@orcha-ai/runtime-bridge 0.1.42 → 0.1.44

package/README.md

@@ -76,16 +76,16 @@ npm run build
 
 Build produces `bin/orcha-runtime-bridge.js` and the clean npm package in `dist/package`, including the OpenClaw plugin. Bridge is distributed through npm; backend images do not bundle a separate browser download.
 
-Version 0.1.42 routes replies, native `message` tool sends, and background notifications through the same Orcha IM sender, and streams native Channel tools and host-visible reasoning/process updates through the existing Orcha progress UI. The plugin sends response headers immediately and heartbeats every 15 seconds; task deadlines and transport timeouts remain explicit failures. Bridge and the bundled plugin must upgrade together: native delivery preflight and content negotiation reject the old JSON-only contract before starting a host turn. `orcha-runtime-node.v2` is unchanged. Deploying Orcha does not publish npm or upgrade connected devices automatically. Build and validate the release tarball before publishing:
+Version 0.1.44 routes replies, native `message` tool sends, and background notifications through the same Orcha IM sender, and streams native Channel tools and host-visible reasoning/process updates through the existing Orcha progress UI. The plugin sends response headers immediately and heartbeats every 15 seconds; task deadlines and transport timeouts remain explicit failures. Bridge and the bundled plugin must upgrade together: native delivery preflight and content negotiation reject the old JSON-only contract before starting a host turn. `orcha-runtime-node.v2` is unchanged. Deploying Orcha does not publish npm or upgrade connected devices automatically. Build and validate the release tarball before publishing:
 
 ```bash
 npm run pack:local
-npm publish ./dist/orcha-ai-runtime-bridge-0.1.42.tgz --access public --registry=https://registry.npmjs.org
+npm publish ./dist/orcha-ai-runtime-bridge-0.1.44.tgz --access public --registry=https://registry.npmjs.org
 ```
 
-After updating the npm package on a device, run `orcha-runtime-bridge reload --url ...` to switch the existing background process to the installed version. The earlier manually downloaded foreground process must be stopped before connecting with npm to avoid duplicate connections.
+After updating the npm package on a device, run `orcha-runtime-bridge reload --url ...` to switch the existing background process to the installed version. `reload` and `restart` also install/update the bundled plugin for OpenClaw targets saved on that device, using the target's executable and environment. Bridge stops before `openclaw plugins install <bundled-path> --force` and `openclaw gateway restart`; it starts again only after Gateway health succeeds and any configured MCP binding endpoint passes native Channel protocol preflight. Targets sharing an executable and environment update together. Installation/restart/health failures stop the command with an error and leave Bridge stopped; fix the reported problem and rerun `reload`. Package/executable preflight failures leave the existing Bridge running. The earlier manually downloaded foreground process must be stopped before connecting with npm to avoid duplicate connections.
 
-For native OpenClaw Channel use, also update the bundled OpenClaw plugin using the host's supported plugin update/reload procedure; updating Bridge alone does not update an installed Gateway plugin. Create a binding in the Orcha Agent's **消息通道** tab, merge its generated `channels.orcha.accounts` configuration into OpenClaw, and retain the existing Gateway/MCP binding configuration below. Existing ACP/CLI targets without a native binding continue using their configured execution path. Real OpenClaw host/model acceptance remains required before production use.
+Installing/updating the npm package alone does not change OpenClaw; run Bridge `reload` afterwards. Automatic plugin installation uses OpenClaw's official installer and preserves existing plugin/channel configuration. It does not create account credentials or configure MCP authorization. Create a binding in the Orcha Agent's **消息通道** tab, merge its generated `channels.orcha.accounts` configuration into OpenClaw, and retain the existing Gateway/MCP binding configuration below. A remote `mcpBridgeUrl` cannot be upgraded by the local reload command: update its plugin on the Gateway host. Source-checkout reload requires `npm run build` first to provide the self-contained plugin in `dist/package`. Existing ACP/CLI targets without a native binding continue using their configured execution path. Real OpenClaw host/model acceptance remains required before production use.
 
 Native delivery uses `application/x-orcha-channel-events-v2+ndjson` with `heartbeat`, `update`, `result`, and `error` frames. Tool events are restricted to the exact host run and honor hidden-progress flags; reasoning uses only the host's public reply callback without enabling hidden reasoning. Final text and attachments are sent through `POST /api/agent-channels/messages`; terminal frames carry only `messageIds` and status. Core validates the existing receipts and projects execution metadata onto the original reply. Core, Bridge and plugin must upgrade together; old JSON/v1 streams and body-based background completion are incompatible. Skill authors use the native `message` tool with `action: "send"`, `channel: "orcha"`, `accountId` (binding ID), `target` (session ID), and `message`/`media`. Credentials stay in the configured account. Durable queue IDs and native tool idempotency keys are persisted before sending; unknown acknowledgements reconcile through the same idempotent Core endpoint. Core persists updates under the Attempt fence and deduplicates their stable channel IDs before acknowledging them. An active plugin operation keeps at most 16 MiB of replay history; exceeding it fails explicitly. Plugin restarts cannot reconstruct an in-flight host turn and continue to fail with `RUNTIME_OPERATION_NOT_FOUND`. This release requires no database migration or new environment variables.
 
@@ -93,6 +93,14 @@ Tests cover discovery errors, paths, public-field filtering, immutable commands,
 
 To check reply classification against the real SDK without installing or starting a Gateway, extract the official `openclaw@2026.7.1` npm tarball and run `npm run test:openclaw-sdk -- /absolute/path/to/extracted/package`. This check imports the actual SDK functions, covering final text/media, reasoning, commentary, status/progress notices and TTS supplements; it does not replace a live host/model acceptance test.
 
+## Native conversation context (0.1.44)
+
+OpenClaw native Channel and device Codex conversations send only the current message and attachments. Orcha task IDs define conversation boundaries; native runtimes own history and compaction. OpenClaw session keys include the Core endpoint, binding revision, chat/task/member and history/policy scope. Codex saves the actual `thread.started.thread_id` under `~/.orcha/codex-sessions/` and uses `codex exec resume <thread-id>` for later turns. The identity also includes the endpoint, Agent, target, workspace and Codex home. It never uses `--last`. Each turn still has a separate run ID, tool credential and retry fence. Device Codex closes its temporary MCP proxy after each turn and opens a fresh one for the next.
+
+Send exactly `/new` to an Agent to create and select a new Orcha task, using the same task service as the UI. It creates no model run and is not forwarded to OpenClaw or Codex. In a group, select the Agent explicitly; send the command without attachments, plugins or skills. The existing receipt returns the new `taskContextId` with `runId:null`; clients must select that task for subsequent messages. An already running task continues independently. Other raw commands, such as `/status`, reach OpenClaw and remain subject to its own command permissions.
+
+Old Orcha history and per-run native sessions are not migrated or injected. Upgrade Core, Bridge and the bundled plugin together. A normal Bridge restart preserves completed Codex conversations. If a process crashes during a Codex turn, its durable lock remains and the affected task requires `/new`: automatically replaying a detached process could repeat side effects. Missing/mismatched native IDs and repeated run IDs fail explicitly. Keep the local Codex home and Orcha session mapping together; clearing either does not authorize silently starting over in the same task. This change adds no database migration, project environment variables or wire protocol version.
+
 ## Delegated group member tools
 
 Codex supports task-scoped Orcha MCP through the existing local transport adapter. OpenClaw additionally requires the bundled Gateway plugin, a trusted binding endpoint and Gateway authentication. Discovery/import does not install the plugin or configure these credentials. Claude Code's delegated dynamic MCP adapter remains unsupported and returns an explicit error.

package/bin/orcha-runtime-bridge.js

@@ -1,31 +1,34 @@
 #!/usr/bin/env node
-import{spawn as Da}from"node:child_process";import{closeSync as va,existsSync as Xn,mkdirSync as Ha,openSync as Fa,readFileSync as cr,rmSync as $a,statSync as Gn,writeFileSync as Yn}from"node:fs";import{dirname as Ba,resolve as dr}from"node:path";import{fileURLToPath as ja}from"node:url";import{createHash as Rr}from"node:crypto";import{mkdir as fs,readFile as ps,writeFile as hs,rename as ms}from"node:fs/promises";import{join as yr}from"node:path";import{homedir as gs,hostname as _s}from"node:os";import{execFile as is}from"node:child_process";import{access as os,realpath as as}from"node:fs/promises";import{constants as cs}from"node:fs";import{delimiter as us,join as gr,isAbsolute as _r}from"node:path";import{homedir as mr}from"node:os";async function ls(e,t=process.env){let r=process.platform==="win32"?[".exe",".cmd",".bat",""]:[""];for(let n of(t.PATH||"").split(us).filter(_r))for(let s of r){let i=gr(n,`${e}${s}`);try{return await os(i,cs.X_OK),i}catch{}}return null}function ds(e,t){return new Promise(r=>is(e,t,{timeout:8e3,maxBuffer:1024*1024,windowsHide:!0},(n,s)=>r({code:n?n.code:0,stdout:String(s||"")})))}async function ae(e){let t=e==="~"?mr():e.startsWith("~/")?gr(mr(),e.slice(2)):e;if(!_r(t))throw new Error("\u5DE5\u4F5C\u76EE\u5F55\u5FC5\u987B\u662F\u8BBE\u5907\u4E0A\u7684\u7EDD\u5BF9\u8DEF\u5F84\u6216 ~/ \u5F00\u5934\u7684\u8DEF\u5F84");let r=await as(t),{stat:n}=await import("node:fs/promises");if(!(await n(r)).isDirectory())throw new Error("\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u662F\u6587\u4EF6\u5939");return r}async function Tr({find:e=ls,run:t=ds,cwd:r=process.cwd()}={}){return(await Promise.all(["codex","claude","openclaw"].map(async s=>{let i=await e(s);if(!i)return[];let o={codex:"Codex",claude:"Claude Code",openclaw:"OpenClaw"}[s],c=await t(i,["--version"]),u=c.code===0&&c.stdout.match(/\d+\.\d+\.\d+[^\s]*/)?.[0]||"",d={id:s,name:o,framework:s,version:u,workspace:r,managed:!1};if(c.code!==0)return[{...d,status:"error",message:"\u7A0B\u5E8F\u65E0\u6CD5\u542F\u52A8\uFF0C\u8BF7\u5728\u672C\u673A\u68C0\u67E5\u5B89\u88C5"}];if(s==="openclaw"){let h=await t(i,["agents","list","--json"]),m;try{m=JSON.parse(h.stdout)}catch{}if(h.code!==0||!Array.isArray(m))return[{...d,status:"error",message:"\u65E0\u6CD5\u8BFB\u53D6 OpenClaw \u667A\u80FD\u4F53\uFF0C\u8BF7\u68C0\u67E5\u672C\u673A\u914D\u7F6E"}];let T=await t(i,["health","--json"]);return m.filter(R=>typeof R.id=="string"&&typeof R.workspace=="string").slice(0,32).map(R=>({...d,id:`openclaw:${R.id}`,name:R.name||R.identityName||R.id,workspace:R.workspace,managed:!0,localAgentId:R.id,command:i,status:T.code===0?"ready":"needs_setup",message:T.code===0?"":"\u8BF7\u5148\u5728\u672C\u673A\u542F\u52A8\u5E76\u914D\u7F6E OpenClaw Gateway"}))}let f=await t(i,s==="codex"?["login","status"]:["auth","status"]),p=f.code===0?"ready":f.code===1?"needs_login":"error";return[{...d,command:i,status:p,message:p==="needs_login"?`\u8BF7\u5728\u672C\u673A\u8FD0\u884C ${s} ${s==="codex"?"login":"auth login"}`:p==="error"?"\u767B\u5F55\u72B6\u6001\u68C0\u6D4B\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5 CLI \u7248\u672C":""}]}))).flat()}async function wr(e,t){let r=`${e}.${process.pid}.tmp`;await hs(r,JSON.stringify(t),{mode:384}),await ms(r,e)}function ue(e){let t=new URL(e);if(t.username||t.password||t.search||t.hash||t.protocol!=="https:"&&!(t.protocol==="http:"&&["localhost","127.0.0.1","[::1]"].includes(t.hostname)))throw new Error("\u8FDE\u63A5\u5730\u5740\u5FC5\u987B\u4F7F\u7528 HTTPS\uFF1B\u4EC5\u672C\u673A\u5F00\u53D1\u5141\u8BB8 HTTP");let r=yr(gs(),".orcha","devices"),n=yr(r,Rr("sha256").update(t.toString()).digest("hex").slice(0,20));return{address:t,root:r,profile:`${n}.json`,pidFile:`${n}.pid`,logFile:`${n}.log`}}async function It(e,{url:t,pairCode:r}){let{address:n,root:s,profile:i}=ue(t||e.orchaUrl);await fs(s,{recursive:!0,mode:448});let o;if(r){let c=await fetch(new URL("api/agent-devices/pairings/exchange",`${n.toString().replace(/\/+$/,"")}/`),{method:"POST",redirect:"error",headers:{"content-type":"application/json"},signal:AbortSignal.timeout(15e3),body:JSON.stringify({code:r,name:_s()})}),u=await c.json();if(!c.ok||!u.success)throw new Error(u.message||u.detail||"\u8BBE\u5907\u8FDE\u63A5\u5931\u8D25");o={...u.data,targets:{}},await wr(i,o)}else try{o=JSON.parse(await ps(i,"utf8"))}catch{throw new Error("\u6CA1\u6709\u5DF2\u8FDE\u63A5\u8BBE\u5907\uFF0C\u8BF7\u4ECE\u667A\u80FD\u4F53\u9875\u9762\u751F\u6210\u8FDE\u63A5\u7801")}e.orchaUrl=n.toString().replace(/\/+$/,""),e.mode="node",e.nodeId=o.nodeCode,e.nodeName=o.nodeName,e.nodeToken=o.token,e.targets=o.targets,e.defaultTargetCode="",e.deviceConnection=new ce(e,o,async()=>wr(i,o))}var ce=class{constructor(t,r,n,s=Tr){this.config=t,this.profile=r,this.persist=n,this.discover=s}async candidates(){return{candidates:(await this.discover()).map(({command:r,localAgentId:n,...s})=>s)}}async configure(t,r){if(!Array.isArray(t.selections)||!t.selections.length||t.selections.length>32)throw new Error("\u6DFB\u52A0\u9879\u65E0\u6548");let n=new Map((await this.discover()).map(u=>[u.id,u])),s={...r.targets},i=[],o=new Set;for(let u of t.selections){let d=n.get(u.candidateId);if(!d||d.status!=="ready"||o.has(d.id))throw new Error("\u53D1\u73B0\u7ED3\u679C\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u68C0\u6D4B");o.add(d.id);let f=String(u.name||"").trim();if(!f||f.length>128)throw new Error("\u667A\u80FD\u4F53\u540D\u79F0\u65E0\u6548");let p=await ae(String(u.workspace||""));if(d.managed&&p!==await ae(d.workspace))throw new Error("\u5DF2\u6709\u667A\u80FD\u4F53\u5FC5\u987B\u6CBF\u7528\u672C\u673A\u5DE5\u4F5C\u76EE\u5F55");let h=`${this.config.nodeId}:${Rr("sha256").update(d.id).digest("hex").slice(0,20)}`;if([...r.sessions.values()].some(m=>m.targetCode===h))throw new Error("\u6B64\u667A\u80FD\u4F53\u4ECD\u6709\u4F1A\u8BDD\uFF0C\u8BF7\u5148\u7ED3\u675F\u4F1A\u8BDD\u518D\u4FEE\u6539\u63A5\u5165");s[h]={name:f,workspace:p,command:d.command,type:d.managed?"openclaw":"cli",...d.managed?{openclawAgentId:d.localAgentId}:d.framework==="codex"?{terminalProtocol:"codex",args:["exec","--skip-git-repo-check","--json"],promptMode:"stdin",outputMode:"json-lines",captureLastMessage:!0}:{terminalProtocol:"claude",args:["-p","--output-format","json","--no-session-persistence"],promptMode:"args",outputMode:"json-lines"}},i.push({candidateId:d.id,name:f,workspace:p,targetCode:h,framework:d.framework})}let c=this.profile.targets;this.profile.targets=s;try{await this.persist()}catch(u){throw this.profile.targets=c,u}return r.targets=s,this.config.targets=s,r.notifyCapacityChanged(),{agents:i}}};import{createHash as Po,randomUUID as Jt}from"node:crypto";var et="0.1.42";function pt(){return new Date().toISOString()}function U(e,t=2){return String(e).padStart(t,"0")}function Er(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${U(Math.floor(r/60))}:${U(r%60)}`}function Ts(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${U(e.getMonth()+1)}-${U(e.getDate())}`,`T${U(e.getHours())}:${U(e.getMinutes())}:${U(e.getSeconds())}.${U(e.getMilliseconds(),3)}`,Er(t)].join("")}function ys(e,t){let r=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),n={};for(let s of r.formatToParts(e))s.type!=="literal"&&(n[s.type]=Number(s.value));return n}function ws(e,t){let r=ys(e,t),n=Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second,e.getMilliseconds()),s=Math.round((n-e.getTime())/6e4);return[`${r.year}-${U(r.month)}-${U(r.day)}`,`T${U(r.hour)}:${U(r.minute)}:${U(r.second)}.${U(e.getMilliseconds(),3)}`,Er(s)].join("")}function Rs(e=new Date){let t=a(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return ws(e,t)}catch{return Ts(e)}}function l(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function a(e){return String(e??"").trim()}function _(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)?r:t}function x(e){return Array.isArray(e)?e.map(String):[]}function rt(e,t,r=process.cwd()){let n=l(e)?e:{};return a(n.cwd)||a(n.workspace)||a(t)||a(r)||process.cwd()}var Ct="[redacted]",Es=/(authorization|api[_-]?key|credential|password|secret|token)/i;function At(e){return Es.test(a(e))}function Sr(e,t=[]){let r=String(e??"");for(let n of t){let s=String(n??"");s.length>=4&&(r=r.split(s).join(Ct))}return r.replace(/((?:authorization|api[_-]?key|credential|password|secret|token)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi,`$1${Ct}`).replace(/([?&](?:api[_-]?key|credential|password|secret|token)=)[^&\s]+/gi,`$1${Ct}`)}function W(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=W(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>W(i,t));return t.delete(e),s}let r={},n=At(e.name||e.key);for(let[s,i]of Object.entries(e))r[s]=At(s)||n&&s.toLowerCase()==="value"?Ct:W(i,t);return t.delete(e),r}function Or(e,t=4e3){let r=JSON.stringify(W(e))??String(e);return!Number.isFinite(t)||r.length<=t?r:`${r.slice(0,t)}...`}function g(e,t,r,n={}){let s={ts:Rs(),level:e,module:t,msg:r,...l(n)?W(n):{}};console.error(JSON.stringify(s))}function xt(e){return Array.isArray(e)?e.map(t=>l(t)?t.type==="text"?a(t.text):t.type==="file"?a(t.uri):t.type==="image"?a(t.uri):"":"").filter(Boolean).join(`
-`):""}var Nt=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,r){let n=xt(t.prompt);return r({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as Ss}from"node:child_process";var ht="2.0",le=3e4,Os=4e3;function bt(e,t){let r=Object.entries(l(t)?t:{}).filter(([n])=>At(n)).map(([,n])=>n);return Sr(e,r)}function Is(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,message:a(e?.message)||String(e),data:l(e?.data)?e.data:void 0}}function Cs(e){if(!l(e))return new Error(String(e||"runtime error"));let t=a(e.message)||"runtime error",r="data"in e?Or(e.data,4e3):"",n=new Error(r?`${t}; data=${r}`:t);return n.rpcCode=e.code,n.data=e.data,n}function As(e){return l(e)&&"id"in e&&!("method"in e)}function xs(e){return l(e)&&typeof e.method=="string"&&"id"in e}function Ns(e){return l(e)&&typeof e.method=="string"&&!("id"in e)}var Mt=class{constructor({command:t,args:r=[],cwd:n,env:s,label:i,framing:o="line",detached:c=!0}){this.command=t,this.args=Array.isArray(r)?r.map(String):[],this.cwd=n||process.cwd(),this.env=l(s)?{...s}:{...process.env},this.label=i||t,this.framing=o==="content-length"?"content-length":"line",this.detached=c!==!1,this.child=null,this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stopPromise=null,this.stderrTail="",this.spawnError=null,this.lineBuffer="",this.headerBuffer=Buffer.alloc(0),this.seq=0,this.pending=new Map,this.notificationHandlers=new Map,this.requestHandlers=new Map,this.exitHandlers=new Set}async start({initialize:t=!0,initializeParams:r={},initializeTimeoutMs:n=le}={}){if(!(this.child&&!this.exited)&&(this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stderrTail="",this.spawnError=null,this.child=Ss(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"],detached:this.detached}),this.child.stdout.on("data",s=>this.onStdout(s)),this.child.stderr.setEncoding("utf8"),this.child.stderr.on("data",s=>{this.stderrTail=`${this.stderrTail}${s}`.slice(-Os);let i=bt(s.trimEnd(),this.env);i&&g("debug","runtime.stderr","runtime stderr",{target:this.label,text:i})}),this.child.on("exit",(s,i)=>this.handleExit(s,i)),this.child.on("error",s=>{this.spawnError=s,this.rejectAll(s)}),t)){let s=Math.max(1,_(n,le));try{await this.call("initialize",{protocolVersion:1,clientCapabilities:{},...r},s)}catch(i){let o=this.startupFailureDetail(),c=bt(i?.message||i,this.env);g("warn","runtime.initialize","runtime initialize failed",{target:this.label,timeoutMs:s,cause:c,...o}),await this.stop("initialize failed",{termTimeoutMs:1e3,killTimeoutMs:1e3});let u=o.stderr?`; stderr: ${o.stderr}`:`; command=${o.command}; cwd=${o.cwd}`;throw Object.assign(new Error(`runtime initialize failed: ${c}${u}`,{cause:i}),{code:"RUNTIME_INITIALIZE_FAILED",detail:o})}}}startupFailureDetail(){return{command:this.command,cwd:this.cwd,exited:this.exited,exitCode:this.exitCode,exitSignal:this.exitSignal,...this.spawnError?{spawnError:bt(this.spawnError.message,this.env)}:{},...this.stderrTail.trim()?{stderr:bt(this.stderrTail.trim(),this.env)}:{}}}onStdout(t){if(this.framing==="content-length"){this.onContentLengthData(Buffer.isBuffer(t)?t:Buffer.from(t));return}this.onLineData(t.toString("utf8"))}onLineData(t){this.lineBuffer+=t;let r=this.lineBuffer.split(/\r?\n/);this.lineBuffer=r.pop()||"";for(let n of r){let s=n.trim();s&&this.dispatchRaw(s)}}onContentLengthData(t){for(this.headerBuffer=Buffer.concat([this.headerBuffer,t]);this.headerBuffer.length>0;){let r=this.headerBuffer.indexOf(`\r
+import{spawn as dc}from"node:child_process";import{closeSync as fc,existsSync as Er,mkdirSync as pc,openSync as hc,readFileSync as yr,rmSync as mc,statSync as us,writeFileSync as hs}from"node:fs";import{dirname as ms,resolve as pt}from"node:path";import{fileURLToPath as gc}from"node:url";import{createHash as Ur}from"node:crypto";import{mkdir as bs,readFile as Ms,writeFile as Us,rename as Ps}from"node:fs/promises";import{join as br}from"node:path";import{homedir as Ls,hostname as ks}from"node:os";import{execFile as Os}from"node:child_process";import{access as Is,realpath as Cs}from"node:fs/promises";import{constants as xs}from"node:fs";import{delimiter as As,join as xr,isAbsolute as Ar}from"node:path";import{homedir as Cr}from"node:os";async function pe(e,t=process.env){let r=process.platform==="win32"?[".exe",".cmd",".bat",""]:[""];for(let n of(t.PATH||"").split(As).filter(Ar))for(let s of r){let i=xr(n,`${e}${s}`);try{return await Is(i,xs.X_OK),i}catch{}}return null}function Ns(e,t){return new Promise(r=>Os(e,t,{timeout:8e3,maxBuffer:1024*1024,windowsHide:!0},(n,s)=>r({code:n?n.code:0,stdout:String(s||"")})))}async function he(e){let t=e==="~"?Cr():e.startsWith("~/")?xr(Cr(),e.slice(2)):e;if(!Ar(t))throw new Error("\u5DE5\u4F5C\u76EE\u5F55\u5FC5\u987B\u662F\u8BBE\u5907\u4E0A\u7684\u7EDD\u5BF9\u8DEF\u5F84\u6216 ~/ \u5F00\u5934\u7684\u8DEF\u5F84");let r=await Cs(t),{stat:n}=await import("node:fs/promises");if(!(await n(r)).isDirectory())throw new Error("\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u662F\u6587\u4EF6\u5939");return r}async function Nr({find:e=pe,run:t=Ns,cwd:r=process.cwd()}={}){return(await Promise.all(["codex","claude","openclaw"].map(async s=>{let i=await e(s);if(!i)return[];let o={codex:"Codex",claude:"Claude Code",openclaw:"OpenClaw"}[s],a=await t(i,["--version"]),u=a.code===0&&a.stdout.match(/\d+\.\d+\.\d+[^\s]*/)?.[0]||"",d={id:s,name:o,framework:s,version:u,workspace:r,managed:!1};if(a.code!==0)return[{...d,status:"error",message:"\u7A0B\u5E8F\u65E0\u6CD5\u542F\u52A8\uFF0C\u8BF7\u5728\u672C\u673A\u68C0\u67E5\u5B89\u88C5"}];if(s==="openclaw"){let h=await t(i,["agents","list","--json"]),m;try{m=JSON.parse(h.stdout)}catch{}if(h.code!==0||!Array.isArray(m))return[{...d,status:"error",message:"\u65E0\u6CD5\u8BFB\u53D6 OpenClaw \u667A\u80FD\u4F53\uFF0C\u8BF7\u68C0\u67E5\u672C\u673A\u914D\u7F6E"}];let y=await t(i,["health","--json"]);return m.filter(S=>typeof S.id=="string"&&typeof S.workspace=="string").slice(0,32).map(S=>({...d,id:`openclaw:${S.id}`,name:S.name||S.identityName||S.id,workspace:S.workspace,managed:!0,localAgentId:S.id,command:i,status:y.code===0?"ready":"needs_setup",message:y.code===0?"":"\u8BF7\u5148\u5728\u672C\u673A\u542F\u52A8\u5E76\u914D\u7F6E OpenClaw Gateway"}))}let f=await t(i,s==="codex"?["login","status"]:["auth","status"]),p=f.code===0?"ready":f.code===1?"needs_login":"error";return[{...d,command:i,status:p,message:p==="needs_login"?`\u8BF7\u5728\u672C\u673A\u8FD0\u884C ${s} ${s==="codex"?"login":"auth login"}`:p==="error"?"\u767B\u5F55\u72B6\u6001\u68C0\u6D4B\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5 CLI \u7248\u672C":""}]}))).flat()}async function Mr(e,t){let r=`${e}.${process.pid}.tmp`;await Us(r,JSON.stringify(t),{mode:384}),await Ps(r,e)}function ge(e){let t=new URL(e);if(t.username||t.password||t.search||t.hash||t.protocol!=="https:"&&!(t.protocol==="http:"&&["localhost","127.0.0.1","[::1]"].includes(t.hostname)))throw new Error("\u8FDE\u63A5\u5730\u5740\u5FC5\u987B\u4F7F\u7528 HTTPS\uFF1B\u4EC5\u672C\u673A\u5F00\u53D1\u5141\u8BB8 HTTP");let r=br(Ls(),".orcha","devices"),n=br(r,Ur("sha256").update(t.toString()).digest("hex").slice(0,20));return{address:t,root:r,profile:`${n}.json`,pidFile:`${n}.pid`,logFile:`${n}.log`}}async function Nt(e,{url:t,pairCode:r}){let{address:n,root:s,profile:i}=ge(t||e.orchaUrl);await bs(s,{recursive:!0,mode:448});let o;if(r){let a=await fetch(new URL("api/agent-devices/pairings/exchange",`${n.toString().replace(/\/+$/,"")}/`),{method:"POST",redirect:"error",headers:{"content-type":"application/json"},signal:AbortSignal.timeout(15e3),body:JSON.stringify({code:r,name:ks()})}),u=await a.json();if(!a.ok||!u.success)throw new Error(u.message||u.detail||"\u8BBE\u5907\u8FDE\u63A5\u5931\u8D25");o={...u.data,targets:{}},await Mr(i,o)}else try{o=JSON.parse(await Ms(i,"utf8"))}catch{throw new Error("\u6CA1\u6709\u5DF2\u8FDE\u63A5\u8BBE\u5907\uFF0C\u8BF7\u4ECE\u667A\u80FD\u4F53\u9875\u9762\u751F\u6210\u8FDE\u63A5\u7801")}e.orchaUrl=n.toString().replace(/\/+$/,""),e.mode="node",e.nodeId=o.nodeCode,e.nodeName=o.nodeName,e.nodeToken=o.token,e.targets=o.targets,e.defaultTargetCode="",e.deviceConnection=new me(e,o,async()=>Mr(i,o))}var me=class{constructor(t,r,n,s=Nr){this.config=t,this.profile=r,this.persist=n,this.discover=s}async candidates(){return{candidates:(await this.discover()).map(({command:r,localAgentId:n,...s})=>s)}}async configure(t,r){if(!Array.isArray(t.selections)||!t.selections.length||t.selections.length>32)throw new Error("\u6DFB\u52A0\u9879\u65E0\u6548");let n=new Map((await this.discover()).map(u=>[u.id,u])),s={...r.targets},i=[],o=new Set;for(let u of t.selections){let d=n.get(u.candidateId);if(!d||d.status!=="ready"||o.has(d.id))throw new Error("\u53D1\u73B0\u7ED3\u679C\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u68C0\u6D4B");o.add(d.id);let f=String(u.name||"").trim();if(!f||f.length>128)throw new Error("\u667A\u80FD\u4F53\u540D\u79F0\u65E0\u6548");let p=await he(String(u.workspace||""));if(d.managed&&p!==await he(d.workspace))throw new Error("\u5DF2\u6709\u667A\u80FD\u4F53\u5FC5\u987B\u6CBF\u7528\u672C\u673A\u5DE5\u4F5C\u76EE\u5F55");let h=`${this.config.nodeId}:${Ur("sha256").update(d.id).digest("hex").slice(0,20)}`;if([...r.sessions.values()].some(m=>m.targetCode===h))throw new Error("\u6B64\u667A\u80FD\u4F53\u4ECD\u6709\u4F1A\u8BDD\uFF0C\u8BF7\u5148\u7ED3\u675F\u4F1A\u8BDD\u518D\u4FEE\u6539\u63A5\u5165");s[h]={name:f,workspace:p,command:d.command,type:d.managed?"openclaw":"cli",...d.managed?{openclawAgentId:d.localAgentId}:d.framework==="codex"?{terminalProtocol:"codex",args:["exec","--skip-git-repo-check","--json"],promptMode:"stdin",outputMode:"json-lines",captureLastMessage:!0}:{terminalProtocol:"claude",args:["-p","--output-format","json","--no-session-persistence"],promptMode:"args",outputMode:"json-lines"}},i.push({candidateId:d.id,name:f,workspace:p,targetCode:h,framework:d.framework})}let a=this.profile.targets;this.profile.targets=s;try{await this.persist()}catch(u){throw this.profile.targets=a,u}return r.targets=s,this.config.targets=s,r.notifyCapacityChanged(),{agents:i}}};import{execFile as Ws}from"node:child_process";import{constants as Xs}from"node:fs";import{access as Br,readFile as jr,realpath as Ys}from"node:fs/promises";import{join as _e}from"node:path";import{promisify as Qs}from"node:util";var J="0.1.44";function _t(){return new Date().toISOString()}function P(e,t=2){return String(e).padStart(t,"0")}function Pr(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${P(Math.floor(r/60))}:${P(r%60)}`}function vs(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${P(e.getMonth()+1)}-${P(e.getDate())}`,`T${P(e.getHours())}:${P(e.getMinutes())}:${P(e.getSeconds())}.${P(e.getMilliseconds(),3)}`,Pr(t)].join("")}function Ds(e,t){let r=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),n={};for(let s of r.formatToParts(e))s.type!=="literal"&&(n[s.type]=Number(s.value));return n}function Hs(e,t){let r=Ds(e,t),n=Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second,e.getMilliseconds()),s=Math.round((n-e.getTime())/6e4);return[`${r.year}-${P(r.month)}-${P(r.day)}`,`T${P(r.hour)}:${P(r.minute)}:${P(r.second)}.${P(e.getMilliseconds(),3)}`,Pr(s)].join("")}function Fs(e=new Date){let t=c(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return Hs(e,t)}catch{return vs(e)}}function l(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function c(e){return String(e??"").trim()}function T(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)?r:t}function A(e){return Array.isArray(e)?e.map(String):[]}function Z(e,t,r=process.cwd()){let n=l(e)?e:{};return c(n.cwd)||c(n.workspace)||c(t)||c(r)||process.cwd()}var bt="[redacted]",$s=/(authorization|api[_-]?key|credential|password|secret|token)/i;function at(e){return $s.test(c(e))}function Mt(e,t=[]){let r=String(e??"");for(let n of t){let s=String(n??"");s.length>=4&&(r=r.split(s).join(bt))}return r.replace(/((?:authorization|api[_-]?key|credential|password|secret|token)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi,`$1${bt}`).replace(/([?&](?:api[_-]?key|credential|password|secret|token)=)[^&\s]+/gi,`$1${bt}`)}function Q(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=Q(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>Q(i,t));return t.delete(e),s}let r={},n=at(e.name||e.key);for(let[s,i]of Object.entries(e))r[s]=at(s)||n&&s.toLowerCase()==="value"?bt:Q(i,t);return t.delete(e),r}function Lr(e,t=4e3){let r=JSON.stringify(Q(e))??String(e);return!Number.isFinite(t)||r.length<=t?r:`${r.slice(0,t)}...`}function g(e,t,r,n={}){let s={ts:Fs(),level:e,module:t,msg:r,...l(n)?Q(n):{}};console.error(JSON.stringify(s))}var tt="application/x-orcha-channel-events-v2+ndjson";function M(e,t){return Object.assign(new Error(t||(["run_timeout","RUNTIME_NODE_TIMEOUT"].includes(e)?"OpenClaw \u539F\u751F IM \u6267\u884C\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002":e==="OPENCLAW_CHANNEL_PROTOCOL_MISMATCH"?"OpenClaw \u63D2\u4EF6\u4E0E Bridge \u7684\u539F\u751F IM \u534F\u8BAE\u4E0D\u517C\u5BB9\uFF0C\u8BF7\u914D\u5957\u5347\u7EA7\u3002":`OpenClaw \u539F\u751F IM \u6267\u884C\u5931\u8D25\uFF08${e}\uFF09`)),{code:e})}function kr(e,t){let r=e.cause?.code||e.code;return t?.reason?.name==="TimeoutError"||e.name==="TimeoutError"||["UND_ERR_HEADERS_TIMEOUT","UND_ERR_BODY_TIMEOUT","UND_ERR_CONNECT_TIMEOUT","ETIMEDOUT"].includes(r)?Object.assign(M("RUNTIME_NODE_TIMEOUT","OpenClaw \u8FDE\u63A5\u6216\u7B49\u5F85\u54CD\u5E94\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002"),{detail:{causeCode:r||"REQUEST_TIMEOUT"}}):e}async function vr(e,t){if(e.headers.get("content-type")!==tt)throw await e.body?.cancel(),M("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");let r=Buffer.alloc(0);for await(let n of e.body){r=Buffer.concat([r,n]);let s;for(;(s=r.indexOf(10))>=0;){if(s>2097152)throw M("OPENCLAW_CHANNEL_FRAME_TOO_LARGE");let i=r.subarray(0,s).toString("utf8");r=r.subarray(s+1);let o;try{o=JSON.parse(i)}catch{throw M("OPENCLAW_CHANNEL_INVALID_FRAME")}if(o.type!=="heartbeat")if(o.type==="update"&&o.payload?.update&&o.payload?._meta?.channelUpdateId)await t(o.payload);else{if(o.type==="result"&&o.result?.stopReason)return o.result;throw o.type==="error"&&typeof o.code=="string"?M(o.code):M("OPENCLAW_CHANNEL_INVALID_FRAME")}}if(r.length>2097152)throw M("OPENCLAW_CHANNEL_FRAME_TOO_LARGE")}throw M("OPENCLAW_CHANNEL_STREAM_INTERRUPTED","OpenClaw \u8FC7\u7A0B\u8FDE\u63A5\u4E2D\u65AD\uFF0C\u672A\u6536\u5230\u4EFB\u52A1\u7EC8\u6001\uFF0C\u8BF7\u68C0\u67E5\u8282\u70B9\u8FDE\u63A5\u540E\u91CD\u8BD5\u3002")}import{createServer as js}from"node:http";import{randomBytes as qs}from"node:crypto";var Ut={controlTools:["find_capabilities_and_skills","describe_capability","inspect_result","execute_capability"],residentTools:["search_orcha_docs"]};var Gs=Object.freeze([...Ut.controlTools,...Ut.residentTools]),Ks=new Set(Gs),zs=8*1024*1024;function Pt(e,t){if(!Array.isArray(e)||e.length!==1)throw new Error("one task-scoped Orcha MCP server is required");let r=e[0],n=new URL(r.url);if(r.name!=="orcha"||r.type!=="http"||!["http:","https:"].includes(n.protocol)||n.username||n.password||n.hash||t&&n.href!==new URL(t).href)throw new Error("Orcha MCP server does not match the trusted binding");let s=Object.fromEntries((r.headers||[]).map(({name:i,value:o})=>[i.toLowerCase(),o]));if(!String(s.authorization||"").startsWith("Bearer "))throw new Error("Orcha MCP task credentials are missing");return{url:n.href,headers:{...s,"content-type":"application/json",accept:"application/json"}}}async function Hr(e){let t=0,r=[];for await(let n of e){if(t+=n.length,t>zs)throw new Error("MCP payload exceeds the size limit");r.push(Buffer.from(n))}return JSON.parse(Buffer.concat(r).toString("utf8"))}async function Fr(e,t,r){let n=await fetch(e.url,{method:"POST",headers:e.headers,body:JSON.stringify(t),redirect:"error",signal:AbortSignal.any([AbortSignal.timeout(36e5),...r?[r]:[]])});if(!n.ok)throw new Error(`Orcha MCP request failed (${n.status})`);if(n.status===202||n.status===204)return null;let s=await Hr(n.body);if(!s||s.jsonrpc!=="2.0"||s.id!==t.id)throw new Error("Orcha MCP response identity mismatch");return s}async function Dr(e,t){let r=await Fr(e,{jsonrpc:"2.0",id:"orcha-bind-tools",method:"tools/list"},t),n=r?.result?.tools;if(r?.error)throw new Error("Orcha MCP tool discovery failed");return Js(n)}function Js(e){if(!Array.isArray(e)||e.some(t=>!t||!Ks.has(t.name)||t.inputSchema?.type!=="object"||typeof t.description!="string")||new Set(e.map(t=>t.name)).size!==e.length||e.length&&Ut.controlTools.some(t=>!e.some(r=>r.name===t)))throw new Error("Orcha MCP returned an unsupported or invalid authorized tool catalog");return e}function Vs(e,t){let r=s=>Array.isArray(s)?s.map(r):s&&typeof s=="object"?Object.fromEntries(Object.keys(s).sort().map(i=>[i,r(s[i])])):s,n=s=>s.map(({name:i,inputSchema:o})=>({name:i,inputSchema:o})).sort((i,o)=>i.name.localeCompare(o.name));return JSON.stringify(r(n(e)))===JSON.stringify(r(n(t)))}async function $r(e){let t=Pt(e),r=new AbortController,n=await Dr(t,r.signal),s=qs(32).toString("hex"),i=js(async(o,a)=>{if(o.url!=="/mcp"||o.headers.authorization!==`Bearer ${s}`){a.writeHead(403).end();return}if(o.method!=="POST"){a.writeHead(405).end();return}try{let u=await Hr(o);if(!u||u.jsonrpc!=="2.0"||typeof u.method!="string")throw new Error("Invalid MCP request");if(u.method==="tools/call"&&!n.some(f=>f.name===u.params?.name))throw new Error("Tool is not authorized in this task binding");let d=await Fr(t,u,r.signal);a.writeHead(d===null?202:200,{"content-type":"application/json"}),a.end(d===null?"":JSON.stringify(d))}catch{a.writeHead(502,{"content-type":"application/json"}).end(JSON.stringify({error:"The task-scoped Orcha MCP connection failed"}))}});return await new Promise((o,a)=>{i.once("error",a),i.listen(0,"127.0.0.1",o)}),{url:`http://127.0.0.1:${i.address().port}/mcp`,token:s,async refresh(o){let a=Pt(o,t.url);if(!Vs(n,await Dr(a,r.signal)))throw new Error("The frozen MCP tool catalog changed; start a new task");t=a},async close(){r.abort(),i.closeAllConnections(),await new Promise(o=>i.close(o))}}}var V=class{constructor(t,r){this.target=t,this.identity=r,this.bound=!1}async request(t,r,n=!1,s="mcp-bindings",i=3e4,o=null){let a=c(this.target.mcpBridgeUrl),u=c(this.target.mcpBridgeTokenEnv),d=this.target.env?.[u]||process.env[u];if(!a||!u||!d)throw Object.assign(new Error("OpenClaw requires the Orcha tool plugin, mcpBridgeUrl and mcpBridgeTokenEnv"),{code:"OPENCLAW_MCP_NOT_CONFIGURED"});let f=new URL(a);if(!["http:","https:"].includes(f.protocol)||f.username||f.password||f.pathname!=="/plugins/orcha-runtime/mcp-bindings"||f.search||f.hash)throw new Error("OpenClaw MCP binding URL must be the trusted Gateway plugin route");if(!["mcp-bindings","deliveries","background"].includes(s))throw new Error("Unsupported Orcha plugin route");f.pathname=`/plugins/orcha-runtime/${s}`;let p=AbortSignal.timeout(i);try{let h=await fetch(f,{method:t,redirect:"error",signal:p,headers:{authorization:`Bearer ${d}`,"content-type":"application/json",...o?{accept:tt}:{},...n?{"if-match":this.identity.runId}:{}},...r!==void 0?{body:JSON.stringify(r)}:{}});if(t==="GET"&&s==="deliveries"&&[404,405].includes(h.status))throw await h.body?.cancel(),M("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");if(h.ok&&o)return await vr(h,o);let m=await h.json();if(!h.ok)throw M(m.error||"OPENCLAW_MCP_BINDING_FAILED");return m}catch(h){throw kr(h,p)}}async bind(t,r=!1){Pt(t),await this.request("PUT",{...this.identity,mcpServer:t[0]},r),this.bound=!0}async close(){this.bound&&(await this.request("DELETE",{runId:this.identity.runId,sessionKey:this.identity.sessionKey}),this.bound=!1)}};var Zs=Qs(Ws),ti=12e4;async function qr(e,t){let r=new Map,n=[];for(let s of Object.values(e)){if(s.type!=="openclaw")continue;if(s.mcpBridgeUrl&&(n.push(s),!["localhost","127.0.0.1","[::1]"].includes(new URL(s.mcpBridgeUrl).hostname))){process.stderr.write(`\u8FDC\u7A0B OpenClaw Gateway \u7684\u914D\u5957\u63D2\u4EF6\u9700\u5728\u6240\u5728\u4E3B\u673A\u66F4\u65B0\uFF1Breload \u5C06\u68C0\u67E5\u5176\u534F\u8BAE\u3002
+`);continue}let i={...process.env,...s.env},o=c(s.command)||"openclaw",a=o.includes("/")?o:await pe(o,i);if(!a)throw new Error("\u627E\u4E0D\u5230\u5DF2\u63A5\u5165\u7684 OpenClaw\uFF0C\u8BF7\u68C0\u67E5\u672C\u673A\u5B89\u88C5\u540E\u91CD\u8BD5 reload");let u=await Ys(a);await Br(u,Xs.X_OK);let d=JSON.stringify([u,Object.entries(i).sort(([f],[p])=>f.localeCompare(p))]);r.has(d)||r.set(d,{command:u,env:i})}if(r.size)try{let s=JSON.parse(await jr(_e(t,"openclaw.plugin.json"),"utf8")),i=JSON.parse(await jr(_e(t,"package.json"),"utf8"));if(await Br(_e(t,"index.js")),s.id!=="orcha-runtime"||i.version!==J)throw new Error("\u63D2\u4EF6\u6807\u8BC6\u6216\u7248\u672C\u4E0D\u5339\u914D")}catch(s){throw new Error("\u914D\u5957 OpenClaw \u63D2\u4EF6\u7F3A\u5931\u3001\u635F\u574F\u6216\u7248\u672C\u4E0D\u4E00\u81F4\uFF0C\u8BF7\u91CD\u65B0\u5B89\u88C5 Bridge\uFF1B\u6E90\u7801\u8FD0\u884C\u8BF7\u5148 npm run build",{cause:s})}return async()=>{for(let s of r.values()){process.stderr.write(`\u6B63\u5728\u5B89\u88C5\u914D\u5957 OpenClaw \u63D2\u4EF6\u5E76\u91CD\u542F Gateway\u2026
+`),await ye(s,["plugins","install",t,"--force"]),await ye(s,["gateway","restart"]);let i=await ye(s,["health","--json"]);if(JSON.parse(i).ok!==!0)throw new Error("OpenClaw Gateway \u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0CBridge \u672A\u542F\u52A8\uFF0C\u8BF7\u4FEE\u590D\u540E\u91CD\u8BD5 reload");process.stderr.write(`OpenClaw \u914D\u5957\u63D2\u4EF6\u5DF2\u66F4\u65B0\uFF0CGateway \u5065\u5EB7\u68C0\u67E5\u901A\u8FC7\u3002
+`)}for(let s of n)if((await new V(s,{}).request("GET",void 0,!1,"deliveries")).streamType!==tt)throw M("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH")}}async function ye(e,t){try{let{stdout:r}=await Zs(e.command,t,{env:e.env,timeout:ti,killSignal:"SIGKILL",maxBuffer:1048576,windowsHide:!0});return r}catch(r){let n=Object.entries(e.env).filter(([i])=>at(i)).map(([,i])=>i),s=Mt(r.stderr||r.message,n).trim();throw new Error(`OpenClaw ${t.slice(0,2).join(" ")} \u5931\u8D25\uFF0CBridge \u672A\u542F\u52A8\uFF0C\u8BF7\u4FEE\u590D\u540E\u91CD\u8BD5 reload\uFF1A${s}`)}}import{createHash as ca,randomUUID as te}from"node:crypto";function Lt(e){return Array.isArray(e)?e.map(t=>l(t)?t.type==="text"?c(t.text):t.type==="file"?c(t.uri):t.type==="image"?c(t.uri):"":"").filter(Boolean).join(`
+`):""}var kt=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,r){let n=Lt(t.prompt);return r({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as ei}from"node:child_process";var yt="2.0",Te=3e4,ri=4e3;function vt(e,t){let r=Object.entries(l(t)?t:{}).filter(([n])=>at(n)).map(([,n])=>n);return Mt(e,r)}function ni(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,message:c(e?.message)||String(e),data:l(e?.data)?e.data:void 0}}function si(e){if(!l(e))return new Error(String(e||"runtime error"));let t=c(e.message)||"runtime error",r="data"in e?Lr(e.data,4e3):"",n=new Error(r?`${t}; data=${r}`:t);return n.rpcCode=e.code,n.data=e.data,n}function ii(e){return l(e)&&"id"in e&&!("method"in e)}function oi(e){return l(e)&&typeof e.method=="string"&&"id"in e}function ai(e){return l(e)&&typeof e.method=="string"&&!("id"in e)}var Dt=class{constructor({command:t,args:r=[],cwd:n,env:s,label:i,framing:o="line",detached:a=!0}){this.command=t,this.args=Array.isArray(r)?r.map(String):[],this.cwd=n||process.cwd(),this.env=l(s)?{...s}:{...process.env},this.label=i||t,this.framing=o==="content-length"?"content-length":"line",this.detached=a!==!1,this.child=null,this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stopPromise=null,this.stderrTail="",this.spawnError=null,this.lineBuffer="",this.headerBuffer=Buffer.alloc(0),this.seq=0,this.pending=new Map,this.notificationHandlers=new Map,this.requestHandlers=new Map,this.exitHandlers=new Set}async start({initialize:t=!0,initializeParams:r={},initializeTimeoutMs:n=Te}={}){if(!(this.child&&!this.exited)&&(this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stderrTail="",this.spawnError=null,this.child=ei(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"],detached:this.detached}),this.child.stdout.on("data",s=>this.onStdout(s)),this.child.stderr.setEncoding("utf8"),this.child.stderr.on("data",s=>{this.stderrTail=`${this.stderrTail}${s}`.slice(-ri);let i=vt(s.trimEnd(),this.env);i&&g("debug","runtime.stderr","runtime stderr",{target:this.label,text:i})}),this.child.on("exit",(s,i)=>this.handleExit(s,i)),this.child.on("error",s=>{this.spawnError=s,this.rejectAll(s)}),t)){let s=Math.max(1,T(n,Te));try{await this.call("initialize",{protocolVersion:1,clientCapabilities:{},...r},s)}catch(i){let o=this.startupFailureDetail(),a=vt(i?.message||i,this.env);g("warn","runtime.initialize","runtime initialize failed",{target:this.label,timeoutMs:s,cause:a,...o}),await this.stop("initialize failed",{termTimeoutMs:1e3,killTimeoutMs:1e3});let u=o.stderr?`; stderr: ${o.stderr}`:`; command=${o.command}; cwd=${o.cwd}`;throw Object.assign(new Error(`runtime initialize failed: ${a}${u}`,{cause:i}),{code:"RUNTIME_INITIALIZE_FAILED",detail:o})}}}startupFailureDetail(){return{command:this.command,cwd:this.cwd,exited:this.exited,exitCode:this.exitCode,exitSignal:this.exitSignal,...this.spawnError?{spawnError:vt(this.spawnError.message,this.env)}:{},...this.stderrTail.trim()?{stderr:vt(this.stderrTail.trim(),this.env)}:{}}}onStdout(t){if(this.framing==="content-length"){this.onContentLengthData(Buffer.isBuffer(t)?t:Buffer.from(t));return}this.onLineData(t.toString("utf8"))}onLineData(t){this.lineBuffer+=t;let r=this.lineBuffer.split(/\r?\n/);this.lineBuffer=r.pop()||"";for(let n of r){let s=n.trim();s&&this.dispatchRaw(s)}}onContentLengthData(t){for(this.headerBuffer=Buffer.concat([this.headerBuffer,t]);this.headerBuffer.length>0;){let r=this.headerBuffer.indexOf(`\r
 \r
-`);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){g("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.alloc(0);return}let i=Number.parseInt(s[1],10),o=r+4,c=o+i;if(this.headerBuffer.length<c)return;let u=this.headerBuffer.subarray(o,c).toString("utf8");this.headerBuffer=this.headerBuffer.subarray(c),this.dispatchRaw(u)}}dispatchRaw(t){let r;try{r=JSON.parse(t)}catch(n){g("warn","runtime.protocol","invalid JSON frame",{target:this.label,error:String(n)});return}this.dispatch(r)}dispatch(t){if(As(t)){this.resolveResponse(t);return}if(xs(t)){this.handleRequest(t);return}Ns(t)&&this.handleNotification(t)}resolveResponse(t){let r=String(t.id),n=this.pending.get(r);n&&(clearTimeout(n.timer),this.pending.delete(r),t.error?(g("warn","runtime.protocol","runtime rpc error",{target:this.label,method:n.method,requestId:r,error:t.error}),n.reject(Cs(t.error))):n.resolve(t.result))}async handleRequest(t){let r=this.requestHandlers.get(t.method);if(!r){this.writeFrame({jsonrpc:ht,id:t.id,error:{code:-32601,message:`method not found: ${t.method}`}});return}try{let n=await r(l(t.params)?t.params:{},t);this.writeFrame({jsonrpc:ht,id:t.id,result:n??{}})}catch(n){this.writeFrame({jsonrpc:ht,id:t.id,error:Is(n)})}}handleNotification(t){let r=this.notificationHandlers.get(t.method);if(r)for(let n of r)n(l(t.params)?t.params:{},t)}call(t,r={},n=le){if(!this.child||!this.child.stdin||this.exited)return Promise.reject(new Error("runtime process is not running"));let s=`${t}_${++this.seq}`,i={jsonrpc:ht,id:s,method:t,params:r};return new Promise((o,c)=>{let u=setTimeout(()=>{this.pending.delete(s),c(new Error(`${t} timed out after ${n}ms`))},n);this.pending.set(s,{resolve:o,reject:c,timer:u,method:t}),this.writeFrame(i,d=>{d&&(clearTimeout(u),this.pending.delete(s),c(d))})})}notify(t,r={}){this.writeFrame({jsonrpc:ht,method:t,params:r})}writeFrame(t,r){if(!this.child?.stdin||this.exited){r?.(new Error("runtime process is not running"));return}let n=JSON.stringify(t),s=this.framing==="content-length"?`Content-Length: ${Buffer.byteLength(n,"utf8")}\r
+`);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){g("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.alloc(0);return}let i=Number.parseInt(s[1],10),o=r+4,a=o+i;if(this.headerBuffer.length<a)return;let u=this.headerBuffer.subarray(o,a).toString("utf8");this.headerBuffer=this.headerBuffer.subarray(a),this.dispatchRaw(u)}}dispatchRaw(t){let r;try{r=JSON.parse(t)}catch(n){g("warn","runtime.protocol","invalid JSON frame",{target:this.label,error:String(n)});return}this.dispatch(r)}dispatch(t){if(ii(t)){this.resolveResponse(t);return}if(oi(t)){this.handleRequest(t);return}ai(t)&&this.handleNotification(t)}resolveResponse(t){let r=String(t.id),n=this.pending.get(r);n&&(clearTimeout(n.timer),this.pending.delete(r),t.error?(g("warn","runtime.protocol","runtime rpc error",{target:this.label,method:n.method,requestId:r,error:t.error}),n.reject(si(t.error))):n.resolve(t.result))}async handleRequest(t){let r=this.requestHandlers.get(t.method);if(!r){this.writeFrame({jsonrpc:yt,id:t.id,error:{code:-32601,message:`method not found: ${t.method}`}});return}try{let n=await r(l(t.params)?t.params:{},t);this.writeFrame({jsonrpc:yt,id:t.id,result:n??{}})}catch(n){this.writeFrame({jsonrpc:yt,id:t.id,error:ni(n)})}}handleNotification(t){let r=this.notificationHandlers.get(t.method);if(r)for(let n of r)n(l(t.params)?t.params:{},t)}call(t,r={},n=Te){if(!this.child||!this.child.stdin||this.exited)return Promise.reject(new Error("runtime process is not running"));let s=`${t}_${++this.seq}`,i={jsonrpc:yt,id:s,method:t,params:r};return new Promise((o,a)=>{let u=setTimeout(()=>{this.pending.delete(s),a(new Error(`${t} timed out after ${n}ms`))},n);this.pending.set(s,{resolve:o,reject:a,timer:u,method:t}),this.writeFrame(i,d=>{d&&(clearTimeout(u),this.pending.delete(s),a(d))})})}notify(t,r={}){this.writeFrame({jsonrpc:yt,method:t,params:r})}writeFrame(t,r){if(!this.child?.stdin||this.exited){r?.(new Error("runtime process is not running"));return}let n=JSON.stringify(t),s=this.framing==="content-length"?`Content-Length: ${Buffer.byteLength(n,"utf8")}\r
 \r
 ${n}`:`${n}
-`;this.child.stdin.write(s,r)}onNotification(t,r){let n=this.notificationHandlers.get(t)||new Set;return n.add(r),this.notificationHandlers.set(t,n),()=>{n.delete(r),n.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,r){return this.requestHandlers.set(t,r),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let r of this.pending.values())clearTimeout(r.timer),r.reject(t);this.pending.clear()}handleExit(t,r){this.exited=!0,this.exitCode=t,this.exitSignal=r,this.rejectAll(new Error(`runtime exited before response (${t}/${r})`));for(let n of this.exitHandlers)n(t,r)}async waitForExit(t=5e3){return!this.child||this.exited?!0:await new Promise(r=>{let n=setTimeout(()=>{s(),r(!1)},t);n.unref?.();let s=()=>{clearTimeout(n),this.exitHandlers.delete(i)},i=()=>{s(),r(!0)};this.exitHandlers.add(i),this.exited&&i()})}signal(t){if(!this.child||this.exited)return!1;let r=this.child.pid;if(!r)return!1;try{return this.detached&&process.platform!=="win32"?process.kill(-r,t):this.child.kill(t),!0}catch(n){if(n?.code==="ESRCH")return this.exited=!0,!1;try{return this.child.kill(t),!0}catch(s){return s?.code!=="ESRCH"&&g("warn","runtime","runtime signal failed",{target:this.label,pid:r,signal:t,error:String(s)}),!1}}}async stop(t="stop",{termTimeoutMs:r=5e3,killTimeoutMs:n=2e3}={}){if(!(!this.child||this.exited)){if(this.stopPromise)return await this.stopPromise;this.stopPromise=(async()=>{if(!this.child||this.exited)return;let s=this.child.pid;g("info","runtime","stopping runtime",{target:this.label,reason:t,pid:s}),this.rejectAll(new Error(`runtime stopped: ${t}`)),this.signal("SIGTERM"),!await this.waitForExit(r)&&this.child&&!this.exited&&(g("warn","runtime","runtime did not exit after SIGTERM; force killing",{target:this.label,reason:t,pid:s}),this.signal("SIGKILL"),await this.waitForExit(n))})();try{await this.stopPromise}finally{this.stopPromise=null}}}};import{randomUUID as xr}from"node:crypto";import{existsSync as bs,readFileSync as Ms,realpathSync as Ir,statSync as Us}from"node:fs";import{basename as Nr,extname as br,isAbsolute as mt,join as Ps,relative as Mr,resolve as Cr}from"node:path";var Ls=25*1024*1024;function Ur(e,t=""){let r=a(t);if(r)return r;let n=br(a(e)).toLowerCase();return n===".jpg"||n===".jpeg"?"image/jpeg":n===".webp"?"image/webp":n===".gif"?"image/gif":"image/png"}function Pr(e,t){let r=typeof e=="string"?e.trim():"";return!r||r==="<omitted>"?"":r.startsWith("data:")?r:`data:${t};base64,${r.replace(/\s+/g,"")}`}function Ut(e){if(Array.isArray(e))return e.map(a).filter(Boolean);let t=a(e);return t?[t]:[]}function ks(e,t){let r=Mr(t,e);return r===""||!!r&&!r.startsWith("..")&&!mt(r)}function Ds(e,t){let r=a(e);if(!r||!bs(r))return"";try{let n=Ir(r);for(let s of t)try{let i=Ir(s);if(ks(n,i))return n}catch{}}catch{return""}return""}function vs(e,t){let r=a(e);if(!r||!mt(r))return r;for(let n of Array.isArray(t)?t:[]){if(!l(n))continue;let s=a(n.runtimeRoot),i=a(n.hostRoot);if(!s||!i||!mt(s)||!mt(i))continue;let o=Mr(Cr(s),Cr(r));if(o===""||!o.startsWith("..")&&!mt(o))return o?Ps(i,o):i}return r}function de(e,t,r={}){let n=a(e);return!n||n.startsWith("data:")||/^https?:\/\//i.test(n)?n:Hs(n,t,r)}function Hs(e,t,r={}){let n=[...Ut(r.trustedFileRoots),...Ut(r.trustedFileRoot),...Ut(r.artifactRoots),...Ut(r.artifactRoot)],s=Ds(vs(e,r.pathMappings),n);if(!s)return"";try{let i=Us(s);return!i.isFile()||i.size<=0||i.size>Ls?"":`data:${t};base64,${Ms(s).toString("base64")}`}catch{return""}}function A(...e){for(let t of e){let r=a(t);if(r)return r}return""}function Fs(e,t,r,n){let s=r.toLowerCase();if(s==="image"||s==="picture")return!0;let i=A(n,e.previewUrl,e.fileUrl,e.imageUrl,e.dataUrl,e.url,e.uri,t.previewUrl,t.fileUrl,t.imageUrl,t.dataUrl,t.url,t.uri),o=br(i.split("?",1)[0].split("#",1)[0]).toLowerCase();return[".png",".jpg",".jpeg",".webp",".gif"].includes(o)}function pe(e,t={}){let{source:r="runtime_image_generation_event"}=t;if(!l(e))return null;let n=l(e.payload)?e.payload:{},s=a(e.type),i=a(n.type);if(!(s==="event_msg"&&i==="image_generation_end"||s==="response_item"&&i==="image_generation_call"))return null;let o=A(n.call_id,n.id),c=A(n.saved_path,n.savedPath),u=A(n.revised_prompt,n.revisedPrompt),d=Ur(c,n.mimeType||n.mime_type),f=Pr(n.result,d)||de(c,d,t);if(!f)return null;let p=f.startsWith("data:")?f:"",h=c?Nr(c):`${o||xr()}.png`;return{artifactType:"image",type:"image",fieldKey:"image",title:h||"Generated image",summary:u||"Generated image",content:{prompt:u||void 0,dataUrl:p||void 0,imageUrl:f,previewUrl:f,fileUrl:f,mimeType:d},dataUrl:p||void 0,previewUrl:f,fileUrl:f,metadata:{source:r,eventType:i,callId:o||void 0,savedPath:c||void 0,filename:h,mimeType:d,revisedPrompt:u||void 0}}}function $s(e){let t=l(e)?e:{},r=[];for(let n of["_artifacts","artifacts"]){let s=t[n];Array.isArray(s)&&r.push(...s)}for(let n of["_artifact","artifact"]){let s=t[n];l(s)&&r.push(s)}return r}function Bs(e,t={}){let{source:r="runtime_artifact"}=t,n=l(e)?e:{};if(!Object.keys(n).length)return null;let s=l(n.content)?{...n.content}:{},i=l(n.metadata)?{...n.metadata}:{},o=A(n.saved_path,n.savedPath,s.saved_path,s.savedPath,i.savedPath),c=A(n.mimeType,n.mime_type,s.mimeType,s.mime_type,i.mimeType),u=A(n.artifactType,n.artifact_type,n.type,n.kind,s.type,o?"image":"file"),d=Fs(n,s,u,o),f=d?Ur(o,c):c;if(d){let N=A(n.dataUrl,s.dataUrl),y=N.startsWith("data:")?N:"",w=A(n.imageUrl,n.previewUrl,n.fileUrl,n.downloadUrl,n.url,n.uri,s.imageUrl,s.previewUrl,s.fileUrl,s.downloadUrl,s.url,s.uri),E=Pr(n.result??s.result,f)||y||de(o,f,t)||de(w,f,t);E&&(E.startsWith("data:")&&(s.dataUrl||=E),s.imageUrl||=E,s.previewUrl||=E,s.fileUrl||=E,f&&(s.mimeType||=f))}for(let[N,y]of[["prompt","prompt"],["previewUrl","previewUrl"],["fileUrl","fileUrl"],["downloadUrl","downloadUrl"],["imageUrl","imageUrl"],["dataUrl","dataUrl"],["url","url"],["uri","uri"],["mimeType","mimeType"],["mime_type","mimeType"]]){let w=n[N];w!=null&&w!==""&&!(y in s)&&(s[y]=w)}let p=A(n.fileUrl,n.downloadUrl,n.imageUrl,n.dataUrl,n.url,n.uri,s.fileUrl,s.downloadUrl,s.imageUrl,s.dataUrl,s.url,s.uri),h=A(n.previewUrl,n.imageUrl,n.dataUrl,n.url,n.fileUrl,n.uri,s.previewUrl,s.imageUrl,s.dataUrl,s.url,s.fileUrl,s.uri),m=A(n.dataUrl,s.dataUrl,p.startsWith("data:")?p:"",h.startsWith("data:")?h:""),T=A(n.filename,i.filename,o?Nr(o):""),R=A(n.fieldKey,n.field_key,s.fieldKey,i.fieldKey,d?"image":"artifact");return{...n,artifactType:u,type:n.type||u,fieldKey:R,title:A(n.title,T,"Runtime artifact"),summary:A(n.summary,s.prompt,n.title,T,"Runtime artifact"),content:s,dataUrl:m||void 0,fileUrl:p||void 0,previewUrl:h||void 0,metadata:{...i,source:A(i.source,r),savedPath:o||i.savedPath,filename:T||i.filename,mimeType:f||i.mimeType}}}function Pt(e,t){if(!t||!e)return;let r=l(t.metadata)?t.metadata:{},n=A(r.savedPath,r.callId,t.previewUrl,t.fileUrl)||xr(),s=e.get(n);if(!s){e.set(n,t);return}s.content={...l(s.content)?s.content:{},...l(t.content)?t.content:{}},s.metadata={...l(s.metadata)?s.metadata:{},...r},s.previewUrl=t.previewUrl||s.previewUrl,s.fileUrl=t.fileUrl||s.fileUrl,s.summary=t.summary||s.summary,s.title=t.title||s.title}function fe(e,t,r={}){for(let n of $s(e))Pt(t,Bs(n,r))}function he(e){if(!l(e)||!l(e.payload))return l(e)?e:{value:e};let t=a(e.payload.type);if(t!=="image_generation_end"&&t!=="image_generation_call")return e;let r={...e.payload};return typeof r.result=="string"&&r.result&&(r.result="<omitted>",r.resultLength=e.payload.result.length),{...e,payload:r}}function Ar(e,t,r){if(!l(e))return e;let n=l(e.event)?e.event:null;return n?(Pt(t,pe(n,r)),{...e,event:he(n)}):e}function Lr(e,t,r={}){if(!l(e))return e;fe(e,t,r);let n=Ar(e,t,r),s=l(n.update)?Ar(n.update,t,r):null;return s&&s!==n.update&&(n={...n,update:s}),n}function kr(e,t,r={}){let n=l(e)?{...e}:{};fe(n,t,r),fe(l(n.output)?n.output:{},t,r);let s=[...t?.values?.()||[]];return s.length&&(n._artifacts=s),delete n.artifacts,n}function Dr(e,t){let r=_(e,t);return r>0?r:t}var nt=class{constructor(t,r,n={},s={}){this.agent=t,this.target=r,this.callbacks=n,this.options=s,this.proc=null,this.launch=null,this.launchCleanup=null,this.permissionHandlers=new Map}async ensureStarted(){if(this.proc)return;let t=a(this.target.command);if(!t)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let r={command:t,args:x(this.target.args),cwd:rt(this.target,this.agent.workspace),environment:l(this.target.env)?this.target.env:{}},n=this.options.prepareLaunch?await this.options.prepareLaunch(r):{...r,environment:{...process.env,...r.environment},cleanup:async()=>{}};this.launch=n,this.launchCleanup=n.cleanup,this.proc=new Mt({command:n.command,args:n.args,cwd:n.cwd,env:n.environment,label:`${this.agent.agentId}:${this.agent.targetCode}`,framing:a(this.target.framing||"line")}),this.proc.onRequest("session/request_permission",s=>this.handlePermissionRequest(s)),this.proc.onRequest("session/requestPermission",s=>this.handlePermissionRequest(s));try{await this.proc.start({initialize:this.target.initialize!==!1,initializeTimeoutMs:Dr(this.target.initializeTimeoutMs,Dr(this.options.initializeTimeoutMs,3e4)),initializeParams:{clientInfo:{name:"orcha-runtime-bridge",version:et},...l(this.target.initializeParams)?this.target.initializeParams:{}}})}catch(s){throw await this.proc?.stop("runtime startup failed"),this.proc=null,await this.cleanupLaunch(),s}}async sessionNew(t={}){return await this.ensureStarted(),this.proc.call("session/new",this.sessionNewParams(t))}sessionNewParams(t={}){let r=Array.isArray(t.mcpServers)?t.mcpServers:Array.isArray(this.target.mcpServers)?this.target.mcpServers:[];return{...t,mcpServers:r}}async sessionPrompt(t,r){await this.ensureStarted();let n=a(t.sessionId),s=new Map,i=this.artifactOptions(),o=this.proc.onNotification("session/update",u=>{let d=a(u.sessionId);(!d||d===n)&&r(Lr(u,s,i))}),c=async u=>this.callbacks.onPermissionRequest?.({agent:this.agent,runtimeSessionId:n,request:u,emitUpdate:r})||{outcome:"denied",reason:"permission handler is not configured"};n&&this.permissionHandlers.set(n,c),this.permissionHandlers.set("*",c);try{let u=await this.proc.call("session/prompt",t,this.options.sessionPromptTimeoutMs);return kr(u,s,i)}finally{o(),n&&this.permissionHandlers.delete(n),this.permissionHandlers.delete("*")}}async sessionCancel(t){return await this.ensureStarted(),this.proc.call("session/cancel",t,5e3).catch(()=>({ok:!0}))}async handlePermissionRequest(t){let r=a(t.sessionId),n=this.permissionHandlers.get(r)||this.permissionHandlers.get("*");return n?n(t):{outcome:"denied",reason:"no active Orcha permission handler"}}artifactSource(){return a(this.target.type||"acp")==="openclaw"?"openclaw_image_generation":"acp_runtime_image_generation"}artifactOptions(){let t=l(this.target.env)?this.target.env:{};return{source:this.artifactSource(),trustedFileRoots:[a(this.launch?.artifactDirectory),a(this.launch?.homeDirectory),a(this.target.artifactRoot),a(this.target.artifactDir),a(this.target.runtimeArtifactRoot),a(t.ORCHA_RUNTIME_ARTIFACT_DIR),...x(this.target.trustedArtifactRoots),...x(this.target.trustedFileRoots),...x(this.target.artifactRoots),...x(this.target.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(this.launch?.pathMappings)?this.launch.pathMappings:[]}}async stop(t){try{await this.proc?.stop(t)}finally{this.proc=null,await this.cleanupLaunch()}}async cleanupLaunch(){let t=this.launchCleanup;this.launchCleanup=null,this.launch=null,await t?.()}};import{createServer as qs}from"node:http";import{randomBytes as Ks}from"node:crypto";var Lt={controlTools:["find_capabilities_and_skills","describe_capability","inspect_result","execute_capability"],residentTools:["search_orcha_docs"]};var Gs=Object.freeze([...Lt.controlTools,...Lt.residentTools]),zs=new Set(Gs),Vs=8*1024*1024;function kt(e,t){if(!Array.isArray(e)||e.length!==1)throw new Error("one task-scoped Orcha MCP server is required");let r=e[0],n=new URL(r.url);if(r.name!=="orcha"||r.type!=="http"||!["http:","https:"].includes(n.protocol)||n.username||n.password||n.hash||t&&n.href!==new URL(t).href)throw new Error("Orcha MCP server does not match the trusted binding");let s=Object.fromEntries((r.headers||[]).map(({name:i,value:o})=>[i.toLowerCase(),o]));if(!String(s.authorization||"").startsWith("Bearer "))throw new Error("Orcha MCP task credentials are missing");return{url:n.href,headers:{...s,"content-type":"application/json",accept:"application/json"}}}async function Hr(e){let t=0,r=[];for await(let n of e){if(t+=n.length,t>Vs)throw new Error("MCP payload exceeds the size limit");r.push(Buffer.from(n))}return JSON.parse(Buffer.concat(r).toString("utf8"))}async function Fr(e,t,r){let n=await fetch(e.url,{method:"POST",headers:e.headers,body:JSON.stringify(t),redirect:"error",signal:AbortSignal.any([AbortSignal.timeout(36e5),...r?[r]:[]])});if(!n.ok)throw new Error(`Orcha MCP request failed (${n.status})`);if(n.status===202||n.status===204)return null;let s=await Hr(n.body);if(!s||s.jsonrpc!=="2.0"||s.id!==t.id)throw new Error("Orcha MCP response identity mismatch");return s}async function vr(e,t){let r=await Fr(e,{jsonrpc:"2.0",id:"orcha-bind-tools",method:"tools/list"},t),n=r?.result?.tools;if(r?.error)throw new Error("Orcha MCP tool discovery failed");return Ws(n)}function Ws(e){if(!Array.isArray(e)||e.some(t=>!t||!zs.has(t.name)||t.inputSchema?.type!=="object"||typeof t.description!="string")||new Set(e.map(t=>t.name)).size!==e.length||e.length&&Lt.controlTools.some(t=>!e.some(r=>r.name===t)))throw new Error("Orcha MCP returned an unsupported or invalid authorized tool catalog");return e}function Js(e,t){let r=s=>Array.isArray(s)?s.map(r):s&&typeof s=="object"?Object.fromEntries(Object.keys(s).sort().map(i=>[i,r(s[i])])):s,n=s=>s.map(({name:i,inputSchema:o})=>({name:i,inputSchema:o})).sort((i,o)=>i.name.localeCompare(o.name));return JSON.stringify(r(n(e)))===JSON.stringify(r(n(t)))}async function $r(e){let t=kt(e),r=new AbortController,n=await vr(t,r.signal),s=Ks(32).toString("hex"),i=qs(async(o,c)=>{if(o.url!=="/mcp"||o.headers.authorization!==`Bearer ${s}`){c.writeHead(403).end();return}if(o.method!=="POST"){c.writeHead(405).end();return}try{let u=await Hr(o);if(!u||u.jsonrpc!=="2.0"||typeof u.method!="string")throw new Error("Invalid MCP request");if(u.method==="tools/call"&&!n.some(f=>f.name===u.params?.name))throw new Error("Tool is not authorized in this task binding");let d=await Fr(t,u,r.signal);c.writeHead(d===null?202:200,{"content-type":"application/json"}),c.end(d===null?"":JSON.stringify(d))}catch{c.writeHead(502,{"content-type":"application/json"}).end(JSON.stringify({error:"The task-scoped Orcha MCP connection failed"}))}});return await new Promise((o,c)=>{i.once("error",c),i.listen(0,"127.0.0.1",o)}),{url:`http://127.0.0.1:${i.address().port}/mcp`,token:s,async refresh(o){let c=kt(o,t.url);if(!Js(n,await vr(c,r.signal)))throw new Error("The frozen MCP tool catalog changed; start a new task");t=c},async close(){r.abort(),i.closeAllConnections(),await new Promise(o=>i.close(o))}}}var gt="application/x-orcha-channel-events-v2+ndjson";function L(e,t){return Object.assign(new Error(t||(["run_timeout","RUNTIME_NODE_TIMEOUT"].includes(e)?"OpenClaw \u539F\u751F IM \u6267\u884C\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002":e==="OPENCLAW_CHANNEL_PROTOCOL_MISMATCH"?"OpenClaw \u63D2\u4EF6\u4E0E Bridge \u7684\u539F\u751F IM \u534F\u8BAE\u4E0D\u517C\u5BB9\uFF0C\u8BF7\u914D\u5957\u5347\u7EA7\u3002":`OpenClaw \u539F\u751F IM \u6267\u884C\u5931\u8D25\uFF08${e}\uFF09`)),{code:e})}function Br(e,t){let r=e.cause?.code||e.code;return t?.reason?.name==="TimeoutError"||e.name==="TimeoutError"||["UND_ERR_HEADERS_TIMEOUT","UND_ERR_BODY_TIMEOUT","UND_ERR_CONNECT_TIMEOUT","ETIMEDOUT"].includes(r)?Object.assign(L("RUNTIME_NODE_TIMEOUT","OpenClaw \u8FDE\u63A5\u6216\u7B49\u5F85\u54CD\u5E94\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002"),{detail:{causeCode:r||"REQUEST_TIMEOUT"}}):e}async function jr(e,t){if(e.headers.get("content-type")!==gt)throw await e.body?.cancel(),L("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");let r=Buffer.alloc(0);for await(let n of e.body){r=Buffer.concat([r,n]);let s;for(;(s=r.indexOf(10))>=0;){if(s>2097152)throw L("OPENCLAW_CHANNEL_FRAME_TOO_LARGE");let i=r.subarray(0,s).toString("utf8");r=r.subarray(s+1);let o;try{o=JSON.parse(i)}catch{throw L("OPENCLAW_CHANNEL_INVALID_FRAME")}if(o.type!=="heartbeat")if(o.type==="update"&&o.payload?.update&&o.payload?._meta?.channelUpdateId)await t(o.payload);else{if(o.type==="result"&&o.result?.stopReason)return o.result;throw o.type==="error"&&typeof o.code=="string"?L(o.code):L("OPENCLAW_CHANNEL_INVALID_FRAME")}}if(r.length>2097152)throw L("OPENCLAW_CHANNEL_FRAME_TOO_LARGE")}throw L("OPENCLAW_CHANNEL_STREAM_INTERRUPTED","OpenClaw \u8FC7\u7A0B\u8FDE\u63A5\u4E2D\u65AD\uFF0C\u672A\u6536\u5230\u4EFB\u52A1\u7EC8\u6001\uFF0C\u8BF7\u68C0\u67E5\u8282\u70B9\u8FDE\u63A5\u540E\u91CD\u8BD5\u3002")}var st=class{constructor(t,r){this.target=t,this.identity=r,this.bound=!1}async request(t,r,n=!1,s="mcp-bindings",i=3e4,o=null){let c=a(this.target.mcpBridgeUrl),u=a(this.target.mcpBridgeTokenEnv),d=this.target.env?.[u]||process.env[u];if(!c||!u||!d)throw Object.assign(new Error("OpenClaw requires the Orcha tool plugin, mcpBridgeUrl and mcpBridgeTokenEnv"),{code:"OPENCLAW_MCP_NOT_CONFIGURED"});let f=new URL(c);if(!["http:","https:"].includes(f.protocol)||f.username||f.password||f.pathname!=="/plugins/orcha-runtime/mcp-bindings"||f.search||f.hash)throw new Error("OpenClaw MCP binding URL must be the trusted Gateway plugin route");if(!["mcp-bindings","deliveries","background"].includes(s))throw new Error("Unsupported Orcha plugin route");f.pathname=`/plugins/orcha-runtime/${s}`;let p=AbortSignal.timeout(i);try{let h=await fetch(f,{method:t,redirect:"error",signal:p,headers:{authorization:`Bearer ${d}`,"content-type":"application/json",...o?{accept:gt}:{},...n?{"if-match":this.identity.runId}:{}},...r!==void 0?{body:JSON.stringify(r)}:{}});if(t==="GET"&&s==="deliveries"&&[404,405].includes(h.status))throw await h.body?.cancel(),L("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");if(h.ok&&o)return await jr(h,o);let m=await h.json();if(!h.ok)throw L(m.error||"OPENCLAW_MCP_BINDING_FAILED");return m}catch(h){throw Br(h,p)}}async bind(t,r=!1){kt(t),await this.request("PUT",{...this.identity,mcpServer:t[0]},r),this.bound=!0}async close(){this.bound&&(await this.request("DELETE",{runId:this.identity.runId,sessionKey:this.identity.sessionKey}),this.bound=!1)}};var Dt=class{constructor(t,r,n,s,i={}){this.agent=t,this.target=r,this.options=i,this.sessionKey=n,this.mcp=null,this.metadata=null,this.finished=!1,this.transport=new st(r,{runId:i.runId}),this.expiresAt=new Date(Date.now()+Number(i.sandboxPolicy?.maxRuntimeSeconds||i.sessionPromptTimeoutMs/1e3||3600)*1e3).toISOString()}async sessionNew({mcpServers:t,metadata:r}){if(r?.source!=="channel_message"||r.delivery?.dispatchMode!=="bridge")throw new Error("Invalid native Channel dispatch");return this.mcp=t[0],this.metadata=r,{sessionId:this.sessionKey}}async refreshMcpServers(t){this.mcp=t[0],this.promptBody&&await this.transport.request("PATCH",{...this.promptBody,mcpServer:this.mcp,attachOnly:!0},!1,"deliveries")}async sessionPrompt({prompt:t},r){if((await this.transport.request("GET",void 0,!1,"deliveries")).streamType!==gt)throw L("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");this.promptBody={runId:this.options.runId,agentCode:this.target.openclawAgentId||this.metadata.agentCode,delivery:this.metadata.delivery,expiresAt:this.expiresAt,mcpServer:this.mcp,attachOnly:this.options.attachOnly===!0,prompt:t};let s=await this.transport.request("POST",this.promptBody,!1,"deliveries",Number(this.options.sessionPromptTimeoutMs||36e5),i=>r?.(i));return this.finished=!0,s}async stop(){!this.finished&&this.promptBody&&await this.transport.request("DELETE",{runId:this.options.runId},!1,"deliveries")}};function me(e){let t=l(e.metadata)?e.metadata:{};return a(t.agentCode)}function qr(e,t,r){let n=a(r?.openclawAgentId)||me(e);return n?`agent:${n}:${t}`:`orcha-${t}`}var vt=class extends nt{constructor(t,r,n,s={},i={}){if(i.source==="channel_message")return new Dt(t,r,n,s,i);let o=a(n).replace(/[^A-Za-z0-9._-]+/g,"-")||"default",c=a(r.command)||"openclaw",u=Array.isArray(r.args)?r.args.map(String):[],d=u.length>0?u:["acp","--session",qr(t,o,r)];super(t,{...r,command:c,args:d},s,i),this.boundSessionKey=qr(t,o,r),this.binding=null}async sessionNew(t={}){if(t.mcpServers?.length){let r=[...this.target.args],n=r.indexOf("--session"),s=r.find(u=>u.startsWith("--session=")),i=s?s.slice(10):n<0?null:r[n+1];if(i&&i!==this.boundSessionKey)throw Object.assign(new Error("OpenClaw --session must match this Orcha task's private session"),{code:"OPENCLAW_SESSION_BINDING_CONFLICT"});i===null&&r.push("--session",this.boundSessionKey),this.target.args=r;let o=a(this.options.runId),c=Number(this.options.sandboxPolicy?.maxRuntimeSeconds||this.options.sessionPromptTimeoutMs/1e3||3600);if(!o||!me(this.agent))throw new Error("OpenClaw MCP requires a trusted task and Agent identity");this.binding=new st(this.target,{runId:o,sessionKey:this.boundSessionKey,agentCode:a(this.target.openclawAgentId)||me(this.agent),expiresAt:new Date(Date.now()+c*1e3).toISOString()}),await this.binding.bind(t.mcpServers)}try{return await super.sessionNew(t)}catch(r){throw await this.binding?.close(),r}}async refreshMcpServers(t){if(!this.binding)throw Object.assign(new Error("The original OpenClaw task binding is unavailable"),{code:"RUNTIME_OPERATION_NOT_FOUND"});await this.binding.bind(t,!0)}async stop(t){try{await super.stop(t)}finally{await this.binding?.close()}}sessionNewParams(t={}){return{...t,mcpServers:[]}}};import{spawn as Yr}from"node:child_process";import{randomUUID as it}from"node:crypto";import{existsSync as Qr,mkdirSync as Xs,readdirSync as Zr,readFileSync as tn,realpathSync as Tt,rmSync as Ys,rmdirSync as Qs,statSync as Zs,unlinkSync as ti}from"node:fs";import{homedir as ei,tmpdir as en}from"node:os";import{basename as we,dirname as ri,join as $,resolve as Gr}from"node:path";async function Kr(e){let t=await $r(e),r="ORCHA_TASK_MCP_TOKEN";return{args:["-c",`mcp_servers.orcha={url=${JSON.stringify(t.url)},bearer_token_env_var=${JSON.stringify(r)},required=true}`],environment:{[r]:t.token},refresh:n=>t.refresh(n),close:()=>t.close()}}var ni=36e5,rn=5e3,si=2*60*1e3,ii=2*60*1e3,oi=12,ai=1e3,ci=1500,ui=1e3,Ht=24*60*60*1e3,_t=new Set(["final_answer","final","complete","completed","done"]),li=new Set(["function_call","function_call_output","custom_tool_call","custom_tool_call_output","local_shell_call","local_shell_call_output","mcp_tool_call","mcp_tool_call_output","web_search_call","image_generation_call","image_generation_end"]),di=new Set(["context_compacted","context_compaction","context_compressed"]);function $t(e,t){if(e?.pid){if(process.platform==="win32"){let r=["/PID",String(e.pid),"/T"];t==="SIGKILL"&&r.push("/F");try{Yr("taskkill",r,{stdio:"ignore",windowsHide:!0}).unref?.()}catch{try{e.kill(t)}catch{}}return}try{process.kill(-e.pid,t)}catch(r){if(r?.code==="ESRCH")return;try{e.kill(t)}catch{}}}}function ge(e){$t(e,"SIGTERM");let t=setTimeout(()=>$t(e,"SIGKILL"),rn);return t.unref?.(),t}function v(e){if(typeof e=="string")return e;if(Array.isArray(e))return e.map(t=>v(t)).join("");if(!l(e))return"";for(let t of["text","delta","output_text","content","message","output"]){let r=v(e[t]);if(r)return r}return""}function nn(e){if(!l(e))return"";let t=l(e.payload)?e.payload:{};if(a(e.type)==="event_msg"){if(a(t.type)==="agent_message")return a(t.message);if(a(t.type)==="task_complete")return a(t.last_agent_message)}if(a(e.type)==="response_item"&&a(t.type)==="message"&&a(t.role)==="assistant")return v(t.content)||v(t.message);if(a(e.type)==="result")return v(e.result);let r=v(e.delta)||v(e.text)||v(e.content);if(r)return r;let n=l(e.item)?e.item:{};return["message","agent_message"].includes(a(n.type))||a(n.role)==="assistant"?v(n.content)||v(n.text)||v(n.message):""}function sn(e,t={}){return pe(e,{source:"codex_cli_image_generation",...t})}function on(e,t){Pt(e.artifacts,t)}function an(e){return W(he(e))}function Re(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);if(r==="event_msg"&&n==="task_complete")return!0;let s=a(t.phase||t.status||t.stage).toLowerCase();if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&a(t.role)==="assistant")return _t.has(s);let i=l(e.item)?e.item:{};return r==="item.completed"&&a(i.type)==="agent_message"?!0:r==="result"&&e.is_error!==!0?a(e.result).length>0:!1}function zr(e){let t=a(e.terminalProtocol||e.eventProtocol).toLowerCase();if(t)return t;let r=we(a(e.command)).replace(/\.exe$/i,"").toLowerCase();return r==="codex"||r==="claude"?r:""}function Vr(e,t,r){let n=l(t.error)?t.error:{},s=a(n.message)||v(t.error)||a(t.result)||a(t.message)||r;return Object.assign(new Error(s),{code:e})}function fi(e,t){if(!l(e))return null;let r=a(e.type).toLowerCase();if(t==="codex")return r==="turn.completed"?{status:"completed",result:{stopReason:"end_turn"}}:r==="turn.failed"?{status:"failed",error:Vr("RUNTIME_CODEX_TURN_FAILED",e,"Codex turn failed")}:null;if(t==="claude"&&r==="result"){let n=a(e.subtype).toLowerCase();return e.is_error===!0||n.startsWith("error")||["failed","failure"].includes(n)?{status:"failed",error:Vr("RUNTIME_CLAUDE_RESULT_FAILED",e,"Claude result failed")}:{status:"completed",result:{stopReason:"end_turn",...a(e.result)?{output:a(e.result)}:{}}}}return null}function Wr(e){return l(e)?a(e.phase||e.status||e.stage).toLowerCase():""}function pi(e){if(!l(e)||Re(e))return!1;let t=l(e.payload)?e.payload:{},r=a(e.type),n=a(t.type),s=Wr(t);if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&a(t.role)==="assistant")return!!(s&&!_t.has(s));let i=l(e.item)?e.item:{},o=Wr(i);return a(i.role)==="assistant"||a(i.type)==="message"?!!(o&&!_t.has(o)):!1}function hi(e,t,r){return r.captureLastMessage===!1||t.includes("--output-last-message")||t.includes("-o")?!1:r.captureLastMessage===!0?!0:we(e)==="codex"}function mi(e,t){return t.collectCodexTranscriptArtifacts===!1?!1:t.collectCodexTranscriptArtifacts===!0?!0:we(e)==="codex"}function cn(e){return Math.max(20,_(e.codexTranscriptPollMs||e.transcriptPollMs,ai))}function gi(e){return Math.max(0,_(e.codexFinalOutputWaitMs||e.finalOutputWaitMs,ci))}function Bt(e){if(typeof e=="boolean")return e;let t=a(e).toLowerCase();return["true","1","yes","y","on"].includes(t)?!0:["false","0","no","n","off"].includes(t)?!1:null}function Ee(e){let t=l(e?.metadata)?e.metadata:{};return l(t._runtimeBridge)?t._runtimeBridge:{}}function _e(e){return a(Ee(e).promptKind).toLowerCase()}function _i(e,t){for(let r of[e.codexTranscriptStreaming,e.streamCodexTranscript]){let n=Bt(r);if(n!=null)return n}return _e(t)==="chat"}function Ti(e,t){let r=Ee(e);for(let s of[r.emitThoughtChunks,r.streamThoughts]){let i=Bt(s);if(i!=null)return i}let n=_e(e);if(n&&n!=="chat")return!1;for(let s of[t.emitThoughtChunks,t.streamThoughts]){let i=Bt(s);if(i!=null)return i}return _e(e)==="chat"}function yi(e){let t=Ee(e);for(let r of[t.finalTextOnly,t.finalOutputOnly]){let n=Bt(r);if(n!=null)return n}return null}function wi(e,t){let r=yi(e);return r??(t.finalTextOnly===!0||t.finalOutputOnly===!0?!0:(t.finalTextOnly===!1||t.finalOutputOnly===!1,!1))}function Ri(e,t){return!e.finalTextOnly||t}function un(e,t,r,n,s=n){return!n||e.emittedTexts.has(s)?!1:(e.emittedTexts.add(s),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}}),!0)}function ln(e,t,r,n){return!n||e.emittedThoughtTexts.has(n)?!1:(e.emittedThoughtTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_thought_chunk",content:{type:"text",text:n}}}),!0)}function Ei(e,t,r,n=new Set){return{target:e,promptText:t,startedAtMs:r,baselinePaths:n,matchedPath:"",disabled:!1,processedLines:new Map}}function Si(e,t){let r=l(e.env)?e.env:{},n=a(e.artifactRoot||e.artifactDir||e.runtimeArtifactRoot||r.ORCHA_RUNTIME_ARTIFACT_DIR)||$(en(),"orcha-runtime-artifacts"),s=a(t).replace(/[^A-Za-z0-9._-]+/g,"-").slice(0,80)||it(),i=$(n,s),o=$(i,it());return Xs(o,{recursive:!0}),{root:o,realRoot:Tt(o),sessionRoot:i,realSessionRoot:Tt(i)}}function Oi(e){let t=a(e?.artifactDirectory);if(!t)throw new Error("sandbox launch did not provide an artifact directory");return{root:t,realRoot:Tt(t),sessionRoot:"",realSessionRoot:""}}function dn(e){return a(l(e)?e.root:e)}function Jr(e){let t=dn(e),r=a(l(e)?e.sessionRoot:ri(t)),n=a(l(e)?e.realSessionRoot:"");if(r)try{if(n&&Tt(r)!==n)return;Qs(r)}catch{}}function Ii(e,t={}){let r=dn(e),n=a(l(e)?e.realRoot:"");if(r){try{if(n&&Tt(r)!==n){g("warn","runtime.cli","runtime artifact directory cleanup skipped; path changed",{...t,artifactRoot:r});return}}catch{Jr(e);return}try{Ys(r,{recursive:!0,force:!0})}catch(s){g("warn","runtime.cli","runtime artifact directory cleanup failed",{...t,artifactRoot:r,error:String(s?.message||s)});return}Jr(e)}}function Ci(e,t,r=null){return{trustedFileRoots:[t,a(r?.artifactDirectory),a(r?.homeDirectory),...x(e.trustedArtifactRoots),...x(e.trustedFileRoots),...x(e.artifactRoots),...x(e.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(r?.pathMappings)?r.pathMappings:[]}}function fn(e){let t=a(e.codexSessionsRoot||e.codexSessionRoot);if(t)return t;let r=l(e.env)?e.env:{},n=a(e.codexHome||r.CODEX_HOME||process.env.CODEX_HOME)||$(ei(),".codex");return $(n,"sessions")}function Ai(e,t){let r=new Date(t),n=String(r.getFullYear()),s=String(r.getMonth()+1).padStart(2,"0"),i=String(r.getDate()).padStart(2,"0");return $(e,n,s,i)}function pn(e,t,r){let n=new Set;for(let s of[t-Ht,t,t+Ht,r-Ht,r,r+Ht])n.add(Ai(e,s));return[...n].filter(s=>Qr(s))}function xi(e,t,r){let n=fn(e),s=t-si,i=r+ii,o=[];for(let c of pn(n,t,r)){let u=[];try{u=Zr(c)}catch{continue}for(let d of u){if(!d.endsWith(".jsonl"))continue;let f=$(c,d);try{let p=Zs(f);if(!p.isFile()||p.mtimeMs<s||p.mtimeMs>i)continue;o.push({path:f,mtimeMs:p.mtimeMs})}catch{}}}return o.sort((c,u)=>u.mtimeMs-c.mtimeMs).slice(0,oi)}function Ni(e,t,r=t){let n=fn(e),s=new Set;for(let i of pn(n,t,r)){let o=[];try{o=Zr(i)}catch{continue}for(let c of o)c.endsWith(".jsonl")&&s.add($(i,c))}return s}function Te(e,t,r=0){if(!(r>8||e===null||e===void 0)){if(typeof e=="string"){e&&t.push(e);return}if(Array.isArray(e)){for(let n of e)Te(n,t,r+1);return}if(l(e))for(let n of["payload","item","text","delta","output_text","content","message","output","input","prompt","last_agent_message","revised_prompt"])n in e&&Te(e[n],t,r+1)}}function hn(e){return a(e).replace(/\s+/g," ")}function bi(e){let t=hn(e);if(!t)return[];if(t.length<=200)return[t];let r=160,n=[0,Math.floor((t.length-r)/2),t.length-r],s=new Set,i=[];for(let o of n){let c=t.slice(Math.max(0,o),Math.max(0,o)+r).trim();c.length>=40&&!s.has(c)&&(s.add(c),i.push(c))}return i}function Mi(e,t){let r=bi(t);if(!r.length)return!1;let n=[];for(let i of e)Te(i,n);let s=hn(n.join(" "));return r.every(i=>s.includes(i))}function Ui(e){return e.find(t=>l(t)&&a(t.type)==="session_meta"&&l(t.payload))||null}function Pi(e){let t=l(e?.payload)?e.payload:{},r=a(e?.timestamp||t.timestamp),n=Date.parse(r);return Number.isFinite(n)?n:Number.NaN}function Li(e){let t=a(e.originator),r=a(e.source);if(t!=="codex_exec"&&r!=="exec"||a(e.parent_thread_id))return!1;let n=a(e.thread_source);if(n&&n!=="user")return!1;let s=a(e.session_id),i=a(e.id);return!(s&&i&&s!==i)}function ki(e,t,r){if(!Mi(e,t.promptText))return!1;let n=Ui(e);if(!n)return!1;let s=n.payload;if(!Li(s))return!1;let i=Pi(n);if(!Number.isFinite(i)||i<t.startedAtMs-5e3||i>r+5e3)return!1;let o=a(t.target.cwd),c=a(s.cwd);return!(o&&c&&Gr(o)!==Gr(c))}function Xr(e){try{return vi(tn(e,"utf8"))}catch{return null}}function Di(e,t,r){if(!e||e.disabled)return null;if(e.matchedPath){let s=Xr(e.matchedPath);return s?{path:e.matchedPath,events:s}:null}let n=[];for(let s of xi(e.target,e.startedAtMs,r)){if(e.baselinePaths.has(s.path))continue;let i=Xr(s.path);!i||!ki(i,e,r)||n.push({path:s.path,events:i})}return n.length!==1?(n.length>1&&(e.disabled=!0,g("warn","runtime.cli","codex transcript fallback disabled; multiple matching transcripts",{target:e.target.targetCode,sessionId:t,transcriptCount:n.length})),null):(e.matchedPath=n[0].path,g("info","runtime.cli","codex transcript stream attached",{target:e.target.targetCode,sessionId:t}),n[0])}function vi(e){let t=[];for(let r of e.split(/\r?\n/)){let n=r.trim();if(n)try{t.push(JSON.parse(n))}catch{}}return t}function Hi(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);return r==="event_msg"&&n==="image_generation_end"||r==="response_item"&&n==="image_generation_call"}function Fi(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{};return a(e.type)==="response_item"&&li.has(a(t.type))}function $i(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{};return di.has(a(t.type))}function Bi(e,t,r,n){let s=nn(e),i=Re(e),o=0,c=0,u=0;if(s&&!i&&t.emitThoughtChunks&&ln(t,r,n,s)&&(u=1),s&&i){let d=t.emittedTexts.size?`
+`;this.child.stdin.write(s,r)}onNotification(t,r){let n=this.notificationHandlers.get(t)||new Set;return n.add(r),this.notificationHandlers.set(t,n),()=>{n.delete(r),n.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,r){return this.requestHandlers.set(t,r),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let r of this.pending.values())clearTimeout(r.timer),r.reject(t);this.pending.clear()}handleExit(t,r){this.exited=!0,this.exitCode=t,this.exitSignal=r,this.rejectAll(new Error(`runtime exited before response (${t}/${r})`));for(let n of this.exitHandlers)n(t,r)}async waitForExit(t=5e3){return!this.child||this.exited?!0:await new Promise(r=>{let n=setTimeout(()=>{s(),r(!1)},t);n.unref?.();let s=()=>{clearTimeout(n),this.exitHandlers.delete(i)},i=()=>{s(),r(!0)};this.exitHandlers.add(i),this.exited&&i()})}signal(t){if(!this.child||this.exited)return!1;let r=this.child.pid;if(!r)return!1;try{return this.detached&&process.platform!=="win32"?process.kill(-r,t):this.child.kill(t),!0}catch(n){if(n?.code==="ESRCH")return this.exited=!0,!1;try{return this.child.kill(t),!0}catch(s){return s?.code!=="ESRCH"&&g("warn","runtime","runtime signal failed",{target:this.label,pid:r,signal:t,error:String(s)}),!1}}}async stop(t="stop",{termTimeoutMs:r=5e3,killTimeoutMs:n=2e3}={}){if(!(!this.child||this.exited)){if(this.stopPromise)return await this.stopPromise;this.stopPromise=(async()=>{if(!this.child||this.exited)return;let s=this.child.pid;g("info","runtime","stopping runtime",{target:this.label,reason:t,pid:s}),this.rejectAll(new Error(`runtime stopped: ${t}`)),this.signal("SIGTERM"),!await this.waitForExit(r)&&this.child&&!this.exited&&(g("warn","runtime","runtime did not exit after SIGTERM; force killing",{target:this.label,reason:t,pid:s}),this.signal("SIGKILL"),await this.waitForExit(n))})();try{await this.stopPromise}finally{this.stopPromise=null}}}};import{randomUUID as Jr}from"node:crypto";import{existsSync as ci,readFileSync as ui,realpathSync as Gr,statSync as li}from"node:fs";import{basename as Vr,extname as Wr,isAbsolute as Tt,join as di,relative as Xr,resolve as Kr}from"node:path";var fi=25*1024*1024;function Yr(e,t=""){let r=c(t);if(r)return r;let n=Wr(c(e)).toLowerCase();return n===".jpg"||n===".jpeg"?"image/jpeg":n===".webp"?"image/webp":n===".gif"?"image/gif":"image/png"}function Qr(e,t){let r=typeof e=="string"?e.trim():"";return!r||r==="<omitted>"?"":r.startsWith("data:")?r:`data:${t};base64,${r.replace(/\s+/g,"")}`}function Ht(e){if(Array.isArray(e))return e.map(c).filter(Boolean);let t=c(e);return t?[t]:[]}function pi(e,t){let r=Xr(t,e);return r===""||!!r&&!r.startsWith("..")&&!Tt(r)}function hi(e,t){let r=c(e);if(!r||!ci(r))return"";try{let n=Gr(r);for(let s of t)try{let i=Gr(s);if(pi(n,i))return n}catch{}}catch{return""}return""}function mi(e,t){let r=c(e);if(!r||!Tt(r))return r;for(let n of Array.isArray(t)?t:[]){if(!l(n))continue;let s=c(n.runtimeRoot),i=c(n.hostRoot);if(!s||!i||!Tt(s)||!Tt(i))continue;let o=Xr(Kr(s),Kr(r));if(o===""||!o.startsWith("..")&&!Tt(o))return o?di(i,o):i}return r}function we(e,t,r={}){let n=c(e);return!n||n.startsWith("data:")||/^https?:\/\//i.test(n)?n:gi(n,t,r)}function gi(e,t,r={}){let n=[...Ht(r.trustedFileRoots),...Ht(r.trustedFileRoot),...Ht(r.artifactRoots),...Ht(r.artifactRoot)],s=hi(mi(e,r.pathMappings),n);if(!s)return"";try{let i=li(s);return!i.isFile()||i.size<=0||i.size>fi?"":`data:${t};base64,${ui(s).toString("base64")}`}catch{return""}}function x(...e){for(let t of e){let r=c(t);if(r)return r}return""}function _i(e,t,r,n){let s=r.toLowerCase();if(s==="image"||s==="picture")return!0;let i=x(n,e.previewUrl,e.fileUrl,e.imageUrl,e.dataUrl,e.url,e.uri,t.previewUrl,t.fileUrl,t.imageUrl,t.dataUrl,t.url,t.uri),o=Wr(i.split("?",1)[0].split("#",1)[0]).toLowerCase();return[".png",".jpg",".jpeg",".webp",".gif"].includes(o)}function Re(e,t={}){let{source:r="runtime_image_generation_event"}=t;if(!l(e))return null;let n=l(e.payload)?e.payload:{},s=c(e.type),i=c(n.type);if(!(s==="event_msg"&&i==="image_generation_end"||s==="response_item"&&i==="image_generation_call"))return null;let o=x(n.call_id,n.id),a=x(n.saved_path,n.savedPath),u=x(n.revised_prompt,n.revisedPrompt),d=Yr(a,n.mimeType||n.mime_type),f=Qr(n.result,d)||we(a,d,t);if(!f)return null;let p=f.startsWith("data:")?f:"",h=a?Vr(a):`${o||Jr()}.png`;return{artifactType:"image",type:"image",fieldKey:"image",title:h||"Generated image",summary:u||"Generated image",content:{prompt:u||void 0,dataUrl:p||void 0,imageUrl:f,previewUrl:f,fileUrl:f,mimeType:d},dataUrl:p||void 0,previewUrl:f,fileUrl:f,metadata:{source:r,eventType:i,callId:o||void 0,savedPath:a||void 0,filename:h,mimeType:d,revisedPrompt:u||void 0}}}function yi(e){let t=l(e)?e:{},r=[];for(let n of["_artifacts","artifacts"]){let s=t[n];Array.isArray(s)&&r.push(...s)}for(let n of["_artifact","artifact"]){let s=t[n];l(s)&&r.push(s)}return r}function Ti(e,t={}){let{source:r="runtime_artifact"}=t,n=l(e)?e:{};if(!Object.keys(n).length)return null;let s=l(n.content)?{...n.content}:{},i=l(n.metadata)?{...n.metadata}:{},o=x(n.saved_path,n.savedPath,s.saved_path,s.savedPath,i.savedPath),a=x(n.mimeType,n.mime_type,s.mimeType,s.mime_type,i.mimeType),u=x(n.artifactType,n.artifact_type,n.type,n.kind,s.type,o?"image":"file"),d=_i(n,s,u,o),f=d?Yr(o,a):a;if(d){let N=x(n.dataUrl,s.dataUrl),_=N.startsWith("data:")?N:"",w=x(n.imageUrl,n.previewUrl,n.fileUrl,n.downloadUrl,n.url,n.uri,s.imageUrl,s.previewUrl,s.fileUrl,s.downloadUrl,s.url,s.uri),E=Qr(n.result??s.result,f)||_||we(o,f,t)||we(w,f,t);E&&(E.startsWith("data:")&&(s.dataUrl||=E),s.imageUrl||=E,s.previewUrl||=E,s.fileUrl||=E,f&&(s.mimeType||=f))}for(let[N,_]of[["prompt","prompt"],["previewUrl","previewUrl"],["fileUrl","fileUrl"],["downloadUrl","downloadUrl"],["imageUrl","imageUrl"],["dataUrl","dataUrl"],["url","url"],["uri","uri"],["mimeType","mimeType"],["mime_type","mimeType"]]){let w=n[N];w!=null&&w!==""&&!(_ in s)&&(s[_]=w)}let p=x(n.fileUrl,n.downloadUrl,n.imageUrl,n.dataUrl,n.url,n.uri,s.fileUrl,s.downloadUrl,s.imageUrl,s.dataUrl,s.url,s.uri),h=x(n.previewUrl,n.imageUrl,n.dataUrl,n.url,n.fileUrl,n.uri,s.previewUrl,s.imageUrl,s.dataUrl,s.url,s.fileUrl,s.uri),m=x(n.dataUrl,s.dataUrl,p.startsWith("data:")?p:"",h.startsWith("data:")?h:""),y=x(n.filename,i.filename,o?Vr(o):""),S=x(n.fieldKey,n.field_key,s.fieldKey,i.fieldKey,d?"image":"artifact");return{...n,artifactType:u,type:n.type||u,fieldKey:S,title:x(n.title,y,"Runtime artifact"),summary:x(n.summary,s.prompt,n.title,y,"Runtime artifact"),content:s,dataUrl:m||void 0,fileUrl:p||void 0,previewUrl:h||void 0,metadata:{...i,source:x(i.source,r),savedPath:o||i.savedPath,filename:y||i.filename,mimeType:f||i.mimeType}}}function Ft(e,t){if(!t||!e)return;let r=l(t.metadata)?t.metadata:{},n=x(r.savedPath,r.callId,t.previewUrl,t.fileUrl)||Jr(),s=e.get(n);if(!s){e.set(n,t);return}s.content={...l(s.content)?s.content:{},...l(t.content)?t.content:{}},s.metadata={...l(s.metadata)?s.metadata:{},...r},s.previewUrl=t.previewUrl||s.previewUrl,s.fileUrl=t.fileUrl||s.fileUrl,s.summary=t.summary||s.summary,s.title=t.title||s.title}function Ee(e,t,r={}){for(let n of yi(e))Ft(t,Ti(n,r))}function Se(e){if(!l(e)||!l(e.payload))return l(e)?e:{value:e};let t=c(e.payload.type);if(t!=="image_generation_end"&&t!=="image_generation_call")return e;let r={...e.payload};return typeof r.result=="string"&&r.result&&(r.result="<omitted>",r.resultLength=e.payload.result.length),{...e,payload:r}}function zr(e,t,r){if(!l(e))return e;let n=l(e.event)?e.event:null;return n?(Ft(t,Re(n,r)),{...e,event:Se(n)}):e}function Zr(e,t,r={}){if(!l(e))return e;Ee(e,t,r);let n=zr(e,t,r),s=l(n.update)?zr(n.update,t,r):null;return s&&s!==n.update&&(n={...n,update:s}),n}function tn(e,t,r={}){let n=l(e)?{...e}:{};Ee(n,t,r),Ee(l(n.output)?n.output:{},t,r);let s=[...t?.values?.()||[]];return s.length&&(n._artifacts=s),delete n.artifacts,n}function en(e,t){let r=T(e,t);return r>0?r:t}var ct=class{constructor(t,r,n={},s={}){this.agent=t,this.target=r,this.callbacks=n,this.options=s,this.proc=null,this.launch=null,this.launchCleanup=null,this.permissionHandlers=new Map}async ensureStarted(){if(this.proc)return;let t=c(this.target.command);if(!t)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let r={command:t,args:A(this.target.args),cwd:Z(this.target,this.agent.workspace),environment:l(this.target.env)?this.target.env:{}},n=this.options.prepareLaunch?await this.options.prepareLaunch(r):{...r,environment:{...process.env,...r.environment},cleanup:async()=>{}};this.launch=n,this.launchCleanup=n.cleanup,this.proc=new Dt({command:n.command,args:n.args,cwd:n.cwd,env:n.environment,label:`${this.agent.agentId}:${this.agent.targetCode}`,framing:c(this.target.framing||"line")}),this.proc.onRequest("session/request_permission",s=>this.handlePermissionRequest(s)),this.proc.onRequest("session/requestPermission",s=>this.handlePermissionRequest(s));try{await this.proc.start({initialize:this.target.initialize!==!1,initializeTimeoutMs:en(this.target.initializeTimeoutMs,en(this.options.initializeTimeoutMs,3e4)),initializeParams:{clientInfo:{name:"orcha-runtime-bridge",version:J},...l(this.target.initializeParams)?this.target.initializeParams:{}}})}catch(s){throw await this.proc?.stop("runtime startup failed"),this.proc=null,await this.cleanupLaunch(),s}}async sessionNew(t={}){return await this.ensureStarted(),this.proc.call("session/new",this.sessionNewParams(t))}sessionNewParams(t={}){let r=Array.isArray(t.mcpServers)?t.mcpServers:Array.isArray(this.target.mcpServers)?this.target.mcpServers:[];return{...t,mcpServers:r}}async sessionPrompt(t,r){await this.ensureStarted();let n=c(t.sessionId),s=new Map,i=this.artifactOptions(),o=this.proc.onNotification("session/update",u=>{let d=c(u.sessionId);(!d||d===n)&&r(Zr(u,s,i))}),a=async u=>this.callbacks.onPermissionRequest?.({agent:this.agent,runtimeSessionId:n,request:u,emitUpdate:r})||{outcome:"denied",reason:"permission handler is not configured"};n&&this.permissionHandlers.set(n,a),this.permissionHandlers.set("*",a);try{let u=await this.proc.call("session/prompt",t,this.options.sessionPromptTimeoutMs);return tn(u,s,i)}finally{o(),n&&this.permissionHandlers.delete(n),this.permissionHandlers.delete("*")}}async sessionCancel(t){return await this.ensureStarted(),this.proc.call("session/cancel",t,5e3).catch(()=>({ok:!0}))}async handlePermissionRequest(t){let r=c(t.sessionId),n=this.permissionHandlers.get(r)||this.permissionHandlers.get("*");return n?n(t):{outcome:"denied",reason:"no active Orcha permission handler"}}artifactSource(){return c(this.target.type||"acp")==="openclaw"?"openclaw_image_generation":"acp_runtime_image_generation"}artifactOptions(){let t=l(this.target.env)?this.target.env:{};return{source:this.artifactSource(),trustedFileRoots:[c(this.launch?.artifactDirectory),c(this.launch?.homeDirectory),c(this.target.artifactRoot),c(this.target.artifactDir),c(this.target.runtimeArtifactRoot),c(t.ORCHA_RUNTIME_ARTIFACT_DIR),...A(this.target.trustedArtifactRoots),...A(this.target.trustedFileRoots),...A(this.target.artifactRoots),...A(this.target.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(this.launch?.pathMappings)?this.launch.pathMappings:[]}}async stop(t){try{await this.proc?.stop(t)}finally{this.proc=null,await this.cleanupLaunch()}}async cleanupLaunch(){let t=this.launchCleanup;this.launchCleanup=null,this.launch=null,await t?.()}};var $t=class{constructor(t,r,n,s,i={}){this.agent=t,this.target=r,this.options=i,this.sessionKey=n,this.mcp=null,this.metadata=null,this.finished=!1,this.transport=new V(r,{runId:i.runId}),this.expiresAt=new Date(Date.now()+Number(i.sandboxPolicy?.maxRuntimeSeconds||i.sessionPromptTimeoutMs/1e3||3600)*1e3).toISOString()}async sessionNew({mcpServers:t,metadata:r}){if(r?.source!=="channel_message"||r.delivery?.dispatchMode!=="bridge")throw new Error("Invalid native Channel dispatch");return this.mcp=t[0],this.metadata=r,{sessionId:this.sessionKey}}async refreshMcpServers(t){this.mcp=t[0],this.promptBody&&await this.transport.request("PATCH",{...this.promptBody,mcpServer:this.mcp,attachOnly:!0},!1,"deliveries")}async sessionPrompt({prompt:t},r){if((await this.transport.request("GET",void 0,!1,"deliveries")).streamType!==tt)throw M("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");this.promptBody={runId:this.options.runId,agentCode:this.target.openclawAgentId||this.metadata.agentCode,delivery:this.metadata.delivery,expiresAt:this.expiresAt,mcpServer:this.mcp,attachOnly:this.options.attachOnly===!0,prompt:t};let s=await this.transport.request("POST",this.promptBody,!1,"deliveries",Number(this.options.sessionPromptTimeoutMs||36e5),i=>r?.(i));return this.finished=!0,s}async stop(){!this.finished&&this.promptBody&&await this.transport.request("DELETE",{runId:this.options.runId},!1,"deliveries")}};function Oe(e){let t=l(e.metadata)?e.metadata:{};return c(t.agentCode)}function rn(e,t,r){let n=c(r?.openclawAgentId)||Oe(e);return n?`agent:${n}:${t}`:`orcha-${t}`}var Bt=class extends ct{constructor(t,r,n,s={},i={}){if(i.source==="channel_message")return new $t(t,r,n,s,i);let o=c(n).replace(/[^A-Za-z0-9._-]+/g,"-")||"default",a=c(r.command)||"openclaw",u=Array.isArray(r.args)?r.args.map(String):[],d=u.length>0?u:["acp","--session",rn(t,o,r)];super(t,{...r,command:a,args:d},s,i),this.boundSessionKey=rn(t,o,r),this.binding=null}async sessionNew(t={}){if(t.mcpServers?.length){let r=[...this.target.args],n=r.indexOf("--session"),s=r.find(u=>u.startsWith("--session=")),i=s?s.slice(10):n<0?null:r[n+1];if(i&&i!==this.boundSessionKey)throw Object.assign(new Error("OpenClaw --session must match this Orcha task's private session"),{code:"OPENCLAW_SESSION_BINDING_CONFLICT"});i===null&&r.push("--session",this.boundSessionKey),this.target.args=r;let o=c(this.options.runId),a=Number(this.options.sandboxPolicy?.maxRuntimeSeconds||this.options.sessionPromptTimeoutMs/1e3||3600);if(!o||!Oe(this.agent))throw new Error("OpenClaw MCP requires a trusted task and Agent identity");this.binding=new V(this.target,{runId:o,sessionKey:this.boundSessionKey,agentCode:c(this.target.openclawAgentId)||Oe(this.agent),expiresAt:new Date(Date.now()+a*1e3).toISOString()}),await this.binding.bind(t.mcpServers)}try{return await super.sessionNew(t)}catch(r){throw await this.binding?.close(),r}}async refreshMcpServers(t){if(!this.binding)throw Object.assign(new Error("The original OpenClaw task binding is unavailable"),{code:"RUNTIME_OPERATION_NOT_FOUND"});await this.binding.bind(t,!0)}async stop(t){try{await super.stop(t)}finally{await this.binding?.close()}}sessionNewParams(t={}){return{...t,mcpServers:[]}}};import{spawn as mn}from"node:child_process";import{randomUUID as ut}from"node:crypto";import{existsSync as gn,mkdirSync as Ci,readdirSync as _n,readFileSync as yn,realpathSync as Rt,rmSync as xi,rmdirSync as Ai,statSync as Ni,unlinkSync as bi}from"node:fs";import{homedir as Tn,tmpdir as wn}from"node:os";import{basename as be,dirname as Mi,join as F,resolve as ln}from"node:path";async function nn(e){let t=await $r(e),r="ORCHA_TASK_MCP_TOKEN";return{args:["-c",`mcp_servers.orcha={url=${JSON.stringify(t.url)},bearer_token_env_var=${JSON.stringify(r)},required=true}`],environment:{[r]:t.token},refresh:n=>t.refresh(n),close:()=>t.close()}}import{createHash as wi,randomUUID as Ei}from"node:crypto";import{mkdirSync as sn,readFileSync as Ri,renameSync as Si,rmSync as Oi,writeFileSync as on}from"node:fs";import{homedir as Ii}from"node:os";import{join as wt}from"node:path";var an=e=>wi("sha256").update(JSON.stringify(e)).digest("hex"),et=(e,t)=>Object.assign(new Error(t),{code:e}),cn=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,jt=class{constructor(t,r=wt(Ii(),".orcha","codex-sessions")){this.directory=wt(r,an(t))}async turn(t,r,n,s,i){if(!t)throw et("BAD_REQUEST","Codex native turn requires a run ID");sn(this.directory,{recursive:!0,mode:448});let o=wt(this.directory,"active");try{sn(o,{mode:448})}catch(f){throw f.code==="EEXIST"?et("RUNTIME_SESSION_BUSY","Codex \u4EFB\u52A1\u4ECD\u5728\u8FD0\u884C\u6216\u4E0A\u8F6E\u5F02\u5E38\u4E2D\u65AD\uFF1B\u8BF7\u7B49\u5F85\u5B8C\u6210\uFF0C\u6216\u53D1\u9001 /new \u5F00\u59CB\u65B0\u4EFB\u52A1"):f}let a=wt(this.directory,"session.json"),u,d=()=>{let f=`${a}.${Ei()}.pending`;on(f,JSON.stringify(u),{mode:384}),Si(f,a)};try{try{u=JSON.parse(Ri(a,"utf8"))}catch(m){if(m.code!=="ENOENT")throw m}if(u&&!cn.test(u.threadId||""))throw et("RUNTIME_OPERATION_NOT_FOUND","Codex \u4E0A\u8F6E\u672A\u80FD\u4FDD\u5B58\u539F\u751F\u4F1A\u8BDD\u6807\u8BC6\uFF0C\u8BF7\u53D1\u9001 /new");try{on(wt(this.directory,`${an(t)}.run`),"",{flag:"wx",mode:384})}catch(m){throw m.code==="EEXIST"?et("RUNTIME_OPERATION_NOT_FOUND","\u6B64\u8F6E Codex \u5DF2\u6267\u884C\u6216\u6267\u884C\u7ED3\u679C\u4E0D\u786E\u5B9A\uFF0C\u4E0D\u80FD\u91CD\u590D\u53D1\u9001"):m}u||={threadId:null},d();let f,p=m=>{if(f)return;let y=m.update?.sessionUpdate==="runtime_event"&&m.update.event;if(y?.type==="thread.started")try{if(!cn.test(y.thread_id||"")||u.threadId&&u.threadId!==y.thread_id)throw et("CODEX_SESSION_MISMATCH","Codex \u8FD4\u56DE\u4E86\u4E0D\u540C\u7684\u539F\u751F\u4F1A\u8BDD\uFF0C\u8BF7\u53D1\u9001 /new");u.threadId=y.thread_id,d()}catch(S){f=S,i();return}n(m)},h=await r(u.threadId,p,m=>{!f&&u.threadId&&s?.(m)});if(f)throw f;if(!u.threadId)throw et("CODEX_SESSION_MISSING","Codex \u6CA1\u6709\u8FD4\u56DE\u539F\u751F\u4F1A\u8BDD\u6807\u8BC6\uFF0C\u8BF7\u68C0\u67E5 CLI \u7248\u672C\u5E76\u53D1\u9001 /new");return h}finally{Oi(o,{recursive:!0})}}};function un(e,t){let r=e.indexOf("exec");if(r<0||e.includes("resume")||e.includes("--ephemeral"))throw et("BAD_REQUEST","Codex \u539F\u751F\u4F1A\u8BDD\u9700\u8981\u6807\u51C6 codex exec \u914D\u7F6E");return t?[...e.slice(0,r+1),"resume",t,...e.slice(r+1)]:e}var Ui=36e5,En=5e3,Pi=2*60*1e3,Li=2*60*1e3,ki=12,vi=1e3,Di=1500,Hi=1e3,qt=24*60*60*1e3,Et=new Set(["final_answer","final","complete","completed","done"]),Fi=new Set(["function_call","function_call_output","custom_tool_call","custom_tool_call_output","local_shell_call","local_shell_call_output","mcp_tool_call","mcp_tool_call_output","web_search_call","image_generation_call","image_generation_end"]),$i=new Set(["context_compacted","context_compaction","context_compressed"]);function Kt(e,t){if(e?.pid){if(process.platform==="win32"){let r=["/PID",String(e.pid),"/T"];t==="SIGKILL"&&r.push("/F");try{mn("taskkill",r,{stdio:"ignore",windowsHide:!0}).unref?.()}catch{try{e.kill(t)}catch{}}return}try{process.kill(-e.pid,t)}catch(r){if(r?.code==="ESRCH")return;try{e.kill(t)}catch{}}}}function Ie(e){Kt(e,"SIGTERM");let t=setTimeout(()=>Kt(e,"SIGKILL"),En);return t.unref?.(),t}function H(e){if(typeof e=="string")return e;if(Array.isArray(e))return e.map(t=>H(t)).join("");if(!l(e))return"";for(let t of["text","delta","output_text","content","message","output"]){let r=H(e[t]);if(r)return r}return""}function Rn(e){if(!l(e))return"";let t=l(e.payload)?e.payload:{};if(c(e.type)==="event_msg"){if(c(t.type)==="agent_message")return c(t.message);if(c(t.type)==="task_complete")return c(t.last_agent_message)}if(c(e.type)==="response_item"&&c(t.type)==="message"&&c(t.role)==="assistant")return H(t.content)||H(t.message);if(c(e.type)==="result")return H(e.result);let r=H(e.delta)||H(e.text)||H(e.content);if(r)return r;let n=l(e.item)?e.item:{};return["message","agent_message"].includes(c(n.type))||c(n.role)==="assistant"?H(n.content)||H(n.text)||H(n.message):""}function Sn(e,t={}){return Re(e,{source:"codex_cli_image_generation",...t})}function On(e,t){Ft(e.artifacts,t)}function In(e){return Q(Se(e))}function Me(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{},r=c(e.type),n=c(t.type);if(r==="event_msg"&&n==="task_complete")return!0;let s=c(t.phase||t.status||t.stage).toLowerCase();if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&c(t.role)==="assistant")return Et.has(s);let i=l(e.item)?e.item:{};return r==="item.completed"&&c(i.type)==="agent_message"?!0:r==="result"&&e.is_error!==!0?c(e.result).length>0:!1}function Ce(e){let t=c(e.terminalProtocol||e.eventProtocol).toLowerCase();if(t)return t;let r=be(c(e.command)).replace(/\.exe$/i,"").toLowerCase();return r==="codex"||r==="claude"?r:""}function dn(e,t,r){let n=l(t.error)?t.error:{},s=c(n.message)||H(t.error)||c(t.result)||c(t.message)||r;return Object.assign(new Error(s),{code:e})}function Bi(e,t){if(!l(e))return null;let r=c(e.type).toLowerCase();if(t==="codex")return r==="turn.completed"?{status:"completed",result:{stopReason:"end_turn"}}:r==="turn.failed"?{status:"failed",error:dn("RUNTIME_CODEX_TURN_FAILED",e,"Codex turn failed")}:null;if(t==="claude"&&r==="result"){let n=c(e.subtype).toLowerCase();return e.is_error===!0||n.startsWith("error")||["failed","failure"].includes(n)?{status:"failed",error:dn("RUNTIME_CLAUDE_RESULT_FAILED",e,"Claude result failed")}:{status:"completed",result:{stopReason:"end_turn",...c(e.result)?{output:c(e.result)}:{}}}}return null}function fn(e){return l(e)?c(e.phase||e.status||e.stage).toLowerCase():""}function ji(e){if(!l(e)||Me(e))return!1;let t=l(e.payload)?e.payload:{},r=c(e.type),n=c(t.type),s=fn(t);if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&c(t.role)==="assistant")return!!(s&&!Et.has(s));let i=l(e.item)?e.item:{},o=fn(i);return c(i.role)==="assistant"||c(i.type)==="message"?!!(o&&!Et.has(o)):!1}function qi(e,t,r){return r.captureLastMessage===!1||t.includes("--output-last-message")||t.includes("-o")?!1:r.captureLastMessage===!0?!0:be(e)==="codex"}function Gi(e,t){return t.collectCodexTranscriptArtifacts===!1?!1:t.collectCodexTranscriptArtifacts===!0?!0:be(e)==="codex"}function Cn(e){return Math.max(20,T(e.codexTranscriptPollMs||e.transcriptPollMs,vi))}function Ki(e){return Math.max(0,T(e.codexFinalOutputWaitMs||e.finalOutputWaitMs,Di))}function zt(e){if(typeof e=="boolean")return e;let t=c(e).toLowerCase();return["true","1","yes","y","on"].includes(t)?!0:["false","0","no","n","off"].includes(t)?!1:null}function Ue(e){let t=l(e?.metadata)?e.metadata:{};return l(t._runtimeBridge)?t._runtimeBridge:{}}function xe(e){return c(Ue(e).promptKind).toLowerCase()}function zi(e,t){for(let r of[e.codexTranscriptStreaming,e.streamCodexTranscript]){let n=zt(r);if(n!=null)return n}return xe(t)==="chat"}function Ji(e,t){let r=Ue(e);for(let s of[r.emitThoughtChunks,r.streamThoughts]){let i=zt(s);if(i!=null)return i}let n=xe(e);if(n&&n!=="chat")return!1;for(let s of[t.emitThoughtChunks,t.streamThoughts]){let i=zt(s);if(i!=null)return i}return xe(e)==="chat"}function Vi(e){let t=Ue(e);for(let r of[t.finalTextOnly,t.finalOutputOnly]){let n=zt(r);if(n!=null)return n}return null}function Wi(e,t){let r=Vi(e);return r??(t.finalTextOnly===!0||t.finalOutputOnly===!0?!0:(t.finalTextOnly===!1||t.finalOutputOnly===!1,!1))}function Xi(e,t){return!e.finalTextOnly||t}function xn(e,t,r,n,s=n){return!n||e.emittedTexts.has(s)?!1:(e.emittedTexts.add(s),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}}),!0)}function An(e,t,r,n){return!n||e.emittedThoughtTexts.has(n)?!1:(e.emittedThoughtTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_thought_chunk",content:{type:"text",text:n}}}),!0)}function Yi(e,t,r,n=new Set){return{target:e,promptText:t,startedAtMs:r,baselinePaths:n,matchedPath:"",disabled:!1,processedLines:new Map}}function Qi(e,t){let r=l(e.env)?e.env:{},n=c(e.artifactRoot||e.artifactDir||e.runtimeArtifactRoot||r.ORCHA_RUNTIME_ARTIFACT_DIR)||F(wn(),"orcha-runtime-artifacts"),s=c(t).replace(/[^A-Za-z0-9._-]+/g,"-").slice(0,80)||ut(),i=F(n,s),o=F(i,ut());return Ci(o,{recursive:!0}),{root:o,realRoot:Rt(o),sessionRoot:i,realSessionRoot:Rt(i)}}function Zi(e){let t=c(e?.artifactDirectory);if(!t)throw new Error("sandbox launch did not provide an artifact directory");return{root:t,realRoot:Rt(t),sessionRoot:"",realSessionRoot:""}}function Nn(e){return c(l(e)?e.root:e)}function pn(e){let t=Nn(e),r=c(l(e)?e.sessionRoot:Mi(t)),n=c(l(e)?e.realSessionRoot:"");if(r)try{if(n&&Rt(r)!==n)return;Ai(r)}catch{}}function to(e,t={}){let r=Nn(e),n=c(l(e)?e.realRoot:"");if(r){try{if(n&&Rt(r)!==n){g("warn","runtime.cli","runtime artifact directory cleanup skipped; path changed",{...t,artifactRoot:r});return}}catch{pn(e);return}try{xi(r,{recursive:!0,force:!0})}catch(s){g("warn","runtime.cli","runtime artifact directory cleanup failed",{...t,artifactRoot:r,error:String(s?.message||s)});return}pn(e)}}function eo(e,t,r=null){return{trustedFileRoots:[t,c(r?.artifactDirectory),c(r?.homeDirectory),...A(e.trustedArtifactRoots),...A(e.trustedFileRoots),...A(e.artifactRoots),...A(e.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(r?.pathMappings)?r.pathMappings:[]}}function bn(e){let t=c(e.codexSessionsRoot||e.codexSessionRoot);if(t)return t;let r=l(e.env)?e.env:{},n=c(e.codexHome||r.CODEX_HOME||process.env.CODEX_HOME)||F(Tn(),".codex");return F(n,"sessions")}function ro(e,t){let r=new Date(t),n=String(r.getFullYear()),s=String(r.getMonth()+1).padStart(2,"0"),i=String(r.getDate()).padStart(2,"0");return F(e,n,s,i)}function Mn(e,t,r){let n=new Set;for(let s of[t-qt,t,t+qt,r-qt,r,r+qt])n.add(ro(e,s));return[...n].filter(s=>gn(s))}function no(e,t,r){let n=bn(e),s=t-Pi,i=r+Li,o=[];for(let a of Mn(n,t,r)){let u=[];try{u=_n(a)}catch{continue}for(let d of u){if(!d.endsWith(".jsonl"))continue;let f=F(a,d);try{let p=Ni(f);if(!p.isFile()||p.mtimeMs<s||p.mtimeMs>i)continue;o.push({path:f,mtimeMs:p.mtimeMs})}catch{}}}return o.sort((a,u)=>u.mtimeMs-a.mtimeMs).slice(0,ki)}function so(e,t,r=t){let n=bn(e),s=new Set;for(let i of Mn(n,t,r)){let o=[];try{o=_n(i)}catch{continue}for(let a of o)a.endsWith(".jsonl")&&s.add(F(i,a))}return s}function Ae(e,t,r=0){if(!(r>8||e===null||e===void 0)){if(typeof e=="string"){e&&t.push(e);return}if(Array.isArray(e)){for(let n of e)Ae(n,t,r+1);return}if(l(e))for(let n of["payload","item","text","delta","output_text","content","message","output","input","prompt","last_agent_message","revised_prompt"])n in e&&Ae(e[n],t,r+1)}}function Un(e){return c(e).replace(/\s+/g," ")}function io(e){let t=Un(e);if(!t)return[];if(t.length<=200)return[t];let r=160,n=[0,Math.floor((t.length-r)/2),t.length-r],s=new Set,i=[];for(let o of n){let a=t.slice(Math.max(0,o),Math.max(0,o)+r).trim();a.length>=40&&!s.has(a)&&(s.add(a),i.push(a))}return i}function oo(e,t){let r=io(t);if(!r.length)return!1;let n=[];for(let i of e)Ae(i,n);let s=Un(n.join(" "));return r.every(i=>s.includes(i))}function ao(e){return e.find(t=>l(t)&&c(t.type)==="session_meta"&&l(t.payload))||null}function co(e){let t=l(e?.payload)?e.payload:{},r=c(e?.timestamp||t.timestamp),n=Date.parse(r);return Number.isFinite(n)?n:Number.NaN}function uo(e){let t=c(e.originator),r=c(e.source);if(t!=="codex_exec"&&r!=="exec"||c(e.parent_thread_id))return!1;let n=c(e.thread_source);if(n&&n!=="user")return!1;let s=c(e.session_id),i=c(e.id);return!(s&&i&&s!==i)}function lo(e,t,r){if(!oo(e,t.promptText))return!1;let n=ao(e);if(!n)return!1;let s=n.payload;if(!uo(s))return!1;let i=co(n);if(!Number.isFinite(i)||i<t.startedAtMs-5e3||i>r+5e3)return!1;let o=c(t.target.cwd),a=c(s.cwd);return!(o&&a&&ln(o)!==ln(a))}function hn(e){try{return po(yn(e,"utf8"))}catch{return null}}function fo(e,t,r){if(!e||e.disabled)return null;if(e.matchedPath){let s=hn(e.matchedPath);return s?{path:e.matchedPath,events:s}:null}let n=[];for(let s of no(e.target,e.startedAtMs,r)){if(e.baselinePaths.has(s.path))continue;let i=hn(s.path);!i||!lo(i,e,r)||n.push({path:s.path,events:i})}return n.length!==1?(n.length>1&&(e.disabled=!0,g("warn","runtime.cli","codex transcript fallback disabled; multiple matching transcripts",{target:e.target.targetCode,sessionId:t,transcriptCount:n.length})),null):(e.matchedPath=n[0].path,g("info","runtime.cli","codex transcript stream attached",{target:e.target.targetCode,sessionId:t}),n[0])}function po(e){let t=[];for(let r of e.split(/\r?\n/)){let n=r.trim();if(n)try{t.push(JSON.parse(n))}catch{}}return t}function ho(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{},r=c(e.type),n=c(t.type);return r==="event_msg"&&n==="image_generation_end"||r==="response_item"&&n==="image_generation_call"}function mo(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{};return c(e.type)==="response_item"&&Fi.has(c(t.type))}function go(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{};return $i.has(c(t.type))}function _o(e,t,r,n){let s=Rn(e),i=Me(e),o=0,a=0,u=0;if(s&&!i&&t.emitThoughtChunks&&An(t,r,n,s)&&(u=1),s&&i){let d=t.emittedTexts.size?`
 
-${s}`:s;un(t,r,n,d,s)&&(o=1,c=1)}return s&&i&&(t.finalTextSeen=!0),on(t,sn(e,t.artifactOptions)),(Hi(e)||Fi(e)||$i(e)||i)&&n({sessionId:r,update:{sessionUpdate:"runtime_event",event:an(e)}}),{textCount:o,finalTextCount:c,thoughtCount:u}}function ye(e,t,r,n,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0,textCount:0,finalTextCount:0,thoughtCount:0};let i=e.artifacts.size,o=0,c=0,u=0,d=0,f=Di(t,r,s);if(f){let p=Math.min(t.processedLines.get(f.path)||0,f.events.length),h=e.artifacts.size;for(let m of f.events.slice(p)){let T=Bi(m,e,r,n);c+=T.textCount,u+=T.finalTextCount,d+=T.thoughtCount}t.processedLines.set(f.path,f.events.length),(f.events.length>p||e.artifacts.size>h)&&(o=1)}return{artifactCount:e.artifacts.size-i,transcriptCount:o,textCount:c,finalTextCount:u,thoughtCount:d}}function ji(e,{remove:t=!0}={}){if(!e||!Qr(e))return"";try{return tn(e,"utf8").trim()}catch{return""}finally{t&&Ft(e)}}function Ft(e){if(e)try{ti(e)}catch{}}function qi(e,t){return{artifactCount:(e?.artifactCount||0)+(t?.artifactCount||0),transcriptCount:(e?.transcriptCount||0)+(t?.transcriptCount||0),textCount:(e?.textCount||0)+(t?.textCount||0),finalTextCount:(e?.finalTextCount||0)+(t?.finalTextCount||0),thoughtCount:(e?.thoughtCount||0)+(t?.thoughtCount||0)}}function Ki(e){return new Promise(t=>setTimeout(t,e))}function Gi(e,t,r,n){return n?(e.finalTextSeen=!0,e.emittedTexts.has(n)||(e.emittedTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}})),!0):!1}async function zi(e,t,r,n,s,i){let o=ye(e,t,r,n,Date.now()),c=()=>Gi(e,r,n,ji(s,{remove:!1}));if(c()||e.finalTextSeen)return Ft(s),o;let u=gi(i);if(u<=0||!t&&!s)return Ft(s),o;let d=Date.now()+u,f=Math.min(cn(i),100);for(;!e.finalTextSeen&&Date.now()<d&&(await Ki(Math.min(f,Math.max(0,d-Date.now()))),o=qi(o,ye(e,t,r,n,Date.now())),!c()););return Ft(s),o}var jt=class{constructor(t,r,n={}){this.agent=t,this.target=r,this.options=n,this.active=new Map}async sessionNew(t={}){let r=t.mcpServers||[];if(r.length&&t.metadata?.source==="conversation_delegation"&&zr(this.target)==="codex"){if(this.options.prepareLaunch)throw Object.assign(new Error("Codex task MCP requires a reachable node-local transport; this sandbox launcher does not provide one"),{code:"unsupported_dynamic_mcp"});this.taskMcp=await Kr(r)}else if(r.length&&t.metadata?.source==="conversation_delegation")throw Object.assign(new Error("This CLI adapter does not support task-scoped MCP"),{code:"unsupported_dynamic_mcp"});return{sessionId:`cli-${this.agent.agentId}-${it()}`}}async refreshMcpServers(t){if(!this.taskMcp)throw Object.assign(new Error("The original Codex MCP binding is unavailable"),{code:"RUNTIME_OPERATION_NOT_FOUND"});await this.taskMcp.refresh(t)}async sessionPrompt(t,r,n){let s=Date.now(),i=a(this.target.command);if(!i)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let o=a(t.sessionId)||it(),c=xt(t.prompt),u=a(this.target.promptMode||"stdin"),d=[...this.taskMcp?.args||[],...this.buildArgs(u,c)],f=rt(this.target,this.agent.workspace),p=typeof this.options.prepareLaunch=="function",m=hi(i,d,this.target)?p?`/tmp/orcha-runtime-last-message-${it()}.txt`:$(en(),`orcha-runtime-last-message-${it()}.txt`):"";m&&d.push("--output-last-message",m);let T={...l(this.target.env)?this.target.env:{},...this.taskMcp?.environment||{},...u==="env"?{ORCHA_RUNTIME_PROMPT:c}:{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:o},R=p?await this.options.prepareLaunch({command:i,args:d,cwd:f,environment:T}):{command:i,args:d,cwd:f,environment:{...process.env,...T},cleanup:async()=>{}},N=p?Oi(R):Si(this.target,o),y=N.root,w=Ci(this.target,y,R),E=mi(i,this.target),I={...this.target,targetCode:this.agent.targetCode,cwd:f,...p?{codexHome:$(R.homeDirectory,".codex")}:{}},P=E?Ni(I,s):new Set,H=p&&m?$(R.tempDirectory,m.slice(5)):m,b=_(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,_(this.options.sessionPromptTimeoutMs,ni));p||(R.environment.ORCHA_RUNTIME_ARTIFACT_DIR=y);let O=Yr(R.command,R.args,{cwd:R.cwd,env:R.environment,stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(o,O),g("info","runtime.cli","runtime prompt started",{target:this.agent.targetCode,sessionId:o,pid:O.pid,timeoutMs:b,isolation:R.isolation});let Z="",ut=a(this.target.outputMode||"text"),M={artifacts:new Map,emittedTexts:new Set,emittedThoughtTexts:new Set,value:"",artifactOptions:w,finalTextSeen:!1,finalTextOnly:wi(t,this.target),emitThoughtChunks:Ti(t,this.target),terminalOutcome:null,terminalProtocol:zr(this.target),emitTerminal:null},se=E?Ei(I,c,s,P):null;return O.stdout.setEncoding("utf8"),O.stdout.on("data",tt=>this.handleStdout(tt,ut,M,o,r)),O.stderr.setEncoding("utf8"),O.stderr.on("data",tt=>{Z+=tt,this.target.emitStderr===!0&&r({sessionId:o,update:{sessionUpdate:"runtime_stderr_chunk",content:{type:"text",text:tt}}})}),u==="stdin"?O.stdin.end(c):O.stdin.end(),await new Promise((tt,ie)=>{let lt=!1,fr=!1,Ot=null,dt=null,oe=se&&_i(this.target,t)?setInterval(()=>{try{ye(M,se,o,r)}catch(C){g("warn","runtime.cli","codex transcript stream poll failed",{target:this.agent.targetCode,sessionId:o,error:String(C?.message||C)})}},cn(this.target)):null;oe?.unref?.();let pr=setTimeout(()=>{fr=!0,g("warn","runtime.cli","runtime prompt timed out; terminating child",{target:this.agent.targetCode,sessionId:o,pid:O.pid,timeoutMs:b}),$t(O,"SIGTERM"),Ot=setTimeout(()=>{g("warn","runtime.cli","runtime prompt force killing child",{target:this.agent.targetCode,sessionId:o,pid:O.pid}),$t(O,"SIGKILL")},rn),Ot.unref?.(),ft(Object.assign(new Error(`runtime CLI timed out after ${b}ms`),{code:"RUNTIME_CLI_TIMEOUT"}))},b);pr.unref?.();let hr=async()=>{clearTimeout(pr),dt&&clearTimeout(dt),oe&&clearInterval(oe),Ot&&!fr&&clearTimeout(Ot),Ii(N,{target:this.agent.targetCode,sessionId:o}),this.active.delete(o),M.emitTerminal=null,await R.cleanup?.()},ns=C=>{lt||(lt=!0,hr().then(()=>tt(C),ie))},ft=C=>{lt||(lt=!0,hr().then(()=>ie(C),B=>{g("warn","runtime.cli","sandbox launch cleanup failed",{target:this.agent.targetCode,sessionId:o,error:String(B?.message||B)}),ie(C)}))};M.emitTerminal=C=>{let B={...l(C.result)?C.result:{},_artifacts:[...M.artifacts.values()]};try{n?.({...C,result:B})}catch(V){g("warn","runtime.cli","runtime terminal listener failed",{target:this.agent.targetCode,sessionId:o,error:String(V?.message||V)})}let F=Math.max(0,_(this.target.terminalExitGraceMs,ui));dt=setTimeout(()=>{dt=null,!(lt||this.active.get(o)!==O)&&(g("warn","runtime.cli","runtime stayed alive after terminal event; terminating child",{target:this.agent.targetCode,sessionId:o,pid:O.pid,terminalProtocol:M.terminalProtocol,graceMs:F}),ge(O))},F),dt.unref?.()},O.on("error",C=>{g("warn","runtime.cli","runtime child error",{target:this.agent.targetCode,sessionId:o,pid:O.pid,error:String(C?.message||C)}),ft(C)}),O.on("exit",(C,B)=>{(async()=>{ut==="json-lines"&&M.value.trim()&&this.handleStdout(`
-`,ut,M,o,r);let F=await zi(M,se,o,r,H,this.target);(F.artifactCount>0||F.textCount>0||F.thoughtCount>0)&&g("info","runtime.cli","codex transcript updates collected",{target:this.agent.targetCode,sessionId:o,artifactCount:F.artifactCount,textCount:F.textCount,finalTextCount:F.finalTextCount,thoughtCount:F.thoughtCount,transcriptCount:F.transcriptCount});let V=Z.trim();if(V&&g("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:o,stderr:V}),g("info","runtime.cli","runtime prompt finished",{target:this.agent.targetCode,sessionId:o,pid:O.pid,exitCode:C,signal:B,artifactCount:M.artifacts.size,finalTextSeen:M.finalTextSeen}),M.terminalOutcome?.status==="failed"){ft(M.terminalOutcome.error);return}if(C!==0&&M.terminalOutcome?.status!=="completed"){let ss=Object.assign(new Error(`runtime CLI exited with code ${C??"unknown"}${B?` (${B})`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:C,signal:B});ft(ss);return}ns({stopReason:"end_turn",exitCode:C,signal:B,_artifacts:[...M.artifacts.values()],...V?{stderr:V}:{}})})().catch(ft)})})}buildArgs(t,r){let n=x(this.target.args);return t==="args"?[...n,r]:n}handleStdout(t,r,n,s,i){if(r!=="json-lines"){i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:t}}});return}n.value+=t;let o=n.value.split(/\r?\n/);n.value=o.pop()||"";for(let c of o){let u=c.trim();if(u)try{let d=JSON.parse(u);on(n,sn(d,n.artifactOptions)),i({sessionId:s,update:{sessionUpdate:"runtime_event",event:an(d)}});let f=nn(d),p=Re(d);f&&n.emitThoughtChunks&&!p&&pi(d)?ln(n,s,i,f):f&&Ri(n,p)&&un(n,s,i,f),f&&p&&(n.finalTextSeen=!0);let h=fi(d,n.terminalProtocol);h&&!n.terminalOutcome&&(h.status==="failed"||n.finalTextSeen||n.artifacts.size>0)&&(n.terminalOutcome=h,n.emitTerminal?.(h))}catch{i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:`${c}
-`}}})}}}async sessionCancel(t){let r=a(t.sessionId),n=this.active.get(r);return n?(g("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),ge(n),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}async stop(t="stop"){for(let[r,n]of this.active.entries())g("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),ge(n);this.active.clear(),await this.taskMcp?.close(),this.taskMcp=null}};var Se="ORCHA_RUNTIME_OUTPUT_START",Oe="ORCHA_RUNTIME_OUTPUT_END",Ie="ORCHA_RUNTIME_CONTROL_START",Ce="ORCHA_RUNTIME_CONTROL_END",Ae=Se,xe=Oe,Ne=Ie,be=Ce,Me=[Se,Oe,Ie,Ce],Vi=new Set(["_artifacts","_decision","_meta"]),Wi=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${Me.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),k=class extends Error{constructor(t,r,n){super(r),this.name="RuntimeResultProtocolError",this.code=t,this.detail={rawOutput:n}}};function gn(e){let t=typeof e=="string"?e.trimStart():"";return Me.some(r=>t.startsWith(r))}function Ue(e){if(typeof e!="string")return null;let t=e,r=Ji(t);if(![...r.values()].some(m=>m.length>0))return null;let n=[],s=[];for(let[m,T]of r)T.length===0?n.push(m):T.length>1&&s.push(m);if(n.length>0||s.length>0){let m=[];throw n.length>0&&m.push(`\u7F3A\u5C11 ${n.join(", ")}`),s.length>0&&m.push(`\u91CD\u590D ${s.join(", ")}`),new k("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${m.join("\uFF1B")}`,t)}let i=r.get(Se)[0],o=r.get(Oe)[0],c=r.get(Ie)[0],u=r.get(Ce)[0];if(!(i.end<=o.start&&o.end<=c.start&&c.end<=u.start))throw new k("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757",t);let d=Xi(t.slice(i.end,o.start));if(!d.trim())throw new k("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let f=t.slice(c.end,u.start).trim();if(!f)throw new k("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let p;try{p=JSON.parse(f)}catch(m){throw new k("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(m?.message||m)}`,t)}if(!mn(p))throw new k("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61",t);let h=Object.keys(p).filter(m=>!Vi.has(m)).sort();if(h.length>0)throw new k("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${h.join(", ")}`,t);if("_artifacts"in p&&!Array.isArray(p._artifacts))throw new k("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4",t);for(let m of["_decision","_meta"])if(m in p&&!mn(p[m]))throw new k("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${m} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`,t);return{output:d,...p}}function Ji(e){let t=new Map(Me.map(r=>[r,[]]));for(let r of e.matchAll(Wi))t.get(r.groups.marker).push({start:r.index,end:r.index+r[0].length});return t}function Xi(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",r=t?e.slice(t.length):e;return t&&r.endsWith(t)?r.slice(0,-t.length):r}function mn(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as Yi}from"node:crypto";var Qi="orcha.goal-contract/v1",Zi=new Set(["complete","completed","done","ok","passed","success","succeeded"]),to=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),eo=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function De(e){return Yi("sha256").update(q(e)).digest("hex")}function Tn(e){if(!wn(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","Each check requires requiredMatches distinct successful tool call IDs; repeated updates for one call count once.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
-`)}function yn(e,t,r=""){if(!wn(e))return e==null?null:{required:!0,status:"failed",outcome:a(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let n=De(e),s=e.verificationPlan.required===!0;if(a(r)&&a(r)!==n)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:n,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:n,checks:[]};let i=ro(t),o=e.verificationPlan.checks.map(u=>uo(u,i));return{required:!0,status:o.some(u=>u.status==="failed")?"failed":o.some(u=>u.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:n,checks:o}}function wn(e){if(!l(e)||e.schemaVersion!==Qi||!a(e.outcome))return!1;let t=e.verificationPlan;if(!l(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let r=new Set;for(let n of t.checks)if(!l(n)||!a(n.id)||r.has(a(n.id))||(r.add(a(n.id)),!Array.isArray(n.toolNames)||n.toolNames.length===0||n.toolNames.some(s=>!a(s)))||!Number.isSafeInteger(n.requiredMatches)||n.requiredMatches<1||n.arguments!==void 0&&!l(n.arguments))return!1;return!0}function ro(e){let t=new Map,r=[];for(let n of Array.isArray(e)?e:[]){let s=l(n?.update)?n.update:{},i=a(s.sessionUpdate);if(i==="runtime_event"){no(s.event,t,r);continue}if(i==="tool_call"){let o=Kt(s)||`tool-${r.length+1}`,c=qt(t,r,o),u=Le(s,s.name||s.toolName||s.kind);c.toolName=u.toolName,c.arguments=u.arguments,c.status=yt(s.status),c.evidence=zt(s);continue}if(i==="tool_call_update"){let o=Kt(s);if(!o)continue;let c=qt(t,r,o),u=Le(s,s.name||s.toolName||s.kind);c.toolName||=u.toolName,Object.keys(c.arguments).length===0&&(c.arguments=u.arguments),c.status=yt(s.status),c.evidence.push(...zt(s))}}return r}function no(e,t,r){let n=l(e)&&l(e.payload)?e.payload:l(e)?e:{},s=a(n.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let c=Kt(n)||`runtime-${r.length+1}`,u=qt(t,r,c),d=Le(n,n.name||n.tool||s,s);u.toolName=d.toolName,u.arguments=d.arguments,u.status=yt(n.status),u.evidence.push(...zt(n));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=Kt(n);if(!i)return;let o=qt(t,r,i);o.status=ao(n,o.toolName),o.evidence.push(...zt(n))}function qt(e,t,r){let n=e.get(r);return n||(n={toolCallId:r,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(r,n),t.push(n)),n}function so(e){let t=a(e).toLowerCase();return eo.get(t)||t}function Le(e,t,r=""){let n=io(e),s=a(r)==="mcp_tool_call"||a(e?.kind).toLowerCase()==="mcp",i=l(e?._meta)?e._meta:{},o=a(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let c=a(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...n,...c?{operationCode:c}:{}}}}return{toolName:so(t),arguments:n}}function Kt(e){return l(e)?a(e.call_id||e.callId||e.toolCallId||e.id):""}function io(e){if(!l(e))return{};for(let r of["arguments","args","rawInput","input","params","parameters"]){let n=oo(e[r]);if(n)return n}let t={};for(let r of["cmd","command","cwd","operationCode","path","query","url"])e[r]!==void 0&&(t[r]=e[r]);return t}function oo(e){if(l(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return l(t)?t:null}catch{return null}}function ao(e,t){if(!l(e))return"unknown";let r=Gt(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return r.includes("failed")?"failed":r.includes("success")?"success":"unknown"}function Gt(e,t=0,r={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return co(e,t,r);if(Array.isArray(e))return e.flatMap(o=>Gt(o,t+1,r));if(!l(e))return[];let n=[];typeof e.isError=="boolean"&&n.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&n.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&n.push(e.success?"success":"failed");let s=yt(e.status);s!=="unknown"&&n.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&n.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&n.push(...Gt(e[o],t+1,r));return n}function co(e,t,r){let n=e.trim();if(!n)return[];try{return Gt(JSON.parse(n),t+1,r)}catch{}if(r.parseCliExitCode!==!0)return[];let s=[];for(let i of n.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function yt(e){let t=a(e).toLowerCase();return Zi.has(t)?"success":to.has(t)?"failed":"unknown"}function zt(e){if(!l(e))return[];let t=l(e.output)?e.output:{},r=[e.verificationEvidence,l(e.verification)?e.verification.evidence:null,t.verificationEvidence,l(t.verification)?t.verification.evidence:null],n=[];for(let s of r)for(let i of Array.isArray(s)?s:s?[s]:[])!l(i)||!a(i.id)||n.push({id:a(i.id),status:yt(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...a(i.message)?{message:a(i.message)}:{}});return n}function uo(e,t){let r=t.filter(o=>e.toolNames.includes(o.toolName)&&ke(e.arguments||{},o.arguments)),n=a(e.evidenceId),s=r.filter(o=>o.status==="success"&&(!n||o.evidence.some(c=>c.id===n&&c.status==="success")));if(s.length>=e.requiredMatches)return Pe(e,"passed",s,`Runtime tool evidence passed ${s.length} times.`);let i=r.filter(o=>o.status==="failed"||n&&o.evidence.some(c=>c.id===n&&c.status==="failed"));return s.length===0&&i.length?Pe(e,"failed",i,"Runtime tool evidence failed."):Pe(e,"missing",s,`Only ${s.length}/${e.requiredMatches} required tool executions passed.`)}function Pe(e,t,r,n){let s=r.map(i=>i.toolCallId).filter(Boolean);return{id:e.id,status:t,message:n,...a(e.description)?{description:a(e.description)}:{},toolNames:e.toolNames,requiredMatches:e.requiredMatches,observedMatches:s.length,toolCallIds:s,...l(e.arguments)?{arguments:e.arguments}:{},...a(e.evidenceId)?{evidenceId:a(e.evidenceId)}:{}}}function ke(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((r,n)=>ke(r,t[n])):l(e)?l(t)?Object.entries(e).every(([r,n])=>Object.hasOwn(t,r)&&ke(n,t[r])):!1:Object.is(e,t)}function q(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return _n(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,r)=>{if(!Object.hasOwn(e,r))throw new Error("invalid_jcs_json_value");return q(e[r])}).join(",")}]`;if(l(e))return`{${Object.keys(e).sort().map(t=>`${_n(t)}:${q(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function _n(e){return lo(e),JSON.stringify(e)}function lo(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(r>=56320&&r<=57343)throw new Error("invalid_jcs_unicode")}}import{spawn as fo}from"node:child_process";import{createHash as po,randomUUID as ho}from"node:crypto";import{constants as mo}from"node:fs";import{access as go,mkdir as ve,readdir as _o,realpath as wt,rm as To,stat as yo}from"node:fs/promises";import wo from"node:http";import{tmpdir as Ro}from"node:os";import{isAbsolute as Rt,join as ot,relative as Rn,resolve as Fe}from"node:path";var $e=1,Eo="orcha.process-isolation/v1",Be="orcha.egress-proxy/v1",So="--disable-wasm-trap-handler",Vt={read_only:0,workspace_write:1,workspace_network:2},He={read_only:["read_only","denied"],workspace_write:["workspace_write","denied"],workspace_network:["workspace_write","restricted"]},Oo=new Set([".env",".git-credentials",".netrc",".npmrc",".pypirc","credentials.json","secrets.json","id_rsa","id_ed25519"]);function J(e){if(!l(e))throw S("RUNTIME_SANDBOX_POLICY_REQUIRED","sandboxPolicy is required");let t=structuredClone(e),r=a(t.accessMode),n=a(t.accessModeCeiling);if(!(r in He)||!(n in He))throw S("RUNTIME_SANDBOX_POLICY_INVALID","unsupported runtime access mode");if(Vt[r]>Vt[n])throw S("RUNTIME_SANDBOX_POLICY_INVALID","access mode exceeds its ceiling");let[s,i]=He[r];if(t.filesystemMode!==s||t.networkMode!==i)throw S("RUNTIME_SANDBOX_POLICY_INVALID","runtime access profile does not match its mode");if(Number(t.policySchemaVersion)!==$e||!Number.isInteger(Number(t.policyRevision))||Number(t.policyRevision)<1)throw S("RUNTIME_SANDBOX_POLICY_INVALID","unsupported sandbox policy schema or revision");for(let[c,u]of Object.entries({outsideWorkspaceAccess:"denied",hostAccess:"denied",hostEnvironmentAccess:"denied",dockerSocketAccess:"denied",environmentMode:"allowlist"}))if(t[c]!==u)throw S("RUNTIME_SANDBOX_POLICY_INVALID",`${c} cannot be relaxed`);let o=l(t.processIsolation)?t.processIsolation:{};if(o.mode!=="required"||o.backend==="direct")throw S("RUNTIME_SANDBOX_POLICY_INVALID","strong process isolation is required");if(Array.isArray(t.alwaysApprovedApprovalKeys)&&t.alwaysApprovedApprovalKeys.length)throw S("RUNTIME_SANDBOX_POLICY_INVALID","persistent runtime approvals are forbidden");return t}function En(e,t){let r=J(e),n=J(t);return Vt[n.accessMode]<Vt[r.accessMode]}async function Sn(e){if(!e.sandboxRequired)return{dispatchable:!0,enforced:!1,backend:"direct",daemonStatus:"not_required",daemonProtocolVersion:"",policySchemaVersions:[$e],runtimePolicyUpdates:!1,workspaceSync:!1,egressProxy:!1,reason:"external_runtime_sandbox_not_required"};let t=await In(e.sandboxBrokerCommand,process.env.PATH||"");if(!t)throw S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let r=await No(t,x(e.sandboxBrokerArguments),e.sandboxProbeTimeoutMs);if(r.enforced!==!0||a(r.protocolVersion)!=="orcha.runtime-sandbox-broker/v1"||!["bubblewrap","broker"].includes(a(r.backend)))throw S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker did not report enforced isolation");let n=l(r.probes)?r.probes:{};for(let s of["emptyRoot","outsideWorkspaceDenied","hostFilesystemDenied","sensitiveFilesDenied","environmentAllowlist","dockerSocketDenied","networkNamespace","workspaceReadOnly","workspaceWrite","resourceLimits"])if(n[s]!==!0)throw S("RUNTIME_SANDBOX_UNAVAILABLE",`sandbox broker probe failed: ${s}`);return e.egressProxyRequired&&await Uo(e),{dispatchable:!0,enforced:!0,backend:a(r.backend),daemonStatus:"ok",daemonProtocolVersion:a(r.protocolVersion||"orcha.runtime-sandbox-broker/v1"),policySchemaVersions:[$e],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:e.egressProxyRequired}}async function je(e,t,r){let n=a(t.workspace||t.cwd),s=a(r),i=n||(t.allowRequestWorkspace===!0?s:"");if(!i||!Rt(i))throw S("RUNTIME_WORKSPACE_NOT_CONFIGURED","runtime target must configure an absolute trusted workspace");let o=await wt(i);if(!(await yo(o)).isDirectory())throw S("RUNTIME_WORKSPACE_INVALID","runtime workspace is not a directory");if(!(e.trustedWorkspaceRoots.length?await Promise.all(e.trustedWorkspaceRoots.map(d=>wt(d))):[o]).some(d=>Ke(d,o)))throw S("RUNTIME_WORKSPACE_OUTSIDE_TRUSTED_ROOT","runtime workspace is outside trusted roots");return o}async function On({config:e,target:t,command:r,args:n,cwd:s,environment:i,runId:o,agentId:c,sessionId:u,sandboxPolicy:d}){if(!e.sandboxRequired)return{command:r,args:[...n],cwd:s,environment:{...process.env,...i},tempDirectory:"",isolation:{enforced:!1,backend:"development_direct"},cleanup:async()=>{}};let f=J(d),p=await je(e,t,s),h=await wt(s);if(!Ke(p,h))throw S("RUNTIME_WORKSPACE_CWD_INVALID","runtime cwd is outside its workspace");let m=await In(e.sandboxBrokerCommand,process.env.PATH||"");if(!m)throw S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let T=`runtime-${po("sha256").update(String(o)).digest("hex").slice(0,32)}`,R=Fe(e.sandboxTempRoot||ot(Ro(),"orcha-runtime-sandboxes"));await ve(R,{recursive:!0,mode:448});let N=ot(R,`${T}-${ho()}`),y=ot(N,"home"),w=ot(N,"artifacts");await ve(y,{recursive:!0,mode:448}),await ve(w,{recursive:!0,mode:448});let E=f.networkMode==="restricted"?await bo(e,{runId:String(o),instanceId:T,policyRevision:Number(f.policyRevision),ttlMs:Math.min(_(f.maxRuntimeSeconds,900)*1e3,e.egressGrantMaxTtlMs),maxTransferBytes:_(f.maxNetworkBytes,64*1024*1024)}):null,I={PATH:a(i.PATH||process.env.PATH),LANG:a(i.LANG||process.env.LANG||"C.UTF-8"),HOME:"/tmp/home",TMPDIR:"/tmp",USER:"orcha",LOGNAME:"orcha",SHELL:"/bin/sh",ORCHA_AGENT_ID:String(c),ORCHA_SESSION_ID:String(u),ORCHA_RUN_ID:String(o),ORCHA_RUNTIME_ARTIFACT_DIR:"/tmp/artifacts",...Co(t,i)};I.HOME="/tmp/home",I.TMPDIR="/tmp",I.ORCHA_RUNTIME_ARTIFACT_DIR="/tmp/artifacts",I.NODE_OPTIONS=So;let P={schemaVersion:Eo,runId:String(o),instanceId:T,workspace:p,cwd:h,filesystemMode:f.filesystemMode,networkMode:f.networkMode,environmentMode:"allowlist",deniedRelativePaths:await Ao(p),temporaryDirectory:N,egressProxy:E,environment:I,resourceLimits:xo(f),readOnlyToolchainRoots:await Io(e,t)},H=!1,b=async()=>{if(!H){H=!0;try{E&&await Mo(e,E,{runId:String(o),instanceId:T})}finally{await To(N,{recursive:!0,force:!0})}}};return{command:m,args:[...x(e.sandboxBrokerArguments),"--",r,...n],cwd:h,environment:{PATH:process.env.PATH||"",LANG:process.env.LANG||"C.UTF-8",ORCHA_PROCESS_ISOLATION_REQUEST:JSON.stringify(P)},tempDirectory:N,homeDirectory:y,artifactDirectory:w,pathMappings:[{runtimeRoot:"/tmp/artifacts",hostRoot:w},{runtimeRoot:"/tmp/home",hostRoot:y}],isolation:{enforced:!0,backend:"broker",instanceId:T,policyRevision:f.policyRevision},cleanup:b}}async function Io(e,t){let r=x(t.toolchainRoots||t.sandboxToolchainRoots);if(!r.length)return[];let n=await Promise.all(x(e.trustedToolchainRoots).map(i=>wt(i)));if(!n.length)throw S("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","target toolchain roots require ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS");let s=[];for(let i of r){if(!Rt(i))throw S("RUNTIME_TOOLCHAIN_ROOT_INVALID","toolchain roots must be absolute");let o=await wt(i);if(!n.some(c=>Ke(c,o)))throw S("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","toolchain root is outside trusted roots");s.push(o)}return[...new Set(s)]}function Co(e,t){let r=l(e.env)?e.env:{},n={};for(let[s,i]of Object.entries(r))/^[A-Za-z_][A-Za-z0-9_]*$/.test(s)&&i!=null&&(n[s]=String(i));for(let s of["ORCHA_RUNTIME_PROMPT","ORCHA_RUNTIME_ARTIFACT_DIR"])t[s]!=null&&(n[s]=String(t[s]));return n}async function Ao(e){let t=[],r=0,n=async s=>{let i;try{i=await _o(s,{withFileTypes:!0})}catch(o){if(s===e)throw o;return}for(let o of i){if(r+=1,r>1e4)throw S("RUNTIME_WORKSPACE_SCAN_LIMIT_EXCEEDED","workspace contains more than 10000 entries");let c=ot(s,o.name),u=Rn(e,c),d=o.name.toLowerCase();(Oo.has(d)||d.startsWith(".env."))&&t.push(u),o.isDirectory()&&!o.isSymbolicLink()&&await n(c)}};return await n(e),t.sort()}function xo(e){return{maxCpuSeconds:Math.max(1,_(e.maxRuntimeSeconds,900)),maxMemoryBytes:_(e.maxMemoryBytes,2*1024*1024*1024),maxProcesses:_(e.maxProcesses,128),maxOpenFiles:_(e.maxOpenFiles,1024),maxFileBytes:_(e.maxFileBytes,64*1024*1024)}}async function No(e,t,r){return await new Promise((n,s)=>{let i=fo(e,[...t,"--probe"],{env:{PATH:process.env.PATH||"",LANG:"C.UTF-8"},stdio:["ignore","pipe","pipe"],windowsHide:!0}),o=[],c=[];i.stdout.on("data",d=>o.push(Buffer.from(d))),i.stderr.on("data",d=>c.push(Buffer.from(d)));let u=setTimeout(()=>i.kill("SIGKILL"),Math.max(1e3,r));i.once("error",s),i.once("close",d=>{if(clearTimeout(u),d!==0){s(S("RUNTIME_SANDBOX_UNAVAILABLE",Buffer.concat(c).toString("utf8").trim()||`sandbox probe exited with ${d}`));return}try{n(JSON.parse(Buffer.concat(o).toString("utf8")))}catch{s(S("RUNTIME_SANDBOX_UNAVAILABLE","sandbox probe returned invalid JSON"))}})})}async function In(e,t){let r=a(e);if(!r)return"";let n=Rt(r)?[r]:String(t||"").split(":").filter(Boolean).map(s=>ot(s,r));for(let s of n)try{return await go(s,mo.X_OK),s}catch{}return""}async function bo(e,t){if(!e.egressProxyRequired)throw S("RUNTIME_EGRESS_UNAVAILABLE","restricted network requires the Egress Proxy");let r=await qe(e,"POST","/v1/grants",{protocolVersion:Be,...t}),n={socketPath:e.egressProxySocket,grantId:a(r.grantId),credential:a(r.credential)};if(!n.grantId||!n.credential)throw S("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy returned an invalid grant");return n}async function Mo(e,t,r){await qe(e,"POST",`/v1/grants/${encodeURIComponent(t.grantId)}/revoke`,{protocolVersion:Be,...r}).catch(()=>{})}async function Uo(e){let t=await qe(e,"GET","/health");if(t.status!=="ok"||t.proxy!=="orcha-egress-proxy"||t.protocolVersion!==Be)throw S("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy is unavailable or incompatible")}async function qe(e,t,r,n){if(!Rt(e.egressProxySocket)||!e.egressProxyToken)throw S("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy socket and token are required");return await new Promise((s,i)=>{let o=wo.request({socketPath:e.egressProxySocket,path:r,method:t,headers:{Authorization:`Bearer ${e.egressProxyToken}`,Accept:"application/json",...n?{"Content-Type":"application/json"}:{}}},c=>{let u=[],d=0;c.on("data",f=>{d+=f.length,d>1048576?o.destroy(new Error("egress response is too large")):u.push(Buffer.from(f))}),c.once("end",()=>{try{let f=JSON.parse(Buffer.concat(u).toString("utf8")||"{}");(c.statusCode||500)>=400?i(S("RUNTIME_EGRESS_UNAVAILABLE",a(f.error)||"Egress Proxy rejected the request")):s(f)}catch(f){i(f)}})});o.once("error",i),o.setTimeout(3e3,()=>o.destroy(new Error("Egress Proxy request timed out"))),n?o.end(JSON.stringify(n)):o.end()})}function Ke(e,t){let r=Rn(Fe(e),Fe(t));return r===""||!r.startsWith("..")&&!Rt(r)}function S(e,t){return Object.assign(new Error(t),{code:e})}var Ge=24e3,ze=8,Ve=50,We=6e3,Lo=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),ko=10*60*1e3,Do=60*1e3,vo=8,Ho=30*60*1e3,Fo=60*1e3,$o=1,Nn=2400,Bo=new Set(["max_tokens","max_output_tokens","length"]),jo=new Set(["agent_message_chunk","tool_call","tool_call_update"]),qo=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions"]),Ko=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function Go(e){if(!l(e))return{};let t={};for(let r of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let n=a(e[r]);n&&(t[r]=n)}return t}function zo(e){return(Array.isArray(e)?e:[]).map(Go).sort((t,r)=>{let n=q(t),s=q(r);return n<s?-1:n>s?1:0})}function Vo(e){return!l(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(r=>l(r)&&Array.isArray(r.toolNames)&&r.toolNames.some(n=>a(n)==="plugin_operation"))}function Wo(e,t,r){let n=l(e?._meta)?e._meta:{};return{...l(e)?e:{},sessionId:t,update:l(e?.update)?e.update:{},_meta:{...n,orchaAgentId:r.agentId,runtimeSessionId:r.runtimeSessionId,bridgeUpdateId:Jt()}}}function D(e){return e==null||e===""?!1:typeof e=="string"?a(e)!=="":Array.isArray(e)?e.length>0:l(e)?Object.keys(e).length>0:!0}function bn(e){let t=a(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return Lo.has(t)}function z(e,t){let r=_(e,t);return Number.isFinite(r)&&r>0?r:t}function Et(e,t=!1){if(typeof e=="boolean")return e;let r=a(e).toLowerCase();return["true","1","yes","y","on"].includes(r)?!0:["false","0","no","n","off"].includes(r)?!1:t}function G(e){return a(e?.type||"echo")}function Mn(e){let t=G(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function Ye(e){if(l(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function Jo(e){let t=String(e||"");if(Ko.test(t))return!0;let r=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return r.endsWith("token")||r.endsWith("secret")||r.endsWith("password")||r.endsWith("apikey")||r.endsWith("privatekey")||r==="authorization"||r==="cookie"||r==="jwt"||r.includes("credential")}function Qe(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=We)return e;let r=e.length-We;return`${e.slice(0,We)}... [truncated ${r} characters]`}if(t>=ze)return Array.isArray(e)?`[array truncated at depth ${ze}, items=${e.length}]`:l(e)?`[object truncated at depth ${ze}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let r=e.slice(0,Ve).map(n=>Qe(n,t+1));return e.length>Ve&&r.push(`[truncated ${e.length-Ve} items]`),r}if(l(e)){let r={};for(let[n,s]of Object.entries(e))r[n]=Jo(n)?"[REDACTED]":Qe(s,t+1);return r}return String(e)}var Xo=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function Yo(e){if(!l(e))return e;let t={};for(let r of Xo)D(e[r])&&(t[r]=e[r]);return t}function Qo(e){if(!l(e))return e;let t={...e};return l(t.renderedPayload)&&(t.renderedPayload=Yo(t.renderedPayload)),t}function Zo(e){let t=l(e)?e:{},r={};D(t.metadata)&&(r.metadata=Qo(t.metadata));for(let[n,s]of Object.entries(t))qo.has(n)||n==="metadata"||D(s)&&(r[n]=s);return r}function ta(e){let t=l(e)?e:{},r=l(t.metadata)?t.metadata:{},n=l(r.renderedPayload)?r.renderedPayload:{};return l(t.resultContract)?t.resultContract:l(n.resultContract)?n.resultContract:{}}function Un(e){return a(ta(e).kind).toLowerCase()==="decision"}function ea(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:G(e)==="cli"}function Cn(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return Et(t,Mn(e))}function ra(e,t){let r=l(e?.metadata)?{...e.metadata}:{},n=l(r._runtimeBridge)?{...r._runtimeBridge}:{},s=Ye(n);return r._runtimeBridge={...n,promptKind:"dispatch",finalTextOnly:ea(t),releaseAfterPrompt:s===void 0?Cn(t):Et(s,Cn(t)),requiresRuntimeResult:Un(e)},r}function na(e){let t=Zo(e);if(!D(t))return"";let r=JSON.stringify(Qe(t),null,2);if(r.length<=Ge)return r;let n=r.length-Ge;return`${r.slice(0,Ge)}
-... [truncated ${n} characters]`}function tr(e){if(!l(e))return"";let t=l(e.update)?e.update:e,n=(l(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function Ze(e){if(!l(e))return"";let t=l(e.update)?e.update:e;return a(t.sessionUpdate)}function er(e){if(!Array.isArray(e))return"";let t=!1,r=[],n=[],s=[],i=()=>{r.length>0&&(n.push(r),r=[])};for(let c of e){let u=Ze(c),d=tr(c);if(!u){d&&s.push(d);continue}if(t=!0,u==="agent_message_chunk"){d&&r.push(d);continue}(u==="agent_thought_chunk"||u==="user_message_chunk"||u==="tool_call"||u==="tool_call_update"||u==="plan")&&i()}if(i(),!t)return at(s);let o=n[n.length-1]||[];return at(o)}function sa(e){return Array.isArray(e)?e.map(tr).filter(t=>t!==""):[]}function Xt(e){return Array.isArray(e)?e.some(r=>Ze(r))?e.filter(r=>jo.has(Ze(r))).map(tr).filter(r=>r!==""):sa(e):[]}function ia(e){if(!l(e))return null;let t=l(e.update)?e.update:e;return a(t.sessionUpdate)!=="runtime_event"?null:l(t.event)?t.event:null}function oa(e){if(!l(e))return"";let t=l(e.payload)?e.payload:{},r=a(e.type),n=a(t.type);if(r==="event_msg"){if(n==="task_complete")return a(t.last_agent_message||t.message||t.output);if(n==="agent_message"){let s=a(t.phase||t.status||t.stage).toLowerCase();if(["final_answer","final","complete","completed","done"].includes(s))return a(t.message||t.text||t.content)}}return""}function aa(e){if(!Array.isArray(e))return"";for(let t=e.length-1;t>=0;t-=1){let r=oa(ia(e[t]));if(r)return r}return""}function at(e){let t="";for(let r of e){let n=String(r||"");if(n)if(!t)t=n;else if(n.length>t.length&&n.startsWith(t))t=n;else{let s=gn(n)&&!/[\r\n]$/.test(t)?`
-`:"";t+=`${s}${n}`}}return t.trim()}function ca(e){let t=String(e||"").trim();if(!t)return"";let r=t.match(/(?:^|\n)#{1,3}\s+\S/);return!r||r.index===0?t:t.slice(r.index+(t[r.index]===`
-`?1:0)).trim()}function An(e){let t=String(e||"").trim();if(!t)return null;try{let r=JSON.parse(t);if(l(r)&&(Pn(r)||D(r._artifacts)||D(r.artifacts)||D(r._decision)||D(r._meta)))return r}catch{}return null}function St(e){try{return Ue(e)}catch{return null}}function Wt(...e){let t=null;for(let r of e)try{if(Ue(r))return}catch(n){t||=n}if(t)throw t}function Je(e){let t=String(e||"").trim();if(!t)return null;let r=St(t);if(r)return r;let n=[...t.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)];for(let s=n.length-1;s>=0;s-=1){let i=An(n[s][1]);if(i)return i}if(!t.endsWith("}"))return null;for(let s=t.lastIndexOf("{");s>=0;s=t.lastIndexOf("{",s-1)){let i=An(t.slice(s));if(i)return i}return null}function ua(e){let t=St(er(e));if(t)return t;let r=Xt(e);for(let n=r.length-1;n>=0;n-=1){let s=St(r[n]);if(s)return s}return St(at(r))}function Pn(e){if(!l(e))return!1;if(D(e.output))return!0;for(let t of["content","text","message","summary"])if(a(e[t]))return!0;return!!(bn(e.status)||a(e.error)||a(e.errorMessage))}function j(e){let t=l(e)?{...e}:{};return(!Array.isArray(t._artifacts)||t._artifacts.length===0)&&Array.isArray(t.artifacts)&&t.artifacts.length>0&&(t._artifacts=t.artifacts),delete t.artifacts,t}function la(e){return l(e)?typeof(l(e._decision)?e._decision:l(e.decision)?e.decision:e).passed=="boolean":!1}function Ln(e){return l(e)?l(e._decision)&&typeof e._decision.passed=="boolean"?!0:la(e.output):!1}function Xe(e,t,r){let n=l(e)?{...e}:{};if(!D(n.output)){for(let s of["summary","message","content","text"])if(a(n[s])){n.output=a(n[s]);break}}return!D(n.output)&&a(r)&&(n.output=a(r)),{...n,_meta:{...l(n._meta)?n._meta:{},runtimeOutputSource:t,requiredRuntimeResult:!0,finalMessagePreview:a(r).slice(0,1e3)}}}var da=["dataUrl","dataURL","contentDataUrl","contentDataURL","contentBase64","base64","data"];function xn(e){if(!l(e))return"";let t=l(e.content)?e.content:{},r=l(e.metadata)?e.metadata:{};return a(e.fieldKey||e.field_key||t.fieldKey||r.fieldKey)}function fa(e,t){let r=l(e.content)?e.content:{},n=l(t.content)?t.content:{},s={...e,...t,content:{...r,...n},metadata:{...l(e.metadata)?e.metadata:{},...l(t.metadata)?t.metadata:{}}};for(let i of da)D(e[i])&&(s[i]=e[i]),D(r[i])&&(s.content[i]=r[i]);return s}function kn(e,t){let r=Array.isArray(e)?e.filter(l):[],n=Array.isArray(t)?t.filter(l):[];if(!r.length)return n;if(!n.length)return r;let s=[...r],i=new Map;for(let c=0;c<r.length;c+=1){let u=xn(r[c]),d=i.get(u)||[];d.push(c),i.set(u,d)}let o=new Map;for(let c of n){let u=xn(c),d=o.get(u)||0;o.set(u,d+1);let f=i.get(u)?.[d];f===void 0?s.push(c):s[f]=fa(s[f],c)}return s}function K(e,t,r){let n={...e,...t,_meta:{...l(e._meta)?e._meta:{},...l(t._meta)?t._meta:{},runtimeOutputSource:r}};return(Array.isArray(e._artifacts)||Array.isArray(t._artifacts))&&(n._artifacts=kn(e._artifacts,t._artifacts)),n}function Dn(e,t,r={}){let n=a(r.promptKind),s=r.requiresRuntimeResult===!0,i=s||n==="dispatch",o=j(e),c=typeof o.output=="string"?St(o.output):null;if(c)return K(o,j(c),"result_block");let u=aa(t),d=u?Je(u):null,f=i?ua(t):null;if(Pn(o))return bn(o.status)||a(o.error)||a(o.errorMessage)?o:n==="dispatch"&&d?K(o,j(d),"final_event"):n==="dispatch"&&f?K(o,j(f),"updates"):!s||Ln(o)?o:d?K(o,j(d),"final_event"):f?K(o,j(f),"updates"):(Wt(o.output,u,at(Xt(t))),Xe(o,"result",o.output));if(d)return K(o,j(d),"final_event");if(f)return K(o,j(f),"updates");if(u)return s?(Wt(u,at(Xt(t))),Xe(o,"final_event",u)):{...o,output:u,_meta:{...l(o._meta)?o._meta:{},runtimeOutputSource:"final_event"}};let p=er(t),h=Je(p);if(h)return K(o,j(h),"updates");let m=ca(p);if(!m)return s&&Wt(at(Xt(t))),o;let T=Je(m);return T?K(o,j(T),"updates"):s?(Wt(p,m),Xe(o,"updates",m)):{...o,output:m,_meta:{...l(o._meta)?o._meta:{},runtimeOutputSource:"updates"}}}function rr(e){return l(e)?a(e.stopReason||e.stop_reason).toLowerCase():""}function vn(e){return Bo.has(rr(e))}function pa(e,t,r){if(r.promptKind!=="dispatch"||r.requiresRuntimeResult!==!0||!vn(e))return!1;try{return!Ln(Dn(e,t,r))}catch{return!0}}function ha(){return["Your previous final response reached the output limit before the Runtime Result protocol was complete.","Re-emit the complete final Runtime Result from scratch using the conclusion you already reached.","Do not repeat analysis, process notes, tool calls, or task work.",`Keep the OUTPUT report within ${Nn} Unicode characters.`,`Output ${Ae}, ${xe}, ${Ne}, and ${be} on their own lines.`,"The CONTROL block must be valid JSON containing _decision and must be fully closed.","Return only the two protocol blocks."].join(`
-`)}function ma(e,t){let r=l(t)?{...t}:{},n=kn(e?._artifacts,t?._artifacts);return n.length>0&&(r._artifacts=n),r}function ga(e,t){return{...e,_meta:{...l(e?._meta)?e._meta:{},runtimeProtocolRetry:{attempted:!0,recovered:!0,reason:rr(t)||"max_tokens"}}}}function _a(e,t){let r=typeof e?.output=="string"?e.output:er(t),n=new k("runtime_output_truncated","Runtime Result \u8FBE\u5230\u6700\u5927\u8F93\u51FA\u957F\u5EA6\uFF0C\u7D27\u51D1\u91CD\u8BD5\u540E\u4ECD\u672A\u5B8C\u6574\u8FD4\u56DE",r);return n.detail={...n.detail,stopReason:rr(e)||"max_tokens",retryAttempted:!0},n}var Yt=class{constructor(t){this.config=t,this.targets=t.targets||{},this.agents=new Map,this.sessions=new Map,this.startingSessions=new Set,this.targetReservations=new Map,this.runtimeSessionIndex=new Map,this.pendingPermissions=new Map,this.operations=new Map,this.startedAt=pt(),this.sandboxCapabilities={dispatchable:t.sandboxRequired!==!0,enforced:!1,backend:t.sandboxRequired?"unavailable":"direct",daemonStatus:t.sandboxRequired?"pending":"not_required",policySchemaVersions:[1],runtimePolicyUpdates:t.sandboxRequired===!0,workspaceSync:!1,egressProxy:!1},this.cleanupTimer=null,this.onCapacityChanged=null,this.startSessionCleanup()}async start(){try{this.sandboxCapabilities=await Sn(this.config)}catch(t){this.sandboxCapabilities={...this.sandboxCapabilities,dispatchable:!1,enforced:!1,backend:"unavailable",daemonStatus:"unavailable",reason:a(t?.code||t?.message||t)||"sandbox_probe_failed"},g("error","runtime-bridge","runtime node sandbox probe failed; node will not accept work",{reason:this.sandboxCapabilities.reason})}return this.sandboxCapabilities}assertDispatchable(){if(this.config.sandboxRequired&&!(this.sandboxCapabilities.dispatchable===!0&&this.sandboxCapabilities.enforced===!0))throw Object.assign(new Error("runtime node strong sandbox is unavailable"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"})}operationIdentity(t,r,n){let s=l(t.goalContract)?De(t.goalContract):a(t.goalContractHash),i=Po("sha256").update(q({prompt:Array.isArray(t.prompt)?t.prompt:[],mcpServers:zo(t.mcpServers),metadata:l(t.metadata)?t.metadata:{}})).digest("hex");return{agentId:r,runId:a(t.runId),sessionId:n,targetCode:a(t.targetCode||t.framework),workspace:a(t.workspace),goalContractHash:s,requestHash:i}}assertOperationIdentity(t,r,n,s){let i=this.operationIdentity(r,n,s),o=Object.keys(t.identity).find(c=>t.identity[c]!==i[c]);if(o)throw Object.assign(new Error(`runtime operation correlation conflict: ${t.correlationId}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT",field:o})}createOperation(t,r,n,s){let i={correlationId:t,agentId:n,sessionId:s,identity:this.operationIdentity(r,n,s),sandboxPolicy:l(r.sandboxPolicy)?structuredClone(r.sandboxPolicy):null,status:"running",updates:[],listeners:new Set,waiters:[],response:null,error:null,mcpServers:r.mcpServers,createdAtMs:Date.now(),completedAtMs:null};return this.operations.set(t,i),i}async attachOperation(t,r={}){let n=()=>{if(r.onUpdate)for(let s of t.updates)r.onUpdate(s)};if(t.status==="completed")return n(),t.response;if(t.status==="failed")throw n(),t.error;r.onUpdate&&t.listeners.add(r.onUpdate);try{return n(),await new Promise((s,i)=>t.waiters.push({resolve:s,reject:i}))}finally{r.onUpdate&&t.listeners.delete(r.onUpdate)}}completeOperation(t,r){if(t.status==="running"){t.status="completed",t.response=r,t.mcpServers=null,t.completedAtMs=Date.now();for(let n of t.waiters.splice(0))n.resolve(r);t.listeners.clear()}}promptResponse(t,r,n,s,i,o=s){let c=l(t.metadata)?t.metadata:{},u=l(c._runtimeBridge)?c._runtimeBridge:{},d=Dn(i,o,u),f=yn(t.goalContract,s,t.goalContractHash);return{sessionId:n,runtimeSessionId:r.runtimeSessionId,result:d,updates:s,...f?{verification:f}:{}}}failOperation(t,r){if(t.status!=="running")return;let n=r instanceof Error?r:Object.assign(new Error(String(r||"runtime operation failed")),{code:"RUNTIME_NODE_ERROR"});t.status="failed",t.error=n,t.mcpServers=null,t.completedAtMs=Date.now();for(let s of t.waiters.splice(0))s.reject(n);t.listeners.clear()}cleanupOperations(t=Date.now()){let r=z(this.config.operationTtlMs,Ho);for(let[n,s]of this.operations)s.status!=="running"&&t-(s.completedAtMs||s.createdAtMs)>r&&this.operations.delete(n)}targetFor(t){let r=a(t)||this.config.defaultTargetCode,n=this.targets[r];if(!r||!l(n)){let s=new Error(`runtime target is not configured: ${r||"<empty>"}`);throw s.code="RUNTIME_TARGET_NOT_FOUND",s}return{code:r,target:n}}targetIdleTtlMs(t){let n=G(t)==="openclaw"?z(this.config.openClawSessionIdleTtlMs,Fo):z(this.config.sessionIdleTtlMs,ko);return z(t?.sessionIdleTtlMs??t?.idleTtlMs,n)}targetMaxSessions(t){let n=G(t)==="openclaw"?z(this.config.openClawMaxSessions,$o):z(this.config.maxSessionsPerTarget,vo);return z(t?.maxSessions,n)}targetReservationCount(t){return Number(this.targetReservations.get(t)||0)}notifyCapacityChanged(){try{this.onCapacityChanged?.()}catch(t){g("warn","runtime-bridge","capacity heartbeat callback failed",{error:String(t)})}}targetCapacitySnapshot(t=!0){return Object.entries(this.targets).map(([r,n])=>{let s=[...this.sessions.values()].filter(f=>f.targetCode===r),i=s.filter(f=>f.busy).length,o=s.length-i,c=this.targetReservationCount(r),u=this.targetMaxSessions(n),d=t?Math.max(0,u-i-c):0;return{targetCode:r,targetName:a(n?.name||n?.targetName||r),targetType:a(n?.type||"echo"),status:t?d>0?"available":"busy":"unavailable",maxSessions:u,busySessions:i,idleSessions:o,reservedSessions:c,availableSessions:d}})}targetReleaseAfterPrompt(t,r={}){let n=G(t),s=l(r?._runtimeBridge)?r._runtimeBridge:{},i=Ye(s);return i!==void 0?Et(i,!1):Et(t?.releaseAfterPrompt??t?.disposeAfterPrompt,n==="openclaw")}promptReleaseAfterPrompt(t,r={}){if(this.config.sandboxRequired)return!0;let n=l(r?._runtimeBridge)?r._runtimeBridge:{},s=Ye(n);return s!==void 0?Et(s,t.releaseAfterPrompt):t.releaseAfterPrompt}startSessionCleanup(){let t=z(this.config.sessionCleanupIntervalMs,Do);t<=0||(this.cleanupTimer=setInterval(()=>{this.cleanupExpiredSessions().catch(r=>{g("warn","runtime-bridge","runtime session cleanup failed",{error:String(r)})})},t),this.cleanupTimer.unref?.())}sessionCountForTarget(t){let r=0;for(let n of this.sessions.values())n.targetCode===t&&(r+=1);return r}idleTargetSessions(t){return[...this.sessions.entries()].filter(([,r])=>r.targetCode===t&&!r.busy).sort((r,n)=>(r[1].lastUsedAtMs||0)-(n[1].lastUsedAtMs||0))}async closeSession(t,r="session_closed"){let n=this.sessions.get(t);if(!n)return!1;try{await n.runtime?.stop?.(r)}catch(s){g("warn","runtime-bridge","runtime session stop failed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,error:String(s)})}return this.sessions.delete(t),this.runtimeSessionIndex.delete(`${n.agentId}:${n.runtimeSessionId}`),this.notifyCapacityChanged(),g("info","runtime-bridge","runtime session closed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,reason:r}),!0}async closeAllSessions(t="bridge_shutdown"){for(let r of[...this.sessions.keys()])await this.closeSession(r,t)}async stop(t="bridge_stop"){this.cleanupTimer&&clearInterval(this.cleanupTimer),this.cleanupTimer=null,await this.closeAllSessions(t)}async cleanupExpiredSessions(t=Date.now()){for(let[r,n]of[...this.sessions.entries()])n.busy||t-(n.lastUsedAtMs||n.createdAtMs||t)>n.idleTtlMs&&await this.closeSession(r,"idle_timeout")}async reserveTargetSlot(t,r){let n=this.targetMaxSessions(r);for(;this.sessionCountForTarget(t)+this.targetReservationCount(t)>=n;){let s=this.idleTargetSessions(t);if(!s.length){let i=new Error(`runtime target session limit reached: ${t}`);throw i.code="RUNTIME_TARGET_SESSION_LIMIT",i}await this.closeSession(s[0][0],"target_session_limit")}this.targetReservations.set(t,this.targetReservationCount(t)+1),this.notifyCapacityChanged()}releaseTargetSlot(t){let r=Math.max(0,this.targetReservationCount(t)-1);r>0?this.targetReservations.set(t,r):this.targetReservations.delete(t),this.notifyCapacityChanged()}async createAgent(t){let r=a(t.agentId);if(!r)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});let{code:n,target:s}=this.targetFor(t.targetCode||t.framework),i=this.agents.get(r);if(i&&i.targetCode!==n)throw Object.assign(new Error(`runtime agent target conflict: ${r}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});let o=this.config.sandboxRequired?await je(this.config,s,t.workspace):a(t.workspace),c={agentId:r,targetCode:n,framework:a(t.framework||n),workspace:o,metadata:l(t.metadata)?t.metadata:{},createdAt:pt(),runtimeKind:G(s)};return this.agents.set(r,c),{agent:c}}runtimeFor(t,r,n={}){let{target:s}=this.targetFor(t.targetCode),i=G(s),o={onPermissionRequest:u=>n.source==="conversation_delegation"?{outcome:"denied",reason:"External group member permission continuation is not supported"}:this.requestPermission(u)},c={sessionPromptTimeoutMs:this.config.sessionPromptTimeoutMs,initializeTimeoutMs:this.config.initializeTimeoutMs,sandboxRequired:this.config.sandboxRequired,runId:n.runId,source:n.source,attachOnly:n.attachOnly,sandboxPolicy:n.sandboxPolicy,...this.config.sandboxRequired?{prepareLaunch:u=>On({config:this.config,target:s,...u,runId:n.runId,agentId:t.agentId,sessionId:r,sandboxPolicy:n.sandboxPolicy})}:{}};return i==="stdio-acp"||i==="acp"?new nt(t,s,o,c):i==="openclaw"?new vt(t,s,r,o,c):i==="cli"?new jt(t,s,c):new Nt(t)}async prompt(t,r={}){if(this.assertDispatchable(),this.config.sandboxRequired){let c=a(t.runId);if(!c)throw Object.assign(new Error("runId is required"),{code:"BAD_REQUEST"});t={...t,runId:c,sandboxPolicy:J(t.sandboxPolicy)}}let n=a(t.agentId),s=a(t.sessionId)||Jt(),i=a(t.correlationId);if(!n)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});if(this.cleanupOperations(),i){let c=this.operations.get(i);if(c){if(this.assertOperationIdentity(c,t,n,s),c.status==="running"&&["conversation_delegation","channel_message"].includes(t.metadata?.source)){c.mcpServers=t.mcpServers;let u=this.sessions.get(`${n}:${s}`);if(u){if(!u.runtime.refreshMcpServers)throw Object.assign(new Error("This runtime cannot refresh task MCP credentials"),{code:"unsupported_dynamic_mcp"});await u.runtime.refreshMcpServers(t.mcpServers)}}return this.attachOperation(c,r)}if(t.attachOnly===!0&&!(t.metadata?.source==="channel_message"&&this.targetFor(t.targetCode||t.framework).target.type==="openclaw"))throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"})}else if(t.attachOnly===!0)throw Object.assign(new Error("correlationId is required for attachOnly"),{code:"BAD_REQUEST"});let o=i?this.createOperation(i,t,n,s):null;if(o){let c=this.attachOperation(o,r);return(async()=>{try{await this._promptOwned(t,{},o,n,s)}catch(u){let d=o.status==="completed";this.failOperation(o,u),d&&g("warn","runtime-bridge","runtime cleanup failed after operation completion",{correlationId:o.correlationId,error:String(u)})}})(),await c}return await this._promptOwned(t,r,o,n,s)}async _promptOwned(t,r,n,s,i){let o=a(t.runId),c=this.config.sandboxRequired?J(n?.sandboxPolicy||t.sandboxPolicy):null,u=this.agents.get(s),d=this.targetFor(t.targetCode||t.framework||u?.targetCode);if(u&&u.targetCode!==d.code)throw Object.assign(new Error(`runtime agent target conflict: ${s}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});if(G(d.target)==="cli"&&Vo(t.goalContract))throw Object.assign(new Error("CLI runtimes do not support per-run dynamic MCP required by plugin_operation"),{code:"unsupported_dynamic_mcp"});let f=u||(await this.createAgent({agentId:s,targetCode:d.code,framework:t.framework,workspace:t.workspace,metadata:t.metadata})).agent;if(!this.config.sandboxRequired){let y=a(t.workspace);y&&y!==f.workspace&&(f.workspace=y)}let p=`${s}:${i}`;await this.cleanupExpiredSessions();let h=this.sessions.get(p),m=null;if(h&&h.targetCode!==d.code)throw Object.assign(new Error(`runtime session target conflict: ${i}`),{code:"RUNTIME_SESSION_TARGET_CONFLICT"});if(h&&this.config.sandboxRequired&&h.runId!==o)throw Object.assign(new Error(`runtime session cannot be shared across runs: ${i}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});if(!h){if(this.startingSessions.has(p))throw Object.assign(new Error(`runtime session is already starting: ${i}`),{code:"RUNTIME_SESSION_BUSY"});this.startingSessions.add(p);let{code:y,target:w}=d,E;try{await this.reserveTargetSlot(y,w),m=y;let I=this.runtimeFor(f,i,{runId:o,sandboxPolicy:c,source:t.metadata?.source,attachOnly:t.attachOnly});E=I;let P=n?.mcpServers||t.mcpServers||[],H=await I.sessionNew({cwd:rt(w,f.workspace),mcpServers:P,metadata:l(t.metadata)?t.metadata:{}});if(n&&n.status!=="running")throw Object.assign(new Error("Runtime operation was cancelled before prompt dispatch"),{code:"RUNTIME_OPERATION_CANCELLED"});let b=Date.now();h={agentId:s,sessionId:i,runtime:I,targetCode:y,runtimeKind:G(w),runId:o,sandboxPolicy:c?structuredClone(c):null,runtimeSessionId:a(l(H)?H.sessionId:"")||i,idleTtlMs:this.targetIdleTtlMs(w),releaseAfterPrompt:this.config.sandboxRequired?!0:this.targetReleaseAfterPrompt(w,t.metadata),createdAtMs:b,lastUsedAtMs:b,busy:!1,createdAt:pt()},this.sessions.set(p,h),this.runtimeSessionIndex.set(`${s}:${h.runtimeSessionId}`,h),n?.mcpServers!==P&&n?.mcpServers&&I.refreshMcpServers&&await I.refreshMcpServers(n.mcpServers)}catch(I){throw this.sessions.get(p)?.runtime===E?await this.closeSession(p,"session_start_failed"):await E?.stop("session_start_failed"),m&&(this.releaseTargetSlot(m),m=null),I}finally{this.startingSessions.delete(p)}}if(h.busy){let y=new Error(`runtime session is already running: ${i}`);throw y.code="RUNTIME_SESSION_BUSY",y}h.busy=!0,m&&this.releaseTargetSlot(m),this.notifyCapacityChanged(),h.operationCorrelationId=n?.correlationId||null,h.lastUsedAtMs=Date.now();let T=n?.updates||[],R=y=>{let w=Wo(y,i,h);if(T.push(w),n)for(let E of n.listeners)try{E?.(w)}catch(I){g("warn","runtime-bridge","runtime operation update listener failed",{correlationId:n.correlationId,error:String(I)})}else r.onUpdate?.(w)},N=y=>{if(!(!n||n.status!=="running"||!l(y))){if(y.status==="failed"){let w=y.error;if(w instanceof Error){this.failOperation(n,w);return}let E=l(w)?w:{},I=Object.assign(new Error(a(E.message||y.message)||"runtime terminal failure"),{code:a(E.code||y.code)||"RUNTIME_TERMINAL_FAILED"});this.failOperation(n,I);return}this.completeOperation(n,this.promptResponse(t,h,i,T,l(y.result)?y.result:{stopReason:"end_turn"}))}};try{let y=Tn(t.goalContract),w=Array.isArray(t.prompt)?[...t.prompt]:[];y&&w.unshift({type:"text",text:y,metadata:{source:"orcha_goal_contract"}});let E=l(t.metadata)?t.metadata:{},I=l(E._runtimeBridge)?E._runtimeBridge:{},P=await h.runtime.sessionPrompt({sessionId:h.runtimeSessionId,prompt:w,metadata:E},R,N),H=T,b=null;if(Mn({type:h.runtimeKind})&&pa(P,T,I)){b=P;let Z=T.length,ut=await h.runtime.sessionPrompt({sessionId:h.runtimeSessionId,prompt:[{type:"text",text:ha()}],metadata:E,_meta:{thinking:"off"}},R,N);P=ma(b,ut),H=T.slice(Z)}let O;try{O=this.promptResponse(t,h,i,T,P,H)}catch(Z){throw b&&vn(P)?_a(P,H):Z}return b&&(O.result=ga(O.result,b)),n&&this.completeOperation(n,O),O}finally{h.busy=!1,this.notifyCapacityChanged(),h.operationCorrelationId===n?.correlationId&&(h.operationCorrelationId=null),h.lastUsedAtMs=Date.now(),this.promptReleaseAfterPrompt(h,l(t.metadata)?t.metadata:{})&&await this.closeSession(p,"release_after_prompt"),n&&(n.mcpServers=null)}}async updatePolicy(t){if(this.assertDispatchable(),!this.config.sandboxRequired)throw Object.assign(new Error("runtime sandbox policy updates require an enforced sandbox"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"});let r=a(t.agentId),n=a(t.runId),s=a(t.sessionId),i=a(t.correlationId);if(!r||!n||!s||!i)throw Object.assign(new Error("agentId, runId, sessionId and correlationId are required"),{code:"BAD_REQUEST"});let o=J(t.sandboxPolicy),c=this.operations.get(i);if(c&&(c.agentId!==r||c.sessionId!==s||c.identity.runId!==n))throw Object.assign(new Error(`runtime operation policy identity conflict: ${i}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let u=`${r}:${s}`,d=this.sessions.get(u);if(d&&d.runId!==n)throw Object.assign(new Error(`runtime session policy identity conflict: ${s}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});let f=d?.sandboxPolicy||c?.sandboxPolicy;if(!f)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"});let p=Number(f.policyRevision),h=Number(o.policyRevision);if(h<p)throw Object.assign(new Error("runtime sandbox policy revision is stale"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});if(h===p){if(q(f)!==q(o))throw Object.assign(new Error("runtime sandbox policy revision payload conflicts"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});return{updated:!1,idempotent:!0,policyRevision:p,accessMode:f.accessMode}}let m=En(f,o);c&&(c.sandboxPolicy=structuredClone(o)),d&&(d.sandboxPolicy=structuredClone(o));let T=!1;return m&&d?.busy===!0&&(await d.runtime.sessionCancel({sessionId:d.runtimeSessionId}),T=await this.closeSession(u,"sandbox_policy_downgrade")),{updated:!0,policyRevision:h,accessMode:o.accessMode,activeCommandCancelled:T,deferredToNextLaunch:!m&&d?.busy===!0}}async cancel(t){let r=a(t.agentId),n=a(t.sessionId),s=a(t.correlationId);if(s){let c=this.operations.get(s);if(!c||c.status!=="running")return{cancelled:!1,correlationId:s,reason:"operation_not_running"};if(c.agentId!==r||c.sessionId!==n)throw Object.assign(new Error(`runtime operation cancellation identity conflict: ${s}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let u=this.sessions.get(`${r}:${n}`);return!u||u.busy!==!0||u.operationCorrelationId!==s?(this.failOperation(c,Object.assign(new Error("Runtime operation cancelled before dispatch"),{code:"RUNTIME_OPERATION_CANCELLED"})),{cancelled:!0,correlationId:s,reason:"cancelled_before_dispatch"}):(await u.runtime.sessionCancel({sessionId:u.runtimeSessionId}),await this.closeSession(`${r}:${n}`,"cancelled"),{cancelled:!0,correlationId:s})}let i=`${r}:${n}`,o=this.sessions.get(i);return o?(await o.runtime.sessionCancel({sessionId:o.runtimeSessionId}),await this.closeSession(i,"cancelled"),{cancelled:!0}):{cancelled:!1}}async dispatch(t,r={}){let n=a(t.agentId),s=a(t.taskId),i=a(t.executionId);if(!n||!s)throw Object.assign(new Error("agentId and taskId are required"),{status:400,code:"BAD_REQUEST"});let o=a(t.sessionId)||`dispatch-${i||s}`,c=a(t.instructions),u=na(t),d=Un(t),{target:f}=this.targetFor(t.targetCode||t.framework),p=[{type:"text",text:["Task dispatch received.",`taskId: ${s}`,i?`executionId: ${i}`:"",c?`instructions: ${c}`:"",u?"orchaContext:":"",u,u?"Use orchaContext as the source of truth for upstream outputs, review reports, artifacts, and workflow metadata.":"","Follow the execution protocol in instructions exactly.","When embedding a generated artifact in final Markdown, use the Orcha artifact placeholder as the link target: orcha-artifact://<fieldKey>/<index>.","Example: use ![illustration](orcha-artifact://image/0) for the first generated image artifact.","Do not use local filesystem paths, file:// URLs, or data: URLs in final Markdown; Orcha replaces artifact placeholders after ingestion.",d?`For decision results, put the raw report between ${Ae} and ${xe}.`:"",d?`Then put a JSON object containing _decision between ${Ne} and ${be}.`:"",d?"Do not JSON-escape the report. Keep output out of the CONTROL JSON, and put every protocol marker on its own line.":"",d?`Keep the report within ${Nn} Unicode characters so the CONTROL block fits before the output limit.`:"","Return only the final answer required by that protocol.","Do not include process notes, logs, or explanations."].filter(Boolean).join(`
-`)}];return this.prompt({...t,agentId:n,sessionId:o,prompt:p,metadata:ra(t,f)},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s}){let i=Jt(),c=this.runtimeSessionIndex.get(`${t.agentId}:${r}`)?.sessionId||r||Jt(),u={permissionId:i,agentId:t.agentId,sessionId:c,runtimeSessionId:r,request:l(n)?n:{},status:"pending",createdAt:pt()};return s?.({sessionId:r,update:{sessionUpdate:"permission_request",permission:u}}),await new Promise(d=>{let f=_(n?.timeoutMs,this.config.permissionRequestTimeoutMs),p=setTimeout(()=>{this.pendingPermissions.delete(i),d({permissionId:i,outcome:"denied",response:{reason:"permission request timed out"}})},f);this.pendingPermissions.set(i,{timer:p,resolve:d,permission:u})})}async respondPermission(t){let r=a(t.permissionId),n=this.pendingPermissions.get(r),s=a(t.outcome||"approved")||"approved";return n?(clearTimeout(n.timer),this.pendingPermissions.delete(r),n.resolve({permissionId:r,outcome:s,response:l(t.response)?t.response:{},userId:a(t.userId),metadata:l(t.metadata)?t.metadata:{}}),{accepted:!0,permissionId:r,outcome:s}):{accepted:!1,permissionId:r,outcome:s}}health(){return{status:this.config.sandboxRequired&&!this.sandboxCapabilities.dispatchable?"unavailable":"ok",bridgeVersion:et,startedAt:this.startedAt,agents:[...this.agents.values()].map(t=>({agentId:t.agentId,targetCode:t.targetCode,framework:t.framework,runtimeKind:t.runtimeKind})),sessions:this.sessions.size,pendingPermissions:this.pendingPermissions.size,targets:Object.keys(this.targets),sandboxCapabilities:this.sandboxCapabilities}}};import Ta from"node:http";import ya from"node:https";import{randomBytes as Hn}from"node:crypto";var ct=1,X=3,wa=1e4,Qt=class{constructor(t,r={}){this.url=t,this.readyState=0,this.socket=null,this.request=null,this.buffer=Buffer.alloc(0),this.listeners=new Map,this.connectTimeoutMs=Ra(r.connectTimeoutMs,wa),this.connectTimer=null,this.connect()}addEventListener(t,r){let n=this.listeners.get(t)||new Set;n.add(r),this.listeners.set(t,n)}emit(t,r={}){let n=this.listeners.get(t);if(n)for(let s of n)s(r)}connect(){let t=new URL(this.url),r=t.protocol==="wss:"?ya:Ta,n=Hn(16).toString("base64"),s=r.request({protocol:t.protocol==="wss:"?"https:":"http:",hostname:t.hostname,port:t.port||(t.protocol==="wss:"?443:80),path:`${t.pathname}${t.search}`,method:"GET",headers:{Connection:"Upgrade",Upgrade:"websocket","Sec-WebSocket-Key":n,"Sec-WebSocket-Version":"13"}});this.request=s,this.startConnectTimer(s),s.on("upgrade",(i,o,c)=>{if(this.clearConnectTimer(),this.readyState===X){o.destroy();return}this.socket=o,this.readyState=ct,o.on("data",u=>this.onData(u)),o.on("close",()=>this.onClose()),o.on("error",u=>{this.readyState!==X&&this.emit("error",{error:u,message:u.message,type:"error"}),this.onClose()}),c?.length&&this.onData(c),this.emit("open")}),s.on("response",i=>{this.clearConnectTimer(),this.emit("error",{message:`websocket upgrade failed: HTTP ${i.statusCode}`,type:"error"}),i.resume(),this.onClose()}),s.on("error",i=>{this.clearConnectTimer(),this.readyState!==X&&this.emit("error",{error:i,message:i.message,type:"error"}),this.onClose()}),s.end()}startConnectTimer(t){this.connectTimeoutMs<=0||(this.connectTimer=setTimeout(()=>{if(this.readyState===ct||this.readyState===X)return;let r=`websocket connect timeout after ${this.connectTimeoutMs}ms`;this.emit("error",{message:r,type:"timeout"}),this.onClose(),t.destroy(new Error(r))},this.connectTimeoutMs),this.connectTimer.unref?.())}clearConnectTimer(){this.connectTimer&&(clearTimeout(this.connectTimer),this.connectTimer=null)}send(t){!this.socket||this.readyState!==ct||this.socket.write(nr(1,Buffer.from(String(t),"utf8")))}close(){if(this.readyState!==X){if(this.clearConnectTimer(),!this.socket){this.request?.destroy(),this.onClose();return}try{this.readyState===ct&&this.socket.write(nr(8,Buffer.alloc(0))),this.socket.end()}catch{this.socket.destroy()}this.onClose()}}onClose(){this.readyState!==X&&(this.clearConnectTimer(),this.readyState=X,this.request=null,this.emit("close"))}onData(t){for(this.buffer=Buffer.concat([this.buffer,t]);this.buffer.length>=2;){let r=this.buffer[0],n=this.buffer[1],s=r&15,i=(n&128)!==0,o=n&127,c=2;if(o===126){if(this.buffer.length<c+2)return;o=this.buffer.readUInt16BE(c),c+=2}else if(o===127){if(this.buffer.length<c+8)return;let f=this.buffer.readUInt32BE(c),p=this.buffer.readUInt32BE(c+4);o=f*2**32+p,c+=8}let u=c;if(i&&(c+=4),this.buffer.length<c+o)return;let d=this.buffer.subarray(c,c+o);if(i){let f=this.buffer.subarray(u,u+4);d=Buffer.from(d.map((p,h)=>p^f[h%4]))}this.buffer=this.buffer.subarray(c+o),s===1?this.emit("message",{data:d.toString("utf8")}):s===8?this.close():s===9&&this.socket?.write(nr(10,d))}}};function Ra(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function nr(e,t){let r=t.length,n=2;r>=126&&r<=65535?n+=2:r>65535&&(n+=8);let s=Hn(4),i=Buffer.alloc(n+4+r);i[0]=128|e;let o=2;r<126?i[1]=128|r:r<=65535?(i[1]=254,i.writeUInt16BE(r,o),o+=2):(i[1]=255,i.writeUInt32BE(Math.floor(r/2**32),o),i.writeUInt32BE(r>>>0,o+4),o+=8),s.copy(i,o),o+=4;for(let c=0;c<r;c+=1)i[o+c]=t[c]^s[c%4];return i}function Ea(e){let t=new URL(e);if(t.protocol==="http:")t.protocol="ws:";else if(t.protocol==="https:")t.protocol="wss:";else if(t.protocol!=="ws:"&&t.protocol!=="wss:")throw new Error(`unsupported ORCHA_RUNTIME_ORCHA_URL protocol: ${t.protocol}`);return t.pathname=`${t.pathname.replace(/\/+$/,"")}/api/agent-runtime-bridge/ws`,t.search="",t.toString()}function Sa(e,t=!0){return Object.entries(e||{}).map(([r,n])=>({targetCode:r,targetName:a(n?.name||n?.targetName||r),targetType:a(n?.type||"echo"),status:t?"available":"unavailable"}))}var Oa=Object.freeze(["health","agents/create","agents/dispatch","sessions/prompt","sessions/policy","sessions/cancel","permissions/respond"]),Zt=class{constructor(t,r){this.config=t,this.bridge=r,this.ws=null,this.stopped=!1,this.connected=!1,this.reconnectTimer=null,this.heartbeatTimer=null,this.capacityHeartbeatTimer=null,this.bridge.onCapacityChanged=()=>this.scheduleCapacityHeartbeat()}sandboxCapabilities(){return this.bridge.sandboxCapabilities||{dispatchable:this.config.sandboxRequired!==!0,enforced:!1,backend:"development_direct",daemonStatus:"development_only",policySchemaVersions:[1],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:!1}}supportedMethods(){return[...Oa,...this.config.deviceConnection?["devices/discover","devices/configure"]:[]]}runtimeTargets(){let t=this.sandboxCapabilities().dispatchable===!0;return typeof this.bridge.targetCapacitySnapshot=="function"?this.bridge.targetCapacitySnapshot(t):Sa(this.config.targets,t)}start(){this.connect()}stop(){this.stopped=!0,this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=null,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.capacityHeartbeatTimer&&clearTimeout(this.capacityHeartbeatTimer),this.capacityHeartbeatTimer=null,this.bridge.onCapacityChanged=null,this.ws?.close()}connect(){if(this.stopped)return;let t=Ea(this.config.orchaUrl),r=new Qt(t,{connectTimeoutMs:this.config.connectTimeoutMs});this.ws=r,r.addEventListener("open",()=>{if(this.ws!==r||this.stopped){r.close();return}this.authenticate(r)}),r.addEventListener("message",n=>this.handleMessage(n.data,r)),r.addEventListener("close",()=>this.scheduleReconnect("close",r)),r.addEventListener("error",n=>{g("warn","orcha-client","runtime node websocket error",{error:String(n?.message||n?.type||n)})})}authenticate(t=this.ws){this.send({type:"runtime_node.authenticate",token:this.config.nodeToken,nodeId:this.config.nodeId,nodeName:this.config.nodeName,version:et,protocolVersion:"orcha-runtime-node.v2",defaultTargetCode:this.config.defaultTargetCode,supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()},t)}scheduleReconnect(t,r=this.ws){r&&this.ws!==r||(this.connected=!1,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.capacityHeartbeatTimer&&clearTimeout(this.capacityHeartbeatTimer),this.capacityHeartbeatTimer=null,r&&this.ws===r&&(this.ws=null),!this.stopped&&(this.reconnectTimer||(g("info","orcha-client","runtime node disconnected; reconnect scheduled",{reason:t,reconnectMs:this.config.reconnectMs}),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},this.config.reconnectMs))))}async handleMessage(t,r=this.ws){if(r&&this.ws!==r)return;let n;try{n=JSON.parse(String(t))}catch(s){g("warn","orcha-client","invalid Orcha websocket frame",{error:String(s)});return}if(l(n)){if(n.type==="runtime_node.authenticated"){if(r&&this.ws!==r)return;this.connected=!0,this.startHeartbeat(r),g("info","orcha-client","runtime node authenticated",{nodeId:this.config.nodeId,connectionId:n.connectionId});return}if(n.type==="orcha.runtime.request"){await this.handleRequest(n);return}n.type==="runtime_node.ping"&&this.send({type:"runtime_node.pong",ts:new Date().toISOString(),supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()})}}startHeartbeat(t){this.heartbeatTimer&&clearInterval(this.heartbeatTimer);let r=Math.max(1e3,Number(this.config.heartbeatIntervalMs||15e3)),n=()=>this.sendCapacityHeartbeat(t);n(),this.heartbeatTimer=setInterval(n,r),this.heartbeatTimer.unref?.()}scheduleCapacityHeartbeat(){if(!this.connected||this.capacityHeartbeatTimer)return;let t=Math.max(25,Math.min(1e3,Number(this.config.capacityHeartbeatDebounceMs||100)));this.capacityHeartbeatTimer=setTimeout(()=>{this.capacityHeartbeatTimer=null,this.sendCapacityHeartbeat()},t),this.capacityHeartbeatTimer.unref?.()}sendCapacityHeartbeat(t=this.ws){return this.connected?this.send({type:"runtime_node.heartbeat",ts:new Date().toISOString(),supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()},t):!1}async handleRequest(t){let r=a(t.id),n=a(t.method),s=l(t.params)?t.params:{};try{let i=await this.invoke(n,s,r);this.send({type:"orcha.runtime.response",id:r,ok:!0,result:i})}catch(i){this.send({type:"orcha.runtime.response",id:r,ok:!1,error:{code:i.code||"RUNTIME_NODE_ERROR",message:i.message||String(i),...i.detail===void 0?{}:{detail:i.detail}}})}}async invoke(t,r,n){if(t==="devices/discover"&&this.config.deviceConnection)return this.config.deviceConnection.candidates();if(t==="devices/configure"&&this.config.deviceConnection)return this.config.deviceConnection.configure(r,this.bridge);if(t==="health")return this.bridge.health();if(t==="agents/create")return this.bridge.createAgent(r);if(t==="agents/dispatch")return this.bridge.dispatch(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/prompt")return this.bridge.prompt(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/policy")return this.bridge.updatePolicy(r);if(t==="sessions/cancel")return this.bridge.cancel(r);if(t==="permissions/respond")return this.bridge.respondPermission(r);throw Object.assign(new Error(`unsupported Orcha runtime method: ${t}`),{code:"METHOD_NOT_FOUND"})}sendUpdate(t,r){this.send({type:"orcha.runtime.event",requestId:t,eventType:"runtime.update",payload:r})}send(t,r=this.ws){return!r||r!==this.ws||r.readyState!==ct?!1:(r.send(JSON.stringify(t)),!0)}};import{existsSync as Fn,readFileSync as Ia}from"node:fs";import{dirname as Ca,resolve as te}from"node:path";import{fileURLToPath as Aa}from"node:url";var xa=/^[A-Za-z_][A-Za-z0-9_]*$/;function $n(e=process.env,t=process.cwd()){let r=a(e.ORCHA_RUNTIME_ENV_FILE),n=r?te(t,r):te(t,".env");if(!Fn(n))return r&&g("warn","config","runtime env file not found",{path:n}),{loaded:!1,path:n,keys:[]};let s=[],i=Ia(n,"utf8");for(let o of i.split(/\r?\n/)){let c=Ma(o);if(!c)continue;let[u,d]=c;Object.prototype.hasOwnProperty.call(e,u)||(e[u]=d,s.push(u))}return g("info","config","runtime env file loaded",{path:n,keyCount:s.length}),{loaded:!0,path:n,keys:s}}function Bn(e=process.env){let t=a(e.ORCHA_RUNTIME_MODE||(e.ORCHA_RUNTIME_ORCHA_URL?"node":"server")),r=a(e.ORCHA_RUNTIME_BRIDGE_HOST||"127.0.0.1"),n=!1,s=Ca(Aa(import.meta.url)),i=te(s,"sandbox","broker.js"),o=te(s,"orcha-runtime-sandbox-broker.js"),c=Fn(i)?i:o,u=a(e.ORCHA_RUNTIME_SANDBOX_BROKER_COMMAND);return{mode:t,host:r,port:_(e.ORCHA_RUNTIME_BRIDGE_PORT,5588),token:e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",orchaUrl:a(e.ORCHA_RUNTIME_ORCHA_URL),nodeToken:e.ORCHA_RUNTIME_NODE_TOKEN||e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",nodeId:a(e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"local-runtime-node"),nodeName:a(e.ORCHA_RUNTIME_NODE_NAME||e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"Local Runtime Node"),reconnectMs:_(e.ORCHA_RUNTIME_RECONNECT_MS,3e3),connectTimeoutMs:_(e.ORCHA_RUNTIME_CONNECT_TIMEOUT_MS||e.ORCHA_RUNTIME_WS_CONNECT_TIMEOUT_MS,1e4),defaultTargetCode:e.ORCHA_RUNTIME_DEFAULT_TARGET||"echo",requestLimitBytes:_(e.ORCHA_RUNTIME_REQUEST_LIMIT_BYTES,1048576),initializeTimeoutMs:_(e.ORCHA_RUNTIME_INITIALIZE_TIMEOUT_MS,3e4),sessionPromptTimeoutMs:_(e.ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS,36e5),permissionRequestTimeoutMs:_(e.ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS,3e5),sessionIdleTtlMs:_(e.ORCHA_RUNTIME_SESSION_IDLE_TTL_MS,6e5),sessionCleanupIntervalMs:_(e.ORCHA_RUNTIME_SESSION_CLEANUP_INTERVAL_MS,6e4),maxSessionsPerTarget:_(e.ORCHA_RUNTIME_MAX_SESSIONS_PER_TARGET,8),openClawSessionIdleTtlMs:_(e.ORCHA_RUNTIME_OPENCLAW_SESSION_IDLE_TTL_MS,6e4),openClawMaxSessions:_(e.ORCHA_RUNTIME_OPENCLAW_MAX_SESSIONS,1),heartbeatIntervalMs:_(e.ORCHA_RUNTIME_HEARTBEAT_INTERVAL_MS,15e3),sandboxRequired:n,sandboxBrokerCommand:u||process.execPath,sandboxBrokerArguments:sr(e.ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS,"ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS",u?[]:[c]),sandboxProbeTimeoutMs:_(e.ORCHA_RUNTIME_SANDBOX_PROBE_TIMEOUT_MS,1e4),sandboxTempRoot:a(e.ORCHA_RUNTIME_SANDBOX_TEMP_ROOT),trustedWorkspaceRoots:sr(e.ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS,"ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS"),trustedToolchainRoots:sr(e.ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS,"ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS"),egressProxyRequired:ba(e.ORCHA_RUNTIME_EGRESS_PROXY_REQUIRED,t==="node"),egressProxySocket:a(e.ORCHA_RUNTIME_EGRESS_PROXY_SOCKET),egressProxyToken:a(e.ORCHA_RUNTIME_EGRESS_PROXY_TOKEN),egressGrantMaxTtlMs:_(e.ORCHA_RUNTIME_EGRESS_GRANT_MAX_TTL_MS,9e5),targets:Na(e.ORCHA_RUNTIME_TARGETS_JSON||"")}}function Na(e){if(!a(e))return{};try{let t=JSON.parse(e);if(l(t))return t}catch(t){g("warn","config","invalid ORCHA_RUNTIME_TARGETS_JSON",{error:String(t)})}return{}}function ba(e,t){let r=a(e).toLowerCase();if(!r)return t;if(["true","1","yes","on"].includes(r))return!0;if(["false","0","no","off"].includes(r))return!1;throw new Error(`invalid boolean configuration value: ${r}`)}function sr(e,t,r=[]){let n=a(e);if(!n)return[...r];let s;try{s=JSON.parse(n)}catch{throw new Error(`${t} must be a JSON string array`)}if(!Array.isArray(s)||s.some(i=>typeof i!="string"))throw new Error(`${t} must be a JSON string array`);return s.map(i=>i.trim()).filter(Boolean)}function Ma(e){let t=e.trim();if(!t||t.startsWith("#"))return null;let r=t.startsWith("export ")?t.slice(7).trimStart():t,n=r.indexOf("=");if(n<=0)return null;let s=r.slice(0,n).trim();if(!xa.test(s))return null;let i=Ua(r.slice(n+1).trim());return[s,i]}function Ua(e){if(!e)return"";let t=e[0];if((t==='"'||t==="'")&&e.endsWith(t)){let r=e.slice(1,-1);return t==='"'?Pa(r):r}return La(e).trim()}function Pa(e){return e.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","	").replaceAll('\\"','"').replaceAll("\\\\","\\")}function La(e){let t=!1,r=!1;for(let n=0;n<e.length;n+=1){let s=e[n],i=e[n-1];if(s==="'"&&!r)t=!t;else if(s==='"'&&!t&&i!=="\\")r=!r;else if(s==="#"&&!t&&!r&&/\s/.test(i||""))return e.slice(0,n)}return e}import{createServer as ka}from"node:http";function ee(e,t,r){let n=JSON.stringify(r);e.writeHead(t,{"content-type":"application/json; charset=utf-8","content-length":Buffer.byteLength(n)}),e.end(n)}function Y(e={}){return{ok:!0,...e}}function ir(e,t,r){return{ok:!1,error:{code:e,message:t,...r===void 0?{}:{detail:r}}}}async function jn(e,t){let r=[],n=0;for await(let i of e){if(n+=i.length,n>t)throw Object.assign(new Error("request body too large"),{status:413,code:"REQUEST_TOO_LARGE"});r.push(i)}if(r.length===0)return{};let s=Buffer.concat(r).toString("utf8");if(!s.trim())return{};try{let i=JSON.parse(s);if(!l(i))throw Object.assign(new Error("JSON body must be an object"),{status:400,code:"BAD_JSON"});return i}catch(i){throw i.status?i:Object.assign(new Error(`invalid JSON body: ${i.message}`),{status:400,code:"BAD_JSON"})}}function qn(e,t){if(!t)return;if((e.headers.authorization||"")!==`Bearer ${t}`)throw Object.assign(new Error("runtime bridge token is invalid"),{status:401,code:"UNAUTHORIZED"})}function Kn(e,t){let r={"GET /health":async()=>Y(t.health()),"POST /agents/create":async n=>Y(await t.createAgent(n)),"POST /agents/dispatch":async n=>Y(await t.dispatch(n)),"POST /sessions/prompt":async n=>Y(await t.prompt(n)),"POST /sessions/cancel":async n=>Y(await t.cancel(n)),"POST /permissions/respond":async n=>Y(await t.respondPermission(n))};return ka(async(n,s)=>{let i=new URL(n.url||"/",`http://${n.headers.host||`${e.host}:${e.port}`}`),o=`${n.method||"GET"} ${i.pathname}`,c=r[o];if(!c){ee(s,404,ir("NOT_FOUND",`No route for ${o}`));return}try{qn(n,e.token);let u=n.method==="GET"?{}:await jn(n,e.requestLimitBytes);ee(s,200,await c(u))}catch(u){let d=u.status||500,f=u.code||"BRIDGE_INTERNAL";ee(s,d,ir(f,u.message||String(u),u.detail))}})}var qa=ja(import.meta.url),Ka=".orcha-runtime-bridge.pid",Ga=".orcha-runtime-bridge.log",za=3,Va=36e5,{command:Wa,options:Qn}=Ya(process.argv.slice(2));Qa(Qn);$n();var Ja=Bn();await Zn(Wa,Ja,Qn);async function Zn(e,t,r){if(r.url){let s=ue(r.url);r.pidFile||(process.env.ORCHA_RUNTIME_PID_FILE=s.pidFile),r.logFile||(process.env.ORCHA_RUNTIME_LOG_FILE=s.logFile)}let n=()=>["connect","--url",t.orchaUrl,"--foreground"];switch(e){case"connect":if(r.pairCode&&Q(ne(re())))throw new Error("\u8BBE\u5907\u8FDE\u63A5\u4ECD\u5728\u540E\u53F0\u8FD0\u884C\uFF0C\u8BF7\u5148\u6267\u884C stop --url \u540E\u91CD\u65B0\u914D\u5BF9");await It(t,r),r.foreground?await or(t):ar(n());return;case"run":case"foreground":r.url&&await It(t,r),await or(t);return;case"start":if(r.url)return Zn("connect",t,r);if(r.foreground){await or(t);return}ar();return;case"reload":case"restart":r.url&&await It(t,{url:r.url}),await Vn({quiet:!0}),ar(r.url?n():void 0);return;case"stop":await Vn();return;case"status":Xa();return;case"help":case"--help":case"-h":rc();return;default:throw new Error(`Unknown command: ${e}`)}}async function or(e){Za();let t=new Yt(e);if(await t.start(),e.mode==="server"){let n=Kn(e,t);zn({bridge:t,server:n}),n.listen(e.port,e.host,()=>{g("info","runtime-bridge","Orcha runtime bridge HTTP server started",{host:e.host,port:e.port,targets:Object.keys(t.targets)})});return}if(!e.orchaUrl)throw new Error("ORCHA_RUNTIME_ORCHA_URL is required in runtime node mode");let r=new Zt(e,t);zn({bridge:t,client:r}),r.start(),g("info","runtime-bridge","Orcha runtime node started",{nodeId:e.nodeId,nodeName:e.nodeName,orchaUrl:e.orchaUrl,targets:Object.keys(t.targets)})}function zn({bridge:e,client:t,server:r}){let n=!1,s=i=>{if(n)return;n=!0;let o=Number(e?.sessions?.size||0)>0;g("info","runtime-bridge","runtime bridge shutting down",{signal:i});try{t?.stop?.()}catch(c){g("warn","runtime-bridge","runtime client stop failed",{error:String(c)})}Promise.resolve(e?.stop?.(`process_${String(i||"shutdown").toLowerCase()}`)).catch(c=>{g("warn","runtime-bridge","runtime bridge stop failed",{error:String(c)})}).finally(()=>{try{r?.close?.()}catch(c){g("warn","runtime-bridge","runtime server close failed",{error:String(c)})}}),setTimeout(()=>process.exit(0),o?8500:200)};process.once("SIGTERM",()=>s("SIGTERM")),process.once("SIGINT",()=>s("SIGINT"))}function ar(e=["run"]){let t=re(),r=ts(),n=ne(t);if(n&&Q(n)){console.log(JSON.stringify({status:"already_running",pid:n,pidFile:t,logFile:r}));return}n&&lr(t),Jn(t),Jn(r),ur(r);let s=Fa(r,"a"),i={...process.env,ORCHA_RUNTIME_PID_FILE:t,ORCHA_RUNTIME_LOG_FILE:r},o=Da(process.execPath,[qa,...e,"--pid-file",t,"--log-file",r],{cwd:process.cwd(),detached:!0,env:i,stdio:["ignore",s,s]});o.unref(),va(s),Yn(t,`${o.pid}
-`),console.log(JSON.stringify({status:"started",pid:o.pid,pidFile:t,logFile:r}))}async function Vn({quiet:e=!1}={}){let t=re(),r=ne(t);if(!r){e||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!Q(r)){lr(t),e||console.log(JSON.stringify({status:"not_running",pid:r,pidFile:t}));return}process.kill(r,"SIGTERM"),!await Wn(r,1e4)&&Q(r)&&(process.kill(r,"SIGKILL"),await Wn(r,3e3)),lr(t),e||console.log(JSON.stringify({status:"stopped",pid:r,pidFile:t}))}function Xa(){let e=re(),t=ts(),r=ne(e),n=!!(r&&Q(r));console.log(JSON.stringify({status:n?"running":"not_running",running:n,pid:n?r:null,pidFile:e,logFile:t}))}function Ya(e){let t=[],r={};for(let s=0;s<e.length;s+=1){let i=e[s];i==="--url"?r.url=e[++s]:i==="--pair-code"?r.pairCode=e[++s]:i==="--daemon"?r.daemon=!0:i==="--foreground"?r.foreground=!0:i==="--env-file"?r.envFile=e[++s]:i==="--pid-file"?r.pidFile=e[++s]:i==="--log-file"?r.logFile=e[++s]:t.push(i)}return{command:t[0]||"run",options:r}}function Qa(e){e.envFile&&(process.env.ORCHA_RUNTIME_ENV_FILE=e.envFile),e.pidFile&&(process.env.ORCHA_RUNTIME_PID_FILE=e.pidFile),e.logFile&&(process.env.ORCHA_RUNTIME_LOG_FILE=e.logFile)}function re(){return dr(process.cwd(),process.env.ORCHA_RUNTIME_PID_FILE||Ka)}function ts(){return dr(process.cwd(),process.env.ORCHA_RUNTIME_LOG_FILE||Ga)}function Za(){let e=process.env.ORCHA_RUNTIME_LOG_FILE;if(!e)return;let t=es();if(t<=0)return;let r=dr(process.cwd(),e);ur(r,t);let n=ec();n<=0||setInterval(()=>ur(r,t),n).unref()}function ur(e,t=es()){if(t<=0||!Xn(e))return;let r=0,n="";try{if(r=Gn(e).size,r<=0)return;n=cr(e,"utf8")}catch(d){g("warn","runtime-bridge","runtime log cleanup skipped",{logFile:e,error:String(d)});return}let s=Date.now()-t*24*60*60*1e3,i=n.split(/\r?\n/),o=[],c=0;for(let d of i)d&&(tc(d,s)?o.push(d):c+=1);if(c===0)return;let u="";try{Gn(e).size>r&&(u=cr(e,"utf8").slice(n.length));let f=[...o,...u.split(/\r?\n/).filter(Boolean)].join(`
-`);Yn(e,f?`${f}
-`:""),g("info","runtime-bridge","runtime log cleanup completed",{logFile:e,retentionDays:t,removed:c})}catch(d){g("warn","runtime-bridge","runtime log cleanup failed",{logFile:e,error:String(d)})}}function tc(e,t){try{let r=JSON.parse(e);if(!r||typeof r!="object")return!0;let n=typeof r.ts=="string"?Date.parse(r.ts):Number.NaN;return!Number.isFinite(n)||n>=t}catch{return!0}}function es(){return rs(process.env.ORCHA_RUNTIME_LOG_RETENTION_DAYS,za)}function ec(){return rs(process.env.ORCHA_RUNTIME_LOG_CLEANUP_INTERVAL_MS,Va)}function rs(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function ne(e){if(!Xn(e))return null;let t=Number.parseInt(cr(e,"utf8").trim(),10);return Number.isInteger(t)&&t>0?t:null}function Q(e){if(!Number.isInteger(e)||e<=0)return!1;try{return process.kill(e,0),!0}catch(t){return t?.code==="EPERM"}}async function Wn(e,t){let r=Date.now();for(;Date.now()-r<t;){if(!Q(e))return!0;await new Promise(n=>setTimeout(n,100))}return!Q(e)}function Jn(e){Ha(Ba(e),{recursive:!0})}function lr(e){try{$a(e,{force:!0})}catch{}}function rc(){console.log(`Usage: orcha-runtime-bridge [command] [options]
+${s}`:s;xn(t,r,n,d,s)&&(o=1,a=1)}return s&&i&&(t.finalTextSeen=!0),On(t,Sn(e,t.artifactOptions)),(ho(e)||mo(e)||go(e)||i)&&n({sessionId:r,update:{sessionUpdate:"runtime_event",event:In(e)}}),{textCount:o,finalTextCount:a,thoughtCount:u}}function Ne(e,t,r,n,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0,textCount:0,finalTextCount:0,thoughtCount:0};let i=e.artifacts.size,o=0,a=0,u=0,d=0,f=fo(t,r,s);if(f){let p=Math.min(t.processedLines.get(f.path)||0,f.events.length),h=e.artifacts.size;for(let m of f.events.slice(p)){let y=_o(m,e,r,n);a+=y.textCount,u+=y.finalTextCount,d+=y.thoughtCount}t.processedLines.set(f.path,f.events.length),(f.events.length>p||e.artifacts.size>h)&&(o=1)}return{artifactCount:e.artifacts.size-i,transcriptCount:o,textCount:a,finalTextCount:u,thoughtCount:d}}function yo(e,{remove:t=!0}={}){if(!e||!gn(e))return"";try{return yn(e,"utf8").trim()}catch{return""}finally{t&&Gt(e)}}function Gt(e){if(e)try{bi(e)}catch{}}function To(e,t){return{artifactCount:(e?.artifactCount||0)+(t?.artifactCount||0),transcriptCount:(e?.transcriptCount||0)+(t?.transcriptCount||0),textCount:(e?.textCount||0)+(t?.textCount||0),finalTextCount:(e?.finalTextCount||0)+(t?.finalTextCount||0),thoughtCount:(e?.thoughtCount||0)+(t?.thoughtCount||0)}}function wo(e){return new Promise(t=>setTimeout(t,e))}function Eo(e,t,r,n){return n?(e.finalTextSeen=!0,e.emittedTexts.has(n)||(e.emittedTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}})),!0):!1}async function Ro(e,t,r,n,s,i){let o=Ne(e,t,r,n,Date.now()),a=()=>Eo(e,r,n,yo(s,{remove:!1}));if(a()||e.finalTextSeen)return Gt(s),o;let u=Ki(i);if(u<=0||!t&&!s)return Gt(s),o;let d=Date.now()+u,f=Math.min(Cn(i),100);for(;!e.finalTextSeen&&Date.now()<d&&(await wo(Math.min(f,Math.max(0,d-Date.now()))),o=To(o,Ne(e,t,r,n,Date.now())),!a()););return Gt(s),o}var Jt=class{constructor(t,r,n={}){if(this.agent=t,this.target=r,this.options=n,this.active=new Map,n.source==="ai_chat_runtime_node"&&Ce(r)==="codex"){if(!n.cloudSessionId?.startsWith("task-")||!n.orchaUrl||n.prepareLaunch)throw Object.assign(new Error("Codex \u539F\u751F\u4F1A\u8BDD\u9700\u8981\u5347\u7EA7 Core \u5E76\u4F7F\u7528\u5DF2\u63A5\u5165\u7684\u672C\u673A\u8BBE\u5907"),{code:"BAD_REQUEST"});this.nativeSession=new jt([n.orchaUrl,t.agentId,t.targetCode,n.cloudSessionId,Z(r,t.workspace),r.command,r.env?.CODEX_HOME||process.env.CODEX_HOME||F(Tn(),".codex")])}}async sessionNew(t={}){let r=t.mcpServers||[];if(r.length&&(t.metadata?.source==="conversation_delegation"||this.nativeSession)&&Ce(this.target)==="codex"){if(this.options.prepareLaunch)throw Object.assign(new Error("Codex task MCP requires a reachable node-local transport; this sandbox launcher does not provide one"),{code:"unsupported_dynamic_mcp"});this.taskMcp=await nn(r)}else if(r.length&&t.metadata?.source==="conversation_delegation")throw Object.assign(new Error("This CLI adapter does not support task-scoped MCP"),{code:"unsupported_dynamic_mcp"});return{sessionId:`cli-${this.agent.agentId}-${ut()}`}}async refreshMcpServers(t){if(!this.taskMcp)throw Object.assign(new Error("The original Codex MCP binding is unavailable"),{code:"RUNTIME_OPERATION_NOT_FOUND"});await this.taskMcp.refresh(t)}async sessionPrompt(t,r,n){return this.nativeSession?this.nativeSession.turn(this.options.runId,(s,i,o)=>this.runPrompt(t,i,o,s),r,n,()=>this.sessionCancel(t)):this.runPrompt(t,r,n)}async runPrompt(t,r,n,s){let i=Date.now(),o=c(this.target.command);if(!o)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let a=c(t.sessionId)||ut(),u=Lt(t.prompt),d=c(this.target.promptMode||"stdin"),f=this.buildArgs(d,u),p=[...this.taskMcp?.args||[],...this.nativeSession?un(f,s):f],h=Z(this.target,this.agent.workspace),m=typeof this.options.prepareLaunch=="function",S=qi(o,p,this.target)?m?`/tmp/orcha-runtime-last-message-${ut()}.txt`:F(wn(),`orcha-runtime-last-message-${ut()}.txt`):"";S&&p.push("--output-last-message",S);let N={...l(this.target.env)?this.target.env:{},...this.taskMcp?.environment||{},...d==="env"?{ORCHA_RUNTIME_PROMPT:u}:{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:a},_=m?await this.options.prepareLaunch({command:o,args:p,cwd:h,environment:N}):{command:o,args:p,cwd:h,environment:{...process.env,...N},cleanup:async()=>{}},w=m?Zi(_):Qi(this.target,a),E=w.root,O=eo(this.target,E,_),U=Gi(o,this.target),v={...this.target,targetCode:this.agent.targetCode,cwd:h,...m?{codexHome:F(_.homeDirectory,".codex")}:{}},D=U?so(v,i):new Set,X=m&&S?F(_.tempDirectory,S.slice(5)):S,z=T(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,T(this.options.sessionPromptTimeoutMs,Ui));m||(_.environment.ORCHA_RUNTIME_ARTIFACT_DIR=E);let I=mn(_.command,_.args,{cwd:_.cwd,env:_.environment,stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(a,I),g("info","runtime.cli","runtime prompt started",{target:this.agent.targetCode,sessionId:a,pid:I.pid,timeoutMs:z,isolation:_.isolation});let Rr="",ue=c(this.target.outputMode||"text"),b={artifacts:new Map,emittedTexts:new Set,emittedThoughtTexts:new Set,value:"",artifactOptions:O,finalTextSeen:!1,finalTextOnly:Wi(t,this.target),emitThoughtChunks:Ji(t,this.target),terminalOutcome:null,terminalProtocol:Ce(this.target),emitTerminal:null},le=U?Yi(v,u,i,D):null;return I.stdout.setEncoding("utf8"),I.stdout.on("data",ot=>this.handleStdout(ot,ue,b,a,r)),I.stderr.setEncoding("utf8"),I.stderr.on("data",ot=>{Rr+=ot,this.target.emitStderr===!0&&r({sessionId:a,update:{sessionUpdate:"runtime_stderr_chunk",content:{type:"text",text:ot}}})}),d==="stdin"?I.stdin.end(u):I.stdin.end(),await new Promise((ot,de)=>{let ht=!1,Sr=!1,At=null,mt=null,fe=le&&zi(this.target,t)?setInterval(()=>{try{Ne(b,le,a,r)}catch(C){g("warn","runtime.cli","codex transcript stream poll failed",{target:this.agent.targetCode,sessionId:a,error:String(C?.message||C)})}},Cn(this.target)):null;fe?.unref?.();let Or=setTimeout(()=>{Sr=!0,g("warn","runtime.cli","runtime prompt timed out; terminating child",{target:this.agent.targetCode,sessionId:a,pid:I.pid,timeoutMs:z}),Kt(I,"SIGTERM"),At=setTimeout(()=>{g("warn","runtime.cli","runtime prompt force killing child",{target:this.agent.targetCode,sessionId:a,pid:I.pid}),Kt(I,"SIGKILL")},En),At.unref?.(),gt(Object.assign(new Error(`runtime CLI timed out after ${z}ms`),{code:"RUNTIME_CLI_TIMEOUT"}))},z);Or.unref?.();let Ir=async()=>{clearTimeout(Or),mt&&clearTimeout(mt),fe&&clearInterval(fe),At&&!Sr&&clearTimeout(At),to(w,{target:this.agent.targetCode,sessionId:a}),this.active.delete(a),b.emitTerminal=null,await _.cleanup?.()},Rs=C=>{ht||(ht=!0,Ir().then(()=>ot(C),de))},gt=C=>{ht||(ht=!0,Ir().then(()=>de(C),B=>{g("warn","runtime.cli","sandbox launch cleanup failed",{target:this.agent.targetCode,sessionId:a,error:String(B?.message||B)}),de(C)}))};b.emitTerminal=C=>{let B={...l(C.result)?C.result:{},_artifacts:[...b.artifacts.values()]};try{n?.({...C,result:B})}catch(Y){g("warn","runtime.cli","runtime terminal listener failed",{target:this.agent.targetCode,sessionId:a,error:String(Y?.message||Y)})}let $=Math.max(0,T(this.target.terminalExitGraceMs,Hi));mt=setTimeout(()=>{mt=null,!(ht||this.active.get(a)!==I)&&(g("warn","runtime.cli","runtime stayed alive after terminal event; terminating child",{target:this.agent.targetCode,sessionId:a,pid:I.pid,terminalProtocol:b.terminalProtocol,graceMs:$}),Ie(I))},$),mt.unref?.()},I.on("error",C=>{g("warn","runtime.cli","runtime child error",{target:this.agent.targetCode,sessionId:a,pid:I.pid,error:String(C?.message||C)}),gt(C)}),I.on("exit",(C,B)=>{(async()=>{ue==="json-lines"&&b.value.trim()&&this.handleStdout(`
+`,ue,b,a,r);let $=await Ro(b,le,a,r,X,this.target);($.artifactCount>0||$.textCount>0||$.thoughtCount>0)&&g("info","runtime.cli","codex transcript updates collected",{target:this.agent.targetCode,sessionId:a,artifactCount:$.artifactCount,textCount:$.textCount,finalTextCount:$.finalTextCount,thoughtCount:$.thoughtCount,transcriptCount:$.transcriptCount});let Y=Rr.trim();if(Y&&g("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:a,stderr:Y}),g("info","runtime.cli","runtime prompt finished",{target:this.agent.targetCode,sessionId:a,pid:I.pid,exitCode:C,signal:B,artifactCount:b.artifacts.size,finalTextSeen:b.finalTextSeen}),b.terminalOutcome?.status==="failed"){gt(b.terminalOutcome.error);return}if(C!==0&&b.terminalOutcome?.status!=="completed"){let Ss=Object.assign(new Error(`runtime CLI exited with code ${C??"unknown"}${B?` (${B})`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:C,signal:B});gt(Ss);return}Rs({stopReason:"end_turn",exitCode:C,signal:B,_artifacts:[...b.artifacts.values()],...Y?{stderr:Y}:{}})})().catch(gt)})})}buildArgs(t,r){let n=A(this.target.args);return t==="args"?[...n,r]:n}handleStdout(t,r,n,s,i){if(r!=="json-lines"){i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:t}}});return}n.value+=t;let o=n.value.split(/\r?\n/);n.value=o.pop()||"";for(let a of o){let u=a.trim();if(u)try{let d=JSON.parse(u);On(n,Sn(d,n.artifactOptions)),i({sessionId:s,update:{sessionUpdate:"runtime_event",event:In(d)}});let f=Rn(d),p=Me(d);f&&n.emitThoughtChunks&&!p&&ji(d)?An(n,s,i,f):f&&Xi(n,p)&&xn(n,s,i,f),f&&p&&(n.finalTextSeen=!0);let h=Bi(d,n.terminalProtocol);h&&!n.terminalOutcome&&(h.status==="failed"||n.finalTextSeen||n.artifacts.size>0)&&(n.terminalOutcome=h,n.emitTerminal?.(h))}catch{i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:`${a}
+`}}})}}}async sessionCancel(t){let r=c(t.sessionId),n=this.active.get(r);return n?(g("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),Ie(n),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}async stop(t="stop"){for(let[r,n]of this.active.entries())g("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),Ie(n);this.active.clear(),await this.taskMcp?.close(),this.taskMcp=null}};var Pe="ORCHA_RUNTIME_OUTPUT_START",Le="ORCHA_RUNTIME_OUTPUT_END",ke="ORCHA_RUNTIME_CONTROL_START",ve="ORCHA_RUNTIME_CONTROL_END",De=Pe,He=Le,Fe=ke,$e=ve,Be=[Pe,Le,ke,ve],So=new Set(["_artifacts","_decision","_meta"]),Oo=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${Be.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),L=class extends Error{constructor(t,r,n){super(r),this.name="RuntimeResultProtocolError",this.code=t,this.detail={rawOutput:n}}};function Ln(e){let t=typeof e=="string"?e.trimStart():"";return Be.some(r=>t.startsWith(r))}function je(e){if(typeof e!="string")return null;let t=e,r=Io(t);if(![...r.values()].some(m=>m.length>0))return null;let n=[],s=[];for(let[m,y]of r)y.length===0?n.push(m):y.length>1&&s.push(m);if(n.length>0||s.length>0){let m=[];throw n.length>0&&m.push(`\u7F3A\u5C11 ${n.join(", ")}`),s.length>0&&m.push(`\u91CD\u590D ${s.join(", ")}`),new L("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${m.join("\uFF1B")}`,t)}let i=r.get(Pe)[0],o=r.get(Le)[0],a=r.get(ke)[0],u=r.get(ve)[0];if(!(i.end<=o.start&&o.end<=a.start&&a.end<=u.start))throw new L("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757",t);let d=Co(t.slice(i.end,o.start));if(!d.trim())throw new L("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let f=t.slice(a.end,u.start).trim();if(!f)throw new L("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let p;try{p=JSON.parse(f)}catch(m){throw new L("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(m?.message||m)}`,t)}if(!Pn(p))throw new L("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61",t);let h=Object.keys(p).filter(m=>!So.has(m)).sort();if(h.length>0)throw new L("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${h.join(", ")}`,t);if("_artifacts"in p&&!Array.isArray(p._artifacts))throw new L("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4",t);for(let m of["_decision","_meta"])if(m in p&&!Pn(p[m]))throw new L("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${m} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`,t);return{output:d,...p}}function Io(e){let t=new Map(Be.map(r=>[r,[]]));for(let r of e.matchAll(Oo))t.get(r.groups.marker).push({start:r.index,end:r.index+r[0].length});return t}function Co(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",r=t?e.slice(t.length):e;return t&&r.endsWith(t)?r.slice(0,-t.length):r}function Pn(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as xo}from"node:crypto";var Ao="orcha.goal-contract/v1",No=new Set(["complete","completed","done","ok","passed","success","succeeded"]),bo=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),Mo=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function ze(e){return xo("sha256").update(q(e)).digest("hex")}function vn(e){if(!Hn(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","Each check requires requiredMatches distinct successful tool call IDs; repeated updates for one call count once.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
+`)}function Dn(e,t,r=""){if(!Hn(e))return e==null?null:{required:!0,status:"failed",outcome:c(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let n=ze(e),s=e.verificationPlan.required===!0;if(c(r)&&c(r)!==n)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:n,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:n,checks:[]};let i=Uo(t),o=e.verificationPlan.checks.map(u=>Fo(u,i));return{required:!0,status:o.some(u=>u.status==="failed")?"failed":o.some(u=>u.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:n,checks:o}}function Hn(e){if(!l(e)||e.schemaVersion!==Ao||!c(e.outcome))return!1;let t=e.verificationPlan;if(!l(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let r=new Set;for(let n of t.checks)if(!l(n)||!c(n.id)||r.has(c(n.id))||(r.add(c(n.id)),!Array.isArray(n.toolNames)||n.toolNames.length===0||n.toolNames.some(s=>!c(s)))||!Number.isSafeInteger(n.requiredMatches)||n.requiredMatches<1||n.arguments!==void 0&&!l(n.arguments))return!1;return!0}function Uo(e){let t=new Map,r=[];for(let n of Array.isArray(e)?e:[]){let s=l(n?.update)?n.update:{},i=c(s.sessionUpdate);if(i==="runtime_event"){Po(s.event,t,r);continue}if(i==="tool_call"){let o=Wt(s)||`tool-${r.length+1}`,a=Vt(t,r,o),u=Ge(s,s.name||s.toolName||s.kind);a.toolName=u.toolName,a.arguments=u.arguments,a.status=St(s.status),a.evidence=Yt(s);continue}if(i==="tool_call_update"){let o=Wt(s);if(!o)continue;let a=Vt(t,r,o),u=Ge(s,s.name||s.toolName||s.kind);a.toolName||=u.toolName,Object.keys(a.arguments).length===0&&(a.arguments=u.arguments),a.status=St(s.status),a.evidence.push(...Yt(s))}}return r}function Po(e,t,r){let n=l(e)&&l(e.payload)?e.payload:l(e)?e:{},s=c(n.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let a=Wt(n)||`runtime-${r.length+1}`,u=Vt(t,r,a),d=Ge(n,n.name||n.tool||s,s);u.toolName=d.toolName,u.arguments=d.arguments,u.status=St(n.status),u.evidence.push(...Yt(n));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=Wt(n);if(!i)return;let o=Vt(t,r,i);o.status=Do(n,o.toolName),o.evidence.push(...Yt(n))}function Vt(e,t,r){let n=e.get(r);return n||(n={toolCallId:r,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(r,n),t.push(n)),n}function Lo(e){let t=c(e).toLowerCase();return Mo.get(t)||t}function Ge(e,t,r=""){let n=ko(e),s=c(r)==="mcp_tool_call"||c(e?.kind).toLowerCase()==="mcp",i=l(e?._meta)?e._meta:{},o=c(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let a=c(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...n,...a?{operationCode:a}:{}}}}return{toolName:Lo(t),arguments:n}}function Wt(e){return l(e)?c(e.call_id||e.callId||e.toolCallId||e.id):""}function ko(e){if(!l(e))return{};for(let r of["arguments","args","rawInput","input","params","parameters"]){let n=vo(e[r]);if(n)return n}let t={};for(let r of["cmd","command","cwd","operationCode","path","query","url"])e[r]!==void 0&&(t[r]=e[r]);return t}function vo(e){if(l(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return l(t)?t:null}catch{return null}}function Do(e,t){if(!l(e))return"unknown";let r=Xt(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return r.includes("failed")?"failed":r.includes("success")?"success":"unknown"}function Xt(e,t=0,r={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return Ho(e,t,r);if(Array.isArray(e))return e.flatMap(o=>Xt(o,t+1,r));if(!l(e))return[];let n=[];typeof e.isError=="boolean"&&n.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&n.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&n.push(e.success?"success":"failed");let s=St(e.status);s!=="unknown"&&n.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&n.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&n.push(...Xt(e[o],t+1,r));return n}function Ho(e,t,r){let n=e.trim();if(!n)return[];try{return Xt(JSON.parse(n),t+1,r)}catch{}if(r.parseCliExitCode!==!0)return[];let s=[];for(let i of n.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function St(e){let t=c(e).toLowerCase();return No.has(t)?"success":bo.has(t)?"failed":"unknown"}function Yt(e){if(!l(e))return[];let t=l(e.output)?e.output:{},r=[e.verificationEvidence,l(e.verification)?e.verification.evidence:null,t.verificationEvidence,l(t.verification)?t.verification.evidence:null],n=[];for(let s of r)for(let i of Array.isArray(s)?s:s?[s]:[])!l(i)||!c(i.id)||n.push({id:c(i.id),status:St(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...c(i.message)?{message:c(i.message)}:{}});return n}function Fo(e,t){let r=t.filter(o=>e.toolNames.includes(o.toolName)&&Ke(e.arguments||{},o.arguments)),n=c(e.evidenceId),s=r.filter(o=>o.status==="success"&&(!n||o.evidence.some(a=>a.id===n&&a.status==="success")));if(s.length>=e.requiredMatches)return qe(e,"passed",s,`Runtime tool evidence passed ${s.length} times.`);let i=r.filter(o=>o.status==="failed"||n&&o.evidence.some(a=>a.id===n&&a.status==="failed"));return s.length===0&&i.length?qe(e,"failed",i,"Runtime tool evidence failed."):qe(e,"missing",s,`Only ${s.length}/${e.requiredMatches} required tool executions passed.`)}function qe(e,t,r,n){let s=r.map(i=>i.toolCallId).filter(Boolean);return{id:e.id,status:t,message:n,...c(e.description)?{description:c(e.description)}:{},toolNames:e.toolNames,requiredMatches:e.requiredMatches,observedMatches:s.length,toolCallIds:s,...l(e.arguments)?{arguments:e.arguments}:{},...c(e.evidenceId)?{evidenceId:c(e.evidenceId)}:{}}}function Ke(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((r,n)=>Ke(r,t[n])):l(e)?l(t)?Object.entries(e).every(([r,n])=>Object.hasOwn(t,r)&&Ke(n,t[r])):!1:Object.is(e,t)}function q(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return kn(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,r)=>{if(!Object.hasOwn(e,r))throw new Error("invalid_jcs_json_value");return q(e[r])}).join(",")}]`;if(l(e))return`{${Object.keys(e).sort().map(t=>`${kn(t)}:${q(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function kn(e){return $o(e),JSON.stringify(e)}function $o(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(r>=56320&&r<=57343)throw new Error("invalid_jcs_unicode")}}import{spawn as Bo}from"node:child_process";import{createHash as jo,randomUUID as qo}from"node:crypto";import{constants as Go}from"node:fs";import{access as Ko,mkdir as Je,readdir as zo,realpath as Ot,rm as Jo,stat as Vo}from"node:fs/promises";import Wo from"node:http";import{tmpdir as Xo}from"node:os";import{isAbsolute as It,join as lt,relative as Fn,resolve as We}from"node:path";var Xe=1,Yo="orcha.process-isolation/v1",Ye="orcha.egress-proxy/v1",Qo="--disable-wasm-trap-handler",Qt={read_only:0,workspace_write:1,workspace_network:2},Ve={read_only:["read_only","denied"],workspace_write:["workspace_write","denied"],workspace_network:["workspace_write","restricted"]},Zo=new Set([".env",".git-credentials",".netrc",".npmrc",".pypirc","credentials.json","secrets.json","id_rsa","id_ed25519"]);function rt(e){if(!l(e))throw R("RUNTIME_SANDBOX_POLICY_REQUIRED","sandboxPolicy is required");let t=structuredClone(e),r=c(t.accessMode),n=c(t.accessModeCeiling);if(!(r in Ve)||!(n in Ve))throw R("RUNTIME_SANDBOX_POLICY_INVALID","unsupported runtime access mode");if(Qt[r]>Qt[n])throw R("RUNTIME_SANDBOX_POLICY_INVALID","access mode exceeds its ceiling");let[s,i]=Ve[r];if(t.filesystemMode!==s||t.networkMode!==i)throw R("RUNTIME_SANDBOX_POLICY_INVALID","runtime access profile does not match its mode");if(Number(t.policySchemaVersion)!==Xe||!Number.isInteger(Number(t.policyRevision))||Number(t.policyRevision)<1)throw R("RUNTIME_SANDBOX_POLICY_INVALID","unsupported sandbox policy schema or revision");for(let[a,u]of Object.entries({outsideWorkspaceAccess:"denied",hostAccess:"denied",hostEnvironmentAccess:"denied",dockerSocketAccess:"denied",environmentMode:"allowlist"}))if(t[a]!==u)throw R("RUNTIME_SANDBOX_POLICY_INVALID",`${a} cannot be relaxed`);let o=l(t.processIsolation)?t.processIsolation:{};if(o.mode!=="required"||o.backend==="direct")throw R("RUNTIME_SANDBOX_POLICY_INVALID","strong process isolation is required");if(Array.isArray(t.alwaysApprovedApprovalKeys)&&t.alwaysApprovedApprovalKeys.length)throw R("RUNTIME_SANDBOX_POLICY_INVALID","persistent runtime approvals are forbidden");return t}function $n(e,t){let r=rt(e),n=rt(t);return Qt[n.accessMode]<Qt[r.accessMode]}async function Bn(e){if(!e.sandboxRequired)return{dispatchable:!0,enforced:!1,backend:"direct",daemonStatus:"not_required",daemonProtocolVersion:"",policySchemaVersions:[Xe],runtimePolicyUpdates:!1,workspaceSync:!1,egressProxy:!1,reason:"external_runtime_sandbox_not_required"};let t=await qn(e.sandboxBrokerCommand,process.env.PATH||"");if(!t)throw R("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let r=await sa(t,A(e.sandboxBrokerArguments),e.sandboxProbeTimeoutMs);if(r.enforced!==!0||c(r.protocolVersion)!=="orcha.runtime-sandbox-broker/v1"||!["bubblewrap","broker"].includes(c(r.backend)))throw R("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker did not report enforced isolation");let n=l(r.probes)?r.probes:{};for(let s of["emptyRoot","outsideWorkspaceDenied","hostFilesystemDenied","sensitiveFilesDenied","environmentAllowlist","dockerSocketDenied","networkNamespace","workspaceReadOnly","workspaceWrite","resourceLimits"])if(n[s]!==!0)throw R("RUNTIME_SANDBOX_UNAVAILABLE",`sandbox broker probe failed: ${s}`);return e.egressProxyRequired&&await aa(e),{dispatchable:!0,enforced:!0,backend:c(r.backend),daemonStatus:"ok",daemonProtocolVersion:c(r.protocolVersion||"orcha.runtime-sandbox-broker/v1"),policySchemaVersions:[Xe],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:e.egressProxyRequired}}async function Qe(e,t,r){let n=c(t.workspace||t.cwd),s=c(r),i=n||(t.allowRequestWorkspace===!0?s:"");if(!i||!It(i))throw R("RUNTIME_WORKSPACE_NOT_CONFIGURED","runtime target must configure an absolute trusted workspace");let o=await Ot(i);if(!(await Vo(o)).isDirectory())throw R("RUNTIME_WORKSPACE_INVALID","runtime workspace is not a directory");if(!(e.trustedWorkspaceRoots.length?await Promise.all(e.trustedWorkspaceRoots.map(d=>Ot(d))):[o]).some(d=>tr(d,o)))throw R("RUNTIME_WORKSPACE_OUTSIDE_TRUSTED_ROOT","runtime workspace is outside trusted roots");return o}async function jn({config:e,target:t,command:r,args:n,cwd:s,environment:i,runId:o,agentId:a,sessionId:u,sandboxPolicy:d}){if(!e.sandboxRequired)return{command:r,args:[...n],cwd:s,environment:{...process.env,...i},tempDirectory:"",isolation:{enforced:!1,backend:"development_direct"},cleanup:async()=>{}};let f=rt(d),p=await Qe(e,t,s),h=await Ot(s);if(!tr(p,h))throw R("RUNTIME_WORKSPACE_CWD_INVALID","runtime cwd is outside its workspace");let m=await qn(e.sandboxBrokerCommand,process.env.PATH||"");if(!m)throw R("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let y=`runtime-${jo("sha256").update(String(o)).digest("hex").slice(0,32)}`,S=We(e.sandboxTempRoot||lt(Xo(),"orcha-runtime-sandboxes"));await Je(S,{recursive:!0,mode:448});let N=lt(S,`${y}-${qo()}`),_=lt(N,"home"),w=lt(N,"artifacts");await Je(_,{recursive:!0,mode:448}),await Je(w,{recursive:!0,mode:448});let E=f.networkMode==="restricted"?await ia(e,{runId:String(o),instanceId:y,policyRevision:Number(f.policyRevision),ttlMs:Math.min(T(f.maxRuntimeSeconds,900)*1e3,e.egressGrantMaxTtlMs),maxTransferBytes:T(f.maxNetworkBytes,64*1024*1024)}):null,O={PATH:c(i.PATH||process.env.PATH),LANG:c(i.LANG||process.env.LANG||"C.UTF-8"),HOME:"/tmp/home",TMPDIR:"/tmp",USER:"orcha",LOGNAME:"orcha",SHELL:"/bin/sh",ORCHA_AGENT_ID:String(a),ORCHA_SESSION_ID:String(u),ORCHA_RUN_ID:String(o),ORCHA_RUNTIME_ARTIFACT_DIR:"/tmp/artifacts",...ea(t,i)};O.HOME="/tmp/home",O.TMPDIR="/tmp",O.ORCHA_RUNTIME_ARTIFACT_DIR="/tmp/artifacts",O.NODE_OPTIONS=Qo;let U={schemaVersion:Yo,runId:String(o),instanceId:y,workspace:p,cwd:h,filesystemMode:f.filesystemMode,networkMode:f.networkMode,environmentMode:"allowlist",deniedRelativePaths:await ra(p),temporaryDirectory:N,egressProxy:E,environment:O,resourceLimits:na(f),readOnlyToolchainRoots:await ta(e,t)},v=!1,D=async()=>{if(!v){v=!0;try{E&&await oa(e,E,{runId:String(o),instanceId:y})}finally{await Jo(N,{recursive:!0,force:!0})}}};return{command:m,args:[...A(e.sandboxBrokerArguments),"--",r,...n],cwd:h,environment:{PATH:process.env.PATH||"",LANG:process.env.LANG||"C.UTF-8",ORCHA_PROCESS_ISOLATION_REQUEST:JSON.stringify(U)},tempDirectory:N,homeDirectory:_,artifactDirectory:w,pathMappings:[{runtimeRoot:"/tmp/artifacts",hostRoot:w},{runtimeRoot:"/tmp/home",hostRoot:_}],isolation:{enforced:!0,backend:"broker",instanceId:y,policyRevision:f.policyRevision},cleanup:D}}async function ta(e,t){let r=A(t.toolchainRoots||t.sandboxToolchainRoots);if(!r.length)return[];let n=await Promise.all(A(e.trustedToolchainRoots).map(i=>Ot(i)));if(!n.length)throw R("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","target toolchain roots require ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS");let s=[];for(let i of r){if(!It(i))throw R("RUNTIME_TOOLCHAIN_ROOT_INVALID","toolchain roots must be absolute");let o=await Ot(i);if(!n.some(a=>tr(a,o)))throw R("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","toolchain root is outside trusted roots");s.push(o)}return[...new Set(s)]}function ea(e,t){let r=l(e.env)?e.env:{},n={};for(let[s,i]of Object.entries(r))/^[A-Za-z_][A-Za-z0-9_]*$/.test(s)&&i!=null&&(n[s]=String(i));for(let s of["ORCHA_RUNTIME_PROMPT","ORCHA_RUNTIME_ARTIFACT_DIR"])t[s]!=null&&(n[s]=String(t[s]));return n}async function ra(e){let t=[],r=0,n=async s=>{let i;try{i=await zo(s,{withFileTypes:!0})}catch(o){if(s===e)throw o;return}for(let o of i){if(r+=1,r>1e4)throw R("RUNTIME_WORKSPACE_SCAN_LIMIT_EXCEEDED","workspace contains more than 10000 entries");let a=lt(s,o.name),u=Fn(e,a),d=o.name.toLowerCase();(Zo.has(d)||d.startsWith(".env."))&&t.push(u),o.isDirectory()&&!o.isSymbolicLink()&&await n(a)}};return await n(e),t.sort()}function na(e){return{maxCpuSeconds:Math.max(1,T(e.maxRuntimeSeconds,900)),maxMemoryBytes:T(e.maxMemoryBytes,2*1024*1024*1024),maxProcesses:T(e.maxProcesses,128),maxOpenFiles:T(e.maxOpenFiles,1024),maxFileBytes:T(e.maxFileBytes,64*1024*1024)}}async function sa(e,t,r){return await new Promise((n,s)=>{let i=Bo(e,[...t,"--probe"],{env:{PATH:process.env.PATH||"",LANG:"C.UTF-8"},stdio:["ignore","pipe","pipe"],windowsHide:!0}),o=[],a=[];i.stdout.on("data",d=>o.push(Buffer.from(d))),i.stderr.on("data",d=>a.push(Buffer.from(d)));let u=setTimeout(()=>i.kill("SIGKILL"),Math.max(1e3,r));i.once("error",s),i.once("close",d=>{if(clearTimeout(u),d!==0){s(R("RUNTIME_SANDBOX_UNAVAILABLE",Buffer.concat(a).toString("utf8").trim()||`sandbox probe exited with ${d}`));return}try{n(JSON.parse(Buffer.concat(o).toString("utf8")))}catch{s(R("RUNTIME_SANDBOX_UNAVAILABLE","sandbox probe returned invalid JSON"))}})})}async function qn(e,t){let r=c(e);if(!r)return"";let n=It(r)?[r]:String(t||"").split(":").filter(Boolean).map(s=>lt(s,r));for(let s of n)try{return await Ko(s,Go.X_OK),s}catch{}return""}async function ia(e,t){if(!e.egressProxyRequired)throw R("RUNTIME_EGRESS_UNAVAILABLE","restricted network requires the Egress Proxy");let r=await Ze(e,"POST","/v1/grants",{protocolVersion:Ye,...t}),n={socketPath:e.egressProxySocket,grantId:c(r.grantId),credential:c(r.credential)};if(!n.grantId||!n.credential)throw R("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy returned an invalid grant");return n}async function oa(e,t,r){await Ze(e,"POST",`/v1/grants/${encodeURIComponent(t.grantId)}/revoke`,{protocolVersion:Ye,...r}).catch(()=>{})}async function aa(e){let t=await Ze(e,"GET","/health");if(t.status!=="ok"||t.proxy!=="orcha-egress-proxy"||t.protocolVersion!==Ye)throw R("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy is unavailable or incompatible")}async function Ze(e,t,r,n){if(!It(e.egressProxySocket)||!e.egressProxyToken)throw R("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy socket and token are required");return await new Promise((s,i)=>{let o=Wo.request({socketPath:e.egressProxySocket,path:r,method:t,headers:{Authorization:`Bearer ${e.egressProxyToken}`,Accept:"application/json",...n?{"Content-Type":"application/json"}:{}}},a=>{let u=[],d=0;a.on("data",f=>{d+=f.length,d>1048576?o.destroy(new Error("egress response is too large")):u.push(Buffer.from(f))}),a.once("end",()=>{try{let f=JSON.parse(Buffer.concat(u).toString("utf8")||"{}");(a.statusCode||500)>=400?i(R("RUNTIME_EGRESS_UNAVAILABLE",c(f.error)||"Egress Proxy rejected the request")):s(f)}catch(f){i(f)}})});o.once("error",i),o.setTimeout(3e3,()=>o.destroy(new Error("Egress Proxy request timed out"))),n?o.end(JSON.stringify(n)):o.end()})}function tr(e,t){let r=Fn(We(e),We(t));return r===""||!r.startsWith("..")&&!It(r)}function R(e,t){return Object.assign(new Error(t),{code:e})}var er=24e3,rr=8,nr=50,sr=6e3,ua=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),la=10*60*1e3,da=60*1e3,fa=8,pa=30*60*1e3,ha=60*1e3,ma=1,Jn=2400,ga=new Set(["max_tokens","max_output_tokens","length"]),_a=new Set(["agent_message_chunk","tool_call","tool_call_update"]),ya=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions"]),Ta=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function wa(e){if(!l(e))return{};let t={};for(let r of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let n=c(e[r]);n&&(t[r]=n)}return t}function Ea(e){return(Array.isArray(e)?e:[]).map(wa).sort((t,r)=>{let n=q(t),s=q(r);return n<s?-1:n>s?1:0})}function Ra(e){return!l(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(r=>l(r)&&Array.isArray(r.toolNames)&&r.toolNames.some(n=>c(n)==="plugin_operation"))}function Sa(e,t,r){let n=l(e?._meta)?e._meta:{};return{...l(e)?e:{},sessionId:t,update:l(e?.update)?e.update:{},_meta:{...n,orchaAgentId:r.agentId,runtimeSessionId:r.runtimeSessionId,bridgeUpdateId:te()}}}function k(e){return e==null||e===""?!1:typeof e=="string"?c(e)!=="":Array.isArray(e)?e.length>0:l(e)?Object.keys(e).length>0:!0}function Vn(e){let t=c(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return ua.has(t)}function W(e,t){let r=T(e,t);return Number.isFinite(r)&&r>0?r:t}function Ct(e,t=!1){if(typeof e=="boolean")return e;let r=c(e).toLowerCase();return["true","1","yes","y","on"].includes(r)?!0:["false","0","no","n","off"].includes(r)?!1:t}function K(e){return c(e?.type||"echo")}function Wn(e){let t=K(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function ar(e){if(l(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function Oa(e){let t=String(e||"");if(Ta.test(t))return!0;let r=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return r.endsWith("token")||r.endsWith("secret")||r.endsWith("password")||r.endsWith("apikey")||r.endsWith("privatekey")||r==="authorization"||r==="cookie"||r==="jwt"||r.includes("credential")}function cr(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=sr)return e;let r=e.length-sr;return`${e.slice(0,sr)}... [truncated ${r} characters]`}if(t>=rr)return Array.isArray(e)?`[array truncated at depth ${rr}, items=${e.length}]`:l(e)?`[object truncated at depth ${rr}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let r=e.slice(0,nr).map(n=>cr(n,t+1));return e.length>nr&&r.push(`[truncated ${e.length-nr} items]`),r}if(l(e)){let r={};for(let[n,s]of Object.entries(e))r[n]=Oa(n)?"[REDACTED]":cr(s,t+1);return r}return String(e)}var Ia=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function Ca(e){if(!l(e))return e;let t={};for(let r of Ia)k(e[r])&&(t[r]=e[r]);return t}function xa(e){if(!l(e))return e;let t={...e};return l(t.renderedPayload)&&(t.renderedPayload=Ca(t.renderedPayload)),t}function Aa(e){let t=l(e)?e:{},r={};k(t.metadata)&&(r.metadata=xa(t.metadata));for(let[n,s]of Object.entries(t))ya.has(n)||n==="metadata"||k(s)&&(r[n]=s);return r}function Na(e){let t=l(e)?e:{},r=l(t.metadata)?t.metadata:{},n=l(r.renderedPayload)?r.renderedPayload:{};return l(t.resultContract)?t.resultContract:l(n.resultContract)?n.resultContract:{}}function Xn(e){return c(Na(e).kind).toLowerCase()==="decision"}function ba(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:K(e)==="cli"}function Gn(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return Ct(t,Wn(e))}function Ma(e,t){let r=l(e?.metadata)?{...e.metadata}:{},n=l(r._runtimeBridge)?{...r._runtimeBridge}:{},s=ar(n);return r._runtimeBridge={...n,promptKind:"dispatch",finalTextOnly:ba(t),releaseAfterPrompt:s===void 0?Gn(t):Ct(s,Gn(t)),requiresRuntimeResult:Xn(e)},r}function Ua(e){let t=Aa(e);if(!k(t))return"";let r=JSON.stringify(cr(t),null,2);if(r.length<=er)return r;let n=r.length-er;return`${r.slice(0,er)}
+... [truncated ${n} characters]`}function lr(e){if(!l(e))return"";let t=l(e.update)?e.update:e,n=(l(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function ur(e){if(!l(e))return"";let t=l(e.update)?e.update:e;return c(t.sessionUpdate)}function dr(e){if(!Array.isArray(e))return"";let t=!1,r=[],n=[],s=[],i=()=>{r.length>0&&(n.push(r),r=[])};for(let a of e){let u=ur(a),d=lr(a);if(!u){d&&s.push(d);continue}if(t=!0,u==="agent_message_chunk"){d&&r.push(d);continue}(u==="agent_thought_chunk"||u==="user_message_chunk"||u==="tool_call"||u==="tool_call_update"||u==="plan")&&i()}if(i(),!t)return dt(s);let o=n[n.length-1]||[];return dt(o)}function Pa(e){return Array.isArray(e)?e.map(lr).filter(t=>t!==""):[]}function ee(e){return Array.isArray(e)?e.some(r=>ur(r))?e.filter(r=>_a.has(ur(r))).map(lr).filter(r=>r!==""):Pa(e):[]}function La(e){if(!l(e))return null;let t=l(e.update)?e.update:e;return c(t.sessionUpdate)!=="runtime_event"?null:l(t.event)?t.event:null}function ka(e){if(!l(e))return"";let t=l(e.payload)?e.payload:{},r=c(e.type),n=c(t.type);if(r==="event_msg"){if(n==="task_complete")return c(t.last_agent_message||t.message||t.output);if(n==="agent_message"){let s=c(t.phase||t.status||t.stage).toLowerCase();if(["final_answer","final","complete","completed","done"].includes(s))return c(t.message||t.text||t.content)}}return""}function va(e){if(!Array.isArray(e))return"";for(let t=e.length-1;t>=0;t-=1){let r=ka(La(e[t]));if(r)return r}return""}function dt(e){let t="";for(let r of e){let n=String(r||"");if(n)if(!t)t=n;else if(n.length>t.length&&n.startsWith(t))t=n;else{let s=Ln(n)&&!/[\r\n]$/.test(t)?`
+`:"";t+=`${s}${n}`}}return t.trim()}function Da(e){let t=String(e||"").trim();if(!t)return"";let r=t.match(/(?:^|\n)#{1,3}\s+\S/);return!r||r.index===0?t:t.slice(r.index+(t[r.index]===`
+`?1:0)).trim()}function Kn(e){let t=String(e||"").trim();if(!t)return null;try{let r=JSON.parse(t);if(l(r)&&(Yn(r)||k(r._artifacts)||k(r.artifacts)||k(r._decision)||k(r._meta)))return r}catch{}return null}function xt(e){try{return je(e)}catch{return null}}function Zt(...e){let t=null;for(let r of e)try{if(je(r))return}catch(n){t||=n}if(t)throw t}function ir(e){let t=String(e||"").trim();if(!t)return null;let r=xt(t);if(r)return r;let n=[...t.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)];for(let s=n.length-1;s>=0;s-=1){let i=Kn(n[s][1]);if(i)return i}if(!t.endsWith("}"))return null;for(let s=t.lastIndexOf("{");s>=0;s=t.lastIndexOf("{",s-1)){let i=Kn(t.slice(s));if(i)return i}return null}function Ha(e){let t=xt(dr(e));if(t)return t;let r=ee(e);for(let n=r.length-1;n>=0;n-=1){let s=xt(r[n]);if(s)return s}return xt(dt(r))}function Yn(e){if(!l(e))return!1;if(k(e.output))return!0;for(let t of["content","text","message","summary"])if(c(e[t]))return!0;return!!(Vn(e.status)||c(e.error)||c(e.errorMessage))}function j(e){let t=l(e)?{...e}:{};return(!Array.isArray(t._artifacts)||t._artifacts.length===0)&&Array.isArray(t.artifacts)&&t.artifacts.length>0&&(t._artifacts=t.artifacts),delete t.artifacts,t}function Fa(e){return l(e)?typeof(l(e._decision)?e._decision:l(e.decision)?e.decision:e).passed=="boolean":!1}function Qn(e){return l(e)?l(e._decision)&&typeof e._decision.passed=="boolean"?!0:Fa(e.output):!1}function or(e,t,r){let n=l(e)?{...e}:{};if(!k(n.output)){for(let s of["summary","message","content","text"])if(c(n[s])){n.output=c(n[s]);break}}return!k(n.output)&&c(r)&&(n.output=c(r)),{...n,_meta:{...l(n._meta)?n._meta:{},runtimeOutputSource:t,requiredRuntimeResult:!0,finalMessagePreview:c(r).slice(0,1e3)}}}var $a=["dataUrl","dataURL","contentDataUrl","contentDataURL","contentBase64","base64","data"];function zn(e){if(!l(e))return"";let t=l(e.content)?e.content:{},r=l(e.metadata)?e.metadata:{};return c(e.fieldKey||e.field_key||t.fieldKey||r.fieldKey)}function Ba(e,t){let r=l(e.content)?e.content:{},n=l(t.content)?t.content:{},s={...e,...t,content:{...r,...n},metadata:{...l(e.metadata)?e.metadata:{},...l(t.metadata)?t.metadata:{}}};for(let i of $a)k(e[i])&&(s[i]=e[i]),k(r[i])&&(s.content[i]=r[i]);return s}function Zn(e,t){let r=Array.isArray(e)?e.filter(l):[],n=Array.isArray(t)?t.filter(l):[];if(!r.length)return n;if(!n.length)return r;let s=[...r],i=new Map;for(let a=0;a<r.length;a+=1){let u=zn(r[a]),d=i.get(u)||[];d.push(a),i.set(u,d)}let o=new Map;for(let a of n){let u=zn(a),d=o.get(u)||0;o.set(u,d+1);let f=i.get(u)?.[d];f===void 0?s.push(a):s[f]=Ba(s[f],a)}return s}function G(e,t,r){let n={...e,...t,_meta:{...l(e._meta)?e._meta:{},...l(t._meta)?t._meta:{},runtimeOutputSource:r}};return(Array.isArray(e._artifacts)||Array.isArray(t._artifacts))&&(n._artifacts=Zn(e._artifacts,t._artifacts)),n}function ts(e,t,r={}){let n=c(r.promptKind),s=r.requiresRuntimeResult===!0,i=s||n==="dispatch",o=j(e),a=typeof o.output=="string"?xt(o.output):null;if(a)return G(o,j(a),"result_block");let u=va(t),d=u?ir(u):null,f=i?Ha(t):null;if(Yn(o))return Vn(o.status)||c(o.error)||c(o.errorMessage)?o:n==="dispatch"&&d?G(o,j(d),"final_event"):n==="dispatch"&&f?G(o,j(f),"updates"):!s||Qn(o)?o:d?G(o,j(d),"final_event"):f?G(o,j(f),"updates"):(Zt(o.output,u,dt(ee(t))),or(o,"result",o.output));if(d)return G(o,j(d),"final_event");if(f)return G(o,j(f),"updates");if(u)return s?(Zt(u,dt(ee(t))),or(o,"final_event",u)):{...o,output:u,_meta:{...l(o._meta)?o._meta:{},runtimeOutputSource:"final_event"}};let p=dr(t),h=ir(p);if(h)return G(o,j(h),"updates");let m=Da(p);if(!m)return s&&Zt(dt(ee(t))),o;let y=ir(m);return y?G(o,j(y),"updates"):s?(Zt(p,m),or(o,"updates",m)):{...o,output:m,_meta:{...l(o._meta)?o._meta:{},runtimeOutputSource:"updates"}}}function fr(e){return l(e)?c(e.stopReason||e.stop_reason).toLowerCase():""}function es(e){return ga.has(fr(e))}function ja(e,t,r){if(r.promptKind!=="dispatch"||r.requiresRuntimeResult!==!0||!es(e))return!1;try{return!Qn(ts(e,t,r))}catch{return!0}}function qa(){return["Your previous final response reached the output limit before the Runtime Result protocol was complete.","Re-emit the complete final Runtime Result from scratch using the conclusion you already reached.","Do not repeat analysis, process notes, tool calls, or task work.",`Keep the OUTPUT report within ${Jn} Unicode characters.`,`Output ${De}, ${He}, ${Fe}, and ${$e} on their own lines.`,"The CONTROL block must be valid JSON containing _decision and must be fully closed.","Return only the two protocol blocks."].join(`
+`)}function Ga(e,t){let r=l(t)?{...t}:{},n=Zn(e?._artifacts,t?._artifacts);return n.length>0&&(r._artifacts=n),r}function Ka(e,t){return{...e,_meta:{...l(e?._meta)?e._meta:{},runtimeProtocolRetry:{attempted:!0,recovered:!0,reason:fr(t)||"max_tokens"}}}}function za(e,t){let r=typeof e?.output=="string"?e.output:dr(t),n=new L("runtime_output_truncated","Runtime Result \u8FBE\u5230\u6700\u5927\u8F93\u51FA\u957F\u5EA6\uFF0C\u7D27\u51D1\u91CD\u8BD5\u540E\u4ECD\u672A\u5B8C\u6574\u8FD4\u56DE",r);return n.detail={...n.detail,stopReason:fr(e)||"max_tokens",retryAttempted:!0},n}var re=class{constructor(t){this.config=t,this.targets=t.targets||{},this.agents=new Map,this.sessions=new Map,this.startingSessions=new Set,this.targetReservations=new Map,this.runtimeSessionIndex=new Map,this.pendingPermissions=new Map,this.operations=new Map,this.startedAt=_t(),this.sandboxCapabilities={dispatchable:t.sandboxRequired!==!0,enforced:!1,backend:t.sandboxRequired?"unavailable":"direct",daemonStatus:t.sandboxRequired?"pending":"not_required",policySchemaVersions:[1],runtimePolicyUpdates:t.sandboxRequired===!0,workspaceSync:!1,egressProxy:!1},this.cleanupTimer=null,this.onCapacityChanged=null,this.startSessionCleanup()}async start(){try{this.sandboxCapabilities=await Bn(this.config)}catch(t){this.sandboxCapabilities={...this.sandboxCapabilities,dispatchable:!1,enforced:!1,backend:"unavailable",daemonStatus:"unavailable",reason:c(t?.code||t?.message||t)||"sandbox_probe_failed"},g("error","runtime-bridge","runtime node sandbox probe failed; node will not accept work",{reason:this.sandboxCapabilities.reason})}return this.sandboxCapabilities}assertDispatchable(){if(this.config.sandboxRequired&&!(this.sandboxCapabilities.dispatchable===!0&&this.sandboxCapabilities.enforced===!0))throw Object.assign(new Error("runtime node strong sandbox is unavailable"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"})}operationIdentity(t,r,n){let s=l(t.goalContract)?ze(t.goalContract):c(t.goalContractHash),i=ca("sha256").update(q({prompt:Array.isArray(t.prompt)?t.prompt:[],mcpServers:Ea(t.mcpServers),metadata:l(t.metadata)?t.metadata:{}})).digest("hex");return{agentId:r,runId:c(t.runId),sessionId:n,targetCode:c(t.targetCode||t.framework),workspace:c(t.workspace),goalContractHash:s,requestHash:i}}assertOperationIdentity(t,r,n,s){let i=this.operationIdentity(r,n,s),o=Object.keys(t.identity).find(a=>t.identity[a]!==i[a]);if(o)throw Object.assign(new Error(`runtime operation correlation conflict: ${t.correlationId}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT",field:o})}createOperation(t,r,n,s){let i={correlationId:t,agentId:n,sessionId:s,identity:this.operationIdentity(r,n,s),sandboxPolicy:l(r.sandboxPolicy)?structuredClone(r.sandboxPolicy):null,status:"running",updates:[],listeners:new Set,waiters:[],response:null,error:null,mcpServers:r.mcpServers,createdAtMs:Date.now(),completedAtMs:null};return this.operations.set(t,i),i}async attachOperation(t,r={}){let n=()=>{if(r.onUpdate)for(let s of t.updates)r.onUpdate(s)};if(t.status==="completed")return n(),t.response;if(t.status==="failed")throw n(),t.error;r.onUpdate&&t.listeners.add(r.onUpdate);try{return n(),await new Promise((s,i)=>t.waiters.push({resolve:s,reject:i}))}finally{r.onUpdate&&t.listeners.delete(r.onUpdate)}}completeOperation(t,r){if(t.status==="running"){t.status="completed",t.response=r,t.mcpServers=null,t.completedAtMs=Date.now();for(let n of t.waiters.splice(0))n.resolve(r);t.listeners.clear()}}promptResponse(t,r,n,s,i,o=s){let a=l(t.metadata)?t.metadata:{},u=l(a._runtimeBridge)?a._runtimeBridge:{},d=ts(i,o,u),f=Dn(t.goalContract,s,t.goalContractHash);return{sessionId:n,runtimeSessionId:r.runtimeSessionId,result:d,updates:s,...f?{verification:f}:{}}}failOperation(t,r){if(t.status!=="running")return;let n=r instanceof Error?r:Object.assign(new Error(String(r||"runtime operation failed")),{code:"RUNTIME_NODE_ERROR"});t.status="failed",t.error=n,t.mcpServers=null,t.completedAtMs=Date.now();for(let s of t.waiters.splice(0))s.reject(n);t.listeners.clear()}cleanupOperations(t=Date.now()){let r=W(this.config.operationTtlMs,pa);for(let[n,s]of this.operations)s.status!=="running"&&t-(s.completedAtMs||s.createdAtMs)>r&&this.operations.delete(n)}targetFor(t){let r=c(t)||this.config.defaultTargetCode,n=this.targets[r];if(!r||!l(n)){let s=new Error(`runtime target is not configured: ${r||"<empty>"}`);throw s.code="RUNTIME_TARGET_NOT_FOUND",s}return{code:r,target:n}}targetIdleTtlMs(t){let n=K(t)==="openclaw"?W(this.config.openClawSessionIdleTtlMs,ha):W(this.config.sessionIdleTtlMs,la);return W(t?.sessionIdleTtlMs??t?.idleTtlMs,n)}targetMaxSessions(t){let n=K(t)==="openclaw"?W(this.config.openClawMaxSessions,ma):W(this.config.maxSessionsPerTarget,fa);return W(t?.maxSessions,n)}targetReservationCount(t){return Number(this.targetReservations.get(t)||0)}notifyCapacityChanged(){try{this.onCapacityChanged?.()}catch(t){g("warn","runtime-bridge","capacity heartbeat callback failed",{error:String(t)})}}targetCapacitySnapshot(t=!0){return Object.entries(this.targets).map(([r,n])=>{let s=[...this.sessions.values()].filter(f=>f.targetCode===r),i=s.filter(f=>f.busy).length,o=s.length-i,a=this.targetReservationCount(r),u=this.targetMaxSessions(n),d=t?Math.max(0,u-i-a):0;return{targetCode:r,targetName:c(n?.name||n?.targetName||r),targetType:c(n?.type||"echo"),status:t?d>0?"available":"busy":"unavailable",maxSessions:u,busySessions:i,idleSessions:o,reservedSessions:a,availableSessions:d}})}targetReleaseAfterPrompt(t,r={}){let n=K(t),s=l(r?._runtimeBridge)?r._runtimeBridge:{},i=ar(s);return i!==void 0?Ct(i,!1):Ct(t?.releaseAfterPrompt??t?.disposeAfterPrompt,n==="openclaw")}promptReleaseAfterPrompt(t,r={}){if(this.config.sandboxRequired)return!0;let n=l(r?._runtimeBridge)?r._runtimeBridge:{},s=ar(n);return s!==void 0?Ct(s,t.releaseAfterPrompt):t.releaseAfterPrompt}startSessionCleanup(){let t=W(this.config.sessionCleanupIntervalMs,da);t<=0||(this.cleanupTimer=setInterval(()=>{this.cleanupExpiredSessions().catch(r=>{g("warn","runtime-bridge","runtime session cleanup failed",{error:String(r)})})},t),this.cleanupTimer.unref?.())}sessionCountForTarget(t){let r=0;for(let n of this.sessions.values())n.targetCode===t&&(r+=1);return r}idleTargetSessions(t){return[...this.sessions.entries()].filter(([,r])=>r.targetCode===t&&!r.busy).sort((r,n)=>(r[1].lastUsedAtMs||0)-(n[1].lastUsedAtMs||0))}async closeSession(t,r="session_closed"){let n=this.sessions.get(t);if(!n)return!1;try{await n.runtime?.stop?.(r)}catch(s){g("warn","runtime-bridge","runtime session stop failed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,error:String(s)})}return this.sessions.delete(t),this.runtimeSessionIndex.delete(`${n.agentId}:${n.runtimeSessionId}`),this.notifyCapacityChanged(),g("info","runtime-bridge","runtime session closed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,reason:r}),!0}async closeAllSessions(t="bridge_shutdown"){for(let r of[...this.sessions.keys()])await this.closeSession(r,t)}async stop(t="bridge_stop"){this.cleanupTimer&&clearInterval(this.cleanupTimer),this.cleanupTimer=null,await this.closeAllSessions(t)}async cleanupExpiredSessions(t=Date.now()){for(let[r,n]of[...this.sessions.entries()])n.busy||t-(n.lastUsedAtMs||n.createdAtMs||t)>n.idleTtlMs&&await this.closeSession(r,"idle_timeout")}async reserveTargetSlot(t,r){let n=this.targetMaxSessions(r);for(;this.sessionCountForTarget(t)+this.targetReservationCount(t)>=n;){let s=this.idleTargetSessions(t);if(!s.length){let i=new Error(`runtime target session limit reached: ${t}`);throw i.code="RUNTIME_TARGET_SESSION_LIMIT",i}await this.closeSession(s[0][0],"target_session_limit")}this.targetReservations.set(t,this.targetReservationCount(t)+1),this.notifyCapacityChanged()}releaseTargetSlot(t){let r=Math.max(0,this.targetReservationCount(t)-1);r>0?this.targetReservations.set(t,r):this.targetReservations.delete(t),this.notifyCapacityChanged()}async createAgent(t){let r=c(t.agentId);if(!r)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});let{code:n,target:s}=this.targetFor(t.targetCode||t.framework),i=this.agents.get(r);if(i&&i.targetCode!==n)throw Object.assign(new Error(`runtime agent target conflict: ${r}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});let o=this.config.sandboxRequired?await Qe(this.config,s,t.workspace):c(t.workspace),a={agentId:r,targetCode:n,framework:c(t.framework||n),workspace:o,metadata:l(t.metadata)?t.metadata:{},createdAt:_t(),runtimeKind:K(s)};return this.agents.set(r,a),{agent:a}}runtimeFor(t,r,n={}){let{target:s}=this.targetFor(t.targetCode),i=K(s),o={onPermissionRequest:u=>n.source==="conversation_delegation"?{outcome:"denied",reason:"External group member permission continuation is not supported"}:this.requestPermission(u)},a={sessionPromptTimeoutMs:this.config.sessionPromptTimeoutMs,initializeTimeoutMs:this.config.initializeTimeoutMs,sandboxRequired:this.config.sandboxRequired,runId:n.runId,source:n.source,cloudSessionId:r,orchaUrl:this.config.orchaUrl,attachOnly:n.attachOnly,sandboxPolicy:n.sandboxPolicy,...this.config.sandboxRequired?{prepareLaunch:u=>jn({config:this.config,target:s,...u,runId:n.runId,agentId:t.agentId,sessionId:r,sandboxPolicy:n.sandboxPolicy})}:{}};return i==="stdio-acp"||i==="acp"?new ct(t,s,o,a):i==="openclaw"?new Bt(t,s,r,o,a):i==="cli"?new Jt(t,s,a):new kt(t)}async prompt(t,r={}){if(this.assertDispatchable(),this.config.sandboxRequired){let a=c(t.runId);if(!a)throw Object.assign(new Error("runId is required"),{code:"BAD_REQUEST"});t={...t,runId:a,sandboxPolicy:rt(t.sandboxPolicy)}}let n=c(t.agentId),s=c(t.sessionId)||te(),i=c(t.correlationId);if(!n)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});if(this.cleanupOperations(),i){let a=this.operations.get(i);if(a){if(this.assertOperationIdentity(a,t,n,s),a.status==="running"&&(["conversation_delegation","channel_message"].includes(t.metadata?.source)||t.metadata?.source==="ai_chat_runtime_node"&&t.framework==="codex")){a.mcpServers=t.mcpServers;let u=this.sessions.get(`${n}:${s}`);if(u){if(!u.runtime.refreshMcpServers)throw Object.assign(new Error("This runtime cannot refresh task MCP credentials"),{code:"unsupported_dynamic_mcp"});await u.runtime.refreshMcpServers(t.mcpServers)}}return this.attachOperation(a,r)}if(t.attachOnly===!0&&!(t.metadata?.source==="channel_message"&&this.targetFor(t.targetCode||t.framework).target.type==="openclaw"))throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"})}else if(t.attachOnly===!0)throw Object.assign(new Error("correlationId is required for attachOnly"),{code:"BAD_REQUEST"});let o=i?this.createOperation(i,t,n,s):null;if(o){let a=this.attachOperation(o,r);return(async()=>{try{await this._promptOwned(t,{},o,n,s)}catch(u){let d=o.status==="completed";this.failOperation(o,u),d&&g("warn","runtime-bridge","runtime cleanup failed after operation completion",{correlationId:o.correlationId,error:String(u)})}})(),await a}return await this._promptOwned(t,r,o,n,s)}async _promptOwned(t,r,n,s,i){let o=c(t.runId),a=this.config.sandboxRequired?rt(n?.sandboxPolicy||t.sandboxPolicy):null,u=this.agents.get(s),d=this.targetFor(t.targetCode||t.framework||u?.targetCode);if(u&&u.targetCode!==d.code)throw Object.assign(new Error(`runtime agent target conflict: ${s}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});if(K(d.target)==="cli"&&Ra(t.goalContract))throw Object.assign(new Error("CLI runtimes do not support per-run dynamic MCP required by plugin_operation"),{code:"unsupported_dynamic_mcp"});let f=u||(await this.createAgent({agentId:s,targetCode:d.code,framework:t.framework,workspace:t.workspace,metadata:t.metadata})).agent;if(!this.config.sandboxRequired){let _=c(t.workspace);_&&_!==f.workspace&&(f.workspace=_)}let p=`${s}:${i}`;await this.cleanupExpiredSessions();let h=this.sessions.get(p),m=null;if(h&&h.targetCode!==d.code)throw Object.assign(new Error(`runtime session target conflict: ${i}`),{code:"RUNTIME_SESSION_TARGET_CONFLICT"});if(h&&this.config.sandboxRequired&&h.runId!==o)throw Object.assign(new Error(`runtime session cannot be shared across runs: ${i}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});if(!h){if(this.startingSessions.has(p))throw Object.assign(new Error(`runtime session is already starting: ${i}`),{code:"RUNTIME_SESSION_BUSY"});this.startingSessions.add(p);let{code:_,target:w}=d,E;try{await this.reserveTargetSlot(_,w),m=_;let O=this.runtimeFor(f,i,{runId:o,sandboxPolicy:a,source:t.metadata?.source,attachOnly:t.attachOnly});E=O;let U=n?.mcpServers||t.mcpServers||[],v=await O.sessionNew({cwd:Z(w,f.workspace),mcpServers:U,metadata:l(t.metadata)?t.metadata:{}});if(n&&n.status!=="running")throw Object.assign(new Error("Runtime operation was cancelled before prompt dispatch"),{code:"RUNTIME_OPERATION_CANCELLED"});let D=Date.now();h={agentId:s,sessionId:i,runtime:O,targetCode:_,runtimeKind:K(w),runId:o,sandboxPolicy:a?structuredClone(a):null,runtimeSessionId:c(l(v)?v.sessionId:"")||i,idleTtlMs:this.targetIdleTtlMs(w),releaseAfterPrompt:this.config.sandboxRequired?!0:this.targetReleaseAfterPrompt(w,t.metadata),createdAtMs:D,lastUsedAtMs:D,busy:!1,createdAt:_t()},this.sessions.set(p,h),this.runtimeSessionIndex.set(`${s}:${h.runtimeSessionId}`,h),n?.mcpServers!==U&&n?.mcpServers&&O.refreshMcpServers&&await O.refreshMcpServers(n.mcpServers)}catch(O){throw this.sessions.get(p)?.runtime===E?await this.closeSession(p,"session_start_failed"):await E?.stop("session_start_failed"),m&&(this.releaseTargetSlot(m),m=null),O}finally{this.startingSessions.delete(p)}}if(h.busy){let _=new Error(`runtime session is already running: ${i}`);throw _.code="RUNTIME_SESSION_BUSY",_}h.busy=!0,m&&this.releaseTargetSlot(m),this.notifyCapacityChanged(),h.operationCorrelationId=n?.correlationId||null,h.lastUsedAtMs=Date.now();let y=n?.updates||[],S=_=>{let w=Sa(_,i,h);if(y.push(w),n)for(let E of n.listeners)try{E?.(w)}catch(O){g("warn","runtime-bridge","runtime operation update listener failed",{correlationId:n.correlationId,error:String(O)})}else r.onUpdate?.(w)},N=_=>{if(!(!n||n.status!=="running"||!l(_))){if(_.status==="failed"){let w=_.error;if(w instanceof Error){this.failOperation(n,w);return}let E=l(w)?w:{},O=Object.assign(new Error(c(E.message||_.message)||"runtime terminal failure"),{code:c(E.code||_.code)||"RUNTIME_TERMINAL_FAILED"});this.failOperation(n,O);return}this.completeOperation(n,this.promptResponse(t,h,i,y,l(_.result)?_.result:{stopReason:"end_turn"}))}};try{let _=vn(t.goalContract),w=Array.isArray(t.prompt)?[...t.prompt]:[];_&&w.unshift({type:"text",text:_,metadata:{source:"orcha_goal_contract"}});let E=l(t.metadata)?t.metadata:{},O=l(E._runtimeBridge)?E._runtimeBridge:{},U=await h.runtime.sessionPrompt({sessionId:h.runtimeSessionId,prompt:w,metadata:E},S,N),v=y,D=null;if(Wn({type:h.runtimeKind})&&ja(U,y,O)){D=U;let z=y.length,I=await h.runtime.sessionPrompt({sessionId:h.runtimeSessionId,prompt:[{type:"text",text:qa()}],metadata:E,_meta:{thinking:"off"}},S,N);U=Ga(D,I),v=y.slice(z)}let X;try{X=this.promptResponse(t,h,i,y,U,v)}catch(z){throw D&&es(U)?za(U,v):z}return D&&(X.result=Ka(X.result,D)),n&&this.completeOperation(n,X),X}finally{h.busy=!1,this.notifyCapacityChanged(),h.operationCorrelationId===n?.correlationId&&(h.operationCorrelationId=null),h.lastUsedAtMs=Date.now(),this.promptReleaseAfterPrompt(h,l(t.metadata)?t.metadata:{})&&await this.closeSession(p,"release_after_prompt"),n&&(n.mcpServers=null)}}async updatePolicy(t){if(this.assertDispatchable(),!this.config.sandboxRequired)throw Object.assign(new Error("runtime sandbox policy updates require an enforced sandbox"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"});let r=c(t.agentId),n=c(t.runId),s=c(t.sessionId),i=c(t.correlationId);if(!r||!n||!s||!i)throw Object.assign(new Error("agentId, runId, sessionId and correlationId are required"),{code:"BAD_REQUEST"});let o=rt(t.sandboxPolicy),a=this.operations.get(i);if(a&&(a.agentId!==r||a.sessionId!==s||a.identity.runId!==n))throw Object.assign(new Error(`runtime operation policy identity conflict: ${i}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let u=`${r}:${s}`,d=this.sessions.get(u);if(d&&d.runId!==n)throw Object.assign(new Error(`runtime session policy identity conflict: ${s}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});let f=d?.sandboxPolicy||a?.sandboxPolicy;if(!f)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"});let p=Number(f.policyRevision),h=Number(o.policyRevision);if(h<p)throw Object.assign(new Error("runtime sandbox policy revision is stale"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});if(h===p){if(q(f)!==q(o))throw Object.assign(new Error("runtime sandbox policy revision payload conflicts"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:p});return{updated:!1,idempotent:!0,policyRevision:p,accessMode:f.accessMode}}let m=$n(f,o);a&&(a.sandboxPolicy=structuredClone(o)),d&&(d.sandboxPolicy=structuredClone(o));let y=!1;return m&&d?.busy===!0&&(await d.runtime.sessionCancel({sessionId:d.runtimeSessionId}),y=await this.closeSession(u,"sandbox_policy_downgrade")),{updated:!0,policyRevision:h,accessMode:o.accessMode,activeCommandCancelled:y,deferredToNextLaunch:!m&&d?.busy===!0}}async cancel(t){let r=c(t.agentId),n=c(t.sessionId),s=c(t.correlationId);if(s){let a=this.operations.get(s);if(!a||a.status!=="running")return{cancelled:!1,correlationId:s,reason:"operation_not_running"};if(a.agentId!==r||a.sessionId!==n)throw Object.assign(new Error(`runtime operation cancellation identity conflict: ${s}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let u=this.sessions.get(`${r}:${n}`);return!u||u.busy!==!0||u.operationCorrelationId!==s?(this.failOperation(a,Object.assign(new Error("Runtime operation cancelled before dispatch"),{code:"RUNTIME_OPERATION_CANCELLED"})),{cancelled:!0,correlationId:s,reason:"cancelled_before_dispatch"}):(await u.runtime.sessionCancel({sessionId:u.runtimeSessionId}),await this.closeSession(`${r}:${n}`,"cancelled"),{cancelled:!0,correlationId:s})}let i=`${r}:${n}`,o=this.sessions.get(i);return o?(await o.runtime.sessionCancel({sessionId:o.runtimeSessionId}),await this.closeSession(i,"cancelled"),{cancelled:!0}):{cancelled:!1}}async dispatch(t,r={}){let n=c(t.agentId),s=c(t.taskId),i=c(t.executionId);if(!n||!s)throw Object.assign(new Error("agentId and taskId are required"),{status:400,code:"BAD_REQUEST"});let o=c(t.sessionId)||`dispatch-${i||s}`,a=c(t.instructions),u=Ua(t),d=Xn(t),{target:f}=this.targetFor(t.targetCode||t.framework),p=[{type:"text",text:["Task dispatch received.",`taskId: ${s}`,i?`executionId: ${i}`:"",a?`instructions: ${a}`:"",u?"orchaContext:":"",u,u?"Use orchaContext as the source of truth for upstream outputs, review reports, artifacts, and workflow metadata.":"","Follow the execution protocol in instructions exactly.","When embedding a generated artifact in final Markdown, use the Orcha artifact placeholder as the link target: orcha-artifact://<fieldKey>/<index>.","Example: use ![illustration](orcha-artifact://image/0) for the first generated image artifact.","Do not use local filesystem paths, file:// URLs, or data: URLs in final Markdown; Orcha replaces artifact placeholders after ingestion.",d?`For decision results, put the raw report between ${De} and ${He}.`:"",d?`Then put a JSON object containing _decision between ${Fe} and ${$e}.`:"",d?"Do not JSON-escape the report. Keep output out of the CONTROL JSON, and put every protocol marker on its own line.":"",d?`Keep the report within ${Jn} Unicode characters so the CONTROL block fits before the output limit.`:"","Return only the final answer required by that protocol.","Do not include process notes, logs, or explanations."].filter(Boolean).join(`
+`)}];return this.prompt({...t,agentId:n,sessionId:o,prompt:p,metadata:Ma(t,f)},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s}){let i=te(),a=this.runtimeSessionIndex.get(`${t.agentId}:${r}`)?.sessionId||r||te(),u={permissionId:i,agentId:t.agentId,sessionId:a,runtimeSessionId:r,request:l(n)?n:{},status:"pending",createdAt:_t()};return s?.({sessionId:r,update:{sessionUpdate:"permission_request",permission:u}}),await new Promise(d=>{let f=T(n?.timeoutMs,this.config.permissionRequestTimeoutMs),p=setTimeout(()=>{this.pendingPermissions.delete(i),d({permissionId:i,outcome:"denied",response:{reason:"permission request timed out"}})},f);this.pendingPermissions.set(i,{timer:p,resolve:d,permission:u})})}async respondPermission(t){let r=c(t.permissionId),n=this.pendingPermissions.get(r),s=c(t.outcome||"approved")||"approved";return n?(clearTimeout(n.timer),this.pendingPermissions.delete(r),n.resolve({permissionId:r,outcome:s,response:l(t.response)?t.response:{},userId:c(t.userId),metadata:l(t.metadata)?t.metadata:{}}),{accepted:!0,permissionId:r,outcome:s}):{accepted:!1,permissionId:r,outcome:s}}health(){return{status:this.config.sandboxRequired&&!this.sandboxCapabilities.dispatchable?"unavailable":"ok",bridgeVersion:J,startedAt:this.startedAt,agents:[...this.agents.values()].map(t=>({agentId:t.agentId,targetCode:t.targetCode,framework:t.framework,runtimeKind:t.runtimeKind})),sessions:this.sessions.size,pendingPermissions:this.pendingPermissions.size,targets:Object.keys(this.targets),sandboxCapabilities:this.sandboxCapabilities}}};import Ja from"node:http";import Va from"node:https";import{randomBytes as rs}from"node:crypto";var ft=1,nt=3,Wa=1e4,ne=class{constructor(t,r={}){this.url=t,this.readyState=0,this.socket=null,this.request=null,this.buffer=Buffer.alloc(0),this.listeners=new Map,this.connectTimeoutMs=Xa(r.connectTimeoutMs,Wa),this.connectTimer=null,this.connect()}addEventListener(t,r){let n=this.listeners.get(t)||new Set;n.add(r),this.listeners.set(t,n)}emit(t,r={}){let n=this.listeners.get(t);if(n)for(let s of n)s(r)}connect(){let t=new URL(this.url),r=t.protocol==="wss:"?Va:Ja,n=rs(16).toString("base64"),s=r.request({protocol:t.protocol==="wss:"?"https:":"http:",hostname:t.hostname,port:t.port||(t.protocol==="wss:"?443:80),path:`${t.pathname}${t.search}`,method:"GET",headers:{Connection:"Upgrade",Upgrade:"websocket","Sec-WebSocket-Key":n,"Sec-WebSocket-Version":"13"}});this.request=s,this.startConnectTimer(s),s.on("upgrade",(i,o,a)=>{if(this.clearConnectTimer(),this.readyState===nt){o.destroy();return}this.socket=o,this.readyState=ft,o.on("data",u=>this.onData(u)),o.on("close",()=>this.onClose()),o.on("error",u=>{this.readyState!==nt&&this.emit("error",{error:u,message:u.message,type:"error"}),this.onClose()}),a?.length&&this.onData(a),this.emit("open")}),s.on("response",i=>{this.clearConnectTimer(),this.emit("error",{message:`websocket upgrade failed: HTTP ${i.statusCode}`,type:"error"}),i.resume(),this.onClose()}),s.on("error",i=>{this.clearConnectTimer(),this.readyState!==nt&&this.emit("error",{error:i,message:i.message,type:"error"}),this.onClose()}),s.end()}startConnectTimer(t){this.connectTimeoutMs<=0||(this.connectTimer=setTimeout(()=>{if(this.readyState===ft||this.readyState===nt)return;let r=`websocket connect timeout after ${this.connectTimeoutMs}ms`;this.emit("error",{message:r,type:"timeout"}),this.onClose(),t.destroy(new Error(r))},this.connectTimeoutMs),this.connectTimer.unref?.())}clearConnectTimer(){this.connectTimer&&(clearTimeout(this.connectTimer),this.connectTimer=null)}send(t){!this.socket||this.readyState!==ft||this.socket.write(pr(1,Buffer.from(String(t),"utf8")))}close(){if(this.readyState!==nt){if(this.clearConnectTimer(),!this.socket){this.request?.destroy(),this.onClose();return}try{this.readyState===ft&&this.socket.write(pr(8,Buffer.alloc(0))),this.socket.end()}catch{this.socket.destroy()}this.onClose()}}onClose(){this.readyState!==nt&&(this.clearConnectTimer(),this.readyState=nt,this.request=null,this.emit("close"))}onData(t){for(this.buffer=Buffer.concat([this.buffer,t]);this.buffer.length>=2;){let r=this.buffer[0],n=this.buffer[1],s=r&15,i=(n&128)!==0,o=n&127,a=2;if(o===126){if(this.buffer.length<a+2)return;o=this.buffer.readUInt16BE(a),a+=2}else if(o===127){if(this.buffer.length<a+8)return;let f=this.buffer.readUInt32BE(a),p=this.buffer.readUInt32BE(a+4);o=f*2**32+p,a+=8}let u=a;if(i&&(a+=4),this.buffer.length<a+o)return;let d=this.buffer.subarray(a,a+o);if(i){let f=this.buffer.subarray(u,u+4);d=Buffer.from(d.map((p,h)=>p^f[h%4]))}this.buffer=this.buffer.subarray(a+o),s===1?this.emit("message",{data:d.toString("utf8")}):s===8?this.close():s===9&&this.socket?.write(pr(10,d))}}};function Xa(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function pr(e,t){let r=t.length,n=2;r>=126&&r<=65535?n+=2:r>65535&&(n+=8);let s=rs(4),i=Buffer.alloc(n+4+r);i[0]=128|e;let o=2;r<126?i[1]=128|r:r<=65535?(i[1]=254,i.writeUInt16BE(r,o),o+=2):(i[1]=255,i.writeUInt32BE(Math.floor(r/2**32),o),i.writeUInt32BE(r>>>0,o+4),o+=8),s.copy(i,o),o+=4;for(let a=0;a<r;a+=1)i[o+a]=t[a]^s[a%4];return i}function Ya(e){let t=new URL(e);if(t.protocol==="http:")t.protocol="ws:";else if(t.protocol==="https:")t.protocol="wss:";else if(t.protocol!=="ws:"&&t.protocol!=="wss:")throw new Error(`unsupported ORCHA_RUNTIME_ORCHA_URL protocol: ${t.protocol}`);return t.pathname=`${t.pathname.replace(/\/+$/,"")}/api/agent-runtime-bridge/ws`,t.search="",t.toString()}function Qa(e,t=!0){return Object.entries(e||{}).map(([r,n])=>({targetCode:r,targetName:c(n?.name||n?.targetName||r),targetType:c(n?.type||"echo"),status:t?"available":"unavailable"}))}var Za=Object.freeze(["health","agents/create","agents/dispatch","sessions/prompt","sessions/policy","sessions/cancel","permissions/respond"]),se=class{constructor(t,r){this.config=t,this.bridge=r,this.ws=null,this.stopped=!1,this.connected=!1,this.reconnectTimer=null,this.heartbeatTimer=null,this.capacityHeartbeatTimer=null,this.bridge.onCapacityChanged=()=>this.scheduleCapacityHeartbeat()}sandboxCapabilities(){return this.bridge.sandboxCapabilities||{dispatchable:this.config.sandboxRequired!==!0,enforced:!1,backend:"development_direct",daemonStatus:"development_only",policySchemaVersions:[1],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:!1}}supportedMethods(){return[...Za,...this.config.deviceConnection?["devices/discover","devices/configure"]:[]]}runtimeTargets(){let t=this.sandboxCapabilities().dispatchable===!0;return typeof this.bridge.targetCapacitySnapshot=="function"?this.bridge.targetCapacitySnapshot(t):Qa(this.config.targets,t)}start(){this.connect()}stop(){this.stopped=!0,this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=null,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.capacityHeartbeatTimer&&clearTimeout(this.capacityHeartbeatTimer),this.capacityHeartbeatTimer=null,this.bridge.onCapacityChanged=null,this.ws?.close()}connect(){if(this.stopped)return;let t=Ya(this.config.orchaUrl),r=new ne(t,{connectTimeoutMs:this.config.connectTimeoutMs});this.ws=r,r.addEventListener("open",()=>{if(this.ws!==r||this.stopped){r.close();return}this.authenticate(r)}),r.addEventListener("message",n=>this.handleMessage(n.data,r)),r.addEventListener("close",()=>this.scheduleReconnect("close",r)),r.addEventListener("error",n=>{g("warn","orcha-client","runtime node websocket error",{error:String(n?.message||n?.type||n)})})}authenticate(t=this.ws){this.send({type:"runtime_node.authenticate",token:this.config.nodeToken,nodeId:this.config.nodeId,nodeName:this.config.nodeName,version:J,protocolVersion:"orcha-runtime-node.v2",defaultTargetCode:this.config.defaultTargetCode,supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()},t)}scheduleReconnect(t,r=this.ws){r&&this.ws!==r||(this.connected=!1,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.capacityHeartbeatTimer&&clearTimeout(this.capacityHeartbeatTimer),this.capacityHeartbeatTimer=null,r&&this.ws===r&&(this.ws=null),!this.stopped&&(this.reconnectTimer||(g("info","orcha-client","runtime node disconnected; reconnect scheduled",{reason:t,reconnectMs:this.config.reconnectMs}),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},this.config.reconnectMs))))}async handleMessage(t,r=this.ws){if(r&&this.ws!==r)return;let n;try{n=JSON.parse(String(t))}catch(s){g("warn","orcha-client","invalid Orcha websocket frame",{error:String(s)});return}if(l(n)){if(n.type==="runtime_node.authenticated"){if(r&&this.ws!==r)return;this.connected=!0,this.startHeartbeat(r),g("info","orcha-client","runtime node authenticated",{nodeId:this.config.nodeId,connectionId:n.connectionId});return}if(n.type==="orcha.runtime.request"){await this.handleRequest(n);return}n.type==="runtime_node.ping"&&this.send({type:"runtime_node.pong",ts:new Date().toISOString(),supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()})}}startHeartbeat(t){this.heartbeatTimer&&clearInterval(this.heartbeatTimer);let r=Math.max(1e3,Number(this.config.heartbeatIntervalMs||15e3)),n=()=>this.sendCapacityHeartbeat(t);n(),this.heartbeatTimer=setInterval(n,r),this.heartbeatTimer.unref?.()}scheduleCapacityHeartbeat(){if(!this.connected||this.capacityHeartbeatTimer)return;let t=Math.max(25,Math.min(1e3,Number(this.config.capacityHeartbeatDebounceMs||100)));this.capacityHeartbeatTimer=setTimeout(()=>{this.capacityHeartbeatTimer=null,this.sendCapacityHeartbeat()},t),this.capacityHeartbeatTimer.unref?.()}sendCapacityHeartbeat(t=this.ws){return this.connected?this.send({type:"runtime_node.heartbeat",ts:new Date().toISOString(),supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()},t):!1}async handleRequest(t){let r=c(t.id),n=c(t.method),s=l(t.params)?t.params:{};try{let i=await this.invoke(n,s,r);this.send({type:"orcha.runtime.response",id:r,ok:!0,result:i})}catch(i){this.send({type:"orcha.runtime.response",id:r,ok:!1,error:{code:i.code||"RUNTIME_NODE_ERROR",message:i.message||String(i),...i.detail===void 0?{}:{detail:i.detail}}})}}async invoke(t,r,n){if(t==="devices/discover"&&this.config.deviceConnection)return this.config.deviceConnection.candidates();if(t==="devices/configure"&&this.config.deviceConnection)return this.config.deviceConnection.configure(r,this.bridge);if(t==="health")return this.bridge.health();if(t==="agents/create")return this.bridge.createAgent(r);if(t==="agents/dispatch")return this.bridge.dispatch(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/prompt")return this.bridge.prompt(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/policy")return this.bridge.updatePolicy(r);if(t==="sessions/cancel")return this.bridge.cancel(r);if(t==="permissions/respond")return this.bridge.respondPermission(r);throw Object.assign(new Error(`unsupported Orcha runtime method: ${t}`),{code:"METHOD_NOT_FOUND"})}sendUpdate(t,r){this.send({type:"orcha.runtime.event",requestId:t,eventType:"runtime.update",payload:r})}send(t,r=this.ws){return!r||r!==this.ws||r.readyState!==ft?!1:(r.send(JSON.stringify(t)),!0)}};import{existsSync as ns,readFileSync as tc}from"node:fs";import{dirname as ec,resolve as ie}from"node:path";import{fileURLToPath as rc}from"node:url";var nc=/^[A-Za-z_][A-Za-z0-9_]*$/;function ss(e=process.env,t=process.cwd()){let r=c(e.ORCHA_RUNTIME_ENV_FILE),n=r?ie(t,r):ie(t,".env");if(!ns(n))return r&&g("warn","config","runtime env file not found",{path:n}),{loaded:!1,path:n,keys:[]};let s=[],i=tc(n,"utf8");for(let o of i.split(/\r?\n/)){let a=oc(o);if(!a)continue;let[u,d]=a;Object.prototype.hasOwnProperty.call(e,u)||(e[u]=d,s.push(u))}return g("info","config","runtime env file loaded",{path:n,keyCount:s.length}),{loaded:!0,path:n,keys:s}}function is(e=process.env){let t=c(e.ORCHA_RUNTIME_MODE||(e.ORCHA_RUNTIME_ORCHA_URL?"node":"server")),r=c(e.ORCHA_RUNTIME_BRIDGE_HOST||"127.0.0.1"),n=!1,s=ec(rc(import.meta.url)),i=ie(s,"sandbox","broker.js"),o=ie(s,"orcha-runtime-sandbox-broker.js"),a=ns(i)?i:o,u=c(e.ORCHA_RUNTIME_SANDBOX_BROKER_COMMAND);return{mode:t,host:r,port:T(e.ORCHA_RUNTIME_BRIDGE_PORT,5588),token:e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",orchaUrl:c(e.ORCHA_RUNTIME_ORCHA_URL),nodeToken:e.ORCHA_RUNTIME_NODE_TOKEN||e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",nodeId:c(e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"local-runtime-node"),nodeName:c(e.ORCHA_RUNTIME_NODE_NAME||e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"Local Runtime Node"),reconnectMs:T(e.ORCHA_RUNTIME_RECONNECT_MS,3e3),connectTimeoutMs:T(e.ORCHA_RUNTIME_CONNECT_TIMEOUT_MS||e.ORCHA_RUNTIME_WS_CONNECT_TIMEOUT_MS,1e4),defaultTargetCode:e.ORCHA_RUNTIME_DEFAULT_TARGET||"echo",requestLimitBytes:T(e.ORCHA_RUNTIME_REQUEST_LIMIT_BYTES,1048576),initializeTimeoutMs:T(e.ORCHA_RUNTIME_INITIALIZE_TIMEOUT_MS,3e4),sessionPromptTimeoutMs:T(e.ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS,36e5),permissionRequestTimeoutMs:T(e.ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS,3e5),sessionIdleTtlMs:T(e.ORCHA_RUNTIME_SESSION_IDLE_TTL_MS,6e5),sessionCleanupIntervalMs:T(e.ORCHA_RUNTIME_SESSION_CLEANUP_INTERVAL_MS,6e4),maxSessionsPerTarget:T(e.ORCHA_RUNTIME_MAX_SESSIONS_PER_TARGET,8),openClawSessionIdleTtlMs:T(e.ORCHA_RUNTIME_OPENCLAW_SESSION_IDLE_TTL_MS,6e4),openClawMaxSessions:T(e.ORCHA_RUNTIME_OPENCLAW_MAX_SESSIONS,1),heartbeatIntervalMs:T(e.ORCHA_RUNTIME_HEARTBEAT_INTERVAL_MS,15e3),sandboxRequired:n,sandboxBrokerCommand:u||process.execPath,sandboxBrokerArguments:hr(e.ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS,"ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS",u?[]:[a]),sandboxProbeTimeoutMs:T(e.ORCHA_RUNTIME_SANDBOX_PROBE_TIMEOUT_MS,1e4),sandboxTempRoot:c(e.ORCHA_RUNTIME_SANDBOX_TEMP_ROOT),trustedWorkspaceRoots:hr(e.ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS,"ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS"),trustedToolchainRoots:hr(e.ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS,"ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS"),egressProxyRequired:ic(e.ORCHA_RUNTIME_EGRESS_PROXY_REQUIRED,t==="node"),egressProxySocket:c(e.ORCHA_RUNTIME_EGRESS_PROXY_SOCKET),egressProxyToken:c(e.ORCHA_RUNTIME_EGRESS_PROXY_TOKEN),egressGrantMaxTtlMs:T(e.ORCHA_RUNTIME_EGRESS_GRANT_MAX_TTL_MS,9e5),targets:sc(e.ORCHA_RUNTIME_TARGETS_JSON||"")}}function sc(e){if(!c(e))return{};try{let t=JSON.parse(e);if(l(t))return t}catch(t){g("warn","config","invalid ORCHA_RUNTIME_TARGETS_JSON",{error:String(t)})}return{}}function ic(e,t){let r=c(e).toLowerCase();if(!r)return t;if(["true","1","yes","on"].includes(r))return!0;if(["false","0","no","off"].includes(r))return!1;throw new Error(`invalid boolean configuration value: ${r}`)}function hr(e,t,r=[]){let n=c(e);if(!n)return[...r];let s;try{s=JSON.parse(n)}catch{throw new Error(`${t} must be a JSON string array`)}if(!Array.isArray(s)||s.some(i=>typeof i!="string"))throw new Error(`${t} must be a JSON string array`);return s.map(i=>i.trim()).filter(Boolean)}function oc(e){let t=e.trim();if(!t||t.startsWith("#"))return null;let r=t.startsWith("export ")?t.slice(7).trimStart():t,n=r.indexOf("=");if(n<=0)return null;let s=r.slice(0,n).trim();if(!nc.test(s))return null;let i=ac(r.slice(n+1).trim());return[s,i]}function ac(e){if(!e)return"";let t=e[0];if((t==='"'||t==="'")&&e.endsWith(t)){let r=e.slice(1,-1);return t==='"'?cc(r):r}return uc(e).trim()}function cc(e){return e.replaceAll("\\n",`
+`).replaceAll("\\r","\r").replaceAll("\\t","	").replaceAll('\\"','"').replaceAll("\\\\","\\")}function uc(e){let t=!1,r=!1;for(let n=0;n<e.length;n+=1){let s=e[n],i=e[n-1];if(s==="'"&&!r)t=!t;else if(s==='"'&&!t&&i!=="\\")r=!r;else if(s==="#"&&!t&&!r&&/\s/.test(i||""))return e.slice(0,n)}return e}import{createServer as lc}from"node:http";function oe(e,t,r){let n=JSON.stringify(r);e.writeHead(t,{"content-type":"application/json; charset=utf-8","content-length":Buffer.byteLength(n)}),e.end(n)}function st(e={}){return{ok:!0,...e}}function mr(e,t,r){return{ok:!1,error:{code:e,message:t,...r===void 0?{}:{detail:r}}}}async function os(e,t){let r=[],n=0;for await(let i of e){if(n+=i.length,n>t)throw Object.assign(new Error("request body too large"),{status:413,code:"REQUEST_TOO_LARGE"});r.push(i)}if(r.length===0)return{};let s=Buffer.concat(r).toString("utf8");if(!s.trim())return{};try{let i=JSON.parse(s);if(!l(i))throw Object.assign(new Error("JSON body must be an object"),{status:400,code:"BAD_JSON"});return i}catch(i){throw i.status?i:Object.assign(new Error(`invalid JSON body: ${i.message}`),{status:400,code:"BAD_JSON"})}}function as(e,t){if(!t)return;if((e.headers.authorization||"")!==`Bearer ${t}`)throw Object.assign(new Error("runtime bridge token is invalid"),{status:401,code:"UNAUTHORIZED"})}function cs(e,t){let r={"GET /health":async()=>st(t.health()),"POST /agents/create":async n=>st(await t.createAgent(n)),"POST /agents/dispatch":async n=>st(await t.dispatch(n)),"POST /sessions/prompt":async n=>st(await t.prompt(n)),"POST /sessions/cancel":async n=>st(await t.cancel(n)),"POST /permissions/respond":async n=>st(await t.respondPermission(n))};return lc(async(n,s)=>{let i=new URL(n.url||"/",`http://${n.headers.host||`${e.host}:${e.port}`}`),o=`${n.method||"GET"} ${i.pathname}`,a=r[o];if(!a){oe(s,404,mr("NOT_FOUND",`No route for ${o}`));return}try{as(n,e.token);let u=n.method==="GET"?{}:await os(n,e.requestLimitBytes);oe(s,200,await a(u))}catch(u){let d=u.status||500,f=u.code||"BRIDGE_INTERNAL";oe(s,d,mr(f,u.message||String(u),u.detail))}})}var gs=gc(import.meta.url),_c=".orcha-runtime-bridge.pid",yc=".orcha-runtime-bridge.log",Tc=3,wc=36e5,{command:Ec,options:_s}=Oc(process.argv.slice(2));Ic(_s);ss();var Rc=is();await ys(Ec,Rc,_s);async function ys(e,t,r){if(r.url){let s=ge(r.url);r.pidFile||(process.env.ORCHA_RUNTIME_PID_FILE=s.pidFile),r.logFile||(process.env.ORCHA_RUNTIME_LOG_FILE=s.logFile)}let n=()=>["connect","--url",t.orchaUrl,"--foreground"];switch(e){case"connect":if(r.pairCode&&it(ce(ae())))throw new Error("\u8BBE\u5907\u8FDE\u63A5\u4ECD\u5728\u540E\u53F0\u8FD0\u884C\uFF0C\u8BF7\u5148\u6267\u884C stop --url \u540E\u91CD\u65B0\u914D\u5BF9");await Nt(t,r),r.foreground?await gr(t):_r(n());return;case"run":case"foreground":r.url&&await Nt(t,r),await gr(t);return;case"start":if(r.url)return ys("connect",t,r);if(r.foreground){await gr(t);return}_r();return;case"reload":case"restart":{r.url&&await Nt(t,{url:r.url});let s=pt(ms(gs),".."),i=pt(s,...Er(pt(s,"src","index.js"))?["dist","package"]:[],"openclaw-plugin"),o=await qr(t.targets,i);await ds({quiet:!0}),await o(),_r(r.url?n():void 0);return}case"stop":await ds();return;case"status":Sc();return;case"help":case"--help":case"-h":Nc();return;default:throw new Error(`Unknown command: ${e}`)}}async function gr(e){Cc();let t=new re(e);if(await t.start(),e.mode==="server"){let n=cs(e,t);ls({bridge:t,server:n}),n.listen(e.port,e.host,()=>{g("info","runtime-bridge","Orcha runtime bridge HTTP server started",{host:e.host,port:e.port,targets:Object.keys(t.targets)})});return}if(!e.orchaUrl)throw new Error("ORCHA_RUNTIME_ORCHA_URL is required in runtime node mode");let r=new se(e,t);ls({bridge:t,client:r}),r.start(),g("info","runtime-bridge","Orcha runtime node started",{nodeId:e.nodeId,nodeName:e.nodeName,orchaUrl:e.orchaUrl,targets:Object.keys(t.targets)})}function ls({bridge:e,client:t,server:r}){let n=!1,s=i=>{if(n)return;n=!0;let o=Number(e?.sessions?.size||0)>0;g("info","runtime-bridge","runtime bridge shutting down",{signal:i});try{t?.stop?.()}catch(a){g("warn","runtime-bridge","runtime client stop failed",{error:String(a)})}Promise.resolve(e?.stop?.(`process_${String(i||"shutdown").toLowerCase()}`)).catch(a=>{g("warn","runtime-bridge","runtime bridge stop failed",{error:String(a)})}).finally(()=>{try{r?.close?.()}catch(a){g("warn","runtime-bridge","runtime server close failed",{error:String(a)})}}),setTimeout(()=>process.exit(0),o?8500:200)};process.once("SIGTERM",()=>s("SIGTERM")),process.once("SIGINT",()=>s("SIGINT"))}function _r(e=["run"]){let t=ae(),r=Ts(),n=ce(t);if(n&&it(n)){console.log(JSON.stringify({status:"already_running",pid:n,pidFile:t,logFile:r}));return}n&&wr(t),ps(t),ps(r),Tr(r);let s=hc(r,"a"),i={...process.env,ORCHA_RUNTIME_PID_FILE:t,ORCHA_RUNTIME_LOG_FILE:r},o=dc(process.execPath,[gs,...e,"--pid-file",t,"--log-file",r],{cwd:process.cwd(),detached:!0,env:i,stdio:["ignore",s,s]});o.unref(),fc(s),hs(t,`${o.pid}
+`),console.log(JSON.stringify({status:"started",pid:o.pid,pidFile:t,logFile:r}))}async function ds({quiet:e=!1}={}){let t=ae(),r=ce(t);if(!r){e||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!it(r)){wr(t),e||console.log(JSON.stringify({status:"not_running",pid:r,pidFile:t}));return}process.kill(r,"SIGTERM"),!await fs(r,1e4)&&it(r)&&(process.kill(r,"SIGKILL"),await fs(r,3e3)),wr(t),e||console.log(JSON.stringify({status:"stopped",pid:r,pidFile:t}))}function Sc(){let e=ae(),t=Ts(),r=ce(e),n=!!(r&&it(r));console.log(JSON.stringify({status:n?"running":"not_running",running:n,pid:n?r:null,pidFile:e,logFile:t}))}function Oc(e){let t=[],r={};for(let s=0;s<e.length;s+=1){let i=e[s];i==="--url"?r.url=e[++s]:i==="--pair-code"?r.pairCode=e[++s]:i==="--daemon"?r.daemon=!0:i==="--foreground"?r.foreground=!0:i==="--env-file"?r.envFile=e[++s]:i==="--pid-file"?r.pidFile=e[++s]:i==="--log-file"?r.logFile=e[++s]:t.push(i)}return{command:t[0]||"run",options:r}}function Ic(e){e.envFile&&(process.env.ORCHA_RUNTIME_ENV_FILE=e.envFile),e.pidFile&&(process.env.ORCHA_RUNTIME_PID_FILE=e.pidFile),e.logFile&&(process.env.ORCHA_RUNTIME_LOG_FILE=e.logFile)}function ae(){return pt(process.cwd(),process.env.ORCHA_RUNTIME_PID_FILE||_c)}function Ts(){return pt(process.cwd(),process.env.ORCHA_RUNTIME_LOG_FILE||yc)}function Cc(){let e=process.env.ORCHA_RUNTIME_LOG_FILE;if(!e)return;let t=ws();if(t<=0)return;let r=pt(process.cwd(),e);Tr(r,t);let n=Ac();n<=0||setInterval(()=>Tr(r,t),n).unref()}function Tr(e,t=ws()){if(t<=0||!Er(e))return;let r=0,n="";try{if(r=us(e).size,r<=0)return;n=yr(e,"utf8")}catch(d){g("warn","runtime-bridge","runtime log cleanup skipped",{logFile:e,error:String(d)});return}let s=Date.now()-t*24*60*60*1e3,i=n.split(/\r?\n/),o=[],a=0;for(let d of i)d&&(xc(d,s)?o.push(d):a+=1);if(a===0)return;let u="";try{us(e).size>r&&(u=yr(e,"utf8").slice(n.length));let f=[...o,...u.split(/\r?\n/).filter(Boolean)].join(`
+`);hs(e,f?`${f}
+`:""),g("info","runtime-bridge","runtime log cleanup completed",{logFile:e,retentionDays:t,removed:a})}catch(d){g("warn","runtime-bridge","runtime log cleanup failed",{logFile:e,error:String(d)})}}function xc(e,t){try{let r=JSON.parse(e);if(!r||typeof r!="object")return!0;let n=typeof r.ts=="string"?Date.parse(r.ts):Number.NaN;return!Number.isFinite(n)||n>=t}catch{return!0}}function ws(){return Es(process.env.ORCHA_RUNTIME_LOG_RETENTION_DAYS,Tc)}function Ac(){return Es(process.env.ORCHA_RUNTIME_LOG_CLEANUP_INTERVAL_MS,wc)}function Es(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function ce(e){if(!Er(e))return null;let t=Number.parseInt(yr(e,"utf8").trim(),10);return Number.isInteger(t)&&t>0?t:null}function it(e){if(!Number.isInteger(e)||e<=0)return!1;try{return process.kill(e,0),!0}catch(t){return t?.code==="EPERM"}}async function fs(e,t){let r=Date.now();for(;Date.now()-r<t;){if(!it(e))return!0;await new Promise(n=>setTimeout(n,100))}return!it(e)}function ps(e){pc(ms(e),{recursive:!0})}function wr(e){try{mc(e,{force:!0})}catch{}}function Nc(){console.log(`Usage: orcha-runtime-bridge [command] [options]
 
 Commands:
   connect             Pair or reconnect this device, then run in the background.
   run, foreground      Run in the foreground. This is the default.
   start               Start in the background and write a pid file.
-  reload, restart     Stop the background process and start it again.
+  reload, restart     Update connected OpenClaw plugins/restart Gateway, then restart Bridge.
   stop                Stop the background process.
   status              Print background process status as JSON.
 

package/openclaw-plugin/index.js

@@ -1,5 +1,5 @@
-import{getPluginRuntimeGatewayRequestScope as Pe}from"openclaw/plugin-sdk/plugin-runtime";import{loadOutboundMediaFromUrl as He}from"openclaw/plugin-sdk/outbound-media";var $={controlTools:["find_capabilities_and_skills","describe_capability","inspect_result","execute_capability"],residentTools:["search_orcha_docs"]};var Y=Object.freeze([...$.controlTools,...$.residentTools]),ye=new Set(Y),we=8*1024*1024;function re(e,r){if(!Array.isArray(e)||e.length!==1)throw new Error("one task-scoped Orcha MCP server is required");let i=e[0],p=new URL(i.url);if(i.name!=="orcha"||i.type!=="http"||!["http:","https:"].includes(p.protocol)||p.username||p.password||p.hash||r&&p.href!==new URL(r).href)throw new Error("Orcha MCP server does not match the trusted binding");let h=Object.fromEntries((i.headers||[]).map(({name:m,value:f})=>[m.toLowerCase(),f]));if(!String(h.authorization||"").startsWith("Bearer "))throw new Error("Orcha MCP task credentials are missing");return{url:p.href,headers:{...h,"content-type":"application/json",accept:"application/json"}}}async function x(e){let r=0,i=[];for await(let p of e){if(r+=p.length,r>we)throw new Error("MCP payload exceeds the size limit");i.push(Buffer.from(p))}return JSON.parse(Buffer.concat(i).toString("utf8"))}async function G(e,r,i){let p=await fetch(e.url,{method:"POST",headers:e.headers,body:JSON.stringify(r),redirect:"error",signal:AbortSignal.any([AbortSignal.timeout(36e5),...i?[i]:[]])});if(!p.ok)throw new Error(`Orcha MCP request failed (${p.status})`);if(p.status===202||p.status===204)return null;let h=await x(p.body);if(!h||h.jsonrpc!=="2.0"||h.id!==r.id)throw new Error("Orcha MCP response identity mismatch");return h}async function ae(e,r){let i=await G(e,{jsonrpc:"2.0",id:"orcha-bind-tools",method:"tools/list"},r),p=i?.result?.tools;if(i?.error)throw new Error("Orcha MCP tool discovery failed");return Ie(p)}function Ie(e){if(!Array.isArray(e)||e.some(r=>!r||!ye.has(r.name)||r.inputSchema?.type!=="object"||typeof r.description!="string")||new Set(e.map(r=>r.name)).size!==e.length||e.length&&$.controlTools.some(r=>!e.some(i=>i.name===r)))throw new Error("Orcha MCP returned an unsupported or invalid authorized tool catalog");return e}function oe(e,r){let i=h=>Array.isArray(h)?h.map(i):h&&typeof h=="object"?Object.fromEntries(Object.keys(h).sort().map(m=>[m,i(h[m])])):h,p=h=>h.map(({name:m,inputSchema:f})=>({name:m,inputSchema:f})).sort((m,f)=>m.name.localeCompare(f.name));return JSON.stringify(i(p(e)))===JSON.stringify(i(p(r)))}var Q=e=>Object.assign(new Error(e),{status:409});function se(e){let r=new Map,i=e.pluginConfig?.allowedOrchaMcpUrl;if(!i)throw new Error("Orcha plugin requires allowedOrchaMcpUrl");function p(f,s=r.get(f)){!s||r.get(f)!==s||(s.lifetime.abort(),clearTimeout(s.timer),r.delete(f))}function h(f){let s=r.get(f);return s&&s.deadline<=Date.now()?(p(f,s),null):s}async function m(f,{refresh:s=!1}={}){let{runId:d,sessionKey:T,agentCode:v,expiresAt:L,mcpServer:t}=f,u=Date.parse(L);if(typeof d!="string"||!d||typeof T!="string"||!T||typeof v!="string"||!v||!T.startsWith(`agent:${v}:`)||!Number.isFinite(u)||u<=Date.now()||u>Date.now()+24*36e5)throw new Error("invalid_binding_scope");let w=h(T);if(s&&!w||w&&(w.runId!==d||w.agentCode!==v||w.deadline!==u))throw Q("original_binding_unavailable_or_changed");let n=re([t],i),c=w?.lifetime||new AbortController,a=await ae(n,c.signal);if(h(T)!==w)throw Q("binding_changed");if(w){if(!oe(w.tools,a))throw Q("frozen_tool_catalog_changed");w.upstream=n}else{let o={runId:d,agentCode:v,deadline:u,upstream:n,tools:a,lifetime:c};o.timer=setTimeout(()=>p(T,o),u-Date.now()),o.timer.unref?.(),r.set(T,o)}}return e.registerTool(f=>{let s=h(f.sessionKey);return!s||f.agentId!==s.agentCode?null:s.tools.map(d=>({name:`orcha_${d.name}`,label:`Orcha ${d.name}`,description:d.description,parameters:d.inputSchema,async execute(T,v,L){if(h(f.sessionKey)!==s||f.agentId!==s.agentCode||!T||!s.tools.some(u=>u.name===d.name))throw new Error("Orcha task binding expired or changed");let t=await G(s.upstream,{jsonrpc:"2.0",id:T,method:"tools/call",params:{name:d.name,arguments:v}},AbortSignal.any([s.lifetime.signal,...L?[L]:[]]));if(t?.error||!t?.result)throw new Error("Orcha rejected this task-scoped tool call");return{content:t.result.content,details:t.result.structuredContent,isError:t.result.isError===!0}}}))},{names:Y.map(f=>`orcha_${f}`)}),{bind:m,active:h,release:p,allowedUrl:i}}import{createHash as Oe}from"node:crypto";import{mkdirSync as Te,readFileSync as Ae,renameSync as Ne,writeFileSync as Ce}from"node:fs";import{join as le}from"node:path";import{createHash as _e}from"node:crypto";var ie=e=>_e("sha256").update(JSON.stringify(e)).digest("hex"),B=e=>Object.assign(new Error(e),{code:e}),V=e=>{let r=String(e||"").replace(/^orcha:/,"");return/^[1-9]\d{0,18}$/.test(r)?r:void 0},ce={normalizeTarget:V,targetResolver:{looksLikeId:e=>!!V(e),hint:"Orcha session ID"}};function de({core:e,load:r,save:i,loadMedia:p,activeRun:h}){let m=new Map,f=(t,u)=>ie([t,u]),s=t=>({channel:"orcha",messageId:t.messageId,chatId:t.sessionId,receipt:{primaryPlatformMessageId:t.messageId,platformMessageIds:[t.messageId],parts:[{platformMessageId:t.messageId,kind:"unknown",index:0}],sentAt:Date.now()}});async function d(t,u,w={}){return await w.onPlatformSendDispatch?.(),w.signal?.throwIfAborted(),s(await e(t,"/messages",u.payload,{cfg:w.cfg,signal:w.signal}))}async function T(t){t.signal?.throwIfAborted();let u=V(t.to);if(!u)throw B("invalid_conversation");if(!t.deliveryQueueId)throw B("OPENCLAW_DURABLE_DELIVERY_ID_REQUIRED");let w=t.run&&t.run.delivery.bindingId===t.accountId&&t.run.delivery.sessionId===u?t.run:null,n=t.replyToId||w?.delivery.messageId||null,c=t.payload||{text:t.text||"",mediaUrl:t.mediaUrl},a=c.mediaUrls||(c.mediaUrl?[c.mediaUrl]:[]),o=f(t.accountId,t.deliveryQueueId),l=ie([u,c.text||"",a,n,w?.runId||null]),I=r(o,"sends");if(I&&I.requestHash!==l)throw B("channel_send_conflict");let _=m.get(o);if(_){if(_.requestHash!==l)throw B("channel_send_conflict");return _.promise}let O=(async()=>{let g=I;if(!g){let y=[];for(let S of a){let C=await p(S,{maxBytes:33554432,mediaAccess:t.mediaAccess,mediaReadFile:t.mediaReadFile,mediaLocalRoots:t.mediaLocalRoots}),A=new FormData;A.set("sessionId",u),A.set("file",new Blob([C.buffer],{type:C.contentType||"application/octet-stream"}),C.fileName||"attachment"),y.push((await e(t.accountId,"/files",A,{cfg:t.cfg,signal:t.signal})).inputPart)}g={requestHash:l,payload:{sourceMessageId:`openclaw:${o}`,sessionId:u,content:c.text||"",inputParts:y,...n?{replyToMessageId:n}:{},...w?{agentRunId:w.runId}:{}}},i(o,g,"sends")}let N=await d(t.accountId,g,t);return w&&!w.messageIds.includes(N.messageId)&&w.messageIds.push(N.messageId),N})().finally(()=>m.delete(o));return m.set(o,{requestHash:l,promise:O}),O}return{send:T,message:{send:{text:T,media:T,payload:T},durableFinal:{capabilities:{text:!0,media:!0,payload:!0,replyTo:!0,reconcileUnknownSend:!0},reconcileUnknownSendKinds:{text:!0,media:!0,payload:!0},async reconcileUnknownSend(t){let u=r(f(t.accountId,t.queueId),"sends");if(!u)return{status:"not_sent"};if(u.payload.sessionId!==String(t.to).replace(/^orcha:/,""))throw B("channel_send_conflict");let w=await d(t.accountId,u,t);return{status:"sent",receipt:w.receipt,messageId:w.messageId}}}},actions:{describeMessageTool:()=>({actions:["send"],mediaSourceParams:{send:["media"]}}),supportsAction:({action:t})=>t==="send",isToolDeliveryAction:({args:t})=>t.action==="send",extractToolSend:({args:t})=>typeof(t.to||t.target)=="string"?{to:t.to||t.target,accountId:t.accountId}:null,async handleAction(t){if(t.action!=="send")throw B("unsupported_channel_action");let u=t.params;if(t.dryRun)return{content:[{type:"text",text:"Orcha send dry run"}],details:{dryRun:!0}};let w=h(t.sessionKey),n=await T({cfg:t.cfg,accountId:t.accountId,to:u.to||u.target,text:u.message,mediaUrl:u.media,replyToId:u.replyTo,deliveryQueueId:u.idempotencyKey,mediaAccess:t.mediaAccess,mediaLocalRoots:t.mediaLocalRoots,mediaReadFile:t.mediaReadFile,run:w,signal:w?.controller.signal});return{content:[{type:"text",text:JSON.stringify(n)}],details:n}}}}}var j="application/x-orcha-channel-events-v2+ndjson";function F(e,r){return Object.assign(new Error(r||(["run_timeout","RUNTIME_NODE_TIMEOUT"].includes(e)?"OpenClaw \u539F\u751F IM \u6267\u884C\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002":e==="OPENCLAW_CHANNEL_PROTOCOL_MISMATCH"?"OpenClaw \u63D2\u4EF6\u4E0E Bridge \u7684\u539F\u751F IM \u534F\u8BAE\u4E0D\u517C\u5BB9\uFF0C\u8BF7\u914D\u5957\u5347\u7EA7\u3002":`OpenClaw \u539F\u751F IM \u6267\u884C\u5931\u8D25\uFF08${e}\uFF09`)),{code:e})}function q(e,r){let i=e.cause?.code||e.code;return r?.reason?.name==="TimeoutError"||e.name==="TimeoutError"||["UND_ERR_HEADERS_TIMEOUT","UND_ERR_BODY_TIMEOUT","UND_ERR_CONNECT_TIMEOUT","ETIMEDOUT"].includes(i)?Object.assign(F("RUNTIME_NODE_TIMEOUT","OpenClaw \u8FDE\u63A5\u6216\u7B49\u5F85\u54CD\u5E94\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002"),{detail:{causeCode:i||"REQUEST_TIMEOUT"}}):e}var Se=e=>Oe("sha256").update(JSON.stringify(e)).digest("hex"),R=(e,r=409)=>Object.assign(new Error(e),{status:r,code:e}),J=e=>typeof e=="string"&&/^[1-9]\d{0,18}$/.test(e),be=e=>new Promise(r=>setTimeout(r,e));function ue(e,r,i,p,h){let m=new Map,f=()=>e.config;function s(n,c=f()){let a=c?.channels?.orcha?.accounts?.[n];if(!J(n)||!a||a.enabled===!1||!a.serviceToken||!a.agentId)throw R("orcha_channel_account_unavailable",403);return{...a,accountId:n}}async function d(n,c,a,{cfg:o,signal:l,method:I="POST"}={}){let _=s(n,o),O=new URL(`/api/agent-channels${c}`,r.allowedUrl),g=a instanceof FormData,N=AbortSignal.any([AbortSignal.timeout(3e4),...l?[l]:[]]);try{let y=await fetch(O,{method:I,redirect:"error",signal:N,headers:{authorization:`Bearer ${_.serviceToken}`,...g?{}:{"content-type":"application/json"}},...a!==void 0?{body:g?a:JSON.stringify(a)}:{}}),S=await x(y.body);if(!y.ok||S.success!==!0)throw R(`orcha_channel_request_${y.status}`,y.status);return S.data}catch(y){throw q(y,N)}}function T(n,c="runs"){if(!/^[a-zA-Z0-9_-]{1,128}$/.test(n))throw R("invalid_record_identity",422);let a=le(e.runtime.state.resolveStateDir(),"plugins","orcha-runtime",c);return Te(a,{recursive:!0,mode:448}),le(a,`${n}.json`)}function v(n,c){try{return JSON.parse(Ae(T(n,c),"utf8"))}catch(a){if(a.code==="ENOENT")return null;throw a}}function L(n,c,a){let o=T(n,a),l=`${o}.pending`;Ce(l,JSON.stringify(c),{mode:384}),Ne(l,o)}async function t(n,c=!1,a){let o=s(n.delivery?.bindingId),{runId:l,delivery:I}=n;if(!J(l)||!J(I.sessionId)||!J(I.taskContextId)||I.mode!=="channel"||n.agentCode!==o.agentId)throw R("invalid_channel_delivery",422);if(!Array.isArray(n.prompt)||n.prompt.some(M=>!["text","image","file"].includes(M.type)||(M.type==="text"?typeof M.text!="string":typeof M.uri!="string")))throw R("invalid_channel_prompt",422);let _=Se({agentCode:n.agentCode,delivery:I,prompt:n.prompt}),O=v(l);if(O&&O.requestHash!==_)throw R("channel_delivery_conflict");if(O?.status==="completed")return O.result;if(O?.status==="failed")throw R(O.error);let g=m.get(l),N=O?.expiresAt||n.expiresAt,y=`agent:${o.agentId}:orcha:${I.bindingId}:${l}`,S=O?.hostRunId||`orcha-${l}`;if(O&&!g||n.attachOnly&&!g&&!O)throw R("RUNTIME_OPERATION_NOT_FOUND");if(g){try{await r.bind({runId:l,sessionKey:y,agentCode:o.agentId,expiresAt:N,mcpServer:n.mcpServer},{refresh:!0})}catch(M){if(m.get(l)!==g)return await g.promise;throw M}if(c)return{refreshed:!0};g.listeners.add(a);try{for(let M of g.updates)a?.(M);return await g.promise}finally{g.listeners.delete(a)}}if(c)throw R("RUNTIME_OPERATION_NOT_FOUND");let C=new AbortController,A={runId:l,delivery:I,messageIds:[],controller:C,promise:null,listeners:new Set(a?[a]:[]),updates:[],bytes:0},D=M=>{let P={type:"update",payload:{sessionId:y,update:M,_meta:{channelUpdateId:`${S}:${A.updates.length+1}`}}},U=Buffer.byteLength(JSON.stringify(P));if(U>2097152||A.bytes+U>16777216){C.abort(F("OPENCLAW_CHANNEL_PROGRESS_LIMIT"));return}A.bytes+=U,A.updates.push(P);for(let W of A.listeners)W?.(P)};return m.set(l,A),A.promise=(async()=>{await r.bind({runId:l,sessionKey:y,agentCode:o.agentId,expiresAt:N,mcpServer:n.mcpServer}),L(l,{requestHash:_,status:"running",sessionKey:y,hostRunId:S,expiresAt:N});let M=0,P,U,W=setTimeout(()=>C.abort(R("run_timeout")),Date.parse(N)-Date.now());try{let k=e.runtime.channel.reply;if(typeof k?.dispatchReplyWithBufferedBlockDispatcher!="function"||typeof e.runtime.events?.onAgentEvent!="function")throw R("OPENCLAW_CHANNEL_RUNTIME_UNAVAILABLE");U=e.runtime.events.onAgentEvent(E=>{let b=E.data;E.runId!==S||E.stream!=="tool"||!b?.toolCallId||b.hideFromChannelProgress||!["start","update","result"].includes(b.phase)||D({sessionUpdate:b.phase==="start"?"tool_call":"tool_call_update",toolCallId:b.toolCallId,title:b.name,status:b.phase==="result"?b.isError?"failed":"completed":"in_progress",...b.args?{rawInput:b.args}:{},...b.result!==void 0?{rawOutput:b.result}:{}})});let H="",Z=E=>{if(E.requiresReasoningProgressOptIn||typeof E.text!="string")return;let b=E.text.startsWith(H)?E.text.slice(H.length):E.text;H=E.text,b&&D({sessionUpdate:"agent_thought_chunk",content:{type:"text",text:b}})},z=n.prompt.filter(E=>E.type==="text").map(E=>E.text).join(`
+import{getPluginRuntimeGatewayRequestScope as He}from"openclaw/plugin-sdk/plugin-runtime";import{loadOutboundMediaFromUrl as xe}from"openclaw/plugin-sdk/outbound-media";var $={controlTools:["find_capabilities_and_skills","describe_capability","inspect_result","execute_capability"],residentTools:["search_orcha_docs"]};var G=Object.freeze([...$.controlTools,...$.residentTools]),_e=new Set(G),Ee=8*1024*1024;function oe(e,n){if(!Array.isArray(e)||e.length!==1)throw new Error("one task-scoped Orcha MCP server is required");let s=e[0],p=new URL(s.url);if(s.name!=="orcha"||s.type!=="http"||!["http:","https:"].includes(p.protocol)||p.username||p.password||p.hash||n&&p.href!==new URL(n).href)throw new Error("Orcha MCP server does not match the trusted binding");let m=Object.fromEntries((s.headers||[]).map(({name:h,value:f})=>[h.toLowerCase(),f]));if(!String(m.authorization||"").startsWith("Bearer "))throw new Error("Orcha MCP task credentials are missing");return{url:p.href,headers:{...m,"content-type":"application/json",accept:"application/json"}}}async function B(e){let n=0,s=[];for await(let p of e){if(n+=p.length,n>Ee)throw new Error("MCP payload exceeds the size limit");s.push(Buffer.from(p))}return JSON.parse(Buffer.concat(s).toString("utf8"))}async function Q(e,n,s){let p=await fetch(e.url,{method:"POST",headers:e.headers,body:JSON.stringify(n),redirect:"error",signal:AbortSignal.any([AbortSignal.timeout(36e5),...s?[s]:[]])});if(!p.ok)throw new Error(`Orcha MCP request failed (${p.status})`);if(p.status===202||p.status===204)return null;let m=await B(p.body);if(!m||m.jsonrpc!=="2.0"||m.id!==n.id)throw new Error("Orcha MCP response identity mismatch");return m}async function ae(e,n){let s=await Q(e,{jsonrpc:"2.0",id:"orcha-bind-tools",method:"tools/list"},n),p=s?.result?.tools;if(s?.error)throw new Error("Orcha MCP tool discovery failed");return Oe(p)}function Oe(e){if(!Array.isArray(e)||e.some(n=>!n||!_e.has(n.name)||n.inputSchema?.type!=="object"||typeof n.description!="string")||new Set(e.map(n=>n.name)).size!==e.length||e.length&&$.controlTools.some(n=>!e.some(s=>s.name===n)))throw new Error("Orcha MCP returned an unsupported or invalid authorized tool catalog");return e}function se(e,n){let s=m=>Array.isArray(m)?m.map(s):m&&typeof m=="object"?Object.fromEntries(Object.keys(m).sort().map(h=>[h,s(m[h])])):m,p=m=>m.map(({name:h,inputSchema:f})=>({name:h,inputSchema:f})).sort((h,f)=>h.name.localeCompare(f.name));return JSON.stringify(s(p(e)))===JSON.stringify(s(p(n)))}var V=e=>Object.assign(new Error(e),{status:409});function ie(e){let n=new Map,s=e.pluginConfig?.allowedOrchaMcpUrl;if(!s)throw new Error("Orcha plugin requires allowedOrchaMcpUrl");function p(f,i=n.get(f)){!i||n.get(f)!==i||(i.lifetime.abort(),clearTimeout(i.timer),n.delete(f))}function m(f){let i=n.get(f);return i&&i.deadline<=Date.now()?(p(f,i),null):i}async function h(f,{refresh:i=!1}={}){let{runId:d,sessionKey:T,agentCode:L,expiresAt:P,mcpServer:t}=f,u=Date.parse(P);if(typeof d!="string"||!d||typeof T!="string"||!T||typeof L!="string"||!L||!T.startsWith(`agent:${L}:`)||!Number.isFinite(u)||u<=Date.now()||u>Date.now()+24*36e5)throw new Error("invalid_binding_scope");let w=m(T);if(i&&!w||w&&(w.runId!==d||w.agentCode!==L||w.deadline!==u))throw V("original_binding_unavailable_or_changed");let r=oe([t],s),c=w?.lifetime||new AbortController,o=await ae(r,c.signal);if(m(T)!==w)throw V("binding_changed");if(w){if(!se(w.tools,o))throw V("frozen_tool_catalog_changed");w.upstream=r}else{let a={runId:d,agentCode:L,deadline:u,upstream:r,tools:o,lifetime:c};a.timer=setTimeout(()=>p(T,a),u-Date.now()),a.timer.unref?.(),n.set(T,a)}}return e.registerTool(f=>{let i=m(f.sessionKey);return!i||f.agentId!==i.agentCode?null:i.tools.map(d=>({name:`orcha_${d.name}`,label:`Orcha ${d.name}`,description:d.description,parameters:d.inputSchema,async execute(T,L,P){if(m(f.sessionKey)!==i||f.agentId!==i.agentCode||!T||!i.tools.some(u=>u.name===d.name))throw new Error("Orcha task binding expired or changed");let t=await Q(i.upstream,{jsonrpc:"2.0",id:T,method:"tools/call",params:{name:d.name,arguments:L}},AbortSignal.any([i.lifetime.signal,...P?[P]:[]]));if(t?.error||!t?.result)throw new Error("Orcha rejected this task-scoped tool call");return{content:t.result.content,details:t.result.structuredContent,isError:t.result.isError===!0}}}))},{names:G.map(f=>`orcha_${f}`)}),{bind:h,active:m,release:p,allowedUrl:s}}import{createHash as Ne}from"node:crypto";import{mkdirSync as Ce,readFileSync as be,renameSync as Se,writeFileSync as Re}from"node:fs";import{join as ue}from"node:path";import{createHash as Te}from"node:crypto";var ce=e=>Te("sha256").update(JSON.stringify(e)).digest("hex"),D=e=>Object.assign(new Error(e),{code:e}),q=e=>{let n=String(e||"").replace(/^orcha:/,"");return/^[1-9]\d{0,18}$/.test(n)?n:void 0},de={normalizeTarget:q,targetResolver:{looksLikeId:e=>!!q(e),hint:"Orcha session ID"}};function le({core:e,load:n,save:s,loadMedia:p,activeRun:m}){let h=new Map,f=(t,u)=>ce([t,u]),i=t=>({channel:"orcha",messageId:t.messageId,chatId:t.sessionId,receipt:{primaryPlatformMessageId:t.messageId,platformMessageIds:[t.messageId],parts:[{platformMessageId:t.messageId,kind:"unknown",index:0}],sentAt:Date.now()}});async function d(t,u,w={}){return await w.onPlatformSendDispatch?.(),w.signal?.throwIfAborted(),i(await e(t,"/messages",u.payload,{cfg:w.cfg,signal:w.signal}))}async function T(t){t.signal?.throwIfAborted();let u=q(t.to);if(!u)throw D("invalid_conversation");if(!t.deliveryQueueId)throw D("OPENCLAW_DURABLE_DELIVERY_ID_REQUIRED");let w=t.run&&t.run.delivery.bindingId===t.accountId&&t.run.delivery.sessionId===u?t.run:null,r=t.replyToId||w?.delivery.messageId||null,c=t.payload||{text:t.text||"",mediaUrl:t.mediaUrl},o=c.mediaUrls||(c.mediaUrl?[c.mediaUrl]:[]),a=f(t.accountId,t.deliveryQueueId),l=ce([u,c.text||"",o,r,w?.runId||null]),_=n(a,"sends");if(_&&_.requestHash!==l)throw D("channel_send_conflict");let I=h.get(a);if(I){if(I.requestHash!==l)throw D("channel_send_conflict");return I.promise}let O=(async()=>{let g=_;if(!g){let y=[];for(let v of o){let C=await p(v,{maxBytes:33554432,mediaAccess:t.mediaAccess,mediaReadFile:t.mediaReadFile,mediaLocalRoots:t.mediaLocalRoots}),N=new FormData;N.set("sessionId",u),N.set("file",new Blob([C.buffer],{type:C.contentType||"application/octet-stream"}),C.fileName||"attachment"),y.push((await e(t.accountId,"/files",N,{cfg:t.cfg,signal:t.signal})).inputPart)}g={requestHash:l,payload:{sourceMessageId:`openclaw:${a}`,sessionId:u,content:c.text||"",inputParts:y,...r?{replyToMessageId:r}:{},...w?{agentRunId:w.runId}:{}}},s(a,g,"sends")}let A=await d(t.accountId,g,t);return w&&!w.messageIds.includes(A.messageId)&&w.messageIds.push(A.messageId),A})().finally(()=>h.delete(a));return h.set(a,{requestHash:l,promise:O}),O}return{send:T,message:{send:{text:T,media:T,payload:T},durableFinal:{capabilities:{text:!0,media:!0,payload:!0,replyTo:!0,reconcileUnknownSend:!0},reconcileUnknownSendKinds:{text:!0,media:!0,payload:!0},async reconcileUnknownSend(t){let u=n(f(t.accountId,t.queueId),"sends");if(!u)return{status:"not_sent"};if(u.payload.sessionId!==String(t.to).replace(/^orcha:/,""))throw D("channel_send_conflict");let w=await d(t.accountId,u,t);return{status:"sent",receipt:w.receipt,messageId:w.messageId}}}},actions:{describeMessageTool:()=>({actions:["send"],mediaSourceParams:{send:["media"]}}),supportsAction:({action:t})=>t==="send",isToolDeliveryAction:({args:t})=>t.action==="send",extractToolSend:({args:t})=>typeof(t.to||t.target)=="string"?{to:t.to||t.target,accountId:t.accountId}:null,async handleAction(t){if(t.action!=="send")throw D("unsupported_channel_action");let u=t.params;if(t.dryRun)return{content:[{type:"text",text:"Orcha send dry run"}],details:{dryRun:!0}};let w=m(t.sessionKey),r=await T({cfg:t.cfg,accountId:t.accountId,to:u.to||u.target,text:u.message,mediaUrl:u.media,replyToId:u.replyTo,deliveryQueueId:u.idempotencyKey,mediaAccess:t.mediaAccess,mediaLocalRoots:t.mediaLocalRoots,mediaReadFile:t.mediaReadFile,run:w,signal:w?.controller.signal});return{content:[{type:"text",text:JSON.stringify(r)}],details:r}}}}}var J="application/x-orcha-channel-events-v2+ndjson";function W(e,n){return Object.assign(new Error(n||(["run_timeout","RUNTIME_NODE_TIMEOUT"].includes(e)?"OpenClaw \u539F\u751F IM \u6267\u884C\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002":e==="OPENCLAW_CHANNEL_PROTOCOL_MISMATCH"?"OpenClaw \u63D2\u4EF6\u4E0E Bridge \u7684\u539F\u751F IM \u534F\u8BAE\u4E0D\u517C\u5BB9\uFF0C\u8BF7\u914D\u5957\u5347\u7EA7\u3002":`OpenClaw \u539F\u751F IM \u6267\u884C\u5931\u8D25\uFF08${e}\uFF09`)),{code:e})}function X(e,n){let s=e.cause?.code||e.code;return n?.reason?.name==="TimeoutError"||e.name==="TimeoutError"||["UND_ERR_HEADERS_TIMEOUT","UND_ERR_BODY_TIMEOUT","UND_ERR_CONNECT_TIMEOUT","ETIMEDOUT"].includes(s)?Object.assign(W("RUNTIME_NODE_TIMEOUT","OpenClaw \u8FDE\u63A5\u6216\u7B49\u5F85\u54CD\u5E94\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002"),{detail:{causeCode:s||"REQUEST_TIMEOUT"}}):e}var me=e=>Ne("sha256").update(JSON.stringify(e)).digest("hex"),R=(e,n=409)=>Object.assign(new Error(e),{status:n,code:e}),z=e=>typeof e=="string"&&/^[1-9]\d{0,18}$/.test(e),Me=e=>new Promise(n=>setTimeout(n,e));function pe(e,n,s){return`agent:${e}:orcha:task:${me([s,n.bindingId,n.bindingRevision,n.sessionId,n.taskContextId,n.memberId,n.historyFromSeq,n.runtimePolicyRevision])}`}function he(e,n,s,p,m){let h=new Map,f=()=>e.config;function i(r,c=f()){let o=c?.channels?.orcha?.accounts?.[r];if(!z(r)||!o||o.enabled===!1||!o.serviceToken||!o.agentId)throw R("orcha_channel_account_unavailable",403);return{...o,accountId:r}}async function d(r,c,o,{cfg:a,signal:l,method:_="POST"}={}){let I=i(r,a),O=new URL(`/api/agent-channels${c}`,n.allowedUrl),g=o instanceof FormData,A=AbortSignal.any([AbortSignal.timeout(3e4),...l?[l]:[]]);try{let y=await fetch(O,{method:_,redirect:"error",signal:A,headers:{authorization:`Bearer ${I.serviceToken}`,...g?{}:{"content-type":"application/json"}},...o!==void 0?{body:g?o:JSON.stringify(o)}:{}}),v=await B(y.body);if(!y.ok||v.success!==!0)throw R(`orcha_channel_request_${y.status}`,y.status);return v.data}catch(y){throw X(y,A)}}function T(r,c="runs"){if(!/^[a-zA-Z0-9_-]{1,128}$/.test(r))throw R("invalid_record_identity",422);let o=ue(e.runtime.state.resolveStateDir(),"plugins","orcha-runtime",c);return Ce(o,{recursive:!0,mode:448}),ue(o,`${r}.json`)}function L(r,c){try{return JSON.parse(be(T(r,c),"utf8"))}catch(o){if(o.code==="ENOENT")return null;throw o}}function P(r,c,o){let a=T(r,o),l=`${a}.pending`;Re(l,JSON.stringify(c),{mode:384}),Se(l,a)}async function t(r,c=!1,o){let a=i(r.delivery?.bindingId),{runId:l,delivery:_}=r;if(!z(l)||!z(_.sessionId)||!z(_.taskContextId)||_.mode!=="channel"||r.agentCode!==a.agentId)throw R("invalid_channel_delivery",422);if(!Array.isArray(r.prompt)||r.prompt.some(b=>!["text","image","file"].includes(b.type)||(b.type==="text"?typeof b.text!="string":typeof b.uri!="string")))throw R("invalid_channel_prompt",422);let I=me({agentCode:r.agentCode,delivery:_,prompt:r.prompt}),O=L(l);if(O&&O.requestHash!==I)throw R("channel_delivery_conflict");if(O?.status==="completed")return O.result;if(O?.status==="failed")throw R(O.error);let g=h.get(l),A=O?.expiresAt||r.expiresAt,y=pe(a.agentId,_,n.allowedUrl),v=()=>{let b=n.active(y);b?.runId===l&&n.release(y,b)},C=O?.hostRunId||`orcha-${l}`;if(O&&!g||r.attachOnly&&!g&&!O)throw R("RUNTIME_OPERATION_NOT_FOUND");if(g){try{await n.bind({runId:l,sessionKey:y,agentCode:a.agentId,expiresAt:A,mcpServer:r.mcpServer},{refresh:!0})}catch(b){if(h.get(l)!==g)return await g.promise;throw b}if(c)return{refreshed:!0};g.listeners.add(o);try{for(let b of g.updates)o?.(b);return await g.promise}finally{g.listeners.delete(o)}}if(c)throw R("RUNTIME_OPERATION_NOT_FOUND");let N=new AbortController,M={runId:l,delivery:_,messageIds:[],controller:N,promise:null,listeners:new Set(o?[o]:[]),updates:[],bytes:0},k=b=>{let U={type:"update",payload:{sessionId:y,update:b,_meta:{channelUpdateId:`${C}:${M.updates.length+1}`}}},x=Buffer.byteLength(JSON.stringify(U));if(x>2097152||M.bytes+x>16777216){N.abort(W("OPENCLAW_CHANNEL_PROGRESS_LIMIT"));return}M.bytes+=x,M.updates.push(U);for(let K of M.listeners)K?.(U)};return h.set(l,M),M.promise=(async()=>{await n.bind({runId:l,sessionKey:y,agentCode:a.agentId,expiresAt:A,mcpServer:r.mcpServer}),P(l,{requestHash:I,status:"running",sessionKey:y,hostRunId:C,expiresAt:A});let b=0,U,x,K=setTimeout(()=>N.abort(R("run_timeout")),Date.parse(A)-Date.now());try{let j=e.runtime.channel.reply;if(typeof j?.dispatchReplyWithBufferedBlockDispatcher!="function"||typeof e.runtime.events?.onAgentEvent!="function")throw R("OPENCLAW_CHANNEL_RUNTIME_UNAVAILABLE");x=e.runtime.events.onAgentEvent(E=>{let S=E.data;E.runId!==C||E.stream!=="tool"||!S?.toolCallId||S.hideFromChannelProgress||!["start","update","result"].includes(S.phase)||k({sessionUpdate:S.phase==="start"?"tool_call":"tool_call_update",toolCallId:S.toolCallId,title:S.name,status:S.phase==="result"?S.isError?"failed":"completed":"in_progress",...S.args?{rawInput:S.args}:{},...S.result!==void 0?{rawOutput:S.result}:{}})});let H="",ee=E=>{if(E.requiresReasoningProgressOptIn||typeof E.text!="string")return;let S=E.text.startsWith(H)?E.text.slice(H.length):E.text;H=E.text,S&&k({sessionUpdate:"agent_thought_chunk",content:{type:"text",text:S}})},F=r.prompt.filter(E=>E.type==="text").map(E=>E.text).join(`
 
-`),ee=n.prompt.filter(E=>E.type!=="text"),me={Body:z,BodyForAgent:z,RawBody:z,From:`orcha:${I.memberId}`,To:`orcha:${I.sessionId}`,SessionKey:y,AccountId:I.bindingId,Provider:"orcha",Surface:"orcha",ChatType:"direct",OriginatingChannel:"orcha",OriginatingTo:I.sessionId,MessageSid:I.messageId||l,MediaUrls:ee.map(E=>E.uri),MediaTypes:ee.map(E=>E.mimeType||"application/octet-stream"),CommandAuthorized:!1,CommandInterpretationSuppressed:!0,WasMentioned:!0};if(await k.dispatchReplyWithBufferedBlockDispatcher({ctx:me,cfg:f(),replyOptions:{runId:S,abortSignal:C.signal,suppressTyping:!0,suppressDefaultToolProgressMessages:!0,reasoningPayloadsEnabled:!0,commentaryPayloadsEnabled:!0,onAssistantMessageStart:()=>{H=""},onReasoningStream:Z},dispatcherOptions:{deliver:async(E,b)=>{if(C.signal.throwIfAborted(),E.isReasoning&&Z(E),E.isCommentary&&E.text&&D({sessionUpdate:"agent_thought_chunk",content:{type:"text",text:E.text}}),b.kind==="final"&&p(E)){let K=f(),ne=K?.agents?.list?.find(fe=>fe.id===o.agentId)?.workspace||K?.agents?.defaults?.workspace;await u.send({cfg:K,accountId:I.bindingId,to:I.sessionId,payload:E,run:A,deliveryQueueId:`${S}:final:${++M}`,signal:C.signal,mediaLocalRoots:ne?[ne]:void 0})}},onError:E=>{P??=E}}}),P)throw P;if(C.signal.throwIfAborted(),!A.messageIds.length)throw R("runtime_node_empty_result");let te={stopReason:"end_turn",messageIds:A.messageIds,sessionId:y};return L(l,{requestHash:_,status:"completed",sessionKey:y,hostRunId:S,expiresAt:N,result:te}),te}catch(k){let H=C.signal.aborted?C.signal.reason:q(k,C.signal);throw L(l,{requestHash:_,status:"failed",sessionKey:y,hostRunId:S,expiresAt:N,error:H.code||"channel_host_failed"}),H}finally{U?.(),clearTimeout(W),r.release(y),m.delete(l)}})().catch(M=>{throw r.release(y),m.delete(l),M}),A.promise}let u=de({core:d,load:v,save:L,loadMedia:h,activeRun:n=>m.get(r.active(n)?.runId)});e.registerChannel({plugin:{id:"orcha",meta:{id:"orcha",label:"Orcha",selectionLabel:"Orcha",docsPath:"/channels/orcha",blurb:"Enterprise people and Agent conversations"},capabilities:{chatTypes:["direct","group"],media:!0},config:{listAccountIds:n=>Object.keys(n?.channels?.orcha?.accounts||{}),inspectAccount:(n,c)=>{let a=n?.channels?.orcha?.accounts?.[c];return{enabled:!!(a&&a.enabled!==!1),configured:!!(a?.serviceToken&&a?.agentId),tokenStatus:a?.serviceToken?"available":"missing"}},resolveAccount:(n,c)=>s(c,n),isEnabled:n=>n.enabled!==!1,isConfigured:n=>!!(n.serviceToken&&n.agentId)},outbound:{deliveryMode:"direct",textChunkLimit:1e5},message:u.message,actions:u.actions,messaging:ce}});async function w(n){let{accountId:c,grantId:a,externalInvocationId:o}=n;s(c);let l=await d(c,"/runs",{grantId:a,externalInvocationId:o,input:n.input||{}}),I=l.agentRunId;if(["completed","failed","cancelled","expired"].includes(l.status))return l;let _;do _=await d(c,`/runs/${I}/claim`,{}),_.attemptId||await be(Math.max(1,_.retryAfterSeconds||2)*1e3);while(!_.attemptId);let O=`agent:${s(c).agentId}:orcha:${c}:${I}`,g,N=!1,y=setInterval(async()=>{if(!N){N=!0;try{let A=await d(c,`/runs/${I}/heartbeat`,{attemptId:_.attemptId});r.active(O)&&await r.bind({runId:I,sessionKey:O,agentCode:s(c).agentId,expiresAt:_.expiresAt,mcpServer:A.mcpServer},{refresh:!0})}catch(A){g=A,m.get(I)?.controller.abort(A),r.release(O)}finally{N=!1}}},Math.max(1,_.heartbeatIntervalSeconds)*1e3),S,C;try{let A;try{A=await t({runId:I,agentCode:s(c).agentId,delivery:_.delivery,prompt:[{type:"text",text:JSON.stringify({task:_.prompt,eventInput:_.input})}],mcpServer:_.mcpServer,expiresAt:_.expiresAt,attachOnly:_.recovery})}catch(M){C=M}if(g)throw g;S=C?{attemptId:_.attemptId,errorMessage:F(C.code||"channel_host_failed").message,status:"failed"}:{attemptId:_.attemptId,messageIds:A.messageIds,status:"completed"};let D=await d(c,`/runs/${I}/complete`,S);if(C)throw C;return D}finally{clearInterval(y),r.release(O)}}for(let[n,c]of[["deliveries",t],["background",w]])e.registerHttpRoute({path:`/plugins/orcha-runtime/${n}`,auth:"gateway",match:"exact",async handler(a,o){let l,I=Promise.resolve(),_=0,O=g=>{if(o.destroyed||o.writableEnded)return;let N=JSON.stringify(g)+`
-`,y=Buffer.byteLength(N);if(y>2097152||_+o.writableLength+y>2097152){o.destroy();return}return _+=y,I=I.then(async()=>{o.destroyed||o.writableEnded||(await i(),o.write(N))}).catch(S=>{!o.destroyed&&!o.writableEnded&&o.end(JSON.stringify({type:"error",code:S.code||"OPENCLAW_CHANNEL_AUTH_FAILED"})+`
-`)}).finally(()=>{_-=y}),I};try{if(n==="deliveries"&&a.method==="GET"){await i(),o.writeHead(200,{"content-type":"application/json"}).end(JSON.stringify({streamType:j}));return}if(!["POST","PATCH","DELETE"].includes(a.method))throw R("method_not_allowed",405);let g=await x(a);if(await i(),n==="deliveries"&&a.method==="POST"){if(a.headers.accept!==j)throw R("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH",409);o.writeHead(200,{"content-type":j,"cache-control":"no-store","x-accel-buffering":"no"}),O({type:"heartbeat"}),l=setInterval(()=>O({type:"heartbeat"}),15e3),o.once("close",()=>clearInterval(l));let y=await t(g,!1,O);await i(),await O({type:"result",result:y}),o.end();return}if(a.method==="DELETE"){let y=m.get(g.runId);y?.controller.abort(R("RUNTIME_OPERATION_CANCELLED")),o.writeHead(200,{"content-type":"application/json"}).end(JSON.stringify({cancelled:!!y}));return}if(a.method==="PATCH"&&n!=="deliveries")throw R("method_not_allowed",405);let N=await c(g,a.method==="PATCH");await i(),o.writeHead(200,{"content-type":"application/json"}).end(JSON.stringify(N))}catch(g){o.headersSent?(await O({type:"error",code:g.code||"channel_host_failed"}),o.end()):o.writableEnded||o.writeHead(g.status||500,{"content-type":"application/json"}).end(JSON.stringify({error:g.code||g.message}))}finally{clearInterval(l)}}})}function pe(e,r,i){return{id:"orcha-runtime",name:"Orcha Channel and authorized tools",register(p){let h=se(p);p.registerHttpRoute({path:"/plugins/orcha-runtime/mcp-bindings",auth:"gateway",match:"exact",async handler(m,f){let s=(d,T)=>{f.writeHead(d,{"content-type":"application/json"}),f.end(JSON.stringify(T))};try{if(m.method==="GET"){s(200,{ready:!0});return}if(!["PUT","DELETE"].includes(m.method)){s(405,{error:"method_not_allowed"});return}let d=await x(m);if(await e(),typeof d.runId!="string"||!d.runId||typeof d.sessionKey!="string"||!d.sessionKey){s(422,{error:"invalid_binding_identity"});return}let T=h.active(d.sessionKey);if(m.headers["if-match"]&&m.headers["if-match"]!==d.runId){s(409,{error:"binding_run_conflict"});return}if(T&&T.runId!==d.runId){s(409,{error:"session_already_bound"});return}m.method==="DELETE"?h.release(d.sessionKey):await h.bind(d,{refresh:!!m.headers["if-match"]}),s(200,{[m.method==="DELETE"?"released":"bound"]:!0})}catch(d){f.writableEnded||s(d.status||422,{error:d.message})}}}),ue(p,h,e,r,i)}}}import{isFastModeAutoProgressPayload as Re,isReasoningReplyPayload as Me,isReplyPayloadNonTerminalToolErrorWarning as ve,isReplyPayloadTtsSupplement as Le}from"openclaw/plugin-sdk/reply-payload";function he(e){return!Me(e)&&!e.isCommentary&&!e.isCompactionNotice&&!e.isFallbackNotice&&!e.isStatusNotice&&!Re(e)&&!ve(e)&&!Le(e)}var it=pe(async()=>{await Pe()?.revalidate?.()},he,He);export{it as default};
+`),te=r.prompt.filter(E=>E.type!=="text"),ye={Body:F,BodyForAgent:F,BodyForCommands:F,RawBody:F,From:`orcha:${_.memberId}`,To:`orcha:${_.sessionId}`,SessionKey:y,AccountId:_.bindingId,Provider:"orcha",Surface:"orcha",ChatType:"direct",OriginatingChannel:"orcha",OriginatingTo:_.sessionId,MessageSid:_.messageId||l,MediaUrls:te.map(E=>E.uri),MediaTypes:te.map(E=>E.mimeType||"application/octet-stream"),CommandAuthorized:!1,WasMentioned:!0};if(await j.dispatchReplyWithBufferedBlockDispatcher({ctx:ye,cfg:f(),replyOptions:{runId:C,abortSignal:N.signal,suppressTyping:!0,suppressDefaultToolProgressMessages:!0,reasoningPayloadsEnabled:!0,commentaryPayloadsEnabled:!0,onAssistantMessageStart:()=>{H=""},onReasoningStream:ee},dispatcherOptions:{deliver:async(E,S)=>{if(N.signal.throwIfAborted(),E.isReasoning&&ee(E),E.isCommentary&&E.text&&k({sessionUpdate:"agent_thought_chunk",content:{type:"text",text:E.text}}),S.kind==="final"&&p(E)){let Y=f(),re=Y?.agents?.list?.find(we=>we.id===a.agentId)?.workspace||Y?.agents?.defaults?.workspace;await u.send({cfg:Y,accountId:_.bindingId,to:_.sessionId,payload:E,run:M,deliveryQueueId:`${C}:final:${++b}`,signal:N.signal,mediaLocalRoots:re?[re]:void 0})}},onError:E=>{U??=E}}}),U)throw U;if(N.signal.throwIfAborted(),!M.messageIds.length)throw R("runtime_node_empty_result");let ne={stopReason:"end_turn",messageIds:M.messageIds,sessionId:y};return P(l,{requestHash:I,status:"completed",sessionKey:y,hostRunId:C,expiresAt:A,result:ne}),ne}catch(j){let H=N.signal.aborted?N.signal.reason:X(j,N.signal);throw P(l,{requestHash:I,status:"failed",sessionKey:y,hostRunId:C,expiresAt:A,error:H.code||"channel_host_failed"}),H}finally{x?.(),clearTimeout(K),v(),h.delete(l)}})().catch(b=>{throw v(),h.delete(l),b}),M.promise}let u=le({core:d,load:L,save:P,loadMedia:m,activeRun:r=>h.get(n.active(r)?.runId)});e.registerChannel({plugin:{id:"orcha",meta:{id:"orcha",label:"Orcha",selectionLabel:"Orcha",docsPath:"/channels/orcha",blurb:"Enterprise people and Agent conversations"},capabilities:{chatTypes:["direct","group"],media:!0},config:{listAccountIds:r=>Object.keys(r?.channels?.orcha?.accounts||{}),inspectAccount:(r,c)=>{let o=r?.channels?.orcha?.accounts?.[c];return{enabled:!!(o&&o.enabled!==!1),configured:!!(o?.serviceToken&&o?.agentId),tokenStatus:o?.serviceToken?"available":"missing"}},resolveAccount:(r,c)=>i(c,r),isEnabled:r=>r.enabled!==!1,isConfigured:r=>!!(r.serviceToken&&r.agentId)},outbound:{deliveryMode:"direct",textChunkLimit:1e5},message:u.message,actions:u.actions,messaging:de}});async function w(r){let{accountId:c,grantId:o,externalInvocationId:a}=r;i(c);let l=await d(c,"/runs",{grantId:o,externalInvocationId:a,input:r.input||{}}),_=l.agentRunId;if(["completed","failed","cancelled","expired"].includes(l.status))return l;let I;do I=await d(c,`/runs/${_}/claim`,{}),I.attemptId||await Me(Math.max(1,I.retryAfterSeconds||2)*1e3);while(!I.attemptId);let O=pe(i(c).agentId,I.delivery,n.allowedUrl),g,A=!1,y=setInterval(async()=>{if(!A){A=!0;try{let N=await d(c,`/runs/${_}/heartbeat`,{attemptId:I.attemptId});n.active(O)&&await n.bind({runId:_,sessionKey:O,agentCode:i(c).agentId,expiresAt:I.expiresAt,mcpServer:N.mcpServer},{refresh:!0})}catch(N){g=N,h.get(_)?.controller.abort(N),n.release(O)}finally{A=!1}}},Math.max(1,I.heartbeatIntervalSeconds)*1e3),v,C;try{let N;try{N=await t({runId:_,agentCode:i(c).agentId,delivery:I.delivery,prompt:[{type:"text",text:JSON.stringify({task:I.prompt,eventInput:I.input})}],mcpServer:I.mcpServer,expiresAt:I.expiresAt,attachOnly:I.recovery})}catch(k){C=k}if(g)throw g;v=C?{attemptId:I.attemptId,errorMessage:W(C.code||"channel_host_failed").message,status:"failed"}:{attemptId:I.attemptId,messageIds:N.messageIds,status:"completed"};let M=await d(c,`/runs/${_}/complete`,v);if(C)throw C;return M}finally{clearInterval(y),n.release(O)}}for(let[r,c]of[["deliveries",t],["background",w]])e.registerHttpRoute({path:`/plugins/orcha-runtime/${r}`,auth:"gateway",match:"exact",async handler(o,a){let l,_=Promise.resolve(),I=0,O=g=>{if(a.destroyed||a.writableEnded)return;let A=JSON.stringify(g)+`
+`,y=Buffer.byteLength(A);if(y>2097152||I+a.writableLength+y>2097152){a.destroy();return}return I+=y,_=_.then(async()=>{a.destroyed||a.writableEnded||(await s(),a.write(A))}).catch(v=>{!a.destroyed&&!a.writableEnded&&a.end(JSON.stringify({type:"error",code:v.code||"OPENCLAW_CHANNEL_AUTH_FAILED"})+`
+`)}).finally(()=>{I-=y}),_};try{if(r==="deliveries"&&o.method==="GET"){await s(),a.writeHead(200,{"content-type":"application/json"}).end(JSON.stringify({streamType:J}));return}if(!["POST","PATCH","DELETE"].includes(o.method))throw R("method_not_allowed",405);let g=await B(o);if(await s(),r==="deliveries"&&o.method==="POST"){if(o.headers.accept!==J)throw R("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH",409);a.writeHead(200,{"content-type":J,"cache-control":"no-store","x-accel-buffering":"no"}),O({type:"heartbeat"}),l=setInterval(()=>O({type:"heartbeat"}),15e3),a.once("close",()=>clearInterval(l));let y=await t(g,!1,O);await s(),await O({type:"result",result:y}),a.end();return}if(o.method==="DELETE"){let y=h.get(g.runId);y?.controller.abort(R("RUNTIME_OPERATION_CANCELLED")),a.writeHead(200,{"content-type":"application/json"}).end(JSON.stringify({cancelled:!!y}));return}if(o.method==="PATCH"&&r!=="deliveries")throw R("method_not_allowed",405);let A=await c(g,o.method==="PATCH");await s(),a.writeHead(200,{"content-type":"application/json"}).end(JSON.stringify(A))}catch(g){a.headersSent?(await O({type:"error",code:g.code||"channel_host_failed"}),a.end()):a.writableEnded||a.writeHead(g.status||500,{"content-type":"application/json"}).end(JSON.stringify({error:g.code||g.message}))}finally{clearInterval(l)}}})}function fe(e,n,s){return{id:"orcha-runtime",name:"Orcha Channel and authorized tools",register(p){let m=ie(p);p.registerHttpRoute({path:"/plugins/orcha-runtime/mcp-bindings",auth:"gateway",match:"exact",async handler(h,f){let i=(d,T)=>{f.writeHead(d,{"content-type":"application/json"}),f.end(JSON.stringify(T))};try{if(h.method==="GET"){i(200,{ready:!0});return}if(!["PUT","DELETE"].includes(h.method)){i(405,{error:"method_not_allowed"});return}let d=await B(h);if(await e(),typeof d.runId!="string"||!d.runId||typeof d.sessionKey!="string"||!d.sessionKey){i(422,{error:"invalid_binding_identity"});return}let T=m.active(d.sessionKey);if(h.headers["if-match"]&&h.headers["if-match"]!==d.runId){i(409,{error:"binding_run_conflict"});return}if(T&&T.runId!==d.runId){i(409,{error:"session_already_bound"});return}h.method==="DELETE"?m.release(d.sessionKey):await m.bind(d,{refresh:!!h.headers["if-match"]}),i(200,{[h.method==="DELETE"?"released":"bound"]:!0})}catch(d){f.writableEnded||i(d.status||422,{error:d.message})}}}),he(p,m,e,n,s)}}}import{isFastModeAutoProgressPayload as ve,isReasoningReplyPayload as Le,isReplyPayloadNonTerminalToolErrorWarning as Pe,isReplyPayloadTtsSupplement as Ue}from"openclaw/plugin-sdk/reply-payload";function ge(e){return!Le(e)&&!e.isCommentary&&!e.isCompactionNotice&&!e.isFallbackNotice&&!e.isStatusNotice&&!ve(e)&&!Pe(e)&&!Ue(e)}var dt=fe(async()=>{await He()?.revalidate?.()},ge,xe);export{dt as default};

package/openclaw-plugin/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orcha-ai/openclaw-tools",
-  "version": "0.1.42",
+  "version": "0.1.44",
   "type": "module",
   "private": true,
   "openclaw": { "extensions": ["./index.js"] }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orcha-ai/runtime-bridge",
-  "version": "0.1.42",
+  "version": "0.1.44",
   "private": false,
   "type": "module",
   "description": "Local Orcha runtime bridge for ACP-compatible agent runtimes.",