@ornexus/neocortex 4.60.73 → 4.60.74

package/packages/client/dist/runner/scheduler.js

@@ -1,995 +1,7 @@
-/**
- * @license FSL-1.1
- * Copyright (c) 2026 OrNexus AI
- *
- * P180.07 -- user-scope scheduler install/start/stop/status/doctor for
- * `neocortex-runner`.
- */
-import { Buffer } from 'node:buffer';
-import { spawnSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { delimiter, dirname, isAbsolute, join, resolve } from 'node:path';
-import { checkRunnerBinaryTrust, resolveTrustedRunnerBinary, } from './binary.js';
-import { deriveProjectIdentity } from './project-identity.js';
-import { executeClosedGitInspection, executeSchedulerManifestWrite, executeSchedulerProcess, } from '../effects/invoke-effect-gateways.js';
-export const SCHEDULER_REASON_CODES = Object.freeze({
-    OK: 'continuity-ok',
-    SCHEDULER_INSTALL_UNSAFE: 'scheduler-install-unsafe',
-    PRIMARY_USER_SCHEDULER_UNAVAILABLE: 'primary-user-scheduler-unavailable',
-    SYSTEMD_USER_BUS_UNAVAILABLE: 'systemd-user-bus-unavailable',
-    CRON_FALLBACK_SELECTED: 'cron-fallback-selected',
-    CRON_FALLBACK_NOT_ALLOWED: 'cron-fallback-primary-scheduler-available',
-    CRON_FALLBACK_NOT_PERMITTED: 'cron-fallback-not-permitted',
-    SCHEDULER_UNAVAILABLE: 'scheduler-unavailable',
-    SCHEDULER_COMMAND_FAILED: 'scheduler-command-failed',
-    RUNNER_BINARY_UNTRUSTED: 'runner-binary-untrusted',
-    LEGACY_GLOBAL_SCHEDULER_DETECTED: 'legacy-global-scheduler-detected',
-    LEGACY_GLOBAL_SCHEDULER_AMBIGUOUS: 'legacy-global-scheduler-ambiguous',
-    LEGACY_GLOBAL_SCHEDULER_OTHER_PROJECT: 'legacy-global-scheduler-other-project',
-});
-export const RUNNER_SCHEDULER_BOOTSTRAP_REASON_CODES = Object.freeze({
-    OK: 'runner-bootstrap-ok',
-    ALREADY_ACTIVE: 'runner-bootstrap-already-active',
-    BINARY_UNAVAILABLE: 'runner-bootstrap-binary-unavailable',
-    INSTALL_FAILED: 'runner-bootstrap-install-failed',
-    START_FAILED: 'runner-bootstrap-start-failed',
-    UNEXPECTED_ERROR: 'runner-bootstrap-unexpected-error',
-});
-/** Request-only observation: never exports subprocess output or scheduler paths. */
-export async function observeRunnerOperationalStatus(command, options = {}) {
-    const report = await runRunnerSchedulerCommand({ ...options, command, trustCheck: false });
-    const operational = Boolean(report.strategy);
-    const knownCodes = new Set(Object.values(SCHEDULER_REASON_CODES));
-    const reasonCodes = unique(report.reasonCodes.filter((code) => knownCodes.has(code) && (report.ok || code !== SCHEDULER_REASON_CODES.OK))).slice(0, 12);
-    return {
-        schemaVersion: 1,
-        command,
-        projectKey: report.identity.projectKey,
-        platform: report.platform,
-        ...(report.capability.primaryStrategy ? { primaryStrategy: report.capability.primaryStrategy } : {}),
-        ...(report.strategy ? { selectedStrategy: report.strategy } : {}),
-        operational,
-        status: !operational ? 'unavailable' : command === 'doctor' ? 'available' : report.ok ? 'active' : 'inactive',
-        reasonCodes,
-        observedAt: new Date().toISOString(),
-        publicSafe: true,
-    };
-}
-const SCHEDULER_NAME_PREFIX = 'neocortex-runner';
-const LEGACY_SYSTEMD_SERVICE_FILE = `${SCHEDULER_NAME_PREFIX}.service`;
-const LEGACY_SYSTEMD_TIMER_FILE = `${SCHEDULER_NAME_PREFIX}.timer`;
-const LEGACY_LAUNCHD_LABEL = 'com.ornexus.neocortex.runner';
-const LEGACY_LAUNCHD_FILE = `${LEGACY_LAUNCHD_LABEL}.plist`;
-const LEGACY_WINDOWS_TASK_NAME = 'NeocortexRunner';
-const LEGACY_WINDOWS_XML_FILE = 'neocortex-runner-task.xml';
-const LEGACY_CRON_FILE = 'runner.cron';
-const DEFAULT_INTERVAL_SECONDS = 60;
-const runnerSchedulerBootstrapCache = new Map();
-export function createRunnerSchedulerIdentity(canonicalProjectRoot) {
-    const safeRoot = safeAbsolutePath(canonicalProjectRoot) ?? resolve(canonicalProjectRoot || '.');
-    const projectIdentity = deriveProjectIdentity(safeRoot);
-    const projectBasename = projectIdentity.projectLabel;
-    const projectKey = projectIdentity.projectId;
-    const serviceBase = `${SCHEDULER_NAME_PREFIX}-${projectKey}`;
-    const launchdLabel = `com.ornexus.neocortex.runner.${projectKey}`;
-    return {
-        projectKey,
-        projectBasename,
-        systemdServiceName: `${serviceBase}.service`,
-        systemdTimerName: `${serviceBase}.timer`,
-        systemdServiceFile: `${serviceBase}.service`,
-        systemdTimerFile: `${serviceBase}.timer`,
-        launchdLabel,
-        launchdFile: `${launchdLabel}.plist`,
-        windowsTaskName: `NeocortexRunner-${projectKey}`,
-        windowsXmlFile: `${serviceBase}-task.xml`,
-        cronFile: `runner-${projectKey}.cron`,
-        cronMarkerStart: `# BEGIN neocortex-runner:${projectKey}`,
-        cronMarkerEnd: `# END neocortex-runner:${projectKey}`,
-        publicSafe: true,
-    };
-}
-export function __resetRunnerSchedulerBootstrapCacheForTests() {
-    runnerSchedulerBootstrapCache.clear();
-}
-export async function ensureRunnerSchedulerBootstrap(options = {}) {
-    const platform = options.platform ?? process.platform;
-    const projectRoot = safeAbsolutePath(options.projectRoot ?? process.cwd()) ?? process.cwd();
-    const identity = createRunnerSchedulerIdentity(projectRoot);
-    const cacheKey = `${platform}:${identity.projectKey}`;
-    const cached = runnerSchedulerBootstrapCache.get(cacheKey);
-    if (cached?.ok) {
-        return {
-            ...cached,
-            attempted: false,
-            installed: false,
-            started: false,
-            cached: true,
-            reasonCodes: unique([...cached.reasonCodes, RUNNER_SCHEDULER_BOOTSTRAP_REASON_CODES.ALREADY_ACTIVE]),
-            publicSummary: 'runner scheduler bootstrap already active for project key.',
-            publicSafe: true,
-        };
-    }
-    try {
-        if (options.effectAuthority) {
-            executeClosedGitInspection(options.effectAuthority, 'git-rev-parse', projectRoot, (profile) => {
-                const inspected = spawnSync(profile.executable, [...profile.argv], {
-                    cwd: profile.cwd,
-                    env: { ...profile.env },
-                    shell: profile.shell,
-                    timeout: profile.timeoutMs,
-                    encoding: 'utf8',
-                    maxBuffer: 64 * 1024,
-                });
-                return {
-                    status: inspected.status,
-                    stdout: inspected.stdout ?? '',
-                    stderr: inspected.stderr ?? '',
-                    projected: false,
-                };
-            }, 'client-preflight');
-        }
-        const resolver = options.binaryResolver ?? resolveTrustedRunnerBinary;
-        const sourceExecutable = safeAbsolutePath(options.executablePath ?? process.argv[1]) ?? process.argv[1];
-        const resolution = resolver({ from: sourceExecutable, platform });
-        if (!resolution.ok) {
-            return bootstrapFailure({
-                projectKey: identity.projectKey,
-                reasonCodes: [RUNNER_SCHEDULER_BOOTSTRAP_REASON_CODES.BINARY_UNAVAILABLE, ...resolution.reasonCodes],
-                publicSummary: 'runner scheduler bootstrap could not resolve a trusted runner binary.',
-            });
-        }
-        const guardedEnv = bootstrapGuardEnv(options.env ?? process.env);
-        const sharedOptions = {
-            ...options,
-            projectRoot,
-            executablePath: resolution.executablePath,
-            platform,
-            env: guardedEnv,
-            binaryResolver: () => resolution,
-        };
-        const install = await runRunnerSchedulerCommand({
-            ...sharedOptions,
-            command: 'install',
-        });
-        if (!install.ok) {
-            return bootstrapFailure({
-                projectKey: identity.projectKey,
-                strategy: install.strategy,
-                reasonCodes: [RUNNER_SCHEDULER_BOOTSTRAP_REASON_CODES.INSTALL_FAILED, ...install.reasonCodes],
-                publicSummary: 'runner scheduler bootstrap install failed.',
-                attempted: true,
-            });
-        }
-        const start = await runRunnerSchedulerCommand({
-            ...sharedOptions,
-            command: 'start',
-        });
-        if (!start.ok) {
-            return bootstrapFailure({
-                projectKey: identity.projectKey,
-                strategy: start.strategy ?? install.strategy,
-                reasonCodes: [RUNNER_SCHEDULER_BOOTSTRAP_REASON_CODES.START_FAILED, ...start.reasonCodes],
-                publicSummary: 'runner scheduler bootstrap start failed.',
-                attempted: true,
-                installed: install.applied || install.ok,
-            });
-        }
-        const result = {
-            ok: true,
-            attempted: true,
-            installed: install.applied || install.ok,
-            started: start.applied || start.ok,
-            cached: false,
-            projectKey: identity.projectKey,
-            strategy: start.strategy ?? install.strategy,
-            reasonCodes: unique([
-                RUNNER_SCHEDULER_BOOTSTRAP_REASON_CODES.OK,
-                ...install.reasonCodes,
-                ...start.reasonCodes,
-            ]),
-            publicSummary: 'runner scheduler bootstrap completed for project key.',
-            publicSafe: true,
-        };
-        runnerSchedulerBootstrapCache.set(cacheKey, result);
-        return result;
-    }
-    catch {
-        return bootstrapFailure({
-            projectKey: identity.projectKey,
-            reasonCodes: [RUNNER_SCHEDULER_BOOTSTRAP_REASON_CODES.UNEXPECTED_ERROR],
-            publicSummary: 'runner scheduler bootstrap stopped unexpectedly.',
-        });
-    }
-}
-function bootstrapFailure(input) {
-    return {
-        ok: false,
-        attempted: input.attempted ?? false,
-        installed: input.installed ?? false,
-        started: false,
-        cached: false,
-        projectKey: input.projectKey,
-        strategy: input.strategy,
-        reasonCodes: unique(input.reasonCodes),
-        publicSummary: input.publicSummary,
-        publicSafe: true,
-    };
-}
-function bootstrapGuardEnv(env) {
-    return {
-        ...env,
-        NEOCORTEX_RUNNER_BOOTSTRAP_IN_PROGRESS: '1',
-        NEOCORTEX_BOOTSTRAP_IN_PROGRESS: '1',
-    };
-}
-export async function runRunnerSchedulerCommand(options) {
-    const env = options.env ?? process.env;
-    const platform = options.platform ?? process.platform;
-    const dryRun = options.dryRun === true;
-    const projectRoot = safeAbsolutePath(options.projectRoot ?? process.cwd());
-    const requestedExecutablePath = safeAbsolutePath(options.executablePath ?? process.argv[1]);
-    const resolvedRunner = resolveSchedulerRunnerCommand(options, requestedExecutablePath, platform);
-    const runnerCommand = resolvedRunner.runnerCommand;
-    const executablePath = runnerCommand?.executablePath ?? requestedExecutablePath;
-    const identity = createRunnerSchedulerIdentity(projectRoot ?? process.cwd());
-    const commandAvailable = options.commandAvailable ?? ((command) => defaultCommandAvailable(command, env));
-    const intervalSeconds = boundedInteger(options.intervalSeconds ?? DEFAULT_INTERVAL_SECONDS, 10, 24 * 60 * 60);
-    const capability = detectSchedulerCapability({
-        platform,
-        env,
-        strategy: options.strategy,
-        allowCronFallback: options.allowCronFallback,
-        commandAvailable,
-        userBusProbe: options.userBusProbe ?? (options.commandAvailable ? () => true : undefined),
-        uid: options.uid,
-    });
-    const trust = evaluateTrust(options, executablePath, resolvedRunner.resolution);
-    const safetyBlockers = [...capability.blockers];
-    if (!projectRoot || !runnerCommand)
-        safetyBlockers.push(SCHEDULER_REASON_CODES.SCHEDULER_INSTALL_UNSAFE);
-    if (!trust.trusted) {
-        const trustReasonCodes = trust.reasonCodes && trust.reasonCodes.length > 0
-            ? trust.reasonCodes
-            : [trust.reasonCode ?? SCHEDULER_REASON_CODES.RUNNER_BINARY_UNTRUSTED];
-        safetyBlockers.push(SCHEDULER_REASON_CODES.SCHEDULER_INSTALL_UNSAFE, SCHEDULER_REASON_CODES.RUNNER_BINARY_UNTRUSTED, ...trustReasonCodes);
-    }
-    const selectedStrategy = capability.selectedStrategy;
-    if (!selectedStrategy)
-        safetyBlockers.push(SCHEDULER_REASON_CODES.SCHEDULER_UNAVAILABLE);
-    const paths = selectedStrategy ? pathsForStrategy(selectedStrategy, env, identity) : undefined;
-    const legacyEntries = selectedStrategy && projectRoot && shouldDiscoverLegacy(options.command)
-        ? detectLegacyManagedEntries({ strategy: selectedStrategy, env, projectRoot })
-        : [];
-    const legacyReasonCodes = legacyEntries.flatMap((entry) => entry.reasonCodes);
-    const blocksMutation = options.command === 'install' || options.command === 'start' || options.command === 'stop';
-    const blocked = blocksMutation && safetyBlockers.length > 0;
-    const reasonCodes = unique([
-        ...capability.reasonCodes,
-        ...safetyBlockers,
-        ...legacyReasonCodes,
-        blocked ? SCHEDULER_REASON_CODES.SCHEDULER_INSTALL_UNSAFE : SCHEDULER_REASON_CODES.OK,
-    ]);
-    if (blocked || !selectedStrategy || !paths || !projectRoot || !runnerCommand) {
-        return {
-            ok: !blocked && Boolean(selectedStrategy),
-            command: options.command,
-            platform,
-            strategy: selectedStrategy,
-            dryRun,
-            manifestPaths: [],
-            manifests: [],
-            identity,
-            legacyEntries,
-            controlCommands: [],
-            uninstallGuidance: selectedStrategy && paths ? uninstallGuidance(selectedStrategy, paths, identity) : [],
-            capability: withSafetyBlockers(capability, safetyBlockers),
-            reasonCodes,
-            applied: false,
-            publicSafe: true,
-        };
-    }
-    const manifests = options.command === 'install'
-        ? renderSchedulerManifests({ strategy: selectedStrategy, paths, projectRoot, executablePath: runnerCommand.command, runnerCommand, intervalSeconds, identity })
-        : [];
-    const controlCommands = controlCommandsForAction(options.command, selectedStrategy, paths, identity, legacyEntries, env);
-    let applied = false;
-    let ok = true;
-    const commandReasonCodes = [];
-    if (options.command === 'install' && !dryRun) {
-        let manifestApplied = false;
-        for (const manifest of manifests) {
-            const writeManifest = () => {
-                mkdirSync(dirname(manifest.path), { recursive: true });
-                writeFileSync(manifest.path, manifest.content, 'utf8');
-            };
-            if (options.effectAuthority) {
-                manifestApplied = executeSchedulerManifestWrite(options.effectAuthority, writeManifest) || manifestApplied;
-            }
-            else {
-                writeManifest();
-                manifestApplied = true;
-            }
-        }
-        applied = manifestApplied;
-    }
-    if (!dryRun && controlCommands.length > 0) {
-        const runner = options.commandRunner ?? defaultCommandRunner;
-        for (const controlCommand of controlCommands) {
-            if (controlCommand.manualOnly)
-                continue;
-            const execution = options.effectAuthority
-                ? executeSchedulerProcess(options.effectAuthority, controlCommand, () => ({ executed: true, result: runner(controlCommand) }), () => ({ executed: false, result: { ok: true, reasonCode: SCHEDULER_REASON_CODES.OK } }))
-                : { executed: true, result: runner(controlCommand) };
-            const result = execution.result;
-            if (!result.ok) {
-                ok = false;
-                commandReasonCodes.push(result.reasonCode ?? SCHEDULER_REASON_CODES.SCHEDULER_COMMAND_FAILED);
-            }
-            else if (execution.executed) {
-                applied = true;
-            }
-        }
-    }
-    return {
-        ok,
-        command: options.command,
-        platform,
-        strategy: selectedStrategy,
-        dryRun,
-        manifestPaths: manifests.map((manifest) => manifest.path),
-        manifests,
-        identity,
-        legacyEntries,
-        controlCommands,
-        uninstallGuidance: [...uninstallGuidance(selectedStrategy, paths, identity), ...legacyRemediationGuidance(selectedStrategy, legacyEntries)],
-        capability: withSafetyBlockers(capability, safetyBlockers),
-        reasonCodes: unique([...reasonCodes, ...commandReasonCodes, ok ? SCHEDULER_REASON_CODES.OK : SCHEDULER_REASON_CODES.SCHEDULER_COMMAND_FAILED]),
-        applied,
-        publicSafe: true,
-    };
-}
-export function detectSchedulerCapability(input = {}) {
-    const env = input.env ?? process.env;
-    const platform = input.platform ?? process.platform;
-    const commandAvailable = input.commandAvailable ?? ((command) => defaultCommandAvailable(command, env));
-    const blockers = unsafeContextBlockers(platform, env, input.uid);
-    const primaryStrategy = primaryStrategyForPlatform(platform);
-    const primaryBinaryAvailable = primaryStrategy ? strategyAvailable(primaryStrategy, commandAvailable) : false;
-    let userBusAvailable = true;
-    if (primaryStrategy === 'systemd-user' && primaryBinaryAvailable) {
-        try {
-            userBusAvailable = (input.userBusProbe ?? defaultUserBusProbe)(env) === true;
-        }
-        catch {
-            userBusAvailable = false;
-        }
-    }
-    const primaryAvailable = primaryBinaryAvailable && userBusAvailable;
-    const cronFallbackAvailable = platform !== 'win32' && commandAvailable('crontab');
-    const allowCronFallback = input.allowCronFallback === true;
-    let selectedStrategy = input.strategy;
-    const reasonCodes = [];
-    if (primaryStrategy === 'systemd-user' && primaryBinaryAvailable && !userBusAvailable) {
-        reasonCodes.push(SCHEDULER_REASON_CODES.SYSTEMD_USER_BUS_UNAVAILABLE);
-    }
-    if (!selectedStrategy) {
-        if (primaryStrategy && primaryAvailable)
-            selectedStrategy = primaryStrategy;
-        else if (allowCronFallback && cronFallbackAvailable) {
-            selectedStrategy = 'cron-fallback';
-            reasonCodes.push(SCHEDULER_REASON_CODES.PRIMARY_USER_SCHEDULER_UNAVAILABLE, SCHEDULER_REASON_CODES.CRON_FALLBACK_SELECTED);
-        }
-    }
-    if (selectedStrategy === 'cron-fallback' && primaryAvailable) {
-        selectedStrategy = undefined;
-        reasonCodes.push(SCHEDULER_REASON_CODES.CRON_FALLBACK_NOT_ALLOWED);
-    }
-    else if (selectedStrategy === 'cron-fallback' && !allowCronFallback) {
-        selectedStrategy = undefined;
-        reasonCodes.push(SCHEDULER_REASON_CODES.CRON_FALLBACK_NOT_PERMITTED);
-    }
-    if (selectedStrategy && (selectedStrategy === primaryStrategy ? !primaryAvailable : !strategyAvailable(selectedStrategy, commandAvailable))) {
-        if (selectedStrategy !== 'cron-fallback' || !cronFallbackAvailable)
-            selectedStrategy = undefined;
-    }
-    if (!selectedStrategy)
-        reasonCodes.push(SCHEDULER_REASON_CODES.SCHEDULER_UNAVAILABLE);
-    if (blockers.length > 0)
-        reasonCodes.push(...blockers);
-    if (reasonCodes.length === 0)
-        reasonCodes.push(SCHEDULER_REASON_CODES.OK);
-    return {
-        platform,
-        primaryStrategy,
-        selectedStrategy,
-        fallbackStrategy: cronFallbackAvailable ? 'cron-fallback' : undefined,
-        primaryAvailable,
-        cronFallbackAvailable,
-        safeToInstall: blockers.length === 0,
-        blockers,
-        reasonCodes: unique(reasonCodes),
-        publicSafe: true,
-    };
-}
-function defaultUserBusProbe(env) {
-    const result = spawnSync('systemctl', ['--user', 'show-environment'], {
-        env, shell: false, stdio: 'ignore', timeout: 2_000, windowsHide: true,
-    });
-    return result.error === undefined && result.status === 0;
-}
-export function renderSchedulerManifests(input) {
-    const identity = input.identity ?? createRunnerSchedulerIdentity(input.projectRoot);
-    const runnerCommand = input.runnerCommand ?? { command: input.executablePath, args: [], executablePath: input.executablePath, publicSafe: true };
-    switch (input.strategy) {
-        case 'systemd-user':
-            return [
-                {
-                    kind: 'systemd-service',
-                    path: input.paths.systemdServicePath,
-                    content: renderSystemdService(runnerCommand, input.projectRoot, identity),
-                    publicSafe: true,
-                },
-                {
-                    kind: 'systemd-timer',
-                    path: input.paths.systemdTimerPath,
-                    content: renderSystemdTimer(input.intervalSeconds, identity),
-                    publicSafe: true,
-                },
-            ];
-        case 'launchd-user':
-            return [{ kind: 'launchd-plist', path: input.paths.launchdPlistPath, content: renderLaunchdPlist(runnerCommand, input.projectRoot, input.intervalSeconds, identity), publicSafe: true }];
-        case 'windows-task-scheduler':
-            return [{ kind: 'windows-task-xml', path: input.paths.windowsTaskXmlPath, content: renderWindowsTaskXml(runnerCommand, input.projectRoot, input.intervalSeconds, identity), publicSafe: true }];
-        case 'cron-fallback':
-            return [{ kind: 'cron-snippet', path: input.paths.cronSnippetPath, content: renderCronSnippet(runnerCommand, input.projectRoot, identity), publicSafe: true }];
-    }
-}
-function pathsForStrategy(strategy, env, identity) {
-    const home = resolveHome(env);
-    const xdgConfig = safeAbsolutePath(env.XDG_CONFIG_HOME) ?? join(home, '.config');
-    const systemdUserDir = join(xdgConfig, 'systemd', 'user');
-    const launchAgentsDir = join(home, 'Library', 'LaunchAgents');
-    const appData = safeAbsolutePath(env.APPDATA) ?? join(safeAbsolutePath(env.USERPROFILE) ?? home, 'AppData', 'Roaming');
-    const windowsDir = join(appData, 'Neocortex', 'Runner');
-    const cronDir = join(xdgConfig, 'neocortex');
-    void strategy;
-    return {
-        systemdServicePath: join(systemdUserDir, identity.systemdServiceFile),
-        systemdTimerPath: join(systemdUserDir, identity.systemdTimerFile),
-        launchdPlistPath: join(launchAgentsDir, identity.launchdFile),
-        windowsTaskXmlPath: join(windowsDir, identity.windowsXmlFile),
-        cronSnippetPath: join(cronDir, identity.cronFile),
-    };
-}
-function legacyPathsForStrategy(strategy, env) {
-    const home = resolveHome(env);
-    const xdgConfig = safeAbsolutePath(env.XDG_CONFIG_HOME) ?? join(home, '.config');
-    const systemdUserDir = join(xdgConfig, 'systemd', 'user');
-    const launchAgentsDir = join(home, 'Library', 'LaunchAgents');
-    const appData = safeAbsolutePath(env.APPDATA) ?? join(safeAbsolutePath(env.USERPROFILE) ?? home, 'AppData', 'Roaming');
-    const windowsDir = join(appData, 'Neocortex', 'Runner');
-    const cronDir = join(xdgConfig, 'neocortex');
-    void strategy;
-    return {
-        systemdServicePath: join(systemdUserDir, LEGACY_SYSTEMD_SERVICE_FILE),
-        systemdTimerPath: join(systemdUserDir, LEGACY_SYSTEMD_TIMER_FILE),
-        launchdPlistPath: join(launchAgentsDir, LEGACY_LAUNCHD_FILE),
-        windowsTaskXmlPath: join(windowsDir, LEGACY_WINDOWS_XML_FILE),
-        cronSnippetPath: join(cronDir, LEGACY_CRON_FILE),
-    };
-}
-function controlCommandsForAction(command, strategy, paths, identity, legacyEntries, env) {
-    if (command === 'doctor')
-        return [];
-    const scopedCommands = command === 'install'
-        ? installCommands(strategy, paths, identity)
-        : command === 'start'
-            ? startCommands(strategy, paths, identity)
-            : command === 'stop'
-                ? stopCommands(strategy, paths, identity)
-                : statusCommands(strategy, paths, identity);
-    return [...scopedCommands, ...legacyControlCommandsForAction(command, strategy, legacyEntries, env)];
-}
-function installCommands(strategy, paths, identity) {
-    switch (strategy) {
-        case 'systemd-user':
-            return [control('systemctl', ['--user', 'daemon-reload']), control('systemctl', ['--user', 'enable', '--now', identity.systemdTimerName])];
-        case 'launchd-user':
-            return [control('launchctl', ['load', '-w', paths.launchdPlistPath])];
-        case 'windows-task-scheduler':
-            return [control('schtasks', ['/Create', '/TN', identity.windowsTaskName, '/XML', paths.windowsTaskXmlPath, '/F'])];
-        case 'cron-fallback':
-            return [control('crontab', ['-l', '# append snippet from', paths.cronSnippetPath], true)];
-    }
-}
-function startCommands(strategy, paths, identity) {
-    switch (strategy) {
-        case 'systemd-user':
-            return [control('systemctl', ['--user', 'start', identity.systemdTimerName])];
-        case 'launchd-user':
-            return [control('launchctl', ['load', '-w', paths.launchdPlistPath])];
-        case 'windows-task-scheduler':
-            return [control('schtasks', ['/Run', '/TN', identity.windowsTaskName])];
-        case 'cron-fallback':
-            return [control('crontab', ['-l', '# ensure snippet from', paths.cronSnippetPath, 'is installed'], true)];
-    }
-}
-function stopCommands(strategy, paths, identity) {
-    switch (strategy) {
-        case 'systemd-user':
-            return [control('systemctl', ['--user', 'stop', identity.systemdTimerName])];
-        case 'launchd-user':
-            return [control('launchctl', ['unload', '-w', paths.launchdPlistPath])];
-        case 'windows-task-scheduler':
-            return [control('schtasks', ['/End', '/TN', identity.windowsTaskName])];
-        case 'cron-fallback':
-            return [control('crontab', ['-l', '# remove scoped neocortex-runner snippet'], true)];
-    }
-}
-function statusCommands(strategy, paths, identity) {
-    switch (strategy) {
-        case 'systemd-user':
-            return [control('systemctl', ['--user', 'status', identity.systemdTimerName, '--no-pager'])];
-        case 'launchd-user':
-            return [control('launchctl', ['list', identity.launchdLabel])];
-        case 'windows-task-scheduler':
-            return [control('schtasks', ['/Query', '/TN', identity.windowsTaskName, '/FO', 'LIST'])];
-        case 'cron-fallback':
-            return [control('crontab', ['-l', '# look for neocortex-runner snippet from', paths.cronSnippetPath], true)];
-    }
-}
-function uninstallGuidance(strategy, paths, identity) {
-    switch (strategy) {
-        case 'systemd-user':
-            return [
-                `systemctl --user disable --now ${identity.systemdTimerName}`,
-                `rm ${paths.systemdServicePath}`,
-                `rm ${paths.systemdTimerPath}`,
-            ];
-        case 'launchd-user':
-            return [`launchctl unload -w ${paths.launchdPlistPath}`, `rm ${paths.launchdPlistPath}`];
-        case 'windows-task-scheduler':
-            return [`schtasks /Delete /TN ${identity.windowsTaskName} /F`, `Remove-Item ${paths.windowsTaskXmlPath}`];
-        case 'cron-fallback':
-            return [`Remove the ${identity.cronMarkerStart} block from the user crontab.`, `rm ${paths.cronSnippetPath}`];
-    }
-}
-function legacyControlCommandsForAction(command, strategy, entries, env) {
-    const hasCurrentProjectLegacy = entries.some((entry) => entry.relation === 'current-project');
-    if (!hasCurrentProjectLegacy || (command !== 'status' && command !== 'stop'))
-        return [];
-    const paths = legacyPathsForStrategy(strategy, env);
-    return command === 'status' ? legacyStatusCommands(strategy, paths) : legacyStopCommands(strategy, paths);
-}
-function legacyStatusCommands(strategy, paths) {
-    switch (strategy) {
-        case 'systemd-user':
-            return [control('systemctl', ['--user', 'status', LEGACY_SYSTEMD_TIMER_FILE, '--no-pager'])];
-        case 'launchd-user':
-            return [control('launchctl', ['list', LEGACY_LAUNCHD_LABEL])];
-        case 'windows-task-scheduler':
-            return [control('schtasks', ['/Query', '/TN', LEGACY_WINDOWS_TASK_NAME, '/FO', 'LIST'])];
-        case 'cron-fallback':
-            return [control('crontab', ['-l', '# look for legacy neocortex-runner snippet from', paths.cronSnippetPath], true)];
-    }
-}
-function legacyStopCommands(strategy, paths) {
-    switch (strategy) {
-        case 'systemd-user':
-            return [control('systemctl', ['--user', 'stop', LEGACY_SYSTEMD_TIMER_FILE])];
-        case 'launchd-user':
-            return [control('launchctl', ['unload', '-w', paths.launchdPlistPath])];
-        case 'windows-task-scheduler':
-            return [control('schtasks', ['/End', '/TN', LEGACY_WINDOWS_TASK_NAME])];
-        case 'cron-fallback':
-            return [control('crontab', ['-l', '# remove legacy neocortex-runner snippet'], true)];
-    }
-}
-function legacyRemediationGuidance(strategy, entries) {
-    if (entries.length === 0)
-        return [];
-    const current = entries.filter((entry) => entry.relation === 'current-project');
-    const ambiguous = entries.filter((entry) => entry.relation === 'ambiguous');
-    const otherProject = entries.filter((entry) => entry.relation === 'other-project');
-    const guidance = [];
-    if (current.length > 0)
-        guidance.push(`Legacy global ${strategy} scheduler matches this project; stop it before relying on project-scoped runner scheduling.`);
-    if (ambiguous.length > 0)
-        guidance.push(`Legacy global ${strategy} scheduler ownership is ambiguous; inspect it manually before removal.`);
-    if (otherProject.length > 0)
-        guidance.push(`Legacy global ${strategy} scheduler appears to belong to another project; leave it unchanged.`);
-    return guidance;
-}
-function renderSystemdService(runnerCommand, projectRoot, identity) {
-    const commandLine = [...systemdRunnerCommand(runnerCommand), 'tick', '--project-root', projectRoot, '--scheduled']
-        .map(systemdQuote)
-        .join(' ');
-    return [
-        '[Unit]',
-        `Description=Neocortex Enterprise Continuity Runner (${identity.projectKey}, user scope)`,
-        `# Managed by Neocortex runner for project ${identity.projectKey}`,
-        'After=network-online.target',
-        '',
-        '[Service]',
-        'Type=oneshot',
-        `WorkingDirectory=${systemdPathSettingValue(projectRoot)}`,
-        `ExecStart=${commandLine}`,
-        '',
-        '[Install]',
-        'WantedBy=default.target',
-        '',
-    ].join('\n');
-}
-function systemdRunnerCommand(runnerCommand) {
-    const nodeExecutable = safeAbsolutePath(process.execPath);
-    if (!nodeExecutable || runnerCommand.command === nodeExecutable)
-        return [runnerCommand.command, ...runnerCommand.args];
-    return [nodeExecutable, runnerCommand.command, ...runnerCommand.args];
-}
-function renderSystemdTimer(intervalSeconds, identity) {
-    return [
-        '[Unit]',
-        `Description=Run Neocortex Enterprise Continuity Runner periodically (${identity.projectKey}, user scope)`,
-        `# Managed by Neocortex runner for project ${identity.projectKey}`,
-        '',
-        '[Timer]',
-        'OnBootSec=60s',
-        `OnUnitActiveSec=${intervalSeconds}s`,
-        `Unit=${identity.systemdServiceName}`,
-        '',
-        '[Install]',
-        'WantedBy=timers.target',
-        '',
-    ].join('\n');
-}
-function renderLaunchdPlist(runnerCommand, projectRoot, intervalSeconds, identity) {
-    const args = [runnerCommand.command, ...runnerCommand.args, 'tick', '--project-root', projectRoot, '--scheduled'];
-    return [
-        '<?xml version="1.0" encoding="UTF-8"?>',
-        '<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">',
-        '<plist version="1.0">',
-        '<dict>',
-        `  <!-- Managed by Neocortex runner for project ${xmlEscape(identity.projectKey)} -->`,
-        '  <key>Label</key>',
-        `  <string>${xmlEscape(identity.launchdLabel)}</string>`,
-        '  <key>ProgramArguments</key>',
-        '  <array>',
-        ...args.map((arg) => `    <string>${xmlEscape(arg)}</string>`),
-        '  </array>',
-        '  <key>WorkingDirectory</key>',
-        `  <string>${xmlEscape(projectRoot)}</string>`,
-        '  <key>StartInterval</key>',
-        `  <integer>${intervalSeconds}</integer>`,
-        '  <key>RunAtLoad</key>',
-        '  <true/>',
-        '</dict>',
-        '</plist>',
-        '',
-    ].join('\n');
-}
-function renderWindowsTaskXml(runnerCommand, projectRoot, intervalSeconds, identity) {
-    const args = [...runnerCommand.args, 'tick', '--project-root', projectRoot, '--scheduled'].map(windowsQuote).join(' ');
-    return [
-        '<?xml version="1.0" encoding="UTF-16"?>',
-        '<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">',
-        '  <RegistrationInfo>',
-        `    <Description>Neocortex Enterprise Continuity Runner (${xmlEscape(identity.projectKey)}, user scope)</Description>`,
-        '  </RegistrationInfo>',
-        '  <Triggers>',
-        '    <TimeTrigger>',
-        '      <Repetition>',
-        `        <Interval>PT${intervalSeconds}S</Interval>`,
-        '        <StopAtDurationEnd>false</StopAtDurationEnd>',
-        '      </Repetition>',
-        '      <Enabled>true</Enabled>',
-        '    </TimeTrigger>',
-        '  </Triggers>',
-        '  <Principals>',
-        '    <Principal id="Author">',
-        '      <LogonType>InteractiveToken</LogonType>',
-        '      <RunLevel>LeastPrivilege</RunLevel>',
-        '    </Principal>',
-        '  </Principals>',
-        '  <Settings>',
-        '    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>',
-        '    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>',
-        '    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>',
-        '    <Enabled>true</Enabled>',
-        '  </Settings>',
-        '  <Actions Context="Author">',
-        '    <Exec>',
-        `      <Command>${xmlEscape(runnerCommand.command)}</Command>`,
-        `      <Arguments>${xmlEscape(args)}</Arguments>`,
-        `      <WorkingDirectory>${xmlEscape(projectRoot)}</WorkingDirectory>`,
-        '    </Exec>',
-        '  </Actions>',
-        '</Task>',
-        '',
-    ].join('\n');
-}
-function renderCronSnippet(runnerCommand, projectRoot, identity) {
-    const commandLine = [runnerCommand.command, ...runnerCommand.args, 'tick', '--project-root', projectRoot, '--scheduled']
-        .map(shellQuote)
-        .join(' ');
-    return [
-        identity.cronMarkerStart,
-        `# neocortex-runner user-scope cron fallback for project ${identity.projectKey}`,
-        '# Reason: primary-user-scheduler-unavailable',
-        `* * * * * ${commandLine} # neocortex-runner:${identity.projectKey}`,
-        identity.cronMarkerEnd,
-        '',
-    ].join('\n');
-}
-function shouldDiscoverLegacy(command) {
-    return command === 'status' || command === 'stop' || command === 'doctor';
-}
-function detectLegacyManagedEntries(input) {
-    const paths = legacyPathsForStrategy(input.strategy, input.env);
-    switch (input.strategy) {
-        case 'systemd-user': {
-            const serviceContent = readOptional(paths.systemdServicePath);
-            const timerContent = readOptional(paths.systemdTimerPath);
-            const serviceManaged = serviceContent ? looksLikeManagedLegacy(serviceContent) : false;
-            const timerManaged = timerContent ? looksLikeLegacySystemdTimer(timerContent) : false;
-            if (!serviceManaged && !timerManaged)
-                return [];
-            const relation = classifyLegacyRelation([serviceContent, timerContent].filter(Boolean).join('\n'), input.projectRoot, serviceManaged);
-            return [legacyEntry(input.strategy, 'systemd-timer', LEGACY_SYSTEMD_TIMER_FILE, relation)];
-        }
-        case 'launchd-user': {
-            const content = readOptional(paths.launchdPlistPath);
-            if (!content || !looksLikeManagedLegacy(content))
-                return [];
-            return [legacyEntry(input.strategy, 'launchd-plist', LEGACY_LAUNCHD_LABEL, classifyLegacyRelation(content, input.projectRoot, true))];
-        }
-        case 'windows-task-scheduler': {
-            const content = readOptional(paths.windowsTaskXmlPath);
-            if (!content || !looksLikeManagedLegacy(content))
-                return [];
-            return [legacyEntry(input.strategy, 'windows-task-xml', LEGACY_WINDOWS_TASK_NAME, classifyLegacyRelation(content, input.projectRoot, true))];
-        }
-        case 'cron-fallback': {
-            const content = readOptional(paths.cronSnippetPath);
-            if (!content || !looksLikeManagedLegacy(content))
-                return [];
-            return [legacyEntry(input.strategy, 'cron-snippet', '# neocortex-runner', classifyLegacyRelation(content, input.projectRoot, true))];
-        }
-    }
-}
-function legacyEntry(strategy, kind, name, relation) {
-    const reasonCode = relation === 'current-project'
-        ? SCHEDULER_REASON_CODES.LEGACY_GLOBAL_SCHEDULER_DETECTED
-        : relation === 'ambiguous'
-            ? SCHEDULER_REASON_CODES.LEGACY_GLOBAL_SCHEDULER_AMBIGUOUS
-            : SCHEDULER_REASON_CODES.LEGACY_GLOBAL_SCHEDULER_OTHER_PROJECT;
-    return {
-        strategy,
-        kind,
-        name,
-        relation,
-        reasonCodes: [reasonCode],
-        remediation: relation === 'current-project' ? 'stop-safe' : relation === 'ambiguous' ? 'manual-review-only' : 'report-only',
-        publicSafe: true,
-    };
-}
-function classifyLegacyRelation(content, projectRoot, managedWithRootHint) {
-    if (containsCurrentProjectRoot(content, projectRoot))
-        return 'current-project';
-    if (managedWithRootHint && /--project-root|WorkingDirectory=|<key>WorkingDirectory<\/key>|<Arguments>[^<]*--project-root/i.test(content))
-        return 'other-project';
-    return 'ambiguous';
-}
-function containsCurrentProjectRoot(content, projectRoot) {
-    const candidates = unique([
-        projectRoot,
-        systemdQuote(projectRoot),
-        legacySystemdQuote(projectRoot),
-        systemdPathSettingValue(projectRoot),
-        legacySystemdPathValue(projectRoot),
-        shellQuote(projectRoot),
-        windowsQuote(projectRoot),
-        xmlEscape(projectRoot),
-    ].filter(Boolean));
-    return candidates.some((candidate) => content.includes(candidate));
-}
-function looksLikeManagedLegacy(content) {
-    return /neocortex-runner|com\.ornexus\.neocortex\.runner|NeocortexRunner|Neocortex Enterprise Continuity Runner/i.test(content)
-        && /tick|--project-root|StartInterval|OnUnitActiveSec|InteractiveToken|primary-user-scheduler-unavailable/i.test(content);
-}
-function looksLikeLegacySystemdTimer(content) {
-    return /neocortex-runner\.service|Neocortex Enterprise Continuity Runner|OnUnitActiveSec/i.test(content);
-}
-function readOptional(path) {
-    try {
-        return readFileSync(path, 'utf8');
-    }
-    catch {
-        return null;
-    }
-}
-function primaryStrategyForPlatform(platform) {
-    if (platform === 'linux')
-        return 'systemd-user';
-    if (platform === 'darwin')
-        return 'launchd-user';
-    if (platform === 'win32')
-        return 'windows-task-scheduler';
-    return undefined;
-}
-function strategyAvailable(strategy, commandAvailable) {
-    switch (strategy) {
-        case 'systemd-user': return commandAvailable('systemctl');
-        case 'launchd-user': return commandAvailable('launchctl');
-        case 'windows-task-scheduler': return commandAvailable('schtasks') || commandAvailable('schtasks.exe');
-        case 'cron-fallback': return commandAvailable('crontab');
-    }
-}
-function unsafeContextBlockers(platform, env, uid) {
-    const blockers = [];
-    const effectiveUid = uid ?? (typeof process.getuid === 'function' ? process.getuid() : null);
-    if (platform !== 'win32' && effectiveUid === 0)
-        blockers.push(SCHEDULER_REASON_CODES.SCHEDULER_INSTALL_UNSAFE);
-    if (platform !== 'win32' && (env.SUDO_USER || env.SUDO_UID || env.SUDO_COMMAND))
-        blockers.push(SCHEDULER_REASON_CODES.SCHEDULER_INSTALL_UNSAFE);
-    const declaredHome = env.HOME ?? env.USERPROFILE;
-    if (!declaredHome || !isAbsolute(declaredHome) || !safeAbsolutePath(declaredHome))
-        blockers.push(SCHEDULER_REASON_CODES.SCHEDULER_INSTALL_UNSAFE);
-    return unique(blockers);
-}
-function resolveSchedulerRunnerCommand(options, executablePath, platform) {
-    if (options.trustCheck === false || options.trustChecker) {
-        return {
-            runnerCommand: executablePath ? { command: executablePath, args: [], executablePath, publicSafe: true } : undefined,
-        };
-    }
-    const resolver = options.binaryResolver ?? resolveTrustedRunnerBinary;
-    const resolution = resolver({ from: executablePath ?? process.argv[1], platform });
-    if (resolution.ok) {
-        return {
-            runnerCommand: {
-                command: resolution.command,
-                args: resolution.args,
-                executablePath: resolution.executablePath,
-                provenance: resolution.provenance,
-                publicSafe: true,
-            },
-            resolution,
-        };
-    }
-    return {
-        runnerCommand: executablePath ? { command: executablePath, args: [], executablePath, provenance: resolution.provenance, publicSafe: true } : undefined,
-        resolution,
-    };
-}
-function evaluateTrust(options, executablePath, resolution) {
-    if (options.trustCheck === false)
-        return { trusted: true, executablePath: executablePath ?? undefined, publicSafe: true };
-    if (options.trustChecker)
-        return options.trustChecker(executablePath ?? undefined);
-    if (resolution)
-        return resolution.ok ? {
-            trusted: true,
-            packageName: resolution.packageName,
-            packageVersion: resolution.packageVersion,
-            packageRoot: resolution.packageRoot,
-            executablePath: resolution.executablePath,
-            expectedRelativePath: resolution.expectedRelativePath,
-            provenance: resolution.provenance,
-            reasonCodes: resolution.reasonCodes,
-            publicSafe: true,
-        } : {
-            trusted: false,
-            reasonCode: resolution.reasonCode,
-            reasonCodes: resolution.reasonCodes,
-            packageName: resolution.packageName,
-            packageVersion: resolution.packageVersion,
-            packageRoot: resolution.packageRoot,
-            executablePath: resolution.executablePath ?? executablePath ?? undefined,
-            expectedRelativePath: resolution.expectedRelativePath,
-            provenance: resolution.provenance,
-            publicSafe: true,
-        };
-    return checkRunnerBinaryTrust(executablePath ?? undefined);
-}
-function resolveHome(env) {
-    return env.HOME ?? env.USERPROFILE ?? process.env.HOME ?? process.cwd();
-}
-function safeAbsolutePath(value) {
-    if (!value || /[\r\n\0]/.test(value))
-        return null;
-    const resolved = isAbsolute(value) ? value : resolve(value);
-    return isAbsolute(resolved) ? resolved : null;
-}
-function control(command, args, manualOnly = false) {
-    return { command, args, preview: [command, ...args.map(shellQuote)].join(' '), safeUserScope: true, ...(manualOnly ? { manualOnly: true } : {}) };
-}
-function defaultCommandRunner(command) {
-    const result = spawnSync(command.command, [...command.args], { stdio: 'ignore', shell: false, timeout: 3_000, windowsHide: true });
-    return {
-        ok: result.status === 0,
-        code: result.status,
-        signal: result.signal,
-        reasonCode: result.status === 0 ? SCHEDULER_REASON_CODES.OK : SCHEDULER_REASON_CODES.SCHEDULER_COMMAND_FAILED,
-    };
-}
-function defaultCommandAvailable(command, env) {
-    const pathValue = env.PATH ?? process.env.PATH ?? '';
-    const pathExt = (env.PATHEXT ?? '.EXE;.CMD;.BAT;.COM').split(';').filter(Boolean);
-    const candidates = pathValue.split(delimiter).filter(Boolean);
-    for (const directory of candidates) {
-        const direct = join(directory, command);
-        if (existsSync(direct))
-            return true;
-        for (const extension of pathExt) {
-            if (existsSync(join(directory, `${command}${extension.toLowerCase()}`)) || existsSync(join(directory, `${command}${extension.toUpperCase()}`)))
-                return true;
-        }
-    }
-    return false;
-}
-function withSafetyBlockers(capability, blockers) {
-    const mergedBlockers = unique([...capability.blockers, ...blockers]);
-    return {
-        ...capability,
-        safeToInstall: mergedBlockers.length === 0,
-        blockers: mergedBlockers,
-        reasonCodes: unique([...capability.reasonCodes, ...mergedBlockers]),
-    };
-}
-function systemdQuote(value) {
-    return systemdArgValue(value, true);
-}
-function legacySystemdQuote(value) {
-    return systemdArgValue(value, false);
-}
-function systemdArgValue(value, escapePercent) {
-    const escaped = value
-        .replace(/\\/g, '\\\\')
-        .replace(/"/g, '\\"')
-        .replace(/%/g, escapePercent ? '%%' : '%');
-    if (!/[\s"'\\]/.test(value))
-        return escaped;
-    return `"${escaped}"`;
-}
-function systemdPathSettingValue(value) {
-    // systemd path settings are not argv tokens and must not use unit-name
-    // \xNN escaping. Preserve literal path characters and only escape percent
-    // specifiers by doubling them.
-    return value.replace(/%/g, '%%');
-}
-function legacySystemdPathValue(value) {
-    return Array.from(value, (char) => {
-        if (/^[A-Za-z0-9_./:@+=,-]$/.test(char))
-            return char;
-        if (char === '%')
-            return '%%';
-        return Array.from(Buffer.from(char, 'utf8'), (byte) => `\\x${byte.toString(16).padStart(2, '0')}`).join('');
-    }).join('');
-}
-function shellQuote(value) {
-    if (/^[A-Za-z0-9_./:=@%+-]+$/.test(value))
-        return value;
-    return `'${value.replace(/'/g, `'\\''`)}'`;
-}
-function windowsQuote(value) {
-    if (!/[\s"]/.test(value))
-        return value;
-    return `"${value.replace(/"/g, '\\"')}"`;
-}
-function xmlEscape(value) {
-    return value
-        .replace(/&/g, '&amp;')
-        .replace(/</g, '&lt;')
-        .replace(/>/g, '&gt;')
-        .replace(/"/g, '&quot;')
-        .replace(/'/g, '&apos;');
-}
-function boundedInteger(value, min, max) {
-    if (!Number.isFinite(value))
-        return min;
-    return Math.max(min, Math.min(max, Math.floor(value)));
-}
-function unique(values) {
-    return Array.from(new Set(values));
-}
+import{Buffer as de}from"node:buffer";import{spawnSync as F}from"node:child_process";import{existsSync as $,mkdirSync as me,readFileSync as fe,writeFileSync as pe}from"node:fs";import{delimiter as he,dirname as ye,isAbsolute as M,join as l,resolve as J}from"node:path";import{checkRunnerBinaryTrust as Ee,resolveTrustedRunnerBinary as Z}from"./binary.js";import{deriveProjectIdentity as Se}from"./project-identity.js";import{executeClosedGitInspection as ge,executeSchedulerManifestWrite as Ae,executeSchedulerProcess as Ce}from"../effects/invoke-effect-gateways.js";const c=Object.freeze({OK:"continuity-ok",SCHEDULER_INSTALL_UNSAFE:"scheduler-install-unsafe",PRIMARY_USER_SCHEDULER_UNAVAILABLE:"primary-user-scheduler-unavailable",SYSTEMD_USER_BUS_UNAVAILABLE:"systemd-user-bus-unavailable",CRON_FALLBACK_SELECTED:"cron-fallback-selected",CRON_FALLBACK_NOT_ALLOWED:"cron-fallback-primary-scheduler-available",CRON_FALLBACK_NOT_PERMITTED:"cron-fallback-not-permitted",SCHEDULER_UNAVAILABLE:"scheduler-unavailable",SCHEDULER_COMMAND_FAILED:"scheduler-command-failed",RUNNER_BINARY_UNTRUSTED:"runner-binary-untrusted",LEGACY_GLOBAL_SCHEDULER_DETECTED:"legacy-global-scheduler-detected",LEGACY_GLOBAL_SCHEDULER_AMBIGUOUS:"legacy-global-scheduler-ambiguous",LEGACY_GLOBAL_SCHEDULER_OTHER_PROJECT:"legacy-global-scheduler-other-project"}),R=Object.freeze({OK:"runner-bootstrap-ok",ALREADY_ACTIVE:"runner-bootstrap-already-active",BINARY_UNAVAILABLE:"runner-bootstrap-binary-unavailable",INSTALL_FAILED:"runner-bootstrap-install-failed",START_FAILED:"runner-bootstrap-start-failed",UNEXPECTED_ERROR:"runner-bootstrap-unexpected-error"});async function ft(e,t={}){const r=await X({...t,command:e,trustCheck:!1}),n=!!r.strategy,s=new Set(Object.values(c)),a=g(r.reasonCodes.filter(o=>s.has(o)&&(r.ok||o!==c.OK))).slice(0,12);return{schemaVersion:1,command:e,projectKey:r.identity.projectKey,platform:r.platform,...r.capability.primaryStrategy?{primaryStrategy:r.capability.primaryStrategy}:{},...r.strategy?{selectedStrategy:r.strategy}:{},operational:n,status:n?e==="doctor"?"available":r.ok?"active":"inactive":"unavailable",reasonCodes:a,observedAt:new Date().toISOString(),publicSafe:!0}}const H="neocortex-runner",be=`${H}.service`,N=`${H}.timer`,K="com.ornexus.neocortex.runner",Le=`${K}.plist`,G="NeocortexRunner",ke="neocortex-runner-task.xml",Re="runner.cron",_e=60,Y=new Map;function V(e){const t=S(e)??J(e||"."),r=Se(t),n=r.projectLabel,s=r.projectId,a=`${H}-${s}`,o=`com.ornexus.neocortex.runner.${s}`;return{projectKey:s,projectBasename:n,systemdServiceName:`${a}.service`,systemdTimerName:`${a}.timer`,systemdServiceFile:`${a}.service`,systemdTimerFile:`${a}.timer`,launchdLabel:o,launchdFile:`${o}.plist`,windowsTaskName:`NeocortexRunner-${s}`,windowsXmlFile:`${a}-task.xml`,cronFile:`runner-${s}.cron`,cronMarkerStart:`# BEGIN neocortex-runner:${s}`,cronMarkerEnd:`# END neocortex-runner:${s}`,publicSafe:!0}}function pt(){Y.clear()}async function ht(e={}){const t=e.platform??process.platform,r=S(e.projectRoot??process.cwd())??process.cwd(),n=V(r),s=`${t}:${n.projectKey}`,a=Y.get(s);if(a?.ok)return{...a,attempted:!1,installed:!1,started:!1,cached:!0,reasonCodes:g([...a.reasonCodes,R.ALREADY_ACTIVE]),publicSummary:"runner scheduler bootstrap already active for project key.",publicSafe:!0};try{e.effectAuthority&&ge(e.effectAuthority,"git-rev-parse",r,E=>{const f=F(E.executable,[...E.argv],{cwd:E.cwd,env:{...E.env},shell:E.shell,timeout:E.timeoutMs,encoding:"utf8",maxBuffer:65536});return{status:f.status,stdout:f.stdout??"",stderr:f.stderr??"",projected:!1}},"client-preflight");const o=e.binaryResolver??Z,m=S(e.executablePath??process.argv[1])??process.argv[1],h=o({from:m,platform:t});if(!h.ok)return P({projectKey:n.projectKey,reasonCodes:[R.BINARY_UNAVAILABLE,...h.reasonCodes],publicSummary:"runner scheduler bootstrap could not resolve a trusted runner binary."});const p=Te(e.env??process.env),L={...e,projectRoot:r,executablePath:h.executablePath,platform:t,env:p,binaryResolver:()=>h},u=await X({...L,command:"install"});if(!u.ok)return P({projectKey:n.projectKey,strategy:u.strategy,reasonCodes:[R.INSTALL_FAILED,...u.reasonCodes],publicSummary:"runner scheduler bootstrap install failed.",attempted:!0});const d=await X({...L,command:"start"});if(!d.ok)return P({projectKey:n.projectKey,strategy:d.strategy??u.strategy,reasonCodes:[R.START_FAILED,...d.reasonCodes],publicSummary:"runner scheduler bootstrap start failed.",attempted:!0,installed:u.applied||u.ok});const A={ok:!0,attempted:!0,installed:u.applied||u.ok,started:d.applied||d.ok,cached:!1,projectKey:n.projectKey,strategy:d.strategy??u.strategy,reasonCodes:g([R.OK,...u.reasonCodes,...d.reasonCodes]),publicSummary:"runner scheduler bootstrap completed for project key.",publicSafe:!0};return Y.set(s,A),A}catch{return P({projectKey:n.projectKey,reasonCodes:[R.UNEXPECTED_ERROR],publicSummary:"runner scheduler bootstrap stopped unexpectedly."})}}function P(e){return{ok:!1,attempted:e.attempted??!1,installed:e.installed??!1,started:!1,cached:!1,projectKey:e.projectKey,strategy:e.strategy,reasonCodes:g(e.reasonCodes),publicSummary:e.publicSummary,publicSafe:!0}}function Te(e){return{...e,NEOCORTEX_RUNNER_BOOTSTRAP_IN_PROGRESS:"1",NEOCORTEX_BOOTSTRAP_IN_PROGRESS:"1"}}async function X(e){const t=e.env??process.env,r=e.platform??process.platform,n=e.dryRun===!0,s=S(e.projectRoot??process.cwd()),a=S(e.executablePath??process.argv[1]),o=Ze(e,a,r),m=o.runnerCommand,h=m?.executablePath??a,p=V(s??process.cwd()),L=e.commandAvailable??(y=>se(y,t)),u=st(e.intervalSeconds??_e,10,1440*60),d=we({platform:r,env:t,strategy:e.strategy,allowCronFallback:e.allowCronFallback,commandAvailable:L,userBusProbe:e.userBusProbe??(e.commandAvailable?()=>!0:void 0),uid:e.uid}),A=et(e,h,o.resolution),E=[...d.blockers];if((!s||!m)&&E.push(c.SCHEDULER_INSTALL_UNSAFE),!A.trusted){const y=A.reasonCodes&&A.reasonCodes.length>0?A.reasonCodes:[A.reasonCode??c.RUNNER_BINARY_UNTRUSTED];E.push(c.SCHEDULER_INSTALL_UNSAFE,c.RUNNER_BINARY_UNTRUSTED,...y)}const f=d.selectedStrategy;f||E.push(c.SCHEDULER_UNAVAILABLE);const k=f?De(f,t,p):void 0,_=f&&s&&Xe(e.command)?We({strategy:f,env:t,projectRoot:s}):[],ie=_.flatMap(y=>y.reasonCodes),x=(e.command==="install"||e.command==="start"||e.command==="stop")&&E.length>0,Q=g([...d.reasonCodes,...E,...ie,x?c.SCHEDULER_INSTALL_UNSAFE:c.OK]);if(x||!f||!k||!s||!m)return{ok:!x&&!!f,command:e.command,platform:r,strategy:f,dryRun:n,manifestPaths:[],manifests:[],identity:p,legacyEntries:_,controlCommands:[],uninstallGuidance:f&&k?te(f,k,p):[],capability:ae(d,E),reasonCodes:Q,applied:!1,publicSafe:!0};const I=e.command==="install"?Pe({strategy:f,paths:k,projectRoot:s,executablePath:m.command,runnerCommand:m,intervalSeconds:u,identity:p}):[],U=ve(e.command,f,k,p,_,t);let j=!1,B=!0;const z=[];if(e.command==="install"&&!n){let y=!1;for(const b of I){const T=()=>{me(ye(b.path),{recursive:!0}),pe(b.path,b.content,"utf8")};e.effectAuthority?y=Ae(e.effectAuthority,T)||y:(T(),y=!0)}j=y}if(!n&&U.length>0){const y=e.commandRunner??tt;for(const b of U){if(b.manualOnly)continue;const T=e.effectAuthority?Ce(e.effectAuthority,b,()=>({executed:!0,result:y(b)}),()=>({executed:!1,result:{ok:!0,reasonCode:c.OK}})):{executed:!0,result:y(b)},q=T.result;q.ok?T.executed&&(j=!0):(B=!1,z.push(q.reasonCode??c.SCHEDULER_COMMAND_FAILED))}}return{ok:B,command:e.command,platform:r,strategy:f,dryRun:n,manifestPaths:I.map(y=>y.path),manifests:I,identity:p,legacyEntries:_,controlCommands:U,uninstallGuidance:[...te(f,k,p),...$e(f,_)],capability:ae(d,E),reasonCodes:g([...Q,...z,B?c.OK:c.SCHEDULER_COMMAND_FAILED]),applied:j,publicSafe:!0}}function we(e={}){const t=e.env??process.env,r=e.platform??process.platform,n=e.commandAvailable??(A=>se(A,t)),s=Je(r,t,e.uid),a=qe(r),o=a?re(a,n):!1;let m=!0;if(a==="systemd-user"&&o)try{m=(e.userBusProbe??Ne)(t)===!0}catch{m=!1}const h=o&&m,p=r!=="win32"&&n("crontab"),L=e.allowCronFallback===!0;let u=e.strategy;const d=[];return a==="systemd-user"&&o&&!m&&d.push(c.SYSTEMD_USER_BUS_UNAVAILABLE),u||(a&&h?u=a:L&&p&&(u="cron-fallback",d.push(c.PRIMARY_USER_SCHEDULER_UNAVAILABLE,c.CRON_FALLBACK_SELECTED))),u==="cron-fallback"&&h?(u=void 0,d.push(c.CRON_FALLBACK_NOT_ALLOWED)):u==="cron-fallback"&&!L&&(u=void 0,d.push(c.CRON_FALLBACK_NOT_PERMITTED)),u&&(u===a?!h:!re(u,n))&&(u!=="cron-fallback"||!p)&&(u=void 0),u||d.push(c.SCHEDULER_UNAVAILABLE),s.length>0&&d.push(...s),d.length===0&&d.push(c.OK),{platform:r,primaryStrategy:a,selectedStrategy:u,fallbackStrategy:p?"cron-fallback":void 0,primaryAvailable:h,cronFallbackAvailable:p,safeToInstall:s.length===0,blockers:s,reasonCodes:g(d),publicSafe:!0}}function Ne(e){const t=F("systemctl",["--user","show-environment"],{env:e,shell:!1,stdio:"ignore",timeout:2e3,windowsHide:!0});return t.error===void 0&&t.status===0}function Pe(e){const t=e.identity??V(e.projectRoot),r=e.runnerCommand??{command:e.executablePath,args:[],executablePath:e.executablePath,publicSafe:!0};switch(e.strategy){case"systemd-user":return[{kind:"systemd-service",path:e.paths.systemdServicePath,content:Me(r,e.projectRoot,t),publicSafe:!0},{kind:"systemd-timer",path:e.paths.systemdTimerPath,content:Ke(e.intervalSeconds,t),publicSafe:!0}];case"launchd-user":return[{kind:"launchd-plist",path:e.paths.launchdPlistPath,content:Ge(r,e.projectRoot,e.intervalSeconds,t),publicSafe:!0}];case"windows-task-scheduler":return[{kind:"windows-task-xml",path:e.paths.windowsTaskXmlPath,content:Ye(r,e.projectRoot,e.intervalSeconds,t),publicSafe:!0}];case"cron-fallback":return[{kind:"cron-snippet",path:e.paths.cronSnippetPath,content:Ve(r,e.projectRoot,t),publicSafe:!0}]}}function De(e,t,r){const n=ne(t),s=S(t.XDG_CONFIG_HOME)??l(n,".config"),a=l(s,"systemd","user"),o=l(n,"Library","LaunchAgents"),m=S(t.APPDATA)??l(S(t.USERPROFILE)??n,"AppData","Roaming"),h=l(m,"Neocortex","Runner"),p=l(s,"neocortex");return{systemdServicePath:l(a,r.systemdServiceFile),systemdTimerPath:l(a,r.systemdTimerFile),launchdPlistPath:l(o,r.launchdFile),windowsTaskXmlPath:l(h,r.windowsXmlFile),cronSnippetPath:l(p,r.cronFile)}}function ee(e,t){const r=ne(t),n=S(t.XDG_CONFIG_HOME)??l(r,".config"),s=l(n,"systemd","user"),a=l(r,"Library","LaunchAgents"),o=S(t.APPDATA)??l(S(t.USERPROFILE)??r,"AppData","Roaming"),m=l(o,"Neocortex","Runner"),h=l(n,"neocortex");return{systemdServicePath:l(s,be),systemdTimerPath:l(s,N),launchdPlistPath:l(a,Le),windowsTaskXmlPath:l(m,ke),cronSnippetPath:l(h,Re)}}function ve(e,t,r,n,s,a){return e==="doctor"?[]:[...e==="install"?Oe(t,r,n):e==="start"?xe(t,r,n):e==="stop"?Ie(t,r,n):Ue(t,r,n),...je(e,t,s,a)]}function Oe(e,t,r){switch(e){case"systemd-user":return[i("systemctl",["--user","daemon-reload"]),i("systemctl",["--user","enable","--now",r.systemdTimerName])];case"launchd-user":return[i("launchctl",["load","-w",t.launchdPlistPath])];case"windows-task-scheduler":return[i("schtasks",["/Create","/TN",r.windowsTaskName,"/XML",t.windowsTaskXmlPath,"/F"])];case"cron-fallback":return[i("crontab",["-l","# append snippet from",t.cronSnippetPath],!0)]}}function xe(e,t,r){switch(e){case"systemd-user":return[i("systemctl",["--user","start",r.systemdTimerName])];case"launchd-user":return[i("launchctl",["load","-w",t.launchdPlistPath])];case"windows-task-scheduler":return[i("schtasks",["/Run","/TN",r.windowsTaskName])];case"cron-fallback":return[i("crontab",["-l","# ensure snippet from",t.cronSnippetPath,"is installed"],!0)]}}function Ie(e,t,r){switch(e){case"systemd-user":return[i("systemctl",["--user","stop",r.systemdTimerName])];case"launchd-user":return[i("launchctl",["unload","-w",t.launchdPlistPath])];case"windows-task-scheduler":return[i("schtasks",["/End","/TN",r.windowsTaskName])];case"cron-fallback":return[i("crontab",["-l","# remove scoped neocortex-runner snippet"],!0)]}}function Ue(e,t,r){switch(e){case"systemd-user":return[i("systemctl",["--user","status",r.systemdTimerName,"--no-pager"])];case"launchd-user":return[i("launchctl",["list",r.launchdLabel])];case"windows-task-scheduler":return[i("schtasks",["/Query","/TN",r.windowsTaskName,"/FO","LIST"])];case"cron-fallback":return[i("crontab",["-l","# look for neocortex-runner snippet from",t.cronSnippetPath],!0)]}}function te(e,t,r){switch(e){case"systemd-user":return[`systemctl --user disable --now ${r.systemdTimerName}`,`rm ${t.systemdServicePath}`,`rm ${t.systemdTimerPath}`];case"launchd-user":return[`launchctl unload -w ${t.launchdPlistPath}`,`rm ${t.launchdPlistPath}`];case"windows-task-scheduler":return[`schtasks /Delete /TN ${r.windowsTaskName} /F`,`Remove-Item ${t.windowsTaskXmlPath}`];case"cron-fallback":return[`Remove the ${r.cronMarkerStart} block from the user crontab.`,`rm ${t.cronSnippetPath}`]}}function je(e,t,r,n){if(!r.some(o=>o.relation==="current-project")||e!=="status"&&e!=="stop")return[];const a=ee(t,n);return e==="status"?Be(t,a):Fe(t,a)}function Be(e,t){switch(e){case"systemd-user":return[i("systemctl",["--user","status",N,"--no-pager"])];case"launchd-user":return[i("launchctl",["list",K])];case"windows-task-scheduler":return[i("schtasks",["/Query","/TN",G,"/FO","LIST"])];case"cron-fallback":return[i("crontab",["-l","# look for legacy neocortex-runner snippet from",t.cronSnippetPath],!0)]}}function Fe(e,t){switch(e){case"systemd-user":return[i("systemctl",["--user","stop",N])];case"launchd-user":return[i("launchctl",["unload","-w",t.launchdPlistPath])];case"windows-task-scheduler":return[i("schtasks",["/End","/TN",G])];case"cron-fallback":return[i("crontab",["-l","# remove legacy neocortex-runner snippet"],!0)]}}function $e(e,t){if(t.length===0)return[];const r=t.filter(o=>o.relation==="current-project"),n=t.filter(o=>o.relation==="ambiguous"),s=t.filter(o=>o.relation==="other-project"),a=[];return r.length>0&&a.push(`Legacy global ${e} scheduler matches this project; stop it before relying on project-scoped runner scheduling.`),n.length>0&&a.push(`Legacy global ${e} scheduler ownership is ambiguous; inspect it manually before removal.`),s.length>0&&a.push(`Legacy global ${e} scheduler appears to belong to another project; leave it unchanged.`),a}function Me(e,t,r){const n=[...He(e),"tick","--project-root",t,"--scheduled"].map(oe).join(" ");return["[Unit]",`Description=Neocortex Enterprise Continuity Runner (${r.projectKey}, user scope)`,`# Managed by Neocortex runner for project ${r.projectKey}`,"After=network-online.target","","[Service]","Type=oneshot",`WorkingDirectory=${ue(t)}`,`ExecStart=${n}`,"","[Install]","WantedBy=default.target",""].join(`
+`)}function He(e){const t=S(process.execPath);return!t||e.command===t?[e.command,...e.args]:[t,e.command,...e.args]}function Ke(e,t){return["[Unit]",`Description=Run Neocortex Enterprise Continuity Runner periodically (${t.projectKey}, user scope)`,`# Managed by Neocortex runner for project ${t.projectKey}`,"","[Timer]","OnBootSec=60s",`OnUnitActiveSec=${e}s`,`Unit=${t.systemdServiceName}`,"","[Install]","WantedBy=timers.target",""].join(`
+`)}function Ge(e,t,r,n){const s=[e.command,...e.args,"tick","--project-root",t,"--scheduled"];return['<?xml version="1.0" encoding="UTF-8"?>','<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">','<plist version="1.0">',"<dict>",`  <!-- Managed by Neocortex runner for project ${C(n.projectKey)} -->`,"  <key>Label</key>",`  <string>${C(n.launchdLabel)}</string>`,"  <key>ProgramArguments</key>","  <array>",...s.map(a=>`    <string>${C(a)}</string>`),"  </array>","  <key>WorkingDirectory</key>",`  <string>${C(t)}</string>`,"  <key>StartInterval</key>",`  <integer>${r}</integer>`,"  <key>RunAtLoad</key>","  <true/>","</dict>","</plist>",""].join(`
+`)}function Ye(e,t,r,n){const s=[...e.args,"tick","--project-root",t,"--scheduled"].map(le).join(" ");return['<?xml version="1.0" encoding="UTF-16"?>','<Task version="1.4" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">',"  <RegistrationInfo>",`    <Description>Neocortex Enterprise Continuity Runner (${C(n.projectKey)}, user scope)</Description>`,"  </RegistrationInfo>","  <Triggers>","    <TimeTrigger>","      <Repetition>",`        <Interval>PT${r}S</Interval>`,"        <StopAtDurationEnd>false</StopAtDurationEnd>","      </Repetition>","      <Enabled>true</Enabled>","    </TimeTrigger>","  </Triggers>","  <Principals>",'    <Principal id="Author">',"      <LogonType>InteractiveToken</LogonType>","      <RunLevel>LeastPrivilege</RunLevel>","    </Principal>","  </Principals>","  <Settings>","    <MultipleInstancesPolicy>IgnoreNew</MultipleInstancesPolicy>","    <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>","    <StopIfGoingOnBatteries>false</StopIfGoingOnBatteries>","    <Enabled>true</Enabled>","  </Settings>",'  <Actions Context="Author">',"    <Exec>",`      <Command>${C(e.command)}</Command>`,`      <Arguments>${C(s)}</Arguments>`,`      <WorkingDirectory>${C(t)}</WorkingDirectory>`,"    </Exec>","  </Actions>","</Task>",""].join(`
+`)}function Ve(e,t,r){const n=[e.command,...e.args,"tick","--project-root",t,"--scheduled"].map(W).join(" ");return[r.cronMarkerStart,`# neocortex-runner user-scope cron fallback for project ${r.projectKey}`,"# Reason: primary-user-scheduler-unavailable",`* * * * * ${n} # neocortex-runner:${r.projectKey}`,r.cronMarkerEnd,""].join(`
+`)}function Xe(e){return e==="status"||e==="stop"||e==="doctor"}function We(e){const t=ee(e.strategy,e.env);switch(e.strategy){case"systemd-user":{const r=w(t.systemdServicePath),n=w(t.systemdTimerPath),s=r?O(r):!1,a=n?ze(n):!1;if(!s&&!a)return[];const o=v([r,n].filter(Boolean).join(`
+`),e.projectRoot,s);return[D(e.strategy,"systemd-timer",N,o)]}case"launchd-user":{const r=w(t.launchdPlistPath);return!r||!O(r)?[]:[D(e.strategy,"launchd-plist",K,v(r,e.projectRoot,!0))]}case"windows-task-scheduler":{const r=w(t.windowsTaskXmlPath);return!r||!O(r)?[]:[D(e.strategy,"windows-task-xml",G,v(r,e.projectRoot,!0))]}case"cron-fallback":{const r=w(t.cronSnippetPath);return!r||!O(r)?[]:[D(e.strategy,"cron-snippet","# neocortex-runner",v(r,e.projectRoot,!0))]}}}function D(e,t,r,n){const s=n==="current-project"?c.LEGACY_GLOBAL_SCHEDULER_DETECTED:n==="ambiguous"?c.LEGACY_GLOBAL_SCHEDULER_AMBIGUOUS:c.LEGACY_GLOBAL_SCHEDULER_OTHER_PROJECT;return{strategy:e,kind:t,name:r,relation:n,reasonCodes:[s],remediation:n==="current-project"?"stop-safe":n==="ambiguous"?"manual-review-only":"report-only",publicSafe:!0}}function v(e,t,r){return Qe(e,t)?"current-project":r&&/--project-root|WorkingDirectory=|<key>WorkingDirectory<\/key>|<Arguments>[^<]*--project-root/i.test(e)?"other-project":"ambiguous"}function Qe(e,t){return g([t,oe(t),rt(t),ue(t),nt(t),W(t),le(t),C(t)].filter(Boolean)).some(n=>e.includes(n))}function O(e){return/neocortex-runner|com\.ornexus\.neocortex\.runner|NeocortexRunner|Neocortex Enterprise Continuity Runner/i.test(e)&&/tick|--project-root|StartInterval|OnUnitActiveSec|InteractiveToken|primary-user-scheduler-unavailable/i.test(e)}function ze(e){return/neocortex-runner\.service|Neocortex Enterprise Continuity Runner|OnUnitActiveSec/i.test(e)}function w(e){try{return fe(e,"utf8")}catch{return null}}function qe(e){if(e==="linux")return"systemd-user";if(e==="darwin")return"launchd-user";if(e==="win32")return"windows-task-scheduler"}function re(e,t){switch(e){case"systemd-user":return t("systemctl");case"launchd-user":return t("launchctl");case"windows-task-scheduler":return t("schtasks")||t("schtasks.exe");case"cron-fallback":return t("crontab")}}function Je(e,t,r){const n=[],s=r??(typeof process.getuid=="function"?process.getuid():null);e!=="win32"&&s===0&&n.push(c.SCHEDULER_INSTALL_UNSAFE),e!=="win32"&&(t.SUDO_USER||t.SUDO_UID||t.SUDO_COMMAND)&&n.push(c.SCHEDULER_INSTALL_UNSAFE);const a=t.HOME??t.USERPROFILE;return(!a||!M(a)||!S(a))&&n.push(c.SCHEDULER_INSTALL_UNSAFE),g(n)}function Ze(e,t,r){if(e.trustCheck===!1||e.trustChecker)return{runnerCommand:t?{command:t,args:[],executablePath:t,publicSafe:!0}:void 0};const s=(e.binaryResolver??Z)({from:t??process.argv[1],platform:r});return s.ok?{runnerCommand:{command:s.command,args:s.args,executablePath:s.executablePath,provenance:s.provenance,publicSafe:!0},resolution:s}:{runnerCommand:t?{command:t,args:[],executablePath:t,provenance:s.provenance,publicSafe:!0}:void 0,resolution:s}}function et(e,t,r){return e.trustCheck===!1?{trusted:!0,executablePath:t??void 0,publicSafe:!0}:e.trustChecker?e.trustChecker(t??void 0):r?r.ok?{trusted:!0,packageName:r.packageName,packageVersion:r.packageVersion,packageRoot:r.packageRoot,executablePath:r.executablePath,expectedRelativePath:r.expectedRelativePath,provenance:r.provenance,reasonCodes:r.reasonCodes,publicSafe:!0}:{trusted:!1,reasonCode:r.reasonCode,reasonCodes:r.reasonCodes,packageName:r.packageName,packageVersion:r.packageVersion,packageRoot:r.packageRoot,executablePath:r.executablePath??t??void 0,expectedRelativePath:r.expectedRelativePath,provenance:r.provenance,publicSafe:!0}:Ee(t??void 0)}function ne(e){return e.HOME??e.USERPROFILE??process.env.HOME??process.cwd()}function S(e){if(!e||/[\r\n\0]/.test(e))return null;const t=M(e)?e:J(e);return M(t)?t:null}function i(e,t,r=!1){return{command:e,args:t,preview:[e,...t.map(W)].join(" "),safeUserScope:!0,...r?{manualOnly:!0}:{}}}function tt(e){const t=F(e.command,[...e.args],{stdio:"ignore",shell:!1,timeout:3e3,windowsHide:!0});return{ok:t.status===0,code:t.status,signal:t.signal,reasonCode:t.status===0?c.OK:c.SCHEDULER_COMMAND_FAILED}}function se(e,t){const r=t.PATH??process.env.PATH??"",n=(t.PATHEXT??".EXE;.CMD;.BAT;.COM").split(";").filter(Boolean),s=r.split(he).filter(Boolean);for(const a of s){const o=l(a,e);if($(o))return!0;for(const m of n)if($(l(a,`${e}${m.toLowerCase()}`))||$(l(a,`${e}${m.toUpperCase()}`)))return!0}return!1}function ae(e,t){const r=g([...e.blockers,...t]);return{...e,safeToInstall:r.length===0,blockers:r,reasonCodes:g([...e.reasonCodes,...r])}}function oe(e){return ce(e,!0)}function rt(e){return ce(e,!1)}function ce(e,t){const r=e.replace(/\\/g,"\\\\").replace(/"/g,'\\"').replace(/%/g,t?"%%":"%");return/[\s"'\\]/.test(e)?`"${r}"`:r}function ue(e){return e.replace(/%/g,"%%")}function nt(e){return Array.from(e,t=>/^[A-Za-z0-9_./:@+=,-]$/.test(t)?t:t==="%"?"%%":Array.from(de.from(t,"utf8"),r=>`\\x${r.toString(16).padStart(2,"0")}`).join("")).join("")}function W(e){return/^[A-Za-z0-9_./:=@%+-]+$/.test(e)?e:`'${e.replace(/'/g,"'\\''")}'`}function le(e){return/[\s"]/.test(e)?`"${e.replace(/"/g,'\\"')}"`:e}function C(e){return e.replace(/&/g,"&amp;").replace(/</g,"&lt;").replace(/>/g,"&gt;").replace(/"/g,"&quot;").replace(/'/g,"&apos;")}function st(e,t,r){return Number.isFinite(e)?Math.max(t,Math.min(r,Math.floor(e))):t}function g(e){return Array.from(new Set(e))}export{R as RUNNER_SCHEDULER_BOOTSTRAP_REASON_CODES,c as SCHEDULER_REASON_CODES,pt as __resetRunnerSchedulerBootstrapCacheForTests,V as createRunnerSchedulerIdentity,we as detectSchedulerCapability,ht as ensureRunnerSchedulerBootstrap,ft as observeRunnerOperationalStatus,Pe as renderSchedulerManifests,X as runRunnerSchedulerCommand};