npm - @orcha-ai/runtime-bridge - Versions diffs - 0.1.52 → 0.1.54 - Mend

@orcha-ai/runtime-bridge 0.1.52 → 0.1.54

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/README.md +28 -9
package/bin/orcha-runtime-bridge.js +27 -22
package/openclaw-plugin/package.json +1 -1
package/package.json +1 -1

package/README.md CHANGED Viewed

@@ -51,9 +51,9 @@ Missing installations are absent; failed probes are explicit errors. Login and G
 Codex/Claude Code use a user-selected existing local directory. OpenClaw keeps its existing agent ID and directory; its private session key uses that ID, not Orcha's generated Agent code. Core cannot supply arbitrary launch commands. Every selection and directory is validated before one atomic profile update. Core serializes imports by locking the device credential to prevent duplicate Agents.
-Codex device targets use `exec --skip-git-repo-check --json` so ordinary directories work as well as Git repositories. Existing device profiles created without this flag need their Codex target arguments updated locally and Bridge reloaded; updating the npm package alone does not rewrite saved profiles.
+Codex device targets run `codex app-server`, the Codex surface that asks its client to approve actions; ordinary directories work as well as Git repositories. Profiles saved by Bridge 0.1.52 or earlier with exactly `exec --skip-git-repo-check --json` are rewritten to this launch the next time Bridge loads the device profile, and their saved threads resume unchanged. Customized Codex arguments are left untouched and keep running `codex exec` without approvals until updated locally. Remove this upgrade once connected devices no longer run those profiles.
-Claude Code device targets use `-p --output-format stream-json --verbose` and receive the prompt on stdin. Profiles saved by Bridge 0.1.51 or earlier with exactly `-p --output-format json --no-session-persistence` are rewritten to this launch the next time Bridge loads the device profile; customized Claude arguments are left untouched and must be updated locally if they block native sessions. Remove this upgrade once connected devices no longer run those profiles.
+Claude Code device targets use `-p --output-format stream-json --verbose --include-partial-messages` and receive the prompt on stdin. Profiles saved by Bridge 0.1.51 or earlier with exactly `-p --output-format json --no-session-persistence`, and by 0.1.53 or earlier with exactly `-p --output-format stream-json --verbose`, are rewritten to this launch the next time Bridge loads the device profile; customized Claude arguments are left untouched and must be updated locally if they block native sessions. Remove this upgrade once connected devices no longer run those profiles.
 Targets are namespaced by device code and candidate digest. Chat, group delegation, workflow dispatch and recovery are pinned to that device; an offline or revoked device never falls back to a different computer. External execution uses the local CLI's own permissions, not Orcha's cloud Docker Sandbox.
@@ -82,7 +82,7 @@ Version 0.1.44 routes replies, native `message` tool sends, and background notif
 ```bash
 npm run pack:local
-npm publish ./dist/orcha-ai-runtime-bridge-0.1.52.tgz --access public --registry=https://registry.npmjs.org
+npm publish ./dist/orcha-ai-runtime-bridge-0.1.54.tgz --access public --registry=https://registry.npmjs.org
 ```
 After updating the npm package on a device, run `orcha-runtime-bridge reload --url ...` to switch the existing background process to the installed version. `reload` and `restart` also install/update the bundled plugin for OpenClaw targets saved on that device, using the target's executable and environment. Bridge stops before `openclaw plugins install <bundled-path> --force` and `openclaw gateway restart`; it starts again only after Gateway health succeeds and any configured MCP binding endpoint passes native Channel protocol preflight. Targets sharing an executable and environment update together. Installation/restart/health failures stop the command with an error and leave Bridge stopped; fix the reported problem and rerun `reload`. Package/executable preflight failures leave the existing Bridge running. The earlier manually downloaded foreground process must be stopped before connecting with npm to avoid duplicate connections.
@@ -91,7 +91,7 @@ Installing/updating the npm package alone does not change OpenClaw; run Bridge `
 Native delivery uses `application/x-orcha-channel-events-v2+ndjson` with `heartbeat`, `update`, `result`, and `error` frames. Tool events are restricted to the exact host run and honor hidden-progress flags; reasoning uses only the host's public reply callback without enabling hidden reasoning. Final text and attachments are sent through `POST /api/agent-channels/messages`; terminal frames carry only `messageIds` and status. Core validates the existing receipts and projects execution metadata onto the original reply. Core, Bridge and plugin must upgrade together; old JSON/v1 streams and body-based background completion are incompatible. Skill authors use the native `message` tool with `action: "send"`, `channel: "orcha"`, `accountId` (binding ID), `target` (session ID), and `message`/`media`. Credentials stay in the configured account. Durable queue IDs and native tool idempotency keys are persisted before sending; unknown acknowledgements reconcile through the same idempotent Core endpoint. Core persists updates under the Attempt fence and deduplicates their stable channel IDs before acknowledging them. An active plugin operation keeps at most 16 MiB of replay history; exceeding it fails explicitly. Plugin restarts cannot reconstruct an in-flight host turn and continue to fail with `RUNTIME_OPERATION_NOT_FOUND`. This release requires no database migration or new environment variables.
-Tests cover discovery errors, paths, public-field filtering, immutable commands, exact OpenClaw IDs, atomic configuration, capacity, reconnect, MCP lifecycle and cancellation. The live Codex model test is opt-in; fixtures do not certify a real vendor account or OpenClaw Gateway version.
+Tests cover discovery errors, paths, public-field filtering, immutable commands, exact OpenClaw IDs, atomic configuration, capacity, reconnect, MCP lifecycle and cancellation. The live Codex model test is opt-in (`ORCHA_TEST_REAL_CODEX` set to the installed CLI path) and spends one short turn of the local account; fixtures do not certify a real vendor account or OpenClaw Gateway version.
 To check reply classification against the real SDK without installing or starting a Gateway, extract the official `openclaw@2026.7.1` npm tarball and run `npm run test:openclaw-sdk -- /absolute/path/to/extracted/package`. This check imports the actual SDK functions, covering final text/media, reasoning, commentary, status/progress notices and TTS supplements; it does not replace a live host/model acceptance test.
@@ -117,7 +117,7 @@ Version 0.1.49 fixes Codex ordinary conversation admission in Bridge and disting
 Device Codex accepts Core's existing `session-<id>:<human-member>:<agent-member>:<history-floor>:<policy-revision>` scope for ordinary conversations and `task-<id>:...` for task contexts. All five numeric fields remain strings and must be positive decimal integers. The complete scope is preserved in the native identity, including membership, context reset and policy boundaries. Invalid scope, missing Core address and unsupported sandbox launch produce separate errors. This fixes the previous task-only Bridge check without changing Core's payload, protocol version or stored session mappings. Reload the device Bridge after installing the fix; restarting Core alone does not reload the device process.
-OpenClaw native Channel, device Codex and device Claude Code conversations send only the current message and attachments. Orcha conversation IDs and optional historical task IDs define conversation boundaries; native runtimes own history and compaction. OpenClaw session keys include the Core endpoint, binding revision, chat/task/member and history/policy scope. Codex saves the actual `thread.started.thread_id` under `~/.orcha/codex-sessions/` and uses `codex exec resume <thread-id>` for later turns. The identity also includes the endpoint, Agent, target, workspace and Codex home. It never uses `--last`. Claude Code saves the `session_id` from its `system/init` event under `~/.orcha/claude-sessions/` and uses `claude -p --resume <session-id>`; the identity includes the endpoint, Agent, target, workspace and Claude config directory, and never uses `--continue`. Each turn still has a separate run ID, tool credential and retry fence. Device Codex and Claude Code close their temporary MCP proxy after each turn and open a fresh one for the next.
+OpenClaw native Channel, device Codex and device Claude Code conversations send only the current message and attachments. Orcha conversation IDs and optional historical task IDs define conversation boundaries; native runtimes own history and compaction. OpenClaw session keys include the Core endpoint, binding revision, chat/task/member and history/policy scope. Device Codex saves the thread ID returned by app-server `thread/start` under `~/.orcha/codex-sessions/` and resumes it with `thread/resume`; env-configured `codex exec` targets save `thread.started.thread_id` and use `codex exec resume <thread-id>`. The identity also includes the endpoint, Agent, target, workspace and Codex home. It never uses `--last`. Claude Code saves the `session_id` from its `system/init` event under `~/.orcha/claude-sessions/` and uses `claude -p --resume <session-id>`; the identity includes the endpoint, Agent, target, workspace and Claude config directory, and never uses `--continue`. Each turn still has a separate run ID, tool credential and retry fence. Device Codex and Claude Code close their temporary MCP proxy after each turn and open a fresh one for the next.
 Send exactly `/new` to an Agent to reset context while staying in the current conversation. It creates no model run and is not forwarded to OpenClaw, Codex or Claude Code. Core records a centered “已开始新对话” system notice; existing messages remain visible, while subsequent model context starts after this boundary. The receipt retains the same `sessionId` and task scope with `runId:null`. In a group, select an Agent explicitly; send the command without a quoted message, attachments, plugins or skills. Complete or stop unfinished work in that context before resetting. The existing history boundary in native session keys makes the next OpenClaw/Codex/Claude Code turn start a fresh native conversation. Other raw commands, such as `/status`, reach OpenClaw and remain subject to its own command permissions.
@@ -129,11 +129,30 @@ Codex and Claude Code support task-scoped Orcha MCP through the same local trans
 ### Claude Code native IM turns (0.1.52)
-Device Claude Code now follows the same IM model as device Codex: Core sends only the current message, Bridge resumes the scoped native session, and conversation and delegated turns receive the task's Orcha MCP tools, including `send_file`. The MCP proxy is passed with `--mcp-config`; argv contains only the loopback URL and an `${ORCHA_TASK_MCP_TOKEN}` header placeholder that Claude Code expands from the child environment. `--allowedTools mcp__orcha` lets the Core-authorized task tools run without a local prompt; other Claude tools keep the device's own permission settings, and print mode denies anything that would prompt. Claude Code continues without an unreachable MCP server, so Bridge stops the turn with `RUNTIME_CLAUDE_MCP_UNAVAILABLE` when `system/init` does not report `orcha` as connected; the native session is not advanced.
+Device Claude Code now follows the same IM model as device Codex: Core sends only the current message, Bridge resumes the scoped native session, and conversation and delegated turns receive the task's Orcha MCP tools, including `send_file`. The MCP proxy is passed with `--mcp-config`; argv contains only the loopback URL and an `${ORCHA_TASK_MCP_TOKEN}` header placeholder that Claude Code expands from the child environment. `--allowedTools mcp__orcha` lets the Core-authorized task tools run without a local prompt; other Claude tools keep the device's own permission settings, and since 0.1.53 anything those settings would prompt for goes to the Orcha user (see [Device approvals](#device-approvals-0153)). Claude Code continues without an unreachable MCP server, so Bridge stops the turn with `RUNTIME_CLAUDE_MCP_UNAVAILABLE` when `system/init` does not report `orcha` as connected; the native session is not advanced.
-`stream-json` events become the existing Orcha progress updates: top-level `tool_use`/`tool_result` blocks map to `tool_call`/`tool_call_update`, text before a tool call becomes process commentary, and the `result` event remains the only final reply. Subagent internals stay inside their parent tool call, tool result images are reduced to their text, and thinking blocks are not forwarded. The `generated_images` delivery root remains Codex-only; Claude deliverables must be in the workspace or a configured artifact root.
+`stream-json` events become the existing Orcha progress updates: top-level `tool_use`/`tool_result` blocks map to `tool_call`/`tool_call_update`, text before a tool call becomes process commentary, and the `result` event remains the authoritative final reply. Since 0.1.54 the reply streams while Claude writes it (see [Claude Code streaming replies](#claude-code-streaming-replies-0154)). Subagent internals stay inside their parent tool call, tool result images are reduced to their text, and thinking blocks are not forwarded. The `generated_images` delivery root remains Codex-only; Claude deliverables must be in the workspace or a configured artifact root.
-Rollout requires Core with this change, then the updated and reloaded device Bridge. There is no database migration, protocol-version change or new project environment variable. Old Orcha history is not injected into Claude Code. The fixture tests use a fake Claude CLI over a real HTTP MCP endpoint; a real Claude account/model turn has not been accepted yet.
+Rollout requires Core with this change, then the updated and reloaded device Bridge. There is no database migration, protocol-version change or new project environment variable. Old Orcha history is not injected into Claude Code. The fixture tests use a fake Claude CLI over a real HTTP MCP endpoint; a real Claude turn was accepted with 0.1.53 (see [Device approvals](#device-approvals-0153)).
+### Claude Code streaming replies (0.1.54)
+Without partial messages Claude Code prints each assistant message only after it is complete, so a long answer left the Orcha reply empty until the turn ended. Bridge now launches Claude Code with `--include-partial-messages`. Top-level `text_delta` events stream as `agent_message_chunk`. When a `tool_use` block starts after streamed text, that text was commentary: Bridge clears the reply with an empty `agent_message_snapshot` and re-emits the text as `agent_thought_chunk`. The `result` event adds nothing when it matches the streamed text and otherwise replaces it with an `agent_message_snapshot`. Thinking, tool input deltas and subagent stream events are not forwarded; thinking time still shows no text. Prompts that ask for final text only, and customized launches without the flag, keep whole-message progress.
+Core folds `agent_message_snapshot` into the stored reply with the same replace semantics as its live `message_replace` projection; earlier Core versions ignored snapshots there and would store withdrawn commentary in the reply. Rollout: deploy Core first, then install and reload Bridge 0.1.54 on devices. There is no database migration, protocol-version change or new project environment variable. Acceptance so far covers the fixture tests with a fake Claude CLI; a real streamed Claude turn on a connected device has not been accepted yet.
+### Device approvals (0.1.53)
+Device Codex and Claude Code keep deciding locally which actions need confirmation; Bridge only changes who answers. Instead of an automatic denial, a request the device's own settings would prompt for reaches the user who started the Orcha turn, as a confirmation above the chat input. The native process waits in place and continues the same turn as soon as the user approves or denies. Nothing relaxes or rewrites local permission configuration.
+- **Claude Code** receives `--permission-prompt-tool mcp__orcha__permission_prompt`, a local tool on the task MCP proxy. It answers `{"behavior":"allow","updatedInput":...}` with the original input, or `{"behavior":"deny","message":...}`. Claude abandons an HTTP MCP call after five idle minutes, so its wait is capped at 270 seconds.
+- **Codex** runs `codex app-server` over stdio JSON-RPC (one process per turn, like `exec`). `item/commandExecution/requestApproval`, `item/fileChange/requestApproval` and `item/permissions/requestApproval` go to the user and are answered `accept` (or the requested permissions for this turn) or `decline`. MCP approval elicitations from the `orcha` server are accepted because Core already authorized the task tools; elicitations from other servers are declined, and `item/tool/requestUserInput` is not supported yet. The task MCP `-c` override is passed after the subcommand because app-server drops top-level overrides once it receives its own. A failed `orcha` MCP startup ends the turn with `RUNTIME_CODEX_MCP_UNAVAILABLE`.
+- **Bridge contract**: a `permission_request` update carries `permission.request = {runtime, kind, title, command?, cwd?, paths?, toolName?, input}` with `kind` one of `command`, `file_change`, `permission`, `other`, plus `expiresAt`. Every ending emits `permission_resolved` with `outcome` `approved`, `denied`, `expired` (wait timeout) or `cancelled` (the native turn ended first). `permissions/respond` delivers the user's decision. The wait uses `ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS` (300 seconds by default). Delegated group-member turns never wait and are denied, as before. ACP permission requests keep their existing handling.
+- **Core** shows only requests whose `runtime` is `claude` or `codex`. It persists each one as a `ChatToolCall` with `tool_code = external_agent_permission` and `external_call_id = permissionId`, and reuses the confirmation Interaction. Only the turn's initiator can answer. A decision never converges or resumes the ChatRun, because the process is still running. Approvals left open when the turn ends are withdrawn, and an answer that arrives after Bridge stopped waiting is recorded as expired.
+Rollout: deploy Core first, then install and reload Bridge 0.1.53 on devices. An older Core ignores the requests, and the device action is denied when the wait expires. There is no database migration, protocol-version change or new project environment variable.
+Acceptance on 2026-10-08: Bridge checks/tests/build and the PostgreSQL approval lifecycle test pass. One real turn each ran with local Claude Code 2.1.287 and, through the opt-in test, codex-cli 0.160.1. Claude ran the approved command and never ran the denied one. Codex called the Orcha task tool, uploaded a file through `send_file`, and ran a read-only-sandbox escalation only after approval. Multi-turn resumed conversations, group delegation and the live web confirmation have not been accepted on a real device yet.
 ### Codex file delivery (0.1.51)
@@ -145,7 +164,7 @@ For these tool-enabled turns, legacy image-generation events no longer publish i
 Rollout requires the updated Core endpoint, then an updated and reloaded device Bridge. There is no database migration, protocol-version change or new project environment variable. This source change has not been published to npm or deployed; historical empty attachment messages are not backfilled.
-Acceptance on 2026-10-02: Bridge checks/tests/build and the PostgreSQL/Redis file/channel/MCP tests pass. The opt-in installed-Codex test now checks discovery plus an actual file upload to an isolated local fixture. With local `codex-cli 0.153.4`, discovery and `send_file` both stop before invocation with `MCP tool call requires approval, but approval policy is never`. End-to-end model delivery remains unverified, so local service restart was skipped under the repository's failed-validation rule. No host approval policy was changed. Resolve the device's approved MCP policy or implement a supported approval interaction before production acceptance; do not treat this as successful delivery. Codex supports server/tool approval settings in its [official configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference).
+Acceptance on 2026-10-02: Bridge checks/tests/build and the PostgreSQL/Redis file/channel/MCP tests pass. The opt-in installed-Codex test now checks discovery plus an actual file upload to an isolated local fixture. With local `codex-cli 0.153.4`, discovery and `send_file` both stop before invocation with `MCP tool call requires approval, but approval policy is never`. End-to-end model delivery remains unverified, so local service restart was skipped under the repository's failed-validation rule. No host approval policy was changed. Resolve the device's approved MCP policy or implement a supported approval interaction before production acceptance; do not treat this as successful delivery. Codex supports server/tool approval settings in its [official configuration reference](https://learn.chatgpt.com/docs/config-file/config-reference). Resolved for device Codex in 0.1.53: app-server routes Orcha task-tool approvals to Bridge, which accepts them for the Core-authorized task.
 For OpenClaw, install the built plugin, set `plugins.entries.orcha-runtime.enabled` to `true` and its `config.allowedOrchaMcpUrl` to the Orcha MCP URL. Preserve existing plugins and allowlists, permit the `orcha_` tools for the local Agent, then follow the host version's plugin reload procedure:

package/bin/orcha-runtime-bridge.js CHANGED Viewed

@@ -1,31 +1,36 @@
 #!/usr/bin/env node
-import{spawn as xc}from"node:child_process";import{closeSync as Nc,existsSync as Ar,mkdirSync as bc,openSync as Mc,readFileSync as Or,rmSync as Uc,statSync as ms,writeFileSync as Ts}from"node:fs";import{dirname as Es,resolve as _t}from"node:path";import{fileURLToPath as Pc}from"node:url";import{createHash as Dr}from"node:crypto";import{mkdir as vs,readFile as Ds,writeFile as Hs,rename as $s}from"node:fs/promises";import{join as vr}from"node:path";import{homedir as Fs,hostname as Bs}from"node:os";import{execFile as bs}from"node:child_process";import{access as Ms,realpath as Us}from"node:fs/promises";import{constants as Ps}from"node:fs";import{delimiter as Ls,join as Pr,isAbsolute as Lr}from"node:path";import{homedir as Ur}from"node:os";async function ge(e,t=process.env){let r=process.platform==="win32"?[".exe",".cmd",".bat",""]:[""];for(let n of(t.PATH||"").split(Ls).filter(Lr))for(let s of r){let i=Pr(n,`${e}${s}`);try{return await Ms(i,Ps.X_OK),i}catch{}}return null}function ks(e,t){return new Promise(r=>bs(e,t,{timeout:8e3,maxBuffer:1024*1024,windowsHide:!0},(n,s)=>r({code:n?n.code:0,stdout:String(s||"")})))}async function _e(e){let t=e==="~"?Ur():e.startsWith("~/")?Pr(Ur(),e.slice(2)):e;if(!Lr(t))throw new Error("\u5DE5\u4F5C\u76EE\u5F55\u5FC5\u987B\u662F\u8BBE\u5907\u4E0A\u7684\u7EDD\u5BF9\u8DEF\u5F84\u6216 ~/ \u5F00\u5934\u7684\u8DEF\u5F84");let r=await Us(t),{stat:n}=await import("node:fs/promises");if(!(await n(r)).isDirectory())throw new Error("\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u662F\u6587\u4EF6\u5939");return r}async function kr({find:e=ge,run:t=ks,cwd:r=process.cwd()}={}){return(await Promise.all(["codex","claude","openclaw"].map(async s=>{let i=await e(s);if(!i)return[];let o={codex:"Codex",claude:"Claude Code",openclaw:"OpenClaw"}[s],a=await t(i,["--version"]),u=a.code===0&&a.stdout.match(/\d+\.\d+\.\d+[^\s]*/)?.[0]||"",d={id:s,name:o,framework:s,version:u,workspace:r,managed:!1};if(a.code!==0)return[{...d,status:"error",message:"\u7A0B\u5E8F\u65E0\u6CD5\u542F\u52A8\uFF0C\u8BF7\u5728\u672C\u673A\u68C0\u67E5\u5B89\u88C5"}];if(s==="openclaw"){let p=await t(i,["agents","list","--json"]),m;try{m=JSON.parse(p.stdout)}catch{}if(p.code!==0||!Array.isArray(m))return[{...d,status:"error",message:"\u65E0\u6CD5\u8BFB\u53D6 OpenClaw \u667A\u80FD\u4F53\uFF0C\u8BF7\u68C0\u67E5\u672C\u673A\u914D\u7F6E"}];let y=await t(i,["health","--json"]);return m.filter(w=>typeof w.id=="string"&&typeof w.workspace=="string").slice(0,32).map(w=>({...d,id:`openclaw:${w.id}`,name:w.name||w.identityName||w.id,workspace:w.workspace,managed:!0,localAgentId:w.id,command:i,status:y.code===0?"ready":"needs_setup",message:y.code===0?"":"\u8BF7\u5148\u5728\u672C\u673A\u542F\u52A8\u5E76\u914D\u7F6E OpenClaw Gateway"}))}let f=await t(i,s==="codex"?["login","status"]:["auth","status"]),h=f.code===0?"ready":f.code===1?"needs_login":"error";return[{...d,command:i,status:h,message:h==="needs_login"?`\u8BF7\u5728\u672C\u673A\u8FD0\u884C ${s} ${s==="codex"?"login":"auth login"}`:h==="error"?"\u767B\u5F55\u72B6\u6001\u68C0\u6D4B\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5 CLI \u7248\u672C":""}]}))).flat()}var Hr={terminalProtocol:"claude",args:["-p","--output-format","stream-json","--verbose"],promptMode:"stdin",outputMode:"json-lines"},js=JSON.stringify(["-p","--output-format","json","--no-session-persistence"]);async function ye(e,t){let r=`${e}.${process.pid}.tmp`;await Hs(r,JSON.stringify(t),{mode:384}),await $s(r,e)}function Te(e){let t=new URL(e);if(t.username||t.password||t.search||t.hash||t.protocol!=="https:"&&!(t.protocol==="http:"&&["localhost","127.0.0.1","[::1]"].includes(t.hostname)))throw new Error("\u8FDE\u63A5\u5730\u5740\u5FC5\u987B\u4F7F\u7528 HTTPS\uFF1B\u4EC5\u672C\u673A\u5F00\u53D1\u5141\u8BB8 HTTP");let r=vr(Fs(),".orcha","devices"),n=vr(r,Dr("sha256").update(t.toString()).digest("hex").slice(0,20));return{address:t,root:r,profile:`${n}.json`,pidFile:`${n}.pid`,logFile:`${n}.log`}}async function Ut(e,{url:t,pairCode:r}){let{address:n,root:s,profile:i}=Te(t||e.orchaUrl);await vs(s,{recursive:!0,mode:448});let o;if(r){let a=await fetch(new URL("api/agent-devices/pairings/exchange",`${n.toString().replace(/\/+$/,"")}/`),{method:"POST",redirect:"error",headers:{"content-type":"application/json"},signal:AbortSignal.timeout(15e3),body:JSON.stringify({code:r,name:Bs()})}),u=await a.json();if(!a.ok||!u.success)throw new Error(u.message||u.detail||"\u8BBE\u5907\u8FDE\u63A5\u5931\u8D25");o={...u.data,targets:{}},await ye(i,o)}else{try{o=JSON.parse(await Ds(i,"utf8"))}catch{throw new Error("\u6CA1\u6709\u5DF2\u8FDE\u63A5\u8BBE\u5907\uFF0C\u8BF7\u4ECE\u667A\u80FD\u4F53\u9875\u9762\u751F\u6210\u8FDE\u63A5\u7801")}let a=Object.values(o.targets||{}).filter(u=>u.terminalProtocol==="claude"&&u.promptMode==="args"&&JSON.stringify(u.args)===js);for(let u of a)Object.assign(u,structuredClone(Hr));a.length&&await ye(i,o)}e.orchaUrl=n.toString().replace(/\/+$/,""),e.mode="node",e.nodeId=o.nodeCode,e.nodeName=o.nodeName,e.nodeToken=o.token,e.targets=o.targets,e.defaultTargetCode="",e.deviceConnection=new we(e,o,async()=>ye(i,o))}var we=class{constructor(t,r,n,s=kr){this.config=t,this.profile=r,this.persist=n,this.discover=s}async candidates(){return{candidates:(await this.discover()).map(({command:r,localAgentId:n,...s})=>s)}}async configure(t,r){if(!Array.isArray(t.selections)||!t.selections.length||t.selections.length>32)throw new Error("\u6DFB\u52A0\u9879\u65E0\u6548");let n=new Map((await this.discover()).map(u=>[u.id,u])),s={...r.targets},i=[],o=new Set;for(let u of t.selections){let d=n.get(u.candidateId);if(!d||d.status!=="ready"||o.has(d.id))throw new Error("\u53D1\u73B0\u7ED3\u679C\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u68C0\u6D4B");o.add(d.id);let f=String(u.name||"").trim();if(!f||f.length>128)throw new Error("\u667A\u80FD\u4F53\u540D\u79F0\u65E0\u6548");let h=await _e(String(u.workspace||""));if(d.managed&&h!==await _e(d.workspace))throw new Error("\u5DF2\u6709\u667A\u80FD\u4F53\u5FC5\u987B\u6CBF\u7528\u672C\u673A\u5DE5\u4F5C\u76EE\u5F55");let p=`${this.config.nodeId}:${Dr("sha256").update(d.id).digest("hex").slice(0,20)}`;if([...r.sessions.values()].some(m=>m.targetCode===p))throw new Error("\u6B64\u667A\u80FD\u4F53\u4ECD\u6709\u4F1A\u8BDD\uFF0C\u8BF7\u5148\u7ED3\u675F\u4F1A\u8BDD\u518D\u4FEE\u6539\u63A5\u5165");s[p]={name:f,workspace:h,command:d.command,type:d.managed?"openclaw":"cli",...d.managed?{openclawAgentId:d.localAgentId}:d.framework==="codex"?{terminalProtocol:"codex",args:["exec","--skip-git-repo-check","--json"],promptMode:"stdin",outputMode:"json-lines",captureLastMessage:!0}:structuredClone(Hr)},i.push({candidateId:d.id,name:f,workspace:h,targetCode:p,framework:d.framework})}let a=this.profile.targets;this.profile.targets=s;try{await this.persist()}catch(u){throw this.profile.targets=a,u}return r.targets=s,this.config.targets=s,r.notifyCapacityChanged(),{agents:i}}};import{execFile as ri}from"node:child_process";import{constants as ni}from"node:fs";import{access as Vr,readFile as Jr,realpath as si}from"node:fs/promises";import{join as Ee}from"node:path";import{promisify as ii}from"node:util";var W="0.1.52";function Et(){return new Date().toISOString()}function L(e,t=2){return String(e).padStart(t,"0")}function $r(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${L(Math.floor(r/60))}:${L(r%60)}`}function qs(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${L(e.getMonth()+1)}-${L(e.getDate())}`,`T${L(e.getHours())}:${L(e.getMinutes())}:${L(e.getSeconds())}.${L(e.getMilliseconds(),3)}`,$r(t)].join("")}function Gs(e,t){let r=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),n={};for(let s of r.formatToParts(e))s.type!=="literal"&&(n[s.type]=Number(s.value));return n}function Ks(e,t){let r=Gs(e,t),n=Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second,e.getMilliseconds()),s=Math.round((n-e.getTime())/6e4);return[`${r.year}-${L(r.month)}-${L(r.day)}`,`T${L(r.hour)}:${L(r.minute)}:${L(r.second)}.${L(e.getMilliseconds(),3)}`,$r(s)].join("")}function zs(e=new Date){let t=c(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return Ks(e,t)}catch{return qs(e)}}function l(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function c(e){return String(e??"").trim()}function S(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)?r:t}function b(e){return Array.isArray(e)?e.map(String):[]}function rt(e,t,r=process.cwd()){let n=l(e)?e:{};return c(n.cwd)||c(n.workspace)||c(t)||c(r)||process.cwd()}var Pt="[redacted]",Vs=/(authorization|api[_-]?key|credential|password|secret|token)/i;function J(e){return Vs.test(c(e))}function nt(e,t=[]){let r=String(e??"");for(let n of t){let s=String(n??"");s.length>=4&&(r=r.split(s).join(Pt))}return r.replace(/((?:authorization|api[_-]?key|credential|password|secret|token)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi,`$1${Pt}`).replace(/([?&](?:api[_-]?key|credential|password|secret|token)=)[^&\s]+/gi,`$1${Pt}`)}function et(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=et(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>et(i,t));return t.delete(e),s}let r={},n=J(e.name||e.key);for(let[s,i]of Object.entries(e))r[s]=J(s)||n&&s.toLowerCase()==="value"?Pt:et(i,t);return t.delete(e),r}function Fr(e,t=4e3){let r=JSON.stringify(et(e))??String(e);return!Number.isFinite(t)||r.length<=t?r:`${r.slice(0,t)}...`}function g(e,t,r,n={}){let s={ts:zs(),level:e,module:t,msg:r,...l(n)?et(n):{}};console.error(JSON.stringify(s))}var st="application/x-orcha-channel-events-v2+ndjson";function P(e,t){return Object.assign(new Error(t||(["run_timeout","RUNTIME_NODE_TIMEOUT"].includes(e)?"OpenClaw \u539F\u751F IM \u6267\u884C\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002":e==="OPENCLAW_CHANNEL_PROTOCOL_MISMATCH"?"OpenClaw \u63D2\u4EF6\u4E0E Bridge \u7684\u539F\u751F IM \u534F\u8BAE\u4E0D\u517C\u5BB9\uFF0C\u8BF7\u914D\u5957\u5347\u7EA7\u3002":`OpenClaw \u539F\u751F IM \u6267\u884C\u5931\u8D25\uFF08${e}\uFF09`)),{code:e})}function Br(e,t){let r=e.cause?.code||e.code;return t?.reason?.name==="TimeoutError"||e.name==="TimeoutError"||["UND_ERR_HEADERS_TIMEOUT","UND_ERR_BODY_TIMEOUT","UND_ERR_CONNECT_TIMEOUT","ETIMEDOUT"].includes(r)?Object.assign(P("RUNTIME_NODE_TIMEOUT","OpenClaw \u8FDE\u63A5\u6216\u7B49\u5F85\u54CD\u5E94\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002"),{detail:{causeCode:r||"REQUEST_TIMEOUT"}}):e}async function jr(e,t){if(e.headers.get("content-type")!==st)throw await e.body?.cancel(),P("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");let r=Buffer.alloc(0);for await(let n of e.body){r=Buffer.concat([r,n]);let s;for(;(s=r.indexOf(10))>=0;){if(s>2097152)throw P("OPENCLAW_CHANNEL_FRAME_TOO_LARGE");let i=r.subarray(0,s).toString("utf8");r=r.subarray(s+1);let o;try{o=JSON.parse(i)}catch{throw P("OPENCLAW_CHANNEL_INVALID_FRAME")}if(o.type!=="heartbeat")if(o.type==="update"&&o.payload?.update&&o.payload?._meta?.channelUpdateId)await t(o.payload);else{if(o.type==="result"&&o.result?.stopReason)return o.result;throw o.type==="error"&&typeof o.code=="string"?P(o.code):P("OPENCLAW_CHANNEL_INVALID_FRAME")}}if(r.length>2097152)throw P("OPENCLAW_CHANNEL_FRAME_TOO_LARGE")}throw P("OPENCLAW_CHANNEL_STREAM_INTERRUPTED","OpenClaw \u8FC7\u7A0B\u8FDE\u63A5\u4E2D\u65AD\uFF0C\u672A\u6536\u5230\u4EFB\u52A1\u7EC8\u6001\uFF0C\u8BF7\u68C0\u67E5\u8282\u70B9\u8FDE\u63A5\u540E\u91CD\u8BD5\u3002")}import{createServer as Ws}from"node:http";import{randomBytes as Xs}from"node:crypto";var Lt={controlTools:["find_capabilities_and_skills","describe_capability","inspect_result","execute_capability"],residentTools:["search_orcha_docs","knowledge_search"]};var Ys=Object.freeze([...Lt.controlTools,...Lt.residentTools]),Qs=new Set(Ys),Zs=8*1024*1024;function kt(e,t){if(!Array.isArray(e)||e.length!==1)throw new Error("one task-scoped Orcha MCP server is required");let r=e[0],n=new URL(r.url);if(r.name!=="orcha"||r.type!=="http"||!["http:","https:"].includes(n.protocol)||n.username||n.password||n.hash||t&&n.href!==new URL(t).href)throw new Error("Orcha MCP server does not match the trusted binding");let s=Object.fromEntries((r.headers||[]).map(({name:i,value:o})=>[i.toLowerCase(),o]));if(!String(s.authorization||"").startsWith("Bearer "))throw new Error("Orcha MCP task credentials are missing");return{url:n.href,headers:{...s,"content-type":"application/json",accept:"application/json"}}}async function Gr(e){let t=0,r=[];for await(let n of e){if(t+=n.length,t>Zs)throw new Error("MCP payload exceeds the size limit");r.push(Buffer.from(n))}return JSON.parse(Buffer.concat(r).toString("utf8"))}async function Kr(e,t,r){let n=await fetch(e.url,{method:"POST",headers:e.headers,body:JSON.stringify(t),redirect:"error",signal:AbortSignal.any([AbortSignal.timeout(36e5),...r?[r]:[]])});if(!n.ok)throw new Error(`Orcha MCP request failed (${n.status})`);if(n.status===202||n.status===204)return null;let s=await Gr(n.body);if(!s||s.jsonrpc!=="2.0"||s.id!==t.id)throw new Error("Orcha MCP response identity mismatch");return s}async function qr(e,t){let r=await Kr(e,{jsonrpc:"2.0",id:"orcha-bind-tools",method:"tools/list"},t),n=r?.result?.tools;if(r?.error){let s=Object.entries(e.headers).filter(([a])=>J(a)).flatMap(([,a])=>[a,String(a).replace(/^Bearer\s+/i,"")]),i=typeof r.error.message=="string"?nt(r.error.message,s).slice(0,512):"",o=Number.isInteger(r.error.code)?` (${r.error.code})`:"";throw new Error(`Orcha MCP tool discovery failed${o}${i?`: ${i}`:""}`)}return ti(n)}function ti(e){if(!Array.isArray(e)||e.some(t=>!t||!Qs.has(t.name)||t.inputSchema?.type!=="object"||typeof t.description!="string")||new Set(e.map(t=>t.name)).size!==e.length||e.length&&Lt.controlTools.some(t=>!e.some(r=>r.name===t)))throw new Error("Orcha MCP returned an unsupported or invalid authorized tool catalog");return e}function ei(e,t){let r=s=>Array.isArray(s)?s.map(r):s&&typeof s=="object"?Object.fromEntries(Object.keys(s).sort().map(i=>[i,r(s[i])])):s,n=s=>s.map(({name:i,inputSchema:o})=>({name:i,inputSchema:o})).sort((i,o)=>i.name.localeCompare(o.name));return JSON.stringify(r(n(e)))===JSON.stringify(r(n(t)))}async function zr(e,t=[]){let r=kt(e),n=new AbortController,s=await qr(r,n.signal);if(t.some(a=>s.some(u=>u.name===a.name)))throw new Error("Local and remote MCP tools conflict");let i=Xs(32).toString("hex"),o=Ws(async(a,u)=>{if(a.url!=="/mcp"||a.headers.authorization!==`Bearer ${i}`){u.writeHead(403).end();return}if(a.method!=="POST"){u.writeHead(405).end();return}try{let d=await Gr(a);if(!d||d.jsonrpc!=="2.0"||typeof d.method!="string")throw new Error("Invalid MCP request");let f=d.method==="tools/call"&&t.find(p=>p.name===d.params?.name);if(d.method==="tools/call"&&!f&&!s.some(p=>p.name===d.params?.name))throw new Error("Tool is not authorized in this task binding");let h;if(f)try{h={jsonrpc:"2.0",id:d.id,result:await f.call(d.params.arguments,{upstream:r,signal:n.signal})}}catch(p){h={jsonrpc:"2.0",id:d.id,result:{isError:!0,content:[{type:"text",text:nt(String(p.message),[r.headers.authorization,i])}]}}}else h=await Kr(r,d,n.signal),d.method==="tools/list"&&h?.result?.tools&&h.result.tools.push(...t.map(({call:p,...m})=>m));u.writeHead(h===null?202:200,{"content-type":"application/json"}),u.end(h===null?"":JSON.stringify(h))}catch{u.writeHead(502,{"content-type":"application/json"}).end(JSON.stringify({error:"The task-scoped Orcha MCP connection failed"}))}});return await new Promise((a,u)=>{o.once("error",u),o.listen(0,"127.0.0.1",a)}),{url:`http://127.0.0.1:${o.address().port}/mcp`,token:i,async refresh(a){let u=kt(a,r.url);if(!ei(s,await qr(u,n.signal)))throw new Error("The frozen MCP tool catalog changed; start a new task");r=u},async close(){n.abort(),o.closeAllConnections(),await new Promise(a=>o.close(a))}}}var X=class{constructor(t,r){this.target=t,this.identity=r,this.bound=!1}async request(t,r,n=!1,s="mcp-bindings",i=3e4,o=null){let a=c(this.target.mcpBridgeUrl),u=c(this.target.mcpBridgeTokenEnv),d=this.target.env?.[u]||process.env[u];if(!a||!u||!d)throw Object.assign(new Error("OpenClaw requires the Orcha tool plugin, mcpBridgeUrl and mcpBridgeTokenEnv"),{code:"OPENCLAW_MCP_NOT_CONFIGURED"});let f=new URL(a);if(!["http:","https:"].includes(f.protocol)||f.username||f.password||f.pathname!=="/plugins/orcha-runtime/mcp-bindings"||f.search||f.hash)throw new Error("OpenClaw MCP binding URL must be the trusted Gateway plugin route");if(!["mcp-bindings","deliveries","background"].includes(s))throw new Error("Unsupported Orcha plugin route");f.pathname=`/plugins/orcha-runtime/${s}`;let h=AbortSignal.timeout(i);try{let p=await fetch(f,{method:t,redirect:"error",signal:h,headers:{authorization:`Bearer ${d}`,"content-type":"application/json",...o?{accept:st}:{},...n?{"if-match":this.identity.runId}:{}},...r!==void 0?{body:JSON.stringify(r)}:{}});if(t==="GET"&&s==="deliveries"&&[404,405].includes(p.status))throw await p.body?.cancel(),P("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");if(p.ok&&o)return await jr(p,o);let m=await p.json();if(!p.ok)throw P(m.error||"OPENCLAW_MCP_BINDING_FAILED");return m}catch(p){throw Br(p,h)}}async bind(t,r=!1){kt(t),await this.request("PUT",{...this.identity,mcpServer:t[0]},r),this.bound=!0}async close(){this.bound&&(await this.request("DELETE",{runId:this.identity.runId,sessionKey:this.identity.sessionKey}),this.bound=!1)}};var oi=ii(ri),ai=12e4;async function Wr(e,t){let r=new Map,n=[];for(let s of Object.values(e)){if(s.type!=="openclaw")continue;if(s.mcpBridgeUrl&&(n.push(s),!["localhost","127.0.0.1","[::1]"].includes(new URL(s.mcpBridgeUrl).hostname))){process.stderr.write(`\u8FDC\u7A0B OpenClaw Gateway \u7684\u914D\u5957\u63D2\u4EF6\u9700\u5728\u6240\u5728\u4E3B\u673A\u66F4\u65B0\uFF1Breload \u5C06\u68C0\u67E5\u5176\u534F\u8BAE\u3002
-`);continue}let i={...process.env,...s.env},o=c(s.command)||"openclaw",a=o.includes("/")?o:await ge(o,i);if(!a)throw new Error("\u627E\u4E0D\u5230\u5DF2\u63A5\u5165\u7684 OpenClaw\uFF0C\u8BF7\u68C0\u67E5\u672C\u673A\u5B89\u88C5\u540E\u91CD\u8BD5 reload");let u=await si(a);await Vr(u,ni.X_OK);let d=JSON.stringify([u,Object.entries(i).sort(([f],[h])=>f.localeCompare(h))]);r.has(d)||r.set(d,{command:u,env:i})}if(r.size)try{let s=JSON.parse(await Jr(Ee(t,"openclaw.plugin.json"),"utf8")),i=JSON.parse(await Jr(Ee(t,"package.json"),"utf8"));if(await Vr(Ee(t,"index.js")),s.id!=="orcha-runtime"||i.version!==W)throw new Error("\u63D2\u4EF6\u6807\u8BC6\u6216\u7248\u672C\u4E0D\u5339\u914D")}catch(s){throw new Error("\u914D\u5957 OpenClaw \u63D2\u4EF6\u7F3A\u5931\u3001\u635F\u574F\u6216\u7248\u672C\u4E0D\u4E00\u81F4\uFF0C\u8BF7\u91CD\u65B0\u5B89\u88C5 Bridge\uFF1B\u6E90\u7801\u8FD0\u884C\u8BF7\u5148 npm run build",{cause:s})}return async()=>{for(let s of r.values()){process.stderr.write(`\u6B63\u5728\u5B89\u88C5\u914D\u5957 OpenClaw \u63D2\u4EF6\u5E76\u91CD\u542F Gateway\u2026
-`),await Se(s,["plugins","install",t,"--force"]),await Se(s,["gateway","restart"]);let i=await Se(s,["health","--json"]);if(JSON.parse(i).ok!==!0)throw new Error("OpenClaw Gateway \u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0CBridge \u672A\u542F\u52A8\uFF0C\u8BF7\u4FEE\u590D\u540E\u91CD\u8BD5 reload");process.stderr.write(`OpenClaw \u914D\u5957\u63D2\u4EF6\u5DF2\u66F4\u65B0\uFF0CGateway \u5065\u5EB7\u68C0\u67E5\u901A\u8FC7\u3002
-`)}for(let s of n)if((await new X(s,{}).request("GET",void 0,!1,"deliveries")).streamType!==st)throw P("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH")}}async function Se(e,t){try{let{stdout:r}=await oi(e.command,t,{env:e.env,timeout:ai,killSignal:"SIGKILL",maxBuffer:1048576,windowsHide:!0});return r}catch(r){let n=Object.entries(e.env).filter(([i])=>J(i)).map(([,i])=>i),s=nt(r.stderr||r.message,n).trim();throw new Error(`OpenClaw ${t.slice(0,2).join(" ")} \u5931\u8D25\uFF0CBridge \u672A\u542F\u52A8\uFF0C\u8BF7\u4FEE\u590D\u540E\u91CD\u8BD5 reload\uFF1A${s}`)}}import{createHash as ka,randomUUID as se}from"node:crypto";function vt(e){return Array.isArray(e)?e.map(t=>l(t)?t.type==="text"?c(t.text):t.type==="file"?c(t.uri):t.type==="image"?c(t.uri):"":"").filter(Boolean).join(`
-`):""}var Dt=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,r){let n=vt(t.prompt);return r({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as ci}from"node:child_process";var St="2.0",Re=3e4,ui=4e3;function Ht(e,t){let r=Object.entries(l(t)?t:{}).filter(([n])=>J(n)).map(([,n])=>n);return nt(e,r)}function li(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,message:c(e?.message)||String(e),data:l(e?.data)?e.data:void 0}}function di(e){if(!l(e))return new Error(String(e||"runtime error"));let t=c(e.message)||"runtime error",r="data"in e?Fr(e.data,4e3):"",n=new Error(r?`${t}; data=${r}`:t);return n.rpcCode=e.code,n.data=e.data,n}function fi(e){return l(e)&&"id"in e&&!("method"in e)}function pi(e){return l(e)&&typeof e.method=="string"&&"id"in e}function hi(e){return l(e)&&typeof e.method=="string"&&!("id"in e)}var $t=class{constructor({command:t,args:r=[],cwd:n,env:s,label:i,framing:o="line",detached:a=!0}){this.command=t,this.args=Array.isArray(r)?r.map(String):[],this.cwd=n||process.cwd(),this.env=l(s)?{...s}:{...process.env},this.label=i||t,this.framing=o==="content-length"?"content-length":"line",this.detached=a!==!1,this.child=null,this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stopPromise=null,this.stderrTail="",this.spawnError=null,this.lineBuffer="",this.headerBuffer=Buffer.alloc(0),this.seq=0,this.pending=new Map,this.notificationHandlers=new Map,this.requestHandlers=new Map,this.exitHandlers=new Set}async start({initialize:t=!0,initializeParams:r={},initializeTimeoutMs:n=Re}={}){if(!(this.child&&!this.exited)&&(this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stderrTail="",this.spawnError=null,this.child=ci(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"],detached:this.detached}),this.child.stdout.on("data",s=>this.onStdout(s)),this.child.stderr.setEncoding("utf8"),this.child.stderr.on("data",s=>{this.stderrTail=`${this.stderrTail}${s}`.slice(-ui);let i=Ht(s.trimEnd(),this.env);i&&g("debug","runtime.stderr","runtime stderr",{target:this.label,text:i})}),this.child.on("exit",(s,i)=>this.handleExit(s,i)),this.child.on("error",s=>{this.spawnError=s,this.rejectAll(s)}),t)){let s=Math.max(1,S(n,Re));try{await this.call("initialize",{protocolVersion:1,clientCapabilities:{},...r},s)}catch(i){let o=this.startupFailureDetail(),a=Ht(i?.message||i,this.env);g("warn","runtime.initialize","runtime initialize failed",{target:this.label,timeoutMs:s,cause:a,...o}),await this.stop("initialize failed",{termTimeoutMs:1e3,killTimeoutMs:1e3});let u=o.stderr?`; stderr: ${o.stderr}`:`; command=${o.command}; cwd=${o.cwd}`;throw Object.assign(new Error(`runtime initialize failed: ${a}${u}`,{cause:i}),{code:"RUNTIME_INITIALIZE_FAILED",detail:o})}}}startupFailureDetail(){return{command:this.command,cwd:this.cwd,exited:this.exited,exitCode:this.exitCode,exitSignal:this.exitSignal,...this.spawnError?{spawnError:Ht(this.spawnError.message,this.env)}:{},...this.stderrTail.trim()?{stderr:Ht(this.stderrTail.trim(),this.env)}:{}}}onStdout(t){if(this.framing==="content-length"){this.onContentLengthData(Buffer.isBuffer(t)?t:Buffer.from(t));return}this.onLineData(t.toString("utf8"))}onLineData(t){this.lineBuffer+=t;let r=this.lineBuffer.split(/\r?\n/);this.lineBuffer=r.pop()||"";for(let n of r){let s=n.trim();s&&this.dispatchRaw(s)}}onContentLengthData(t){for(this.headerBuffer=Buffer.concat([this.headerBuffer,t]);this.headerBuffer.length>0;){let r=this.headerBuffer.indexOf(`\r
+import{spawn as nu}from"node:child_process";import{closeSync as su,existsSync as Hr,mkdirSync as iu,openSync as ou,readFileSync as vr,rmSync as au,statSync as Ls,writeFileSync as Hs}from"node:fs";import{dirname as Fs,resolve as Rt}from"node:path";import{fileURLToPath as cu}from"node:url";import{createHash as Wr}from"node:crypto";import{mkdir as ei,readFile as ri,writeFile as ni,rename as si}from"node:fs/promises";import{join as Jr}from"node:path";import{homedir as ii,hostname as oi}from"node:os";import{execFile as Ws}from"node:child_process";import{access as Xs,realpath as Ys}from"node:fs/promises";import{constants as Qs}from"node:fs";import{delimiter as Zs,join as Kr,isAbsolute as zr}from"node:path";import{homedir as Gr}from"node:os";async function Se(e,t=process.env){let r=process.platform==="win32"?[".exe",".cmd",".bat",""]:[""];for(let n of(t.PATH||"").split(Zs).filter(zr))for(let s of r){let i=Kr(n,`${e}${s}`);try{return await Xs(i,Qs.X_OK),i}catch{}}return null}function ti(e,t){return new Promise(r=>Ws(e,t,{timeout:8e3,maxBuffer:1024*1024,windowsHide:!0},(n,s)=>r({code:n?n.code:0,stdout:String(s||"")})))}async function Re(e){let t=e==="~"?Gr():e.startsWith("~/")?Kr(Gr(),e.slice(2)):e;if(!zr(t))throw new Error("\u5DE5\u4F5C\u76EE\u5F55\u5FC5\u987B\u662F\u8BBE\u5907\u4E0A\u7684\u7EDD\u5BF9\u8DEF\u5F84\u6216 ~/ \u5F00\u5934\u7684\u8DEF\u5F84");let r=await Ys(t),{stat:n}=await import("node:fs/promises");if(!(await n(r)).isDirectory())throw new Error("\u5DE5\u4F5C\u76EE\u5F55\u4E0D\u662F\u6587\u4EF6\u5939");return r}async function Vr({find:e=Se,run:t=ti,cwd:r=process.cwd()}={}){return(await Promise.all(["codex","claude","openclaw"].map(async s=>{let i=await e(s);if(!i)return[];let o={codex:"Codex",claude:"Claude Code",openclaw:"OpenClaw"}[s],a=await t(i,["--version"]),c=a.code===0&&a.stdout.match(/\d+\.\d+\.\d+[^\s]*/)?.[0]||"",l={id:s,name:o,framework:s,version:c,workspace:r,managed:!1};if(a.code!==0)return[{...l,status:"error",message:"\u7A0B\u5E8F\u65E0\u6CD5\u542F\u52A8\uFF0C\u8BF7\u5728\u672C\u673A\u68C0\u67E5\u5B89\u88C5"}];if(s==="openclaw"){let f=await t(i,["agents","list","--json"]),h;try{h=JSON.parse(f.stdout)}catch{}if(f.code!==0||!Array.isArray(h))return[{...l,status:"error",message:"\u65E0\u6CD5\u8BFB\u53D6 OpenClaw \u667A\u80FD\u4F53\uFF0C\u8BF7\u68C0\u67E5\u672C\u673A\u914D\u7F6E"}];let y=await t(i,["health","--json"]);return h.filter(T=>typeof T.id=="string"&&typeof T.workspace=="string").slice(0,32).map(T=>({...l,id:`openclaw:${T.id}`,name:T.name||T.identityName||T.id,workspace:T.workspace,managed:!0,localAgentId:T.id,command:i,status:y.code===0?"ready":"needs_setup",message:y.code===0?"":"\u8BF7\u5148\u5728\u672C\u673A\u542F\u52A8\u5E76\u914D\u7F6E OpenClaw Gateway"}))}let p=await t(i,s==="codex"?["login","status"]:["auth","status"]),m=p.code===0?"ready":p.code===1?"needs_login":"error";return[{...l,command:i,status:m,message:m==="needs_login"?`\u8BF7\u5728\u672C\u673A\u8FD0\u884C ${s} ${s==="codex"?"login":"auth login"}`:m==="error"?"\u767B\u5F55\u72B6\u6001\u68C0\u6D4B\u5931\u8D25\uFF0C\u8BF7\u68C0\u67E5 CLI \u7248\u672C":""}]}))).flat()}var Ie={terminalProtocol:"claude",args:["-p","--output-format","stream-json","--verbose","--include-partial-messages"],promptMode:"stdin",outputMode:"json-lines"},Xr={terminalProtocol:"codex",args:["app-server"]},ai=[{protocol:"claude",promptMode:"args",args:JSON.stringify(["-p","--output-format","json","--no-session-persistence"]),launch:Ie},{protocol:"claude",promptMode:"stdin",args:JSON.stringify(["-p","--output-format","stream-json","--verbose"]),launch:Ie},{protocol:"codex",promptMode:"stdin",args:JSON.stringify(["exec","--skip-git-repo-check","--json"]),launch:Xr}];async function Oe(e,t){let r=`${e}.${process.pid}.tmp`;await ni(r,JSON.stringify(t),{mode:384}),await si(r,e)}function xe(e){let t=new URL(e);if(t.username||t.password||t.search||t.hash||t.protocol!=="https:"&&!(t.protocol==="http:"&&["localhost","127.0.0.1","[::1]"].includes(t.hostname)))throw new Error("\u8FDE\u63A5\u5730\u5740\u5FC5\u987B\u4F7F\u7528 HTTPS\uFF1B\u4EC5\u672C\u673A\u5F00\u53D1\u5141\u8BB8 HTTP");let r=Jr(ii(),".orcha","devices"),n=Jr(r,Wr("sha256").update(t.toString()).digest("hex").slice(0,20));return{address:t,root:r,profile:`${n}.json`,pidFile:`${n}.pid`,logFile:`${n}.log`}}async function Ht(e,{url:t,pairCode:r}){let{address:n,root:s,profile:i}=xe(t||e.orchaUrl);await ei(s,{recursive:!0,mode:448});let o;if(r){let a=await fetch(new URL("api/agent-devices/pairings/exchange",`${n.toString().replace(/\/+$/,"")}/`),{method:"POST",redirect:"error",headers:{"content-type":"application/json"},signal:AbortSignal.timeout(15e3),body:JSON.stringify({code:r,name:oi()})}),c=await a.json();if(!a.ok||!c.success)throw new Error(c.message||c.detail||"\u8BBE\u5907\u8FDE\u63A5\u5931\u8D25");o={...c.data,targets:{}},await Oe(i,o)}else{try{o=JSON.parse(await ri(i,"utf8"))}catch{throw new Error("\u6CA1\u6709\u5DF2\u8FDE\u63A5\u8BBE\u5907\uFF0C\u8BF7\u4ECE\u667A\u80FD\u4F53\u9875\u9762\u751F\u6210\u8FDE\u63A5\u7801")}let a=!1;for(let[c,l]of Object.entries(o.targets||{})){let p=ai.find(g=>g.protocol===l.terminalProtocol&&g.promptMode===l.promptMode&&g.args===JSON.stringify(l.args));if(!p)continue;let{terminalProtocol:m,args:f,promptMode:h,outputMode:y,captureLastMessage:T,...x}=l;o.targets[c]={...x,...structuredClone(p.launch)},a=!0}a&&await Oe(i,o)}e.orchaUrl=n.toString().replace(/\/+$/,""),e.mode="node",e.nodeId=o.nodeCode,e.nodeName=o.nodeName,e.nodeToken=o.token,e.targets=o.targets,e.defaultTargetCode="",e.deviceConnection=new Ce(e,o,async()=>Oe(i,o))}var Ce=class{constructor(t,r,n,s=Vr){this.config=t,this.profile=r,this.persist=n,this.discover=s}async candidates(){return{candidates:(await this.discover()).map(({command:r,localAgentId:n,...s})=>s)}}async configure(t,r){if(!Array.isArray(t.selections)||!t.selections.length||t.selections.length>32)throw new Error("\u6DFB\u52A0\u9879\u65E0\u6548");let n=new Map((await this.discover()).map(c=>[c.id,c])),s={...r.targets},i=[],o=new Set;for(let c of t.selections){let l=n.get(c.candidateId);if(!l||l.status!=="ready"||o.has(l.id))throw new Error("\u53D1\u73B0\u7ED3\u679C\u5DF2\u53D8\u5316\uFF0C\u8BF7\u91CD\u65B0\u68C0\u6D4B");o.add(l.id);let p=String(c.name||"").trim();if(!p||p.length>128)throw new Error("\u667A\u80FD\u4F53\u540D\u79F0\u65E0\u6548");let m=await Re(String(c.workspace||""));if(l.managed&&m!==await Re(l.workspace))throw new Error("\u5DF2\u6709\u667A\u80FD\u4F53\u5FC5\u987B\u6CBF\u7528\u672C\u673A\u5DE5\u4F5C\u76EE\u5F55");let f=`${this.config.nodeId}:${Wr("sha256").update(l.id).digest("hex").slice(0,20)}`;if([...r.sessions.values()].some(h=>h.targetCode===f))throw new Error("\u6B64\u667A\u80FD\u4F53\u4ECD\u6709\u4F1A\u8BDD\uFF0C\u8BF7\u5148\u7ED3\u675F\u4F1A\u8BDD\u518D\u4FEE\u6539\u63A5\u5165");s[f]={name:p,workspace:m,command:l.command,type:l.managed?"openclaw":"cli",...l.managed?{openclawAgentId:l.localAgentId}:structuredClone(l.framework==="codex"?Xr:Ie)},i.push({candidateId:l.id,name:p,workspace:m,targetCode:f,framework:l.framework})}let a=this.profile.targets;this.profile.targets=s;try{await this.persist()}catch(c){throw this.profile.targets=a,c}return r.targets=s,this.config.targets=s,r.notifyCapacityChanged(),{agents:i}}};import{execFile as Ei}from"node:child_process";import{constants as Si}from"node:fs";import{access as on,readFile as an,realpath as Ri}from"node:fs/promises";import{join as Ae}from"node:path";import{promisify as Oi}from"node:util";var K="0.1.54";function xt(){return new Date().toISOString()}function D(e,t=2){return String(e).padStart(t,"0")}function Yr(e){let t=e>=0?"+":"-",r=Math.abs(e);return`${t}${D(Math.floor(r/60))}:${D(r%60)}`}function ci(e){let t=-e.getTimezoneOffset();return[`${e.getFullYear()}-${D(e.getMonth()+1)}-${D(e.getDate())}`,`T${D(e.getHours())}:${D(e.getMinutes())}:${D(e.getSeconds())}.${D(e.getMilliseconds(),3)}`,Yr(t)].join("")}function ui(e,t){let r=new Intl.DateTimeFormat("en-US",{timeZone:t,hourCycle:"h23",year:"numeric",month:"2-digit",day:"2-digit",hour:"2-digit",minute:"2-digit",second:"2-digit"}),n={};for(let s of r.formatToParts(e))s.type!=="literal"&&(n[s.type]=Number(s.value));return n}function li(e,t){let r=ui(e,t),n=Date.UTC(r.year,r.month-1,r.day,r.hour,r.minute,r.second,e.getMilliseconds()),s=Math.round((n-e.getTime())/6e4);return[`${r.year}-${D(r.month)}-${D(r.day)}`,`T${D(r.hour)}:${D(r.minute)}:${D(r.second)}.${D(e.getMilliseconds(),3)}`,Yr(s)].join("")}function di(e=new Date){let t=u(process.env.ORCHA_RUNTIME_LOG_TIMEZONE||process.env.TZ||"Asia/Shanghai");try{return li(e,t)}catch{return ci(e)}}function d(e){return e!==null&&typeof e=="object"&&!Array.isArray(e)}function u(e){return String(e??"").trim()}function R(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)?r:t}function U(e){return Array.isArray(e)?e.map(String):[]}function J(e,t,r=process.cwd()){let n=d(e)?e:{};return u(n.cwd)||u(n.workspace)||u(t)||u(r)||process.cwd()}var Ft="[redacted]",pi=/(authorization|api[_-]?key|credential|password|secret|token)/i;function Z(e){return pi.test(u(e))}function st(e,t=[]){let r=String(e??"");for(let n of t){let s=String(n??"");s.length>=4&&(r=r.split(s).join(Ft))}return r.replace(/((?:authorization|api[_-]?key|credential|password|secret|token)\s*[:=]\s*)(?:"[^"]*"|'[^']*'|[^\s,;]+)/gi,`$1${Ft}`).replace(/([?&](?:api[_-]?key|credential|password|secret|token)=)[^&\s]+/gi,`$1${Ft}`)}function nt(e,t=new WeakSet){if(e==null)return e;if(typeof e=="bigint")return e.toString();if(typeof e!="object")return e;if(e instanceof Date)return e.toISOString();if(e instanceof Error){if(t.has(e))return"[circular]";t.add(e);let s={name:e.name,message:e.message};e.stack&&(s.stack=e.stack);for(let i of Object.keys(e))s[i]=nt(e[i],t);return t.delete(e),s}if(t.has(e))return"[circular]";if(t.add(e),Array.isArray(e)){let s=e.map(i=>nt(i,t));return t.delete(e),s}let r={},n=Z(e.name||e.key);for(let[s,i]of Object.entries(e))r[s]=Z(s)||n&&s.toLowerCase()==="value"?Ft:nt(i,t);return t.delete(e),r}function Qr(e,t=4e3){let r=JSON.stringify(nt(e))??String(e);return!Number.isFinite(t)||r.length<=t?r:`${r.slice(0,t)}...`}function _(e,t,r,n={}){let s={ts:di(),level:e,module:t,msg:r,...d(n)?nt(n):{}};console.error(JSON.stringify(s))}var it="application/x-orcha-channel-events-v2+ndjson";function v(e,t){return Object.assign(new Error(t||(["run_timeout","RUNTIME_NODE_TIMEOUT"].includes(e)?"OpenClaw \u539F\u751F IM \u6267\u884C\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002":e==="OPENCLAW_CHANNEL_PROTOCOL_MISMATCH"?"OpenClaw \u63D2\u4EF6\u4E0E Bridge \u7684\u539F\u751F IM \u534F\u8BAE\u4E0D\u517C\u5BB9\uFF0C\u8BF7\u914D\u5957\u5347\u7EA7\u3002":`OpenClaw \u539F\u751F IM \u6267\u884C\u5931\u8D25\uFF08${e}\uFF09`)),{code:e})}function Zr(e,t){let r=e.cause?.code||e.code;return t?.reason?.name==="TimeoutError"||e.name==="TimeoutError"||["UND_ERR_HEADERS_TIMEOUT","UND_ERR_BODY_TIMEOUT","UND_ERR_CONNECT_TIMEOUT","ETIMEDOUT"].includes(r)?Object.assign(v("RUNTIME_NODE_TIMEOUT","OpenClaw \u8FDE\u63A5\u6216\u7B49\u5F85\u54CD\u5E94\u8D85\u65F6\uFF0C\u4EFB\u52A1\u5DF2\u7ED3\u675F\uFF0C\u8BF7\u91CD\u8BD5\u3002"),{detail:{causeCode:r||"REQUEST_TIMEOUT"}}):e}async function tn(e,t){if(e.headers.get("content-type")!==it)throw await e.body?.cancel(),v("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");let r=Buffer.alloc(0);for await(let n of e.body){r=Buffer.concat([r,n]);let s;for(;(s=r.indexOf(10))>=0;){if(s>2097152)throw v("OPENCLAW_CHANNEL_FRAME_TOO_LARGE");let i=r.subarray(0,s).toString("utf8");r=r.subarray(s+1);let o;try{o=JSON.parse(i)}catch{throw v("OPENCLAW_CHANNEL_INVALID_FRAME")}if(o.type!=="heartbeat")if(o.type==="update"&&o.payload?.update&&o.payload?._meta?.channelUpdateId)await t(o.payload);else{if(o.type==="result"&&o.result?.stopReason)return o.result;throw o.type==="error"&&typeof o.code=="string"?v(o.code):v("OPENCLAW_CHANNEL_INVALID_FRAME")}}if(r.length>2097152)throw v("OPENCLAW_CHANNEL_FRAME_TOO_LARGE")}throw v("OPENCLAW_CHANNEL_STREAM_INTERRUPTED","OpenClaw \u8FC7\u7A0B\u8FDE\u63A5\u4E2D\u65AD\uFF0C\u672A\u6536\u5230\u4EFB\u52A1\u7EC8\u6001\uFF0C\u8BF7\u68C0\u67E5\u8282\u70B9\u8FDE\u63A5\u540E\u91CD\u8BD5\u3002")}import{createServer as mi}from"node:http";import{randomBytes as hi}from"node:crypto";var Bt={controlTools:["find_capabilities_and_skills","describe_capability","inspect_result","execute_capability"],residentTools:["search_orcha_docs","knowledge_search"]};var gi=Object.freeze([...Bt.controlTools,...Bt.residentTools]),_i=new Set(gi),yi=8*1024*1024;function jt(e,t){if(!Array.isArray(e)||e.length!==1)throw new Error("one task-scoped Orcha MCP server is required");let r=e[0],n=new URL(r.url);if(r.name!=="orcha"||r.type!=="http"||!["http:","https:"].includes(n.protocol)||n.username||n.password||n.hash||t&&n.href!==new URL(t).href)throw new Error("Orcha MCP server does not match the trusted binding");let s=Object.fromEntries((r.headers||[]).map(({name:i,value:o})=>[i.toLowerCase(),o]));if(!String(s.authorization||"").startsWith("Bearer "))throw new Error("Orcha MCP task credentials are missing");return{url:n.href,headers:{...s,"content-type":"application/json",accept:"application/json"}}}async function rn(e){let t=0,r=[];for await(let n of e){if(t+=n.length,t>yi)throw new Error("MCP payload exceeds the size limit");r.push(Buffer.from(n))}return JSON.parse(Buffer.concat(r).toString("utf8"))}async function nn(e,t,r){let n=await fetch(e.url,{method:"POST",headers:e.headers,body:JSON.stringify(t),redirect:"error",signal:AbortSignal.any([AbortSignal.timeout(36e5),...r?[r]:[]])});if(!n.ok)throw new Error(`Orcha MCP request failed (${n.status})`);if(n.status===202||n.status===204)return null;let s=await rn(n.body);if(!s||s.jsonrpc!=="2.0"||s.id!==t.id)throw new Error("Orcha MCP response identity mismatch");return s}async function en(e,t){let r=await nn(e,{jsonrpc:"2.0",id:"orcha-bind-tools",method:"tools/list"},t),n=r?.result?.tools;if(r?.error){let s=Object.entries(e.headers).filter(([a])=>Z(a)).flatMap(([,a])=>[a,String(a).replace(/^Bearer\s+/i,"")]),i=typeof r.error.message=="string"?st(r.error.message,s).slice(0,512):"",o=Number.isInteger(r.error.code)?` (${r.error.code})`:"";throw new Error(`Orcha MCP tool discovery failed${o}${i?`: ${i}`:""}`)}return Ti(n)}function Ti(e){if(!Array.isArray(e)||e.some(t=>!t||!_i.has(t.name)||t.inputSchema?.type!=="object"||typeof t.description!="string")||new Set(e.map(t=>t.name)).size!==e.length||e.length&&Bt.controlTools.some(t=>!e.some(r=>r.name===t)))throw new Error("Orcha MCP returned an unsupported or invalid authorized tool catalog");return e}function wi(e,t){let r=s=>Array.isArray(s)?s.map(r):s&&typeof s=="object"?Object.fromEntries(Object.keys(s).sort().map(i=>[i,r(s[i])])):s,n=s=>s.map(({name:i,inputSchema:o})=>({name:i,inputSchema:o})).sort((i,o)=>i.name.localeCompare(o.name));return JSON.stringify(r(n(e)))===JSON.stringify(r(n(t)))}async function sn(e,t=[]){let r=jt(e),n=new AbortController,s=await en(r,n.signal);if(t.some(a=>s.some(c=>c.name===a.name)))throw new Error("Local and remote MCP tools conflict");let i=hi(32).toString("hex"),o=mi(async(a,c)=>{if(a.url!=="/mcp"||a.headers.authorization!==`Bearer ${i}`){c.writeHead(403).end();return}if(a.method!=="POST"){c.writeHead(405).end();return}try{let l=await rn(a);if(!l||l.jsonrpc!=="2.0"||typeof l.method!="string")throw new Error("Invalid MCP request");let p=l.method==="tools/call"&&t.find(f=>f.name===l.params?.name);if(l.method==="tools/call"&&!p&&!s.some(f=>f.name===l.params?.name))throw new Error("Tool is not authorized in this task binding");let m;if(p)try{m={jsonrpc:"2.0",id:l.id,result:await p.call(l.params.arguments,{upstream:r,signal:n.signal})}}catch(f){m={jsonrpc:"2.0",id:l.id,result:{isError:!0,content:[{type:"text",text:st(String(f.message),[r.headers.authorization,i])}]}}}else m=await nn(r,l,n.signal),l.method==="tools/list"&&m?.result?.tools&&m.result.tools.push(...t.map(({call:f,...h})=>h));c.writeHead(m===null?202:200,{"content-type":"application/json"}),c.end(m===null?"":JSON.stringify(m))}catch{c.writeHead(502,{"content-type":"application/json"}).end(JSON.stringify({error:"The task-scoped Orcha MCP connection failed"}))}});return await new Promise((a,c)=>{o.once("error",c),o.listen(0,"127.0.0.1",a)}),{url:`http://127.0.0.1:${o.address().port}/mcp`,token:i,async refresh(a){let c=jt(a,r.url);if(!wi(s,await en(c,n.signal)))throw new Error("The frozen MCP tool catalog changed; start a new task");r=c},async close(){n.abort(),o.closeAllConnections(),await new Promise(a=>o.close(a))}}}var tt=class{constructor(t,r){this.target=t,this.identity=r,this.bound=!1}async request(t,r,n=!1,s="mcp-bindings",i=3e4,o=null){let a=u(this.target.mcpBridgeUrl),c=u(this.target.mcpBridgeTokenEnv),l=this.target.env?.[c]||process.env[c];if(!a||!c||!l)throw Object.assign(new Error("OpenClaw requires the Orcha tool plugin, mcpBridgeUrl and mcpBridgeTokenEnv"),{code:"OPENCLAW_MCP_NOT_CONFIGURED"});let p=new URL(a);if(!["http:","https:"].includes(p.protocol)||p.username||p.password||p.pathname!=="/plugins/orcha-runtime/mcp-bindings"||p.search||p.hash)throw new Error("OpenClaw MCP binding URL must be the trusted Gateway plugin route");if(!["mcp-bindings","deliveries","background"].includes(s))throw new Error("Unsupported Orcha plugin route");p.pathname=`/plugins/orcha-runtime/${s}`;let m=AbortSignal.timeout(i);try{let f=await fetch(p,{method:t,redirect:"error",signal:m,headers:{authorization:`Bearer ${l}`,"content-type":"application/json",...o?{accept:it}:{},...n?{"if-match":this.identity.runId}:{}},...r!==void 0?{body:JSON.stringify(r)}:{}});if(t==="GET"&&s==="deliveries"&&[404,405].includes(f.status))throw await f.body?.cancel(),v("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");if(f.ok&&o)return await tn(f,o);let h=await f.json();if(!f.ok)throw v(h.error||"OPENCLAW_MCP_BINDING_FAILED");return h}catch(f){throw Zr(f,m)}}async bind(t,r=!1){jt(t),await this.request("PUT",{...this.identity,mcpServer:t[0]},r),this.bound=!0}async close(){this.bound&&(await this.request("DELETE",{runId:this.identity.runId,sessionKey:this.identity.sessionKey}),this.bound=!1)}};var Ii=Oi(Ei),Ci=12e4;async function cn(e,t){let r=new Map,n=[];for(let s of Object.values(e)){if(s.type!=="openclaw")continue;if(s.mcpBridgeUrl&&(n.push(s),!["localhost","127.0.0.1","[::1]"].includes(new URL(s.mcpBridgeUrl).hostname))){process.stderr.write(`\u8FDC\u7A0B OpenClaw Gateway \u7684\u914D\u5957\u63D2\u4EF6\u9700\u5728\u6240\u5728\u4E3B\u673A\u66F4\u65B0\uFF1Breload \u5C06\u68C0\u67E5\u5176\u534F\u8BAE\u3002
+`);continue}let i={...process.env,...s.env},o=u(s.command)||"openclaw",a=o.includes("/")?o:await Se(o,i);if(!a)throw new Error("\u627E\u4E0D\u5230\u5DF2\u63A5\u5165\u7684 OpenClaw\uFF0C\u8BF7\u68C0\u67E5\u672C\u673A\u5B89\u88C5\u540E\u91CD\u8BD5 reload");let c=await Ri(a);await on(c,Si.X_OK);let l=JSON.stringify([c,Object.entries(i).sort(([p],[m])=>p.localeCompare(m))]);r.has(l)||r.set(l,{command:c,env:i})}if(r.size)try{let s=JSON.parse(await an(Ae(t,"openclaw.plugin.json"),"utf8")),i=JSON.parse(await an(Ae(t,"package.json"),"utf8"));if(await on(Ae(t,"index.js")),s.id!=="orcha-runtime"||i.version!==K)throw new Error("\u63D2\u4EF6\u6807\u8BC6\u6216\u7248\u672C\u4E0D\u5339\u914D")}catch(s){throw new Error("\u914D\u5957 OpenClaw \u63D2\u4EF6\u7F3A\u5931\u3001\u635F\u574F\u6216\u7248\u672C\u4E0D\u4E00\u81F4\uFF0C\u8BF7\u91CD\u65B0\u5B89\u88C5 Bridge\uFF1B\u6E90\u7801\u8FD0\u884C\u8BF7\u5148 npm run build",{cause:s})}return async()=>{for(let s of r.values()){process.stderr.write(`\u6B63\u5728\u5B89\u88C5\u914D\u5957 OpenClaw \u63D2\u4EF6\u5E76\u91CD\u542F Gateway\u2026
+`),await Ne(s,["plugins","install",t,"--force"]),await Ne(s,["gateway","restart"]);let i=await Ne(s,["health","--json"]);if(JSON.parse(i).ok!==!0)throw new Error("OpenClaw Gateway \u5065\u5EB7\u68C0\u67E5\u5931\u8D25\uFF0CBridge \u672A\u542F\u52A8\uFF0C\u8BF7\u4FEE\u590D\u540E\u91CD\u8BD5 reload");process.stderr.write(`OpenClaw \u914D\u5957\u63D2\u4EF6\u5DF2\u66F4\u65B0\uFF0CGateway \u5065\u5EB7\u68C0\u67E5\u901A\u8FC7\u3002
+`)}for(let s of n)if((await new tt(s,{}).request("GET",void 0,!1,"deliveries")).streamType!==it)throw v("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH")}}async function Ne(e,t){try{let{stdout:r}=await Ii(e.command,t,{env:e.env,timeout:Ci,killSignal:"SIGKILL",maxBuffer:1048576,windowsHide:!0});return r}catch(r){let n=Object.entries(e.env).filter(([i])=>Z(i)).map(([,i])=>i),s=st(r.stderr||r.message,n).trim();throw new Error(`OpenClaw ${t.slice(0,2).join(" ")} \u5931\u8D25\uFF0CBridge \u672A\u542F\u52A8\uFF0C\u8BF7\u4FEE\u590D\u540E\u91CD\u8BD5 reload\uFF1A${s}`)}}import{createHash as lc,randomUUID as le}from"node:crypto";function mt(e){return Array.isArray(e)?e.map(t=>d(t)?t.type==="text"?u(t.text):t.type==="file"?u(t.uri):t.type==="image"?u(t.uri):"":"").filter(Boolean).join(`
+`):""}var qt=class{constructor(t){this.agent=t,this.sessionCounter=0}async sessionNew(){return this.sessionCounter+=1,{sessionId:`echo-${this.agent.agentId}-${this.sessionCounter}`}}async sessionPrompt(t,r){let n=mt(t.prompt);return r({sessionId:t.sessionId,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n?`Echo runtime received: ${n}`:"Echo runtime received an empty prompt."}}}),{stopReason:"end_turn"}}async sessionCancel(){return{ok:!0}}};import{spawn as xi}from"node:child_process";var At="2.0",be=3e4,Ai=4e3;function Gt(e,t){let r=Object.entries(d(t)?t:{}).filter(([n])=>Z(n)).map(([,n])=>n);return st(e,r)}function Ni(e){return{code:Number.isInteger(e?.code)?e.code:-32e3,message:u(e?.message)||String(e),data:d(e?.data)?e.data:void 0}}function bi(e){if(!d(e))return new Error(String(e||"runtime error"));let t=u(e.message)||"runtime error",r="data"in e?Qr(e.data,4e3):"",n=new Error(r?`${t}; data=${r}`:t);return n.rpcCode=e.code,n.data=e.data,n}function Mi(e){return d(e)&&"id"in e&&!("method"in e)}function Ui(e){return d(e)&&typeof e.method=="string"&&"id"in e}function Pi(e){return d(e)&&typeof e.method=="string"&&!("id"in e)}var Kt=class{constructor({command:t,args:r=[],cwd:n,env:s,label:i,framing:o="line",detached:a=!0}){this.command=t,this.args=Array.isArray(r)?r.map(String):[],this.cwd=n||process.cwd(),this.env=d(s)?{...s}:{...process.env},this.label=i||t,this.framing=o==="content-length"?"content-length":"line",this.detached=a!==!1,this.child=null,this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stopPromise=null,this.stderrTail="",this.spawnError=null,this.lineBuffer="",this.headerBuffer=Buffer.alloc(0),this.seq=0,this.pending=new Map,this.notificationHandlers=new Map,this.requestHandlers=new Map,this.exitHandlers=new Set}async start({initialize:t=!0,initializeParams:r={},initializeTimeoutMs:n=be}={}){if(!(this.child&&!this.exited)&&(this.exited=!1,this.exitCode=null,this.exitSignal=null,this.stderrTail="",this.spawnError=null,this.child=xi(this.command,this.args,{cwd:this.cwd,env:this.env,stdio:["pipe","pipe","pipe"],detached:this.detached}),this.child.stdout.on("data",s=>this.onStdout(s)),this.child.stderr.setEncoding("utf8"),this.child.stderr.on("data",s=>{this.stderrTail=`${this.stderrTail}${s}`.slice(-Ai);let i=Gt(s.trimEnd(),this.env);i&&_("debug","runtime.stderr","runtime stderr",{target:this.label,text:i})}),this.child.on("exit",(s,i)=>this.handleExit(s,i)),this.child.on("error",s=>{this.spawnError=s,this.rejectAll(s)}),t)){let s=Math.max(1,R(n,be));try{await this.call("initialize",{protocolVersion:1,clientCapabilities:{},...r},s)}catch(i){let o=this.startupFailureDetail(),a=Gt(i?.message||i,this.env);_("warn","runtime.initialize","runtime initialize failed",{target:this.label,timeoutMs:s,cause:a,...o}),await this.stop("initialize failed",{termTimeoutMs:1e3,killTimeoutMs:1e3});let c=o.stderr?`; stderr: ${o.stderr}`:`; command=${o.command}; cwd=${o.cwd}`;throw Object.assign(new Error(`runtime initialize failed: ${a}${c}`,{cause:i}),{code:"RUNTIME_INITIALIZE_FAILED",detail:o})}}}startupFailureDetail(){return{command:this.command,cwd:this.cwd,exited:this.exited,exitCode:this.exitCode,exitSignal:this.exitSignal,...this.spawnError?{spawnError:Gt(this.spawnError.message,this.env)}:{},...this.stderrTail.trim()?{stderr:Gt(this.stderrTail.trim(),this.env)}:{}}}onStdout(t){if(this.framing==="content-length"){this.onContentLengthData(Buffer.isBuffer(t)?t:Buffer.from(t));return}this.onLineData(t.toString("utf8"))}onLineData(t){this.lineBuffer+=t;let r=this.lineBuffer.split(/\r?\n/);this.lineBuffer=r.pop()||"";for(let n of r){let s=n.trim();s&&this.dispatchRaw(s)}}onContentLengthData(t){for(this.headerBuffer=Buffer.concat([this.headerBuffer,t]);this.headerBuffer.length>0;){let r=this.headerBuffer.indexOf(`\r
 \r
-`);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){g("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.alloc(0);return}let i=Number.parseInt(s[1],10),o=r+4,a=o+i;if(this.headerBuffer.length<a)return;let u=this.headerBuffer.subarray(o,a).toString("utf8");this.headerBuffer=this.headerBuffer.subarray(a),this.dispatchRaw(u)}}dispatchRaw(t){let r;try{r=JSON.parse(t)}catch(n){g("warn","runtime.protocol","invalid JSON frame",{target:this.label,error:String(n)});return}this.dispatch(r)}dispatch(t){if(fi(t)){this.resolveResponse(t);return}if(pi(t)){this.handleRequest(t);return}hi(t)&&this.handleNotification(t)}resolveResponse(t){let r=String(t.id),n=this.pending.get(r);n&&(clearTimeout(n.timer),this.pending.delete(r),t.error?(g("warn","runtime.protocol","runtime rpc error",{target:this.label,method:n.method,requestId:r,error:t.error}),n.reject(di(t.error))):n.resolve(t.result))}async handleRequest(t){let r=this.requestHandlers.get(t.method);if(!r){this.writeFrame({jsonrpc:St,id:t.id,error:{code:-32601,message:`method not found: ${t.method}`}});return}try{let n=await r(l(t.params)?t.params:{},t);this.writeFrame({jsonrpc:St,id:t.id,result:n??{}})}catch(n){this.writeFrame({jsonrpc:St,id:t.id,error:li(n)})}}handleNotification(t){let r=this.notificationHandlers.get(t.method);if(r)for(let n of r)n(l(t.params)?t.params:{},t)}call(t,r={},n=Re){if(!this.child||!this.child.stdin||this.exited)return Promise.reject(new Error("runtime process is not running"));let s=`${t}_${++this.seq}`,i={jsonrpc:St,id:s,method:t,params:r};return new Promise((o,a)=>{let u=setTimeout(()=>{this.pending.delete(s),a(new Error(`${t} timed out after ${n}ms`))},n);this.pending.set(s,{resolve:o,reject:a,timer:u,method:t}),this.writeFrame(i,d=>{d&&(clearTimeout(u),this.pending.delete(s),a(d))})})}notify(t,r={}){this.writeFrame({jsonrpc:St,method:t,params:r})}writeFrame(t,r){if(!this.child?.stdin||this.exited){r?.(new Error("runtime process is not running"));return}let n=JSON.stringify(t),s=this.framing==="content-length"?`Content-Length: ${Buffer.byteLength(n,"utf8")}\r
+`);if(r<0)return;let s=this.headerBuffer.subarray(0,r).toString("utf8").match(/content-length:\s*(\d+)/i);if(!s){_("warn","runtime.protocol","missing Content-Length header",{target:this.label}),this.headerBuffer=Buffer.alloc(0);return}let i=Number.parseInt(s[1],10),o=r+4,a=o+i;if(this.headerBuffer.length<a)return;let c=this.headerBuffer.subarray(o,a).toString("utf8");this.headerBuffer=this.headerBuffer.subarray(a),this.dispatchRaw(c)}}dispatchRaw(t){let r;try{r=JSON.parse(t)}catch(n){_("warn","runtime.protocol","invalid JSON frame",{target:this.label,error:String(n)});return}this.dispatch(r)}dispatch(t){if(Mi(t)){this.resolveResponse(t);return}if(Ui(t)){this.handleRequest(t);return}Pi(t)&&this.handleNotification(t)}resolveResponse(t){let r=String(t.id),n=this.pending.get(r);n&&(clearTimeout(n.timer),this.pending.delete(r),t.error?(_("warn","runtime.protocol","runtime rpc error",{target:this.label,method:n.method,requestId:r,error:t.error}),n.reject(bi(t.error))):n.resolve(t.result))}async handleRequest(t){let r=this.requestHandlers.get(t.method);if(!r){this.writeFrame({jsonrpc:At,id:t.id,error:{code:-32601,message:`method not found: ${t.method}`}});return}try{let n=await r(d(t.params)?t.params:{},t);this.writeFrame({jsonrpc:At,id:t.id,result:n??{}})}catch(n){this.writeFrame({jsonrpc:At,id:t.id,error:Ni(n)})}}handleNotification(t){let r=this.notificationHandlers.get(t.method);if(r)for(let n of r)n(d(t.params)?t.params:{},t)}call(t,r={},n=be){if(!this.child||!this.child.stdin||this.exited)return Promise.reject(new Error("runtime process is not running"));let s=`${t}_${++this.seq}`,i={jsonrpc:At,id:s,method:t,params:r};return new Promise((o,a)=>{let c=setTimeout(()=>{this.pending.delete(s),a(new Error(`${t} timed out after ${n}ms`))},n);this.pending.set(s,{resolve:o,reject:a,timer:c,method:t}),this.writeFrame(i,l=>{l&&(clearTimeout(c),this.pending.delete(s),a(l))})})}notify(t,r={}){this.writeFrame({jsonrpc:At,method:t,params:r})}writeFrame(t,r){if(!this.child?.stdin||this.exited){r?.(new Error("runtime process is not running"));return}let n=JSON.stringify(t),s=this.framing==="content-length"?`Content-Length: ${Buffer.byteLength(n,"utf8")}\r
 \r
 ${n}`:`${n}
-`;this.child.stdin.write(s,r)}onNotification(t,r){let n=this.notificationHandlers.get(t)||new Set;return n.add(r),this.notificationHandlers.set(t,n),()=>{n.delete(r),n.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,r){return this.requestHandlers.set(t,r),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let r of this.pending.values())clearTimeout(r.timer),r.reject(t);this.pending.clear()}handleExit(t,r){this.exited=!0,this.exitCode=t,this.exitSignal=r,this.rejectAll(new Error(`runtime exited before response (${t}/${r})`));for(let n of this.exitHandlers)n(t,r)}async waitForExit(t=5e3){return!this.child||this.exited?!0:await new Promise(r=>{let n=setTimeout(()=>{s(),r(!1)},t);n.unref?.();let s=()=>{clearTimeout(n),this.exitHandlers.delete(i)},i=()=>{s(),r(!0)};this.exitHandlers.add(i),this.exited&&i()})}signal(t){if(!this.child||this.exited)return!1;let r=this.child.pid;if(!r)return!1;try{return this.detached&&process.platform!=="win32"?process.kill(-r,t):this.child.kill(t),!0}catch(n){if(n?.code==="ESRCH")return this.exited=!0,!1;try{return this.child.kill(t),!0}catch(s){return s?.code!=="ESRCH"&&g("warn","runtime","runtime signal failed",{target:this.label,pid:r,signal:t,error:String(s)}),!1}}}async stop(t="stop",{termTimeoutMs:r=5e3,killTimeoutMs:n=2e3}={}){if(!(!this.child||this.exited)){if(this.stopPromise)return await this.stopPromise;this.stopPromise=(async()=>{if(!this.child||this.exited)return;let s=this.child.pid;g("info","runtime","stopping runtime",{target:this.label,reason:t,pid:s}),this.rejectAll(new Error(`runtime stopped: ${t}`)),this.signal("SIGTERM"),!await this.waitForExit(r)&&this.child&&!this.exited&&(g("warn","runtime","runtime did not exit after SIGTERM; force killing",{target:this.label,reason:t,pid:s}),this.signal("SIGKILL"),await this.waitForExit(n))})();try{await this.stopPromise}finally{this.stopPromise=null}}}};import{randomUUID as Zr}from"node:crypto";import{existsSync as mi,readFileSync as gi,realpathSync as Xr,statSync as _i}from"node:fs";import{basename as tn,extname as en,isAbsolute as Rt,join as yi,relative as rn,resolve as Yr}from"node:path";var wi=25*1024*1024;function nn(e,t=""){let r=c(t);if(r)return r;let n=en(c(e)).toLowerCase();return n===".jpg"||n===".jpeg"?"image/jpeg":n===".webp"?"image/webp":n===".gif"?"image/gif":"image/png"}function sn(e,t){let r=typeof e=="string"?e.trim():"";return!r||r==="<omitted>"?"":r.startsWith("data:")?r:`data:${t};base64,${r.replace(/\s+/g,"")}`}function Ft(e){if(Array.isArray(e))return e.map(c).filter(Boolean);let t=c(e);return t?[t]:[]}function Ti(e,t){let r=rn(t,e);return r===""||!!r&&!r.startsWith("..")&&!Rt(r)}function Ei(e,t){let r=c(e);if(!r||!mi(r))return"";try{let n=Xr(r);for(let s of t)try{let i=Xr(s);if(Ti(n,i))return n}catch{}}catch{return""}return""}function Si(e,t){let r=c(e);if(!r||!Rt(r))return r;for(let n of Array.isArray(t)?t:[]){if(!l(n))continue;let s=c(n.runtimeRoot),i=c(n.hostRoot);if(!s||!i||!Rt(s)||!Rt(i))continue;let o=rn(Yr(s),Yr(r));if(o===""||!o.startsWith("..")&&!Rt(o))return o?yi(i,o):i}return r}function Oe(e,t,r={}){let n=c(e);return!n||n.startsWith("data:")||/^https?:\/\//i.test(n)?n:Ri(n,t,r)}function Ri(e,t,r={}){let n=[...Ft(r.trustedFileRoots),...Ft(r.trustedFileRoot),...Ft(r.artifactRoots),...Ft(r.artifactRoot)],s=Ei(Si(e,r.pathMappings),n);if(!s)return"";try{let i=_i(s);return!i.isFile()||i.size<=0||i.size>wi?"":`data:${t};base64,${gi(s).toString("base64")}`}catch{return""}}function x(...e){for(let t of e){let r=c(t);if(r)return r}return""}function Oi(e,t,r,n){let s=r.toLowerCase();if(s==="image"||s==="picture")return!0;let i=x(n,e.previewUrl,e.fileUrl,e.imageUrl,e.dataUrl,e.url,e.uri,t.previewUrl,t.fileUrl,t.imageUrl,t.dataUrl,t.url,t.uri),o=en(i.split("?",1)[0].split("#",1)[0]).toLowerCase();return[".png",".jpg",".jpeg",".webp",".gif"].includes(o)}function Ce(e,t={}){let{source:r="runtime_image_generation_event"}=t;if(!l(e))return null;let n=l(e.payload)?e.payload:{},s=c(e.type),i=c(n.type);if(!(s==="event_msg"&&i==="image_generation_end"||s==="response_item"&&i==="image_generation_call"))return null;let o=x(n.call_id,n.id),a=x(n.saved_path,n.savedPath),u=x(n.revised_prompt,n.revisedPrompt),d=nn(a,n.mimeType||n.mime_type),f=sn(n.result,d)||Oe(a,d,t);if(!f)return null;let h=f.startsWith("data:")?f:"",p=a?tn(a):`${o||Zr()}.png`;return{artifactType:"image",type:"image",fieldKey:"image",title:p||"Generated image",summary:u||"Generated image",content:{prompt:u||void 0,dataUrl:h||void 0,imageUrl:f,previewUrl:f,fileUrl:f,mimeType:d},dataUrl:h||void 0,previewUrl:f,fileUrl:f,metadata:{source:r,eventType:i,callId:o||void 0,savedPath:a||void 0,filename:p,mimeType:d,revisedPrompt:u||void 0}}}function Ii(e){let t=l(e)?e:{},r=[];for(let n of["_artifacts","artifacts"]){let s=t[n];Array.isArray(s)&&r.push(...s)}for(let n of["_artifact","artifact"]){let s=t[n];l(s)&&r.push(s)}return r}function Ci(e,t={}){let{source:r="runtime_artifact"}=t,n=l(e)?e:{};if(!Object.keys(n).length)return null;let s=l(n.content)?{...n.content}:{},i=l(n.metadata)?{...n.metadata}:{},o=x(n.saved_path,n.savedPath,s.saved_path,s.savedPath,i.savedPath),a=x(n.mimeType,n.mime_type,s.mimeType,s.mime_type,i.mimeType),u=x(n.artifactType,n.artifact_type,n.type,n.kind,s.type,o?"image":"file"),d=Oi(n,s,u,o),f=d?nn(o,a):a;if(d){let I=x(n.dataUrl,s.dataUrl),_=I.startsWith("data:")?I:"",T=x(n.imageUrl,n.previewUrl,n.fileUrl,n.downloadUrl,n.url,n.uri,s.imageUrl,s.previewUrl,s.fileUrl,s.downloadUrl,s.url,s.uri),E=sn(n.result??s.result,f)||_||Oe(o,f,t)||Oe(T,f,t);E&&(E.startsWith("data:")&&(s.dataUrl||=E),s.imageUrl||=E,s.previewUrl||=E,s.fileUrl||=E,f&&(s.mimeType||=f))}for(let[I,_]of[["prompt","prompt"],["previewUrl","previewUrl"],["fileUrl","fileUrl"],["downloadUrl","downloadUrl"],["imageUrl","imageUrl"],["dataUrl","dataUrl"],["url","url"],["uri","uri"],["mimeType","mimeType"],["mime_type","mimeType"]]){let T=n[I];T!=null&&T!==""&&!(_ in s)&&(s[_]=T)}let h=x(n.fileUrl,n.downloadUrl,n.imageUrl,n.dataUrl,n.url,n.uri,s.fileUrl,s.downloadUrl,s.imageUrl,s.dataUrl,s.url,s.uri),p=x(n.previewUrl,n.imageUrl,n.dataUrl,n.url,n.fileUrl,n.uri,s.previewUrl,s.imageUrl,s.dataUrl,s.url,s.fileUrl,s.uri),m=x(n.dataUrl,s.dataUrl,h.startsWith("data:")?h:"",p.startsWith("data:")?p:""),y=x(n.filename,i.filename,o?tn(o):""),w=x(n.fieldKey,n.field_key,s.fieldKey,i.fieldKey,d?"image":"artifact");return{...n,artifactType:u,type:n.type||u,fieldKey:w,title:x(n.title,y,"Runtime artifact"),summary:x(n.summary,s.prompt,n.title,y,"Runtime artifact"),content:s,dataUrl:m||void 0,fileUrl:h||void 0,previewUrl:p||void 0,metadata:{...i,source:x(i.source,r),savedPath:o||i.savedPath,filename:y||i.filename,mimeType:f||i.mimeType}}}function Bt(e,t){if(!t||!e)return;let r=l(t.metadata)?t.metadata:{},n=x(r.savedPath,r.callId,t.previewUrl,t.fileUrl)||Zr(),s=e.get(n);if(!s){e.set(n,t);return}s.content={...l(s.content)?s.content:{},...l(t.content)?t.content:{}},s.metadata={...l(s.metadata)?s.metadata:{},...r},s.previewUrl=t.previewUrl||s.previewUrl,s.fileUrl=t.fileUrl||s.fileUrl,s.summary=t.summary||s.summary,s.title=t.title||s.title}function Ie(e,t,r={}){for(let n of Ii(e))Bt(t,Ci(n,r))}function Ae(e){if(!l(e)||!l(e.payload))return l(e)?e:{value:e};let t=c(e.payload.type);if(t!=="image_generation_end"&&t!=="image_generation_call")return e;let r={...e.payload};return typeof r.result=="string"&&r.result&&(r.result="<omitted>",r.resultLength=e.payload.result.length),{...e,payload:r}}function Qr(e,t,r){if(!l(e))return e;let n=l(e.event)?e.event:null;return n?(Bt(t,Ce(n,r)),{...e,event:Ae(n)}):e}function on(e,t,r={}){if(!l(e))return e;Ie(e,t,r);let n=Qr(e,t,r),s=l(n.update)?Qr(n.update,t,r):null;return s&&s!==n.update&&(n={...n,update:s}),n}function an(e,t,r={}){let n=l(e)?{...e}:{};Ie(n,t,r),Ie(l(n.output)?n.output:{},t,r);let s=[...t?.values?.()||[]];return s.length&&(n._artifacts=s),delete n.artifacts,n}function cn(e,t){let r=S(e,t);return r>0?r:t}var ft=class{constructor(t,r,n={},s={}){this.agent=t,this.target=r,this.callbacks=n,this.options=s,this.proc=null,this.launch=null,this.launchCleanup=null,this.permissionHandlers=new Map}async ensureStarted(){if(this.proc)return;let t=c(this.target.command);if(!t)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let r={command:t,args:b(this.target.args),cwd:rt(this.target,this.agent.workspace),environment:l(this.target.env)?this.target.env:{}},n=this.options.prepareLaunch?await this.options.prepareLaunch(r):{...r,environment:{...process.env,...r.environment},cleanup:async()=>{}};this.launch=n,this.launchCleanup=n.cleanup,this.proc=new $t({command:n.command,args:n.args,cwd:n.cwd,env:n.environment,label:`${this.agent.agentId}:${this.agent.targetCode}`,framing:c(this.target.framing||"line")}),this.proc.onRequest("session/request_permission",s=>this.handlePermissionRequest(s)),this.proc.onRequest("session/requestPermission",s=>this.handlePermissionRequest(s));try{await this.proc.start({initialize:this.target.initialize!==!1,initializeTimeoutMs:cn(this.target.initializeTimeoutMs,cn(this.options.initializeTimeoutMs,3e4)),initializeParams:{clientInfo:{name:"orcha-runtime-bridge",version:W},...l(this.target.initializeParams)?this.target.initializeParams:{}}})}catch(s){throw await this.proc?.stop("runtime startup failed"),this.proc=null,await this.cleanupLaunch(),s}}async sessionNew(t={}){return await this.ensureStarted(),this.proc.call("session/new",this.sessionNewParams(t))}sessionNewParams(t={}){let r=Array.isArray(t.mcpServers)?t.mcpServers:Array.isArray(this.target.mcpServers)?this.target.mcpServers:[];return{...t,mcpServers:r}}async sessionPrompt(t,r){await this.ensureStarted();let n=c(t.sessionId),s=new Map,i=this.artifactOptions(),o=this.proc.onNotification("session/update",u=>{let d=c(u.sessionId);(!d||d===n)&&r(on(u,s,i))}),a=async u=>this.callbacks.onPermissionRequest?.({agent:this.agent,runtimeSessionId:n,request:u,emitUpdate:r})||{outcome:"denied",reason:"permission handler is not configured"};n&&this.permissionHandlers.set(n,a),this.permissionHandlers.set("*",a);try{let u=await this.proc.call("session/prompt",t,this.options.sessionPromptTimeoutMs);return an(u,s,i)}finally{o(),n&&this.permissionHandlers.delete(n),this.permissionHandlers.delete("*")}}async sessionCancel(t){return await this.ensureStarted(),this.proc.call("session/cancel",t,5e3).catch(()=>({ok:!0}))}async handlePermissionRequest(t){let r=c(t.sessionId),n=this.permissionHandlers.get(r)||this.permissionHandlers.get("*");return n?n(t):{outcome:"denied",reason:"no active Orcha permission handler"}}artifactSource(){return c(this.target.type||"acp")==="openclaw"?"openclaw_image_generation":"acp_runtime_image_generation"}artifactOptions(){let t=l(this.target.env)?this.target.env:{};return{source:this.artifactSource(),trustedFileRoots:[c(this.launch?.artifactDirectory),c(this.launch?.homeDirectory),c(this.target.artifactRoot),c(this.target.artifactDir),c(this.target.runtimeArtifactRoot),c(t.ORCHA_RUNTIME_ARTIFACT_DIR),...b(this.target.trustedArtifactRoots),...b(this.target.trustedFileRoots),...b(this.target.artifactRoots),...b(this.target.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(this.launch?.pathMappings)?this.launch.pathMappings:[]}}async stop(t){try{await this.proc?.stop(t)}finally{this.proc=null,await this.cleanupLaunch()}}async cleanupLaunch(){let t=this.launchCleanup;this.launchCleanup=null,this.launch=null,await t?.()}};import{existsSync as un,readFileSync as Ai}from"node:fs";import{dirname as xi,resolve as jt}from"node:path";import{fileURLToPath as Ni}from"node:url";var bi=/^[A-Za-z_][A-Za-z0-9_]*$/,Y=24*60*60*1e3;function ln(e=process.env,t=process.cwd()){let r=c(e.ORCHA_RUNTIME_ENV_FILE),n=r?jt(t,r):jt(t,".env");if(!un(n))return r&&g("warn","config","runtime env file not found",{path:n}),{loaded:!1,path:n,keys:[]};let s=[],i=Ai(n,"utf8");for(let o of i.split(/\r?\n/)){let a=Pi(o);if(!a)continue;let[u,d]=a;Object.prototype.hasOwnProperty.call(e,u)||(e[u]=d,s.push(u))}return g("info","config","runtime env file loaded",{path:n,keyCount:s.length}),{loaded:!0,path:n,keys:s}}function dn(e=process.env){let t=c(e.ORCHA_RUNTIME_MODE||(e.ORCHA_RUNTIME_ORCHA_URL?"node":"server")),r=c(e.ORCHA_RUNTIME_BRIDGE_HOST||"127.0.0.1"),n=!1,s=xi(Ni(import.meta.url)),i=jt(s,"sandbox","broker.js"),o=jt(s,"orcha-runtime-sandbox-broker.js"),a=un(i)?i:o,u=c(e.ORCHA_RUNTIME_SANDBOX_BROKER_COMMAND);return{mode:t,host:r,port:S(e.ORCHA_RUNTIME_BRIDGE_PORT,5588),token:e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",orchaUrl:c(e.ORCHA_RUNTIME_ORCHA_URL),nodeToken:e.ORCHA_RUNTIME_NODE_TOKEN||e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",nodeId:c(e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"local-runtime-node"),nodeName:c(e.ORCHA_RUNTIME_NODE_NAME||e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"Local Runtime Node"),reconnectMs:S(e.ORCHA_RUNTIME_RECONNECT_MS,3e3),connectTimeoutMs:S(e.ORCHA_RUNTIME_CONNECT_TIMEOUT_MS||e.ORCHA_RUNTIME_WS_CONNECT_TIMEOUT_MS,1e4),defaultTargetCode:e.ORCHA_RUNTIME_DEFAULT_TARGET||"echo",requestLimitBytes:S(e.ORCHA_RUNTIME_REQUEST_LIMIT_BYTES,1048576),initializeTimeoutMs:S(e.ORCHA_RUNTIME_INITIALIZE_TIMEOUT_MS,3e4),sessionPromptTimeoutMs:S(e.ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS,Y),permissionRequestTimeoutMs:S(e.ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS,3e5),sessionIdleTtlMs:S(e.ORCHA_RUNTIME_SESSION_IDLE_TTL_MS,6e5),sessionCleanupIntervalMs:S(e.ORCHA_RUNTIME_SESSION_CLEANUP_INTERVAL_MS,6e4),maxSessionsPerTarget:S(e.ORCHA_RUNTIME_MAX_SESSIONS_PER_TARGET,8),openClawSessionIdleTtlMs:S(e.ORCHA_RUNTIME_OPENCLAW_SESSION_IDLE_TTL_MS,6e4),openClawMaxSessions:S(e.ORCHA_RUNTIME_OPENCLAW_MAX_SESSIONS,1),heartbeatIntervalMs:S(e.ORCHA_RUNTIME_HEARTBEAT_INTERVAL_MS,15e3),sandboxRequired:n,sandboxBrokerCommand:u||process.execPath,sandboxBrokerArguments:xe(e.ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS,"ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS",u?[]:[a]),sandboxProbeTimeoutMs:S(e.ORCHA_RUNTIME_SANDBOX_PROBE_TIMEOUT_MS,1e4),sandboxTempRoot:c(e.ORCHA_RUNTIME_SANDBOX_TEMP_ROOT),trustedWorkspaceRoots:xe(e.ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS,"ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS"),trustedToolchainRoots:xe(e.ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS,"ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS"),egressProxyRequired:Ui(e.ORCHA_RUNTIME_EGRESS_PROXY_REQUIRED,t==="node"),egressProxySocket:c(e.ORCHA_RUNTIME_EGRESS_PROXY_SOCKET),egressProxyToken:c(e.ORCHA_RUNTIME_EGRESS_PROXY_TOKEN),egressGrantMaxTtlMs:S(e.ORCHA_RUNTIME_EGRESS_GRANT_MAX_TTL_MS,9e5),targets:Mi(e.ORCHA_RUNTIME_TARGETS_JSON||"")}}function Mi(e){if(!c(e))return{};try{let t=JSON.parse(e);if(l(t))return t}catch(t){g("warn","config","invalid ORCHA_RUNTIME_TARGETS_JSON",{error:String(t)})}return{}}function Ui(e,t){let r=c(e).toLowerCase();if(!r)return t;if(["true","1","yes","on"].includes(r))return!0;if(["false","0","no","off"].includes(r))return!1;throw new Error(`invalid boolean configuration value: ${r}`)}function xe(e,t,r=[]){let n=c(e);if(!n)return[...r];let s;try{s=JSON.parse(n)}catch{throw new Error(`${t} must be a JSON string array`)}if(!Array.isArray(s)||s.some(i=>typeof i!="string"))throw new Error(`${t} must be a JSON string array`);return s.map(i=>i.trim()).filter(Boolean)}function Pi(e){let t=e.trim();if(!t||t.startsWith("#"))return null;let r=t.startsWith("export ")?t.slice(7).trimStart():t,n=r.indexOf("=");if(n<=0)return null;let s=r.slice(0,n).trim();if(!bi.test(s))return null;let i=Li(r.slice(n+1).trim());return[s,i]}function Li(e){if(!e)return"";let t=e[0];if((t==='"'||t==="'")&&e.endsWith(t)){let r=e.slice(1,-1);return t==='"'?ki(r):r}return vi(e).trim()}function ki(e){return e.replaceAll("\\n",`
-`).replaceAll("\\r","\r").replaceAll("\\t","	").replaceAll('\\"','"').replaceAll("\\\\","\\")}function vi(e){let t=!1,r=!1;for(let n=0;n<e.length;n+=1){let s=e[n],i=e[n-1];if(s==="'"&&!r)t=!t;else if(s==='"'&&!t&&i!=="\\")r=!r;else if(s==="#"&&!t&&!r&&/\s/.test(i||""))return e.slice(0,n)}return e}var qt=class{constructor(t,r,n,s,i={}){this.agent=t,this.target=r,this.options=i,this.sessionKey=n,this.mcp=null,this.metadata=null,this.finished=!1,this.transport=new X(r,{runId:i.runId}),this.expiresAt=new Date(Date.now()+Number(i.sandboxPolicy?.maxRuntimeSeconds||i.sessionPromptTimeoutMs/1e3||Y/1e3)*1e3).toISOString()}async sessionNew({mcpServers:t,metadata:r}){if(r?.source!=="channel_message"||r.delivery?.dispatchMode!=="bridge")throw new Error("Invalid native Channel dispatch");return this.mcp=t[0],this.metadata=r,{sessionId:this.sessionKey}}async refreshMcpServers(t){this.mcp=t[0],this.promptBody&&await this.transport.request("PATCH",{...this.promptBody,mcpServer:this.mcp,attachOnly:!0},!1,"deliveries")}async sessionPrompt({prompt:t},r){if((await this.transport.request("GET",void 0,!1,"deliveries")).streamType!==st)throw P("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");this.promptBody={runId:this.options.runId,agentCode:this.target.openclawAgentId||this.metadata.agentCode,delivery:this.metadata.delivery,expiresAt:this.expiresAt,mcpServer:this.mcp,attachOnly:this.options.attachOnly===!0,prompt:t};let s=await this.transport.request("POST",this.promptBody,!1,"deliveries",Number(this.options.sessionPromptTimeoutMs||Y),i=>r?.(i));return this.finished=!0,s}async stop(){!this.finished&&this.promptBody&&await this.transport.request("DELETE",{runId:this.options.runId},!1,"deliveries")}};function Ne(e){let t=l(e.metadata)?e.metadata:{};return c(t.agentCode)}function fn(e,t,r){let n=c(r?.openclawAgentId)||Ne(e);return n?`agent:${n}:${t}`:`orcha-${t}`}var Gt=class extends ft{constructor(t,r,n,s={},i={}){if(i.source==="channel_message")return new qt(t,r,n,s,i);let o=c(n).replace(/[^A-Za-z0-9._-]+/g,"-")||"default",a=c(r.command)||"openclaw",u=Array.isArray(r.args)?r.args.map(String):[],d=u.length>0?u:["acp","--session",fn(t,o,r)];super(t,{...r,command:a,args:d},s,i),this.boundSessionKey=fn(t,o,r),this.binding=null}async sessionNew(t={}){if(t.mcpServers?.length){let r=[...this.target.args],n=r.indexOf("--session"),s=r.find(u=>u.startsWith("--session=")),i=s?s.slice(10):n<0?null:r[n+1];if(i&&i!==this.boundSessionKey)throw Object.assign(new Error("OpenClaw --session must match this Orcha task's private session"),{code:"OPENCLAW_SESSION_BINDING_CONFLICT"});i===null&&r.push("--session",this.boundSessionKey),this.target.args=r;let o=c(this.options.runId),a=Number(this.options.sandboxPolicy?.maxRuntimeSeconds||this.options.sessionPromptTimeoutMs/1e3||Y/1e3);if(!o||!Ne(this.agent))throw new Error("OpenClaw MCP requires a trusted task and Agent identity");this.binding=new X(this.target,{runId:o,sessionKey:this.boundSessionKey,agentCode:c(this.target.openclawAgentId)||Ne(this.agent),expiresAt:new Date(Date.now()+a*1e3).toISOString()}),await this.binding.bind(t.mcpServers)}try{return await super.sessionNew(t)}catch(r){throw await this.binding?.close(),r}}async refreshMcpServers(t){if(!this.binding)throw Object.assign(new Error("The original OpenClaw task binding is unavailable"),{code:"RUNTIME_OPERATION_NOT_FOUND"});await this.binding.bind(t,!0)}async stop(t){try{await super.stop(t)}finally{await this.binding?.close()}}sessionNewParams(t={}){return{...t,mcpServers:[]}}};import{spawn as An}from"node:child_process";import{randomUUID as pt}from"node:crypto";import{existsSync as xn,mkdirSync as Qi,readdirSync as Nn,readFileSync as bn,realpathSync as It,rmSync as Zi,rmdirSync as to,statSync as eo,unlinkSync as ro}from"node:fs";import{homedir as no,tmpdir as Mn}from"node:os";import{basename as ve,dirname as so,join as $,resolve as En}from"node:path";import{createHash as Gi,randomUUID as Ki}from"node:crypto";import{mkdirSync as gn,readFileSync as zi,renameSync as Vi,rmSync as Ji,writeFileSync as _n}from"node:fs";import{homedir as Me}from"node:os";import{join as it}from"node:path";import{createHash as pn}from"node:crypto";import{constants as be}from"node:fs";import{open as Di,realpath as hn}from"node:fs/promises";import{basename as Hi,isAbsolute as $i,relative as Fi,resolve as Bi}from"node:path";var ji=32*1024*1024,qi={name:"send_file",description:"Send one explicitly selected local file to the current OrchaAI conversation. Use this to deliver images, PDFs, documents, spreadsheets or other files to the user; viewing an image or writing a local Markdown link does not send it. path must be in the current workspace, a configured artifact root, or (Codex only) the current thread's generated_images directory. Copy other intended deliverables into the workspace first. Success means the attachment message is saved; do not send it again or embed the local path. Internal previews and intermediate files need not be sent.",inputSchema:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string",minLength:1,description:"Absolute file path, or a path relative to the current workspace."},message:{type:"string",maxLength:1e4,description:"Optional caption for the attachment message."}}}};function mn(e){return{...qi,async call(t,{upstream:r,signal:n}){if(!t||typeof t.path!="string"||!t.path.trim()||Object.keys(t).some(E=>!["path","message"].includes(E))||t.message!==void 0&&(typeof t.message!="string"||t.message.length>1e4))throw new Error("send_file requires a file path and an optional caption of at most 10000 characters");let{cwd:s,roots:i}=e();if(!s)throw new Error("The current file delivery workspace is unavailable");let o=await hn(Bi(s,t.path)),a=!1;for(let E of i)try{let R=Fi(await hn(E),o);(!R||R!==".."&&!R.startsWith("../")&&!R.startsWith("..\\")&&!$i(R))&&(a=!0)}catch{}if(!a)throw new Error("File is outside the current workspace and authorized artifact roots");let u=await Di(o,be.O_RDONLY|be.O_NOFOLLOW|be.O_NONBLOCK),d;try{let E=await u.stat();if(!E.isFile()||E.size<=0||E.size>ji)throw new Error("Select a non-empty regular file of at most 32 MiB");d=Buffer.alloc(E.size);let R=0;for(;R<d.length;){let{bytesRead:M}=await u.read(d,R,d.length-R,R);if(!M)throw new Error("File changed while preparing delivery; retry after it is saved");R+=M}let N=await u.stat();if(N.size!==E.size||N.mtimeMs!==E.mtimeMs)throw new Error("File changed while preparing delivery; retry after it is saved")}finally{await u.close()}let f=t.message||"",h=Hi(o),p=pn("sha256").update(d).digest("hex"),m=pn("sha256").update(JSON.stringify([o,p,f])).digest("hex"),y=new FormData;y.set("deliveryId",m),y.set("message",f),y.set("file",new Blob([d]),h);let w=new URL(r.url);w.pathname=`${w.pathname.replace(/\/$/,"")}/files`;let I=await fetch(w,{method:"POST",headers:{authorization:r.headers.authorization},body:y,redirect:"error",signal:AbortSignal.any([n,AbortSignal.timeout(12e4)])});if(!I.ok)throw new Error(`File delivery failed (HTTP ${I.status}); no successful receipt was received`);let _=await I.json();if(!_.success)throw new Error(`File delivery failed: ${String(_.message||_.code||"request rejected").slice(0,512)}`);let T=_.data;if(!T?.accepted||typeof T.messageId!="string"||!T.messageId||typeof T.fileId!="string"||!T.fileId)throw new Error("File delivery did not return a saved message and file receipt");return{content:[{type:"text",text:JSON.stringify(T)}],structuredContent:T,isError:!1}}}}var yn=e=>Gi("sha256").update(JSON.stringify(e)).digest("hex"),q=(e,t)=>Object.assign(new Error(t),{code:e}),wn=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,Ue="ORCHA_TASK_MCP_TOKEN",Wi=new Set(["--no-session-persistence","--resume","-r","--continue","-c","--session-id","--fork-session"]);function Xi(e){return typeof e=="string"?e:Array.isArray(e)?e.filter(t=>t?.type==="text").map(t=>t.text).join(`
-`):""}function Yi(e,t,r){if(!["assistant","user"].includes(e?.type))return null;let n=e.parent_tool_use_id?[]:Array.isArray(e.message?.content)?e.message.content:[],s=[];for(let i of n)e.type==="user"?i?.type==="tool_result"&&i.tool_use_id&&s.push({sessionUpdate:"tool_call_update",toolCallId:i.tool_use_id,status:i.is_error?"failed":"completed",rawOutput:Xi(i.content)}):i?.type==="text"&&i.text?t.text=t.text?`${t.text}
+`;this.child.stdin.write(s,r)}onNotification(t,r){let n=this.notificationHandlers.get(t)||new Set;return n.add(r),this.notificationHandlers.set(t,n),()=>{n.delete(r),n.size===0&&this.notificationHandlers.delete(t)}}onRequest(t,r){return this.requestHandlers.set(t,r),()=>this.requestHandlers.delete(t)}onExit(t){return this.exitHandlers.add(t),()=>this.exitHandlers.delete(t)}rejectAll(t){for(let r of this.pending.values())clearTimeout(r.timer),r.reject(t);this.pending.clear()}handleExit(t,r){this.exited=!0,this.exitCode=t,this.exitSignal=r,this.rejectAll(new Error(`runtime exited before response (${t}/${r})`));for(let n of this.exitHandlers)n(t,r)}async waitForExit(t=5e3){return!this.child||this.exited?!0:await new Promise(r=>{let n=setTimeout(()=>{s(),r(!1)},t);n.unref?.();let s=()=>{clearTimeout(n),this.exitHandlers.delete(i)},i=()=>{s(),r(!0)};this.exitHandlers.add(i),this.exited&&i()})}signal(t){if(!this.child||this.exited)return!1;let r=this.child.pid;if(!r)return!1;try{return this.detached&&process.platform!=="win32"?process.kill(-r,t):this.child.kill(t),!0}catch(n){if(n?.code==="ESRCH")return this.exited=!0,!1;try{return this.child.kill(t),!0}catch(s){return s?.code!=="ESRCH"&&_("warn","runtime","runtime signal failed",{target:this.label,pid:r,signal:t,error:String(s)}),!1}}}async stop(t="stop",{termTimeoutMs:r=5e3,killTimeoutMs:n=2e3}={}){if(!(!this.child||this.exited)){if(this.stopPromise)return await this.stopPromise;this.stopPromise=(async()=>{if(!this.child||this.exited)return;let s=this.child.pid;_("info","runtime","stopping runtime",{target:this.label,reason:t,pid:s}),this.rejectAll(new Error(`runtime stopped: ${t}`)),this.signal("SIGTERM"),!await this.waitForExit(r)&&this.child&&!this.exited&&(_("warn","runtime","runtime did not exit after SIGTERM; force killing",{target:this.label,reason:t,pid:s}),this.signal("SIGKILL"),await this.waitForExit(n))})();try{await this.stopPromise}finally{this.stopPromise=null}}}};import{randomUUID as pn}from"node:crypto";import{existsSync as Li,readFileSync as ki,realpathSync as un,statSync as vi}from"node:fs";import{basename as fn,extname as mn,isAbsolute as Nt,join as Di,relative as hn,resolve as ln}from"node:path";var $i=25*1024*1024;function gn(e,t=""){let r=u(t);if(r)return r;let n=mn(u(e)).toLowerCase();return n===".jpg"||n===".jpeg"?"image/jpeg":n===".webp"?"image/webp":n===".gif"?"image/gif":"image/png"}function _n(e,t){let r=typeof e=="string"?e.trim():"";return!r||r==="<omitted>"?"":r.startsWith("data:")?r:`data:${t};base64,${r.replace(/\s+/g,"")}`}function zt(e){if(Array.isArray(e))return e.map(u).filter(Boolean);let t=u(e);return t?[t]:[]}function Hi(e,t){let r=hn(t,e);return r===""||!!r&&!r.startsWith("..")&&!Nt(r)}function Fi(e,t){let r=u(e);if(!r||!Li(r))return"";try{let n=un(r);for(let s of t)try{let i=un(s);if(Hi(n,i))return n}catch{}}catch{return""}return""}function Bi(e,t){let r=u(e);if(!r||!Nt(r))return r;for(let n of Array.isArray(t)?t:[]){if(!d(n))continue;let s=u(n.runtimeRoot),i=u(n.hostRoot);if(!s||!i||!Nt(s)||!Nt(i))continue;let o=hn(ln(s),ln(r));if(o===""||!o.startsWith("..")&&!Nt(o))return o?Di(i,o):i}return r}function Me(e,t,r={}){let n=u(e);return!n||n.startsWith("data:")||/^https?:\/\//i.test(n)?n:ji(n,t,r)}function ji(e,t,r={}){let n=[...zt(r.trustedFileRoots),...zt(r.trustedFileRoot),...zt(r.artifactRoots),...zt(r.artifactRoot)],s=Fi(Bi(e,r.pathMappings),n);if(!s)return"";try{let i=vi(s);return!i.isFile()||i.size<=0||i.size>$i?"":`data:${t};base64,${ki(s).toString("base64")}`}catch{return""}}function L(...e){for(let t of e){let r=u(t);if(r)return r}return""}function qi(e,t,r,n){let s=r.toLowerCase();if(s==="image"||s==="picture")return!0;let i=L(n,e.previewUrl,e.fileUrl,e.imageUrl,e.dataUrl,e.url,e.uri,t.previewUrl,t.fileUrl,t.imageUrl,t.dataUrl,t.url,t.uri),o=mn(i.split("?",1)[0].split("#",1)[0]).toLowerCase();return[".png",".jpg",".jpeg",".webp",".gif"].includes(o)}function Pe(e,t={}){let{source:r="runtime_image_generation_event"}=t;if(!d(e))return null;let n=d(e.payload)?e.payload:{},s=u(e.type),i=u(n.type);if(!(s==="event_msg"&&i==="image_generation_end"||s==="response_item"&&i==="image_generation_call"))return null;let o=L(n.call_id,n.id),a=L(n.saved_path,n.savedPath),c=L(n.revised_prompt,n.revisedPrompt),l=gn(a,n.mimeType||n.mime_type),p=_n(n.result,l)||Me(a,l,t);if(!p)return null;let m=p.startsWith("data:")?p:"",f=a?fn(a):`${o||pn()}.png`;return{artifactType:"image",type:"image",fieldKey:"image",title:f||"Generated image",summary:c||"Generated image",content:{prompt:c||void 0,dataUrl:m||void 0,imageUrl:p,previewUrl:p,fileUrl:p,mimeType:l},dataUrl:m||void 0,previewUrl:p,fileUrl:p,metadata:{source:r,eventType:i,callId:o||void 0,savedPath:a||void 0,filename:f,mimeType:l,revisedPrompt:c||void 0}}}function Gi(e){let t=d(e)?e:{},r=[];for(let n of["_artifacts","artifacts"]){let s=t[n];Array.isArray(s)&&r.push(...s)}for(let n of["_artifact","artifact"]){let s=t[n];d(s)&&r.push(s)}return r}function Ki(e,t={}){let{source:r="runtime_artifact"}=t,n=d(e)?e:{};if(!Object.keys(n).length)return null;let s=d(n.content)?{...n.content}:{},i=d(n.metadata)?{...n.metadata}:{},o=L(n.saved_path,n.savedPath,s.saved_path,s.savedPath,i.savedPath),a=L(n.mimeType,n.mime_type,s.mimeType,s.mime_type,i.mimeType),c=L(n.artifactType,n.artifact_type,n.type,n.kind,s.type,o?"image":"file"),l=qi(n,s,c,o),p=l?gn(o,a):a;if(l){let x=L(n.dataUrl,s.dataUrl),g=x.startsWith("data:")?x:"",E=L(n.imageUrl,n.previewUrl,n.fileUrl,n.downloadUrl,n.url,n.uri,s.imageUrl,s.previewUrl,s.fileUrl,s.downloadUrl,s.url,s.uri),w=_n(n.result??s.result,p)||g||Me(o,p,t)||Me(E,p,t);w&&(w.startsWith("data:")&&(s.dataUrl||=w),s.imageUrl||=w,s.previewUrl||=w,s.fileUrl||=w,p&&(s.mimeType||=p))}for(let[x,g]of[["prompt","prompt"],["previewUrl","previewUrl"],["fileUrl","fileUrl"],["downloadUrl","downloadUrl"],["imageUrl","imageUrl"],["dataUrl","dataUrl"],["url","url"],["uri","uri"],["mimeType","mimeType"],["mime_type","mimeType"]]){let E=n[x];E!=null&&E!==""&&!(g in s)&&(s[g]=E)}let m=L(n.fileUrl,n.downloadUrl,n.imageUrl,n.dataUrl,n.url,n.uri,s.fileUrl,s.downloadUrl,s.imageUrl,s.dataUrl,s.url,s.uri),f=L(n.previewUrl,n.imageUrl,n.dataUrl,n.url,n.fileUrl,n.uri,s.previewUrl,s.imageUrl,s.dataUrl,s.url,s.fileUrl,s.uri),h=L(n.dataUrl,s.dataUrl,m.startsWith("data:")?m:"",f.startsWith("data:")?f:""),y=L(n.filename,i.filename,o?fn(o):""),T=L(n.fieldKey,n.field_key,s.fieldKey,i.fieldKey,l?"image":"artifact");return{...n,artifactType:c,type:n.type||c,fieldKey:T,title:L(n.title,y,"Runtime artifact"),summary:L(n.summary,s.prompt,n.title,y,"Runtime artifact"),content:s,dataUrl:h||void 0,fileUrl:m||void 0,previewUrl:f||void 0,metadata:{...i,source:L(i.source,r),savedPath:o||i.savedPath,filename:y||i.filename,mimeType:p||i.mimeType}}}function Vt(e,t){if(!t||!e)return;let r=d(t.metadata)?t.metadata:{},n=L(r.savedPath,r.callId,t.previewUrl,t.fileUrl)||pn(),s=e.get(n);if(!s){e.set(n,t);return}s.content={...d(s.content)?s.content:{},...d(t.content)?t.content:{}},s.metadata={...d(s.metadata)?s.metadata:{},...r},s.previewUrl=t.previewUrl||s.previewUrl,s.fileUrl=t.fileUrl||s.fileUrl,s.summary=t.summary||s.summary,s.title=t.title||s.title}function Ue(e,t,r={}){for(let n of Gi(e))Vt(t,Ki(n,r))}function Le(e){if(!d(e)||!d(e.payload))return d(e)?e:{value:e};let t=u(e.payload.type);if(t!=="image_generation_end"&&t!=="image_generation_call")return e;let r={...e.payload};return typeof r.result=="string"&&r.result&&(r.result="<omitted>",r.resultLength=e.payload.result.length),{...e,payload:r}}function dn(e,t,r){if(!d(e))return e;let n=d(e.event)?e.event:null;return n?(Vt(t,Pe(n,r)),{...e,event:Le(n)}):e}function yn(e,t,r={}){if(!d(e))return e;Ue(e,t,r);let n=dn(e,t,r),s=d(n.update)?dn(n.update,t,r):null;return s&&s!==n.update&&(n={...n,update:s}),n}function Tn(e,t,r={}){let n=d(e)?{...e}:{};Ue(n,t,r),Ue(d(n.output)?n.output:{},t,r);let s=[...t?.values?.()||[]];return s.length&&(n._artifacts=s),delete n.artifacts,n}function wn(e,t){let r=R(e,t);return r>0?r:t}var ht=class{constructor(t,r,n={},s={}){this.agent=t,this.target=r,this.callbacks=n,this.options=s,this.proc=null,this.launch=null,this.launchCleanup=null,this.permissionHandlers=new Map}async ensureStarted(){if(this.proc)return;let t=u(this.target.command);if(!t)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let r={command:t,args:U(this.target.args),cwd:J(this.target,this.agent.workspace),environment:d(this.target.env)?this.target.env:{}},n=this.options.prepareLaunch?await this.options.prepareLaunch(r):{...r,environment:{...process.env,...r.environment},cleanup:async()=>{}};this.launch=n,this.launchCleanup=n.cleanup,this.proc=new Kt({command:n.command,args:n.args,cwd:n.cwd,env:n.environment,label:`${this.agent.agentId}:${this.agent.targetCode}`,framing:u(this.target.framing||"line")}),this.proc.onRequest("session/request_permission",s=>this.handlePermissionRequest(s)),this.proc.onRequest("session/requestPermission",s=>this.handlePermissionRequest(s));try{await this.proc.start({initialize:this.target.initialize!==!1,initializeTimeoutMs:wn(this.target.initializeTimeoutMs,wn(this.options.initializeTimeoutMs,3e4)),initializeParams:{clientInfo:{name:"orcha-runtime-bridge",version:K},...d(this.target.initializeParams)?this.target.initializeParams:{}}})}catch(s){throw await this.proc?.stop("runtime startup failed"),this.proc=null,await this.cleanupLaunch(),s}}async sessionNew(t={}){return await this.ensureStarted(),this.proc.call("session/new",this.sessionNewParams(t))}sessionNewParams(t={}){let r=Array.isArray(t.mcpServers)?t.mcpServers:Array.isArray(this.target.mcpServers)?this.target.mcpServers:[];return{...t,mcpServers:r}}async sessionPrompt(t,r){await this.ensureStarted();let n=u(t.sessionId),s=new Map,i=this.artifactOptions(),o=this.proc.onNotification("session/update",c=>{let l=u(c.sessionId);(!l||l===n)&&r(yn(c,s,i))}),a=async c=>this.callbacks.onPermissionRequest?.({agent:this.agent,runtimeSessionId:n,request:c,emitUpdate:r})||{outcome:"denied",reason:"permission handler is not configured"};n&&this.permissionHandlers.set(n,a),this.permissionHandlers.set("*",a);try{let c=await this.proc.call("session/prompt",t,this.options.sessionPromptTimeoutMs);return Tn(c,s,i)}finally{o(),n&&this.permissionHandlers.delete(n),this.permissionHandlers.delete("*")}}async sessionCancel(t){return await this.ensureStarted(),this.proc.call("session/cancel",t,5e3).catch(()=>({ok:!0}))}async handlePermissionRequest(t){let r=u(t.sessionId),n=this.permissionHandlers.get(r)||this.permissionHandlers.get("*");return n?n(t):{outcome:"denied",reason:"no active Orcha permission handler"}}artifactSource(){return u(this.target.type||"acp")==="openclaw"?"openclaw_image_generation":"acp_runtime_image_generation"}artifactOptions(){let t=d(this.target.env)?this.target.env:{};return{source:this.artifactSource(),trustedFileRoots:[u(this.launch?.artifactDirectory),u(this.launch?.homeDirectory),u(this.target.artifactRoot),u(this.target.artifactDir),u(this.target.runtimeArtifactRoot),u(t.ORCHA_RUNTIME_ARTIFACT_DIR),...U(this.target.trustedArtifactRoots),...U(this.target.trustedFileRoots),...U(this.target.artifactRoots),...U(this.target.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(this.launch?.pathMappings)?this.launch.pathMappings:[]}}async stop(t){try{await this.proc?.stop(t)}finally{this.proc=null,await this.cleanupLaunch()}}async cleanupLaunch(){let t=this.launchCleanup;this.launchCleanup=null,this.launch=null,await t?.()}};import{existsSync as En,readFileSync as zi}from"node:fs";import{dirname as Vi,resolve as Jt}from"node:path";import{fileURLToPath as Ji}from"node:url";var Wi=/^[A-Za-z_][A-Za-z0-9_]*$/,z=24*60*60*1e3;function Sn(e=process.env,t=process.cwd()){let r=u(e.ORCHA_RUNTIME_ENV_FILE),n=r?Jt(t,r):Jt(t,".env");if(!En(n))return r&&_("warn","config","runtime env file not found",{path:n}),{loaded:!1,path:n,keys:[]};let s=[],i=zi(n,"utf8");for(let o of i.split(/\r?\n/)){let a=Qi(o);if(!a)continue;let[c,l]=a;Object.prototype.hasOwnProperty.call(e,c)||(e[c]=l,s.push(c))}return _("info","config","runtime env file loaded",{path:n,keyCount:s.length}),{loaded:!0,path:n,keys:s}}function Rn(e=process.env){let t=u(e.ORCHA_RUNTIME_MODE||(e.ORCHA_RUNTIME_ORCHA_URL?"node":"server")),r=u(e.ORCHA_RUNTIME_BRIDGE_HOST||"127.0.0.1"),n=!1,s=Vi(Ji(import.meta.url)),i=Jt(s,"sandbox","broker.js"),o=Jt(s,"orcha-runtime-sandbox-broker.js"),a=En(i)?i:o,c=u(e.ORCHA_RUNTIME_SANDBOX_BROKER_COMMAND);return{mode:t,host:r,port:R(e.ORCHA_RUNTIME_BRIDGE_PORT,5588),token:e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",orchaUrl:u(e.ORCHA_RUNTIME_ORCHA_URL),nodeToken:e.ORCHA_RUNTIME_NODE_TOKEN||e.ORCHA_RUNTIME_BRIDGE_TOKEN||"",nodeId:u(e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"local-runtime-node"),nodeName:u(e.ORCHA_RUNTIME_NODE_NAME||e.ORCHA_RUNTIME_NODE_ID||e.HOSTNAME||"Local Runtime Node"),reconnectMs:R(e.ORCHA_RUNTIME_RECONNECT_MS,3e3),connectTimeoutMs:R(e.ORCHA_RUNTIME_CONNECT_TIMEOUT_MS||e.ORCHA_RUNTIME_WS_CONNECT_TIMEOUT_MS,1e4),defaultTargetCode:e.ORCHA_RUNTIME_DEFAULT_TARGET||"echo",requestLimitBytes:R(e.ORCHA_RUNTIME_REQUEST_LIMIT_BYTES,1048576),initializeTimeoutMs:R(e.ORCHA_RUNTIME_INITIALIZE_TIMEOUT_MS,3e4),sessionPromptTimeoutMs:R(e.ORCHA_RUNTIME_SESSION_PROMPT_TIMEOUT_MS,z),permissionRequestTimeoutMs:R(e.ORCHA_RUNTIME_PERMISSION_TIMEOUT_MS,3e5),sessionIdleTtlMs:R(e.ORCHA_RUNTIME_SESSION_IDLE_TTL_MS,6e5),sessionCleanupIntervalMs:R(e.ORCHA_RUNTIME_SESSION_CLEANUP_INTERVAL_MS,6e4),maxSessionsPerTarget:R(e.ORCHA_RUNTIME_MAX_SESSIONS_PER_TARGET,8),openClawSessionIdleTtlMs:R(e.ORCHA_RUNTIME_OPENCLAW_SESSION_IDLE_TTL_MS,6e4),openClawMaxSessions:R(e.ORCHA_RUNTIME_OPENCLAW_MAX_SESSIONS,1),heartbeatIntervalMs:R(e.ORCHA_RUNTIME_HEARTBEAT_INTERVAL_MS,15e3),sandboxRequired:n,sandboxBrokerCommand:c||process.execPath,sandboxBrokerArguments:ke(e.ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS,"ORCHA_RUNTIME_SANDBOX_BROKER_ARGUMENTS",c?[]:[a]),sandboxProbeTimeoutMs:R(e.ORCHA_RUNTIME_SANDBOX_PROBE_TIMEOUT_MS,1e4),sandboxTempRoot:u(e.ORCHA_RUNTIME_SANDBOX_TEMP_ROOT),trustedWorkspaceRoots:ke(e.ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS,"ORCHA_RUNTIME_TRUSTED_WORKSPACE_ROOTS"),trustedToolchainRoots:ke(e.ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS,"ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS"),egressProxyRequired:Yi(e.ORCHA_RUNTIME_EGRESS_PROXY_REQUIRED,t==="node"),egressProxySocket:u(e.ORCHA_RUNTIME_EGRESS_PROXY_SOCKET),egressProxyToken:u(e.ORCHA_RUNTIME_EGRESS_PROXY_TOKEN),egressGrantMaxTtlMs:R(e.ORCHA_RUNTIME_EGRESS_GRANT_MAX_TTL_MS,9e5),targets:Xi(e.ORCHA_RUNTIME_TARGETS_JSON||"")}}function Xi(e){if(!u(e))return{};try{let t=JSON.parse(e);if(d(t))return t}catch(t){_("warn","config","invalid ORCHA_RUNTIME_TARGETS_JSON",{error:String(t)})}return{}}function Yi(e,t){let r=u(e).toLowerCase();if(!r)return t;if(["true","1","yes","on"].includes(r))return!0;if(["false","0","no","off"].includes(r))return!1;throw new Error(`invalid boolean configuration value: ${r}`)}function ke(e,t,r=[]){let n=u(e);if(!n)return[...r];let s;try{s=JSON.parse(n)}catch{throw new Error(`${t} must be a JSON string array`)}if(!Array.isArray(s)||s.some(i=>typeof i!="string"))throw new Error(`${t} must be a JSON string array`);return s.map(i=>i.trim()).filter(Boolean)}function Qi(e){let t=e.trim();if(!t||t.startsWith("#"))return null;let r=t.startsWith("export ")?t.slice(7).trimStart():t,n=r.indexOf("=");if(n<=0)return null;let s=r.slice(0,n).trim();if(!Wi.test(s))return null;let i=Zi(r.slice(n+1).trim());return[s,i]}function Zi(e){if(!e)return"";let t=e[0];if((t==='"'||t==="'")&&e.endsWith(t)){let r=e.slice(1,-1);return t==='"'?to(r):r}return eo(e).trim()}function to(e){return e.replaceAll("\\n",`
+`).replaceAll("\\r","\r").replaceAll("\\t","	").replaceAll('\\"','"').replaceAll("\\\\","\\")}function eo(e){let t=!1,r=!1;for(let n=0;n<e.length;n+=1){let s=e[n],i=e[n-1];if(s==="'"&&!r)t=!t;else if(s==='"'&&!t&&i!=="\\")r=!r;else if(s==="#"&&!t&&!r&&/\s/.test(i||""))return e.slice(0,n)}return e}var Wt=class{constructor(t,r,n,s,i={}){this.agent=t,this.target=r,this.options=i,this.sessionKey=n,this.mcp=null,this.metadata=null,this.finished=!1,this.transport=new tt(r,{runId:i.runId}),this.expiresAt=new Date(Date.now()+Number(i.sandboxPolicy?.maxRuntimeSeconds||i.sessionPromptTimeoutMs/1e3||z/1e3)*1e3).toISOString()}async sessionNew({mcpServers:t,metadata:r}){if(r?.source!=="channel_message"||r.delivery?.dispatchMode!=="bridge")throw new Error("Invalid native Channel dispatch");return this.mcp=t[0],this.metadata=r,{sessionId:this.sessionKey}}async refreshMcpServers(t){this.mcp=t[0],this.promptBody&&await this.transport.request("PATCH",{...this.promptBody,mcpServer:this.mcp,attachOnly:!0},!1,"deliveries")}async sessionPrompt({prompt:t},r){if((await this.transport.request("GET",void 0,!1,"deliveries")).streamType!==it)throw v("OPENCLAW_CHANNEL_PROTOCOL_MISMATCH");this.promptBody={runId:this.options.runId,agentCode:this.target.openclawAgentId||this.metadata.agentCode,delivery:this.metadata.delivery,expiresAt:this.expiresAt,mcpServer:this.mcp,attachOnly:this.options.attachOnly===!0,prompt:t};let s=await this.transport.request("POST",this.promptBody,!1,"deliveries",Number(this.options.sessionPromptTimeoutMs||z),i=>r?.(i));return this.finished=!0,s}async stop(){!this.finished&&this.promptBody&&await this.transport.request("DELETE",{runId:this.options.runId},!1,"deliveries")}};function ve(e){let t=d(e.metadata)?e.metadata:{};return u(t.agentCode)}function On(e,t,r){let n=u(r?.openclawAgentId)||ve(e);return n?`agent:${n}:${t}`:`orcha-${t}`}var Xt=class extends ht{constructor(t,r,n,s={},i={}){if(i.source==="channel_message")return new Wt(t,r,n,s,i);let o=u(n).replace(/[^A-Za-z0-9._-]+/g,"-")||"default",a=u(r.command)||"openclaw",c=Array.isArray(r.args)?r.args.map(String):[],l=c.length>0?c:["acp","--session",On(t,o,r)];super(t,{...r,command:a,args:l},s,i),this.boundSessionKey=On(t,o,r),this.binding=null}async sessionNew(t={}){if(t.mcpServers?.length){let r=[...this.target.args],n=r.indexOf("--session"),s=r.find(c=>c.startsWith("--session=")),i=s?s.slice(10):n<0?null:r[n+1];if(i&&i!==this.boundSessionKey)throw Object.assign(new Error("OpenClaw --session must match this Orcha task's private session"),{code:"OPENCLAW_SESSION_BINDING_CONFLICT"});i===null&&r.push("--session",this.boundSessionKey),this.target.args=r;let o=u(this.options.runId),a=Number(this.options.sandboxPolicy?.maxRuntimeSeconds||this.options.sessionPromptTimeoutMs/1e3||z/1e3);if(!o||!ve(this.agent))throw new Error("OpenClaw MCP requires a trusted task and Agent identity");this.binding=new tt(this.target,{runId:o,sessionKey:this.boundSessionKey,agentCode:u(this.target.openclawAgentId)||ve(this.agent),expiresAt:new Date(Date.now()+a*1e3).toISOString()}),await this.binding.bind(t.mcpServers)}try{return await super.sessionNew(t)}catch(r){throw await this.binding?.close(),r}}async refreshMcpServers(t){if(!this.binding)throw Object.assign(new Error("The original OpenClaw task binding is unavailable"),{code:"RUNTIME_OPERATION_NOT_FOUND"});await this.binding.bind(t,!0)}async stop(t){try{await super.stop(t)}finally{await this.binding?.close()}}sessionNewParams(t={}){return{...t,mcpServers:[]}}};import{spawn as qn}from"node:child_process";import{randomUUID as gt}from"node:crypto";import{existsSync as Gn,mkdirSync as Ro,readdirSync as Kn,readFileSync as zn,realpathSync as Ut,rmSync as Oo,rmdirSync as Io,statSync as Co,unlinkSync as xo}from"node:fs";import{homedir as Ao,tmpdir as Vn}from"node:os";import{basename as Ge,dirname as No,join as j,resolve as $n}from"node:path";import{createHash as ho,randomUUID as go}from"node:crypto";import{mkdirSync as Pn,readFileSync as _o,renameSync as yo,rmSync as To,writeFileSync as Ln}from"node:fs";import{homedir as He}from"node:os";import{join as at}from"node:path";import{createHash as In}from"node:crypto";import{constants as De}from"node:fs";import{open as ro,realpath as Cn}from"node:fs/promises";import{basename as no,isAbsolute as so,relative as io,resolve as oo}from"node:path";var ao=32*1024*1024,co={name:"send_file",description:"Send one explicitly selected local file to the current OrchaAI conversation. Use this to deliver images, PDFs, documents, spreadsheets or other files to the user; viewing an image or writing a local Markdown link does not send it. path must be in the current workspace, a configured artifact root, or (Codex only) the current thread's generated_images directory. Copy other intended deliverables into the workspace first. Success means the attachment message is saved; do not send it again or embed the local path. Internal previews and intermediate files need not be sent.",inputSchema:{type:"object",additionalProperties:!1,required:["path"],properties:{path:{type:"string",minLength:1,description:"Absolute file path, or a path relative to the current workspace."},message:{type:"string",maxLength:1e4,description:"Optional caption for the attachment message."}}}};function xn(e){return{...co,async call(t,{upstream:r,signal:n}){if(!t||typeof t.path!="string"||!t.path.trim()||Object.keys(t).some(w=>!["path","message"].includes(w))||t.message!==void 0&&(typeof t.message!="string"||t.message.length>1e4))throw new Error("send_file requires a file path and an optional caption of at most 10000 characters");let{cwd:s,roots:i}=e();if(!s)throw new Error("The current file delivery workspace is unavailable");let o=await Cn(oo(s,t.path)),a=!1;for(let w of i)try{let O=io(await Cn(w),o);(!O||O!==".."&&!O.startsWith("../")&&!O.startsWith("..\\")&&!so(O))&&(a=!0)}catch{}if(!a)throw new Error("File is outside the current workspace and authorized artifact roots");let c=await ro(o,De.O_RDONLY|De.O_NOFOLLOW|De.O_NONBLOCK),l;try{let w=await c.stat();if(!w.isFile()||w.size<=0||w.size>ao)throw new Error("Select a non-empty regular file of at most 32 MiB");l=Buffer.alloc(w.size);let O=0;for(;O<l.length;){let{bytesRead:N}=await c.read(l,O,l.length-O,O);if(!N)throw new Error("File changed while preparing delivery; retry after it is saved");O+=N}let M=await c.stat();if(M.size!==w.size||M.mtimeMs!==w.mtimeMs)throw new Error("File changed while preparing delivery; retry after it is saved")}finally{await c.close()}let p=t.message||"",m=no(o),f=In("sha256").update(l).digest("hex"),h=In("sha256").update(JSON.stringify([o,f,p])).digest("hex"),y=new FormData;y.set("deliveryId",h),y.set("message",p),y.set("file",new Blob([l]),m);let T=new URL(r.url);T.pathname=`${T.pathname.replace(/\/$/,"")}/files`;let x=await fetch(T,{method:"POST",headers:{authorization:r.headers.authorization},body:y,redirect:"error",signal:AbortSignal.any([n,AbortSignal.timeout(12e4)])});if(!x.ok)throw new Error(`File delivery failed (HTTP ${x.status}); no successful receipt was received`);let g=await x.json();if(!g.success)throw new Error(`File delivery failed: ${String(g.message||g.code||"request rejected").slice(0,512)}`);let E=g.data;if(!E?.accepted||typeof E.messageId!="string"||!E.messageId||typeof E.fileId!="string"||!E.fileId)throw new Error("File delivery did not return a saved message and file receipt");return{content:[{type:"text",text:JSON.stringify(E)}],structuredContent:E,isError:!1}}}}var $e="permission_prompt",uo=27e4,lo=new Set(["Bash","PowerShell"]),po=new Set(["Edit","Write","MultiEdit","NotebookEdit"]),An=2e3,Nn=50;function ot(e,t=0){return typeof e=="string"?e.length>An?`${e.slice(0,An)}\u2026`:e:t>=4&&(Array.isArray(e)||d(e))?"\u2026":Array.isArray(e)?e.slice(0,Nn).map(r=>ot(r,t+1)):d(e)?Object.fromEntries(Object.entries(e).slice(0,Nn).map(([r,n])=>[r,ot(n,t+1)])):e}function fo(e){let t=String(e.tool_name),r=e.input,n=lo.has(t)?"command":po.has(t)?"file_change":"other",s=r.file_path||r.notebook_path;return{runtime:"claude",kind:n,toolName:t,title:typeof r.description=="string"?r.description:"",...n==="command"&&typeof r.command=="string"?{command:r.command}:{},...n==="file_change"&&typeof s=="string"?{paths:[s]}:{},input:ot(r)}}function bn(e){return{name:$e,description:"Internal OrchaAI approval channel for Claude Code permission prompts. Never call this tool directly.",inputSchema:{type:"object",required:["tool_name","input"],properties:{tool_name:{type:"string"},input:{type:"object"},tool_use_id:{type:"string"}}},async call(t,{signal:r}){if(!t||typeof t.tool_name!="string"||!d(t.input))throw new Error("permission_prompt requires tool_name and input");let n=await e(fo(t),{signal:r,maxTimeoutMs:uo}),s=n?.response?.reason||n?.reason||n?.outcome||"not approved",i=n?.outcome==="approved"?{behavior:"allow",updatedInput:t.input}:{behavior:"deny",message:`OrchaAI did not approve this action (${s}). Do not retry the same action unless the user asks.`};return{content:[{type:"text",text:JSON.stringify(i)}]}}}}var mo=new Set(["threadId","turnId","itemId","approvalId","startedAtMs","environmentId","command","cwd","reason"]);function Mn(e,t,r){let n=Object.fromEntries(Object.entries(t).filter(([i,o])=>!mo.has(i)&&o!=null)),s={runtime:"codex",title:typeof t.reason=="string"?t.reason:"",input:ot(n)};if(e==="item/commandExecution/requestApproval")return{...s,kind:"command",toolName:"shell",...typeof t.command=="string"?{command:t.command}:{},...typeof t.cwd=="string"?{cwd:t.cwd}:{}};if(e==="item/fileChange/requestApproval"){let i=Array.isArray(r?.changes)?r.changes.map(o=>o?.path).filter(o=>typeof o=="string"):[];return{...s,kind:"file_change",toolName:"apply_patch",...i.length?{paths:i}:{}}}return{...s,kind:"permission",...typeof t.cwd=="string"?{cwd:t.cwd}:{}}}function Un(e,t,r){return e==="item/permissions/requestApproval"?{permissions:Object.fromEntries(Object.entries(d(t.permissions)?t.permissions:{}).filter(([,s])=>r&&s!=null)),scope:"turn"}:{decision:r?"accept":"decline"}}var kn=e=>ho("sha256").update(JSON.stringify(e)).digest("hex"),W=(e,t)=>Object.assign(new Error(t),{code:e}),vn=/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i,Fe="ORCHA_TASK_MCP_TOKEN",wo=new Set(["--no-session-persistence","--resume","-r","--continue","-c","--session-id","--fork-session"]);function Eo(e){return typeof e=="string"?e:Array.isArray(e)?e.filter(t=>t?.type==="text").map(t=>t.text).join(`
+`):""}var bt=(e,t)=>({sessionUpdate:e,content:{type:"text",text:t}});function So(e,t,{emitThoughts:r,streamText:n}){let s=e?.type;if(s==="result"&&e.is_error!==!0){let c=typeof e.result=="string"?e.result:"",l=t.streamed;return t.text=t.streamed="",c?l?l.trim()===c.trim()?[]:[bt("agent_message_snapshot",c)]:[bt("agent_message_chunk",c)]:[]}if(!["assistant","user","stream_event"].includes(s))return null;let i=[];if(e.parent_tool_use_id)return i;let o=()=>{let c=t.streamed||t.text;t.streamed&&i.push(bt("agent_message_snapshot","")),c&&r&&i.push(bt("agent_thought_chunk",c)),t.text=t.streamed=""},a=c=>{t.streamed=(t.streamed||"")+c,i.push(bt("agent_message_chunk",c))};if(s==="stream_event"){if(!n)return i;t.streaming=!0;let c=e.event,l=c?.content_block?.type;return c?.type==="content_block_start"&&l==="tool_use"?o():c?.type==="content_block_start"&&l==="text"&&t.streamed?a(`
-${i.text}`:i.text:i?.type==="tool_use"&&i.id&&(t.text&&r&&s.push({sessionUpdate:"agent_thought_chunk",content:{type:"text",text:t.text}}),t.text="",s.push({sessionUpdate:"tool_call",toolCallId:i.id,title:i.name,status:"in_progress",rawInput:i.input}));return s}var ot=Object.freeze({codex:{label:"Codex",code:"CODEX",sessionDirectory:"codex-sessions",home:e=>e.env?.CODEX_HOME||process.env.CODEX_HOME||it(Me(),".codex"),threadId:e=>e?.type==="thread.started"?e.thread_id:void 0,resumeArgs(e,t){let r=e.indexOf("exec");if(r<0||e.includes("resume")||e.includes("--ephemeral"))throw q("BAD_REQUEST","Codex \u539F\u751F\u4F1A\u8BDD\u9700\u8981\u6807\u51C6 codex exec \u914D\u7F6E");return t?[...e.slice(0,r+1),"resume",t,...e.slice(r+1)]:e},mcpArgs:e=>["-c",`mcp_servers.orcha={url=${JSON.stringify(e)},bearer_token_env_var=${JSON.stringify(Ue)},required=true}`]},claude:{label:"Claude Code",code:"CLAUDE",sessionDirectory:"claude-sessions",home:e=>e.env?.CLAUDE_CONFIG_DIR||process.env.CLAUDE_CONFIG_DIR||it(Me(),".claude"),threadId:e=>e?.type==="system"&&e.subtype==="init"?e.session_id:void 0,resumeArgs(e,t){let r=e.indexOf("--output-format");if(!e.includes("-p")&&!e.includes("--print")||r<0||e[r+1]!=="stream-json"||!e.includes("--verbose")||e.some(n=>Wi.has(n)))throw q("BAD_REQUEST","Claude Code \u539F\u751F\u4F1A\u8BDD\u9700\u8981\u6807\u51C6 claude -p --output-format stream-json --verbose \u914D\u7F6E");return t?[...e,"--resume",t]:e},mcpArgs:e=>["--mcp-config",JSON.stringify({mcpServers:{orcha:{type:"http",url:e,headers:{Authorization:`Bearer \${${Ue}}`}}}}),"--allowedTools","mcp__orcha"],taskMcpError(e){if(e?.type!=="system"||e.subtype!=="init")return null;let t=e.mcp_servers?.find(r=>r?.name==="orcha")?.status||"missing";return t==="connected"?null:q("RUNTIME_CLAUDE_MCP_UNAVAILABLE",`Claude Code \u672A\u80FD\u8FDE\u63A5 OrchaAI \u4EFB\u52A1\u5DE5\u5177\uFF08${t}\uFF09\uFF0C\u672C\u8F6E\u672A\u6267\u884C`)},progress:Yi}});async function Tn(e,t,r){let n=await zr(t,r?[mn(r)]:[]);return{args:e.mcpArgs(n.url),environment:{[Ue]:n.token},refresh:s=>n.refresh(s),close:()=>n.close()}}var Kt=class{constructor(t,r,n=it(Me(),".orcha",ot[t].sessionDirectory)){this.adapter=ot[t],this.directory=it(n,yn(r))}async turn(t,r,n,s,i){let{label:o,code:a}=this.adapter;if(!t)throw q("BAD_REQUEST",`${o} native turn requires a run ID`);gn(this.directory,{recursive:!0,mode:448});let u=it(this.directory,"active");try{gn(u,{mode:448})}catch(p){throw p.code==="EEXIST"?q("RUNTIME_SESSION_BUSY",`${o} \u4EFB\u52A1\u4ECD\u5728\u8FD0\u884C\u6216\u4E0A\u8F6E\u5F02\u5E38\u4E2D\u65AD\uFF1B\u8BF7\u7B49\u5F85\u5B8C\u6210\uFF0C\u6216\u53D1\u9001 /new \u5F00\u59CB\u65B0\u4EFB\u52A1`):p}let d=it(this.directory,"session.json"),f,h=()=>{let p=`${d}.${Ki()}.pending`;_n(p,JSON.stringify(f),{mode:384}),Vi(p,d)};try{try{f=JSON.parse(zi(d,"utf8"))}catch(w){if(w.code!=="ENOENT")throw w}if(f&&!wn.test(f.threadId||""))throw q("RUNTIME_OPERATION_NOT_FOUND",`${o} \u4E0A\u8F6E\u672A\u80FD\u4FDD\u5B58\u539F\u751F\u4F1A\u8BDD\u6807\u8BC6\uFF0C\u8BF7\u53D1\u9001 /new`);try{_n(it(this.directory,`${yn(t)}.run`),"",{flag:"wx",mode:384})}catch(w){throw w.code==="EEXIST"?q("RUNTIME_OPERATION_NOT_FOUND",`\u6B64\u8F6E ${o} \u5DF2\u6267\u884C\u6216\u6267\u884C\u7ED3\u679C\u4E0D\u786E\u5B9A\uFF0C\u4E0D\u80FD\u91CD\u590D\u53D1\u9001`):w}f||={threadId:null},h();let p,m=w=>{if(p)return;let I=w.update?.sessionUpdate==="runtime_event"?this.adapter.threadId(w.update.event):void 0;if(I!==void 0)try{if(!wn.test(I||"")||f.threadId&&f.threadId!==I)throw q(`${a}_SESSION_MISMATCH`,`${o} \u8FD4\u56DE\u4E86\u4E0D\u540C\u7684\u539F\u751F\u4F1A\u8BDD\uFF0C\u8BF7\u53D1\u9001 /new`);f.threadId=I,h()}catch(_){p=_,i();return}n(w)},y=await r(f.threadId,m,w=>{!p&&f.threadId&&s?.(w)});if(p)throw p;if(!f.threadId)throw q(`${a}_SESSION_MISSING`,`${o} \u6CA1\u6709\u8FD4\u56DE\u539F\u751F\u4F1A\u8BDD\u6807\u8BC6\uFF0C\u8BF7\u68C0\u67E5 CLI \u7248\u672C\u5E76\u53D1\u9001 /new`);return y}finally{Ji(u,{recursive:!0})}}};var Un=5e3,io=2*60*1e3,oo=2*60*1e3,ao=12,co=1e3,uo=1500,lo=1e3,fo=/^(?:task|session)-[1-9]\d*(?::[1-9]\d*){4}(?![\s\S])/,zt=24*60*60*1e3,Ot=new Set(["final_answer","final","complete","completed","done"]),po=new Set(["function_call","function_call_output","custom_tool_call","custom_tool_call_output","local_shell_call","local_shell_call_output","mcp_tool_call","mcp_tool_call_output","web_search_call","image_generation_call","image_generation_end"]),ho=new Set(["context_compacted","context_compaction","context_compressed"]);function Wt(e,t){if(e?.pid){if(process.platform==="win32"){let r=["/PID",String(e.pid),"/T"];t==="SIGKILL"&&r.push("/F");try{An("taskkill",r,{stdio:"ignore",windowsHide:!0}).unref?.()}catch{try{e.kill(t)}catch{}}return}try{process.kill(-e.pid,t)}catch(r){if(r?.code==="ESRCH")return;try{e.kill(t)}catch{}}}}function Vt(e){Wt(e,"SIGTERM");let t=setTimeout(()=>Wt(e,"SIGKILL"),Un);return t.unref?.(),t}function H(e){if(typeof e=="string")return e;if(Array.isArray(e))return e.map(t=>H(t)).join("");if(!l(e))return"";for(let t of["text","delta","output_text","content","message","output"]){let r=H(e[t]);if(r)return r}return""}function Pn(e){if(!l(e))return"";let t=l(e.payload)?e.payload:{};if(c(e.type)==="event_msg"){if(c(t.type)==="agent_message")return c(t.message);if(c(t.type)==="task_complete")return c(t.last_agent_message)}if(c(e.type)==="response_item"&&c(t.type)==="message"&&c(t.role)==="assistant")return H(t.content)||H(t.message);if(c(e.type)==="result")return H(e.result);let r=H(e.delta)||H(e.text)||H(e.content);if(r)return r;let n=l(e.item)?e.item:{};return["message","agent_message"].includes(c(n.type))||c(n.role)==="assistant"?H(n.content)||H(n.text)||H(n.message):""}function Ln(e,t){e.explicitFileDelivery||Bt(e.artifacts,Ce(t,{source:"codex_cli_image_generation",...e.artifactOptions}))}function kn(e){return et(Ae(e))}function De(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{},r=c(e.type),n=c(t.type);if(r==="event_msg"&&n==="task_complete")return!0;let s=c(t.phase||t.status||t.stage).toLowerCase();if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&c(t.role)==="assistant")return Ot.has(s);let i=l(e.item)?e.item:{};return r==="item.completed"&&c(i.type)==="agent_message"?!0:r==="result"&&e.is_error!==!0?c(e.result).length>0:!1}function Sn(e){let t=c(e.terminalProtocol||e.eventProtocol).toLowerCase();if(t)return t;let r=ve(c(e.command)).replace(/\.exe$/i,"").toLowerCase();return r==="codex"||r==="claude"?r:""}function Rn(e,t,r){let n=l(t.error)?t.error:{},s=c(n.message)||H(t.error)||c(t.result)||c(t.message)||r;return Object.assign(new Error(s),{code:e})}function mo(e,t){if(!l(e))return null;let r=c(e.type).toLowerCase();if(t==="codex")return r==="turn.completed"?{status:"completed",result:{stopReason:"end_turn"}}:r==="turn.failed"?{status:"failed",error:Rn("RUNTIME_CODEX_TURN_FAILED",e,"Codex turn failed")}:null;if(t==="claude"&&r==="result"){let n=c(e.subtype).toLowerCase();return e.is_error===!0||n.startsWith("error")||["failed","failure"].includes(n)?{status:"failed",error:Rn("RUNTIME_CLAUDE_RESULT_FAILED",e,"Claude result failed")}:{status:"completed",result:{stopReason:"end_turn",...c(e.result)?{output:c(e.result)}:{}}}}return null}function On(e){return l(e)?c(e.phase||e.status||e.stage).toLowerCase():""}function go(e){if(!l(e)||De(e))return!1;let t=l(e.payload)?e.payload:{},r=c(e.type),n=c(t.type),s=On(t);if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&c(t.role)==="assistant")return!!(s&&!Ot.has(s));let i=l(e.item)?e.item:{},o=On(i);return c(i.role)==="assistant"||c(i.type)==="message"?!!(o&&!Ot.has(o)):!1}function _o(e,t,r){return r.captureLastMessage===!1||t.includes("--output-last-message")||t.includes("-o")?!1:r.captureLastMessage===!0?!0:ve(e)==="codex"}function yo(e,t){return t.collectCodexTranscriptArtifacts===!1?!1:t.collectCodexTranscriptArtifacts===!0?!0:ve(e)==="codex"}function vn(e){return Math.max(20,S(e.codexTranscriptPollMs||e.transcriptPollMs,co))}function wo(e){return Math.max(0,S(e.codexFinalOutputWaitMs||e.finalOutputWaitMs,uo))}function Xt(e){if(typeof e=="boolean")return e;let t=c(e).toLowerCase();return["true","1","yes","y","on"].includes(t)?!0:["false","0","no","n","off"].includes(t)?!1:null}function He(e){let t=l(e?.metadata)?e.metadata:{};return l(t._runtimeBridge)?t._runtimeBridge:{}}function Pe(e){return c(He(e).promptKind).toLowerCase()}function To(e,t){for(let r of[e.codexTranscriptStreaming,e.streamCodexTranscript]){let n=Xt(r);if(n!=null)return n}return Pe(t)==="chat"}function Eo(e,t){let r=He(e);for(let s of[r.emitThoughtChunks,r.streamThoughts]){let i=Xt(s);if(i!=null)return i}let n=Pe(e);if(n&&n!=="chat")return!1;for(let s of[t.emitThoughtChunks,t.streamThoughts]){let i=Xt(s);if(i!=null)return i}return Pe(e)==="chat"}function So(e){let t=He(e);for(let r of[t.finalTextOnly,t.finalOutputOnly]){let n=Xt(r);if(n!=null)return n}return null}function Ro(e,t){let r=So(e);return r??(t.finalTextOnly===!0||t.finalOutputOnly===!0?!0:(t.finalTextOnly===!1||t.finalOutputOnly===!1,!1))}function Oo(e,t){return!e.finalTextOnly||t}function Dn(e,t,r,n,s=n){return!n||e.emittedTexts.has(s)?!1:(e.emittedTexts.add(s),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}}),!0)}function Hn(e,t,r,n){return!n||e.emittedThoughtTexts.has(n)?!1:(e.emittedThoughtTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_thought_chunk",content:{type:"text",text:n}}}),!0)}function Io(e,t,r,n=new Set){return{target:e,promptText:t,startedAtMs:r,baselinePaths:n,matchedPath:"",disabled:!1,processedLines:new Map}}function Co(e,t){let r=l(e.env)?e.env:{},n=c(e.artifactRoot||e.artifactDir||e.runtimeArtifactRoot||r.ORCHA_RUNTIME_ARTIFACT_DIR)||$(Mn(),"orcha-runtime-artifacts"),s=c(t).replace(/[^A-Za-z0-9._-]+/g,"-").slice(0,80)||pt(),i=$(n,s),o=$(i,pt());return Qi(o,{recursive:!0}),{root:o,realRoot:It(o),sessionRoot:i,realSessionRoot:It(i)}}function Ao(e){let t=c(e?.artifactDirectory);if(!t)throw new Error("sandbox launch did not provide an artifact directory");return{root:t,realRoot:It(t),sessionRoot:"",realSessionRoot:""}}function $n(e){return c(l(e)?e.root:e)}function In(e){let t=$n(e),r=c(l(e)?e.sessionRoot:so(t)),n=c(l(e)?e.realSessionRoot:"");if(r)try{if(n&&It(r)!==n)return;to(r)}catch{}}function xo(e,t={}){let r=$n(e),n=c(l(e)?e.realRoot:"");if(r){try{if(n&&It(r)!==n){g("warn","runtime.cli","runtime artifact directory cleanup skipped; path changed",{...t,artifactRoot:r});return}}catch{In(e);return}try{Zi(r,{recursive:!0,force:!0})}catch(s){g("warn","runtime.cli","runtime artifact directory cleanup failed",{...t,artifactRoot:r,error:String(s?.message||s)});return}In(e)}}function No(e,t,r=null){return{trustedFileRoots:[t,c(r?.artifactDirectory),c(r?.homeDirectory),...b(e.trustedArtifactRoots),...b(e.trustedFileRoots),...b(e.artifactRoots),...b(e.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(r?.pathMappings)?r.pathMappings:[]}}function $e(e){let t=c(e.codexSessionsRoot||e.codexSessionRoot);if(t)return t;let r=l(e.env)?e.env:{},n=c(e.codexHome||r.CODEX_HOME||process.env.CODEX_HOME)||$(no(),".codex");return $(n,"sessions")}function bo(e,t){let r=new Date(t),n=String(r.getFullYear()),s=String(r.getMonth()+1).padStart(2,"0"),i=String(r.getDate()).padStart(2,"0");return $(e,n,s,i)}function Fn(e,t,r){let n=new Set;for(let s of[t-zt,t,t+zt,r-zt,r,r+zt])n.add(bo(e,s));return[...n].filter(s=>xn(s))}function Mo(e,t,r){let n=$e(e),s=t-io,i=r+oo,o=[];for(let a of Fn(n,t,r)){let u=[];try{u=Nn(a)}catch{continue}for(let d of u){if(!d.endsWith(".jsonl"))continue;let f=$(a,d);try{let h=eo(f);if(!h.isFile()||h.mtimeMs<s||h.mtimeMs>i)continue;o.push({path:f,mtimeMs:h.mtimeMs})}catch{}}}return o.sort((a,u)=>u.mtimeMs-a.mtimeMs).slice(0,ao)}function Uo(e,t,r=t){let n=$e(e),s=new Set;for(let i of Fn(n,t,r)){let o=[];try{o=Nn(i)}catch{continue}for(let a of o)a.endsWith(".jsonl")&&s.add($(i,a))}return s}function Le(e,t,r=0){if(!(r>8||e===null||e===void 0)){if(typeof e=="string"){e&&t.push(e);return}if(Array.isArray(e)){for(let n of e)Le(n,t,r+1);return}if(l(e))for(let n of["payload","item","text","delta","output_text","content","message","output","input","prompt","last_agent_message","revised_prompt"])n in e&&Le(e[n],t,r+1)}}function Bn(e){return c(e).replace(/\s+/g," ")}function Po(e){let t=Bn(e);if(!t)return[];if(t.length<=200)return[t];let r=160,n=[0,Math.floor((t.length-r)/2),t.length-r],s=new Set,i=[];for(let o of n){let a=t.slice(Math.max(0,o),Math.max(0,o)+r).trim();a.length>=40&&!s.has(a)&&(s.add(a),i.push(a))}return i}function Lo(e,t){let r=Po(t);if(!r.length)return!1;let n=[];for(let i of e)Le(i,n);let s=Bn(n.join(" "));return r.every(i=>s.includes(i))}function ko(e){return e.find(t=>l(t)&&c(t.type)==="session_meta"&&l(t.payload))||null}function vo(e){let t=l(e?.payload)?e.payload:{},r=c(e?.timestamp||t.timestamp),n=Date.parse(r);return Number.isFinite(n)?n:Number.NaN}function Do(e){let t=c(e.originator),r=c(e.source);if(t!=="codex_exec"&&r!=="exec"||c(e.parent_thread_id))return!1;let n=c(e.thread_source);if(n&&n!=="user")return!1;let s=c(e.session_id),i=c(e.id);return!(s&&i&&s!==i)}function Ho(e,t,r){if(!Lo(e,t.promptText))return!1;let n=ko(e);if(!n)return!1;let s=n.payload;if(!Do(s))return!1;let i=vo(n);if(!Number.isFinite(i)||i<t.startedAtMs-5e3||i>r+5e3)return!1;let o=c(t.target.cwd),a=c(s.cwd);return!(o&&a&&En(o)!==En(a))}function Cn(e){try{return Fo(bn(e,"utf8"))}catch{return null}}function $o(e,t,r){if(!e||e.disabled)return null;if(e.matchedPath){let s=Cn(e.matchedPath);return s?{path:e.matchedPath,events:s}:null}let n=[];for(let s of Mo(e.target,e.startedAtMs,r)){if(e.baselinePaths.has(s.path))continue;let i=Cn(s.path);!i||!Ho(i,e,r)||n.push({path:s.path,events:i})}return n.length!==1?(n.length>1&&(e.disabled=!0,g("warn","runtime.cli","codex transcript fallback disabled; multiple matching transcripts",{target:e.target.targetCode,sessionId:t,transcriptCount:n.length})),null):(e.matchedPath=n[0].path,g("info","runtime.cli","codex transcript stream attached",{target:e.target.targetCode,sessionId:t}),n[0])}function Fo(e){let t=[];for(let r of e.split(/\r?\n/)){let n=r.trim();if(n)try{t.push(JSON.parse(n))}catch{}}return t}function Bo(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{},r=c(e.type),n=c(t.type);return r==="event_msg"&&n==="image_generation_end"||r==="response_item"&&n==="image_generation_call"}function jo(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{};return c(e.type)==="response_item"&&po.has(c(t.type))}function qo(e){if(!l(e))return!1;let t=l(e.payload)?e.payload:{};return ho.has(c(t.type))}function Go(e,t,r,n){let s=Pn(e),i=De(e),o=0,a=0,u=0;if(s&&!i&&t.emitThoughtChunks&&Hn(t,r,n,s)&&(u=1),s&&i){let d=t.emittedTexts.size?`
+`):c?.type==="content_block_delta"&&c.delta?.type==="text_delta"&&c.delta.text&&a(c.delta.text),i}for(let c of Array.isArray(e.message?.content)?e.message.content:[])s==="user"?c?.type==="tool_result"&&c.tool_use_id&&i.push({sessionUpdate:"tool_call_update",toolCallId:c.tool_use_id,status:c.is_error?"failed":"completed",rawOutput:Eo(c.content)}):c?.type==="text"&&c.text?t.streaming||(t.text=t.text?`${t.text}
-${s}`:s;Dn(t,r,n,d,s)&&(o=1,a=1)}return s&&i&&(t.finalTextSeen=!0),Ln(t,e),(Bo(e)||jo(e)||qo(e)||i)&&n({sessionId:r,update:{sessionUpdate:"runtime_event",event:kn(e)}}),{textCount:o,finalTextCount:a,thoughtCount:u}}function ke(e,t,r,n,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0,textCount:0,finalTextCount:0,thoughtCount:0};let i=e.artifacts.size,o=0,a=0,u=0,d=0,f=$o(t,r,s);if(f){let h=Math.min(t.processedLines.get(f.path)||0,f.events.length),p=e.artifacts.size;for(let m of f.events.slice(h)){let y=Go(m,e,r,n);a+=y.textCount,u+=y.finalTextCount,d+=y.thoughtCount}t.processedLines.set(f.path,f.events.length),(f.events.length>h||e.artifacts.size>p)&&(o=1)}return{artifactCount:e.artifacts.size-i,transcriptCount:o,textCount:a,finalTextCount:u,thoughtCount:d}}function Ko(e,{remove:t=!0}={}){if(!e||!xn(e))return"";try{return bn(e,"utf8").trim()}catch{return""}finally{t&&Jt(e)}}function Jt(e){if(e)try{ro(e)}catch{}}function zo(e,t){return{artifactCount:(e?.artifactCount||0)+(t?.artifactCount||0),transcriptCount:(e?.transcriptCount||0)+(t?.transcriptCount||0),textCount:(e?.textCount||0)+(t?.textCount||0),finalTextCount:(e?.finalTextCount||0)+(t?.finalTextCount||0),thoughtCount:(e?.thoughtCount||0)+(t?.thoughtCount||0)}}function Vo(e){return new Promise(t=>setTimeout(t,e))}function Jo(e,t,r,n){return n?(e.finalTextSeen=!0,e.emittedTexts.has(n)||(e.emittedTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}})),!0):!1}async function Wo(e,t,r,n,s,i){let o=ke(e,t,r,n,Date.now()),a=()=>Jo(e,r,n,Ko(s,{remove:!1}));if(a()||e.finalTextSeen)return Jt(s),o;let u=wo(i);if(u<=0||!t&&!s)return Jt(s),o;let d=Date.now()+u,f=Math.min(vn(i),100);for(;!e.finalTextSeen&&Date.now()<d&&(await Vo(Math.min(f,Math.max(0,d-Date.now()))),o=zo(o,ke(e,t,r,n,Date.now())),!a()););return Jt(s),o}var Yt=class{constructor(t,r,n={}){this.agent=t,this.target=r,this.options=n,this.active=new Map;let s=Sn(r);if(this.adapter=Object.hasOwn(ot,s)?ot[s]:null,n.source==="ai_chat_runtime_node"&&this.adapter){let{label:i}=this.adapter;if(typeof n.cloudSessionId!="string"||!fo.test(n.cloudSessionId))throw Object.assign(new Error(`${i} \u539F\u751F\u4F1A\u8BDD\u6807\u8BC6\u65E0\u6548\uFF1A\u9700\u8981\u5B8C\u6574\u7684\u4EFB\u52A1\u6216\u4F1A\u8BDD\u9694\u79BB\u6807\u8BC6`),{code:"BAD_REQUEST"});if(!n.orchaUrl)throw Object.assign(new Error(`${i} \u539F\u751F\u4F1A\u8BDD\u7F3A\u5C11 OrchaAI \u670D\u52A1\u5730\u5740\uFF0C\u8BF7\u91CD\u65B0\u8FDE\u63A5\u8BBE\u5907`),{code:"BAD_REQUEST"});if(n.prepareLaunch)throw Object.assign(new Error(`${i} \u539F\u751F\u4F1A\u8BDD\u4E0D\u652F\u6301\u6C99\u7BB1\u542F\u52A8\uFF0C\u8BF7\u4F7F\u7528\u5DF2\u63A5\u5165\u7684\u672C\u673A\u8BBE\u5907`),{code:"BAD_REQUEST"});this.nativeSession=new Kt(s,[n.orchaUrl,t.agentId,t.targetCode,n.cloudSessionId,rt(r,t.workspace),r.command,this.adapter.home(r)])}}async sessionNew(t={}){let r=t.mcpServers||[];if(r.length&&(t.metadata?.source==="conversation_delegation"||this.nativeSession)&&this.adapter){if(this.options.prepareLaunch)throw Object.assign(new Error(`${this.adapter.label} task MCP requires a reachable node-local transport; this sandbox launcher does not provide one`),{code:"unsupported_dynamic_mcp"});this.explicitFileDelivery=!0,this.taskMcp=await Tn(this.adapter,r,()=>({cwd:this.deliveryCwd,roots:[...this.deliveryRoots||[],...this.deliveryThreadId?[$($e(this.target),"..","generated_images",this.deliveryThreadId)]:[]]}))}else if(r.length&&t.metadata?.source==="conversation_delegation")throw Object.assign(new Error("This CLI adapter does not support task-scoped MCP"),{code:"unsupported_dynamic_mcp"});return{sessionId:`cli-${this.agent.agentId}-${pt()}`}}async refreshMcpServers(t){if(!this.taskMcp)throw Object.assign(new Error("The original Codex MCP binding is unavailable"),{code:"RUNTIME_OPERATION_NOT_FOUND"});await this.taskMcp.refresh(t)}async sessionPrompt(t,r,n){return this.nativeSession?this.nativeSession.turn(this.options.runId,(s,i,o)=>this.runPrompt(t,i,o,s),s=>{let i=s.update?.event;i?.type==="thread.started"&&(this.deliveryThreadId=i.thread_id),r(s)},n,()=>this.sessionCancel(t)):this.runPrompt(t,r,n)}async runPrompt(t,r,n,s){let i=Date.now(),o=c(this.target.command);if(!o)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let a=c(t.sessionId)||pt(),u=vt(t.prompt),d=c(this.target.promptMode||"stdin"),f=this.buildArgs(d,u),h=[...this.taskMcp?.args||[],...this.nativeSession?this.adapter.resumeArgs(f,s):f],p=rt(this.target,this.agent.workspace),m=typeof this.options.prepareLaunch=="function",w=_o(o,h,this.target)?m?`/tmp/orcha-runtime-last-message-${pt()}.txt`:$(Mn(),`orcha-runtime-last-message-${pt()}.txt`):"";w&&h.push("--output-last-message",w);let I={...l(this.target.env)?this.target.env:{},...this.taskMcp?.environment||{},...d==="env"?{ORCHA_RUNTIME_PROMPT:u}:{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:a},_=m?await this.options.prepareLaunch({command:o,args:h,cwd:p,environment:I}):{command:o,args:h,cwd:p,environment:{...process.env,...I},cleanup:async()=>{}},T=m?Ao(_):Co(this.target,a),E=T.root,R=No(this.target,E,_);this.deliveryCwd=p,this.deliveryRoots=[p,...R.trustedFileRoots].filter(Boolean),this.deliveryThreadId=s||null;let N=yo(o,this.target),M={...this.target,targetCode:this.agent.targetCode,cwd:p,...m?{codexHome:$(_.homeDirectory,".codex")}:{}},D=N?Uo(M,i):new Set,Z=m&&w?$(_.tempDirectory,w.slice(5)):w,V=S(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,S(this.options.sessionPromptTimeoutMs,Y));m||(_.environment.ORCHA_RUNTIME_ARTIFACT_DIR=E);let C=An(_.command,_.args,{cwd:_.cwd,env:_.environment,stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(a,C),g("info","runtime.cli","runtime prompt started",{target:this.agent.targetCode,sessionId:a,pid:C.pid,timeoutMs:V,isolation:_.isolation});let xr="",fe=c(this.target.outputMode||"text"),U={explicitFileDelivery:this.explicitFileDelivery,artifacts:new Map,emittedTexts:new Set,emittedThoughtTexts:new Set,value:"",artifactOptions:R,finalTextSeen:!1,finalTextOnly:Ro(t,this.target),emitThoughtChunks:Eo(t,this.target),terminalOutcome:null,terminalProtocol:Sn(this.target),emitTerminal:null,progress:{}},pe=N?Io(M,u,i,D):null;return C.stdout.setEncoding("utf8"),C.stdout.on("data",dt=>this.handleStdout(dt,fe,U,a,r)),C.stderr.setEncoding("utf8"),C.stderr.on("data",dt=>{xr+=dt,this.target.emitStderr===!0&&r({sessionId:a,update:{sessionUpdate:"runtime_stderr_chunk",content:{type:"text",text:dt}}})}),d==="stdin"?C.stdin.end(u):C.stdin.end(),await new Promise((dt,he)=>{let yt=!1,Nr=!1,Mt=null,wt=null,me=pe&&To(this.target,t)?setInterval(()=>{try{ke(U,pe,a,r)}catch(A){g("warn","runtime.cli","codex transcript stream poll failed",{target:this.agent.targetCode,sessionId:a,error:String(A?.message||A)})}},vn(this.target)):null;me?.unref?.();let br=setTimeout(()=>{Nr=!0,g("warn","runtime.cli","runtime prompt timed out; terminating child",{target:this.agent.targetCode,sessionId:a,pid:C.pid,timeoutMs:V}),Wt(C,"SIGTERM"),Mt=setTimeout(()=>{g("warn","runtime.cli","runtime prompt force killing child",{target:this.agent.targetCode,sessionId:a,pid:C.pid}),Wt(C,"SIGKILL")},Un),Mt.unref?.(),Tt(Object.assign(new Error(`runtime CLI timed out after ${V}ms`),{code:"RUNTIME_CLI_TIMEOUT"}))},V);br.unref?.();let Mr=async()=>{clearTimeout(br),wt&&clearTimeout(wt),me&&clearInterval(me),Mt&&!Nr&&clearTimeout(Mt),xo(T,{target:this.agent.targetCode,sessionId:a}),this.active.delete(a),U.emitTerminal=null,await _.cleanup?.()},xs=A=>{yt||(yt=!0,Mr().then(()=>dt(A),he))},Tt=A=>{yt||(yt=!0,Mr().then(()=>he(A),B=>{g("warn","runtime.cli","sandbox launch cleanup failed",{target:this.agent.targetCode,sessionId:a,error:String(B?.message||B)}),he(A)}))};U.emitTerminal=A=>{let B={...l(A.result)?A.result:{},_artifacts:[...U.artifacts.values()]};try{n?.({...A,result:B})}catch(tt){g("warn","runtime.cli","runtime terminal listener failed",{target:this.agent.targetCode,sessionId:a,error:String(tt?.message||tt)})}let F=Math.max(0,S(this.target.terminalExitGraceMs,lo));wt=setTimeout(()=>{wt=null,!(yt||this.active.get(a)!==C)&&(g("warn","runtime.cli","runtime stayed alive after terminal event; terminating child",{target:this.agent.targetCode,sessionId:a,pid:C.pid,terminalProtocol:U.terminalProtocol,graceMs:F}),Vt(C))},F),wt.unref?.()},C.on("error",A=>{g("warn","runtime.cli","runtime child error",{target:this.agent.targetCode,sessionId:a,pid:C.pid,error:String(A?.message||A)}),Tt(A)}),C.on("exit",(A,B)=>{(async()=>{fe==="json-lines"&&U.value.trim()&&this.handleStdout(`
-`,fe,U,a,r);let F=await Wo(U,pe,a,r,Z,this.target);(F.artifactCount>0||F.textCount>0||F.thoughtCount>0)&&g("info","runtime.cli","codex transcript updates collected",{target:this.agent.targetCode,sessionId:a,artifactCount:F.artifactCount,textCount:F.textCount,finalTextCount:F.finalTextCount,thoughtCount:F.thoughtCount,transcriptCount:F.transcriptCount});let tt=xr.trim();if(tt&&g("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:a,stderr:tt}),g("info","runtime.cli","runtime prompt finished",{target:this.agent.targetCode,sessionId:a,pid:C.pid,exitCode:A,signal:B,artifactCount:U.artifacts.size,finalTextSeen:U.finalTextSeen}),U.terminalOutcome?.status==="failed"){Tt(U.terminalOutcome.error);return}if(A!==0&&U.terminalOutcome?.status!=="completed"){let Ns=Object.assign(new Error(`runtime CLI exited with code ${A??"unknown"}${B?` (${B})`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:A,signal:B});Tt(Ns);return}xs({stopReason:"end_turn",exitCode:A,signal:B,_artifacts:[...U.artifacts.values()],...tt?{stderr:tt}:{}})})().catch(Tt)})})}buildArgs(t,r){let n=b(this.target.args);return t==="args"?[...n,r]:n}handleStdout(t,r,n,s,i){if(r!=="json-lines"){i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:t}}});return}n.value+=t;let o=n.value.split(/\r?\n/);n.value=o.pop()||"";for(let a of o){let u=a.trim();if(u)try{let d=JSON.parse(u);!this.nativeSession&&d.type==="thread.started"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(d.thread_id||"")&&(this.deliveryThreadId=d.thread_id);let f=this.taskMcp&&this.adapter?.taskMcpError?.(d);if(f){n.terminalOutcome||(n.terminalOutcome={status:"failed",error:f},n.emitTerminal?.(n.terminalOutcome)),Vt(this.active.get(s));continue}Ln(n,d);let h=this.adapter?.progress?.(d,n.progress,n.emitThoughtChunks);for(let w of h||[{sessionUpdate:"runtime_event",event:kn(d)}])i({sessionId:s,update:w});let p=Pn(d),m=De(d);p&&n.emitThoughtChunks&&!m&&go(d)?Hn(n,s,i,p):p&&Oo(n,m)&&Dn(n,s,i,p),p&&m&&(n.finalTextSeen=!0);let y=mo(d,n.terminalProtocol);y&&!n.terminalOutcome&&(y.status==="failed"||n.finalTextSeen||n.artifacts.size>0)&&(n.terminalOutcome=y,n.emitTerminal?.(y))}catch{i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:`${a}
-`}}})}}}async sessionCancel(t){let r=c(t.sessionId),n=this.active.get(r);return n?(g("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),Vt(n),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}async stop(t="stop"){for(let[r,n]of this.active.entries())g("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),Vt(n);this.active.clear(),await this.taskMcp?.close(),this.taskMcp=null}};var Fe="ORCHA_RUNTIME_OUTPUT_START",Be="ORCHA_RUNTIME_OUTPUT_END",je="ORCHA_RUNTIME_CONTROL_START",qe="ORCHA_RUNTIME_CONTROL_END",Ge=Fe,Ke=Be,ze=je,Ve=qe,Je=[Fe,Be,je,qe],Xo=new Set(["_artifacts","_decision","_meta"]),Yo=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${Je.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),k=class extends Error{constructor(t,r,n){super(r),this.name="RuntimeResultProtocolError",this.code=t,this.detail={rawOutput:n}}};function qn(e){let t=typeof e=="string"?e.trimStart():"";return Je.some(r=>t.startsWith(r))}function We(e){if(typeof e!="string")return null;let t=e,r=Qo(t);if(![...r.values()].some(m=>m.length>0))return null;let n=[],s=[];for(let[m,y]of r)y.length===0?n.push(m):y.length>1&&s.push(m);if(n.length>0||s.length>0){let m=[];throw n.length>0&&m.push(`\u7F3A\u5C11 ${n.join(", ")}`),s.length>0&&m.push(`\u91CD\u590D ${s.join(", ")}`),new k("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${m.join("\uFF1B")}`,t)}let i=r.get(Fe)[0],o=r.get(Be)[0],a=r.get(je)[0],u=r.get(qe)[0];if(!(i.end<=o.start&&o.end<=a.start&&a.end<=u.start))throw new k("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757",t);let d=Zo(t.slice(i.end,o.start));if(!d.trim())throw new k("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let f=t.slice(a.end,u.start).trim();if(!f)throw new k("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let h;try{h=JSON.parse(f)}catch(m){throw new k("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(m?.message||m)}`,t)}if(!jn(h))throw new k("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61",t);let p=Object.keys(h).filter(m=>!Xo.has(m)).sort();if(p.length>0)throw new k("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${p.join(", ")}`,t);if("_artifacts"in h&&!Array.isArray(h._artifacts))throw new k("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4",t);for(let m of["_decision","_meta"])if(m in h&&!jn(h[m]))throw new k("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${m} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`,t);return{output:d,...h}}function Qo(e){let t=new Map(Je.map(r=>[r,[]]));for(let r of e.matchAll(Yo))t.get(r.groups.marker).push({start:r.index,end:r.index+r[0].length});return t}function Zo(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",r=t?e.slice(t.length):e;return t&&r.endsWith(t)?r.slice(0,-t.length):r}function jn(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as ta}from"node:crypto";var ea="orcha.goal-contract/v1",ra=new Set(["complete","completed","done","ok","passed","success","succeeded"]),na=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),sa=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function Ze(e){return ta("sha256").update(G(e)).digest("hex")}function Kn(e){if(!Vn(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","Each check requires requiredMatches distinct successful tool call IDs; repeated updates for one call count once.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
-`)}function zn(e,t,r=""){if(!Vn(e))return e==null?null:{required:!0,status:"failed",outcome:c(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let n=Ze(e),s=e.verificationPlan.required===!0;if(c(r)&&c(r)!==n)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:n,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:n,checks:[]};let i=ia(t),o=e.verificationPlan.checks.map(u=>fa(u,i));return{required:!0,status:o.some(u=>u.status==="failed")?"failed":o.some(u=>u.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:n,checks:o}}function Vn(e){if(!l(e)||e.schemaVersion!==ea||!c(e.outcome))return!1;let t=e.verificationPlan;if(!l(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let r=new Set;for(let n of t.checks)if(!l(n)||!c(n.id)||r.has(c(n.id))||(r.add(c(n.id)),!Array.isArray(n.toolNames)||n.toolNames.length===0||n.toolNames.some(s=>!c(s)))||!Number.isSafeInteger(n.requiredMatches)||n.requiredMatches<1||n.arguments!==void 0&&!l(n.arguments))return!1;return!0}function ia(e){let t=new Map,r=[];for(let n of Array.isArray(e)?e:[]){let s=l(n?.update)?n.update:{},i=c(s.sessionUpdate);if(i==="runtime_event"){oa(s.event,t,r);continue}if(i==="tool_call"){let o=Zt(s)||`tool-${r.length+1}`,a=Qt(t,r,o),u=Ye(s,s.name||s.toolName||s.kind);a.toolName=u.toolName,a.arguments=u.arguments,a.status=Ct(s.status),a.evidence=ee(s);continue}if(i==="tool_call_update"){let o=Zt(s);if(!o)continue;let a=Qt(t,r,o),u=Ye(s,s.name||s.toolName||s.kind);a.toolName||=u.toolName,Object.keys(a.arguments).length===0&&(a.arguments=u.arguments),a.status=Ct(s.status),a.evidence.push(...ee(s))}}return r}function oa(e,t,r){let n=l(e)&&l(e.payload)?e.payload:l(e)?e:{},s=c(n.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let a=Zt(n)||`runtime-${r.length+1}`,u=Qt(t,r,a),d=Ye(n,n.name||n.tool||s,s);u.toolName=d.toolName,u.arguments=d.arguments,u.status=Ct(n.status),u.evidence.push(...ee(n));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=Zt(n);if(!i)return;let o=Qt(t,r,i);o.status=la(n,o.toolName),o.evidence.push(...ee(n))}function Qt(e,t,r){let n=e.get(r);return n||(n={toolCallId:r,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(r,n),t.push(n)),n}function aa(e){let t=c(e).toLowerCase();return sa.get(t)||t}function Ye(e,t,r=""){let n=ca(e),s=c(r)==="mcp_tool_call"||c(e?.kind).toLowerCase()==="mcp",i=l(e?._meta)?e._meta:{},o=c(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let a=c(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...n,...a?{operationCode:a}:{}}}}return{toolName:aa(t),arguments:n}}function Zt(e){return l(e)?c(e.call_id||e.callId||e.toolCallId||e.id):""}function ca(e){if(!l(e))return{};for(let r of["arguments","args","rawInput","input","params","parameters"]){let n=ua(e[r]);if(n)return n}let t={};for(let r of["cmd","command","cwd","operationCode","path","query","url"])e[r]!==void 0&&(t[r]=e[r]);return t}function ua(e){if(l(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return l(t)?t:null}catch{return null}}function la(e,t){if(!l(e))return"unknown";let r=te(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return r.includes("failed")?"failed":r.includes("success")?"success":"unknown"}function te(e,t=0,r={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return da(e,t,r);if(Array.isArray(e))return e.flatMap(o=>te(o,t+1,r));if(!l(e))return[];let n=[];typeof e.isError=="boolean"&&n.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&n.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&n.push(e.success?"success":"failed");let s=Ct(e.status);s!=="unknown"&&n.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&n.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&n.push(...te(e[o],t+1,r));return n}function da(e,t,r){let n=e.trim();if(!n)return[];try{return te(JSON.parse(n),t+1,r)}catch{}if(r.parseCliExitCode!==!0)return[];let s=[];for(let i of n.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function Ct(e){let t=c(e).toLowerCase();return ra.has(t)?"success":na.has(t)?"failed":"unknown"}function ee(e){if(!l(e))return[];let t=l(e.output)?e.output:{},r=[e.verificationEvidence,l(e.verification)?e.verification.evidence:null,t.verificationEvidence,l(t.verification)?t.verification.evidence:null],n=[];for(let s of r)for(let i of Array.isArray(s)?s:s?[s]:[])!l(i)||!c(i.id)||n.push({id:c(i.id),status:Ct(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...c(i.message)?{message:c(i.message)}:{}});return n}function fa(e,t){let r=t.filter(o=>e.toolNames.includes(o.toolName)&&Qe(e.arguments||{},o.arguments)),n=c(e.evidenceId),s=r.filter(o=>o.status==="success"&&(!n||o.evidence.some(a=>a.id===n&&a.status==="success")));if(s.length>=e.requiredMatches)return Xe(e,"passed",s,`Runtime tool evidence passed ${s.length} times.`);let i=r.filter(o=>o.status==="failed"||n&&o.evidence.some(a=>a.id===n&&a.status==="failed"));return s.length===0&&i.length?Xe(e,"failed",i,"Runtime tool evidence failed."):Xe(e,"missing",s,`Only ${s.length}/${e.requiredMatches} required tool executions passed.`)}function Xe(e,t,r,n){let s=r.map(i=>i.toolCallId).filter(Boolean);return{id:e.id,status:t,message:n,...c(e.description)?{description:c(e.description)}:{},toolNames:e.toolNames,requiredMatches:e.requiredMatches,observedMatches:s.length,toolCallIds:s,...l(e.arguments)?{arguments:e.arguments}:{},...c(e.evidenceId)?{evidenceId:c(e.evidenceId)}:{}}}function Qe(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((r,n)=>Qe(r,t[n])):l(e)?l(t)?Object.entries(e).every(([r,n])=>Object.hasOwn(t,r)&&Qe(n,t[r])):!1:Object.is(e,t)}function G(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return Gn(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,r)=>{if(!Object.hasOwn(e,r))throw new Error("invalid_jcs_json_value");return G(e[r])}).join(",")}]`;if(l(e))return`{${Object.keys(e).sort().map(t=>`${Gn(t)}:${G(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function Gn(e){return pa(e),JSON.stringify(e)}function pa(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(r>=56320&&r<=57343)throw new Error("invalid_jcs_unicode")}}import{spawn as ha}from"node:child_process";import{createHash as ma,randomUUID as ga}from"node:crypto";import{constants as _a}from"node:fs";import{access as ya,mkdir as tr,readdir as wa,realpath as At,rm as Ta,stat as Ea}from"node:fs/promises";import Sa from"node:http";import{tmpdir as Ra}from"node:os";import{isAbsolute as xt,join as ht,relative as Jn,resolve as rr}from"node:path";var nr=1,Oa="orcha.process-isolation/v1",sr="orcha.egress-proxy/v1",Ia="--disable-wasm-trap-handler",re={read_only:0,workspace_write:1,workspace_network:2},er={read_only:["read_only","denied"],workspace_write:["workspace_write","denied"],workspace_network:["workspace_write","restricted"]},Ca=new Set([".env",".git-credentials",".netrc",".npmrc",".pypirc","credentials.json","secrets.json","id_rsa","id_ed25519"]);function at(e){if(!l(e))throw O("RUNTIME_SANDBOX_POLICY_REQUIRED","sandboxPolicy is required");let t=structuredClone(e),r=c(t.accessMode),n=c(t.accessModeCeiling);if(!(r in er)||!(n in er))throw O("RUNTIME_SANDBOX_POLICY_INVALID","unsupported runtime access mode");if(re[r]>re[n])throw O("RUNTIME_SANDBOX_POLICY_INVALID","access mode exceeds its ceiling");let[s,i]=er[r];if(t.filesystemMode!==s||t.networkMode!==i)throw O("RUNTIME_SANDBOX_POLICY_INVALID","runtime access profile does not match its mode");if(Number(t.policySchemaVersion)!==nr||!Number.isInteger(Number(t.policyRevision))||Number(t.policyRevision)<1)throw O("RUNTIME_SANDBOX_POLICY_INVALID","unsupported sandbox policy schema or revision");for(let[a,u]of Object.entries({outsideWorkspaceAccess:"denied",hostAccess:"denied",hostEnvironmentAccess:"denied",dockerSocketAccess:"denied",environmentMode:"allowlist"}))if(t[a]!==u)throw O("RUNTIME_SANDBOX_POLICY_INVALID",`${a} cannot be relaxed`);let o=l(t.processIsolation)?t.processIsolation:{};if(o.mode!=="required"||o.backend==="direct")throw O("RUNTIME_SANDBOX_POLICY_INVALID","strong process isolation is required");if(Array.isArray(t.alwaysApprovedApprovalKeys)&&t.alwaysApprovedApprovalKeys.length)throw O("RUNTIME_SANDBOX_POLICY_INVALID","persistent runtime approvals are forbidden");return t}function Wn(e,t){let r=at(e),n=at(t);return re[n.accessMode]<re[r.accessMode]}async function Xn(e){if(!e.sandboxRequired)return{dispatchable:!0,enforced:!1,backend:"direct",daemonStatus:"not_required",daemonProtocolVersion:"",policySchemaVersions:[nr],runtimePolicyUpdates:!1,workspaceSync:!1,egressProxy:!1,reason:"external_runtime_sandbox_not_required"};let t=await Qn(e.sandboxBrokerCommand,process.env.PATH||"");if(!t)throw O("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let r=await Ma(t,b(e.sandboxBrokerArguments),e.sandboxProbeTimeoutMs);if(r.enforced!==!0||c(r.protocolVersion)!=="orcha.runtime-sandbox-broker/v1"||!["bubblewrap","broker"].includes(c(r.backend)))throw O("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker did not report enforced isolation");let n=l(r.probes)?r.probes:{};for(let s of["emptyRoot","outsideWorkspaceDenied","hostFilesystemDenied","sensitiveFilesDenied","environmentAllowlist","dockerSocketDenied","networkNamespace","workspaceReadOnly","workspaceWrite","resourceLimits"])if(n[s]!==!0)throw O("RUNTIME_SANDBOX_UNAVAILABLE",`sandbox broker probe failed: ${s}`);return e.egressProxyRequired&&await La(e),{dispatchable:!0,enforced:!0,backend:c(r.backend),daemonStatus:"ok",daemonProtocolVersion:c(r.protocolVersion||"orcha.runtime-sandbox-broker/v1"),policySchemaVersions:[nr],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:e.egressProxyRequired}}async function ir(e,t,r){let n=c(t.workspace||t.cwd),s=c(r),i=n||(t.allowRequestWorkspace===!0?s:"");if(!i||!xt(i))throw O("RUNTIME_WORKSPACE_NOT_CONFIGURED","runtime target must configure an absolute trusted workspace");let o=await At(i);if(!(await Ea(o)).isDirectory())throw O("RUNTIME_WORKSPACE_INVALID","runtime workspace is not a directory");if(!(e.trustedWorkspaceRoots.length?await Promise.all(e.trustedWorkspaceRoots.map(d=>At(d))):[o]).some(d=>ar(d,o)))throw O("RUNTIME_WORKSPACE_OUTSIDE_TRUSTED_ROOT","runtime workspace is outside trusted roots");return o}async function Yn({config:e,target:t,command:r,args:n,cwd:s,environment:i,runId:o,agentId:a,sessionId:u,sandboxPolicy:d}){if(!e.sandboxRequired)return{command:r,args:[...n],cwd:s,environment:{...process.env,...i},tempDirectory:"",isolation:{enforced:!1,backend:"development_direct"},cleanup:async()=>{}};let f=at(d),h=await ir(e,t,s),p=await At(s);if(!ar(h,p))throw O("RUNTIME_WORKSPACE_CWD_INVALID","runtime cwd is outside its workspace");let m=await Qn(e.sandboxBrokerCommand,process.env.PATH||"");if(!m)throw O("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let y=`runtime-${ma("sha256").update(String(o)).digest("hex").slice(0,32)}`,w=rr(e.sandboxTempRoot||ht(Ra(),"orcha-runtime-sandboxes"));await tr(w,{recursive:!0,mode:448});let I=ht(w,`${y}-${ga()}`),_=ht(I,"home"),T=ht(I,"artifacts");await tr(_,{recursive:!0,mode:448}),await tr(T,{recursive:!0,mode:448});let E=f.networkMode==="restricted"?await Ua(e,{runId:String(o),instanceId:y,policyRevision:Number(f.policyRevision),ttlMs:Math.min(S(f.maxRuntimeSeconds,900)*1e3,e.egressGrantMaxTtlMs),maxTransferBytes:S(f.maxNetworkBytes,64*1024*1024)}):null,R={PATH:c(i.PATH||process.env.PATH),LANG:c(i.LANG||process.env.LANG||"C.UTF-8"),HOME:"/tmp/home",TMPDIR:"/tmp",USER:"orcha",LOGNAME:"orcha",SHELL:"/bin/sh",ORCHA_AGENT_ID:String(a),ORCHA_SESSION_ID:String(u),ORCHA_RUN_ID:String(o),ORCHA_RUNTIME_ARTIFACT_DIR:"/tmp/artifacts",...xa(t,i)};R.HOME="/tmp/home",R.TMPDIR="/tmp",R.ORCHA_RUNTIME_ARTIFACT_DIR="/tmp/artifacts",R.NODE_OPTIONS=Ia;let N={schemaVersion:Oa,runId:String(o),instanceId:y,workspace:h,cwd:p,filesystemMode:f.filesystemMode,networkMode:f.networkMode,environmentMode:"allowlist",deniedRelativePaths:await Na(h),temporaryDirectory:I,egressProxy:E,environment:R,resourceLimits:ba(f),readOnlyToolchainRoots:await Aa(e,t)},M=!1,D=async()=>{if(!M){M=!0;try{E&&await Pa(e,E,{runId:String(o),instanceId:y})}finally{await Ta(I,{recursive:!0,force:!0})}}};return{command:m,args:[...b(e.sandboxBrokerArguments),"--",r,...n],cwd:p,environment:{PATH:process.env.PATH||"",LANG:process.env.LANG||"C.UTF-8",ORCHA_PROCESS_ISOLATION_REQUEST:JSON.stringify(N)},tempDirectory:I,homeDirectory:_,artifactDirectory:T,pathMappings:[{runtimeRoot:"/tmp/artifacts",hostRoot:T},{runtimeRoot:"/tmp/home",hostRoot:_}],isolation:{enforced:!0,backend:"broker",instanceId:y,policyRevision:f.policyRevision},cleanup:D}}async function Aa(e,t){let r=b(t.toolchainRoots||t.sandboxToolchainRoots);if(!r.length)return[];let n=await Promise.all(b(e.trustedToolchainRoots).map(i=>At(i)));if(!n.length)throw O("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","target toolchain roots require ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS");let s=[];for(let i of r){if(!xt(i))throw O("RUNTIME_TOOLCHAIN_ROOT_INVALID","toolchain roots must be absolute");let o=await At(i);if(!n.some(a=>ar(a,o)))throw O("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","toolchain root is outside trusted roots");s.push(o)}return[...new Set(s)]}function xa(e,t){let r=l(e.env)?e.env:{},n={};for(let[s,i]of Object.entries(r))/^[A-Za-z_][A-Za-z0-9_]*$/.test(s)&&i!=null&&(n[s]=String(i));for(let s of["ORCHA_RUNTIME_PROMPT","ORCHA_RUNTIME_ARTIFACT_DIR"])t[s]!=null&&(n[s]=String(t[s]));return n}async function Na(e){let t=[],r=0,n=async s=>{let i;try{i=await wa(s,{withFileTypes:!0})}catch(o){if(s===e)throw o;return}for(let o of i){if(r+=1,r>1e4)throw O("RUNTIME_WORKSPACE_SCAN_LIMIT_EXCEEDED","workspace contains more than 10000 entries");let a=ht(s,o.name),u=Jn(e,a),d=o.name.toLowerCase();(Ca.has(d)||d.startsWith(".env."))&&t.push(u),o.isDirectory()&&!o.isSymbolicLink()&&await n(a)}};return await n(e),t.sort()}function ba(e){return{maxCpuSeconds:Math.max(1,S(e.maxRuntimeSeconds,900)),maxMemoryBytes:S(e.maxMemoryBytes,2*1024*1024*1024),maxProcesses:S(e.maxProcesses,128),maxOpenFiles:S(e.maxOpenFiles,1024),maxFileBytes:S(e.maxFileBytes,64*1024*1024)}}async function Ma(e,t,r){return await new Promise((n,s)=>{let i=ha(e,[...t,"--probe"],{env:{PATH:process.env.PATH||"",LANG:"C.UTF-8"},stdio:["ignore","pipe","pipe"],windowsHide:!0}),o=[],a=[];i.stdout.on("data",d=>o.push(Buffer.from(d))),i.stderr.on("data",d=>a.push(Buffer.from(d)));let u=setTimeout(()=>i.kill("SIGKILL"),Math.max(1e3,r));i.once("error",s),i.once("close",d=>{if(clearTimeout(u),d!==0){s(O("RUNTIME_SANDBOX_UNAVAILABLE",Buffer.concat(a).toString("utf8").trim()||`sandbox probe exited with ${d}`));return}try{n(JSON.parse(Buffer.concat(o).toString("utf8")))}catch{s(O("RUNTIME_SANDBOX_UNAVAILABLE","sandbox probe returned invalid JSON"))}})})}async function Qn(e,t){let r=c(e);if(!r)return"";let n=xt(r)?[r]:String(t||"").split(":").filter(Boolean).map(s=>ht(s,r));for(let s of n)try{return await ya(s,_a.X_OK),s}catch{}return""}async function Ua(e,t){if(!e.egressProxyRequired)throw O("RUNTIME_EGRESS_UNAVAILABLE","restricted network requires the Egress Proxy");let r=await or(e,"POST","/v1/grants",{protocolVersion:sr,...t}),n={socketPath:e.egressProxySocket,grantId:c(r.grantId),credential:c(r.credential)};if(!n.grantId||!n.credential)throw O("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy returned an invalid grant");return n}async function Pa(e,t,r){await or(e,"POST",`/v1/grants/${encodeURIComponent(t.grantId)}/revoke`,{protocolVersion:sr,...r}).catch(()=>{})}async function La(e){let t=await or(e,"GET","/health");if(t.status!=="ok"||t.proxy!=="orcha-egress-proxy"||t.protocolVersion!==sr)throw O("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy is unavailable or incompatible")}async function or(e,t,r,n){if(!xt(e.egressProxySocket)||!e.egressProxyToken)throw O("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy socket and token are required");return await new Promise((s,i)=>{let o=Sa.request({socketPath:e.egressProxySocket,path:r,method:t,headers:{Authorization:`Bearer ${e.egressProxyToken}`,Accept:"application/json",...n?{"Content-Type":"application/json"}:{}}},a=>{let u=[],d=0;a.on("data",f=>{d+=f.length,d>1048576?o.destroy(new Error("egress response is too large")):u.push(Buffer.from(f))}),a.once("end",()=>{try{let f=JSON.parse(Buffer.concat(u).toString("utf8")||"{}");(a.statusCode||500)>=400?i(O("RUNTIME_EGRESS_UNAVAILABLE",c(f.error)||"Egress Proxy rejected the request")):s(f)}catch(f){i(f)}})});o.once("error",i),o.setTimeout(3e3,()=>o.destroy(new Error("Egress Proxy request timed out"))),n?o.end(JSON.stringify(n)):o.end()})}function ar(e,t){let r=Jn(rr(e),rr(t));return r===""||!r.startsWith("..")&&!xt(r)}function O(e,t){return Object.assign(new Error(t),{code:e})}var cr=24e3,ur=8,lr=50,dr=6e3,va=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),Da=10*60*1e3,Ha=60*1e3,$a=8,Fa=30*60*1e3,Ba=60*1e3,ja=1,rs=2400,qa=new Set(["max_tokens","max_output_tokens","length"]),Ga=new Set(["agent_message_chunk","tool_call","tool_call_update"]),Ka=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions"]),za=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function Va(e){if(!l(e))return{};let t={};for(let r of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let n=c(e[r]);n&&(t[r]=n)}return t}function Ja(e){return(Array.isArray(e)?e:[]).map(Va).sort((t,r)=>{let n=G(t),s=G(r);return n<s?-1:n>s?1:0})}function Wa(e){return!l(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(r=>l(r)&&Array.isArray(r.toolNames)&&r.toolNames.some(n=>c(n)==="plugin_operation"))}function Xa(e,t,r){let n=l(e?._meta)?e._meta:{};return{...l(e)?e:{},sessionId:t,update:l(e?.update)?e.update:{},_meta:{...n,orchaAgentId:r.agentId,runtimeSessionId:r.runtimeSessionId,bridgeUpdateId:se()}}}function v(e){return e==null||e===""?!1:typeof e=="string"?c(e)!=="":Array.isArray(e)?e.length>0:l(e)?Object.keys(e).length>0:!0}function ns(e){let t=c(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return va.has(t)}function Q(e,t){let r=S(e,t);return Number.isFinite(r)&&r>0?r:t}function Nt(e,t=!1){if(typeof e=="boolean")return e;let r=c(e).toLowerCase();return["true","1","yes","y","on"].includes(r)?!0:["false","0","no","n","off"].includes(r)?!1:t}function z(e){return c(e?.type||"echo")}function ss(e){let t=z(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function hr(e){if(l(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function Ya(e){let t=String(e||"");if(za.test(t))return!0;let r=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return r.endsWith("token")||r.endsWith("secret")||r.endsWith("password")||r.endsWith("apikey")||r.endsWith("privatekey")||r==="authorization"||r==="cookie"||r==="jwt"||r.includes("credential")}function mr(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=dr)return e;let r=e.length-dr;return`${e.slice(0,dr)}... [truncated ${r} characters]`}if(t>=ur)return Array.isArray(e)?`[array truncated at depth ${ur}, items=${e.length}]`:l(e)?`[object truncated at depth ${ur}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let r=e.slice(0,lr).map(n=>mr(n,t+1));return e.length>lr&&r.push(`[truncated ${e.length-lr} items]`),r}if(l(e)){let r={};for(let[n,s]of Object.entries(e))r[n]=Ya(n)?"[REDACTED]":mr(s,t+1);return r}return String(e)}var Qa=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function Za(e){if(!l(e))return e;let t={};for(let r of Qa)v(e[r])&&(t[r]=e[r]);return t}function tc(e){if(!l(e))return e;let t={...e};return l(t.renderedPayload)&&(t.renderedPayload=Za(t.renderedPayload)),t}function ec(e){let t=l(e)?e:{},r={};v(t.metadata)&&(r.metadata=tc(t.metadata));for(let[n,s]of Object.entries(t))Ka.has(n)||n==="metadata"||v(s)&&(r[n]=s);return r}function rc(e){let t=l(e)?e:{},r=l(t.metadata)?t.metadata:{},n=l(r.renderedPayload)?r.renderedPayload:{};return l(t.resultContract)?t.resultContract:l(n.resultContract)?n.resultContract:{}}function is(e){return c(rc(e).kind).toLowerCase()==="decision"}function nc(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:z(e)==="cli"}function Zn(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return Nt(t,ss(e))}function sc(e,t){let r=l(e?.metadata)?{...e.metadata}:{},n=l(r._runtimeBridge)?{...r._runtimeBridge}:{},s=hr(n);return r._runtimeBridge={...n,promptKind:"dispatch",finalTextOnly:nc(t),releaseAfterPrompt:s===void 0?Zn(t):Nt(s,Zn(t)),requiresRuntimeResult:is(e)},r}function ic(e){let t=ec(e);if(!v(t))return"";let r=JSON.stringify(mr(t),null,2);if(r.length<=cr)return r;let n=r.length-cr;return`${r.slice(0,cr)}
-... [truncated ${n} characters]`}function _r(e){if(!l(e))return"";let t=l(e.update)?e.update:e,n=(l(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function gr(e){if(!l(e))return"";let t=l(e.update)?e.update:e;return c(t.sessionUpdate)}function yr(e){if(!Array.isArray(e))return"";let t=!1,r=[],n=[],s=[],i=()=>{r.length>0&&(n.push(r),r=[])};for(let a of e){let u=gr(a),d=_r(a);if(!u){d&&s.push(d);continue}if(t=!0,u==="agent_message_chunk"){d&&r.push(d);continue}(u==="agent_thought_chunk"||u==="user_message_chunk"||u==="tool_call"||u==="tool_call_update"||u==="plan")&&i()}if(i(),!t)return mt(s);let o=n[n.length-1]||[];return mt(o)}function oc(e){return Array.isArray(e)?e.map(_r).filter(t=>t!==""):[]}function ie(e){return Array.isArray(e)?e.some(r=>gr(r))?e.filter(r=>Ga.has(gr(r))).map(_r).filter(r=>r!==""):oc(e):[]}function ac(e){if(!l(e))return null;let t=l(e.update)?e.update:e;return c(t.sessionUpdate)!=="runtime_event"?null:l(t.event)?t.event:null}function cc(e){if(!l(e))return"";let t=l(e.payload)?e.payload:{},r=c(e.type),n=c(t.type);if(r==="event_msg"){if(n==="task_complete")return c(t.last_agent_message||t.message||t.output);if(n==="agent_message"){let s=c(t.phase||t.status||t.stage).toLowerCase();if(["final_answer","final","complete","completed","done"].includes(s))return c(t.message||t.text||t.content)}}return""}function uc(e){if(!Array.isArray(e))return"";for(let t=e.length-1;t>=0;t-=1){let r=cc(ac(e[t]));if(r)return r}return""}function mt(e){let t="";for(let r of e){let n=String(r||"");if(n)if(!t)t=n;else if(n.length>t.length&&n.startsWith(t))t=n;else{let s=qn(n)&&!/[\r\n]$/.test(t)?`
-`:"";t+=`${s}${n}`}}return t.trim()}function lc(e){let t=String(e||"").trim();if(!t)return"";let r=t.match(/(?:^|\n)#{1,3}\s+\S/);return!r||r.index===0?t:t.slice(r.index+(t[r.index]===`
-`?1:0)).trim()}function ts(e){let t=String(e||"").trim();if(!t)return null;try{let r=JSON.parse(t);if(l(r)&&(os(r)||v(r._artifacts)||v(r.artifacts)||v(r._decision)||v(r._meta)))return r}catch{}return null}function bt(e){try{return We(e)}catch{return null}}function ne(...e){let t=null;for(let r of e)try{if(We(r))return}catch(n){t||=n}if(t)throw t}function fr(e){let t=String(e||"").trim();if(!t)return null;let r=bt(t);if(r)return r;let n=[...t.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)];for(let s=n.length-1;s>=0;s-=1){let i=ts(n[s][1]);if(i)return i}if(!t.endsWith("}"))return null;for(let s=t.lastIndexOf("{");s>=0;s=t.lastIndexOf("{",s-1)){let i=ts(t.slice(s));if(i)return i}return null}function dc(e){let t=bt(yr(e));if(t)return t;let r=ie(e);for(let n=r.length-1;n>=0;n-=1){let s=bt(r[n]);if(s)return s}return bt(mt(r))}function os(e){if(!l(e))return!1;if(v(e.output))return!0;for(let t of["content","text","message","summary"])if(c(e[t]))return!0;return!!(ns(e.status)||c(e.error)||c(e.errorMessage))}function j(e){let t=l(e)?{...e}:{};return(!Array.isArray(t._artifacts)||t._artifacts.length===0)&&Array.isArray(t.artifacts)&&t.artifacts.length>0&&(t._artifacts=t.artifacts),delete t.artifacts,t}function fc(e){return l(e)?typeof(l(e._decision)?e._decision:l(e.decision)?e.decision:e).passed=="boolean":!1}function as(e){return l(e)?l(e._decision)&&typeof e._decision.passed=="boolean"?!0:fc(e.output):!1}function pr(e,t,r){let n=l(e)?{...e}:{};if(!v(n.output)){for(let s of["summary","message","content","text"])if(c(n[s])){n.output=c(n[s]);break}}return!v(n.output)&&c(r)&&(n.output=c(r)),{...n,_meta:{...l(n._meta)?n._meta:{},runtimeOutputSource:t,requiredRuntimeResult:!0,finalMessagePreview:c(r).slice(0,1e3)}}}var pc=["dataUrl","dataURL","contentDataUrl","contentDataURL","contentBase64","base64","data"];function es(e){if(!l(e))return"";let t=l(e.content)?e.content:{},r=l(e.metadata)?e.metadata:{};return c(e.fieldKey||e.field_key||t.fieldKey||r.fieldKey)}function hc(e,t){let r=l(e.content)?e.content:{},n=l(t.content)?t.content:{},s={...e,...t,content:{...r,...n},metadata:{...l(e.metadata)?e.metadata:{},...l(t.metadata)?t.metadata:{}}};for(let i of pc)v(e[i])&&(s[i]=e[i]),v(r[i])&&(s.content[i]=r[i]);return s}function cs(e,t){let r=Array.isArray(e)?e.filter(l):[],n=Array.isArray(t)?t.filter(l):[];if(!r.length)return n;if(!n.length)return r;let s=[...r],i=new Map;for(let a=0;a<r.length;a+=1){let u=es(r[a]),d=i.get(u)||[];d.push(a),i.set(u,d)}let o=new Map;for(let a of n){let u=es(a),d=o.get(u)||0;o.set(u,d+1);let f=i.get(u)?.[d];f===void 0?s.push(a):s[f]=hc(s[f],a)}return s}function K(e,t,r){let n={...e,...t,_meta:{...l(e._meta)?e._meta:{},...l(t._meta)?t._meta:{},runtimeOutputSource:r}};return(Array.isArray(e._artifacts)||Array.isArray(t._artifacts))&&(n._artifacts=cs(e._artifacts,t._artifacts)),n}function us(e,t,r={}){let n=c(r.promptKind),s=r.requiresRuntimeResult===!0,i=s||n==="dispatch",o=j(e),a=typeof o.output=="string"?bt(o.output):null;if(a)return K(o,j(a),"result_block");let u=uc(t),d=u?fr(u):null,f=i?dc(t):null;if(os(o))return ns(o.status)||c(o.error)||c(o.errorMessage)?o:n==="dispatch"&&d?K(o,j(d),"final_event"):n==="dispatch"&&f?K(o,j(f),"updates"):!s||as(o)?o:d?K(o,j(d),"final_event"):f?K(o,j(f),"updates"):(ne(o.output,u,mt(ie(t))),pr(o,"result",o.output));if(d)return K(o,j(d),"final_event");if(f)return K(o,j(f),"updates");if(u)return s?(ne(u,mt(ie(t))),pr(o,"final_event",u)):{...o,output:u,_meta:{...l(o._meta)?o._meta:{},runtimeOutputSource:"final_event"}};let h=yr(t),p=fr(h);if(p)return K(o,j(p),"updates");let m=lc(h);if(!m)return s&&ne(mt(ie(t))),o;let y=fr(m);return y?K(o,j(y),"updates"):s?(ne(h,m),pr(o,"updates",m)):{...o,output:m,_meta:{...l(o._meta)?o._meta:{},runtimeOutputSource:"updates"}}}function wr(e){return l(e)?c(e.stopReason||e.stop_reason).toLowerCase():""}function ls(e){return qa.has(wr(e))}function mc(e,t,r){if(r.promptKind!=="dispatch"||r.requiresRuntimeResult!==!0||!ls(e))return!1;try{return!as(us(e,t,r))}catch{return!0}}function gc(){return["Your previous final response reached the output limit before the Runtime Result protocol was complete.","Re-emit the complete final Runtime Result from scratch using the conclusion you already reached.","Do not repeat analysis, process notes, tool calls, or task work.",`Keep the OUTPUT report within ${rs} Unicode characters.`,`Output ${Ge}, ${Ke}, ${ze}, and ${Ve} on their own lines.`,"The CONTROL block must be valid JSON containing _decision and must be fully closed.","Return only the two protocol blocks."].join(`
-`)}function _c(e,t){let r=l(t)?{...t}:{},n=cs(e?._artifacts,t?._artifacts);return n.length>0&&(r._artifacts=n),r}function yc(e,t){return{...e,_meta:{...l(e?._meta)?e._meta:{},runtimeProtocolRetry:{attempted:!0,recovered:!0,reason:wr(t)||"max_tokens"}}}}function wc(e,t){let r=typeof e?.output=="string"?e.output:yr(t),n=new k("runtime_output_truncated","Runtime Result \u8FBE\u5230\u6700\u5927\u8F93\u51FA\u957F\u5EA6\uFF0C\u7D27\u51D1\u91CD\u8BD5\u540E\u4ECD\u672A\u5B8C\u6574\u8FD4\u56DE",r);return n.detail={...n.detail,stopReason:wr(e)||"max_tokens",retryAttempted:!0},n}var oe=class{constructor(t){this.config=t,this.targets=t.targets||{},this.agents=new Map,this.sessions=new Map,this.startingSessions=new Set,this.targetReservations=new Map,this.runtimeSessionIndex=new Map,this.pendingPermissions=new Map,this.operations=new Map,this.startedAt=Et(),this.sandboxCapabilities={dispatchable:t.sandboxRequired!==!0,enforced:!1,backend:t.sandboxRequired?"unavailable":"direct",daemonStatus:t.sandboxRequired?"pending":"not_required",policySchemaVersions:[1],runtimePolicyUpdates:t.sandboxRequired===!0,workspaceSync:!1,egressProxy:!1},this.cleanupTimer=null,this.onCapacityChanged=null,this.startSessionCleanup()}async start(){try{this.sandboxCapabilities=await Xn(this.config)}catch(t){this.sandboxCapabilities={...this.sandboxCapabilities,dispatchable:!1,enforced:!1,backend:"unavailable",daemonStatus:"unavailable",reason:c(t?.code||t?.message||t)||"sandbox_probe_failed"},g("error","runtime-bridge","runtime node sandbox probe failed; node will not accept work",{reason:this.sandboxCapabilities.reason})}return this.sandboxCapabilities}assertDispatchable(){if(this.config.sandboxRequired&&!(this.sandboxCapabilities.dispatchable===!0&&this.sandboxCapabilities.enforced===!0))throw Object.assign(new Error("runtime node strong sandbox is unavailable"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"})}operationIdentity(t,r,n){let s=l(t.goalContract)?Ze(t.goalContract):c(t.goalContractHash),i=ka("sha256").update(G({prompt:Array.isArray(t.prompt)?t.prompt:[],mcpServers:Ja(t.mcpServers),metadata:l(t.metadata)?t.metadata:{}})).digest("hex");return{agentId:r,runId:c(t.runId),sessionId:n,targetCode:c(t.targetCode||t.framework),workspace:c(t.workspace),goalContractHash:s,requestHash:i}}assertOperationIdentity(t,r,n,s){let i=this.operationIdentity(r,n,s),o=Object.keys(t.identity).find(a=>t.identity[a]!==i[a]);if(o)throw Object.assign(new Error(`runtime operation correlation conflict: ${t.correlationId}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT",field:o})}createOperation(t,r,n,s){let i={correlationId:t,agentId:n,sessionId:s,identity:this.operationIdentity(r,n,s),sandboxPolicy:l(r.sandboxPolicy)?structuredClone(r.sandboxPolicy):null,status:"running",updates:[],listeners:new Set,waiters:[],response:null,error:null,mcpServers:r.mcpServers,createdAtMs:Date.now(),completedAtMs:null};return this.operations.set(t,i),i}async attachOperation(t,r={}){let n=()=>{if(r.onUpdate)for(let s of t.updates)r.onUpdate(s)};if(t.status==="completed")return n(),t.response;if(t.status==="failed")throw n(),t.error;r.onUpdate&&t.listeners.add(r.onUpdate);try{return n(),await new Promise((s,i)=>t.waiters.push({resolve:s,reject:i}))}finally{r.onUpdate&&t.listeners.delete(r.onUpdate)}}completeOperation(t,r){if(t.status==="running"){t.status="completed",t.response=r,t.mcpServers=null,t.completedAtMs=Date.now();for(let n of t.waiters.splice(0))n.resolve(r);t.listeners.clear()}}promptResponse(t,r,n,s,i,o=s){let a=l(t.metadata)?t.metadata:{},u=l(a._runtimeBridge)?a._runtimeBridge:{},d=a.source==="channel_message"?i:us(i,o,u),f=zn(t.goalContract,s,t.goalContractHash);return{sessionId:n,runtimeSessionId:r.runtimeSessionId,result:d,updates:s,...f?{verification:f}:{}}}failOperation(t,r){if(t.status!=="running")return;let n=r instanceof Error?r:Object.assign(new Error(String(r||"runtime operation failed")),{code:"RUNTIME_NODE_ERROR"});t.status="failed",t.error=n,t.mcpServers=null,t.completedAtMs=Date.now();for(let s of t.waiters.splice(0))s.reject(n);t.listeners.clear()}cleanupOperations(t=Date.now()){let r=Q(this.config.operationTtlMs,Fa);for(let[n,s]of this.operations)s.status!=="running"&&t-(s.completedAtMs||s.createdAtMs)>r&&this.operations.delete(n)}targetFor(t){let r=c(t)||this.config.defaultTargetCode,n=this.targets[r];if(!r||!l(n)){let s=new Error(`runtime target is not configured: ${r||"<empty>"}`);throw s.code="RUNTIME_TARGET_NOT_FOUND",s}return{code:r,target:n}}targetIdleTtlMs(t){let n=z(t)==="openclaw"?Q(this.config.openClawSessionIdleTtlMs,Ba):Q(this.config.sessionIdleTtlMs,Da);return Q(t?.sessionIdleTtlMs??t?.idleTtlMs,n)}targetMaxSessions(t){let n=z(t)==="openclaw"?Q(this.config.openClawMaxSessions,ja):Q(this.config.maxSessionsPerTarget,$a);return Q(t?.maxSessions,n)}targetReservationCount(t){return Number(this.targetReservations.get(t)||0)}notifyCapacityChanged(){try{this.onCapacityChanged?.()}catch(t){g("warn","runtime-bridge","capacity heartbeat callback failed",{error:String(t)})}}targetCapacitySnapshot(t=!0){return Object.entries(this.targets).map(([r,n])=>{let s=[...this.sessions.values()].filter(f=>f.targetCode===r),i=s.filter(f=>f.busy).length,o=s.length-i,a=this.targetReservationCount(r),u=this.targetMaxSessions(n),d=t?Math.max(0,u-i-a):0;return{targetCode:r,targetName:c(n?.name||n?.targetName||r),targetType:c(n?.type||"echo"),status:t?d>0?"available":"busy":"unavailable",maxSessions:u,busySessions:i,idleSessions:o,reservedSessions:a,availableSessions:d}})}targetReleaseAfterPrompt(t,r={}){let n=z(t),s=l(r?._runtimeBridge)?r._runtimeBridge:{},i=hr(s);return i!==void 0?Nt(i,!1):Nt(t?.releaseAfterPrompt??t?.disposeAfterPrompt,n==="openclaw")}promptReleaseAfterPrompt(t,r={}){if(this.config.sandboxRequired)return!0;let n=l(r?._runtimeBridge)?r._runtimeBridge:{},s=hr(n);return s!==void 0?Nt(s,t.releaseAfterPrompt):t.releaseAfterPrompt}startSessionCleanup(){let t=Q(this.config.sessionCleanupIntervalMs,Ha);t<=0||(this.cleanupTimer=setInterval(()=>{this.cleanupExpiredSessions().catch(r=>{g("warn","runtime-bridge","runtime session cleanup failed",{error:String(r)})})},t),this.cleanupTimer.unref?.())}sessionCountForTarget(t){let r=0;for(let n of this.sessions.values())n.targetCode===t&&(r+=1);return r}idleTargetSessions(t){return[...this.sessions.entries()].filter(([,r])=>r.targetCode===t&&!r.busy).sort((r,n)=>(r[1].lastUsedAtMs||0)-(n[1].lastUsedAtMs||0))}async closeSession(t,r="session_closed"){let n=this.sessions.get(t);if(!n)return!1;try{await n.runtime?.stop?.(r)}catch(s){g("warn","runtime-bridge","runtime session stop failed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,error:String(s)})}return this.sessions.delete(t),this.runtimeSessionIndex.delete(`${n.agentId}:${n.runtimeSessionId}`),this.notifyCapacityChanged(),g("info","runtime-bridge","runtime session closed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,reason:r}),!0}async closeAllSessions(t="bridge_shutdown"){for(let r of[...this.sessions.keys()])await this.closeSession(r,t)}async stop(t="bridge_stop"){this.cleanupTimer&&clearInterval(this.cleanupTimer),this.cleanupTimer=null,await this.closeAllSessions(t)}async cleanupExpiredSessions(t=Date.now()){for(let[r,n]of[...this.sessions.entries()])n.busy||t-(n.lastUsedAtMs||n.createdAtMs||t)>n.idleTtlMs&&await this.closeSession(r,"idle_timeout")}async reserveTargetSlot(t,r){let n=this.targetMaxSessions(r);for(;this.sessionCountForTarget(t)+this.targetReservationCount(t)>=n;){let s=this.idleTargetSessions(t);if(!s.length){let i=new Error(`runtime target session limit reached: ${t}`);throw i.code="RUNTIME_TARGET_SESSION_LIMIT",i}await this.closeSession(s[0][0],"target_session_limit")}this.targetReservations.set(t,this.targetReservationCount(t)+1),this.notifyCapacityChanged()}releaseTargetSlot(t){let r=Math.max(0,this.targetReservationCount(t)-1);r>0?this.targetReservations.set(t,r):this.targetReservations.delete(t),this.notifyCapacityChanged()}async createAgent(t){let r=c(t.agentId);if(!r)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});let{code:n,target:s}=this.targetFor(t.targetCode||t.framework),i=this.agents.get(r);if(i&&i.targetCode!==n)throw Object.assign(new Error(`runtime agent target conflict: ${r}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});let o=this.config.sandboxRequired?await ir(this.config,s,t.workspace):c(t.workspace),a={agentId:r,targetCode:n,framework:c(t.framework||n),workspace:o,metadata:l(t.metadata)?t.metadata:{},createdAt:Et(),runtimeKind:z(s)};return this.agents.set(r,a),{agent:a}}runtimeFor(t,r,n={}){let{target:s}=this.targetFor(t.targetCode),i=z(s),o={onPermissionRequest:u=>n.source==="conversation_delegation"?{outcome:"denied",reason:"External group member permission continuation is not supported"}:this.requestPermission(u)},a={sessionPromptTimeoutMs:this.config.sessionPromptTimeoutMs,initializeTimeoutMs:this.config.initializeTimeoutMs,sandboxRequired:this.config.sandboxRequired,runId:n.runId,source:n.source,cloudSessionId:r,orchaUrl:this.config.orchaUrl,attachOnly:n.attachOnly,sandboxPolicy:n.sandboxPolicy,...this.config.sandboxRequired?{prepareLaunch:u=>Yn({config:this.config,target:s,...u,runId:n.runId,agentId:t.agentId,sessionId:r,sandboxPolicy:n.sandboxPolicy})}:{}};return i==="stdio-acp"||i==="acp"?new ft(t,s,o,a):i==="openclaw"?new Gt(t,s,r,o,a):i==="cli"?new Yt(t,s,a):new Dt(t)}async prompt(t,r={}){if(this.assertDispatchable(),this.config.sandboxRequired){let a=c(t.runId);if(!a)throw Object.assign(new Error("runId is required"),{code:"BAD_REQUEST"});t={...t,runId:a,sandboxPolicy:at(t.sandboxPolicy)}}let n=c(t.agentId),s=c(t.sessionId)||se(),i=c(t.correlationId);if(!n)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});if(this.cleanupOperations(),i){let a=this.operations.get(i);if(a){if(this.assertOperationIdentity(a,t,n,s),a.status==="running"&&(["conversation_delegation","channel_message"].includes(t.metadata?.source)||t.metadata?.source==="ai_chat_runtime_node"&&Object.hasOwn(ot,t.framework||""))){a.mcpServers=t.mcpServers;let u=this.sessions.get(`${n}:${s}`);if(u){if(!u.runtime.refreshMcpServers)throw Object.assign(new Error("This runtime cannot refresh task MCP credentials"),{code:"unsupported_dynamic_mcp"});await u.runtime.refreshMcpServers(t.mcpServers)}}return this.attachOperation(a,r)}if(t.attachOnly===!0&&!(t.metadata?.source==="channel_message"&&this.targetFor(t.targetCode||t.framework).target.type==="openclaw"))throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"})}else if(t.attachOnly===!0)throw Object.assign(new Error("correlationId is required for attachOnly"),{code:"BAD_REQUEST"});let o=i?this.createOperation(i,t,n,s):null;if(o){let a=this.attachOperation(o,r);return(async()=>{try{await this._promptOwned(t,{},o,n,s)}catch(u){let d=o.status==="completed";this.failOperation(o,u),d&&g("warn","runtime-bridge","runtime cleanup failed after operation completion",{correlationId:o.correlationId,error:String(u)})}})(),await a}return await this._promptOwned(t,r,o,n,s)}async _promptOwned(t,r,n,s,i){let o=c(t.runId),a=this.config.sandboxRequired?at(n?.sandboxPolicy||t.sandboxPolicy):null,u=this.agents.get(s),d=this.targetFor(t.targetCode||t.framework||u?.targetCode);if(u&&u.targetCode!==d.code)throw Object.assign(new Error(`runtime agent target conflict: ${s}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});if(z(d.target)==="cli"&&Wa(t.goalContract))throw Object.assign(new Error("CLI runtimes do not support per-run dynamic MCP required by plugin_operation"),{code:"unsupported_dynamic_mcp"});let f=u||(await this.createAgent({agentId:s,targetCode:d.code,framework:t.framework,workspace:t.workspace,metadata:t.metadata})).agent;if(!this.config.sandboxRequired){let _=c(t.workspace);_&&_!==f.workspace&&(f.workspace=_)}let h=`${s}:${i}`;await this.cleanupExpiredSessions();let p=this.sessions.get(h),m=null;if(p&&p.targetCode!==d.code)throw Object.assign(new Error(`runtime session target conflict: ${i}`),{code:"RUNTIME_SESSION_TARGET_CONFLICT"});if(p&&this.config.sandboxRequired&&p.runId!==o)throw Object.assign(new Error(`runtime session cannot be shared across runs: ${i}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});if(!p){if(this.startingSessions.has(h))throw Object.assign(new Error(`runtime session is already starting: ${i}`),{code:"RUNTIME_SESSION_BUSY"});this.startingSessions.add(h);let{code:_,target:T}=d,E;try{await this.reserveTargetSlot(_,T),m=_;let R=this.runtimeFor(f,i,{runId:o,sandboxPolicy:a,source:t.metadata?.source,attachOnly:t.attachOnly});E=R;let N=n?.mcpServers||t.mcpServers||[],M=await R.sessionNew({cwd:rt(T,f.workspace),mcpServers:N,metadata:l(t.metadata)?t.metadata:{}});if(n&&n.status!=="running")throw Object.assign(new Error("Runtime operation was cancelled before prompt dispatch"),{code:"RUNTIME_OPERATION_CANCELLED"});let D=Date.now();p={agentId:s,sessionId:i,runtime:R,targetCode:_,runtimeKind:z(T),runId:o,sandboxPolicy:a?structuredClone(a):null,runtimeSessionId:c(l(M)?M.sessionId:"")||i,idleTtlMs:this.targetIdleTtlMs(T),releaseAfterPrompt:this.config.sandboxRequired?!0:this.targetReleaseAfterPrompt(T,t.metadata),createdAtMs:D,lastUsedAtMs:D,busy:!1,createdAt:Et()},this.sessions.set(h,p),this.runtimeSessionIndex.set(`${s}:${p.runtimeSessionId}`,p),n?.mcpServers!==N&&n?.mcpServers&&R.refreshMcpServers&&await R.refreshMcpServers(n.mcpServers)}catch(R){throw this.sessions.get(h)?.runtime===E?await this.closeSession(h,"session_start_failed"):await E?.stop("session_start_failed"),m&&(this.releaseTargetSlot(m),m=null),R}finally{this.startingSessions.delete(h)}}if(p.busy){let _=new Error(`runtime session is already running: ${i}`);throw _.code="RUNTIME_SESSION_BUSY",_}p.busy=!0,m&&this.releaseTargetSlot(m),this.notifyCapacityChanged(),p.operationCorrelationId=n?.correlationId||null,p.lastUsedAtMs=Date.now();let y=n?.updates||[],w=_=>{let T=Xa(_,i,p);if(y.push(T),n)for(let E of n.listeners)try{E?.(T)}catch(R){g("warn","runtime-bridge","runtime operation update listener failed",{correlationId:n.correlationId,error:String(R)})}else r.onUpdate?.(T)},I=_=>{if(!(!n||n.status!=="running"||!l(_))){if(_.status==="failed"){let T=_.error;if(T instanceof Error){this.failOperation(n,T);return}let E=l(T)?T:{},R=Object.assign(new Error(c(E.message||_.message)||"runtime terminal failure"),{code:c(E.code||_.code)||"RUNTIME_TERMINAL_FAILED"});this.failOperation(n,R);return}this.completeOperation(n,this.promptResponse(t,p,i,y,l(_.result)?_.result:{stopReason:"end_turn"}))}};try{let _=Kn(t.goalContract),T=Array.isArray(t.prompt)?[...t.prompt]:[];_&&T.unshift({type:"text",text:_,metadata:{source:"orcha_goal_contract"}});let E=l(t.metadata)?t.metadata:{},R=l(E._runtimeBridge)?E._runtimeBridge:{},N=await p.runtime.sessionPrompt({sessionId:p.runtimeSessionId,prompt:T,metadata:E},w,I),M=y,D=null;if(ss({type:p.runtimeKind})&&mc(N,y,R)){D=N;let V=y.length,C=await p.runtime.sessionPrompt({sessionId:p.runtimeSessionId,prompt:[{type:"text",text:gc()}],metadata:E,_meta:{thinking:"off"}},w,I);N=_c(D,C),M=y.slice(V)}let Z;try{Z=this.promptResponse(t,p,i,y,N,M)}catch(V){throw D&&ls(N)?wc(N,M):V}return D&&(Z.result=yc(Z.result,D)),n&&this.completeOperation(n,Z),Z}finally{p.busy=!1,this.notifyCapacityChanged(),p.operationCorrelationId===n?.correlationId&&(p.operationCorrelationId=null),p.lastUsedAtMs=Date.now(),this.promptReleaseAfterPrompt(p,l(t.metadata)?t.metadata:{})&&await this.closeSession(h,"release_after_prompt"),n&&(n.mcpServers=null)}}async updatePolicy(t){if(this.assertDispatchable(),!this.config.sandboxRequired)throw Object.assign(new Error("runtime sandbox policy updates require an enforced sandbox"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"});let r=c(t.agentId),n=c(t.runId),s=c(t.sessionId),i=c(t.correlationId);if(!r||!n||!s||!i)throw Object.assign(new Error("agentId, runId, sessionId and correlationId are required"),{code:"BAD_REQUEST"});let o=at(t.sandboxPolicy),a=this.operations.get(i);if(a&&(a.agentId!==r||a.sessionId!==s||a.identity.runId!==n))throw Object.assign(new Error(`runtime operation policy identity conflict: ${i}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let u=`${r}:${s}`,d=this.sessions.get(u);if(d&&d.runId!==n)throw Object.assign(new Error(`runtime session policy identity conflict: ${s}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});let f=d?.sandboxPolicy||a?.sandboxPolicy;if(!f)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"});let h=Number(f.policyRevision),p=Number(o.policyRevision);if(p<h)throw Object.assign(new Error("runtime sandbox policy revision is stale"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:h});if(p===h){if(G(f)!==G(o))throw Object.assign(new Error("runtime sandbox policy revision payload conflicts"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:h});return{updated:!1,idempotent:!0,policyRevision:h,accessMode:f.accessMode}}let m=Wn(f,o);a&&(a.sandboxPolicy=structuredClone(o)),d&&(d.sandboxPolicy=structuredClone(o));let y=!1;return m&&d?.busy===!0&&(await d.runtime.sessionCancel({sessionId:d.runtimeSessionId}),y=await this.closeSession(u,"sandbox_policy_downgrade")),{updated:!0,policyRevision:p,accessMode:o.accessMode,activeCommandCancelled:y,deferredToNextLaunch:!m&&d?.busy===!0}}async cancel(t){let r=c(t.agentId),n=c(t.sessionId),s=c(t.correlationId);if(s){let a=this.operations.get(s);if(!a||a.status!=="running")return{cancelled:!1,correlationId:s,reason:"operation_not_running"};if(a.agentId!==r||a.sessionId!==n)throw Object.assign(new Error(`runtime operation cancellation identity conflict: ${s}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let u=this.sessions.get(`${r}:${n}`);return!u||u.busy!==!0||u.operationCorrelationId!==s?(this.failOperation(a,Object.assign(new Error("Runtime operation cancelled before dispatch"),{code:"RUNTIME_OPERATION_CANCELLED"})),{cancelled:!0,correlationId:s,reason:"cancelled_before_dispatch"}):(await u.runtime.sessionCancel({sessionId:u.runtimeSessionId}),await this.closeSession(`${r}:${n}`,"cancelled"),{cancelled:!0,correlationId:s})}let i=`${r}:${n}`,o=this.sessions.get(i);return o?(await o.runtime.sessionCancel({sessionId:o.runtimeSessionId}),await this.closeSession(i,"cancelled"),{cancelled:!0}):{cancelled:!1}}async dispatch(t,r={}){let n=c(t.agentId),s=c(t.taskId),i=c(t.executionId);if(!n||!s)throw Object.assign(new Error("agentId and taskId are required"),{status:400,code:"BAD_REQUEST"});let o=c(t.sessionId)||`dispatch-${i||s}`,a=c(t.instructions),u=ic(t),d=is(t),{target:f}=this.targetFor(t.targetCode||t.framework),h=[{type:"text",text:["Task dispatch received.",`taskId: ${s}`,i?`executionId: ${i}`:"",a?`instructions: ${a}`:"",u?"orchaContext:":"",u,u?"Use orchaContext as the source of truth for upstream outputs, review reports, artifacts, and workflow metadata.":"","Follow the execution protocol in instructions exactly.","When embedding a generated artifact in final Markdown, use the Orcha artifact placeholder as the link target: orcha-artifact://<fieldKey>/<index>.","Example: use ![illustration](orcha-artifact://image/0) for the first generated image artifact.","Do not use local filesystem paths, file:// URLs, or data: URLs in final Markdown; Orcha replaces artifact placeholders after ingestion.",d?`For decision results, put the raw report between ${Ge} and ${Ke}.`:"",d?`Then put a JSON object containing _decision between ${ze} and ${Ve}.`:"",d?"Do not JSON-escape the report. Keep output out of the CONTROL JSON, and put every protocol marker on its own line.":"",d?`Keep the report within ${rs} Unicode characters so the CONTROL block fits before the output limit.`:"","Return only the final answer required by that protocol.","Do not include process notes, logs, or explanations."].filter(Boolean).join(`
-`)}];return this.prompt({...t,agentId:n,sessionId:o,prompt:h,metadata:sc(t,f)},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s}){let i=se(),a=this.runtimeSessionIndex.get(`${t.agentId}:${r}`)?.sessionId||r||se(),u={permissionId:i,agentId:t.agentId,sessionId:a,runtimeSessionId:r,request:l(n)?n:{},status:"pending",createdAt:Et()};return s?.({sessionId:r,update:{sessionUpdate:"permission_request",permission:u}}),await new Promise(d=>{let f=S(n?.timeoutMs,this.config.permissionRequestTimeoutMs),h=setTimeout(()=>{this.pendingPermissions.delete(i),d({permissionId:i,outcome:"denied",response:{reason:"permission request timed out"}})},f);this.pendingPermissions.set(i,{timer:h,resolve:d,permission:u})})}async respondPermission(t){let r=c(t.permissionId),n=this.pendingPermissions.get(r),s=c(t.outcome||"approved")||"approved";return n?(clearTimeout(n.timer),this.pendingPermissions.delete(r),n.resolve({permissionId:r,outcome:s,response:l(t.response)?t.response:{},userId:c(t.userId),metadata:l(t.metadata)?t.metadata:{}}),{accepted:!0,permissionId:r,outcome:s}):{accepted:!1,permissionId:r,outcome:s}}health(){return{status:this.config.sandboxRequired&&!this.sandboxCapabilities.dispatchable?"unavailable":"ok",bridgeVersion:W,startedAt:this.startedAt,agents:[...this.agents.values()].map(t=>({agentId:t.agentId,targetCode:t.targetCode,framework:t.framework,runtimeKind:t.runtimeKind})),sessions:this.sessions.size,pendingPermissions:this.pendingPermissions.size,targets:Object.keys(this.targets),sandboxCapabilities:this.sandboxCapabilities}}};import Tc from"node:http";import Ec from"node:https";import{randomBytes as ds}from"node:crypto";var gt=1,ct=3,Sc=1e4,ae=class{constructor(t,r={}){this.url=t,this.readyState=0,this.socket=null,this.request=null,this.buffer=Buffer.alloc(0),this.listeners=new Map,this.connectTimeoutMs=Rc(r.connectTimeoutMs,Sc),this.connectTimer=null,this.connect()}addEventListener(t,r){let n=this.listeners.get(t)||new Set;n.add(r),this.listeners.set(t,n)}emit(t,r={}){let n=this.listeners.get(t);if(n)for(let s of n)s(r)}connect(){let t=new URL(this.url),r=t.protocol==="wss:"?Ec:Tc,n=ds(16).toString("base64"),s=r.request({protocol:t.protocol==="wss:"?"https:":"http:",hostname:t.hostname,port:t.port||(t.protocol==="wss:"?443:80),path:`${t.pathname}${t.search}`,method:"GET",headers:{Connection:"Upgrade",Upgrade:"websocket","Sec-WebSocket-Key":n,"Sec-WebSocket-Version":"13"}});this.request=s,this.startConnectTimer(s),s.on("upgrade",(i,o,a)=>{if(this.clearConnectTimer(),this.readyState===ct){o.destroy();return}this.socket=o,this.readyState=gt,o.on("data",u=>this.onData(u)),o.on("close",()=>this.onClose()),o.on("error",u=>{this.readyState!==ct&&this.emit("error",{error:u,message:u.message,type:"error"}),this.onClose()}),a?.length&&this.onData(a),this.emit("open")}),s.on("response",i=>{this.clearConnectTimer(),this.emit("error",{message:`websocket upgrade failed: HTTP ${i.statusCode}`,type:"error"}),i.resume(),this.onClose()}),s.on("error",i=>{this.clearConnectTimer(),this.readyState!==ct&&this.emit("error",{error:i,message:i.message,type:"error"}),this.onClose()}),s.end()}startConnectTimer(t){this.connectTimeoutMs<=0||(this.connectTimer=setTimeout(()=>{if(this.readyState===gt||this.readyState===ct)return;let r=`websocket connect timeout after ${this.connectTimeoutMs}ms`;this.emit("error",{message:r,type:"timeout"}),this.onClose(),t.destroy(new Error(r))},this.connectTimeoutMs),this.connectTimer.unref?.())}clearConnectTimer(){this.connectTimer&&(clearTimeout(this.connectTimer),this.connectTimer=null)}send(t){!this.socket||this.readyState!==gt||this.socket.write(Tr(1,Buffer.from(String(t),"utf8")))}close(){if(this.readyState!==ct){if(this.clearConnectTimer(),!this.socket){this.request?.destroy(),this.onClose();return}try{this.readyState===gt&&this.socket.write(Tr(8,Buffer.alloc(0))),this.socket.end()}catch{this.socket.destroy()}this.onClose()}}onClose(){this.readyState!==ct&&(this.clearConnectTimer(),this.readyState=ct,this.request=null,this.emit("close"))}onData(t){for(this.buffer=Buffer.concat([this.buffer,t]);this.buffer.length>=2;){let r=this.buffer[0],n=this.buffer[1],s=r&15,i=(n&128)!==0,o=n&127,a=2;if(o===126){if(this.buffer.length<a+2)return;o=this.buffer.readUInt16BE(a),a+=2}else if(o===127){if(this.buffer.length<a+8)return;let f=this.buffer.readUInt32BE(a),h=this.buffer.readUInt32BE(a+4);o=f*2**32+h,a+=8}let u=a;if(i&&(a+=4),this.buffer.length<a+o)return;let d=this.buffer.subarray(a,a+o);if(i){let f=this.buffer.subarray(u,u+4);d=Buffer.from(d.map((h,p)=>h^f[p%4]))}this.buffer=this.buffer.subarray(a+o),s===1?this.emit("message",{data:d.toString("utf8")}):s===8?this.close():s===9&&this.socket?.write(Tr(10,d))}}};function Rc(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function Tr(e,t){let r=t.length,n=2;r>=126&&r<=65535?n+=2:r>65535&&(n+=8);let s=ds(4),i=Buffer.alloc(n+4+r);i[0]=128|e;let o=2;r<126?i[1]=128|r:r<=65535?(i[1]=254,i.writeUInt16BE(r,o),o+=2):(i[1]=255,i.writeUInt32BE(Math.floor(r/2**32),o),i.writeUInt32BE(r>>>0,o+4),o+=8),s.copy(i,o),o+=4;for(let a=0;a<r;a+=1)i[o+a]=t[a]^s[a%4];return i}function Oc(e){let t=new URL(e);if(t.protocol==="http:")t.protocol="ws:";else if(t.protocol==="https:")t.protocol="wss:";else if(t.protocol!=="ws:"&&t.protocol!=="wss:")throw new Error(`unsupported ORCHA_RUNTIME_ORCHA_URL protocol: ${t.protocol}`);return t.pathname=`${t.pathname.replace(/\/+$/,"")}/api/agent-runtime-bridge/ws`,t.search="",t.toString()}function Ic(e,t=!0){return Object.entries(e||{}).map(([r,n])=>({targetCode:r,targetName:c(n?.name||n?.targetName||r),targetType:c(n?.type||"echo"),status:t?"available":"unavailable"}))}var Cc=Object.freeze(["health","agents/create","agents/dispatch","sessions/prompt","sessions/policy","sessions/cancel","permissions/respond"]),ce=class{constructor(t,r){this.config=t,this.bridge=r,this.ws=null,this.stopped=!1,this.connected=!1,this.reconnectTimer=null,this.heartbeatTimer=null,this.capacityHeartbeatTimer=null,this.bridge.onCapacityChanged=()=>this.scheduleCapacityHeartbeat()}sandboxCapabilities(){return this.bridge.sandboxCapabilities||{dispatchable:this.config.sandboxRequired!==!0,enforced:!1,backend:"development_direct",daemonStatus:"development_only",policySchemaVersions:[1],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:!1}}supportedMethods(){return[...Cc,...this.config.deviceConnection?["devices/discover","devices/configure"]:[]]}runtimeTargets(){let t=this.sandboxCapabilities().dispatchable===!0;return typeof this.bridge.targetCapacitySnapshot=="function"?this.bridge.targetCapacitySnapshot(t):Ic(this.config.targets,t)}start(){this.connect()}stop(){this.stopped=!0,this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=null,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.capacityHeartbeatTimer&&clearTimeout(this.capacityHeartbeatTimer),this.capacityHeartbeatTimer=null,this.bridge.onCapacityChanged=null,this.ws?.close()}connect(){if(this.stopped)return;let t=Oc(this.config.orchaUrl),r=new ae(t,{connectTimeoutMs:this.config.connectTimeoutMs});this.ws=r,r.addEventListener("open",()=>{if(this.ws!==r||this.stopped){r.close();return}this.authenticate(r)}),r.addEventListener("message",n=>this.handleMessage(n.data,r)),r.addEventListener("close",()=>this.scheduleReconnect("close",r)),r.addEventListener("error",n=>{g("warn","orcha-client","runtime node websocket error",{error:String(n?.message||n?.type||n)})})}authenticate(t=this.ws){this.send({type:"runtime_node.authenticate",token:this.config.nodeToken,nodeId:this.config.nodeId,nodeName:this.config.nodeName,version:W,protocolVersion:"orcha-runtime-node.v2",defaultTargetCode:this.config.defaultTargetCode,supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()},t)}scheduleReconnect(t,r=this.ws){r&&this.ws!==r||(this.connected=!1,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.capacityHeartbeatTimer&&clearTimeout(this.capacityHeartbeatTimer),this.capacityHeartbeatTimer=null,r&&this.ws===r&&(this.ws=null),!this.stopped&&(this.reconnectTimer||(g("info","orcha-client","runtime node disconnected; reconnect scheduled",{reason:t,reconnectMs:this.config.reconnectMs}),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},this.config.reconnectMs))))}async handleMessage(t,r=this.ws){if(r&&this.ws!==r)return;let n;try{n=JSON.parse(String(t))}catch(s){g("warn","orcha-client","invalid Orcha websocket frame",{error:String(s)});return}if(l(n)){if(n.type==="runtime_node.authenticated"){if(r&&this.ws!==r)return;this.connected=!0,this.startHeartbeat(r),g("info","orcha-client","runtime node authenticated",{nodeId:this.config.nodeId,connectionId:n.connectionId});return}if(n.type==="orcha.runtime.request"){await this.handleRequest(n);return}n.type==="runtime_node.ping"&&this.send({type:"runtime_node.pong",ts:new Date().toISOString(),supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()})}}startHeartbeat(t){this.heartbeatTimer&&clearInterval(this.heartbeatTimer);let r=Math.max(1e3,Number(this.config.heartbeatIntervalMs||15e3)),n=()=>this.sendCapacityHeartbeat(t);n(),this.heartbeatTimer=setInterval(n,r),this.heartbeatTimer.unref?.()}scheduleCapacityHeartbeat(){if(!this.connected||this.capacityHeartbeatTimer)return;let t=Math.max(25,Math.min(1e3,Number(this.config.capacityHeartbeatDebounceMs||100)));this.capacityHeartbeatTimer=setTimeout(()=>{this.capacityHeartbeatTimer=null,this.sendCapacityHeartbeat()},t),this.capacityHeartbeatTimer.unref?.()}sendCapacityHeartbeat(t=this.ws){return this.connected?this.send({type:"runtime_node.heartbeat",ts:new Date().toISOString(),supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()},t):!1}async handleRequest(t){let r=c(t.id),n=c(t.method),s=l(t.params)?t.params:{};try{let i=await this.invoke(n,s,r);this.send({type:"orcha.runtime.response",id:r,ok:!0,result:i})}catch(i){this.send({type:"orcha.runtime.response",id:r,ok:!1,error:{code:i.code||"RUNTIME_NODE_ERROR",message:i.message||String(i),...i.detail===void 0?{}:{detail:i.detail}}})}}async invoke(t,r,n){if(t==="devices/discover"&&this.config.deviceConnection)return this.config.deviceConnection.candidates();if(t==="devices/configure"&&this.config.deviceConnection)return this.config.deviceConnection.configure(r,this.bridge);if(t==="health")return this.bridge.health();if(t==="agents/create")return this.bridge.createAgent(r);if(t==="agents/dispatch")return this.bridge.dispatch(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/prompt")return this.bridge.prompt(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/policy")return this.bridge.updatePolicy(r);if(t==="sessions/cancel")return this.bridge.cancel(r);if(t==="permissions/respond")return this.bridge.respondPermission(r);throw Object.assign(new Error(`unsupported Orcha runtime method: ${t}`),{code:"METHOD_NOT_FOUND"})}sendUpdate(t,r){this.send({type:"orcha.runtime.event",requestId:t,eventType:"runtime.update",payload:r})}send(t,r=this.ws){return!r||r!==this.ws||r.readyState!==gt?!1:(r.send(JSON.stringify(t)),!0)}};import{createServer as Ac}from"node:http";function ue(e,t,r){let n=JSON.stringify(r);e.writeHead(t,{"content-type":"application/json; charset=utf-8","content-length":Buffer.byteLength(n)}),e.end(n)}function ut(e={}){return{ok:!0,...e}}function Er(e,t,r){return{ok:!1,error:{code:e,message:t,...r===void 0?{}:{detail:r}}}}async function fs(e,t){let r=[],n=0;for await(let i of e){if(n+=i.length,n>t)throw Object.assign(new Error("request body too large"),{status:413,code:"REQUEST_TOO_LARGE"});r.push(i)}if(r.length===0)return{};let s=Buffer.concat(r).toString("utf8");if(!s.trim())return{};try{let i=JSON.parse(s);if(!l(i))throw Object.assign(new Error("JSON body must be an object"),{status:400,code:"BAD_JSON"});return i}catch(i){throw i.status?i:Object.assign(new Error(`invalid JSON body: ${i.message}`),{status:400,code:"BAD_JSON"})}}function ps(e,t){if(!t)return;if((e.headers.authorization||"")!==`Bearer ${t}`)throw Object.assign(new Error("runtime bridge token is invalid"),{status:401,code:"UNAUTHORIZED"})}function hs(e,t){let r={"GET /health":async()=>ut(t.health()),"POST /agents/create":async n=>ut(await t.createAgent(n)),"POST /agents/dispatch":async n=>ut(await t.dispatch(n)),"POST /sessions/prompt":async n=>ut(await t.prompt(n)),"POST /sessions/cancel":async n=>ut(await t.cancel(n)),"POST /permissions/respond":async n=>ut(await t.respondPermission(n))};return Ac(async(n,s)=>{let i=new URL(n.url||"/",`http://${n.headers.host||`${e.host}:${e.port}`}`),o=`${n.method||"GET"} ${i.pathname}`,a=r[o];if(!a){ue(s,404,Er("NOT_FOUND",`No route for ${o}`));return}try{ps(n,e.token);let u=n.method==="GET"?{}:await fs(n,e.requestLimitBytes);ue(s,200,await a(u))}catch(u){let d=u.status||500,f=u.code||"BRIDGE_INTERNAL";ue(s,d,Er(f,u.message||String(u),u.detail))}})}var Ss=Pc(import.meta.url),Lc=".orcha-runtime-bridge.pid",kc=".orcha-runtime-bridge.log",vc=3,Dc=36e5,{command:Hc,options:Rs}=Bc(process.argv.slice(2));jc(Rs);ln();var $c=dn();await Os(Hc,$c,Rs);async function Os(e,t,r){if(r.url){let s=Te(r.url);r.pidFile||(process.env.ORCHA_RUNTIME_PID_FILE=s.pidFile),r.logFile||(process.env.ORCHA_RUNTIME_LOG_FILE=s.logFile)}let n=()=>["connect","--url",t.orchaUrl,"--foreground"];switch(e){case"connect":if(r.pairCode&&lt(de(le())))throw new Error("\u8BBE\u5907\u8FDE\u63A5\u4ECD\u5728\u540E\u53F0\u8FD0\u884C\uFF0C\u8BF7\u5148\u6267\u884C stop --url \u540E\u91CD\u65B0\u914D\u5BF9");await Ut(t,r),r.foreground?await Sr(t):Rr(n());return;case"run":case"foreground":r.url&&await Ut(t,r),await Sr(t);return;case"start":if(r.url)return Os("connect",t,r);if(r.foreground){await Sr(t);return}Rr();return;case"reload":case"restart":{r.url&&await Ut(t,{url:r.url});let s=_t(Es(Ss),".."),i=_t(s,...Ar(_t(s,"src","index.js"))?["dist","package"]:[],"openclaw-plugin"),o=await Wr(t.targets,i);await _s({quiet:!0}),await o(),Rr(r.url?n():void 0);return}case"stop":await _s();return;case"status":Fc();return;case"help":case"--help":case"-h":zc();return;default:throw new Error(`Unknown command: ${e}`)}}async function Sr(e){qc();let t=new oe(e);if(await t.start(),e.mode==="server"){let n=hs(e,t);gs({bridge:t,server:n}),n.listen(e.port,e.host,()=>{g("info","runtime-bridge","Orcha runtime bridge HTTP server started",{host:e.host,port:e.port,targets:Object.keys(t.targets)})});return}if(!e.orchaUrl)throw new Error("ORCHA_RUNTIME_ORCHA_URL is required in runtime node mode");let r=new ce(e,t);gs({bridge:t,client:r}),r.start(),g("info","runtime-bridge","Orcha runtime node started",{nodeId:e.nodeId,nodeName:e.nodeName,orchaUrl:e.orchaUrl,targets:Object.keys(t.targets)})}function gs({bridge:e,client:t,server:r}){let n=!1,s=i=>{if(n)return;n=!0;let o=Number(e?.sessions?.size||0)>0;g("info","runtime-bridge","runtime bridge shutting down",{signal:i});try{t?.stop?.()}catch(a){g("warn","runtime-bridge","runtime client stop failed",{error:String(a)})}Promise.resolve(e?.stop?.(`process_${String(i||"shutdown").toLowerCase()}`)).catch(a=>{g("warn","runtime-bridge","runtime bridge stop failed",{error:String(a)})}).finally(()=>{try{r?.close?.()}catch(a){g("warn","runtime-bridge","runtime server close failed",{error:String(a)})}}),setTimeout(()=>process.exit(0),o?8500:200)};process.once("SIGTERM",()=>s("SIGTERM")),process.once("SIGINT",()=>s("SIGINT"))}function Rr(e=["run"]){let t=le(),r=Is(),n=de(t);if(n&&lt(n)){console.log(JSON.stringify({status:"already_running",pid:n,pidFile:t,logFile:r}));return}n&&Cr(t),ws(t),ws(r),Ir(r);let s=Mc(r,"a"),i={...process.env,ORCHA_RUNTIME_PID_FILE:t,ORCHA_RUNTIME_LOG_FILE:r},o=xc(process.execPath,[Ss,...e,"--pid-file",t,"--log-file",r],{cwd:process.cwd(),detached:!0,env:i,stdio:["ignore",s,s]});o.unref(),Nc(s),Ts(t,`${o.pid}
-`),console.log(JSON.stringify({status:"started",pid:o.pid,pidFile:t,logFile:r}))}async function _s({quiet:e=!1}={}){let t=le(),r=de(t);if(!r){e||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!lt(r)){Cr(t),e||console.log(JSON.stringify({status:"not_running",pid:r,pidFile:t}));return}process.kill(r,"SIGTERM"),!await ys(r,1e4)&&lt(r)&&(process.kill(r,"SIGKILL"),await ys(r,3e3)),Cr(t),e||console.log(JSON.stringify({status:"stopped",pid:r,pidFile:t}))}function Fc(){let e=le(),t=Is(),r=de(e),n=!!(r&&lt(r));console.log(JSON.stringify({status:n?"running":"not_running",running:n,pid:n?r:null,pidFile:e,logFile:t}))}function Bc(e){let t=[],r={};for(let s=0;s<e.length;s+=1){let i=e[s];i==="--url"?r.url=e[++s]:i==="--pair-code"?r.pairCode=e[++s]:i==="--daemon"?r.daemon=!0:i==="--foreground"?r.foreground=!0:i==="--env-file"?r.envFile=e[++s]:i==="--pid-file"?r.pidFile=e[++s]:i==="--log-file"?r.logFile=e[++s]:t.push(i)}return{command:t[0]||"run",options:r}}function jc(e){e.envFile&&(process.env.ORCHA_RUNTIME_ENV_FILE=e.envFile),e.pidFile&&(process.env.ORCHA_RUNTIME_PID_FILE=e.pidFile),e.logFile&&(process.env.ORCHA_RUNTIME_LOG_FILE=e.logFile)}function le(){return _t(process.cwd(),process.env.ORCHA_RUNTIME_PID_FILE||Lc)}function Is(){return _t(process.cwd(),process.env.ORCHA_RUNTIME_LOG_FILE||kc)}function qc(){let e=process.env.ORCHA_RUNTIME_LOG_FILE;if(!e)return;let t=Cs();if(t<=0)return;let r=_t(process.cwd(),e);Ir(r,t);let n=Kc();n<=0||setInterval(()=>Ir(r,t),n).unref()}function Ir(e,t=Cs()){if(t<=0||!Ar(e))return;let r=0,n="";try{if(r=ms(e).size,r<=0)return;n=Or(e,"utf8")}catch(d){g("warn","runtime-bridge","runtime log cleanup skipped",{logFile:e,error:String(d)});return}let s=Date.now()-t*24*60*60*1e3,i=n.split(/\r?\n/),o=[],a=0;for(let d of i)d&&(Gc(d,s)?o.push(d):a+=1);if(a===0)return;let u="";try{ms(e).size>r&&(u=Or(e,"utf8").slice(n.length));let f=[...o,...u.split(/\r?\n/).filter(Boolean)].join(`
-`);Ts(e,f?`${f}
-`:""),g("info","runtime-bridge","runtime log cleanup completed",{logFile:e,retentionDays:t,removed:a})}catch(d){g("warn","runtime-bridge","runtime log cleanup failed",{logFile:e,error:String(d)})}}function Gc(e,t){try{let r=JSON.parse(e);if(!r||typeof r!="object")return!0;let n=typeof r.ts=="string"?Date.parse(r.ts):Number.NaN;return!Number.isFinite(n)||n>=t}catch{return!0}}function Cs(){return As(process.env.ORCHA_RUNTIME_LOG_RETENTION_DAYS,vc)}function Kc(){return As(process.env.ORCHA_RUNTIME_LOG_CLEANUP_INTERVAL_MS,Dc)}function As(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function de(e){if(!Ar(e))return null;let t=Number.parseInt(Or(e,"utf8").trim(),10);return Number.isInteger(t)&&t>0?t:null}function lt(e){if(!Number.isInteger(e)||e<=0)return!1;try{return process.kill(e,0),!0}catch(t){return t?.code==="EPERM"}}async function ys(e,t){let r=Date.now();for(;Date.now()-r<t;){if(!lt(e))return!0;await new Promise(n=>setTimeout(n,100))}return!lt(e)}function ws(e){bc(Es(e),{recursive:!0})}function Cr(e){try{Uc(e,{force:!0})}catch{}}function zc(){console.log(`Usage: orcha-runtime-bridge [command] [options]
+${c.text}`:c.text):c?.type==="tool_use"&&c.id&&(o(),i.push({sessionUpdate:"tool_call",toolCallId:c.id,title:c.name,status:"in_progress",rawInput:c.input}));return i}var ct=Object.freeze({codex:{label:"Codex",code:"CODEX",sessionDirectory:"codex-sessions",home:e=>e.env?.CODEX_HOME||process.env.CODEX_HOME||at(He(),".codex"),threadId:e=>e?.type==="thread.started"?e.thread_id:void 0,resumeArgs(e,t){let r=e.indexOf("exec");if(r<0||e.includes("resume")||e.includes("--ephemeral"))throw W("BAD_REQUEST","Codex \u539F\u751F\u4F1A\u8BDD\u9700\u8981\u6807\u51C6 codex exec \u914D\u7F6E");return t?[...e.slice(0,r+1),"resume",t,...e.slice(r+1)]:e},mcpArgs:e=>["-c",`mcp_servers.orcha={url=${JSON.stringify(e)},bearer_token_env_var=${JSON.stringify(Fe)},required=true}`]},claude:{label:"Claude Code",code:"CLAUDE",sessionDirectory:"claude-sessions",home:e=>e.env?.CLAUDE_CONFIG_DIR||process.env.CLAUDE_CONFIG_DIR||at(He(),".claude"),threadId:e=>e?.type==="system"&&e.subtype==="init"?e.session_id:void 0,resumeArgs(e,t){let r=e.indexOf("--output-format");if(!e.includes("-p")&&!e.includes("--print")||r<0||e[r+1]!=="stream-json"||!e.includes("--verbose")||e.some(n=>wo.has(n)))throw W("BAD_REQUEST","Claude Code \u539F\u751F\u4F1A\u8BDD\u9700\u8981\u6807\u51C6 claude -p --output-format stream-json --verbose \u914D\u7F6E");return t?[...e,"--resume",t]:e},mcpArgs:e=>["--mcp-config",JSON.stringify({mcpServers:{orcha:{type:"http",url:e,headers:{Authorization:`Bearer \${${Fe}}`}}}}),"--allowedTools","mcp__orcha","--permission-prompt-tool",`mcp__orcha__${$e}`],approvalTool:bn,taskMcpError(e){if(e?.type!=="system"||e.subtype!=="init")return null;let t=e.mcp_servers?.find(r=>r?.name==="orcha")?.status||"missing";return t==="connected"?null:W("RUNTIME_CLAUDE_MCP_UNAVAILABLE",`Claude Code \u672A\u80FD\u8FDE\u63A5 OrchaAI \u4EFB\u52A1\u5DE5\u5177\uFF08${t}\uFF09\uFF0C\u672C\u8F6E\u672A\u6267\u884C`)},progress:So}});async function Dn(e,t,r,n){let s=await sn(t,[...r?[xn(r)]:[],...e.approvalTool&&n?[e.approvalTool(n)]:[]]);return{args:e.mcpArgs(s.url),environment:{[Fe]:s.token},refresh:i=>s.refresh(i),close:()=>s.close()}}var Yt=class{constructor(t,r,n=at(He(),".orcha",ct[t].sessionDirectory)){this.adapter=ct[t],this.directory=at(n,kn(r))}async turn(t,r,n,s,i){let{label:o,code:a}=this.adapter;if(!t)throw W("BAD_REQUEST",`${o} native turn requires a run ID`);Pn(this.directory,{recursive:!0,mode:448});let c=at(this.directory,"active");try{Pn(c,{mode:448})}catch(f){throw f.code==="EEXIST"?W("RUNTIME_SESSION_BUSY",`${o} \u4EFB\u52A1\u4ECD\u5728\u8FD0\u884C\u6216\u4E0A\u8F6E\u5F02\u5E38\u4E2D\u65AD\uFF1B\u8BF7\u7B49\u5F85\u5B8C\u6210\uFF0C\u6216\u53D1\u9001 /new \u5F00\u59CB\u65B0\u4EFB\u52A1`):f}let l=at(this.directory,"session.json"),p,m=()=>{let f=`${l}.${go()}.pending`;Ln(f,JSON.stringify(p),{mode:384}),yo(f,l)};try{try{p=JSON.parse(_o(l,"utf8"))}catch(T){if(T.code!=="ENOENT")throw T}if(p&&!vn.test(p.threadId||""))throw W("RUNTIME_OPERATION_NOT_FOUND",`${o} \u4E0A\u8F6E\u672A\u80FD\u4FDD\u5B58\u539F\u751F\u4F1A\u8BDD\u6807\u8BC6\uFF0C\u8BF7\u53D1\u9001 /new`);try{Ln(at(this.directory,`${kn(t)}.run`),"",{flag:"wx",mode:384})}catch(T){throw T.code==="EEXIST"?W("RUNTIME_OPERATION_NOT_FOUND",`\u6B64\u8F6E ${o} \u5DF2\u6267\u884C\u6216\u6267\u884C\u7ED3\u679C\u4E0D\u786E\u5B9A\uFF0C\u4E0D\u80FD\u91CD\u590D\u53D1\u9001`):T}p||={threadId:null},m();let f,h=T=>{if(f)return;let x=T.update?.sessionUpdate==="runtime_event"?this.adapter.threadId(T.update.event):void 0;if(x!==void 0)try{if(!vn.test(x||"")||p.threadId&&p.threadId!==x)throw W(`${a}_SESSION_MISMATCH`,`${o} \u8FD4\u56DE\u4E86\u4E0D\u540C\u7684\u539F\u751F\u4F1A\u8BDD\uFF0C\u8BF7\u53D1\u9001 /new`);p.threadId=x,m()}catch(g){f=g,i();return}n(T)},y=await r(p.threadId,h,T=>{!f&&p.threadId&&s?.(T)});if(f)throw f;if(!p.threadId)throw W(`${a}_SESSION_MISSING`,`${o} \u6CA1\u6709\u8FD4\u56DE\u539F\u751F\u4F1A\u8BDD\u6807\u8BC6\uFF0C\u8BF7\u68C0\u67E5 CLI \u7248\u672C\u5E76\u53D1\u9001 /new`);return y}finally{To(c,{recursive:!0})}}};var Jn=5e3,bo=2*60*1e3,Mo=2*60*1e3,Uo=12,Po=1e3,Lo=1500,ko=1e3,vo=/^(?:task|session)-[1-9]\d*(?::[1-9]\d*){4}(?![\s\S])/,Qt=24*60*60*1e3,Mt=new Set(["final_answer","final","complete","completed","done"]),Do=new Set(["function_call","function_call_output","custom_tool_call","custom_tool_call_output","local_shell_call","local_shell_call_output","mcp_tool_call","mcp_tool_call_output","web_search_call","image_generation_call","image_generation_end"]),$o=new Set(["context_compacted","context_compaction","context_compressed"]);function te(e,t){if(e?.pid){if(process.platform==="win32"){let r=["/PID",String(e.pid),"/T"];t==="SIGKILL"&&r.push("/F");try{qn("taskkill",r,{stdio:"ignore",windowsHide:!0}).unref?.()}catch{try{e.kill(t)}catch{}}return}try{process.kill(-e.pid,t)}catch(r){if(r?.code==="ESRCH")return;try{e.kill(t)}catch{}}}}function _t(e){te(e,"SIGTERM");let t=setTimeout(()=>te(e,"SIGKILL"),Jn);return t.unref?.(),t}function B(e){if(typeof e=="string")return e;if(Array.isArray(e))return e.map(t=>B(t)).join("");if(!d(e))return"";for(let t of["text","delta","output_text","content","message","output"]){let r=B(e[t]);if(r)return r}return""}function Wn(e){if(!d(e))return"";let t=d(e.payload)?e.payload:{};if(u(e.type)==="event_msg"){if(u(t.type)==="agent_message")return u(t.message);if(u(t.type)==="task_complete")return u(t.last_agent_message)}if(u(e.type)==="response_item"&&u(t.type)==="message"&&u(t.role)==="assistant")return B(t.content)||B(t.message);if(u(e.type)==="result")return B(e.result);let r=B(e.delta)||B(e.text)||B(e.content);if(r)return r;let n=d(e.item)?e.item:{};return["message","agent_message"].includes(u(n.type))||u(n.role)==="assistant"?B(n.content)||B(n.text)||B(n.message):""}function Xn(e,t){e.explicitFileDelivery||Vt(e.artifacts,Pe(t,{source:"codex_cli_image_generation",...e.artifactOptions}))}function Yn(e){return nt(Le(e))}function Ke(e){if(!d(e))return!1;let t=d(e.payload)?e.payload:{},r=u(e.type),n=u(t.type);if(r==="event_msg"&&n==="task_complete")return!0;let s=u(t.phase||t.status||t.stage).toLowerCase();if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&u(t.role)==="assistant")return Mt.has(s);let i=d(e.item)?e.item:{};return r==="item.completed"&&u(i.type)==="agent_message"?!0:r==="result"&&e.is_error!==!0?u(e.result).length>0:!1}function ee(e){let t=u(e.terminalProtocol||e.eventProtocol).toLowerCase();if(t)return t;let r=Ge(u(e.command)).replace(/\.exe$/i,"").toLowerCase();return r==="codex"||r==="claude"?r:""}function Hn(e,t,r){let n=d(t.error)?t.error:{},s=u(n.message)||B(t.error)||u(t.result)||u(t.message)||r;return Object.assign(new Error(s),{code:e})}function Ho(e,t){if(!d(e))return null;let r=u(e.type).toLowerCase();if(t==="codex")return r==="turn.completed"?{status:"completed",result:{stopReason:"end_turn"}}:r==="turn.failed"?{status:"failed",error:Hn("RUNTIME_CODEX_TURN_FAILED",e,"Codex turn failed")}:null;if(t==="claude"&&r==="result"){let n=u(e.subtype).toLowerCase();return e.is_error===!0||n.startsWith("error")||["failed","failure"].includes(n)?{status:"failed",error:Hn("RUNTIME_CLAUDE_RESULT_FAILED",e,"Claude result failed")}:{status:"completed",result:{stopReason:"end_turn",...u(e.result)?{output:u(e.result)}:{}}}}return null}function Fn(e){return d(e)?u(e.phase||e.status||e.stage).toLowerCase():""}function Fo(e){if(!d(e)||Ke(e))return!1;let t=d(e.payload)?e.payload:{},r=u(e.type),n=u(t.type),s=Fn(t);if(r==="event_msg"&&n==="agent_message"||r==="response_item"&&n==="message"&&u(t.role)==="assistant")return!!(s&&!Mt.has(s));let i=d(e.item)?e.item:{},o=Fn(i);return u(i.role)==="assistant"||u(i.type)==="message"?!!(o&&!Mt.has(o)):!1}function Bo(e,t,r){return r.captureLastMessage===!1||t.includes("--output-last-message")||t.includes("-o")?!1:r.captureLastMessage===!0?!0:Ge(e)==="codex"}function jo(e,t){return t.collectCodexTranscriptArtifacts===!1?!1:t.collectCodexTranscriptArtifacts===!0?!0:Ge(e)==="codex"}function Qn(e){return Math.max(20,R(e.codexTranscriptPollMs||e.transcriptPollMs,Po))}function qo(e){return Math.max(0,R(e.codexFinalOutputWaitMs||e.finalOutputWaitMs,Lo))}function re(e){if(typeof e=="boolean")return e;let t=u(e).toLowerCase();return["true","1","yes","y","on"].includes(t)?!0:["false","0","no","n","off"].includes(t)?!1:null}function ze(e){let t=d(e?.metadata)?e.metadata:{};return d(t._runtimeBridge)?t._runtimeBridge:{}}function Be(e){return u(ze(e).promptKind).toLowerCase()}function Go(e,t){for(let r of[e.codexTranscriptStreaming,e.streamCodexTranscript]){let n=re(r);if(n!=null)return n}return Be(t)==="chat"}function Ve(e,t){let r=ze(e);for(let s of[r.emitThoughtChunks,r.streamThoughts]){let i=re(s);if(i!=null)return i}let n=Be(e);if(n&&n!=="chat")return!1;for(let s of[t.emitThoughtChunks,t.streamThoughts]){let i=re(s);if(i!=null)return i}return Be(e)==="chat"}function Ko(e){let t=ze(e);for(let r of[t.finalTextOnly,t.finalOutputOnly]){let n=re(r);if(n!=null)return n}return null}function zo(e,t){let r=Ko(e);return r??(t.finalTextOnly===!0||t.finalOutputOnly===!0?!0:(t.finalTextOnly===!1||t.finalOutputOnly===!1,!1))}function Vo(e,t){return!e.finalTextOnly||t}function Zn(e,t,r,n,s=n){return!n||e.emittedTexts.has(s)?!1:(e.emittedTexts.add(s),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}}),!0)}function ts(e,t,r,n){return!n||e.emittedThoughtTexts.has(n)?!1:(e.emittedThoughtTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_thought_chunk",content:{type:"text",text:n}}}),!0)}function Jo(e,t,r,n=new Set){return{target:e,promptText:t,startedAtMs:r,baselinePaths:n,matchedPath:"",disabled:!1,processedLines:new Map}}function Je(e,t){let r=d(e.env)?e.env:{},n=u(e.artifactRoot||e.artifactDir||e.runtimeArtifactRoot||r.ORCHA_RUNTIME_ARTIFACT_DIR)||j(Vn(),"orcha-runtime-artifacts"),s=u(t).replace(/[^A-Za-z0-9._-]+/g,"-").slice(0,80)||gt(),i=j(n,s),o=j(i,gt());return Ro(o,{recursive:!0}),{root:o,realRoot:Ut(o),sessionRoot:i,realSessionRoot:Ut(i)}}function Wo(e){let t=u(e?.artifactDirectory);if(!t)throw new Error("sandbox launch did not provide an artifact directory");return{root:t,realRoot:Ut(t),sessionRoot:"",realSessionRoot:""}}function es(e){return u(d(e)?e.root:e)}function Bn(e){let t=es(e),r=u(d(e)?e.sessionRoot:No(t)),n=u(d(e)?e.realSessionRoot:"");if(r)try{if(n&&Ut(r)!==n)return;Io(r)}catch{}}function We(e,t={}){let r=es(e),n=u(d(e)?e.realRoot:"");if(r){try{if(n&&Ut(r)!==n){_("warn","runtime.cli","runtime artifact directory cleanup skipped; path changed",{...t,artifactRoot:r});return}}catch{Bn(e);return}try{Oo(r,{recursive:!0,force:!0})}catch(s){_("warn","runtime.cli","runtime artifact directory cleanup failed",{...t,artifactRoot:r,error:String(s?.message||s)});return}Bn(e)}}function Xe(e,t,r=null){return{trustedFileRoots:[t,u(r?.artifactDirectory),u(r?.homeDirectory),...U(e.trustedArtifactRoots),...U(e.trustedFileRoots),...U(e.artifactRoots),...U(e.artifactFileRoots)].filter(Boolean),pathMappings:Array.isArray(r?.pathMappings)?r.pathMappings:[]}}function Ye(e){let t=u(e.codexSessionsRoot||e.codexSessionRoot);if(t)return t;let r=d(e.env)?e.env:{},n=u(e.codexHome||r.CODEX_HOME||process.env.CODEX_HOME)||j(Ao(),".codex");return j(n,"sessions")}function Xo(e,t){let r=new Date(t),n=String(r.getFullYear()),s=String(r.getMonth()+1).padStart(2,"0"),i=String(r.getDate()).padStart(2,"0");return j(e,n,s,i)}function rs(e,t,r){let n=new Set;for(let s of[t-Qt,t,t+Qt,r-Qt,r,r+Qt])n.add(Xo(e,s));return[...n].filter(s=>Gn(s))}function Yo(e,t,r){let n=Ye(e),s=t-bo,i=r+Mo,o=[];for(let a of rs(n,t,r)){let c=[];try{c=Kn(a)}catch{continue}for(let l of c){if(!l.endsWith(".jsonl"))continue;let p=j(a,l);try{let m=Co(p);if(!m.isFile()||m.mtimeMs<s||m.mtimeMs>i)continue;o.push({path:p,mtimeMs:m.mtimeMs})}catch{}}}return o.sort((a,c)=>c.mtimeMs-a.mtimeMs).slice(0,Uo)}function Qo(e,t,r=t){let n=Ye(e),s=new Set;for(let i of rs(n,t,r)){let o=[];try{o=Kn(i)}catch{continue}for(let a of o)a.endsWith(".jsonl")&&s.add(j(i,a))}return s}function je(e,t,r=0){if(!(r>8||e===null||e===void 0)){if(typeof e=="string"){e&&t.push(e);return}if(Array.isArray(e)){for(let n of e)je(n,t,r+1);return}if(d(e))for(let n of["payload","item","text","delta","output_text","content","message","output","input","prompt","last_agent_message","revised_prompt"])n in e&&je(e[n],t,r+1)}}function ns(e){return u(e).replace(/\s+/g," ")}function Zo(e){let t=ns(e);if(!t)return[];if(t.length<=200)return[t];let r=160,n=[0,Math.floor((t.length-r)/2),t.length-r],s=new Set,i=[];for(let o of n){let a=t.slice(Math.max(0,o),Math.max(0,o)+r).trim();a.length>=40&&!s.has(a)&&(s.add(a),i.push(a))}return i}function ta(e,t){let r=Zo(t);if(!r.length)return!1;let n=[];for(let i of e)je(i,n);let s=ns(n.join(" "));return r.every(i=>s.includes(i))}function ea(e){return e.find(t=>d(t)&&u(t.type)==="session_meta"&&d(t.payload))||null}function ra(e){let t=d(e?.payload)?e.payload:{},r=u(e?.timestamp||t.timestamp),n=Date.parse(r);return Number.isFinite(n)?n:Number.NaN}function na(e){let t=u(e.originator),r=u(e.source);if(t!=="codex_exec"&&r!=="exec"||u(e.parent_thread_id))return!1;let n=u(e.thread_source);if(n&&n!=="user")return!1;let s=u(e.session_id),i=u(e.id);return!(s&&i&&s!==i)}function sa(e,t,r){if(!ta(e,t.promptText))return!1;let n=ea(e);if(!n)return!1;let s=n.payload;if(!na(s))return!1;let i=ra(n);if(!Number.isFinite(i)||i<t.startedAtMs-5e3||i>r+5e3)return!1;let o=u(t.target.cwd),a=u(s.cwd);return!(o&&a&&$n(o)!==$n(a))}function jn(e){try{return oa(zn(e,"utf8"))}catch{return null}}function ia(e,t,r){if(!e||e.disabled)return null;if(e.matchedPath){let s=jn(e.matchedPath);return s?{path:e.matchedPath,events:s}:null}let n=[];for(let s of Yo(e.target,e.startedAtMs,r)){if(e.baselinePaths.has(s.path))continue;let i=jn(s.path);!i||!sa(i,e,r)||n.push({path:s.path,events:i})}return n.length!==1?(n.length>1&&(e.disabled=!0,_("warn","runtime.cli","codex transcript fallback disabled; multiple matching transcripts",{target:e.target.targetCode,sessionId:t,transcriptCount:n.length})),null):(e.matchedPath=n[0].path,_("info","runtime.cli","codex transcript stream attached",{target:e.target.targetCode,sessionId:t}),n[0])}function oa(e){let t=[];for(let r of e.split(/\r?\n/)){let n=r.trim();if(n)try{t.push(JSON.parse(n))}catch{}}return t}function aa(e){if(!d(e))return!1;let t=d(e.payload)?e.payload:{},r=u(e.type),n=u(t.type);return r==="event_msg"&&n==="image_generation_end"||r==="response_item"&&n==="image_generation_call"}function ca(e){if(!d(e))return!1;let t=d(e.payload)?e.payload:{};return u(e.type)==="response_item"&&Do.has(u(t.type))}function ua(e){if(!d(e))return!1;let t=d(e.payload)?e.payload:{};return $o.has(u(t.type))}function la(e,t,r,n){let s=Wn(e),i=Ke(e),o=0,a=0,c=0;if(s&&!i&&t.emitThoughtChunks&&ts(t,r,n,s)&&(c=1),s&&i){let l=t.emittedTexts.size?`
+${s}`:s;Zn(t,r,n,l,s)&&(o=1,a=1)}return s&&i&&(t.finalTextSeen=!0),Xn(t,e),(aa(e)||ca(e)||ua(e)||i)&&n({sessionId:r,update:{sessionUpdate:"runtime_event",event:Yn(e)}}),{textCount:o,finalTextCount:a,thoughtCount:c}}function qe(e,t,r,n,s=Date.now()){if(!t)return{artifactCount:0,transcriptCount:0,textCount:0,finalTextCount:0,thoughtCount:0};let i=e.artifacts.size,o=0,a=0,c=0,l=0,p=ia(t,r,s);if(p){let m=Math.min(t.processedLines.get(p.path)||0,p.events.length),f=e.artifacts.size;for(let h of p.events.slice(m)){let y=la(h,e,r,n);a+=y.textCount,c+=y.finalTextCount,l+=y.thoughtCount}t.processedLines.set(p.path,p.events.length),(p.events.length>m||e.artifacts.size>f)&&(o=1)}return{artifactCount:e.artifacts.size-i,transcriptCount:o,textCount:a,finalTextCount:c,thoughtCount:l}}function da(e,{remove:t=!0}={}){if(!e||!Gn(e))return"";try{return zn(e,"utf8").trim()}catch{return""}finally{t&&Zt(e)}}function Zt(e){if(e)try{xo(e)}catch{}}function pa(e,t){return{artifactCount:(e?.artifactCount||0)+(t?.artifactCount||0),transcriptCount:(e?.transcriptCount||0)+(t?.transcriptCount||0),textCount:(e?.textCount||0)+(t?.textCount||0),finalTextCount:(e?.finalTextCount||0)+(t?.finalTextCount||0),thoughtCount:(e?.thoughtCount||0)+(t?.thoughtCount||0)}}function fa(e){return new Promise(t=>setTimeout(t,e))}function ma(e,t,r,n){return n?(e.finalTextSeen=!0,e.emittedTexts.has(n)||(e.emittedTexts.add(n),r({sessionId:t,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:n}}})),!0):!1}async function ha(e,t,r,n,s,i){let o=qe(e,t,r,n,Date.now()),a=()=>ma(e,r,n,da(s,{remove:!1}));if(a()||e.finalTextSeen)return Zt(s),o;let c=qo(i);if(c<=0||!t&&!s)return Zt(s),o;let l=Date.now()+c,p=Math.min(Qn(i),100);for(;!e.finalTextSeen&&Date.now()<l&&(await fa(Math.min(p,Math.max(0,l-Date.now()))),o=pa(o,qe(e,t,r,n,Date.now())),!a()););return Zt(s),o}var yt=class{constructor(t,r,n={},s={}){this.agent=t,this.target=r,this.options=n,this.callbacks=s,this.active=new Map;let i=ee(r);if(this.adapter=Object.hasOwn(ct,i)?ct[i]:null,n.source==="ai_chat_runtime_node"&&this.adapter){let{label:o}=this.adapter;if(typeof n.cloudSessionId!="string"||!vo.test(n.cloudSessionId))throw Object.assign(new Error(`${o} \u539F\u751F\u4F1A\u8BDD\u6807\u8BC6\u65E0\u6548\uFF1A\u9700\u8981\u5B8C\u6574\u7684\u4EFB\u52A1\u6216\u4F1A\u8BDD\u9694\u79BB\u6807\u8BC6`),{code:"BAD_REQUEST"});if(!n.orchaUrl)throw Object.assign(new Error(`${o} \u539F\u751F\u4F1A\u8BDD\u7F3A\u5C11 OrchaAI \u670D\u52A1\u5730\u5740\uFF0C\u8BF7\u91CD\u65B0\u8FDE\u63A5\u8BBE\u5907`),{code:"BAD_REQUEST"});if(n.prepareLaunch)throw Object.assign(new Error(`${o} \u539F\u751F\u4F1A\u8BDD\u4E0D\u652F\u6301\u6C99\u7BB1\u542F\u52A8\uFF0C\u8BF7\u4F7F\u7528\u5DF2\u63A5\u5165\u7684\u672C\u673A\u8BBE\u5907`),{code:"BAD_REQUEST"});this.nativeSession=new Yt(i,[n.orchaUrl,t.agentId,t.targetCode,n.cloudSessionId,J(r,t.workspace),r.command,this.adapter.home(r)])}}async sessionNew(t={}){let r=t.mcpServers||[];if(r.length&&(t.metadata?.source==="conversation_delegation"||this.nativeSession)&&this.adapter){if(this.options.prepareLaunch)throw Object.assign(new Error(`${this.adapter.label} task MCP requires a reachable node-local transport; this sandbox launcher does not provide one`),{code:"unsupported_dynamic_mcp"});this.explicitFileDelivery=!0,this.taskMcp=await Dn(this.adapter,r,()=>({cwd:this.deliveryCwd,roots:[...this.deliveryRoots||[],...this.deliveryThreadId?[j(Ye(this.target),"..","generated_images",this.deliveryThreadId)]:[]]}),(n,s)=>this.requestApproval(n,s))}else if(r.length&&t.metadata?.source==="conversation_delegation")throw Object.assign(new Error("This CLI adapter does not support task-scoped MCP"),{code:"unsupported_dynamic_mcp"});return{sessionId:`cli-${this.agent.agentId}-${gt()}`}}async requestApproval(t,{signal:r,maxTimeoutMs:n}={}){let s=this.approvalTurn;return!s||!this.callbacks.onPermissionRequest?{outcome:"denied",reason:"no active OrchaAI turn"}:this.callbacks.onPermissionRequest({agent:this.agent,runtimeSessionId:s.sessionId,request:t,emitUpdate:s.emitUpdate,maxTimeoutMs:n,signal:r?AbortSignal.any([s.ended.signal,r]):s.ended.signal})}async refreshMcpServers(t){if(!this.taskMcp)throw Object.assign(new Error("The original Codex MCP binding is unavailable"),{code:"RUNTIME_OPERATION_NOT_FOUND"});await this.taskMcp.refresh(t)}async sessionPrompt(t,r,n){return this.nativeSession?this.nativeSession.turn(this.options.runId,(s,i,o)=>this.runPrompt(t,i,o,s),s=>{let i=s.update?.event;i?.type==="thread.started"&&(this.deliveryThreadId=i.thread_id),r(s)},n,()=>this.sessionCancel(t)):this.runPrompt(t,r,n)}async runPrompt(t,r,n,s){let i=Date.now(),o=u(this.target.command);if(!o)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);let a=u(t.sessionId)||gt(),c=mt(t.prompt),l=u(this.target.promptMode||"stdin"),p=this.buildArgs(l,c),m=[...this.taskMcp?.args||[],...this.nativeSession?this.adapter.resumeArgs(p,s):p],f=J(this.target,this.agent.workspace),h=typeof this.options.prepareLaunch=="function",T=Bo(o,m,this.target)?h?`/tmp/orcha-runtime-last-message-${gt()}.txt`:j(Vn(),`orcha-runtime-last-message-${gt()}.txt`):"";T&&m.push("--output-last-message",T);let x={...d(this.target.env)?this.target.env:{},...this.taskMcp?.environment||{},...l==="env"?{ORCHA_RUNTIME_PROMPT:c}:{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:a},g=h?await this.options.prepareLaunch({command:o,args:m,cwd:f,environment:x}):{command:o,args:m,cwd:f,environment:{...process.env,...x},cleanup:async()=>{}},E=h?Wo(g):Je(this.target,a),w=E.root,O=Xe(this.target,w,g);this.deliveryCwd=f,this.deliveryRoots=[f,...O.trustedFileRoots].filter(Boolean),this.deliveryThreadId=s||null;let M=jo(o,this.target),N={...this.target,targetCode:this.agent.targetCode,cwd:f,...h?{codexHome:j(g.homeDirectory,".codex")}:{}},S=M?Qo(N,i):new Set,I=h&&T?j(g.tempDirectory,T.slice(5)):T,C=R(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,R(this.options.sessionPromptTimeoutMs,z));h||(g.environment.ORCHA_RUNTIME_ARTIFACT_DIR=w);let $={sessionId:a,emitUpdate:r,ended:new AbortController};this.approvalTurn=$;let P=qn(g.command,g.args,{cwd:g.cwd,env:g.environment,stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(a,P),_("info","runtime.cli","runtime prompt started",{target:this.agent.targetCode,sessionId:a,pid:P.pid,timeoutMs:C,isolation:g.isolation});let Fr="",ye=u(this.target.outputMode||"text"),k={explicitFileDelivery:this.explicitFileDelivery,artifacts:new Map,emittedTexts:new Set,emittedThoughtTexts:new Set,value:"",artifactOptions:O,finalTextSeen:!1,finalTextOnly:zo(t,this.target),emitThoughtChunks:Ve(t,this.target),terminalOutcome:null,terminalProtocol:ee(this.target),emitTerminal:null,progress:{}},Te=M?Jo(N,c,i,S):null;return P.stdout.setEncoding("utf8"),P.stdout.on("data",ft=>this.handleStdout(ft,ye,k,a,r)),P.stderr.setEncoding("utf8"),P.stderr.on("data",ft=>{Fr+=ft,this.target.emitStderr===!0&&r({sessionId:a,update:{sessionUpdate:"runtime_stderr_chunk",content:{type:"text",text:ft}}})}),l==="stdin"?P.stdin.end(c):P.stdin.end(),await new Promise((ft,we)=>{let Ot=!1,Br=!1,$t=null,It=null,Ee=Te&&Go(this.target,t)?setInterval(()=>{try{qe(k,Te,a,r)}catch(b){_("warn","runtime.cli","codex transcript stream poll failed",{target:this.agent.targetCode,sessionId:a,error:String(b?.message||b)})}},Qn(this.target)):null;Ee?.unref?.();let jr=setTimeout(()=>{Br=!0,_("warn","runtime.cli","runtime prompt timed out; terminating child",{target:this.agent.targetCode,sessionId:a,pid:P.pid,timeoutMs:C}),te(P,"SIGTERM"),$t=setTimeout(()=>{_("warn","runtime.cli","runtime prompt force killing child",{target:this.agent.targetCode,sessionId:a,pid:P.pid}),te(P,"SIGKILL")},Jn),$t.unref?.(),Ct(Object.assign(new Error(`runtime CLI timed out after ${C}ms`),{code:"RUNTIME_CLI_TIMEOUT"}))},C);jr.unref?.();let qr=async()=>{clearTimeout(jr),It&&clearTimeout(It),Ee&&clearInterval(Ee),$t&&!Br&&clearTimeout($t),$.ended.abort(),this.approvalTurn===$&&(this.approvalTurn=null),We(E,{target:this.agent.targetCode,sessionId:a}),this.active.delete(a),k.emitTerminal=null,await g.cleanup?.()},Vs=b=>{Ot||(Ot=!0,qr().then(()=>ft(b),we))},Ct=b=>{Ot||(Ot=!0,qr().then(()=>we(b),G=>{_("warn","runtime.cli","sandbox launch cleanup failed",{target:this.agent.targetCode,sessionId:a,error:String(G?.message||G)}),we(b)}))};k.emitTerminal=b=>{let G={...d(b.result)?b.result:{},_artifacts:[...k.artifacts.values()]};try{n?.({...b,result:G})}catch(rt){_("warn","runtime.cli","runtime terminal listener failed",{target:this.agent.targetCode,sessionId:a,error:String(rt?.message||rt)})}let q=Math.max(0,R(this.target.terminalExitGraceMs,ko));It=setTimeout(()=>{It=null,!(Ot||this.active.get(a)!==P)&&(_("warn","runtime.cli","runtime stayed alive after terminal event; terminating child",{target:this.agent.targetCode,sessionId:a,pid:P.pid,terminalProtocol:k.terminalProtocol,graceMs:q}),_t(P))},q),It.unref?.()},P.on("error",b=>{_("warn","runtime.cli","runtime child error",{target:this.agent.targetCode,sessionId:a,pid:P.pid,error:String(b?.message||b)}),Ct(b)}),P.on("exit",(b,G)=>{(async()=>{ye==="json-lines"&&k.value.trim()&&this.handleStdout(`
+`,ye,k,a,r);let q=await ha(k,Te,a,r,I,this.target);(q.artifactCount>0||q.textCount>0||q.thoughtCount>0)&&_("info","runtime.cli","codex transcript updates collected",{target:this.agent.targetCode,sessionId:a,artifactCount:q.artifactCount,textCount:q.textCount,finalTextCount:q.finalTextCount,thoughtCount:q.thoughtCount,transcriptCount:q.transcriptCount});let rt=Fr.trim();if(rt&&_("debug","runtime.cli","runtime stderr",{target:this.agent.targetCode,sessionId:a,stderr:rt}),_("info","runtime.cli","runtime prompt finished",{target:this.agent.targetCode,sessionId:a,pid:P.pid,exitCode:b,signal:G,artifactCount:k.artifacts.size,finalTextSeen:k.finalTextSeen}),k.terminalOutcome?.status==="failed"){Ct(k.terminalOutcome.error);return}if(b!==0&&k.terminalOutcome?.status!=="completed"){let Js=Object.assign(new Error(`runtime CLI exited with code ${b??"unknown"}${G?` (${G})`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:b,signal:G});Ct(Js);return}Vs({stopReason:"end_turn",exitCode:b,signal:G,_artifacts:[...k.artifacts.values()],...rt?{stderr:rt}:{}})})().catch(Ct)})})}buildArgs(t,r){let n=U(this.target.args);return t==="args"?[...n,r]:n}handleStdout(t,r,n,s,i){if(r!=="json-lines"){i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:t}}});return}n.value+=t;let o=n.value.split(/\r?\n/);n.value=o.pop()||"";for(let a of o){let c=a.trim();if(c)try{let l=JSON.parse(c);!this.nativeSession&&l.type==="thread.started"&&/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(l.thread_id||"")&&(this.deliveryThreadId=l.thread_id);let p=this.taskMcp&&this.adapter?.taskMcpError?.(l);if(p){n.terminalOutcome||(n.terminalOutcome={status:"failed",error:p},n.emitTerminal?.(n.terminalOutcome)),_t(this.active.get(s));continue}Xn(n,l);let m=this.adapter?.progress?.(l,n.progress,{emitThoughts:n.emitThoughtChunks,streamText:!n.finalTextOnly});for(let x of m||[{sessionUpdate:"runtime_event",event:Yn(l)}])i({sessionId:s,update:x});let f=Wn(l),h=Ke(l),y=m?"":f;y&&n.emitThoughtChunks&&!h&&Fo(l)?ts(n,s,i,y):y&&Vo(n,h)&&Zn(n,s,i,y),f&&h&&(n.finalTextSeen=!0);let T=Ho(l,n.terminalProtocol);T&&!n.terminalOutcome&&(T.status==="failed"||n.finalTextSeen||n.artifacts.size>0)&&(n.terminalOutcome=T,n.emitTerminal?.(T))}catch{i({sessionId:s,update:{sessionUpdate:"agent_message_chunk",content:{type:"text",text:`${a}
+`}}})}}}async sessionCancel(t){let r=u(t.sessionId),n=this.active.get(r);return n?(_("info","runtime.cli","cancelling runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid}),_t(n),{ok:!0,cancelled:!0}):{ok:!0,cancelled:!1}}async stop(t="stop"){for(let[r,n]of this.active.entries())_("info","runtime.cli","stopping runtime child",{target:this.agent.targetCode,sessionId:r,pid:n.pid,reason:t}),_t(n);this.active.clear(),await this.taskMcp?.close(),this.taskMcp=null}};import{spawn as ga}from"node:child_process";import{randomUUID as _a}from"node:crypto";import{createInterface as ya}from"node:readline";var Ta=new Set(["item/commandExecution/requestApproval","item/fileChange/requestApproval","item/permissions/requestApproval"]),wa={commandExecution:"shell",fileChange:"apply_patch",webSearch:"web_search",imageGeneration:"image_generation",imageView:"view_image"},Ea=new Set(["failed","declined"]);function os(e){return ee(e)==="codex"&&U(e.args)[0]==="app-server"}function Tt(e,t){return Object.assign(new Error(t),{code:e})}function ss(e){return e.type==="mcpToolCall"?`mcp__${e.server}__${e.tool}`:e.type==="dynamicToolCall"||e.type==="collabAgentToolCall"?u(e.tool)||e.type:wa[e.type]||""}function Sa(e){if(e.type==="commandExecution")return{command:e.command,cwd:e.cwd};if(e.type==="fileChange")return{paths:(e.changes||[]).map(i=>i?.path).filter(Boolean)};if(e.type==="mcpToolCall"||e.type==="dynamicToolCall")return ot(e.arguments);let{id:t,type:r,status:n,...s}=e;return ot(s)}function is(e){return Array.isArray(e)?e.filter(t=>t?.type==="text").map(t=>t.text).join(`
+`):""}function Ra(e){return e.type==="commandExecution"?e.aggregatedOutput||"":e.type==="mcpToolCall"?e.error?.message||is(e.result?.content):e.type==="dynamicToolCall"?is(e.contentItems):e.type==="fileChange"?(e.changes||[]).map(t=>t?.path).filter(Boolean).join(`
+`):""}function Oa(e,{onNotification:t,onRequest:r}){let n=1,s=new Map,i=o=>e.stdin.write(`${JSON.stringify(o)}
+`);return ya({input:e.stdout}).on("line",o=>{if(!o.trim())return;let a;try{a=JSON.parse(o)}catch{_("warn","runtime.codex","ignored non-JSON app-server output",{line:o.slice(0,200)});return}if(typeof a.method=="string"&&a.id!==void 0){Promise.resolve().then(()=>r(a.method,d(a.params)?a.params:{})).then(l=>i({id:a.id,result:l}),l=>i({id:a.id,error:{code:-32603,message:String(l?.message||l)}}));return}if(typeof a.method=="string"){t(a.method,d(a.params)?a.params:{});return}let c=s.get(a.id);c&&(s.delete(a.id),a.error?c.reject(Tt("RUNTIME_CODEX_APP_SERVER_ERROR",u(a.error.message)||"Codex app-server request failed")):c.resolve(a.result))}),{request:(o,a)=>new Promise((c,l)=>{let p=n++;s.set(p,{resolve:c,reject:l}),i({id:p,method:o,params:a})}),notify:o=>i({method:o})}}var ne=class extends yt{async runPrompt(t,r,n,s){let i=u(this.target.command);if(!i)throw new Error(`runtime target ${this.agent.targetCode} is missing command`);if(this.options.prepareLaunch)throw Tt("BAD_REQUEST","Codex app-server \u53EA\u652F\u6301\u5DF2\u63A5\u5165\u7684\u672C\u673A\u8BBE\u5907\uFF0C\u4E0D\u652F\u6301\u6C99\u7BB1\u542F\u52A8");let o=u(t.sessionId)||_a(),a=J(this.target,this.agent.workspace),c=Je(this.target,o);this.deliveryCwd=a,this.deliveryRoots=[a,...Xe(this.target,c.root).trustedFileRoots],this.deliveryThreadId=s||null;let l=Ve(t,this.target),p=R(this.target.timeoutMs||this.target.sessionPromptTimeoutMs,R(this.options.sessionPromptTimeoutMs,z)),m={sessionId:o,emitUpdate:r,ended:new AbortController};this.approvalTurn=m;let f=ga(i,[...U(this.target.args),...this.taskMcp?.args||[]],{cwd:a,env:{...process.env,...d(this.target.env)?this.target.env:{},...this.taskMcp?.environment||{},ORCHA_AGENT_ID:this.agent.agentId,ORCHA_SESSION_ID:o,ORCHA_RUNTIME_ARTIFACT_DIR:c.root},stdio:["pipe","pipe","pipe"],detached:process.platform!=="win32",windowsHide:!0});this.active.set(o,f),_("info","runtime.codex","app-server turn started",{target:this.agent.targetCode,sessionId:o,pid:f.pid,timeoutMs:p});let h=T=>r({sessionId:o,update:T}),y="";return f.stderr.setEncoding("utf8"),f.stderr.on("data",T=>{y=`${y}${T}`.slice(-4e3)}),await new Promise((T,x)=>{let g={threadId:null,turnId:null,items:new Map,pending:"",lastError:""},E=!1,w=(S,I)=>{E||(E=!0,clearTimeout(O),m.ended.abort(),this.approvalTurn===m&&(this.approvalTurn=null),this.active.delete(o),_t(f),We(c,{target:this.agent.targetCode,sessionId:o}),_("info","runtime.codex","app-server turn finished",{target:this.agent.targetCode,sessionId:o,status:S?"failed":"completed",...S?{error:String(S.message||S)}:{}}),S?x(S):T(I))},O=setTimeout(()=>w(Tt("RUNTIME_CLI_TIMEOUT",`runtime CLI timed out after ${p}ms`)),p);O.unref?.(),f.on("error",S=>w(S)),f.on("exit",(S,I)=>w(Object.assign(new Error(`Codex app-server exited before the turn completed (${I||S})${y.trim()?`: ${y.trim().slice(-500)}`:""}`),{code:"RUNTIME_CLI_EXIT_NONZERO",exitCode:S,signal:I})));let M=()=>{g.pending&&l&&h({sessionUpdate:"agent_thought_chunk",content:{type:"text",text:g.pending}}),g.pending=""},N=Oa(f,{onRequest:async(S,I)=>{if(Ta.has(S)){let C=await this.requestApproval(Mn(S,I,g.items.get(I.itemId)),{});return Un(S,I,C?.outcome==="approved")}if(S==="mcpServer/elicitation/request")return I.serverName==="orcha"&&I.mode!=="url"?{action:"accept",content:{},_meta:null}:{action:"decline",content:null,_meta:null};throw new Error(`OrchaAI does not handle Codex request ${S}`)},onNotification:(S,I)=>{if(I.threadId&&g.threadId&&I.threadId!==g.threadId)return;let C=d(I.item)?I.item:null;if(S==="item/started"&&C){g.items.set(C.id,C);let $=ss(C);if(!$)return;M(),h({sessionUpdate:"tool_call",toolCallId:C.id,title:$,status:"in_progress",rawInput:Sa(C)})}else if(S==="item/completed"&&C)g.items.set(C.id,C),C.type==="agentMessage"&&u(C.text)?(M(),C.phase==="commentary"?l&&h({sessionUpdate:"agent_thought_chunk",content:{type:"text",text:C.text}}):g.pending=C.text):C.type==="contextCompaction"?h({sessionUpdate:"runtime_event",event:{payload:{type:"context_compacted",id:C.id}}}):ss(C)&&h({sessionUpdate:"tool_call_update",toolCallId:C.id,status:Ea.has(C.status)||C.success===!1?"failed":"completed",rawOutput:Ra(C)});else if(S==="mcpServer/startupStatus/updated"&&I.name==="orcha"&&I.status==="failed")w(Tt("RUNTIME_CODEX_MCP_UNAVAILABLE",`Codex \u672A\u80FD\u8FDE\u63A5 OrchaAI \u4EFB\u52A1\u5DE5\u5177\uFF1A${u(I.error)||"\u542F\u52A8\u5931\u8D25"}`));else if(S==="error"&&I.willRetry!==!0)g.lastError=u(I.error?.message);else if(S==="turn/completed"&&(!g.turnId||I.turn?.id===g.turnId)){let $=d(I.turn)?I.turn:{};if($.status!=="completed"){w(Tt($.status==="interrupted"?"RUNTIME_CODEX_TURN_INTERRUPTED":"RUNTIME_CODEX_TURN_FAILED",u($.error?.message)||g.lastError||`Codex turn ${$.status||"failed"}`));return}g.pending&&h({sessionUpdate:"agent_message_chunk",content:{type:"text",text:g.pending}}),w(null,{stopReason:"end_turn",_artifacts:[]})}}});(async()=>{await N.request("initialize",{clientInfo:{name:"orcha_runtime_bridge",title:"OrchaAI Runtime Bridge",version:K},capabilities:null}),N.notify("initialized");let S=s?await N.request("thread/resume",{threadId:s,cwd:a,excludeTurns:!0}):await N.request("thread/start",{cwd:a}),I=u(S?.thread?.id);if(!I)throw Tt("RUNTIME_CODEX_APP_SERVER_ERROR","Codex app-server did not return a thread");g.threadId=I,this.deliveryThreadId=I,h({sessionUpdate:"runtime_event",event:{type:"thread.started",thread_id:I}});let C=await N.request("turn/start",{threadId:I,input:[{type:"text",text:mt(t.prompt),text_elements:[]}]});g.turnId=u(C?.turn?.id)||null})().catch(S=>w(S))})}};var Qe="ORCHA_RUNTIME_OUTPUT_START",Ze="ORCHA_RUNTIME_OUTPUT_END",tr="ORCHA_RUNTIME_CONTROL_START",er="ORCHA_RUNTIME_CONTROL_END",rr=Qe,nr=Ze,sr=tr,ir=er,or=[Qe,Ze,tr,er],Ia=new Set(["_artifacts","_decision","_meta"]),Ca=new RegExp(`(?:^|(?<=[\\r\\n]))[ \\t]*(?<marker>${or.join("|")})[ \\t]*(?=\\r\\n?|\\n|$)`,"g"),H=class extends Error{constructor(t,r,n){super(r),this.name="RuntimeResultProtocolError",this.code=t,this.detail={rawOutput:n}}};function cs(e){let t=typeof e=="string"?e.trimStart():"";return or.some(r=>t.startsWith(r))}function ar(e){if(typeof e!="string")return null;let t=e,r=xa(t);if(![...r.values()].some(h=>h.length>0))return null;let n=[],s=[];for(let[h,y]of r)y.length===0?n.push(h):y.length>1&&s.push(h);if(n.length>0||s.length>0){let h=[];throw n.length>0&&h.push(`\u7F3A\u5C11 ${n.join(", ")}`),s.length>0&&h.push(`\u91CD\u590D ${s.join(", ")}`),new H("invalid_markers",`Runtime Result \u534F\u8BAE\u6807\u8BB0\u4E0D\u5B8C\u6574\uFF1A${h.join("\uFF1B")}`,t)}let i=r.get(Qe)[0],o=r.get(Ze)[0],a=r.get(tr)[0],c=r.get(er)[0];if(!(i.end<=o.start&&o.end<=a.start&&a.end<=c.start))throw new H("invalid_marker_order","Runtime Result \u534F\u8BAE\u6807\u8BB0\u987A\u5E8F\u9519\u8BEF\uFF1A\u5FC5\u987B\u5148\u8F93\u51FA OUTPUT \u5757\uFF0C\u518D\u8F93\u51FA CONTROL \u5757",t);let l=Aa(t.slice(i.end,o.start));if(!l.trim())throw new H("empty_output","Runtime Result OUTPUT \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let p=t.slice(a.end,c.start).trim();if(!p)throw new H("empty_control","Runtime Result CONTROL \u5757\u4E0D\u80FD\u4E3A\u7A7A",t);let m;try{m=JSON.parse(p)}catch(h){throw new H("invalid_control_json",`Runtime Result CONTROL \u5757\u4E0D\u662F\u5408\u6CD5 JSON\uFF1A${String(h?.message||h)}`,t)}if(!as(m))throw new H("invalid_control_type","Runtime Result CONTROL \u5757\u5FC5\u987B\u662F JSON \u5BF9\u8C61",t);let f=Object.keys(m).filter(h=>!Ia.has(h)).sort();if(f.length>0)throw new H("invalid_control_keys",`Runtime Result CONTROL \u5757\u5305\u542B\u975E\u6807\u51C6\u5B57\u6BB5\uFF1A${f.join(", ")}`,t);if("_artifacts"in m&&!Array.isArray(m._artifacts))throw new H("invalid_control_field_type","Runtime Result CONTROL \u5757\u7684 _artifacts \u5FC5\u987B\u662F JSON \u6570\u7EC4",t);for(let h of["_decision","_meta"])if(h in m&&!as(m[h]))throw new H("invalid_control_field_type",`Runtime Result CONTROL \u5757\u7684 ${h} \u5FC5\u987B\u662F JSON \u5BF9\u8C61`,t);return{output:l,...m}}function xa(e){let t=new Map(or.map(r=>[r,[]]));for(let r of e.matchAll(Ca))t.get(r.groups.marker).push({start:r.index,end:r.index+r[0].length});return t}function Aa(e){let t=e.match(/^(?:\r\n|\r|\n)/)?.[0]||"",r=t?e.slice(t.length):e;return t&&r.endsWith(t)?r.slice(0,-t.length):r}function as(e){return!!e&&typeof e=="object"&&!Array.isArray(e)}import{createHash as Na}from"node:crypto";var ba="orcha.goal-contract/v1",Ma=new Set(["complete","completed","done","ok","passed","success","succeeded"]),Ua=new Set(["aborted","blocked","cancelled","canceled","denied","error","failed","failure","timeout","timed_out"]),Pa=new Map([["exec_command","run_command"],["local_shell_call","run_command"],["run_command","run_command"],["apply_patch","apply_patch"],["read_file","read_file"],["list_files","list_files"],["plugin_operation","plugin_operation"]]);function dr(e){return Na("sha256").update(X(e)).digest("hex")}function ls(e){if(!ps(e))return"";let t=["The following Orcha goal contract is immutable for this turn. Do not narrow its outcome or constraints.",`<goal_contract>${JSON.stringify(e)}</goal_contract>`];return e.verificationPlan?.required===!0&&t.push("Every verification check must be satisfied by a real successful tool call from one of its toolNames.","Each check requires requiredMatches distinct successful tool call IDs; repeated updates for one call count once.","A final text claim is not verification; missing or failed tool evidence prevents completion."),t.join(`
+`)}function ds(e,t,r=""){if(!ps(e))return e==null?null:{required:!0,status:"failed",outcome:u(e?.outcome),goalContractHash:"",checks:[],errorCode:"invalid_goal_contract"};let n=dr(e),s=e.verificationPlan.required===!0;if(u(r)&&u(r)!==n)return{required:s,status:"failed",outcome:e.outcome,goalContractHash:n,checks:[],errorCode:"goal_contract_hash_mismatch"};if(!s)return{required:!1,status:"not_required",outcome:e.outcome,goalContractHash:n,checks:[]};let i=La(t),o=e.verificationPlan.checks.map(c=>Ba(c,i));return{required:!0,status:o.some(c=>c.status==="failed")?"failed":o.some(c=>c.status==="missing")?"missing":"passed",outcome:e.outcome,goalContractHash:n,checks:o}}function ps(e){if(!d(e)||e.schemaVersion!==ba||!u(e.outcome))return!1;let t=e.verificationPlan;if(!d(t)||typeof t.required!="boolean"||!Array.isArray(t.checks)||t.required&&t.checks.length===0)return!1;let r=new Set;for(let n of t.checks)if(!d(n)||!u(n.id)||r.has(u(n.id))||(r.add(u(n.id)),!Array.isArray(n.toolNames)||n.toolNames.length===0||n.toolNames.some(s=>!u(s)))||!Number.isSafeInteger(n.requiredMatches)||n.requiredMatches<1||n.arguments!==void 0&&!d(n.arguments))return!1;return!0}function La(e){let t=new Map,r=[];for(let n of Array.isArray(e)?e:[]){let s=d(n?.update)?n.update:{},i=u(s.sessionUpdate);if(i==="runtime_event"){ka(s.event,t,r);continue}if(i==="tool_call"){let o=ie(s)||`tool-${r.length+1}`,a=se(t,r,o),c=ur(s,s.name||s.toolName||s.kind);a.toolName=c.toolName,a.arguments=c.arguments,a.status=Pt(s.status),a.evidence=ae(s);continue}if(i==="tool_call_update"){let o=ie(s);if(!o)continue;let a=se(t,r,o),c=ur(s,s.name||s.toolName||s.kind);a.toolName||=c.toolName,Object.keys(a.arguments).length===0&&(a.arguments=c.arguments),a.status=Pt(s.status),a.evidence.push(...ae(s))}}return r}function ka(e,t,r){let n=d(e)&&d(e.payload)?e.payload:d(e)?e:{},s=u(n.type);if(["function_call","custom_tool_call","local_shell_call","mcp_tool_call"].includes(s)){let a=ie(n)||`runtime-${r.length+1}`,c=se(t,r,a),l=ur(n,n.name||n.tool||s,s);c.toolName=l.toolName,c.arguments=l.arguments,c.status=Pt(n.status),c.evidence.push(...ae(n));return}if(!["function_call_output","custom_tool_call_output","local_shell_call_output","mcp_tool_call_output"].includes(s))return;let i=ie(n);if(!i)return;let o=se(t,r,i);o.status=Ha(n,o.toolName),o.evidence.push(...ae(n))}function se(e,t,r){let n=e.get(r);return n||(n={toolCallId:r,toolName:"",arguments:{},status:"unknown",evidence:[]},e.set(r,n),t.push(n)),n}function va(e){let t=u(e).toLowerCase();return Pa.get(t)||t}function ur(e,t,r=""){let n=Da(e),s=u(r)==="mcp_tool_call"||u(e?.kind).toLowerCase()==="mcp",i=d(e?._meta)?e._meta:{},o=u(e?.server||e?.serverName||e?.server_name||e?.mcpServer||i.server||i.serverName).toLowerCase();if(s&&o==="orcha"){let a=u(e?.tool||e?.toolName||e?.name||t);return{toolName:"plugin_operation",arguments:{...n,...a?{operationCode:a}:{}}}}return{toolName:va(t),arguments:n}}function ie(e){return d(e)?u(e.call_id||e.callId||e.toolCallId||e.id):""}function Da(e){if(!d(e))return{};for(let r of["arguments","args","rawInput","input","params","parameters"]){let n=$a(e[r]);if(n)return n}let t={};for(let r of["cmd","command","cwd","operationCode","path","query","url"])e[r]!==void 0&&(t[r]=e[r]);return t}function $a(e){if(d(e))return structuredClone(e);if(typeof e!="string")return null;try{let t=JSON.parse(e);return d(t)?t:null}catch{return null}}function Ha(e,t){if(!d(e))return"unknown";let r=oe(e,0,{parseCliExitCode:t==="run_command"||t==="apply_patch"});return r.includes("failed")?"failed":r.includes("success")?"success":"unknown"}function oe(e,t=0,r={}){if(t>8||e===null||e===void 0)return[];if(typeof e=="string")return Fa(e,t,r);if(Array.isArray(e))return e.flatMap(o=>oe(o,t+1,r));if(!d(e))return[];let n=[];typeof e.isError=="boolean"&&n.push(e.isError?"failed":"success"),typeof e.ok=="boolean"&&n.push(e.ok?"success":"failed"),typeof e.success=="boolean"&&n.push(e.success?"success":"failed");let s=Pt(e.status);s!=="unknown"&&n.push(s);let i=e.exitCode??e.exit_code;typeof i=="number"&&Number.isFinite(i)&&n.push(i===0?"success":"failed");for(let o of["output","result","structuredContent","content"])e[o]!==void 0&&n.push(...oe(e[o],t+1,r));return n}function Fa(e,t,r){let n=e.trim();if(!n)return[];try{return oe(JSON.parse(n),t+1,r)}catch{}if(r.parseCliExitCode!==!0)return[];let s=[];for(let i of n.matchAll(/(?:process\s+exited\s+with\s+code|exit\s+code\s*:?)\s*(-?\d+)/gi))s.push(Number(i[1])===0?"success":"failed");return s}function Pt(e){let t=u(e).toLowerCase();return Ma.has(t)?"success":Ua.has(t)?"failed":"unknown"}function ae(e){if(!d(e))return[];let t=d(e.output)?e.output:{},r=[e.verificationEvidence,d(e.verification)?e.verification.evidence:null,t.verificationEvidence,d(t.verification)?t.verification.evidence:null],n=[];for(let s of r)for(let i of Array.isArray(s)?s:s?[s]:[])!d(i)||!u(i.id)||n.push({id:u(i.id),status:Pt(i.status??(i.passed===!0?"passed":i.passed===!1?"failed":"")),...u(i.message)?{message:u(i.message)}:{}});return n}function Ba(e,t){let r=t.filter(o=>e.toolNames.includes(o.toolName)&&lr(e.arguments||{},o.arguments)),n=u(e.evidenceId),s=r.filter(o=>o.status==="success"&&(!n||o.evidence.some(a=>a.id===n&&a.status==="success")));if(s.length>=e.requiredMatches)return cr(e,"passed",s,`Runtime tool evidence passed ${s.length} times.`);let i=r.filter(o=>o.status==="failed"||n&&o.evidence.some(a=>a.id===n&&a.status==="failed"));return s.length===0&&i.length?cr(e,"failed",i,"Runtime tool evidence failed."):cr(e,"missing",s,`Only ${s.length}/${e.requiredMatches} required tool executions passed.`)}function cr(e,t,r,n){let s=r.map(i=>i.toolCallId).filter(Boolean);return{id:e.id,status:t,message:n,...u(e.description)?{description:u(e.description)}:{},toolNames:e.toolNames,requiredMatches:e.requiredMatches,observedMatches:s.length,toolCallIds:s,...d(e.arguments)?{arguments:e.arguments}:{},...u(e.evidenceId)?{evidenceId:u(e.evidenceId)}:{}}}function lr(e,t){return Array.isArray(e)?Array.isArray(t)&&e.length===t.length&&e.every((r,n)=>lr(r,t[n])):d(e)?d(t)?Object.entries(e).every(([r,n])=>Object.hasOwn(t,r)&&lr(n,t[r])):!1:Object.is(e,t)}function X(e){if(e===null||typeof e=="boolean")return JSON.stringify(e);if(typeof e=="string")return us(e);if(typeof e=="number"){if(!Number.isFinite(e))throw new Error("invalid_jcs_number");return JSON.stringify(Object.is(e,-0)?0:e)}if(Array.isArray(e))return`[${Array.from({length:e.length},(t,r)=>{if(!Object.hasOwn(e,r))throw new Error("invalid_jcs_json_value");return X(e[r])}).join(",")}]`;if(d(e))return`{${Object.keys(e).sort().map(t=>`${us(t)}:${X(e[t])}`).join(",")}}`;throw new Error("invalid_jcs_json_value")}function us(e){return ja(e),JSON.stringify(e)}function ja(e){for(let t=0;t<e.length;t+=1){let r=e.charCodeAt(t);if(r>=55296&&r<=56319){let n=e.charCodeAt(t+1);if(!(n>=56320&&n<=57343))throw new Error("invalid_jcs_unicode");t+=1}else if(r>=56320&&r<=57343)throw new Error("invalid_jcs_unicode")}}import{spawn as qa}from"node:child_process";import{createHash as Ga,randomUUID as Ka}from"node:crypto";import{constants as za}from"node:fs";import{access as Va,mkdir as pr,readdir as Ja,realpath as Lt,rm as Wa,stat as Xa}from"node:fs/promises";import Ya from"node:http";import{tmpdir as Qa}from"node:os";import{isAbsolute as kt,join as wt,relative as fs,resolve as mr}from"node:path";var hr=1,Za="orcha.process-isolation/v1",gr="orcha.egress-proxy/v1",tc="--disable-wasm-trap-handler",ce={read_only:0,workspace_write:1,workspace_network:2},fr={read_only:["read_only","denied"],workspace_write:["workspace_write","denied"],workspace_network:["workspace_write","restricted"]},ec=new Set([".env",".git-credentials",".netrc",".npmrc",".pypirc","credentials.json","secrets.json","id_rsa","id_ed25519"]);function ut(e){if(!d(e))throw A("RUNTIME_SANDBOX_POLICY_REQUIRED","sandboxPolicy is required");let t=structuredClone(e),r=u(t.accessMode),n=u(t.accessModeCeiling);if(!(r in fr)||!(n in fr))throw A("RUNTIME_SANDBOX_POLICY_INVALID","unsupported runtime access mode");if(ce[r]>ce[n])throw A("RUNTIME_SANDBOX_POLICY_INVALID","access mode exceeds its ceiling");let[s,i]=fr[r];if(t.filesystemMode!==s||t.networkMode!==i)throw A("RUNTIME_SANDBOX_POLICY_INVALID","runtime access profile does not match its mode");if(Number(t.policySchemaVersion)!==hr||!Number.isInteger(Number(t.policyRevision))||Number(t.policyRevision)<1)throw A("RUNTIME_SANDBOX_POLICY_INVALID","unsupported sandbox policy schema or revision");for(let[a,c]of Object.entries({outsideWorkspaceAccess:"denied",hostAccess:"denied",hostEnvironmentAccess:"denied",dockerSocketAccess:"denied",environmentMode:"allowlist"}))if(t[a]!==c)throw A("RUNTIME_SANDBOX_POLICY_INVALID",`${a} cannot be relaxed`);let o=d(t.processIsolation)?t.processIsolation:{};if(o.mode!=="required"||o.backend==="direct")throw A("RUNTIME_SANDBOX_POLICY_INVALID","strong process isolation is required");if(Array.isArray(t.alwaysApprovedApprovalKeys)&&t.alwaysApprovedApprovalKeys.length)throw A("RUNTIME_SANDBOX_POLICY_INVALID","persistent runtime approvals are forbidden");return t}function ms(e,t){let r=ut(e),n=ut(t);return ce[n.accessMode]<ce[r.accessMode]}async function hs(e){if(!e.sandboxRequired)return{dispatchable:!0,enforced:!1,backend:"direct",daemonStatus:"not_required",daemonProtocolVersion:"",policySchemaVersions:[hr],runtimePolicyUpdates:!1,workspaceSync:!1,egressProxy:!1,reason:"external_runtime_sandbox_not_required"};let t=await _s(e.sandboxBrokerCommand,process.env.PATH||"");if(!t)throw A("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let r=await oc(t,U(e.sandboxBrokerArguments),e.sandboxProbeTimeoutMs);if(r.enforced!==!0||u(r.protocolVersion)!=="orcha.runtime-sandbox-broker/v1"||!["bubblewrap","broker"].includes(u(r.backend)))throw A("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker did not report enforced isolation");let n=d(r.probes)?r.probes:{};for(let s of["emptyRoot","outsideWorkspaceDenied","hostFilesystemDenied","sensitiveFilesDenied","environmentAllowlist","dockerSocketDenied","networkNamespace","workspaceReadOnly","workspaceWrite","resourceLimits"])if(n[s]!==!0)throw A("RUNTIME_SANDBOX_UNAVAILABLE",`sandbox broker probe failed: ${s}`);return e.egressProxyRequired&&await uc(e),{dispatchable:!0,enforced:!0,backend:u(r.backend),daemonStatus:"ok",daemonProtocolVersion:u(r.protocolVersion||"orcha.runtime-sandbox-broker/v1"),policySchemaVersions:[hr],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:e.egressProxyRequired}}async function _r(e,t,r){let n=u(t.workspace||t.cwd),s=u(r),i=n||(t.allowRequestWorkspace===!0?s:"");if(!i||!kt(i))throw A("RUNTIME_WORKSPACE_NOT_CONFIGURED","runtime target must configure an absolute trusted workspace");let o=await Lt(i);if(!(await Xa(o)).isDirectory())throw A("RUNTIME_WORKSPACE_INVALID","runtime workspace is not a directory");if(!(e.trustedWorkspaceRoots.length?await Promise.all(e.trustedWorkspaceRoots.map(l=>Lt(l))):[o]).some(l=>Tr(l,o)))throw A("RUNTIME_WORKSPACE_OUTSIDE_TRUSTED_ROOT","runtime workspace is outside trusted roots");return o}async function gs({config:e,target:t,command:r,args:n,cwd:s,environment:i,runId:o,agentId:a,sessionId:c,sandboxPolicy:l}){if(!e.sandboxRequired)return{command:r,args:[...n],cwd:s,environment:{...process.env,...i},tempDirectory:"",isolation:{enforced:!1,backend:"development_direct"},cleanup:async()=>{}};let p=ut(l),m=await _r(e,t,s),f=await Lt(s);if(!Tr(m,f))throw A("RUNTIME_WORKSPACE_CWD_INVALID","runtime cwd is outside its workspace");let h=await _s(e.sandboxBrokerCommand,process.env.PATH||"");if(!h)throw A("RUNTIME_SANDBOX_UNAVAILABLE","sandbox broker is not executable");let y=`runtime-${Ga("sha256").update(String(o)).digest("hex").slice(0,32)}`,T=mr(e.sandboxTempRoot||wt(Qa(),"orcha-runtime-sandboxes"));await pr(T,{recursive:!0,mode:448});let x=wt(T,`${y}-${Ka()}`),g=wt(x,"home"),E=wt(x,"artifacts");await pr(g,{recursive:!0,mode:448}),await pr(E,{recursive:!0,mode:448});let w=p.networkMode==="restricted"?await ac(e,{runId:String(o),instanceId:y,policyRevision:Number(p.policyRevision),ttlMs:Math.min(R(p.maxRuntimeSeconds,900)*1e3,e.egressGrantMaxTtlMs),maxTransferBytes:R(p.maxNetworkBytes,64*1024*1024)}):null,O={PATH:u(i.PATH||process.env.PATH),LANG:u(i.LANG||process.env.LANG||"C.UTF-8"),HOME:"/tmp/home",TMPDIR:"/tmp",USER:"orcha",LOGNAME:"orcha",SHELL:"/bin/sh",ORCHA_AGENT_ID:String(a),ORCHA_SESSION_ID:String(c),ORCHA_RUN_ID:String(o),ORCHA_RUNTIME_ARTIFACT_DIR:"/tmp/artifacts",...nc(t,i)};O.HOME="/tmp/home",O.TMPDIR="/tmp",O.ORCHA_RUNTIME_ARTIFACT_DIR="/tmp/artifacts",O.NODE_OPTIONS=tc;let M={schemaVersion:Za,runId:String(o),instanceId:y,workspace:m,cwd:f,filesystemMode:p.filesystemMode,networkMode:p.networkMode,environmentMode:"allowlist",deniedRelativePaths:await sc(m),temporaryDirectory:x,egressProxy:w,environment:O,resourceLimits:ic(p),readOnlyToolchainRoots:await rc(e,t)},N=!1,S=async()=>{if(!N){N=!0;try{w&&await cc(e,w,{runId:String(o),instanceId:y})}finally{await Wa(x,{recursive:!0,force:!0})}}};return{command:h,args:[...U(e.sandboxBrokerArguments),"--",r,...n],cwd:f,environment:{PATH:process.env.PATH||"",LANG:process.env.LANG||"C.UTF-8",ORCHA_PROCESS_ISOLATION_REQUEST:JSON.stringify(M)},tempDirectory:x,homeDirectory:g,artifactDirectory:E,pathMappings:[{runtimeRoot:"/tmp/artifacts",hostRoot:E},{runtimeRoot:"/tmp/home",hostRoot:g}],isolation:{enforced:!0,backend:"broker",instanceId:y,policyRevision:p.policyRevision},cleanup:S}}async function rc(e,t){let r=U(t.toolchainRoots||t.sandboxToolchainRoots);if(!r.length)return[];let n=await Promise.all(U(e.trustedToolchainRoots).map(i=>Lt(i)));if(!n.length)throw A("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","target toolchain roots require ORCHA_RUNTIME_TRUSTED_TOOLCHAIN_ROOTS");let s=[];for(let i of r){if(!kt(i))throw A("RUNTIME_TOOLCHAIN_ROOT_INVALID","toolchain roots must be absolute");let o=await Lt(i);if(!n.some(a=>Tr(a,o)))throw A("RUNTIME_TOOLCHAIN_ROOT_NOT_TRUSTED","toolchain root is outside trusted roots");s.push(o)}return[...new Set(s)]}function nc(e,t){let r=d(e.env)?e.env:{},n={};for(let[s,i]of Object.entries(r))/^[A-Za-z_][A-Za-z0-9_]*$/.test(s)&&i!=null&&(n[s]=String(i));for(let s of["ORCHA_RUNTIME_PROMPT","ORCHA_RUNTIME_ARTIFACT_DIR"])t[s]!=null&&(n[s]=String(t[s]));return n}async function sc(e){let t=[],r=0,n=async s=>{let i;try{i=await Ja(s,{withFileTypes:!0})}catch(o){if(s===e)throw o;return}for(let o of i){if(r+=1,r>1e4)throw A("RUNTIME_WORKSPACE_SCAN_LIMIT_EXCEEDED","workspace contains more than 10000 entries");let a=wt(s,o.name),c=fs(e,a),l=o.name.toLowerCase();(ec.has(l)||l.startsWith(".env."))&&t.push(c),o.isDirectory()&&!o.isSymbolicLink()&&await n(a)}};return await n(e),t.sort()}function ic(e){return{maxCpuSeconds:Math.max(1,R(e.maxRuntimeSeconds,900)),maxMemoryBytes:R(e.maxMemoryBytes,2*1024*1024*1024),maxProcesses:R(e.maxProcesses,128),maxOpenFiles:R(e.maxOpenFiles,1024),maxFileBytes:R(e.maxFileBytes,64*1024*1024)}}async function oc(e,t,r){return await new Promise((n,s)=>{let i=qa(e,[...t,"--probe"],{env:{PATH:process.env.PATH||"",LANG:"C.UTF-8"},stdio:["ignore","pipe","pipe"],windowsHide:!0}),o=[],a=[];i.stdout.on("data",l=>o.push(Buffer.from(l))),i.stderr.on("data",l=>a.push(Buffer.from(l)));let c=setTimeout(()=>i.kill("SIGKILL"),Math.max(1e3,r));i.once("error",s),i.once("close",l=>{if(clearTimeout(c),l!==0){s(A("RUNTIME_SANDBOX_UNAVAILABLE",Buffer.concat(a).toString("utf8").trim()||`sandbox probe exited with ${l}`));return}try{n(JSON.parse(Buffer.concat(o).toString("utf8")))}catch{s(A("RUNTIME_SANDBOX_UNAVAILABLE","sandbox probe returned invalid JSON"))}})})}async function _s(e,t){let r=u(e);if(!r)return"";let n=kt(r)?[r]:String(t||"").split(":").filter(Boolean).map(s=>wt(s,r));for(let s of n)try{return await Va(s,za.X_OK),s}catch{}return""}async function ac(e,t){if(!e.egressProxyRequired)throw A("RUNTIME_EGRESS_UNAVAILABLE","restricted network requires the Egress Proxy");let r=await yr(e,"POST","/v1/grants",{protocolVersion:gr,...t}),n={socketPath:e.egressProxySocket,grantId:u(r.grantId),credential:u(r.credential)};if(!n.grantId||!n.credential)throw A("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy returned an invalid grant");return n}async function cc(e,t,r){await yr(e,"POST",`/v1/grants/${encodeURIComponent(t.grantId)}/revoke`,{protocolVersion:gr,...r}).catch(()=>{})}async function uc(e){let t=await yr(e,"GET","/health");if(t.status!=="ok"||t.proxy!=="orcha-egress-proxy"||t.protocolVersion!==gr)throw A("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy is unavailable or incompatible")}async function yr(e,t,r,n){if(!kt(e.egressProxySocket)||!e.egressProxyToken)throw A("RUNTIME_EGRESS_UNAVAILABLE","Egress Proxy socket and token are required");return await new Promise((s,i)=>{let o=Ya.request({socketPath:e.egressProxySocket,path:r,method:t,headers:{Authorization:`Bearer ${e.egressProxyToken}`,Accept:"application/json",...n?{"Content-Type":"application/json"}:{}}},a=>{let c=[],l=0;a.on("data",p=>{l+=p.length,l>1048576?o.destroy(new Error("egress response is too large")):c.push(Buffer.from(p))}),a.once("end",()=>{try{let p=JSON.parse(Buffer.concat(c).toString("utf8")||"{}");(a.statusCode||500)>=400?i(A("RUNTIME_EGRESS_UNAVAILABLE",u(p.error)||"Egress Proxy rejected the request")):s(p)}catch(p){i(p)}})});o.once("error",i),o.setTimeout(3e3,()=>o.destroy(new Error("Egress Proxy request timed out"))),n?o.end(JSON.stringify(n)):o.end()})}function Tr(e,t){let r=fs(mr(e),mr(t));return r===""||!r.startsWith("..")&&!kt(r)}function A(e,t){return Object.assign(new Error(t),{code:e})}var wr=24e3,Er=8,Sr=50,Rr=6e3,dc=new Set(["fail","failed","failure","error","errored","timeout","timed_out","cancelled","canceled","aborted"]),pc=10*60*1e3,fc=60*1e3,mc=8,hc=30*60*1e3,gc=60*1e3,_c=1,Es=2400,yc=new Set(["max_tokens","max_output_tokens","length"]),Tc=new Set(["agent_message_chunk","tool_call","tool_call_update"]),wc=new Set(["agentId","taskId","executionId","sessionId","nodeId","targetCode","framework","workspace","instructions"]),Ec=/(^|[_-])(token|secret|password|authorization|api[-_]?key|private[-_]?key|credential|cookie|jwt|access[-_]?token|refresh[-_]?token|service[-_]?token|execution[-_]?token)([_-]|$)/i;function Sc(e){if(!d(e))return{};let t={};for(let r of["name","code","serverName","serverCode","type","transport","url","command","protocolVersion"]){let n=u(e[r]);n&&(t[r]=n)}return t}function Rc(e){return(Array.isArray(e)?e:[]).map(Sc).sort((t,r)=>{let n=X(t),s=X(r);return n<s?-1:n>s?1:0})}function Oc(e){return!d(e)||e.verificationPlan?.required!==!0?!1:(Array.isArray(e.verificationPlan.checks)?e.verificationPlan.checks:[]).some(r=>d(r)&&Array.isArray(r.toolNames)&&r.toolNames.some(n=>u(n)==="plugin_operation"))}function Ic(e,t,r){let n=d(e?._meta)?e._meta:{};return{...d(e)?e:{},sessionId:t,update:d(e?.update)?e.update:{},_meta:{...n,orchaAgentId:r.agentId,runtimeSessionId:r.runtimeSessionId,bridgeUpdateId:le()}}}function F(e){return e==null||e===""?!1:typeof e=="string"?u(e)!=="":Array.isArray(e)?e.length>0:d(e)?Object.keys(e).length>0:!0}function Ss(e){let t=u(e).toLowerCase().replace(/[.。!！]+$/g,"").replace(/[\s-]+/g,"_");return dc.has(t)}function et(e,t){let r=R(e,t);return Number.isFinite(r)&&r>0?r:t}function vt(e,t=!1){if(typeof e=="boolean")return e;let r=u(e).toLowerCase();return["true","1","yes","y","on"].includes(r)?!0:["false","0","no","n","off"].includes(r)?!1:t}function Q(e){return u(e?.type||"echo")}function Rs(e){let t=Q(e);return t==="acp"||t==="stdio-acp"||t==="openclaw"}function Cr(e){if(d(e)){if(Object.prototype.hasOwnProperty.call(e,"releaseAfterPrompt"))return e.releaseAfterPrompt;if(Object.prototype.hasOwnProperty.call(e,"disposeAfterPrompt"))return e.disposeAfterPrompt}}function Cc(e){let t=String(e||"");if(Ec.test(t))return!0;let r=t.replace(/[^a-z0-9]/gi,"").toLowerCase();return r.endsWith("token")||r.endsWith("secret")||r.endsWith("password")||r.endsWith("apikey")||r.endsWith("privatekey")||r==="authorization"||r==="cookie"||r==="jwt"||r.includes("credential")}function xr(e,t=0){if(e==null||typeof e=="number"||typeof e=="boolean")return e;if(typeof e=="string"){if(e.length<=Rr)return e;let r=e.length-Rr;return`${e.slice(0,Rr)}... [truncated ${r} characters]`}if(t>=Er)return Array.isArray(e)?`[array truncated at depth ${Er}, items=${e.length}]`:d(e)?`[object truncated at depth ${Er}, keys=${Object.keys(e).length}]`:String(e);if(Array.isArray(e)){let r=e.slice(0,Sr).map(n=>xr(n,t+1));return e.length>Sr&&r.push(`[truncated ${e.length-Sr} items]`),r}if(d(e)){let r={};for(let[n,s]of Object.entries(e))r[n]=Cc(n)?"[REDACTED]":xr(s,t+1);return r}return String(e)}var xc=new Set(["type","executionId","taskId","task","traceId","requestId","agentCode","stage","phase","nodeId","nodeType","capabilityCode","operationCode","outputType","artifactType","input","inputs","rejection","previous","artifactRefs","outputSchema","executionPolicy","resultContract"]);function Ac(e){if(!d(e))return e;let t={};for(let r of xc)F(e[r])&&(t[r]=e[r]);return t}function Nc(e){if(!d(e))return e;let t={...e};return d(t.renderedPayload)&&(t.renderedPayload=Ac(t.renderedPayload)),t}function bc(e){let t=d(e)?e:{},r={};F(t.metadata)&&(r.metadata=Nc(t.metadata));for(let[n,s]of Object.entries(t))wc.has(n)||n==="metadata"||F(s)&&(r[n]=s);return r}function Mc(e){let t=d(e)?e:{},r=d(t.metadata)?t.metadata:{},n=d(r.renderedPayload)?r.renderedPayload:{};return d(t.resultContract)?t.resultContract:d(n.resultContract)?n.resultContract:{}}function Os(e){return u(Mc(e).kind).toLowerCase()==="decision"}function Uc(e){return e?.dispatchFinalTextOnly===!0||e?.dispatchFinalOutputOnly===!0?!0:e?.dispatchFinalTextOnly===!1||e?.dispatchFinalOutputOnly===!1?!1:Q(e)==="cli"}function ys(e){let t=e?.dispatchReleaseAfterPrompt??e?.dispatchDisposeAfterPrompt;return vt(t,Rs(e))}function Pc(e,t){let r=d(e?.metadata)?{...e.metadata}:{},n=d(r._runtimeBridge)?{...r._runtimeBridge}:{},s=Cr(n);return r._runtimeBridge={...n,promptKind:"dispatch",finalTextOnly:Uc(t),releaseAfterPrompt:s===void 0?ys(t):vt(s,ys(t)),requiresRuntimeResult:Os(e)},r}function Lc(e){let t=bc(e);if(!F(t))return"";let r=JSON.stringify(xr(t),null,2);if(r.length<=wr)return r;let n=r.length-wr;return`${r.slice(0,wr)}
+... [truncated ${n} characters]`}function Nr(e){if(!d(e))return"";let t=d(e.update)?e.update:e,n=(d(t.content)?t.content:{}).text??t.text;return n==null?"":String(n)}function Ar(e){if(!d(e))return"";let t=d(e.update)?e.update:e;return u(t.sessionUpdate)}function br(e){if(!Array.isArray(e))return"";let t=!1,r=[],n=[],s=[],i=()=>{r.length>0&&(n.push(r),r=[])};for(let a of e){let c=Ar(a),l=Nr(a);if(!c){l&&s.push(l);continue}if(t=!0,c==="agent_message_chunk"){l&&r.push(l);continue}if(c==="agent_message_snapshot"){n.length=0,r=l?[l]:[];continue}(c==="agent_thought_chunk"||c==="user_message_chunk"||c==="tool_call"||c==="tool_call_update"||c==="plan")&&i()}if(i(),!t)return Et(s);let o=n[n.length-1]||[];return Et(o)}function kc(e){return Array.isArray(e)?e.map(Nr).filter(t=>t!==""):[]}function de(e){return Array.isArray(e)?e.some(r=>Ar(r))?e.filter(r=>Tc.has(Ar(r))).map(Nr).filter(r=>r!==""):kc(e):[]}function vc(e){if(!d(e))return null;let t=d(e.update)?e.update:e;return u(t.sessionUpdate)!=="runtime_event"?null:d(t.event)?t.event:null}function Dc(e){if(!d(e))return"";let t=d(e.payload)?e.payload:{},r=u(e.type),n=u(t.type);if(r==="event_msg"){if(n==="task_complete")return u(t.last_agent_message||t.message||t.output);if(n==="agent_message"){let s=u(t.phase||t.status||t.stage).toLowerCase();if(["final_answer","final","complete","completed","done"].includes(s))return u(t.message||t.text||t.content)}}return""}function $c(e){if(!Array.isArray(e))return"";for(let t=e.length-1;t>=0;t-=1){let r=Dc(vc(e[t]));if(r)return r}return""}function Et(e){let t="";for(let r of e){let n=String(r||"");if(n)if(!t)t=n;else if(n.length>t.length&&n.startsWith(t))t=n;else{let s=cs(n)&&!/[\r\n]$/.test(t)?`
+`:"";t+=`${s}${n}`}}return t.trim()}function Hc(e){let t=String(e||"").trim();if(!t)return"";let r=t.match(/(?:^|\n)#{1,3}\s+\S/);return!r||r.index===0?t:t.slice(r.index+(t[r.index]===`
+`?1:0)).trim()}function Ts(e){let t=String(e||"").trim();if(!t)return null;try{let r=JSON.parse(t);if(d(r)&&(Is(r)||F(r._artifacts)||F(r.artifacts)||F(r._decision)||F(r._meta)))return r}catch{}return null}function Dt(e){try{return ar(e)}catch{return null}}function ue(...e){let t=null;for(let r of e)try{if(ar(r))return}catch(n){t||=n}if(t)throw t}function Or(e){let t=String(e||"").trim();if(!t)return null;let r=Dt(t);if(r)return r;let n=[...t.matchAll(/```(?:json)?\s*([\s\S]*?)```/gi)];for(let s=n.length-1;s>=0;s-=1){let i=Ts(n[s][1]);if(i)return i}if(!t.endsWith("}"))return null;for(let s=t.lastIndexOf("{");s>=0;s=t.lastIndexOf("{",s-1)){let i=Ts(t.slice(s));if(i)return i}return null}function Fc(e){let t=Dt(br(e));if(t)return t;let r=de(e);for(let n=r.length-1;n>=0;n-=1){let s=Dt(r[n]);if(s)return s}return Dt(Et(r))}function Is(e){if(!d(e))return!1;if(F(e.output))return!0;for(let t of["content","text","message","summary"])if(u(e[t]))return!0;return!!(Ss(e.status)||u(e.error)||u(e.errorMessage))}function V(e){let t=d(e)?{...e}:{};return(!Array.isArray(t._artifacts)||t._artifacts.length===0)&&Array.isArray(t.artifacts)&&t.artifacts.length>0&&(t._artifacts=t.artifacts),delete t.artifacts,t}function Bc(e){return d(e)?typeof(d(e._decision)?e._decision:d(e.decision)?e.decision:e).passed=="boolean":!1}function Cs(e){return d(e)?d(e._decision)&&typeof e._decision.passed=="boolean"?!0:Bc(e.output):!1}function Ir(e,t,r){let n=d(e)?{...e}:{};if(!F(n.output)){for(let s of["summary","message","content","text"])if(u(n[s])){n.output=u(n[s]);break}}return!F(n.output)&&u(r)&&(n.output=u(r)),{...n,_meta:{...d(n._meta)?n._meta:{},runtimeOutputSource:t,requiredRuntimeResult:!0,finalMessagePreview:u(r).slice(0,1e3)}}}var jc=["dataUrl","dataURL","contentDataUrl","contentDataURL","contentBase64","base64","data"];function ws(e){if(!d(e))return"";let t=d(e.content)?e.content:{},r=d(e.metadata)?e.metadata:{};return u(e.fieldKey||e.field_key||t.fieldKey||r.fieldKey)}function qc(e,t){let r=d(e.content)?e.content:{},n=d(t.content)?t.content:{},s={...e,...t,content:{...r,...n},metadata:{...d(e.metadata)?e.metadata:{},...d(t.metadata)?t.metadata:{}}};for(let i of jc)F(e[i])&&(s[i]=e[i]),F(r[i])&&(s.content[i]=r[i]);return s}function xs(e,t){let r=Array.isArray(e)?e.filter(d):[],n=Array.isArray(t)?t.filter(d):[];if(!r.length)return n;if(!n.length)return r;let s=[...r],i=new Map;for(let a=0;a<r.length;a+=1){let c=ws(r[a]),l=i.get(c)||[];l.push(a),i.set(c,l)}let o=new Map;for(let a of n){let c=ws(a),l=o.get(c)||0;o.set(c,l+1);let p=i.get(c)?.[l];p===void 0?s.push(a):s[p]=qc(s[p],a)}return s}function Y(e,t,r){let n={...e,...t,_meta:{...d(e._meta)?e._meta:{},...d(t._meta)?t._meta:{},runtimeOutputSource:r}};return(Array.isArray(e._artifacts)||Array.isArray(t._artifacts))&&(n._artifacts=xs(e._artifacts,t._artifacts)),n}function As(e,t,r={}){let n=u(r.promptKind),s=r.requiresRuntimeResult===!0,i=s||n==="dispatch",o=V(e),a=typeof o.output=="string"?Dt(o.output):null;if(a)return Y(o,V(a),"result_block");let c=$c(t),l=c?Or(c):null,p=i?Fc(t):null;if(Is(o))return Ss(o.status)||u(o.error)||u(o.errorMessage)?o:n==="dispatch"&&l?Y(o,V(l),"final_event"):n==="dispatch"&&p?Y(o,V(p),"updates"):!s||Cs(o)?o:l?Y(o,V(l),"final_event"):p?Y(o,V(p),"updates"):(ue(o.output,c,Et(de(t))),Ir(o,"result",o.output));if(l)return Y(o,V(l),"final_event");if(p)return Y(o,V(p),"updates");if(c)return s?(ue(c,Et(de(t))),Ir(o,"final_event",c)):{...o,output:c,_meta:{...d(o._meta)?o._meta:{},runtimeOutputSource:"final_event"}};let m=br(t),f=Or(m);if(f)return Y(o,V(f),"updates");let h=Hc(m);if(!h)return s&&ue(Et(de(t))),o;let y=Or(h);return y?Y(o,V(y),"updates"):s?(ue(m,h),Ir(o,"updates",h)):{...o,output:h,_meta:{...d(o._meta)?o._meta:{},runtimeOutputSource:"updates"}}}function Mr(e){return d(e)?u(e.stopReason||e.stop_reason).toLowerCase():""}function Ns(e){return yc.has(Mr(e))}function Gc(e,t,r){if(r.promptKind!=="dispatch"||r.requiresRuntimeResult!==!0||!Ns(e))return!1;try{return!Cs(As(e,t,r))}catch{return!0}}function Kc(){return["Your previous final response reached the output limit before the Runtime Result protocol was complete.","Re-emit the complete final Runtime Result from scratch using the conclusion you already reached.","Do not repeat analysis, process notes, tool calls, or task work.",`Keep the OUTPUT report within ${Es} Unicode characters.`,`Output ${rr}, ${nr}, ${sr}, and ${ir} on their own lines.`,"The CONTROL block must be valid JSON containing _decision and must be fully closed.","Return only the two protocol blocks."].join(`
+`)}function zc(e,t){let r=d(t)?{...t}:{},n=xs(e?._artifacts,t?._artifacts);return n.length>0&&(r._artifacts=n),r}function Vc(e,t){return{...e,_meta:{...d(e?._meta)?e._meta:{},runtimeProtocolRetry:{attempted:!0,recovered:!0,reason:Mr(t)||"max_tokens"}}}}function Jc(e,t){let r=typeof e?.output=="string"?e.output:br(t),n=new H("runtime_output_truncated","Runtime Result \u8FBE\u5230\u6700\u5927\u8F93\u51FA\u957F\u5EA6\uFF0C\u7D27\u51D1\u91CD\u8BD5\u540E\u4ECD\u672A\u5B8C\u6574\u8FD4\u56DE",r);return n.detail={...n.detail,stopReason:Mr(e)||"max_tokens",retryAttempted:!0},n}var pe=class{constructor(t){this.config=t,this.targets=t.targets||{},this.agents=new Map,this.sessions=new Map,this.startingSessions=new Set,this.targetReservations=new Map,this.runtimeSessionIndex=new Map,this.pendingPermissions=new Map,this.operations=new Map,this.startedAt=xt(),this.sandboxCapabilities={dispatchable:t.sandboxRequired!==!0,enforced:!1,backend:t.sandboxRequired?"unavailable":"direct",daemonStatus:t.sandboxRequired?"pending":"not_required",policySchemaVersions:[1],runtimePolicyUpdates:t.sandboxRequired===!0,workspaceSync:!1,egressProxy:!1},this.cleanupTimer=null,this.onCapacityChanged=null,this.startSessionCleanup()}async start(){try{this.sandboxCapabilities=await hs(this.config)}catch(t){this.sandboxCapabilities={...this.sandboxCapabilities,dispatchable:!1,enforced:!1,backend:"unavailable",daemonStatus:"unavailable",reason:u(t?.code||t?.message||t)||"sandbox_probe_failed"},_("error","runtime-bridge","runtime node sandbox probe failed; node will not accept work",{reason:this.sandboxCapabilities.reason})}return this.sandboxCapabilities}assertDispatchable(){if(this.config.sandboxRequired&&!(this.sandboxCapabilities.dispatchable===!0&&this.sandboxCapabilities.enforced===!0))throw Object.assign(new Error("runtime node strong sandbox is unavailable"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"})}operationIdentity(t,r,n){let s=d(t.goalContract)?dr(t.goalContract):u(t.goalContractHash),i=lc("sha256").update(X({prompt:Array.isArray(t.prompt)?t.prompt:[],mcpServers:Rc(t.mcpServers),metadata:d(t.metadata)?t.metadata:{}})).digest("hex");return{agentId:r,runId:u(t.runId),sessionId:n,targetCode:u(t.targetCode||t.framework),workspace:u(t.workspace),goalContractHash:s,requestHash:i}}assertOperationIdentity(t,r,n,s){let i=this.operationIdentity(r,n,s),o=Object.keys(t.identity).find(a=>t.identity[a]!==i[a]);if(o)throw Object.assign(new Error(`runtime operation correlation conflict: ${t.correlationId}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT",field:o})}createOperation(t,r,n,s){let i={correlationId:t,agentId:n,sessionId:s,identity:this.operationIdentity(r,n,s),sandboxPolicy:d(r.sandboxPolicy)?structuredClone(r.sandboxPolicy):null,status:"running",updates:[],listeners:new Set,waiters:[],response:null,error:null,mcpServers:r.mcpServers,createdAtMs:Date.now(),completedAtMs:null};return this.operations.set(t,i),i}async attachOperation(t,r={}){let n=()=>{if(r.onUpdate)for(let s of t.updates)r.onUpdate(s)};if(t.status==="completed")return n(),t.response;if(t.status==="failed")throw n(),t.error;r.onUpdate&&t.listeners.add(r.onUpdate);try{return n(),await new Promise((s,i)=>t.waiters.push({resolve:s,reject:i}))}finally{r.onUpdate&&t.listeners.delete(r.onUpdate)}}completeOperation(t,r){if(t.status==="running"){t.status="completed",t.response=r,t.mcpServers=null,t.completedAtMs=Date.now();for(let n of t.waiters.splice(0))n.resolve(r);t.listeners.clear()}}promptResponse(t,r,n,s,i,o=s){let a=d(t.metadata)?t.metadata:{},c=d(a._runtimeBridge)?a._runtimeBridge:{},l=a.source==="channel_message"?i:As(i,o,c),p=ds(t.goalContract,s,t.goalContractHash);return{sessionId:n,runtimeSessionId:r.runtimeSessionId,result:l,updates:s,...p?{verification:p}:{}}}failOperation(t,r){if(t.status!=="running")return;let n=r instanceof Error?r:Object.assign(new Error(String(r||"runtime operation failed")),{code:"RUNTIME_NODE_ERROR"});t.status="failed",t.error=n,t.mcpServers=null,t.completedAtMs=Date.now();for(let s of t.waiters.splice(0))s.reject(n);t.listeners.clear()}cleanupOperations(t=Date.now()){let r=et(this.config.operationTtlMs,hc);for(let[n,s]of this.operations)s.status!=="running"&&t-(s.completedAtMs||s.createdAtMs)>r&&this.operations.delete(n)}targetFor(t){let r=u(t)||this.config.defaultTargetCode,n=this.targets[r];if(!r||!d(n)){let s=new Error(`runtime target is not configured: ${r||"<empty>"}`);throw s.code="RUNTIME_TARGET_NOT_FOUND",s}return{code:r,target:n}}targetIdleTtlMs(t){let n=Q(t)==="openclaw"?et(this.config.openClawSessionIdleTtlMs,gc):et(this.config.sessionIdleTtlMs,pc);return et(t?.sessionIdleTtlMs??t?.idleTtlMs,n)}targetMaxSessions(t){let n=Q(t)==="openclaw"?et(this.config.openClawMaxSessions,_c):et(this.config.maxSessionsPerTarget,mc);return et(t?.maxSessions,n)}targetReservationCount(t){return Number(this.targetReservations.get(t)||0)}notifyCapacityChanged(){try{this.onCapacityChanged?.()}catch(t){_("warn","runtime-bridge","capacity heartbeat callback failed",{error:String(t)})}}targetCapacitySnapshot(t=!0){return Object.entries(this.targets).map(([r,n])=>{let s=[...this.sessions.values()].filter(p=>p.targetCode===r),i=s.filter(p=>p.busy).length,o=s.length-i,a=this.targetReservationCount(r),c=this.targetMaxSessions(n),l=t?Math.max(0,c-i-a):0;return{targetCode:r,targetName:u(n?.name||n?.targetName||r),targetType:u(n?.type||"echo"),status:t?l>0?"available":"busy":"unavailable",maxSessions:c,busySessions:i,idleSessions:o,reservedSessions:a,availableSessions:l}})}targetReleaseAfterPrompt(t,r={}){let n=Q(t),s=d(r?._runtimeBridge)?r._runtimeBridge:{},i=Cr(s);return i!==void 0?vt(i,!1):vt(t?.releaseAfterPrompt??t?.disposeAfterPrompt,n==="openclaw")}promptReleaseAfterPrompt(t,r={}){if(this.config.sandboxRequired)return!0;let n=d(r?._runtimeBridge)?r._runtimeBridge:{},s=Cr(n);return s!==void 0?vt(s,t.releaseAfterPrompt):t.releaseAfterPrompt}startSessionCleanup(){let t=et(this.config.sessionCleanupIntervalMs,fc);t<=0||(this.cleanupTimer=setInterval(()=>{this.cleanupExpiredSessions().catch(r=>{_("warn","runtime-bridge","runtime session cleanup failed",{error:String(r)})})},t),this.cleanupTimer.unref?.())}sessionCountForTarget(t){let r=0;for(let n of this.sessions.values())n.targetCode===t&&(r+=1);return r}idleTargetSessions(t){return[...this.sessions.entries()].filter(([,r])=>r.targetCode===t&&!r.busy).sort((r,n)=>(r[1].lastUsedAtMs||0)-(n[1].lastUsedAtMs||0))}async closeSession(t,r="session_closed"){let n=this.sessions.get(t);if(!n)return!1;try{await n.runtime?.stop?.(r)}catch(s){_("warn","runtime-bridge","runtime session stop failed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,error:String(s)})}return this.sessions.delete(t),this.runtimeSessionIndex.delete(`${n.agentId}:${n.runtimeSessionId}`),this.notifyCapacityChanged(),_("info","runtime-bridge","runtime session closed",{sessionId:n.sessionId,runtimeSessionId:n.runtimeSessionId,targetCode:n.targetCode,runtimeKind:n.runtimeKind,reason:r}),!0}async closeAllSessions(t="bridge_shutdown"){for(let r of[...this.sessions.keys()])await this.closeSession(r,t)}async stop(t="bridge_stop"){this.cleanupTimer&&clearInterval(this.cleanupTimer),this.cleanupTimer=null,await this.closeAllSessions(t)}async cleanupExpiredSessions(t=Date.now()){for(let[r,n]of[...this.sessions.entries()])n.busy||t-(n.lastUsedAtMs||n.createdAtMs||t)>n.idleTtlMs&&await this.closeSession(r,"idle_timeout")}async reserveTargetSlot(t,r){let n=this.targetMaxSessions(r);for(;this.sessionCountForTarget(t)+this.targetReservationCount(t)>=n;){let s=this.idleTargetSessions(t);if(!s.length){let i=new Error(`runtime target session limit reached: ${t}`);throw i.code="RUNTIME_TARGET_SESSION_LIMIT",i}await this.closeSession(s[0][0],"target_session_limit")}this.targetReservations.set(t,this.targetReservationCount(t)+1),this.notifyCapacityChanged()}releaseTargetSlot(t){let r=Math.max(0,this.targetReservationCount(t)-1);r>0?this.targetReservations.set(t,r):this.targetReservations.delete(t),this.notifyCapacityChanged()}async createAgent(t){let r=u(t.agentId);if(!r)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});let{code:n,target:s}=this.targetFor(t.targetCode||t.framework),i=this.agents.get(r);if(i&&i.targetCode!==n)throw Object.assign(new Error(`runtime agent target conflict: ${r}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});let o=this.config.sandboxRequired?await _r(this.config,s,t.workspace):u(t.workspace),a={agentId:r,targetCode:n,framework:u(t.framework||n),workspace:o,metadata:d(t.metadata)?t.metadata:{},createdAt:xt(),runtimeKind:Q(s)};return this.agents.set(r,a),{agent:a}}runtimeFor(t,r,n={}){let{target:s}=this.targetFor(t.targetCode),i=Q(s),o={onPermissionRequest:c=>n.source==="conversation_delegation"?{outcome:"denied",reason:"External group member permission continuation is not supported"}:this.requestPermission(c)},a={sessionPromptTimeoutMs:this.config.sessionPromptTimeoutMs,initializeTimeoutMs:this.config.initializeTimeoutMs,sandboxRequired:this.config.sandboxRequired,runId:n.runId,source:n.source,cloudSessionId:r,orchaUrl:this.config.orchaUrl,attachOnly:n.attachOnly,sandboxPolicy:n.sandboxPolicy,...this.config.sandboxRequired?{prepareLaunch:c=>gs({config:this.config,target:s,...c,runId:n.runId,agentId:t.agentId,sessionId:r,sandboxPolicy:n.sandboxPolicy})}:{}};return i==="stdio-acp"||i==="acp"?new ht(t,s,o,a):i==="openclaw"?new Xt(t,s,r,o,a):i==="cli"?os(s)?new ne(t,s,a,o):new yt(t,s,a,o):new qt(t)}async prompt(t,r={}){if(this.assertDispatchable(),this.config.sandboxRequired){let a=u(t.runId);if(!a)throw Object.assign(new Error("runId is required"),{code:"BAD_REQUEST"});t={...t,runId:a,sandboxPolicy:ut(t.sandboxPolicy)}}let n=u(t.agentId),s=u(t.sessionId)||le(),i=u(t.correlationId);if(!n)throw Object.assign(new Error("agentId is required"),{status:400,code:"BAD_REQUEST"});if(this.cleanupOperations(),i){let a=this.operations.get(i);if(a){if(this.assertOperationIdentity(a,t,n,s),a.status==="running"&&(["conversation_delegation","channel_message"].includes(t.metadata?.source)||t.metadata?.source==="ai_chat_runtime_node"&&Object.hasOwn(ct,t.framework||""))){a.mcpServers=t.mcpServers;let c=this.sessions.get(`${n}:${s}`);if(c){if(!c.runtime.refreshMcpServers)throw Object.assign(new Error("This runtime cannot refresh task MCP credentials"),{code:"unsupported_dynamic_mcp"});await c.runtime.refreshMcpServers(t.mcpServers)}}return this.attachOperation(a,r)}if(t.attachOnly===!0&&!(t.metadata?.source==="channel_message"&&this.targetFor(t.targetCode||t.framework).target.type==="openclaw"))throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"})}else if(t.attachOnly===!0)throw Object.assign(new Error("correlationId is required for attachOnly"),{code:"BAD_REQUEST"});let o=i?this.createOperation(i,t,n,s):null;if(o){let a=this.attachOperation(o,r);return(async()=>{try{await this._promptOwned(t,{},o,n,s)}catch(c){let l=o.status==="completed";this.failOperation(o,c),l&&_("warn","runtime-bridge","runtime cleanup failed after operation completion",{correlationId:o.correlationId,error:String(c)})}})(),await a}return await this._promptOwned(t,r,o,n,s)}async _promptOwned(t,r,n,s,i){let o=u(t.runId),a=this.config.sandboxRequired?ut(n?.sandboxPolicy||t.sandboxPolicy):null,c=this.agents.get(s),l=this.targetFor(t.targetCode||t.framework||c?.targetCode);if(c&&c.targetCode!==l.code)throw Object.assign(new Error(`runtime agent target conflict: ${s}`),{code:"RUNTIME_AGENT_TARGET_CONFLICT"});if(Q(l.target)==="cli"&&Oc(t.goalContract))throw Object.assign(new Error("CLI runtimes do not support per-run dynamic MCP required by plugin_operation"),{code:"unsupported_dynamic_mcp"});let p=c||(await this.createAgent({agentId:s,targetCode:l.code,framework:t.framework,workspace:t.workspace,metadata:t.metadata})).agent;if(!this.config.sandboxRequired){let g=u(t.workspace);g&&g!==p.workspace&&(p.workspace=g)}let m=`${s}:${i}`;await this.cleanupExpiredSessions();let f=this.sessions.get(m),h=null;if(f&&f.targetCode!==l.code)throw Object.assign(new Error(`runtime session target conflict: ${i}`),{code:"RUNTIME_SESSION_TARGET_CONFLICT"});if(f&&this.config.sandboxRequired&&f.runId!==o)throw Object.assign(new Error(`runtime session cannot be shared across runs: ${i}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});if(!f){if(this.startingSessions.has(m))throw Object.assign(new Error(`runtime session is already starting: ${i}`),{code:"RUNTIME_SESSION_BUSY"});this.startingSessions.add(m);let{code:g,target:E}=l,w;try{await this.reserveTargetSlot(g,E),h=g;let O=this.runtimeFor(p,i,{runId:o,sandboxPolicy:a,source:t.metadata?.source,attachOnly:t.attachOnly});w=O;let M=n?.mcpServers||t.mcpServers||[],N=await O.sessionNew({cwd:J(E,p.workspace),mcpServers:M,metadata:d(t.metadata)?t.metadata:{}});if(n&&n.status!=="running")throw Object.assign(new Error("Runtime operation was cancelled before prompt dispatch"),{code:"RUNTIME_OPERATION_CANCELLED"});let S=Date.now();f={agentId:s,sessionId:i,runtime:O,targetCode:g,runtimeKind:Q(E),runId:o,sandboxPolicy:a?structuredClone(a):null,runtimeSessionId:u(d(N)?N.sessionId:"")||i,idleTtlMs:this.targetIdleTtlMs(E),releaseAfterPrompt:this.config.sandboxRequired?!0:this.targetReleaseAfterPrompt(E,t.metadata),createdAtMs:S,lastUsedAtMs:S,busy:!1,createdAt:xt()},this.sessions.set(m,f),this.runtimeSessionIndex.set(`${s}:${f.runtimeSessionId}`,f),n?.mcpServers!==M&&n?.mcpServers&&O.refreshMcpServers&&await O.refreshMcpServers(n.mcpServers)}catch(O){throw this.sessions.get(m)?.runtime===w?await this.closeSession(m,"session_start_failed"):await w?.stop("session_start_failed"),h&&(this.releaseTargetSlot(h),h=null),O}finally{this.startingSessions.delete(m)}}if(f.busy){let g=new Error(`runtime session is already running: ${i}`);throw g.code="RUNTIME_SESSION_BUSY",g}f.busy=!0,h&&this.releaseTargetSlot(h),this.notifyCapacityChanged(),f.operationCorrelationId=n?.correlationId||null,f.lastUsedAtMs=Date.now();let y=n?.updates||[],T=g=>{let E=Ic(g,i,f);if(y.push(E),n)for(let w of n.listeners)try{w?.(E)}catch(O){_("warn","runtime-bridge","runtime operation update listener failed",{correlationId:n.correlationId,error:String(O)})}else r.onUpdate?.(E)},x=g=>{if(!(!n||n.status!=="running"||!d(g))){if(g.status==="failed"){let E=g.error;if(E instanceof Error){this.failOperation(n,E);return}let w=d(E)?E:{},O=Object.assign(new Error(u(w.message||g.message)||"runtime terminal failure"),{code:u(w.code||g.code)||"RUNTIME_TERMINAL_FAILED"});this.failOperation(n,O);return}this.completeOperation(n,this.promptResponse(t,f,i,y,d(g.result)?g.result:{stopReason:"end_turn"}))}};try{let g=ls(t.goalContract),E=Array.isArray(t.prompt)?[...t.prompt]:[];g&&E.unshift({type:"text",text:g,metadata:{source:"orcha_goal_contract"}});let w=d(t.metadata)?t.metadata:{},O=d(w._runtimeBridge)?w._runtimeBridge:{},M=await f.runtime.sessionPrompt({sessionId:f.runtimeSessionId,prompt:E,metadata:w},T,x),N=y,S=null;if(Rs({type:f.runtimeKind})&&Gc(M,y,O)){S=M;let C=y.length,$=await f.runtime.sessionPrompt({sessionId:f.runtimeSessionId,prompt:[{type:"text",text:Kc()}],metadata:w,_meta:{thinking:"off"}},T,x);M=zc(S,$),N=y.slice(C)}let I;try{I=this.promptResponse(t,f,i,y,M,N)}catch(C){throw S&&Ns(M)?Jc(M,N):C}return S&&(I.result=Vc(I.result,S)),n&&this.completeOperation(n,I),I}finally{f.busy=!1,this.notifyCapacityChanged(),f.operationCorrelationId===n?.correlationId&&(f.operationCorrelationId=null),f.lastUsedAtMs=Date.now(),this.promptReleaseAfterPrompt(f,d(t.metadata)?t.metadata:{})&&await this.closeSession(m,"release_after_prompt"),n&&(n.mcpServers=null)}}async updatePolicy(t){if(this.assertDispatchable(),!this.config.sandboxRequired)throw Object.assign(new Error("runtime sandbox policy updates require an enforced sandbox"),{code:"RUNTIME_NODE_SANDBOX_UNAVAILABLE"});let r=u(t.agentId),n=u(t.runId),s=u(t.sessionId),i=u(t.correlationId);if(!r||!n||!s||!i)throw Object.assign(new Error("agentId, runId, sessionId and correlationId are required"),{code:"BAD_REQUEST"});let o=ut(t.sandboxPolicy),a=this.operations.get(i);if(a&&(a.agentId!==r||a.sessionId!==s||a.identity.runId!==n))throw Object.assign(new Error(`runtime operation policy identity conflict: ${i}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let c=`${r}:${s}`,l=this.sessions.get(c);if(l&&l.runId!==n)throw Object.assign(new Error(`runtime session policy identity conflict: ${s}`),{code:"RUNTIME_SESSION_RUN_CONFLICT"});let p=l?.sandboxPolicy||a?.sandboxPolicy;if(!p)throw Object.assign(new Error(`runtime operation is no longer available: ${i}`),{code:"RUNTIME_OPERATION_NOT_FOUND"});let m=Number(p.policyRevision),f=Number(o.policyRevision);if(f<m)throw Object.assign(new Error("runtime sandbox policy revision is stale"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:m});if(f===m){if(X(p)!==X(o))throw Object.assign(new Error("runtime sandbox policy revision payload conflicts"),{code:"RUNTIME_POLICY_REVISION_CONFLICT",currentPolicyRevision:m});return{updated:!1,idempotent:!0,policyRevision:m,accessMode:p.accessMode}}let h=ms(p,o);a&&(a.sandboxPolicy=structuredClone(o)),l&&(l.sandboxPolicy=structuredClone(o));let y=!1;return h&&l?.busy===!0&&(await l.runtime.sessionCancel({sessionId:l.runtimeSessionId}),y=await this.closeSession(c,"sandbox_policy_downgrade")),{updated:!0,policyRevision:f,accessMode:o.accessMode,activeCommandCancelled:y,deferredToNextLaunch:!h&&l?.busy===!0}}async cancel(t){let r=u(t.agentId),n=u(t.sessionId),s=u(t.correlationId);if(s){let a=this.operations.get(s);if(!a||a.status!=="running")return{cancelled:!1,correlationId:s,reason:"operation_not_running"};if(a.agentId!==r||a.sessionId!==n)throw Object.assign(new Error(`runtime operation cancellation identity conflict: ${s}`),{code:"RUNTIME_OPERATION_CORRELATION_CONFLICT"});let c=this.sessions.get(`${r}:${n}`);return!c||c.busy!==!0||c.operationCorrelationId!==s?(this.failOperation(a,Object.assign(new Error("Runtime operation cancelled before dispatch"),{code:"RUNTIME_OPERATION_CANCELLED"})),{cancelled:!0,correlationId:s,reason:"cancelled_before_dispatch"}):(await c.runtime.sessionCancel({sessionId:c.runtimeSessionId}),await this.closeSession(`${r}:${n}`,"cancelled"),{cancelled:!0,correlationId:s})}let i=`${r}:${n}`,o=this.sessions.get(i);return o?(await o.runtime.sessionCancel({sessionId:o.runtimeSessionId}),await this.closeSession(i,"cancelled"),{cancelled:!0}):{cancelled:!1}}async dispatch(t,r={}){let n=u(t.agentId),s=u(t.taskId),i=u(t.executionId);if(!n||!s)throw Object.assign(new Error("agentId and taskId are required"),{status:400,code:"BAD_REQUEST"});let o=u(t.sessionId)||`dispatch-${i||s}`,a=u(t.instructions),c=Lc(t),l=Os(t),{target:p}=this.targetFor(t.targetCode||t.framework),m=[{type:"text",text:["Task dispatch received.",`taskId: ${s}`,i?`executionId: ${i}`:"",a?`instructions: ${a}`:"",c?"orchaContext:":"",c,c?"Use orchaContext as the source of truth for upstream outputs, review reports, artifacts, and workflow metadata.":"","Follow the execution protocol in instructions exactly.","When embedding a generated artifact in final Markdown, use the Orcha artifact placeholder as the link target: orcha-artifact://<fieldKey>/<index>.","Example: use ![illustration](orcha-artifact://image/0) for the first generated image artifact.","Do not use local filesystem paths, file:// URLs, or data: URLs in final Markdown; Orcha replaces artifact placeholders after ingestion.",l?`For decision results, put the raw report between ${rr} and ${nr}.`:"",l?`Then put a JSON object containing _decision between ${sr} and ${ir}.`:"",l?"Do not JSON-escape the report. Keep output out of the CONTROL JSON, and put every protocol marker on its own line.":"",l?`Keep the report within ${Es} Unicode characters so the CONTROL block fits before the output limit.`:"","Return only the final answer required by that protocol.","Do not include process notes, logs, or explanations."].filter(Boolean).join(`
+`)}];return this.prompt({...t,agentId:n,sessionId:o,prompt:m,metadata:Pc(t,p)},r)}async requestPermission({agent:t,runtimeSessionId:r,request:n,emitUpdate:s,maxTimeoutMs:i,signal:o}){let a=le(),l=this.runtimeSessionIndex.get(`${t.agentId}:${r}`)?.sessionId||r||le(),p=R(n?.timeoutMs,this.config.permissionRequestTimeoutMs),m=i?Math.min(p,i):p,f={permissionId:a,agentId:t.agentId,sessionId:l,runtimeSessionId:r,request:d(n)?n:{},status:"pending",createdAt:xt(),expiresAt:new Date(Date.now()+m).toISOString()};return o?.aborted?{permissionId:a,outcome:"cancelled",response:{reason:"runtime turn ended"}}:await new Promise(h=>{let y=(g,E)=>{clearTimeout(x),o?.removeEventListener("abort",T),this.pendingPermissions.delete(a),s?.({sessionId:r,update:{sessionUpdate:"permission_resolved",permissionId:a,outcome:E}}),h(g)},T=()=>y({permissionId:a,outcome:"cancelled",response:{reason:"runtime turn ended"}},"cancelled"),x=setTimeout(()=>y({permissionId:a,outcome:"denied",response:{reason:"permission request timed out"}},"expired"),m);o?.addEventListener("abort",T,{once:!0}),this.pendingPermissions.set(a,{settle:y,permission:f}),s?.({sessionId:r,update:{sessionUpdate:"permission_request",permission:f}})})}async respondPermission(t){let r=u(t.permissionId),n=this.pendingPermissions.get(r),s=u(t.outcome||"approved")||"approved";return n?(n.settle({permissionId:r,outcome:s,response:d(t.response)?t.response:{},userId:u(t.userId),metadata:d(t.metadata)?t.metadata:{}},s),{accepted:!0,permissionId:r,outcome:s}):{accepted:!1,permissionId:r,outcome:s}}health(){return{status:this.config.sandboxRequired&&!this.sandboxCapabilities.dispatchable?"unavailable":"ok",bridgeVersion:K,startedAt:this.startedAt,agents:[...this.agents.values()].map(t=>({agentId:t.agentId,targetCode:t.targetCode,framework:t.framework,runtimeKind:t.runtimeKind})),sessions:this.sessions.size,pendingPermissions:this.pendingPermissions.size,targets:Object.keys(this.targets),sandboxCapabilities:this.sandboxCapabilities}}};import Wc from"node:http";import Xc from"node:https";import{randomBytes as bs}from"node:crypto";var St=1,lt=3,Yc=1e4,fe=class{constructor(t,r={}){this.url=t,this.readyState=0,this.socket=null,this.request=null,this.buffer=Buffer.alloc(0),this.listeners=new Map,this.connectTimeoutMs=Qc(r.connectTimeoutMs,Yc),this.connectTimer=null,this.connect()}addEventListener(t,r){let n=this.listeners.get(t)||new Set;n.add(r),this.listeners.set(t,n)}emit(t,r={}){let n=this.listeners.get(t);if(n)for(let s of n)s(r)}connect(){let t=new URL(this.url),r=t.protocol==="wss:"?Xc:Wc,n=bs(16).toString("base64"),s=r.request({protocol:t.protocol==="wss:"?"https:":"http:",hostname:t.hostname,port:t.port||(t.protocol==="wss:"?443:80),path:`${t.pathname}${t.search}`,method:"GET",headers:{Connection:"Upgrade",Upgrade:"websocket","Sec-WebSocket-Key":n,"Sec-WebSocket-Version":"13"}});this.request=s,this.startConnectTimer(s),s.on("upgrade",(i,o,a)=>{if(this.clearConnectTimer(),this.readyState===lt){o.destroy();return}this.socket=o,this.readyState=St,o.on("data",c=>this.onData(c)),o.on("close",()=>this.onClose()),o.on("error",c=>{this.readyState!==lt&&this.emit("error",{error:c,message:c.message,type:"error"}),this.onClose()}),a?.length&&this.onData(a),this.emit("open")}),s.on("response",i=>{this.clearConnectTimer(),this.emit("error",{message:`websocket upgrade failed: HTTP ${i.statusCode}`,type:"error"}),i.resume(),this.onClose()}),s.on("error",i=>{this.clearConnectTimer(),this.readyState!==lt&&this.emit("error",{error:i,message:i.message,type:"error"}),this.onClose()}),s.end()}startConnectTimer(t){this.connectTimeoutMs<=0||(this.connectTimer=setTimeout(()=>{if(this.readyState===St||this.readyState===lt)return;let r=`websocket connect timeout after ${this.connectTimeoutMs}ms`;this.emit("error",{message:r,type:"timeout"}),this.onClose(),t.destroy(new Error(r))},this.connectTimeoutMs),this.connectTimer.unref?.())}clearConnectTimer(){this.connectTimer&&(clearTimeout(this.connectTimer),this.connectTimer=null)}send(t){!this.socket||this.readyState!==St||this.socket.write(Ur(1,Buffer.from(String(t),"utf8")))}close(){if(this.readyState!==lt){if(this.clearConnectTimer(),!this.socket){this.request?.destroy(),this.onClose();return}try{this.readyState===St&&this.socket.write(Ur(8,Buffer.alloc(0))),this.socket.end()}catch{this.socket.destroy()}this.onClose()}}onClose(){this.readyState!==lt&&(this.clearConnectTimer(),this.readyState=lt,this.request=null,this.emit("close"))}onData(t){for(this.buffer=Buffer.concat([this.buffer,t]);this.buffer.length>=2;){let r=this.buffer[0],n=this.buffer[1],s=r&15,i=(n&128)!==0,o=n&127,a=2;if(o===126){if(this.buffer.length<a+2)return;o=this.buffer.readUInt16BE(a),a+=2}else if(o===127){if(this.buffer.length<a+8)return;let p=this.buffer.readUInt32BE(a),m=this.buffer.readUInt32BE(a+4);o=p*2**32+m,a+=8}let c=a;if(i&&(a+=4),this.buffer.length<a+o)return;let l=this.buffer.subarray(a,a+o);if(i){let p=this.buffer.subarray(c,c+4);l=Buffer.from(l.map((m,f)=>m^p[f%4]))}this.buffer=this.buffer.subarray(a+o),s===1?this.emit("message",{data:l.toString("utf8")}):s===8?this.close():s===9&&this.socket?.write(Ur(10,l))}}};function Qc(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function Ur(e,t){let r=t.length,n=2;r>=126&&r<=65535?n+=2:r>65535&&(n+=8);let s=bs(4),i=Buffer.alloc(n+4+r);i[0]=128|e;let o=2;r<126?i[1]=128|r:r<=65535?(i[1]=254,i.writeUInt16BE(r,o),o+=2):(i[1]=255,i.writeUInt32BE(Math.floor(r/2**32),o),i.writeUInt32BE(r>>>0,o+4),o+=8),s.copy(i,o),o+=4;for(let a=0;a<r;a+=1)i[o+a]=t[a]^s[a%4];return i}function Zc(e){let t=new URL(e);if(t.protocol==="http:")t.protocol="ws:";else if(t.protocol==="https:")t.protocol="wss:";else if(t.protocol!=="ws:"&&t.protocol!=="wss:")throw new Error(`unsupported ORCHA_RUNTIME_ORCHA_URL protocol: ${t.protocol}`);return t.pathname=`${t.pathname.replace(/\/+$/,"")}/api/agent-runtime-bridge/ws`,t.search="",t.toString()}function tu(e,t=!0){return Object.entries(e||{}).map(([r,n])=>({targetCode:r,targetName:u(n?.name||n?.targetName||r),targetType:u(n?.type||"echo"),status:t?"available":"unavailable"}))}var eu=Object.freeze(["health","agents/create","agents/dispatch","sessions/prompt","sessions/policy","sessions/cancel","permissions/respond"]),me=class{constructor(t,r){this.config=t,this.bridge=r,this.ws=null,this.stopped=!1,this.connected=!1,this.reconnectTimer=null,this.heartbeatTimer=null,this.capacityHeartbeatTimer=null,this.bridge.onCapacityChanged=()=>this.scheduleCapacityHeartbeat()}sandboxCapabilities(){return this.bridge.sandboxCapabilities||{dispatchable:this.config.sandboxRequired!==!0,enforced:!1,backend:"development_direct",daemonStatus:"development_only",policySchemaVersions:[1],runtimePolicyUpdates:!0,workspaceSync:!1,egressProxy:!1}}supportedMethods(){return[...eu,...this.config.deviceConnection?["devices/discover","devices/configure"]:[]]}runtimeTargets(){let t=this.sandboxCapabilities().dispatchable===!0;return typeof this.bridge.targetCapacitySnapshot=="function"?this.bridge.targetCapacitySnapshot(t):tu(this.config.targets,t)}start(){this.connect()}stop(){this.stopped=!0,this.reconnectTimer&&clearTimeout(this.reconnectTimer),this.reconnectTimer=null,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.capacityHeartbeatTimer&&clearTimeout(this.capacityHeartbeatTimer),this.capacityHeartbeatTimer=null,this.bridge.onCapacityChanged=null,this.ws?.close()}connect(){if(this.stopped)return;let t=Zc(this.config.orchaUrl),r=new fe(t,{connectTimeoutMs:this.config.connectTimeoutMs});this.ws=r,r.addEventListener("open",()=>{if(this.ws!==r||this.stopped){r.close();return}this.authenticate(r)}),r.addEventListener("message",n=>this.handleMessage(n.data,r)),r.addEventListener("close",()=>this.scheduleReconnect("close",r)),r.addEventListener("error",n=>{_("warn","orcha-client","runtime node websocket error",{error:String(n?.message||n?.type||n)})})}authenticate(t=this.ws){this.send({type:"runtime_node.authenticate",token:this.config.nodeToken,nodeId:this.config.nodeId,nodeName:this.config.nodeName,version:K,protocolVersion:"orcha-runtime-node.v2",defaultTargetCode:this.config.defaultTargetCode,supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()},t)}scheduleReconnect(t,r=this.ws){r&&this.ws!==r||(this.connected=!1,this.heartbeatTimer&&clearInterval(this.heartbeatTimer),this.heartbeatTimer=null,this.capacityHeartbeatTimer&&clearTimeout(this.capacityHeartbeatTimer),this.capacityHeartbeatTimer=null,r&&this.ws===r&&(this.ws=null),!this.stopped&&(this.reconnectTimer||(_("info","orcha-client","runtime node disconnected; reconnect scheduled",{reason:t,reconnectMs:this.config.reconnectMs}),this.reconnectTimer=setTimeout(()=>{this.reconnectTimer=null,this.connect()},this.config.reconnectMs))))}async handleMessage(t,r=this.ws){if(r&&this.ws!==r)return;let n;try{n=JSON.parse(String(t))}catch(s){_("warn","orcha-client","invalid Orcha websocket frame",{error:String(s)});return}if(d(n)){if(n.type==="runtime_node.authenticated"){if(r&&this.ws!==r)return;this.connected=!0,this.startHeartbeat(r),_("info","orcha-client","runtime node authenticated",{nodeId:this.config.nodeId,connectionId:n.connectionId});return}if(n.type==="orcha.runtime.request"){await this.handleRequest(n);return}n.type==="runtime_node.ping"&&this.send({type:"runtime_node.pong",ts:new Date().toISOString(),supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()})}}startHeartbeat(t){this.heartbeatTimer&&clearInterval(this.heartbeatTimer);let r=Math.max(1e3,Number(this.config.heartbeatIntervalMs||15e3)),n=()=>this.sendCapacityHeartbeat(t);n(),this.heartbeatTimer=setInterval(n,r),this.heartbeatTimer.unref?.()}scheduleCapacityHeartbeat(){if(!this.connected||this.capacityHeartbeatTimer)return;let t=Math.max(25,Math.min(1e3,Number(this.config.capacityHeartbeatDebounceMs||100)));this.capacityHeartbeatTimer=setTimeout(()=>{this.capacityHeartbeatTimer=null,this.sendCapacityHeartbeat()},t),this.capacityHeartbeatTimer.unref?.()}sendCapacityHeartbeat(t=this.ws){return this.connected?this.send({type:"runtime_node.heartbeat",ts:new Date().toISOString(),supportedMethods:this.supportedMethods(),sandboxCapabilities:this.sandboxCapabilities(),targets:this.runtimeTargets()},t):!1}async handleRequest(t){let r=u(t.id),n=u(t.method),s=d(t.params)?t.params:{};try{let i=await this.invoke(n,s,r);this.send({type:"orcha.runtime.response",id:r,ok:!0,result:i})}catch(i){this.send({type:"orcha.runtime.response",id:r,ok:!1,error:{code:i.code||"RUNTIME_NODE_ERROR",message:i.message||String(i),...i.detail===void 0?{}:{detail:i.detail}}})}}async invoke(t,r,n){if(t==="devices/discover"&&this.config.deviceConnection)return this.config.deviceConnection.candidates();if(t==="devices/configure"&&this.config.deviceConnection)return this.config.deviceConnection.configure(r,this.bridge);if(t==="health")return this.bridge.health();if(t==="agents/create")return this.bridge.createAgent(r);if(t==="agents/dispatch")return this.bridge.dispatch(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/prompt")return this.bridge.prompt(r,{onUpdate:s=>this.sendUpdate(n,s)});if(t==="sessions/policy")return this.bridge.updatePolicy(r);if(t==="sessions/cancel")return this.bridge.cancel(r);if(t==="permissions/respond")return this.bridge.respondPermission(r);throw Object.assign(new Error(`unsupported Orcha runtime method: ${t}`),{code:"METHOD_NOT_FOUND"})}sendUpdate(t,r){this.send({type:"orcha.runtime.event",requestId:t,eventType:"runtime.update",payload:r})}send(t,r=this.ws){return!r||r!==this.ws||r.readyState!==St?!1:(r.send(JSON.stringify(t)),!0)}};import{createServer as ru}from"node:http";function he(e,t,r){let n=JSON.stringify(r);e.writeHead(t,{"content-type":"application/json; charset=utf-8","content-length":Buffer.byteLength(n)}),e.end(n)}function dt(e={}){return{ok:!0,...e}}function Pr(e,t,r){return{ok:!1,error:{code:e,message:t,...r===void 0?{}:{detail:r}}}}async function Ms(e,t){let r=[],n=0;for await(let i of e){if(n+=i.length,n>t)throw Object.assign(new Error("request body too large"),{status:413,code:"REQUEST_TOO_LARGE"});r.push(i)}if(r.length===0)return{};let s=Buffer.concat(r).toString("utf8");if(!s.trim())return{};try{let i=JSON.parse(s);if(!d(i))throw Object.assign(new Error("JSON body must be an object"),{status:400,code:"BAD_JSON"});return i}catch(i){throw i.status?i:Object.assign(new Error(`invalid JSON body: ${i.message}`),{status:400,code:"BAD_JSON"})}}function Us(e,t){if(!t)return;if((e.headers.authorization||"")!==`Bearer ${t}`)throw Object.assign(new Error("runtime bridge token is invalid"),{status:401,code:"UNAUTHORIZED"})}function Ps(e,t){let r={"GET /health":async()=>dt(t.health()),"POST /agents/create":async n=>dt(await t.createAgent(n)),"POST /agents/dispatch":async n=>dt(await t.dispatch(n)),"POST /sessions/prompt":async n=>dt(await t.prompt(n)),"POST /sessions/cancel":async n=>dt(await t.cancel(n)),"POST /permissions/respond":async n=>dt(await t.respondPermission(n))};return ru(async(n,s)=>{let i=new URL(n.url||"/",`http://${n.headers.host||`${e.host}:${e.port}`}`),o=`${n.method||"GET"} ${i.pathname}`,a=r[o];if(!a){he(s,404,Pr("NOT_FOUND",`No route for ${o}`));return}try{Us(n,e.token);let c=n.method==="GET"?{}:await Ms(n,e.requestLimitBytes);he(s,200,await a(c))}catch(c){let l=c.status||500,p=c.code||"BRIDGE_INTERNAL";he(s,l,Pr(p,c.message||String(c),c.detail))}})}var Bs=cu(import.meta.url),uu=".orcha-runtime-bridge.pid",lu=".orcha-runtime-bridge.log",du=3,pu=36e5,{command:fu,options:js}=gu(process.argv.slice(2));_u(js);Sn();var mu=Rn();await qs(fu,mu,js);async function qs(e,t,r){if(r.url){let s=xe(r.url);r.pidFile||(process.env.ORCHA_RUNTIME_PID_FILE=s.pidFile),r.logFile||(process.env.ORCHA_RUNTIME_LOG_FILE=s.logFile)}let n=()=>["connect","--url",t.orchaUrl,"--foreground"];switch(e){case"connect":if(r.pairCode&&pt(_e(ge())))throw new Error("\u8BBE\u5907\u8FDE\u63A5\u4ECD\u5728\u540E\u53F0\u8FD0\u884C\uFF0C\u8BF7\u5148\u6267\u884C stop --url \u540E\u91CD\u65B0\u914D\u5BF9");await Ht(t,r),r.foreground?await Lr(t):kr(n());return;case"run":case"foreground":r.url&&await Ht(t,r),await Lr(t);return;case"start":if(r.url)return qs("connect",t,r);if(r.foreground){await Lr(t);return}kr();return;case"reload":case"restart":{r.url&&await Ht(t,{url:r.url});let s=Rt(Fs(Bs),".."),i=Rt(s,...Hr(Rt(s,"src","index.js"))?["dist","package"]:[],"openclaw-plugin"),o=await cn(t.targets,i);await vs({quiet:!0}),await o(),kr(r.url?n():void 0);return}case"stop":await vs();return;case"status":hu();return;case"help":case"--help":case"-h":Eu();return;default:throw new Error(`Unknown command: ${e}`)}}async function Lr(e){yu();let t=new pe(e);if(await t.start(),e.mode==="server"){let n=Ps(e,t);ks({bridge:t,server:n}),n.listen(e.port,e.host,()=>{_("info","runtime-bridge","Orcha runtime bridge HTTP server started",{host:e.host,port:e.port,targets:Object.keys(t.targets)})});return}if(!e.orchaUrl)throw new Error("ORCHA_RUNTIME_ORCHA_URL is required in runtime node mode");let r=new me(e,t);ks({bridge:t,client:r}),r.start(),_("info","runtime-bridge","Orcha runtime node started",{nodeId:e.nodeId,nodeName:e.nodeName,orchaUrl:e.orchaUrl,targets:Object.keys(t.targets)})}function ks({bridge:e,client:t,server:r}){let n=!1,s=i=>{if(n)return;n=!0;let o=Number(e?.sessions?.size||0)>0;_("info","runtime-bridge","runtime bridge shutting down",{signal:i});try{t?.stop?.()}catch(a){_("warn","runtime-bridge","runtime client stop failed",{error:String(a)})}Promise.resolve(e?.stop?.(`process_${String(i||"shutdown").toLowerCase()}`)).catch(a=>{_("warn","runtime-bridge","runtime bridge stop failed",{error:String(a)})}).finally(()=>{try{r?.close?.()}catch(a){_("warn","runtime-bridge","runtime server close failed",{error:String(a)})}}),setTimeout(()=>process.exit(0),o?8500:200)};process.once("SIGTERM",()=>s("SIGTERM")),process.once("SIGINT",()=>s("SIGINT"))}function kr(e=["run"]){let t=ge(),r=Gs(),n=_e(t);if(n&&pt(n)){console.log(JSON.stringify({status:"already_running",pid:n,pidFile:t,logFile:r}));return}n&&$r(t),$s(t),$s(r),Dr(r);let s=ou(r,"a"),i={...process.env,ORCHA_RUNTIME_PID_FILE:t,ORCHA_RUNTIME_LOG_FILE:r},o=nu(process.execPath,[Bs,...e,"--pid-file",t,"--log-file",r],{cwd:process.cwd(),detached:!0,env:i,stdio:["ignore",s,s]});o.unref(),su(s),Hs(t,`${o.pid}
+`),console.log(JSON.stringify({status:"started",pid:o.pid,pidFile:t,logFile:r}))}async function vs({quiet:e=!1}={}){let t=ge(),r=_e(t);if(!r){e||console.log(JSON.stringify({status:"not_running",pidFile:t}));return}if(!pt(r)){$r(t),e||console.log(JSON.stringify({status:"not_running",pid:r,pidFile:t}));return}process.kill(r,"SIGTERM"),!await Ds(r,1e4)&&pt(r)&&(process.kill(r,"SIGKILL"),await Ds(r,3e3)),$r(t),e||console.log(JSON.stringify({status:"stopped",pid:r,pidFile:t}))}function hu(){let e=ge(),t=Gs(),r=_e(e),n=!!(r&&pt(r));console.log(JSON.stringify({status:n?"running":"not_running",running:n,pid:n?r:null,pidFile:e,logFile:t}))}function gu(e){let t=[],r={};for(let s=0;s<e.length;s+=1){let i=e[s];i==="--url"?r.url=e[++s]:i==="--pair-code"?r.pairCode=e[++s]:i==="--daemon"?r.daemon=!0:i==="--foreground"?r.foreground=!0:i==="--env-file"?r.envFile=e[++s]:i==="--pid-file"?r.pidFile=e[++s]:i==="--log-file"?r.logFile=e[++s]:t.push(i)}return{command:t[0]||"run",options:r}}function _u(e){e.envFile&&(process.env.ORCHA_RUNTIME_ENV_FILE=e.envFile),e.pidFile&&(process.env.ORCHA_RUNTIME_PID_FILE=e.pidFile),e.logFile&&(process.env.ORCHA_RUNTIME_LOG_FILE=e.logFile)}function ge(){return Rt(process.cwd(),process.env.ORCHA_RUNTIME_PID_FILE||uu)}function Gs(){return Rt(process.cwd(),process.env.ORCHA_RUNTIME_LOG_FILE||lu)}function yu(){let e=process.env.ORCHA_RUNTIME_LOG_FILE;if(!e)return;let t=Ks();if(t<=0)return;let r=Rt(process.cwd(),e);Dr(r,t);let n=wu();n<=0||setInterval(()=>Dr(r,t),n).unref()}function Dr(e,t=Ks()){if(t<=0||!Hr(e))return;let r=0,n="";try{if(r=Ls(e).size,r<=0)return;n=vr(e,"utf8")}catch(l){_("warn","runtime-bridge","runtime log cleanup skipped",{logFile:e,error:String(l)});return}let s=Date.now()-t*24*60*60*1e3,i=n.split(/\r?\n/),o=[],a=0;for(let l of i)l&&(Tu(l,s)?o.push(l):a+=1);if(a===0)return;let c="";try{Ls(e).size>r&&(c=vr(e,"utf8").slice(n.length));let p=[...o,...c.split(/\r?\n/).filter(Boolean)].join(`
+`);Hs(e,p?`${p}
+`:""),_("info","runtime-bridge","runtime log cleanup completed",{logFile:e,retentionDays:t,removed:a})}catch(l){_("warn","runtime-bridge","runtime log cleanup failed",{logFile:e,error:String(l)})}}function Tu(e,t){try{let r=JSON.parse(e);if(!r||typeof r!="object")return!0;let n=typeof r.ts=="string"?Date.parse(r.ts):Number.NaN;return!Number.isFinite(n)||n>=t}catch{return!0}}function Ks(){return zs(process.env.ORCHA_RUNTIME_LOG_RETENTION_DAYS,du)}function wu(){return zs(process.env.ORCHA_RUNTIME_LOG_CLEANUP_INTERVAL_MS,pu)}function zs(e,t){let r=Number.parseInt(String(e??""),10);return Number.isFinite(r)&&r>=0?r:t}function _e(e){if(!Hr(e))return null;let t=Number.parseInt(vr(e,"utf8").trim(),10);return Number.isInteger(t)&&t>0?t:null}function pt(e){if(!Number.isInteger(e)||e<=0)return!1;try{return process.kill(e,0),!0}catch(t){return t?.code==="EPERM"}}async function Ds(e,t){let r=Date.now();for(;Date.now()-r<t;){if(!pt(e))return!0;await new Promise(n=>setTimeout(n,100))}return!pt(e)}function $s(e){iu(Fs(e),{recursive:!0})}function $r(e){try{au(e,{force:!0})}catch{}}function Eu(){console.log(`Usage: orcha-runtime-bridge [command] [options]
 Commands:
   connect             Pair or reconnect this device, then run in the background.

package/openclaw-plugin/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@orcha-ai/openclaw-tools",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "type": "module",
   "private": true,
   "openclaw": { "extensions": ["./index.js"] }

package/package.json CHANGED Viewed

@@ -1,6 +1,6 @@
 {
   "name": "@orcha-ai/runtime-bridge",
-  "version": "0.1.52",
+  "version": "0.1.54",
   "private": false,
   "type": "module",
   "description": "Local Orcha runtime bridge for ACP-compatible agent runtimes.",