cronies-cli 0.1.0

package/dist/chunk-FVB2S2MS.js

@@ -0,0 +1,4229 @@
+// src/config/schema.ts
+import { z } from "zod";
+var DaemonConfigSchema = z.object({
+  daemon: z.object({
+    port: z.number().default(7890),
+    logLevel: z.enum(["debug", "info", "warn", "error"]).default("info"),
+    dataDir: z.string().default("~/.cronies")
+  }).default({}),
+  cloud: z.object({
+    url: z.string().default("https://cronies.dev"),
+    token: z.string().optional()
+  }).default({}),
+  agents: z.object({
+    "claude-code": z.object({
+      path: z.string().default("claude"),
+      defaultFlags: z.array(z.string()).default([])
+    }).default({}),
+    "codex-cli": z.object({
+      path: z.string().default("codex"),
+      defaultFlags: z.array(z.string()).default([])
+    }).default({}),
+    "gemini-cli": z.object({
+      path: z.string().default("gemini"),
+      defaultFlags: z.array(z.string()).default([])
+    }).default({}),
+    "cursor-agent": z.object({
+      path: z.string().default("agent"),
+      defaultFlags: z.array(z.string()).default([])
+    }).default({})
+  }).default({})
+});
+
+// src/config/loader.ts
+import { readFileSync, existsSync } from "fs";
+import { resolve } from "path";
+import { homedir } from "os";
+import { parse as parseYaml } from "yaml";
+function resolveTilde(filePath) {
+  if (filePath === "~") return homedir();
+  if (filePath.startsWith("~/") || filePath.startsWith("~\\")) {
+    return resolve(homedir(), filePath.slice(2));
+  }
+  return filePath;
+}
+function loadConfig(configPath) {
+  const resolvedPath = resolveTilde(configPath ?? "~/.cronies/config.yaml");
+  if (!existsSync(resolvedPath)) {
+    return DaemonConfigSchema.parse({});
+  }
+  const raw = readFileSync(resolvedPath, "utf-8");
+  const parsed = parseYaml(raw);
+  const result = DaemonConfigSchema.safeParse(parsed ?? {});
+  if (!result.success) {
+    const issues = result.error.issues.map((i) => `  - ${i.path.join(".")}: ${i.message}`).join("\n");
+    throw new Error(`Invalid config at ${resolvedPath}:
+${issues}`);
+  }
+  return result.data;
+}
+function resolveDataDir(config) {
+  return resolveTilde(config.daemon.dataDir);
+}
+
+// src/config/writer.ts
+import { readFileSync as readFileSync2, writeFileSync, mkdirSync, existsSync as existsSync2 } from "fs";
+import { resolve as resolve2, dirname } from "path";
+import { homedir as homedir2 } from "os";
+import { parse as parseYaml2, stringify as stringifyYaml } from "yaml";
+function getDefaultConfigPath() {
+  return resolve2(homedir2(), ".cronies", "config.yaml");
+}
+function writeConfigToken(token, configPath) {
+  const resolvedPath = configPath ?? getDefaultConfigPath();
+  const dir = dirname(resolvedPath);
+  if (!existsSync2(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+  let config = {};
+  if (existsSync2(resolvedPath)) {
+    const raw = readFileSync2(resolvedPath, "utf-8");
+    const parsed = parseYaml2(raw);
+    if (parsed && typeof parsed === "object") {
+      config = parsed;
+    }
+  }
+  const existingCloud = config.cloud && typeof config.cloud === "object" ? config.cloud : {};
+  config.cloud = { ...existingCloud, token };
+  writeFileSync(resolvedPath, stringifyYaml(config), "utf-8");
+}
+
+// src/pid.ts
+import { readFileSync as readFileSync3, writeFileSync as writeFileSync2, unlinkSync, existsSync as existsSync3, mkdirSync as mkdirSync2 } from "fs";
+import { join } from "path";
+function pidFilePath(dataDir) {
+  return join(dataDir, "daemon.pid");
+}
+function writePidFile(dataDir) {
+  mkdirSync2(dataDir, { recursive: true });
+  writeFileSync2(pidFilePath(dataDir), String(process.pid), "utf-8");
+}
+function readPidFile(dataDir) {
+  const filePath = pidFilePath(dataDir);
+  if (!existsSync3(filePath)) return null;
+  try {
+    const content = readFileSync3(filePath, "utf-8").trim();
+    const pid = Number.parseInt(content, 10);
+    return Number.isNaN(pid) ? null : pid;
+  } catch {
+    return null;
+  }
+}
+function removePidFile(dataDir) {
+  const filePath = pidFilePath(dataDir);
+  try {
+    unlinkSync(filePath);
+  } catch {
+  }
+}
+function isDaemonRunning(dataDir) {
+  const pid = readPidFile(dataDir);
+  if (pid === null) return false;
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+// src/storage/database.ts
+import Database from "better-sqlite3";
+
+// src/storage/migrations.ts
+function runMigrations(db) {
+  db.exec(`
+    CREATE TABLE IF NOT EXISTS daemon_jobs (
+      job_id TEXT PRIMARY KEY,
+      outcome_id TEXT NOT NULL,
+      definition TEXT NOT NULL,
+      machine_state TEXT NOT NULL,
+      machine_context TEXT NOT NULL,
+      status TEXT NOT NULL DEFAULT 'active',
+      assigned_at INTEGER NOT NULL,
+      updated_at INTEGER NOT NULL,
+      synced_at INTEGER
+    );
+
+    CREATE TABLE IF NOT EXISTS run_events (
+      id TEXT PRIMARY KEY,
+      run_id TEXT NOT NULL,
+      job_id TEXT NOT NULL,
+      source TEXT NOT NULL,
+      source_id TEXT NOT NULL,
+      type TEXT NOT NULL,
+      payload TEXT NOT NULL,
+      timestamp INTEGER NOT NULL,
+      sequence INTEGER NOT NULL,
+      synced INTEGER DEFAULT 0,
+      UNIQUE(source, source_id, sequence)
+    );
+    CREATE INDEX IF NOT EXISTS idx_run_events_job ON run_events(job_id, timestamp);
+    CREATE INDEX IF NOT EXISTS idx_run_events_run ON run_events(run_id, timestamp);
+    CREATE INDEX IF NOT EXISTS idx_run_events_unsynced ON run_events(synced, sequence);
+
+    CREATE TABLE IF NOT EXISTS checkpoints (
+      id TEXT PRIMARY KEY,
+      run_id TEXT NOT NULL,
+      job_id TEXT NOT NULL,
+      machine_state TEXT NOT NULL,
+      machine_context TEXT NOT NULL,
+      agent_state TEXT,
+      created_at INTEGER NOT NULL,
+      synced INTEGER DEFAULT 0
+    );
+    CREATE INDEX IF NOT EXISTS idx_checkpoints_job ON checkpoints(job_id, created_at);
+
+    CREATE TABLE IF NOT EXISTS policy_cache (
+      id TEXT PRIMARY KEY DEFAULT 'default',
+      policy TEXT NOT NULL,
+      version INTEGER NOT NULL,
+      received_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS outcome_cache (
+      outcome_id TEXT PRIMARY KEY,
+      definition TEXT NOT NULL,
+      version INTEGER NOT NULL,
+      received_at INTEGER NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS sync_outbox (
+      id INTEGER PRIMARY KEY AUTOINCREMENT,
+      message_type TEXT NOT NULL,
+      payload TEXT NOT NULL,
+      created_at INTEGER NOT NULL,
+      attempts INTEGER DEFAULT 0,
+      last_attempt INTEGER
+    );
+
+    CREATE TABLE IF NOT EXISTS daemon_meta (
+      key TEXT PRIMARY KEY,
+      value TEXT NOT NULL
+    );
+
+    CREATE TABLE IF NOT EXISTS spawned_pids (
+      pid INTEGER PRIMARY KEY,
+      job_id TEXT NOT NULL,
+      agent TEXT NOT NULL,
+      spawned_at INTEGER NOT NULL DEFAULT (unixepoch())
+    );
+  `);
+}
+
+// src/storage/database.ts
+function createDatabase(dbPath) {
+  const db = new Database(dbPath);
+  db.pragma("journal_mode = WAL");
+  db.pragma("foreign_keys = ON");
+  runMigrations(db);
+  return db;
+}
+
+// src/storage/store.ts
+import { ulid } from "ulid";
+var DaemonStore = class {
+  db;
+  sequence;
+  constructor(db) {
+    this.db = db;
+    this.sequence = this.getLastSequence();
+  }
+  // -----------------------------------------------------------------------
+  // Jobs
+  // -----------------------------------------------------------------------
+  saveJob(jobId, outcomeId, definition, machineState, machineContext) {
+    const now = Date.now();
+    const stmt = this.db.prepare(
+      `INSERT OR REPLACE INTO daemon_jobs
+         (job_id, outcome_id, definition, machine_state, machine_context, status, assigned_at, updated_at)
+       VALUES (?, ?, ?, ?, ?, 'active', ?, ?)`
+    );
+    stmt.run(jobId, outcomeId, JSON.stringify(definition), machineState, machineContext, now, now);
+  }
+  getJob(jobId) {
+    const stmt = this.db.prepare(
+      `SELECT * FROM daemon_jobs WHERE job_id = ?`
+    );
+    const row = stmt.get(jobId);
+    return row ? this.mapJobRow(row) : null;
+  }
+  getActiveJobs() {
+    const stmt = this.db.prepare(
+      `SELECT * FROM daemon_jobs WHERE status = 'active'`
+    );
+    return stmt.all().map((row) => this.mapJobRow(row));
+  }
+  updateJobState(jobId, machineState, machineContext, status) {
+    const stmt = this.db.prepare(
+      `UPDATE daemon_jobs
+         SET machine_state = ?, machine_context = ?, status = ?, updated_at = ?
+       WHERE job_id = ?`
+    );
+    stmt.run(machineState, machineContext, status, Date.now(), jobId);
+  }
+  deleteJob(jobId) {
+    const stmt = this.db.prepare(`DELETE FROM daemon_jobs WHERE job_id = ?`);
+    stmt.run(jobId);
+  }
+  // -----------------------------------------------------------------------
+  // Run Events
+  // -----------------------------------------------------------------------
+  appendEvent(event) {
+    this.sequence += 1;
+    const seq = this.sequence;
+    const stmt = this.db.prepare(
+      `INSERT INTO run_events
+         (id, run_id, job_id, source, source_id, type, payload, timestamp, sequence, synced)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, 0)`
+    );
+    const id = event.id || ulid();
+    stmt.run(
+      id,
+      event.runId,
+      event.jobId,
+      event.source,
+      event.sourceId,
+      event.type,
+      JSON.stringify(event.payload),
+      event.timestamp,
+      seq
+    );
+    return {
+      id,
+      runId: event.runId,
+      jobId: event.jobId,
+      source: event.source,
+      sourceId: event.sourceId,
+      type: event.type,
+      payload: event.payload,
+      timestamp: event.timestamp,
+      sequence: seq
+    };
+  }
+  getEvents(runId, limit = 100) {
+    const stmt = this.db.prepare(
+      `SELECT * FROM run_events WHERE run_id = ? ORDER BY timestamp ASC LIMIT ?`
+    );
+    return stmt.all(runId, limit).map((row) => this.mapEventRow(row));
+  }
+  getEventsByJob(jobId, limit = 100) {
+    const stmt = this.db.prepare(
+      `SELECT * FROM run_events WHERE job_id = ? ORDER BY timestamp ASC LIMIT ?`
+    );
+    return stmt.all(jobId, limit).map((row) => this.mapEventRow(row));
+  }
+  getUnsyncedEvents(limit = 50) {
+    const stmt = this.db.prepare(
+      `SELECT * FROM run_events WHERE synced = 0 ORDER BY sequence ASC LIMIT ?`
+    );
+    return stmt.all(limit).map((row) => ({
+      ...this.mapEventRow(row),
+      jobId: row.job_id
+    }));
+  }
+  markEventsSynced(upToSequence) {
+    const stmt = this.db.prepare(
+      `UPDATE run_events SET synced = 1 WHERE sequence <= ? AND synced = 0`
+    );
+    stmt.run(upToSequence);
+  }
+  getLastSequence() {
+    const stmt = this.db.prepare(
+      `SELECT MAX(sequence) AS max_seq FROM run_events WHERE source = 'daemon'`
+    );
+    const row = stmt.get();
+    return row?.max_seq ?? 0;
+  }
+  // -----------------------------------------------------------------------
+  // Checkpoints
+  // -----------------------------------------------------------------------
+  saveCheckpoint(checkpoint) {
+    const stmt = this.db.prepare(
+      `INSERT OR REPLACE INTO checkpoints
+         (id, run_id, job_id, machine_state, machine_context, agent_state, created_at, synced)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+    );
+    stmt.run(
+      checkpoint.id,
+      checkpoint.runId,
+      checkpoint.jobId,
+      checkpoint.machineState,
+      checkpoint.machineContext,
+      checkpoint.agentState ?? null,
+      checkpoint.createdAt instanceof Date ? checkpoint.createdAt.getTime() : checkpoint.createdAt,
+      checkpoint.synced ?? 0
+    );
+  }
+  getLatestCheckpoint(jobId) {
+    const stmt = this.db.prepare(
+      `SELECT * FROM checkpoints WHERE job_id = ? ORDER BY created_at DESC LIMIT 1`
+    );
+    const row = stmt.get(jobId);
+    return row ? this.mapCheckpointRow(row) : null;
+  }
+  getCheckpoint(id) {
+    const stmt = this.db.prepare(
+      `SELECT * FROM checkpoints WHERE id = ?`
+    );
+    const row = stmt.get(id);
+    return row ? this.mapCheckpointRow(row) : null;
+  }
+  markCheckpointSynced(id) {
+    const stmt = this.db.prepare(
+      `UPDATE checkpoints SET synced = 1 WHERE id = ?`
+    );
+    stmt.run(id);
+  }
+  // -----------------------------------------------------------------------
+  // Policy Cache
+  // -----------------------------------------------------------------------
+  cachePolicy(policy) {
+    const stmt = this.db.prepare(
+      `INSERT OR REPLACE INTO policy_cache (id, policy, version, received_at)
+       VALUES (?, ?, ?, ?)`
+    );
+    stmt.run("default", JSON.stringify(policy), policy.version, Date.now());
+  }
+  getCachedPolicy() {
+    const stmt = this.db.prepare(
+      `SELECT * FROM policy_cache WHERE id = 'default'`
+    );
+    const row = stmt.get();
+    return row ? JSON.parse(row.policy) : null;
+  }
+  // -----------------------------------------------------------------------
+  // Outcome Cache
+  // -----------------------------------------------------------------------
+  cacheOutcome(outcomeId, definition, version) {
+    const stmt = this.db.prepare(
+      `INSERT OR REPLACE INTO outcome_cache (outcome_id, definition, version, received_at)
+       VALUES (?, ?, ?, ?)`
+    );
+    stmt.run(outcomeId, definition, version, Date.now());
+  }
+  getCachedOutcome(outcomeId) {
+    const stmt = this.db.prepare(
+      `SELECT * FROM outcome_cache WHERE outcome_id = ?`
+    );
+    const row = stmt.get(outcomeId);
+    return row ? { definition: row.definition, version: row.version } : null;
+  }
+  // -----------------------------------------------------------------------
+  // Sync Outbox
+  // -----------------------------------------------------------------------
+  enqueueMessage(messageType, payload) {
+    const stmt = this.db.prepare(
+      `INSERT INTO sync_outbox (message_type, payload, created_at) VALUES (?, ?, ?)`
+    );
+    stmt.run(messageType, payload, Date.now());
+  }
+  dequeueMessages(limit = 10) {
+    const stmt = this.db.prepare(
+      `SELECT * FROM sync_outbox ORDER BY id ASC LIMIT ?`
+    );
+    return stmt.all(limit).map((row) => ({
+      id: row.id,
+      messageType: row.message_type,
+      payload: row.payload,
+      createdAt: row.created_at,
+      attempts: row.attempts
+    }));
+  }
+  markMessageSent(id) {
+    const stmt = this.db.prepare(`DELETE FROM sync_outbox WHERE id = ?`);
+    stmt.run(id);
+  }
+  retryMessage(id) {
+    const stmt = this.db.prepare(
+      `UPDATE sync_outbox SET attempts = attempts + 1, last_attempt = ? WHERE id = ?`
+    );
+    stmt.run(Date.now(), id);
+  }
+  // -----------------------------------------------------------------------
+  // Daemon Meta
+  // -----------------------------------------------------------------------
+  setMeta(key, value) {
+    const stmt = this.db.prepare(
+      `INSERT OR REPLACE INTO daemon_meta (key, value) VALUES (?, ?)`
+    );
+    stmt.run(key, value);
+  }
+  getMeta(key) {
+    const stmt = this.db.prepare(
+      `SELECT * FROM daemon_meta WHERE key = ?`
+    );
+    const row = stmt.get(key);
+    return row ? row.value : null;
+  }
+  // -----------------------------------------------------------------------
+  // Cleanup
+  // -----------------------------------------------------------------------
+  close() {
+    this.db.close();
+  }
+  // -----------------------------------------------------------------------
+  // PID tracking — for crash recovery and orphan cleanup
+  // -----------------------------------------------------------------------
+  trackPid(pid, jobId, agent) {
+    this.db.prepare(
+      "INSERT OR REPLACE INTO spawned_pids (pid, job_id, agent) VALUES (?, ?, ?)"
+    ).run(pid, jobId, agent);
+  }
+  removePid(pid) {
+    this.db.prepare("DELETE FROM spawned_pids WHERE pid = ?").run(pid);
+  }
+  getTrackedPids() {
+    return this.db.prepare("SELECT pid, job_id as jobId, agent FROM spawned_pids").all();
+  }
+  clearAllPids() {
+    this.db.prepare("DELETE FROM spawned_pids").run();
+  }
+  // -----------------------------------------------------------------------
+  // Private helpers
+  // -----------------------------------------------------------------------
+  mapJobRow(row) {
+    return {
+      jobId: row.job_id,
+      outcomeId: row.outcome_id,
+      definition: JSON.parse(row.definition),
+      machineState: row.machine_state,
+      machineContext: row.machine_context,
+      status: row.status,
+      assignedAt: row.assigned_at,
+      updatedAt: row.updated_at,
+      syncedAt: row.synced_at
+    };
+  }
+  mapEventRow(row) {
+    return {
+      id: row.id,
+      runId: row.run_id,
+      source: row.source,
+      sourceId: row.source_id,
+      type: row.type,
+      payload: JSON.parse(row.payload),
+      timestamp: row.timestamp,
+      sequence: row.sequence
+    };
+  }
+  mapCheckpointRow(row) {
+    return {
+      id: row.id,
+      runId: row.run_id,
+      jobId: row.job_id,
+      machineState: row.machine_state,
+      machineContext: row.machine_context,
+      agentState: row.agent_state ?? void 0,
+      createdAt: new Date(row.created_at)
+    };
+  }
+};
+
+// ../adapters/dist/base.js
+import { spawn as cpSpawn } from "child_process";
+var childProcessMap = /* @__PURE__ */ new WeakMap();
+var AUTH_ERROR_PATTERNS = [
+  /unauthorized/,
+  /unauthenticated/,
+  /invalid.*api.*key/,
+  /authentication.*required/,
+  /not.*logged.*in/,
+  /login.*required/,
+  /api.*key.*not.*found/,
+  /no.*api.*key/,
+  /credentials.*not.*found/,
+  /please.*log.*in/,
+  /please.*authenticate/,
+  /token.*expired/,
+  /invalid.*token/,
+  /access.*denied/,
+  /permission.*denied/,
+  /sign.*in.*required/
+];
+var AUTH_CHECK_PROCESS_TIMEOUT = 3e4;
+var AUTH_CHECK_RESPONSE_TIMEOUT = 2e4;
+var BaseAdapter = class {
+  /**
+   * Check if the agent is authenticated by running a minimal test prompt.
+   * Pass `skipAvailabilityCheck: true` if the caller already verified `isAvailable()`.
+   */
+  async checkAuth(opts) {
+    if (!opts?.skipAvailabilityCheck) {
+      const available = await this.isAvailable();
+      if (!available) {
+        return { status: "unavailable" };
+      }
+    }
+    return this.runAuthCheck();
+  }
+  async runAuthCheck() {
+    try {
+      const { cmd, args, shell } = this.buildCommand({
+        prompt: "respond with the word ok and nothing else",
+        workingDirectory: process.cwd()
+      });
+      const { spawn: cpSpawnLocal } = await import("child_process");
+      const child = cpSpawnLocal(cmd, args, {
+        stdio: ["pipe", "pipe", "pipe"],
+        shell: shell ?? process.platform === "win32",
+        timeout: AUTH_CHECK_PROCESS_TIMEOUT
+      });
+      child.stdin.write("respond with the word ok and nothing else");
+      child.stdin.end();
+      return new Promise((resolve4) => {
+        let stdout = "";
+        let stderr = "";
+        child.stdout.on("data", (chunk) => {
+          stdout += chunk.toString();
+        });
+        child.stderr.on("data", (chunk) => {
+          stderr += chunk.toString();
+        });
+        const timeout = setTimeout(() => {
+          try {
+            child.kill("SIGKILL");
+          } catch {
+          }
+          resolve4({ status: "authenticated" });
+        }, AUTH_CHECK_RESPONSE_TIMEOUT);
+        child.on("exit", (code) => {
+          clearTimeout(timeout);
+          const combined = `${stdout}
+${stderr}`.toLowerCase();
+          for (const pattern of AUTH_ERROR_PATTERNS) {
+            if (pattern.test(combined)) {
+              return resolve4({
+                status: "needs_auth",
+                error: stderr.trim() || stdout.trim(),
+                authCommand: this.getAuthCommand()
+              });
+            }
+          }
+          if (code === 0 || stdout.length > 0) {
+            resolve4({ status: "authenticated" });
+          } else {
+            resolve4({
+              status: "error",
+              error: stderr.trim() || `Exit code ${code}`
+            });
+          }
+        });
+        child.on("error", (err) => {
+          clearTimeout(timeout);
+          resolve4({ status: "error", error: err.message });
+        });
+      });
+    } catch (err) {
+      return {
+        status: "error",
+        error: err instanceof Error ? err.message : String(err)
+      };
+    }
+  }
+  /**
+   * Return the CLI command the user should run to authenticate this agent.
+   * Subclasses should override with agent-specific instructions.
+   */
+  getAuthCommand() {
+    return void 0;
+  }
+  async spawn(options) {
+    const { cmd, args, shell } = this.buildCommand(options);
+    const child = cpSpawn(cmd, args, {
+      cwd: options.workingDirectory,
+      stdio: ["pipe", "pipe", "pipe"],
+      shell: shell ?? process.platform === "win32",
+      // Default: shell on Windows for .cmd executables
+      env: {
+        ...process.env,
+        ...options.env ?? {}
+      }
+    });
+    if (child.pid === void 0) {
+      return new Promise((_resolve, reject) => {
+        child.once("error", (err) => {
+          reject(new Error(`Failed to spawn ${cmd}: ${err.message}`));
+        });
+        setTimeout(() => {
+          reject(new Error(`Failed to spawn ${cmd}: no PID assigned`));
+        }, 2e3);
+      });
+    }
+    if (options.prompt) {
+      child.stdin.write(options.prompt);
+      child.stdin.end();
+    }
+    const agentProcess = {
+      pid: child.pid,
+      stdin: child.stdin,
+      stdout: child.stdout,
+      stderr: child.stderr,
+      workingDirectory: options.workingDirectory,
+      startedAt: Date.now()
+    };
+    childProcessMap.set(agentProcess, child);
+    return agentProcess;
+  }
+  async terminate(agentProcess) {
+    const SIGTERM_WAIT_MS = 5e3;
+    try {
+      process.kill(agentProcess.pid, "SIGTERM");
+    } catch {
+      return;
+    }
+    return new Promise((resolve4) => {
+      const checkInterval = setInterval(() => {
+        try {
+          process.kill(agentProcess.pid, 0);
+        } catch {
+          clearInterval(checkInterval);
+          clearTimeout(killTimeout);
+          resolve4();
+        }
+      }, 200);
+      const killTimeout = setTimeout(() => {
+        clearInterval(checkInterval);
+        try {
+          process.kill(agentProcess.pid, "SIGKILL");
+        } catch {
+        }
+        resolve4();
+      }, SIGTERM_WAIT_MS);
+    });
+  }
+  async sendInstruction(agentProcess, instruction) {
+    return new Promise((resolve4, reject) => {
+      const ok = agentProcess.stdin.write(instruction + "\n", "utf-8", (err) => {
+        if (err)
+          reject(err);
+        else
+          resolve4();
+      });
+      if (!ok) {
+        agentProcess.stdin.once("drain", () => resolve4());
+      }
+    });
+  }
+  onOutput(agentProcess, handler) {
+    const makeHandler = (stream) => (chunk) => {
+      const lines = chunk.toString("utf-8").split("\n");
+      for (const line of lines) {
+        if (line.length === 0)
+          continue;
+        const output = this.parseOutput(line, stream);
+        handler(output);
+      }
+    };
+    agentProcess.stdout.on("data", makeHandler("stdout"));
+    agentProcess.stderr.on("data", makeHandler("stderr"));
+  }
+  onExit(agentProcess, handler) {
+    const child = childProcessMap.get(agentProcess);
+    if (child) {
+      child.on("exit", (code, signal) => {
+        handler(code, signal);
+      });
+    }
+  }
+};
+
+// ../adapters/dist/classifier.js
+var ERROR_KEYWORDS = /\b(error|fail(ed|ure)?|exception|traceback|panic|crash|abort(ed)?|segfault|ENOENT|EACCES|EPERM|ECONNREFUSED|timeout)\b/i;
+var SUCCESS_KEYWORDS = /\b(success(ful(ly)?)?|complete(d)?|done|finished|pass(ed)?|ok|applied|created|updated|merged|deployed)\b/i;
+var RISK_KEYWORDS = /\b(force\s+push|--force|rm\s+-rf|DROP\s+TABLE|DELETE\s+FROM|TRUNCATE|chmod\s+777|sudo\s+rm|git\s+reset\s+--hard|git\s+clean\s+-fd)\b/i;
+function patternMatch(text, rules) {
+  let bestMatch = null;
+  for (const rule of rules) {
+    if (rule.pattern.test(text)) {
+      if (bestMatch === null || rule.confidence > bestMatch.confidence) {
+        bestMatch = rule;
+      }
+    }
+  }
+  if (bestMatch !== null && bestMatch.confidence >= 0.5) {
+    return {
+      category: bestMatch.category,
+      confidence: bestMatch.confidence,
+      riskScore: bestMatch.riskScore,
+      detectedAction: bestMatch.name,
+      summary: bestMatch.description,
+      rawOutput: text
+    };
+  }
+  return null;
+}
+function heuristicScore(text, exitCode) {
+  let category = "ambiguous";
+  let confidence = 0.3;
+  let riskScore = 0;
+  const signals = [];
+  if (exitCode !== null) {
+    if (exitCode === 0) {
+      confidence += 0.2;
+      category = "success";
+      signals.push("exit_code_0");
+    } else {
+      confidence += 0.15;
+      category = "transient_error";
+      signals.push(`exit_code_${exitCode}`);
+    }
+  }
+  if (ERROR_KEYWORDS.test(text)) {
+    if (category !== "transient_error") {
+      category = "transient_error";
+    }
+    confidence = Math.min(confidence + 0.15, 1);
+    signals.push("error_keywords");
+  }
+  if (SUCCESS_KEYWORDS.test(text)) {
+    if (category === "ambiguous") {
+      category = "success";
+    }
+    confidence = Math.min(confidence + 0.1, 1);
+    signals.push("success_keywords");
+  }
+  if (RISK_KEYWORDS.test(text)) {
+    category = "risky_action";
+    riskScore = 80;
+    confidence = Math.min(confidence + 0.2, 1);
+    signals.push("risk_keywords");
+  }
+  if (text.length < 10 && exitCode === null) {
+    if (category === "ambiguous") {
+      category = "idle";
+    }
+    confidence = Math.max(confidence - 0.1, 0);
+    signals.push("very_short_output");
+  }
+  if (confidence < 0.5) {
+    category = "ambiguous";
+    confidence = 0.3;
+  }
+  return {
+    category,
+    confidence,
+    riskScore,
+    detectedAction: signals.join(", ") || void 0,
+    summary: `Heuristic classification: ${category} (signals: ${signals.join(", ") || "none"})`,
+    rawOutput: text
+  };
+}
+function classifyOutput(output, exitCode, rules) {
+  const patternResult = patternMatch(output.data, rules);
+  if (patternResult !== null) {
+    return patternResult;
+  }
+  return heuristicScore(output.data, exitCode);
+}
+
+// ../adapters/dist/manager.js
+var AdapterManager = class {
+  adapters = /* @__PURE__ */ new Map();
+  /** Register an adapter. Overwrites any previous adapter with the same name. */
+  register(adapter) {
+    this.adapters.set(adapter.name, adapter);
+  }
+  /** Get an adapter by name, or undefined if not registered. */
+  get(name) {
+    return this.adapters.get(name);
+  }
+  /**
+   * Return the names of all registered adapters whose CLIs are actually
+   * installed and available on this machine.
+   */
+  async getAvailable() {
+    const results = [];
+    for (const [name, adapter] of this.adapters) {
+      try {
+        const available = await adapter.isAvailable();
+        if (available) {
+          results.push(name);
+        }
+      } catch {
+      }
+    }
+    return results;
+  }
+  /**
+   * Resolve the preferred adapter, falling back to an alternative if the
+   * preferred one is not available.
+   *
+   * @throws Error if neither preferred nor fallback adapter is available.
+   */
+  async getPreferred(preferred, fallback) {
+    const preferredAdapter = this.adapters.get(preferred);
+    if (preferredAdapter) {
+      try {
+        const available = await preferredAdapter.isAvailable();
+        if (available)
+          return preferredAdapter;
+      } catch {
+      }
+    }
+    if (fallback !== void 0) {
+      const fallbackAdapter = this.adapters.get(fallback);
+      if (fallbackAdapter) {
+        try {
+          const available = await fallbackAdapter.isAvailable();
+          if (available)
+            return fallbackAdapter;
+        } catch {
+        }
+      }
+    }
+    throw new Error(`No available adapter found. Preferred: ${preferred}` + (fallback ? `, fallback: ${fallback}` : ""));
+  }
+};
+
+// ../adapters/dist/claude-code/adapter.js
+import { execFile } from "child_process";
+
+// ../adapters/dist/claude-code/commands.js
+function buildClaudeCommand(options) {
+  const args = [
+    "-p",
+    "--permission-mode",
+    "auto",
+    "--output-format",
+    "stream-json"
+  ];
+  if (options.allowedTools && options.allowedTools.length > 0) {
+    args.push("--allowedTools", options.allowedTools.join(","));
+  }
+  if (options.disallowedTools && options.disallowedTools.length > 0) {
+    args.push("--disallowedTools", options.disallowedTools.join(","));
+  }
+  if (options.useWorktree) {
+    args.push("--worktree");
+  }
+  return { cmd: "claude", args };
+}
+
+// ../adapters/dist/claude-code/parser.js
+function parseClaudeJsonStream(line) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0)
+    return null;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    const obj = parsed;
+    if (typeof obj["type"] !== "string") {
+      return null;
+    }
+    return obj;
+  } catch {
+    return null;
+  }
+}
+
+// ../adapters/dist/claude-code/adapter.js
+var ClaudeCodeAdapter = class extends BaseAdapter {
+  name = "claude-code";
+  buildCommand(options) {
+    return buildClaudeCommand(options);
+  }
+  parseOutput(raw, stream) {
+    const output = {
+      stream,
+      data: raw,
+      timestamp: Date.now()
+    };
+    if (stream === "stdout") {
+      const event = parseClaudeJsonStream(raw);
+      if (event !== null) {
+        output.parsed = event;
+      }
+    }
+    return output;
+  }
+  getAuthCommand() {
+    return "claude";
+  }
+  async isAvailable() {
+    try {
+      const version = await this.getVersion();
+      return version !== null;
+    } catch {
+      return false;
+    }
+  }
+  getVersion() {
+    return new Promise((resolve4) => {
+      execFile("claude", ["--version"], { timeout: 1e4, shell: process.platform === "win32" }, (error, stdout) => {
+        if (error) {
+          resolve4(null);
+          return;
+        }
+        const trimmed = stdout.trim();
+        if (trimmed.length === 0) {
+          resolve4(null);
+          return;
+        }
+        const match = trimmed.match(/(\d+\.\d+\.\d+[\w.-]*)/);
+        resolve4(match ? match[1] : trimmed);
+      });
+    });
+  }
+};
+
+// ../adapters/dist/codex-cli/adapter.js
+import { execFile as execFile2, execSync } from "child_process";
+
+// ../adapters/dist/codex-cli/commands.js
+function buildCodexCommand(options) {
+  const args = [
+    "exec",
+    "--full-auto",
+    "--json",
+    "-"
+    // Read prompt from stdin
+  ];
+  return { cmd: "codex", args };
+}
+
+// ../adapters/dist/codex-cli/parser.js
+var COMMAND_PATTERN = /^\s*[$>]\s+/;
+var ERROR_PATTERN = /^(Error|FATAL|FAIL(ED)?|Exception|Traceback)\b/i;
+var COMPLETION_PATTERN = /^(Done|Complete(d)?|Finished|Success(ful(ly)?)?)\b/i;
+function parseCodexOutput(line) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0) {
+    return { type: "text", content: "" };
+  }
+  if (ERROR_PATTERN.test(trimmed)) {
+    return { type: "error", content: trimmed };
+  }
+  if (COMPLETION_PATTERN.test(trimmed)) {
+    return { type: "completion", content: trimmed };
+  }
+  if (COMMAND_PATTERN.test(trimmed)) {
+    return { type: "command", content: trimmed };
+  }
+  return { type: "text", content: trimmed };
+}
+
+// ../adapters/dist/codex-cli/adapter.js
+var CodexCliAdapter = class extends BaseAdapter {
+  name = "codex-cli";
+  buildCommand(options) {
+    return buildCodexCommand(options);
+  }
+  /**
+   * Override spawn to:
+   * 1. Create an isolation branch for Codex to work on
+   * 2. Use the headless piped I/O path (codex exec)
+   * 3. Pipe the prompt via stdin
+   */
+  async spawn(options) {
+    const branchName = `cronies/codex-${Date.now()}`;
+    try {
+      execSync(`git checkout -b ${branchName}`, {
+        cwd: options.workingDirectory,
+        stdio: "ignore",
+        timeout: 5e3
+      });
+    } catch {
+      console.warn(`[codex] Failed to create isolation branch ${branchName} \u2014 running on current branch`);
+    }
+    return super.spawn({ ...options, mode: "supervised" });
+  }
+  parseOutput(raw, stream) {
+    const output = {
+      stream,
+      data: raw,
+      timestamp: Date.now()
+    };
+    if (stream === "stdout") {
+      try {
+        const obj = JSON.parse(raw.trim());
+        if (typeof obj === "object" && obj !== null && typeof obj.type === "string") {
+          output.parsed = obj;
+          return output;
+        }
+      } catch {
+      }
+    }
+    const parsed = parseCodexOutput(raw);
+    output.parsed = parsed;
+    return output;
+  }
+  getAuthCommand() {
+    return "codex auth login";
+  }
+  async isAvailable() {
+    try {
+      const version = await this.getVersion();
+      return version !== null;
+    } catch {
+      return false;
+    }
+  }
+  getVersion() {
+    return new Promise((resolve4) => {
+      execFile2("codex", ["--version"], { timeout: 1e4, shell: process.platform === "win32" }, (error, stdout) => {
+        if (error) {
+          resolve4(null);
+          return;
+        }
+        const trimmed = stdout.trim();
+        if (trimmed.length === 0) {
+          resolve4(null);
+          return;
+        }
+        const match = trimmed.match(/(\d+\.\d+\.\d+[\w.-]*)/);
+        resolve4(match ? match[1] : trimmed);
+      });
+    });
+  }
+};
+
+// ../adapters/dist/gemini-cli/adapter.js
+import { execFile as execFile3 } from "child_process";
+
+// ../adapters/dist/gemini-cli/commands.js
+function buildGeminiCommand(options) {
+  const args = [
+    "--approval-mode",
+    "yolo",
+    "-o",
+    "stream-json",
+    // Prompt is piped via stdin by the base adapter (bypasses cmd.exe char limit).
+    // -p with no value tells Gemini to read from stdin in non-interactive mode.
+    "-p"
+  ];
+  return { cmd: "gemini", args };
+}
+
+// ../adapters/dist/gemini-cli/parser.js
+function parseGeminiJsonStream(line) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0)
+    return null;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    const obj = parsed;
+    if (typeof obj["type"] !== "string")
+      return null;
+    return obj;
+  } catch {
+    return null;
+  }
+}
+
+// ../adapters/dist/gemini-cli/adapter.js
+var GeminiCliAdapter = class extends BaseAdapter {
+  name = "gemini-cli";
+  buildCommand(options) {
+    return buildGeminiCommand(options);
+  }
+  parseOutput(raw, stream) {
+    const output = {
+      stream,
+      data: raw,
+      timestamp: Date.now()
+    };
+    if (stream === "stdout") {
+      const event = parseGeminiJsonStream(raw);
+      if (event !== null) {
+        output.parsed = event;
+      }
+    }
+    return output;
+  }
+  getAuthCommand() {
+    return "gemini auth login";
+  }
+  async isAvailable() {
+    try {
+      const version = await this.getVersion();
+      return version !== null;
+    } catch {
+      return false;
+    }
+  }
+  getVersion() {
+    return new Promise((resolve4) => {
+      execFile3("gemini", ["--version"], { timeout: 1e4, shell: process.platform === "win32" }, (error, stdout) => {
+        if (error) {
+          resolve4(null);
+          return;
+        }
+        const trimmed = stdout.trim();
+        if (trimmed.length === 0) {
+          resolve4(null);
+          return;
+        }
+        const match = trimmed.match(/(\d+\.\d+\.\d+[\w.-]*)/);
+        resolve4(match ? match[1] : trimmed);
+      });
+    });
+  }
+};
+
+// ../adapters/dist/cursor-agent/adapter.js
+import { execFile as execFile4 } from "child_process";
+
+// ../adapters/dist/cursor-agent/commands.js
+function toWslPath(winPath) {
+  const normalized = winPath.replace(/\\/g, "/");
+  const match = normalized.match(/^([A-Za-z]):\/(.*)/);
+  if (!match)
+    return normalized;
+  return `/mnt/${match[1].toLowerCase()}/${match[2]}`;
+}
+function buildCursorAgentCommand(options) {
+  const isWindows = process.platform === "win32";
+  const workspace = isWindows ? toWslPath(options.workingDirectory) : options.workingDirectory;
+  const args = [
+    "-p",
+    "--trust",
+    "--yolo",
+    "--output-format",
+    "stream-json",
+    "--workspace",
+    workspace
+  ];
+  if (options.useWorktree) {
+    args.push("--worktree");
+  }
+  if (isWindows) {
+    const agentArgs = ["agent", ...args];
+    const escaped = agentArgs.map((a) => `'${a.replace(/'/g, "'\\''")}'`).join(" ");
+    return { cmd: "wsl", args: ["bash", "-ic", escaped], shell: false };
+  }
+  return { cmd: "agent", args };
+}
+
+// ../adapters/dist/cursor-agent/parser.js
+function parseCursorJsonStream(line) {
+  const trimmed = line.trim();
+  if (trimmed.length === 0)
+    return null;
+  try {
+    const parsed = JSON.parse(trimmed);
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+      return null;
+    }
+    const obj = parsed;
+    if (typeof obj["type"] !== "string")
+      return null;
+    return obj;
+  } catch {
+    return null;
+  }
+}
+
+// ../adapters/dist/cursor-agent/adapter.js
+var CursorAgentAdapter = class extends BaseAdapter {
+  name = "cursor-agent";
+  buildCommand(options) {
+    return buildCursorAgentCommand(options);
+  }
+  parseOutput(raw, stream) {
+    const output = {
+      stream,
+      data: raw,
+      timestamp: Date.now()
+    };
+    if (stream === "stdout") {
+      const event = parseCursorJsonStream(raw);
+      if (event !== null) {
+        output.parsed = event;
+      }
+    }
+    return output;
+  }
+  getAuthCommand() {
+    return "agent auth login";
+  }
+  async isAvailable() {
+    try {
+      const version = await this.getVersion();
+      return version !== null;
+    } catch {
+      return false;
+    }
+  }
+  getVersion() {
+    const isWindows = process.platform === "win32";
+    const cmd = isWindows ? "wsl" : "agent";
+    const args = isWindows ? ["bash", "-ic", "agent --version"] : ["--version"];
+    return new Promise((resolve4) => {
+      execFile4(cmd, args, { timeout: 1e4 }, (error, stdout) => {
+        if (error) {
+          resolve4(null);
+          return;
+        }
+        const trimmed = stdout.trim();
+        if (trimmed.length === 0) {
+          resolve4(null);
+          return;
+        }
+        const match = trimmed.match(/(\d+[\d.]+[\w.-]*)/);
+        resolve4(match ? match[1] : trimmed);
+      });
+    });
+  }
+};
+
+// src/adapters/manager.ts
+function createAdapterManager() {
+  const manager = new AdapterManager();
+  manager.register(new ClaudeCodeAdapter());
+  manager.register(new CodexCliAdapter());
+  manager.register(new GeminiCliAdapter());
+  manager.register(new CursorAgentAdapter());
+  return manager;
+}
+
+// src/policy/engine.ts
+var LocalPolicyEngine = class {
+  snapshot;
+  constructor(snapshot) {
+    this.snapshot = snapshot;
+  }
+  /** Replace the active policy snapshot (e.g. after a cloud policy update). */
+  updatePolicy(snapshot) {
+    this.snapshot = snapshot;
+  }
+  /** Return the current policy snapshot. */
+  getSnapshot() {
+    return this.snapshot;
+  }
+  // -------------------------------------------------------------------------
+  // Action evaluation
+  // -------------------------------------------------------------------------
+  /**
+   * Evaluate whether a classified action should proceed.
+   *
+   * Order of checks:
+   *  1. Deny list  (hard block)
+   *  2. Escalation patterns  (regex match -> escalate)
+   *  3. Risk threshold  (score exceeds limit -> escalate)
+   *  4. Allowed list  (if non-empty, action must be listed)
+   *  5. Default allow
+   */
+  evaluateAction(classification) {
+    const action = classification.detectedAction;
+    if (action && this.isDenied(action)) {
+      return {
+        allowed: false,
+        action: "deny",
+        reason: `Action '${action}' is in deny list`
+      };
+    }
+    if (action && this.matchesEscalationPattern(action)) {
+      return {
+        allowed: false,
+        action: "escalate",
+        reason: `Action '${action}' matches escalation pattern`
+      };
+    }
+    if (classification.riskScore > this.snapshot.localRiskThreshold) {
+      return {
+        allowed: false,
+        action: "escalate",
+        reason: `Risk score ${classification.riskScore} exceeds threshold ${this.snapshot.localRiskThreshold}`
+      };
+    }
+    if (this.snapshot.allowedActions.length > 0 && action) {
+      if (!this.snapshot.allowedActions.includes(action)) {
+        return {
+          allowed: false,
+          action: "escalate",
+          reason: `Action '${action}' not in allowed list`
+        };
+      }
+    }
+    return { allowed: true, action: "allow", reason: "Action permitted by policy" };
+  }
+  // -------------------------------------------------------------------------
+  // Limit checks
+  // -------------------------------------------------------------------------
+  /** True when retryCount is below the local retry threshold. */
+  canRetryLocally(retryCount) {
+    return retryCount < this.snapshot.localRetryThreshold;
+  }
+  /** True when the job is still within its maximum wall-clock duration. */
+  isWithinTimeLimit(startedAt) {
+    return Date.now() - startedAt < this.snapshot.maxJobDurationMs;
+  }
+  /** True when accumulated agent CPU time is below the policy limit. */
+  isWithinCostLimit(totalAgentTimeMs) {
+    return totalAgentTimeMs < this.snapshot.maxAgentTimeMs;
+  }
+  // -------------------------------------------------------------------------
+  // Private helpers
+  // -------------------------------------------------------------------------
+  isDenied(action) {
+    return this.snapshot.deniedActions.some((d) => action.includes(d));
+  }
+  matchesEscalationPattern(action) {
+    return this.snapshot.escalatePatterns.some((pattern) => {
+      try {
+        return new RegExp(pattern).test(action);
+      } catch {
+        return false;
+      }
+    });
+  }
+};
+
+// ../protocol/dist/version.js
+var PROTOCOL_VERSION = 1;
+
+// ../protocol/dist/messages.js
+import { z as z12 } from "zod";
+
+// ../core/dist/types/common.js
+import { z as z2 } from "zod";
+var AgentTypeSchema = z2.enum(["claude-code", "codex-cli", "gemini-cli", "cursor-agent"]);
+var EventSourceSchema = z2.enum(["daemon", "cloud"]);
+
+// ../core/dist/types/outcome.js
+import { z as z3 } from "zod";
+var TimeHorizonSchema = z3.enum(["ongoing", "deadline"]);
+var RiskLevelSchema = z3.enum(["low", "medium", "high"]);
+var OutcomeStatusSchema = z3.enum(["active", "paused", "completed", "failed"]);
+var OutcomeSchema = z3.object({
+  id: z3.string(),
+  teamId: z3.string(),
+  name: z3.string(),
+  objective: z3.string(),
+  successCriteria: z3.array(z3.string()),
+  timeHorizon: TimeHorizonSchema,
+  deadline: z3.date().optional(),
+  riskLevel: RiskLevelSchema,
+  policyId: z3.string(),
+  status: OutcomeStatusSchema,
+  createdAt: z3.date(),
+  updatedAt: z3.date()
+});
+
+// ../core/dist/types/job.js
+import { z as z4 } from "zod";
+var ScheduleTypeSchema = z4.enum(["cron", "event", "manual"]);
+var JobScheduleSchema = z4.object({
+  type: ScheduleTypeSchema,
+  cron: z4.string().optional(),
+  event: z4.string().optional()
+});
+var JobStatusSchema = z4.enum(["active", "paused", "completed"]);
+var JobSchema = z4.object({
+  id: z4.string(),
+  outcomeId: z4.string(),
+  name: z4.string(),
+  prompt: z4.string(),
+  schedule: JobScheduleSchema,
+  preferredAgent: AgentTypeSchema,
+  fallbackAgent: AgentTypeSchema.optional(),
+  workingDirectory: z4.string(),
+  repository: z4.string().optional(),
+  maxAttempts: z4.number().default(10),
+  timeout: z4.number().default(36e5),
+  status: JobStatusSchema,
+  createdAt: z4.date(),
+  updatedAt: z4.date()
+});
+
+// ../core/dist/types/run.js
+import { z as z5 } from "zod";
+var RunCostSchema = z5.object({
+  agentTimeMs: z5.number(),
+  tokenEstimate: z5.number().optional()
+});
+var RunSchema = z5.object({
+  id: z5.string(),
+  jobId: z5.string(),
+  daemonId: z5.string(),
+  agentUsed: AgentTypeSchema,
+  status: z5.string(),
+  startedAt: z5.date(),
+  completedAt: z5.date().optional(),
+  cost: RunCostSchema,
+  artifacts: z5.array(z5.string()),
+  exitReason: z5.string().optional(),
+  checkpointId: z5.string().optional()
+});
+
+// ../core/dist/types/event.js
+import { z as z6 } from "zod";
+var RunEventTypeSchema = z6.enum([
+  "state_transition",
+  "agent_output",
+  "classification",
+  "decision",
+  "checkpoint_created",
+  "escalation_sent",
+  "escalation_resolved",
+  "policy_updated",
+  "cost_accrued",
+  "health_check"
+]);
+var RunEventSchema = z6.object({
+  id: z6.string(),
+  runId: z6.string(),
+  source: EventSourceSchema,
+  sourceId: z6.string(),
+  type: RunEventTypeSchema,
+  payload: z6.record(z6.string(), z6.unknown()),
+  timestamp: z6.number(),
+  sequence: z6.number()
+});
+
+// ../core/dist/types/classification.js
+import { z as z7 } from "zod";
+var ClassificationCategorySchema = z7.enum([
+  "success",
+  "transient_error",
+  "fatal_error",
+  "milestone",
+  "complete",
+  "risky_action",
+  "ambiguous",
+  "idle"
+]);
+var ClassificationSchema = z7.object({
+  category: ClassificationCategorySchema,
+  confidence: z7.number().min(0).max(1),
+  riskScore: z7.number().min(0).max(100),
+  detectedAction: z7.string().optional(),
+  summary: z7.string(),
+  rawOutput: z7.string()
+});
+
+// ../core/dist/types/policy.js
+import { z as z8 } from "zod";
+var OfflineModeSchema = z8.enum(["pause", "continue-safe", "continue-all"]);
+var PolicySnapshotSchema = z8.object({
+  version: z8.number(),
+  updatedAt: z8.number(),
+  localRetryThreshold: z8.number().default(3),
+  localRiskThreshold: z8.number().default(60),
+  maxRetries: z8.number().default(10),
+  maxJobDurationMs: z8.number().default(36e5),
+  maxAgentTimeMs: z8.number().default(72e5),
+  allowedActions: z8.array(z8.string()),
+  deniedActions: z8.array(z8.string()),
+  escalatePatterns: z8.array(z8.string()),
+  allowAgentSwitching: z8.boolean(),
+  preferredAgent: AgentTypeSchema,
+  offlineMode: OfflineModeSchema,
+  offlineMaxRetries: z8.number().default(3)
+});
+
+// ../core/dist/types/escalation.js
+import { z as z9 } from "zod";
+var EscalationTypeSchema = z9.enum([
+  "STUCK_LOOP",
+  "POLICY_VIOLATION",
+  "HIGH_RISK",
+  "AMBIGUOUS_OUTPUT",
+  "LIMIT_EXCEEDED",
+  "CAPABILITY_GAP",
+  "CONFLICT"
+]);
+var EscalationSeveritySchema = z9.enum(["low", "medium", "high", "critical"]);
+var EscalationContextSchema = z9.object({
+  currentState: z9.string(),
+  recentOutput: z9.array(z9.string()),
+  classificationHistory: z9.array(ClassificationSchema),
+  checkpointId: z9.string().optional()
+});
+var EscalationRequestSchema = z9.object({
+  id: z9.string(),
+  daemonId: z9.string(),
+  jobId: z9.string(),
+  outcomeId: z9.string(),
+  runId: z9.string(),
+  escalationType: EscalationTypeSchema,
+  severity: EscalationSeveritySchema,
+  context: EscalationContextSchema,
+  localAssessment: z9.string(),
+  timestamp: z9.number()
+});
+var EscalationDecisionSchema = z9.discriminatedUnion("action", [
+  z9.object({ action: z9.literal("continue"), instruction: z9.string().optional() }),
+  z9.object({ action: z9.literal("retry"), modifiedPrompt: z9.string().optional() }),
+  z9.object({ action: z9.literal("switch_agent"), targetAgent: AgentTypeSchema }),
+  z9.object({ action: z9.literal("abort"), reason: z9.string() }),
+  z9.object({ action: z9.literal("human_escalation"), message: z9.string() }),
+  z9.object({ action: z9.literal("approve_action") }),
+  z9.object({ action: z9.literal("deny_action"), alternative: z9.string().optional() }),
+  z9.object({
+    action: z9.literal("wait"),
+    durationMs: z9.number(),
+    then: z9.lazy(() => EscalationDecisionSchema)
+  })
+]);
+var EscalationResponseSchema = z9.object({
+  id: z9.string(),
+  decision: EscalationDecisionSchema,
+  reasoning: z9.string(),
+  overrides: z9.record(z9.string(), z9.unknown()).optional(),
+  timestamp: z9.number()
+});
+
+// ../core/dist/types/checkpoint.js
+import { z as z10 } from "zod";
+var CheckpointSchema = z10.object({
+  id: z10.string(),
+  runId: z10.string(),
+  machineState: z10.string(),
+  machineContext: z10.string(),
+  agentState: z10.string().optional(),
+  createdAt: z10.date()
+});
+
+// ../core/dist/types/health.js
+import { z as z11 } from "zod";
+var SessionHealthStatusSchema = z11.enum([
+  "healthy",
+  // Normal operation, recent activity, no issues
+  "degraded",
+  // Retrying, elevated errors, but still progressing
+  "stalled",
+  // No output for extended period, may be stuck
+  "failing",
+  // Repeated errors, escalations pending
+  "terminated"
+  // Session ended (completed or failed)
+]);
+var HealthSignalsSchema = z11.object({
+  /** Seconds since last agent output */
+  idleSeconds: z11.number(),
+  /** Rolling error rate over last N classifications (0-1) */
+  errorRate: z11.number().min(0).max(1),
+  /** Current retry count vs max */
+  retryRatio: z11.number().min(0).max(1),
+  /** Number of pending escalations */
+  pendingEscalations: z11.number(),
+  /** Whether the agent process is alive */
+  processAlive: z11.boolean(),
+  /** Total wall-clock duration in ms */
+  wallClockMs: z11.number(),
+  /** Total agent CPU time in ms */
+  agentTimeMs: z11.number(),
+  /** Percentage of max job duration consumed (0-1) */
+  timebudgetUsed: z11.number().min(0).max(1),
+  /** Number of checkpoints created */
+  checkpointCount: z11.number(),
+  /** Most recent classification category, if any */
+  lastClassification: ClassificationCategorySchema.nullable(),
+  /** Most recent classification confidence */
+  lastConfidence: z11.number().min(0).max(1).nullable(),
+  /** Most recent risk score */
+  lastRiskScore: z11.number().min(0).max(100).nullable(),
+  /** Whether a stuck-loop pattern has been detected */
+  stuckLoopDetected: z11.boolean(),
+  /** Count of consecutive errors */
+  consecutiveErrors: z11.number()
+});
+var SessionHealthSchema = z11.object({
+  /** Job ID this health report belongs to */
+  jobId: z11.string(),
+  /** Run ID for the current execution */
+  runId: z11.string(),
+  /** Current agent type */
+  agent: AgentTypeSchema,
+  /** Current XState machine state (serialized) */
+  machineState: z11.string(),
+  /** Overall health status */
+  status: SessionHealthStatusSchema,
+  /** Individual health signals */
+  signals: HealthSignalsSchema,
+  /** Human-readable summary of current health */
+  summary: z11.string(),
+  /** Timestamp of this health snapshot */
+  timestamp: z11.number()
+});
+var HealthThresholdsSchema = z11.object({
+  /** Seconds of idle before marking as stalled (default: 120) */
+  stallIdleSeconds: z11.number().default(120),
+  /** Error rate threshold for degraded status (default: 0.3) */
+  degradedErrorRate: z11.number().default(0.3),
+  /** Error rate threshold for failing status (default: 0.6) */
+  failingErrorRate: z11.number().default(0.6),
+  /** Consecutive errors before failing (default: 3) */
+  failingConsecutiveErrors: z11.number().default(3),
+  /** Number of recent classifications to consider for error rate (default: 10) */
+  errorRateWindow: z11.number().default(10),
+  /** Repeated classification pattern length to detect stuck loops (default: 3) */
+  stuckLoopPatternLength: z11.number().default(3)
+});
+var DEFAULT_HEALTH_THRESHOLDS = {
+  stallIdleSeconds: 120,
+  degradedErrorRate: 0.3,
+  failingErrorRate: 0.6,
+  failingConsecutiveErrors: 3,
+  errorRateWindow: 10,
+  stuckLoopPatternLength: 3
+};
+
+// ../core/dist/state-machine/orchestrator.js
+import { setup } from "xstate";
+var initialContext = {
+  jobId: "",
+  outcomeId: "",
+  daemonId: "",
+  currentAgent: "claude-code",
+  agentProcessId: null,
+  retryCount: 0,
+  maxRetries: 10,
+  retryBackoffMs: 1e3,
+  lastClassification: null,
+  classificationHistory: [],
+  lastCheckpointId: null,
+  checkpointCount: 0,
+  pendingEscalation: null,
+  escalationCount: 0,
+  jobStartedAt: 0,
+  lastActivityAt: 0,
+  totalAgentTimeMs: 0,
+  policySnapshot: {
+    version: 0,
+    updatedAt: 0,
+    localRetryThreshold: 3,
+    localRiskThreshold: 60,
+    maxRetries: 10,
+    maxJobDurationMs: 36e5,
+    maxAgentTimeMs: 72e5,
+    allowedActions: [],
+    deniedActions: [],
+    escalatePatterns: [],
+    allowAgentSwitching: false,
+    preferredAgent: "claude-code",
+    offlineMode: "pause",
+    offlineMaxRetries: 3
+  },
+  pendingRunEvents: []
+};
+var orchestratorMachine = setup({
+  types: {
+    context: {},
+    events: {}
+  },
+  guards: {
+    canRetry: () => false,
+    retriesExhausted: () => false,
+    exceedsLocalPolicy: () => false,
+    tooManyRetries: () => false,
+    patternDetected: () => false,
+    highRiskAction: () => false,
+    exceedsTimeLimit: () => false,
+    exceedsCostEstimate: () => false,
+    hasResumePlan: () => false,
+    needsRestart: () => false,
+    isDecisionSwitchAgent: () => false,
+    isDecisionRetry: () => false,
+    isDecisionAbort: () => false,
+    isDecisionHumanEscalation: () => false
+  },
+  actions: {
+    spawnAgent: () => {
+    },
+    terminateAgent: () => {
+    },
+    incrementRetry: () => {
+    },
+    resetRetry: () => {
+    },
+    recordClassification: () => {
+    },
+    createCheckpoint: () => {
+    },
+    sendEscalation: () => {
+    },
+    recordRunEvent: () => {
+    },
+    updateTimings: () => {
+    },
+    assignJob: () => {
+    },
+    assignAgent: () => {
+    },
+    assignDecision: () => {
+    },
+    assignEscalation: () => {
+    },
+    clearEscalation: () => {
+    }
+  }
+}).createMachine({
+  id: "orchestrator",
+  context: initialContext,
+  initial: "idle",
+  states: {
+    // ------------------------------------------------------------------
+    // idle — waiting for a job assignment
+    // ------------------------------------------------------------------
+    idle: {
+      on: {
+        JOB_ASSIGNED: {
+          target: "starting",
+          actions: ["assignJob"]
+        }
+      }
+    },
+    // ------------------------------------------------------------------
+    // starting — spawn the agent process
+    // ------------------------------------------------------------------
+    starting: {
+      entry: ["spawnAgent"],
+      on: {
+        AGENT_SPAWNED: {
+          target: "observing",
+          actions: ["assignAgent"]
+        },
+        AGENT_SPAWN_FAILED: {
+          target: "failed"
+        },
+        CANCEL: { target: "cancelled" }
+      }
+    },
+    // ------------------------------------------------------------------
+    // observing — watching agent output
+    // ------------------------------------------------------------------
+    observing: {
+      entry: ["updateTimings"],
+      on: {
+        OUTPUT_RECEIVED: {
+          target: "classifying",
+          actions: ["recordRunEvent"]
+        },
+        AGENT_IDLE_TIMEOUT: [
+          {
+            target: "acting",
+            guard: "exceedsTimeLimit"
+          },
+          {
+            target: "classifying"
+          }
+        ],
+        PAUSE: { target: "paused", actions: ["createCheckpoint"] },
+        CANCEL: { target: "cancelled", actions: ["terminateAgent"] }
+      }
+    },
+    // ------------------------------------------------------------------
+    // classifying — evaluating agent output
+    // ------------------------------------------------------------------
+    classifying: {
+      on: {
+        CLASSIFIED_SUCCESS: {
+          target: "observing",
+          actions: ["recordClassification", "resetRetry", "updateTimings"]
+        },
+        CLASSIFIED_MILESTONE: {
+          target: "acting",
+          actions: ["recordClassification", "createCheckpoint"]
+        },
+        CLASSIFIED_DONE: {
+          target: "completed",
+          actions: ["recordClassification", "createCheckpoint"]
+        },
+        CLASSIFIED_TRANSIENT_ERROR: [
+          {
+            target: "acting",
+            guard: "patternDetected",
+            actions: ["recordClassification"]
+          },
+          {
+            target: "acting",
+            guard: "canRetry",
+            actions: ["recordClassification"]
+          },
+          {
+            target: "failed",
+            actions: ["recordClassification"]
+          }
+        ],
+        CLASSIFIED_COMPLEX_FAILURE: {
+          target: "acting",
+          actions: ["recordClassification"]
+        },
+        CLASSIFIED_RISKY_ACTION: [
+          {
+            target: "acting",
+            guard: "highRiskAction",
+            actions: ["recordClassification"]
+          },
+          {
+            target: "acting",
+            guard: "exceedsLocalPolicy",
+            actions: ["recordClassification"]
+          },
+          {
+            target: "observing",
+            actions: ["recordClassification"]
+          }
+        ],
+        CLASSIFIED_FATAL: {
+          target: "failed",
+          actions: ["recordClassification", "terminateAgent", "createCheckpoint"]
+        },
+        CLASSIFIED_AMBIGUOUS: {
+          target: "acting",
+          actions: ["recordClassification"]
+        },
+        CANCEL: { target: "cancelled", actions: ["terminateAgent"] }
+      }
+    },
+    // ------------------------------------------------------------------
+    // acting — compound state for taking action based on classification
+    // ------------------------------------------------------------------
+    acting: {
+      initial: "continuing",
+      on: {
+        CANCEL: { target: "cancelled", actions: ["terminateAgent"] },
+        PAUSE: { target: "paused", actions: ["createCheckpoint"] }
+      },
+      states: {
+        // Continue normal operation
+        continuing: {
+          always: [
+            {
+              target: "escalating",
+              guard: "exceedsTimeLimit"
+            },
+            {
+              target: "escalating",
+              guard: "exceedsCostEstimate"
+            },
+            {
+              target: "escalating",
+              guard: "tooManyRetries"
+            },
+            {
+              target: "escalating",
+              guard: "patternDetected"
+            }
+          ],
+          on: {
+            ACTION_COMPLETE: {
+              target: "#orchestrator.observing",
+              actions: ["updateTimings"]
+            }
+          }
+        },
+        // Retry with backoff
+        retrying: {
+          entry: ["incrementRetry"],
+          always: [
+            {
+              target: "escalating",
+              guard: "retriesExhausted"
+            }
+          ],
+          on: {
+            ACTION_COMPLETE: {
+              target: "#orchestrator.observing",
+              actions: ["updateTimings"]
+            }
+          }
+        },
+        // Checkpointing machine + agent state
+        checkpointing: {
+          entry: ["createCheckpoint"],
+          on: {
+            ACTION_COMPLETE: {
+              target: "#orchestrator.observing"
+            }
+          }
+        },
+        // Escalating to cloud for a decision
+        escalating: {
+          entry: ["sendEscalation"],
+          on: {
+            ESCALATION_SENT: {
+              target: "#orchestrator.paused.cloud_decision",
+              actions: ["assignEscalation"]
+            }
+          }
+        },
+        // Switching to fallback agent
+        switching: {
+          entry: ["terminateAgent", "spawnAgent"],
+          on: {
+            AGENT_SPAWNED: {
+              target: "#orchestrator.observing",
+              actions: ["assignAgent", "resetRetry"]
+            },
+            AGENT_SPAWN_FAILED: {
+              target: "#orchestrator.failed"
+            }
+          }
+        }
+      }
+    },
+    // ------------------------------------------------------------------
+    // paused — waiting for external input
+    // ------------------------------------------------------------------
+    paused: {
+      initial: "user_requested",
+      on: {
+        CANCEL: { target: "cancelled", actions: ["terminateAgent"] }
+      },
+      states: {
+        // Human escalation — waiting for human operator
+        human_escalation: {
+          on: {
+            CLOUD_DECISION_RECEIVED: {
+              target: "#orchestrator.observing",
+              actions: ["assignDecision", "clearEscalation"]
+            }
+          }
+        },
+        // Cloud decision — waiting for automated cloud response
+        cloud_decision: {
+          on: {
+            CLOUD_DECISION_RECEIVED: [
+              {
+                target: "#orchestrator.acting.switching",
+                guard: "isDecisionSwitchAgent",
+                actions: ["assignDecision", "clearEscalation"]
+              },
+              {
+                target: "#orchestrator.acting.retrying",
+                guard: "isDecisionRetry",
+                actions: ["assignDecision", "clearEscalation"]
+              },
+              {
+                target: "#orchestrator.failed",
+                guard: "isDecisionAbort",
+                actions: ["assignDecision", "clearEscalation", "terminateAgent"]
+              },
+              {
+                target: "human_escalation",
+                guard: "isDecisionHumanEscalation",
+                actions: ["assignDecision"]
+              },
+              {
+                target: "#orchestrator.observing",
+                actions: ["assignDecision", "clearEscalation"]
+              }
+            ]
+          }
+        },
+        // Cooldown — brief pause before retrying
+        cooldown: {
+          on: {
+            RESUME: [
+              {
+                target: "#orchestrator.starting",
+                guard: "needsRestart"
+              },
+              {
+                target: "#orchestrator.observing",
+                guard: "hasResumePlan"
+              }
+            ]
+          }
+        },
+        // User-requested pause
+        user_requested: {
+          on: {
+            RESUME: [
+              {
+                target: "#orchestrator.starting",
+                guard: "needsRestart"
+              },
+              {
+                target: "#orchestrator.observing",
+                guard: "hasResumePlan"
+              }
+            ]
+          }
+        }
+      }
+    },
+    // ------------------------------------------------------------------
+    // Terminal states
+    // ------------------------------------------------------------------
+    completed: {
+      type: "final",
+      entry: ["terminateAgent", "createCheckpoint", "recordRunEvent"]
+    },
+    failed: {
+      type: "final",
+      entry: ["terminateAgent", "recordRunEvent"]
+    },
+    cancelled: {
+      type: "final",
+      entry: ["recordRunEvent"]
+    }
+  }
+});
+
+// ../core/dist/state-machine/guards.js
+function canRetry({ context }) {
+  return context.retryCount < context.maxRetries;
+}
+function retriesExhausted({ context }) {
+  return context.retryCount >= context.maxRetries;
+}
+function exceedsLocalPolicy({ context }) {
+  const action = context.lastClassification?.detectedAction;
+  if (!action)
+    return false;
+  const { allowedActions, deniedActions, escalatePatterns } = context.policySnapshot;
+  if (deniedActions.includes(action))
+    return true;
+  if (allowedActions.length > 0 && !allowedActions.includes(action))
+    return true;
+  return escalatePatterns.some((pattern) => {
+    try {
+      return new RegExp(pattern).test(action);
+    } catch {
+      return false;
+    }
+  });
+}
+function tooManyRetries({ context }) {
+  return context.retryCount > context.policySnapshot.localRetryThreshold;
+}
+function patternDetected({ context }) {
+  const recent = context.classificationHistory.slice(-5);
+  const errorCount = recent.filter((c) => c.category === "transient_error" || c.category === "fatal_error").length;
+  return errorCount >= 3;
+}
+function highRiskAction({ context }) {
+  if (!context.lastClassification)
+    return false;
+  return context.lastClassification.riskScore > context.policySnapshot.localRiskThreshold;
+}
+function exceedsTimeLimit({ context }) {
+  const elapsed = Date.now() - context.jobStartedAt;
+  return elapsed > context.policySnapshot.maxJobDurationMs;
+}
+function exceedsCostEstimate({ context }) {
+  return context.totalAgentTimeMs > context.policySnapshot.maxAgentTimeMs;
+}
+function hasResumePlan({ context }) {
+  return context.lastCheckpointId !== null;
+}
+function needsRestart({ context }) {
+  return context.lastCheckpointId === null;
+}
+function isDecisionSwitchAgent({ event }) {
+  return event.decision?.action === "switch_agent";
+}
+function isDecisionRetry({ event }) {
+  return event.decision?.action === "retry";
+}
+function isDecisionAbort({ event }) {
+  return event.decision?.action === "abort";
+}
+function isDecisionHumanEscalation({ event }) {
+  return event.decision?.action === "human_escalation";
+}
+
+// ../core/dist/constants.js
+var DEFAULT_POLICY = {
+  localRetryThreshold: 3,
+  localRiskThreshold: 60,
+  maxRetries: 10,
+  maxJobDurationMs: 36e5,
+  maxAgentTimeMs: 72e5,
+  offlineMaxRetries: 3
+};
+
+// ../protocol/dist/messages.js
+var ProtocolEnvelopeSchema = z12.object({
+  v: z12.number(),
+  id: z12.string(),
+  type: z12.string(),
+  ts: z12.number()
+});
+var JobDefinitionSchema = z12.object({
+  id: z12.string(),
+  outcomeId: z12.string(),
+  name: z12.string(),
+  prompt: z12.string(),
+  preferredAgent: AgentTypeSchema,
+  fallbackAgent: AgentTypeSchema.optional(),
+  workingDirectory: z12.string(),
+  repository: z12.string().optional(),
+  maxAttempts: z12.number(),
+  timeout: z12.number()
+});
+var StateOverrideSchema = z12.object({
+  jobId: z12.string(),
+  machineState: z12.string(),
+  machineContext: z12.string(),
+  reason: z12.string()
+});
+var baseEnvelope = (type) => ProtocolEnvelopeSchema.extend({ type: z12.literal(type) });
+var DaemonHelloSchema = baseEnvelope("daemon:hello").extend({
+  daemonId: z12.string(),
+  lastCloudSeq: z12.number(),
+  protocolVersion: z12.number(),
+  daemonVersion: z12.string(),
+  hostname: z12.string()
+});
+var DaemonHeartbeatSchema = baseEnvelope("daemon:heartbeat").extend({
+  daemonId: z12.string(),
+  activeJobs: z12.number(),
+  cpuUsage: z12.number(),
+  memoryUsage: z12.number()
+});
+var DaemonEventBatchSchema = baseEnvelope("daemon:event_batch").extend({
+  daemonId: z12.string(),
+  events: z12.array(RunEventSchema)
+});
+var DaemonStateSnapshotSchema = baseEnvelope("daemon:state_snapshot").extend({
+  daemonId: z12.string(),
+  jobId: z12.string(),
+  machineState: z12.string(),
+  machineContext: z12.string()
+});
+var DaemonEscalationRequestSchema = baseEnvelope("daemon:escalation_request").extend({
+  escalation: EscalationRequestSchema
+});
+var DaemonAgentOutputSchema = baseEnvelope("daemon:agent_output").extend({
+  daemonId: z12.string(),
+  jobId: z12.string(),
+  runId: z12.string(),
+  output: z12.string(),
+  stream: z12.enum(["stdout", "stderr"]),
+  timestamp: z12.number()
+});
+var DaemonJobStatusSchema = baseEnvelope("daemon:job_status").extend({
+  daemonId: z12.string(),
+  jobId: z12.string(),
+  runId: z12.string(),
+  status: z12.string(),
+  classification: ClassificationSchema.optional()
+});
+var DaemonMessageSchema = z12.discriminatedUnion("type", [
+  DaemonHelloSchema,
+  DaemonHeartbeatSchema,
+  DaemonEventBatchSchema,
+  DaemonStateSnapshotSchema,
+  DaemonEscalationRequestSchema,
+  DaemonAgentOutputSchema,
+  DaemonJobStatusSchema
+]);
+var CloudWelcomeSchema = baseEnvelope("cloud:welcome").extend({
+  lastDaemonSeq: z12.number(),
+  pendingJobs: z12.array(JobDefinitionSchema),
+  policySnapshot: PolicySnapshotSchema,
+  pendingOverrides: z12.array(StateOverrideSchema)
+});
+var CloudJobAssignSchema = baseEnvelope("cloud:job_assign").extend({
+  jobId: z12.string(),
+  outcomeId: z12.string(),
+  job: JobDefinitionSchema,
+  policySnapshot: PolicySnapshotSchema
+});
+var CloudJobCancelSchema = baseEnvelope("cloud:job_cancel").extend({
+  jobId: z12.string(),
+  reason: z12.string()
+});
+var CloudJobPauseSchema = baseEnvelope("cloud:job_pause").extend({
+  jobId: z12.string()
+});
+var CloudJobResumeSchema = baseEnvelope("cloud:job_resume").extend({
+  jobId: z12.string(),
+  checkpoint: z12.string().optional()
+});
+var CloudEscalationResponseSchema = baseEnvelope("cloud:escalation_response").extend({
+  escalationResponse: EscalationResponseSchema
+});
+var CloudPolicyUpdateSchema = baseEnvelope("cloud:policy_update").extend({
+  policySnapshot: PolicySnapshotSchema
+});
+var CloudStateOverrideSchema = baseEnvelope("cloud:state_override").extend({
+  jobId: z12.string(),
+  machineState: z12.string(),
+  machineContext: z12.string(),
+  reason: z12.string()
+});
+var CloudEventBatchSchema = baseEnvelope("cloud:event_batch").extend({
+  events: z12.array(RunEventSchema)
+});
+var CloudAckSchema = baseEnvelope("cloud:ack").extend({
+  lastSeq: z12.number()
+});
+var CloudTokenRefreshSchema = baseEnvelope("cloud:token_refresh").extend({
+  token: z12.string(),
+  expiresAt: z12.number()
+});
+var CloudMessageSchema = z12.discriminatedUnion("type", [
+  CloudWelcomeSchema,
+  CloudJobAssignSchema,
+  CloudJobCancelSchema,
+  CloudJobPauseSchema,
+  CloudJobResumeSchema,
+  CloudEscalationResponseSchema,
+  CloudPolicyUpdateSchema,
+  CloudStateOverrideSchema,
+  CloudEventBatchSchema,
+  CloudAckSchema,
+  CloudTokenRefreshSchema
+]);
+var ProtocolMessageSchema = z12.union([DaemonMessageSchema, CloudMessageSchema]);
+
+// ../protocol/dist/codec.js
+import { randomUUID } from "crypto";
+function createMessageId() {
+  return randomUUID();
+}
+function createEnvelope(type, payload) {
+  return {
+    v: PROTOCOL_VERSION,
+    id: createMessageId(),
+    type,
+    ts: Date.now(),
+    ...payload
+  };
+}
+function encodeMessage(msg) {
+  return JSON.stringify(msg);
+}
+function decodeMessage(raw) {
+  const json2 = JSON.parse(raw);
+  const daemonResult = DaemonMessageSchema.safeParse(json2);
+  if (daemonResult.success) {
+    return daemonResult.data;
+  }
+  const cloudResult = CloudMessageSchema.safeParse(json2);
+  if (cloudResult.success) {
+    return cloudResult.data;
+  }
+  const parsed = json2;
+  if (typeof parsed?.type === "string" && parsed.type.startsWith("daemon:")) {
+    throw daemonResult.error;
+  }
+  throw cloudResult.error;
+}
+
+// ../protocol/dist/auth.js
+import { z as z13 } from "zod";
+var DaemonRegistrationRequestSchema = z13.object({
+  clerkToken: z13.string(),
+  hostname: z13.string(),
+  daemonVersion: z13.string(),
+  capabilities: z13.array(AgentTypeSchema)
+});
+var DaemonRegistrationResponseSchema = z13.object({
+  daemonId: z13.string(),
+  daemonToken: z13.string(),
+  expiresAt: z13.number(),
+  wsUrl: z13.string()
+});
+
+// src/sync/queue.ts
+var SyncQueue = class {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  /**
+   * Enqueue a message for later delivery.
+   * Called when the SyncClient is disconnected.
+   */
+  enqueue(message) {
+    this.store.enqueueMessage(message.type, encodeMessage(message));
+  }
+  /**
+   * Drain queued messages by passing each to the send function.
+   * Stops draining if a send fails (connection lost again).
+   * Returns the number of messages successfully sent.
+   */
+  drain(sendFn) {
+    const messages = this.store.dequeueMessages(100);
+    let sent = 0;
+    for (const msg of messages) {
+      let decoded;
+      try {
+        decoded = JSON.parse(msg.payload);
+      } catch {
+        this.store.markMessageSent(msg.id);
+        continue;
+      }
+      if (sendFn(decoded)) {
+        this.store.markMessageSent(msg.id);
+        sent++;
+      } else {
+        break;
+      }
+    }
+    return sent;
+  }
+  /**
+   * Get the count of messages waiting to be sent.
+   */
+  getPendingCount() {
+    return this.store.dequeueMessages(1e4).length;
+  }
+};
+
+// src/sync/reconciler.ts
+var SyncReconciler = class {
+  store;
+  constructor(store) {
+    this.store = store;
+  }
+  /**
+   * Called when the cloud sends a welcome message after our hello.
+   * Reconciles pending jobs, policy, and state overrides from the cloud.
+   */
+  handleWelcome(welcome) {
+    for (const job of welcome.pendingJobs) {
+      this.store.saveJob(
+        job.id,
+        job.outcomeId,
+        job,
+        "idle",
+        // initial machine state
+        "{}"
+        // initial machine context
+      );
+    }
+    this.store.cachePolicy(welcome.policySnapshot);
+    for (const override of welcome.pendingOverrides) {
+      this.store.updateJobState(
+        override.jobId,
+        override.machineState,
+        override.machineContext,
+        "active"
+      );
+    }
+    console.log(
+      `[sync:reconciler] Welcome received: ${welcome.pendingJobs.length} pending jobs, ${welcome.pendingOverrides.length} overrides, policy v${welcome.policySnapshot.version}`
+    );
+  }
+  /**
+   * Called when the cloud sends a batch of events (e.g., events from other daemons
+   * or cloud-generated events).
+   */
+  handleCloudEvents(batch) {
+    for (const event of batch.events) {
+      const jobId = event.payload["jobId"] ?? "unknown";
+      this.store.appendEvent({
+        id: event.id,
+        runId: event.runId,
+        jobId,
+        source: event.source,
+        sourceId: event.sourceId,
+        type: event.type,
+        payload: event.payload,
+        timestamp: event.timestamp
+      });
+    }
+    console.log(`[sync:reconciler] Stored ${batch.events.length} cloud events`);
+  }
+  /**
+   * Called when the cloud acknowledges receipt of our events.
+   * Marks events as synced up to the acknowledged sequence number.
+   */
+  handleAck(ack) {
+    this.store.markEventsSynced(ack.lastSeq);
+    console.log(`[sync:reconciler] Events synced up to seq ${ack.lastSeq}`);
+  }
+  /**
+   * Called when the cloud sends a policy update.
+   * Updates the cached policy so the daemon uses the latest rules.
+   */
+  handlePolicyUpdate(update) {
+    this.store.cachePolicy(update.policySnapshot);
+    console.log(`[sync:reconciler] Policy updated to v${update.policySnapshot.version}`);
+  }
+  /**
+   * Get events that need to be synced to the cloud.
+   */
+  getUnsyncedEvents(limit) {
+    return this.store.getUnsyncedEvents(limit);
+  }
+};
+
+// src/orchestrator/health.ts
+var SessionHealthMonitor = class {
+  thresholds;
+  lastOutputAt;
+  processAlive = false;
+  runId;
+  constructor(runId, thresholds) {
+    this.runId = runId;
+    this.thresholds = { ...DEFAULT_HEALTH_THRESHOLDS, ...thresholds };
+    this.lastOutputAt = Date.now();
+  }
+  /** Call when agent output is received to reset the idle timer. */
+  recordOutput() {
+    this.lastOutputAt = Date.now();
+  }
+  /** Call when agent process spawns or dies. */
+  setProcessAlive(alive) {
+    this.processAlive = alive;
+  }
+  /** Compute the current health snapshot from orchestrator context. */
+  compute(context, machineState) {
+    const now = Date.now();
+    const signals = this.computeSignals(context, now);
+    const status = this.deriveStatus(signals, machineState);
+    const summary = this.buildSummary(status, signals, context.currentAgent, machineState);
+    return {
+      jobId: context.jobId,
+      runId: this.runId,
+      agent: context.currentAgent,
+      machineState,
+      status,
+      signals,
+      summary,
+      timestamp: now
+    };
+  }
+  // -------------------------------------------------------------------------
+  // Signal computation
+  // -------------------------------------------------------------------------
+  computeSignals(context, now) {
+    const history = context.classificationHistory;
+    const window = history.slice(-this.thresholds.errorRateWindow);
+    const errorCategories = [
+      "transient_error",
+      "fatal_error"
+    ];
+    const errorCount = window.filter((c) => errorCategories.includes(c.category)).length;
+    const errorRate = window.length > 0 ? errorCount / window.length : 0;
+    const consecutiveErrors = this.countConsecutiveErrors(history);
+    const stuckLoopDetected = this.detectStuckLoop(history);
+    const maxDuration = context.policySnapshot.maxJobDurationMs || 36e5;
+    const wallClockMs = now - context.jobStartedAt;
+    const timebudgetUsed = Math.min(wallClockMs / maxDuration, 1);
+    const last = context.lastClassification;
+    return {
+      idleSeconds: Math.floor((now - this.lastOutputAt) / 1e3),
+      errorRate,
+      retryRatio: context.maxRetries > 0 ? context.retryCount / context.maxRetries : 0,
+      pendingEscalations: context.pendingEscalation ? 1 : 0,
+      processAlive: this.processAlive,
+      wallClockMs,
+      agentTimeMs: context.totalAgentTimeMs,
+      timebudgetUsed,
+      checkpointCount: context.checkpointCount,
+      lastClassification: last?.category ?? null,
+      lastConfidence: last?.confidence ?? null,
+      lastRiskScore: last?.riskScore ?? null,
+      stuckLoopDetected,
+      consecutiveErrors
+    };
+  }
+  // -------------------------------------------------------------------------
+  // Status derivation — maps signals to a single health status
+  // -------------------------------------------------------------------------
+  deriveStatus(signals, machineState) {
+    if (machineState === "completed" || machineState === "failed" || machineState === "cancelled") {
+      return "terminated";
+    }
+    if (signals.errorRate >= this.thresholds.failingErrorRate || signals.consecutiveErrors >= this.thresholds.failingConsecutiveErrors || signals.pendingEscalations > 0) {
+      return "failing";
+    }
+    if (signals.idleSeconds >= this.thresholds.stallIdleSeconds && signals.processAlive) {
+      return "stalled";
+    }
+    if (!signals.processAlive && machineState !== "idle" && machineState !== "starting") {
+      return "stalled";
+    }
+    if (signals.errorRate >= this.thresholds.degradedErrorRate || signals.retryRatio > 0.5 || signals.stuckLoopDetected || signals.timebudgetUsed > 0.8) {
+      return "degraded";
+    }
+    return "healthy";
+  }
+  // -------------------------------------------------------------------------
+  // Helpers
+  // -------------------------------------------------------------------------
+  countConsecutiveErrors(history) {
+    let count = 0;
+    for (let i = history.length - 1; i >= 0; i--) {
+      if (history[i].category === "transient_error" || history[i].category === "fatal_error") {
+        count++;
+      } else {
+        break;
+      }
+    }
+    return count;
+  }
+  detectStuckLoop(history) {
+    const len = this.thresholds.stuckLoopPatternLength;
+    if (history.length < len * 2) return false;
+    const recent = history.slice(-len).map((c) => c.category);
+    const prior = history.slice(-len * 2, -len).map((c) => c.category);
+    return recent.every((cat, i) => cat === prior[i]);
+  }
+  buildSummary(status, signals, agent, machineState) {
+    const parts = [];
+    switch (status) {
+      case "healthy":
+        parts.push(`${agent} running normally`);
+        break;
+      case "degraded":
+        parts.push(`${agent} degraded`);
+        if (signals.stuckLoopDetected) parts.push("stuck loop detected");
+        if (signals.retryRatio > 0.5) parts.push(`retries at ${Math.round(signals.retryRatio * 100)}%`);
+        if (signals.timebudgetUsed > 0.8) parts.push(`${Math.round(signals.timebudgetUsed * 100)}% time budget used`);
+        break;
+      case "stalled":
+        parts.push(`${agent} stalled`);
+        parts.push(`idle ${signals.idleSeconds}s`);
+        if (!signals.processAlive) parts.push("process not responding");
+        break;
+      case "failing":
+        parts.push(`${agent} failing`);
+        if (signals.consecutiveErrors > 0) parts.push(`${signals.consecutiveErrors} consecutive errors`);
+        if (signals.pendingEscalations > 0) parts.push("escalation pending");
+        break;
+      case "terminated":
+        parts.push(`${agent} ${machineState}`);
+        break;
+    }
+    if (signals.lastClassification && status !== "terminated") {
+      parts.push(`last: ${signals.lastClassification}`);
+    }
+    return parts.join(" \u2014 ");
+  }
+};
+
+// src/orchestrator/runner.ts
+import { createActor, assign } from "xstate";
+
+// src/orchestrator/summary.ts
+var FILE_EXT = /\.(ts|tsx|js|jsx|json|md|css|html|py|rs|go|yaml|yml|toml|sql|sh|bat|ps1)$/i;
+var FILE_CREATED_PATTERNS = [
+  /^A\s+(.+)$/,
+  // git-style "A path/to/file"
+  /Created\s+\[?([^\]\s]+\.\w+)/i,
+  // "Created [file.ts]" or "Created file.ts"
+  /new file mode/,
+  // git diff header (skip, use the A line)
+  /^\+\+\+ b\/(.+)$/
+  // git diff "+++ b/path"
+];
+var FILE_MODIFIED_PATTERNS = [
+  /^M\s+(.+)$/,
+  // git-style "M path/to/file"
+  /Modified\s+\[?([^\]\s]+\.\w+)/i,
+  // "Modified file.ts"
+  /Updated\s+\[?([^\]\s]+\.\w+)/i
+  // "Updated file.ts"
+];
+var TOOL_PATTERNS = [
+  [/apply_patch/i, "apply_patch"],
+  [/\bexec\b.*exited/i, "shell"],
+  [/Tool:\s*(\w+)/i, "$1"],
+  [/tool_call.*"name":\s*"([^"]+)"/i, "$1"],
+  [/\bBash\b/i, "Bash"],
+  [/\bEdit\b/i, "Edit"],
+  [/\bWrite\b/i, "Write"],
+  [/\bRead\b/i, "Read"]
+];
+var ERROR_PATTERNS = [
+  /\bERROR\b/i,
+  /\bfailed\b/i,
+  /\berror:\b/i,
+  /exited\s+(?!0\b)\d+/i,
+  // non-zero exit
+  /\bpanic\b/i,
+  /\btimeout\b/i,
+  /rate.?limit/i
+];
+var NOISE_PATTERNS = [
+  /^[\s{}[\]]+$/,
+  // braces, brackets
+  /^[-=]{3,}$/,
+  // dividers
+  /^(diff --git|index \w|---|\+\+\+|@@)/,
+  // diff headers
+  /^[+-]\s*[{})\]]/,
+  // diff context lines
+  /^new file mode/,
+  /^file update:?$/i,
+  /^\d[\d,]+$/,
+  // bare numbers
+  /^(tokens?\s+used|mcp:|session\s+id:)/i,
+  // metadata
+  /^```/
+  // code fences
+];
+function extractSessionSummary(outputBuffer) {
+  const filesCreated = /* @__PURE__ */ new Set();
+  const filesModified = /* @__PURE__ */ new Set();
+  const toolsUsed = /* @__PURE__ */ new Set();
+  const errors = [];
+  let tokensUsed = null;
+  let agentVersion = null;
+  let model = null;
+  let lastSubstantiveLine = "";
+  for (let i = 0; i < outputBuffer.length; i++) {
+    const line = outputBuffer[i].trim();
+    if (!line) continue;
+    if (!agentVersion) {
+      const vMatch = line.match(/(Claude Code|OpenAI Codex|Gemini CLI|Cursor Agent)\s+v?([\d.]+[^\s]*)/i);
+      if (vMatch) {
+        agentVersion = `${vMatch[1]} ${vMatch[2]}`;
+      }
+    }
+    if (!model) {
+      const mMatch = line.match(/^model:\s+(.+)$/i);
+      if (mMatch) model = mMatch[1].trim();
+    }
+    if (tokensUsed === null) {
+      if (/tokens?\s+used/i.test(line)) {
+        const next = outputBuffer[i + 1]?.trim() ?? "";
+        const num = next.replace(/,/g, "");
+        if (/^\d+$/.test(num)) {
+          tokensUsed = parseInt(num, 10);
+        }
+      }
+      const tMatch = line.match(/total_tokens["\s:]+(\d+)/);
+      if (tMatch) tokensUsed = parseInt(tMatch[1], 10);
+    }
+    for (const pattern of FILE_CREATED_PATTERNS) {
+      const match = line.match(pattern);
+      if (match?.[1] && FILE_EXT.test(match[1])) {
+        filesCreated.add(match[1].replace(/\\/g, "/"));
+      }
+    }
+    for (const pattern of FILE_MODIFIED_PATTERNS) {
+      const match = line.match(pattern);
+      if (match?.[1] && FILE_EXT.test(match[1])) {
+        filesModified.add(match[1].replace(/\\/g, "/"));
+      }
+    }
+    for (const [pattern, name] of TOOL_PATTERNS) {
+      if (pattern.test(line)) {
+        const toolName = name.startsWith("$") ? line.match(pattern)?.[1] ?? name : name;
+        toolsUsed.add(toolName);
+      }
+    }
+    if (errors.length < 5) {
+      for (const pattern of ERROR_PATTERNS) {
+        if (pattern.test(line) && !line.includes("failed to load skill")) {
+          errors.push(line.length > 200 ? line.slice(0, 200) + "..." : line);
+          break;
+        }
+      }
+    }
+    const isNoise = NOISE_PATTERNS.some((p) => p.test(line));
+    if (!isNoise && line.length > 10) {
+      lastSubstantiveLine = line;
+    }
+  }
+  for (const f of filesCreated) {
+    filesModified.delete(f);
+  }
+  return {
+    filesCreated: [...filesCreated],
+    filesModified: [...filesModified],
+    toolsUsed: [...toolsUsed],
+    errors,
+    finalResult: lastSubstantiveLine.length > 500 ? lastSubstantiveLine.slice(0, 500) + "..." : lastSubstantiveLine,
+    tokensUsed,
+    agentVersion,
+    model
+  };
+}
+
+// src/orchestrator/runner.ts
+import { ulid as ulid2 } from "ulid";
+var JobRunner = class {
+  actor;
+  adapter;
+  process = null;
+  policy;
+  prompt;
+  workingDirectory;
+  // sessionMode removed — all sessions run headless (supervised)
+  classificationRules;
+  outputBuffer = [];
+  lastExitCode = null;
+  runId;
+  callbacks;
+  eventSequence = 0;
+  jobId;
+  daemonId;
+  hardTimeoutTimer = null;
+  healthMonitor;
+  healthInterval = null;
+  constructor(options, callbacks = {}) {
+    this.adapter = options.adapter;
+    this.policy = options.policy;
+    this.prompt = options.prompt;
+    this.workingDirectory = options.workingDirectory;
+    this.classificationRules = options.classificationRules ?? [];
+    this.runId = options.runId;
+    this.callbacks = callbacks;
+    this.jobId = options.jobId;
+    this.daemonId = options.daemonId;
+    this.healthMonitor = new SessionHealthMonitor(options.runId, options.healthThresholds);
+    const self = this;
+    const providedMachine = orchestratorMachine.provide({
+      guards: {
+        canRetry,
+        retriesExhausted,
+        exceedsLocalPolicy,
+        tooManyRetries,
+        patternDetected,
+        highRiskAction,
+        exceedsTimeLimit,
+        exceedsCostEstimate,
+        hasResumePlan,
+        needsRestart,
+        isDecisionSwitchAgent,
+        isDecisionRetry,
+        isDecisionAbort,
+        isDecisionHumanEscalation
+      },
+      actions: {
+        // -- Context-mutating (assign) actions ----------------------------
+        assignJob: assign(({ event }) => {
+          const e = event;
+          return {
+            jobId: e.jobId,
+            outcomeId: e.outcomeId,
+            daemonId: e.daemonId,
+            policySnapshot: e.policySnapshot,
+            maxRetries: e.policySnapshot.maxRetries,
+            jobStartedAt: Date.now(),
+            lastActivityAt: Date.now()
+          };
+        }),
+        assignAgent: assign(({ event }) => {
+          const e = event;
+          return {
+            agentProcessId: e.agentProcessId,
+            currentAgent: e.agent,
+            lastActivityAt: Date.now()
+          };
+        }),
+        assignDecision: assign(({ event }) => {
+          const e = event;
+          return {
+            lastActivityAt: Date.now()
+            // Store decision info if needed for logging
+          };
+        }),
+        assignEscalation: assign(({ context, event }) => {
+          const e = event;
+          return {
+            pendingEscalation: e.request,
+            escalationCount: context.escalationCount + 1
+          };
+        }),
+        clearEscalation: assign({
+          pendingEscalation: null
+        }),
+        incrementRetry: assign(({ context }) => ({
+          retryCount: context.retryCount + 1,
+          retryBackoffMs: Math.min(context.retryBackoffMs * 2, 3e4)
+        })),
+        resetRetry: assign({
+          retryCount: 0,
+          retryBackoffMs: 1e3
+        }),
+        recordClassification: assign(({ context, event }) => {
+          const classification = event.classification;
+          if (!classification) return {};
+          return {
+            lastClassification: classification,
+            classificationHistory: [...context.classificationHistory, classification]
+          };
+        }),
+        updateTimings: assign(({ context }) => {
+          const now = Date.now();
+          const elapsed = now - context.lastActivityAt;
+          return {
+            lastActivityAt: now,
+            totalAgentTimeMs: context.totalAgentTimeMs + Math.max(elapsed, 0)
+          };
+        }),
+        // -- Side-effect actions ------------------------------------------
+        spawnAgent: ({ context }) => {
+          void self.spawnAgent(context.currentAgent);
+        },
+        terminateAgent: () => {
+          void self.terminateProcess();
+        },
+        createCheckpoint: ({ context }) => {
+          self.emitCheckpoint(context);
+        },
+        sendEscalation: ({ context }) => {
+          self.emitEscalation(context);
+        },
+        recordRunEvent: ({ context, event }) => {
+          self.emitRunEvent(context, event);
+        }
+      }
+    });
+    if (options.checkpoint) {
+      const restoredSnapshot = JSON.parse(options.checkpoint.machineState);
+      this.actor = createActor(providedMachine, {
+        snapshot: restoredSnapshot
+      });
+    } else {
+      this.actor = createActor(providedMachine);
+    }
+    this.actor.subscribe((snapshot) => {
+      const stateValue = this.serializeStateValue(snapshot.value);
+      this.callbacks.onStateChange?.(stateValue);
+      this.emitHealth();
+    });
+  }
+  // =========================================================================
+  // Public API
+  // =========================================================================
+  /** Start the actor and send the JOB_ASSIGNED event to kick things off. */
+  async start() {
+    this.actor.start();
+    const policySnapshot = this.policy.getSnapshot();
+    this.actor.send({
+      type: "JOB_ASSIGNED",
+      jobId: this.jobId,
+      outcomeId: "",
+      // Will be set from the actual job
+      daemonId: this.daemonId,
+      policySnapshot
+    });
+    this.healthInterval = setInterval(() => this.emitHealth(), 1e4);
+    const maxDuration = policySnapshot.maxJobDurationMs ?? 36e5;
+    this.hardTimeoutTimer = setTimeout(() => {
+      if (this.process) {
+        this.emitRunEvent(
+          this.actor.getSnapshot().context,
+          { type: "CANCEL" }
+        );
+        void this.adapter.terminate(this.process);
+      }
+    }, maxDuration);
+  }
+  /** Pause the running job (checkpoints machine state). */
+  pause() {
+    this.actor.send({ type: "PAUSE" });
+  }
+  /** Resume from a paused state. */
+  resume() {
+    this.actor.send({ type: "RESUME" });
+  }
+  /** Cancel the job and terminate any running agent. */
+  cancel() {
+    this.actor.send({ type: "CANCEL" });
+  }
+  /** Forward a cloud escalation decision into the machine. */
+  deliverDecision(decision) {
+    this.actor.send({
+      type: "CLOUD_DECISION_RECEIVED",
+      decision
+    });
+  }
+  /** Send ACTION_COMPLETE to advance past acting sub-states. */
+  completeAction() {
+    this.actor.send({ type: "ACTION_COMPLETE" });
+  }
+  /** Return the current state value as a string. */
+  getState() {
+    return this.serializeStateValue(this.actor.getSnapshot().value);
+  }
+  /** Return the current agent process (for PID tracking). */
+  getProcess() {
+    return this.process;
+  }
+  /** Return the current machine context. */
+  getContext() {
+    return this.actor.getSnapshot().context;
+  }
+  /** Return the run ID for this runner. */
+  getRunId() {
+    return this.runId;
+  }
+  /** Extract a structured summary from the session's output. */
+  getSessionSummary() {
+    return extractSessionSummary(this.outputBuffer);
+  }
+  /** Compute and return the current session health snapshot. */
+  getHealth() {
+    return this.healthMonitor.compute(this.getContext(), this.getState());
+  }
+  /** Serialise the full machine snapshot for checkpointing. */
+  getPersistedSnapshot() {
+    return JSON.stringify(this.actor.getSnapshot());
+  }
+  /** Stop the actor and terminate any running agent process. */
+  stop() {
+    if (this.hardTimeoutTimer) {
+      clearTimeout(this.hardTimeoutTimer);
+      this.hardTimeoutTimer = null;
+    }
+    if (this.healthInterval) {
+      clearInterval(this.healthInterval);
+      this.healthInterval = null;
+    }
+    this.actor.stop();
+    void this.terminateProcess();
+  }
+  /** Update the policy engine (e.g. after cloud sends a policy update). */
+  updatePolicy(snapshot) {
+    this.policy.updatePolicy(snapshot);
+  }
+  // =========================================================================
+  // Agent lifecycle (private)
+  // =========================================================================
+  async spawnAgent(agentName) {
+    try {
+      this.process = await this.adapter.spawn({
+        prompt: this.prompt,
+        workingDirectory: this.workingDirectory,
+        mode: "supervised"
+      });
+      this.lastExitCode = null;
+      this.actor.send({
+        type: "AGENT_SPAWNED",
+        agentProcessId: String(this.process.pid),
+        agent: agentName ?? this.adapter.name
+      });
+      this.callbacks.onSpawned?.(this.process.pid);
+      this.healthMonitor.setProcessAlive(true);
+      this.adapter.onOutput(this.process, (output) => {
+        this.handleOutput(output);
+      });
+      this.adapter.onExit(this.process, (code, _signal) => {
+        this.lastExitCode = code;
+        this.handleExit(code);
+      });
+    } catch (err) {
+      this.actor.send({
+        type: "AGENT_SPAWN_FAILED",
+        error: String(err)
+      });
+    }
+  }
+  async terminateProcess() {
+    if (this.process) {
+      try {
+        await this.adapter.terminate(this.process);
+      } catch {
+      }
+      this.process = null;
+    }
+  }
+  // =========================================================================
+  // Output handling — observe → classify → act
+  // =========================================================================
+  handleOutput(output) {
+    this.outputBuffer.push(output.data);
+    this.healthMonitor.recordOutput();
+    const parsed = output.parsed;
+    const summary = this.summarizeOutput(parsed, output.data);
+    const runEvent = {
+      id: ulid2(),
+      runId: this.runId,
+      source: "daemon",
+      sourceId: this.runId,
+      type: "agent_output",
+      payload: { summary, stream: output.stream },
+      timestamp: output.timestamp,
+      sequence: this.eventSequence++
+    };
+    this.callbacks.onRunEvent?.(runEvent);
+    this.actor.send({
+      type: "OUTPUT_RECEIVED",
+      output: output.data
+    });
+    this.classifyAndAct(output);
+  }
+  summarizeOutput(parsed, raw) {
+    if (!parsed) return raw.slice(0, 200);
+    const type = parsed.type;
+    const subtype = parsed.subtype;
+    if (type === "system") {
+      if (subtype === "init") return "Session started";
+      if (subtype?.startsWith("hook_")) return "";
+      return "";
+    }
+    if (type === "assistant") {
+      const msg = parsed.message;
+      const content = msg?.content;
+      if (content) {
+        for (const block of content) {
+          if (block.type === "tool_use") {
+            const name = block.name;
+            const input = block.input;
+            const path = input?.file_path ?? input?.path ?? input?.command ?? "";
+            const short = path.split(/[/\\]/).pop() ?? "";
+            return short ? `Tool: ${name}(${short})` : `Tool: ${name}`;
+          }
+          if (block.type === "text") {
+            return (block.text ?? "").slice(0, 200);
+          }
+        }
+      }
+      return "";
+    }
+    if (type === "user") return "";
+    if (type === "message") {
+      const role = parsed.role;
+      if (role === "user") return "";
+      const content = parsed.content;
+      if (content) return content.slice(0, 200);
+      return "";
+    }
+    if (type === "init") return "Session started";
+    if (type === "rate_limit_event") return "Rate limited";
+    if (type === "result") {
+      const cost = parsed.cost_usd;
+      const duration = parsed.duration_ms;
+      const status = parsed.status;
+      const ds = duration ? `${(duration / 1e3).toFixed(1)}s` : "";
+      if (cost != null) return `Completed (${ds}, $${cost.toFixed(4)})`;
+      if (status === "success") return `Completed (${ds})`;
+      if (status) return `${status} (${ds})`;
+      return `Completed (${ds})`;
+    }
+    if (parsed.tool && typeof parsed.tool === "object") {
+      const tool = parsed.tool;
+      return `Tool: ${tool.name ?? "unknown"}`;
+    }
+    if (typeof parsed.content === "string") {
+      return parsed.content.slice(0, 200);
+    }
+    if (parsed.result && typeof parsed.result === "object") {
+      const result = parsed.result;
+      return result.success ? "Success" : `Error: ${result.output ?? "unknown"}`;
+    }
+    if (typeof parsed.error === "object" && parsed.error !== null) {
+      return `Error: ${parsed.error.message ?? "unknown"}`;
+    }
+    return String(parsed.type ?? "") || raw.slice(0, 200);
+  }
+  classifyAndAct(output) {
+    const classification = classifyOutput(
+      output,
+      this.lastExitCode,
+      this.classificationRules
+    );
+    const verdict = this.policy.evaluateAction(classification);
+    switch (classification.category) {
+      case "success":
+        this.actor.send({
+          type: "CLASSIFIED_SUCCESS",
+          classification
+        });
+        break;
+      case "transient_error":
+        this.actor.send({
+          type: "CLASSIFIED_TRANSIENT_ERROR",
+          classification
+        });
+        break;
+      case "fatal_error":
+        this.actor.send({
+          type: "CLASSIFIED_FATAL",
+          classification
+        });
+        break;
+      case "milestone":
+        this.actor.send({
+          type: "CLASSIFIED_MILESTONE",
+          classification
+        });
+        break;
+      case "complete":
+        this.actor.send({
+          type: "CLASSIFIED_DONE",
+          classification
+        });
+        break;
+      case "risky_action":
+        if (!verdict.allowed) {
+          this.actor.send({
+            type: "CLASSIFIED_RISKY_ACTION",
+            classification
+          });
+        } else {
+          this.actor.send({
+            type: "CLASSIFIED_SUCCESS",
+            classification
+          });
+        }
+        break;
+      case "ambiguous":
+        this.actor.send({
+          type: "CLASSIFIED_AMBIGUOUS",
+          classification
+        });
+        break;
+      case "idle":
+        this.actor.send({
+          type: "CLASSIFIED_AMBIGUOUS",
+          classification
+        });
+        break;
+      default:
+        this.actor.send({
+          type: "CLASSIFIED_SUCCESS",
+          classification
+        });
+        break;
+    }
+  }
+  handleExit(code) {
+    this.healthMonitor.setProcessAlive(false);
+    if (code === 0) {
+      this.actor.send({
+        type: "CLASSIFIED_DONE",
+        classification: {
+          category: "complete",
+          confidence: 0.9,
+          riskScore: 0,
+          summary: "Agent exited successfully",
+          rawOutput: ""
+        }
+      });
+      this.callbacks.onComplete?.(true);
+    } else if (code === null) {
+      this.actor.send({
+        type: "CLASSIFIED_DONE",
+        classification: {
+          category: "complete",
+          confidence: 0.8,
+          riskScore: 0,
+          summary: "Agent process terminated externally",
+          rawOutput: ""
+        }
+      });
+      this.callbacks.onComplete?.(false);
+    } else {
+      this.actor.send({
+        type: "CLASSIFIED_TRANSIENT_ERROR",
+        classification: {
+          category: "transient_error",
+          confidence: 0.7,
+          riskScore: 20,
+          summary: `Agent exited with code ${code}`,
+          rawOutput: ""
+        }
+      });
+    }
+  }
+  // =========================================================================
+  // Side-effect emitters
+  // =========================================================================
+  emitHealth() {
+    const health = this.getHealth();
+    this.callbacks.onHealthChange?.(health);
+  }
+  emitCheckpoint(context) {
+    const checkpoint = {
+      id: ulid2(),
+      runId: this.runId,
+      machineState: this.getPersistedSnapshot(),
+      machineContext: JSON.stringify(context),
+      createdAt: /* @__PURE__ */ new Date()
+    };
+    this.callbacks.onCheckpoint?.(checkpoint);
+  }
+  emitEscalation(context) {
+    const request = {
+      id: ulid2(),
+      daemonId: context.daemonId,
+      jobId: context.jobId,
+      outcomeId: context.outcomeId,
+      runId: this.runId,
+      escalationType: this.inferEscalationType(context),
+      severity: this.inferSeverity(context),
+      context: {
+        currentState: this.getState(),
+        recentOutput: this.outputBuffer.slice(-10),
+        classificationHistory: context.classificationHistory.slice(-5),
+        checkpointId: context.lastCheckpointId ?? void 0
+      },
+      localAssessment: this.buildLocalAssessment(context),
+      timestamp: Date.now()
+    };
+    this.callbacks.onEscalation?.(request);
+    this.actor.send({
+      type: "ESCALATION_SENT",
+      request
+    });
+  }
+  emitRunEvent(context, event) {
+    const runEvent = {
+      id: ulid2(),
+      runId: this.runId,
+      source: "daemon",
+      sourceId: this.runId,
+      type: "state_transition",
+      payload: {
+        machineEvent: event.type,
+        state: this.getState()
+      },
+      timestamp: Date.now(),
+      sequence: this.eventSequence++
+    };
+    this.callbacks.onRunEvent?.(runEvent);
+  }
+  // =========================================================================
+  // Helpers
+  // =========================================================================
+  inferEscalationType(context) {
+    const last = context.lastClassification;
+    if (context.retryCount > context.policySnapshot.localRetryThreshold) {
+      return "STUCK_LOOP";
+    }
+    if (last?.category === "risky_action") {
+      return "HIGH_RISK";
+    }
+    if (last?.category === "ambiguous") {
+      return "AMBIGUOUS_OUTPUT";
+    }
+    if (Date.now() - context.jobStartedAt > context.policySnapshot.maxJobDurationMs || context.totalAgentTimeMs > context.policySnapshot.maxAgentTimeMs) {
+      return "LIMIT_EXCEEDED";
+    }
+    return "CAPABILITY_GAP";
+  }
+  inferSeverity(context) {
+    if (context.retryCount >= context.maxRetries) return "critical";
+    if ((context.lastClassification?.riskScore ?? 0) > 80) return "high";
+    if (context.escalationCount > 2) return "high";
+    return "medium";
+  }
+  buildLocalAssessment(context) {
+    const parts = [];
+    parts.push(`State: ${this.getState()}`);
+    parts.push(`Retries: ${context.retryCount}/${context.maxRetries}`);
+    parts.push(`Escalations: ${context.escalationCount}`);
+    parts.push(`Agent time: ${context.totalAgentTimeMs}ms`);
+    if (context.lastClassification) {
+      parts.push(
+        `Last classification: ${context.lastClassification.category} (confidence: ${context.lastClassification.confidence}, risk: ${context.lastClassification.riskScore})`
+      );
+    }
+    return parts.join("; ");
+  }
+  /**
+   * Convert an XState state value (which can be a string or nested object)
+   * to a flat dot-separated string for logging and reporting.
+   */
+  serializeStateValue(value) {
+    if (typeof value === "string") return value;
+    if (typeof value === "object" && value !== null) {
+      const entries = Object.entries(value);
+      return entries.map(([key, val]) => `${key}.${this.serializeStateValue(val)}`).join(", ");
+    }
+    return String(value);
+  }
+};
+
+// src/daemon.ts
+import { mkdirSync as mkdirSync3 } from "fs";
+import { join as join3 } from "path";
+import { randomUUID as randomUUID2 } from "crypto";
+
+// src/server.ts
+import { createServer } from "http";
+import { readFile, readdir, writeFile } from "fs/promises";
+import { join as join2, resolve as resolve3, isAbsolute, basename } from "path";
+var SKIP_NAMES = /* @__PURE__ */ new Set([
+  ".git",
+  "node_modules",
+  "dist",
+  ".next",
+  ".env",
+  ".env.local",
+  ".env.production",
+  ".env.development",
+  "__pycache__",
+  ".DS_Store"
+]);
+var BLOCKED_EXTENSIONS = /* @__PURE__ */ new Set([".env", ".pem", ".key", ".p12", ".pfx"]);
+function isBlocked(name) {
+  if (SKIP_NAMES.has(name)) return true;
+  if (name.startsWith(".env")) return true;
+  for (const ext of BLOCKED_EXTENSIONS) {
+    if (name.endsWith(ext)) return true;
+  }
+  return false;
+}
+function getParam(url, key) {
+  return url.searchParams.get(key);
+}
+function json(res, status, body) {
+  res.writeHead(status, { "Content-Type": "application/json" });
+  res.end(JSON.stringify(body));
+}
+async function handleReadFile(url, res) {
+  const filePath = getParam(url, "path");
+  const maxLines = parseInt(getParam(url, "maxLines") ?? "200", 10);
+  if (!filePath || !isAbsolute(filePath)) {
+    return json(res, 400, { error: 'Absolute "path" parameter required' });
+  }
+  const resolved = resolve3(filePath);
+  const name = resolved.split(/[\\/]/).pop() ?? "";
+  if (isBlocked(name)) {
+    return json(res, 403, { error: "Access to this file is restricted" });
+  }
+  try {
+    const content = await readFile(resolved, "utf-8");
+    const lines = content.split("\n");
+    const truncated = lines.length > maxLines;
+    json(res, 200, {
+      path: resolved,
+      content: lines.slice(0, maxLines).join("\n"),
+      totalLines: lines.length,
+      truncated
+    });
+  } catch (err) {
+    json(res, 404, { error: `Cannot read: ${err instanceof Error ? err.message : String(err)}` });
+  }
+}
+async function handleListDirectory(url, res) {
+  const dirPath = getParam(url, "path");
+  const recursive = getParam(url, "recursive") === "true";
+  if (!dirPath || !isAbsolute(dirPath)) {
+    return json(res, 400, { error: 'Absolute "path" parameter required' });
+  }
+  const resolved = resolve3(dirPath);
+  try {
+    const entries = await readdir(resolved, { withFileTypes: true });
+    const items = [];
+    for (const entry of entries) {
+      if (isBlocked(entry.name)) continue;
+      items.push({
+        name: entry.name,
+        type: entry.isDirectory() ? "directory" : "file"
+      });
+    }
+    if (recursive) {
+      const dirs = items.filter((i) => i.type === "directory").map((i) => i.name);
+      for (const dir of dirs) {
+        try {
+          const subEntries = await readdir(join2(resolved, dir), { withFileTypes: true });
+          for (const sub of subEntries) {
+            if (isBlocked(sub.name)) continue;
+            items.push({
+              name: `${dir}/${sub.name}`,
+              type: sub.isDirectory() ? "directory" : "file"
+            });
+          }
+        } catch {
+        }
+      }
+    }
+    json(res, 200, { path: resolved, items });
+  } catch (err) {
+    json(res, 404, { error: `Cannot list: ${err instanceof Error ? err.message : String(err)}` });
+  }
+}
+async function handleSearchFiles(url, res) {
+  const directory = getParam(url, "dir");
+  const pattern = getParam(url, "pattern");
+  const maxResults = parseInt(getParam(url, "max") ?? "20", 10);
+  if (!directory || !isAbsolute(directory)) {
+    return json(res, 400, { error: 'Absolute "dir" parameter required' });
+  }
+  if (!pattern) {
+    return json(res, 400, { error: '"pattern" parameter required' });
+  }
+  const resolved = resolve3(directory);
+  const lowerPattern = pattern.toLowerCase();
+  const results = [];
+  async function walk(dir, depth) {
+    if (depth > 4 || results.length >= maxResults) return;
+    try {
+      const entries = await readdir(dir, { withFileTypes: true });
+      for (const entry of entries) {
+        if (results.length >= maxResults) break;
+        if (isBlocked(entry.name)) continue;
+        const fullPath = join2(dir, entry.name);
+        if (entry.name.toLowerCase().includes(lowerPattern)) {
+          results.push(fullPath);
+        }
+        if (entry.isDirectory()) {
+          await walk(fullPath, depth + 1);
+        }
+      }
+    } catch {
+    }
+  }
+  await walk(resolved, 0);
+  json(res, 200, { directory: resolved, pattern, matches: results });
+}
+async function handleWriteCronies(req, res) {
+  const chunks = [];
+  for await (const chunk of req) {
+    chunks.push(typeof chunk === "string" ? Buffer.from(chunk) : chunk);
+  }
+  let body;
+  try {
+    body = JSON.parse(Buffer.concat(chunks).toString("utf-8"));
+  } catch {
+    return json(res, 400, { error: "Invalid JSON body" });
+  }
+  if (!body.path || !body.content) {
+    return json(res, 400, { error: "path and content required" });
+  }
+  if (!isAbsolute(body.path)) {
+    return json(res, 400, { error: "Absolute path required" });
+  }
+  const filename = basename(body.path);
+  if (filename !== "CRONIES.md") {
+    return json(res, 403, { error: "Only CRONIES.md files can be written via this endpoint" });
+  }
+  try {
+    await writeFile(resolve3(body.path), body.content, "utf-8");
+    json(res, 200, { ok: true, path: resolve3(body.path) });
+  } catch (err) {
+    json(res, 500, { error: `Cannot write: ${err instanceof Error ? err.message : String(err)}` });
+  }
+}
+function createDaemonServer(options) {
+  const { port, apiToken, logger } = options;
+  const server = createServer(async (req, res) => {
+    const remoteAddr = req.socket.remoteAddress ?? "";
+    const isLocalhost = ["127.0.0.1", "::1", "::ffff:127.0.0.1"].includes(remoteAddr);
+    const authHeader = req.headers.authorization;
+    const hasValidToken = apiToken && authHeader === `Bearer ${apiToken}`;
+    if (!isLocalhost && !hasValidToken) {
+      return json(res, 401, { error: "Unauthorized" });
+    }
+    const url = new URL(req.url ?? "/", `http://localhost:${port}`);
+    const path = url.pathname;
+    try {
+      if (req.method === "GET" && path === "/api/fs/read") {
+        await handleReadFile(url, res);
+      } else if (req.method === "GET" && path === "/api/fs/list") {
+        await handleListDirectory(url, res);
+      } else if (req.method === "GET" && path === "/api/fs/search") {
+        await handleSearchFiles(url, res);
+      } else if (req.method === "POST" && path === "/api/fs/write-cronies") {
+        await handleWriteCronies(req, res);
+      } else if (req.method === "GET" && path === "/status") {
+        json(res, 200, { status: "ok", pid: process.pid });
+      } else {
+        json(res, 404, { error: "Not found" });
+      }
+    } catch (err) {
+      logger.error("Server error", { path, error: String(err) });
+      json(res, 500, { error: "Internal server error" });
+    }
+  });
+  server.listen(port, "127.0.0.1", () => {
+    logger.info("Daemon HTTP server started", { port, host: "127.0.0.1" });
+  });
+  return server;
+}
+
+// src/sync/rest-client.ts
+var RestClient = class {
+  options;
+  pollTimer = null;
+  running = false;
+  pollCount = 0;
+  // Evaluate idle outcomes every 10 polls (~5 min at 30s poll interval)
+  evalEveryNPolls = 10;
+  /** Called when the poll returns one or more jobs */
+  onJobsReceived;
+  /** Called when a running job has been cancelled/paused from the dashboard */
+  onJobCancelled;
+  /** Called on any polling or network error */
+  onError;
+  constructor(options) {
+    this.options = options;
+  }
+  // -----------------------------------------------------------------------
+  // Lifecycle
+  // -----------------------------------------------------------------------
+  /** Register this daemon with the cloud, then start polling for jobs. */
+  start() {
+    this.running = true;
+    void this.register();
+    void this.poll();
+    this.pollTimer = setInterval(() => void this.poll(), this.options.pollIntervalMs);
+  }
+  /** Stop polling. */
+  stop() {
+    this.running = false;
+    if (this.pollTimer) {
+      clearInterval(this.pollTimer);
+      this.pollTimer = null;
+    }
+  }
+  isConnected() {
+    return this.running;
+  }
+  // -----------------------------------------------------------------------
+  // Registration & Heartbeat
+  // -----------------------------------------------------------------------
+  /** Register this daemon with the cloud on startup. */
+  async register() {
+    const os = await import("os");
+    const { execSync: execSync2 } = await import("child_process");
+    const agentHelp = {};
+    try {
+      agentHelp["claude-code"] = execSync2("claude --help", {
+        timeout: 5e3,
+        encoding: "utf-8"
+      }).trim();
+    } catch {
+    }
+    try {
+      agentHelp["codex-cli"] = execSync2("codex --help", {
+        timeout: 5e3,
+        encoding: "utf-8"
+      }).trim();
+    } catch {
+    }
+    try {
+      agentHelp["gemini-cli"] = execSync2("gemini --help", {
+        timeout: 5e3,
+        encoding: "utf-8"
+      }).trim();
+    } catch {
+    }
+    try {
+      const cursorCmd = process.platform === "win32" ? 'wsl bash -ic "agent --help"' : "agent --help";
+      agentHelp["cursor-agent"] = execSync2(cursorCmd, {
+        timeout: 5e3,
+        encoding: "utf-8",
+        shell: process.platform === "win32" ? "cmd.exe" : "/bin/sh"
+      }).trim();
+    } catch {
+    }
+    try {
+      await this.post("/api/daemon/register", {
+        daemonId: this.options.daemonId,
+        hostname: os.hostname(),
+        port: this.options.port,
+        daemonVersion: "0.1.0",
+        capabilities: ["claude-code", "codex-cli", "gemini-cli", "cursor-agent"],
+        agentHelp
+      });
+    } catch {
+    }
+  }
+  /** Send heartbeat to keep daemon status online. Called on each poll. */
+  async heartbeat() {
+    try {
+      await this.patch("/api/daemon/register", {
+        daemonId: this.options.daemonId
+      });
+    } catch {
+    }
+  }
+  // -----------------------------------------------------------------------
+  // Polling
+  // -----------------------------------------------------------------------
+  async poll() {
+    if (!this.running) return;
+    void this.heartbeat();
+    try {
+      const response = await fetch(`${this.options.baseUrl}/api/daemon/jobs`, {
+        headers: { Authorization: `Bearer ${this.options.apiKey}` }
+      });
+      if (!response.ok) {
+        this.onError?.(new Error(`Poll failed: ${response.status}`));
+        return;
+      }
+      const data = await response.json();
+      if (data.jobs && data.jobs.length > 0) {
+        this.onJobsReceived?.(data.jobs);
+      }
+    } catch (error) {
+      this.onError?.(error instanceof Error ? error : new Error(String(error)));
+    }
+    this.pollCount++;
+    if (this.pollCount % this.evalEveryNPolls === 0) {
+      void this.evaluateIdleOutcomes();
+    }
+  }
+  /** Evaluate all active outcomes that have no running sessions. */
+  async evaluateIdleOutcomes() {
+    try {
+      const response = await fetch(`${this.options.baseUrl}/api/supervisor/evaluate`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.options.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify({ idleOnly: true })
+      });
+      if (response.ok) {
+        const data = await response.json();
+        const evals = data.evaluations ?? [];
+        for (const e of evals) {
+          if (e.action !== "no_action") {
+            console.log(`[cronies] Heartbeat: ${e.action} for outcome ${e.outcomeId} \u2014 ${e.reasoning.slice(0, 100)}`);
+          }
+        }
+      }
+    } catch {
+    }
+  }
+  /** Check if any jobs the daemon is running have been cancelled/paused from the dashboard */
+  async checkForCancelledJobs(runningJobIds) {
+    if (runningJobIds.length === 0) return;
+    for (const jobId of runningJobIds) {
+      try {
+        const response = await fetch(`${this.options.baseUrl}/api/daemon/jobs/${jobId}`, {
+          headers: { Authorization: `Bearer ${this.options.apiKey}` }
+        });
+        if (!response.ok) continue;
+        const data = await response.json();
+        if (data.job && (data.job.status === "paused" || data.job.status === "cancelled" || data.job.status === "completed")) {
+          this.onJobCancelled?.(jobId);
+        }
+      } catch {
+      }
+    }
+  }
+  // -----------------------------------------------------------------------
+  // Reporting helpers
+  // -----------------------------------------------------------------------
+  /** Report a new run starting */
+  async createRun(run) {
+    await this.post("/api/daemon/runs", run);
+  }
+  /** Update a run (status change, completion, etc.) */
+  async updateRun(runId, update) {
+    await this.patch(`/api/daemon/runs/${runId}`, update);
+  }
+  /** Post run events (batch) */
+  async postEvents(events) {
+    await this.post("/api/daemon/events", { events });
+  }
+  /** Report session health snapshot to the cloud */
+  async postHealth(health) {
+    await this.post("/api/daemon/health", health);
+  }
+  /** Update a job's status (e.g. 'running', 'active', 'completed') */
+  async updateJobStatus(jobId, status) {
+    await this.patch(`/api/daemon/jobs/${jobId}`, { status });
+  }
+  /** Reset orphaned running jobs back to active on daemon startup */
+  async resetOrphanedJobs() {
+    try {
+      await this.post("/api/daemon/jobs/reset-orphaned", {
+        daemonId: this.options.daemonId
+      });
+    } catch {
+    }
+  }
+  /** Ask the supervisor to evaluate an outcome's next steps. Retries once on failure. */
+  async triggerSupervisorEvaluation(outcomeId) {
+    for (let attempt = 0; attempt < 2; attempt++) {
+      try {
+        const response = await fetch(`${this.options.baseUrl}/api/supervisor/evaluate`, {
+          method: "POST",
+          headers: {
+            Authorization: `Bearer ${this.options.apiKey}`,
+            "Content-Type": "application/json"
+          },
+          body: JSON.stringify({ outcomeId })
+        });
+        if (response.ok) {
+          const data = await response.json();
+          const eval0 = data.evaluations?.[0];
+          if (eval0) {
+            console.log(`[supervisor] Evaluation for ${outcomeId}: ${eval0.action} \u2014 ${eval0.reasoning.slice(0, 100)}`);
+          }
+          return;
+        }
+        console.error(`[supervisor] Evaluation failed: ${response.status}`);
+      } catch (err) {
+        console.error(`[supervisor] Evaluation error (attempt ${attempt + 1}):`, err instanceof Error ? err.message : err);
+      }
+      if (attempt === 0) await new Promise((r) => setTimeout(r, 5e3));
+    }
+    console.error(`[supervisor] Evaluation for ${outcomeId} failed after 2 attempts \u2014 outcome may stall`);
+  }
+  // -----------------------------------------------------------------------
+  // Internal HTTP helpers
+  // -----------------------------------------------------------------------
+  async post(path, body) {
+    try {
+      const response = await fetch(`${this.options.baseUrl}${path}`, {
+        method: "POST",
+        headers: {
+          Authorization: `Bearer ${this.options.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      });
+      if (!response.ok) {
+        const text = await response.text().catch(() => "");
+        console.error(`[REST] POST ${path} failed: ${response.status} ${text}`);
+        this.onError?.(new Error(`POST ${path} failed: ${response.status}`));
+      }
+    } catch (error) {
+      console.error(`[REST] POST ${path} error:`, error);
+      this.onError?.(error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+  async patch(path, body) {
+    try {
+      const response = await fetch(`${this.options.baseUrl}${path}`, {
+        method: "PATCH",
+        headers: {
+          Authorization: `Bearer ${this.options.apiKey}`,
+          "Content-Type": "application/json"
+        },
+        body: JSON.stringify(body)
+      });
+      if (!response.ok) {
+        this.onError?.(new Error(`PATCH ${path} failed: ${response.status}`));
+      }
+    } catch (error) {
+      this.onError?.(error instanceof Error ? error : new Error(String(error)));
+    }
+  }
+};
+
+// src/sessionHealthMonitor.ts
+var DaemonSessionHealthMonitor = class {
+  store;
+  restClient;
+  runners;
+  logger;
+  timer = null;
+  checkIntervalMs;
+  staleTimeoutMs;
+  constructor(options) {
+    this.store = options.store;
+    this.restClient = options.restClient;
+    this.runners = options.runners;
+    this.logger = options.logger;
+    this.checkIntervalMs = parseInt(
+      process.env.SESSION_HEALTH_CHECK_INTERVAL ?? "",
+      10
+    ) || 3e4;
+    this.staleTimeoutMs = parseInt(
+      process.env.SESSION_STALE_TIMEOUT ?? "",
+      10
+    ) || 12e4;
+  }
+  /** Start the periodic health check timer. */
+  start() {
+    if (this.timer) return;
+    this.logger.info("Session health monitor started", {
+      checkIntervalMs: this.checkIntervalMs,
+      staleTimeoutMs: this.staleTimeoutMs
+    });
+    this.timer = setInterval(() => this.check(), this.checkIntervalMs);
+  }
+  /** Stop the health check timer for graceful shutdown. */
+  stop() {
+    if (this.timer) {
+      clearInterval(this.timer);
+      this.timer = null;
+      this.logger.info("Session health monitor stopped");
+    }
+  }
+  /** Run a single health check pass. Exposed for testing. */
+  check() {
+    const trackedPids = this.store.getTrackedPids();
+    const now = Date.now();
+    for (const { pid, jobId, agent } of trackedPids) {
+      const alive = this.isProcessAlive(pid);
+      if (alive) continue;
+      const runner = this.runners.get(jobId);
+      if (!runner) {
+        this.store.removePid(pid);
+        continue;
+      }
+      const job = this.store.getJob(jobId);
+      const jobStartedAt = job?.assignedAt ?? 0;
+      const elapsed = now - jobStartedAt;
+      if (elapsed < this.staleTimeoutMs) {
+        continue;
+      }
+      this.logger.warn("[SessionHealthMonitor] Cancelled stale run", {
+        jobId,
+        pid,
+        agent,
+        elapsedMs: elapsed
+      });
+      try {
+        runner.stop();
+      } catch (err) {
+        this.logger.error("Failed to stop stale runner", { jobId, error: String(err) });
+      }
+      this.runners.delete(jobId);
+      this.store.updateJobState(jobId, "cancelled", "{}", "cancelled");
+      this.store.removePid(pid);
+      if (this.restClient) {
+        const runId = this.getRunIdFromRunner(runner);
+        if (runId) {
+          void this.restClient.updateRun(runId, {
+            status: "cancelled",
+            exitReason: "Process died unexpectedly (health monitor)",
+            completedAt: (/* @__PURE__ */ new Date()).toISOString()
+          });
+        }
+        void this.restClient.updateJobStatus(jobId, "failed");
+      }
+    }
+    for (const [jobId, runner] of this.runners) {
+      const proc = runner.getProcess();
+      if (proc?.pid) {
+        if (this.isProcessAlive(proc.pid)) continue;
+      } else {
+      }
+      const job = this.store.getJob(jobId);
+      const jobStartedAt = job?.assignedAt ?? 0;
+      const elapsed = now - jobStartedAt;
+      if (elapsed < this.staleTimeoutMs) continue;
+      if (!proc?.pid) {
+        this.logger.warn("[SessionHealthMonitor] Cancelled stale run (no PID)", {
+          jobId,
+          elapsedMs: elapsed
+        });
+        try {
+          runner.stop();
+        } catch (err) {
+          this.logger.error("Failed to stop stale runner", { jobId, error: String(err) });
+        }
+        this.runners.delete(jobId);
+        this.store.updateJobState(jobId, "cancelled", "{}", "cancelled");
+        if (this.restClient) {
+          const runId = this.getRunIdFromRunner(runner);
+          if (runId) {
+            void this.restClient.updateRun(runId, {
+              status: "cancelled",
+              exitReason: "Process died unexpectedly (health monitor)",
+              completedAt: (/* @__PURE__ */ new Date()).toISOString()
+            });
+          }
+          void this.restClient.updateJobStatus(jobId, "failed");
+        }
+      }
+    }
+  }
+  // -------------------------------------------------------------------------
+  // Helpers
+  // -------------------------------------------------------------------------
+  isProcessAlive(pid) {
+    try {
+      process.kill(pid, 0);
+      return true;
+    } catch {
+      return false;
+    }
+  }
+  getRunIdFromRunner(runner) {
+    try {
+      return runner.getRunId();
+    } catch {
+      return null;
+    }
+  }
+};
+
+// src/daemon.ts
+import { ulid as ulid3 } from "ulid";
+var DEFAULT_POLICY_SNAPSHOT = {
+  version: 0,
+  updatedAt: 0,
+  localRetryThreshold: DEFAULT_POLICY.localRetryThreshold,
+  localRiskThreshold: DEFAULT_POLICY.localRiskThreshold,
+  maxRetries: DEFAULT_POLICY.maxRetries,
+  maxJobDurationMs: DEFAULT_POLICY.maxJobDurationMs,
+  maxAgentTimeMs: DEFAULT_POLICY.maxAgentTimeMs,
+  offlineMaxRetries: DEFAULT_POLICY.offlineMaxRetries,
+  allowedActions: [],
+  deniedActions: [],
+  escalatePatterns: [],
+  allowAgentSwitching: true,
+  preferredAgent: "claude-code",
+  offlineMode: "pause"
+};
+function generateDaemonId(store) {
+  const id = randomUUID2();
+  store.setMeta("daemon_id", id);
+  return id;
+}
+async function startDaemon(config, logger) {
+  const dataDir = resolveDataDir(config);
+  mkdirSync3(dataDir, { recursive: true });
+  mkdirSync3(join3(dataDir, "logs"), { recursive: true });
+  if (isDaemonRunning(dataDir)) {
+    logger.error("Daemon is already running");
+    process.exit(1);
+  }
+  writePidFile(dataDir);
+  const dbPath = join3(dataDir, "daemon.db");
+  const db = createDatabase(dbPath);
+  const store = new DaemonStore(db);
+  logger.info("Database initialized", { path: dbPath });
+  const orphanPids = store.getTrackedPids();
+  if (orphanPids.length > 0) {
+    logger.info("Cleaning up orphaned processes", { count: orphanPids.length });
+    for (const { pid, jobId, agent } of orphanPids) {
+      try {
+        process.kill(pid, "SIGTERM");
+        logger.info("Killed orphaned process", { pid, jobId, agent });
+      } catch {
+      }
+    }
+    store.clearAllPids();
+  }
+  const adapterManager = createAdapterManager();
+  const available = await adapterManager.getAvailable();
+  logger.info("Adapters initialized", { available });
+  const cachedPolicy = store.getCachedPolicy();
+  const policy = new LocalPolicyEngine(cachedPolicy ?? DEFAULT_POLICY_SNAPSHOT);
+  logger.info("Policy engine initialized", { version: cachedPolicy?.version ?? "default" });
+  const syncQueue = new SyncQueue(store);
+  const reconciler = new SyncReconciler(store);
+  const activeJobs = store.getActiveJobs();
+  const runners = /* @__PURE__ */ new Map();
+  if (activeJobs.length > 0) {
+    logger.info("Cleaning up orphaned jobs from previous run", { count: activeJobs.length });
+    for (const job of activeJobs) {
+      store.updateJobState(job.jobId, "failed", "{}", "failed");
+      logger.info("Marked orphaned job as failed", { jobId: job.jobId });
+    }
+  }
+  const daemonId = store.getMeta("daemon_id") ?? generateDaemonId(store);
+  let syncClient = null;
+  let cancelCheckInterval = null;
+  let restClient = null;
+  const deps = {
+    store,
+    reconciler,
+    policy,
+    runners,
+    adapterManager,
+    logger,
+    syncQueue,
+    syncClient: null,
+    // will be set after SyncClient is created
+    restClient: null,
+    // will be set after RestClient is created
+    daemonId
+  };
+  if (config.cloud.token) {
+    restClient = new RestClient({
+      baseUrl: config.cloud.url,
+      apiKey: config.cloud.token,
+      daemonId,
+      port: config.daemon.port,
+      pollIntervalMs: 3e4
+    });
+    restClient.onJobsReceived = (jobs) => {
+      for (const job of jobs) {
+        if (!runners.has(job.id)) {
+          const adapterName = job.preferredAgent ?? "claude-code";
+          const adapter = adapterManager.get(adapterName);
+          if (!adapter) {
+            logger.error("No adapter available for REST job", { jobId: job.id, agent: adapterName });
+            continue;
+          }
+          const jobPolicy = new LocalPolicyEngine(cachedPolicy ?? DEFAULT_POLICY_SNAPSHOT);
+          const runId = ulid3();
+          const runner = new JobRunner(
+            {
+              jobId: job.id,
+              outcomeId: job.outcomeId,
+              runId,
+              daemonId,
+              adapter,
+              policy: jobPolicy,
+              prompt: job.prompt,
+              workingDirectory: job.workingDirectory
+            },
+            {
+              onCheckpoint: (checkpoint) => {
+                store.saveCheckpoint({ ...checkpoint, jobId: job.id });
+                logger.debug("Checkpoint saved", { jobId: job.id, checkpointId: checkpoint.id });
+              },
+              onRunEvent: (event) => {
+                store.appendEvent({ ...event, jobId: job.id });
+                void restClient.postEvents([event]);
+              },
+              onEscalation: (request) => {
+                logger.info("Escalation raised (REST)", { jobId: job.id, type: request.escalationType });
+              },
+              onSpawned: (pid) => {
+                store.trackPid(pid, job.id, adapterName);
+                logger.debug("Tracked PID", { pid, jobId: job.id });
+              },
+              onComplete: (success) => {
+                logger.info("Job completed (REST)", { jobId: job.id, success });
+                store.updateJobState(job.id, "completed", "{}", success ? "completed" : "failed");
+                const proc = runner.getProcess();
+                if (proc?.pid) store.removePid(proc.pid);
+                runners.delete(job.id);
+                const nextJobStatus = job.scheduleType === "cron" ? "active" : job.scheduleType === "event" ? "paused" : "completed";
+                void restClient.updateJobStatus(job.id, nextJobStatus);
+                void restClient.updateRun(runId, {
+                  status: success ? "completed" : "failed",
+                  exitReason: success ? "completed" : "failed",
+                  completedAt: (/* @__PURE__ */ new Date()).toISOString(),
+                  summary: runner.getSessionSummary()
+                });
+                void restClient.triggerSupervisorEvaluation(job.outcomeId);
+              },
+              onStateChange: (state) => {
+                logger.debug("Job state change (REST)", { jobId: job.id, state });
+              },
+              onHealthChange: (health) => {
+                logger.debug("Session health (REST)", { jobId: job.id, status: health.status, summary: health.summary });
+                void restClient.postHealth(health);
+              }
+            }
+          );
+          void restClient.updateJobStatus(job.id, "running");
+          void restClient.createRun({
+            runId,
+            jobId: job.id,
+            daemonId,
+            agentUsed: adapterName
+          });
+          runners.set(job.id, runner);
+          void runner.start();
+          logger.info("Job runner started (REST)", { jobId: job.id, agent: adapterName });
+        }
+      }
+    };
+    restClient.onJobCancelled = (jobId) => {
+      const runner = runners.get(jobId);
+      if (runner) {
+        logger.info("Job cancelled from dashboard \u2014 stopping", { jobId });
+        runner.stop();
+        const proc = runner.getProcess();
+        if (proc?.pid) store.removePid(proc.pid);
+        runners.delete(jobId);
+      }
+    };
+    restClient.onError = (error) => {
+      logger.error("REST client error", { error: error.message });
+    };
+    deps.restClient = restClient;
+    restClient.start();
+    cancelCheckInterval = setInterval(() => {
+      if (runners.size > 0) {
+        void restClient.checkForCancelledJobs([...runners.keys()]);
+      }
+    }, 3e4);
+    void restClient.resetOrphanedJobs();
+    logger.info("Connected to cloud via REST polling", { url: config.cloud.url });
+  } else {
+    logger.warn("No cloud token configured. Running in offline mode. Set cloud.token in config.");
+  }
+  const sessionMonitor = new DaemonSessionHealthMonitor({
+    store,
+    restClient,
+    runners,
+    logger
+  });
+  sessionMonitor.start();
+  const httpServer = createDaemonServer({
+    port: config.daemon.port,
+    apiToken: config.cloud.token,
+    logger
+  });
+  logger.info("Cronies daemon started", {
+    pid: process.pid,
+    dataDir,
+    adapters: available,
+    activeJobs: activeJobs.length,
+    cloudConnected: !!syncClient,
+    restPolling: !!restClient,
+    httpPort: config.daemon.port
+  });
+  const shutdown = async (signal) => {
+    logger.info("Shutting down...", { signal });
+    for (const [jobId, runner] of runners) {
+      try {
+        logger.info("Checkpointing job", { jobId });
+        runner.stop();
+      } catch (err) {
+        logger.error("Failed to stop runner", { jobId, error: String(err) });
+      }
+    }
+    runners.clear();
+    sessionMonitor.stop();
+    if (cancelCheckInterval) clearInterval(cancelCheckInterval);
+    if (restClient) {
+      restClient.stop();
+    }
+    store.clearAllPids();
+    httpServer.close();
+    store.close();
+    removePidFile(dataDir);
+    logger.info("Daemon stopped");
+    process.exit(0);
+  };
+  process.on("SIGTERM", () => shutdown("SIGTERM"));
+  process.on("SIGINT", () => shutdown("SIGINT"));
+  await new Promise(() => {
+  });
+}
+
+// src/logger.ts
+var LEVEL_ORDER = {
+  debug: 0,
+  info: 1,
+  warn: 2,
+  error: 3
+};
+var LEVEL_LABEL = {
+  debug: "DEBUG",
+  info: "INFO ",
+  warn: "WARN ",
+  error: "ERROR"
+};
+function formatLine(level, msg, data) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const suffix = data && Object.keys(data).length > 0 ? ` ${JSON.stringify(data)}` : "";
+  return `[${timestamp}] [${LEVEL_LABEL[level]}] ${msg}${suffix}`;
+}
+function createLogger(level) {
+  const threshold = LEVEL_ORDER[level];
+  function log(msgLevel, msg, data) {
+    if (LEVEL_ORDER[msgLevel] >= threshold) {
+      process.stderr.write(formatLine(msgLevel, msg, data) + "\n");
+    }
+  }
+  return {
+    debug: (msg, data) => log("debug", msg, data),
+    info: (msg, data) => log("info", msg, data),
+    warn: (msg, data) => log("warn", msg, data),
+    error: (msg, data) => log("error", msg, data)
+  };
+}
+
+export {
+  DaemonConfigSchema,
+  loadConfig,
+  resolveDataDir,
+  getDefaultConfigPath,
+  writeConfigToken,
+  writePidFile,
+  readPidFile,
+  removePidFile,
+  isDaemonRunning,
+  createDatabase,
+  DaemonStore,
+  ClaudeCodeAdapter,
+  CodexCliAdapter,
+  GeminiCliAdapter,
+  CursorAgentAdapter,
+  createAdapterManager,
+  LocalPolicyEngine,
+  PROTOCOL_VERSION,
+  createEnvelope,
+  encodeMessage,
+  decodeMessage,
+  SyncQueue,
+  SyncReconciler,
+  SessionHealthMonitor,
+  JobRunner,
+  startDaemon,
+  createLogger
+};