000
 ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS=3600000
 ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS=300000
 ORCHA_RUNTIME_SESSION_IDLE_TTL_MS=600000
@@ -22,4 +23,4 @@ ORCHA_RUNTIME_LOG_RETENTION_DAYS=3
 ORCHA_RUNTIME_LOG_CLEANUP_INTERVAL_MS=3600000
 
 # Target examples. Keep this JSON on one line.
-ORCHA_RUNTIME_TARGETS_JSON='{"codex":{"type":"cli","command":"codex","args":["exec","--json"],"promptMode":"stdin","outputMode":"json-lines","captureLastMessage":true},"openclaw":{"type":"openclaw","command":"openclaw","maxSessions":1,"releaseAfterPrompt":true,"sessionIdleTtlMs":60000},"claude":{"type":"cli","command":"claude","args":["-p","--output-format","json","--no-session-persistence"],"promptMode":"args","outputMode":"json-lines"}}'
+ORCHA_RUNTIME_TARGETS_JSON='{"codex":{"type":"cli","command":"/opt/orcha-runtime-tools/bin/codex","toolchainRoots":["/opt/orcha-runtime-tools"],"args":["exec","--json"],"workspace":"/workspaces/project-a","promptMode":"stdin","outputMode":"json-lines","captureLastMessage":true},"openclaw":{"type":"openclaw","command":"/opt/orcha-runtime-tools/bin/openclaw","toolchainRoots":["/opt/orcha-runtime-tools"],"workspace":"/workspaces/project-a","maxSessions":1,"releaseAfterPrompt":true,"sessionIdleTtlMs":60000},"claude":{"type":"cli","command":"/opt/orcha-runtime-tools/bin/claude","toolchainRoots":["/opt/orcha-runtime-tools"],"args":["-p","--output-format","json","--no-session-persistence"],"workspace":"/workspaces/project-a","promptMode":"args","outputMode":"json-lines"}}'

package/README.md

@@ -11,12 +11,29 @@ runtime permission requests, and process lifecycle are implemented under
 In production the Runtime Node actively connects to Orcha over WebSocket. The
 computer running Codex/OpenClaw/Claude does not need to expose an inbound port.
 
+Runtime Node mode is fail-closed: before registering targets as available it
+runs the bundled Linux Bubblewrap broker probe. Every prompt/dispatch is bound
+to a control-plane `runId` and frozen sandbox policy, and the actual Runtime
+process is started by the broker inside an empty-root namespace. Missing
+Bubblewrap, `prlimit`, Egress Proxy, trusted workspace, or a failed escape probe
+keeps the node visible for diagnostics but unavailable for dispatch. It never
+falls back to spawning Codex/OpenClaw/Claude directly on the host.
+
+The broker does not mount `/usr/local` or other operator directories by
+default. Install runtime CLIs under a dedicated immutable directory, list it in
+`ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS`, and repeat it in each target's
+`toolchainRoots`. This keeps the executable surface explicit and avoids
+exposing unrelated host installations or credentials.
+
 ## Install
 
 ```bash
 npm install -g @orcha-ai/runtime-bridge
 ```
 
+Production Runtime Nodes require Node.js 22.19 or newer and Linux with
+Bubblewrap, `prlimit`, `ip`, and `socat` installed.
+
 Run it with:
 
 ```bash
@@ -113,19 +130,40 @@ and receives Orcha RPC frames for:
 - `agents/create`
 - `agents/dispatch`
 - `sessions/prompt`
+- `sessions/policy`
 - `sessions/cancel`
 - `permissions/respond`
 
 Runtime targets are configured with `ORCHA_RUNTIME_TARGETS_JSON`.
 
+Start the bundled Egress Proxy as a separate supervised process before the
+Runtime Bridge. In production use separate protected environment files: the
+proxy file contains only its socket, token, and limits; the bridge file contains
+the Node identity plus the matching proxy socket/token. The proxy accepts
+`ORCHA_RUNTIME_EGRESS_PROXY_SOCKET` and `ORCHA_RUNTIME_EGRESS_PROXY_TOKEN`, and
+listens only on that Unix Socket.
+
+```bash
+orcha-runtime-egress-proxy --env-file /etc/orcha/runtime-egress.env
+orcha-runtime-bridge start --env-file /etc/orcha/runtime-node.env
+```
+
+The proxy must run under its own OS account in production. The bridge uses its
+admin token only to create and revoke short-lived Run-bound grants; sandboxed
+commands receive only the individual grant credential. A node whose proxy or
+escape probe is unavailable remains registered for diagnostics but cannot
+receive work.
+
 ```json
 {
   "codex": {
     "type": "cli",
-    "command": "codex",
+    "command": "/opt/orcha-runtime-tools/bin/codex",
+    "toolchainRoots": ["/opt/orcha-runtime-tools"],
     "args": ["exec", "--json"],
     "promptMode": "stdin",
-    "outputMode": "json-lines"
+    "outputMode": "json-lines",
+    "workspace": "/workspaces/project-a"
   },
   "openclaw": {
     "type": "openclaw",
@@ -144,6 +182,11 @@ Runtime targets are configured with `ORCHA_RUNTIME_TARGETS_JSON`.
 }
 ```
 
+External Runtime Nodes call the agents configured by the node operator directly.
+They do not require a Bridge-managed process sandbox and remain dispatchable on
+Linux, macOS, and Windows. Keep target commands, workspaces, credentials, and OS
+permissions under the operator's control.
+
 If a request references a missing target, the bridge returns
 `RUNTIME_TARGET_NOT_FOUND`. The built-in `echo` adapter is available only when
 you explicitly configure a target with `"type": "echo"`.

package/bin/orcha-runtime-bridge.js

@@ -1,24 +1,24 @@
 #!/usr/bin/env node
-import{spawn as Ai}from"node:child_process";import{closeSync as Ni,existsSync as kn,mkdirSync as Mi,openSync as Ui,readFileSync as ce,rmSync as bi,statSync as Cn,writeFileSync as Ln}from"node:fs";import{dirname as ki,resolve as de}from"node:path";import{fileURLToPath as Li}from"node:url";import{createHash as Ns,randomUUID as Rt}from"node:crypto";var z="0.1.29";function Q(){return new Date().toISOString()}function x(e,t=2){return String(e).padStart(t,"0")}function ye(e){let t=e>=0?"+":"-",n=Math.abs(e);return`${t}${x(Math.floor(n/60))}:${x(n%60)}`}function Bn(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${x(e.getMonth()+1)}-${x(e.getDate())}`,`T${x(e.getHours())}:${x(e.getMinutes())}:${x(e.getSeconds())}.${x(e.getMilliseconds(),3)}`,ye(t)].join("")}function Kn(e,t){let n=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),r={};for(let s of n.formatToParts(e))s.type!=="literal"&&(r[s.type]=Number(s.value));return r}function qn(e,t){let n=Kn(e,t),r=Date.UTC(n.year,n.month-1,n.day,n.hour,n.minute,n.second,e.getMilliseconds()),s=Math.round((r-e.getTime())/6e4);return[`${n.year}-${x(n.month)}-${x(n.day)}`,`T${x(n.hour)}:${x(n.minute)}:${x(n.second)}.${x(e.getMilliseconds(),3)}`,ye(s)].join("")}function Gn(e=new Date){let t=a(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return qn(e,t)}catch{return Bn(e)}}function c(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function a(e){return String(e??"").trim()}function S(e,t){let n=Number.parseInt(String(e??""),10);return Number.isFinite(n)?n:t}function N(e){return Array.isArray(e)?e.map(String):[]}var zn="[redacted]",Te=/(authorization|api[_-]?key|credential|password|secret|token)/i;function v(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=v(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>v(i,t));return t.delete(e),s}let n={},r=Te.test(a(e.name||e.key));for(let[s,i]of Object.entries(e))n[s]=Te.test(s)||r&&s.toLowerCase()==="value"?zn:v(i,t);return t.delete(e),n}function Se(e,t=4e3){let n=JSON.stringify(v(e))??String(e);return!Number.isFinite(t)||n.length<=t?n:`${n.slice(0,t)}...`}function m(e,t,n,r={}){let s={ts:Gn(),level:e,module:t,msg:n,...c(r)?v(r):{}};console.error(JSON.stringify(s))}function ot(e){return Array.isArray(e)?e.map(t=>c(t)?t.type==="text"?a(t.text):t.type==="file"?a(t.uri):t.type==="image"?a(t.uri):"":"").filter(Boolean).join(`
-`):""}var at=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,n){let r=ot(t.prompt);return n({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:r?`Echo runtime received: ${r}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as Jn}from"node:child_process";var tt="2.0",Wn=3e4;function Vn(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,message:a(e?.message)||String(e),data:c(e?.data)?e.data:void 0}}function Xn(e){if(!c(e))return new Error(String(e||"runtime error"));let t=a(e.message)||"runtime error",n="data"in e?Se(e.data,4e3):"",r=new Error(n?`${t}; data=${n}`:t);return r.rpcCode=e.code,r.data=e.data,r}function Yn(e){return c(e)&&"id"in e&&!("method"in e)}function Zn(e){return c(e)&&typeof e.method=="string"&&"id"in e}function Qn(e){return c(e)&&typeof e.method=="string"&&!("id"in e)}var ct=class{constructor({command:t,args:n=[],cwd:r,env:s,label:i,framing:o="line",detached:u=!0}){this.command=t,this.args=Array.isArray(n)?n.map(String):[],this.cwd=r||process.cwd(),this.env={...process.env,...c(s)?s:{}},this.label=i||t,this.framing=o==="content-length"?"content-length":"line",this.detached=u!==!1,this.child=null,this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stopPromise=null,this.lineBuffer="",this.headerBuffer=Buffer.alloc(0),this.seq=0,this.pending=new Map,this.notificationHandlers=new Map,this.requestHandlers=new Map,this.exitHandlers=new Set}async start({initialize:t=!0,initializeParams:n={}}={}){this.child&&!this.exited||(this.exited=!1,this.exitCode=null,this.exitSignal=null,this.child=Jn(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"],detached:this.detached}),this.child.stdout.on("data",r=>this.onStdout(r)),this.child.stderr.setEncoding("utf8"),this.child.stderr.on("data",r=>{let s=r.trimEnd();s&&m("debug","runtime.stderr","runtime stderr",{target:this.label,text:s})}),this.child.on("exit",(r,s)=>this.handleExit(r,s)),this.child.on("error",r=>this.rejectAll(r)),t&&await this.call("initialize",{protocolVersion:1,clientCapabilities:{},...n}).catch(r=>{throw Object.assign(new Error(`runtime initialize failed: ${r.message}`),{code:"RUNTIME_INITIALIZE_FAILED"})}))}onStdout(t){if(this.framing==="content-length"){this.onContentLengthData(Buffer.isBuffer(t)?t:Buffer.from(t));return}this.onLineData(t.toString("utf8"))}onLineData(t){this.lineBuffer+=t;let n=this.lineBuffer.split(/\r?\n/);this.lineBuffer=n.pop()||"";for(let r of n){let s=r.trim();s&&this.dispatchRaw(s)}}onContentLengthData(t){for(this.headerBuffer=Buffer.concat([this.headerBuffer,t]);this.headerBuffer.length>0;){let n=this.headerBuffer.indexOf(`\r
+import{spawn as Co}from"node:child_process";import{closeSync as No,existsSync as fn,mkdirSync as bo,openSync as Mo,readFileSync as ke,rmSync as Uo,statSync as sn,writeFileSync as pn}from"node:fs";import{dirname as Po,resolve as ve}from"node:path";import{fileURLToPath as ko}from"node:url";import{createHash as Ci,randomUUID as kt}from"node:crypto";var Y="0.1.31";function ot(){return new Date().toISOString()}function M(e,t=2){return String(e).padStart(t,"0")}function Ke(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${M(Math.floor(r/60))}:${M(r%60)}`}function Rn(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${M(e.getMonth()+1)}-${M(e.getDate())}`,`T${M(e.getHours())}:${M(e.getMinutes())}:${M(e.getSeconds())}.${M(e.getMilliseconds(),3)}`,Ke(t)].join("")}function Sn(e,t){let r=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),n={};for(let s of r.formatToParts(e))s.type!=="literal"&&(n[s.type]=Number(s.value));return n}function En(e,t){let r=Sn(e,t),n=Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second,e.getMilliseconds()),s=Math.round((n-e.getTime())/6e4);return[`${r.year}-${M(r.month)}-${M(r.day)}`,`T${M(r.hour)}:${M(r.minute)}:${M(r.second)}.${M(e.getMilliseconds(),3)}`,Ke(s)].join("")}function wn(e=new Date){let t=a(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return En(e,t)}catch{return Rn(e)}}function u(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function a(e){return String(e??"").trim()}function T(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)?r:t}function C(e){return Array.isArray(e)?e.map(String):[]}var In="[redacted]",Ge=/(authorization|api[_-]?key|credential|password|secret|token)/i;function G(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=G(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>G(i,t));return t.delete(e),s}let r={},n=Ge.test(a(e.name||e.key));for(let[s,i]of Object.entries(e))r[s]=Ge.test(s)||n&&s.toLowerCase()==="value"?In:G(i,t);return t.delete(e),r}function Ve(e,t=4e3){let r=JSON.stringify(G(e))??String(e);return!Number.isFinite(t)||r.length<=t?r:`${r.slice(0,t)}...`}function h(e,t,r,n={}){let s={ts:wn(),level:e,module:t,msg:r,...u(n)?G(n):{}};console.error(JSON.stringify(s))}function Tt(e){return Array.isArray(e)?e.map(t=>u(t)?t.type==="text"?a(t.text):t.type==="file"?a(t.uri):t.type==="image"?a(t.uri):"":"").filter(Boolean).join(`
+`):""}var yt=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,r){let n=Tt(t.prompt);return r({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as On}from"node:child_process";var at="2.0",xn=3e4;function An(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,message:a(e?.message)||String(e),data:u(e?.data)?e.data:void 0}}function Cn(e){if(!u(e))return new Error(String(e||"runtime error"));let t=a(e.message)||"runtime error",r="data"in e?Ve(e.data,4e3):"",n=new Error(r?`${t}; data=${r}`:t);return n.rpcCode=e.code,n.data=e.data,n}function Nn(e){return u(e)&&"id"in e&&!("method"in e)}function bn(e){return u(e)&&typeof e.method=="string"&&"id"in e}function Mn(e){return u(e)&&typeof e.method=="string"&&!("id"in e)}var Rt=class{constructor({command:t,args:r=[],cwd:n,env:s,label:i,framing:o="line",detached:c=!0}){this.command=t,this.args=Array.isArray(r)?r.map(String):[],this.cwd=n||process.cwd(),this.env=u(s)?{...s}:{...process.env},this.label=i||t,this.framing=o==="content-length"?"content-length":"line",this.detached=c!==!1,this.child=null,this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stopPromise=null,this.lineBuffer="",this.headerBuffer=Buffer.alloc(0),this.seq=0,this.pending=new Map,this.notificationHandlers=new Map,this.requestHandlers=new Map,this.exitHandlers=new Set}async start({initialize:t=!0,initializeParams:r={}}={}){this.child&&!this.exited||(this.exited=!1,this.exitCode=null,this.exitSignal=null,this.child=On(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"],detached:this.detached}),this.child.stdout.on("data",n=>this.onStdout(n)),this.child.stderr.setEncoding("utf8"),this.child.stderr.on("data",n=>{let s=n.trimEnd();s&&h("debug","runtime.stderr","runtime stderr",{target:this.label,text:s})}),this.child.on("exit",(n,s)=>this.handleExit(n,s)),this.child.on("error",n=>this.rejectAll(n)),t&&await this.call("initialize",{protocolVersion:1,clientCapabilities:{},...r}).catch(n=>{throw Object.assign(new Error(`runtime initialize failed: ${n.message}`),{code:"RUNTIME_INITIALIZE_FAILED"})}))}onStdout(t){if(this.framing==="content-length"){this.onContentLengthData(Buffer.isBuffer(t)?t:Buffer.from(t));return}this.onLineData(t.toString("utf8"))}onLineData(t){this.lineBuffer+=t;let r=this.lineBuffer.split(/\r?\n/);this.lineBuffer=r.pop()||"";for(let n of r){let s=n.trim();s&&this.dispatchRaw(s)}}onContentLengthData(t){for(this.headerBuffer=Buffer.concat([this.headerBuffer,t]);this.headerBuffer.length>0;){let r=this.headerBuffer.indexOf(`\r
 \r
-`);if(n<0)return;let s=this.headerBuffer.subarray(0,n).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){m("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.alloc(0);return}let i=Number.parseInt(s[1],10),o=n+4,u=o+i;if(this.headerBuffer.length<u)return;let l=this.headerBuffer.subarray(o,u).toString("utf8");this.headerBuffer=this.headerBuffer.subarray(u),this.dispatchRaw(l)}}dispatchRaw(t){let n;try{n=JSON.parse(t)}catch(r){m("warn","runtime.protocol","invalid JSON frame",{target:this.label,error:String(r)});return}this.dispatch(n)}dispatch(t){if(Yn(t)){this.resolveResponse(t);return}if(Zn(t)){this.handleRequest(t);return}Qn(t)&&this.handleNotification(t)}resolveResponse(t){let n=String(t.id),r=this.pending.get(n);r&&(clearTimeout(r.timer),this.pending.delete(n),t.error?(m("warn","runtime.protocol","runtime rpc error",{target:this.label,method:r.method,requestId:n,error:t.error}),r.reject(Xn(t.error))):r.resolve(t.result))}async handleRequest(t){let n=this.requestHandlers.get(t.method);if(!n){this.writeFrame({jsonrpc:tt,id:t.id,error:{code:-32601,message:`method not found: ${t.method}`}});return}try{let r=await n(c(t.params)?t.params:{},t);this.writeFrame({jsonrpc:tt,id:t.id,result:r??{}})}catch(r){this.writeFrame({jsonrpc:tt,id:t.id,error:Vn(r)})}}handleNotification(t){let n=this.notificationHandlers.get(t.method);if(n)for(let r of n)r(c(t.params)?t.params:{},t)}call(t,n={},r=Wn){if(!this.child||!this.child.stdin||this.exited)return Promise.reject(new Error("runtime process is not running"));let s=`${t}_${++this.seq}`,i={jsonrpc:tt,id:s,method:t,params:n};return new Promise((o,u)=>{let l=setTimeout(()=>{this.pending.delete(s),u(new Error(`${t} timed out after ${r}ms`))},r);this.pending.set(s,{resolve:o,reject:u,timer:l,method:t}),this.writeFrame(i,d=>{d&&(clearTimeout(l),this.pending.delete(s),u(d))})})}notify(t,n={}){this.writeFrame({jsonrpc:tt,method:t,params:n})}writeFrame(t,n){if(!this.child?.stdin||this.exited){n?.(new Error("runtime process is not running"));return}let r=JSON.stringify(t),s=this.framing==="content-length"?`Content-Length: ${Buffer.byteLength(r,"utf8")}\r
+`);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){h("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.alloc(0);return}let i=Number.parseInt(s[1],10),o=r+4,c=o+i;if(this.headerBuffer.length<c)return;let l=this.headerBuffer.subarray(o,c).toString("utf8");this.headerBuffer=this.headerBuffer.subarray(c),this.dispatchRaw(l)}}dispatchRaw(t){let r;try{r=JSON.parse(t)}catch(n){h("warn","runtime.protocol","invalid JSON frame",{target:this.label,error:String(n)});return}this.dispatch(r)}dispatch(t){if(Nn(t)){this.resolveResponse(t);return}if(bn(t)){this.handleRequest(t);return}Mn(t)&&this.handleNotification(t)}resolveResponse(t){let r=String(t.id),n=this.pending.get(r);n&&(clearTimeout(n.timer),this.pending.delete(r),t.error?(h("warn","runtime.protocol","runtime rpc error",{target:this.label,method:n.method,requestId:r,error:t.error}),n.reject(Cn(t.error))):n.resolve(t.result))}async handleRequest(t){let r=this.requestHandlers.get(t.method);if(!r){this.writeFrame({jsonrpc:at,id:t.id,error:{code:-32601,message:`method not found: ${t.method}`}});return}try{let n=await r(u(t.params)?t.params:{},t);this.writeFrame({jsonrpc:at,id:t.id,result:n??{}})}catch(n){this.writeFrame({jsonrpc:at,id:t.id,error:An(n)})}}handleNotification(t){let r=this.notificationHandlers.get(t.method);if(r)for(let n of r)n(u(t.params)?t.params:{},t)}call(t,r={},n=xn){if(!this.child||!this.child.stdin||this.exited)return Promise.reject(new Error("runtime process is not running"));let s=`${t}_${++this.seq}`,i={jsonrpc:at,id:s,method:t,params:r};return new Promise((o,c)=>{let l=setTimeout(()=>{this.pending.delete(s),c(new Error(`${t} timed out after ${n}ms`))},n);this.pending.set(s,{resolve:o,reject:c,timer:l,method:t}),this.writeFrame(i,d=>{d&&(clearTimeout(l),this.pending.delete(s),c(d))})})}notify(t,r={}){this.writeFrame({jsonrpc:at,method:t,params:r})}writeFrame(t,r){if(!this.child?.stdin||this.exited){r?.(new Error("runtime process is not running"));return}let n=JSON.stringify(t),s=this.framing==="content-length"?`Content-Length: ${Buffer.byteLength(n,"utf8")}\r
 \r
-${r}`:`${r}
-`;this.child.stdin.write(s,n)}onNotification(t,n){let r=this.notificationHandlers.get(t)||new Set;return r.add(n),this.notificationHandlers.set(t,r),()=>{r.delete(n),r.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,n){return this.requestHandlers.set(t,n),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let n of this.pending.values())clearTimeout(n.timer),n.reject(t);this.pending.clear()}handleExit(t,n){this.exited=!0,this.exitCode=t,this.exitSignal=n,this.rejectAll(new Error(`runtime exited before response (${t}/${n})`));for(let r of this.exitHandlers)r(t,n)}async waitForExit(t=5e3){return!this.child||this.exited?!0:await new Promise(n=>{let r=setTimeout(()=>{s(),n(!1)},t);r.unref?.();let s=()=>{clearTimeout(r),this.exitHandlers.delete(i)},i=()=>{s(),n(!0)};this.exitHandlers.add(i),this.exited&&i()})}signal(t){if(!this.child||this.exited)return!1;let n=this.child.pid;if(!n)return!1;try{return this.detached&&process.platform!=="win32"?process.kill(-n,t):this.child.kill(t),!0}catch(r){if(r?.code==="ESRCH")return this.exited=!0,!1;try{return this.child.kill(t),!0}catch(s){return s?.code!=="ESRCH"&&m("warn","runtime","runtime signal failed",{target:this.label,pid:n,signal:t,error:String(s)}),!1}}}async stop(t="stop",{termTimeoutMs:n=5e3,killTimeoutMs:r=2e3}={}){if(!(!this.child||this.exited)){if(this.stopPromise)return await this.stopPromise;this.stopPromise=(async()=>{if(!this.child||this.exited)return;let s=this.child.pid;m("info","runtime","stopping runtime",{target:this.label,reason:t,pid:s}),this.rejectAll(new Error(`runtime stopped: ${t}`)),this.signal("SIGTERM"),!await this.waitForExit(n)&&this.child&&!this.exited&&(m("warn","runtime","runtime did not exit after SIGTERM; force killing",{target:this.label,reason:t,pid:s}),this.signal("SIGKILL"),await this.waitForExit(r))})();try{await this.stopPromise}finally{this.stopPromise=null}}}};import{randomUUID as Ee}from"node:crypto";import{existsSync as tr,readFileSync as er,realpathSync as we,statSync as nr}from"node:fs";import{basename as Oe,extname as Ie,isAbsolute as rr,relative as sr}from"node:path";var ir=25*1024*1024;function Ce(e,t=""){let n=a(t);if(n)return n;let r=Ie(a(e)).toLowerCase();return r===".jpg"||r===".jpeg"?"image/jpeg":r===".webp"?"image/webp":r===".gif"?"image/gif":"image/png"}function xe(e,t){let n=typeof e=="string"?e.trim():"";return!n||n==="<omitted>"?"":n.startsWith("data:")?n:`data:${t};base64,${n.replace(/\s+/g,"")}`}function ut(e){if(Array.isArray(e))return e.map(a).filter(Boolean);let t=a(e);return t?[t]:[]}function or(e,t){let n=sr(t,e);return n===""||!!n&&!n.startsWith("..")&&!rr(n)}function ar(e,t){let n=a(e);if(!n||!tr(n))return"";try{let r=we(n);for(let s of t)try{let i=we(s);if(or(r,i))return r}catch{}}catch{return""}return""}function Ut(e,t,n={}){let r=a(e);return!r||r.startsWith("data:")||/^https?:\/\//i.test(r)?r:cr(r,t,n)}function cr(e,t,n={}){let r=[...ut(n.trustedFileRoots),...ut(n.trustedFileRoot),...ut(n.artifactRoots),...ut(n.artifactRoot)],s=ar(e,r);if(!s)return"";try{let i=nr(s);return!i.isFile()||i.size<=0||i.size>ir?"":`data:${t};base64,${er(s).toString("base64")}`}catch{return""}}function O(...e){for(let t of e){let n=a(t);if(n)return n}return""}function ur(e,t,n,r){let s=n.toLowerCase();if(s==="image"||s==="picture")return!0;let i=O(r,e.previewUrl,e.fileUrl,e.imageUrl,e.dataUrl,e.url,e.uri,t.previewUrl,t.fileUrl,t.imageUrl,t.dataUrl,t.url,t.uri),o=Ie(i.split("?",1)[0].split("#",1)[0]).toLowerCase();return[".png",".jpg",".jpeg",".webp",".gif"].includes(o)}function kt(e,t={}){let{source:n="runtime_image_generation_event"}=t;if(!c(e))return null;let r=c(e.payload)?e.payload:{},s=a(e.type),i=a(r.type);if(!(s==="event_msg"&&i==="image_generation_end"||s==="response_item"&&i==="image_generation_call"))return null;let o=O(r.call_id,r.id),u=O(r.saved_path,r.savedPath),l=O(r.revised_prompt,r.revisedPrompt),d=Ce(u,r.mimeType||r.mime_type),f=xe(r.result,d)||Ut(u,d,t);if(!f)return null;let p=f.startsWith("data:")?f:"",h=u?Oe(u):`${o||Ee()}.png`;return{artifactType:"image",type:"image",fieldKey:"image",title:h||"Generated image",summary:l||"Generated image",content:{prompt:l||void 0,dataUrl:p||void 0,imageUrl:f,previewUrl:f,fileUrl:f,mimeType:d},dataUrl:p||void 0,previewUrl:f,fileUrl:f,metadata:{source:n,eventType:i,callId:o||void 0,savedPath:u||void 0,filename:h,mimeType:d,revisedPrompt:l||void 0}}}function lr(e){let t=c(e)?e:{},n=[];for(let r of["_artifacts","artifacts"]){let s=t[r];Array.isArray(s)&&n.push(...s)}for(let r of["_artifact","artifact"]){let s=t[r];c(s)&&n.push(s)}return n}function dr(e,t={}){let{source:n="runtime_artifact"}=t,r=c(e)?e:{};if(!Object.keys(r).length)return null;let s=c(r.content)?{...r.content}:{},i=c(r.metadata)?{...r.metadata}:{},o=O(r.saved_path,r.savedPath,s.saved_path,s.savedPath,i.savedPath),u=O(r.mimeType,r.mime_type,s.mimeType,s.mime_type,i.mimeType),l=O(r.artifactType,r.artifact_type,r.type,r.kind,s.type,o?"image":"file"),d=ur(r,s,l,o),f=d?Ce(o,u):u;if(d){let _=O(r.dataUrl,s.dataUrl),T=_.startsWith("data:")?_:"",w=O(r.imageUrl,r.previewUrl,r.fileUrl,r.downloadUrl,r.url,r.uri,s.imageUrl,s.previewUrl,s.fileUrl,s.downloadUrl,s.url,s.uri),E=xe(r.result??s.result,f)||T||Ut(o,f,t)||Ut(w,f,t);E&&(E.startsWith("data:")&&(s.dataUrl||=E),s.imageUrl||=E,s.previewUrl||=E,s.fileUrl||=E,f&&(s.mimeType||=f))}for(let[_,T]of[["prompt","prompt"],["previewUrl","previewUrl"],["fileUrl","fileUrl"],["downloadUrl","downloadUrl"],["imageUrl","imageUrl"],["dataUrl","dataUrl"],["url","url"],["uri","uri"],["mimeType","mimeType"],["mime_type","mimeType"]]){let w=r[_];w!=null&&w!==""&&!(T in s)&&(s[T]=w)}let p=O(r.fileUrl,r.downloadUrl,r.imageUrl,r.dataUrl,r.url,r.uri,s.fileUrl,s.downloadUrl,s.imageUrl,s.dataUrl,s.url,s.uri),h=O(r.previewUrl,r.imageUrl,r.dataUrl,r.url,r.fileUrl,r.uri,s.previewUrl,s.imageUrl,s.dataUrl,s.url,s.fileUrl,s.uri),g=O(r.dataUrl,s.dataUrl,p.startsWith("data:")?p:"",h.startsWith("data:")?h:""),I=O(r.filename,i.filename,o?Oe(o):""),q=O(r.fieldKey,r.field_key,s.fieldKey,i.fieldKey,d?"image":"artifact");return{...r,artifactType:l,type:r.type||l,fieldKey:q,title:O(r.title,I,"Runtime artifact"),summary:O(r.summary,s.prompt,r.title,I,"Runtime artifact"),content:s,dataUrl:g||void 0,fileUrl:p||void 0,previewUrl:h||void 0,metadata:{...i,source:O(i.source,n),savedPath:o||i.savedPath,filename:I||i.filename,mimeType:f||i.mimeType}}}function lt(e,t){if(!t||!e)return;let n=c(t.metadata)?t.metadata:{},r=O(n.savedPath,n.callId,t.previewUrl,t.fileUrl)||Ee(),s=e.get(r);if(!s){e.set(r,t);return}s.content={...c(s.content)?s.content:{},...c(t.content)?t.content:{}},s.metadata={...c(s.metadata)?s.metadata:{},...n},s.previewUrl=t.previewUrl||s.previewUrl,s.fileUrl=t.fileUrl||s.fileUrl,s.summary=t.summary||s.summary,s.title=t.title||s.title}function bt(e,t,n={}){for(let r of lr(e))lt(t,dr(r,n))}function Lt(e){if(!c(e)||!c(e.payload))return c(e)?e:{value:e};let t=a(e.payload.type);if(t!=="image_generation_end"&&t!=="image_generation_call")return e;let n={...e.payload};return typeof n.result=="string"&&n.result&&(n.result="<omitted>",n.resultLength=e.payload.result.length),{...e,payload:n}}function Re(e,t,n){if(!c(e))return e;let r=c(e.event)?e.event:null;return r?(lt(t,kt(r,n)),{...e,event:Lt(r)}):e}function Ae(e,t,n={}){if(!c(e))return e;bt(e,t,n);let r=Re(e,t,n),s=c(r.update)?Re(r.update,t,n):null;return s&&s!==r.update&&(r={...r,update:s}),r}function Ne(e,t,n={}){let r=c(e)?{...e}:{};bt(r,t,n),bt(c(r.output)?r.output:{},t,n);let s=[...t?.values?.()||[]];return s.length&&(r._artifacts=s),delete r.artifacts,r}var J=class{constructor(t,n,r={},s={}){this.agent=t,this.target=n,this.callbacks=r,this.options=s,this.proc=null,this.permissionHandlers=new Map}async ensureStarted(){if(this.proc)return;let t=a(this.target.command);if(!t)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);this.proc=new ct({command:t,args:N(this.target.args),cwd:a(this.target.cwd)||this.agent.workspace||process.cwd(),env:c(this.target.env)?this.target.env:{},label:`${this.agent.agentId}:${this.agent.targetCode}`,framing:a(this.target.framing||"line")}),this.proc.onRequest("session/request_permission",n=>this.handlePermissionRequest(n)),this.proc.onRequest("session/requestPermission",n=>this.handlePermissionRequest(n)),await this.proc.start({initialize:this.target.initialize!==!1,initializeParams:{clientInfo:{name:"orcha-runtime-bridge",version:z},...c(this.target.initializeParams)?this.target.initializeParams:{}}})}async sessionNew(t={}){return await this.ensureStarted(),this.proc.call("session/new",this.sessionNewParams(t))}sessionNewParams(t={}){let n=Array.isArray(t.mcpServers)?t.mcpServers:Array.isArray(this.target.mcpServers)?this.target.mcpServers:[];return{...t,mcpServers:n}}async sessionPrompt(t,n){await this.ensureStarted();let r=a(t.sessionId),s=new Map,i=this.artifactOptions(),o=this.proc.onNotification("session/update",l=>{let d=a(l.sessionId);(!d||d===r)&&n(Ae(l,s,i))}),u=async l=>this.callbacks.onPermissionRequest?.({agent:this.agent,runtimeSessionId:r,request:l,emitUpdate:n})||{outcome:"denied",reason:"permission handler is not configured"};r&&this.permissionHandlers.set(r,u),this.permissionHandlers.set("*",u);try{let l=await this.proc.call("session/prompt",t,this.options.sessionPromptTimeoutMs);return Ne(l,s,i)}finally{o(),r&&this.permissionHandlers.delete(r),this.permissionHandlers.delete("*")}}async sessionCancel(t){return await this.ensureStarted(),this.proc.call("session/cancel",t,5e3).catch(()=>({ok:!0}))}async handlePermissionRequest(t){let n=a(t.sessionId),r=this.permissionHandlers.get(n)||this.permissionHandlers.get("*");return r?r(t):{outcome:"denied",reason:"no active Orcha permission handler"}}artifactSource(){return a(this.target.type||"acp")==="openclaw"?"openclaw_image_generation":"acp_runtime_image_generation"}artifactOptions(){let t=c(this.target.env)?this.target.env:{};return{source:this.artifactSource(),trustedFileRoots:[a(this.target.artifactRoot),a(this.target.artifactDir),a(this.target.runtimeArtifactRoot),a(t.ORCHA_RUNTIME_ARTIFACT_DIR),...N(this.target.trustedArtifactRoots),...N(this.target.trustedFileRoots),...N(this.target.artifactRoots),...N(this.target.artifactFileRoots)].filter(Boolean)}}async stop(t){await this.proc?.stop(t)}};function fr(e){let t=c(e.metadata)?e.metadata:{};return a(t.agentCode)}function mr(e,t){let n=fr(e);return n?`agent:${n}:${t}`:`orcha-${t}`}var dt=class extends J{constructor(t,n,r,s={},i={}){let o=a(r).replace(/[^A-Za-z0-9._-]+/g,"-")||"default",u=a(n.command)||"openclaw",l=Array.isArray(n.args)?n.args.map(String):[],d=l.length>0?l:["acp","--session",mr(t,o)];super(t,{...n,command:u,args:d},s,i)}sessionNewParams(t={}){return{...t,mcpServers:[]}}};import{spawn as Pe}from"node:child_process";import{randomUUID as et}from"node:crypto";import{existsSync as De,mkdirSync as pr,readdirSync as Fe,readFileSync as $e,realpathSync as pt,rmSync as hr,rmdirSync as gr,statSync as _r,unlinkSync as Tr}from"node:fs";import{homedir as yr,tmpdir as He}from"node:os";import{basename as Ht,dirname as Sr,join as k,resolve as Me}from"node:path";var wr=36e5,ve=5e3,Rr=2*60*1e3,Er=2*60*1e3,Or=12,Ir=1e3,Cr=1500,xr=1e3,ft=24*60*60*1e3,nt=new Set(["final_answer","final","complete","completed","done"]),Ar=new Set(["function_call","function_call_output","custom_tool_call","custom_tool_call_output","local_shell_call","local_shell_call_output","mcp_tool_call","mcp_tool_call_output","web_search_call","image_generation_call","image_generation_end"]),Nr=new Set(["context_compacted","context_compaction","context_compressed"]);function ht(e,t){if(e?.pid){if(process.platform==="win32"){let n=["/PID",String(e.pid),"/T"];t==="SIGKILL"&&n.push("/F");try{Pe("taskkill",n,{stdio:"ignore",windowsHide:!0}).unref?.()}catch{try{e.kill(t)}catch{}}return}try{process.kill(-e.pid,t)}catch(n){if(n?.code==="ESRCH")return;try{e.kill(t)}catch{}}}}function Pt(e){ht(e,"SIGTERM");let t=setTimeout(()=>ht(e,"SIGKILL"),ve);return t.unref?.(),t}function M(e){if(typeof e=="string")return e;if(Array.isArray(e))return e.map(t=>M(t)).join("");if(!c(e))return"";for(let t of["text","delta","output_text","content","message","output"]){let n=M(e[t]);if(n)return n}return""}function je(e){if(!c(e))return"";let t=c(e.payload)?e.payload:{};if(a(e.type)==="event_msg"){if(a(t.type)==="agent_message")return a(t.message);if(a(t.type)==="task_complete")return a(t.last_agent_message)}if(a(e.type)==="response_item"&&a(t.type)==="message"&&a(t.role)==="assistant")return M(t.content)||M(t.message);if(a(e.type)==="result")return M(e.result);let n=M(e.delta)||M(e.text)||M(e.content);if(n)return n;let r=c(e.item)?e.item:{};return["message","agent_message"].includes(a(r.type))||a(r.role)==="assistant"?M(r.content)||M(r.text)||M(r.message):""}function Be(e,t={}){return kt(e,{source:"codex_cli_image_generation",...t})}function Ke(e,t){lt(e.artifacts,t)}function qe(e){return v(Lt(e))}function vt(e){if(!c(e))return!1;let t=c(e.payload)?e.payload:{},n=a(e.type),r=a(t.type);if(n==="event_msg"&&r==="task_complete")return!0;let s=a(t.phase||t.status||t.stage).toLowerCase();if(n==="event_msg"&&r==="agent_message"||n==="response_item"&&r==="message"&&a(t.role)==="assistant")return nt.has(s);let i=c(e.item)?e.item:{};return n==="item.completed"&&a(i.type)==="agent_message"?!0:n==="result"&&e.is_error!==!0?a(e.result).length>0:!1}function Mr(e){let t=a(e.terminalProtocol||e.eventProtocol).toLowerCase();if(t)return t;let n=Ht(a(e.command)).replace(/\.exe$/i,"").toLowerCase();return n==="codex"||n==="claude"?n:""}function Ue(e,t,n){let r=c(t.error)?t.error:{},s=a(r.message)||M(t.error)||a(t.result)||a(t.message)||n;return Object.assign(new Error(s),{code:e})}function Ur(e,t){if(!c(e))return null;let n=a(e.type).toLowerCase();if(t==="codex")return n==="turn.completed"?{status:"completed",result:{stopReason:"end_turn"}}:n==="turn.failed"?{status:"failed",error:Ue("RUNTIME_CODEX_TURN_FAILED",e,"Codex turn failed")}:null;if(t==="claude"&&n==="result"){let r=a(e.subtype).toLowerCase();return e.is_error===!0||r.startsWith("error")||["failed","failure"].includes(r)?{status:"failed",error:Ue("RUNTIME_CLAUDE_RESULT_FAILED",e,"Claude result failed")}:{status:"completed",result:{stopReason:"end_turn",...a(e.result)?{output:a(e.result)}:{}}}}return null}function be(e){return c(e)?a(e.phase||e.status||e.stage).toLowerCase():""}function br(e){if(!c(e)||vt(e))return!1;let t=c(e.payload)?e.payload:{},n=a(e.type),r=a(t.type),s=be(t);if(n==="event_msg"&&r==="agent_message"||n==="response_item"&&r==="message"&&a(t.role)==="assistant")return!!(s&&!nt.has(s));let i=c(e.item)?e.item:{},o=be(i);return a(i.role)==="assistant"||a(i.type)==="message"?!!(o&&!nt.has(o)):!1}function kr(e,t,n){return n.captureLastMessage===!1||t.includes("--output-last-message")||t.includes("-o")?!1:n.captureLastMessage===!0?!0:Ht(e)==="codex"}function Lr(e,t){return t.collectCodexTranscriptArtifacts===!1?!1:t.collectCodexTranscriptArtifacts===!0?!0:Ht(e)==="codex"}function Ge(e){return Math.max(20,S(e.codexTranscriptPollMs||e.transcriptPollMs,Ir))}function Pr(e){return Math.max(0,S(e.codexFinalOutputWaitMs||e.finalOutputWaitMs,Cr))}function gt(e){if(typeof e=="boolean")return e;let t=a(e).toLowerCase();return["true","1","yes","y","on"].includes(t)?!0:["false","0","no","n","off"].includes(t)?!1:null}function jt(e){let t=c(e?.metadata)?e.metadata:{};return c(t._runtimeBridge)?t._runtimeBridge:{}}function Dt(e){return a(jt(e).promptKind).toLowerCase()}function Dr(e,t){for(let n of[e.codexTranscriptStreaming,e.streamCodexTranscript]){let r=gt(n);if(r!=null)return r}return Dt(t)==="chat"}function Fr(e,t){let n=jt(e);for(let s of[n.emitThoughtChunks,n.streamThoughts]){let i=gt(s);if(i!=null)return i}let r=Dt(e);if(r&&r!=="chat")return!1;for(let s of[t.emitThoughtChunks,t.streamThoughts]){let i=gt(s);if(i!=null)return i}return Dt(e)==="chat"}function $r(e){let t=jt(e);for(let n of[t.finalTextOnly,t.finalOutputOnly]){let r=gt(n);if(r!=null)return r}return null}function Hr(e,t){let n=$r(e);return n??(t.finalTextOnly===!0||t.finalOutputOnly===!0?!0:(t.finalTextOnly===!1||t.finalOutputOnly===!1,!1))}function vr(e,t){return!e.finalTextOnly||t}function ze(e,t,n,r,s=r){return!r||e.emittedTexts.has(s)?!1:(e.emittedTexts.add(s),n({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:r}}}),!0)}function Je(e,t,n,r){return!r||e.emittedThoughtTexts.has(r)?!1:(e.emittedThoughtTexts.add(r),n({sessionId:t,update:{sessionUpdate:"agent_thought_chunk",content:{type:"text",text:r}}}),!0)}function jr(e,t,n,r=new Set){return{target:e,promptText:t,startedAtMs:n,baselinePaths:r,matchedPath:"",disabled:!1,processedLines:new Map}}function Br(e,t){let n=c(e.env)?e.env:{},r=a(e.artifactRoot||e.artifactDir||e.runtimeArtifactRoot||n.ORCHA_RUNTIME_ARTIFACT_DIR)||k(He(),"orcha-runtime-artifacts"),s=a(t).replace(/[^A-Za-z0-9._-]+/g,"-").slice(0,80)||et(),i=k(r,s),o=k(i,et());return pr(o,{recursive:!0}),{root:o,realRoot:pt(o),sessionRoot:i,realSessionRoot:pt(i)}}function We(e){return a(c(e)?e.root:e)}function ke(e){let t=We(e),n=a(c(e)?e.sessionRoot:Sr(t)),r=a(c(e)?e.realSessionRoot:"");if(n)try{if(r&&pt(n)!==r)return;gr(n)}catch{}}function Kr(e,t={}){let n=We(e),r=a(c(e)?e.realRoot:"");if(n){try{if(r&&pt(n)!==r){m("warn","runtime.cli","runtime artifact directory cleanup skipped; path changed",{...t,artifactRoot:n});return}}catch{ke(e);return}try{hr(n,{recursive:!0,force:!0})}catch(s){m("warn","runtime.cli","runtime artifact directory cleanup failed",{...t,artifactRoot:n,error:String(s?.message||s)});return}ke(e)}}function qr(e,t){return{trustedFileRoots:[t,...N(e.trustedArtifactRoots),...N(e.trustedFileRoots),...N(e.artifactRoots),...N(e.artifactFileRoots)].filter(Boolean)}}function Ve(e){let t=a(e.codexSessionsRoot||e.codexSessionRoot);if(t)return t;let n=c(e.env)?e.env:{},r=a(e.codexHome||n.CODEX_HOME||process.env.CODEX_HOME)||k(yr(),".codex");return k(r,"sessions")}function Gr(e,t){let n=new Date(t),r=String(n.getFullYear()),s=String(n.getMonth()+1).padStart(2,"0"),i=String(n.getDate()).padStart(2,"0");return k(e,r,s,i)}function Xe(e,t,n){let r=new Set;for(let s of[t-ft,t,t+ft,n-ft,n,n+ft])r.add(Gr(e,s));return[...r].filter(s=>De(s))}function zr(e,t,n){let r=Ve(e),s=t-Rr,i=n+Er,o=[];for(let u of Xe(r,t,n)){let l=[];try{l=Fe(u)}catch{continue}for(let d of l){if(!d.endsWith(".jsonl"))continue;let f=k(u,d);try{let p=_r(f);if(!p.isFile()||p.mtimeMs<s||p.mtimeMs>i)continue;o.push({path:f,mtimeMs:p.mtimeMs})}catch{}}}return o.sort((u,l)=>l.mtimeMs-u.mtimeMs).slice(0,Or)}function Jr(e,t,n=t){let r=Ve(e),s=new Set;for(let i of Xe(r,t,n)){let o=[];try{o=Fe(i)}catch{continue}for(let u of o)u.endsWith(".jsonl")&&s.add(k(i,u))}return s}function Ft(e,t,n=0){if(!(n>8||e===null||e===void 0)){if(typeof e=="string"){e&&t.push(e);return}if(Array.isArray(e)){for(let r of e)Ft(r,t,n+1);return}if(c(e))for(let r of["payload","item","text","delta","output_text","content","message","output","input","prompt","last_agent_message","revised_prompt"])r in e&&Ft(e[r],t,n+1)}}function Ye(e){return a(e).replace(/\s+/g," ")}function Wr(e){let t=Ye(e);if(!t)return[];if(t.length<=200)return[t];let n=160,r=[0,Math.floor((t.length-n)/2),t.length-n],s=new Set,i=[];for(let o of r){let u=t.slice(Math.max(0,o),Math.max(0,o)+n).trim();u.length>=40&&!s.has(u)&&(s.add(u),i.push(u))}return i}function Vr(e,t){let n=Wr(t);if(!n.length)return!1;let r=[];for(let i of e)Ft(i,r);let s=Ye(r.join(" "));return n.every(i=>s.includes(i))}function Xr(e){return e.find(t=>c(t)&&a(t.type)==="session_meta"&&c(t.payload))||null}function Yr(e){let t=c(e?.payload)?e.payload:{},n=a(e?.timestamp||t.timestamp),r=Date.parse(n);return Number.isFinite(r)?r:Number.NaN}function Zr(e){let t=a(e.originator),n=a(e.source);if(t!=="codex_exec"&&n!=="exec"||a(e.parent_thread_id))return!1;let r=a(e.thread_source);if(r&&r!=="user")return!1;let s=a(e.session_id),i=a(e.id);return!(s&&i&&s!==i)}function Qr(e,t,n){if(!Vr(e,t.promptText))return!1;let r=Xr(e);if(!r)return!1;let s=r.payload;if(!Zr(s))return!1;let i=Yr(r);if(!Number.isFinite(i)||i<t.startedAtMs-5e3||i>n+5e3)return!1;let o=a(t.target.cwd),u=a(s.cwd);return!(o&&u&&Me(o)!==Me(u))}function Le(e){try{return es($e(e,"utf8"))}catch{return null}}function ts(e,t,n){if(!e||e.disabled)return null;if(e.matchedPath){let s=Le(e.matchedPath);return s?{path:e.matchedPath,events:s}:null}let r=[];for(let s of zr(e.target,e.startedAtMs,n)){if(e.baselinePaths.has(s.path))continue;let i=Le(s.path);!i||!Qr(i,e,n)||r.push({path:s.path,events:i})}return r.length!==1?(r.length>1&&(e.disabled=!0,m("warn","runtime.cli","codex transcript fallback disabled; multiple matching transcripts",{target:e.target.targetCode,sessionId:t,transcriptCount:r.length})),null):(e.matchedPath=r[0].path,m("info","runtime.cli","codex transcript stream attached",{target:e.target.targetCode,sessionId:t}),r[0])}function es(e){let t=[];for(let n of e.split(/\r?\n/)){let r=n.trim();if(r)try{t.push(JSON.parse(r))}catch{}}return t}function ns(e){if(!c(e))return!1;let t=c(e.payload)?e.payload:{},n=a(e.type),r=a(t.type);return n==="event_msg"&&r==="image_generation_end"||n==="response_item"&&r==="image_generation_call"}function rs(e){if(!c(e))return!1;let t=c(e.payload)?e.payload:{};return a(e.type)==="response_item"&&Ar.has(a(t.type))}function ss(e){if(!c(e))return!1;let t=c(e.payload)?e.payload:{};return Nr.has(a(t.type))}function is(e,t,n,r){let s=je(e),i=vt(e),o=0,u=0,l=0;if(s&&!i&&t.emitThoughtChunks&&Je(t,n,r,s)&&(l=1),s&&i){let d=t.emittedTexts.size?`
+${n}`:`${n}
+`;this.child.stdin.write(s,r)}onNotification(t,r){let n=this.notificationHandlers.get(t)||new Set;return n.add(r),this.notificationHandlers.set(t,n),()=>{n.delete(r),n.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,r){return this.requestHandlers.set(t,r),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let r of this.pending.values())clearTimeout(r.timer),r.reject(t);this.pending.clear()}handleExit(t,r){this.exited=!0,this.exitCode=t,this.exitSignal=r,this.rejectAll(new Error(`runtime exited before response (${t}/${r})`));for(let n of this.exitHandlers)n(t,r)}async waitForExit(t=5e3){return!this.child||this.exited?!0:await new Promise(r=>{let n=setTimeout(()=>{s(),r(!1)},t);n.unref?.();let s=()=>{clearTimeout(n),this.exitHandlers.delete(i)},i=()=>{s(),r(!0)};this.exitHandlers.add(i),this.exited&&i()})}signal(t){if(!this.child||this.exited)return!1;let r=this.child.pid;if(!r)return!1;try{return this.detached&&process.platform!=="win32"?process.kill(-r,t):this.child.kill(t),!0}catch(n){if(n?.code==="ESRCH")return this.exited=!0,!1;try{return this.child.kill(t),!0}catch(s){return s?.code!=="ESRCH"&&h("warn","runtime","runtime signal failed",{target:this.label,pid:r,signal:t,error:String(s)}),!1}}}async stop(t="stop",{termTimeoutMs:r=5e3,killTimeoutMs:n=2e3}={}){if(!(!this.child||this.exited)){if(this.stopPromise)return await this.stopPromise;this.stopPromise=(async()=>{if(!this.child||this.exited)return;let s=this.child.pid;h("info","runtime","stopping runtime",{target:this.label,reason:t,pid:s}),this.rejectAll(new Error(`runtime stopped: ${t}`)),this.signal("SIGTERM"),!await this.waitForExit(r)&&this.child&&!this.exited&&(h("warn","runtime","runtime did not exit after SIGTERM; force killing",{target:this.label,reason:t,pid:s}),this.signal("SIGKILL"),await this.waitForExit(n))})();try{await this.stopPromise}finally{this.stopPromise=null}}}};import{randomUUID as Xe}from"node:crypto";import{existsSync as Un,readFileSync as Pn,realpathSync as ze,statSync as kn}from"node:fs";import{basename as Ye,extname as Qe,isAbsolute as ct,join as Ln,relative as Ze,resolve as We}from"node:path";var Dn=25*1024*1024;function tr(e,t=""){let r=a(t);if(r)return r;let n=Qe(a(e)).toLowerCase();return n===".jpg"||n===".jpeg"?"image/jpeg":n===".webp"?"image/webp":n===".gif"?"image/gif":"image/png"}function er(e,t){let r=typeof e=="string"?e.trim():"";return!r||r==="<omitted>"?"":r.startsWith("data:")?r:`data:${t};base64,${r.replace(/\s+/g,"")}`}function St(e){if(Array.isArray(e))return e.map(a).filter(Boolean);let t=a(e);return t?[t]:[]}function vn(e,t){let r=Ze(t,e);return r===""||!!r&&!r.startsWith("..")&&!ct(r)}function Fn(e,t){let r=a(e);if(!r||!Un(r))return"";try{let n=ze(r);for(let s of t)try{let i=ze(s);if(vn(n,i))return n}catch{}}catch{return""}return""}function Hn(e,t){let r=a(e);if(!r||!ct(r))return r;for(let n of Array.isArray(t)?t:[]){if(!u(n))continue;let s=a(n.runtimeRoot),i=a(n.hostRoot);if(!s||!i||!ct(s)||!ct(i))continue;let o=Ze(We(s),We(r));if(o===""||!o.startsWith("..")&&!ct(o))return o?Ln(i,o):i}return r}function Kt(e,t,r={}){let n=a(e);return!n||n.startsWith("data:")||/^https?:\/\//i.test(n)?n:$n(n,t,r)}function $n(e,t,r={}){let n=[...St(r.trustedFileRoots),...St(r.trustedFileRoot),...St(r.artifactRoots),...St(r.artifactRoot)],s=Fn(Hn(e,r.pathMappings),n);if(!s)return"";try{let i=kn(s);return!i.isFile()||i.size<=0||i.size>Dn?"":`data:${t};base64,${Pn(s).toString("base64")}`}catch{return""}}function x(...e){for(let t of e){let r=a(t);if(r)return r}return""}function Bn(e,t,r,n){let s=r.toLowerCase();if(s==="image"||s==="picture")return!0;let i=x(n,e.previewUrl,e.fileUrl,e.imageUrl,e.dataUrl,e.url,e.uri,t.previewUrl,t.fileUrl,t.imageUrl,t.dataUrl,t.url,t.uri),o=Qe(i.split("?",1)[0].split("#",1)[0]).toLowerCase();return[".png",".jpg",".jpeg",".webp",".gif"].includes(o)}function zt(e,t={}){let{source:r="runtime_image_generation_event"}=t;if(!u(e))return null;let n=u(e.payload)?e.payload:{},s=a(e.type),i=a(n.type);if(!(s==="event_msg"&&i==="image_generation_end"||s==="response_item"&&i==="image_generation_call"))return null;let o=x(n.call_id,n.id),c=x(n.saved_path,n.savedPath),l=x(n.revised_prompt,n.revisedPrompt),d=tr(c,n.mimeType||n.mime_type),f=er(n.result,d)||Kt(c,d,t);if(!f)return null;let p=f.startsWith("data:")?f:"",g=c?Ye(c):`${o||Xe()}.png`;return{artifactType:"image",type:"image",fieldKey:"image",title:g||"Generated image",summary:l||"Generated image",content:{prompt:l||void 0,dataUrl:p||void 0,imageUrl:f,previewUrl:f,fileUrl:f,mimeType:d},dataUrl:p||void 0,previewUrl:f,fileUrl:f,metadata:{source:r,eventType:i,callId:o||void 0,savedPath:c||void 0,filename:g,mimeType:d,revisedPrompt:l||void 0}}}function qn(e){let t=u(e)?e:{},r=[];for(let n of["_artifacts","artifacts"]){let s=t[n];Array.isArray(s)&&r.push(...s)}for(let n of["_artifact","artifact"]){let s=t[n];u(s)&&r.push(s)}return r}function jn(e,t={}){let{source:r="runtime_artifact"}=t,n=u(e)?e:{};if(!Object.keys(n).length)return null;let s=u(n.content)?{...n.content}:{},i=u(n.metadata)?{...n.metadata}:{},o=x(n.saved_path,n.savedPath,s.saved_path,s.savedPath,i.savedPath),c=x(n.mimeType,n.mime_type,s.mimeType,s.mime_type,i.mimeType),l=x(n.artifactType,n.artifact_type,n.type,n.kind,s.type,o?"image":"file"),d=Bn(n,s,l,o),f=d?tr(o,c):c;if(d){let N=x(n.dataUrl,s.dataUrl),_=N.startsWith("data:")?N:"",y=x(n.imageUrl,n.previewUrl,n.fileUrl,n.downloadUrl,n.url,n.uri,s.imageUrl,s.previewUrl,s.fileUrl,s.downloadUrl,s.url,s.uri),E=er(n.result??s.result,f)||_||Kt(o,f,t)||Kt(y,f,t);E&&(E.startsWith("data:")&&(s.dataUrl||=E),s.imageUrl||=E,s.previewUrl||=E,s.fileUrl||=E,f&&(s.mimeType||=f))}for(let[N,_]of[["prompt","prompt"],["previewUrl","previewUrl"],["fileUrl","fileUrl"],["downloadUrl","downloadUrl"],["imageUrl","imageUrl"],["dataUrl","dataUrl"],["url","url"],["uri","uri"],["mimeType","mimeType"],["mime_type","mimeType"]]){let y=n[N];y!=null&&y!==""&&!(_ in s)&&(s[_]=y)}let p=x(n.fileUrl,n.downloadUrl,n.imageUrl,n.dataUrl,n.url,n.uri,s.fileUrl,s.downloadUrl,s.imageUrl,s.dataUrl,s.url,s.uri),g=x(n.previewUrl,n.imageUrl,n.dataUrl,n.url,n.fileUrl,n.uri,s.previewUrl,s.imageUrl,s.dataUrl,s.url,s.fileUrl,s.uri),m=x(n.dataUrl,s.dataUrl,p.startsWith("data:")?p:"",g.startsWith("data:")?g:""),S=x(n.filename,i.filename,o?Ye(o):""),O=x(n.fieldKey,n.field_key,s.fieldKey,i.fieldKey,d?"image":"artifact");return{...n,artifactType:l,type:n.type||l,fieldKey:O,title:x(n.title,S,"Runtime artifact"),summary:x(n.summary,s.prompt,n.title,S,"Runtime artifact"),content:s,dataUrl:m||void 0,fileUrl:p||void 0,previewUrl:g||void 0,metadata:{...i,source:x(i.source,r),savedPath:o||i.savedPath,filename:S||i.filename,mimeType:f||i.mimeType}}}function Et(e,t){if(!t||!e)return;let r=u(t.metadata)?t.metadata:{},n=x(r.savedPath,r.callId,t.previewUrl,t.fileUrl)||Xe(),s=e.get(n);if(!s){e.set(n,t);return}s.content={...u(s.content)?s.content:{},...u(t.content)?t.content:{}},s.metadata={...u(s.metadata)?s.metadata:{},...r},s.previewUrl=t.previewUrl||s.previewUrl,s.fileUrl=t.fileUrl||s.fileUrl,s.summary=t.summary||s.summary,s.title=t.title||s.title}function Vt(e,t,r={}){for(let n of qn(e))Et(t,jn(n,r))}function Wt(e){if(!u(e)||!u(e.payload))return u(e)?e:{value:e};let t=a(e.payload.type);if(t!=="image_generation_end"&&t!=="image_generation_call")return e;let r={...e.payload};return typeof r.result=="string"&&r.result&&(r.result="<omitted>",r.resultLength=e.payload.result.length),{...e,payload:r}}function Je(e,t,r){if(!u(e))return e;let n=u(e.event)?e.event:null;return n?(Et(t,zt(n,r)),{...e,event:Wt(n)}):e}function rr(e,t,r={}){if(!u(e))return e;Vt(e,t,r);let n=Je(e,t,r),s=u(n.update)?Je(n.update,t,r):null;return s&&s!==n.update&&(n={...n,update:s}),n}function nr(e,t,r={}){let n=u(e)?{...e}:{};Vt(n,t,r),Vt(u(n.output)?n.output:{},t,r);let s=[...t?.values?.()||[]];return s.length&&(n._artifacts=s),delete n.artifacts,n}var Q=class{constructor(t,r,n={},s={}){this.agent=t,this.target=r,this.callbacks=n,this.options=s,this.proc=null,this.launch=null,this.launchCleanup=null,this.permissionHandlers=new Map}async ensureStarted(){if(this.proc)return;let t=a(this.target.command);if(!t)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let r={command:t,args:C(this.target.args),cwd:a(this.target.cwd)||this.agent.workspace||process.cwd(),environment:u(this.target.env)?this.target.env:{}},n=this.options.prepareLaunch?await this.options.prepareLaunch(r):{...r,environment:{...process.env,...r.environment},cleanup:async()=>{}};this.launch=n,this.launchCleanup=n.cleanup,this.proc=new Rt({command:n.command,args:n.args,cwd:n.cwd,env:n.environment,label:`${this.agent.agentId}:${this.agent.targetCode}`,framing:a(this.target.framing||"line")}),this.proc.onRequest("session/request_permission",s=>this.handlePermissionRequest(s)),this.proc.onRequest("session/requestPermission",s=>this.handlePermissionRequest(s));try{await this.proc.start({initialize:this.target.initialize!==!1,initializeParams:{clientInfo:{name:"orcha-runtime-bridge",version:Y},...u(this.target.initializeParams)?this.target.initializeParams:{}}})}catch(s){throw this.proc=null,await this.cleanupLaunch(),s}}async sessionNew(t={}){return await this.ensureStarted(),this.proc.call("session/new",this.sessionNewParams(t))}sessionNewParams(t={}){let r=Array.isArray(t.mcpServers)?t.mcpServers:Array.isArray(this.target.mcpServers)?this.target.mcpServers:[];return{...t,mcpServers:r}}async sessionPrompt(t,r){await this.ensureStarted();let n=a(t.sessionId),s=new Map,i=this.artifactOptions(),o=this.proc.onNotification("session/update",l=>{let d=a(l.sessionId);(!d||d===n)&&r(rr(l,s,i))}),c=async l=>this.callbacks.onPermissionRequest?.({agent:this.agent,runtimeSessionId:n,request:l,emitUpdate:r})||{outcome:"denied",reason:"permission handler is not configured"};n&&this.permissionHandlers.set(n,c),this.permissionHandlers.set("*",c);try{let l=await this.proc.call("session/prompt",t,this.options.sessionPromptTimeoutMs);return nr(l,s,i)}finally{o(),n&&this.permissionHandlers.delete(n),this.permissionHandlers.delete("*")}}async sessionCancel(t){return await this.ensureStarted(),this.proc.call("session/cancel",t,5e3).catch(()=>({ok:!0}))}async handlePermissionRequest(t){let r=a(t.sessionId),n=this.permissionHandlers.get(r)||this.permissionHandlers.get("*");return n?n(t):{outcome:"denied",reason:"no active Orcha permission handler"}}artifactSource(){return a(this.target.type||"acp")==="openclaw"?"openclaw_image_generation":"acp_runtime_image_generation"}artifactOptions(){let t=u(this.target.env)?this.target.env:{};return{source:this.artifactSource(),trustedFileRoots:[a(this.launch?.artifactDirectory),a(this.launch?.homeDirectory),a(this.target.artifactRoot),a(this.target.artifactDir),a(this.target.runtimeArtifactRoot),a(t.ORCHA_RUNTIME_ARTIFACT_DIR),...C(this.target.trustedArtifactRoots),...C(this.target.trustedFileRoots),...C(this.target.artifactRoots),...C(this.target.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(this.launch?.pathMappings)?this.launch.pathMappings:[]}}async stop(t){try{await this.proc?.stop(t)}finally{this.proc=null,await this.cleanupLaunch()}}async cleanupLaunch(){let t=this.launchCleanup;this.launchCleanup=null,this.launch=null,await t?.()}};function Gn(e){let t=u(e.metadata)?e.metadata:{};return a(t.agentCode)}function Kn(e,t){let r=Gn(e);return r?`agent:${r}:${t}`:`orcha-${t}`}var wt=class extends Q{constructor(t,r,n,s={},i={}){let o=a(n).replace(/[^A-Za-z0-9._-]+/g,"-")||"default",c=a(r.command)||"openclaw",l=Array.isArray(r.args)?r.args.map(String):[],d=l.length>0?l:["acp","--session",Kn(t,o)];super(t,{...r,command:c,args:d},s,i)}sessionNewParams(t={}){return{...t,mcpServers:[]}}};import{spawn as ur}from"node:child_process";import{randomUUID as Z}from"node:crypto";import{existsSync as lr,mkdirSync as Vn,readdirSync as dr,readFileSync as fr,realpathSync as lt,rmSync as zn,rmdirSync as Wn,statSync as Jn,unlinkSync as Xn}from"node:fs";import{homedir as Yn,tmpdir as pr}from"node:os";import{basename as Zt,dirname as Qn,join as L,resolve as sr}from"node:path";var Zn=36e5,mr=5e3,ts=2*60*1e3,es=2*60*1e3,rs=12,ns=1e3,ss=1500,is=1e3,It=24*60*60*1e3,ut=new Set(["final_answer","final","complete","completed","done"]),os=new Set(["function_call","function_call_output","custom_tool_call","custom_tool_call_output","local_shell_call","local_shell_call_output","mcp_tool_call","mcp_tool_call_output","web_search_call","image_generation_call","image_generation_end"]),as=new Set(["context_compacted","context_compaction","context_compressed"]);function xt(e,t){if(e?.pid){if(process.platform==="win32"){let r=["/PID",String(e.pid),"/T"];t==="SIGKILL"&&r.push("/F");try{ur("taskkill",r,{stdio:"ignore",windowsHide:!0}).unref?.()}catch{try{e.kill(t)}catch{}}return}try{process.kill(-e.pid,t)}catch(r){if(r?.code==="ESRCH")return;try{e.kill(t)}catch{}}}}function Jt(e){xt(e,"SIGTERM");let t=setTimeout(()=>xt(e,"SIGKILL"),mr);return t.unref?.(),t}function P(e){if(typeof e=="string")return e;if(Array.isArray(e))return e.map(t=>P(t)).join("");if(!u(e))return"";for(let t of["text","delta","output_text","content","message","output"]){let r=P(e[t]);if(r)return r}return""}function hr(e){if(!u(e))return"";let t=u(e.payload)?e.payload:{};if(a(e.type)==="event_msg"){if(a(t.type)==="agent_message")return a(t.message);if(a(t.type)==="task_complete")return a(t.last_agent_message)}if(a(e.type)==="response_item"&&a(t.type)==="message"&&a(t.role)==="assistant")return P(t.content)||P(t.message);if(a(e.type)==="result")return P(e.result);let r=P(e.delta)||P(e.text)||P(e.content);if(r)return r;let n=u(e.item)?e.item:{};return["message","agent_message"].includes(a(n.type))||a(n.role)==="assistant"?P(n.content)||P(n.text)||P(n.message):""}function gr(e,t={}){return zt(e,{source:"codex_cli_image_generation",...t})}function _r(e,t){Et(e.artifacts,t)}function Tr(e){return G(Wt(e))}function te(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);if(r==="event_msg"&&n==="task_complete")return!0;let s=a(t.phase||t.status||t.stage).toLowerCase();if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&a(t.role)==="assistant")return ut.has(s);let i=u(e.item)?e.item:{};return r==="item.completed"&&a(i.type)==="agent_message"?!0:r==="result"&&e.is_error!==!0?a(e.result).length>0:!1}function cs(e){let t=a(e.terminalProtocol||e.eventProtocol).toLowerCase();if(t)return t;let r=Zt(a(e.command)).replace(/\.exe$/i,"").toLowerCase();return r==="codex"||r==="claude"?r:""}function ir(e,t,r){let n=u(t.error)?t.error:{},s=a(n.message)||P(t.error)||a(t.result)||a(t.message)||r;return Object.assign(new Error(s),{code:e})}function us(e,t){if(!u(e))return null;let r=a(e.type).toLowerCase();if(t==="codex")return r==="turn.completed"?{status:"completed",result:{stopReason:"end_turn"}}:r==="turn.failed"?{status:"failed",error:ir("RUNTIME_CODEX_TURN_FAILED",e,"Codex turn failed")}:null;if(t==="claude"&&r==="result"){let n=a(e.subtype).toLowerCase();return e.is_error===!0||n.startsWith("error")||["failed","failure"].includes(n)?{status:"failed",error:ir("RUNTIME_CLAUDE_RESULT_FAILED",e,"Claude result failed")}:{status:"completed",result:{stopReason:"end_turn",...a(e.result)?{output:a(e.result)}:{}}}}return null}function or(e){return u(e)?a(e.phase||e.status||e.stage).toLowerCase():""}function ls(e){if(!u(e)||te(e))return!1;let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type),s=or(t);if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&a(t.role)==="assistant")return!!(s&&!ut.has(s));let i=u(e.item)?e.item:{},o=or(i);return a(i.role)==="assistant"||a(i.type)==="message"?!!(o&&!ut.has(o)):!1}function ds(e,t,r){return r.captureLastMessage===!1||t.includes("--output-last-message")||t.includes("-o")?!1:r.captureLastMessage===!0?!0:Zt(e)==="codex"}function fs(e,t){return t.collectCodexTranscriptArtifacts===!1?!1:t.collectCodexTranscriptArtifacts===!0?!0:Zt(e)==="codex"}function yr(e){return Math.max(20,T(e.codexTranscriptPollMs||e.transcriptPollMs,ns))}function ps(e){return Math.max(0,T(e.codexFinalOutputWaitMs||e.finalOutputWaitMs,ss))}function At(e){if(typeof e=="boolean")return e;let t=a(e).toLowerCase();return["true","1","yes","y","on"].includes(t)?!0:["false","0","no","n","off"].includes(t)?!1:null}function ee(e){let t=u(e?.metadata)?e.metadata:{};return u(t._runtimeBridge)?t._runtimeBridge:{}}function Xt(e){return a(ee(e).promptKind).toLowerCase()}function ms(e,t){for(let r of[e.codexTranscriptStreaming,e.streamCodexTranscript]){let n=At(r);if(n!=null)return n}return Xt(t)==="chat"}function hs(e,t){let r=ee(e);for(let s of[r.emitThoughtChunks,r.streamThoughts]){let i=At(s);if(i!=null)return i}let n=Xt(e);if(n&&n!=="chat")return!1;for(let s of[t.emitThoughtChunks,t.streamThoughts]){let i=At(s);if(i!=null)return i}return Xt(e)==="chat"}function gs(e){let t=ee(e);for(let r of[t.finalTextOnly,t.finalOutputOnly]){let n=At(r);if(n!=null)return n}return null}function _s(e,t){let r=gs(e);return r??(t.finalTextOnly===!0||t.finalOutputOnly===!0?!0:(t.finalTextOnly===!1||t.finalOutputOnly===!1,!1))}function Ts(e,t){return!e.finalTextOnly||t}function Rr(e,t,r,n,s=n){return!n||e.emittedTexts.has(s)?!1:(e.emittedTexts.add(s),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}}),!0)}function Sr(e,t,r,n){return!n||e.emittedThoughtTexts.has(n)?!1:(e.emittedThoughtTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_thought_chunk",content:{type:"text",text:n}}}),!0)}function ys(e,t,r,n=new Set){return{target:e,promptText:t,startedAtMs:r,baselinePaths:n,matchedPath:"",disabled:!1,processedLines:new Map}}function Rs(e,t){let r=u(e.env)?e.env:{},n=a(e.artifactRoot||e.artifactDir||e.runtimeArtifactRoot||r.ORCHA_RUNTIME_ARTIFACT_DIR)||L(pr(),"orcha-runtime-artifacts"),s=a(t).replace(/[^A-Za-z0-9._-]+/g,"-").slice(0,80)||Z(),i=L(n,s),o=L(i,Z());return Vn(o,{recursive:!0}),{root:o,realRoot:lt(o),sessionRoot:i,realSessionRoot:lt(i)}}function Ss(e){let t=a(e?.artifactDirectory);if(!t)throw new Error("sandbox launch did not provide an artifact directory");return{root:t,realRoot:lt(t),sessionRoot:"",realSessionRoot:""}}function Er(e){return a(u(e)?e.root:e)}function ar(e){let t=Er(e),r=a(u(e)?e.sessionRoot:Qn(t)),n=a(u(e)?e.realSessionRoot:"");if(r)try{if(n&&lt(r)!==n)return;Wn(r)}catch{}}function Es(e,t={}){let r=Er(e),n=a(u(e)?e.realRoot:"");if(r){try{if(n&&lt(r)!==n){h("warn","runtime.cli","runtime artifact directory cleanup skipped; path changed",{...t,artifactRoot:r});return}}catch{ar(e);return}try{zn(r,{recursive:!0,force:!0})}catch(s){h("warn","runtime.cli","runtime artifact directory cleanup failed",{...t,artifactRoot:r,error:String(s?.message||s)});return}ar(e)}}function ws(e,t,r=null){return{trustedFileRoots:[t,a(r?.artifactDirectory),a(r?.homeDirectory),...C(e.trustedArtifactRoots),...C(e.trustedFileRoots),...C(e.artifactRoots),...C(e.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(r?.pathMappings)?r.pathMappings:[]}}function wr(e){let t=a(e.codexSessionsRoot||e.codexSessionRoot);if(t)return t;let r=u(e.env)?e.env:{},n=a(e.codexHome||r.CODEX_HOME||process.env.CODEX_HOME)||L(Yn(),".codex");return L(n,"sessions")}function Is(e,t){let r=new Date(t),n=String(r.getFullYear()),s=String(r.getMonth()+1).padStart(2,"0"),i=String(r.getDate()).padStart(2,"0");return L(e,n,s,i)}function Ir(e,t,r){let n=new Set;for(let s of[t-It,t,t+It,r-It,r,r+It])n.add(Is(e,s));return[...n].filter(s=>lr(s))}function Os(e,t,r){let n=wr(e),s=t-ts,i=r+es,o=[];for(let c of Ir(n,t,r)){let l=[];try{l=dr(c)}catch{continue}for(let d of l){if(!d.endsWith(".jsonl"))continue;let f=L(c,d);try{let p=Jn(f);if(!p.isFile()||p.mtimeMs<s||p.mtimeMs>i)continue;o.push({path:f,mtimeMs:p.mtimeMs})}catch{}}}return o.sort((c,l)=>l.mtimeMs-c.mtimeMs).slice(0,rs)}function xs(e,t,r=t){let n=wr(e),s=new Set;for(let i of Ir(n,t,r)){let o=[];try{o=dr(i)}catch{continue}for(let c of o)c.endsWith(".jsonl")&&s.add(L(i,c))}return s}function Yt(e,t,r=0){if(!(r>8||e===null||e===void 0)){if(typeof e=="string"){e&&t.push(e);return}if(Array.isArray(e)){for(let n of e)Yt(n,t,r+1);return}if(u(e))for(let n of["payload","item","text","delta","output_text","content","message","output","input","prompt","last_agent_message","revised_prompt"])n in e&&Yt(e[n],t,r+1)}}function Or(e){return a(e).replace(/\s+/g," ")}function As(e){let t=Or(e);if(!t)return[];if(t.length<=200)return[t];let r=160,n=[0,Math.floor((t.length-r)/2),t.length-r],s=new Set,i=[];for(let o of n){let c=t.slice(Math.max(0,o),Math.max(0,o)+r).trim();c.length>=40&&!s.has(c)&&(s.add(c),i.push(c))}return i}function Cs(e,t){let r=As(t);if(!r.length)return!1;let n=[];for(let i of e)Yt(i,n);let s=Or(n.join(" "));return r.every(i=>s.includes(i))}function Ns(e){return e.find(t=>u(t)&&a(t.type)==="session_meta"&&u(t.payload))||null}function bs(e){let t=u(e?.payload)?e.payload:{},r=a(e?.timestamp||t.timestamp),n=Date.parse(r);return Number.isFinite(n)?n:Number.NaN}function Ms(e){let t=a(e.originator),r=a(e.source);if(t!=="codex_exec"&&r!=="exec"||a(e.parent_thread_id))return!1;let n=a(e.thread_source);if(n&&n!=="user")return!1;let s=a(e.session_id),i=a(e.id);return!(s&&i&&s!==i)}function Us(e,t,r){if(!Cs(e,t.promptText))return!1;let n=Ns(e);if(!n)return!1;let s=n.payload;if(!Ms(s))return!1;let i=bs(n);if(!Number.isFinite(i)||i<t.startedAtMs-5e3||i>r+5e3)return!1;let o=a(t.target.cwd),c=a(s.cwd);return!(o&&c&&sr(o)!==sr(c))}function cr(e){try{return ks(fr(e,"utf8"))}catch{return null}}function Ps(e,t,r){if(!e||e.disabled)return null;if(e.matchedPath){let s=cr(e.matchedPath);return s?{path:e.matchedPath,events:s}:null}let n=[];for(let s of Os(e.target,e.startedAtMs,r)){if(e.baselinePaths.has(s.path))continue;let i=cr(s.path);!i||!Us(i,e,r)||n.push({path:s.path,events:i})}return n.length!==1?(n.length>1&&(e.disabled=!0,h("warn","runtime.cli","codex transcript fallback disabled; multiple matching transcripts",{target:e.target.targetCode,sessionId:t,transcriptCount:n.length})),null):(e.matchedPath=n[0].path,h("info","runtime.cli","codex transcript stream attached",{target:e.target.targetCode,sessionId:t}),n[0])}function ks(e){let t=[];for(let r of e.split(/\r?\n/)){let n=r.trim();if(n)try{t.push(JSON.parse(n))}catch{}}return t}function Ls(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);return r==="event_msg"&&n==="image_generation_end"||r==="response_item"&&n==="image_generation_call"}function Ds(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{};return a(e.type)==="response_item"&&os.has(a(t.type))}function vs(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{};return as.has(a(t.type))}function Fs(e,t,r,n){let s=hr(e),i=te(e),o=0,c=0,l=0;if(s&&!i&&t.emitThoughtChunks&&Sr(t,r,n,s)&&(l=1),s&&i){let d=t.emittedTexts.size?`
 
-${s}`:s;ze(t,n,r,d,s)&&(o=1,u=1)}return s&&i&&(t.finalTextSeen=!0),Ke(t,Be(e,t.artifactOptions)),(ns(e)||rs(e)||ss(e)||i)&&r({sessionId:n,update:{sessionUpdate:"runtime_event",event:qe(e)}}),{textCount:o,finalTextCount:u,thoughtCount:l}}function $t(e,t,n,r,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0,textCount:0,finalTextCount:0,thoughtCount:0};let i=e.artifacts.size,o=0,u=0,l=0,d=0,f=ts(t,n,s);if(f){let p=Math.min(t.processedLines.get(f.path)||0,f.events.length),h=e.artifacts.size;for(let g of f.events.slice(p)){let I=is(g,e,n,r);u+=I.textCount,l+=I.finalTextCount,d+=I.thoughtCount}t.processedLines.set(f.path,f.events.length),(f.events.length>p||e.artifacts.size>h)&&(o=1)}return{artifactCount:e.artifacts.size-i,transcriptCount:o,textCount:u,finalTextCount:l,thoughtCount:d}}function os(e,{remove:t=!0}={}){if(!e||!De(e))return"";try{return $e(e,"utf8").trim()}catch{return""}finally{t&&mt(e)}}function mt(e){if(e)try{Tr(e)}catch{}}function as(e,t){return{artifactCount:(e?.artifactCount||0)+(t?.artifactCount||0),transcriptCount:(e?.transcriptCount||0)+(t?.transcriptCount||0),textCount:(e?.textCount||0)+(t?.textCount||0),finalTextCount:(e?.finalTextCount||0)+(t?.finalTextCount||0),thoughtCount:(e?.thoughtCount||0)+(t?.thoughtCount||0)}}function cs(e){return new Promise(t=>setTimeout(t,e))}function us(e,t,n,r){return r?(e.finalTextSeen=!0,e.emittedTexts.has(r)||(e.emittedTexts.add(r),n({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:r}}})),!0):!1}async function ls(e,t,n,r,s,i){let o=$t(e,t,n,r,Date.now()),u=()=>us(e,n,r,os(s,{remove:!1}));if(u()||e.finalTextSeen)return mt(s),o;let l=Pr(i);if(l<=0||!t&&!s)return mt(s),o;let d=Date.now()+l,f=Math.min(Ge(i),100);for(;!e.finalTextSeen&&Date.now()<d&&(await cs(Math.min(f,Math.max(0,d-Date.now()))),o=as(o,$t(e,t,n,r,Date.now())),!u()););return mt(s),o}var _t=class{constructor(t,n,r={}){this.agent=t,this.target=n,this.options=r,this.active=new Map}async sessionNew(){return{sessionId:`cli-${this.agent.agentId}-${et()}`}}async sessionPrompt(t,n,r){let s=Date.now(),i=a(this.target.command);if(!i)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let o=a(t.sessionId)||et(),u=ot(t.prompt),l=a(this.target.promptMode||"stdin"),d=this.buildArgs(l,u),f=a(this.target.cwd)||this.agent.workspace||process.cwd(),p=Br(this.target,o),h=p.root,g=qr(this.target,h),I=Lr(i,this.target),q={...this.target,targetCode:this.agent.targetCode,cwd:f},_=I?Jr(q,s):new Set,T=kr(i,d,this.target)?k(He(),`orcha-runtime-last-message-${et()}.txt`):"";T&&d.push("--output-last-message",T);let w=S(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,S(this.options.sessionPromptTimeoutMs,wr)),E={...process.env,...c(this.target.env)?this.target.env:{},...l==="env"?{ORCHA_RUNTIME_PROMPT:u}:{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:o,ORCHA_RUNTIME_ARTIFACT_DIR:h},y=Pe(i,d,{cwd:f,env:E,stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(o,y),m("info","runtime.cli","runtime prompt started",{target:this.agent.targetCode,sessionId:o,pid:y.pid,timeoutMs:w});let pe="",At=a(this.target.outputMode||"text"),C={artifacts:new Map,emittedTexts:new Set,emittedThoughtTexts:new Set,value:"",artifactOptions:g,finalTextSeen:!1,finalTextOnly:Hr(t,this.target),emitThoughtChunks:Fr(t,this.target),terminalOutcome:null,terminalProtocol:Mr(this.target),emitTerminal:null},Nt=I?jr(q,u,s,_):null;return y.stdout.setEncoding("utf8"),y.stdout.on("data",G=>this.handleStdout(G,At,C,o,n)),y.stderr.setEncoding("utf8"),y.stderr.on("data",G=>{pe+=G,this.target.emitStderr===!0&&n({sessionId:o,update:{sessionUpdate:"runtime_stderr_chunk",content:{type:"text",text:G}}})}),l==="stdin"?y.stdin.end(u):y.stdin.end(),await new Promise((G,Hn)=>{let X=!1,he=!1,it=null,Y=null,Mt=Nt&&Dr(this.target,t)?setInterval(()=>{try{$t(C,Nt,o,n)}catch(R){m("warn","runtime.cli","codex transcript stream poll failed",{target:this.agent.targetCode,sessionId:o,error:String(R?.message||R)})}},Ge(this.target)):null;Mt?.unref?.();let ge=setTimeout(()=>{he=!0,m("warn","runtime.cli","runtime prompt timed out; terminating child",{target:this.agent.targetCode,sessionId:o,pid:y.pid,timeoutMs:w}),ht(y,"SIGTERM"),it=setTimeout(()=>{m("warn","runtime.cli","runtime prompt force killing child",{target:this.agent.targetCode,sessionId:o,pid:y.pid}),ht(y,"SIGKILL")},ve),it.unref?.(),Z(Object.assign(new Error(`runtime CLI timed out after ${w}ms`),{code:"RUNTIME_CLI_TIMEOUT"}))},w);ge.unref?.();let _e=()=>{clearTimeout(ge),Y&&clearTimeout(Y),Mt&&clearInterval(Mt),it&&!he&&clearTimeout(it),Kr(p,{target:this.agent.targetCode,sessionId:o}),this.active.delete(o),C.emitTerminal=null},vn=R=>{X||(X=!0,_e(),G(R))},Z=R=>{X||(X=!0,_e(),Hn(R))};C.emitTerminal=R=>{let $={...c(R.result)?R.result:{},_artifacts:[...C.artifacts.values()]};try{r?.({...R,result:$})}catch(H){m("warn","runtime.cli","runtime terminal listener failed",{target:this.agent.targetCode,sessionId:o,error:String(H?.message||H)})}let U=Math.max(0,S(this.target.terminalExitGraceMs,xr));Y=setTimeout(()=>{Y=null,!(X||this.active.get(o)!==y)&&(m("warn","runtime.cli","runtime stayed alive after terminal event; terminating child",{target:this.agent.targetCode,sessionId:o,pid:y.pid,terminalProtocol:C.terminalProtocol,graceMs:U}),Pt(y))},U),Y.unref?.()},y.on("error",R=>{m("warn","runtime.cli","runtime child error",{target:this.agent.targetCode,sessionId:o,pid:y.pid,error:String(R?.message||R)}),Z(R)}),y.on("exit",(R,$)=>{(async()=>{At==="json-lines"&&C.value.trim()&&this.handleStdout(`
-`,At,C,o,n);let U=await ls(C,Nt,o,n,T,this.target);(U.artifactCount>0||U.textCount>0||U.thoughtCount>0)&&m("info","runtime.cli","codex transcript updates collected",{target:this.agent.targetCode,sessionId:o,artifactCount:U.artifactCount,textCount:U.textCount,finalTextCount:U.finalTextCount,thoughtCount:U.thoughtCount,transcriptCount:U.transcriptCount});let H=pe.trim();if(H&&m("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:o,stderr:H}),m("info","runtime.cli","runtime prompt finished",{target:this.agent.targetCode,sessionId:o,pid:y.pid,exitCode:R,signal:$,artifactCount:C.artifacts.size,finalTextSeen:C.finalTextSeen}),C.terminalOutcome?.status==="failed"){Z(C.terminalOutcome.error);return}if(R!==0&&C.terminalOutcome?.status!=="completed"){let jn=Object.assign(new Error(`runtime CLI exited with code ${R??"unknown"}${$?` (${$})`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:R,signal:$});Z(jn);return}vn({stopReason:"end_turn",exitCode:R,signal:$,_artifacts:[...C.artifacts.values()],...H?{stderr:H}:{}})})().catch(Z)})})}buildArgs(t,n){let r=N(this.target.args);return t==="args"?[...r,n]:r}handleStdout(t,n,r,s,i){if(n!=="json-lines"){i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:t}}});return}r.value+=t;let o=r.value.split(/\r?\n/);r.value=o.pop()||"";for(let u of o){let l=u.trim();if(l)try{let d=JSON.parse(l);Ke(r,Be(d,r.artifactOptions)),i({sessionId:s,update:{sessionUpdate:"runtime_event",event:qe(d)}});let f=je(d),p=vt(d);f&&r.emitThoughtChunks&&!p&&br(d)?Je(r,s,i,f):f&&vr(r,p)&&ze(r,s,i,f),f&&p&&(r.finalTextSeen=!0);let h=Ur(d,r.terminalProtocol);h&&!r.terminalOutcome&&(h.status==="failed"||r.finalTextSeen||r.artifacts.size>0)&&(r.terminalOutcome=h,r.emitTerminal?.(h))}catch{i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:`${u}
-`}}})}}}async sessionCancel(t){let n=a(t.sessionId),r=this.active.get(n);return r?(m("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:n,pid:r.pid}),Pt(r),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}stop(t="stop"){for(let[n,r]of this.active.entries())m("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:n,pid:r.pid,reason:t}),Pt(r);this.active.clear()}};var Bt="ORCHA_RUNTIME_OUTPUT_START",Kt="ORCHA_RUNTIME_OUTPUT_END",qt="ORCHA_RUNTIME_CONTROL_START",Gt="ORCHA_RUNTIME_CONTROL_END",Qe=Bt,tn=Kt,en=qt,nn=Gt,zt=[Bt,Kt,qt,Gt],ds=new Set(["_artifacts","_decision","_meta"]),fs=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${zt.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),b=class extends Error{constructor(t,n){super(n),this.name="RuntimeResultProtocolError",this.code=t}};function rn(e){let t=typeof e=="string"?e.trimStart():"";return zt.some(n=>t.startsWith(n))}function sn(e){if(typeof e!="string")return null;let t=e,n=ms(t);if(![...n.values()].some(g=>g.length>0))return null;let r=[],s=[];for(let[g,I]of n)I.length===0?r.push(g):I.length>1&&s.push(g);if(r.length>0||s.length>0){let g=[];throw r.length>0&&g.push(`\u7F3A\u5C11 ${r.join(", ")}`),s.length>0&&g.push(`\u91CD\u590D ${s.join(", ")}`),new b("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${g.join("\uFF1B")}`)}let i=n.get(Bt)[0],o=n.get(Kt)[0],u=n.get(qt)[0],l=n.get(Gt)[0];if(!(i.end<=o.start&&o.end<=u.start&&u.end<=l.start))throw new b("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757");let d=ps(t.slice(i.end,o.start));if(!d.trim())throw new b("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A");let f=t.slice(u.end,l.start).trim();if(!f)throw new b("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A");let p;try{p=JSON.parse(f)}catch(g){throw new b("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(g?.message||g)}`)}if(!Ze(p))throw new b("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61");let h=Object.keys(p).filter(g=>!ds.has(g)).sort();if(h.length>0)throw new b("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${h.join(", ")}`);if("_artifacts"in p&&!Array.isArray(p._artifacts))throw new b("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4");for(let g of["_decision","_meta"])if(g in p&&!Ze(p[g]))throw new b("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${g} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`);return{output:d,...p}}function ms(e){let t=new Map(zt.map(n=>[n,[]]));for(let n of e.matchAll(fs))t.get(n.groups.marker).push({start:n.index,end:n.index+n[0].length});return t}function ps(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",n=t?e.slice(t.length):e;return t&&n.endsWith(t)?n.slice(0,-t.length):n}function Ze(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as hs}from"node:crypto";var gs="orcha.goal-contract/v1",_s=new Set(["complete","completed","done","ok","passed","success","succeeded"]),Ts=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),ys=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function Xt(e){return hs("sha256").update(j(e)).digest("hex")}function an(e){if(!un(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
-`)}function cn(e,t,n=""){if(!un(e))return e==null?null:{required:!0,status:"failed",outcome:a(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let r=Xt(e),s=e.verificationPlan.required===!0;if(a(n)&&a(n)!==r)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:r,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:r,checks:[]};let i=Ss(t),o=e.verificationPlan.checks.map(l=>xs(l,i));return{required:!0,status:o.some(l=>l.status==="failed")?"failed":o.some(l=>l.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:r,checks:o}}function un(e){if(!c(e)||e.schemaVersion!==gs||!a(e.outcome))return!1;let t=e.verificationPlan;if(!c(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let n=new Set;for(let r of t.checks)if(!c(r)||!a(r.id)||n.has(a(r.id))||(n.add(a(r.id)),!Array.isArray(r.toolNames)||r.toolNames.length===0||r.toolNames.some(s=>!a(s)))||r.arguments!==void 0&&!c(r.arguments))return!1;return!0}function Ss(e){let t=new Map,n=[];for(let r of Array.isArray(e)?e:[]){let s=c(r?.update)?r.update:{},i=a(s.sessionUpdate);if(i==="runtime_event"){ws(s.event,t,n);continue}if(i==="tool_call"){let o=yt(s)||`tool-${n.length+1}`,u=Tt(t,n,o),l=Wt(s,s.name||s.toolName||s.kind);u.toolName=l.toolName,u.arguments=l.arguments,u.status=rt(s.status),u.evidence=wt(s);continue}if(i==="tool_call_update"){let o=yt(s);if(!o)continue;let u=Tt(t,n,o),l=Wt(s,s.name||s.toolName||s.kind);u.toolName||=l.toolName,Object.keys(u.arguments).length===0&&(u.arguments=l.arguments),u.status=rt(s.status),u.evidence.push(...wt(s))}}return n}function ws(e,t,n){let r=c(e)&&c(e.payload)?e.payload:c(e)?e:{},s=a(r.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let u=yt(r)||`runtime-${n.length+1}`,l=Tt(t,n,u),d=Wt(r,r.name||r.tool||s,s);l.toolName=d.toolName,l.arguments=d.arguments,l.status=rt(r.status),l.evidence.push(...wt(r));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=yt(r);if(!i)return;let o=Tt(t,n,i);o.status=Is(r,o.toolName),o.evidence.push(...wt(r))}function Tt(e,t,n){let r=e.get(n);return r||(r={toolCallId:n,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(n,r),t.push(r)),r}function Rs(e){let t=a(e).toLowerCase();return ys.get(t)||t}function Wt(e,t,n=""){let r=Es(e),s=a(n)==="mcp_tool_call"||a(e?.kind).toLowerCase()==="mcp",i=c(e?._meta)?e._meta:{},o=a(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let u=a(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...r,...u?{operationCode:u}:{}}}}return{toolName:Rs(t),arguments:r}}function yt(e){return c(e)?a(e.call_id||e.callId||e.toolCallId||e.id):""}function Es(e){if(!c(e))return{};for(let n of["arguments","args","rawInput","input","params","parameters"]){let r=Os(e[n]);if(r)return r}let t={};for(let n of["cmd","command","cwd","operationCode","path","query","url"])e[n]!==void 0&&(t[n]=e[n]);return t}function Os(e){if(c(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return c(t)?t:null}catch{return null}}function Is(e,t){if(!c(e))return"unknown";let n=St(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return n.includes("failed")?"failed":n.includes("success")?"success":"unknown"}function St(e,t=0,n={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return Cs(e,t,n);if(Array.isArray(e))return e.flatMap(o=>St(o,t+1,n));if(!c(e))return[];let r=[];typeof e.isError=="boolean"&&r.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&r.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&r.push(e.success?"success":"failed");let s=rt(e.status);s!=="unknown"&&r.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&r.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&r.push(...St(e[o],t+1,n));return r}function Cs(e,t,n){let r=e.trim();if(!r)return[];try{return St(JSON.parse(r),t+1,n)}catch{}if(n.parseCliExitCode!==!0)return[];let s=[];for(let i of r.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function rt(e){let t=a(e).toLowerCase();return _s.has(t)?"success":Ts.has(t)?"failed":"unknown"}function wt(e){if(!c(e))return[];let t=c(e.output)?e.output:{},n=[e.verificationEvidence,c(e.verification)?e.verification.evidence:null,t.verificationEvidence,c(t.verification)?t.verification.evidence:null],r=[];for(let s of n)for(let i of Array.isArray(s)?s:s?[s]:[])!c(i)||!a(i.id)||r.push({id:a(i.id),status:rt(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...a(i.message)?{message:a(i.message)}:{}});return r}function xs(e,t){let n=t.filter(o=>e.toolNames.includes(o.toolName)&&Vt(e.arguments||{},o.arguments)),r=a(e.evidenceId),s=n.find(o=>o.status==="success"&&(!r||o.evidence.some(u=>u.id===r&&u.status==="success")));if(s)return Jt(e,"passed",s,"Runtime tool evidence passed.");let i=n.find(o=>o.status==="failed"||r&&o.evidence.some(u=>u.id===r&&u.status==="failed"));return i?Jt(e,"failed",i,"Runtime tool evidence failed."):Jt(e,"missing",n.at(-1),r?"Required evidence is missing.":"Required tool execution is missing.")}function Jt(e,t,n,r){return{id:e.id,status:t,message:r,...a(e.description)?{description:a(e.description)}:{},toolNames:e.toolNames,...c(e.arguments)?{arguments:e.arguments}:{},...a(e.evidenceId)?{evidenceId:a(e.evidenceId)}:{},...n?.toolCallId?{toolCallId:n.toolCallId}:{}}}function Vt(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((n,r)=>Vt(n,t[r])):c(e)?c(t)?Object.entries(e).every(([n,r])=>Object.hasOwn(t,n)&&Vt(r,t[n])):!1:Object.is(e,t)}function j(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return on(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,n)=>{if(!Object.hasOwn(e,n))throw new Error("invalid_jcs_json_value");return j(e[n])}).join(",")}]`;if(c(e))return`{${Object.keys(e).sort().map(t=>`${on(t)}:${j(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function on(e){return As(e),JSON.stringify(e)}function As(e){for(let t=0;t<e.length;t+=1){let n=e.charCodeAt(t);if(n>=55296&&n<=56319){let r=e.charCodeAt(t+1);if(!(r>=56320&&r<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(n>=56320&&n<=57343)throw new Error("invalid_jcs_unicode")}}var Yt=24e3,Zt=8,Qt=50,te=6e3,Ms=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),Us=10*60*1e3,bs=60*1e3,ks=8,Ls=30*60*1e3,Ps=60*1e3,Ds=1,Fs=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions","runtimeMaxSessions"]),$s=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function Hs(e){if(!c(e))return{};let t={};for(let n of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let r=a(e[n]);r&&(t[n]=r)}return t}function vs(e){return(Array.isArray(e)?e:[]).map(Hs).sort((t,n)=>{let r=j(t),s=j(n);return r<s?-1:r>s?1:0})}function js(e){return!c(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(n=>c(n)&&Array.isArray(n.toolNames)&&n.toolNames.some(r=>a(r)==="plugin_operation"))}function Bs(e,t,n){let r=c(e?._meta)?e._meta:{};return{...c(e)?e:{},sessionId:t,update:c(e?.update)?e.update:{},_meta:{...r,orchaAgentId:n.agentId,runtimeSessionId:n.runtimeSessionId,bridgeUpdateId:Rt()}}}function A(e){return e==null||e===""?!1:typeof e=="string"?a(e)!=="":Array.isArray(e)?e.length>0:c(e)?Object.keys(e).length>0:!0}function hn(e){let t=a(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return Ms.has(t)}function D(e,t){let n=S(e,t);return Number.isFinite(n)&&n>0?n:t}function ne(e){let t=S(e,null);return Number.isFinite(t)&&t>0?t:null}function st(e,t=!1){if(typeof e=="boolean")return e;let n=a(e).toLowerCase();return["true","1","yes","y","on"].includes(n)?!0:["false","0","no","n","off"].includes(n)?!1:t}function P(e){return a(e?.type||"echo")}function Ks(e){let t=P(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function re(e){if(c(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function qs(e){let t=String(e||"");if($s.test(t))return!0;let n=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return n.endsWith("token")||n.endsWith("secret")||n.endsWith("password")||n.endsWith("apikey")||n.endsWith("privatekey")||n==="authorization"||n==="cookie"||n==="jwt"||n.includes("credential")}function se(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=te)return e;let n=e.length-te;return`${e.slice(0,te)}... [truncated ${n} characters]`}if(t>=Zt)return Array.isArray(e)?`[array truncated at depth ${Zt}, items=${e.length}]`:c(e)?`[object truncated at depth ${Zt}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let n=e.slice(0,Qt).map(r=>se(r,t+1));return e.length>Qt&&n.push(`[truncated ${e.length-Qt} items]`),n}if(c(e)){let n={};for(let[r,s]of Object.entries(e))n[r]=qs(r)?"[REDACTED]":se(s,t+1);return n}return String(e)}var Gs=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function zs(e){if(!c(e))return e;let t={};for(let n of Gs)A(e[n])&&(t[n]=e[n]);return t}function Js(e){if(!c(e))return e;let t={...e};return c(t.renderedPayload)&&(t.renderedPayload=zs(t.renderedPayload)),t}function Ws(e){let t=c(e)?e:{},n={};A(t.metadata)&&(n.metadata=Js(t.metadata));for(let[r,s]of Object.entries(t))Fs.has(r)||r==="metadata"||A(s)&&(n[r]=s);return n}function Vs(e){let t=c(e)?e:{},n=c(t.metadata)?t.metadata:{},r=c(n.renderedPayload)?n.renderedPayload:{};return c(t.resultContract)?t.resultContract:c(r.resultContract)?r.resultContract:{}}function gn(e){return a(Vs(e).kind).toLowerCase()==="decision"}function ln(e){let t=c(e)?e:{},n=c(t.metadata)?t.metadata:{};return ne(t.runtimeMaxSessions??n.runtimeMaxSessions)}function Xs(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:P(e)==="cli"}function dn(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return st(t,Ks(e))}function Ys(e,t){let n=c(e?.metadata)?{...e.metadata}:{},r=c(n._runtimeBridge)?{...n._runtimeBridge}:{},s=re(r);return n._runtimeBridge={...r,promptKind:"dispatch",finalTextOnly:Xs(t),releaseAfterPrompt:s===void 0?dn(t):st(s,dn(t)),requiresRuntimeResult:gn(e)},n}function Zs(e){let t=Ws(e);if(!A(t))return"";let n=JSON.stringify(se(t),null,2);if(n.length<=Yt)return n;let r=n.length-Yt;return`${n.slice(0,Yt)}
-... [truncated ${r} characters]`}function _n(e){if(!c(e))return"";let t=c(e.update)?e.update:e,r=(c(t.content)?t.content:{}).text??t.text;return r==null?"":String(r)}function Qs(e){if(!c(e))return"";let t=c(e.update)?e.update:e;return a(t.sessionUpdate)}function ti(e){if(!Array.isArray(e))return"";let t=!1,n=[],r=[],s=[],i=()=>{n.length>0&&(r.push(n),n=[])};for(let u of e){let l=Qs(u),d=_n(u);if(!l){d&&s.push(d);continue}if(t=!0,l==="agent_message_chunk"){d&&n.push(d);continue}(l==="agent_thought_chunk"||l==="user_message_chunk"||l==="tool_call"||l==="tool_call_update"||l==="plan")&&i()}if(i(),!t)return ie(s);let o=r[r.length-1]||[];return ie(o)}function ei(e){return Array.isArray(e)?e.map(_n).filter(t=>a(t)):[]}function ni(e){if(!c(e))return null;let t=c(e.update)?e.update:e;return a(t.sessionUpdate)!=="runtime_event"?null:c(t.event)?t.event:null}function ri(e){if(!c(e))return"";let t=c(e.payload)?e.payload:{},n=a(e.type),r=a(t.type);if(n==="event_msg"){if(r==="task_complete")return a(t.last_agent_message||t.message||t.output);if(r==="agent_message"){let s=a(t.phase||t.status||t.stage).toLowerCase();if(["final_answer","final","complete","completed","done"].includes(s))return a(t.message||t.text||t.content)}}return""}function si(e){if(!Array.isArray(e))return"";for(let t=e.length-1;t>=0;t-=1){let n=ri(ni(e[t]));if(n)return n}return""}function ie(e){let t="";for(let n of e){let r=String(n||"");if(r){if(!t)t=r;else if(r.startsWith(t))t=r;else if(!t.endsWith(r)){let s=rn(r)&&!/[\r\n]$/.test(t)?`
-`:"";t+=`${s}${r}`}}}return t.trim()}function ii(e){let t=String(e||"").trim();if(!t)return"";let n=t.match(/(?:^|\n)#{1,3}\s+\S/);return!n||n.index===0?t:t.slice(n.index+(t[n.index]===`
-`?1:0)).trim()}function fn(e){let t=String(e||"").trim();if(!t)return null;try{let n=JSON.parse(t);if(c(n)&&(Tn(n)||A(n._artifacts)||A(n.artifacts)||A(n._decision)||A(n._meta)))return n}catch{}return null}function Et(e){try{return sn(e)}catch{return null}}function mn(e){let t=String(e||"").trim();if(!t)return null;let n=Et(t);if(n)return n;let r=[...t.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)];for(let s=r.length-1;s>=0;s-=1){let i=fn(r[s][1]);if(i)return i}if(!t.endsWith("}"))return null;for(let s=t.lastIndexOf("{");s>=0;s=t.lastIndexOf("{",s-1)){let i=fn(t.slice(s));if(i)return i}return null}function oi(e){let t=ei(e);for(let n=t.length-1;n>=0;n-=1){let r=Et(t[n]);if(r)return r}return Et(ie(t))}function Tn(e){if(!c(e))return!1;if(A(e.output))return!0;for(let t of["content","text","message","summary"])if(a(e[t]))return!0;return!!(hn(e.status)||a(e.error)||a(e.errorMessage))}function L(e){let t=c(e)?{...e}:{};return(!Array.isArray(t._artifacts)||t._artifacts.length===0)&&Array.isArray(t.artifacts)&&t.artifacts.length>0&&(t._artifacts=t.artifacts),delete t.artifacts,t}function ai(e){return c(e)?typeof(c(e._decision)?e._decision:c(e.decision)?e.decision:e).passed=="boolean":!1}function ci(e){return c(e)?c(e._decision)&&typeof e._decision.passed=="boolean"?!0:ai(e.output):!1}function ee(e,t,n){let r=c(e)?{...e}:{};if(!A(r.output)){for(let s of["summary","message","content","text"])if(a(r[s])){r.output=a(r[s]);break}}return!A(r.output)&&a(n)&&(r.output=a(n)),{...r,_meta:{...c(r._meta)?r._meta:{},runtimeOutputSource:t,requiredRuntimeResult:!0,finalMessagePreview:a(n).slice(0,1e3)}}}var ui=["dataUrl","dataURL","contentDataUrl","contentDataURL","contentBase64","base64","data"];function pn(e){if(!c(e))return"";let t=c(e.content)?e.content:{},n=c(e.metadata)?e.metadata:{};return a(e.fieldKey||e.field_key||t.fieldKey||n.fieldKey)}function li(e,t){let n=c(e.content)?e.content:{},r=c(t.content)?t.content:{},s={...e,...t,content:{...n,...r},metadata:{...c(e.metadata)?e.metadata:{},...c(t.metadata)?t.metadata:{}}};for(let i of ui)A(e[i])&&(s[i]=e[i]),A(n[i])&&(s.content[i]=n[i]);return s}function di(e,t){let n=Array.isArray(e)?e.filter(c):[],r=Array.isArray(t)?t.filter(c):[];if(!n.length)return r;if(!r.length)return n;let s=[...n],i=new Map;for(let u=0;u<n.length;u+=1){let l=pn(n[u]),d=i.get(l)||[];d.push(u),i.set(l,d)}let o=new Map;for(let u of r){let l=pn(u),d=o.get(l)||0;o.set(l,d+1);let f=i.get(l)?.[d];f===void 0?s.push(u):s[f]=li(s[f],u)}return s}function F(e,t,n){let r={...e,...t,_meta:{...c(e._meta)?e._meta:{},...c(t._meta)?t._meta:{},runtimeOutputSource:n}};return(Array.isArray(e._artifacts)||Array.isArray(t._artifacts))&&(r._artifacts=di(e._artifacts,t._artifacts)),r}function fi(e,t,n={}){let r=a(n.promptKind),s=n.requiresRuntimeResult===!0,i=s||r==="dispatch",o=L(e),u=typeof o.output=="string"?Et(o.output):null;if(u)return F(o,L(u),"result_block");let l=si(t),d=l?mn(l):null,f=i?oi(t):null;if(Tn(o))return hn(o.status)||a(o.error)||a(o.errorMessage)?o:r==="dispatch"&&d?F(o,L(d),"final_event"):r==="dispatch"&&f?F(o,L(f),"updates"):!s||ci(o)?o:d?F(o,L(d),"final_event"):f?F(o,L(f),"updates"):ee(o,"result",o.output);if(d)return F(o,L(d),"final_event");if(f)return F(o,L(f),"updates");if(l)return s?ee(o,"final_event",l):{...o,output:l,_meta:{...c(o._meta)?o._meta:{},runtimeOutputSource:"final_event"}};let p=ii(ti(t));if(!p)return o;let h=mn(p);return h?F(o,L(h),"updates"):s?ee(o,"updates",p):{...o,output:p,_meta:{...c(o._meta)?o._meta:{},runtimeOutputSource:"updates"}}}var Ot=class{constructor(t){this.config=t,this.targets=t.targets||{},this.agents=new Map,this.sessions=new Map,this.runtimeSessionIndex=new Map,this.pendingPermissions=new Map,this.operations=new Map,this.startedAt=Q(),this.cleanupTimer=null,this.startSessionCleanup()}operationIdentity(t,n,r){let s=c(t.goalContract)?Xt(t.goalContract):a(t.goalContractHash),i=Ns("sha256").update(j({prompt:Array.isArray(t.prompt)?t.prompt:[],mcpServers:vs(t.mcpServers)})).digest("hex");return{agentId:n,sessionId:r,targetCode:a(t.targetCode||t.framework),workspace:a(t.workspace),goalContractHash:s,requestHash:i}}assertOperationIdentity(t,n,r,s){let i=this.operationIdentity(n,r,s),o=Object.keys(t.identity).find(u=>t.identity[u]!==i[u]);if(o)throw Object.assign(new Error(`runtime operation correlation conflict: ${t.correlationId}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT",field:o})}createOperation(t,n,r,s){let i={correlationId:t,agentId:r,sessionId:s,identity:this.operationIdentity(n,r,s),status:"running",updates:[],listeners:new Set,waiters:[],response:null,error:null,createdAtMs:Date.now(),completedAtMs:null};return this.operations.set(t,i),i}async attachOperation(t,n={}){let r=()=>{if(n.onUpdate)for(let s of t.updates)n.onUpdate(s)};if(t.status==="completed")return r(),t.response;if(t.status==="failed")throw r(),t.error;n.onUpdate&&t.listeners.add(n.onUpdate);try{return r(),await new Promise((s,i)=>t.waiters.push({resolve:s,reject:i}))}finally{n.onUpdate&&t.listeners.delete(n.onUpdate)}}completeOperation(t,n){if(t.status==="running"){t.status="completed",t.response=n,t.completedAtMs=Date.now();for(let r of t.waiters.splice(0))r.resolve(n);t.listeners.clear()}}promptResponse(t,n,r,s,i){let o=c(t.metadata)?t.metadata:{},u=c(o._runtimeBridge)?o._runtimeBridge:{},l=fi(i,s,u),d=cn(t.goalContract,s,t.goalContractHash);return{sessionId:r,runtimeSessionId:n.runtimeSessionId,result:l,updates:s,...d?{verification:d}:{}}}failOperation(t,n){if(t.status!=="running")return;let r=n instanceof Error?n:Object.assign(new Error(String(n||"runtime operation failed")),{code:"RUNTIME_NODE_ERROR"});t.status="failed",t.error=r,t.completedAtMs=Date.now();for(let s of t.waiters.splice(0))s.reject(r);t.listeners.clear()}cleanupOperations(t=Date.now()){let n=D(this.config.operationTtlMs,Ls);for(let[r,s]of this.operations)s.status!=="running"&&t-(s.completedAtMs||s.createdAtMs)>n&&this.operations.delete(r)}targetFor(t){let n=a(t)||this.config.defaultTargetCode,r=this.targets[n];if(!n||!c(r)){let s=new Error(`runtime target is not configured: ${n||"<empty>"}`);throw s.code="RUNTIME_TARGET_NOT_FOUND",s}return{code:n,target:r}}targetIdleTtlMs(t){let r=P(t)==="openclaw"?D(this.config.openClawSessionIdleTtlMs,Ps):D(this.config.sessionIdleTtlMs,Us);return D(t?.sessionIdleTtlMs??t?.idleTtlMs,r)}targetMaxSessions(t,n=null){let s=P(t)==="openclaw"?D(this.config.openClawMaxSessions,Ds):D(this.config.maxSessionsPerTarget,ks),i=D(t?.maxSessions,s),o=ne(n);return o?Math.max(i,o):i}targetReleaseAfterPrompt(t,n={}){let r=P(t),s=c(n?._runtimeBridge)?n._runtimeBridge:{},i=re(s);return i!==void 0?st(i,!1):st(t?.releaseAfterPrompt??t?.disposeAfterPrompt,r==="openclaw")}promptReleaseAfterPrompt(t,n={}){let r=c(n?._runtimeBridge)?n._runtimeBridge:{},s=re(r);return s!==void 0?st(s,t.releaseAfterPrompt):t.releaseAfterPrompt}startSessionCleanup(){let t=D(this.config.sessionCleanupIntervalMs,bs);t<=0||(this.cleanupTimer=setInterval(()=>{this.cleanupExpiredSessions().catch(n=>{m("warn","runtime-bridge","runtime session cleanup failed",{error:String(n)})})},t),this.cleanupTimer.unref?.())}sessionCountForTarget(t){let n=0;for(let r of this.sessions.values())r.targetCode===t&&(n+=1);return n}sessionCountForAgentTarget(t,n){let r=0;for(let s of this.sessions.values())s.agentId===t&&s.targetCode===n&&(r+=1);return r}idleTargetSessions(t){return[...this.sessions.entries()].filter(([,n])=>n.targetCode===t&&!n.busy).sort((n,r)=>(n[1].lastUsedAtMs||0)-(r[1].lastUsedAtMs||0))}idleAgentTargetSessions(t,n){return[...this.sessions.entries()].filter(([,r])=>r.agentId===t&&r.targetCode===n&&!r.busy).sort((r,s)=>(r[1].lastUsedAtMs||0)-(s[1].lastUsedAtMs||0))}async closeSession(t,n="session_closed"){let r=this.sessions.get(t);if(!r)return!1;try{await r.runtime?.stop?.(n)}catch(s){m("warn","runtime-bridge","runtime session stop failed",{sessionId:r.sessionId,runtimeSessionId:r.runtimeSessionId,targetCode:r.targetCode,runtimeKind:r.runtimeKind,error:String(s)})}return this.sessions.delete(t),this.runtimeSessionIndex.delete(`${r.agentId}:${r.runtimeSessionId}`),m("info","runtime-bridge","runtime session closed",{sessionId:r.sessionId,runtimeSessionId:r.runtimeSessionId,targetCode:r.targetCode,runtimeKind:r.runtimeKind,reason:n}),!0}async closeAllSessions(t="bridge_shutdown"){for(let n of[...this.sessions.keys()])await this.closeSession(n,t)}async stop(t="bridge_stop"){this.cleanupTimer&&clearInterval(this.cleanupTimer),this.cleanupTimer=null,await this.closeAllSessions(t)}async cleanupExpiredSessions(t=Date.now()){for(let[n,r]of[...this.sessions.entries()])r.busy||t-(r.lastUsedAtMs||r.createdAtMs||t)>r.idleTtlMs&&await this.closeSession(n,"idle_timeout")}async reserveTargetSlot(t,n,r={}){let s=a(r.agentId),i=ne(r.runtimeMaxSessions);if(s&&i)for(;this.sessionCountForAgentTarget(s,t)>=i;){let u=this.idleAgentTargetSessions(s,t);if(!u.length){let l=new Error(`runtime agent session limit reached: ${s}`);throw l.code="RUNTIME_AGENT_SESSION_LIMIT",l}await this.closeSession(u[0][0],"agent_session_limit")}let o=this.targetMaxSessions(n,i);for(;this.sessionCountForTarget(t)>=o;){let u=this.idleTargetSessions(t);if(!u.length){let l=new Error(`runtime target session limit reached: ${t}`);throw l.code="RUNTIME_TARGET_SESSION_LIMIT",l}await this.closeSession(u[0][0],"target_session_limit")}}async createAgent(t){let n=a(t.agentId);if(!n)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});let{code:r,target:s}=this.targetFor(t.targetCode||t.framework),i=this.agents.get(n);if(i&&i.targetCode!==r)throw Object.assign(new Error(`runtime agent target conflict: ${n}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});let o={agentId:n,targetCode:r,framework:a(t.framework||r),workspace:a(t.workspace),metadata:c(t.metadata)?t.metadata:{},createdAt:Q(),runtimeKind:P(s),runtimeMaxSessions:ln(t)};return this.agents.set(n,o),{agent:o}}runtimeFor(t,n){let{target:r}=this.targetFor(t.targetCode),s=P(r),i={onPermissionRequest:u=>this.requestPermission(u)},o={sessionPromptTimeoutMs:this.config.sessionPromptTimeoutMs};return s==="stdio-acp"||s==="acp"?new J(t,r,i,o):s==="openclaw"?new dt(t,r,n,i,o):s==="cli"?new _t(t,r,o):new at(t)}async prompt(t,n={}){let r=a(t.agentId),s=a(t.sessionId)||Rt(),i=a(t.correlationId);if(!r)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});if(this.cleanupOperations(),i){let u=this.operations.get(i);if(u)return this.assertOperationIdentity(u,t,r,s),this.attachOperation(u,n);if(t.attachOnly===!0)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"})}else if(t.attachOnly===!0)throw Object.assign(new Error("correlationId is required for attachOnly"),{code:"BAD_REQUEST"});let o=i?this.createOperation(i,t,r,s):null;if(o){let u=this.attachOperation(o,n);return(async()=>{try{await this._promptOwned(t,{},o,r,s)}catch(l){let d=o.status==="completed";this.failOperation(o,l),d&&m("warn","runtime-bridge","runtime cleanup failed after operation completion",{correlationId:o.correlationId,error:String(l)})}})(),await u}return await this._promptOwned(t,n,o,r,s)}async _promptOwned(t,n,r,s,i){let o=this.agents.get(s),u=this.targetFor(t.targetCode||t.framework||o?.targetCode);if(o&&o.targetCode!==u.code)throw Object.assign(new Error(`runtime agent target conflict: ${s}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});if(P(u.target)==="cli"&&js(t.goalContract))throw Object.assign(new Error("CLI runtimes do not support per-run dynamic MCP required by plugin_operation"),{code:"unsupported_dynamic_mcp"});let l=o||(await this.createAgent({agentId:s,targetCode:u.code,framework:t.framework,workspace:t.workspace,runtimeMaxSessions:t.runtimeMaxSessions,metadata:t.metadata})).agent,d=ln(t);d&&(l.runtimeMaxSessions=d);let f=a(t.workspace);f&&f!==l.workspace&&(l.workspace=f);let p=`${s}:${i}`;await this.cleanupExpiredSessions();let h=this.sessions.get(p);if(h&&h.targetCode!==u.code)throw Object.assign(new Error(`runtime session target conflict: ${i}`),{code:"RUNTIME_SESSION_TARGET_CONFLICT"});if(!h){let{code:_,target:T}=u;await this.reserveTargetSlot(_,T,{agentId:s,runtimeMaxSessions:l.runtimeMaxSessions});let w=this.runtimeFor(l,i),E=await w.sessionNew({cwd:l.workspace||process.cwd(),mcpServers:Array.isArray(t.mcpServers)?t.mcpServers:[],metadata:c(t.metadata)?t.metadata:{}}),y=Date.now();h={agentId:s,sessionId:i,runtime:w,targetCode:_,runtimeKind:P(T),runtimeSessionId:a(c(E)?E.sessionId:"")||i,idleTtlMs:this.targetIdleTtlMs(T),releaseAfterPrompt:this.targetReleaseAfterPrompt(T,t.metadata),createdAtMs:y,lastUsedAtMs:y,busy:!1,createdAt:Q()},this.sessions.set(p,h),this.runtimeSessionIndex.set(`${s}:${h.runtimeSessionId}`,h)}if(h.busy){let _=new Error(`runtime session is already running: ${i}`);throw _.code="RUNTIME_SESSION_BUSY",_}h.busy=!0,h.operationCorrelationId=r?.correlationId||null,h.lastUsedAtMs=Date.now();let g=r?.updates||[],I=_=>{let T=Bs(_,i,h);if(g.push(T),r)for(let w of r.listeners)try{w?.(T)}catch(E){m("warn","runtime-bridge","runtime operation update listener failed",{correlationId:r.correlationId,error:String(E)})}else n.onUpdate?.(T)},q=_=>{if(!(!r||r.status!=="running"||!c(_))){if(_.status==="failed"){let T=_.error;if(T instanceof Error){this.failOperation(r,T);return}let w=c(T)?T:{},E=Object.assign(new Error(a(w.message||_.message)||"runtime terminal failure"),{code:a(w.code||_.code)||"RUNTIME_TERMINAL_FAILED"});this.failOperation(r,E);return}this.completeOperation(r,this.promptResponse(t,h,i,g,c(_.result)?_.result:{stopReason:"end_turn"}))}};try{let _=an(t.goalContract),T=Array.isArray(t.prompt)?[...t.prompt]:[];_&&T.unshift({type:"text",text:_,metadata:{source:"orcha_goal_contract"}});let w=await h.runtime.sessionPrompt({sessionId:h.runtimeSessionId,prompt:T,metadata:c(t.metadata)?t.metadata:{}},I,q),E=this.promptResponse(t,h,i,g,w);return r&&this.completeOperation(r,E),E}finally{h.busy=!1,h.operationCorrelationId===r?.correlationId&&(h.operationCorrelationId=null),h.lastUsedAtMs=Date.now(),this.promptReleaseAfterPrompt(h,c(t.metadata)?t.metadata:{})&&await this.closeSession(p,"release_after_prompt")}}async cancel(t){let n=a(t.agentId),r=a(t.sessionId),s=a(t.correlationId);if(s){let u=this.operations.get(s);if(!u||u.status!=="running")return{cancelled:!1,correlationId:s,reason:"operation_not_running"};if(u.agentId!==n||u.sessionId!==r)throw Object.assign(new Error(`runtime operation cancellation identity conflict: ${s}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let l=this.sessions.get(`${n}:${r}`);return!l||l.busy!==!0||l.operationCorrelationId!==s?{cancelled:!1,correlationId:s,reason:"operation_not_running"}:(await l.runtime.sessionCancel({sessionId:l.runtimeSessionId}),await this.closeSession(`${n}:${r}`,"cancelled"),{cancelled:!0,correlationId:s})}let i=`${n}:${r}`,o=this.sessions.get(i);return o?(await o.runtime.sessionCancel({sessionId:o.runtimeSessionId}),await this.closeSession(i,"cancelled"),{cancelled:!0}):{cancelled:!1}}async dispatch(t,n={}){let r=a(t.agentId),s=a(t.taskId),i=a(t.executionId);if(!r||!s)throw Object.assign(new Error("agentId and taskId are required"),{status:400,code:"BAD_REQUEST"});let o=a(t.sessionId)||`dispatch-${i||s}`,u=a(t.instructions),l=Zs(t),d=gn(t),{target:f}=this.targetFor(t.targetCode||t.framework),p=[{type:"text",text:["Task dispatch received.",`taskId: ${s}`,i?`executionId: ${i}`:"",u?`instructions: ${u}`:"",l?"orchaContext:":"",l,l?"Use orchaContext as the source of truth for upstream outputs, review reports, artifacts, and workflow metadata.":"","Follow the execution protocol in instructions exactly.","When embedding a generated artifact in final Markdown, use the Orcha artifact placeholder as the link target: orcha-artifact://<fieldKey>/<index>.","Example: use ![illustration](orcha-artifact://image/0) for the first generated image artifact.","Do not use local filesystem paths, file:// URLs, or data: URLs in final Markdown; Orcha replaces artifact placeholders after ingestion.",d?`For decision results, put the raw report between ${Qe} and ${tn}.`:"",d?`Then put a JSON object containing _decision between ${en} and ${nn}.`:"",d?"Do not JSON-escape the report. Keep output out of the CONTROL JSON, and put every protocol marker on its own line.":"","Return only the final answer required by that protocol.","Do not include process notes, logs, or explanations."].filter(Boolean).join(`
-`)}];return this.prompt({...t,agentId:r,sessionId:o,prompt:p,metadata:Ys(t,f)},n)}async requestPermission({agent:t,runtimeSessionId:n,request:r,emitUpdate:s}){let i=Rt(),u=this.runtimeSessionIndex.get(`${t.agentId}:${n}`)?.sessionId||n||Rt(),l={permissionId:i,agentId:t.agentId,sessionId:u,runtimeSessionId:n,request:c(r)?r:{},status:"pending",createdAt:Q()};return s?.({sessionId:n,update:{sessionUpdate:"permission_request",permission:l}}),await new Promise(d=>{let f=S(r?.timeoutMs,this.config.permissionRequestTimeoutMs),p=setTimeout(()=>{this.pendingPermissions.delete(i),d({permissionId:i,outcome:"denied",response:{reason:"permission request timed out"}})},f);this.pendingPermissions.set(i,{timer:p,resolve:d,permission:l})})}async respondPermission(t){let n=a(t.permissionId),r=this.pendingPermissions.get(n),s=a(t.outcome||"approved")||"approved";return r?(clearTimeout(r.timer),this.pendingPermissions.delete(n),r.resolve({permissionId:n,outcome:s,response:c(t.response)?t.response:{},userId:a(t.userId),metadata:c(t.metadata)?t.metadata:{}}),{accepted:!0,permissionId:n,outcome:s}):{accepted:!1,permissionId:n,outcome:s}}health(){return{status:"ok",bridgeVersion:z,startedAt:this.startedAt,agents:[...this.agents.values()].map(t=>({agentId:t.agentId,targetCode:t.targetCode,framework:t.framework,runtimeKind:t.runtimeKind})),sessions:this.sessions.size,pendingPermissions:this.pendingPermissions.size,targets:Object.keys(this.targets)}}};import mi from"node:http";import pi from"node:https";import{randomBytes as yn}from"node:crypto";var W=1,B=3,hi=1e4,It=class{constructor(t,n={}){this.url=t,this.readyState=0,this.socket=null,this.request=null,this.buffer=Buffer.alloc(0),this.listeners=new Map,this.connectTimeoutMs=gi(n.connectTimeoutMs,hi),this.connectTimer=null,this.connect()}addEventListener(t,n){let r=this.listeners.get(t)||new Set;r.add(n),this.listeners.set(t,r)}emit(t,n={}){let r=this.listeners.get(t);if(r)for(let s of r)s(n)}connect(){let t=new URL(this.url),n=t.protocol==="wss:"?pi:mi,r=yn(16).toString("base64"),s=n.request({protocol:t.protocol==="wss:"?"https:":"http:",hostname:t.hostname,port:t.port||(t.protocol==="wss:"?443:80),path:`${t.pathname}${t.search}`,method:"GET",headers:{Connection:"Upgrade",Upgrade:"websocket","Sec-WebSocket-Key":r,"Sec-WebSocket-Version":"13"}});this.request=s,this.startConnectTimer(s),s.on("upgrade",(i,o,u)=>{if(this.clearConnectTimer(),this.readyState===B){o.destroy();return}this.socket=o,this.readyState=W,o.on("data",l=>this.onData(l)),o.on("close",()=>this.onClose()),o.on("error",l=>{this.readyState!==B&&this.emit("error",{error:l,message:l.message,type:"error"}),this.onClose()}),u?.length&&this.onData(u),this.emit("open")}),s.on("response",i=>{this.clearConnectTimer(),this.emit("error",{message:`websocket upgrade failed: HTTP ${i.statusCode}`,type:"error"}),i.resume(),this.onClose()}),s.on("error",i=>{this.clearConnectTimer(),this.readyState!==B&&this.emit("error",{error:i,message:i.message,type:"error"}),this.onClose()}),s.end()}startConnectTimer(t){this.connectTimeoutMs<=0||(this.connectTimer=setTimeout(()=>{if(this.readyState===W||this.readyState===B)return;let n=`websocket connect timeout after ${this.connectTimeoutMs}ms`;this.emit("error",{message:n,type:"timeout"}),this.onClose(),t.destroy(new Error(n))},this.connectTimeoutMs),this.connectTimer.unref?.())}clearConnectTimer(){this.connectTimer&&(clearTimeout(this.connectTimer),this.connectTimer=null)}send(t){!this.socket||this.readyState!==W||this.socket.write(oe(1,Buffer.from(String(t),"utf8")))}close(){if(this.readyState!==B){if(this.clearConnectTimer(),!this.socket){this.request?.destroy(),this.onClose();return}try{this.readyState===W&&this.socket.write(oe(8,Buffer.alloc(0))),this.socket.end()}catch{this.socket.destroy()}this.onClose()}}onClose(){this.readyState!==B&&(this.clearConnectTimer(),this.readyState=B,this.request=null,this.emit("close"))}onData(t){for(this.buffer=Buffer.concat([this.buffer,t]);this.buffer.length>=2;){let n=this.buffer[0],r=this.buffer[1],s=n&15,i=(r&128)!==0,o=r&127,u=2;if(o===126){if(this.buffer.length<u+2)return;o=this.buffer.readUInt16BE(u),u+=2}else if(o===127){if(this.buffer.length<u+8)return;let f=this.buffer.readUInt32BE(u),p=this.buffer.readUInt32BE(u+4);o=f*2**32+p,u+=8}let l=u;if(i&&(u+=4),this.buffer.length<u+o)return;let d=this.buffer.subarray(u,u+o);if(i){let f=this.buffer.subarray(l,l+4);d=Buffer.from(d.map((p,h)=>p^f[h%4]))}this.buffer=this.buffer.subarray(u+o),s===1?this.emit("message",{data:d.toString("utf8")}):s===8?this.close():s===9&&this.socket?.write(oe(10,d))}}};function gi(e,t){let n=Number.parseInt(String(e??""),10);return Number.isFinite(n)&&n>=0?n:t}function oe(e,t){let n=t.length,r=2;n>=126&&n<=65535?r+=2:n>65535&&(r+=8);let s=yn(4),i=Buffer.alloc(r+4+n);i[0]=128|e;let o=2;n<126?i[1]=128|n:n<=65535?(i[1]=254,i.writeUInt16BE(n,o),o+=2):(i[1]=255,i.writeUInt32BE(Math.floor(n/2**32),o),i.writeUInt32BE(n>>>0,o+4),o+=8),s.copy(i,o),o+=4;for(let u=0;u<n;u+=1)i[o+u]=t[u]^s[u%4];return i}function _i(e){let t=new URL(e);if(t.protocol==="http:")t.protocol="ws:";else if(t.protocol==="https:")t.protocol="wss:";else if(t.protocol!=="ws:"&&t.protocol!=="wss:")throw new Error(`unsupported ORCHA_RUNTIME_ORCHA_URL protocol: ${t.protocol}`);return t.pathname=`${t.pathname.replace(/\/+$/,"")}/api/agent-runtime-bridge/ws`,t.search="",t.toString()}function Ti(e){return Object.entries(e||{}).map(([t,n])=>({targetCode:t,targetName:a(n?.name||n?.targetName||t),targetType:a(n?.type||"echo"),status:"available"}))}var Ct=class{constructor(t,n){this.config=t,this.bridge=n,this.ws=null,this.stopped=!1,this.connected=!1,this.reconnectTimer=null}start(){this.connect()}stop(){this.stopped=!0,this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=null,this.ws?.close()}connect(){if(this.stopped)return;let t=_i(this.config.orchaUrl),n=new It(t,{connectTimeoutMs:this.config.connectTimeoutMs});this.ws=n,n.addEventListener("open",()=>{if(this.ws!==n||this.stopped){n.close();return}this.authenticate(n)}),n.addEventListener("message",r=>this.handleMessage(r.data,n)),n.addEventListener("close",()=>this.scheduleReconnect("close",n)),n.addEventListener("error",r=>{m("warn","orcha-client","runtime node websocket error",{error:String(r?.message||r?.type||r)})})}authenticate(t=this.ws){this.send({type:"runtime_node.authenticate",token:this.config.nodeToken,nodeId:this.config.nodeId,nodeName:this.config.nodeName,version:z,protocolVersion:"orcha-runtime-node.v1",defaultTargetCode:this.config.defaultTargetCode,targets:Ti(this.config.targets)},t)}scheduleReconnect(t,n=this.ws){n&&this.ws!==n||(this.connected=!1,n&&this.ws===n&&(this.ws=null),!this.stopped&&(this.reconnectTimer||(m("info","orcha-client","runtime node disconnected; reconnect scheduled",{reason:t,reconnectMs:this.config.reconnectMs}),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},this.config.reconnectMs))))}async handleMessage(t,n=this.ws){if(n&&this.ws!==n)return;let r;try{r=JSON.parse(String(t))}catch(s){m("warn","orcha-client","invalid Orcha websocket frame",{error:String(s)});return}if(c(r)){if(r.type==="runtime_node.authenticated"){if(n&&this.ws!==n)return;this.connected=!0,m("info","orcha-client","runtime node authenticated",{nodeId:this.config.nodeId,connectionId:r.connectionId});return}if(r.type==="orcha.runtime.request"){await this.handleRequest(r);return}r.type==="runtime_node.ping"&&this.send({type:"runtime_node.pong",ts:new Date().toISOString()})}}async handleRequest(t){let n=a(t.id),r=a(t.method),s=c(t.params)?t.params:{};try{let i=await this.invoke(r,s,n);this.send({type:"orcha.runtime.response",id:n,ok:!0,result:i})}catch(i){this.send({type:"orcha.runtime.response",id:n,ok:!1,error:{code:i.code||"RUNTIME_NODE_ERROR",message:i.message||String(i)}})}}async invoke(t,n,r){if(t==="health")return this.bridge.health();if(t==="agents/create")return this.bridge.createAgent(n);if(t==="agents/dispatch")return this.bridge.dispatch(n,{onUpdate:s=>this.sendUpdate(r,s)});if(t==="sessions/prompt")return this.bridge.prompt(n,{onUpdate:s=>this.sendUpdate(r,s)});if(t==="sessions/cancel")return this.bridge.cancel(n);if(t==="permissions/respond")return this.bridge.respondPermission(n);throw Object.assign(new Error(`unsupported Orcha runtime method: ${t}`),{code:"METHOD_NOT_FOUND"})}sendUpdate(t,n){this.send({type:"orcha.runtime.event",requestId:t,eventType:"runtime.update",payload:n})}send(t,n=this.ws){return!n||n!==this.ws||n.readyState!==W?!1:(n.send(JSON.stringify(t)),!0)}};import{existsSync as yi,readFileSync as Si}from"node:fs";import{resolve as Sn}from"node:path";var wi=/^[A-Za-z_][A-Za-z0-9_]*$/;function wn(e=process.env,t=process.cwd()){let n=a(e.ORCHA_RUNTIME_ENV_FILE),r=n?Sn(t,n):Sn(t,".env");if(!yi(r))return n&&m("warn","config","runtime env file not found",{path:r}),{loaded:!1,path:r,keys:[]};let s=[],i=Si(r,"utf8");for(let o of i.split(/\r?\n/)){let u=Ei(o);if(!u)continue;let[l,d]=u;Object.prototype.hasOwnProperty.call(e,l)||(e[l]=d,s.push(l))}return m("info","config","runtime env file loaded",{path:r,keyCount:s.length}),{loaded:!0,path:r,keys:s}}function Rn(e=process.env){return{mode:a(e.ORCHA_RUNTIME_MODE||(e.ORCHA_RUNTIME_ORCHA_URL?"node":"server")),host:e.ORCHA_RUNTIME_BRIDGE_HOST||"127.0.0.1",port:S(e.ORCHA_RUNTIME_BRIDGE_PORT,5588),token:e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",orchaUrl:a(e.ORCHA_RUNTIME_ORCHA_URL),nodeToken:e.ORCHA_RUNTIME_NODE_TOKEN||e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",nodeId:a(e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"local-runtime-node"),nodeName:a(e.ORCHA_RUNTIME_NODE_NAME||e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"Local Runtime Node"),reconnectMs:S(e.ORCHA_RUNTIME_RECONNECT_MS,3e3),connectTimeoutMs:S(e.ORCHA_RUNTIME_CONNECT_TIMEOUT_MS||e.ORCHA_RUNTIME_WS_CONNECT_TIMEOUT_MS,1e4),defaultTargetCode:e.ORCHA_RUNTIME_DEFAULT_TARGET||"echo",requestLimitBytes:S(e.ORCHA_RUNTIME_REQUEST_LIMIT_BYTES,1048576),sessionPromptTimeoutMs:S(e.ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS,36e5),permissionRequestTimeoutMs:S(e.ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS,3e5),sessionIdleTtlMs:S(e.ORCHA_RUNTIME_SESSION_IDLE_TTL_MS,6e5),sessionCleanupIntervalMs:S(e.ORCHA_RUNTIME_SESSION_CLEANUP_INTERVAL_MS,6e4),maxSessionsPerTarget:S(e.ORCHA_RUNTIME_MAX_SESSIONS_PER_TARGET,8),openClawSessionIdleTtlMs:S(e.ORCHA_RUNTIME_OPENCLAW_SESSION_IDLE_TTL_MS,6e4),openClawMaxSessions:S(e.ORCHA_RUNTIME_OPENCLAW_MAX_SESSIONS,1),targets:Ri(e.ORCHA_RUNTIME_TARGETS_JSON||"")}}function Ri(e){if(!a(e))return{};try{let t=JSON.parse(e);if(c(t))return t}catch(t){m("warn","config","invalid ORCHA_RUNTIME_TARGETS_JSON",{error:String(t)})}return{}}function Ei(e){let t=e.trim();if(!t||t.startsWith("#"))return null;let n=t.startsWith("export ")?t.slice(7).trimStart():t,r=n.indexOf("=");if(r<=0)return null;let s=n.slice(0,r).trim();if(!wi.test(s))return null;let i=Oi(n.slice(r+1).trim());return[s,i]}function Oi(e){if(!e)return"";let t=e[0];if((t==='"'||t==="'")&&e.endsWith(t)){let n=e.slice(1,-1);return t==='"'?Ii(n):n}return Ci(e).trim()}function Ii(e){return e.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","	").replaceAll('\\"','"').replaceAll("\\\\","\\")}function Ci(e){let t=!1,n=!1;for(let r=0;r<e.length;r+=1){let s=e[r],i=e[r-1];if(s==="'"&&!n)t=!t;else if(s==='"'&&!t&&i!=="\\")n=!n;else if(s==="#"&&!t&&!n&&/\s/.test(i||""))return e.slice(0,r)}return e}import{createServer as xi}from"node:http";function xt(e,t,n){let r=JSON.stringify(n);e.writeHead(t,{"content-type":"application/json; charset=utf-8","content-length":Buffer.byteLength(r)}),e.end(r)}function K(e={}){return{ok:!0,...e}}function ae(e,t,n){return{ok:!1,error:{code:e,message:t,...n===void 0?{}:{detail:n}}}}async function En(e,t){let n=[],r=0;for await(let i of e){if(r+=i.length,r>t)throw Object.assign(new Error("request body too large"),{status:413,code:"REQUEST_TOO_LARGE"});n.push(i)}if(n.length===0)return{};let s=Buffer.concat(n).toString("utf8");if(!s.trim())return{};try{let i=JSON.parse(s);if(!c(i))throw Object.assign(new Error("JSON body must be an object"),{status:400,code:"BAD_JSON"});return i}catch(i){throw i.status?i:Object.assign(new Error(`invalid JSON body: ${i.message}`),{status:400,code:"BAD_JSON"})}}function On(e,t){if(!t)return;if((e.headers.authorization||"")!==`Bearer ${t}`)throw Object.assign(new Error("runtime bridge token is invalid"),{status:401,code:"UNAUTHORIZED"})}function In(e,t){let n={"GET /health":async()=>K(t.health()),"POST /agents/create":async r=>K(await t.createAgent(r)),"POST /agents/dispatch":async r=>K(await t.dispatch(r)),"POST /sessions/prompt":async r=>K(await t.prompt(r)),"POST /sessions/cancel":async r=>K(await t.cancel(r)),"POST /permissions/respond":async r=>K(await t.respondPermission(r))};return xi(async(r,s)=>{let i=new URL(r.url||"/",`http://${r.headers.host||`${e.host}:${e.port}`}`),o=`${r.method||"GET"} ${i.pathname}`,u=n[o];if(!u){xt(s,404,ae("NOT_FOUND",`No route for ${o}`));return}try{On(r,e.token);let l=r.method==="GET"?{}:await En(r,e.requestLimitBytes);xt(s,200,await u(l))}catch(l){let d=l.status||500,f=l.code||"BRIDGE_INTERNAL";xt(s,d,ae(f,l.message||String(l)))}})}var Pi=Li(import.meta.url),Di=".orcha-runtime-bridge.pid",Fi=".orcha-runtime-bridge.log",$i=3,Hi=36e5,{command:vi,options:Pn}=qi(process.argv.slice(2));Gi(Pn);wn();var ji=Rn();await Bi(vi,ji,Pn);async function Bi(e,t,n){switch(e){case"run":case"foreground":xn(t);return;case"start":if(n.foreground){xn(t);return}Nn();return;case"reload":case"restart":await Mn({quiet:!0}),Nn();return;case"stop":await Mn();return;case"status":Ki();return;case"help":case"--help":case"-h":Vi();return;default:throw new Error(`Unknown command: ${e}`)}}function xn(e){zi();let t=new Ot(e);if(e.mode==="server"){let r=In(e,t);An({bridge:t,server:r}),r.listen(e.port,e.host,()=>{m("info","runtime-bridge","Orcha runtime bridge HTTP server started",{host:e.host,port:e.port,targets:Object.keys(t.targets)})});return}if(!e.orchaUrl)throw new Error("ORCHA_RUNTIME_ORCHA_URL is required in runtime node mode");let n=new Ct(e,t);An({bridge:t,client:n}),n.start(),m("info","runtime-bridge","Orcha runtime node started",{nodeId:e.nodeId,nodeName:e.nodeName,orchaUrl:e.orchaUrl,targets:Object.keys(t.targets)})}function An({bridge:e,client:t,server:n}){let r=!1,s=i=>{if(r)return;r=!0;let o=Number(e?.sessions?.size||0)>0;m("info","runtime-bridge","runtime bridge shutting down",{signal:i});try{t?.stop?.()}catch(u){m("warn","runtime-bridge","runtime client stop failed",{error:String(u)})}Promise.resolve(e?.stop?.(`process_${String(i||"shutdown").toLowerCase()}`)).catch(u=>{m("warn","runtime-bridge","runtime bridge stop failed",{error:String(u)})}).finally(()=>{try{n?.close?.()}catch(u){m("warn","runtime-bridge","runtime server close failed",{error:String(u)})}}),setTimeout(()=>process.exit(0),o?8500:200)};process.once("SIGTERM",()=>s("SIGTERM")),process.once("SIGINT",()=>s("SIGINT"))}function Nn(){let e=fe(),t=Dn(),n=me(e);if(n&&V(n)){console.log(JSON.stringify({status:"already_running",pid:n,pidFile:e,logFile:t}));return}n&&le(e),bn(e),bn(t),ue(t);let r=Ui(t,"a"),s={...process.env,ORCHA_RUNTIME_PID_FILE:e,ORCHA_RUNTIME_LOG_FILE:t},i=Ai(process.execPath,[Pi,"run"],{cwd:process.cwd(),detached:!0,env:s,stdio:["ignore",r,r]});i.unref(),Ni(r),Ln(e,`${i.pid}
-`),console.log(JSON.stringify({status:"started",pid:i.pid,pidFile:e,logFile:t}))}async function Mn({quiet:e=!1}={}){let t=fe(),n=me(t);if(!n){e||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!V(n)){le(t),e||console.log(JSON.stringify({status:"not_running",pid:n,pidFile:t}));return}process.kill(n,"SIGTERM"),!await Un(n,1e4)&&V(n)&&(process.kill(n,"SIGKILL"),await Un(n,3e3)),le(t),e||console.log(JSON.stringify({status:"stopped",pid:n,pidFile:t}))}function Ki(){let e=fe(),t=Dn(),n=me(e),r=!!(n&&V(n));console.log(JSON.stringify({status:r?"running":"not_running",running:r,pid:r?n:null,pidFile:e,logFile:t}))}function qi(e){let t=[],n={};for(let s=0;s<e.length;s+=1){let i=e[s];i==="--daemon"?n.daemon=!0:i==="--foreground"?n.foreground=!0:i==="--env-file"?n.envFile=e[++s]:i==="--pid-file"?n.pidFile=e[++s]:i==="--log-file"?n.logFile=e[++s]:t.push(i)}return{command:t[0]||"run",options:n}}function Gi(e){e.envFile&&(process.env.ORCHA_RUNTIME_ENV_FILE=e.envFile),e.pidFile&&(process.env.ORCHA_RUNTIME_PID_FILE=e.pidFile),e.logFile&&(process.env.ORCHA_RUNTIME_LOG_FILE=e.logFile)}function fe(){return de(process.cwd(),process.env.ORCHA_RUNTIME_PID_FILE||Di)}function Dn(){return de(process.cwd(),process.env.ORCHA_RUNTIME_LOG_FILE||Fi)}function zi(){let e=process.env.ORCHA_RUNTIME_LOG_FILE;if(!e)return;let t=Fn();if(t<=0)return;let n=de(process.cwd(),e);ue(n,t);let r=Wi();r<=0||setInterval(()=>ue(n,t),r).unref()}function ue(e,t=Fn()){if(t<=0||!kn(e))return;let n=0,r="";try{if(n=Cn(e).size,n<=0)return;r=ce(e,"utf8")}catch(d){m("warn","runtime-bridge","runtime log cleanup skipped",{logFile:e,error:String(d)});return}let s=Date.now()-t*24*60*60*1e3,i=r.split(/\r?\n/),o=[],u=0;for(let d of i)d&&(Ji(d,s)?o.push(d):u+=1);if(u===0)return;let l="";try{Cn(e).size>n&&(l=ce(e,"utf8").slice(r.length));let f=[...o,...l.split(/\r?\n/).filter(Boolean)].join(`
-`);Ln(e,f?`${f}
-`:""),m("info","runtime-bridge","runtime log cleanup completed",{logFile:e,retentionDays:t,removed:u})}catch(d){m("warn","runtime-bridge","runtime log cleanup failed",{logFile:e,error:String(d)})}}function Ji(e,t){try{let n=JSON.parse(e);if(!n||typeof n!="object")return!0;let r=typeof n.ts=="string"?Date.parse(n.ts):Number.NaN;return!Number.isFinite(r)||r>=t}catch{return!0}}function Fn(){return $n(process.env.ORCHA_RUNTIME_LOG_RETENTION_DAYS,$i)}function Wi(){return $n(process.env.ORCHA_RUNTIME_LOG_CLEANUP_INTERVAL_MS,Hi)}function $n(e,t){let n=Number.parseInt(String(e??""),10);return Number.isFinite(n)&&n>=0?n:t}function me(e){if(!kn(e))return null;let t=Number.parseInt(ce(e,"utf8").trim(),10);return Number.isInteger(t)&&t>0?t:null}function V(e){try{return process.kill(e,0),!0}catch(t){return t?.code==="EPERM"}}async function Un(e,t){let n=Date.now();for(;Date.now()-n<t;){if(!V(e))return!0;await new Promise(r=>setTimeout(r,100))}return!V(e)}function bn(e){Mi(ki(e),{recursive:!0})}function le(e){try{bi(e,{force:!0})}catch{}}function Vi(){console.log(`Usage: orcha-runtime-bridge [command] [options]
+${s}`:s;Rr(t,r,n,d,s)&&(o=1,c=1)}return s&&i&&(t.finalTextSeen=!0),_r(t,gr(e,t.artifactOptions)),(Ls(e)||Ds(e)||vs(e)||i)&&n({sessionId:r,update:{sessionUpdate:"runtime_event",event:Tr(e)}}),{textCount:o,finalTextCount:c,thoughtCount:l}}function Qt(e,t,r,n,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0,textCount:0,finalTextCount:0,thoughtCount:0};let i=e.artifacts.size,o=0,c=0,l=0,d=0,f=Ps(t,r,s);if(f){let p=Math.min(t.processedLines.get(f.path)||0,f.events.length),g=e.artifacts.size;for(let m of f.events.slice(p)){let S=Fs(m,e,r,n);c+=S.textCount,l+=S.finalTextCount,d+=S.thoughtCount}t.processedLines.set(f.path,f.events.length),(f.events.length>p||e.artifacts.size>g)&&(o=1)}return{artifactCount:e.artifacts.size-i,transcriptCount:o,textCount:c,finalTextCount:l,thoughtCount:d}}function Hs(e,{remove:t=!0}={}){if(!e||!lr(e))return"";try{return fr(e,"utf8").trim()}catch{return""}finally{t&&Ot(e)}}function Ot(e){if(e)try{Xn(e)}catch{}}function $s(e,t){return{artifactCount:(e?.artifactCount||0)+(t?.artifactCount||0),transcriptCount:(e?.transcriptCount||0)+(t?.transcriptCount||0),textCount:(e?.textCount||0)+(t?.textCount||0),finalTextCount:(e?.finalTextCount||0)+(t?.finalTextCount||0),thoughtCount:(e?.thoughtCount||0)+(t?.thoughtCount||0)}}function Bs(e){return new Promise(t=>setTimeout(t,e))}function qs(e,t,r,n){return n?(e.finalTextSeen=!0,e.emittedTexts.has(n)||(e.emittedTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}})),!0):!1}async function js(e,t,r,n,s,i){let o=Qt(e,t,r,n,Date.now()),c=()=>qs(e,r,n,Hs(s,{remove:!1}));if(c()||e.finalTextSeen)return Ot(s),o;let l=ps(i);if(l<=0||!t&&!s)return Ot(s),o;let d=Date.now()+l,f=Math.min(yr(i),100);for(;!e.finalTextSeen&&Date.now()<d&&(await Bs(Math.min(f,Math.max(0,d-Date.now()))),o=$s(o,Qt(e,t,r,n,Date.now())),!c()););return Ot(s),o}var Ct=class{constructor(t,r,n={}){this.agent=t,this.target=r,this.options=n,this.active=new Map}async sessionNew(){return{sessionId:`cli-${this.agent.agentId}-${Z()}`}}async sessionPrompt(t,r,n){let s=Date.now(),i=a(this.target.command);if(!i)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let o=a(t.sessionId)||Z(),c=Tt(t.prompt),l=a(this.target.promptMode||"stdin"),d=this.buildArgs(l,c),f=a(this.target.cwd)||this.agent.workspace||process.cwd(),p=typeof this.options.prepareLaunch=="function",m=ds(i,d,this.target)?p?`/tmp/orcha-runtime-last-message-${Z()}.txt`:L(pr(),`orcha-runtime-last-message-${Z()}.txt`):"";m&&d.push("--output-last-message",m);let S={...u(this.target.env)?this.target.env:{},...l==="env"?{ORCHA_RUNTIME_PROMPT:c}:{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:o},O=p?await this.options.prepareLaunch({command:i,args:d,cwd:f,environment:S}):{command:i,args:d,cwd:f,environment:{...process.env,...S},cleanup:async()=>{}},N=p?Ss(O):Rs(this.target,o),_=N.root,y=ws(this.target,_,O),E=fs(i,this.target),A={...this.target,targetCode:this.agent.targetCode,cwd:f,...p?{codexHome:L(O.homeDirectory,".codex")}:{}},W=E?xs(A,s):new Set,gt=p&&m?L(O.tempDirectory,m.slice(5)):m,J=T(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,T(this.options.sessionPromptTimeoutMs,Zn));p||(O.environment.ORCHA_RUNTIME_ARTIFACT_DIR=_);let I=ur(O.command,O.args,{cwd:O.cwd,env:O.environment,stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(o,I),h("info","runtime.cli","runtime prompt started",{target:this.agent.targetCode,sessionId:o,pid:I.pid,timeoutMs:J,isolation:O.isolation});let $e="",Bt=a(this.target.outputMode||"text"),b={artifacts:new Map,emittedTexts:new Set,emittedThoughtTexts:new Set,value:"",artifactOptions:y,finalTextSeen:!1,finalTextOnly:_s(t,this.target),emitThoughtChunks:hs(t,this.target),terminalOutcome:null,terminalProtocol:cs(this.target),emitTerminal:null},qt=E?ys(A,c,s,W):null;return I.stdout.setEncoding("utf8"),I.stdout.on("data",X=>this.handleStdout(X,Bt,b,o,r)),I.stderr.setEncoding("utf8"),I.stderr.on("data",X=>{$e+=X,this.target.emitStderr===!0&&r({sessionId:o,update:{sessionUpdate:"runtime_stderr_chunk",content:{type:"text",text:X}}})}),l==="stdin"?I.stdin.end(c):I.stdin.end(),await new Promise((X,jt)=>{let nt=!1,Be=!1,_t=null,st=null,Gt=qt&&ms(this.target,t)?setInterval(()=>{try{Qt(b,qt,o,r)}catch(w){h("warn","runtime.cli","codex transcript stream poll failed",{target:this.agent.targetCode,sessionId:o,error:String(w?.message||w)})}},yr(this.target)):null;Gt?.unref?.();let qe=setTimeout(()=>{Be=!0,h("warn","runtime.cli","runtime prompt timed out; terminating child",{target:this.agent.targetCode,sessionId:o,pid:I.pid,timeoutMs:J}),xt(I,"SIGTERM"),_t=setTimeout(()=>{h("warn","runtime.cli","runtime prompt force killing child",{target:this.agent.targetCode,sessionId:o,pid:I.pid}),xt(I,"SIGKILL")},mr),_t.unref?.(),it(Object.assign(new Error(`runtime CLI timed out after ${J}ms`),{code:"RUNTIME_CLI_TIMEOUT"}))},J);qe.unref?.();let je=async()=>{clearTimeout(qe),st&&clearTimeout(st),Gt&&clearInterval(Gt),_t&&!Be&&clearTimeout(_t),Es(N,{target:this.agent.targetCode,sessionId:o}),this.active.delete(o),b.emitTerminal=null,await O.cleanup?.()},Tn=w=>{nt||(nt=!0,je().then(()=>X(w),jt))},it=w=>{nt||(nt=!0,je().then(()=>jt(w),v=>{h("warn","runtime.cli","sandbox launch cleanup failed",{target:this.agent.targetCode,sessionId:o,error:String(v?.message||v)}),jt(w)}))};b.emitTerminal=w=>{let v={...u(w.result)?w.result:{},_artifacts:[...b.artifacts.values()]};try{n?.({...w,result:v})}catch(j){h("warn","runtime.cli","runtime terminal listener failed",{target:this.agent.targetCode,sessionId:o,error:String(j?.message||j)})}let k=Math.max(0,T(this.target.terminalExitGraceMs,is));st=setTimeout(()=>{st=null,!(nt||this.active.get(o)!==I)&&(h("warn","runtime.cli","runtime stayed alive after terminal event; terminating child",{target:this.agent.targetCode,sessionId:o,pid:I.pid,terminalProtocol:b.terminalProtocol,graceMs:k}),Jt(I))},k),st.unref?.()},I.on("error",w=>{h("warn","runtime.cli","runtime child error",{target:this.agent.targetCode,sessionId:o,pid:I.pid,error:String(w?.message||w)}),it(w)}),I.on("exit",(w,v)=>{(async()=>{Bt==="json-lines"&&b.value.trim()&&this.handleStdout(`
+`,Bt,b,o,r);let k=await js(b,qt,o,r,gt,this.target);(k.artifactCount>0||k.textCount>0||k.thoughtCount>0)&&h("info","runtime.cli","codex transcript updates collected",{target:this.agent.targetCode,sessionId:o,artifactCount:k.artifactCount,textCount:k.textCount,finalTextCount:k.finalTextCount,thoughtCount:k.thoughtCount,transcriptCount:k.transcriptCount});let j=$e.trim();if(j&&h("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:o,stderr:j}),h("info","runtime.cli","runtime prompt finished",{target:this.agent.targetCode,sessionId:o,pid:I.pid,exitCode:w,signal:v,artifactCount:b.artifacts.size,finalTextSeen:b.finalTextSeen}),b.terminalOutcome?.status==="failed"){it(b.terminalOutcome.error);return}if(w!==0&&b.terminalOutcome?.status!=="completed"){let yn=Object.assign(new Error(`runtime CLI exited with code ${w??"unknown"}${v?` (${v})`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:w,signal:v});it(yn);return}Tn({stopReason:"end_turn",exitCode:w,signal:v,_artifacts:[...b.artifacts.values()],...j?{stderr:j}:{}})})().catch(it)})})}buildArgs(t,r){let n=C(this.target.args);return t==="args"?[...n,r]:n}handleStdout(t,r,n,s,i){if(r!=="json-lines"){i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:t}}});return}n.value+=t;let o=n.value.split(/\r?\n/);n.value=o.pop()||"";for(let c of o){let l=c.trim();if(l)try{let d=JSON.parse(l);_r(n,gr(d,n.artifactOptions)),i({sessionId:s,update:{sessionUpdate:"runtime_event",event:Tr(d)}});let f=hr(d),p=te(d);f&&n.emitThoughtChunks&&!p&&ls(d)?Sr(n,s,i,f):f&&Ts(n,p)&&Rr(n,s,i,f),f&&p&&(n.finalTextSeen=!0);let g=us(d,n.terminalProtocol);g&&!n.terminalOutcome&&(g.status==="failed"||n.finalTextSeen||n.artifacts.size>0)&&(n.terminalOutcome=g,n.emitTerminal?.(g))}catch{i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:`${c}
+`}}})}}}async sessionCancel(t){let r=a(t.sessionId),n=this.active.get(r);return n?(h("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),Jt(n),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}stop(t="stop"){for(let[r,n]of this.active.entries())h("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),Jt(n);this.active.clear()}};var re="ORCHA_RUNTIME_OUTPUT_START",ne="ORCHA_RUNTIME_OUTPUT_END",se="ORCHA_RUNTIME_CONTROL_START",ie="ORCHA_RUNTIME_CONTROL_END",Ar=re,Cr=ne,Nr=se,br=ie,oe=[re,ne,se,ie],Gs=new Set(["_artifacts","_decision","_meta"]),Ks=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${oe.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),D=class extends Error{constructor(t,r){super(r),this.name="RuntimeResultProtocolError",this.code=t}};function Mr(e){let t=typeof e=="string"?e.trimStart():"";return oe.some(r=>t.startsWith(r))}function ae(e){if(typeof e!="string")return null;let t=e,r=Vs(t);if(![...r.values()].some(m=>m.length>0))return null;let n=[],s=[];for(let[m,S]of r)S.length===0?n.push(m):S.length>1&&s.push(m);if(n.length>0||s.length>0){let m=[];throw n.length>0&&m.push(`\u7F3A\u5C11 ${n.join(", ")}`),s.length>0&&m.push(`\u91CD\u590D ${s.join(", ")}`),new D("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${m.join("\uFF1B")}`)}let i=r.get(re)[0],o=r.get(ne)[0],c=r.get(se)[0],l=r.get(ie)[0];if(!(i.end<=o.start&&o.end<=c.start&&c.end<=l.start))throw new D("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757");let d=zs(t.slice(i.end,o.start));if(!d.trim())throw new D("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A");let f=t.slice(c.end,l.start).trim();if(!f)throw new D("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A");let p;try{p=JSON.parse(f)}catch(m){throw new D("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(m?.message||m)}`)}if(!xr(p))throw new D("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61");let g=Object.keys(p).filter(m=>!Gs.has(m)).sort();if(g.length>0)throw new D("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${g.join(", ")}`);if("_artifacts"in p&&!Array.isArray(p._artifacts))throw new D("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4");for(let m of["_decision","_meta"])if(m in p&&!xr(p[m]))throw new D("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${m} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`);return{output:d,...p}}function Vs(e){let t=new Map(oe.map(r=>[r,[]]));for(let r of e.matchAll(Ks))t.get(r.groups.marker).push({start:r.index,end:r.index+r[0].length});return t}function zs(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",r=t?e.slice(t.length):e;return t&&r.endsWith(t)?r.slice(0,-t.length):r}function xr(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as Ws}from"node:crypto";var Js="orcha.goal-contract/v1",Xs=new Set(["complete","completed","done","ok","passed","success","succeeded"]),Ys=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),Qs=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function de(e){return Ws("sha256").update(F(e)).digest("hex")}function Pr(e){if(!Lr(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
+`)}function kr(e,t,r=""){if(!Lr(e))return e==null?null:{required:!0,status:"failed",outcome:a(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let n=de(e),s=e.verificationPlan.required===!0;if(a(r)&&a(r)!==n)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:n,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:n,checks:[]};let i=Zs(t),o=e.verificationPlan.checks.map(l=>oi(l,i));return{required:!0,status:o.some(l=>l.status==="failed")?"failed":o.some(l=>l.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:n,checks:o}}function Lr(e){if(!u(e)||e.schemaVersion!==Js||!a(e.outcome))return!1;let t=e.verificationPlan;if(!u(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let r=new Set;for(let n of t.checks)if(!u(n)||!a(n.id)||r.has(a(n.id))||(r.add(a(n.id)),!Array.isArray(n.toolNames)||n.toolNames.length===0||n.toolNames.some(s=>!a(s)))||n.arguments!==void 0&&!u(n.arguments))return!1;return!0}function Zs(e){let t=new Map,r=[];for(let n of Array.isArray(e)?e:[]){let s=u(n?.update)?n.update:{},i=a(s.sessionUpdate);if(i==="runtime_event"){ti(s.event,t,r);continue}if(i==="tool_call"){let o=bt(s)||`tool-${r.length+1}`,c=Nt(t,r,o),l=ue(s,s.name||s.toolName||s.kind);c.toolName=l.toolName,c.arguments=l.arguments,c.status=dt(s.status),c.evidence=Ut(s);continue}if(i==="tool_call_update"){let o=bt(s);if(!o)continue;let c=Nt(t,r,o),l=ue(s,s.name||s.toolName||s.kind);c.toolName||=l.toolName,Object.keys(c.arguments).length===0&&(c.arguments=l.arguments),c.status=dt(s.status),c.evidence.push(...Ut(s))}}return r}function ti(e,t,r){let n=u(e)&&u(e.payload)?e.payload:u(e)?e:{},s=a(n.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let c=bt(n)||`runtime-${r.length+1}`,l=Nt(t,r,c),d=ue(n,n.name||n.tool||s,s);l.toolName=d.toolName,l.arguments=d.arguments,l.status=dt(n.status),l.evidence.push(...Ut(n));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=bt(n);if(!i)return;let o=Nt(t,r,i);o.status=si(n,o.toolName),o.evidence.push(...Ut(n))}function Nt(e,t,r){let n=e.get(r);return n||(n={toolCallId:r,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(r,n),t.push(n)),n}function ei(e){let t=a(e).toLowerCase();return Qs.get(t)||t}function ue(e,t,r=""){let n=ri(e),s=a(r)==="mcp_tool_call"||a(e?.kind).toLowerCase()==="mcp",i=u(e?._meta)?e._meta:{},o=a(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let c=a(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...n,...c?{operationCode:c}:{}}}}return{toolName:ei(t),arguments:n}}function bt(e){return u(e)?a(e.call_id||e.callId||e.toolCallId||e.id):""}function ri(e){if(!u(e))return{};for(let r of["arguments","args","rawInput","input","params","parameters"]){let n=ni(e[r]);if(n)return n}let t={};for(let r of["cmd","command","cwd","operationCode","path","query","url"])e[r]!==void 0&&(t[r]=e[r]);return t}function ni(e){if(u(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return u(t)?t:null}catch{return null}}function si(e,t){if(!u(e))return"unknown";let r=Mt(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return r.includes("failed")?"failed":r.includes("success")?"success":"unknown"}function Mt(e,t=0,r={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return ii(e,t,r);if(Array.isArray(e))return e.flatMap(o=>Mt(o,t+1,r));if(!u(e))return[];let n=[];typeof e.isError=="boolean"&&n.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&n.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&n.push(e.success?"success":"failed");let s=dt(e.status);s!=="unknown"&&n.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&n.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&n.push(...Mt(e[o],t+1,r));return n}function ii(e,t,r){let n=e.trim();if(!n)return[];try{return Mt(JSON.parse(n),t+1,r)}catch{}if(r.parseCliExitCode!==!0)return[];let s=[];for(let i of n.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function dt(e){let t=a(e).toLowerCase();return Xs.has(t)?"success":Ys.has(t)?"failed":"unknown"}function Ut(e){if(!u(e))return[];let t=u(e.output)?e.output:{},r=[e.verificationEvidence,u(e.verification)?e.verification.evidence:null,t.verificationEvidence,u(t.verification)?t.verification.evidence:null],n=[];for(let s of r)for(let i of Array.isArray(s)?s:s?[s]:[])!u(i)||!a(i.id)||n.push({id:a(i.id),status:dt(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...a(i.message)?{message:a(i.message)}:{}});return n}function oi(e,t){let r=t.filter(o=>e.toolNames.includes(o.toolName)&&le(e.arguments||{},o.arguments)),n=a(e.evidenceId),s=r.find(o=>o.status==="success"&&(!n||o.evidence.some(c=>c.id===n&&c.status==="success")));if(s)return ce(e,"passed",s,"Runtime tool evidence passed.");let i=r.find(o=>o.status==="failed"||n&&o.evidence.some(c=>c.id===n&&c.status==="failed"));return i?ce(e,"failed",i,"Runtime tool evidence failed."):ce(e,"missing",r.at(-1),n?"Required evidence is missing.":"Required tool execution is missing.")}function ce(e,t,r,n){return{id:e.id,status:t,message:n,...a(e.description)?{description:a(e.description)}:{},toolNames:e.toolNames,...u(e.arguments)?{arguments:e.arguments}:{},...a(e.evidenceId)?{evidenceId:a(e.evidenceId)}:{},...r?.toolCallId?{toolCallId:r.toolCallId}:{}}}function le(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((r,n)=>le(r,t[n])):u(e)?u(t)?Object.entries(e).every(([r,n])=>Object.hasOwn(t,r)&&le(n,t[r])):!1:Object.is(e,t)}function F(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return Ur(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,r)=>{if(!Object.hasOwn(e,r))throw new Error("invalid_jcs_json_value");return F(e[r])}).join(",")}]`;if(u(e))return`{${Object.keys(e).sort().map(t=>`${Ur(t)}:${F(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function Ur(e){return ai(e),JSON.stringify(e)}function ai(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(r>=56320&&r<=57343)throw new Error("invalid_jcs_unicode")}}import{spawn as ci}from"node:child_process";import{createHash as ui,randomUUID as li}from"node:crypto";import{constants as di}from"node:fs";import{access as fi,mkdir as fe,readdir as pi,realpath as ft,rm as mi,stat as hi}from"node:fs/promises";import gi from"node:http";import{tmpdir as _i}from"node:os";import{isAbsolute as pt,join as tt,relative as Dr,resolve as me}from"node:path";var he=1,Ti="orcha.process-isolation/v1",ge="orcha.egress-proxy/v1",Pt={read_only:0,workspace_write:1,workspace_network:2},pe={read_only:["read_only","denied"],workspace_write:["workspace_write","denied"],workspace_network:["workspace_write","restricted"]},yi=new Set([".env",".git-credentials",".netrc",".npmrc",".pypirc","credentials.json","secrets.json","id_rsa","id_ed25519"]);function K(e){if(!u(e))throw R("RUNTIME_SANDBOX_POLICY_REQUIRED","sandboxPolicy is required");let t=structuredClone(e),r=a(t.accessMode),n=a(t.accessModeCeiling);if(!(r in pe)||!(n in pe))throw R("RUNTIME_SANDBOX_POLICY_INVALID","unsupported runtime access mode");if(Pt[r]>Pt[n])throw R("RUNTIME_SANDBOX_POLICY_INVALID","access mode exceeds its ceiling");let[s,i]=pe[r];if(t.filesystemMode!==s||t.networkMode!==i)throw R("RUNTIME_SANDBOX_POLICY_INVALID","runtime access profile does not match its mode");if(Number(t.policySchemaVersion)!==he||!Number.isInteger(Number(t.policyRevision))||Number(t.policyRevision)<1)throw R("RUNTIME_SANDBOX_POLICY_INVALID","unsupported sandbox policy schema or revision");for(let[c,l]of Object.entries({outsideWorkspaceAccess:"denied",hostAccess:"denied",hostEnvironmentAccess:"denied",dockerSocketAccess:"denied",environmentMode:"allowlist"}))if(t[c]!==l)throw R("RUNTIME_SANDBOX_POLICY_INVALID",`${c} cannot be relaxed`);let o=u(t.processIsolation)?t.processIsolation:{};if(o.mode!=="required"||o.backend==="direct")throw R("RUNTIME_SANDBOX_POLICY_INVALID","strong process isolation is required");if(Array.isArray(t.alwaysApprovedApprovalKeys)&&t.alwaysApprovedApprovalKeys.length)throw R("RUNTIME_SANDBOX_POLICY_INVALID","persistent runtime approvals are forbidden");return t}function vr(e,t){let r=K(e),n=K(t);return Pt[n.accessMode]<Pt[r.accessMode]}async function Fr(e){if(!e.sandboxRequired)return{dispatchable:!0,enforced:!1,backend:"direct",daemonStatus:"not_required",daemonProtocolVersion:"",policySchemaVersions:[he],runtimePolicyUpdates:!1,workspaceSync:!1,egressProxy:!1,reason:"external_runtime_sandbox_not_required"};let t=await $r(e.sandboxBrokerCommand,process.env.PATH||"");if(!t)throw R("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let r=await Ii(t,C(e.sandboxBrokerArguments),e.sandboxProbeTimeoutMs);if(r.enforced!==!0||a(r.protocolVersion)!=="orcha.runtime-sandbox-broker/v1"||!["bubblewrap","broker"].includes(a(r.backend)))throw R("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker did not report enforced isolation");let n=u(r.probes)?r.probes:{};for(let s of["emptyRoot","outsideWorkspaceDenied","hostFilesystemDenied","sensitiveFilesDenied","environmentAllowlist","dockerSocketDenied","networkNamespace","workspaceReadOnly","workspaceWrite","resourceLimits"])if(n[s]!==!0)throw R("RUNTIME_SANDBOX_UNAVAILABLE",`sandbox broker probe failed: ${s}`);return e.egressProxyRequired&&await Ai(e),{dispatchable:!0,enforced:!0,backend:a(r.backend),daemonStatus:"ok",daemonProtocolVersion:a(r.protocolVersion||"orcha.runtime-sandbox-broker/v1"),policySchemaVersions:[he],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:e.egressProxyRequired}}async function _e(e,t,r){let n=a(t.workspace||t.cwd),s=a(r),i=n||(t.allowRequestWorkspace===!0?s:"");if(!i||!pt(i))throw R("RUNTIME_WORKSPACE_NOT_CONFIGURED","runtime target must configure an absolute trusted workspace");let o=await ft(i);if(!(await hi(o)).isDirectory())throw R("RUNTIME_WORKSPACE_INVALID","runtime workspace is not a directory");if(!(e.trustedWorkspaceRoots.length?await Promise.all(e.trustedWorkspaceRoots.map(d=>ft(d))):[o]).some(d=>ye(d,o)))throw R("RUNTIME_WORKSPACE_OUTSIDE_TRUSTED_ROOT","runtime workspace is outside trusted roots");return o}async function Hr({config:e,target:t,command:r,args:n,cwd:s,environment:i,runId:o,agentId:c,sessionId:l,sandboxPolicy:d}){if(!e.sandboxRequired)return{command:r,args:[...n],cwd:s,environment:{...process.env,...i},tempDirectory:"",isolation:{enforced:!1,backend:"development_direct"},cleanup:async()=>{}};let f=K(d),p=await _e(e,t,s),g=await ft(s);if(!ye(p,g))throw R("RUNTIME_WORKSPACE_CWD_INVALID","runtime cwd is outside its workspace");let m=await $r(e.sandboxBrokerCommand,process.env.PATH||"");if(!m)throw R("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let S=`runtime-${ui("sha256").update(String(o)).digest("hex").slice(0,32)}`,O=me(e.sandboxTempRoot||tt(_i(),"orcha-runtime-sandboxes"));await fe(O,{recursive:!0,mode:448});let N=tt(O,`${S}-${li()}`),_=tt(N,"home"),y=tt(N,"artifacts");await fe(_,{recursive:!0,mode:448}),await fe(y,{recursive:!0,mode:448});let E=f.networkMode==="restricted"?await Oi(e,{runId:String(o),instanceId:S,policyRevision:Number(f.policyRevision),ttlMs:Math.min(T(f.maxRuntimeSeconds,900)*1e3,e.egressGrantMaxTtlMs),maxTransferBytes:T(f.maxNetworkBytes,64*1024*1024)}):null,A={PATH:a(i.PATH||process.env.PATH),LANG:a(i.LANG||process.env.LANG||"C.UTF-8"),HOME:"/tmp/home",TMPDIR:"/tmp",USER:"orcha",LOGNAME:"orcha",SHELL:"/bin/sh",ORCHA_AGENT_ID:String(c),ORCHA_SESSION_ID:String(l),ORCHA_RUN_ID:String(o),ORCHA_RUNTIME_ARTIFACT_DIR:"/tmp/artifacts",...Si(t,i)};A.HOME="/tmp/home",A.TMPDIR="/tmp",A.ORCHA_RUNTIME_ARTIFACT_DIR="/tmp/artifacts";let W={schemaVersion:Ti,runId:String(o),instanceId:S,workspace:p,cwd:g,filesystemMode:f.filesystemMode,networkMode:f.networkMode,environmentMode:"allowlist",deniedRelativePaths:await Ei(p),temporaryDirectory:N,egressProxy:E,environment:A,resourceLimits:wi(f),readOnlyToolchainRoots:await Ri(e,t)},gt=!1,J=async()=>{if(!gt){gt=!0;try{E&&await xi(e,E,{runId:String(o),instanceId:S})}finally{await mi(N,{recursive:!0,force:!0})}}};return{command:m,args:[...C(e.sandboxBrokerArguments),"--",r,...n],cwd:g,environment:{PATH:process.env.PATH||"",LANG:process.env.LANG||"C.UTF-8",ORCHA_PROCESS_ISOLATION_REQUEST:JSON.stringify(W)},tempDirectory:N,homeDirectory:_,artifactDirectory:y,pathMappings:[{runtimeRoot:"/tmp/artifacts",hostRoot:y},{runtimeRoot:"/tmp/home",hostRoot:_}],isolation:{enforced:!0,backend:"broker",instanceId:S,policyRevision:f.policyRevision},cleanup:J}}async function Ri(e,t){let r=C(t.toolchainRoots||t.sandboxToolchainRoots);if(!r.length)return[];let n=await Promise.all(C(e.trustedToolchainRoots).map(i=>ft(i)));if(!n.length)throw R("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","target toolchain roots require ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS");let s=[];for(let i of r){if(!pt(i))throw R("RUNTIME_TOOLCHAIN_ROOT_INVALID","toolchain roots must be absolute");let o=await ft(i);if(!n.some(c=>ye(c,o)))throw R("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","toolchain root is outside trusted roots");s.push(o)}return[...new Set(s)]}function Si(e,t){let r=u(e.env)?e.env:{},n={};for(let[s,i]of Object.entries(r))/^[A-Za-z_][A-Za-z0-9_]*$/.test(s)&&i!=null&&(n[s]=String(i));for(let s of["ORCHA_RUNTIME_PROMPT","ORCHA_RUNTIME_ARTIFACT_DIR"])t[s]!=null&&(n[s]=String(t[s]));return n}async function Ei(e){let t=[],r=0,n=async s=>{let i;try{i=await pi(s,{withFileTypes:!0})}catch(o){if(s===e)throw o;return}for(let o of i){if(r+=1,r>1e4)throw R("RUNTIME_WORKSPACE_SCAN_LIMIT_EXCEEDED","workspace contains more than 10000 entries");let c=tt(s,o.name),l=Dr(e,c),d=o.name.toLowerCase();(yi.has(d)||d.startsWith(".env."))&&t.push(l),o.isDirectory()&&!o.isSymbolicLink()&&await n(c)}};return await n(e),t.sort()}function wi(e){return{maxCpuSeconds:Math.max(1,T(e.maxRuntimeSeconds,900)),maxMemoryBytes:T(e.maxMemoryBytes,2*1024*1024*1024),maxProcesses:T(e.maxProcesses,128),maxOpenFiles:T(e.maxOpenFiles,1024),maxFileBytes:T(e.maxFileBytes,64*1024*1024)}}async function Ii(e,t,r){return await new Promise((n,s)=>{let i=ci(e,[...t,"--probe"],{env:{PATH:process.env.PATH||"",LANG:"C.UTF-8"},stdio:["ignore","pipe","pipe"],windowsHide:!0}),o=[],c=[];i.stdout.on("data",d=>o.push(Buffer.from(d))),i.stderr.on("data",d=>c.push(Buffer.from(d)));let l=setTimeout(()=>i.kill("SIGKILL"),Math.max(1e3,r));i.once("error",s),i.once("close",d=>{if(clearTimeout(l),d!==0){s(R("RUNTIME_SANDBOX_UNAVAILABLE",Buffer.concat(c).toString("utf8").trim()||`sandbox probe exited with ${d}`));return}try{n(JSON.parse(Buffer.concat(o).toString("utf8")))}catch{s(R("RUNTIME_SANDBOX_UNAVAILABLE","sandbox probe returned invalid JSON"))}})})}async function $r(e,t){let r=a(e);if(!r)return"";let n=pt(r)?[r]:String(t||"").split(":").filter(Boolean).map(s=>tt(s,r));for(let s of n)try{return await fi(s,di.X_OK),s}catch{}return""}async function Oi(e,t){if(!e.egressProxyRequired)throw R("RUNTIME_EGRESS_UNAVAILABLE","restricted network requires the Egress Proxy");let r=await Te(e,"POST","/v1/grants",{protocolVersion:ge,...t}),n={socketPath:e.egressProxySocket,grantId:a(r.grantId),credential:a(r.credential)};if(!n.grantId||!n.credential)throw R("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy returned an invalid grant");return n}async function xi(e,t,r){await Te(e,"POST",`/v1/grants/${encodeURIComponent(t.grantId)}/revoke`,{protocolVersion:ge,...r}).catch(()=>{})}async function Ai(e){let t=await Te(e,"GET","/health");if(t.status!=="ok"||t.proxy!=="orcha-egress-proxy"||t.protocolVersion!==ge)throw R("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy is unavailable or incompatible")}async function Te(e,t,r,n){if(!pt(e.egressProxySocket)||!e.egressProxyToken)throw R("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy socket and token are required");return await new Promise((s,i)=>{let o=gi.request({socketPath:e.egressProxySocket,path:r,method:t,headers:{Authorization:`Bearer ${e.egressProxyToken}`,Accept:"application/json",...n?{"Content-Type":"application/json"}:{}}},c=>{let l=[],d=0;c.on("data",f=>{d+=f.length,d>1048576?o.destroy(new Error("egress response is too large")):l.push(Buffer.from(f))}),c.once("end",()=>{try{let f=JSON.parse(Buffer.concat(l).toString("utf8")||"{}");(c.statusCode||500)>=400?i(R("RUNTIME_EGRESS_UNAVAILABLE",a(f.error)||"Egress Proxy rejected the request")):s(f)}catch(f){i(f)}})});o.once("error",i),o.setTimeout(3e3,()=>o.destroy(new Error("Egress Proxy request timed out"))),n?o.end(JSON.stringify(n)):o.end()})}function ye(e,t){let r=Dr(me(e),me(t));return r===""||!r.startsWith("..")&&!pt(r)}function R(e,t){return Object.assign(new Error(t),{code:e})}var Re=24e3,Se=8,Ee=50,we=6e3,Ni=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),bi=10*60*1e3,Mi=60*1e3,Ui=8,Pi=30*60*1e3,ki=60*1e3,Li=1,Di=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions","runtimeMaxSessions"]),vi=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function Fi(e){if(!u(e))return{};let t={};for(let r of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let n=a(e[r]);n&&(t[r]=n)}return t}function Hi(e){return(Array.isArray(e)?e:[]).map(Fi).sort((t,r)=>{let n=F(t),s=F(r);return n<s?-1:n>s?1:0})}function $i(e){return!u(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(r=>u(r)&&Array.isArray(r.toolNames)&&r.toolNames.some(n=>a(n)==="plugin_operation"))}function Bi(e,t,r){let n=u(e?._meta)?e._meta:{};return{...u(e)?e:{},sessionId:t,update:u(e?.update)?e.update:{},_meta:{...n,orchaAgentId:r.agentId,runtimeSessionId:r.runtimeSessionId,bridgeUpdateId:kt()}}}function U(e){return e==null||e===""?!1:typeof e=="string"?a(e)!=="":Array.isArray(e)?e.length>0:u(e)?Object.keys(e).length>0:!0}function zr(e){let t=a(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return Ni.has(t)}function B(e,t){let r=T(e,t);return Number.isFinite(r)&&r>0?r:t}function xe(e){let t=T(e,null);return Number.isFinite(t)&&t>0?t:null}function mt(e,t=!1){if(typeof e=="boolean")return e;let r=a(e).toLowerCase();return["true","1","yes","y","on"].includes(r)?!0:["false","0","no","n","off"].includes(r)?!1:t}function $(e){return a(e?.type||"echo")}function qi(e){let t=$(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function Ae(e){if(u(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function ji(e){let t=String(e||"");if(vi.test(t))return!0;let r=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return r.endsWith("token")||r.endsWith("secret")||r.endsWith("password")||r.endsWith("apikey")||r.endsWith("privatekey")||r==="authorization"||r==="cookie"||r==="jwt"||r.includes("credential")}function Ce(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=we)return e;let r=e.length-we;return`${e.slice(0,we)}... [truncated ${r} characters]`}if(t>=Se)return Array.isArray(e)?`[array truncated at depth ${Se}, items=${e.length}]`:u(e)?`[object truncated at depth ${Se}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let r=e.slice(0,Ee).map(n=>Ce(n,t+1));return e.length>Ee&&r.push(`[truncated ${e.length-Ee} items]`),r}if(u(e)){let r={};for(let[n,s]of Object.entries(e))r[n]=ji(n)?"[REDACTED]":Ce(s,t+1);return r}return String(e)}var Gi=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function Ki(e){if(!u(e))return e;let t={};for(let r of Gi)U(e[r])&&(t[r]=e[r]);return t}function Vi(e){if(!u(e))return e;let t={...e};return u(t.renderedPayload)&&(t.renderedPayload=Ki(t.renderedPayload)),t}function zi(e){let t=u(e)?e:{},r={};U(t.metadata)&&(r.metadata=Vi(t.metadata));for(let[n,s]of Object.entries(t))Di.has(n)||n==="metadata"||U(s)&&(r[n]=s);return r}function Wi(e){let t=u(e)?e:{},r=u(t.metadata)?t.metadata:{},n=u(r.renderedPayload)?r.renderedPayload:{};return u(t.resultContract)?t.resultContract:u(n.resultContract)?n.resultContract:{}}function Wr(e){return a(Wi(e).kind).toLowerCase()==="decision"}function Br(e){let t=u(e)?e:{},r=u(t.metadata)?t.metadata:{};return xe(t.runtimeMaxSessions??r.runtimeMaxSessions)}function Ji(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:$(e)==="cli"}function qr(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return mt(t,qi(e))}function Xi(e,t){let r=u(e?.metadata)?{...e.metadata}:{},n=u(r._runtimeBridge)?{...r._runtimeBridge}:{},s=Ae(n);return r._runtimeBridge={...n,promptKind:"dispatch",finalTextOnly:Ji(t),releaseAfterPrompt:s===void 0?qr(t):mt(s,qr(t)),requiresRuntimeResult:Wr(e)},r}function Yi(e){let t=zi(e);if(!U(t))return"";let r=JSON.stringify(Ce(t),null,2);if(r.length<=Re)return r;let n=r.length-Re;return`${r.slice(0,Re)}
+... [truncated ${n} characters]`}function Jr(e){if(!u(e))return"";let t=u(e.update)?e.update:e,n=(u(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function Qi(e){if(!u(e))return"";let t=u(e.update)?e.update:e;return a(t.sessionUpdate)}function jr(e){if(!Array.isArray(e))return"";let t=!1,r=[],n=[],s=[],i=()=>{r.length>0&&(n.push(r),r=[])};for(let c of e){let l=Qi(c),d=Jr(c);if(!l){d&&s.push(d);continue}if(t=!0,l==="agent_message_chunk"){d&&r.push(d);continue}(l==="agent_thought_chunk"||l==="user_message_chunk"||l==="tool_call"||l==="tool_call_update"||l==="plan")&&i()}if(i(),!t)return ht(s);let o=n[n.length-1]||[];return ht(o)}function Ne(e){return Array.isArray(e)?e.map(Jr).filter(t=>t!==""):[]}function Zi(e){if(!u(e))return null;let t=u(e.update)?e.update:e;return a(t.sessionUpdate)!=="runtime_event"?null:u(t.event)?t.event:null}function to(e){if(!u(e))return"";let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);if(r==="event_msg"){if(n==="task_complete")return a(t.last_agent_message||t.message||t.output);if(n==="agent_message"){let s=a(t.phase||t.status||t.stage).toLowerCase();if(["final_answer","final","complete","completed","done"].includes(s))return a(t.message||t.text||t.content)}}return""}function eo(e){if(!Array.isArray(e))return"";for(let t=e.length-1;t>=0;t-=1){let r=to(Zi(e[t]));if(r)return r}return""}function ht(e){let t="";for(let r of e){let n=String(r||"");if(n)if(!t)t=n;else if(n.length>t.length&&n.startsWith(t))t=n;else{let s=Mr(n)&&!/[\r\n]$/.test(t)?`
+`:"";t+=`${s}${n}`}}return t.trim()}function ro(e){let t=String(e||"").trim();if(!t)return"";let r=t.match(/(?:^|\n)#{1,3}\s+\S/);return!r||r.index===0?t:t.slice(r.index+(t[r.index]===`
+`?1:0)).trim()}function Gr(e){let t=String(e||"").trim();if(!t)return null;try{let r=JSON.parse(t);if(u(r)&&(Xr(r)||U(r._artifacts)||U(r.artifacts)||U(r._decision)||U(r._meta)))return r}catch{}return null}function Lt(e){try{return ae(e)}catch{return null}}function no(e){try{return ae(e),null}catch(t){return t}}function Ie(...e){for(let t of e){let r=no(t);if(r)throw r}}function Kr(e){let t=String(e||"").trim();if(!t)return null;let r=Lt(t);if(r)return r;let n=[...t.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)];for(let s=n.length-1;s>=0;s-=1){let i=Gr(n[s][1]);if(i)return i}if(!t.endsWith("}"))return null;for(let s=t.lastIndexOf("{");s>=0;s=t.lastIndexOf("{",s-1)){let i=Gr(t.slice(s));if(i)return i}return null}function so(e){let t=Ne(e);for(let r=t.length-1;r>=0;r-=1){let n=Lt(t[r]);if(n)return n}return Lt(ht(t))}function Xr(e){if(!u(e))return!1;if(U(e.output))return!0;for(let t of["content","text","message","summary"])if(a(e[t]))return!0;return!!(zr(e.status)||a(e.error)||a(e.errorMessage))}function H(e){let t=u(e)?{...e}:{};return(!Array.isArray(t._artifacts)||t._artifacts.length===0)&&Array.isArray(t.artifacts)&&t.artifacts.length>0&&(t._artifacts=t.artifacts),delete t.artifacts,t}function io(e){return u(e)?typeof(u(e._decision)?e._decision:u(e.decision)?e.decision:e).passed=="boolean":!1}function oo(e){return u(e)?u(e._decision)&&typeof e._decision.passed=="boolean"?!0:io(e.output):!1}function Oe(e,t,r){let n=u(e)?{...e}:{};if(!U(n.output)){for(let s of["summary","message","content","text"])if(a(n[s])){n.output=a(n[s]);break}}return!U(n.output)&&a(r)&&(n.output=a(r)),{...n,_meta:{...u(n._meta)?n._meta:{},runtimeOutputSource:t,requiredRuntimeResult:!0,finalMessagePreview:a(r).slice(0,1e3)}}}var ao=["dataUrl","dataURL","contentDataUrl","contentDataURL","contentBase64","base64","data"];function Vr(e){if(!u(e))return"";let t=u(e.content)?e.content:{},r=u(e.metadata)?e.metadata:{};return a(e.fieldKey||e.field_key||t.fieldKey||r.fieldKey)}function co(e,t){let r=u(e.content)?e.content:{},n=u(t.content)?t.content:{},s={...e,...t,content:{...r,...n},metadata:{...u(e.metadata)?e.metadata:{},...u(t.metadata)?t.metadata:{}}};for(let i of ao)U(e[i])&&(s[i]=e[i]),U(r[i])&&(s.content[i]=r[i]);return s}function uo(e,t){let r=Array.isArray(e)?e.filter(u):[],n=Array.isArray(t)?t.filter(u):[];if(!r.length)return n;if(!n.length)return r;let s=[...r],i=new Map;for(let c=0;c<r.length;c+=1){let l=Vr(r[c]),d=i.get(l)||[];d.push(c),i.set(l,d)}let o=new Map;for(let c of n){let l=Vr(c),d=o.get(l)||0;o.set(l,d+1);let f=i.get(l)?.[d];f===void 0?s.push(c):s[f]=co(s[f],c)}return s}function q(e,t,r){let n={...e,...t,_meta:{...u(e._meta)?e._meta:{},...u(t._meta)?t._meta:{},runtimeOutputSource:r}};return(Array.isArray(e._artifacts)||Array.isArray(t._artifacts))&&(n._artifacts=uo(e._artifacts,t._artifacts)),n}function lo(e,t,r={}){let n=a(r.promptKind),s=r.requiresRuntimeResult===!0,i=s||n==="dispatch",o=H(e),c=typeof o.output=="string"?Lt(o.output):null;if(c)return q(o,H(c),"result_block");let l=eo(t),d=l?Kr(l):null,f=i?so(t):null;if(Xr(o))return zr(o.status)||a(o.error)||a(o.errorMessage)?o:n==="dispatch"&&d?q(o,H(d),"final_event"):n==="dispatch"&&f?q(o,H(f),"updates"):!s||oo(o)?o:d?q(o,H(d),"final_event"):f?q(o,H(f),"updates"):(Ie(o.output,l,ht(Ne(t))),Oe(o,"result",o.output));if(d)return q(o,H(d),"final_event");if(f)return q(o,H(f),"updates");if(l)return s?(Ie(l,ht(Ne(t))),Oe(o,"final_event",l)):{...o,output:l,_meta:{...u(o._meta)?o._meta:{},runtimeOutputSource:"final_event"}};let p=ro(jr(t));if(!p)return o;let g=Kr(p);return g?q(o,H(g),"updates"):s?(Ie(jr(t),p),Oe(o,"updates",p)):{...o,output:p,_meta:{...u(o._meta)?o._meta:{},runtimeOutputSource:"updates"}}}var Dt=class{constructor(t){this.config=t,this.targets=t.targets||{},this.agents=new Map,this.sessions=new Map,this.runtimeSessionIndex=new Map,this.pendingPermissions=new Map,this.operations=new Map,this.startedAt=ot(),this.sandboxCapabilities={dispatchable:t.sandboxRequired!==!0,enforced:!1,backend:t.sandboxRequired?"unavailable":"direct",daemonStatus:t.sandboxRequired?"pending":"not_required",policySchemaVersions:[1],runtimePolicyUpdates:t.sandboxRequired===!0,workspaceSync:!1,egressProxy:!1},this.cleanupTimer=null,this.startSessionCleanup()}async start(){try{this.sandboxCapabilities=await Fr(this.config)}catch(t){this.sandboxCapabilities={...this.sandboxCapabilities,dispatchable:!1,enforced:!1,backend:"unavailable",daemonStatus:"unavailable",reason:a(t?.code||t?.message||t)||"sandbox_probe_failed"},h("error","runtime-bridge","runtime node sandbox probe failed; node will not accept work",{reason:this.sandboxCapabilities.reason})}return this.sandboxCapabilities}assertDispatchable(){if(this.config.sandboxRequired&&!(this.sandboxCapabilities.dispatchable===!0&&this.sandboxCapabilities.enforced===!0))throw Object.assign(new Error("runtime node strong sandbox is unavailable"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"})}operationIdentity(t,r,n){let s=u(t.goalContract)?de(t.goalContract):a(t.goalContractHash),i=Ci("sha256").update(F({prompt:Array.isArray(t.prompt)?t.prompt:[],mcpServers:Hi(t.mcpServers)})).digest("hex");return{agentId:r,runId:a(t.runId),sessionId:n,targetCode:a(t.targetCode||t.framework),workspace:a(t.workspace),goalContractHash:s,requestHash:i}}assertOperationIdentity(t,r,n,s){let i=this.operationIdentity(r,n,s),o=Object.keys(t.identity).find(c=>t.identity[c]!==i[c]);if(o)throw Object.assign(new Error(`runtime operation correlation conflict: ${t.correlationId}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT",field:o})}createOperation(t,r,n,s){let i={correlationId:t,agentId:n,sessionId:s,identity:this.operationIdentity(r,n,s),sandboxPolicy:u(r.sandboxPolicy)?structuredClone(r.sandboxPolicy):null,status:"running",updates:[],listeners:new Set,waiters:[],response:null,error:null,createdAtMs:Date.now(),completedAtMs:null};return this.operations.set(t,i),i}async attachOperation(t,r={}){let n=()=>{if(r.onUpdate)for(let s of t.updates)r.onUpdate(s)};if(t.status==="completed")return n(),t.response;if(t.status==="failed")throw n(),t.error;r.onUpdate&&t.listeners.add(r.onUpdate);try{return n(),await new Promise((s,i)=>t.waiters.push({resolve:s,reject:i}))}finally{r.onUpdate&&t.listeners.delete(r.onUpdate)}}completeOperation(t,r){if(t.status==="running"){t.status="completed",t.response=r,t.completedAtMs=Date.now();for(let n of t.waiters.splice(0))n.resolve(r);t.listeners.clear()}}promptResponse(t,r,n,s,i){let o=u(t.metadata)?t.metadata:{},c=u(o._runtimeBridge)?o._runtimeBridge:{},l=lo(i,s,c),d=kr(t.goalContract,s,t.goalContractHash);return{sessionId:n,runtimeSessionId:r.runtimeSessionId,result:l,updates:s,...d?{verification:d}:{}}}failOperation(t,r){if(t.status!=="running")return;let n=r instanceof Error?r:Object.assign(new Error(String(r||"runtime operation failed")),{code:"RUNTIME_NODE_ERROR"});t.status="failed",t.error=n,t.completedAtMs=Date.now();for(let s of t.waiters.splice(0))s.reject(n);t.listeners.clear()}cleanupOperations(t=Date.now()){let r=B(this.config.operationTtlMs,Pi);for(let[n,s]of this.operations)s.status!=="running"&&t-(s.completedAtMs||s.createdAtMs)>r&&this.operations.delete(n)}targetFor(t){let r=a(t)||this.config.defaultTargetCode,n=this.targets[r];if(!r||!u(n)){let s=new Error(`runtime target is not configured: ${r||"<empty>"}`);throw s.code="RUNTIME_TARGET_NOT_FOUND",s}return{code:r,target:n}}targetIdleTtlMs(t){let n=$(t)==="openclaw"?B(this.config.openClawSessionIdleTtlMs,ki):B(this.config.sessionIdleTtlMs,bi);return B(t?.sessionIdleTtlMs??t?.idleTtlMs,n)}targetMaxSessions(t,r=null){let s=$(t)==="openclaw"?B(this.config.openClawMaxSessions,Li):B(this.config.maxSessionsPerTarget,Ui),i=B(t?.maxSessions,s),o=xe(r);return o?Math.max(i,o):i}targetReleaseAfterPrompt(t,r={}){let n=$(t),s=u(r?._runtimeBridge)?r._runtimeBridge:{},i=Ae(s);return i!==void 0?mt(i,!1):mt(t?.releaseAfterPrompt??t?.disposeAfterPrompt,n==="openclaw")}promptReleaseAfterPrompt(t,r={}){if(this.config.sandboxRequired)return!0;let n=u(r?._runtimeBridge)?r._runtimeBridge:{},s=Ae(n);return s!==void 0?mt(s,t.releaseAfterPrompt):t.releaseAfterPrompt}startSessionCleanup(){let t=B(this.config.sessionCleanupIntervalMs,Mi);t<=0||(this.cleanupTimer=setInterval(()=>{this.cleanupExpiredSessions().catch(r=>{h("warn","runtime-bridge","runtime session cleanup failed",{error:String(r)})})},t),this.cleanupTimer.unref?.())}sessionCountForTarget(t){let r=0;for(let n of this.sessions.values())n.targetCode===t&&(r+=1);return r}sessionCountForAgentTarget(t,r){let n=0;for(let s of this.sessions.values())s.agentId===t&&s.targetCode===r&&(n+=1);return n}idleTargetSessions(t){return[...this.sessions.entries()].filter(([,r])=>r.targetCode===t&&!r.busy).sort((r,n)=>(r[1].lastUsedAtMs||0)-(n[1].lastUsedAtMs||0))}idleAgentTargetSessions(t,r){return[...this.sessions.entries()].filter(([,n])=>n.agentId===t&&n.targetCode===r&&!n.busy).sort((n,s)=>(n[1].lastUsedAtMs||0)-(s[1].lastUsedAtMs||0))}async closeSession(t,r="session_closed"){let n=this.sessions.get(t);if(!n)return!1;try{await n.runtime?.stop?.(r)}catch(s){h("warn","runtime-bridge","runtime session stop failed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,error:String(s)})}return this.sessions.delete(t),this.runtimeSessionIndex.delete(`${n.agentId}:${n.runtimeSessionId}`),h("info","runtime-bridge","runtime session closed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,reason:r}),!0}async closeAllSessions(t="bridge_shutdown"){for(let r of[...this.sessions.keys()])await this.closeSession(r,t)}async stop(t="bridge_stop"){this.cleanupTimer&&clearInterval(this.cleanupTimer),this.cleanupTimer=null,await this.closeAllSessions(t)}async cleanupExpiredSessions(t=Date.now()){for(let[r,n]of[...this.sessions.entries()])n.busy||t-(n.lastUsedAtMs||n.createdAtMs||t)>n.idleTtlMs&&await this.closeSession(r,"idle_timeout")}async reserveTargetSlot(t,r,n={}){let s=a(n.agentId),i=xe(n.runtimeMaxSessions);if(s&&i)for(;this.sessionCountForAgentTarget(s,t)>=i;){let c=this.idleAgentTargetSessions(s,t);if(!c.length){let l=new Error(`runtime agent session limit reached: ${s}`);throw l.code="RUNTIME_AGENT_SESSION_LIMIT",l}await this.closeSession(c[0][0],"agent_session_limit")}let o=this.targetMaxSessions(r,i);for(;this.sessionCountForTarget(t)>=o;){let c=this.idleTargetSessions(t);if(!c.length){let l=new Error(`runtime target session limit reached: ${t}`);throw l.code="RUNTIME_TARGET_SESSION_LIMIT",l}await this.closeSession(c[0][0],"target_session_limit")}}async createAgent(t){let r=a(t.agentId);if(!r)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});let{code:n,target:s}=this.targetFor(t.targetCode||t.framework),i=this.agents.get(r);if(i&&i.targetCode!==n)throw Object.assign(new Error(`runtime agent target conflict: ${r}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});let o=this.config.sandboxRequired?await _e(this.config,s,t.workspace):a(t.workspace),c={agentId:r,targetCode:n,framework:a(t.framework||n),workspace:o,metadata:u(t.metadata)?t.metadata:{},createdAt:ot(),runtimeKind:$(s),runtimeMaxSessions:Br(t)};return this.agents.set(r,c),{agent:c}}runtimeFor(t,r,n={}){let{target:s}=this.targetFor(t.targetCode),i=$(s),o={onPermissionRequest:l=>this.requestPermission(l)},c={sessionPromptTimeoutMs:this.config.sessionPromptTimeoutMs,sandboxRequired:this.config.sandboxRequired,...this.config.sandboxRequired?{prepareLaunch:l=>Hr({config:this.config,target:s,...l,runId:n.runId,agentId:t.agentId,sessionId:r,sandboxPolicy:n.sandboxPolicy})}:{}};return i==="stdio-acp"||i==="acp"?new Q(t,s,o,c):i==="openclaw"?new wt(t,s,r,o,c):i==="cli"?new Ct(t,s,c):new yt(t)}async prompt(t,r={}){if(this.assertDispatchable(),this.config.sandboxRequired){let c=a(t.runId);if(!c)throw Object.assign(new Error("runId is required"),{code:"BAD_REQUEST"});t={...t,runId:c,sandboxPolicy:K(t.sandboxPolicy)}}let n=a(t.agentId),s=a(t.sessionId)||kt(),i=a(t.correlationId);if(!n)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});if(this.cleanupOperations(),i){let c=this.operations.get(i);if(c)return this.assertOperationIdentity(c,t,n,s),this.attachOperation(c,r);if(t.attachOnly===!0)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"})}else if(t.attachOnly===!0)throw Object.assign(new Error("correlationId is required for attachOnly"),{code:"BAD_REQUEST"});let o=i?this.createOperation(i,t,n,s):null;if(o){let c=this.attachOperation(o,r);return(async()=>{try{await this._promptOwned(t,{},o,n,s)}catch(l){let d=o.status==="completed";this.failOperation(o,l),d&&h("warn","runtime-bridge","runtime cleanup failed after operation completion",{correlationId:o.correlationId,error:String(l)})}})(),await c}return await this._promptOwned(t,r,o,n,s)}async _promptOwned(t,r,n,s,i){let o=a(t.runId),c=this.config.sandboxRequired?K(n?.sandboxPolicy||t.sandboxPolicy):null,l=this.agents.get(s),d=this.targetFor(t.targetCode||t.framework||l?.targetCode);if(l&&l.targetCode!==d.code)throw Object.assign(new Error(`runtime agent target conflict: ${s}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});if($(d.target)==="cli"&&$i(t.goalContract))throw Object.assign(new Error("CLI runtimes do not support per-run dynamic MCP required by plugin_operation"),{code:"unsupported_dynamic_mcp"});let f=l||(await this.createAgent({agentId:s,targetCode:d.code,framework:t.framework,workspace:t.workspace,runtimeMaxSessions:t.runtimeMaxSessions,metadata:t.metadata})).agent,p=Br(t);if(p&&(f.runtimeMaxSessions=p),!this.config.sandboxRequired){let _=a(t.workspace);_&&_!==f.workspace&&(f.workspace=_)}let g=`${s}:${i}`;await this.cleanupExpiredSessions();let m=this.sessions.get(g);if(m&&m.targetCode!==d.code)throw Object.assign(new Error(`runtime session target conflict: ${i}`),{code:"RUNTIME_SESSION_TARGET_CONFLICT"});if(m&&this.config.sandboxRequired&&m.runId!==o)throw Object.assign(new Error(`runtime session cannot be shared across runs: ${i}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});if(!m){let{code:_,target:y}=d;await this.reserveTargetSlot(_,y,{agentId:s,runtimeMaxSessions:f.runtimeMaxSessions});let E=this.runtimeFor(f,i,{runId:o,sandboxPolicy:c}),A=await E.sessionNew({cwd:f.workspace||process.cwd(),mcpServers:Array.isArray(t.mcpServers)?t.mcpServers:[],metadata:u(t.metadata)?t.metadata:{}}),W=Date.now();m={agentId:s,sessionId:i,runtime:E,targetCode:_,runtimeKind:$(y),runId:o,sandboxPolicy:c?structuredClone(c):null,runtimeSessionId:a(u(A)?A.sessionId:"")||i,idleTtlMs:this.targetIdleTtlMs(y),releaseAfterPrompt:this.config.sandboxRequired?!0:this.targetReleaseAfterPrompt(y,t.metadata),createdAtMs:W,lastUsedAtMs:W,busy:!1,createdAt:ot()},this.sessions.set(g,m),this.runtimeSessionIndex.set(`${s}:${m.runtimeSessionId}`,m)}if(m.busy){let _=new Error(`runtime session is already running: ${i}`);throw _.code="RUNTIME_SESSION_BUSY",_}m.busy=!0,m.operationCorrelationId=n?.correlationId||null,m.lastUsedAtMs=Date.now();let S=n?.updates||[],O=_=>{let y=Bi(_,i,m);if(S.push(y),n)for(let E of n.listeners)try{E?.(y)}catch(A){h("warn","runtime-bridge","runtime operation update listener failed",{correlationId:n.correlationId,error:String(A)})}else r.onUpdate?.(y)},N=_=>{if(!(!n||n.status!=="running"||!u(_))){if(_.status==="failed"){let y=_.error;if(y instanceof Error){this.failOperation(n,y);return}let E=u(y)?y:{},A=Object.assign(new Error(a(E.message||_.message)||"runtime terminal failure"),{code:a(E.code||_.code)||"RUNTIME_TERMINAL_FAILED"});this.failOperation(n,A);return}this.completeOperation(n,this.promptResponse(t,m,i,S,u(_.result)?_.result:{stopReason:"end_turn"}))}};try{let _=Pr(t.goalContract),y=Array.isArray(t.prompt)?[...t.prompt]:[];_&&y.unshift({type:"text",text:_,metadata:{source:"orcha_goal_contract"}});let E=await m.runtime.sessionPrompt({sessionId:m.runtimeSessionId,prompt:y,metadata:u(t.metadata)?t.metadata:{}},O,N),A=this.promptResponse(t,m,i,S,E);return n&&this.completeOperation(n,A),A}finally{m.busy=!1,m.operationCorrelationId===n?.correlationId&&(m.operationCorrelationId=null),m.lastUsedAtMs=Date.now(),this.promptReleaseAfterPrompt(m,u(t.metadata)?t.metadata:{})&&await this.closeSession(g,"release_after_prompt")}}async updatePolicy(t){if(this.assertDispatchable(),!this.config.sandboxRequired)throw Object.assign(new Error("runtime sandbox policy updates require an enforced sandbox"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"});let r=a(t.agentId),n=a(t.runId),s=a(t.sessionId),i=a(t.correlationId);if(!r||!n||!s||!i)throw Object.assign(new Error("agentId, runId, sessionId and correlationId are required"),{code:"BAD_REQUEST"});let o=K(t.sandboxPolicy),c=this.operations.get(i);if(c&&(c.agentId!==r||c.sessionId!==s||c.identity.runId!==n))throw Object.assign(new Error(`runtime operation policy identity conflict: ${i}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let l=`${r}:${s}`,d=this.sessions.get(l);if(d&&d.runId!==n)throw Object.assign(new Error(`runtime session policy identity conflict: ${s}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});let f=d?.sandboxPolicy||c?.sandboxPolicy;if(!f)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"});let p=Number(f.policyRevision),g=Number(o.policyRevision);if(g<p)throw Object.assign(new Error("runtime sandbox policy revision is stale"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});if(g===p){if(F(f)!==F(o))throw Object.assign(new Error("runtime sandbox policy revision payload conflicts"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});return{updated:!1,idempotent:!0,policyRevision:p,accessMode:f.accessMode}}let m=vr(f,o);c&&(c.sandboxPolicy=structuredClone(o)),d&&(d.sandboxPolicy=structuredClone(o));let S=!1;return m&&d?.busy===!0&&(await d.runtime.sessionCancel({sessionId:d.runtimeSessionId}),S=await this.closeSession(l,"sandbox_policy_downgrade")),{updated:!0,policyRevision:g,accessMode:o.accessMode,activeCommandCancelled:S,deferredToNextLaunch:!m&&d?.busy===!0}}async cancel(t){let r=a(t.agentId),n=a(t.sessionId),s=a(t.correlationId);if(s){let c=this.operations.get(s);if(!c||c.status!=="running")return{cancelled:!1,correlationId:s,reason:"operation_not_running"};if(c.agentId!==r||c.sessionId!==n)throw Object.assign(new Error(`runtime operation cancellation identity conflict: ${s}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let l=this.sessions.get(`${r}:${n}`);return!l||l.busy!==!0||l.operationCorrelationId!==s?{cancelled:!1,correlationId:s,reason:"operation_not_running"}:(await l.runtime.sessionCancel({sessionId:l.runtimeSessionId}),await this.closeSession(`${r}:${n}`,"cancelled"),{cancelled:!0,correlationId:s})}let i=`${r}:${n}`,o=this.sessions.get(i);return o?(await o.runtime.sessionCancel({sessionId:o.runtimeSessionId}),await this.closeSession(i,"cancelled"),{cancelled:!0}):{cancelled:!1}}async dispatch(t,r={}){let n=a(t.agentId),s=a(t.taskId),i=a(t.executionId);if(!n||!s)throw Object.assign(new Error("agentId and taskId are required"),{status:400,code:"BAD_REQUEST"});let o=a(t.sessionId)||`dispatch-${i||s}`,c=a(t.instructions),l=Yi(t),d=Wr(t),{target:f}=this.targetFor(t.targetCode||t.framework),p=[{type:"text",text:["Task dispatch received.",`taskId: ${s}`,i?`executionId: ${i}`:"",c?`instructions: ${c}`:"",l?"orchaContext:":"",l,l?"Use orchaContext as the source of truth for upstream outputs, review reports, artifacts, and workflow metadata.":"","Follow the execution protocol in instructions exactly.","When embedding a generated artifact in final Markdown, use the Orcha artifact placeholder as the link target: orcha-artifact://<fieldKey>/<index>.","Example: use ![illustration](orcha-artifact://image/0) for the first generated image artifact.","Do not use local filesystem paths, file:// URLs, or data: URLs in final Markdown; Orcha replaces artifact placeholders after ingestion.",d?`For decision results, put the raw report between ${Ar} and ${Cr}.`:"",d?`Then put a JSON object containing _decision between ${Nr} and ${br}.`:"",d?"Do not JSON-escape the report. Keep output out of the CONTROL JSON, and put every protocol marker on its own line.":"","Return only the final answer required by that protocol.","Do not include process notes, logs, or explanations."].filter(Boolean).join(`
+`)}];return this.prompt({...t,agentId:n,sessionId:o,prompt:p,metadata:Xi(t,f)},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s}){let i=kt(),c=this.runtimeSessionIndex.get(`${t.agentId}:${r}`)?.sessionId||r||kt(),l={permissionId:i,agentId:t.agentId,sessionId:c,runtimeSessionId:r,request:u(n)?n:{},status:"pending",createdAt:ot()};return s?.({sessionId:r,update:{sessionUpdate:"permission_request",permission:l}}),await new Promise(d=>{let f=T(n?.timeoutMs,this.config.permissionRequestTimeoutMs),p=setTimeout(()=>{this.pendingPermissions.delete(i),d({permissionId:i,outcome:"denied",response:{reason:"permission request timed out"}})},f);this.pendingPermissions.set(i,{timer:p,resolve:d,permission:l})})}async respondPermission(t){let r=a(t.permissionId),n=this.pendingPermissions.get(r),s=a(t.outcome||"approved")||"approved";return n?(clearTimeout(n.timer),this.pendingPermissions.delete(r),n.resolve({permissionId:r,outcome:s,response:u(t.response)?t.response:{},userId:a(t.userId),metadata:u(t.metadata)?t.metadata:{}}),{accepted:!0,permissionId:r,outcome:s}):{accepted:!1,permissionId:r,outcome:s}}health(){return{status:this.config.sandboxRequired&&!this.sandboxCapabilities.dispatchable?"unavailable":"ok",bridgeVersion:Y,startedAt:this.startedAt,agents:[...this.agents.values()].map(t=>({agentId:t.agentId,targetCode:t.targetCode,framework:t.framework,runtimeKind:t.runtimeKind})),sessions:this.sessions.size,pendingPermissions:this.pendingPermissions.size,targets:Object.keys(this.targets),sandboxCapabilities:this.sandboxCapabilities}}};import fo from"node:http";import po from"node:https";import{randomBytes as Yr}from"node:crypto";var et=1,V=3,mo=1e4,vt=class{constructor(t,r={}){this.url=t,this.readyState=0,this.socket=null,this.request=null,this.buffer=Buffer.alloc(0),this.listeners=new Map,this.connectTimeoutMs=ho(r.connectTimeoutMs,mo),this.connectTimer=null,this.connect()}addEventListener(t,r){let n=this.listeners.get(t)||new Set;n.add(r),this.listeners.set(t,n)}emit(t,r={}){let n=this.listeners.get(t);if(n)for(let s of n)s(r)}connect(){let t=new URL(this.url),r=t.protocol==="wss:"?po:fo,n=Yr(16).toString("base64"),s=r.request({protocol:t.protocol==="wss:"?"https:":"http:",hostname:t.hostname,port:t.port||(t.protocol==="wss:"?443:80),path:`${t.pathname}${t.search}`,method:"GET",headers:{Connection:"Upgrade",Upgrade:"websocket","Sec-WebSocket-Key":n,"Sec-WebSocket-Version":"13"}});this.request=s,this.startConnectTimer(s),s.on("upgrade",(i,o,c)=>{if(this.clearConnectTimer(),this.readyState===V){o.destroy();return}this.socket=o,this.readyState=et,o.on("data",l=>this.onData(l)),o.on("close",()=>this.onClose()),o.on("error",l=>{this.readyState!==V&&this.emit("error",{error:l,message:l.message,type:"error"}),this.onClose()}),c?.length&&this.onData(c),this.emit("open")}),s.on("response",i=>{this.clearConnectTimer(),this.emit("error",{message:`websocket upgrade failed: HTTP ${i.statusCode}`,type:"error"}),i.resume(),this.onClose()}),s.on("error",i=>{this.clearConnectTimer(),this.readyState!==V&&this.emit("error",{error:i,message:i.message,type:"error"}),this.onClose()}),s.end()}startConnectTimer(t){this.connectTimeoutMs<=0||(this.connectTimer=setTimeout(()=>{if(this.readyState===et||this.readyState===V)return;let r=`websocket connect timeout after ${this.connectTimeoutMs}ms`;this.emit("error",{message:r,type:"timeout"}),this.onClose(),t.destroy(new Error(r))},this.connectTimeoutMs),this.connectTimer.unref?.())}clearConnectTimer(){this.connectTimer&&(clearTimeout(this.connectTimer),this.connectTimer=null)}send(t){!this.socket||this.readyState!==et||this.socket.write(be(1,Buffer.from(String(t),"utf8")))}close(){if(this.readyState!==V){if(this.clearConnectTimer(),!this.socket){this.request?.destroy(),this.onClose();return}try{this.readyState===et&&this.socket.write(be(8,Buffer.alloc(0))),this.socket.end()}catch{this.socket.destroy()}this.onClose()}}onClose(){this.readyState!==V&&(this.clearConnectTimer(),this.readyState=V,this.request=null,this.emit("close"))}onData(t){for(this.buffer=Buffer.concat([this.buffer,t]);this.buffer.length>=2;){let r=this.buffer[0],n=this.buffer[1],s=r&15,i=(n&128)!==0,o=n&127,c=2;if(o===126){if(this.buffer.length<c+2)return;o=this.buffer.readUInt16BE(c),c+=2}else if(o===127){if(this.buffer.length<c+8)return;let f=this.buffer.readUInt32BE(c),p=this.buffer.readUInt32BE(c+4);o=f*2**32+p,c+=8}let l=c;if(i&&(c+=4),this.buffer.length<c+o)return;let d=this.buffer.subarray(c,c+o);if(i){let f=this.buffer.subarray(l,l+4);d=Buffer.from(d.map((p,g)=>p^f[g%4]))}this.buffer=this.buffer.subarray(c+o),s===1?this.emit("message",{data:d.toString("utf8")}):s===8?this.close():s===9&&this.socket?.write(be(10,d))}}};function ho(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function be(e,t){let r=t.length,n=2;r>=126&&r<=65535?n+=2:r>65535&&(n+=8);let s=Yr(4),i=Buffer.alloc(n+4+r);i[0]=128|e;let o=2;r<126?i[1]=128|r:r<=65535?(i[1]=254,i.writeUInt16BE(r,o),o+=2):(i[1]=255,i.writeUInt32BE(Math.floor(r/2**32),o),i.writeUInt32BE(r>>>0,o+4),o+=8),s.copy(i,o),o+=4;for(let c=0;c<r;c+=1)i[o+c]=t[c]^s[c%4];return i}function go(e){let t=new URL(e);if(t.protocol==="http:")t.protocol="ws:";else if(t.protocol==="https:")t.protocol="wss:";else if(t.protocol!=="ws:"&&t.protocol!=="wss:")throw new Error(`unsupported ORCHA_RUNTIME_ORCHA_URL protocol: ${t.protocol}`);return t.pathname=`${t.pathname.replace(/\/+$/,"")}/api/agent-runtime-bridge/ws`,t.search="",t.toString()}function Me(e,t=!0){return Object.entries(e||{}).map(([r,n])=>({targetCode:r,targetName:a(n?.name||n?.targetName||r),targetType:a(n?.type||"echo"),status:t?"available":"unavailable"}))}var Ft=class{constructor(t,r){this.config=t,this.bridge=r,this.ws=null,this.stopped=!1,this.connected=!1,this.reconnectTimer=null,this.heartbeatTimer=null}sandboxCapabilities(){return this.bridge.sandboxCapabilities||{dispatchable:this.config.sandboxRequired!==!0,enforced:!1,backend:"development_direct",daemonStatus:"development_only",policySchemaVersions:[1],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:!1}}start(){this.connect()}stop(){this.stopped=!0,this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=null,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.ws?.close()}connect(){if(this.stopped)return;let t=go(this.config.orchaUrl),r=new vt(t,{connectTimeoutMs:this.config.connectTimeoutMs});this.ws=r,r.addEventListener("open",()=>{if(this.ws!==r||this.stopped){r.close();return}this.authenticate(r)}),r.addEventListener("message",n=>this.handleMessage(n.data,r)),r.addEventListener("close",()=>this.scheduleReconnect("close",r)),r.addEventListener("error",n=>{h("warn","orcha-client","runtime node websocket error",{error:String(n?.message||n?.type||n)})})}authenticate(t=this.ws){this.send({type:"runtime_node.authenticate",token:this.config.nodeToken,nodeId:this.config.nodeId,nodeName:this.config.nodeName,version:Y,protocolVersion:"orcha-runtime-node.v1",defaultTargetCode:this.config.defaultTargetCode,sandboxCapabilities:this.sandboxCapabilities(),targets:Me(this.config.targets,this.sandboxCapabilities().dispatchable===!0)},t)}scheduleReconnect(t,r=this.ws){r&&this.ws!==r||(this.connected=!1,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,r&&this.ws===r&&(this.ws=null),!this.stopped&&(this.reconnectTimer||(h("info","orcha-client","runtime node disconnected; reconnect scheduled",{reason:t,reconnectMs:this.config.reconnectMs}),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},this.config.reconnectMs))))}async handleMessage(t,r=this.ws){if(r&&this.ws!==r)return;let n;try{n=JSON.parse(String(t))}catch(s){h("warn","orcha-client","invalid Orcha websocket frame",{error:String(s)});return}if(u(n)){if(n.type==="runtime_node.authenticated"){if(r&&this.ws!==r)return;this.connected=!0,this.startHeartbeat(r),h("info","orcha-client","runtime node authenticated",{nodeId:this.config.nodeId,connectionId:n.connectionId});return}if(n.type==="orcha.runtime.request"){await this.handleRequest(n);return}n.type==="runtime_node.ping"&&this.send({type:"runtime_node.pong",ts:new Date().toISOString(),sandboxCapabilities:this.sandboxCapabilities(),targets:Me(this.config.targets,this.sandboxCapabilities().dispatchable===!0)})}}startHeartbeat(t){this.heartbeatTimer&&clearInterval(this.heartbeatTimer);let r=Math.max(1e3,Number(this.config.heartbeatIntervalMs||15e3)),n=()=>this.send({type:"runtime_node.heartbeat",ts:new Date().toISOString(),sandboxCapabilities:this.sandboxCapabilities(),targets:Me(this.config.targets,this.sandboxCapabilities().dispatchable===!0)},t);n(),this.heartbeatTimer=setInterval(n,r),this.heartbeatTimer.unref?.()}async handleRequest(t){let r=a(t.id),n=a(t.method),s=u(t.params)?t.params:{};try{let i=await this.invoke(n,s,r);this.send({type:"orcha.runtime.response",id:r,ok:!0,result:i})}catch(i){this.send({type:"orcha.runtime.response",id:r,ok:!1,error:{code:i.code||"RUNTIME_NODE_ERROR",message:i.message||String(i)}})}}async invoke(t,r,n){if(t==="health")return this.bridge.health();if(t==="agents/create")return this.bridge.createAgent(r);if(t==="agents/dispatch")return this.bridge.dispatch(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/prompt")return this.bridge.prompt(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/policy")return this.bridge.updatePolicy(r);if(t==="sessions/cancel")return this.bridge.cancel(r);if(t==="permissions/respond")return this.bridge.respondPermission(r);throw Object.assign(new Error(`unsupported Orcha runtime method: ${t}`),{code:"METHOD_NOT_FOUND"})}sendUpdate(t,r){this.send({type:"orcha.runtime.event",requestId:t,eventType:"runtime.update",payload:r})}send(t,r=this.ws){return!r||r!==this.ws||r.readyState!==et?!1:(r.send(JSON.stringify(t)),!0)}};import{existsSync as Qr,readFileSync as _o}from"node:fs";import{dirname as To,resolve as Ht}from"node:path";import{fileURLToPath as yo}from"node:url";var Ro=/^[A-Za-z_][A-Za-z0-9_]*$/;function Zr(e=process.env,t=process.cwd()){let r=a(e.ORCHA_RUNTIME_ENV_FILE),n=r?Ht(t,r):Ht(t,".env");if(!Qr(n))return r&&h("warn","config","runtime env file not found",{path:n}),{loaded:!1,path:n,keys:[]};let s=[],i=_o(n,"utf8");for(let o of i.split(/\r?\n/)){let c=wo(o);if(!c)continue;let[l,d]=c;Object.prototype.hasOwnProperty.call(e,l)||(e[l]=d,s.push(l))}return h("info","config","runtime env file loaded",{path:n,keyCount:s.length}),{loaded:!0,path:n,keys:s}}function tn(e=process.env){let t=a(e.ORCHA_RUNTIME_MODE||(e.ORCHA_RUNTIME_ORCHA_URL?"node":"server")),r=a(e.ORCHA_RUNTIME_BRIDGE_HOST||"127.0.0.1"),n=!1,s=To(yo(import.meta.url)),i=Ht(s,"sandbox","broker.js"),o=Ht(s,"orcha-runtime-sandbox-broker.js"),c=Qr(i)?i:o,l=a(e.ORCHA_RUNTIME_SANDBOX_BROKER_COMMAND);return{mode:t,host:r,port:T(e.ORCHA_RUNTIME_BRIDGE_PORT,5588),token:e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",orchaUrl:a(e.ORCHA_RUNTIME_ORCHA_URL),nodeToken:e.ORCHA_RUNTIME_NODE_TOKEN||e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",nodeId:a(e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"local-runtime-node"),nodeName:a(e.ORCHA_RUNTIME_NODE_NAME||e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"Local Runtime Node"),reconnectMs:T(e.ORCHA_RUNTIME_RECONNECT_MS,3e3),connectTimeoutMs:T(e.ORCHA_RUNTIME_CONNECT_TIMEOUT_MS||e.ORCHA_RUNTIME_WS_CONNECT_TIMEOUT_MS,1e4),defaultTargetCode:e.ORCHA_RUNTIME_DEFAULT_TARGET||"echo",requestLimitBytes:T(e.ORCHA_RUNTIME_REQUEST_LIMIT_BYTES,1048576),sessionPromptTimeoutMs:T(e.ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS,36e5),permissionRequestTimeoutMs:T(e.ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS,3e5),sessionIdleTtlMs:T(e.ORCHA_RUNTIME_SESSION_IDLE_TTL_MS,6e5),sessionCleanupIntervalMs:T(e.ORCHA_RUNTIME_SESSION_CLEANUP_INTERVAL_MS,6e4),maxSessionsPerTarget:T(e.ORCHA_RUNTIME_MAX_SESSIONS_PER_TARGET,8),openClawSessionIdleTtlMs:T(e.ORCHA_RUNTIME_OPENCLAW_SESSION_IDLE_TTL_MS,6e4),openClawMaxSessions:T(e.ORCHA_RUNTIME_OPENCLAW_MAX_SESSIONS,1),heartbeatIntervalMs:T(e.ORCHA_RUNTIME_HEARTBEAT_INTERVAL_MS,15e3),sandboxRequired:n,sandboxBrokerCommand:l||process.execPath,sandboxBrokerArguments:Ue(e.ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS,"ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS",l?[]:[c]),sandboxProbeTimeoutMs:T(e.ORCHA_RUNTIME_SANDBOX_PROBE_TIMEOUT_MS,1e4),sandboxTempRoot:a(e.ORCHA_RUNTIME_SANDBOX_TEMP_ROOT),trustedWorkspaceRoots:Ue(e.ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS,"ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS"),trustedToolchainRoots:Ue(e.ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS,"ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS"),egressProxyRequired:Eo(e.ORCHA_RUNTIME_EGRESS_PROXY_REQUIRED,t==="node"),egressProxySocket:a(e.ORCHA_RUNTIME_EGRESS_PROXY_SOCKET),egressProxyToken:a(e.ORCHA_RUNTIME_EGRESS_PROXY_TOKEN),egressGrantMaxTtlMs:T(e.ORCHA_RUNTIME_EGRESS_GRANT_MAX_TTL_MS,9e5),targets:So(e.ORCHA_RUNTIME_TARGETS_JSON||"")}}function So(e){if(!a(e))return{};try{let t=JSON.parse(e);if(u(t))return t}catch(t){h("warn","config","invalid ORCHA_RUNTIME_TARGETS_JSON",{error:String(t)})}return{}}function Eo(e,t){let r=a(e).toLowerCase();if(!r)return t;if(["true","1","yes","on"].includes(r))return!0;if(["false","0","no","off"].includes(r))return!1;throw new Error(`invalid boolean configuration value: ${r}`)}function Ue(e,t,r=[]){let n=a(e);if(!n)return[...r];let s;try{s=JSON.parse(n)}catch{throw new Error(`${t} must be a JSON string array`)}if(!Array.isArray(s)||s.some(i=>typeof i!="string"))throw new Error(`${t} must be a JSON string array`);return s.map(i=>i.trim()).filter(Boolean)}function wo(e){let t=e.trim();if(!t||t.startsWith("#"))return null;let r=t.startsWith("export ")?t.slice(7).trimStart():t,n=r.indexOf("=");if(n<=0)return null;let s=r.slice(0,n).trim();if(!Ro.test(s))return null;let i=Io(r.slice(n+1).trim());return[s,i]}function Io(e){if(!e)return"";let t=e[0];if((t==='"'||t==="'")&&e.endsWith(t)){let r=e.slice(1,-1);return t==='"'?Oo(r):r}return xo(e).trim()}function Oo(e){return e.replaceAll("\\n",`
+`).replaceAll("\\r","\r").replaceAll("\\t","	").replaceAll('\\"','"').replaceAll("\\\\","\\")}function xo(e){let t=!1,r=!1;for(let n=0;n<e.length;n+=1){let s=e[n],i=e[n-1];if(s==="'"&&!r)t=!t;else if(s==='"'&&!t&&i!=="\\")r=!r;else if(s==="#"&&!t&&!r&&/\s/.test(i||""))return e.slice(0,n)}return e}import{createServer as Ao}from"node:http";function $t(e,t,r){let n=JSON.stringify(r);e.writeHead(t,{"content-type":"application/json; charset=utf-8","content-length":Buffer.byteLength(n)}),e.end(n)}function z(e={}){return{ok:!0,...e}}function Pe(e,t,r){return{ok:!1,error:{code:e,message:t,...r===void 0?{}:{detail:r}}}}async function en(e,t){let r=[],n=0;for await(let i of e){if(n+=i.length,n>t)throw Object.assign(new Error("request body too large"),{status:413,code:"REQUEST_TOO_LARGE"});r.push(i)}if(r.length===0)return{};let s=Buffer.concat(r).toString("utf8");if(!s.trim())return{};try{let i=JSON.parse(s);if(!u(i))throw Object.assign(new Error("JSON body must be an object"),{status:400,code:"BAD_JSON"});return i}catch(i){throw i.status?i:Object.assign(new Error(`invalid JSON body: ${i.message}`),{status:400,code:"BAD_JSON"})}}function rn(e,t){if(!t)return;if((e.headers.authorization||"")!==`Bearer ${t}`)throw Object.assign(new Error("runtime bridge token is invalid"),{status:401,code:"UNAUTHORIZED"})}function nn(e,t){let r={"GET /health":async()=>z(t.health()),"POST /agents/create":async n=>z(await t.createAgent(n)),"POST /agents/dispatch":async n=>z(await t.dispatch(n)),"POST /sessions/prompt":async n=>z(await t.prompt(n)),"POST /sessions/cancel":async n=>z(await t.cancel(n)),"POST /permissions/respond":async n=>z(await t.respondPermission(n))};return Ao(async(n,s)=>{let i=new URL(n.url||"/",`http://${n.headers.host||`${e.host}:${e.port}`}`),o=`${n.method||"GET"} ${i.pathname}`,c=r[o];if(!c){$t(s,404,Pe("NOT_FOUND",`No route for ${o}`));return}try{rn(n,e.token);let l=n.method==="GET"?{}:await en(n,e.requestLimitBytes);$t(s,200,await c(l))}catch(l){let d=l.status||500,f=l.code||"BRIDGE_INTERNAL";$t(s,d,Pe(f,l.message||String(l)))}})}var Lo=ko(import.meta.url),Do=".orcha-runtime-bridge.pid",vo=".orcha-runtime-bridge.log",Fo=3,Ho=36e5,{command:$o,options:mn}=Go(process.argv.slice(2));Ko(mn);Zr();var Bo=tn();await qo($o,Bo,mn);async function qo(e,t,r){switch(e){case"run":case"foreground":await on(t);return;case"start":if(r.foreground){await on(t);return}cn();return;case"reload":case"restart":await un({quiet:!0}),cn();return;case"stop":await un();return;case"status":jo();return;case"help":case"--help":case"-h":Jo();return;default:throw new Error(`Unknown command: ${e}`)}}async function on(e){Vo();let t=new Dt(e);if(await t.start(),e.mode==="server"){let n=nn(e,t);an({bridge:t,server:n}),n.listen(e.port,e.host,()=>{h("info","runtime-bridge","Orcha runtime bridge HTTP server started",{host:e.host,port:e.port,targets:Object.keys(t.targets)})});return}if(!e.orchaUrl)throw new Error("ORCHA_RUNTIME_ORCHA_URL is required in runtime node mode");let r=new Ft(e,t);an({bridge:t,client:r}),r.start(),h("info","runtime-bridge","Orcha runtime node started",{nodeId:e.nodeId,nodeName:e.nodeName,orchaUrl:e.orchaUrl,targets:Object.keys(t.targets)})}function an({bridge:e,client:t,server:r}){let n=!1,s=i=>{if(n)return;n=!0;let o=Number(e?.sessions?.size||0)>0;h("info","runtime-bridge","runtime bridge shutting down",{signal:i});try{t?.stop?.()}catch(c){h("warn","runtime-bridge","runtime client stop failed",{error:String(c)})}Promise.resolve(e?.stop?.(`process_${String(i||"shutdown").toLowerCase()}`)).catch(c=>{h("warn","runtime-bridge","runtime bridge stop failed",{error:String(c)})}).finally(()=>{try{r?.close?.()}catch(c){h("warn","runtime-bridge","runtime server close failed",{error:String(c)})}}),setTimeout(()=>process.exit(0),o?8500:200)};process.once("SIGTERM",()=>s("SIGTERM")),process.once("SIGINT",()=>s("SIGINT"))}function cn(){let e=Fe(),t=hn(),r=He(e);if(r&&rt(r)){console.log(JSON.stringify({status:"already_running",pid:r,pidFile:e,logFile:t}));return}r&&De(e),dn(e),dn(t),Le(t);let n=Mo(t,"a"),s={...process.env,ORCHA_RUNTIME_PID_FILE:e,ORCHA_RUNTIME_LOG_FILE:t},i=Co(process.execPath,[Lo,"run"],{cwd:process.cwd(),detached:!0,env:s,stdio:["ignore",n,n]});i.unref(),No(n),pn(e,`${i.pid}
+`),console.log(JSON.stringify({status:"started",pid:i.pid,pidFile:e,logFile:t}))}async function un({quiet:e=!1}={}){let t=Fe(),r=He(t);if(!r){e||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!rt(r)){De(t),e||console.log(JSON.stringify({status:"not_running",pid:r,pidFile:t}));return}process.kill(r,"SIGTERM"),!await ln(r,1e4)&&rt(r)&&(process.kill(r,"SIGKILL"),await ln(r,3e3)),De(t),e||console.log(JSON.stringify({status:"stopped",pid:r,pidFile:t}))}function jo(){let e=Fe(),t=hn(),r=He(e),n=!!(r&&rt(r));console.log(JSON.stringify({status:n?"running":"not_running",running:n,pid:n?r:null,pidFile:e,logFile:t}))}function Go(e){let t=[],r={};for(let s=0;s<e.length;s+=1){let i=e[s];i==="--daemon"?r.daemon=!0:i==="--foreground"?r.foreground=!0:i==="--env-file"?r.envFile=e[++s]:i==="--pid-file"?r.pidFile=e[++s]:i==="--log-file"?r.logFile=e[++s]:t.push(i)}return{command:t[0]||"run",options:r}}function Ko(e){e.envFile&&(process.env.ORCHA_RUNTIME_ENV_FILE=e.envFile),e.pidFile&&(process.env.ORCHA_RUNTIME_PID_FILE=e.pidFile),e.logFile&&(process.env.ORCHA_RUNTIME_LOG_FILE=e.logFile)}function Fe(){return ve(process.cwd(),process.env.ORCHA_RUNTIME_PID_FILE||Do)}function hn(){return ve(process.cwd(),process.env.ORCHA_RUNTIME_LOG_FILE||vo)}function Vo(){let e=process.env.ORCHA_RUNTIME_LOG_FILE;if(!e)return;let t=gn();if(t<=0)return;let r=ve(process.cwd(),e);Le(r,t);let n=Wo();n<=0||setInterval(()=>Le(r,t),n).unref()}function Le(e,t=gn()){if(t<=0||!fn(e))return;let r=0,n="";try{if(r=sn(e).size,r<=0)return;n=ke(e,"utf8")}catch(d){h("warn","runtime-bridge","runtime log cleanup skipped",{logFile:e,error:String(d)});return}let s=Date.now()-t*24*60*60*1e3,i=n.split(/\r?\n/),o=[],c=0;for(let d of i)d&&(zo(d,s)?o.push(d):c+=1);if(c===0)return;let l="";try{sn(e).size>r&&(l=ke(e,"utf8").slice(n.length));let f=[...o,...l.split(/\r?\n/).filter(Boolean)].join(`
+`);pn(e,f?`${f}
+`:""),h("info","runtime-bridge","runtime log cleanup completed",{logFile:e,retentionDays:t,removed:c})}catch(d){h("warn","runtime-bridge","runtime log cleanup failed",{logFile:e,error:String(d)})}}function zo(e,t){try{let r=JSON.parse(e);if(!r||typeof r!="object")return!0;let n=typeof r.ts=="string"?Date.parse(r.ts):Number.NaN;return!Number.isFinite(n)||n>=t}catch{return!0}}function gn(){return _n(process.env.ORCHA_RUNTIME_LOG_RETENTION_DAYS,Fo)}function Wo(){return _n(process.env.ORCHA_RUNTIME_LOG_CLEANUP_INTERVAL_MS,Ho)}function _n(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function He(e){if(!fn(e))return null;let t=Number.parseInt(ke(e,"utf8").trim(),10);return Number.isInteger(t)&&t>0?t:null}function rt(e){try{return process.kill(e,0),!0}catch(t){return t?.code==="EPERM"}}async function ln(e,t){let r=Date.now();for(;Date.now()-r<t;){if(!rt(e))return!0;await new Promise(n=>setTimeout(n,100))}return!rt(e)}function dn(e){bo(Po(e),{recursive:!0})}function De(e){try{Uo(e,{force:!0})}catch{}}function Jo(){console.log(`Usage: orcha-runtime-bridge [command] [options]
 
 Commands:
   run, foreground      Run in the foreground. This is the default.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orcha-ai/runtime-bridge",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "private": false,
   "type": "module",
   "description": "Local Orcha runtime bridge for ACP-compatible agent runtimes.",
@@ -29,6 +29,6 @@
     "access": "public"
   },
   "engines": {
-    "node": ">=20"
+    "node": ">=22.19.0"
   }
 }