@orcha-ai/runtime-bridge 0.1.32 → 0.1.34

package/.env.example

@@ -10,6 +10,7 @@ ORCHA_RUNTIME_DEFAULT_TARGET=codex
 ORCHA_RUNTIME_RECONNECT_MS=3000
 ORCHA_RUNTIME_CONNECT_TIMEOUT_MS=10000
 ORCHA_RUNTIME_HEARTBEAT_INTERVAL_MS=15000
+ORCHA_RUNTIME_INITIALIZE_TIMEOUT_MS=30000
 ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS=3600000
 ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS=300000
 ORCHA_RUNTIME_SESSION_IDLE_TTL_MS=600000

package/README.md

@@ -136,6 +136,12 @@ and receives Orcha RPC frames for:
 
 Runtime targets are configured with `ORCHA_RUNTIME_TARGETS_JSON`.
 
+ACP runtimes complete a JSON-RPC `initialize` handshake before a session is
+created. `ORCHA_RUNTIME_INITIALIZE_TIMEOUT_MS` controls that handshake only
+(30 seconds by default); it is independent from the task/prompt timeout. A
+target can override it with `"initializeTimeoutMs"`. Target processes use
+`cwd`, then `workspace`, then the request workspace as their working directory.
+
 Start the bundled Egress Proxy as a separate supervised process before the
 Runtime Bridge. In production use separate protected environment files: the
 proxy file contains only its socket, token, and limits; the bridge file contains
@@ -168,6 +174,7 @@ receive work.
   "openclaw": {
     "type": "openclaw",
     "command": "openclaw",
+    "workspace": "/workspaces/project-a",
     "maxSessions": 1,
     "releaseAfterPrompt": true,
     "sessionIdleTtlMs": 60000,

package/bin/orcha-runtime-bridge.js

@@ -1,24 +1,25 @@
 #!/usr/bin/env node
-import{spawn as Ao}from"node:child_process";import{closeSync as Co,existsSync as mn,mkdirSync as No,openSync as bo,readFileSync as ve,rmSync as Mo,statSync as on,writeFileSync as pn}from"node:fs";import{dirname as Uo,resolve as $e}from"node:path";import{fileURLToPath as Po}from"node:url";import{createHash as Ni,randomUUID as Lt}from"node:crypto";var Y="0.1.32";function ot(){return new Date().toISOString()}function M(e,t=2){return String(e).padStart(t,"0")}function We(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${M(Math.floor(r/60))}:${M(r%60)}`}function Sn(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${M(e.getMonth()+1)}-${M(e.getDate())}`,`T${M(e.getHours())}:${M(e.getMinutes())}:${M(e.getSeconds())}.${M(e.getMilliseconds(),3)}`,We(t)].join("")}function En(e,t){let r=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),n={};for(let s of r.formatToParts(e))s.type!=="literal"&&(n[s.type]=Number(s.value));return n}function wn(e,t){let r=En(e,t),n=Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second,e.getMilliseconds()),s=Math.round((n-e.getTime())/6e4);return[`${r.year}-${M(r.month)}-${M(r.day)}`,`T${M(r.hour)}:${M(r.minute)}:${M(r.second)}.${M(e.getMilliseconds(),3)}`,We(s)].join("")}function In(e=new Date){let t=a(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return wn(e,t)}catch{return Sn(e)}}function u(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function a(e){return String(e??"").trim()}function T(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)?r:t}function C(e){return Array.isArray(e)?e.map(String):[]}var On="[redacted]",ze=/(authorization|api[_-]?key|credential|password|secret|token)/i;function G(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=G(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>G(i,t));return t.delete(e),s}let r={},n=ze.test(a(e.name||e.key));for(let[s,i]of Object.entries(e))r[s]=ze.test(s)||n&&s.toLowerCase()==="value"?On:G(i,t);return t.delete(e),r}function Je(e,t=4e3){let r=JSON.stringify(G(e))??String(e);return!Number.isFinite(t)||r.length<=t?r:`${r.slice(0,t)}...`}function h(e,t,r,n={}){let s={ts:In(),level:e,module:t,msg:r,...u(n)?G(n):{}};console.error(JSON.stringify(s))}function yt(e){return Array.isArray(e)?e.map(t=>u(t)?t.type==="text"?a(t.text):t.type==="file"?a(t.uri):t.type==="image"?a(t.uri):"":"").filter(Boolean).join(`
-`):""}var Rt=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,r){let n=yt(t.prompt);return r({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as xn}from"node:child_process";var at="2.0",An=3e4;function Cn(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,message:a(e?.message)||String(e),data:u(e?.data)?e.data:void 0}}function Nn(e){if(!u(e))return new Error(String(e||"runtime error"));let t=a(e.message)||"runtime error",r="data"in e?Je(e.data,4e3):"",n=new Error(r?`${t}; data=${r}`:t);return n.rpcCode=e.code,n.data=e.data,n}function bn(e){return u(e)&&"id"in e&&!("method"in e)}function Mn(e){return u(e)&&typeof e.method=="string"&&"id"in e}function Un(e){return u(e)&&typeof e.method=="string"&&!("id"in e)}var St=class{constructor({command:t,args:r=[],cwd:n,env:s,label:i,framing:o="line",detached:c=!0}){this.command=t,this.args=Array.isArray(r)?r.map(String):[],this.cwd=n||process.cwd(),this.env=u(s)?{...s}:{...process.env},this.label=i||t,this.framing=o==="content-length"?"content-length":"line",this.detached=c!==!1,this.child=null,this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stopPromise=null,this.lineBuffer="",this.headerBuffer=Buffer.alloc(0),this.seq=0,this.pending=new Map,this.notificationHandlers=new Map,this.requestHandlers=new Map,this.exitHandlers=new Set}async start({initialize:t=!0,initializeParams:r={}}={}){this.child&&!this.exited||(this.exited=!1,this.exitCode=null,this.exitSignal=null,this.child=xn(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"],detached:this.detached}),this.child.stdout.on("data",n=>this.onStdout(n)),this.child.stderr.setEncoding("utf8"),this.child.stderr.on("data",n=>{let s=n.trimEnd();s&&h("debug","runtime.stderr","runtime stderr",{target:this.label,text:s})}),this.child.on("exit",(n,s)=>this.handleExit(n,s)),this.child.on("error",n=>this.rejectAll(n)),t&&await this.call("initialize",{protocolVersion:1,clientCapabilities:{},...r}).catch(n=>{throw Object.assign(new Error(`runtime initialize failed: ${n.message}`),{code:"RUNTIME_INITIALIZE_FAILED"})}))}onStdout(t){if(this.framing==="content-length"){this.onContentLengthData(Buffer.isBuffer(t)?t:Buffer.from(t));return}this.onLineData(t.toString("utf8"))}onLineData(t){this.lineBuffer+=t;let r=this.lineBuffer.split(/\r?\n/);this.lineBuffer=r.pop()||"";for(let n of r){let s=n.trim();s&&this.dispatchRaw(s)}}onContentLengthData(t){for(this.headerBuffer=Buffer.concat([this.headerBuffer,t]);this.headerBuffer.length>0;){let r=this.headerBuffer.indexOf(`\r
+import{spawn as Go}from"node:child_process";import{closeSync as Vo,existsSync as xn,mkdirSync as zo,openSync as Wo,readFileSync as Je,rmSync as Jo,statSync as Rn,writeFileSync as An}from"node:fs";import{dirname as Xo,resolve as Ze}from"node:path";import{fileURLToPath as Yo}from"node:url";import{createHash as ji,randomUUID as qt}from"node:crypto";var Q="0.1.34";function dt(){return new Date().toISOString()}function M(e,t=2){return String(e).padStart(t,"0")}function sr(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${M(Math.floor(r/60))}:${M(r%60)}`}function kn(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${M(e.getMonth()+1)}-${M(e.getDate())}`,`T${M(e.getHours())}:${M(e.getMinutes())}:${M(e.getSeconds())}.${M(e.getMilliseconds(),3)}`,sr(t)].join("")}function Ln(e,t){let r=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),n={};for(let s of r.formatToParts(e))s.type!=="literal"&&(n[s.type]=Number(s.value));return n}function Dn(e,t){let r=Ln(e,t),n=Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second,e.getMilliseconds()),s=Math.round((n-e.getTime())/6e4);return[`${r.year}-${M(r.month)}-${M(r.day)}`,`T${M(r.hour)}:${M(r.minute)}:${M(r.second)}.${M(e.getMilliseconds(),3)}`,sr(s)].join("")}function vn(e=new Date){let t=a(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return Dn(e,t)}catch{return kn(e)}}function u(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function a(e){return String(e??"").trim()}function g(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)?r:t}function C(e){return Array.isArray(e)?e.map(String):[]}function tt(e,t,r=process.cwd()){let n=u(e)?e:{};return a(n.cwd)||a(n.workspace)||a(t)||a(r)||process.cwd()}var Et="[redacted]",Fn=/(authorization|api[_-]?key|credential|password|secret|token)/i;function wt(e){return Fn.test(a(e))}function ir(e,t=[]){let r=String(e??"");for(let n of t){let s=String(n??"");s.length>=4&&(r=r.split(s).join(Et))}return r.replace(/((?:authorization|api[_-]?key|credential|password|secret|token)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi,`$1${Et}`).replace(/([?&](?:api[_-]?key|credential|password|secret|token)=)[^&\s]+/gi,`$1${Et}`)}function z(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=z(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>z(i,t));return t.delete(e),s}let r={},n=wt(e.name||e.key);for(let[s,i]of Object.entries(e))r[s]=wt(s)||n&&s.toLowerCase()==="value"?Et:z(i,t);return t.delete(e),r}function or(e,t=4e3){let r=JSON.stringify(z(e))??String(e);return!Number.isFinite(t)||r.length<=t?r:`${r.slice(0,t)}...`}function h(e,t,r,n={}){let s={ts:vn(),level:e,module:t,msg:r,...u(n)?z(n):{}};console.error(JSON.stringify(s))}function It(e){return Array.isArray(e)?e.map(t=>u(t)?t.type==="text"?a(t.text):t.type==="file"?a(t.uri):t.type==="image"?a(t.uri):"":"").filter(Boolean).join(`
+`):""}var Ot=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,r){let n=It(t.prompt);return r({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as Hn}from"node:child_process";var ft="2.0",Zt=3e4,$n=4e3;function xt(e,t){let r=Object.entries(u(t)?t:{}).filter(([n])=>wt(n)).map(([,n])=>n);return ir(e,r)}function Bn(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,message:a(e?.message)||String(e),data:u(e?.data)?e.data:void 0}}function qn(e){if(!u(e))return new Error(String(e||"runtime error"));let t=a(e.message)||"runtime error",r="data"in e?or(e.data,4e3):"",n=new Error(r?`${t}; data=${r}`:t);return n.rpcCode=e.code,n.data=e.data,n}function jn(e){return u(e)&&"id"in e&&!("method"in e)}function Kn(e){return u(e)&&typeof e.method=="string"&&"id"in e}function Gn(e){return u(e)&&typeof e.method=="string"&&!("id"in e)}var At=class{constructor({command:t,args:r=[],cwd:n,env:s,label:i,framing:o="line",detached:c=!0}){this.command=t,this.args=Array.isArray(r)?r.map(String):[],this.cwd=n||process.cwd(),this.env=u(s)?{...s}:{...process.env},this.label=i||t,this.framing=o==="content-length"?"content-length":"line",this.detached=c!==!1,this.child=null,this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stopPromise=null,this.stderrTail="",this.spawnError=null,this.lineBuffer="",this.headerBuffer=Buffer.alloc(0),this.seq=0,this.pending=new Map,this.notificationHandlers=new Map,this.requestHandlers=new Map,this.exitHandlers=new Set}async start({initialize:t=!0,initializeParams:r={},initializeTimeoutMs:n=Zt}={}){if(!(this.child&&!this.exited)&&(this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stderrTail="",this.spawnError=null,this.child=Hn(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"],detached:this.detached}),this.child.stdout.on("data",s=>this.onStdout(s)),this.child.stderr.setEncoding("utf8"),this.child.stderr.on("data",s=>{this.stderrTail=`${this.stderrTail}${s}`.slice(-$n);let i=xt(s.trimEnd(),this.env);i&&h("debug","runtime.stderr","runtime stderr",{target:this.label,text:i})}),this.child.on("exit",(s,i)=>this.handleExit(s,i)),this.child.on("error",s=>{this.spawnError=s,this.rejectAll(s)}),t)){let s=Math.max(1,g(n,Zt));try{await this.call("initialize",{protocolVersion:1,clientCapabilities:{},...r},s)}catch(i){let o=this.startupFailureDetail(),c=xt(i?.message||i,this.env);h("warn","runtime.initialize","runtime initialize failed",{target:this.label,timeoutMs:s,cause:c,...o}),await this.stop("initialize failed",{termTimeoutMs:1e3,killTimeoutMs:1e3});let l=o.stderr?`; stderr: ${o.stderr}`:`; command=${o.command}; cwd=${o.cwd}`;throw Object.assign(new Error(`runtime initialize failed: ${c}${l}`,{cause:i}),{code:"RUNTIME_INITIALIZE_FAILED",detail:o})}}}startupFailureDetail(){return{command:this.command,cwd:this.cwd,exited:this.exited,exitCode:this.exitCode,exitSignal:this.exitSignal,...this.spawnError?{spawnError:xt(this.spawnError.message,this.env)}:{},...this.stderrTail.trim()?{stderr:xt(this.stderrTail.trim(),this.env)}:{}}}onStdout(t){if(this.framing==="content-length"){this.onContentLengthData(Buffer.isBuffer(t)?t:Buffer.from(t));return}this.onLineData(t.toString("utf8"))}onLineData(t){this.lineBuffer+=t;let r=this.lineBuffer.split(/\r?\n/);this.lineBuffer=r.pop()||"";for(let n of r){let s=n.trim();s&&this.dispatchRaw(s)}}onContentLengthData(t){for(this.headerBuffer=Buffer.concat([this.headerBuffer,t]);this.headerBuffer.length>0;){let r=this.headerBuffer.indexOf(`\r
 \r
-`);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){h("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.alloc(0);return}let i=Number.parseInt(s[1],10),o=r+4,c=o+i;if(this.headerBuffer.length<c)return;let l=this.headerBuffer.subarray(o,c).toString("utf8");this.headerBuffer=this.headerBuffer.subarray(c),this.dispatchRaw(l)}}dispatchRaw(t){let r;try{r=JSON.parse(t)}catch(n){h("warn","runtime.protocol","invalid JSON frame",{target:this.label,error:String(n)});return}this.dispatch(r)}dispatch(t){if(bn(t)){this.resolveResponse(t);return}if(Mn(t)){this.handleRequest(t);return}Un(t)&&this.handleNotification(t)}resolveResponse(t){let r=String(t.id),n=this.pending.get(r);n&&(clearTimeout(n.timer),this.pending.delete(r),t.error?(h("warn","runtime.protocol","runtime rpc error",{target:this.label,method:n.method,requestId:r,error:t.error}),n.reject(Nn(t.error))):n.resolve(t.result))}async handleRequest(t){let r=this.requestHandlers.get(t.method);if(!r){this.writeFrame({jsonrpc:at,id:t.id,error:{code:-32601,message:`method not found: ${t.method}`}});return}try{let n=await r(u(t.params)?t.params:{},t);this.writeFrame({jsonrpc:at,id:t.id,result:n??{}})}catch(n){this.writeFrame({jsonrpc:at,id:t.id,error:Cn(n)})}}handleNotification(t){let r=this.notificationHandlers.get(t.method);if(r)for(let n of r)n(u(t.params)?t.params:{},t)}call(t,r={},n=An){if(!this.child||!this.child.stdin||this.exited)return Promise.reject(new Error("runtime process is not running"));let s=`${t}_${++this.seq}`,i={jsonrpc:at,id:s,method:t,params:r};return new Promise((o,c)=>{let l=setTimeout(()=>{this.pending.delete(s),c(new Error(`${t} timed out after ${n}ms`))},n);this.pending.set(s,{resolve:o,reject:c,timer:l,method:t}),this.writeFrame(i,d=>{d&&(clearTimeout(l),this.pending.delete(s),c(d))})})}notify(t,r={}){this.writeFrame({jsonrpc:at,method:t,params:r})}writeFrame(t,r){if(!this.child?.stdin||this.exited){r?.(new Error("runtime process is not running"));return}let n=JSON.stringify(t),s=this.framing==="content-length"?`Content-Length: ${Buffer.byteLength(n,"utf8")}\r
+`);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){h("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.alloc(0);return}let i=Number.parseInt(s[1],10),o=r+4,c=o+i;if(this.headerBuffer.length<c)return;let l=this.headerBuffer.subarray(o,c).toString("utf8");this.headerBuffer=this.headerBuffer.subarray(c),this.dispatchRaw(l)}}dispatchRaw(t){let r;try{r=JSON.parse(t)}catch(n){h("warn","runtime.protocol","invalid JSON frame",{target:this.label,error:String(n)});return}this.dispatch(r)}dispatch(t){if(jn(t)){this.resolveResponse(t);return}if(Kn(t)){this.handleRequest(t);return}Gn(t)&&this.handleNotification(t)}resolveResponse(t){let r=String(t.id),n=this.pending.get(r);n&&(clearTimeout(n.timer),this.pending.delete(r),t.error?(h("warn","runtime.protocol","runtime rpc error",{target:this.label,method:n.method,requestId:r,error:t.error}),n.reject(qn(t.error))):n.resolve(t.result))}async handleRequest(t){let r=this.requestHandlers.get(t.method);if(!r){this.writeFrame({jsonrpc:ft,id:t.id,error:{code:-32601,message:`method not found: ${t.method}`}});return}try{let n=await r(u(t.params)?t.params:{},t);this.writeFrame({jsonrpc:ft,id:t.id,result:n??{}})}catch(n){this.writeFrame({jsonrpc:ft,id:t.id,error:Bn(n)})}}handleNotification(t){let r=this.notificationHandlers.get(t.method);if(r)for(let n of r)n(u(t.params)?t.params:{},t)}call(t,r={},n=Zt){if(!this.child||!this.child.stdin||this.exited)return Promise.reject(new Error("runtime process is not running"));let s=`${t}_${++this.seq}`,i={jsonrpc:ft,id:s,method:t,params:r};return new Promise((o,c)=>{let l=setTimeout(()=>{this.pending.delete(s),c(new Error(`${t} timed out after ${n}ms`))},n);this.pending.set(s,{resolve:o,reject:c,timer:l,method:t}),this.writeFrame(i,d=>{d&&(clearTimeout(l),this.pending.delete(s),c(d))})})}notify(t,r={}){this.writeFrame({jsonrpc:ft,method:t,params:r})}writeFrame(t,r){if(!this.child?.stdin||this.exited){r?.(new Error("runtime process is not running"));return}let n=JSON.stringify(t),s=this.framing==="content-length"?`Content-Length: ${Buffer.byteLength(n,"utf8")}\r
 \r
 ${n}`:`${n}
-`;this.child.stdin.write(s,r)}onNotification(t,r){let n=this.notificationHandlers.get(t)||new Set;return n.add(r),this.notificationHandlers.set(t,n),()=>{n.delete(r),n.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,r){return this.requestHandlers.set(t,r),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let r of this.pending.values())clearTimeout(r.timer),r.reject(t);this.pending.clear()}handleExit(t,r){this.exited=!0,this.exitCode=t,this.exitSignal=r,this.rejectAll(new Error(`runtime exited before response (${t}/${r})`));for(let n of this.exitHandlers)n(t,r)}async waitForExit(t=5e3){return!this.child||this.exited?!0:await new Promise(r=>{let n=setTimeout(()=>{s(),r(!1)},t);n.unref?.();let s=()=>{clearTimeout(n),this.exitHandlers.delete(i)},i=()=>{s(),r(!0)};this.exitHandlers.add(i),this.exited&&i()})}signal(t){if(!this.child||this.exited)return!1;let r=this.child.pid;if(!r)return!1;try{return this.detached&&process.platform!=="win32"?process.kill(-r,t):this.child.kill(t),!0}catch(n){if(n?.code==="ESRCH")return this.exited=!0,!1;try{return this.child.kill(t),!0}catch(s){return s?.code!=="ESRCH"&&h("warn","runtime","runtime signal failed",{target:this.label,pid:r,signal:t,error:String(s)}),!1}}}async stop(t="stop",{termTimeoutMs:r=5e3,killTimeoutMs:n=2e3}={}){if(!(!this.child||this.exited)){if(this.stopPromise)return await this.stopPromise;this.stopPromise=(async()=>{if(!this.child||this.exited)return;let s=this.child.pid;h("info","runtime","stopping runtime",{target:this.label,reason:t,pid:s}),this.rejectAll(new Error(`runtime stopped: ${t}`)),this.signal("SIGTERM"),!await this.waitForExit(r)&&this.child&&!this.exited&&(h("warn","runtime","runtime did not exit after SIGTERM; force killing",{target:this.label,reason:t,pid:s}),this.signal("SIGKILL"),await this.waitForExit(n))})();try{await this.stopPromise}finally{this.stopPromise=null}}}};import{randomUUID as Ze}from"node:crypto";import{existsSync as Pn,readFileSync as kn,realpathSync as Xe,statSync as Ln}from"node:fs";import{basename as tr,extname as er,isAbsolute as ct,join as Dn,relative as rr,resolve as Ye}from"node:path";var vn=25*1024*1024;function nr(e,t=""){let r=a(t);if(r)return r;let n=er(a(e)).toLowerCase();return n===".jpg"||n===".jpeg"?"image/jpeg":n===".webp"?"image/webp":n===".gif"?"image/gif":"image/png"}function sr(e,t){let r=typeof e=="string"?e.trim():"";return!r||r==="<omitted>"?"":r.startsWith("data:")?r:`data:${t};base64,${r.replace(/\s+/g,"")}`}function Et(e){if(Array.isArray(e))return e.map(a).filter(Boolean);let t=a(e);return t?[t]:[]}function Fn(e,t){let r=rr(t,e);return r===""||!!r&&!r.startsWith("..")&&!ct(r)}function Hn(e,t){let r=a(e);if(!r||!Pn(r))return"";try{let n=Xe(r);for(let s of t)try{let i=Xe(s);if(Fn(n,i))return n}catch{}}catch{return""}return""}function $n(e,t){let r=a(e);if(!r||!ct(r))return r;for(let n of Array.isArray(t)?t:[]){if(!u(n))continue;let s=a(n.runtimeRoot),i=a(n.hostRoot);if(!s||!i||!ct(s)||!ct(i))continue;let o=rr(Ye(s),Ye(r));if(o===""||!o.startsWith("..")&&!ct(o))return o?Dn(i,o):i}return r}function Kt(e,t,r={}){let n=a(e);return!n||n.startsWith("data:")||/^https?:\/\//i.test(n)?n:Bn(n,t,r)}function Bn(e,t,r={}){let n=[...Et(r.trustedFileRoots),...Et(r.trustedFileRoot),...Et(r.artifactRoots),...Et(r.artifactRoot)],s=Hn($n(e,r.pathMappings),n);if(!s)return"";try{let i=Ln(s);return!i.isFile()||i.size<=0||i.size>vn?"":`data:${t};base64,${kn(s).toString("base64")}`}catch{return""}}function x(...e){for(let t of e){let r=a(t);if(r)return r}return""}function qn(e,t,r,n){let s=r.toLowerCase();if(s==="image"||s==="picture")return!0;let i=x(n,e.previewUrl,e.fileUrl,e.imageUrl,e.dataUrl,e.url,e.uri,t.previewUrl,t.fileUrl,t.imageUrl,t.dataUrl,t.url,t.uri),o=er(i.split("?",1)[0].split("#",1)[0]).toLowerCase();return[".png",".jpg",".jpeg",".webp",".gif"].includes(o)}function zt(e,t={}){let{source:r="runtime_image_generation_event"}=t;if(!u(e))return null;let n=u(e.payload)?e.payload:{},s=a(e.type),i=a(n.type);if(!(s==="event_msg"&&i==="image_generation_end"||s==="response_item"&&i==="image_generation_call"))return null;let o=x(n.call_id,n.id),c=x(n.saved_path,n.savedPath),l=x(n.revised_prompt,n.revisedPrompt),d=nr(c,n.mimeType||n.mime_type),f=sr(n.result,d)||Kt(c,d,t);if(!f)return null;let p=f.startsWith("data:")?f:"",g=c?tr(c):`${o||Ze()}.png`;return{artifactType:"image",type:"image",fieldKey:"image",title:g||"Generated image",summary:l||"Generated image",content:{prompt:l||void 0,dataUrl:p||void 0,imageUrl:f,previewUrl:f,fileUrl:f,mimeType:d},dataUrl:p||void 0,previewUrl:f,fileUrl:f,metadata:{source:r,eventType:i,callId:o||void 0,savedPath:c||void 0,filename:g,mimeType:d,revisedPrompt:l||void 0}}}function jn(e){let t=u(e)?e:{},r=[];for(let n of["_artifacts","artifacts"]){let s=t[n];Array.isArray(s)&&r.push(...s)}for(let n of["_artifact","artifact"]){let s=t[n];u(s)&&r.push(s)}return r}function Gn(e,t={}){let{source:r="runtime_artifact"}=t,n=u(e)?e:{};if(!Object.keys(n).length)return null;let s=u(n.content)?{...n.content}:{},i=u(n.metadata)?{...n.metadata}:{},o=x(n.saved_path,n.savedPath,s.saved_path,s.savedPath,i.savedPath),c=x(n.mimeType,n.mime_type,s.mimeType,s.mime_type,i.mimeType),l=x(n.artifactType,n.artifact_type,n.type,n.kind,s.type,o?"image":"file"),d=qn(n,s,l,o),f=d?nr(o,c):c;if(d){let N=x(n.dataUrl,s.dataUrl),_=N.startsWith("data:")?N:"",R=x(n.imageUrl,n.previewUrl,n.fileUrl,n.downloadUrl,n.url,n.uri,s.imageUrl,s.previewUrl,s.fileUrl,s.downloadUrl,s.url,s.uri),E=sr(n.result??s.result,f)||_||Kt(o,f,t)||Kt(R,f,t);E&&(E.startsWith("data:")&&(s.dataUrl||=E),s.imageUrl||=E,s.previewUrl||=E,s.fileUrl||=E,f&&(s.mimeType||=f))}for(let[N,_]of[["prompt","prompt"],["previewUrl","previewUrl"],["fileUrl","fileUrl"],["downloadUrl","downloadUrl"],["imageUrl","imageUrl"],["dataUrl","dataUrl"],["url","url"],["uri","uri"],["mimeType","mimeType"],["mime_type","mimeType"]]){let R=n[N];R!=null&&R!==""&&!(_ in s)&&(s[_]=R)}let p=x(n.fileUrl,n.downloadUrl,n.imageUrl,n.dataUrl,n.url,n.uri,s.fileUrl,s.downloadUrl,s.imageUrl,s.dataUrl,s.url,s.uri),g=x(n.previewUrl,n.imageUrl,n.dataUrl,n.url,n.fileUrl,n.uri,s.previewUrl,s.imageUrl,s.dataUrl,s.url,s.fileUrl,s.uri),m=x(n.dataUrl,s.dataUrl,p.startsWith("data:")?p:"",g.startsWith("data:")?g:""),y=x(n.filename,i.filename,o?tr(o):""),O=x(n.fieldKey,n.field_key,s.fieldKey,i.fieldKey,d?"image":"artifact");return{...n,artifactType:l,type:n.type||l,fieldKey:O,title:x(n.title,y,"Runtime artifact"),summary:x(n.summary,s.prompt,n.title,y,"Runtime artifact"),content:s,dataUrl:m||void 0,fileUrl:p||void 0,previewUrl:g||void 0,metadata:{...i,source:x(i.source,r),savedPath:o||i.savedPath,filename:y||i.filename,mimeType:f||i.mimeType}}}function wt(e,t){if(!t||!e)return;let r=u(t.metadata)?t.metadata:{},n=x(r.savedPath,r.callId,t.previewUrl,t.fileUrl)||Ze(),s=e.get(n);if(!s){e.set(n,t);return}s.content={...u(s.content)?s.content:{},...u(t.content)?t.content:{}},s.metadata={...u(s.metadata)?s.metadata:{},...r},s.previewUrl=t.previewUrl||s.previewUrl,s.fileUrl=t.fileUrl||s.fileUrl,s.summary=t.summary||s.summary,s.title=t.title||s.title}function Vt(e,t,r={}){for(let n of jn(e))wt(t,Gn(n,r))}function Wt(e){if(!u(e)||!u(e.payload))return u(e)?e:{value:e};let t=a(e.payload.type);if(t!=="image_generation_end"&&t!=="image_generation_call")return e;let r={...e.payload};return typeof r.result=="string"&&r.result&&(r.result="<omitted>",r.resultLength=e.payload.result.length),{...e,payload:r}}function Qe(e,t,r){if(!u(e))return e;let n=u(e.event)?e.event:null;return n?(wt(t,zt(n,r)),{...e,event:Wt(n)}):e}function ir(e,t,r={}){if(!u(e))return e;Vt(e,t,r);let n=Qe(e,t,r),s=u(n.update)?Qe(n.update,t,r):null;return s&&s!==n.update&&(n={...n,update:s}),n}function or(e,t,r={}){let n=u(e)?{...e}:{};Vt(n,t,r),Vt(u(n.output)?n.output:{},t,r);let s=[...t?.values?.()||[]];return s.length&&(n._artifacts=s),delete n.artifacts,n}var Q=class{constructor(t,r,n={},s={}){this.agent=t,this.target=r,this.callbacks=n,this.options=s,this.proc=null,this.launch=null,this.launchCleanup=null,this.permissionHandlers=new Map}async ensureStarted(){if(this.proc)return;let t=a(this.target.command);if(!t)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let r={command:t,args:C(this.target.args),cwd:a(this.target.cwd)||this.agent.workspace||process.cwd(),environment:u(this.target.env)?this.target.env:{}},n=this.options.prepareLaunch?await this.options.prepareLaunch(r):{...r,environment:{...process.env,...r.environment},cleanup:async()=>{}};this.launch=n,this.launchCleanup=n.cleanup,this.proc=new St({command:n.command,args:n.args,cwd:n.cwd,env:n.environment,label:`${this.agent.agentId}:${this.agent.targetCode}`,framing:a(this.target.framing||"line")}),this.proc.onRequest("session/request_permission",s=>this.handlePermissionRequest(s)),this.proc.onRequest("session/requestPermission",s=>this.handlePermissionRequest(s));try{await this.proc.start({initialize:this.target.initialize!==!1,initializeParams:{clientInfo:{name:"orcha-runtime-bridge",version:Y},...u(this.target.initializeParams)?this.target.initializeParams:{}}})}catch(s){throw this.proc=null,await this.cleanupLaunch(),s}}async sessionNew(t={}){return await this.ensureStarted(),this.proc.call("session/new",this.sessionNewParams(t))}sessionNewParams(t={}){let r=Array.isArray(t.mcpServers)?t.mcpServers:Array.isArray(this.target.mcpServers)?this.target.mcpServers:[];return{...t,mcpServers:r}}async sessionPrompt(t,r){await this.ensureStarted();let n=a(t.sessionId),s=new Map,i=this.artifactOptions(),o=this.proc.onNotification("session/update",l=>{let d=a(l.sessionId);(!d||d===n)&&r(ir(l,s,i))}),c=async l=>this.callbacks.onPermissionRequest?.({agent:this.agent,runtimeSessionId:n,request:l,emitUpdate:r})||{outcome:"denied",reason:"permission handler is not configured"};n&&this.permissionHandlers.set(n,c),this.permissionHandlers.set("*",c);try{let l=await this.proc.call("session/prompt",t,this.options.sessionPromptTimeoutMs);return or(l,s,i)}finally{o(),n&&this.permissionHandlers.delete(n),this.permissionHandlers.delete("*")}}async sessionCancel(t){return await this.ensureStarted(),this.proc.call("session/cancel",t,5e3).catch(()=>({ok:!0}))}async handlePermissionRequest(t){let r=a(t.sessionId),n=this.permissionHandlers.get(r)||this.permissionHandlers.get("*");return n?n(t):{outcome:"denied",reason:"no active Orcha permission handler"}}artifactSource(){return a(this.target.type||"acp")==="openclaw"?"openclaw_image_generation":"acp_runtime_image_generation"}artifactOptions(){let t=u(this.target.env)?this.target.env:{};return{source:this.artifactSource(),trustedFileRoots:[a(this.launch?.artifactDirectory),a(this.launch?.homeDirectory),a(this.target.artifactRoot),a(this.target.artifactDir),a(this.target.runtimeArtifactRoot),a(t.ORCHA_RUNTIME_ARTIFACT_DIR),...C(this.target.trustedArtifactRoots),...C(this.target.trustedFileRoots),...C(this.target.artifactRoots),...C(this.target.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(this.launch?.pathMappings)?this.launch.pathMappings:[]}}async stop(t){try{await this.proc?.stop(t)}finally{this.proc=null,await this.cleanupLaunch()}}async cleanupLaunch(){let t=this.launchCleanup;this.launchCleanup=null,this.launch=null,await t?.()}};function Kn(e){let t=u(e.metadata)?e.metadata:{};return a(t.agentCode)}function Vn(e,t){let r=Kn(e);return r?`agent:${r}:${t}`:`orcha-${t}`}var It=class extends Q{constructor(t,r,n,s={},i={}){let o=a(n).replace(/[^A-Za-z0-9._-]+/g,"-")||"default",c=a(r.command)||"openclaw",l=Array.isArray(r.args)?r.args.map(String):[],d=l.length>0?l:["acp","--session",Vn(t,o)];super(t,{...r,command:c,args:d},s,i)}sessionNewParams(t={}){return{...t,mcpServers:[]}}};import{spawn as fr}from"node:child_process";import{randomUUID as Z}from"node:crypto";import{existsSync as mr,mkdirSync as zn,readdirSync as pr,readFileSync as hr,realpathSync as lt,rmSync as Wn,rmdirSync as Jn,statSync as Xn,unlinkSync as Yn}from"node:fs";import{homedir as Qn,tmpdir as gr}from"node:os";import{basename as Zt,dirname as Zn,join as L,resolve as ar}from"node:path";var ts=36e5,_r=5e3,es=2*60*1e3,rs=2*60*1e3,ns=12,ss=1e3,is=1500,os=1e3,Ot=24*60*60*1e3,ut=new Set(["final_answer","final","complete","completed","done"]),as=new Set(["function_call","function_call_output","custom_tool_call","custom_tool_call_output","local_shell_call","local_shell_call_output","mcp_tool_call","mcp_tool_call_output","web_search_call","image_generation_call","image_generation_end"]),cs=new Set(["context_compacted","context_compaction","context_compressed"]);function At(e,t){if(e?.pid){if(process.platform==="win32"){let r=["/PID",String(e.pid),"/T"];t==="SIGKILL"&&r.push("/F");try{fr("taskkill",r,{stdio:"ignore",windowsHide:!0}).unref?.()}catch{try{e.kill(t)}catch{}}return}try{process.kill(-e.pid,t)}catch(r){if(r?.code==="ESRCH")return;try{e.kill(t)}catch{}}}}function Jt(e){At(e,"SIGTERM");let t=setTimeout(()=>At(e,"SIGKILL"),_r);return t.unref?.(),t}function P(e){if(typeof e=="string")return e;if(Array.isArray(e))return e.map(t=>P(t)).join("");if(!u(e))return"";for(let t of["text","delta","output_text","content","message","output"]){let r=P(e[t]);if(r)return r}return""}function Tr(e){if(!u(e))return"";let t=u(e.payload)?e.payload:{};if(a(e.type)==="event_msg"){if(a(t.type)==="agent_message")return a(t.message);if(a(t.type)==="task_complete")return a(t.last_agent_message)}if(a(e.type)==="response_item"&&a(t.type)==="message"&&a(t.role)==="assistant")return P(t.content)||P(t.message);if(a(e.type)==="result")return P(e.result);let r=P(e.delta)||P(e.text)||P(e.content);if(r)return r;let n=u(e.item)?e.item:{};return["message","agent_message"].includes(a(n.type))||a(n.role)==="assistant"?P(n.content)||P(n.text)||P(n.message):""}function yr(e,t={}){return zt(e,{source:"codex_cli_image_generation",...t})}function Rr(e,t){wt(e.artifacts,t)}function Sr(e){return G(Wt(e))}function te(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);if(r==="event_msg"&&n==="task_complete")return!0;let s=a(t.phase||t.status||t.stage).toLowerCase();if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&a(t.role)==="assistant")return ut.has(s);let i=u(e.item)?e.item:{};return r==="item.completed"&&a(i.type)==="agent_message"?!0:r==="result"&&e.is_error!==!0?a(e.result).length>0:!1}function us(e){let t=a(e.terminalProtocol||e.eventProtocol).toLowerCase();if(t)return t;let r=Zt(a(e.command)).replace(/\.exe$/i,"").toLowerCase();return r==="codex"||r==="claude"?r:""}function cr(e,t,r){let n=u(t.error)?t.error:{},s=a(n.message)||P(t.error)||a(t.result)||a(t.message)||r;return Object.assign(new Error(s),{code:e})}function ls(e,t){if(!u(e))return null;let r=a(e.type).toLowerCase();if(t==="codex")return r==="turn.completed"?{status:"completed",result:{stopReason:"end_turn"}}:r==="turn.failed"?{status:"failed",error:cr("RUNTIME_CODEX_TURN_FAILED",e,"Codex turn failed")}:null;if(t==="claude"&&r==="result"){let n=a(e.subtype).toLowerCase();return e.is_error===!0||n.startsWith("error")||["failed","failure"].includes(n)?{status:"failed",error:cr("RUNTIME_CLAUDE_RESULT_FAILED",e,"Claude result failed")}:{status:"completed",result:{stopReason:"end_turn",...a(e.result)?{output:a(e.result)}:{}}}}return null}function ur(e){return u(e)?a(e.phase||e.status||e.stage).toLowerCase():""}function ds(e){if(!u(e)||te(e))return!1;let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type),s=ur(t);if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&a(t.role)==="assistant")return!!(s&&!ut.has(s));let i=u(e.item)?e.item:{},o=ur(i);return a(i.role)==="assistant"||a(i.type)==="message"?!!(o&&!ut.has(o)):!1}function fs(e,t,r){return r.captureLastMessage===!1||t.includes("--output-last-message")||t.includes("-o")?!1:r.captureLastMessage===!0?!0:Zt(e)==="codex"}function ms(e,t){return t.collectCodexTranscriptArtifacts===!1?!1:t.collectCodexTranscriptArtifacts===!0?!0:Zt(e)==="codex"}function Er(e){return Math.max(20,T(e.codexTranscriptPollMs||e.transcriptPollMs,ss))}function ps(e){return Math.max(0,T(e.codexFinalOutputWaitMs||e.finalOutputWaitMs,is))}function Ct(e){if(typeof e=="boolean")return e;let t=a(e).toLowerCase();return["true","1","yes","y","on"].includes(t)?!0:["false","0","no","n","off"].includes(t)?!1:null}function ee(e){let t=u(e?.metadata)?e.metadata:{};return u(t._runtimeBridge)?t._runtimeBridge:{}}function Xt(e){return a(ee(e).promptKind).toLowerCase()}function hs(e,t){for(let r of[e.codexTranscriptStreaming,e.streamCodexTranscript]){let n=Ct(r);if(n!=null)return n}return Xt(t)==="chat"}function gs(e,t){let r=ee(e);for(let s of[r.emitThoughtChunks,r.streamThoughts]){let i=Ct(s);if(i!=null)return i}let n=Xt(e);if(n&&n!=="chat")return!1;for(let s of[t.emitThoughtChunks,t.streamThoughts]){let i=Ct(s);if(i!=null)return i}return Xt(e)==="chat"}function _s(e){let t=ee(e);for(let r of[t.finalTextOnly,t.finalOutputOnly]){let n=Ct(r);if(n!=null)return n}return null}function Ts(e,t){let r=_s(e);return r??(t.finalTextOnly===!0||t.finalOutputOnly===!0?!0:(t.finalTextOnly===!1||t.finalOutputOnly===!1,!1))}function ys(e,t){return!e.finalTextOnly||t}function wr(e,t,r,n,s=n){return!n||e.emittedTexts.has(s)?!1:(e.emittedTexts.add(s),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}}),!0)}function Ir(e,t,r,n){return!n||e.emittedThoughtTexts.has(n)?!1:(e.emittedThoughtTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_thought_chunk",content:{type:"text",text:n}}}),!0)}function Rs(e,t,r,n=new Set){return{target:e,promptText:t,startedAtMs:r,baselinePaths:n,matchedPath:"",disabled:!1,processedLines:new Map}}function Ss(e,t){let r=u(e.env)?e.env:{},n=a(e.artifactRoot||e.artifactDir||e.runtimeArtifactRoot||r.ORCHA_RUNTIME_ARTIFACT_DIR)||L(gr(),"orcha-runtime-artifacts"),s=a(t).replace(/[^A-Za-z0-9._-]+/g,"-").slice(0,80)||Z(),i=L(n,s),o=L(i,Z());return zn(o,{recursive:!0}),{root:o,realRoot:lt(o),sessionRoot:i,realSessionRoot:lt(i)}}function Es(e){let t=a(e?.artifactDirectory);if(!t)throw new Error("sandbox launch did not provide an artifact directory");return{root:t,realRoot:lt(t),sessionRoot:"",realSessionRoot:""}}function Or(e){return a(u(e)?e.root:e)}function lr(e){let t=Or(e),r=a(u(e)?e.sessionRoot:Zn(t)),n=a(u(e)?e.realSessionRoot:"");if(r)try{if(n&&lt(r)!==n)return;Jn(r)}catch{}}function ws(e,t={}){let r=Or(e),n=a(u(e)?e.realRoot:"");if(r){try{if(n&&lt(r)!==n){h("warn","runtime.cli","runtime artifact directory cleanup skipped; path changed",{...t,artifactRoot:r});return}}catch{lr(e);return}try{Wn(r,{recursive:!0,force:!0})}catch(s){h("warn","runtime.cli","runtime artifact directory cleanup failed",{...t,artifactRoot:r,error:String(s?.message||s)});return}lr(e)}}function Is(e,t,r=null){return{trustedFileRoots:[t,a(r?.artifactDirectory),a(r?.homeDirectory),...C(e.trustedArtifactRoots),...C(e.trustedFileRoots),...C(e.artifactRoots),...C(e.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(r?.pathMappings)?r.pathMappings:[]}}function xr(e){let t=a(e.codexSessionsRoot||e.codexSessionRoot);if(t)return t;let r=u(e.env)?e.env:{},n=a(e.codexHome||r.CODEX_HOME||process.env.CODEX_HOME)||L(Qn(),".codex");return L(n,"sessions")}function Os(e,t){let r=new Date(t),n=String(r.getFullYear()),s=String(r.getMonth()+1).padStart(2,"0"),i=String(r.getDate()).padStart(2,"0");return L(e,n,s,i)}function Ar(e,t,r){let n=new Set;for(let s of[t-Ot,t,t+Ot,r-Ot,r,r+Ot])n.add(Os(e,s));return[...n].filter(s=>mr(s))}function xs(e,t,r){let n=xr(e),s=t-es,i=r+rs,o=[];for(let c of Ar(n,t,r)){let l=[];try{l=pr(c)}catch{continue}for(let d of l){if(!d.endsWith(".jsonl"))continue;let f=L(c,d);try{let p=Xn(f);if(!p.isFile()||p.mtimeMs<s||p.mtimeMs>i)continue;o.push({path:f,mtimeMs:p.mtimeMs})}catch{}}}return o.sort((c,l)=>l.mtimeMs-c.mtimeMs).slice(0,ns)}function As(e,t,r=t){let n=xr(e),s=new Set;for(let i of Ar(n,t,r)){let o=[];try{o=pr(i)}catch{continue}for(let c of o)c.endsWith(".jsonl")&&s.add(L(i,c))}return s}function Yt(e,t,r=0){if(!(r>8||e===null||e===void 0)){if(typeof e=="string"){e&&t.push(e);return}if(Array.isArray(e)){for(let n of e)Yt(n,t,r+1);return}if(u(e))for(let n of["payload","item","text","delta","output_text","content","message","output","input","prompt","last_agent_message","revised_prompt"])n in e&&Yt(e[n],t,r+1)}}function Cr(e){return a(e).replace(/\s+/g," ")}function Cs(e){let t=Cr(e);if(!t)return[];if(t.length<=200)return[t];let r=160,n=[0,Math.floor((t.length-r)/2),t.length-r],s=new Set,i=[];for(let o of n){let c=t.slice(Math.max(0,o),Math.max(0,o)+r).trim();c.length>=40&&!s.has(c)&&(s.add(c),i.push(c))}return i}function Ns(e,t){let r=Cs(t);if(!r.length)return!1;let n=[];for(let i of e)Yt(i,n);let s=Cr(n.join(" "));return r.every(i=>s.includes(i))}function bs(e){return e.find(t=>u(t)&&a(t.type)==="session_meta"&&u(t.payload))||null}function Ms(e){let t=u(e?.payload)?e.payload:{},r=a(e?.timestamp||t.timestamp),n=Date.parse(r);return Number.isFinite(n)?n:Number.NaN}function Us(e){let t=a(e.originator),r=a(e.source);if(t!=="codex_exec"&&r!=="exec"||a(e.parent_thread_id))return!1;let n=a(e.thread_source);if(n&&n!=="user")return!1;let s=a(e.session_id),i=a(e.id);return!(s&&i&&s!==i)}function Ps(e,t,r){if(!Ns(e,t.promptText))return!1;let n=bs(e);if(!n)return!1;let s=n.payload;if(!Us(s))return!1;let i=Ms(n);if(!Number.isFinite(i)||i<t.startedAtMs-5e3||i>r+5e3)return!1;let o=a(t.target.cwd),c=a(s.cwd);return!(o&&c&&ar(o)!==ar(c))}function dr(e){try{return Ls(hr(e,"utf8"))}catch{return null}}function ks(e,t,r){if(!e||e.disabled)return null;if(e.matchedPath){let s=dr(e.matchedPath);return s?{path:e.matchedPath,events:s}:null}let n=[];for(let s of xs(e.target,e.startedAtMs,r)){if(e.baselinePaths.has(s.path))continue;let i=dr(s.path);!i||!Ps(i,e,r)||n.push({path:s.path,events:i})}return n.length!==1?(n.length>1&&(e.disabled=!0,h("warn","runtime.cli","codex transcript fallback disabled; multiple matching transcripts",{target:e.target.targetCode,sessionId:t,transcriptCount:n.length})),null):(e.matchedPath=n[0].path,h("info","runtime.cli","codex transcript stream attached",{target:e.target.targetCode,sessionId:t}),n[0])}function Ls(e){let t=[];for(let r of e.split(/\r?\n/)){let n=r.trim();if(n)try{t.push(JSON.parse(n))}catch{}}return t}function Ds(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);return r==="event_msg"&&n==="image_generation_end"||r==="response_item"&&n==="image_generation_call"}function vs(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{};return a(e.type)==="response_item"&&as.has(a(t.type))}function Fs(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{};return cs.has(a(t.type))}function Hs(e,t,r,n){let s=Tr(e),i=te(e),o=0,c=0,l=0;if(s&&!i&&t.emitThoughtChunks&&Ir(t,r,n,s)&&(l=1),s&&i){let d=t.emittedTexts.size?`
+`;this.child.stdin.write(s,r)}onNotification(t,r){let n=this.notificationHandlers.get(t)||new Set;return n.add(r),this.notificationHandlers.set(t,n),()=>{n.delete(r),n.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,r){return this.requestHandlers.set(t,r),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let r of this.pending.values())clearTimeout(r.timer),r.reject(t);this.pending.clear()}handleExit(t,r){this.exited=!0,this.exitCode=t,this.exitSignal=r,this.rejectAll(new Error(`runtime exited before response (${t}/${r})`));for(let n of this.exitHandlers)n(t,r)}async waitForExit(t=5e3){return!this.child||this.exited?!0:await new Promise(r=>{let n=setTimeout(()=>{s(),r(!1)},t);n.unref?.();let s=()=>{clearTimeout(n),this.exitHandlers.delete(i)},i=()=>{s(),r(!0)};this.exitHandlers.add(i),this.exited&&i()})}signal(t){if(!this.child||this.exited)return!1;let r=this.child.pid;if(!r)return!1;try{return this.detached&&process.platform!=="win32"?process.kill(-r,t):this.child.kill(t),!0}catch(n){if(n?.code==="ESRCH")return this.exited=!0,!1;try{return this.child.kill(t),!0}catch(s){return s?.code!=="ESRCH"&&h("warn","runtime","runtime signal failed",{target:this.label,pid:r,signal:t,error:String(s)}),!1}}}async stop(t="stop",{termTimeoutMs:r=5e3,killTimeoutMs:n=2e3}={}){if(!(!this.child||this.exited)){if(this.stopPromise)return await this.stopPromise;this.stopPromise=(async()=>{if(!this.child||this.exited)return;let s=this.child.pid;h("info","runtime","stopping runtime",{target:this.label,reason:t,pid:s}),this.rejectAll(new Error(`runtime stopped: ${t}`)),this.signal("SIGTERM"),!await this.waitForExit(r)&&this.child&&!this.exited&&(h("warn","runtime","runtime did not exit after SIGTERM; force killing",{target:this.label,reason:t,pid:s}),this.signal("SIGKILL"),await this.waitForExit(n))})();try{await this.stopPromise}finally{this.stopPromise=null}}}};import{randomUUID as lr}from"node:crypto";import{existsSync as Vn,readFileSync as zn,realpathSync as ar,statSync as Wn}from"node:fs";import{basename as dr,extname as fr,isAbsolute as mt,join as Jn,relative as mr,resolve as cr}from"node:path";var Xn=25*1024*1024;function pr(e,t=""){let r=a(t);if(r)return r;let n=fr(a(e)).toLowerCase();return n===".jpg"||n===".jpeg"?"image/jpeg":n===".webp"?"image/webp":n===".gif"?"image/gif":"image/png"}function hr(e,t){let r=typeof e=="string"?e.trim():"";return!r||r==="<omitted>"?"":r.startsWith("data:")?r:`data:${t};base64,${r.replace(/\s+/g,"")}`}function Ct(e){if(Array.isArray(e))return e.map(a).filter(Boolean);let t=a(e);return t?[t]:[]}function Yn(e,t){let r=mr(t,e);return r===""||!!r&&!r.startsWith("..")&&!mt(r)}function Zn(e,t){let r=a(e);if(!r||!Vn(r))return"";try{let n=ar(r);for(let s of t)try{let i=ar(s);if(Yn(n,i))return n}catch{}}catch{return""}return""}function Qn(e,t){let r=a(e);if(!r||!mt(r))return r;for(let n of Array.isArray(t)?t:[]){if(!u(n))continue;let s=a(n.runtimeRoot),i=a(n.hostRoot);if(!s||!i||!mt(s)||!mt(i))continue;let o=mr(cr(s),cr(r));if(o===""||!o.startsWith("..")&&!mt(o))return o?Jn(i,o):i}return r}function Qt(e,t,r={}){let n=a(e);return!n||n.startsWith("data:")||/^https?:\/\//i.test(n)?n:ts(n,t,r)}function ts(e,t,r={}){let n=[...Ct(r.trustedFileRoots),...Ct(r.trustedFileRoot),...Ct(r.artifactRoots),...Ct(r.artifactRoot)],s=Zn(Qn(e,r.pathMappings),n);if(!s)return"";try{let i=Wn(s);return!i.isFile()||i.size<=0||i.size>Xn?"":`data:${t};base64,${zn(s).toString("base64")}`}catch{return""}}function x(...e){for(let t of e){let r=a(t);if(r)return r}return""}function es(e,t,r,n){let s=r.toLowerCase();if(s==="image"||s==="picture")return!0;let i=x(n,e.previewUrl,e.fileUrl,e.imageUrl,e.dataUrl,e.url,e.uri,t.previewUrl,t.fileUrl,t.imageUrl,t.dataUrl,t.url,t.uri),o=fr(i.split("?",1)[0].split("#",1)[0]).toLowerCase();return[".png",".jpg",".jpeg",".webp",".gif"].includes(o)}function ee(e,t={}){let{source:r="runtime_image_generation_event"}=t;if(!u(e))return null;let n=u(e.payload)?e.payload:{},s=a(e.type),i=a(n.type);if(!(s==="event_msg"&&i==="image_generation_end"||s==="response_item"&&i==="image_generation_call"))return null;let o=x(n.call_id,n.id),c=x(n.saved_path,n.savedPath),l=x(n.revised_prompt,n.revisedPrompt),d=pr(c,n.mimeType||n.mime_type),f=hr(n.result,d)||Qt(c,d,t);if(!f)return null;let p=f.startsWith("data:")?f:"",_=c?dr(c):`${o||lr()}.png`;return{artifactType:"image",type:"image",fieldKey:"image",title:_||"Generated image",summary:l||"Generated image",content:{prompt:l||void 0,dataUrl:p||void 0,imageUrl:f,previewUrl:f,fileUrl:f,mimeType:d},dataUrl:p||void 0,previewUrl:f,fileUrl:f,metadata:{source:r,eventType:i,callId:o||void 0,savedPath:c||void 0,filename:_,mimeType:d,revisedPrompt:l||void 0}}}function rs(e){let t=u(e)?e:{},r=[];for(let n of["_artifacts","artifacts"]){let s=t[n];Array.isArray(s)&&r.push(...s)}for(let n of["_artifact","artifact"]){let s=t[n];u(s)&&r.push(s)}return r}function ns(e,t={}){let{source:r="runtime_artifact"}=t,n=u(e)?e:{};if(!Object.keys(n).length)return null;let s=u(n.content)?{...n.content}:{},i=u(n.metadata)?{...n.metadata}:{},o=x(n.saved_path,n.savedPath,s.saved_path,s.savedPath,i.savedPath),c=x(n.mimeType,n.mime_type,s.mimeType,s.mime_type,i.mimeType),l=x(n.artifactType,n.artifact_type,n.type,n.kind,s.type,o?"image":"file"),d=es(n,s,l,o),f=d?pr(o,c):c;if(d){let N=x(n.dataUrl,s.dataUrl),T=N.startsWith("data:")?N:"",y=x(n.imageUrl,n.previewUrl,n.fileUrl,n.downloadUrl,n.url,n.uri,s.imageUrl,s.previewUrl,s.fileUrl,s.downloadUrl,s.url,s.uri),E=hr(n.result??s.result,f)||T||Qt(o,f,t)||Qt(y,f,t);E&&(E.startsWith("data:")&&(s.dataUrl||=E),s.imageUrl||=E,s.previewUrl||=E,s.fileUrl||=E,f&&(s.mimeType||=f))}for(let[N,T]of[["prompt","prompt"],["previewUrl","previewUrl"],["fileUrl","fileUrl"],["downloadUrl","downloadUrl"],["imageUrl","imageUrl"],["dataUrl","dataUrl"],["url","url"],["uri","uri"],["mimeType","mimeType"],["mime_type","mimeType"]]){let y=n[N];y!=null&&y!==""&&!(T in s)&&(s[T]=y)}let p=x(n.fileUrl,n.downloadUrl,n.imageUrl,n.dataUrl,n.url,n.uri,s.fileUrl,s.downloadUrl,s.imageUrl,s.dataUrl,s.url,s.uri),_=x(n.previewUrl,n.imageUrl,n.dataUrl,n.url,n.fileUrl,n.uri,s.previewUrl,s.imageUrl,s.dataUrl,s.url,s.fileUrl,s.uri),m=x(n.dataUrl,s.dataUrl,p.startsWith("data:")?p:"",_.startsWith("data:")?_:""),R=x(n.filename,i.filename,o?dr(o):""),O=x(n.fieldKey,n.field_key,s.fieldKey,i.fieldKey,d?"image":"artifact");return{...n,artifactType:l,type:n.type||l,fieldKey:O,title:x(n.title,R,"Runtime artifact"),summary:x(n.summary,s.prompt,n.title,R,"Runtime artifact"),content:s,dataUrl:m||void 0,fileUrl:p||void 0,previewUrl:_||void 0,metadata:{...i,source:x(i.source,r),savedPath:o||i.savedPath,filename:R||i.filename,mimeType:f||i.mimeType}}}function Nt(e,t){if(!t||!e)return;let r=u(t.metadata)?t.metadata:{},n=x(r.savedPath,r.callId,t.previewUrl,t.fileUrl)||lr(),s=e.get(n);if(!s){e.set(n,t);return}s.content={...u(s.content)?s.content:{},...u(t.content)?t.content:{}},s.metadata={...u(s.metadata)?s.metadata:{},...r},s.previewUrl=t.previewUrl||s.previewUrl,s.fileUrl=t.fileUrl||s.fileUrl,s.summary=t.summary||s.summary,s.title=t.title||s.title}function te(e,t,r={}){for(let n of rs(e))Nt(t,ns(n,r))}function re(e){if(!u(e)||!u(e.payload))return u(e)?e:{value:e};let t=a(e.payload.type);if(t!=="image_generation_end"&&t!=="image_generation_call")return e;let r={...e.payload};return typeof r.result=="string"&&r.result&&(r.result="<omitted>",r.resultLength=e.payload.result.length),{...e,payload:r}}function ur(e,t,r){if(!u(e))return e;let n=u(e.event)?e.event:null;return n?(Nt(t,ee(n,r)),{...e,event:re(n)}):e}function gr(e,t,r={}){if(!u(e))return e;te(e,t,r);let n=ur(e,t,r),s=u(n.update)?ur(n.update,t,r):null;return s&&s!==n.update&&(n={...n,update:s}),n}function _r(e,t,r={}){let n=u(e)?{...e}:{};te(n,t,r),te(u(n.output)?n.output:{},t,r);let s=[...t?.values?.()||[]];return s.length&&(n._artifacts=s),delete n.artifacts,n}function Tr(e,t){let r=g(e,t);return r>0?r:t}var et=class{constructor(t,r,n={},s={}){this.agent=t,this.target=r,this.callbacks=n,this.options=s,this.proc=null,this.launch=null,this.launchCleanup=null,this.permissionHandlers=new Map}async ensureStarted(){if(this.proc)return;let t=a(this.target.command);if(!t)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let r={command:t,args:C(this.target.args),cwd:tt(this.target,this.agent.workspace),environment:u(this.target.env)?this.target.env:{}},n=this.options.prepareLaunch?await this.options.prepareLaunch(r):{...r,environment:{...process.env,...r.environment},cleanup:async()=>{}};this.launch=n,this.launchCleanup=n.cleanup,this.proc=new At({command:n.command,args:n.args,cwd:n.cwd,env:n.environment,label:`${this.agent.agentId}:${this.agent.targetCode}`,framing:a(this.target.framing||"line")}),this.proc.onRequest("session/request_permission",s=>this.handlePermissionRequest(s)),this.proc.onRequest("session/requestPermission",s=>this.handlePermissionRequest(s));try{await this.proc.start({initialize:this.target.initialize!==!1,initializeTimeoutMs:Tr(this.target.initializeTimeoutMs,Tr(this.options.initializeTimeoutMs,3e4)),initializeParams:{clientInfo:{name:"orcha-runtime-bridge",version:Q},...u(this.target.initializeParams)?this.target.initializeParams:{}}})}catch(s){throw await this.proc?.stop("runtime startup failed"),this.proc=null,await this.cleanupLaunch(),s}}async sessionNew(t={}){return await this.ensureStarted(),this.proc.call("session/new",this.sessionNewParams(t))}sessionNewParams(t={}){let r=Array.isArray(t.mcpServers)?t.mcpServers:Array.isArray(this.target.mcpServers)?this.target.mcpServers:[];return{...t,mcpServers:r}}async sessionPrompt(t,r){await this.ensureStarted();let n=a(t.sessionId),s=new Map,i=this.artifactOptions(),o=this.proc.onNotification("session/update",l=>{let d=a(l.sessionId);(!d||d===n)&&r(gr(l,s,i))}),c=async l=>this.callbacks.onPermissionRequest?.({agent:this.agent,runtimeSessionId:n,request:l,emitUpdate:r})||{outcome:"denied",reason:"permission handler is not configured"};n&&this.permissionHandlers.set(n,c),this.permissionHandlers.set("*",c);try{let l=await this.proc.call("session/prompt",t,this.options.sessionPromptTimeoutMs);return _r(l,s,i)}finally{o(),n&&this.permissionHandlers.delete(n),this.permissionHandlers.delete("*")}}async sessionCancel(t){return await this.ensureStarted(),this.proc.call("session/cancel",t,5e3).catch(()=>({ok:!0}))}async handlePermissionRequest(t){let r=a(t.sessionId),n=this.permissionHandlers.get(r)||this.permissionHandlers.get("*");return n?n(t):{outcome:"denied",reason:"no active Orcha permission handler"}}artifactSource(){return a(this.target.type||"acp")==="openclaw"?"openclaw_image_generation":"acp_runtime_image_generation"}artifactOptions(){let t=u(this.target.env)?this.target.env:{};return{source:this.artifactSource(),trustedFileRoots:[a(this.launch?.artifactDirectory),a(this.launch?.homeDirectory),a(this.target.artifactRoot),a(this.target.artifactDir),a(this.target.runtimeArtifactRoot),a(t.ORCHA_RUNTIME_ARTIFACT_DIR),...C(this.target.trustedArtifactRoots),...C(this.target.trustedFileRoots),...C(this.target.artifactRoots),...C(this.target.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(this.launch?.pathMappings)?this.launch.pathMappings:[]}}async stop(t){try{await this.proc?.stop(t)}finally{this.proc=null,await this.cleanupLaunch()}}async cleanupLaunch(){let t=this.launchCleanup;this.launchCleanup=null,this.launch=null,await t?.()}};function ss(e){let t=u(e.metadata)?e.metadata:{};return a(t.agentCode)}function is(e,t){let r=ss(e);return r?`agent:${r}:${t}`:`orcha-${t}`}var bt=class extends et{constructor(t,r,n,s={},i={}){let o=a(n).replace(/[^A-Za-z0-9._-]+/g,"-")||"default",c=a(r.command)||"openclaw",l=Array.isArray(r.args)?r.args.map(String):[],d=l.length>0?l:["acp","--session",is(t,o)];super(t,{...r,command:c,args:d},s,i)}sessionNewParams(t={}){return{...t,mcpServers:[]}}};import{spawn as Ir}from"node:child_process";import{randomUUID as rt}from"node:crypto";import{existsSync as Or,mkdirSync as os,readdirSync as xr,readFileSync as Ar,realpathSync as ht,rmSync as as,rmdirSync as cs,statSync as us,unlinkSync as ls}from"node:fs";import{homedir as ds,tmpdir as Cr}from"node:os";import{basename as ae,dirname as fs,join as F,resolve as Rr}from"node:path";var ms=36e5,Nr=5e3,ps=2*60*1e3,hs=2*60*1e3,gs=12,_s=1e3,Ts=1500,Rs=1e3,Mt=24*60*60*1e3,pt=new Set(["final_answer","final","complete","completed","done"]),ys=new Set(["function_call","function_call_output","custom_tool_call","custom_tool_call_output","local_shell_call","local_shell_call_output","mcp_tool_call","mcp_tool_call_output","web_search_call","image_generation_call","image_generation_end"]),Ss=new Set(["context_compacted","context_compaction","context_compressed"]);function Pt(e,t){if(e?.pid){if(process.platform==="win32"){let r=["/PID",String(e.pid),"/T"];t==="SIGKILL"&&r.push("/F");try{Ir("taskkill",r,{stdio:"ignore",windowsHide:!0}).unref?.()}catch{try{e.kill(t)}catch{}}return}try{process.kill(-e.pid,t)}catch(r){if(r?.code==="ESRCH")return;try{e.kill(t)}catch{}}}}function ne(e){Pt(e,"SIGTERM");let t=setTimeout(()=>Pt(e,"SIGKILL"),Nr);return t.unref?.(),t}function D(e){if(typeof e=="string")return e;if(Array.isArray(e))return e.map(t=>D(t)).join("");if(!u(e))return"";for(let t of["text","delta","output_text","content","message","output"]){let r=D(e[t]);if(r)return r}return""}function br(e){if(!u(e))return"";let t=u(e.payload)?e.payload:{};if(a(e.type)==="event_msg"){if(a(t.type)==="agent_message")return a(t.message);if(a(t.type)==="task_complete")return a(t.last_agent_message)}if(a(e.type)==="response_item"&&a(t.type)==="message"&&a(t.role)==="assistant")return D(t.content)||D(t.message);if(a(e.type)==="result")return D(e.result);let r=D(e.delta)||D(e.text)||D(e.content);if(r)return r;let n=u(e.item)?e.item:{};return["message","agent_message"].includes(a(n.type))||a(n.role)==="assistant"?D(n.content)||D(n.text)||D(n.message):""}function Mr(e,t={}){return ee(e,{source:"codex_cli_image_generation",...t})}function Ur(e,t){Nt(e.artifacts,t)}function Pr(e){return z(re(e))}function ce(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);if(r==="event_msg"&&n==="task_complete")return!0;let s=a(t.phase||t.status||t.stage).toLowerCase();if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&a(t.role)==="assistant")return pt.has(s);let i=u(e.item)?e.item:{};return r==="item.completed"&&a(i.type)==="agent_message"?!0:r==="result"&&e.is_error!==!0?a(e.result).length>0:!1}function Es(e){let t=a(e.terminalProtocol||e.eventProtocol).toLowerCase();if(t)return t;let r=ae(a(e.command)).replace(/\.exe$/i,"").toLowerCase();return r==="codex"||r==="claude"?r:""}function yr(e,t,r){let n=u(t.error)?t.error:{},s=a(n.message)||D(t.error)||a(t.result)||a(t.message)||r;return Object.assign(new Error(s),{code:e})}function ws(e,t){if(!u(e))return null;let r=a(e.type).toLowerCase();if(t==="codex")return r==="turn.completed"?{status:"completed",result:{stopReason:"end_turn"}}:r==="turn.failed"?{status:"failed",error:yr("RUNTIME_CODEX_TURN_FAILED",e,"Codex turn failed")}:null;if(t==="claude"&&r==="result"){let n=a(e.subtype).toLowerCase();return e.is_error===!0||n.startsWith("error")||["failed","failure"].includes(n)?{status:"failed",error:yr("RUNTIME_CLAUDE_RESULT_FAILED",e,"Claude result failed")}:{status:"completed",result:{stopReason:"end_turn",...a(e.result)?{output:a(e.result)}:{}}}}return null}function Sr(e){return u(e)?a(e.phase||e.status||e.stage).toLowerCase():""}function Is(e){if(!u(e)||ce(e))return!1;let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type),s=Sr(t);if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&a(t.role)==="assistant")return!!(s&&!pt.has(s));let i=u(e.item)?e.item:{},o=Sr(i);return a(i.role)==="assistant"||a(i.type)==="message"?!!(o&&!pt.has(o)):!1}function Os(e,t,r){return r.captureLastMessage===!1||t.includes("--output-last-message")||t.includes("-o")?!1:r.captureLastMessage===!0?!0:ae(e)==="codex"}function xs(e,t){return t.collectCodexTranscriptArtifacts===!1?!1:t.collectCodexTranscriptArtifacts===!0?!0:ae(e)==="codex"}function kr(e){return Math.max(20,g(e.codexTranscriptPollMs||e.transcriptPollMs,_s))}function As(e){return Math.max(0,g(e.codexFinalOutputWaitMs||e.finalOutputWaitMs,Ts))}function kt(e){if(typeof e=="boolean")return e;let t=a(e).toLowerCase();return["true","1","yes","y","on"].includes(t)?!0:["false","0","no","n","off"].includes(t)?!1:null}function ue(e){let t=u(e?.metadata)?e.metadata:{};return u(t._runtimeBridge)?t._runtimeBridge:{}}function se(e){return a(ue(e).promptKind).toLowerCase()}function Cs(e,t){for(let r of[e.codexTranscriptStreaming,e.streamCodexTranscript]){let n=kt(r);if(n!=null)return n}return se(t)==="chat"}function Ns(e,t){let r=ue(e);for(let s of[r.emitThoughtChunks,r.streamThoughts]){let i=kt(s);if(i!=null)return i}let n=se(e);if(n&&n!=="chat")return!1;for(let s of[t.emitThoughtChunks,t.streamThoughts]){let i=kt(s);if(i!=null)return i}return se(e)==="chat"}function bs(e){let t=ue(e);for(let r of[t.finalTextOnly,t.finalOutputOnly]){let n=kt(r);if(n!=null)return n}return null}function Ms(e,t){let r=bs(e);return r??(t.finalTextOnly===!0||t.finalOutputOnly===!0?!0:(t.finalTextOnly===!1||t.finalOutputOnly===!1,!1))}function Us(e,t){return!e.finalTextOnly||t}function Lr(e,t,r,n,s=n){return!n||e.emittedTexts.has(s)?!1:(e.emittedTexts.add(s),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}}),!0)}function Dr(e,t,r,n){return!n||e.emittedThoughtTexts.has(n)?!1:(e.emittedThoughtTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_thought_chunk",content:{type:"text",text:n}}}),!0)}function Ps(e,t,r,n=new Set){return{target:e,promptText:t,startedAtMs:r,baselinePaths:n,matchedPath:"",disabled:!1,processedLines:new Map}}function ks(e,t){let r=u(e.env)?e.env:{},n=a(e.artifactRoot||e.artifactDir||e.runtimeArtifactRoot||r.ORCHA_RUNTIME_ARTIFACT_DIR)||F(Cr(),"orcha-runtime-artifacts"),s=a(t).replace(/[^A-Za-z0-9._-]+/g,"-").slice(0,80)||rt(),i=F(n,s),o=F(i,rt());return os(o,{recursive:!0}),{root:o,realRoot:ht(o),sessionRoot:i,realSessionRoot:ht(i)}}function Ls(e){let t=a(e?.artifactDirectory);if(!t)throw new Error("sandbox launch did not provide an artifact directory");return{root:t,realRoot:ht(t),sessionRoot:"",realSessionRoot:""}}function vr(e){return a(u(e)?e.root:e)}function Er(e){let t=vr(e),r=a(u(e)?e.sessionRoot:fs(t)),n=a(u(e)?e.realSessionRoot:"");if(r)try{if(n&&ht(r)!==n)return;cs(r)}catch{}}function Ds(e,t={}){let r=vr(e),n=a(u(e)?e.realRoot:"");if(r){try{if(n&&ht(r)!==n){h("warn","runtime.cli","runtime artifact directory cleanup skipped; path changed",{...t,artifactRoot:r});return}}catch{Er(e);return}try{as(r,{recursive:!0,force:!0})}catch(s){h("warn","runtime.cli","runtime artifact directory cleanup failed",{...t,artifactRoot:r,error:String(s?.message||s)});return}Er(e)}}function vs(e,t,r=null){return{trustedFileRoots:[t,a(r?.artifactDirectory),a(r?.homeDirectory),...C(e.trustedArtifactRoots),...C(e.trustedFileRoots),...C(e.artifactRoots),...C(e.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(r?.pathMappings)?r.pathMappings:[]}}function Fr(e){let t=a(e.codexSessionsRoot||e.codexSessionRoot);if(t)return t;let r=u(e.env)?e.env:{},n=a(e.codexHome||r.CODEX_HOME||process.env.CODEX_HOME)||F(ds(),".codex");return F(n,"sessions")}function Fs(e,t){let r=new Date(t),n=String(r.getFullYear()),s=String(r.getMonth()+1).padStart(2,"0"),i=String(r.getDate()).padStart(2,"0");return F(e,n,s,i)}function Hr(e,t,r){let n=new Set;for(let s of[t-Mt,t,t+Mt,r-Mt,r,r+Mt])n.add(Fs(e,s));return[...n].filter(s=>Or(s))}function Hs(e,t,r){let n=Fr(e),s=t-ps,i=r+hs,o=[];for(let c of Hr(n,t,r)){let l=[];try{l=xr(c)}catch{continue}for(let d of l){if(!d.endsWith(".jsonl"))continue;let f=F(c,d);try{let p=us(f);if(!p.isFile()||p.mtimeMs<s||p.mtimeMs>i)continue;o.push({path:f,mtimeMs:p.mtimeMs})}catch{}}}return o.sort((c,l)=>l.mtimeMs-c.mtimeMs).slice(0,gs)}function $s(e,t,r=t){let n=Fr(e),s=new Set;for(let i of Hr(n,t,r)){let o=[];try{o=xr(i)}catch{continue}for(let c of o)c.endsWith(".jsonl")&&s.add(F(i,c))}return s}function ie(e,t,r=0){if(!(r>8||e===null||e===void 0)){if(typeof e=="string"){e&&t.push(e);return}if(Array.isArray(e)){for(let n of e)ie(n,t,r+1);return}if(u(e))for(let n of["payload","item","text","delta","output_text","content","message","output","input","prompt","last_agent_message","revised_prompt"])n in e&&ie(e[n],t,r+1)}}function $r(e){return a(e).replace(/\s+/g," ")}function Bs(e){let t=$r(e);if(!t)return[];if(t.length<=200)return[t];let r=160,n=[0,Math.floor((t.length-r)/2),t.length-r],s=new Set,i=[];for(let o of n){let c=t.slice(Math.max(0,o),Math.max(0,o)+r).trim();c.length>=40&&!s.has(c)&&(s.add(c),i.push(c))}return i}function qs(e,t){let r=Bs(t);if(!r.length)return!1;let n=[];for(let i of e)ie(i,n);let s=$r(n.join(" "));return r.every(i=>s.includes(i))}function js(e){return e.find(t=>u(t)&&a(t.type)==="session_meta"&&u(t.payload))||null}function Ks(e){let t=u(e?.payload)?e.payload:{},r=a(e?.timestamp||t.timestamp),n=Date.parse(r);return Number.isFinite(n)?n:Number.NaN}function Gs(e){let t=a(e.originator),r=a(e.source);if(t!=="codex_exec"&&r!=="exec"||a(e.parent_thread_id))return!1;let n=a(e.thread_source);if(n&&n!=="user")return!1;let s=a(e.session_id),i=a(e.id);return!(s&&i&&s!==i)}function Vs(e,t,r){if(!qs(e,t.promptText))return!1;let n=js(e);if(!n)return!1;let s=n.payload;if(!Gs(s))return!1;let i=Ks(n);if(!Number.isFinite(i)||i<t.startedAtMs-5e3||i>r+5e3)return!1;let o=a(t.target.cwd),c=a(s.cwd);return!(o&&c&&Rr(o)!==Rr(c))}function wr(e){try{return Ws(Ar(e,"utf8"))}catch{return null}}function zs(e,t,r){if(!e||e.disabled)return null;if(e.matchedPath){let s=wr(e.matchedPath);return s?{path:e.matchedPath,events:s}:null}let n=[];for(let s of Hs(e.target,e.startedAtMs,r)){if(e.baselinePaths.has(s.path))continue;let i=wr(s.path);!i||!Vs(i,e,r)||n.push({path:s.path,events:i})}return n.length!==1?(n.length>1&&(e.disabled=!0,h("warn","runtime.cli","codex transcript fallback disabled; multiple matching transcripts",{target:e.target.targetCode,sessionId:t,transcriptCount:n.length})),null):(e.matchedPath=n[0].path,h("info","runtime.cli","codex transcript stream attached",{target:e.target.targetCode,sessionId:t}),n[0])}function Ws(e){let t=[];for(let r of e.split(/\r?\n/)){let n=r.trim();if(n)try{t.push(JSON.parse(n))}catch{}}return t}function Js(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);return r==="event_msg"&&n==="image_generation_end"||r==="response_item"&&n==="image_generation_call"}function Xs(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{};return a(e.type)==="response_item"&&ys.has(a(t.type))}function Ys(e){if(!u(e))return!1;let t=u(e.payload)?e.payload:{};return Ss.has(a(t.type))}function Zs(e,t,r,n){let s=br(e),i=ce(e),o=0,c=0,l=0;if(s&&!i&&t.emitThoughtChunks&&Dr(t,r,n,s)&&(l=1),s&&i){let d=t.emittedTexts.size?`
 
-${s}`:s;wr(t,r,n,d,s)&&(o=1,c=1)}return s&&i&&(t.finalTextSeen=!0),Rr(t,yr(e,t.artifactOptions)),(Ds(e)||vs(e)||Fs(e)||i)&&n({sessionId:r,update:{sessionUpdate:"runtime_event",event:Sr(e)}}),{textCount:o,finalTextCount:c,thoughtCount:l}}function Qt(e,t,r,n,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0,textCount:0,finalTextCount:0,thoughtCount:0};let i=e.artifacts.size,o=0,c=0,l=0,d=0,f=ks(t,r,s);if(f){let p=Math.min(t.processedLines.get(f.path)||0,f.events.length),g=e.artifacts.size;for(let m of f.events.slice(p)){let y=Hs(m,e,r,n);c+=y.textCount,l+=y.finalTextCount,d+=y.thoughtCount}t.processedLines.set(f.path,f.events.length),(f.events.length>p||e.artifacts.size>g)&&(o=1)}return{artifactCount:e.artifacts.size-i,transcriptCount:o,textCount:c,finalTextCount:l,thoughtCount:d}}function $s(e,{remove:t=!0}={}){if(!e||!mr(e))return"";try{return hr(e,"utf8").trim()}catch{return""}finally{t&&xt(e)}}function xt(e){if(e)try{Yn(e)}catch{}}function Bs(e,t){return{artifactCount:(e?.artifactCount||0)+(t?.artifactCount||0),transcriptCount:(e?.transcriptCount||0)+(t?.transcriptCount||0),textCount:(e?.textCount||0)+(t?.textCount||0),finalTextCount:(e?.finalTextCount||0)+(t?.finalTextCount||0),thoughtCount:(e?.thoughtCount||0)+(t?.thoughtCount||0)}}function qs(e){return new Promise(t=>setTimeout(t,e))}function js(e,t,r,n){return n?(e.finalTextSeen=!0,e.emittedTexts.has(n)||(e.emittedTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}})),!0):!1}async function Gs(e,t,r,n,s,i){let o=Qt(e,t,r,n,Date.now()),c=()=>js(e,r,n,$s(s,{remove:!1}));if(c()||e.finalTextSeen)return xt(s),o;let l=ps(i);if(l<=0||!t&&!s)return xt(s),o;let d=Date.now()+l,f=Math.min(Er(i),100);for(;!e.finalTextSeen&&Date.now()<d&&(await qs(Math.min(f,Math.max(0,d-Date.now()))),o=Bs(o,Qt(e,t,r,n,Date.now())),!c()););return xt(s),o}var Nt=class{constructor(t,r,n={}){this.agent=t,this.target=r,this.options=n,this.active=new Map}async sessionNew(){return{sessionId:`cli-${this.agent.agentId}-${Z()}`}}async sessionPrompt(t,r,n){let s=Date.now(),i=a(this.target.command);if(!i)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let o=a(t.sessionId)||Z(),c=yt(t.prompt),l=a(this.target.promptMode||"stdin"),d=this.buildArgs(l,c),f=a(this.target.cwd)||this.agent.workspace||process.cwd(),p=typeof this.options.prepareLaunch=="function",m=fs(i,d,this.target)?p?`/tmp/orcha-runtime-last-message-${Z()}.txt`:L(gr(),`orcha-runtime-last-message-${Z()}.txt`):"";m&&d.push("--output-last-message",m);let y={...u(this.target.env)?this.target.env:{},...l==="env"?{ORCHA_RUNTIME_PROMPT:c}:{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:o},O=p?await this.options.prepareLaunch({command:i,args:d,cwd:f,environment:y}):{command:i,args:d,cwd:f,environment:{...process.env,...y},cleanup:async()=>{}},N=p?Es(O):Ss(this.target,o),_=N.root,R=Is(this.target,_,O),E=ms(i,this.target),A={...this.target,targetCode:this.agent.targetCode,cwd:f,...p?{codexHome:L(O.homeDirectory,".codex")}:{}},W=E?As(A,s):new Set,_t=p&&m?L(O.tempDirectory,m.slice(5)):m,J=T(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,T(this.options.sessionPromptTimeoutMs,ts));p||(O.environment.ORCHA_RUNTIME_ARTIFACT_DIR=_);let I=fr(O.command,O.args,{cwd:O.cwd,env:O.environment,stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(o,I),h("info","runtime.cli","runtime prompt started",{target:this.agent.targetCode,sessionId:o,pid:I.pid,timeoutMs:J,isolation:O.isolation});let je="",Bt=a(this.target.outputMode||"text"),b={artifacts:new Map,emittedTexts:new Set,emittedThoughtTexts:new Set,value:"",artifactOptions:R,finalTextSeen:!1,finalTextOnly:Ts(t,this.target),emitThoughtChunks:gs(t,this.target),terminalOutcome:null,terminalProtocol:us(this.target),emitTerminal:null},qt=E?Rs(A,c,s,W):null;return I.stdout.setEncoding("utf8"),I.stdout.on("data",X=>this.handleStdout(X,Bt,b,o,r)),I.stderr.setEncoding("utf8"),I.stderr.on("data",X=>{je+=X,this.target.emitStderr===!0&&r({sessionId:o,update:{sessionUpdate:"runtime_stderr_chunk",content:{type:"text",text:X}}})}),l==="stdin"?I.stdin.end(c):I.stdin.end(),await new Promise((X,jt)=>{let nt=!1,Ge=!1,Tt=null,st=null,Gt=qt&&hs(this.target,t)?setInterval(()=>{try{Qt(b,qt,o,r)}catch(w){h("warn","runtime.cli","codex transcript stream poll failed",{target:this.agent.targetCode,sessionId:o,error:String(w?.message||w)})}},Er(this.target)):null;Gt?.unref?.();let Ke=setTimeout(()=>{Ge=!0,h("warn","runtime.cli","runtime prompt timed out; terminating child",{target:this.agent.targetCode,sessionId:o,pid:I.pid,timeoutMs:J}),At(I,"SIGTERM"),Tt=setTimeout(()=>{h("warn","runtime.cli","runtime prompt force killing child",{target:this.agent.targetCode,sessionId:o,pid:I.pid}),At(I,"SIGKILL")},_r),Tt.unref?.(),it(Object.assign(new Error(`runtime CLI timed out after ${J}ms`),{code:"RUNTIME_CLI_TIMEOUT"}))},J);Ke.unref?.();let Ve=async()=>{clearTimeout(Ke),st&&clearTimeout(st),Gt&&clearInterval(Gt),Tt&&!Ge&&clearTimeout(Tt),ws(N,{target:this.agent.targetCode,sessionId:o}),this.active.delete(o),b.emitTerminal=null,await O.cleanup?.()},yn=w=>{nt||(nt=!0,Ve().then(()=>X(w),jt))},it=w=>{nt||(nt=!0,Ve().then(()=>jt(w),v=>{h("warn","runtime.cli","sandbox launch cleanup failed",{target:this.agent.targetCode,sessionId:o,error:String(v?.message||v)}),jt(w)}))};b.emitTerminal=w=>{let v={...u(w.result)?w.result:{},_artifacts:[...b.artifacts.values()]};try{n?.({...w,result:v})}catch(j){h("warn","runtime.cli","runtime terminal listener failed",{target:this.agent.targetCode,sessionId:o,error:String(j?.message||j)})}let k=Math.max(0,T(this.target.terminalExitGraceMs,os));st=setTimeout(()=>{st=null,!(nt||this.active.get(o)!==I)&&(h("warn","runtime.cli","runtime stayed alive after terminal event; terminating child",{target:this.agent.targetCode,sessionId:o,pid:I.pid,terminalProtocol:b.terminalProtocol,graceMs:k}),Jt(I))},k),st.unref?.()},I.on("error",w=>{h("warn","runtime.cli","runtime child error",{target:this.agent.targetCode,sessionId:o,pid:I.pid,error:String(w?.message||w)}),it(w)}),I.on("exit",(w,v)=>{(async()=>{Bt==="json-lines"&&b.value.trim()&&this.handleStdout(`
-`,Bt,b,o,r);let k=await Gs(b,qt,o,r,_t,this.target);(k.artifactCount>0||k.textCount>0||k.thoughtCount>0)&&h("info","runtime.cli","codex transcript updates collected",{target:this.agent.targetCode,sessionId:o,artifactCount:k.artifactCount,textCount:k.textCount,finalTextCount:k.finalTextCount,thoughtCount:k.thoughtCount,transcriptCount:k.transcriptCount});let j=je.trim();if(j&&h("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:o,stderr:j}),h("info","runtime.cli","runtime prompt finished",{target:this.agent.targetCode,sessionId:o,pid:I.pid,exitCode:w,signal:v,artifactCount:b.artifacts.size,finalTextSeen:b.finalTextSeen}),b.terminalOutcome?.status==="failed"){it(b.terminalOutcome.error);return}if(w!==0&&b.terminalOutcome?.status!=="completed"){let Rn=Object.assign(new Error(`runtime CLI exited with code ${w??"unknown"}${v?` (${v})`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:w,signal:v});it(Rn);return}yn({stopReason:"end_turn",exitCode:w,signal:v,_artifacts:[...b.artifacts.values()],...j?{stderr:j}:{}})})().catch(it)})})}buildArgs(t,r){let n=C(this.target.args);return t==="args"?[...n,r]:n}handleStdout(t,r,n,s,i){if(r!=="json-lines"){i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:t}}});return}n.value+=t;let o=n.value.split(/\r?\n/);n.value=o.pop()||"";for(let c of o){let l=c.trim();if(l)try{let d=JSON.parse(l);Rr(n,yr(d,n.artifactOptions)),i({sessionId:s,update:{sessionUpdate:"runtime_event",event:Sr(d)}});let f=Tr(d),p=te(d);f&&n.emitThoughtChunks&&!p&&ds(d)?Ir(n,s,i,f):f&&ys(n,p)&&wr(n,s,i,f),f&&p&&(n.finalTextSeen=!0);let g=ls(d,n.terminalProtocol);g&&!n.terminalOutcome&&(g.status==="failed"||n.finalTextSeen||n.artifacts.size>0)&&(n.terminalOutcome=g,n.emitTerminal?.(g))}catch{i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:`${c}
-`}}})}}}async sessionCancel(t){let r=a(t.sessionId),n=this.active.get(r);return n?(h("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),Jt(n),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}stop(t="stop"){for(let[r,n]of this.active.entries())h("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),Jt(n);this.active.clear()}};var re="ORCHA_RUNTIME_OUTPUT_START",ne="ORCHA_RUNTIME_OUTPUT_END",se="ORCHA_RUNTIME_CONTROL_START",ie="ORCHA_RUNTIME_CONTROL_END",br=re,Mr=ne,Ur=se,Pr=ie,oe=[re,ne,se,ie],Ks=new Set(["_artifacts","_decision","_meta"]),Vs=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${oe.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),D=class extends Error{constructor(t,r,n){super(r),this.name="RuntimeResultProtocolError",this.code=t,this.detail={rawOutput:n}}};function kr(e){let t=typeof e=="string"?e.trimStart():"";return oe.some(r=>t.startsWith(r))}function ae(e){if(typeof e!="string")return null;let t=e,r=zs(t);if(![...r.values()].some(m=>m.length>0))return null;let n=[],s=[];for(let[m,y]of r)y.length===0?n.push(m):y.length>1&&s.push(m);if(n.length>0||s.length>0){let m=[];throw n.length>0&&m.push(`\u7F3A\u5C11 ${n.join(", ")}`),s.length>0&&m.push(`\u91CD\u590D ${s.join(", ")}`),new D("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${m.join("\uFF1B")}`,t)}let i=r.get(re)[0],o=r.get(ne)[0],c=r.get(se)[0],l=r.get(ie)[0];if(!(i.end<=o.start&&o.end<=c.start&&c.end<=l.start))throw new D("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757",t);let d=Ws(t.slice(i.end,o.start));if(!d.trim())throw new D("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let f=t.slice(c.end,l.start).trim();if(!f)throw new D("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let p;try{p=JSON.parse(f)}catch(m){throw new D("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(m?.message||m)}`,t)}if(!Nr(p))throw new D("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61",t);let g=Object.keys(p).filter(m=>!Ks.has(m)).sort();if(g.length>0)throw new D("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${g.join(", ")}`,t);if("_artifacts"in p&&!Array.isArray(p._artifacts))throw new D("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4",t);for(let m of["_decision","_meta"])if(m in p&&!Nr(p[m]))throw new D("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${m} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`,t);return{output:d,...p}}function zs(e){let t=new Map(oe.map(r=>[r,[]]));for(let r of e.matchAll(Vs))t.get(r.groups.marker).push({start:r.index,end:r.index+r[0].length});return t}function Ws(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",r=t?e.slice(t.length):e;return t&&r.endsWith(t)?r.slice(0,-t.length):r}function Nr(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as Js}from"node:crypto";var Xs="orcha.goal-contract/v1",Ys=new Set(["complete","completed","done","ok","passed","success","succeeded"]),Qs=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),Zs=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function de(e){return Js("sha256").update(H(e)).digest("hex")}function Dr(e){if(!Fr(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
-`)}function vr(e,t,r=""){if(!Fr(e))return e==null?null:{required:!0,status:"failed",outcome:a(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let n=de(e),s=e.verificationPlan.required===!0;if(a(r)&&a(r)!==n)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:n,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:n,checks:[]};let i=ti(t),o=e.verificationPlan.checks.map(l=>ai(l,i));return{required:!0,status:o.some(l=>l.status==="failed")?"failed":o.some(l=>l.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:n,checks:o}}function Fr(e){if(!u(e)||e.schemaVersion!==Xs||!a(e.outcome))return!1;let t=e.verificationPlan;if(!u(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let r=new Set;for(let n of t.checks)if(!u(n)||!a(n.id)||r.has(a(n.id))||(r.add(a(n.id)),!Array.isArray(n.toolNames)||n.toolNames.length===0||n.toolNames.some(s=>!a(s)))||n.arguments!==void 0&&!u(n.arguments))return!1;return!0}function ti(e){let t=new Map,r=[];for(let n of Array.isArray(e)?e:[]){let s=u(n?.update)?n.update:{},i=a(s.sessionUpdate);if(i==="runtime_event"){ei(s.event,t,r);continue}if(i==="tool_call"){let o=Mt(s)||`tool-${r.length+1}`,c=bt(t,r,o),l=ue(s,s.name||s.toolName||s.kind);c.toolName=l.toolName,c.arguments=l.arguments,c.status=dt(s.status),c.evidence=Pt(s);continue}if(i==="tool_call_update"){let o=Mt(s);if(!o)continue;let c=bt(t,r,o),l=ue(s,s.name||s.toolName||s.kind);c.toolName||=l.toolName,Object.keys(c.arguments).length===0&&(c.arguments=l.arguments),c.status=dt(s.status),c.evidence.push(...Pt(s))}}return r}function ei(e,t,r){let n=u(e)&&u(e.payload)?e.payload:u(e)?e:{},s=a(n.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let c=Mt(n)||`runtime-${r.length+1}`,l=bt(t,r,c),d=ue(n,n.name||n.tool||s,s);l.toolName=d.toolName,l.arguments=d.arguments,l.status=dt(n.status),l.evidence.push(...Pt(n));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=Mt(n);if(!i)return;let o=bt(t,r,i);o.status=ii(n,o.toolName),o.evidence.push(...Pt(n))}function bt(e,t,r){let n=e.get(r);return n||(n={toolCallId:r,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(r,n),t.push(n)),n}function ri(e){let t=a(e).toLowerCase();return Zs.get(t)||t}function ue(e,t,r=""){let n=ni(e),s=a(r)==="mcp_tool_call"||a(e?.kind).toLowerCase()==="mcp",i=u(e?._meta)?e._meta:{},o=a(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let c=a(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...n,...c?{operationCode:c}:{}}}}return{toolName:ri(t),arguments:n}}function Mt(e){return u(e)?a(e.call_id||e.callId||e.toolCallId||e.id):""}function ni(e){if(!u(e))return{};for(let r of["arguments","args","rawInput","input","params","parameters"]){let n=si(e[r]);if(n)return n}let t={};for(let r of["cmd","command","cwd","operationCode","path","query","url"])e[r]!==void 0&&(t[r]=e[r]);return t}function si(e){if(u(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return u(t)?t:null}catch{return null}}function ii(e,t){if(!u(e))return"unknown";let r=Ut(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return r.includes("failed")?"failed":r.includes("success")?"success":"unknown"}function Ut(e,t=0,r={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return oi(e,t,r);if(Array.isArray(e))return e.flatMap(o=>Ut(o,t+1,r));if(!u(e))return[];let n=[];typeof e.isError=="boolean"&&n.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&n.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&n.push(e.success?"success":"failed");let s=dt(e.status);s!=="unknown"&&n.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&n.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&n.push(...Ut(e[o],t+1,r));return n}function oi(e,t,r){let n=e.trim();if(!n)return[];try{return Ut(JSON.parse(n),t+1,r)}catch{}if(r.parseCliExitCode!==!0)return[];let s=[];for(let i of n.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function dt(e){let t=a(e).toLowerCase();return Ys.has(t)?"success":Qs.has(t)?"failed":"unknown"}function Pt(e){if(!u(e))return[];let t=u(e.output)?e.output:{},r=[e.verificationEvidence,u(e.verification)?e.verification.evidence:null,t.verificationEvidence,u(t.verification)?t.verification.evidence:null],n=[];for(let s of r)for(let i of Array.isArray(s)?s:s?[s]:[])!u(i)||!a(i.id)||n.push({id:a(i.id),status:dt(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...a(i.message)?{message:a(i.message)}:{}});return n}function ai(e,t){let r=t.filter(o=>e.toolNames.includes(o.toolName)&&le(e.arguments||{},o.arguments)),n=a(e.evidenceId),s=r.find(o=>o.status==="success"&&(!n||o.evidence.some(c=>c.id===n&&c.status==="success")));if(s)return ce(e,"passed",s,"Runtime tool evidence passed.");let i=r.find(o=>o.status==="failed"||n&&o.evidence.some(c=>c.id===n&&c.status==="failed"));return i?ce(e,"failed",i,"Runtime tool evidence failed."):ce(e,"missing",r.at(-1),n?"Required evidence is missing.":"Required tool execution is missing.")}function ce(e,t,r,n){return{id:e.id,status:t,message:n,...a(e.description)?{description:a(e.description)}:{},toolNames:e.toolNames,...u(e.arguments)?{arguments:e.arguments}:{},...a(e.evidenceId)?{evidenceId:a(e.evidenceId)}:{},...r?.toolCallId?{toolCallId:r.toolCallId}:{}}}function le(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((r,n)=>le(r,t[n])):u(e)?u(t)?Object.entries(e).every(([r,n])=>Object.hasOwn(t,r)&&le(n,t[r])):!1:Object.is(e,t)}function H(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return Lr(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,r)=>{if(!Object.hasOwn(e,r))throw new Error("invalid_jcs_json_value");return H(e[r])}).join(",")}]`;if(u(e))return`{${Object.keys(e).sort().map(t=>`${Lr(t)}:${H(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function Lr(e){return ci(e),JSON.stringify(e)}function ci(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(r>=56320&&r<=57343)throw new Error("invalid_jcs_unicode")}}import{spawn as ui}from"node:child_process";import{createHash as li,randomUUID as di}from"node:crypto";import{constants as fi}from"node:fs";import{access as mi,mkdir as fe,readdir as pi,realpath as ft,rm as hi,stat as gi}from"node:fs/promises";import _i from"node:http";import{tmpdir as Ti}from"node:os";import{isAbsolute as mt,join as tt,relative as Hr,resolve as pe}from"node:path";var he=1,yi="orcha.process-isolation/v1",ge="orcha.egress-proxy/v1",kt={read_only:0,workspace_write:1,workspace_network:2},me={read_only:["read_only","denied"],workspace_write:["workspace_write","denied"],workspace_network:["workspace_write","restricted"]},Ri=new Set([".env",".git-credentials",".netrc",".npmrc",".pypirc","credentials.json","secrets.json","id_rsa","id_ed25519"]);function K(e){if(!u(e))throw S("RUNTIME_SANDBOX_POLICY_REQUIRED","sandboxPolicy is required");let t=structuredClone(e),r=a(t.accessMode),n=a(t.accessModeCeiling);if(!(r in me)||!(n in me))throw S("RUNTIME_SANDBOX_POLICY_INVALID","unsupported runtime access mode");if(kt[r]>kt[n])throw S("RUNTIME_SANDBOX_POLICY_INVALID","access mode exceeds its ceiling");let[s,i]=me[r];if(t.filesystemMode!==s||t.networkMode!==i)throw S("RUNTIME_SANDBOX_POLICY_INVALID","runtime access profile does not match its mode");if(Number(t.policySchemaVersion)!==he||!Number.isInteger(Number(t.policyRevision))||Number(t.policyRevision)<1)throw S("RUNTIME_SANDBOX_POLICY_INVALID","unsupported sandbox policy schema or revision");for(let[c,l]of Object.entries({outsideWorkspaceAccess:"denied",hostAccess:"denied",hostEnvironmentAccess:"denied",dockerSocketAccess:"denied",environmentMode:"allowlist"}))if(t[c]!==l)throw S("RUNTIME_SANDBOX_POLICY_INVALID",`${c} cannot be relaxed`);let o=u(t.processIsolation)?t.processIsolation:{};if(o.mode!=="required"||o.backend==="direct")throw S("RUNTIME_SANDBOX_POLICY_INVALID","strong process isolation is required");if(Array.isArray(t.alwaysApprovedApprovalKeys)&&t.alwaysApprovedApprovalKeys.length)throw S("RUNTIME_SANDBOX_POLICY_INVALID","persistent runtime approvals are forbidden");return t}function $r(e,t){let r=K(e),n=K(t);return kt[n.accessMode]<kt[r.accessMode]}async function Br(e){if(!e.sandboxRequired)return{dispatchable:!0,enforced:!1,backend:"direct",daemonStatus:"not_required",daemonProtocolVersion:"",policySchemaVersions:[he],runtimePolicyUpdates:!1,workspaceSync:!1,egressProxy:!1,reason:"external_runtime_sandbox_not_required"};let t=await jr(e.sandboxBrokerCommand,process.env.PATH||"");if(!t)throw S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let r=await Oi(t,C(e.sandboxBrokerArguments),e.sandboxProbeTimeoutMs);if(r.enforced!==!0||a(r.protocolVersion)!=="orcha.runtime-sandbox-broker/v1"||!["bubblewrap","broker"].includes(a(r.backend)))throw S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker did not report enforced isolation");let n=u(r.probes)?r.probes:{};for(let s of["emptyRoot","outsideWorkspaceDenied","hostFilesystemDenied","sensitiveFilesDenied","environmentAllowlist","dockerSocketDenied","networkNamespace","workspaceReadOnly","workspaceWrite","resourceLimits"])if(n[s]!==!0)throw S("RUNTIME_SANDBOX_UNAVAILABLE",`sandbox broker probe failed: ${s}`);return e.egressProxyRequired&&await Ci(e),{dispatchable:!0,enforced:!0,backend:a(r.backend),daemonStatus:"ok",daemonProtocolVersion:a(r.protocolVersion||"orcha.runtime-sandbox-broker/v1"),policySchemaVersions:[he],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:e.egressProxyRequired}}async function _e(e,t,r){let n=a(t.workspace||t.cwd),s=a(r),i=n||(t.allowRequestWorkspace===!0?s:"");if(!i||!mt(i))throw S("RUNTIME_WORKSPACE_NOT_CONFIGURED","runtime target must configure an absolute trusted workspace");let o=await ft(i);if(!(await gi(o)).isDirectory())throw S("RUNTIME_WORKSPACE_INVALID","runtime workspace is not a directory");if(!(e.trustedWorkspaceRoots.length?await Promise.all(e.trustedWorkspaceRoots.map(d=>ft(d))):[o]).some(d=>ye(d,o)))throw S("RUNTIME_WORKSPACE_OUTSIDE_TRUSTED_ROOT","runtime workspace is outside trusted roots");return o}async function qr({config:e,target:t,command:r,args:n,cwd:s,environment:i,runId:o,agentId:c,sessionId:l,sandboxPolicy:d}){if(!e.sandboxRequired)return{command:r,args:[...n],cwd:s,environment:{...process.env,...i},tempDirectory:"",isolation:{enforced:!1,backend:"development_direct"},cleanup:async()=>{}};let f=K(d),p=await _e(e,t,s),g=await ft(s);if(!ye(p,g))throw S("RUNTIME_WORKSPACE_CWD_INVALID","runtime cwd is outside its workspace");let m=await jr(e.sandboxBrokerCommand,process.env.PATH||"");if(!m)throw S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let y=`runtime-${li("sha256").update(String(o)).digest("hex").slice(0,32)}`,O=pe(e.sandboxTempRoot||tt(Ti(),"orcha-runtime-sandboxes"));await fe(O,{recursive:!0,mode:448});let N=tt(O,`${y}-${di()}`),_=tt(N,"home"),R=tt(N,"artifacts");await fe(_,{recursive:!0,mode:448}),await fe(R,{recursive:!0,mode:448});let E=f.networkMode==="restricted"?await xi(e,{runId:String(o),instanceId:y,policyRevision:Number(f.policyRevision),ttlMs:Math.min(T(f.maxRuntimeSeconds,900)*1e3,e.egressGrantMaxTtlMs),maxTransferBytes:T(f.maxNetworkBytes,64*1024*1024)}):null,A={PATH:a(i.PATH||process.env.PATH),LANG:a(i.LANG||process.env.LANG||"C.UTF-8"),HOME:"/tmp/home",TMPDIR:"/tmp",USER:"orcha",LOGNAME:"orcha",SHELL:"/bin/sh",ORCHA_AGENT_ID:String(c),ORCHA_SESSION_ID:String(l),ORCHA_RUN_ID:String(o),ORCHA_RUNTIME_ARTIFACT_DIR:"/tmp/artifacts",...Ei(t,i)};A.HOME="/tmp/home",A.TMPDIR="/tmp",A.ORCHA_RUNTIME_ARTIFACT_DIR="/tmp/artifacts";let W={schemaVersion:yi,runId:String(o),instanceId:y,workspace:p,cwd:g,filesystemMode:f.filesystemMode,networkMode:f.networkMode,environmentMode:"allowlist",deniedRelativePaths:await wi(p),temporaryDirectory:N,egressProxy:E,environment:A,resourceLimits:Ii(f),readOnlyToolchainRoots:await Si(e,t)},_t=!1,J=async()=>{if(!_t){_t=!0;try{E&&await Ai(e,E,{runId:String(o),instanceId:y})}finally{await hi(N,{recursive:!0,force:!0})}}};return{command:m,args:[...C(e.sandboxBrokerArguments),"--",r,...n],cwd:g,environment:{PATH:process.env.PATH||"",LANG:process.env.LANG||"C.UTF-8",ORCHA_PROCESS_ISOLATION_REQUEST:JSON.stringify(W)},tempDirectory:N,homeDirectory:_,artifactDirectory:R,pathMappings:[{runtimeRoot:"/tmp/artifacts",hostRoot:R},{runtimeRoot:"/tmp/home",hostRoot:_}],isolation:{enforced:!0,backend:"broker",instanceId:y,policyRevision:f.policyRevision},cleanup:J}}async function Si(e,t){let r=C(t.toolchainRoots||t.sandboxToolchainRoots);if(!r.length)return[];let n=await Promise.all(C(e.trustedToolchainRoots).map(i=>ft(i)));if(!n.length)throw S("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","target toolchain roots require ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS");let s=[];for(let i of r){if(!mt(i))throw S("RUNTIME_TOOLCHAIN_ROOT_INVALID","toolchain roots must be absolute");let o=await ft(i);if(!n.some(c=>ye(c,o)))throw S("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","toolchain root is outside trusted roots");s.push(o)}return[...new Set(s)]}function Ei(e,t){let r=u(e.env)?e.env:{},n={};for(let[s,i]of Object.entries(r))/^[A-Za-z_][A-Za-z0-9_]*$/.test(s)&&i!=null&&(n[s]=String(i));for(let s of["ORCHA_RUNTIME_PROMPT","ORCHA_RUNTIME_ARTIFACT_DIR"])t[s]!=null&&(n[s]=String(t[s]));return n}async function wi(e){let t=[],r=0,n=async s=>{let i;try{i=await pi(s,{withFileTypes:!0})}catch(o){if(s===e)throw o;return}for(let o of i){if(r+=1,r>1e4)throw S("RUNTIME_WORKSPACE_SCAN_LIMIT_EXCEEDED","workspace contains more than 10000 entries");let c=tt(s,o.name),l=Hr(e,c),d=o.name.toLowerCase();(Ri.has(d)||d.startsWith(".env."))&&t.push(l),o.isDirectory()&&!o.isSymbolicLink()&&await n(c)}};return await n(e),t.sort()}function Ii(e){return{maxCpuSeconds:Math.max(1,T(e.maxRuntimeSeconds,900)),maxMemoryBytes:T(e.maxMemoryBytes,2*1024*1024*1024),maxProcesses:T(e.maxProcesses,128),maxOpenFiles:T(e.maxOpenFiles,1024),maxFileBytes:T(e.maxFileBytes,64*1024*1024)}}async function Oi(e,t,r){return await new Promise((n,s)=>{let i=ui(e,[...t,"--probe"],{env:{PATH:process.env.PATH||"",LANG:"C.UTF-8"},stdio:["ignore","pipe","pipe"],windowsHide:!0}),o=[],c=[];i.stdout.on("data",d=>o.push(Buffer.from(d))),i.stderr.on("data",d=>c.push(Buffer.from(d)));let l=setTimeout(()=>i.kill("SIGKILL"),Math.max(1e3,r));i.once("error",s),i.once("close",d=>{if(clearTimeout(l),d!==0){s(S("RUNTIME_SANDBOX_UNAVAILABLE",Buffer.concat(c).toString("utf8").trim()||`sandbox probe exited with ${d}`));return}try{n(JSON.parse(Buffer.concat(o).toString("utf8")))}catch{s(S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox probe returned invalid JSON"))}})})}async function jr(e,t){let r=a(e);if(!r)return"";let n=mt(r)?[r]:String(t||"").split(":").filter(Boolean).map(s=>tt(s,r));for(let s of n)try{return await mi(s,fi.X_OK),s}catch{}return""}async function xi(e,t){if(!e.egressProxyRequired)throw S("RUNTIME_EGRESS_UNAVAILABLE","restricted network requires the Egress Proxy");let r=await Te(e,"POST","/v1/grants",{protocolVersion:ge,...t}),n={socketPath:e.egressProxySocket,grantId:a(r.grantId),credential:a(r.credential)};if(!n.grantId||!n.credential)throw S("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy returned an invalid grant");return n}async function Ai(e,t,r){await Te(e,"POST",`/v1/grants/${encodeURIComponent(t.grantId)}/revoke`,{protocolVersion:ge,...r}).catch(()=>{})}async function Ci(e){let t=await Te(e,"GET","/health");if(t.status!=="ok"||t.proxy!=="orcha-egress-proxy"||t.protocolVersion!==ge)throw S("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy is unavailable or incompatible")}async function Te(e,t,r,n){if(!mt(e.egressProxySocket)||!e.egressProxyToken)throw S("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy socket and token are required");return await new Promise((s,i)=>{let o=_i.request({socketPath:e.egressProxySocket,path:r,method:t,headers:{Authorization:`Bearer ${e.egressProxyToken}`,Accept:"application/json",...n?{"Content-Type":"application/json"}:{}}},c=>{let l=[],d=0;c.on("data",f=>{d+=f.length,d>1048576?o.destroy(new Error("egress response is too large")):l.push(Buffer.from(f))}),c.once("end",()=>{try{let f=JSON.parse(Buffer.concat(l).toString("utf8")||"{}");(c.statusCode||500)>=400?i(S("RUNTIME_EGRESS_UNAVAILABLE",a(f.error)||"Egress Proxy rejected the request")):s(f)}catch(f){i(f)}})});o.once("error",i),o.setTimeout(3e3,()=>o.destroy(new Error("Egress Proxy request timed out"))),n?o.end(JSON.stringify(n)):o.end()})}function ye(e,t){let r=Hr(pe(e),pe(t));return r===""||!r.startsWith("..")&&!mt(r)}function S(e,t){return Object.assign(new Error(t),{code:e})}var Re=24e3,Se=8,Ee=50,we=6e3,bi=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),Mi=10*60*1e3,Ui=60*1e3,Pi=8,ki=30*60*1e3,Li=60*1e3,Di=1,vi=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions","runtimeMaxSessions"]),Fi=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function Hi(e){if(!u(e))return{};let t={};for(let r of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let n=a(e[r]);n&&(t[r]=n)}return t}function $i(e){return(Array.isArray(e)?e:[]).map(Hi).sort((t,r)=>{let n=H(t),s=H(r);return n<s?-1:n>s?1:0})}function Bi(e){return!u(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(r=>u(r)&&Array.isArray(r.toolNames)&&r.toolNames.some(n=>a(n)==="plugin_operation"))}function qi(e,t,r){let n=u(e?._meta)?e._meta:{};return{...u(e)?e:{},sessionId:t,update:u(e?.update)?e.update:{},_meta:{...n,orchaAgentId:r.agentId,runtimeSessionId:r.runtimeSessionId,bridgeUpdateId:Lt()}}}function U(e){return e==null||e===""?!1:typeof e=="string"?a(e)!=="":Array.isArray(e)?e.length>0:u(e)?Object.keys(e).length>0:!0}function Wr(e){let t=a(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return bi.has(t)}function q(e,t){let r=T(e,t);return Number.isFinite(r)&&r>0?r:t}function Ae(e){let t=T(e,null);return Number.isFinite(t)&&t>0?t:null}function pt(e,t=!1){if(typeof e=="boolean")return e;let r=a(e).toLowerCase();return["true","1","yes","y","on"].includes(r)?!0:["false","0","no","n","off"].includes(r)?!1:t}function B(e){return a(e?.type||"echo")}function ji(e){let t=B(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function Ce(e){if(u(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function Gi(e){let t=String(e||"");if(Fi.test(t))return!0;let r=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return r.endsWith("token")||r.endsWith("secret")||r.endsWith("password")||r.endsWith("apikey")||r.endsWith("privatekey")||r==="authorization"||r==="cookie"||r==="jwt"||r.includes("credential")}function Ne(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=we)return e;let r=e.length-we;return`${e.slice(0,we)}... [truncated ${r} characters]`}if(t>=Se)return Array.isArray(e)?`[array truncated at depth ${Se}, items=${e.length}]`:u(e)?`[object truncated at depth ${Se}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let r=e.slice(0,Ee).map(n=>Ne(n,t+1));return e.length>Ee&&r.push(`[truncated ${e.length-Ee} items]`),r}if(u(e)){let r={};for(let[n,s]of Object.entries(e))r[n]=Gi(n)?"[REDACTED]":Ne(s,t+1);return r}return String(e)}var Ki=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function Vi(e){if(!u(e))return e;let t={};for(let r of Ki)U(e[r])&&(t[r]=e[r]);return t}function zi(e){if(!u(e))return e;let t={...e};return u(t.renderedPayload)&&(t.renderedPayload=Vi(t.renderedPayload)),t}function Wi(e){let t=u(e)?e:{},r={};U(t.metadata)&&(r.metadata=zi(t.metadata));for(let[n,s]of Object.entries(t))vi.has(n)||n==="metadata"||U(s)&&(r[n]=s);return r}function Ji(e){let t=u(e)?e:{},r=u(t.metadata)?t.metadata:{},n=u(r.renderedPayload)?r.renderedPayload:{};return u(t.resultContract)?t.resultContract:u(n.resultContract)?n.resultContract:{}}function Jr(e){return a(Ji(e).kind).toLowerCase()==="decision"}function Gr(e){let t=u(e)?e:{},r=u(t.metadata)?t.metadata:{};return Ae(t.runtimeMaxSessions??r.runtimeMaxSessions)}function Xi(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:B(e)==="cli"}function Kr(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return pt(t,ji(e))}function Yi(e,t){let r=u(e?.metadata)?{...e.metadata}:{},n=u(r._runtimeBridge)?{...r._runtimeBridge}:{},s=Ce(n);return r._runtimeBridge={...n,promptKind:"dispatch",finalTextOnly:Xi(t),releaseAfterPrompt:s===void 0?Kr(t):pt(s,Kr(t)),requiresRuntimeResult:Jr(e)},r}function Qi(e){let t=Wi(e);if(!U(t))return"";let r=JSON.stringify(Ne(t),null,2);if(r.length<=Re)return r;let n=r.length-Re;return`${r.slice(0,Re)}
-... [truncated ${n} characters]`}function Ue(e){if(!u(e))return"";let t=u(e.update)?e.update:e,n=(u(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function be(e){if(!u(e))return"";let t=u(e.update)?e.update:e;return a(t.sessionUpdate)}function Xr(e){if(!Array.isArray(e))return"";let t=!1,r=[],n=[],s=[],i=()=>{r.length>0&&(n.push(r),r=[])};for(let c of e){let l=be(c),d=Ue(c);if(!l){d&&s.push(d);continue}if(t=!0,l==="agent_message_chunk"){d&&r.push(d);continue}(l==="agent_thought_chunk"||l==="user_message_chunk"||l==="tool_call"||l==="tool_call_update"||l==="plan")&&i()}if(i(),!t)return gt(s);let o=n[n.length-1]||[];return gt(o)}function Me(e){return Array.isArray(e)?e.map(Ue).filter(t=>t!==""):[]}function Zi(e){if(!u(e))return null;let t=u(e.update)?e.update:e;return a(t.sessionUpdate)!=="runtime_event"?null:u(t.event)?t.event:null}function to(e){if(!u(e))return"";let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);if(r==="event_msg"){if(n==="task_complete")return a(t.last_agent_message||t.message||t.output);if(n==="agent_message"){let s=a(t.phase||t.status||t.stage).toLowerCase();if(["final_answer","final","complete","completed","done"].includes(s))return a(t.message||t.text||t.content)}}return""}function eo(e){if(!Array.isArray(e))return"";for(let t=e.length-1;t>=0;t-=1){let r=to(Zi(e[t]));if(r)return r}return""}function gt(e){let t="";for(let r of e){let n=String(r||"");if(n)if(!t)t=n;else if(n.length>t.length&&n.startsWith(t))t=n;else{let s=kr(n)&&!/[\r\n]$/.test(t)?`
-`:"";t+=`${s}${n}`}}return t.trim()}function ro(e){let t=String(e||"").trim();if(!t)return"";let r=t.match(/(?:^|\n)#{1,3}\s+\S/);return!r||r.index===0?t:t.slice(r.index+(t[r.index]===`
-`?1:0)).trim()}function Vr(e){let t=String(e||"").trim();if(!t)return null;try{let r=JSON.parse(t);if(u(r)&&(Yr(r)||U(r._artifacts)||U(r.artifacts)||U(r._decision)||U(r._meta)))return r}catch{}return null}function ht(e){try{return ae(e)}catch{return null}}function Ie(...e){let t=null;for(let r of e)try{if(ae(r))return}catch(n){t||=n}if(t)throw t}function Oe(e){let t=String(e||"").trim();if(!t)return null;let r=ht(t);if(r)return r;let n=[...t.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)];for(let s=n.length-1;s>=0;s-=1){let i=Vr(n[s][1]);if(i)return i}if(!t.endsWith("}"))return null;for(let s=t.lastIndexOf("{");s>=0;s=t.lastIndexOf("{",s-1)){let i=Vr(t.slice(s));if(i)return i}return null}function no(e){let t=ht(Xr(e));if(t)return t;let n=Array.isArray(e)&&e.some(s=>be(s))?e.filter(s=>be(s)!=="user_message_chunk").map(Ue).filter(s=>s!==""):Me(e);for(let s=n.length-1;s>=0;s-=1){let i=ht(n[s]);if(i)return i}return ht(gt(n))}function Yr(e){if(!u(e))return!1;if(U(e.output))return!0;for(let t of["content","text","message","summary"])if(a(e[t]))return!0;return!!(Wr(e.status)||a(e.error)||a(e.errorMessage))}function F(e){let t=u(e)?{...e}:{};return(!Array.isArray(t._artifacts)||t._artifacts.length===0)&&Array.isArray(t.artifacts)&&t.artifacts.length>0&&(t._artifacts=t.artifacts),delete t.artifacts,t}function so(e){return u(e)?typeof(u(e._decision)?e._decision:u(e.decision)?e.decision:e).passed=="boolean":!1}function io(e){return u(e)?u(e._decision)&&typeof e._decision.passed=="boolean"?!0:so(e.output):!1}function xe(e,t,r){let n=u(e)?{...e}:{};if(!U(n.output)){for(let s of["summary","message","content","text"])if(a(n[s])){n.output=a(n[s]);break}}return!U(n.output)&&a(r)&&(n.output=a(r)),{...n,_meta:{...u(n._meta)?n._meta:{},runtimeOutputSource:t,requiredRuntimeResult:!0,finalMessagePreview:a(r).slice(0,1e3)}}}var oo=["dataUrl","dataURL","contentDataUrl","contentDataURL","contentBase64","base64","data"];function zr(e){if(!u(e))return"";let t=u(e.content)?e.content:{},r=u(e.metadata)?e.metadata:{};return a(e.fieldKey||e.field_key||t.fieldKey||r.fieldKey)}function ao(e,t){let r=u(e.content)?e.content:{},n=u(t.content)?t.content:{},s={...e,...t,content:{...r,...n},metadata:{...u(e.metadata)?e.metadata:{},...u(t.metadata)?t.metadata:{}}};for(let i of oo)U(e[i])&&(s[i]=e[i]),U(r[i])&&(s.content[i]=r[i]);return s}function co(e,t){let r=Array.isArray(e)?e.filter(u):[],n=Array.isArray(t)?t.filter(u):[];if(!r.length)return n;if(!n.length)return r;let s=[...r],i=new Map;for(let c=0;c<r.length;c+=1){let l=zr(r[c]),d=i.get(l)||[];d.push(c),i.set(l,d)}let o=new Map;for(let c of n){let l=zr(c),d=o.get(l)||0;o.set(l,d+1);let f=i.get(l)?.[d];f===void 0?s.push(c):s[f]=ao(s[f],c)}return s}function $(e,t,r){let n={...e,...t,_meta:{...u(e._meta)?e._meta:{},...u(t._meta)?t._meta:{},runtimeOutputSource:r}};return(Array.isArray(e._artifacts)||Array.isArray(t._artifacts))&&(n._artifacts=co(e._artifacts,t._artifacts)),n}function uo(e,t,r={}){let n=a(r.promptKind),s=r.requiresRuntimeResult===!0,i=s||n==="dispatch",o=F(e),c=typeof o.output=="string"?ht(o.output):null;if(c)return $(o,F(c),"result_block");let l=eo(t),d=l?Oe(l):null,f=i?no(t):null;if(Yr(o))return Wr(o.status)||a(o.error)||a(o.errorMessage)?o:n==="dispatch"&&d?$(o,F(d),"final_event"):n==="dispatch"&&f?$(o,F(f),"updates"):!s||io(o)?o:d?$(o,F(d),"final_event"):f?$(o,F(f),"updates"):(Ie(o.output,l,gt(Me(t))),xe(o,"result",o.output));if(d)return $(o,F(d),"final_event");if(f)return $(o,F(f),"updates");if(l)return s?(Ie(l,gt(Me(t))),xe(o,"final_event",l)):{...o,output:l,_meta:{...u(o._meta)?o._meta:{},runtimeOutputSource:"final_event"}};let p=Xr(t),g=Oe(p);if(g)return $(o,F(g),"updates");let m=ro(p);if(!m)return o;let y=Oe(m);return y?$(o,F(y),"updates"):s?(Ie(p,m),xe(o,"updates",m)):{...o,output:m,_meta:{...u(o._meta)?o._meta:{},runtimeOutputSource:"updates"}}}var Dt=class{constructor(t){this.config=t,this.targets=t.targets||{},this.agents=new Map,this.sessions=new Map,this.runtimeSessionIndex=new Map,this.pendingPermissions=new Map,this.operations=new Map,this.startedAt=ot(),this.sandboxCapabilities={dispatchable:t.sandboxRequired!==!0,enforced:!1,backend:t.sandboxRequired?"unavailable":"direct",daemonStatus:t.sandboxRequired?"pending":"not_required",policySchemaVersions:[1],runtimePolicyUpdates:t.sandboxRequired===!0,workspaceSync:!1,egressProxy:!1},this.cleanupTimer=null,this.startSessionCleanup()}async start(){try{this.sandboxCapabilities=await Br(this.config)}catch(t){this.sandboxCapabilities={...this.sandboxCapabilities,dispatchable:!1,enforced:!1,backend:"unavailable",daemonStatus:"unavailable",reason:a(t?.code||t?.message||t)||"sandbox_probe_failed"},h("error","runtime-bridge","runtime node sandbox probe failed; node will not accept work",{reason:this.sandboxCapabilities.reason})}return this.sandboxCapabilities}assertDispatchable(){if(this.config.sandboxRequired&&!(this.sandboxCapabilities.dispatchable===!0&&this.sandboxCapabilities.enforced===!0))throw Object.assign(new Error("runtime node strong sandbox is unavailable"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"})}operationIdentity(t,r,n){let s=u(t.goalContract)?de(t.goalContract):a(t.goalContractHash),i=Ni("sha256").update(H({prompt:Array.isArray(t.prompt)?t.prompt:[],mcpServers:$i(t.mcpServers)})).digest("hex");return{agentId:r,runId:a(t.runId),sessionId:n,targetCode:a(t.targetCode||t.framework),workspace:a(t.workspace),goalContractHash:s,requestHash:i}}assertOperationIdentity(t,r,n,s){let i=this.operationIdentity(r,n,s),o=Object.keys(t.identity).find(c=>t.identity[c]!==i[c]);if(o)throw Object.assign(new Error(`runtime operation correlation conflict: ${t.correlationId}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT",field:o})}createOperation(t,r,n,s){let i={correlationId:t,agentId:n,sessionId:s,identity:this.operationIdentity(r,n,s),sandboxPolicy:u(r.sandboxPolicy)?structuredClone(r.sandboxPolicy):null,status:"running",updates:[],listeners:new Set,waiters:[],response:null,error:null,createdAtMs:Date.now(),completedAtMs:null};return this.operations.set(t,i),i}async attachOperation(t,r={}){let n=()=>{if(r.onUpdate)for(let s of t.updates)r.onUpdate(s)};if(t.status==="completed")return n(),t.response;if(t.status==="failed")throw n(),t.error;r.onUpdate&&t.listeners.add(r.onUpdate);try{return n(),await new Promise((s,i)=>t.waiters.push({resolve:s,reject:i}))}finally{r.onUpdate&&t.listeners.delete(r.onUpdate)}}completeOperation(t,r){if(t.status==="running"){t.status="completed",t.response=r,t.completedAtMs=Date.now();for(let n of t.waiters.splice(0))n.resolve(r);t.listeners.clear()}}promptResponse(t,r,n,s,i){let o=u(t.metadata)?t.metadata:{},c=u(o._runtimeBridge)?o._runtimeBridge:{},l=uo(i,s,c),d=vr(t.goalContract,s,t.goalContractHash);return{sessionId:n,runtimeSessionId:r.runtimeSessionId,result:l,updates:s,...d?{verification:d}:{}}}failOperation(t,r){if(t.status!=="running")return;let n=r instanceof Error?r:Object.assign(new Error(String(r||"runtime operation failed")),{code:"RUNTIME_NODE_ERROR"});t.status="failed",t.error=n,t.completedAtMs=Date.now();for(let s of t.waiters.splice(0))s.reject(n);t.listeners.clear()}cleanupOperations(t=Date.now()){let r=q(this.config.operationTtlMs,ki);for(let[n,s]of this.operations)s.status!=="running"&&t-(s.completedAtMs||s.createdAtMs)>r&&this.operations.delete(n)}targetFor(t){let r=a(t)||this.config.defaultTargetCode,n=this.targets[r];if(!r||!u(n)){let s=new Error(`runtime target is not configured: ${r||"<empty>"}`);throw s.code="RUNTIME_TARGET_NOT_FOUND",s}return{code:r,target:n}}targetIdleTtlMs(t){let n=B(t)==="openclaw"?q(this.config.openClawSessionIdleTtlMs,Li):q(this.config.sessionIdleTtlMs,Mi);return q(t?.sessionIdleTtlMs??t?.idleTtlMs,n)}targetMaxSessions(t,r=null){let s=B(t)==="openclaw"?q(this.config.openClawMaxSessions,Di):q(this.config.maxSessionsPerTarget,Pi),i=q(t?.maxSessions,s),o=Ae(r);return o?Math.max(i,o):i}targetReleaseAfterPrompt(t,r={}){let n=B(t),s=u(r?._runtimeBridge)?r._runtimeBridge:{},i=Ce(s);return i!==void 0?pt(i,!1):pt(t?.releaseAfterPrompt??t?.disposeAfterPrompt,n==="openclaw")}promptReleaseAfterPrompt(t,r={}){if(this.config.sandboxRequired)return!0;let n=u(r?._runtimeBridge)?r._runtimeBridge:{},s=Ce(n);return s!==void 0?pt(s,t.releaseAfterPrompt):t.releaseAfterPrompt}startSessionCleanup(){let t=q(this.config.sessionCleanupIntervalMs,Ui);t<=0||(this.cleanupTimer=setInterval(()=>{this.cleanupExpiredSessions().catch(r=>{h("warn","runtime-bridge","runtime session cleanup failed",{error:String(r)})})},t),this.cleanupTimer.unref?.())}sessionCountForTarget(t){let r=0;for(let n of this.sessions.values())n.targetCode===t&&(r+=1);return r}sessionCountForAgentTarget(t,r){let n=0;for(let s of this.sessions.values())s.agentId===t&&s.targetCode===r&&(n+=1);return n}idleTargetSessions(t){return[...this.sessions.entries()].filter(([,r])=>r.targetCode===t&&!r.busy).sort((r,n)=>(r[1].lastUsedAtMs||0)-(n[1].lastUsedAtMs||0))}idleAgentTargetSessions(t,r){return[...this.sessions.entries()].filter(([,n])=>n.agentId===t&&n.targetCode===r&&!n.busy).sort((n,s)=>(n[1].lastUsedAtMs||0)-(s[1].lastUsedAtMs||0))}async closeSession(t,r="session_closed"){let n=this.sessions.get(t);if(!n)return!1;try{await n.runtime?.stop?.(r)}catch(s){h("warn","runtime-bridge","runtime session stop failed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,error:String(s)})}return this.sessions.delete(t),this.runtimeSessionIndex.delete(`${n.agentId}:${n.runtimeSessionId}`),h("info","runtime-bridge","runtime session closed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,reason:r}),!0}async closeAllSessions(t="bridge_shutdown"){for(let r of[...this.sessions.keys()])await this.closeSession(r,t)}async stop(t="bridge_stop"){this.cleanupTimer&&clearInterval(this.cleanupTimer),this.cleanupTimer=null,await this.closeAllSessions(t)}async cleanupExpiredSessions(t=Date.now()){for(let[r,n]of[...this.sessions.entries()])n.busy||t-(n.lastUsedAtMs||n.createdAtMs||t)>n.idleTtlMs&&await this.closeSession(r,"idle_timeout")}async reserveTargetSlot(t,r,n={}){let s=a(n.agentId),i=Ae(n.runtimeMaxSessions);if(s&&i)for(;this.sessionCountForAgentTarget(s,t)>=i;){let c=this.idleAgentTargetSessions(s,t);if(!c.length){let l=new Error(`runtime agent session limit reached: ${s}`);throw l.code="RUNTIME_AGENT_SESSION_LIMIT",l}await this.closeSession(c[0][0],"agent_session_limit")}let o=this.targetMaxSessions(r,i);for(;this.sessionCountForTarget(t)>=o;){let c=this.idleTargetSessions(t);if(!c.length){let l=new Error(`runtime target session limit reached: ${t}`);throw l.code="RUNTIME_TARGET_SESSION_LIMIT",l}await this.closeSession(c[0][0],"target_session_limit")}}async createAgent(t){let r=a(t.agentId);if(!r)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});let{code:n,target:s}=this.targetFor(t.targetCode||t.framework),i=this.agents.get(r);if(i&&i.targetCode!==n)throw Object.assign(new Error(`runtime agent target conflict: ${r}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});let o=this.config.sandboxRequired?await _e(this.config,s,t.workspace):a(t.workspace),c={agentId:r,targetCode:n,framework:a(t.framework||n),workspace:o,metadata:u(t.metadata)?t.metadata:{},createdAt:ot(),runtimeKind:B(s),runtimeMaxSessions:Gr(t)};return this.agents.set(r,c),{agent:c}}runtimeFor(t,r,n={}){let{target:s}=this.targetFor(t.targetCode),i=B(s),o={onPermissionRequest:l=>this.requestPermission(l)},c={sessionPromptTimeoutMs:this.config.sessionPromptTimeoutMs,sandboxRequired:this.config.sandboxRequired,...this.config.sandboxRequired?{prepareLaunch:l=>qr({config:this.config,target:s,...l,runId:n.runId,agentId:t.agentId,sessionId:r,sandboxPolicy:n.sandboxPolicy})}:{}};return i==="stdio-acp"||i==="acp"?new Q(t,s,o,c):i==="openclaw"?new It(t,s,r,o,c):i==="cli"?new Nt(t,s,c):new Rt(t)}async prompt(t,r={}){if(this.assertDispatchable(),this.config.sandboxRequired){let c=a(t.runId);if(!c)throw Object.assign(new Error("runId is required"),{code:"BAD_REQUEST"});t={...t,runId:c,sandboxPolicy:K(t.sandboxPolicy)}}let n=a(t.agentId),s=a(t.sessionId)||Lt(),i=a(t.correlationId);if(!n)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});if(this.cleanupOperations(),i){let c=this.operations.get(i);if(c)return this.assertOperationIdentity(c,t,n,s),this.attachOperation(c,r);if(t.attachOnly===!0)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"})}else if(t.attachOnly===!0)throw Object.assign(new Error("correlationId is required for attachOnly"),{code:"BAD_REQUEST"});let o=i?this.createOperation(i,t,n,s):null;if(o){let c=this.attachOperation(o,r);return(async()=>{try{await this._promptOwned(t,{},o,n,s)}catch(l){let d=o.status==="completed";this.failOperation(o,l),d&&h("warn","runtime-bridge","runtime cleanup failed after operation completion",{correlationId:o.correlationId,error:String(l)})}})(),await c}return await this._promptOwned(t,r,o,n,s)}async _promptOwned(t,r,n,s,i){let o=a(t.runId),c=this.config.sandboxRequired?K(n?.sandboxPolicy||t.sandboxPolicy):null,l=this.agents.get(s),d=this.targetFor(t.targetCode||t.framework||l?.targetCode);if(l&&l.targetCode!==d.code)throw Object.assign(new Error(`runtime agent target conflict: ${s}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});if(B(d.target)==="cli"&&Bi(t.goalContract))throw Object.assign(new Error("CLI runtimes do not support per-run dynamic MCP required by plugin_operation"),{code:"unsupported_dynamic_mcp"});let f=l||(await this.createAgent({agentId:s,targetCode:d.code,framework:t.framework,workspace:t.workspace,runtimeMaxSessions:t.runtimeMaxSessions,metadata:t.metadata})).agent,p=Gr(t);if(p&&(f.runtimeMaxSessions=p),!this.config.sandboxRequired){let _=a(t.workspace);_&&_!==f.workspace&&(f.workspace=_)}let g=`${s}:${i}`;await this.cleanupExpiredSessions();let m=this.sessions.get(g);if(m&&m.targetCode!==d.code)throw Object.assign(new Error(`runtime session target conflict: ${i}`),{code:"RUNTIME_SESSION_TARGET_CONFLICT"});if(m&&this.config.sandboxRequired&&m.runId!==o)throw Object.assign(new Error(`runtime session cannot be shared across runs: ${i}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});if(!m){let{code:_,target:R}=d;await this.reserveTargetSlot(_,R,{agentId:s,runtimeMaxSessions:f.runtimeMaxSessions});let E=this.runtimeFor(f,i,{runId:o,sandboxPolicy:c}),A=await E.sessionNew({cwd:f.workspace||process.cwd(),mcpServers:Array.isArray(t.mcpServers)?t.mcpServers:[],metadata:u(t.metadata)?t.metadata:{}}),W=Date.now();m={agentId:s,sessionId:i,runtime:E,targetCode:_,runtimeKind:B(R),runId:o,sandboxPolicy:c?structuredClone(c):null,runtimeSessionId:a(u(A)?A.sessionId:"")||i,idleTtlMs:this.targetIdleTtlMs(R),releaseAfterPrompt:this.config.sandboxRequired?!0:this.targetReleaseAfterPrompt(R,t.metadata),createdAtMs:W,lastUsedAtMs:W,busy:!1,createdAt:ot()},this.sessions.set(g,m),this.runtimeSessionIndex.set(`${s}:${m.runtimeSessionId}`,m)}if(m.busy){let _=new Error(`runtime session is already running: ${i}`);throw _.code="RUNTIME_SESSION_BUSY",_}m.busy=!0,m.operationCorrelationId=n?.correlationId||null,m.lastUsedAtMs=Date.now();let y=n?.updates||[],O=_=>{let R=qi(_,i,m);if(y.push(R),n)for(let E of n.listeners)try{E?.(R)}catch(A){h("warn","runtime-bridge","runtime operation update listener failed",{correlationId:n.correlationId,error:String(A)})}else r.onUpdate?.(R)},N=_=>{if(!(!n||n.status!=="running"||!u(_))){if(_.status==="failed"){let R=_.error;if(R instanceof Error){this.failOperation(n,R);return}let E=u(R)?R:{},A=Object.assign(new Error(a(E.message||_.message)||"runtime terminal failure"),{code:a(E.code||_.code)||"RUNTIME_TERMINAL_FAILED"});this.failOperation(n,A);return}this.completeOperation(n,this.promptResponse(t,m,i,y,u(_.result)?_.result:{stopReason:"end_turn"}))}};try{let _=Dr(t.goalContract),R=Array.isArray(t.prompt)?[...t.prompt]:[];_&&R.unshift({type:"text",text:_,metadata:{source:"orcha_goal_contract"}});let E=await m.runtime.sessionPrompt({sessionId:m.runtimeSessionId,prompt:R,metadata:u(t.metadata)?t.metadata:{}},O,N),A=this.promptResponse(t,m,i,y,E);return n&&this.completeOperation(n,A),A}finally{m.busy=!1,m.operationCorrelationId===n?.correlationId&&(m.operationCorrelationId=null),m.lastUsedAtMs=Date.now(),this.promptReleaseAfterPrompt(m,u(t.metadata)?t.metadata:{})&&await this.closeSession(g,"release_after_prompt")}}async updatePolicy(t){if(this.assertDispatchable(),!this.config.sandboxRequired)throw Object.assign(new Error("runtime sandbox policy updates require an enforced sandbox"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"});let r=a(t.agentId),n=a(t.runId),s=a(t.sessionId),i=a(t.correlationId);if(!r||!n||!s||!i)throw Object.assign(new Error("agentId, runId, sessionId and correlationId are required"),{code:"BAD_REQUEST"});let o=K(t.sandboxPolicy),c=this.operations.get(i);if(c&&(c.agentId!==r||c.sessionId!==s||c.identity.runId!==n))throw Object.assign(new Error(`runtime operation policy identity conflict: ${i}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let l=`${r}:${s}`,d=this.sessions.get(l);if(d&&d.runId!==n)throw Object.assign(new Error(`runtime session policy identity conflict: ${s}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});let f=d?.sandboxPolicy||c?.sandboxPolicy;if(!f)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"});let p=Number(f.policyRevision),g=Number(o.policyRevision);if(g<p)throw Object.assign(new Error("runtime sandbox policy revision is stale"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});if(g===p){if(H(f)!==H(o))throw Object.assign(new Error("runtime sandbox policy revision payload conflicts"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});return{updated:!1,idempotent:!0,policyRevision:p,accessMode:f.accessMode}}let m=$r(f,o);c&&(c.sandboxPolicy=structuredClone(o)),d&&(d.sandboxPolicy=structuredClone(o));let y=!1;return m&&d?.busy===!0&&(await d.runtime.sessionCancel({sessionId:d.runtimeSessionId}),y=await this.closeSession(l,"sandbox_policy_downgrade")),{updated:!0,policyRevision:g,accessMode:o.accessMode,activeCommandCancelled:y,deferredToNextLaunch:!m&&d?.busy===!0}}async cancel(t){let r=a(t.agentId),n=a(t.sessionId),s=a(t.correlationId);if(s){let c=this.operations.get(s);if(!c||c.status!=="running")return{cancelled:!1,correlationId:s,reason:"operation_not_running"};if(c.agentId!==r||c.sessionId!==n)throw Object.assign(new Error(`runtime operation cancellation identity conflict: ${s}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let l=this.sessions.get(`${r}:${n}`);return!l||l.busy!==!0||l.operationCorrelationId!==s?{cancelled:!1,correlationId:s,reason:"operation_not_running"}:(await l.runtime.sessionCancel({sessionId:l.runtimeSessionId}),await this.closeSession(`${r}:${n}`,"cancelled"),{cancelled:!0,correlationId:s})}let i=`${r}:${n}`,o=this.sessions.get(i);return o?(await o.runtime.sessionCancel({sessionId:o.runtimeSessionId}),await this.closeSession(i,"cancelled"),{cancelled:!0}):{cancelled:!1}}async dispatch(t,r={}){let n=a(t.agentId),s=a(t.taskId),i=a(t.executionId);if(!n||!s)throw Object.assign(new Error("agentId and taskId are required"),{status:400,code:"BAD_REQUEST"});let o=a(t.sessionId)||`dispatch-${i||s}`,c=a(t.instructions),l=Qi(t),d=Jr(t),{target:f}=this.targetFor(t.targetCode||t.framework),p=[{type:"text",text:["Task dispatch received.",`taskId: ${s}`,i?`executionId: ${i}`:"",c?`instructions: ${c}`:"",l?"orchaContext:":"",l,l?"Use orchaContext as the source of truth for upstream outputs, review reports, artifacts, and workflow metadata.":"","Follow the execution protocol in instructions exactly.","When embedding a generated artifact in final Markdown, use the Orcha artifact placeholder as the link target: orcha-artifact://<fieldKey>/<index>.","Example: use ![illustration](orcha-artifact://image/0) for the first generated image artifact.","Do not use local filesystem paths, file:// URLs, or data: URLs in final Markdown; Orcha replaces artifact placeholders after ingestion.",d?`For decision results, put the raw report between ${br} and ${Mr}.`:"",d?`Then put a JSON object containing _decision between ${Ur} and ${Pr}.`:"",d?"Do not JSON-escape the report. Keep output out of the CONTROL JSON, and put every protocol marker on its own line.":"","Return only the final answer required by that protocol.","Do not include process notes, logs, or explanations."].filter(Boolean).join(`
-`)}];return this.prompt({...t,agentId:n,sessionId:o,prompt:p,metadata:Yi(t,f)},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s}){let i=Lt(),c=this.runtimeSessionIndex.get(`${t.agentId}:${r}`)?.sessionId||r||Lt(),l={permissionId:i,agentId:t.agentId,sessionId:c,runtimeSessionId:r,request:u(n)?n:{},status:"pending",createdAt:ot()};return s?.({sessionId:r,update:{sessionUpdate:"permission_request",permission:l}}),await new Promise(d=>{let f=T(n?.timeoutMs,this.config.permissionRequestTimeoutMs),p=setTimeout(()=>{this.pendingPermissions.delete(i),d({permissionId:i,outcome:"denied",response:{reason:"permission request timed out"}})},f);this.pendingPermissions.set(i,{timer:p,resolve:d,permission:l})})}async respondPermission(t){let r=a(t.permissionId),n=this.pendingPermissions.get(r),s=a(t.outcome||"approved")||"approved";return n?(clearTimeout(n.timer),this.pendingPermissions.delete(r),n.resolve({permissionId:r,outcome:s,response:u(t.response)?t.response:{},userId:a(t.userId),metadata:u(t.metadata)?t.metadata:{}}),{accepted:!0,permissionId:r,outcome:s}):{accepted:!1,permissionId:r,outcome:s}}health(){return{status:this.config.sandboxRequired&&!this.sandboxCapabilities.dispatchable?"unavailable":"ok",bridgeVersion:Y,startedAt:this.startedAt,agents:[...this.agents.values()].map(t=>({agentId:t.agentId,targetCode:t.targetCode,framework:t.framework,runtimeKind:t.runtimeKind})),sessions:this.sessions.size,pendingPermissions:this.pendingPermissions.size,targets:Object.keys(this.targets),sandboxCapabilities:this.sandboxCapabilities}}};import lo from"node:http";import fo from"node:https";import{randomBytes as Qr}from"node:crypto";var et=1,V=3,mo=1e4,vt=class{constructor(t,r={}){this.url=t,this.readyState=0,this.socket=null,this.request=null,this.buffer=Buffer.alloc(0),this.listeners=new Map,this.connectTimeoutMs=po(r.connectTimeoutMs,mo),this.connectTimer=null,this.connect()}addEventListener(t,r){let n=this.listeners.get(t)||new Set;n.add(r),this.listeners.set(t,n)}emit(t,r={}){let n=this.listeners.get(t);if(n)for(let s of n)s(r)}connect(){let t=new URL(this.url),r=t.protocol==="wss:"?fo:lo,n=Qr(16).toString("base64"),s=r.request({protocol:t.protocol==="wss:"?"https:":"http:",hostname:t.hostname,port:t.port||(t.protocol==="wss:"?443:80),path:`${t.pathname}${t.search}`,method:"GET",headers:{Connection:"Upgrade",Upgrade:"websocket","Sec-WebSocket-Key":n,"Sec-WebSocket-Version":"13"}});this.request=s,this.startConnectTimer(s),s.on("upgrade",(i,o,c)=>{if(this.clearConnectTimer(),this.readyState===V){o.destroy();return}this.socket=o,this.readyState=et,o.on("data",l=>this.onData(l)),o.on("close",()=>this.onClose()),o.on("error",l=>{this.readyState!==V&&this.emit("error",{error:l,message:l.message,type:"error"}),this.onClose()}),c?.length&&this.onData(c),this.emit("open")}),s.on("response",i=>{this.clearConnectTimer(),this.emit("error",{message:`websocket upgrade failed: HTTP ${i.statusCode}`,type:"error"}),i.resume(),this.onClose()}),s.on("error",i=>{this.clearConnectTimer(),this.readyState!==V&&this.emit("error",{error:i,message:i.message,type:"error"}),this.onClose()}),s.end()}startConnectTimer(t){this.connectTimeoutMs<=0||(this.connectTimer=setTimeout(()=>{if(this.readyState===et||this.readyState===V)return;let r=`websocket connect timeout after ${this.connectTimeoutMs}ms`;this.emit("error",{message:r,type:"timeout"}),this.onClose(),t.destroy(new Error(r))},this.connectTimeoutMs),this.connectTimer.unref?.())}clearConnectTimer(){this.connectTimer&&(clearTimeout(this.connectTimer),this.connectTimer=null)}send(t){!this.socket||this.readyState!==et||this.socket.write(Pe(1,Buffer.from(String(t),"utf8")))}close(){if(this.readyState!==V){if(this.clearConnectTimer(),!this.socket){this.request?.destroy(),this.onClose();return}try{this.readyState===et&&this.socket.write(Pe(8,Buffer.alloc(0))),this.socket.end()}catch{this.socket.destroy()}this.onClose()}}onClose(){this.readyState!==V&&(this.clearConnectTimer(),this.readyState=V,this.request=null,this.emit("close"))}onData(t){for(this.buffer=Buffer.concat([this.buffer,t]);this.buffer.length>=2;){let r=this.buffer[0],n=this.buffer[1],s=r&15,i=(n&128)!==0,o=n&127,c=2;if(o===126){if(this.buffer.length<c+2)return;o=this.buffer.readUInt16BE(c),c+=2}else if(o===127){if(this.buffer.length<c+8)return;let f=this.buffer.readUInt32BE(c),p=this.buffer.readUInt32BE(c+4);o=f*2**32+p,c+=8}let l=c;if(i&&(c+=4),this.buffer.length<c+o)return;let d=this.buffer.subarray(c,c+o);if(i){let f=this.buffer.subarray(l,l+4);d=Buffer.from(d.map((p,g)=>p^f[g%4]))}this.buffer=this.buffer.subarray(c+o),s===1?this.emit("message",{data:d.toString("utf8")}):s===8?this.close():s===9&&this.socket?.write(Pe(10,d))}}};function po(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function Pe(e,t){let r=t.length,n=2;r>=126&&r<=65535?n+=2:r>65535&&(n+=8);let s=Qr(4),i=Buffer.alloc(n+4+r);i[0]=128|e;let o=2;r<126?i[1]=128|r:r<=65535?(i[1]=254,i.writeUInt16BE(r,o),o+=2):(i[1]=255,i.writeUInt32BE(Math.floor(r/2**32),o),i.writeUInt32BE(r>>>0,o+4),o+=8),s.copy(i,o),o+=4;for(let c=0;c<r;c+=1)i[o+c]=t[c]^s[c%4];return i}function ho(e){let t=new URL(e);if(t.protocol==="http:")t.protocol="ws:";else if(t.protocol==="https:")t.protocol="wss:";else if(t.protocol!=="ws:"&&t.protocol!=="wss:")throw new Error(`unsupported ORCHA_RUNTIME_ORCHA_URL protocol: ${t.protocol}`);return t.pathname=`${t.pathname.replace(/\/+$/,"")}/api/agent-runtime-bridge/ws`,t.search="",t.toString()}function ke(e,t=!0){return Object.entries(e||{}).map(([r,n])=>({targetCode:r,targetName:a(n?.name||n?.targetName||r),targetType:a(n?.type||"echo"),status:t?"available":"unavailable"}))}var Ft=class{constructor(t,r){this.config=t,this.bridge=r,this.ws=null,this.stopped=!1,this.connected=!1,this.reconnectTimer=null,this.heartbeatTimer=null}sandboxCapabilities(){return this.bridge.sandboxCapabilities||{dispatchable:this.config.sandboxRequired!==!0,enforced:!1,backend:"development_direct",daemonStatus:"development_only",policySchemaVersions:[1],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:!1}}start(){this.connect()}stop(){this.stopped=!0,this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=null,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.ws?.close()}connect(){if(this.stopped)return;let t=ho(this.config.orchaUrl),r=new vt(t,{connectTimeoutMs:this.config.connectTimeoutMs});this.ws=r,r.addEventListener("open",()=>{if(this.ws!==r||this.stopped){r.close();return}this.authenticate(r)}),r.addEventListener("message",n=>this.handleMessage(n.data,r)),r.addEventListener("close",()=>this.scheduleReconnect("close",r)),r.addEventListener("error",n=>{h("warn","orcha-client","runtime node websocket error",{error:String(n?.message||n?.type||n)})})}authenticate(t=this.ws){this.send({type:"runtime_node.authenticate",token:this.config.nodeToken,nodeId:this.config.nodeId,nodeName:this.config.nodeName,version:Y,protocolVersion:"orcha-runtime-node.v1",defaultTargetCode:this.config.defaultTargetCode,sandboxCapabilities:this.sandboxCapabilities(),targets:ke(this.config.targets,this.sandboxCapabilities().dispatchable===!0)},t)}scheduleReconnect(t,r=this.ws){r&&this.ws!==r||(this.connected=!1,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,r&&this.ws===r&&(this.ws=null),!this.stopped&&(this.reconnectTimer||(h("info","orcha-client","runtime node disconnected; reconnect scheduled",{reason:t,reconnectMs:this.config.reconnectMs}),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},this.config.reconnectMs))))}async handleMessage(t,r=this.ws){if(r&&this.ws!==r)return;let n;try{n=JSON.parse(String(t))}catch(s){h("warn","orcha-client","invalid Orcha websocket frame",{error:String(s)});return}if(u(n)){if(n.type==="runtime_node.authenticated"){if(r&&this.ws!==r)return;this.connected=!0,this.startHeartbeat(r),h("info","orcha-client","runtime node authenticated",{nodeId:this.config.nodeId,connectionId:n.connectionId});return}if(n.type==="orcha.runtime.request"){await this.handleRequest(n);return}n.type==="runtime_node.ping"&&this.send({type:"runtime_node.pong",ts:new Date().toISOString(),sandboxCapabilities:this.sandboxCapabilities(),targets:ke(this.config.targets,this.sandboxCapabilities().dispatchable===!0)})}}startHeartbeat(t){this.heartbeatTimer&&clearInterval(this.heartbeatTimer);let r=Math.max(1e3,Number(this.config.heartbeatIntervalMs||15e3)),n=()=>this.send({type:"runtime_node.heartbeat",ts:new Date().toISOString(),sandboxCapabilities:this.sandboxCapabilities(),targets:ke(this.config.targets,this.sandboxCapabilities().dispatchable===!0)},t);n(),this.heartbeatTimer=setInterval(n,r),this.heartbeatTimer.unref?.()}async handleRequest(t){let r=a(t.id),n=a(t.method),s=u(t.params)?t.params:{};try{let i=await this.invoke(n,s,r);this.send({type:"orcha.runtime.response",id:r,ok:!0,result:i})}catch(i){this.send({type:"orcha.runtime.response",id:r,ok:!1,error:{code:i.code||"RUNTIME_NODE_ERROR",message:i.message||String(i),...i.detail===void 0?{}:{detail:i.detail}}})}}async invoke(t,r,n){if(t==="health")return this.bridge.health();if(t==="agents/create")return this.bridge.createAgent(r);if(t==="agents/dispatch")return this.bridge.dispatch(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/prompt")return this.bridge.prompt(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/policy")return this.bridge.updatePolicy(r);if(t==="sessions/cancel")return this.bridge.cancel(r);if(t==="permissions/respond")return this.bridge.respondPermission(r);throw Object.assign(new Error(`unsupported Orcha runtime method: ${t}`),{code:"METHOD_NOT_FOUND"})}sendUpdate(t,r){this.send({type:"orcha.runtime.event",requestId:t,eventType:"runtime.update",payload:r})}send(t,r=this.ws){return!r||r!==this.ws||r.readyState!==et?!1:(r.send(JSON.stringify(t)),!0)}};import{existsSync as Zr,readFileSync as go}from"node:fs";import{dirname as _o,resolve as Ht}from"node:path";import{fileURLToPath as To}from"node:url";var yo=/^[A-Za-z_][A-Za-z0-9_]*$/;function tn(e=process.env,t=process.cwd()){let r=a(e.ORCHA_RUNTIME_ENV_FILE),n=r?Ht(t,r):Ht(t,".env");if(!Zr(n))return r&&h("warn","config","runtime env file not found",{path:n}),{loaded:!1,path:n,keys:[]};let s=[],i=go(n,"utf8");for(let o of i.split(/\r?\n/)){let c=Eo(o);if(!c)continue;let[l,d]=c;Object.prototype.hasOwnProperty.call(e,l)||(e[l]=d,s.push(l))}return h("info","config","runtime env file loaded",{path:n,keyCount:s.length}),{loaded:!0,path:n,keys:s}}function en(e=process.env){let t=a(e.ORCHA_RUNTIME_MODE||(e.ORCHA_RUNTIME_ORCHA_URL?"node":"server")),r=a(e.ORCHA_RUNTIME_BRIDGE_HOST||"127.0.0.1"),n=!1,s=_o(To(import.meta.url)),i=Ht(s,"sandbox","broker.js"),o=Ht(s,"orcha-runtime-sandbox-broker.js"),c=Zr(i)?i:o,l=a(e.ORCHA_RUNTIME_SANDBOX_BROKER_COMMAND);return{mode:t,host:r,port:T(e.ORCHA_RUNTIME_BRIDGE_PORT,5588),token:e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",orchaUrl:a(e.ORCHA_RUNTIME_ORCHA_URL),nodeToken:e.ORCHA_RUNTIME_NODE_TOKEN||e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",nodeId:a(e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"local-runtime-node"),nodeName:a(e.ORCHA_RUNTIME_NODE_NAME||e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"Local Runtime Node"),reconnectMs:T(e.ORCHA_RUNTIME_RECONNECT_MS,3e3),connectTimeoutMs:T(e.ORCHA_RUNTIME_CONNECT_TIMEOUT_MS||e.ORCHA_RUNTIME_WS_CONNECT_TIMEOUT_MS,1e4),defaultTargetCode:e.ORCHA_RUNTIME_DEFAULT_TARGET||"echo",requestLimitBytes:T(e.ORCHA_RUNTIME_REQUEST_LIMIT_BYTES,1048576),sessionPromptTimeoutMs:T(e.ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS,36e5),permissionRequestTimeoutMs:T(e.ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS,3e5),sessionIdleTtlMs:T(e.ORCHA_RUNTIME_SESSION_IDLE_TTL_MS,6e5),sessionCleanupIntervalMs:T(e.ORCHA_RUNTIME_SESSION_CLEANUP_INTERVAL_MS,6e4),maxSessionsPerTarget:T(e.ORCHA_RUNTIME_MAX_SESSIONS_PER_TARGET,8),openClawSessionIdleTtlMs:T(e.ORCHA_RUNTIME_OPENCLAW_SESSION_IDLE_TTL_MS,6e4),openClawMaxSessions:T(e.ORCHA_RUNTIME_OPENCLAW_MAX_SESSIONS,1),heartbeatIntervalMs:T(e.ORCHA_RUNTIME_HEARTBEAT_INTERVAL_MS,15e3),sandboxRequired:n,sandboxBrokerCommand:l||process.execPath,sandboxBrokerArguments:Le(e.ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS,"ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS",l?[]:[c]),sandboxProbeTimeoutMs:T(e.ORCHA_RUNTIME_SANDBOX_PROBE_TIMEOUT_MS,1e4),sandboxTempRoot:a(e.ORCHA_RUNTIME_SANDBOX_TEMP_ROOT),trustedWorkspaceRoots:Le(e.ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS,"ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS"),trustedToolchainRoots:Le(e.ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS,"ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS"),egressProxyRequired:So(e.ORCHA_RUNTIME_EGRESS_PROXY_REQUIRED,t==="node"),egressProxySocket:a(e.ORCHA_RUNTIME_EGRESS_PROXY_SOCKET),egressProxyToken:a(e.ORCHA_RUNTIME_EGRESS_PROXY_TOKEN),egressGrantMaxTtlMs:T(e.ORCHA_RUNTIME_EGRESS_GRANT_MAX_TTL_MS,9e5),targets:Ro(e.ORCHA_RUNTIME_TARGETS_JSON||"")}}function Ro(e){if(!a(e))return{};try{let t=JSON.parse(e);if(u(t))return t}catch(t){h("warn","config","invalid ORCHA_RUNTIME_TARGETS_JSON",{error:String(t)})}return{}}function So(e,t){let r=a(e).toLowerCase();if(!r)return t;if(["true","1","yes","on"].includes(r))return!0;if(["false","0","no","off"].includes(r))return!1;throw new Error(`invalid boolean configuration value: ${r}`)}function Le(e,t,r=[]){let n=a(e);if(!n)return[...r];let s;try{s=JSON.parse(n)}catch{throw new Error(`${t} must be a JSON string array`)}if(!Array.isArray(s)||s.some(i=>typeof i!="string"))throw new Error(`${t} must be a JSON string array`);return s.map(i=>i.trim()).filter(Boolean)}function Eo(e){let t=e.trim();if(!t||t.startsWith("#"))return null;let r=t.startsWith("export ")?t.slice(7).trimStart():t,n=r.indexOf("=");if(n<=0)return null;let s=r.slice(0,n).trim();if(!yo.test(s))return null;let i=wo(r.slice(n+1).trim());return[s,i]}function wo(e){if(!e)return"";let t=e[0];if((t==='"'||t==="'")&&e.endsWith(t)){let r=e.slice(1,-1);return t==='"'?Io(r):r}return Oo(e).trim()}function Io(e){return e.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","	").replaceAll('\\"','"').replaceAll("\\\\","\\")}function Oo(e){let t=!1,r=!1;for(let n=0;n<e.length;n+=1){let s=e[n],i=e[n-1];if(s==="'"&&!r)t=!t;else if(s==='"'&&!t&&i!=="\\")r=!r;else if(s==="#"&&!t&&!r&&/\s/.test(i||""))return e.slice(0,n)}return e}import{createServer as xo}from"node:http";function $t(e,t,r){let n=JSON.stringify(r);e.writeHead(t,{"content-type":"application/json; charset=utf-8","content-length":Buffer.byteLength(n)}),e.end(n)}function z(e={}){return{ok:!0,...e}}function De(e,t,r){return{ok:!1,error:{code:e,message:t,...r===void 0?{}:{detail:r}}}}async function rn(e,t){let r=[],n=0;for await(let i of e){if(n+=i.length,n>t)throw Object.assign(new Error("request body too large"),{status:413,code:"REQUEST_TOO_LARGE"});r.push(i)}if(r.length===0)return{};let s=Buffer.concat(r).toString("utf8");if(!s.trim())return{};try{let i=JSON.parse(s);if(!u(i))throw Object.assign(new Error("JSON body must be an object"),{status:400,code:"BAD_JSON"});return i}catch(i){throw i.status?i:Object.assign(new Error(`invalid JSON body: ${i.message}`),{status:400,code:"BAD_JSON"})}}function nn(e,t){if(!t)return;if((e.headers.authorization||"")!==`Bearer ${t}`)throw Object.assign(new Error("runtime bridge token is invalid"),{status:401,code:"UNAUTHORIZED"})}function sn(e,t){let r={"GET /health":async()=>z(t.health()),"POST /agents/create":async n=>z(await t.createAgent(n)),"POST /agents/dispatch":async n=>z(await t.dispatch(n)),"POST /sessions/prompt":async n=>z(await t.prompt(n)),"POST /sessions/cancel":async n=>z(await t.cancel(n)),"POST /permissions/respond":async n=>z(await t.respondPermission(n))};return xo(async(n,s)=>{let i=new URL(n.url||"/",`http://${n.headers.host||`${e.host}:${e.port}`}`),o=`${n.method||"GET"} ${i.pathname}`,c=r[o];if(!c){$t(s,404,De("NOT_FOUND",`No route for ${o}`));return}try{nn(n,e.token);let l=n.method==="GET"?{}:await rn(n,e.requestLimitBytes);$t(s,200,await c(l))}catch(l){let d=l.status||500,f=l.code||"BRIDGE_INTERNAL";$t(s,d,De(f,l.message||String(l),l.detail))}})}var ko=Po(import.meta.url),Lo=".orcha-runtime-bridge.pid",Do=".orcha-runtime-bridge.log",vo=3,Fo=36e5,{command:Ho,options:hn}=jo(process.argv.slice(2));Go(hn);tn();var $o=en();await Bo(Ho,$o,hn);async function Bo(e,t,r){switch(e){case"run":case"foreground":await an(t);return;case"start":if(r.foreground){await an(t);return}un();return;case"reload":case"restart":await ln({quiet:!0}),un();return;case"stop":await ln();return;case"status":qo();return;case"help":case"--help":case"-h":Wo();return;default:throw new Error(`Unknown command: ${e}`)}}async function an(e){Ko();let t=new Dt(e);if(await t.start(),e.mode==="server"){let n=sn(e,t);cn({bridge:t,server:n}),n.listen(e.port,e.host,()=>{h("info","runtime-bridge","Orcha runtime bridge HTTP server started",{host:e.host,port:e.port,targets:Object.keys(t.targets)})});return}if(!e.orchaUrl)throw new Error("ORCHA_RUNTIME_ORCHA_URL is required in runtime node mode");let r=new Ft(e,t);cn({bridge:t,client:r}),r.start(),h("info","runtime-bridge","Orcha runtime node started",{nodeId:e.nodeId,nodeName:e.nodeName,orchaUrl:e.orchaUrl,targets:Object.keys(t.targets)})}function cn({bridge:e,client:t,server:r}){let n=!1,s=i=>{if(n)return;n=!0;let o=Number(e?.sessions?.size||0)>0;h("info","runtime-bridge","runtime bridge shutting down",{signal:i});try{t?.stop?.()}catch(c){h("warn","runtime-bridge","runtime client stop failed",{error:String(c)})}Promise.resolve(e?.stop?.(`process_${String(i||"shutdown").toLowerCase()}`)).catch(c=>{h("warn","runtime-bridge","runtime bridge stop failed",{error:String(c)})}).finally(()=>{try{r?.close?.()}catch(c){h("warn","runtime-bridge","runtime server close failed",{error:String(c)})}}),setTimeout(()=>process.exit(0),o?8500:200)};process.once("SIGTERM",()=>s("SIGTERM")),process.once("SIGINT",()=>s("SIGINT"))}function un(){let e=Be(),t=gn(),r=qe(e);if(r&&rt(r)){console.log(JSON.stringify({status:"already_running",pid:r,pidFile:e,logFile:t}));return}r&&He(e),fn(e),fn(t),Fe(t);let n=bo(t,"a"),s={...process.env,ORCHA_RUNTIME_PID_FILE:e,ORCHA_RUNTIME_LOG_FILE:t},i=Ao(process.execPath,[ko,"run"],{cwd:process.cwd(),detached:!0,env:s,stdio:["ignore",n,n]});i.unref(),Co(n),pn(e,`${i.pid}
-`),console.log(JSON.stringify({status:"started",pid:i.pid,pidFile:e,logFile:t}))}async function ln({quiet:e=!1}={}){let t=Be(),r=qe(t);if(!r){e||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!rt(r)){He(t),e||console.log(JSON.stringify({status:"not_running",pid:r,pidFile:t}));return}process.kill(r,"SIGTERM"),!await dn(r,1e4)&&rt(r)&&(process.kill(r,"SIGKILL"),await dn(r,3e3)),He(t),e||console.log(JSON.stringify({status:"stopped",pid:r,pidFile:t}))}function qo(){let e=Be(),t=gn(),r=qe(e),n=!!(r&&rt(r));console.log(JSON.stringify({status:n?"running":"not_running",running:n,pid:n?r:null,pidFile:e,logFile:t}))}function jo(e){let t=[],r={};for(let s=0;s<e.length;s+=1){let i=e[s];i==="--daemon"?r.daemon=!0:i==="--foreground"?r.foreground=!0:i==="--env-file"?r.envFile=e[++s]:i==="--pid-file"?r.pidFile=e[++s]:i==="--log-file"?r.logFile=e[++s]:t.push(i)}return{command:t[0]||"run",options:r}}function Go(e){e.envFile&&(process.env.ORCHA_RUNTIME_ENV_FILE=e.envFile),e.pidFile&&(process.env.ORCHA_RUNTIME_PID_FILE=e.pidFile),e.logFile&&(process.env.ORCHA_RUNTIME_LOG_FILE=e.logFile)}function Be(){return $e(process.cwd(),process.env.ORCHA_RUNTIME_PID_FILE||Lo)}function gn(){return $e(process.cwd(),process.env.ORCHA_RUNTIME_LOG_FILE||Do)}function Ko(){let e=process.env.ORCHA_RUNTIME_LOG_FILE;if(!e)return;let t=_n();if(t<=0)return;let r=$e(process.cwd(),e);Fe(r,t);let n=zo();n<=0||setInterval(()=>Fe(r,t),n).unref()}function Fe(e,t=_n()){if(t<=0||!mn(e))return;let r=0,n="";try{if(r=on(e).size,r<=0)return;n=ve(e,"utf8")}catch(d){h("warn","runtime-bridge","runtime log cleanup skipped",{logFile:e,error:String(d)});return}let s=Date.now()-t*24*60*60*1e3,i=n.split(/\r?\n/),o=[],c=0;for(let d of i)d&&(Vo(d,s)?o.push(d):c+=1);if(c===0)return;let l="";try{on(e).size>r&&(l=ve(e,"utf8").slice(n.length));let f=[...o,...l.split(/\r?\n/).filter(Boolean)].join(`
-`);pn(e,f?`${f}
-`:""),h("info","runtime-bridge","runtime log cleanup completed",{logFile:e,retentionDays:t,removed:c})}catch(d){h("warn","runtime-bridge","runtime log cleanup failed",{logFile:e,error:String(d)})}}function Vo(e,t){try{let r=JSON.parse(e);if(!r||typeof r!="object")return!0;let n=typeof r.ts=="string"?Date.parse(r.ts):Number.NaN;return!Number.isFinite(n)||n>=t}catch{return!0}}function _n(){return Tn(process.env.ORCHA_RUNTIME_LOG_RETENTION_DAYS,vo)}function zo(){return Tn(process.env.ORCHA_RUNTIME_LOG_CLEANUP_INTERVAL_MS,Fo)}function Tn(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function qe(e){if(!mn(e))return null;let t=Number.parseInt(ve(e,"utf8").trim(),10);return Number.isInteger(t)&&t>0?t:null}function rt(e){try{return process.kill(e,0),!0}catch(t){return t?.code==="EPERM"}}async function dn(e,t){let r=Date.now();for(;Date.now()-r<t;){if(!rt(e))return!0;await new Promise(n=>setTimeout(n,100))}return!rt(e)}function fn(e){No(Uo(e),{recursive:!0})}function He(e){try{Mo(e,{force:!0})}catch{}}function Wo(){console.log(`Usage: orcha-runtime-bridge [command] [options]
+${s}`:s;Lr(t,r,n,d,s)&&(o=1,c=1)}return s&&i&&(t.finalTextSeen=!0),Ur(t,Mr(e,t.artifactOptions)),(Js(e)||Xs(e)||Ys(e)||i)&&n({sessionId:r,update:{sessionUpdate:"runtime_event",event:Pr(e)}}),{textCount:o,finalTextCount:c,thoughtCount:l}}function oe(e,t,r,n,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0,textCount:0,finalTextCount:0,thoughtCount:0};let i=e.artifacts.size,o=0,c=0,l=0,d=0,f=zs(t,r,s);if(f){let p=Math.min(t.processedLines.get(f.path)||0,f.events.length),_=e.artifacts.size;for(let m of f.events.slice(p)){let R=Zs(m,e,r,n);c+=R.textCount,l+=R.finalTextCount,d+=R.thoughtCount}t.processedLines.set(f.path,f.events.length),(f.events.length>p||e.artifacts.size>_)&&(o=1)}return{artifactCount:e.artifacts.size-i,transcriptCount:o,textCount:c,finalTextCount:l,thoughtCount:d}}function Qs(e,{remove:t=!0}={}){if(!e||!Or(e))return"";try{return Ar(e,"utf8").trim()}catch{return""}finally{t&&Ut(e)}}function Ut(e){if(e)try{ls(e)}catch{}}function ti(e,t){return{artifactCount:(e?.artifactCount||0)+(t?.artifactCount||0),transcriptCount:(e?.transcriptCount||0)+(t?.transcriptCount||0),textCount:(e?.textCount||0)+(t?.textCount||0),finalTextCount:(e?.finalTextCount||0)+(t?.finalTextCount||0),thoughtCount:(e?.thoughtCount||0)+(t?.thoughtCount||0)}}function ei(e){return new Promise(t=>setTimeout(t,e))}function ri(e,t,r,n){return n?(e.finalTextSeen=!0,e.emittedTexts.has(n)||(e.emittedTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}})),!0):!1}async function ni(e,t,r,n,s,i){let o=oe(e,t,r,n,Date.now()),c=()=>ri(e,r,n,Qs(s,{remove:!1}));if(c()||e.finalTextSeen)return Ut(s),o;let l=As(i);if(l<=0||!t&&!s)return Ut(s),o;let d=Date.now()+l,f=Math.min(kr(i),100);for(;!e.finalTextSeen&&Date.now()<d&&(await ei(Math.min(f,Math.max(0,d-Date.now()))),o=ti(o,oe(e,t,r,n,Date.now())),!c()););return Ut(s),o}var Lt=class{constructor(t,r,n={}){this.agent=t,this.target=r,this.options=n,this.active=new Map}async sessionNew(){return{sessionId:`cli-${this.agent.agentId}-${rt()}`}}async sessionPrompt(t,r,n){let s=Date.now(),i=a(this.target.command);if(!i)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let o=a(t.sessionId)||rt(),c=It(t.prompt),l=a(this.target.promptMode||"stdin"),d=this.buildArgs(l,c),f=tt(this.target,this.agent.workspace),p=typeof this.options.prepareLaunch=="function",m=Os(i,d,this.target)?p?`/tmp/orcha-runtime-last-message-${rt()}.txt`:F(Cr(),`orcha-runtime-last-message-${rt()}.txt`):"";m&&d.push("--output-last-message",m);let R={...u(this.target.env)?this.target.env:{},...l==="env"?{ORCHA_RUNTIME_PROMPT:c}:{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:o},O=p?await this.options.prepareLaunch({command:i,args:d,cwd:f,environment:R}):{command:i,args:d,cwd:f,environment:{...process.env,...R},cleanup:async()=>{}},N=p?Ls(O):ks(this.target,o),T=N.root,y=vs(this.target,T,O),E=xs(i,this.target),A={...this.target,targetCode:this.agent.targetCode,cwd:f,...p?{codexHome:F(O.homeDirectory,".codex")}:{}},U=E?$s(A,s):new Set,K=p&&m?F(O.tempDirectory,m.slice(5)):m,L=g(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,g(this.options.sessionPromptTimeoutMs,ms));p||(O.environment.ORCHA_RUNTIME_ARTIFACT_DIR=T);let w=Ir(O.command,O.args,{cwd:O.cwd,env:O.environment,stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(o,w),h("info","runtime.cli","runtime prompt started",{target:this.agent.targetCode,sessionId:o,pid:w.pid,timeoutMs:L,isolation:O.isolation});let Y="",at=a(this.target.outputMode||"text"),b={artifacts:new Map,emittedTexts:new Set,emittedThoughtTexts:new Set,value:"",artifactOptions:y,finalTextSeen:!1,finalTextOnly:Ms(t,this.target),emitThoughtChunks:Ns(t,this.target),terminalOutcome:null,terminalProtocol:Es(this.target),emitTerminal:null},Jt=E?Ps(A,c,s,U):null;return w.stdout.setEncoding("utf8"),w.stdout.on("data",Z=>this.handleStdout(Z,at,b,o,r)),w.stderr.setEncoding("utf8"),w.stderr.on("data",Z=>{Y+=Z,this.target.emitStderr===!0&&r({sessionId:o,update:{sessionUpdate:"runtime_stderr_chunk",content:{type:"text",text:Z}}})}),l==="stdin"?w.stdin.end(c):w.stdin.end(),await new Promise((Z,Xt)=>{let ct=!1,er=!1,St=null,ut=null,Yt=Jt&&Cs(this.target,t)?setInterval(()=>{try{oe(b,Jt,o,r)}catch(I){h("warn","runtime.cli","codex transcript stream poll failed",{target:this.agent.targetCode,sessionId:o,error:String(I?.message||I)})}},kr(this.target)):null;Yt?.unref?.();let rr=setTimeout(()=>{er=!0,h("warn","runtime.cli","runtime prompt timed out; terminating child",{target:this.agent.targetCode,sessionId:o,pid:w.pid,timeoutMs:L}),Pt(w,"SIGTERM"),St=setTimeout(()=>{h("warn","runtime.cli","runtime prompt force killing child",{target:this.agent.targetCode,sessionId:o,pid:w.pid}),Pt(w,"SIGKILL")},Nr),St.unref?.(),lt(Object.assign(new Error(`runtime CLI timed out after ${L}ms`),{code:"RUNTIME_CLI_TIMEOUT"}))},L);rr.unref?.();let nr=async()=>{clearTimeout(rr),ut&&clearTimeout(ut),Yt&&clearInterval(Yt),St&&!er&&clearTimeout(St),Ds(N,{target:this.agent.targetCode,sessionId:o}),this.active.delete(o),b.emitTerminal=null,await O.cleanup?.()},Un=I=>{ct||(ct=!0,nr().then(()=>Z(I),Xt))},lt=I=>{ct||(ct=!0,nr().then(()=>Xt(I),H=>{h("warn","runtime.cli","sandbox launch cleanup failed",{target:this.agent.targetCode,sessionId:o,error:String(H?.message||H)}),Xt(I)}))};b.emitTerminal=I=>{let H={...u(I.result)?I.result:{},_artifacts:[...b.artifacts.values()]};try{n?.({...I,result:H})}catch(V){h("warn","runtime.cli","runtime terminal listener failed",{target:this.agent.targetCode,sessionId:o,error:String(V?.message||V)})}let v=Math.max(0,g(this.target.terminalExitGraceMs,Rs));ut=setTimeout(()=>{ut=null,!(ct||this.active.get(o)!==w)&&(h("warn","runtime.cli","runtime stayed alive after terminal event; terminating child",{target:this.agent.targetCode,sessionId:o,pid:w.pid,terminalProtocol:b.terminalProtocol,graceMs:v}),ne(w))},v),ut.unref?.()},w.on("error",I=>{h("warn","runtime.cli","runtime child error",{target:this.agent.targetCode,sessionId:o,pid:w.pid,error:String(I?.message||I)}),lt(I)}),w.on("exit",(I,H)=>{(async()=>{at==="json-lines"&&b.value.trim()&&this.handleStdout(`
+`,at,b,o,r);let v=await ni(b,Jt,o,r,K,this.target);(v.artifactCount>0||v.textCount>0||v.thoughtCount>0)&&h("info","runtime.cli","codex transcript updates collected",{target:this.agent.targetCode,sessionId:o,artifactCount:v.artifactCount,textCount:v.textCount,finalTextCount:v.finalTextCount,thoughtCount:v.thoughtCount,transcriptCount:v.transcriptCount});let V=Y.trim();if(V&&h("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:o,stderr:V}),h("info","runtime.cli","runtime prompt finished",{target:this.agent.targetCode,sessionId:o,pid:w.pid,exitCode:I,signal:H,artifactCount:b.artifacts.size,finalTextSeen:b.finalTextSeen}),b.terminalOutcome?.status==="failed"){lt(b.terminalOutcome.error);return}if(I!==0&&b.terminalOutcome?.status!=="completed"){let Pn=Object.assign(new Error(`runtime CLI exited with code ${I??"unknown"}${H?` (${H})`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:I,signal:H});lt(Pn);return}Un({stopReason:"end_turn",exitCode:I,signal:H,_artifacts:[...b.artifacts.values()],...V?{stderr:V}:{}})})().catch(lt)})})}buildArgs(t,r){let n=C(this.target.args);return t==="args"?[...n,r]:n}handleStdout(t,r,n,s,i){if(r!=="json-lines"){i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:t}}});return}n.value+=t;let o=n.value.split(/\r?\n/);n.value=o.pop()||"";for(let c of o){let l=c.trim();if(l)try{let d=JSON.parse(l);Ur(n,Mr(d,n.artifactOptions)),i({sessionId:s,update:{sessionUpdate:"runtime_event",event:Pr(d)}});let f=br(d),p=ce(d);f&&n.emitThoughtChunks&&!p&&Is(d)?Dr(n,s,i,f):f&&Us(n,p)&&Lr(n,s,i,f),f&&p&&(n.finalTextSeen=!0);let _=ws(d,n.terminalProtocol);_&&!n.terminalOutcome&&(_.status==="failed"||n.finalTextSeen||n.artifacts.size>0)&&(n.terminalOutcome=_,n.emitTerminal?.(_))}catch{i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:`${c}
+`}}})}}}async sessionCancel(t){let r=a(t.sessionId),n=this.active.get(r);return n?(h("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),ne(n),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}stop(t="stop"){for(let[r,n]of this.active.entries())h("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),ne(n);this.active.clear()}};var le="ORCHA_RUNTIME_OUTPUT_START",de="ORCHA_RUNTIME_OUTPUT_END",fe="ORCHA_RUNTIME_CONTROL_START",me="ORCHA_RUNTIME_CONTROL_END",pe=le,he=de,ge=fe,_e=me,Te=[le,de,fe,me],si=new Set(["_artifacts","_decision","_meta"]),ii=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${Te.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),P=class extends Error{constructor(t,r,n){super(r),this.name="RuntimeResultProtocolError",this.code=t,this.detail={rawOutput:n}}};function qr(e){let t=typeof e=="string"?e.trimStart():"";return Te.some(r=>t.startsWith(r))}function Re(e){if(typeof e!="string")return null;let t=e,r=oi(t);if(![...r.values()].some(m=>m.length>0))return null;let n=[],s=[];for(let[m,R]of r)R.length===0?n.push(m):R.length>1&&s.push(m);if(n.length>0||s.length>0){let m=[];throw n.length>0&&m.push(`\u7F3A\u5C11 ${n.join(", ")}`),s.length>0&&m.push(`\u91CD\u590D ${s.join(", ")}`),new P("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${m.join("\uFF1B")}`,t)}let i=r.get(le)[0],o=r.get(de)[0],c=r.get(fe)[0],l=r.get(me)[0];if(!(i.end<=o.start&&o.end<=c.start&&c.end<=l.start))throw new P("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757",t);let d=ai(t.slice(i.end,o.start));if(!d.trim())throw new P("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let f=t.slice(c.end,l.start).trim();if(!f)throw new P("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let p;try{p=JSON.parse(f)}catch(m){throw new P("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(m?.message||m)}`,t)}if(!Br(p))throw new P("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61",t);let _=Object.keys(p).filter(m=>!si.has(m)).sort();if(_.length>0)throw new P("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${_.join(", ")}`,t);if("_artifacts"in p&&!Array.isArray(p._artifacts))throw new P("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4",t);for(let m of["_decision","_meta"])if(m in p&&!Br(p[m]))throw new P("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${m} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`,t);return{output:d,...p}}function oi(e){let t=new Map(Te.map(r=>[r,[]]));for(let r of e.matchAll(ii))t.get(r.groups.marker).push({start:r.index,end:r.index+r[0].length});return t}function ai(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",r=t?e.slice(t.length):e;return t&&r.endsWith(t)?r.slice(0,-t.length):r}function Br(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as ci}from"node:crypto";var ui="orcha.goal-contract/v1",li=new Set(["complete","completed","done","ok","passed","success","succeeded"]),di=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),fi=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function we(e){return ci("sha256").update(B(e)).digest("hex")}function Kr(e){if(!Vr(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
+`)}function Gr(e,t,r=""){if(!Vr(e))return e==null?null:{required:!0,status:"failed",outcome:a(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let n=we(e),s=e.verificationPlan.required===!0;if(a(r)&&a(r)!==n)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:n,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:n,checks:[]};let i=mi(t),o=e.verificationPlan.checks.map(l=>yi(l,i));return{required:!0,status:o.some(l=>l.status==="failed")?"failed":o.some(l=>l.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:n,checks:o}}function Vr(e){if(!u(e)||e.schemaVersion!==ui||!a(e.outcome))return!1;let t=e.verificationPlan;if(!u(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let r=new Set;for(let n of t.checks)if(!u(n)||!a(n.id)||r.has(a(n.id))||(r.add(a(n.id)),!Array.isArray(n.toolNames)||n.toolNames.length===0||n.toolNames.some(s=>!a(s)))||n.arguments!==void 0&&!u(n.arguments))return!1;return!0}function mi(e){let t=new Map,r=[];for(let n of Array.isArray(e)?e:[]){let s=u(n?.update)?n.update:{},i=a(s.sessionUpdate);if(i==="runtime_event"){pi(s.event,t,r);continue}if(i==="tool_call"){let o=vt(s)||`tool-${r.length+1}`,c=Dt(t,r,o),l=Se(s,s.name||s.toolName||s.kind);c.toolName=l.toolName,c.arguments=l.arguments,c.status=gt(s.status),c.evidence=Ht(s);continue}if(i==="tool_call_update"){let o=vt(s);if(!o)continue;let c=Dt(t,r,o),l=Se(s,s.name||s.toolName||s.kind);c.toolName||=l.toolName,Object.keys(c.arguments).length===0&&(c.arguments=l.arguments),c.status=gt(s.status),c.evidence.push(...Ht(s))}}return r}function pi(e,t,r){let n=u(e)&&u(e.payload)?e.payload:u(e)?e:{},s=a(n.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let c=vt(n)||`runtime-${r.length+1}`,l=Dt(t,r,c),d=Se(n,n.name||n.tool||s,s);l.toolName=d.toolName,l.arguments=d.arguments,l.status=gt(n.status),l.evidence.push(...Ht(n));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=vt(n);if(!i)return;let o=Dt(t,r,i);o.status=Ti(n,o.toolName),o.evidence.push(...Ht(n))}function Dt(e,t,r){let n=e.get(r);return n||(n={toolCallId:r,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(r,n),t.push(n)),n}function hi(e){let t=a(e).toLowerCase();return fi.get(t)||t}function Se(e,t,r=""){let n=gi(e),s=a(r)==="mcp_tool_call"||a(e?.kind).toLowerCase()==="mcp",i=u(e?._meta)?e._meta:{},o=a(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let c=a(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...n,...c?{operationCode:c}:{}}}}return{toolName:hi(t),arguments:n}}function vt(e){return u(e)?a(e.call_id||e.callId||e.toolCallId||e.id):""}function gi(e){if(!u(e))return{};for(let r of["arguments","args","rawInput","input","params","parameters"]){let n=_i(e[r]);if(n)return n}let t={};for(let r of["cmd","command","cwd","operationCode","path","query","url"])e[r]!==void 0&&(t[r]=e[r]);return t}function _i(e){if(u(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return u(t)?t:null}catch{return null}}function Ti(e,t){if(!u(e))return"unknown";let r=Ft(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return r.includes("failed")?"failed":r.includes("success")?"success":"unknown"}function Ft(e,t=0,r={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return Ri(e,t,r);if(Array.isArray(e))return e.flatMap(o=>Ft(o,t+1,r));if(!u(e))return[];let n=[];typeof e.isError=="boolean"&&n.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&n.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&n.push(e.success?"success":"failed");let s=gt(e.status);s!=="unknown"&&n.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&n.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&n.push(...Ft(e[o],t+1,r));return n}function Ri(e,t,r){let n=e.trim();if(!n)return[];try{return Ft(JSON.parse(n),t+1,r)}catch{}if(r.parseCliExitCode!==!0)return[];let s=[];for(let i of n.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function gt(e){let t=a(e).toLowerCase();return li.has(t)?"success":di.has(t)?"failed":"unknown"}function Ht(e){if(!u(e))return[];let t=u(e.output)?e.output:{},r=[e.verificationEvidence,u(e.verification)?e.verification.evidence:null,t.verificationEvidence,u(t.verification)?t.verification.evidence:null],n=[];for(let s of r)for(let i of Array.isArray(s)?s:s?[s]:[])!u(i)||!a(i.id)||n.push({id:a(i.id),status:gt(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...a(i.message)?{message:a(i.message)}:{}});return n}function yi(e,t){let r=t.filter(o=>e.toolNames.includes(o.toolName)&&Ee(e.arguments||{},o.arguments)),n=a(e.evidenceId),s=r.find(o=>o.status==="success"&&(!n||o.evidence.some(c=>c.id===n&&c.status==="success")));if(s)return ye(e,"passed",s,"Runtime tool evidence passed.");let i=r.find(o=>o.status==="failed"||n&&o.evidence.some(c=>c.id===n&&c.status==="failed"));return i?ye(e,"failed",i,"Runtime tool evidence failed."):ye(e,"missing",r.at(-1),n?"Required evidence is missing.":"Required tool execution is missing.")}function ye(e,t,r,n){return{id:e.id,status:t,message:n,...a(e.description)?{description:a(e.description)}:{},toolNames:e.toolNames,...u(e.arguments)?{arguments:e.arguments}:{},...a(e.evidenceId)?{evidenceId:a(e.evidenceId)}:{},...r?.toolCallId?{toolCallId:r.toolCallId}:{}}}function Ee(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((r,n)=>Ee(r,t[n])):u(e)?u(t)?Object.entries(e).every(([r,n])=>Object.hasOwn(t,r)&&Ee(n,t[r])):!1:Object.is(e,t)}function B(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return jr(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,r)=>{if(!Object.hasOwn(e,r))throw new Error("invalid_jcs_json_value");return B(e[r])}).join(",")}]`;if(u(e))return`{${Object.keys(e).sort().map(t=>`${jr(t)}:${B(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function jr(e){return Si(e),JSON.stringify(e)}function Si(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(r>=56320&&r<=57343)throw new Error("invalid_jcs_unicode")}}import{spawn as Ei}from"node:child_process";import{createHash as wi,randomUUID as Ii}from"node:crypto";import{constants as Oi}from"node:fs";import{access as xi,mkdir as Ie,readdir as Ai,realpath as _t,rm as Ci,stat as Ni}from"node:fs/promises";import bi from"node:http";import{tmpdir as Mi}from"node:os";import{isAbsolute as Tt,join as nt,relative as zr,resolve as xe}from"node:path";var Ae=1,Ui="orcha.process-isolation/v1",Ce="orcha.egress-proxy/v1",Pi="--disable-wasm-trap-handler",$t={read_only:0,workspace_write:1,workspace_network:2},Oe={read_only:["read_only","denied"],workspace_write:["workspace_write","denied"],workspace_network:["workspace_write","restricted"]},ki=new Set([".env",".git-credentials",".netrc",".npmrc",".pypirc","credentials.json","secrets.json","id_rsa","id_ed25519"]);function W(e){if(!u(e))throw S("RUNTIME_SANDBOX_POLICY_REQUIRED","sandboxPolicy is required");let t=structuredClone(e),r=a(t.accessMode),n=a(t.accessModeCeiling);if(!(r in Oe)||!(n in Oe))throw S("RUNTIME_SANDBOX_POLICY_INVALID","unsupported runtime access mode");if($t[r]>$t[n])throw S("RUNTIME_SANDBOX_POLICY_INVALID","access mode exceeds its ceiling");let[s,i]=Oe[r];if(t.filesystemMode!==s||t.networkMode!==i)throw S("RUNTIME_SANDBOX_POLICY_INVALID","runtime access profile does not match its mode");if(Number(t.policySchemaVersion)!==Ae||!Number.isInteger(Number(t.policyRevision))||Number(t.policyRevision)<1)throw S("RUNTIME_SANDBOX_POLICY_INVALID","unsupported sandbox policy schema or revision");for(let[c,l]of Object.entries({outsideWorkspaceAccess:"denied",hostAccess:"denied",hostEnvironmentAccess:"denied",dockerSocketAccess:"denied",environmentMode:"allowlist"}))if(t[c]!==l)throw S("RUNTIME_SANDBOX_POLICY_INVALID",`${c} cannot be relaxed`);let o=u(t.processIsolation)?t.processIsolation:{};if(o.mode!=="required"||o.backend==="direct")throw S("RUNTIME_SANDBOX_POLICY_INVALID","strong process isolation is required");if(Array.isArray(t.alwaysApprovedApprovalKeys)&&t.alwaysApprovedApprovalKeys.length)throw S("RUNTIME_SANDBOX_POLICY_INVALID","persistent runtime approvals are forbidden");return t}function Wr(e,t){let r=W(e),n=W(t);return $t[n.accessMode]<$t[r.accessMode]}async function Jr(e){if(!e.sandboxRequired)return{dispatchable:!0,enforced:!1,backend:"direct",daemonStatus:"not_required",daemonProtocolVersion:"",policySchemaVersions:[Ae],runtimePolicyUpdates:!1,workspaceSync:!1,egressProxy:!1,reason:"external_runtime_sandbox_not_required"};let t=await Yr(e.sandboxBrokerCommand,process.env.PATH||"");if(!t)throw S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let r=await Hi(t,C(e.sandboxBrokerArguments),e.sandboxProbeTimeoutMs);if(r.enforced!==!0||a(r.protocolVersion)!=="orcha.runtime-sandbox-broker/v1"||!["bubblewrap","broker"].includes(a(r.backend)))throw S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker did not report enforced isolation");let n=u(r.probes)?r.probes:{};for(let s of["emptyRoot","outsideWorkspaceDenied","hostFilesystemDenied","sensitiveFilesDenied","environmentAllowlist","dockerSocketDenied","networkNamespace","workspaceReadOnly","workspaceWrite","resourceLimits"])if(n[s]!==!0)throw S("RUNTIME_SANDBOX_UNAVAILABLE",`sandbox broker probe failed: ${s}`);return e.egressProxyRequired&&await qi(e),{dispatchable:!0,enforced:!0,backend:a(r.backend),daemonStatus:"ok",daemonProtocolVersion:a(r.protocolVersion||"orcha.runtime-sandbox-broker/v1"),policySchemaVersions:[Ae],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:e.egressProxyRequired}}async function Ne(e,t,r){let n=a(t.workspace||t.cwd),s=a(r),i=n||(t.allowRequestWorkspace===!0?s:"");if(!i||!Tt(i))throw S("RUNTIME_WORKSPACE_NOT_CONFIGURED","runtime target must configure an absolute trusted workspace");let o=await _t(i);if(!(await Ni(o)).isDirectory())throw S("RUNTIME_WORKSPACE_INVALID","runtime workspace is not a directory");if(!(e.trustedWorkspaceRoots.length?await Promise.all(e.trustedWorkspaceRoots.map(d=>_t(d))):[o]).some(d=>Me(d,o)))throw S("RUNTIME_WORKSPACE_OUTSIDE_TRUSTED_ROOT","runtime workspace is outside trusted roots");return o}async function Xr({config:e,target:t,command:r,args:n,cwd:s,environment:i,runId:o,agentId:c,sessionId:l,sandboxPolicy:d}){if(!e.sandboxRequired)return{command:r,args:[...n],cwd:s,environment:{...process.env,...i},tempDirectory:"",isolation:{enforced:!1,backend:"development_direct"},cleanup:async()=>{}};let f=W(d),p=await Ne(e,t,s),_=await _t(s);if(!Me(p,_))throw S("RUNTIME_WORKSPACE_CWD_INVALID","runtime cwd is outside its workspace");let m=await Yr(e.sandboxBrokerCommand,process.env.PATH||"");if(!m)throw S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let R=`runtime-${wi("sha256").update(String(o)).digest("hex").slice(0,32)}`,O=xe(e.sandboxTempRoot||nt(Mi(),"orcha-runtime-sandboxes"));await Ie(O,{recursive:!0,mode:448});let N=nt(O,`${R}-${Ii()}`),T=nt(N,"home"),y=nt(N,"artifacts");await Ie(T,{recursive:!0,mode:448}),await Ie(y,{recursive:!0,mode:448});let E=f.networkMode==="restricted"?await $i(e,{runId:String(o),instanceId:R,policyRevision:Number(f.policyRevision),ttlMs:Math.min(g(f.maxRuntimeSeconds,900)*1e3,e.egressGrantMaxTtlMs),maxTransferBytes:g(f.maxNetworkBytes,64*1024*1024)}):null,A={PATH:a(i.PATH||process.env.PATH),LANG:a(i.LANG||process.env.LANG||"C.UTF-8"),HOME:"/tmp/home",TMPDIR:"/tmp",USER:"orcha",LOGNAME:"orcha",SHELL:"/bin/sh",ORCHA_AGENT_ID:String(c),ORCHA_SESSION_ID:String(l),ORCHA_RUN_ID:String(o),ORCHA_RUNTIME_ARTIFACT_DIR:"/tmp/artifacts",...Di(t,i)};A.HOME="/tmp/home",A.TMPDIR="/tmp",A.ORCHA_RUNTIME_ARTIFACT_DIR="/tmp/artifacts",A.NODE_OPTIONS=Pi;let U={schemaVersion:Ui,runId:String(o),instanceId:R,workspace:p,cwd:_,filesystemMode:f.filesystemMode,networkMode:f.networkMode,environmentMode:"allowlist",deniedRelativePaths:await vi(p),temporaryDirectory:N,egressProxy:E,environment:A,resourceLimits:Fi(f),readOnlyToolchainRoots:await Li(e,t)},K=!1,L=async()=>{if(!K){K=!0;try{E&&await Bi(e,E,{runId:String(o),instanceId:R})}finally{await Ci(N,{recursive:!0,force:!0})}}};return{command:m,args:[...C(e.sandboxBrokerArguments),"--",r,...n],cwd:_,environment:{PATH:process.env.PATH||"",LANG:process.env.LANG||"C.UTF-8",ORCHA_PROCESS_ISOLATION_REQUEST:JSON.stringify(U)},tempDirectory:N,homeDirectory:T,artifactDirectory:y,pathMappings:[{runtimeRoot:"/tmp/artifacts",hostRoot:y},{runtimeRoot:"/tmp/home",hostRoot:T}],isolation:{enforced:!0,backend:"broker",instanceId:R,policyRevision:f.policyRevision},cleanup:L}}async function Li(e,t){let r=C(t.toolchainRoots||t.sandboxToolchainRoots);if(!r.length)return[];let n=await Promise.all(C(e.trustedToolchainRoots).map(i=>_t(i)));if(!n.length)throw S("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","target toolchain roots require ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS");let s=[];for(let i of r){if(!Tt(i))throw S("RUNTIME_TOOLCHAIN_ROOT_INVALID","toolchain roots must be absolute");let o=await _t(i);if(!n.some(c=>Me(c,o)))throw S("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","toolchain root is outside trusted roots");s.push(o)}return[...new Set(s)]}function Di(e,t){let r=u(e.env)?e.env:{},n={};for(let[s,i]of Object.entries(r))/^[A-Za-z_][A-Za-z0-9_]*$/.test(s)&&i!=null&&(n[s]=String(i));for(let s of["ORCHA_RUNTIME_PROMPT","ORCHA_RUNTIME_ARTIFACT_DIR"])t[s]!=null&&(n[s]=String(t[s]));return n}async function vi(e){let t=[],r=0,n=async s=>{let i;try{i=await Ai(s,{withFileTypes:!0})}catch(o){if(s===e)throw o;return}for(let o of i){if(r+=1,r>1e4)throw S("RUNTIME_WORKSPACE_SCAN_LIMIT_EXCEEDED","workspace contains more than 10000 entries");let c=nt(s,o.name),l=zr(e,c),d=o.name.toLowerCase();(ki.has(d)||d.startsWith(".env."))&&t.push(l),o.isDirectory()&&!o.isSymbolicLink()&&await n(c)}};return await n(e),t.sort()}function Fi(e){return{maxCpuSeconds:Math.max(1,g(e.maxRuntimeSeconds,900)),maxMemoryBytes:g(e.maxMemoryBytes,2*1024*1024*1024),maxProcesses:g(e.maxProcesses,128),maxOpenFiles:g(e.maxOpenFiles,1024),maxFileBytes:g(e.maxFileBytes,64*1024*1024)}}async function Hi(e,t,r){return await new Promise((n,s)=>{let i=Ei(e,[...t,"--probe"],{env:{PATH:process.env.PATH||"",LANG:"C.UTF-8"},stdio:["ignore","pipe","pipe"],windowsHide:!0}),o=[],c=[];i.stdout.on("data",d=>o.push(Buffer.from(d))),i.stderr.on("data",d=>c.push(Buffer.from(d)));let l=setTimeout(()=>i.kill("SIGKILL"),Math.max(1e3,r));i.once("error",s),i.once("close",d=>{if(clearTimeout(l),d!==0){s(S("RUNTIME_SANDBOX_UNAVAILABLE",Buffer.concat(c).toString("utf8").trim()||`sandbox probe exited with ${d}`));return}try{n(JSON.parse(Buffer.concat(o).toString("utf8")))}catch{s(S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox probe returned invalid JSON"))}})})}async function Yr(e,t){let r=a(e);if(!r)return"";let n=Tt(r)?[r]:String(t||"").split(":").filter(Boolean).map(s=>nt(s,r));for(let s of n)try{return await xi(s,Oi.X_OK),s}catch{}return""}async function $i(e,t){if(!e.egressProxyRequired)throw S("RUNTIME_EGRESS_UNAVAILABLE","restricted network requires the Egress Proxy");let r=await be(e,"POST","/v1/grants",{protocolVersion:Ce,...t}),n={socketPath:e.egressProxySocket,grantId:a(r.grantId),credential:a(r.credential)};if(!n.grantId||!n.credential)throw S("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy returned an invalid grant");return n}async function Bi(e,t,r){await be(e,"POST",`/v1/grants/${encodeURIComponent(t.grantId)}/revoke`,{protocolVersion:Ce,...r}).catch(()=>{})}async function qi(e){let t=await be(e,"GET","/health");if(t.status!=="ok"||t.proxy!=="orcha-egress-proxy"||t.protocolVersion!==Ce)throw S("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy is unavailable or incompatible")}async function be(e,t,r,n){if(!Tt(e.egressProxySocket)||!e.egressProxyToken)throw S("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy socket and token are required");return await new Promise((s,i)=>{let o=bi.request({socketPath:e.egressProxySocket,path:r,method:t,headers:{Authorization:`Bearer ${e.egressProxyToken}`,Accept:"application/json",...n?{"Content-Type":"application/json"}:{}}},c=>{let l=[],d=0;c.on("data",f=>{d+=f.length,d>1048576?o.destroy(new Error("egress response is too large")):l.push(Buffer.from(f))}),c.once("end",()=>{try{let f=JSON.parse(Buffer.concat(l).toString("utf8")||"{}");(c.statusCode||500)>=400?i(S("RUNTIME_EGRESS_UNAVAILABLE",a(f.error)||"Egress Proxy rejected the request")):s(f)}catch(f){i(f)}})});o.once("error",i),o.setTimeout(3e3,()=>o.destroy(new Error("Egress Proxy request timed out"))),n?o.end(JSON.stringify(n)):o.end()})}function Me(e,t){let r=zr(xe(e),xe(t));return r===""||!r.startsWith("..")&&!Tt(r)}function S(e,t){return Object.assign(new Error(t),{code:e})}var Ue=24e3,Pe=8,ke=50,Le=6e3,Ki=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),Gi=10*60*1e3,Vi=60*1e3,zi=8,Wi=30*60*1e3,Ji=60*1e3,Xi=1,rn=2400,Yi=new Set(["max_tokens","max_output_tokens","length"]),Zi=new Set(["agent_message_chunk","tool_call","tool_call_update"]),Qi=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions","runtimeMaxSessions"]),to=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function eo(e){if(!u(e))return{};let t={};for(let r of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let n=a(e[r]);n&&(t[r]=n)}return t}function ro(e){return(Array.isArray(e)?e:[]).map(eo).sort((t,r)=>{let n=B(t),s=B(r);return n<s?-1:n>s?1:0})}function no(e){return!u(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(r=>u(r)&&Array.isArray(r.toolNames)&&r.toolNames.some(n=>a(n)==="plugin_operation"))}function so(e,t,r){let n=u(e?._meta)?e._meta:{};return{...u(e)?e:{},sessionId:t,update:u(e?.update)?e.update:{},_meta:{...n,orchaAgentId:r.agentId,runtimeSessionId:r.runtimeSessionId,bridgeUpdateId:qt()}}}function k(e){return e==null||e===""?!1:typeof e=="string"?a(e)!=="":Array.isArray(e)?e.length>0:u(e)?Object.keys(e).length>0:!0}function nn(e){let t=a(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return Ki.has(t)}function G(e,t){let r=g(e,t);return Number.isFinite(r)&&r>0?r:t}function Fe(e){let t=g(e,null);return Number.isFinite(t)&&t>0?t:null}function Rt(e,t=!1){if(typeof e=="boolean")return e;let r=a(e).toLowerCase();return["true","1","yes","y","on"].includes(r)?!0:["false","0","no","n","off"].includes(r)?!1:t}function j(e){return a(e?.type||"echo")}function sn(e){let t=j(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function He(e){if(u(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function io(e){let t=String(e||"");if(to.test(t))return!0;let r=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return r.endsWith("token")||r.endsWith("secret")||r.endsWith("password")||r.endsWith("apikey")||r.endsWith("privatekey")||r==="authorization"||r==="cookie"||r==="jwt"||r.includes("credential")}function $e(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=Le)return e;let r=e.length-Le;return`${e.slice(0,Le)}... [truncated ${r} characters]`}if(t>=Pe)return Array.isArray(e)?`[array truncated at depth ${Pe}, items=${e.length}]`:u(e)?`[object truncated at depth ${Pe}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let r=e.slice(0,ke).map(n=>$e(n,t+1));return e.length>ke&&r.push(`[truncated ${e.length-ke} items]`),r}if(u(e)){let r={};for(let[n,s]of Object.entries(e))r[n]=io(n)?"[REDACTED]":$e(s,t+1);return r}return String(e)}var oo=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function ao(e){if(!u(e))return e;let t={};for(let r of oo)k(e[r])&&(t[r]=e[r]);return t}function co(e){if(!u(e))return e;let t={...e};return u(t.renderedPayload)&&(t.renderedPayload=ao(t.renderedPayload)),t}function uo(e){let t=u(e)?e:{},r={};k(t.metadata)&&(r.metadata=co(t.metadata));for(let[n,s]of Object.entries(t))Qi.has(n)||n==="metadata"||k(s)&&(r[n]=s);return r}function lo(e){let t=u(e)?e:{},r=u(t.metadata)?t.metadata:{},n=u(r.renderedPayload)?r.renderedPayload:{};return u(t.resultContract)?t.resultContract:u(n.resultContract)?n.resultContract:{}}function on(e){return a(lo(e).kind).toLowerCase()==="decision"}function Zr(e){let t=u(e)?e:{},r=u(t.metadata)?t.metadata:{};return Fe(t.runtimeMaxSessions??r.runtimeMaxSessions)}function fo(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:j(e)==="cli"}function Qr(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return Rt(t,sn(e))}function mo(e,t){let r=u(e?.metadata)?{...e.metadata}:{},n=u(r._runtimeBridge)?{...r._runtimeBridge}:{},s=He(n);return r._runtimeBridge={...n,promptKind:"dispatch",finalTextOnly:fo(t),releaseAfterPrompt:s===void 0?Qr(t):Rt(s,Qr(t)),requiresRuntimeResult:on(e)},r}function po(e){let t=uo(e);if(!k(t))return"";let r=JSON.stringify($e(t),null,2);if(r.length<=Ue)return r;let n=r.length-Ue;return`${r.slice(0,Ue)}
+... [truncated ${n} characters]`}function qe(e){if(!u(e))return"";let t=u(e.update)?e.update:e,n=(u(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function Be(e){if(!u(e))return"";let t=u(e.update)?e.update:e;return a(t.sessionUpdate)}function je(e){if(!Array.isArray(e))return"";let t=!1,r=[],n=[],s=[],i=()=>{r.length>0&&(n.push(r),r=[])};for(let c of e){let l=Be(c),d=qe(c);if(!l){d&&s.push(d);continue}if(t=!0,l==="agent_message_chunk"){d&&r.push(d);continue}(l==="agent_thought_chunk"||l==="user_message_chunk"||l==="tool_call"||l==="tool_call_update"||l==="plan")&&i()}if(i(),!t)return st(s);let o=n[n.length-1]||[];return st(o)}function ho(e){return Array.isArray(e)?e.map(qe).filter(t=>t!==""):[]}function jt(e){return Array.isArray(e)?e.some(r=>Be(r))?e.filter(r=>Zi.has(Be(r))).map(qe).filter(r=>r!==""):ho(e):[]}function go(e){if(!u(e))return null;let t=u(e.update)?e.update:e;return a(t.sessionUpdate)!=="runtime_event"?null:u(t.event)?t.event:null}function _o(e){if(!u(e))return"";let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);if(r==="event_msg"){if(n==="task_complete")return a(t.last_agent_message||t.message||t.output);if(n==="agent_message"){let s=a(t.phase||t.status||t.stage).toLowerCase();if(["final_answer","final","complete","completed","done"].includes(s))return a(t.message||t.text||t.content)}}return""}function To(e){if(!Array.isArray(e))return"";for(let t=e.length-1;t>=0;t-=1){let r=_o(go(e[t]));if(r)return r}return""}function st(e){let t="";for(let r of e){let n=String(r||"");if(n)if(!t)t=n;else if(n.length>t.length&&n.startsWith(t))t=n;else{let s=qr(n)&&!/[\r\n]$/.test(t)?`
+`:"";t+=`${s}${n}`}}return t.trim()}function Ro(e){let t=String(e||"").trim();if(!t)return"";let r=t.match(/(?:^|\n)#{1,3}\s+\S/);return!r||r.index===0?t:t.slice(r.index+(t[r.index]===`
+`?1:0)).trim()}function tn(e){let t=String(e||"").trim();if(!t)return null;try{let r=JSON.parse(t);if(u(r)&&(an(r)||k(r._artifacts)||k(r.artifacts)||k(r._decision)||k(r._meta)))return r}catch{}return null}function yt(e){try{return Re(e)}catch{return null}}function Bt(...e){let t=null;for(let r of e)try{if(Re(r))return}catch(n){t||=n}if(t)throw t}function De(e){let t=String(e||"").trim();if(!t)return null;let r=yt(t);if(r)return r;let n=[...t.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)];for(let s=n.length-1;s>=0;s-=1){let i=tn(n[s][1]);if(i)return i}if(!t.endsWith("}"))return null;for(let s=t.lastIndexOf("{");s>=0;s=t.lastIndexOf("{",s-1)){let i=tn(t.slice(s));if(i)return i}return null}function yo(e){let t=yt(je(e));if(t)return t;let r=jt(e);for(let n=r.length-1;n>=0;n-=1){let s=yt(r[n]);if(s)return s}return yt(st(r))}function an(e){if(!u(e))return!1;if(k(e.output))return!0;for(let t of["content","text","message","summary"])if(a(e[t]))return!0;return!!(nn(e.status)||a(e.error)||a(e.errorMessage))}function $(e){let t=u(e)?{...e}:{};return(!Array.isArray(t._artifacts)||t._artifacts.length===0)&&Array.isArray(t.artifacts)&&t.artifacts.length>0&&(t._artifacts=t.artifacts),delete t.artifacts,t}function So(e){return u(e)?typeof(u(e._decision)?e._decision:u(e.decision)?e.decision:e).passed=="boolean":!1}function cn(e){return u(e)?u(e._decision)&&typeof e._decision.passed=="boolean"?!0:So(e.output):!1}function ve(e,t,r){let n=u(e)?{...e}:{};if(!k(n.output)){for(let s of["summary","message","content","text"])if(a(n[s])){n.output=a(n[s]);break}}return!k(n.output)&&a(r)&&(n.output=a(r)),{...n,_meta:{...u(n._meta)?n._meta:{},runtimeOutputSource:t,requiredRuntimeResult:!0,finalMessagePreview:a(r).slice(0,1e3)}}}var Eo=["dataUrl","dataURL","contentDataUrl","contentDataURL","contentBase64","base64","data"];function en(e){if(!u(e))return"";let t=u(e.content)?e.content:{},r=u(e.metadata)?e.metadata:{};return a(e.fieldKey||e.field_key||t.fieldKey||r.fieldKey)}function wo(e,t){let r=u(e.content)?e.content:{},n=u(t.content)?t.content:{},s={...e,...t,content:{...r,...n},metadata:{...u(e.metadata)?e.metadata:{},...u(t.metadata)?t.metadata:{}}};for(let i of Eo)k(e[i])&&(s[i]=e[i]),k(r[i])&&(s.content[i]=r[i]);return s}function un(e,t){let r=Array.isArray(e)?e.filter(u):[],n=Array.isArray(t)?t.filter(u):[];if(!r.length)return n;if(!n.length)return r;let s=[...r],i=new Map;for(let c=0;c<r.length;c+=1){let l=en(r[c]),d=i.get(l)||[];d.push(c),i.set(l,d)}let o=new Map;for(let c of n){let l=en(c),d=o.get(l)||0;o.set(l,d+1);let f=i.get(l)?.[d];f===void 0?s.push(c):s[f]=wo(s[f],c)}return s}function q(e,t,r){let n={...e,...t,_meta:{...u(e._meta)?e._meta:{},...u(t._meta)?t._meta:{},runtimeOutputSource:r}};return(Array.isArray(e._artifacts)||Array.isArray(t._artifacts))&&(n._artifacts=un(e._artifacts,t._artifacts)),n}function ln(e,t,r={}){let n=a(r.promptKind),s=r.requiresRuntimeResult===!0,i=s||n==="dispatch",o=$(e),c=typeof o.output=="string"?yt(o.output):null;if(c)return q(o,$(c),"result_block");let l=To(t),d=l?De(l):null,f=i?yo(t):null;if(an(o))return nn(o.status)||a(o.error)||a(o.errorMessage)?o:n==="dispatch"&&d?q(o,$(d),"final_event"):n==="dispatch"&&f?q(o,$(f),"updates"):!s||cn(o)?o:d?q(o,$(d),"final_event"):f?q(o,$(f),"updates"):(Bt(o.output,l,st(jt(t))),ve(o,"result",o.output));if(d)return q(o,$(d),"final_event");if(f)return q(o,$(f),"updates");if(l)return s?(Bt(l,st(jt(t))),ve(o,"final_event",l)):{...o,output:l,_meta:{...u(o._meta)?o._meta:{},runtimeOutputSource:"final_event"}};let p=je(t),_=De(p);if(_)return q(o,$(_),"updates");let m=Ro(p);if(!m)return s&&Bt(st(jt(t))),o;let R=De(m);return R?q(o,$(R),"updates"):s?(Bt(p,m),ve(o,"updates",m)):{...o,output:m,_meta:{...u(o._meta)?o._meta:{},runtimeOutputSource:"updates"}}}function Ke(e){return u(e)?a(e.stopReason||e.stop_reason).toLowerCase():""}function dn(e){return Yi.has(Ke(e))}function Io(e,t,r){if(r.promptKind!=="dispatch"||r.requiresRuntimeResult!==!0||!dn(e))return!1;try{return!cn(ln(e,t,r))}catch{return!0}}function Oo(){return["Your previous final response reached the output limit before the Runtime Result protocol was complete.","Re-emit the complete final Runtime Result from scratch using the conclusion you already reached.","Do not repeat analysis, process notes, tool calls, or task work.",`Keep the OUTPUT report within ${rn} Unicode characters.`,`Output ${pe}, ${he}, ${ge}, and ${_e} on their own lines.`,"The CONTROL block must be valid JSON containing _decision and must be fully closed.","Return only the two protocol blocks."].join(`
+`)}function xo(e,t){let r=u(t)?{...t}:{},n=un(e?._artifacts,t?._artifacts);return n.length>0&&(r._artifacts=n),r}function Ao(e,t){return{...e,_meta:{...u(e?._meta)?e._meta:{},runtimeProtocolRetry:{attempted:!0,recovered:!0,reason:Ke(t)||"max_tokens"}}}}function Co(e,t){let r=typeof e?.output=="string"?e.output:je(t),n=new P("runtime_output_truncated","Runtime Result \u8FBE\u5230\u6700\u5927\u8F93\u51FA\u957F\u5EA6\uFF0C\u7D27\u51D1\u91CD\u8BD5\u540E\u4ECD\u672A\u5B8C\u6574\u8FD4\u56DE",r);return n.detail={...n.detail,stopReason:Ke(e)||"max_tokens",retryAttempted:!0},n}var Kt=class{constructor(t){this.config=t,this.targets=t.targets||{},this.agents=new Map,this.sessions=new Map,this.runtimeSessionIndex=new Map,this.pendingPermissions=new Map,this.operations=new Map,this.startedAt=dt(),this.sandboxCapabilities={dispatchable:t.sandboxRequired!==!0,enforced:!1,backend:t.sandboxRequired?"unavailable":"direct",daemonStatus:t.sandboxRequired?"pending":"not_required",policySchemaVersions:[1],runtimePolicyUpdates:t.sandboxRequired===!0,workspaceSync:!1,egressProxy:!1},this.cleanupTimer=null,this.startSessionCleanup()}async start(){try{this.sandboxCapabilities=await Jr(this.config)}catch(t){this.sandboxCapabilities={...this.sandboxCapabilities,dispatchable:!1,enforced:!1,backend:"unavailable",daemonStatus:"unavailable",reason:a(t?.code||t?.message||t)||"sandbox_probe_failed"},h("error","runtime-bridge","runtime node sandbox probe failed; node will not accept work",{reason:this.sandboxCapabilities.reason})}return this.sandboxCapabilities}assertDispatchable(){if(this.config.sandboxRequired&&!(this.sandboxCapabilities.dispatchable===!0&&this.sandboxCapabilities.enforced===!0))throw Object.assign(new Error("runtime node strong sandbox is unavailable"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"})}operationIdentity(t,r,n){let s=u(t.goalContract)?we(t.goalContract):a(t.goalContractHash),i=ji("sha256").update(B({prompt:Array.isArray(t.prompt)?t.prompt:[],mcpServers:ro(t.mcpServers)})).digest("hex");return{agentId:r,runId:a(t.runId),sessionId:n,targetCode:a(t.targetCode||t.framework),workspace:a(t.workspace),goalContractHash:s,requestHash:i}}assertOperationIdentity(t,r,n,s){let i=this.operationIdentity(r,n,s),o=Object.keys(t.identity).find(c=>t.identity[c]!==i[c]);if(o)throw Object.assign(new Error(`runtime operation correlation conflict: ${t.correlationId}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT",field:o})}createOperation(t,r,n,s){let i={correlationId:t,agentId:n,sessionId:s,identity:this.operationIdentity(r,n,s),sandboxPolicy:u(r.sandboxPolicy)?structuredClone(r.sandboxPolicy):null,status:"running",updates:[],listeners:new Set,waiters:[],response:null,error:null,createdAtMs:Date.now(),completedAtMs:null};return this.operations.set(t,i),i}async attachOperation(t,r={}){let n=()=>{if(r.onUpdate)for(let s of t.updates)r.onUpdate(s)};if(t.status==="completed")return n(),t.response;if(t.status==="failed")throw n(),t.error;r.onUpdate&&t.listeners.add(r.onUpdate);try{return n(),await new Promise((s,i)=>t.waiters.push({resolve:s,reject:i}))}finally{r.onUpdate&&t.listeners.delete(r.onUpdate)}}completeOperation(t,r){if(t.status==="running"){t.status="completed",t.response=r,t.completedAtMs=Date.now();for(let n of t.waiters.splice(0))n.resolve(r);t.listeners.clear()}}promptResponse(t,r,n,s,i,o=s){let c=u(t.metadata)?t.metadata:{},l=u(c._runtimeBridge)?c._runtimeBridge:{},d=ln(i,o,l),f=Gr(t.goalContract,s,t.goalContractHash);return{sessionId:n,runtimeSessionId:r.runtimeSessionId,result:d,updates:s,...f?{verification:f}:{}}}failOperation(t,r){if(t.status!=="running")return;let n=r instanceof Error?r:Object.assign(new Error(String(r||"runtime operation failed")),{code:"RUNTIME_NODE_ERROR"});t.status="failed",t.error=n,t.completedAtMs=Date.now();for(let s of t.waiters.splice(0))s.reject(n);t.listeners.clear()}cleanupOperations(t=Date.now()){let r=G(this.config.operationTtlMs,Wi);for(let[n,s]of this.operations)s.status!=="running"&&t-(s.completedAtMs||s.createdAtMs)>r&&this.operations.delete(n)}targetFor(t){let r=a(t)||this.config.defaultTargetCode,n=this.targets[r];if(!r||!u(n)){let s=new Error(`runtime target is not configured: ${r||"<empty>"}`);throw s.code="RUNTIME_TARGET_NOT_FOUND",s}return{code:r,target:n}}targetIdleTtlMs(t){let n=j(t)==="openclaw"?G(this.config.openClawSessionIdleTtlMs,Ji):G(this.config.sessionIdleTtlMs,Gi);return G(t?.sessionIdleTtlMs??t?.idleTtlMs,n)}targetMaxSessions(t,r=null){let s=j(t)==="openclaw"?G(this.config.openClawMaxSessions,Xi):G(this.config.maxSessionsPerTarget,zi),i=G(t?.maxSessions,s),o=Fe(r);return o?Math.max(i,o):i}targetReleaseAfterPrompt(t,r={}){let n=j(t),s=u(r?._runtimeBridge)?r._runtimeBridge:{},i=He(s);return i!==void 0?Rt(i,!1):Rt(t?.releaseAfterPrompt??t?.disposeAfterPrompt,n==="openclaw")}promptReleaseAfterPrompt(t,r={}){if(this.config.sandboxRequired)return!0;let n=u(r?._runtimeBridge)?r._runtimeBridge:{},s=He(n);return s!==void 0?Rt(s,t.releaseAfterPrompt):t.releaseAfterPrompt}startSessionCleanup(){let t=G(this.config.sessionCleanupIntervalMs,Vi);t<=0||(this.cleanupTimer=setInterval(()=>{this.cleanupExpiredSessions().catch(r=>{h("warn","runtime-bridge","runtime session cleanup failed",{error:String(r)})})},t),this.cleanupTimer.unref?.())}sessionCountForTarget(t){let r=0;for(let n of this.sessions.values())n.targetCode===t&&(r+=1);return r}sessionCountForAgentTarget(t,r){let n=0;for(let s of this.sessions.values())s.agentId===t&&s.targetCode===r&&(n+=1);return n}idleTargetSessions(t){return[...this.sessions.entries()].filter(([,r])=>r.targetCode===t&&!r.busy).sort((r,n)=>(r[1].lastUsedAtMs||0)-(n[1].lastUsedAtMs||0))}idleAgentTargetSessions(t,r){return[...this.sessions.entries()].filter(([,n])=>n.agentId===t&&n.targetCode===r&&!n.busy).sort((n,s)=>(n[1].lastUsedAtMs||0)-(s[1].lastUsedAtMs||0))}async closeSession(t,r="session_closed"){let n=this.sessions.get(t);if(!n)return!1;try{await n.runtime?.stop?.(r)}catch(s){h("warn","runtime-bridge","runtime session stop failed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,error:String(s)})}return this.sessions.delete(t),this.runtimeSessionIndex.delete(`${n.agentId}:${n.runtimeSessionId}`),h("info","runtime-bridge","runtime session closed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,reason:r}),!0}async closeAllSessions(t="bridge_shutdown"){for(let r of[...this.sessions.keys()])await this.closeSession(r,t)}async stop(t="bridge_stop"){this.cleanupTimer&&clearInterval(this.cleanupTimer),this.cleanupTimer=null,await this.closeAllSessions(t)}async cleanupExpiredSessions(t=Date.now()){for(let[r,n]of[...this.sessions.entries()])n.busy||t-(n.lastUsedAtMs||n.createdAtMs||t)>n.idleTtlMs&&await this.closeSession(r,"idle_timeout")}async reserveTargetSlot(t,r,n={}){let s=a(n.agentId),i=Fe(n.runtimeMaxSessions);if(s&&i)for(;this.sessionCountForAgentTarget(s,t)>=i;){let c=this.idleAgentTargetSessions(s,t);if(!c.length){let l=new Error(`runtime agent session limit reached: ${s}`);throw l.code="RUNTIME_AGENT_SESSION_LIMIT",l}await this.closeSession(c[0][0],"agent_session_limit")}let o=this.targetMaxSessions(r,i);for(;this.sessionCountForTarget(t)>=o;){let c=this.idleTargetSessions(t);if(!c.length){let l=new Error(`runtime target session limit reached: ${t}`);throw l.code="RUNTIME_TARGET_SESSION_LIMIT",l}await this.closeSession(c[0][0],"target_session_limit")}}async createAgent(t){let r=a(t.agentId);if(!r)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});let{code:n,target:s}=this.targetFor(t.targetCode||t.framework),i=this.agents.get(r);if(i&&i.targetCode!==n)throw Object.assign(new Error(`runtime agent target conflict: ${r}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});let o=this.config.sandboxRequired?await Ne(this.config,s,t.workspace):a(t.workspace),c={agentId:r,targetCode:n,framework:a(t.framework||n),workspace:o,metadata:u(t.metadata)?t.metadata:{},createdAt:dt(),runtimeKind:j(s),runtimeMaxSessions:Zr(t)};return this.agents.set(r,c),{agent:c}}runtimeFor(t,r,n={}){let{target:s}=this.targetFor(t.targetCode),i=j(s),o={onPermissionRequest:l=>this.requestPermission(l)},c={sessionPromptTimeoutMs:this.config.sessionPromptTimeoutMs,initializeTimeoutMs:this.config.initializeTimeoutMs,sandboxRequired:this.config.sandboxRequired,...this.config.sandboxRequired?{prepareLaunch:l=>Xr({config:this.config,target:s,...l,runId:n.runId,agentId:t.agentId,sessionId:r,sandboxPolicy:n.sandboxPolicy})}:{}};return i==="stdio-acp"||i==="acp"?new et(t,s,o,c):i==="openclaw"?new bt(t,s,r,o,c):i==="cli"?new Lt(t,s,c):new Ot(t)}async prompt(t,r={}){if(this.assertDispatchable(),this.config.sandboxRequired){let c=a(t.runId);if(!c)throw Object.assign(new Error("runId is required"),{code:"BAD_REQUEST"});t={...t,runId:c,sandboxPolicy:W(t.sandboxPolicy)}}let n=a(t.agentId),s=a(t.sessionId)||qt(),i=a(t.correlationId);if(!n)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});if(this.cleanupOperations(),i){let c=this.operations.get(i);if(c)return this.assertOperationIdentity(c,t,n,s),this.attachOperation(c,r);if(t.attachOnly===!0)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"})}else if(t.attachOnly===!0)throw Object.assign(new Error("correlationId is required for attachOnly"),{code:"BAD_REQUEST"});let o=i?this.createOperation(i,t,n,s):null;if(o){let c=this.attachOperation(o,r);return(async()=>{try{await this._promptOwned(t,{},o,n,s)}catch(l){let d=o.status==="completed";this.failOperation(o,l),d&&h("warn","runtime-bridge","runtime cleanup failed after operation completion",{correlationId:o.correlationId,error:String(l)})}})(),await c}return await this._promptOwned(t,r,o,n,s)}async _promptOwned(t,r,n,s,i){let o=a(t.runId),c=this.config.sandboxRequired?W(n?.sandboxPolicy||t.sandboxPolicy):null,l=this.agents.get(s),d=this.targetFor(t.targetCode||t.framework||l?.targetCode);if(l&&l.targetCode!==d.code)throw Object.assign(new Error(`runtime agent target conflict: ${s}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});if(j(d.target)==="cli"&&no(t.goalContract))throw Object.assign(new Error("CLI runtimes do not support per-run dynamic MCP required by plugin_operation"),{code:"unsupported_dynamic_mcp"});let f=l||(await this.createAgent({agentId:s,targetCode:d.code,framework:t.framework,workspace:t.workspace,runtimeMaxSessions:t.runtimeMaxSessions,metadata:t.metadata})).agent,p=Zr(t);if(p&&(f.runtimeMaxSessions=p),!this.config.sandboxRequired){let T=a(t.workspace);T&&T!==f.workspace&&(f.workspace=T)}let _=`${s}:${i}`;await this.cleanupExpiredSessions();let m=this.sessions.get(_);if(m&&m.targetCode!==d.code)throw Object.assign(new Error(`runtime session target conflict: ${i}`),{code:"RUNTIME_SESSION_TARGET_CONFLICT"});if(m&&this.config.sandboxRequired&&m.runId!==o)throw Object.assign(new Error(`runtime session cannot be shared across runs: ${i}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});if(!m){let{code:T,target:y}=d;await this.reserveTargetSlot(T,y,{agentId:s,runtimeMaxSessions:f.runtimeMaxSessions});let E=this.runtimeFor(f,i,{runId:o,sandboxPolicy:c}),A=await E.sessionNew({cwd:tt(y,f.workspace),mcpServers:Array.isArray(t.mcpServers)?t.mcpServers:[],metadata:u(t.metadata)?t.metadata:{}}),U=Date.now();m={agentId:s,sessionId:i,runtime:E,targetCode:T,runtimeKind:j(y),runId:o,sandboxPolicy:c?structuredClone(c):null,runtimeSessionId:a(u(A)?A.sessionId:"")||i,idleTtlMs:this.targetIdleTtlMs(y),releaseAfterPrompt:this.config.sandboxRequired?!0:this.targetReleaseAfterPrompt(y,t.metadata),createdAtMs:U,lastUsedAtMs:U,busy:!1,createdAt:dt()},this.sessions.set(_,m),this.runtimeSessionIndex.set(`${s}:${m.runtimeSessionId}`,m)}if(m.busy){let T=new Error(`runtime session is already running: ${i}`);throw T.code="RUNTIME_SESSION_BUSY",T}m.busy=!0,m.operationCorrelationId=n?.correlationId||null,m.lastUsedAtMs=Date.now();let R=n?.updates||[],O=T=>{let y=so(T,i,m);if(R.push(y),n)for(let E of n.listeners)try{E?.(y)}catch(A){h("warn","runtime-bridge","runtime operation update listener failed",{correlationId:n.correlationId,error:String(A)})}else r.onUpdate?.(y)},N=T=>{if(!(!n||n.status!=="running"||!u(T))){if(T.status==="failed"){let y=T.error;if(y instanceof Error){this.failOperation(n,y);return}let E=u(y)?y:{},A=Object.assign(new Error(a(E.message||T.message)||"runtime terminal failure"),{code:a(E.code||T.code)||"RUNTIME_TERMINAL_FAILED"});this.failOperation(n,A);return}this.completeOperation(n,this.promptResponse(t,m,i,R,u(T.result)?T.result:{stopReason:"end_turn"}))}};try{let T=Kr(t.goalContract),y=Array.isArray(t.prompt)?[...t.prompt]:[];T&&y.unshift({type:"text",text:T,metadata:{source:"orcha_goal_contract"}});let E=u(t.metadata)?t.metadata:{},A=u(E._runtimeBridge)?E._runtimeBridge:{},U=await m.runtime.sessionPrompt({sessionId:m.runtimeSessionId,prompt:y,metadata:E},O,N),K=R,L=null;if(sn({type:m.runtimeKind})&&Io(U,R,A)){L=U;let Y=R.length,at=await m.runtime.sessionPrompt({sessionId:m.runtimeSessionId,prompt:[{type:"text",text:Oo()}],metadata:E,_meta:{thinking:"off"}},O,N);U=xo(L,at),K=R.slice(Y)}let w;try{w=this.promptResponse(t,m,i,R,U,K)}catch(Y){throw L&&dn(U)?Co(U,K):Y}return L&&(w.result=Ao(w.result,L)),n&&this.completeOperation(n,w),w}finally{m.busy=!1,m.operationCorrelationId===n?.correlationId&&(m.operationCorrelationId=null),m.lastUsedAtMs=Date.now(),this.promptReleaseAfterPrompt(m,u(t.metadata)?t.metadata:{})&&await this.closeSession(_,"release_after_prompt")}}async updatePolicy(t){if(this.assertDispatchable(),!this.config.sandboxRequired)throw Object.assign(new Error("runtime sandbox policy updates require an enforced sandbox"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"});let r=a(t.agentId),n=a(t.runId),s=a(t.sessionId),i=a(t.correlationId);if(!r||!n||!s||!i)throw Object.assign(new Error("agentId, runId, sessionId and correlationId are required"),{code:"BAD_REQUEST"});let o=W(t.sandboxPolicy),c=this.operations.get(i);if(c&&(c.agentId!==r||c.sessionId!==s||c.identity.runId!==n))throw Object.assign(new Error(`runtime operation policy identity conflict: ${i}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let l=`${r}:${s}`,d=this.sessions.get(l);if(d&&d.runId!==n)throw Object.assign(new Error(`runtime session policy identity conflict: ${s}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});let f=d?.sandboxPolicy||c?.sandboxPolicy;if(!f)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"});let p=Number(f.policyRevision),_=Number(o.policyRevision);if(_<p)throw Object.assign(new Error("runtime sandbox policy revision is stale"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});if(_===p){if(B(f)!==B(o))throw Object.assign(new Error("runtime sandbox policy revision payload conflicts"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});return{updated:!1,idempotent:!0,policyRevision:p,accessMode:f.accessMode}}let m=Wr(f,o);c&&(c.sandboxPolicy=structuredClone(o)),d&&(d.sandboxPolicy=structuredClone(o));let R=!1;return m&&d?.busy===!0&&(await d.runtime.sessionCancel({sessionId:d.runtimeSessionId}),R=await this.closeSession(l,"sandbox_policy_downgrade")),{updated:!0,policyRevision:_,accessMode:o.accessMode,activeCommandCancelled:R,deferredToNextLaunch:!m&&d?.busy===!0}}async cancel(t){let r=a(t.agentId),n=a(t.sessionId),s=a(t.correlationId);if(s){let c=this.operations.get(s);if(!c||c.status!=="running")return{cancelled:!1,correlationId:s,reason:"operation_not_running"};if(c.agentId!==r||c.sessionId!==n)throw Object.assign(new Error(`runtime operation cancellation identity conflict: ${s}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let l=this.sessions.get(`${r}:${n}`);return!l||l.busy!==!0||l.operationCorrelationId!==s?{cancelled:!1,correlationId:s,reason:"operation_not_running"}:(await l.runtime.sessionCancel({sessionId:l.runtimeSessionId}),await this.closeSession(`${r}:${n}`,"cancelled"),{cancelled:!0,correlationId:s})}let i=`${r}:${n}`,o=this.sessions.get(i);return o?(await o.runtime.sessionCancel({sessionId:o.runtimeSessionId}),await this.closeSession(i,"cancelled"),{cancelled:!0}):{cancelled:!1}}async dispatch(t,r={}){let n=a(t.agentId),s=a(t.taskId),i=a(t.executionId);if(!n||!s)throw Object.assign(new Error("agentId and taskId are required"),{status:400,code:"BAD_REQUEST"});let o=a(t.sessionId)||`dispatch-${i||s}`,c=a(t.instructions),l=po(t),d=on(t),{target:f}=this.targetFor(t.targetCode||t.framework),p=[{type:"text",text:["Task dispatch received.",`taskId: ${s}`,i?`executionId: ${i}`:"",c?`instructions: ${c}`:"",l?"orchaContext:":"",l,l?"Use orchaContext as the source of truth for upstream outputs, review reports, artifacts, and workflow metadata.":"","Follow the execution protocol in instructions exactly.","When embedding a generated artifact in final Markdown, use the Orcha artifact placeholder as the link target: orcha-artifact://<fieldKey>/<index>.","Example: use ![illustration](orcha-artifact://image/0) for the first generated image artifact.","Do not use local filesystem paths, file:// URLs, or data: URLs in final Markdown; Orcha replaces artifact placeholders after ingestion.",d?`For decision results, put the raw report between ${pe} and ${he}.`:"",d?`Then put a JSON object containing _decision between ${ge} and ${_e}.`:"",d?"Do not JSON-escape the report. Keep output out of the CONTROL JSON, and put every protocol marker on its own line.":"",d?`Keep the report within ${rn} Unicode characters so the CONTROL block fits before the output limit.`:"","Return only the final answer required by that protocol.","Do not include process notes, logs, or explanations."].filter(Boolean).join(`
+`)}];return this.prompt({...t,agentId:n,sessionId:o,prompt:p,metadata:mo(t,f)},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s}){let i=qt(),c=this.runtimeSessionIndex.get(`${t.agentId}:${r}`)?.sessionId||r||qt(),l={permissionId:i,agentId:t.agentId,sessionId:c,runtimeSessionId:r,request:u(n)?n:{},status:"pending",createdAt:dt()};return s?.({sessionId:r,update:{sessionUpdate:"permission_request",permission:l}}),await new Promise(d=>{let f=g(n?.timeoutMs,this.config.permissionRequestTimeoutMs),p=setTimeout(()=>{this.pendingPermissions.delete(i),d({permissionId:i,outcome:"denied",response:{reason:"permission request timed out"}})},f);this.pendingPermissions.set(i,{timer:p,resolve:d,permission:l})})}async respondPermission(t){let r=a(t.permissionId),n=this.pendingPermissions.get(r),s=a(t.outcome||"approved")||"approved";return n?(clearTimeout(n.timer),this.pendingPermissions.delete(r),n.resolve({permissionId:r,outcome:s,response:u(t.response)?t.response:{},userId:a(t.userId),metadata:u(t.metadata)?t.metadata:{}}),{accepted:!0,permissionId:r,outcome:s}):{accepted:!1,permissionId:r,outcome:s}}health(){return{status:this.config.sandboxRequired&&!this.sandboxCapabilities.dispatchable?"unavailable":"ok",bridgeVersion:Q,startedAt:this.startedAt,agents:[...this.agents.values()].map(t=>({agentId:t.agentId,targetCode:t.targetCode,framework:t.framework,runtimeKind:t.runtimeKind})),sessions:this.sessions.size,pendingPermissions:this.pendingPermissions.size,targets:Object.keys(this.targets),sandboxCapabilities:this.sandboxCapabilities}}};import No from"node:http";import bo from"node:https";import{randomBytes as fn}from"node:crypto";var it=1,J=3,Mo=1e4,Gt=class{constructor(t,r={}){this.url=t,this.readyState=0,this.socket=null,this.request=null,this.buffer=Buffer.alloc(0),this.listeners=new Map,this.connectTimeoutMs=Uo(r.connectTimeoutMs,Mo),this.connectTimer=null,this.connect()}addEventListener(t,r){let n=this.listeners.get(t)||new Set;n.add(r),this.listeners.set(t,n)}emit(t,r={}){let n=this.listeners.get(t);if(n)for(let s of n)s(r)}connect(){let t=new URL(this.url),r=t.protocol==="wss:"?bo:No,n=fn(16).toString("base64"),s=r.request({protocol:t.protocol==="wss:"?"https:":"http:",hostname:t.hostname,port:t.port||(t.protocol==="wss:"?443:80),path:`${t.pathname}${t.search}`,method:"GET",headers:{Connection:"Upgrade",Upgrade:"websocket","Sec-WebSocket-Key":n,"Sec-WebSocket-Version":"13"}});this.request=s,this.startConnectTimer(s),s.on("upgrade",(i,o,c)=>{if(this.clearConnectTimer(),this.readyState===J){o.destroy();return}this.socket=o,this.readyState=it,o.on("data",l=>this.onData(l)),o.on("close",()=>this.onClose()),o.on("error",l=>{this.readyState!==J&&this.emit("error",{error:l,message:l.message,type:"error"}),this.onClose()}),c?.length&&this.onData(c),this.emit("open")}),s.on("response",i=>{this.clearConnectTimer(),this.emit("error",{message:`websocket upgrade failed: HTTP ${i.statusCode}`,type:"error"}),i.resume(),this.onClose()}),s.on("error",i=>{this.clearConnectTimer(),this.readyState!==J&&this.emit("error",{error:i,message:i.message,type:"error"}),this.onClose()}),s.end()}startConnectTimer(t){this.connectTimeoutMs<=0||(this.connectTimer=setTimeout(()=>{if(this.readyState===it||this.readyState===J)return;let r=`websocket connect timeout after ${this.connectTimeoutMs}ms`;this.emit("error",{message:r,type:"timeout"}),this.onClose(),t.destroy(new Error(r))},this.connectTimeoutMs),this.connectTimer.unref?.())}clearConnectTimer(){this.connectTimer&&(clearTimeout(this.connectTimer),this.connectTimer=null)}send(t){!this.socket||this.readyState!==it||this.socket.write(Ge(1,Buffer.from(String(t),"utf8")))}close(){if(this.readyState!==J){if(this.clearConnectTimer(),!this.socket){this.request?.destroy(),this.onClose();return}try{this.readyState===it&&this.socket.write(Ge(8,Buffer.alloc(0))),this.socket.end()}catch{this.socket.destroy()}this.onClose()}}onClose(){this.readyState!==J&&(this.clearConnectTimer(),this.readyState=J,this.request=null,this.emit("close"))}onData(t){for(this.buffer=Buffer.concat([this.buffer,t]);this.buffer.length>=2;){let r=this.buffer[0],n=this.buffer[1],s=r&15,i=(n&128)!==0,o=n&127,c=2;if(o===126){if(this.buffer.length<c+2)return;o=this.buffer.readUInt16BE(c),c+=2}else if(o===127){if(this.buffer.length<c+8)return;let f=this.buffer.readUInt32BE(c),p=this.buffer.readUInt32BE(c+4);o=f*2**32+p,c+=8}let l=c;if(i&&(c+=4),this.buffer.length<c+o)return;let d=this.buffer.subarray(c,c+o);if(i){let f=this.buffer.subarray(l,l+4);d=Buffer.from(d.map((p,_)=>p^f[_%4]))}this.buffer=this.buffer.subarray(c+o),s===1?this.emit("message",{data:d.toString("utf8")}):s===8?this.close():s===9&&this.socket?.write(Ge(10,d))}}};function Uo(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function Ge(e,t){let r=t.length,n=2;r>=126&&r<=65535?n+=2:r>65535&&(n+=8);let s=fn(4),i=Buffer.alloc(n+4+r);i[0]=128|e;let o=2;r<126?i[1]=128|r:r<=65535?(i[1]=254,i.writeUInt16BE(r,o),o+=2):(i[1]=255,i.writeUInt32BE(Math.floor(r/2**32),o),i.writeUInt32BE(r>>>0,o+4),o+=8),s.copy(i,o),o+=4;for(let c=0;c<r;c+=1)i[o+c]=t[c]^s[c%4];return i}function Po(e){let t=new URL(e);if(t.protocol==="http:")t.protocol="ws:";else if(t.protocol==="https:")t.protocol="wss:";else if(t.protocol!=="ws:"&&t.protocol!=="wss:")throw new Error(`unsupported ORCHA_RUNTIME_ORCHA_URL protocol: ${t.protocol}`);return t.pathname=`${t.pathname.replace(/\/+$/,"")}/api/agent-runtime-bridge/ws`,t.search="",t.toString()}function Ve(e,t=!0){return Object.entries(e||{}).map(([r,n])=>({targetCode:r,targetName:a(n?.name||n?.targetName||r),targetType:a(n?.type||"echo"),status:t?"available":"unavailable"}))}var Vt=class{constructor(t,r){this.config=t,this.bridge=r,this.ws=null,this.stopped=!1,this.connected=!1,this.reconnectTimer=null,this.heartbeatTimer=null}sandboxCapabilities(){return this.bridge.sandboxCapabilities||{dispatchable:this.config.sandboxRequired!==!0,enforced:!1,backend:"development_direct",daemonStatus:"development_only",policySchemaVersions:[1],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:!1}}start(){this.connect()}stop(){this.stopped=!0,this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=null,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.ws?.close()}connect(){if(this.stopped)return;let t=Po(this.config.orchaUrl),r=new Gt(t,{connectTimeoutMs:this.config.connectTimeoutMs});this.ws=r,r.addEventListener("open",()=>{if(this.ws!==r||this.stopped){r.close();return}this.authenticate(r)}),r.addEventListener("message",n=>this.handleMessage(n.data,r)),r.addEventListener("close",()=>this.scheduleReconnect("close",r)),r.addEventListener("error",n=>{h("warn","orcha-client","runtime node websocket error",{error:String(n?.message||n?.type||n)})})}authenticate(t=this.ws){this.send({type:"runtime_node.authenticate",token:this.config.nodeToken,nodeId:this.config.nodeId,nodeName:this.config.nodeName,version:Q,protocolVersion:"orcha-runtime-node.v1",defaultTargetCode:this.config.defaultTargetCode,sandboxCapabilities:this.sandboxCapabilities(),targets:Ve(this.config.targets,this.sandboxCapabilities().dispatchable===!0)},t)}scheduleReconnect(t,r=this.ws){r&&this.ws!==r||(this.connected=!1,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,r&&this.ws===r&&(this.ws=null),!this.stopped&&(this.reconnectTimer||(h("info","orcha-client","runtime node disconnected; reconnect scheduled",{reason:t,reconnectMs:this.config.reconnectMs}),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},this.config.reconnectMs))))}async handleMessage(t,r=this.ws){if(r&&this.ws!==r)return;let n;try{n=JSON.parse(String(t))}catch(s){h("warn","orcha-client","invalid Orcha websocket frame",{error:String(s)});return}if(u(n)){if(n.type==="runtime_node.authenticated"){if(r&&this.ws!==r)return;this.connected=!0,this.startHeartbeat(r),h("info","orcha-client","runtime node authenticated",{nodeId:this.config.nodeId,connectionId:n.connectionId});return}if(n.type==="orcha.runtime.request"){await this.handleRequest(n);return}n.type==="runtime_node.ping"&&this.send({type:"runtime_node.pong",ts:new Date().toISOString(),sandboxCapabilities:this.sandboxCapabilities(),targets:Ve(this.config.targets,this.sandboxCapabilities().dispatchable===!0)})}}startHeartbeat(t){this.heartbeatTimer&&clearInterval(this.heartbeatTimer);let r=Math.max(1e3,Number(this.config.heartbeatIntervalMs||15e3)),n=()=>this.send({type:"runtime_node.heartbeat",ts:new Date().toISOString(),sandboxCapabilities:this.sandboxCapabilities(),targets:Ve(this.config.targets,this.sandboxCapabilities().dispatchable===!0)},t);n(),this.heartbeatTimer=setInterval(n,r),this.heartbeatTimer.unref?.()}async handleRequest(t){let r=a(t.id),n=a(t.method),s=u(t.params)?t.params:{};try{let i=await this.invoke(n,s,r);this.send({type:"orcha.runtime.response",id:r,ok:!0,result:i})}catch(i){this.send({type:"orcha.runtime.response",id:r,ok:!1,error:{code:i.code||"RUNTIME_NODE_ERROR",message:i.message||String(i),...i.detail===void 0?{}:{detail:i.detail}}})}}async invoke(t,r,n){if(t==="health")return this.bridge.health();if(t==="agents/create")return this.bridge.createAgent(r);if(t==="agents/dispatch")return this.bridge.dispatch(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/prompt")return this.bridge.prompt(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/policy")return this.bridge.updatePolicy(r);if(t==="sessions/cancel")return this.bridge.cancel(r);if(t==="permissions/respond")return this.bridge.respondPermission(r);throw Object.assign(new Error(`unsupported Orcha runtime method: ${t}`),{code:"METHOD_NOT_FOUND"})}sendUpdate(t,r){this.send({type:"orcha.runtime.event",requestId:t,eventType:"runtime.update",payload:r})}send(t,r=this.ws){return!r||r!==this.ws||r.readyState!==it?!1:(r.send(JSON.stringify(t)),!0)}};import{existsSync as mn,readFileSync as ko}from"node:fs";import{dirname as Lo,resolve as zt}from"node:path";import{fileURLToPath as Do}from"node:url";var vo=/^[A-Za-z_][A-Za-z0-9_]*$/;function pn(e=process.env,t=process.cwd()){let r=a(e.ORCHA_RUNTIME_ENV_FILE),n=r?zt(t,r):zt(t,".env");if(!mn(n))return r&&h("warn","config","runtime env file not found",{path:n}),{loaded:!1,path:n,keys:[]};let s=[],i=ko(n,"utf8");for(let o of i.split(/\r?\n/)){let c=$o(o);if(!c)continue;let[l,d]=c;Object.prototype.hasOwnProperty.call(e,l)||(e[l]=d,s.push(l))}return h("info","config","runtime env file loaded",{path:n,keyCount:s.length}),{loaded:!0,path:n,keys:s}}function hn(e=process.env){let t=a(e.ORCHA_RUNTIME_MODE||(e.ORCHA_RUNTIME_ORCHA_URL?"node":"server")),r=a(e.ORCHA_RUNTIME_BRIDGE_HOST||"127.0.0.1"),n=!1,s=Lo(Do(import.meta.url)),i=zt(s,"sandbox","broker.js"),o=zt(s,"orcha-runtime-sandbox-broker.js"),c=mn(i)?i:o,l=a(e.ORCHA_RUNTIME_SANDBOX_BROKER_COMMAND);return{mode:t,host:r,port:g(e.ORCHA_RUNTIME_BRIDGE_PORT,5588),token:e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",orchaUrl:a(e.ORCHA_RUNTIME_ORCHA_URL),nodeToken:e.ORCHA_RUNTIME_NODE_TOKEN||e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",nodeId:a(e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"local-runtime-node"),nodeName:a(e.ORCHA_RUNTIME_NODE_NAME||e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"Local Runtime Node"),reconnectMs:g(e.ORCHA_RUNTIME_RECONNECT_MS,3e3),connectTimeoutMs:g(e.ORCHA_RUNTIME_CONNECT_TIMEOUT_MS||e.ORCHA_RUNTIME_WS_CONNECT_TIMEOUT_MS,1e4),defaultTargetCode:e.ORCHA_RUNTIME_DEFAULT_TARGET||"echo",requestLimitBytes:g(e.ORCHA_RUNTIME_REQUEST_LIMIT_BYTES,1048576),initializeTimeoutMs:g(e.ORCHA_RUNTIME_INITIALIZE_TIMEOUT_MS,3e4),sessionPromptTimeoutMs:g(e.ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS,36e5),permissionRequestTimeoutMs:g(e.ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS,3e5),sessionIdleTtlMs:g(e.ORCHA_RUNTIME_SESSION_IDLE_TTL_MS,6e5),sessionCleanupIntervalMs:g(e.ORCHA_RUNTIME_SESSION_CLEANUP_INTERVAL_MS,6e4),maxSessionsPerTarget:g(e.ORCHA_RUNTIME_MAX_SESSIONS_PER_TARGET,8),openClawSessionIdleTtlMs:g(e.ORCHA_RUNTIME_OPENCLAW_SESSION_IDLE_TTL_MS,6e4),openClawMaxSessions:g(e.ORCHA_RUNTIME_OPENCLAW_MAX_SESSIONS,1),heartbeatIntervalMs:g(e.ORCHA_RUNTIME_HEARTBEAT_INTERVAL_MS,15e3),sandboxRequired:n,sandboxBrokerCommand:l||process.execPath,sandboxBrokerArguments:ze(e.ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS,"ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS",l?[]:[c]),sandboxProbeTimeoutMs:g(e.ORCHA_RUNTIME_SANDBOX_PROBE_TIMEOUT_MS,1e4),sandboxTempRoot:a(e.ORCHA_RUNTIME_SANDBOX_TEMP_ROOT),trustedWorkspaceRoots:ze(e.ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS,"ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS"),trustedToolchainRoots:ze(e.ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS,"ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS"),egressProxyRequired:Ho(e.ORCHA_RUNTIME_EGRESS_PROXY_REQUIRED,t==="node"),egressProxySocket:a(e.ORCHA_RUNTIME_EGRESS_PROXY_SOCKET),egressProxyToken:a(e.ORCHA_RUNTIME_EGRESS_PROXY_TOKEN),egressGrantMaxTtlMs:g(e.ORCHA_RUNTIME_EGRESS_GRANT_MAX_TTL_MS,9e5),targets:Fo(e.ORCHA_RUNTIME_TARGETS_JSON||"")}}function Fo(e){if(!a(e))return{};try{let t=JSON.parse(e);if(u(t))return t}catch(t){h("warn","config","invalid ORCHA_RUNTIME_TARGETS_JSON",{error:String(t)})}return{}}function Ho(e,t){let r=a(e).toLowerCase();if(!r)return t;if(["true","1","yes","on"].includes(r))return!0;if(["false","0","no","off"].includes(r))return!1;throw new Error(`invalid boolean configuration value: ${r}`)}function ze(e,t,r=[]){let n=a(e);if(!n)return[...r];let s;try{s=JSON.parse(n)}catch{throw new Error(`${t} must be a JSON string array`)}if(!Array.isArray(s)||s.some(i=>typeof i!="string"))throw new Error(`${t} must be a JSON string array`);return s.map(i=>i.trim()).filter(Boolean)}function $o(e){let t=e.trim();if(!t||t.startsWith("#"))return null;let r=t.startsWith("export ")?t.slice(7).trimStart():t,n=r.indexOf("=");if(n<=0)return null;let s=r.slice(0,n).trim();if(!vo.test(s))return null;let i=Bo(r.slice(n+1).trim());return[s,i]}function Bo(e){if(!e)return"";let t=e[0];if((t==='"'||t==="'")&&e.endsWith(t)){let r=e.slice(1,-1);return t==='"'?qo(r):r}return jo(e).trim()}function qo(e){return e.replaceAll("\\n",`
+`).replaceAll("\\r","\r").replaceAll("\\t","	").replaceAll('\\"','"').replaceAll("\\\\","\\")}function jo(e){let t=!1,r=!1;for(let n=0;n<e.length;n+=1){let s=e[n],i=e[n-1];if(s==="'"&&!r)t=!t;else if(s==='"'&&!t&&i!=="\\")r=!r;else if(s==="#"&&!t&&!r&&/\s/.test(i||""))return e.slice(0,n)}return e}import{createServer as Ko}from"node:http";function Wt(e,t,r){let n=JSON.stringify(r);e.writeHead(t,{"content-type":"application/json; charset=utf-8","content-length":Buffer.byteLength(n)}),e.end(n)}function X(e={}){return{ok:!0,...e}}function We(e,t,r){return{ok:!1,error:{code:e,message:t,...r===void 0?{}:{detail:r}}}}async function gn(e,t){let r=[],n=0;for await(let i of e){if(n+=i.length,n>t)throw Object.assign(new Error("request body too large"),{status:413,code:"REQUEST_TOO_LARGE"});r.push(i)}if(r.length===0)return{};let s=Buffer.concat(r).toString("utf8");if(!s.trim())return{};try{let i=JSON.parse(s);if(!u(i))throw Object.assign(new Error("JSON body must be an object"),{status:400,code:"BAD_JSON"});return i}catch(i){throw i.status?i:Object.assign(new Error(`invalid JSON body: ${i.message}`),{status:400,code:"BAD_JSON"})}}function _n(e,t){if(!t)return;if((e.headers.authorization||"")!==`Bearer ${t}`)throw Object.assign(new Error("runtime bridge token is invalid"),{status:401,code:"UNAUTHORIZED"})}function Tn(e,t){let r={"GET /health":async()=>X(t.health()),"POST /agents/create":async n=>X(await t.createAgent(n)),"POST /agents/dispatch":async n=>X(await t.dispatch(n)),"POST /sessions/prompt":async n=>X(await t.prompt(n)),"POST /sessions/cancel":async n=>X(await t.cancel(n)),"POST /permissions/respond":async n=>X(await t.respondPermission(n))};return Ko(async(n,s)=>{let i=new URL(n.url||"/",`http://${n.headers.host||`${e.host}:${e.port}`}`),o=`${n.method||"GET"} ${i.pathname}`,c=r[o];if(!c){Wt(s,404,We("NOT_FOUND",`No route for ${o}`));return}try{_n(n,e.token);let l=n.method==="GET"?{}:await gn(n,e.requestLimitBytes);Wt(s,200,await c(l))}catch(l){let d=l.status||500,f=l.code||"BRIDGE_INTERNAL";Wt(s,d,We(f,l.message||String(l),l.detail))}})}var Zo=Yo(import.meta.url),Qo=".orcha-runtime-bridge.pid",ta=".orcha-runtime-bridge.log",ea=3,ra=36e5,{command:na,options:Cn}=aa(process.argv.slice(2));ca(Cn);pn();var sa=hn();await ia(na,sa,Cn);async function ia(e,t,r){switch(e){case"run":case"foreground":await yn(t);return;case"start":if(r.foreground){await yn(t);return}En();return;case"reload":case"restart":await wn({quiet:!0}),En();return;case"stop":await wn();return;case"status":oa();return;case"help":case"--help":case"-h":fa();return;default:throw new Error(`Unknown command: ${e}`)}}async function yn(e){ua();let t=new Kt(e);if(await t.start(),e.mode==="server"){let n=Tn(e,t);Sn({bridge:t,server:n}),n.listen(e.port,e.host,()=>{h("info","runtime-bridge","Orcha runtime bridge HTTP server started",{host:e.host,port:e.port,targets:Object.keys(t.targets)})});return}if(!e.orchaUrl)throw new Error("ORCHA_RUNTIME_ORCHA_URL is required in runtime node mode");let r=new Vt(e,t);Sn({bridge:t,client:r}),r.start(),h("info","runtime-bridge","Orcha runtime node started",{nodeId:e.nodeId,nodeName:e.nodeName,orchaUrl:e.orchaUrl,targets:Object.keys(t.targets)})}function Sn({bridge:e,client:t,server:r}){let n=!1,s=i=>{if(n)return;n=!0;let o=Number(e?.sessions?.size||0)>0;h("info","runtime-bridge","runtime bridge shutting down",{signal:i});try{t?.stop?.()}catch(c){h("warn","runtime-bridge","runtime client stop failed",{error:String(c)})}Promise.resolve(e?.stop?.(`process_${String(i||"shutdown").toLowerCase()}`)).catch(c=>{h("warn","runtime-bridge","runtime bridge stop failed",{error:String(c)})}).finally(()=>{try{r?.close?.()}catch(c){h("warn","runtime-bridge","runtime server close failed",{error:String(c)})}}),setTimeout(()=>process.exit(0),o?8500:200)};process.once("SIGTERM",()=>s("SIGTERM")),process.once("SIGINT",()=>s("SIGINT"))}function En(){let e=Qe(),t=Nn(),r=tr(e);if(r&&ot(r)){console.log(JSON.stringify({status:"already_running",pid:r,pidFile:e,logFile:t}));return}r&&Ye(e),On(e),On(t),Xe(t);let n=Wo(t,"a"),s={...process.env,ORCHA_RUNTIME_PID_FILE:e,ORCHA_RUNTIME_LOG_FILE:t},i=Go(process.execPath,[Zo,"run"],{cwd:process.cwd(),detached:!0,env:s,stdio:["ignore",n,n]});i.unref(),Vo(n),An(e,`${i.pid}
+`),console.log(JSON.stringify({status:"started",pid:i.pid,pidFile:e,logFile:t}))}async function wn({quiet:e=!1}={}){let t=Qe(),r=tr(t);if(!r){e||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!ot(r)){Ye(t),e||console.log(JSON.stringify({status:"not_running",pid:r,pidFile:t}));return}process.kill(r,"SIGTERM"),!await In(r,1e4)&&ot(r)&&(process.kill(r,"SIGKILL"),await In(r,3e3)),Ye(t),e||console.log(JSON.stringify({status:"stopped",pid:r,pidFile:t}))}function oa(){let e=Qe(),t=Nn(),r=tr(e),n=!!(r&&ot(r));console.log(JSON.stringify({status:n?"running":"not_running",running:n,pid:n?r:null,pidFile:e,logFile:t}))}function aa(e){let t=[],r={};for(let s=0;s<e.length;s+=1){let i=e[s];i==="--daemon"?r.daemon=!0:i==="--foreground"?r.foreground=!0:i==="--env-file"?r.envFile=e[++s]:i==="--pid-file"?r.pidFile=e[++s]:i==="--log-file"?r.logFile=e[++s]:t.push(i)}return{command:t[0]||"run",options:r}}function ca(e){e.envFile&&(process.env.ORCHA_RUNTIME_ENV_FILE=e.envFile),e.pidFile&&(process.env.ORCHA_RUNTIME_PID_FILE=e.pidFile),e.logFile&&(process.env.ORCHA_RUNTIME_LOG_FILE=e.logFile)}function Qe(){return Ze(process.cwd(),process.env.ORCHA_RUNTIME_PID_FILE||Qo)}function Nn(){return Ze(process.cwd(),process.env.ORCHA_RUNTIME_LOG_FILE||ta)}function ua(){let e=process.env.ORCHA_RUNTIME_LOG_FILE;if(!e)return;let t=bn();if(t<=0)return;let r=Ze(process.cwd(),e);Xe(r,t);let n=da();n<=0||setInterval(()=>Xe(r,t),n).unref()}function Xe(e,t=bn()){if(t<=0||!xn(e))return;let r=0,n="";try{if(r=Rn(e).size,r<=0)return;n=Je(e,"utf8")}catch(d){h("warn","runtime-bridge","runtime log cleanup skipped",{logFile:e,error:String(d)});return}let s=Date.now()-t*24*60*60*1e3,i=n.split(/\r?\n/),o=[],c=0;for(let d of i)d&&(la(d,s)?o.push(d):c+=1);if(c===0)return;let l="";try{Rn(e).size>r&&(l=Je(e,"utf8").slice(n.length));let f=[...o,...l.split(/\r?\n/).filter(Boolean)].join(`
+`);An(e,f?`${f}
+`:""),h("info","runtime-bridge","runtime log cleanup completed",{logFile:e,retentionDays:t,removed:c})}catch(d){h("warn","runtime-bridge","runtime log cleanup failed",{logFile:e,error:String(d)})}}function la(e,t){try{let r=JSON.parse(e);if(!r||typeof r!="object")return!0;let n=typeof r.ts=="string"?Date.parse(r.ts):Number.NaN;return!Number.isFinite(n)||n>=t}catch{return!0}}function bn(){return Mn(process.env.ORCHA_RUNTIME_LOG_RETENTION_DAYS,ea)}function da(){return Mn(process.env.ORCHA_RUNTIME_LOG_CLEANUP_INTERVAL_MS,ra)}function Mn(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function tr(e){if(!xn(e))return null;let t=Number.parseInt(Je(e,"utf8").trim(),10);return Number.isInteger(t)&&t>0?t:null}function ot(e){try{return process.kill(e,0),!0}catch(t){return t?.code==="EPERM"}}async function In(e,t){let r=Date.now();for(;Date.now()-r<t;){if(!ot(e))return!0;await new Promise(n=>setTimeout(n,100))}return!ot(e)}function On(e){zo(Xo(e),{recursive:!0})}function Ye(e){try{Jo(e,{force:!0})}catch{}}function fa(){console.log(`Usage: orcha-runtime-bridge [command] [options]
 
 Commands:
   run, foreground      Run in the foreground. This is the default.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orcha-ai/runtime-bridge",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "private": false,
   "type": "module",
   "description": "Local Orcha runtime bridge for ACP-compatible agent runtimes.",