@orcha-ai/runtime-bridge 0.1.35 → 0.1.36

package/README.md

@@ -61,6 +61,21 @@ npm tarball under `dist/`. The release package includes the minified `bin/`
 runtime, `README.md`, and `.env.example`; it does not publish `src/`, build
 scripts, test scripts, or the local `.env` file.
 
+### 0.1.36 Release
+
+Packages the goal-verification changes committed on August 25–26, 2026.
+Each verification check requires a positive integer `requiredMatches` and
+counts distinct successful tool call IDs. Results report `requiredMatches`,
+`observedMatches`, and `toolCallIds` instead of the previous single `toolCallId`.
+Callers and result consumers must use these fields when upgrading from 0.1.35.
+
+After `npm run check`, `npm test`, and `npm run pack:local` succeed, publish the
+prepared tarball from this directory:
+
+```bash
+npm publish ./dist/orcha-ai-runtime-bridge-0.1.36.tgz --access public --registry=https://registry.npmjs.org
+```
+
 ## Configure
 
 ```bash

package/bin/orcha-runtime-bridge.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import{spawn as Ko}from"node:child_process";import{closeSync as Go,existsSync as On,mkdirSync as Vo,openSync as zo,readFileSync as We,rmSync as Wo,statSync as _n,writeFileSync as In}from"node:fs";import{dirname as Jo,resolve as Ye}from"node:path";import{fileURLToPath as Xo}from"node:url";import{createHash as Bi,randomUUID as qt}from"node:crypto";var Q="0.1.35";function dt(){return new Date().toISOString()}function M(e,t=2){return String(e).padStart(t,"0")}function nr(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${M(Math.floor(r/60))}:${M(r%60)}`}function Un(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${M(e.getMonth()+1)}-${M(e.getDate())}`,`T${M(e.getHours())}:${M(e.getMinutes())}:${M(e.getSeconds())}.${M(e.getMilliseconds(),3)}`,nr(t)].join("")}function Pn(e,t){let r=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),n={};for(let s of r.formatToParts(e))s.type!=="literal"&&(n[s.type]=Number(s.value));return n}function kn(e,t){let r=Pn(e,t),n=Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second,e.getMilliseconds()),s=Math.round((n-e.getTime())/6e4);return[`${r.year}-${M(r.month)}-${M(r.day)}`,`T${M(r.hour)}:${M(r.minute)}:${M(r.second)}.${M(e.getMilliseconds(),3)}`,nr(s)].join("")}function Ln(e=new Date){let t=a(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return kn(e,t)}catch{return Un(e)}}function u(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function a(e){return String(e??"").trim()}function _(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)?r:t}function C(e){return Array.isArray(e)?e.map(String):[]}function tt(e,t,r=process.cwd()){let n=u(e)?e:{};return a(n.cwd)||a(n.workspace)||a(t)||a(r)||process.cwd()}var Et="[redacted]",Dn=/(authorization|api[_-]?key|credential|password|secret|token)/i;function wt(e){return Dn.test(a(e))}function sr(e,t=[]){let r=String(e??"");for(let n of t){let s=String(n??"");s.length>=4&&(r=r.split(s).join(Et))}return r.replace(/((?:authorization|api[_-]?key|credential|password|secret|token)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi,`$1${Et}`).replace(/([?&](?:api[_-]?key|credential|password|secret|token)=)[^&\s]+/gi,`$1${Et}`)}function z(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=z(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>z(i,t));return t.delete(e),s}let r={},n=wt(e.name||e.key);for(let[s,i]of Object.entries(e))r[s]=wt(s)||n&&s.toLowerCase()==="value"?Et:z(i,t);return t.delete(e),r}function ir(e,t=4e3){let r=JSON.stringify(z(e))??String(e);return!Number.isFinite(t)||r.length<=t?r:`${r.slice(0,t)}...`}function h(e,t,r,n={}){let s={ts:Ln(),level:e,module:t,msg:r,...u(n)?z(n):{}};console.error(JSON.stringify(s))}function Ot(e){return Array.isArray(e)?e.map(t=>u(t)?t.type==="text"?a(t.text):t.type==="file"?a(t.uri):t.type==="image"?a(t.uri):"":"").filter(Boolean).join(`
+import{spawn as Ko}from"node:child_process";import{closeSync as Go,existsSync as On,mkdirSync as Vo,openSync as zo,readFileSync as We,rmSync as Wo,statSync as _n,writeFileSync as In}from"node:fs";import{dirname as Jo,resolve as Ye}from"node:path";import{fileURLToPath as Xo}from"node:url";import{createHash as Bi,randomUUID as qt}from"node:crypto";var Q="0.1.36";function dt(){return new Date().toISOString()}function M(e,t=2){return String(e).padStart(t,"0")}function nr(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${M(Math.floor(r/60))}:${M(r%60)}`}function Un(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${M(e.getMonth()+1)}-${M(e.getDate())}`,`T${M(e.getHours())}:${M(e.getMinutes())}:${M(e.getSeconds())}.${M(e.getMilliseconds(),3)}`,nr(t)].join("")}function Pn(e,t){let r=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),n={};for(let s of r.formatToParts(e))s.type!=="literal"&&(n[s.type]=Number(s.value));return n}function kn(e,t){let r=Pn(e,t),n=Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second,e.getMilliseconds()),s=Math.round((n-e.getTime())/6e4);return[`${r.year}-${M(r.month)}-${M(r.day)}`,`T${M(r.hour)}:${M(r.minute)}:${M(r.second)}.${M(e.getMilliseconds(),3)}`,nr(s)].join("")}function Ln(e=new Date){let t=a(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return kn(e,t)}catch{return Un(e)}}function u(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function a(e){return String(e??"").trim()}function _(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)?r:t}function C(e){return Array.isArray(e)?e.map(String):[]}function tt(e,t,r=process.cwd()){let n=u(e)?e:{};return a(n.cwd)||a(n.workspace)||a(t)||a(r)||process.cwd()}var Et="[redacted]",Dn=/(authorization|api[_-]?key|credential|password|secret|token)/i;function wt(e){return Dn.test(a(e))}function sr(e,t=[]){let r=String(e??"");for(let n of t){let s=String(n??"");s.length>=4&&(r=r.split(s).join(Et))}return r.replace(/((?:authorization|api[_-]?key|credential|password|secret|token)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi,`$1${Et}`).replace(/([?&](?:api[_-]?key|credential|password|secret|token)=)[^&\s]+/gi,`$1${Et}`)}function z(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=z(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>z(i,t));return t.delete(e),s}let r={},n=wt(e.name||e.key);for(let[s,i]of Object.entries(e))r[s]=wt(s)||n&&s.toLowerCase()==="value"?Et:z(i,t);return t.delete(e),r}function ir(e,t=4e3){let r=JSON.stringify(z(e))??String(e);return!Number.isFinite(t)||r.length<=t?r:`${r.slice(0,t)}...`}function h(e,t,r,n={}){let s={ts:Ln(),level:e,module:t,msg:r,...u(n)?z(n):{}};console.error(JSON.stringify(s))}function Ot(e){return Array.isArray(e)?e.map(t=>u(t)?t.type==="text"?a(t.text):t.type==="file"?a(t.uri):t.type==="image"?a(t.uri):"":"").filter(Boolean).join(`
 `):""}var It=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,r){let n=Ot(t.prompt);return r({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as vn}from"node:child_process";var ft="2.0",Zt=3e4,Hn=4e3;function xt(e,t){let r=Object.entries(u(t)?t:{}).filter(([n])=>wt(n)).map(([,n])=>n);return sr(e,r)}function Fn(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,message:a(e?.message)||String(e),data:u(e?.data)?e.data:void 0}}function $n(e){if(!u(e))return new Error(String(e||"runtime error"));let t=a(e.message)||"runtime error",r="data"in e?ir(e.data,4e3):"",n=new Error(r?`${t}; data=${r}`:t);return n.rpcCode=e.code,n.data=e.data,n}function Bn(e){return u(e)&&"id"in e&&!("method"in e)}function qn(e){return u(e)&&typeof e.method=="string"&&"id"in e}function jn(e){return u(e)&&typeof e.method=="string"&&!("id"in e)}var At=class{constructor({command:t,args:r=[],cwd:n,env:s,label:i,framing:o="line",detached:c=!0}){this.command=t,this.args=Array.isArray(r)?r.map(String):[],this.cwd=n||process.cwd(),this.env=u(s)?{...s}:{...process.env},this.label=i||t,this.framing=o==="content-length"?"content-length":"line",this.detached=c!==!1,this.child=null,this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stopPromise=null,this.stderrTail="",this.spawnError=null,this.lineBuffer="",this.headerBuffer=Buffer.alloc(0),this.seq=0,this.pending=new Map,this.notificationHandlers=new Map,this.requestHandlers=new Map,this.exitHandlers=new Set}async start({initialize:t=!0,initializeParams:r={},initializeTimeoutMs:n=Zt}={}){if(!(this.child&&!this.exited)&&(this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stderrTail="",this.spawnError=null,this.child=vn(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"],detached:this.detached}),this.child.stdout.on("data",s=>this.onStdout(s)),this.child.stderr.setEncoding("utf8"),this.child.stderr.on("data",s=>{this.stderrTail=`${this.stderrTail}${s}`.slice(-Hn);let i=xt(s.trimEnd(),this.env);i&&h("debug","runtime.stderr","runtime stderr",{target:this.label,text:i})}),this.child.on("exit",(s,i)=>this.handleExit(s,i)),this.child.on("error",s=>{this.spawnError=s,this.rejectAll(s)}),t)){let s=Math.max(1,_(n,Zt));try{await this.call("initialize",{protocolVersion:1,clientCapabilities:{},...r},s)}catch(i){let o=this.startupFailureDetail(),c=xt(i?.message||i,this.env);h("warn","runtime.initialize","runtime initialize failed",{target:this.label,timeoutMs:s,cause:c,...o}),await this.stop("initialize failed",{termTimeoutMs:1e3,killTimeoutMs:1e3});let l=o.stderr?`; stderr: ${o.stderr}`:`; command=${o.command}; cwd=${o.cwd}`;throw Object.assign(new Error(`runtime initialize failed: ${c}${l}`,{cause:i}),{code:"RUNTIME_INITIALIZE_FAILED",detail:o})}}}startupFailureDetail(){return{command:this.command,cwd:this.cwd,exited:this.exited,exitCode:this.exitCode,exitSignal:this.exitSignal,...this.spawnError?{spawnError:xt(this.spawnError.message,this.env)}:{},...this.stderrTail.trim()?{stderr:xt(this.stderrTail.trim(),this.env)}:{}}}onStdout(t){if(this.framing==="content-length"){this.onContentLengthData(Buffer.isBuffer(t)?t:Buffer.from(t));return}this.onLineData(t.toString("utf8"))}onLineData(t){this.lineBuffer+=t;let r=this.lineBuffer.split(/\r?\n/);this.lineBuffer=r.pop()||"";for(let n of r){let s=n.trim();s&&this.dispatchRaw(s)}}onContentLengthData(t){for(this.headerBuffer=Buffer.concat([this.headerBuffer,t]);this.headerBuffer.length>0;){let r=this.headerBuffer.indexOf(`\r
 \r
 `);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){h("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.alloc(0);return}let i=Number.parseInt(s[1],10),o=r+4,c=o+i;if(this.headerBuffer.length<c)return;let l=this.headerBuffer.subarray(o,c).toString("utf8");this.headerBuffer=this.headerBuffer.subarray(c),this.dispatchRaw(l)}}dispatchRaw(t){let r;try{r=JSON.parse(t)}catch(n){h("warn","runtime.protocol","invalid JSON frame",{target:this.label,error:String(n)});return}this.dispatch(r)}dispatch(t){if(Bn(t)){this.resolveResponse(t);return}if(qn(t)){this.handleRequest(t);return}jn(t)&&this.handleNotification(t)}resolveResponse(t){let r=String(t.id),n=this.pending.get(r);n&&(clearTimeout(n.timer),this.pending.delete(r),t.error?(h("warn","runtime.protocol","runtime rpc error",{target:this.label,method:n.method,requestId:r,error:t.error}),n.reject($n(t.error))):n.resolve(t.result))}async handleRequest(t){let r=this.requestHandlers.get(t.method);if(!r){this.writeFrame({jsonrpc:ft,id:t.id,error:{code:-32601,message:`method not found: ${t.method}`}});return}try{let n=await r(u(t.params)?t.params:{},t);this.writeFrame({jsonrpc:ft,id:t.id,result:n??{}})}catch(n){this.writeFrame({jsonrpc:ft,id:t.id,error:Fn(n)})}}handleNotification(t){let r=this.notificationHandlers.get(t.method);if(r)for(let n of r)n(u(t.params)?t.params:{},t)}call(t,r={},n=Zt){if(!this.child||!this.child.stdin||this.exited)return Promise.reject(new Error("runtime process is not running"));let s=`${t}_${++this.seq}`,i={jsonrpc:ft,id:s,method:t,params:r};return new Promise((o,c)=>{let l=setTimeout(()=>{this.pending.delete(s),c(new Error(`${t} timed out after ${n}ms`))},n);this.pending.set(s,{resolve:o,reject:c,timer:l,method:t}),this.writeFrame(i,d=>{d&&(clearTimeout(l),this.pending.delete(s),c(d))})})}notify(t,r={}){this.writeFrame({jsonrpc:ft,method:t,params:r})}writeFrame(t,r){if(!this.child?.stdin||this.exited){r?.(new Error("runtime process is not running"));return}let n=JSON.stringify(t),s=this.framing==="content-length"?`Content-Length: ${Buffer.byteLength(n,"utf8")}\r
@@ -9,8 +9,8 @@ ${n}`:`${n}
 
 ${s}`:s;kr(t,r,n,d,s)&&(o=1,c=1)}return s&&i&&(t.finalTextSeen=!0),Mr(t,Nr(e,t.artifactOptions)),(zs(e)||Ws(e)||Js(e)||i)&&n({sessionId:r,update:{sessionUpdate:"runtime_event",event:Ur(e)}}),{textCount:o,finalTextCount:c,thoughtCount:l}}function oe(e,t,r,n,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0,textCount:0,finalTextCount:0,thoughtCount:0};let i=e.artifacts.size,o=0,c=0,l=0,d=0,f=Gs(t,r,s);if(f){let p=Math.min(t.processedLines.get(f.path)||0,f.events.length),m=e.artifacts.size;for(let g of f.events.slice(p)){let y=Xs(g,e,r,n);c+=y.textCount,l+=y.finalTextCount,d+=y.thoughtCount}t.processedLines.set(f.path,f.events.length),(f.events.length>p||e.artifacts.size>m)&&(o=1)}return{artifactCount:e.artifacts.size-i,transcriptCount:o,textCount:c,finalTextCount:l,thoughtCount:d}}function Ys(e,{remove:t=!0}={}){if(!e||!Or(e))return"";try{return xr(e,"utf8").trim()}catch{return""}finally{t&&Ut(e)}}function Ut(e){if(e)try{cs(e)}catch{}}function Zs(e,t){return{artifactCount:(e?.artifactCount||0)+(t?.artifactCount||0),transcriptCount:(e?.transcriptCount||0)+(t?.transcriptCount||0),textCount:(e?.textCount||0)+(t?.textCount||0),finalTextCount:(e?.finalTextCount||0)+(t?.finalTextCount||0),thoughtCount:(e?.thoughtCount||0)+(t?.thoughtCount||0)}}function Qs(e){return new Promise(t=>setTimeout(t,e))}function ti(e,t,r,n){return n?(e.finalTextSeen=!0,e.emittedTexts.has(n)||(e.emittedTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}})),!0):!1}async function ei(e,t,r,n,s,i){let o=oe(e,t,r,n,Date.now()),c=()=>ti(e,r,n,Ys(s,{remove:!1}));if(c()||e.finalTextSeen)return Ut(s),o;let l=Is(i);if(l<=0||!t&&!s)return Ut(s),o;let d=Date.now()+l,f=Math.min(Pr(i),100);for(;!e.finalTextSeen&&Date.now()<d&&(await Qs(Math.min(f,Math.max(0,d-Date.now()))),o=Zs(o,oe(e,t,r,n,Date.now())),!c()););return Ut(s),o}var Lt=class{constructor(t,r,n={}){this.agent=t,this.target=r,this.options=n,this.active=new Map}async sessionNew(){return{sessionId:`cli-${this.agent.agentId}-${rt()}`}}async sessionPrompt(t,r,n){let s=Date.now(),i=a(this.target.command);if(!i)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let o=a(t.sessionId)||rt(),c=Ot(t.prompt),l=a(this.target.promptMode||"stdin"),d=this.buildArgs(l,c),f=tt(this.target,this.agent.workspace),p=typeof this.options.prepareLaunch=="function",g=ws(i,d,this.target)?p?`/tmp/orcha-runtime-last-message-${rt()}.txt`:H(Ar(),`orcha-runtime-last-message-${rt()}.txt`):"";g&&d.push("--output-last-message",g);let y={...u(this.target.env)?this.target.env:{},...l==="env"?{ORCHA_RUNTIME_PROMPT:c}:{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:o},I=p?await this.options.prepareLaunch({command:i,args:d,cwd:f,environment:y}):{command:i,args:d,cwd:f,environment:{...process.env,...y},cleanup:async()=>{}},b=p?Ps(I):Us(this.target,o),T=b.root,R=Ls(this.target,T,I),S=Os(i,this.target),A={...this.target,targetCode:this.agent.targetCode,cwd:f,...p?{codexHome:H(I.homeDirectory,".codex")}:{}},U=S?Hs(A,s):new Set,K=p&&g?H(I.tempDirectory,g.slice(5)):g,L=_(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,_(this.options.sessionPromptTimeoutMs,ds));p||(I.environment.ORCHA_RUNTIME_ARTIFACT_DIR=T);let w=wr(I.command,I.args,{cwd:I.cwd,env:I.environment,stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(o,w),h("info","runtime.cli","runtime prompt started",{target:this.agent.targetCode,sessionId:o,pid:w.pid,timeoutMs:L,isolation:I.isolation});let Y="",at=a(this.target.outputMode||"text"),N={artifacts:new Map,emittedTexts:new Set,emittedThoughtTexts:new Set,value:"",artifactOptions:R,finalTextSeen:!1,finalTextOnly:bs(t,this.target),emitThoughtChunks:As(t,this.target),terminalOutcome:null,terminalProtocol:Rs(this.target),emitTerminal:null},Jt=S?Ms(A,c,s,U):null;return w.stdout.setEncoding("utf8"),w.stdout.on("data",Z=>this.handleStdout(Z,at,N,o,r)),w.stderr.setEncoding("utf8"),w.stderr.on("data",Z=>{Y+=Z,this.target.emitStderr===!0&&r({sessionId:o,update:{sessionUpdate:"runtime_stderr_chunk",content:{type:"text",text:Z}}})}),l==="stdin"?w.stdin.end(c):w.stdin.end(),await new Promise((Z,Xt)=>{let ct=!1,tr=!1,St=null,ut=null,Yt=Jt&&xs(this.target,t)?setInterval(()=>{try{oe(N,Jt,o,r)}catch(O){h("warn","runtime.cli","codex transcript stream poll failed",{target:this.agent.targetCode,sessionId:o,error:String(O?.message||O)})}},Pr(this.target)):null;Yt?.unref?.();let er=setTimeout(()=>{tr=!0,h("warn","runtime.cli","runtime prompt timed out; terminating child",{target:this.agent.targetCode,sessionId:o,pid:w.pid,timeoutMs:L}),Pt(w,"SIGTERM"),St=setTimeout(()=>{h("warn","runtime.cli","runtime prompt force killing child",{target:this.agent.targetCode,sessionId:o,pid:w.pid}),Pt(w,"SIGKILL")},Cr),St.unref?.(),lt(Object.assign(new Error(`runtime CLI timed out after ${L}ms`),{code:"RUNTIME_CLI_TIMEOUT"}))},L);er.unref?.();let rr=async()=>{clearTimeout(er),ut&&clearTimeout(ut),Yt&&clearInterval(Yt),St&&!tr&&clearTimeout(St),ks(b,{target:this.agent.targetCode,sessionId:o}),this.active.delete(o),N.emitTerminal=null,await I.cleanup?.()},Nn=O=>{ct||(ct=!0,rr().then(()=>Z(O),Xt))},lt=O=>{ct||(ct=!0,rr().then(()=>Xt(O),F=>{h("warn","runtime.cli","sandbox launch cleanup failed",{target:this.agent.targetCode,sessionId:o,error:String(F?.message||F)}),Xt(O)}))};N.emitTerminal=O=>{let F={...u(O.result)?O.result:{},_artifacts:[...N.artifacts.values()]};try{n?.({...O,result:F})}catch(V){h("warn","runtime.cli","runtime terminal listener failed",{target:this.agent.targetCode,sessionId:o,error:String(V?.message||V)})}let v=Math.max(0,_(this.target.terminalExitGraceMs,_s));ut=setTimeout(()=>{ut=null,!(ct||this.active.get(o)!==w)&&(h("warn","runtime.cli","runtime stayed alive after terminal event; terminating child",{target:this.agent.targetCode,sessionId:o,pid:w.pid,terminalProtocol:N.terminalProtocol,graceMs:v}),ne(w))},v),ut.unref?.()},w.on("error",O=>{h("warn","runtime.cli","runtime child error",{target:this.agent.targetCode,sessionId:o,pid:w.pid,error:String(O?.message||O)}),lt(O)}),w.on("exit",(O,F)=>{(async()=>{at==="json-lines"&&N.value.trim()&&this.handleStdout(`
 `,at,N,o,r);let v=await ei(N,Jt,o,r,K,this.target);(v.artifactCount>0||v.textCount>0||v.thoughtCount>0)&&h("info","runtime.cli","codex transcript updates collected",{target:this.agent.targetCode,sessionId:o,artifactCount:v.artifactCount,textCount:v.textCount,finalTextCount:v.finalTextCount,thoughtCount:v.thoughtCount,transcriptCount:v.transcriptCount});let V=Y.trim();if(V&&h("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:o,stderr:V}),h("info","runtime.cli","runtime prompt finished",{target:this.agent.targetCode,sessionId:o,pid:w.pid,exitCode:O,signal:F,artifactCount:N.artifacts.size,finalTextSeen:N.finalTextSeen}),N.terminalOutcome?.status==="failed"){lt(N.terminalOutcome.error);return}if(O!==0&&N.terminalOutcome?.status!=="completed"){let Mn=Object.assign(new Error(`runtime CLI exited with code ${O??"unknown"}${F?` (${F})`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:O,signal:F});lt(Mn);return}Nn({stopReason:"end_turn",exitCode:O,signal:F,_artifacts:[...N.artifacts.values()],...V?{stderr:V}:{}})})().catch(lt)})})}buildArgs(t,r){let n=C(this.target.args);return t==="args"?[...n,r]:n}handleStdout(t,r,n,s,i){if(r!=="json-lines"){i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:t}}});return}n.value+=t;let o=n.value.split(/\r?\n/);n.value=o.pop()||"";for(let c of o){let l=c.trim();if(l)try{let d=JSON.parse(l);Mr(n,Nr(d,n.artifactOptions)),i({sessionId:s,update:{sessionUpdate:"runtime_event",event:Ur(d)}});let f=br(d),p=ce(d);f&&n.emitThoughtChunks&&!p&&Es(d)?Lr(n,s,i,f):f&&Ns(n,p)&&kr(n,s,i,f),f&&p&&(n.finalTextSeen=!0);let m=Ss(d,n.terminalProtocol);m&&!n.terminalOutcome&&(m.status==="failed"||n.finalTextSeen||n.artifacts.size>0)&&(n.terminalOutcome=m,n.emitTerminal?.(m))}catch{i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:`${c}
-`}}})}}}async sessionCancel(t){let r=a(t.sessionId),n=this.active.get(r);return n?(h("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),ne(n),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}stop(t="stop"){for(let[r,n]of this.active.entries())h("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),ne(n);this.active.clear()}};var le="ORCHA_RUNTIME_OUTPUT_START",de="ORCHA_RUNTIME_OUTPUT_END",fe="ORCHA_RUNTIME_CONTROL_START",pe="ORCHA_RUNTIME_CONTROL_END",me=le,he=de,ge=fe,_e=pe,Te=[le,de,fe,pe],ri=new Set(["_artifacts","_decision","_meta"]),ni=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${Te.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),P=class extends Error{constructor(t,r,n){super(r),this.name="RuntimeResultProtocolError",this.code=t,this.detail={rawOutput:n}}};function Br(e){let t=typeof e=="string"?e.trimStart():"";return Te.some(r=>t.startsWith(r))}function ye(e){if(typeof e!="string")return null;let t=e,r=si(t);if(![...r.values()].some(g=>g.length>0))return null;let n=[],s=[];for(let[g,y]of r)y.length===0?n.push(g):y.length>1&&s.push(g);if(n.length>0||s.length>0){let g=[];throw n.length>0&&g.push(`\u7F3A\u5C11 ${n.join(", ")}`),s.length>0&&g.push(`\u91CD\u590D ${s.join(", ")}`),new P("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${g.join("\uFF1B")}`,t)}let i=r.get(le)[0],o=r.get(de)[0],c=r.get(fe)[0],l=r.get(pe)[0];if(!(i.end<=o.start&&o.end<=c.start&&c.end<=l.start))throw new P("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757",t);let d=ii(t.slice(i.end,o.start));if(!d.trim())throw new P("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let f=t.slice(c.end,l.start).trim();if(!f)throw new P("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let p;try{p=JSON.parse(f)}catch(g){throw new P("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(g?.message||g)}`,t)}if(!$r(p))throw new P("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61",t);let m=Object.keys(p).filter(g=>!ri.has(g)).sort();if(m.length>0)throw new P("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${m.join(", ")}`,t);if("_artifacts"in p&&!Array.isArray(p._artifacts))throw new P("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4",t);for(let g of["_decision","_meta"])if(g in p&&!$r(p[g]))throw new P("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${g} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`,t);return{output:d,...p}}function si(e){let t=new Map(Te.map(r=>[r,[]]));for(let r of e.matchAll(ni))t.get(r.groups.marker).push({start:r.index,end:r.index+r[0].length});return t}function ii(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",r=t?e.slice(t.length):e;return t&&r.endsWith(t)?r.slice(0,-t.length):r}function $r(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as oi}from"node:crypto";var ai="orcha.goal-contract/v1",ci=new Set(["complete","completed","done","ok","passed","success","succeeded"]),ui=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),li=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function we(e){return oi("sha256").update(B(e)).digest("hex")}function jr(e){if(!Gr(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
-`)}function Kr(e,t,r=""){if(!Gr(e))return e==null?null:{required:!0,status:"failed",outcome:a(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let n=we(e),s=e.verificationPlan.required===!0;if(a(r)&&a(r)!==n)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:n,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:n,checks:[]};let i=di(t),o=e.verificationPlan.checks.map(l=>Ti(l,i));return{required:!0,status:o.some(l=>l.status==="failed")?"failed":o.some(l=>l.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:n,checks:o}}function Gr(e){if(!u(e)||e.schemaVersion!==ai||!a(e.outcome))return!1;let t=e.verificationPlan;if(!u(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let r=new Set;for(let n of t.checks)if(!u(n)||!a(n.id)||r.has(a(n.id))||(r.add(a(n.id)),!Array.isArray(n.toolNames)||n.toolNames.length===0||n.toolNames.some(s=>!a(s)))||n.arguments!==void 0&&!u(n.arguments))return!1;return!0}function di(e){let t=new Map,r=[];for(let n of Array.isArray(e)?e:[]){let s=u(n?.update)?n.update:{},i=a(s.sessionUpdate);if(i==="runtime_event"){fi(s.event,t,r);continue}if(i==="tool_call"){let o=vt(s)||`tool-${r.length+1}`,c=Dt(t,r,o),l=Se(s,s.name||s.toolName||s.kind);c.toolName=l.toolName,c.arguments=l.arguments,c.status=gt(s.status),c.evidence=Ft(s);continue}if(i==="tool_call_update"){let o=vt(s);if(!o)continue;let c=Dt(t,r,o),l=Se(s,s.name||s.toolName||s.kind);c.toolName||=l.toolName,Object.keys(c.arguments).length===0&&(c.arguments=l.arguments),c.status=gt(s.status),c.evidence.push(...Ft(s))}}return r}function fi(e,t,r){let n=u(e)&&u(e.payload)?e.payload:u(e)?e:{},s=a(n.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let c=vt(n)||`runtime-${r.length+1}`,l=Dt(t,r,c),d=Se(n,n.name||n.tool||s,s);l.toolName=d.toolName,l.arguments=d.arguments,l.status=gt(n.status),l.evidence.push(...Ft(n));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=vt(n);if(!i)return;let o=Dt(t,r,i);o.status=gi(n,o.toolName),o.evidence.push(...Ft(n))}function Dt(e,t,r){let n=e.get(r);return n||(n={toolCallId:r,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(r,n),t.push(n)),n}function pi(e){let t=a(e).toLowerCase();return li.get(t)||t}function Se(e,t,r=""){let n=mi(e),s=a(r)==="mcp_tool_call"||a(e?.kind).toLowerCase()==="mcp",i=u(e?._meta)?e._meta:{},o=a(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let c=a(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...n,...c?{operationCode:c}:{}}}}return{toolName:pi(t),arguments:n}}function vt(e){return u(e)?a(e.call_id||e.callId||e.toolCallId||e.id):""}function mi(e){if(!u(e))return{};for(let r of["arguments","args","rawInput","input","params","parameters"]){let n=hi(e[r]);if(n)return n}let t={};for(let r of["cmd","command","cwd","operationCode","path","query","url"])e[r]!==void 0&&(t[r]=e[r]);return t}function hi(e){if(u(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return u(t)?t:null}catch{return null}}function gi(e,t){if(!u(e))return"unknown";let r=Ht(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return r.includes("failed")?"failed":r.includes("success")?"success":"unknown"}function Ht(e,t=0,r={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return _i(e,t,r);if(Array.isArray(e))return e.flatMap(o=>Ht(o,t+1,r));if(!u(e))return[];let n=[];typeof e.isError=="boolean"&&n.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&n.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&n.push(e.success?"success":"failed");let s=gt(e.status);s!=="unknown"&&n.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&n.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&n.push(...Ht(e[o],t+1,r));return n}function _i(e,t,r){let n=e.trim();if(!n)return[];try{return Ht(JSON.parse(n),t+1,r)}catch{}if(r.parseCliExitCode!==!0)return[];let s=[];for(let i of n.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function gt(e){let t=a(e).toLowerCase();return ci.has(t)?"success":ui.has(t)?"failed":"unknown"}function Ft(e){if(!u(e))return[];let t=u(e.output)?e.output:{},r=[e.verificationEvidence,u(e.verification)?e.verification.evidence:null,t.verificationEvidence,u(t.verification)?t.verification.evidence:null],n=[];for(let s of r)for(let i of Array.isArray(s)?s:s?[s]:[])!u(i)||!a(i.id)||n.push({id:a(i.id),status:gt(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...a(i.message)?{message:a(i.message)}:{}});return n}function Ti(e,t){let r=t.filter(o=>e.toolNames.includes(o.toolName)&&Ee(e.arguments||{},o.arguments)),n=a(e.evidenceId),s=r.find(o=>o.status==="success"&&(!n||o.evidence.some(c=>c.id===n&&c.status==="success")));if(s)return Re(e,"passed",s,"Runtime tool evidence passed.");let i=r.find(o=>o.status==="failed"||n&&o.evidence.some(c=>c.id===n&&c.status==="failed"));return i?Re(e,"failed",i,"Runtime tool evidence failed."):Re(e,"missing",r.at(-1),n?"Required evidence is missing.":"Required tool execution is missing.")}function Re(e,t,r,n){return{id:e.id,status:t,message:n,...a(e.description)?{description:a(e.description)}:{},toolNames:e.toolNames,...u(e.arguments)?{arguments:e.arguments}:{},...a(e.evidenceId)?{evidenceId:a(e.evidenceId)}:{},...r?.toolCallId?{toolCallId:r.toolCallId}:{}}}function Ee(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((r,n)=>Ee(r,t[n])):u(e)?u(t)?Object.entries(e).every(([r,n])=>Object.hasOwn(t,r)&&Ee(n,t[r])):!1:Object.is(e,t)}function B(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return qr(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,r)=>{if(!Object.hasOwn(e,r))throw new Error("invalid_jcs_json_value");return B(e[r])}).join(",")}]`;if(u(e))return`{${Object.keys(e).sort().map(t=>`${qr(t)}:${B(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function qr(e){return yi(e),JSON.stringify(e)}function yi(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(r>=56320&&r<=57343)throw new Error("invalid_jcs_unicode")}}import{spawn as Ri}from"node:child_process";import{createHash as Si,randomUUID as Ei}from"node:crypto";import{constants as wi}from"node:fs";import{access as Oi,mkdir as Oe,readdir as Ii,realpath as _t,rm as xi,stat as Ai}from"node:fs/promises";import Ci from"node:http";import{tmpdir as bi}from"node:os";import{isAbsolute as Tt,join as nt,relative as Vr,resolve as xe}from"node:path";var Ae=1,Ni="orcha.process-isolation/v1",Ce="orcha.egress-proxy/v1",Mi="--disable-wasm-trap-handler",$t={read_only:0,workspace_write:1,workspace_network:2},Ie={read_only:["read_only","denied"],workspace_write:["workspace_write","denied"],workspace_network:["workspace_write","restricted"]},Ui=new Set([".env",".git-credentials",".netrc",".npmrc",".pypirc","credentials.json","secrets.json","id_rsa","id_ed25519"]);function W(e){if(!u(e))throw E("RUNTIME_SANDBOX_POLICY_REQUIRED","sandboxPolicy is required");let t=structuredClone(e),r=a(t.accessMode),n=a(t.accessModeCeiling);if(!(r in Ie)||!(n in Ie))throw E("RUNTIME_SANDBOX_POLICY_INVALID","unsupported runtime access mode");if($t[r]>$t[n])throw E("RUNTIME_SANDBOX_POLICY_INVALID","access mode exceeds its ceiling");let[s,i]=Ie[r];if(t.filesystemMode!==s||t.networkMode!==i)throw E("RUNTIME_SANDBOX_POLICY_INVALID","runtime access profile does not match its mode");if(Number(t.policySchemaVersion)!==Ae||!Number.isInteger(Number(t.policyRevision))||Number(t.policyRevision)<1)throw E("RUNTIME_SANDBOX_POLICY_INVALID","unsupported sandbox policy schema or revision");for(let[c,l]of Object.entries({outsideWorkspaceAccess:"denied",hostAccess:"denied",hostEnvironmentAccess:"denied",dockerSocketAccess:"denied",environmentMode:"allowlist"}))if(t[c]!==l)throw E("RUNTIME_SANDBOX_POLICY_INVALID",`${c} cannot be relaxed`);let o=u(t.processIsolation)?t.processIsolation:{};if(o.mode!=="required"||o.backend==="direct")throw E("RUNTIME_SANDBOX_POLICY_INVALID","strong process isolation is required");if(Array.isArray(t.alwaysApprovedApprovalKeys)&&t.alwaysApprovedApprovalKeys.length)throw E("RUNTIME_SANDBOX_POLICY_INVALID","persistent runtime approvals are forbidden");return t}function zr(e,t){let r=W(e),n=W(t);return $t[n.accessMode]<$t[r.accessMode]}async function Wr(e){if(!e.sandboxRequired)return{dispatchable:!0,enforced:!1,backend:"direct",daemonStatus:"not_required",daemonProtocolVersion:"",policySchemaVersions:[Ae],runtimePolicyUpdates:!1,workspaceSync:!1,egressProxy:!1,reason:"external_runtime_sandbox_not_required"};let t=await Xr(e.sandboxBrokerCommand,process.env.PATH||"");if(!t)throw E("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let r=await vi(t,C(e.sandboxBrokerArguments),e.sandboxProbeTimeoutMs);if(r.enforced!==!0||a(r.protocolVersion)!=="orcha.runtime-sandbox-broker/v1"||!["bubblewrap","broker"].includes(a(r.backend)))throw E("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker did not report enforced isolation");let n=u(r.probes)?r.probes:{};for(let s of["emptyRoot","outsideWorkspaceDenied","hostFilesystemDenied","sensitiveFilesDenied","environmentAllowlist","dockerSocketDenied","networkNamespace","workspaceReadOnly","workspaceWrite","resourceLimits"])if(n[s]!==!0)throw E("RUNTIME_SANDBOX_UNAVAILABLE",`sandbox broker probe failed: ${s}`);return e.egressProxyRequired&&await $i(e),{dispatchable:!0,enforced:!0,backend:a(r.backend),daemonStatus:"ok",daemonProtocolVersion:a(r.protocolVersion||"orcha.runtime-sandbox-broker/v1"),policySchemaVersions:[Ae],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:e.egressProxyRequired}}async function be(e,t,r){let n=a(t.workspace||t.cwd),s=a(r),i=n||(t.allowRequestWorkspace===!0?s:"");if(!i||!Tt(i))throw E("RUNTIME_WORKSPACE_NOT_CONFIGURED","runtime target must configure an absolute trusted workspace");let o=await _t(i);if(!(await Ai(o)).isDirectory())throw E("RUNTIME_WORKSPACE_INVALID","runtime workspace is not a directory");if(!(e.trustedWorkspaceRoots.length?await Promise.all(e.trustedWorkspaceRoots.map(d=>_t(d))):[o]).some(d=>Me(d,o)))throw E("RUNTIME_WORKSPACE_OUTSIDE_TRUSTED_ROOT","runtime workspace is outside trusted roots");return o}async function Jr({config:e,target:t,command:r,args:n,cwd:s,environment:i,runId:o,agentId:c,sessionId:l,sandboxPolicy:d}){if(!e.sandboxRequired)return{command:r,args:[...n],cwd:s,environment:{...process.env,...i},tempDirectory:"",isolation:{enforced:!1,backend:"development_direct"},cleanup:async()=>{}};let f=W(d),p=await be(e,t,s),m=await _t(s);if(!Me(p,m))throw E("RUNTIME_WORKSPACE_CWD_INVALID","runtime cwd is outside its workspace");let g=await Xr(e.sandboxBrokerCommand,process.env.PATH||"");if(!g)throw E("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let y=`runtime-${Si("sha256").update(String(o)).digest("hex").slice(0,32)}`,I=xe(e.sandboxTempRoot||nt(bi(),"orcha-runtime-sandboxes"));await Oe(I,{recursive:!0,mode:448});let b=nt(I,`${y}-${Ei()}`),T=nt(b,"home"),R=nt(b,"artifacts");await Oe(T,{recursive:!0,mode:448}),await Oe(R,{recursive:!0,mode:448});let S=f.networkMode==="restricted"?await Hi(e,{runId:String(o),instanceId:y,policyRevision:Number(f.policyRevision),ttlMs:Math.min(_(f.maxRuntimeSeconds,900)*1e3,e.egressGrantMaxTtlMs),maxTransferBytes:_(f.maxNetworkBytes,64*1024*1024)}):null,A={PATH:a(i.PATH||process.env.PATH),LANG:a(i.LANG||process.env.LANG||"C.UTF-8"),HOME:"/tmp/home",TMPDIR:"/tmp",USER:"orcha",LOGNAME:"orcha",SHELL:"/bin/sh",ORCHA_AGENT_ID:String(c),ORCHA_SESSION_ID:String(l),ORCHA_RUN_ID:String(o),ORCHA_RUNTIME_ARTIFACT_DIR:"/tmp/artifacts",...ki(t,i)};A.HOME="/tmp/home",A.TMPDIR="/tmp",A.ORCHA_RUNTIME_ARTIFACT_DIR="/tmp/artifacts",A.NODE_OPTIONS=Mi;let U={schemaVersion:Ni,runId:String(o),instanceId:y,workspace:p,cwd:m,filesystemMode:f.filesystemMode,networkMode:f.networkMode,environmentMode:"allowlist",deniedRelativePaths:await Li(p),temporaryDirectory:b,egressProxy:S,environment:A,resourceLimits:Di(f),readOnlyToolchainRoots:await Pi(e,t)},K=!1,L=async()=>{if(!K){K=!0;try{S&&await Fi(e,S,{runId:String(o),instanceId:y})}finally{await xi(b,{recursive:!0,force:!0})}}};return{command:g,args:[...C(e.sandboxBrokerArguments),"--",r,...n],cwd:m,environment:{PATH:process.env.PATH||"",LANG:process.env.LANG||"C.UTF-8",ORCHA_PROCESS_ISOLATION_REQUEST:JSON.stringify(U)},tempDirectory:b,homeDirectory:T,artifactDirectory:R,pathMappings:[{runtimeRoot:"/tmp/artifacts",hostRoot:R},{runtimeRoot:"/tmp/home",hostRoot:T}],isolation:{enforced:!0,backend:"broker",instanceId:y,policyRevision:f.policyRevision},cleanup:L}}async function Pi(e,t){let r=C(t.toolchainRoots||t.sandboxToolchainRoots);if(!r.length)return[];let n=await Promise.all(C(e.trustedToolchainRoots).map(i=>_t(i)));if(!n.length)throw E("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","target toolchain roots require ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS");let s=[];for(let i of r){if(!Tt(i))throw E("RUNTIME_TOOLCHAIN_ROOT_INVALID","toolchain roots must be absolute");let o=await _t(i);if(!n.some(c=>Me(c,o)))throw E("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","toolchain root is outside trusted roots");s.push(o)}return[...new Set(s)]}function ki(e,t){let r=u(e.env)?e.env:{},n={};for(let[s,i]of Object.entries(r))/^[A-Za-z_][A-Za-z0-9_]*$/.test(s)&&i!=null&&(n[s]=String(i));for(let s of["ORCHA_RUNTIME_PROMPT","ORCHA_RUNTIME_ARTIFACT_DIR"])t[s]!=null&&(n[s]=String(t[s]));return n}async function Li(e){let t=[],r=0,n=async s=>{let i;try{i=await Ii(s,{withFileTypes:!0})}catch(o){if(s===e)throw o;return}for(let o of i){if(r+=1,r>1e4)throw E("RUNTIME_WORKSPACE_SCAN_LIMIT_EXCEEDED","workspace contains more than 10000 entries");let c=nt(s,o.name),l=Vr(e,c),d=o.name.toLowerCase();(Ui.has(d)||d.startsWith(".env."))&&t.push(l),o.isDirectory()&&!o.isSymbolicLink()&&await n(c)}};return await n(e),t.sort()}function Di(e){return{maxCpuSeconds:Math.max(1,_(e.maxRuntimeSeconds,900)),maxMemoryBytes:_(e.maxMemoryBytes,2*1024*1024*1024),maxProcesses:_(e.maxProcesses,128),maxOpenFiles:_(e.maxOpenFiles,1024),maxFileBytes:_(e.maxFileBytes,64*1024*1024)}}async function vi(e,t,r){return await new Promise((n,s)=>{let i=Ri(e,[...t,"--probe"],{env:{PATH:process.env.PATH||"",LANG:"C.UTF-8"},stdio:["ignore","pipe","pipe"],windowsHide:!0}),o=[],c=[];i.stdout.on("data",d=>o.push(Buffer.from(d))),i.stderr.on("data",d=>c.push(Buffer.from(d)));let l=setTimeout(()=>i.kill("SIGKILL"),Math.max(1e3,r));i.once("error",s),i.once("close",d=>{if(clearTimeout(l),d!==0){s(E("RUNTIME_SANDBOX_UNAVAILABLE",Buffer.concat(c).toString("utf8").trim()||`sandbox probe exited with ${d}`));return}try{n(JSON.parse(Buffer.concat(o).toString("utf8")))}catch{s(E("RUNTIME_SANDBOX_UNAVAILABLE","sandbox probe returned invalid JSON"))}})})}async function Xr(e,t){let r=a(e);if(!r)return"";let n=Tt(r)?[r]:String(t||"").split(":").filter(Boolean).map(s=>nt(s,r));for(let s of n)try{return await Oi(s,wi.X_OK),s}catch{}return""}async function Hi(e,t){if(!e.egressProxyRequired)throw E("RUNTIME_EGRESS_UNAVAILABLE","restricted network requires the Egress Proxy");let r=await Ne(e,"POST","/v1/grants",{protocolVersion:Ce,...t}),n={socketPath:e.egressProxySocket,grantId:a(r.grantId),credential:a(r.credential)};if(!n.grantId||!n.credential)throw E("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy returned an invalid grant");return n}async function Fi(e,t,r){await Ne(e,"POST",`/v1/grants/${encodeURIComponent(t.grantId)}/revoke`,{protocolVersion:Ce,...r}).catch(()=>{})}async function $i(e){let t=await Ne(e,"GET","/health");if(t.status!=="ok"||t.proxy!=="orcha-egress-proxy"||t.protocolVersion!==Ce)throw E("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy is unavailable or incompatible")}async function Ne(e,t,r,n){if(!Tt(e.egressProxySocket)||!e.egressProxyToken)throw E("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy socket and token are required");return await new Promise((s,i)=>{let o=Ci.request({socketPath:e.egressProxySocket,path:r,method:t,headers:{Authorization:`Bearer ${e.egressProxyToken}`,Accept:"application/json",...n?{"Content-Type":"application/json"}:{}}},c=>{let l=[],d=0;c.on("data",f=>{d+=f.length,d>1048576?o.destroy(new Error("egress response is too large")):l.push(Buffer.from(f))}),c.once("end",()=>{try{let f=JSON.parse(Buffer.concat(l).toString("utf8")||"{}");(c.statusCode||500)>=400?i(E("RUNTIME_EGRESS_UNAVAILABLE",a(f.error)||"Egress Proxy rejected the request")):s(f)}catch(f){i(f)}})});o.once("error",i),o.setTimeout(3e3,()=>o.destroy(new Error("Egress Proxy request timed out"))),n?o.end(JSON.stringify(n)):o.end()})}function Me(e,t){let r=Vr(xe(e),xe(t));return r===""||!r.startsWith("..")&&!Tt(r)}function E(e,t){return Object.assign(new Error(t),{code:e})}var Ue=24e3,Pe=8,ke=50,Le=6e3,qi=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),ji=10*60*1e3,Ki=60*1e3,Gi=8,Vi=30*60*1e3,zi=60*1e3,Wi=1,tn=2400,Ji=new Set(["max_tokens","max_output_tokens","length"]),Xi=new Set(["agent_message_chunk","tool_call","tool_call_update"]),Yi=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions"]),Zi=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function Qi(e){if(!u(e))return{};let t={};for(let r of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let n=a(e[r]);n&&(t[r]=n)}return t}function to(e){return(Array.isArray(e)?e:[]).map(Qi).sort((t,r)=>{let n=B(t),s=B(r);return n<s?-1:n>s?1:0})}function eo(e){return!u(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(r=>u(r)&&Array.isArray(r.toolNames)&&r.toolNames.some(n=>a(n)==="plugin_operation"))}function ro(e,t,r){let n=u(e?._meta)?e._meta:{};return{...u(e)?e:{},sessionId:t,update:u(e?.update)?e.update:{},_meta:{...n,orchaAgentId:r.agentId,runtimeSessionId:r.runtimeSessionId,bridgeUpdateId:qt()}}}function k(e){return e==null||e===""?!1:typeof e=="string"?a(e)!=="":Array.isArray(e)?e.length>0:u(e)?Object.keys(e).length>0:!0}function en(e){let t=a(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return qi.has(t)}function G(e,t){let r=_(e,t);return Number.isFinite(r)&&r>0?r:t}function yt(e,t=!1){if(typeof e=="boolean")return e;let r=a(e).toLowerCase();return["true","1","yes","y","on"].includes(r)?!0:["false","0","no","n","off"].includes(r)?!1:t}function j(e){return a(e?.type||"echo")}function rn(e){let t=j(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function He(e){if(u(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function no(e){let t=String(e||"");if(Zi.test(t))return!0;let r=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return r.endsWith("token")||r.endsWith("secret")||r.endsWith("password")||r.endsWith("apikey")||r.endsWith("privatekey")||r==="authorization"||r==="cookie"||r==="jwt"||r.includes("credential")}function Fe(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=Le)return e;let r=e.length-Le;return`${e.slice(0,Le)}... [truncated ${r} characters]`}if(t>=Pe)return Array.isArray(e)?`[array truncated at depth ${Pe}, items=${e.length}]`:u(e)?`[object truncated at depth ${Pe}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let r=e.slice(0,ke).map(n=>Fe(n,t+1));return e.length>ke&&r.push(`[truncated ${e.length-ke} items]`),r}if(u(e)){let r={};for(let[n,s]of Object.entries(e))r[n]=no(n)?"[REDACTED]":Fe(s,t+1);return r}return String(e)}var so=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function io(e){if(!u(e))return e;let t={};for(let r of so)k(e[r])&&(t[r]=e[r]);return t}function oo(e){if(!u(e))return e;let t={...e};return u(t.renderedPayload)&&(t.renderedPayload=io(t.renderedPayload)),t}function ao(e){let t=u(e)?e:{},r={};k(t.metadata)&&(r.metadata=oo(t.metadata));for(let[n,s]of Object.entries(t))Yi.has(n)||n==="metadata"||k(s)&&(r[n]=s);return r}function co(e){let t=u(e)?e:{},r=u(t.metadata)?t.metadata:{},n=u(r.renderedPayload)?r.renderedPayload:{};return u(t.resultContract)?t.resultContract:u(n.resultContract)?n.resultContract:{}}function nn(e){return a(co(e).kind).toLowerCase()==="decision"}function uo(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:j(e)==="cli"}function Yr(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return yt(t,rn(e))}function lo(e,t){let r=u(e?.metadata)?{...e.metadata}:{},n=u(r._runtimeBridge)?{...r._runtimeBridge}:{},s=He(n);return r._runtimeBridge={...n,promptKind:"dispatch",finalTextOnly:uo(t),releaseAfterPrompt:s===void 0?Yr(t):yt(s,Yr(t)),requiresRuntimeResult:nn(e)},r}function fo(e){let t=ao(e);if(!k(t))return"";let r=JSON.stringify(Fe(t),null,2);if(r.length<=Ue)return r;let n=r.length-Ue;return`${r.slice(0,Ue)}
+`}}})}}}async sessionCancel(t){let r=a(t.sessionId),n=this.active.get(r);return n?(h("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),ne(n),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}stop(t="stop"){for(let[r,n]of this.active.entries())h("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),ne(n);this.active.clear()}};var le="ORCHA_RUNTIME_OUTPUT_START",de="ORCHA_RUNTIME_OUTPUT_END",fe="ORCHA_RUNTIME_CONTROL_START",pe="ORCHA_RUNTIME_CONTROL_END",me=le,he=de,ge=fe,_e=pe,Te=[le,de,fe,pe],ri=new Set(["_artifacts","_decision","_meta"]),ni=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${Te.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),P=class extends Error{constructor(t,r,n){super(r),this.name="RuntimeResultProtocolError",this.code=t,this.detail={rawOutput:n}}};function Br(e){let t=typeof e=="string"?e.trimStart():"";return Te.some(r=>t.startsWith(r))}function ye(e){if(typeof e!="string")return null;let t=e,r=si(t);if(![...r.values()].some(g=>g.length>0))return null;let n=[],s=[];for(let[g,y]of r)y.length===0?n.push(g):y.length>1&&s.push(g);if(n.length>0||s.length>0){let g=[];throw n.length>0&&g.push(`\u7F3A\u5C11 ${n.join(", ")}`),s.length>0&&g.push(`\u91CD\u590D ${s.join(", ")}`),new P("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${g.join("\uFF1B")}`,t)}let i=r.get(le)[0],o=r.get(de)[0],c=r.get(fe)[0],l=r.get(pe)[0];if(!(i.end<=o.start&&o.end<=c.start&&c.end<=l.start))throw new P("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757",t);let d=ii(t.slice(i.end,o.start));if(!d.trim())throw new P("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let f=t.slice(c.end,l.start).trim();if(!f)throw new P("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let p;try{p=JSON.parse(f)}catch(g){throw new P("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(g?.message||g)}`,t)}if(!$r(p))throw new P("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61",t);let m=Object.keys(p).filter(g=>!ri.has(g)).sort();if(m.length>0)throw new P("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${m.join(", ")}`,t);if("_artifacts"in p&&!Array.isArray(p._artifacts))throw new P("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4",t);for(let g of["_decision","_meta"])if(g in p&&!$r(p[g]))throw new P("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${g} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`,t);return{output:d,...p}}function si(e){let t=new Map(Te.map(r=>[r,[]]));for(let r of e.matchAll(ni))t.get(r.groups.marker).push({start:r.index,end:r.index+r[0].length});return t}function ii(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",r=t?e.slice(t.length):e;return t&&r.endsWith(t)?r.slice(0,-t.length):r}function $r(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as oi}from"node:crypto";var ai="orcha.goal-contract/v1",ci=new Set(["complete","completed","done","ok","passed","success","succeeded"]),ui=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),li=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function we(e){return oi("sha256").update(B(e)).digest("hex")}function jr(e){if(!Gr(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","Each check requires requiredMatches distinct successful tool call IDs; repeated updates for one call count once.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
+`)}function Kr(e,t,r=""){if(!Gr(e))return e==null?null:{required:!0,status:"failed",outcome:a(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let n=we(e),s=e.verificationPlan.required===!0;if(a(r)&&a(r)!==n)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:n,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:n,checks:[]};let i=di(t),o=e.verificationPlan.checks.map(l=>Ti(l,i));return{required:!0,status:o.some(l=>l.status==="failed")?"failed":o.some(l=>l.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:n,checks:o}}function Gr(e){if(!u(e)||e.schemaVersion!==ai||!a(e.outcome))return!1;let t=e.verificationPlan;if(!u(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let r=new Set;for(let n of t.checks)if(!u(n)||!a(n.id)||r.has(a(n.id))||(r.add(a(n.id)),!Array.isArray(n.toolNames)||n.toolNames.length===0||n.toolNames.some(s=>!a(s)))||!Number.isSafeInteger(n.requiredMatches)||n.requiredMatches<1||n.arguments!==void 0&&!u(n.arguments))return!1;return!0}function di(e){let t=new Map,r=[];for(let n of Array.isArray(e)?e:[]){let s=u(n?.update)?n.update:{},i=a(s.sessionUpdate);if(i==="runtime_event"){fi(s.event,t,r);continue}if(i==="tool_call"){let o=vt(s)||`tool-${r.length+1}`,c=Dt(t,r,o),l=Se(s,s.name||s.toolName||s.kind);c.toolName=l.toolName,c.arguments=l.arguments,c.status=gt(s.status),c.evidence=Ft(s);continue}if(i==="tool_call_update"){let o=vt(s);if(!o)continue;let c=Dt(t,r,o),l=Se(s,s.name||s.toolName||s.kind);c.toolName||=l.toolName,Object.keys(c.arguments).length===0&&(c.arguments=l.arguments),c.status=gt(s.status),c.evidence.push(...Ft(s))}}return r}function fi(e,t,r){let n=u(e)&&u(e.payload)?e.payload:u(e)?e:{},s=a(n.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let c=vt(n)||`runtime-${r.length+1}`,l=Dt(t,r,c),d=Se(n,n.name||n.tool||s,s);l.toolName=d.toolName,l.arguments=d.arguments,l.status=gt(n.status),l.evidence.push(...Ft(n));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=vt(n);if(!i)return;let o=Dt(t,r,i);o.status=gi(n,o.toolName),o.evidence.push(...Ft(n))}function Dt(e,t,r){let n=e.get(r);return n||(n={toolCallId:r,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(r,n),t.push(n)),n}function pi(e){let t=a(e).toLowerCase();return li.get(t)||t}function Se(e,t,r=""){let n=mi(e),s=a(r)==="mcp_tool_call"||a(e?.kind).toLowerCase()==="mcp",i=u(e?._meta)?e._meta:{},o=a(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let c=a(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...n,...c?{operationCode:c}:{}}}}return{toolName:pi(t),arguments:n}}function vt(e){return u(e)?a(e.call_id||e.callId||e.toolCallId||e.id):""}function mi(e){if(!u(e))return{};for(let r of["arguments","args","rawInput","input","params","parameters"]){let n=hi(e[r]);if(n)return n}let t={};for(let r of["cmd","command","cwd","operationCode","path","query","url"])e[r]!==void 0&&(t[r]=e[r]);return t}function hi(e){if(u(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return u(t)?t:null}catch{return null}}function gi(e,t){if(!u(e))return"unknown";let r=Ht(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return r.includes("failed")?"failed":r.includes("success")?"success":"unknown"}function Ht(e,t=0,r={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return _i(e,t,r);if(Array.isArray(e))return e.flatMap(o=>Ht(o,t+1,r));if(!u(e))return[];let n=[];typeof e.isError=="boolean"&&n.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&n.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&n.push(e.success?"success":"failed");let s=gt(e.status);s!=="unknown"&&n.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&n.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&n.push(...Ht(e[o],t+1,r));return n}function _i(e,t,r){let n=e.trim();if(!n)return[];try{return Ht(JSON.parse(n),t+1,r)}catch{}if(r.parseCliExitCode!==!0)return[];let s=[];for(let i of n.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function gt(e){let t=a(e).toLowerCase();return ci.has(t)?"success":ui.has(t)?"failed":"unknown"}function Ft(e){if(!u(e))return[];let t=u(e.output)?e.output:{},r=[e.verificationEvidence,u(e.verification)?e.verification.evidence:null,t.verificationEvidence,u(t.verification)?t.verification.evidence:null],n=[];for(let s of r)for(let i of Array.isArray(s)?s:s?[s]:[])!u(i)||!a(i.id)||n.push({id:a(i.id),status:gt(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...a(i.message)?{message:a(i.message)}:{}});return n}function Ti(e,t){let r=t.filter(o=>e.toolNames.includes(o.toolName)&&Ee(e.arguments||{},o.arguments)),n=a(e.evidenceId),s=r.filter(o=>o.status==="success"&&(!n||o.evidence.some(c=>c.id===n&&c.status==="success")));if(s.length>=e.requiredMatches)return Re(e,"passed",s,`Runtime tool evidence passed ${s.length} times.`);let i=r.filter(o=>o.status==="failed"||n&&o.evidence.some(c=>c.id===n&&c.status==="failed"));return s.length===0&&i.length?Re(e,"failed",i,"Runtime tool evidence failed."):Re(e,"missing",s,`Only ${s.length}/${e.requiredMatches} required tool executions passed.`)}function Re(e,t,r,n){let s=r.map(i=>i.toolCallId).filter(Boolean);return{id:e.id,status:t,message:n,...a(e.description)?{description:a(e.description)}:{},toolNames:e.toolNames,requiredMatches:e.requiredMatches,observedMatches:s.length,toolCallIds:s,...u(e.arguments)?{arguments:e.arguments}:{},...a(e.evidenceId)?{evidenceId:a(e.evidenceId)}:{}}}function Ee(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((r,n)=>Ee(r,t[n])):u(e)?u(t)?Object.entries(e).every(([r,n])=>Object.hasOwn(t,r)&&Ee(n,t[r])):!1:Object.is(e,t)}function B(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return qr(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,r)=>{if(!Object.hasOwn(e,r))throw new Error("invalid_jcs_json_value");return B(e[r])}).join(",")}]`;if(u(e))return`{${Object.keys(e).sort().map(t=>`${qr(t)}:${B(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function qr(e){return yi(e),JSON.stringify(e)}function yi(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(r>=56320&&r<=57343)throw new Error("invalid_jcs_unicode")}}import{spawn as Ri}from"node:child_process";import{createHash as Si,randomUUID as Ei}from"node:crypto";import{constants as wi}from"node:fs";import{access as Oi,mkdir as Oe,readdir as Ii,realpath as _t,rm as xi,stat as Ai}from"node:fs/promises";import Ci from"node:http";import{tmpdir as bi}from"node:os";import{isAbsolute as Tt,join as nt,relative as Vr,resolve as xe}from"node:path";var Ae=1,Ni="orcha.process-isolation/v1",Ce="orcha.egress-proxy/v1",Mi="--disable-wasm-trap-handler",$t={read_only:0,workspace_write:1,workspace_network:2},Ie={read_only:["read_only","denied"],workspace_write:["workspace_write","denied"],workspace_network:["workspace_write","restricted"]},Ui=new Set([".env",".git-credentials",".netrc",".npmrc",".pypirc","credentials.json","secrets.json","id_rsa","id_ed25519"]);function W(e){if(!u(e))throw E("RUNTIME_SANDBOX_POLICY_REQUIRED","sandboxPolicy is required");let t=structuredClone(e),r=a(t.accessMode),n=a(t.accessModeCeiling);if(!(r in Ie)||!(n in Ie))throw E("RUNTIME_SANDBOX_POLICY_INVALID","unsupported runtime access mode");if($t[r]>$t[n])throw E("RUNTIME_SANDBOX_POLICY_INVALID","access mode exceeds its ceiling");let[s,i]=Ie[r];if(t.filesystemMode!==s||t.networkMode!==i)throw E("RUNTIME_SANDBOX_POLICY_INVALID","runtime access profile does not match its mode");if(Number(t.policySchemaVersion)!==Ae||!Number.isInteger(Number(t.policyRevision))||Number(t.policyRevision)<1)throw E("RUNTIME_SANDBOX_POLICY_INVALID","unsupported sandbox policy schema or revision");for(let[c,l]of Object.entries({outsideWorkspaceAccess:"denied",hostAccess:"denied",hostEnvironmentAccess:"denied",dockerSocketAccess:"denied",environmentMode:"allowlist"}))if(t[c]!==l)throw E("RUNTIME_SANDBOX_POLICY_INVALID",`${c} cannot be relaxed`);let o=u(t.processIsolation)?t.processIsolation:{};if(o.mode!=="required"||o.backend==="direct")throw E("RUNTIME_SANDBOX_POLICY_INVALID","strong process isolation is required");if(Array.isArray(t.alwaysApprovedApprovalKeys)&&t.alwaysApprovedApprovalKeys.length)throw E("RUNTIME_SANDBOX_POLICY_INVALID","persistent runtime approvals are forbidden");return t}function zr(e,t){let r=W(e),n=W(t);return $t[n.accessMode]<$t[r.accessMode]}async function Wr(e){if(!e.sandboxRequired)return{dispatchable:!0,enforced:!1,backend:"direct",daemonStatus:"not_required",daemonProtocolVersion:"",policySchemaVersions:[Ae],runtimePolicyUpdates:!1,workspaceSync:!1,egressProxy:!1,reason:"external_runtime_sandbox_not_required"};let t=await Xr(e.sandboxBrokerCommand,process.env.PATH||"");if(!t)throw E("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let r=await vi(t,C(e.sandboxBrokerArguments),e.sandboxProbeTimeoutMs);if(r.enforced!==!0||a(r.protocolVersion)!=="orcha.runtime-sandbox-broker/v1"||!["bubblewrap","broker"].includes(a(r.backend)))throw E("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker did not report enforced isolation");let n=u(r.probes)?r.probes:{};for(let s of["emptyRoot","outsideWorkspaceDenied","hostFilesystemDenied","sensitiveFilesDenied","environmentAllowlist","dockerSocketDenied","networkNamespace","workspaceReadOnly","workspaceWrite","resourceLimits"])if(n[s]!==!0)throw E("RUNTIME_SANDBOX_UNAVAILABLE",`sandbox broker probe failed: ${s}`);return e.egressProxyRequired&&await $i(e),{dispatchable:!0,enforced:!0,backend:a(r.backend),daemonStatus:"ok",daemonProtocolVersion:a(r.protocolVersion||"orcha.runtime-sandbox-broker/v1"),policySchemaVersions:[Ae],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:e.egressProxyRequired}}async function be(e,t,r){let n=a(t.workspace||t.cwd),s=a(r),i=n||(t.allowRequestWorkspace===!0?s:"");if(!i||!Tt(i))throw E("RUNTIME_WORKSPACE_NOT_CONFIGURED","runtime target must configure an absolute trusted workspace");let o=await _t(i);if(!(await Ai(o)).isDirectory())throw E("RUNTIME_WORKSPACE_INVALID","runtime workspace is not a directory");if(!(e.trustedWorkspaceRoots.length?await Promise.all(e.trustedWorkspaceRoots.map(d=>_t(d))):[o]).some(d=>Me(d,o)))throw E("RUNTIME_WORKSPACE_OUTSIDE_TRUSTED_ROOT","runtime workspace is outside trusted roots");return o}async function Jr({config:e,target:t,command:r,args:n,cwd:s,environment:i,runId:o,agentId:c,sessionId:l,sandboxPolicy:d}){if(!e.sandboxRequired)return{command:r,args:[...n],cwd:s,environment:{...process.env,...i},tempDirectory:"",isolation:{enforced:!1,backend:"development_direct"},cleanup:async()=>{}};let f=W(d),p=await be(e,t,s),m=await _t(s);if(!Me(p,m))throw E("RUNTIME_WORKSPACE_CWD_INVALID","runtime cwd is outside its workspace");let g=await Xr(e.sandboxBrokerCommand,process.env.PATH||"");if(!g)throw E("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let y=`runtime-${Si("sha256").update(String(o)).digest("hex").slice(0,32)}`,I=xe(e.sandboxTempRoot||nt(bi(),"orcha-runtime-sandboxes"));await Oe(I,{recursive:!0,mode:448});let b=nt(I,`${y}-${Ei()}`),T=nt(b,"home"),R=nt(b,"artifacts");await Oe(T,{recursive:!0,mode:448}),await Oe(R,{recursive:!0,mode:448});let S=f.networkMode==="restricted"?await Hi(e,{runId:String(o),instanceId:y,policyRevision:Number(f.policyRevision),ttlMs:Math.min(_(f.maxRuntimeSeconds,900)*1e3,e.egressGrantMaxTtlMs),maxTransferBytes:_(f.maxNetworkBytes,64*1024*1024)}):null,A={PATH:a(i.PATH||process.env.PATH),LANG:a(i.LANG||process.env.LANG||"C.UTF-8"),HOME:"/tmp/home",TMPDIR:"/tmp",USER:"orcha",LOGNAME:"orcha",SHELL:"/bin/sh",ORCHA_AGENT_ID:String(c),ORCHA_SESSION_ID:String(l),ORCHA_RUN_ID:String(o),ORCHA_RUNTIME_ARTIFACT_DIR:"/tmp/artifacts",...ki(t,i)};A.HOME="/tmp/home",A.TMPDIR="/tmp",A.ORCHA_RUNTIME_ARTIFACT_DIR="/tmp/artifacts",A.NODE_OPTIONS=Mi;let U={schemaVersion:Ni,runId:String(o),instanceId:y,workspace:p,cwd:m,filesystemMode:f.filesystemMode,networkMode:f.networkMode,environmentMode:"allowlist",deniedRelativePaths:await Li(p),temporaryDirectory:b,egressProxy:S,environment:A,resourceLimits:Di(f),readOnlyToolchainRoots:await Pi(e,t)},K=!1,L=async()=>{if(!K){K=!0;try{S&&await Fi(e,S,{runId:String(o),instanceId:y})}finally{await xi(b,{recursive:!0,force:!0})}}};return{command:g,args:[...C(e.sandboxBrokerArguments),"--",r,...n],cwd:m,environment:{PATH:process.env.PATH||"",LANG:process.env.LANG||"C.UTF-8",ORCHA_PROCESS_ISOLATION_REQUEST:JSON.stringify(U)},tempDirectory:b,homeDirectory:T,artifactDirectory:R,pathMappings:[{runtimeRoot:"/tmp/artifacts",hostRoot:R},{runtimeRoot:"/tmp/home",hostRoot:T}],isolation:{enforced:!0,backend:"broker",instanceId:y,policyRevision:f.policyRevision},cleanup:L}}async function Pi(e,t){let r=C(t.toolchainRoots||t.sandboxToolchainRoots);if(!r.length)return[];let n=await Promise.all(C(e.trustedToolchainRoots).map(i=>_t(i)));if(!n.length)throw E("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","target toolchain roots require ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS");let s=[];for(let i of r){if(!Tt(i))throw E("RUNTIME_TOOLCHAIN_ROOT_INVALID","toolchain roots must be absolute");let o=await _t(i);if(!n.some(c=>Me(c,o)))throw E("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","toolchain root is outside trusted roots");s.push(o)}return[...new Set(s)]}function ki(e,t){let r=u(e.env)?e.env:{},n={};for(let[s,i]of Object.entries(r))/^[A-Za-z_][A-Za-z0-9_]*$/.test(s)&&i!=null&&(n[s]=String(i));for(let s of["ORCHA_RUNTIME_PROMPT","ORCHA_RUNTIME_ARTIFACT_DIR"])t[s]!=null&&(n[s]=String(t[s]));return n}async function Li(e){let t=[],r=0,n=async s=>{let i;try{i=await Ii(s,{withFileTypes:!0})}catch(o){if(s===e)throw o;return}for(let o of i){if(r+=1,r>1e4)throw E("RUNTIME_WORKSPACE_SCAN_LIMIT_EXCEEDED","workspace contains more than 10000 entries");let c=nt(s,o.name),l=Vr(e,c),d=o.name.toLowerCase();(Ui.has(d)||d.startsWith(".env."))&&t.push(l),o.isDirectory()&&!o.isSymbolicLink()&&await n(c)}};return await n(e),t.sort()}function Di(e){return{maxCpuSeconds:Math.max(1,_(e.maxRuntimeSeconds,900)),maxMemoryBytes:_(e.maxMemoryBytes,2*1024*1024*1024),maxProcesses:_(e.maxProcesses,128),maxOpenFiles:_(e.maxOpenFiles,1024),maxFileBytes:_(e.maxFileBytes,64*1024*1024)}}async function vi(e,t,r){return await new Promise((n,s)=>{let i=Ri(e,[...t,"--probe"],{env:{PATH:process.env.PATH||"",LANG:"C.UTF-8"},stdio:["ignore","pipe","pipe"],windowsHide:!0}),o=[],c=[];i.stdout.on("data",d=>o.push(Buffer.from(d))),i.stderr.on("data",d=>c.push(Buffer.from(d)));let l=setTimeout(()=>i.kill("SIGKILL"),Math.max(1e3,r));i.once("error",s),i.once("close",d=>{if(clearTimeout(l),d!==0){s(E("RUNTIME_SANDBOX_UNAVAILABLE",Buffer.concat(c).toString("utf8").trim()||`sandbox probe exited with ${d}`));return}try{n(JSON.parse(Buffer.concat(o).toString("utf8")))}catch{s(E("RUNTIME_SANDBOX_UNAVAILABLE","sandbox probe returned invalid JSON"))}})})}async function Xr(e,t){let r=a(e);if(!r)return"";let n=Tt(r)?[r]:String(t||"").split(":").filter(Boolean).map(s=>nt(s,r));for(let s of n)try{return await Oi(s,wi.X_OK),s}catch{}return""}async function Hi(e,t){if(!e.egressProxyRequired)throw E("RUNTIME_EGRESS_UNAVAILABLE","restricted network requires the Egress Proxy");let r=await Ne(e,"POST","/v1/grants",{protocolVersion:Ce,...t}),n={socketPath:e.egressProxySocket,grantId:a(r.grantId),credential:a(r.credential)};if(!n.grantId||!n.credential)throw E("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy returned an invalid grant");return n}async function Fi(e,t,r){await Ne(e,"POST",`/v1/grants/${encodeURIComponent(t.grantId)}/revoke`,{protocolVersion:Ce,...r}).catch(()=>{})}async function $i(e){let t=await Ne(e,"GET","/health");if(t.status!=="ok"||t.proxy!=="orcha-egress-proxy"||t.protocolVersion!==Ce)throw E("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy is unavailable or incompatible")}async function Ne(e,t,r,n){if(!Tt(e.egressProxySocket)||!e.egressProxyToken)throw E("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy socket and token are required");return await new Promise((s,i)=>{let o=Ci.request({socketPath:e.egressProxySocket,path:r,method:t,headers:{Authorization:`Bearer ${e.egressProxyToken}`,Accept:"application/json",...n?{"Content-Type":"application/json"}:{}}},c=>{let l=[],d=0;c.on("data",f=>{d+=f.length,d>1048576?o.destroy(new Error("egress response is too large")):l.push(Buffer.from(f))}),c.once("end",()=>{try{let f=JSON.parse(Buffer.concat(l).toString("utf8")||"{}");(c.statusCode||500)>=400?i(E("RUNTIME_EGRESS_UNAVAILABLE",a(f.error)||"Egress Proxy rejected the request")):s(f)}catch(f){i(f)}})});o.once("error",i),o.setTimeout(3e3,()=>o.destroy(new Error("Egress Proxy request timed out"))),n?o.end(JSON.stringify(n)):o.end()})}function Me(e,t){let r=Vr(xe(e),xe(t));return r===""||!r.startsWith("..")&&!Tt(r)}function E(e,t){return Object.assign(new Error(t),{code:e})}var Ue=24e3,Pe=8,ke=50,Le=6e3,qi=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),ji=10*60*1e3,Ki=60*1e3,Gi=8,Vi=30*60*1e3,zi=60*1e3,Wi=1,tn=2400,Ji=new Set(["max_tokens","max_output_tokens","length"]),Xi=new Set(["agent_message_chunk","tool_call","tool_call_update"]),Yi=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions"]),Zi=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function Qi(e){if(!u(e))return{};let t={};for(let r of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let n=a(e[r]);n&&(t[r]=n)}return t}function to(e){return(Array.isArray(e)?e:[]).map(Qi).sort((t,r)=>{let n=B(t),s=B(r);return n<s?-1:n>s?1:0})}function eo(e){return!u(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(r=>u(r)&&Array.isArray(r.toolNames)&&r.toolNames.some(n=>a(n)==="plugin_operation"))}function ro(e,t,r){let n=u(e?._meta)?e._meta:{};return{...u(e)?e:{},sessionId:t,update:u(e?.update)?e.update:{},_meta:{...n,orchaAgentId:r.agentId,runtimeSessionId:r.runtimeSessionId,bridgeUpdateId:qt()}}}function k(e){return e==null||e===""?!1:typeof e=="string"?a(e)!=="":Array.isArray(e)?e.length>0:u(e)?Object.keys(e).length>0:!0}function en(e){let t=a(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return qi.has(t)}function G(e,t){let r=_(e,t);return Number.isFinite(r)&&r>0?r:t}function yt(e,t=!1){if(typeof e=="boolean")return e;let r=a(e).toLowerCase();return["true","1","yes","y","on"].includes(r)?!0:["false","0","no","n","off"].includes(r)?!1:t}function j(e){return a(e?.type||"echo")}function rn(e){let t=j(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function He(e){if(u(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function no(e){let t=String(e||"");if(Zi.test(t))return!0;let r=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return r.endsWith("token")||r.endsWith("secret")||r.endsWith("password")||r.endsWith("apikey")||r.endsWith("privatekey")||r==="authorization"||r==="cookie"||r==="jwt"||r.includes("credential")}function Fe(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=Le)return e;let r=e.length-Le;return`${e.slice(0,Le)}... [truncated ${r} characters]`}if(t>=Pe)return Array.isArray(e)?`[array truncated at depth ${Pe}, items=${e.length}]`:u(e)?`[object truncated at depth ${Pe}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let r=e.slice(0,ke).map(n=>Fe(n,t+1));return e.length>ke&&r.push(`[truncated ${e.length-ke} items]`),r}if(u(e)){let r={};for(let[n,s]of Object.entries(e))r[n]=no(n)?"[REDACTED]":Fe(s,t+1);return r}return String(e)}var so=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function io(e){if(!u(e))return e;let t={};for(let r of so)k(e[r])&&(t[r]=e[r]);return t}function oo(e){if(!u(e))return e;let t={...e};return u(t.renderedPayload)&&(t.renderedPayload=io(t.renderedPayload)),t}function ao(e){let t=u(e)?e:{},r={};k(t.metadata)&&(r.metadata=oo(t.metadata));for(let[n,s]of Object.entries(t))Yi.has(n)||n==="metadata"||k(s)&&(r[n]=s);return r}function co(e){let t=u(e)?e:{},r=u(t.metadata)?t.metadata:{},n=u(r.renderedPayload)?r.renderedPayload:{};return u(t.resultContract)?t.resultContract:u(n.resultContract)?n.resultContract:{}}function nn(e){return a(co(e).kind).toLowerCase()==="decision"}function uo(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:j(e)==="cli"}function Yr(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return yt(t,rn(e))}function lo(e,t){let r=u(e?.metadata)?{...e.metadata}:{},n=u(r._runtimeBridge)?{...r._runtimeBridge}:{},s=He(n);return r._runtimeBridge={...n,promptKind:"dispatch",finalTextOnly:uo(t),releaseAfterPrompt:s===void 0?Yr(t):yt(s,Yr(t)),requiresRuntimeResult:nn(e)},r}function fo(e){let t=ao(e);if(!k(t))return"";let r=JSON.stringify(Fe(t),null,2);if(r.length<=Ue)return r;let n=r.length-Ue;return`${r.slice(0,Ue)}
 ... [truncated ${n} characters]`}function Be(e){if(!u(e))return"";let t=u(e.update)?e.update:e,n=(u(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function $e(e){if(!u(e))return"";let t=u(e.update)?e.update:e;return a(t.sessionUpdate)}function qe(e){if(!Array.isArray(e))return"";let t=!1,r=[],n=[],s=[],i=()=>{r.length>0&&(n.push(r),r=[])};for(let c of e){let l=$e(c),d=Be(c);if(!l){d&&s.push(d);continue}if(t=!0,l==="agent_message_chunk"){d&&r.push(d);continue}(l==="agent_thought_chunk"||l==="user_message_chunk"||l==="tool_call"||l==="tool_call_update"||l==="plan")&&i()}if(i(),!t)return st(s);let o=n[n.length-1]||[];return st(o)}function po(e){return Array.isArray(e)?e.map(Be).filter(t=>t!==""):[]}function jt(e){return Array.isArray(e)?e.some(r=>$e(r))?e.filter(r=>Xi.has($e(r))).map(Be).filter(r=>r!==""):po(e):[]}function mo(e){if(!u(e))return null;let t=u(e.update)?e.update:e;return a(t.sessionUpdate)!=="runtime_event"?null:u(t.event)?t.event:null}function ho(e){if(!u(e))return"";let t=u(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);if(r==="event_msg"){if(n==="task_complete")return a(t.last_agent_message||t.message||t.output);if(n==="agent_message"){let s=a(t.phase||t.status||t.stage).toLowerCase();if(["final_answer","final","complete","completed","done"].includes(s))return a(t.message||t.text||t.content)}}return""}function go(e){if(!Array.isArray(e))return"";for(let t=e.length-1;t>=0;t-=1){let r=ho(mo(e[t]));if(r)return r}return""}function st(e){let t="";for(let r of e){let n=String(r||"");if(n)if(!t)t=n;else if(n.length>t.length&&n.startsWith(t))t=n;else{let s=Br(n)&&!/[\r\n]$/.test(t)?`
 `:"";t+=`${s}${n}`}}return t.trim()}function _o(e){let t=String(e||"").trim();if(!t)return"";let r=t.match(/(?:^|\n)#{1,3}\s+\S/);return!r||r.index===0?t:t.slice(r.index+(t[r.index]===`
 `?1:0)).trim()}function Zr(e){let t=String(e||"").trim();if(!t)return null;try{let r=JSON.parse(t);if(u(r)&&(sn(r)||k(r._artifacts)||k(r.artifacts)||k(r._decision)||k(r._meta)))return r}catch{}return null}function Rt(e){try{return ye(e)}catch{return null}}function Bt(...e){let t=null;for(let r of e)try{if(ye(r))return}catch(n){t||=n}if(t)throw t}function De(e){let t=String(e||"").trim();if(!t)return null;let r=Rt(t);if(r)return r;let n=[...t.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)];for(let s=n.length-1;s>=0;s-=1){let i=Zr(n[s][1]);if(i)return i}if(!t.endsWith("}"))return null;for(let s=t.lastIndexOf("{");s>=0;s=t.lastIndexOf("{",s-1)){let i=Zr(t.slice(s));if(i)return i}return null}function To(e){let t=Rt(qe(e));if(t)return t;let r=jt(e);for(let n=r.length-1;n>=0;n-=1){let s=Rt(r[n]);if(s)return s}return Rt(st(r))}function sn(e){if(!u(e))return!1;if(k(e.output))return!0;for(let t of["content","text","message","summary"])if(a(e[t]))return!0;return!!(en(e.status)||a(e.error)||a(e.errorMessage))}function $(e){let t=u(e)?{...e}:{};return(!Array.isArray(t._artifacts)||t._artifacts.length===0)&&Array.isArray(t.artifacts)&&t.artifacts.length>0&&(t._artifacts=t.artifacts),delete t.artifacts,t}function yo(e){return u(e)?typeof(u(e._decision)?e._decision:u(e.decision)?e.decision:e).passed=="boolean":!1}function on(e){return u(e)?u(e._decision)&&typeof e._decision.passed=="boolean"?!0:yo(e.output):!1}function ve(e,t,r){let n=u(e)?{...e}:{};if(!k(n.output)){for(let s of["summary","message","content","text"])if(a(n[s])){n.output=a(n[s]);break}}return!k(n.output)&&a(r)&&(n.output=a(r)),{...n,_meta:{...u(n._meta)?n._meta:{},runtimeOutputSource:t,requiredRuntimeResult:!0,finalMessagePreview:a(r).slice(0,1e3)}}}var Ro=["dataUrl","dataURL","contentDataUrl","contentDataURL","contentBase64","base64","data"];function Qr(e){if(!u(e))return"";let t=u(e.content)?e.content:{},r=u(e.metadata)?e.metadata:{};return a(e.fieldKey||e.field_key||t.fieldKey||r.fieldKey)}function So(e,t){let r=u(e.content)?e.content:{},n=u(t.content)?t.content:{},s={...e,...t,content:{...r,...n},metadata:{...u(e.metadata)?e.metadata:{},...u(t.metadata)?t.metadata:{}}};for(let i of Ro)k(e[i])&&(s[i]=e[i]),k(r[i])&&(s.content[i]=r[i]);return s}function an(e,t){let r=Array.isArray(e)?e.filter(u):[],n=Array.isArray(t)?t.filter(u):[];if(!r.length)return n;if(!n.length)return r;let s=[...r],i=new Map;for(let c=0;c<r.length;c+=1){let l=Qr(r[c]),d=i.get(l)||[];d.push(c),i.set(l,d)}let o=new Map;for(let c of n){let l=Qr(c),d=o.get(l)||0;o.set(l,d+1);let f=i.get(l)?.[d];f===void 0?s.push(c):s[f]=So(s[f],c)}return s}function q(e,t,r){let n={...e,...t,_meta:{...u(e._meta)?e._meta:{},...u(t._meta)?t._meta:{},runtimeOutputSource:r}};return(Array.isArray(e._artifacts)||Array.isArray(t._artifacts))&&(n._artifacts=an(e._artifacts,t._artifacts)),n}function cn(e,t,r={}){let n=a(r.promptKind),s=r.requiresRuntimeResult===!0,i=s||n==="dispatch",o=$(e),c=typeof o.output=="string"?Rt(o.output):null;if(c)return q(o,$(c),"result_block");let l=go(t),d=l?De(l):null,f=i?To(t):null;if(sn(o))return en(o.status)||a(o.error)||a(o.errorMessage)?o:n==="dispatch"&&d?q(o,$(d),"final_event"):n==="dispatch"&&f?q(o,$(f),"updates"):!s||on(o)?o:d?q(o,$(d),"final_event"):f?q(o,$(f),"updates"):(Bt(o.output,l,st(jt(t))),ve(o,"result",o.output));if(d)return q(o,$(d),"final_event");if(f)return q(o,$(f),"updates");if(l)return s?(Bt(l,st(jt(t))),ve(o,"final_event",l)):{...o,output:l,_meta:{...u(o._meta)?o._meta:{},runtimeOutputSource:"final_event"}};let p=qe(t),m=De(p);if(m)return q(o,$(m),"updates");let g=_o(p);if(!g)return s&&Bt(st(jt(t))),o;let y=De(g);return y?q(o,$(y),"updates"):s?(Bt(p,g),ve(o,"updates",g)):{...o,output:g,_meta:{...u(o._meta)?o._meta:{},runtimeOutputSource:"updates"}}}function je(e){return u(e)?a(e.stopReason||e.stop_reason).toLowerCase():""}function un(e){return Ji.has(je(e))}function Eo(e,t,r){if(r.promptKind!=="dispatch"||r.requiresRuntimeResult!==!0||!un(e))return!1;try{return!on(cn(e,t,r))}catch{return!0}}function wo(){return["Your previous final response reached the output limit before the Runtime Result protocol was complete.","Re-emit the complete final Runtime Result from scratch using the conclusion you already reached.","Do not repeat analysis, process notes, tool calls, or task work.",`Keep the OUTPUT report within ${tn} Unicode characters.`,`Output ${me}, ${he}, ${ge}, and ${_e} on their own lines.`,"The CONTROL block must be valid JSON containing _decision and must be fully closed.","Return only the two protocol blocks."].join(`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orcha-ai/runtime-bridge",
-  "version": "0.1.35",
+  "version": "0.1.36",
   "private": false,
   "type": "module",
   "description": "Local Orcha runtime bridge for ACP-compatible agent runtimes.",