dahrk-node 0.1.0

package/dist/main.js

@@ -0,0 +1,3050 @@
+#!/usr/bin/env node
+
+// src/main.ts
+import { existsSync as existsSync4, mkdirSync as mkdirSync6, readFileSync as readFileSync5, realpathSync, writeFileSync as writeFileSync6 } from "fs";
+import { randomUUID as randomUUID2 } from "crypto";
+import { homedir as homedir2 } from "os";
+import { basename, join as join7 } from "path";
+import { pathToFileURL } from "url";
+
+// ../../packages/edge/src/ws-client.ts
+import { randomUUID } from "crypto";
+import { arch as osArch, platform as osPlatform } from "os";
+import { WebSocket } from "ws";
+import { decode, encode, isEnrolmentRejection } from "@dahrk/contracts";
+
+// ../../packages/executor-worktree/src/mock-runner.ts
+var nowIso = () => (/* @__PURE__ */ new Date()).toISOString();
+var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+var COMPLETE_SENTINEL = "__complete__";
+function createMockRunner(runtime) {
+  let cancelled = false;
+  return {
+    runtime,
+    async runBatch(ctx, onTrace) {
+      const tool2 = ctx.config.tools?.[0] ?? "shell";
+      const toolUseId = "mock-tool-1";
+      const events = [
+        { seq: 0, runtime, type: "thought", ts: nowIso(), text: "mock: planning the stage" },
+        { seq: 1, runtime, type: "action", ts: nowIso(), tool: tool2, toolUseId, input: { note: "mock action" } },
+        { seq: 2, runtime, type: "observation", ts: nowIso(), toolUseId, output: { ok: true } },
+        { seq: 3, runtime, type: "response", ts: nowIso(), text: "mock: stage complete" }
+      ];
+      for (const event of events) onTrace(event);
+      const delayMs = Number(process.env.DAHRK_MOCK_DELAY_MS ?? process.env.SKAKEL_MOCK_DELAY_MS ?? 0);
+      if (delayMs > 0) await sleep(delayMs);
+      const costUsd = Number(process.env.DAHRK_MOCK_COST_USD ?? process.env.SKAKEL_MOCK_COST_USD ?? 0);
+      return { status: cancelled ? "fail" : "ok", ...costUsd > 0 ? { costUsd } : {} };
+    },
+    async runInteractive(_ctx, turns, onTrace) {
+      let count = 0;
+      let last = "";
+      let toolExit = false;
+      for await (const turn of turns) {
+        if (turn.text === COMPLETE_SENTINEL) {
+          toolExit = true;
+          break;
+        }
+        count++;
+        last = turn.text;
+        onTrace({ seq: 0, runtime, type: "thought", ts: nowIso(), text: `mock: heard "${turn.text}"` });
+        onTrace({ seq: 0, runtime, type: "response", ts: nowIso(), text: `mock: ack ${count}` });
+      }
+      if (cancelled) {
+        return { status: "fail", summary: "mock interactive: cancelled" };
+      }
+      const summary = toolExit ? `mock interactive complete (tool) after ${count} turns` : `mock interactive complete (gate) after ${count} turns: ${last}`;
+      return { status: "ok", summary };
+    },
+    async summarise(ctx) {
+      return `mock summary: ${ctx.config.runtime} stage complete`;
+    },
+    async cancel() {
+      cancelled = true;
+    }
+  };
+}
+
+// ../../packages/executor-worktree/src/claude-adapter.ts
+import {
+  query
+} from "@anthropic-ai/claude-agent-sdk";
+
+// ../../packages/executor-worktree/src/claude-mappers.ts
+function mapClaudeMessage(msg) {
+  switch (msg.type) {
+    case "assistant": {
+      const events = [];
+      const blocks = Array.isArray(msg.message.content) ? msg.message.content : [];
+      let text = "";
+      let hasToolUse = false;
+      for (const b of blocks) {
+        if (b.type === "text") text += String(b.text ?? "");
+        else if (b.type === "thinking")
+          events.push({ type: "thought", subtype: "reasoning_text", text: String(b.thinking ?? "") });
+        else if (b.type === "redacted_thinking")
+          events.push({ type: "thought", subtype: "reasoning_text", text: "[redacted]" });
+        else if (b.type === "tool_use") {
+          hasToolUse = true;
+          events.push({ type: "action", tool: String(b.name), toolUseId: String(b.id), input: b.input });
+        }
+      }
+      const err = msg.error;
+      if (err) events.push({ type: "error", kind: "assistant_error", message: String(err.message ?? err) });
+      return { events, recognised: true, assistantText: text, hasToolUse };
+    }
+    case "user": {
+      const events = [];
+      const content = msg.message.content;
+      const blocks = Array.isArray(content) ? content : [];
+      for (const b of blocks) {
+        if (b.type === "tool_result") {
+          events.push({
+            type: "observation",
+            toolUseId: String(b.tool_use_id),
+            output: b.content,
+            isError: Boolean(b.is_error)
+          });
+        }
+      }
+      return { events, recognised: true };
+    }
+    case "result": {
+      const m = msg;
+      const status = m.subtype === "success" ? "ok" : "fail";
+      const events = [
+        {
+          type: "state",
+          event: "stage-exit",
+          status,
+          usage: mapUsage(m.usage),
+          costUsd: m.total_cost_usd,
+          durationMs: m.duration_ms
+        }
+      ];
+      if (status !== "ok") events.push({ type: "error", kind: "result_error", message: m.subtype });
+      return { events, recognised: true, resultStatus: status };
+    }
+    // Control / metadata: recognised, captured in the raw sidecar, not normalised.
+    case "system":
+    case "stream_event":
+    case "rate_limit_event":
+      return { events: [], recognised: true };
+    default:
+      return { events: [], recognised: false };
+  }
+}
+function mapUsage(u) {
+  return {
+    input: u?.input_tokens ?? 0,
+    output: u?.output_tokens ?? 0,
+    cacheRead: u?.cache_read_input_tokens ?? 0,
+    cacheCreate: u?.cache_creation_input_tokens ?? 0
+  };
+}
+var newBufferState = () => ({ bufferedText: null, turnEndedOnTool: false });
+function consumeClaudeMessage(msg, state, suppressStageExit) {
+  const r = mapClaudeMessage(msg);
+  const events = [];
+  if (msg.type === "assistant") {
+    events.push(...r.events);
+    const text = (r.assistantText ?? "").trim();
+    if (text) {
+      if (state.bufferedText) events.push({ type: "thought", text: state.bufferedText });
+      state.bufferedText = text;
+      state.turnEndedOnTool = false;
+    } else if (r.hasToolUse) {
+      if (state.bufferedText) {
+        events.push({ type: "thought", text: state.bufferedText });
+        state.bufferedText = null;
+      }
+      state.turnEndedOnTool = true;
+    }
+    return { events, isResult: false };
+  }
+  if (msg.type === "result") {
+    const status = r.resultStatus === "fail" ? "fail" : "ok";
+    let responseText;
+    if (status === "ok" && state.bufferedText && !state.turnEndedOnTool) {
+      responseText = state.bufferedText;
+      events.push({ type: "response", text: state.bufferedText });
+    }
+    for (const e of r.events) {
+      if (suppressStageExit && e.type === "state") continue;
+      events.push(e);
+    }
+    state.bufferedText = null;
+    state.turnEndedOnTool = false;
+    return { events, isResult: true, status, responseText };
+  }
+  events.push(...r.events);
+  return { events, isResult: false };
+}
+
+// ../../packages/executor-worktree/src/runner-shared.ts
+import { readFileSync } from "fs";
+import { join } from "path";
+import { attachedDocBasename } from "@dahrk/contracts";
+var SUMMARISE_PROMPT = "This stage is ending. In ONE concise sentence for a human reviewer reading the Linear ticket, state concretely what you DID or FOUND in this stage and the result (for example which functions or files changed, whether the tests pass, or what a review flagged). Be specific and lead with the outcome. Do not mention internal scratch files or a next-stage entry point. Reply with only that sentence.";
+function makeEmit(runtime, onTrace, now = () => (/* @__PURE__ */ new Date()).toISOString()) {
+  return (event, rawRef) => {
+    const full = { ...event, seq: 0, ts: now(), runtime };
+    if (rawRef !== void 0) full.rawRef = rawRef;
+    onTrace(full);
+  };
+}
+function stripFrontmatter(text) {
+  const lines = text.split("\n");
+  if (lines[0]?.trim() !== "---") return text;
+  for (let i = 1; i < lines.length; i++) {
+    if (lines[i]?.trim() === "---") {
+      return lines.slice(i + 1).join("\n").replace(/^\n+/, "");
+    }
+  }
+  return text;
+}
+function stageInstruction(ctx) {
+  const { config, workspace } = ctx;
+  if (config.promptFile) {
+    try {
+      const raw = readFileSync(join(workspace.worktreePath, config.promptFile), "utf8");
+      const body = stripFrontmatter(raw).trim();
+      if (body) return body;
+    } catch (e) {
+      return `The configured prompt file "${config.promptFile}" could not be read (${e.message}).`;
+    }
+  }
+  if (config.prompt) return config.prompt;
+  if (config.skill) return `Use the ${config.skill} skill to complete this stage.`;
+  return "Begin the stage.";
+}
+var MAX_INLINE_DOC_CHARS = 6e3;
+var MAX_INLINE_DOCS_TOTAL_CHARS = 2e4;
+function neutraliseDelimiters(text) {
+  return text.replace(/<\/(documents?)>/gi, "<\u200B/$1>");
+}
+function documentsBlock(ctx) {
+  const docs = ctx.attachedDocuments;
+  if (!docs || docs.length === 0) return "";
+  let budget = MAX_INLINE_DOCS_TOTAL_CHARS;
+  const parts = [];
+  for (const doc of docs) {
+    const path = `.skakel/scratch/docs/${attachedDocBasename(doc)}.md`;
+    const cap = Math.max(0, Math.min(MAX_INLINE_DOC_CHARS, budget));
+    const body = doc.content.trim();
+    const truncated = body.length > cap;
+    const excerpt = truncated ? body.slice(0, cap) : body;
+    budget -= excerpt.length;
+    const tail = truncated ? `
+...(truncated; full text at ${path})` : "";
+    const title = doc.title.replace(/[<>"]/g, "'");
+    parts.push(
+      `<document title="${title}" file="${path}">
+${neutraliseDelimiters(excerpt)}${tail}
+</document>`
+    );
+    if (budget <= 0) break;
+  }
+  return `<documents>
+${parts.join("\n\n")}
+</documents>`;
+}
+function neutraliseGuidanceDelimiters(text) {
+  return text.replace(/<\/(guidance(?:-rule)?)>/gi, "<\u200B/$1>");
+}
+function guidanceBlock(ctx) {
+  const guidance = ctx.guidance;
+  if (!guidance || guidance.length === 0) return "";
+  const parts = [];
+  for (const rule of guidance) {
+    const content = rule.content.trim();
+    if (!content) continue;
+    const origin = rule.origin.replace(/[<>"]/g, "'");
+    const team = rule.teamName !== void 0 ? ` team="${rule.teamName.replace(/[<>"]/g, "'")}"` : "";
+    parts.push(`<guidance-rule origin="${origin}"${team}>
+${neutraliseGuidanceDelimiters(content)}
+</guidance-rule>`);
+  }
+  if (parts.length === 0) return "";
+  return `<guidance>
+${parts.join("\n")}
+</guidance>`;
+}
+function neutraliseGateFeedbackDelimiters(text) {
+  return text.replace(/<\/(gate-feedback|gate-note)>/gi, "<\u200B/$1>");
+}
+function gateFeedbackBlock(ctx) {
+  const notes = ctx.gateFeedback;
+  if (!notes || notes.length === 0) return "";
+  const parts = [];
+  for (const note of notes) {
+    const content = note.feedback.trim();
+    if (!content) continue;
+    const stage = note.stageId.replace(/[<>"]/g, "'");
+    const decision = note.decision.replace(/[<>"]/g, "'");
+    parts.push(
+      `<gate-note stage="${stage}" decision="${decision}">
+${neutraliseGateFeedbackDelimiters(content)}
+</gate-note>`
+    );
+  }
+  if (parts.length === 0) return "";
+  return `<gate-feedback>
+${parts.join("\n")}
+</gate-feedback>`;
+}
+function resolveStagePrompt(ctx) {
+  const instruction = stageInstruction(ctx);
+  const ticket = ctx.issueContext?.trim() ? `<ticket>
+${ctx.issueContext.trim()}
+</ticket>` : "";
+  const guidance = guidanceBlock(ctx);
+  const gateFeedback = gateFeedbackBlock(ctx);
+  const docs = documentsBlock(ctx);
+  const preamble = [ticket, guidance, gateFeedback, docs].filter(Boolean).join("\n\n");
+  return preamble ? `${preamble}
+
+${instruction}` : instruction;
+}
+function hasSystemPrompt(ctx) {
+  return Boolean(
+    ctx.config.prompt || ctx.config.promptFile || ctx.issueContext?.trim() || ctx.guidance && ctx.guidance.length > 0 || ctx.gateFeedback && ctx.gateFeedback.length > 0 || ctx.attachedDocuments && ctx.attachedDocuments.length > 0
+  );
+}
+var OPENING_KICKOFF = "Begin now. Using the ticket context and your instructions already provided, ask the human your first question. Do not wait for further input before sending your first message.";
+function interactiveSeedText(ctx, instructionInSystemPrompt) {
+  return instructionInSystemPrompt ? OPENING_KICKOFF : resolveStagePrompt(ctx);
+}
+var ManagedMailbox = class {
+  q = [];
+  waiters = [];
+  done = false;
+  push(value) {
+    const w = this.waiters.shift();
+    if (w) w({ value, done: false });
+    else this.q.push(value);
+  }
+  end() {
+    this.done = true;
+    let w;
+    while (w = this.waiters.shift()) w({ value: void 0, done: true });
+  }
+  [Symbol.asyncIterator]() {
+    return {
+      next: () => {
+        const v = this.q.shift();
+        if (v !== void 0) return Promise.resolve({ value: v, done: false });
+        if (this.done) return Promise.resolve({ value: void 0, done: true });
+        return new Promise((resolve) => this.waiters.push(resolve));
+      }
+    };
+  }
+};
+function interactiveIdleWindows(ctx) {
+  const idleMs = ctx.config.idleMs ?? Number(process.env.DAHRK_INTERACTIVE_IDLE_MS ?? process.env.SKAKEL_INTERACTIVE_IDLE_MS ?? 12e4);
+  const firstReplyMs = ctx.config.firstReplyMs ?? Number(process.env.DAHRK_INTERACTIVE_FIRST_REPLY_MS ?? process.env.SKAKEL_INTERACTIVE_FIRST_REPLY_MS ?? 6e5);
+  return { firstReplyMs: Math.max(firstReplyMs, idleMs), idleMs };
+}
+function raceNextTurn(pending, idleMs, signal) {
+  return new Promise((resolve) => {
+    let settled = false;
+    let timer;
+    function finish(r) {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      signal.removeEventListener("abort", onAbort);
+      resolve(r);
+    }
+    function onAbort() {
+      finish({ kind: "cancelled" });
+    }
+    if (signal.aborted) {
+      finish({ kind: "cancelled" });
+      return;
+    }
+    signal.addEventListener("abort", onAbort);
+    timer = setTimeout(() => finish({ kind: "idle-timeout" }), idleMs);
+    pending.then(
+      (res) => finish(res.done ? { kind: "turns-exhausted" } : { kind: "turn", value: res.value }),
+      () => finish({ kind: "turns-exhausted" })
+    );
+  });
+}
+
+// ../../packages/executor-worktree/src/stage-complete-tool.ts
+import { createSdkMcpServer, tool } from "@anthropic-ai/claude-agent-sdk";
+import { z } from "zod";
+var STAGE_COMPLETE_TOOL_NAME = "mcp__dahrk__dahrk_stage_complete";
+function createStageCompleteTool() {
+  let captured = null;
+  let capturedDoc = null;
+  const completeTool = tool(
+    "dahrk_stage_complete",
+    "End the current stage and hand off a one-sentence summary of what was accomplished. When the stage's deliverable is a document (e.g. a specification or report) to be published, pass its full markdown body as `document`; this is the only way an interactive stage can emit a document, since it cannot write files.",
+    {
+      summary: z.string().describe("A one-sentence summary of the stage outcome."),
+      document: z.string().optional().describe("The full markdown body of the stage's deliverable document, if any.")
+    },
+    async (args) => {
+      captured = args.summary;
+      if (args.document !== void 0) capturedDoc = args.document;
+      return { content: [{ type: "text", text: "Stage marked complete." }] };
+    }
+  );
+  return {
+    server: createSdkMcpServer({ name: "dahrk", version: "0.0.0", tools: [completeTool] }),
+    allowedToolName: STAGE_COMPLETE_TOOL_NAME,
+    fired: () => captured !== null,
+    summary: () => captured,
+    document: () => capturedDoc
+  };
+}
+
+// ../../packages/executor-worktree/src/claude-adapter.ts
+var COALESCE_MS = Number(process.env.DAHRK_COALESCE_MS ?? process.env.SKAKEL_COALESCE_MS ?? 40);
+var MAX_TURNS = Number(process.env.DAHRK_MAX_TURNS ?? process.env.SKAKEL_MAX_TURNS ?? 64);
+var HANDED_BACK_ARTIFACT_PATH = ".skakel/scratch/output/document.md";
+var CLAUDE_CODE_SYSTEM_PROMPT = { type: "preset", preset: "claude_code" };
+var userMsg = (text) => ({
+  type: "user",
+  parent_tool_use_id: null,
+  message: { role: "user", content: text }
+});
+var sessionIdOf = (msg) => "session_id" in msg && typeof msg.session_id === "string" ? msg.session_id : void 0;
+function buildBrokeredMcpServers(ctx) {
+  const servers = ctx.config.mcpServers;
+  if (!servers || servers.length === 0 || !ctx.mcpProxyBaseUrl) return void 0;
+  const entries = {};
+  for (const s of servers) entries[s.id] = { type: s.type, url: `${ctx.mcpProxyBaseUrl}/${s.id}` };
+  return entries;
+}
+function createClaudeRunner() {
+  const abortController = new AbortController();
+  let cancelled = false;
+  let active;
+  let sessionId;
+  let costUsd;
+  const baseOptions = (ctx) => ({
+    cwd: ctx.workspace.worktreePath,
+    abortController,
+    // The deterministic push-stage commit sets the harness author identity itself (see
+    // GitService.commitAndPush); when the Claude runtime commits inside an interactive stage it must
+    // NOT append its own `Co-Authored-By: Claude <noreply@anthropic.com>` trailer. `includeCoAuthoredBy`
+    // is a Claude Code SETTINGS key (not a top-level Options field), so it rides the inline `settings`
+    // object, which sits at the flag layer and overrides any project/local setting. Mirrors the cyrus
+    // reference (EdgeWorker.ts writes the same key into .claude/settings.local.json).
+    settings: { includeCoAuthoredBy: false },
+    // Inherit the REPO's .mcp.json / .claude settings (build spec section 9): do NOT set
+    // strictMcpConfig. Policy enforcement around tools is M6; M4 allows tools to run and the
+    // stage runner intercepts denied actions at the trace level.
+    // Deliberately EXCLUDE "user": a stage must be hermetic to the worktree and not inherit the
+    // edge operator's ~/.claude (their CLAUDE.md, settings, memory), which is machine-specific and
+    // bleeds non-deterministic context across edges. "project"/"local" honour the repo's own
+    // .claude/ + CLAUDE.md + .mcp.json, which is all section 9 actually requires. Claude auth is
+    // keychain/OAuth and independent of settingSources, so dropping "user" does not affect it.
+    settingSources: ["project", "local"],
+    ...ctx.config.model ? { model: ctx.config.model } : {},
+    ...ctx.sessionId ? { resume: ctx.sessionId } : {},
+    ...ctx.config.skill ? { skills: [ctx.config.skill] } : {}
+  });
+  const handleMessage = (msg, emit, ctx, state, suppressStageExit) => {
+    const found = sessionIdOf(msg);
+    if (found) sessionId = found;
+    if (msg.type === "result" && typeof msg.total_cost_usd === "number") costUsd = msg.total_cost_usd;
+    const rawRef = ctx.writeRaw?.(msg);
+    const res = consumeClaudeMessage(msg, state, suppressStageExit);
+    for (const e of res.events) emit(e, rawRef);
+    return { isResult: res.isResult, status: res.status, responseText: res.responseText };
+  };
+  const closeActive = () => {
+    try {
+      active?.close();
+    } catch {
+    }
+    active = void 0;
+  };
+  return {
+    runtime: "claude-code",
+    async runBatch(ctx, onTrace) {
+      const emit = makeEmit("claude-code", onTrace);
+      const prompt = resolveStagePrompt(ctx);
+      const mcpServers = buildBrokeredMcpServers(ctx);
+      const options = {
+        ...baseOptions(ctx),
+        systemPrompt: CLAUDE_CODE_SYSTEM_PROMPT,
+        // Brokered MCP servers merged additively with the repo's .mcp.json (settingSources).
+        // Tools stay allowed by canUseTool below; we do NOT set a restrictive allowedTools here.
+        ...mcpServers ? { mcpServers } : {},
+        // Headless: allow tools to run without an interactive permission prompt (M6 wires policy).
+        canUseTool: async (_toolName, input) => ({ behavior: "allow", updatedInput: input })
+      };
+      const state = newBufferState();
+      let status = "ok";
+      try {
+        const q = query({ prompt, options });
+        active = q;
+        for await (const msg of q) {
+          const res = handleMessage(msg, emit, ctx, state, false);
+          if (res.isResult && res.status) status = res.status;
+        }
+      } catch (e) {
+        if (!cancelled) emit({ type: "error", kind: "runtime_error", message: e.message });
+        status = "fail";
+      } finally {
+        closeActive();
+      }
+      if (cancelled) status = "fail";
+      return { status, ...sessionId ? { sessionId } : {}, ...costUsd !== void 0 ? { costUsd } : {} };
+    },
+    async runInteractive(ctx, turns, onTrace) {
+      const emit = makeEmit("claude-code", onTrace);
+      const stageTool = createStageCompleteTool();
+      const brokered = buildBrokeredMcpServers(ctx);
+      let summarising = false;
+      const options = {
+        ...baseOptions(ctx),
+        // Keep the cwd-anchoring preset; fold the stage instruction in via `append` so the
+        // interactive persona still gets it without losing the working-directory context.
+        systemPrompt: hasSystemPrompt(ctx) ? { type: "preset", preset: "claude_code", append: resolveStagePrompt(ctx) } : CLAUDE_CODE_SYSTEM_PROMPT,
+        // Inject the stage-complete exit tool alongside any brokered MCP servers (parity with batch).
+        mcpServers: { dahrk: stageTool.server, ...brokered ?? {} },
+        // Auto-approve the exit tool; `allowedTools` is an auto-approve list, not a whitelist, so it
+        // does not restrict the other tools canUseTool allows.
+        allowedTools: [stageTool.allowedToolName],
+        canUseTool: async (toolName, input) => summarising && toolName !== stageTool.allowedToolName ? { behavior: "deny", message: "Summarise from the work you just did; reply with the sentence only, no tools." } : { behavior: "allow", updatedInput: input },
+        maxTurns: MAX_TURNS,
+        includePartialMessages: false
+      };
+      const exit = ctx.config.exit ?? "gate";
+      const wantsTool = exit === "tool" || exit === "either";
+      const mailbox = new ManagedMailbox();
+      const q = query({ prompt: mailbox, options });
+      active = q;
+      const it = q[Symbol.asyncIterator]();
+      const humanIter = turns[Symbol.asyncIterator]();
+      const state = newBufferState();
+      const consumeTurn = async () => {
+        for (; ; ) {
+          const { value: msg, done } = await it.next();
+          if (done) return void 0;
+          const res = handleMessage(msg, emit, ctx, state, true);
+          if (res.isResult) return res.responseText;
+        }
+      };
+      const { firstReplyMs, idleMs } = interactiveIdleWindows(ctx);
+      let awaitingFirstReply = true;
+      let exited = null;
+      let pending = humanIter.next();
+      try {
+        mailbox.push(userMsg(interactiveSeedText(ctx, hasSystemPrompt(ctx))));
+        await consumeTurn();
+        if (stageTool.fired() && wantsTool) exited = "tool";
+        while (exited === null) {
+          const race = await raceNextTurn(pending, awaitingFirstReply ? firstReplyMs : idleMs, abortController.signal);
+          awaitingFirstReply = false;
+          if (race.kind === "cancelled") {
+            exited = "cancelled";
+            break;
+          }
+          if (race.kind === "idle-timeout") {
+            exited = "timeout";
+            break;
+          }
+          if (race.kind === "turns-exhausted") {
+            exited = "gate";
+            break;
+          }
+          const texts = [race.value.text];
+          pending = humanIter.next();
+          for (; ; ) {
+            const more = await raceNextTurn(pending, COALESCE_MS, abortController.signal);
+            if (more.kind === "turn") {
+              texts.push(more.value.text);
+              pending = humanIter.next();
+              continue;
+            }
+            if (more.kind === "cancelled") exited = "cancelled";
+            break;
+          }
+          if (exited === "cancelled") break;
+          mailbox.push(userMsg(texts.join("\n")));
+          await consumeTurn();
+          if (stageTool.fired() && wantsTool) {
+            exited = "tool";
+            break;
+          }
+        }
+      } catch (e) {
+        if (!cancelled && !exited) emit({ type: "error", kind: "runtime_error", message: e.message });
+        exited = exited ?? (cancelled ? "cancelled" : "gate");
+      }
+      let status = "ok";
+      let summary = "";
+      if (exited === "tool") {
+        summary = stageTool.summary() ?? "(stage marked complete)";
+      } else if (exited === "gate") {
+        summarising = true;
+        try {
+          mailbox.push(userMsg(SUMMARISE_PROMPT));
+          const reply = await consumeTurn();
+          summary = (reply ?? "").trim() || "(no summary produced)";
+        } catch {
+          summary = "(no summary produced)";
+        } finally {
+          summarising = false;
+        }
+      } else if (exited === "timeout") {
+        status = "timeout";
+        summary = "(stage timed out awaiting input)";
+        await this.cancel();
+      } else {
+        status = "fail";
+        summary = "(stage cancelled)";
+      }
+      mailbox.end();
+      try {
+        for (; ; ) {
+          const { done } = await it.next();
+          if (done) break;
+        }
+      } catch {
+      }
+      closeActive();
+      const handedBackDoc = status === "ok" ? stageTool.document() : null;
+      const artifact = handedBackDoc !== null ? { path: ctx.config.emitArtifact ?? HANDED_BACK_ARTIFACT_PATH, content: handedBackDoc } : void 0;
+      return {
+        status,
+        summary,
+        ...sessionId ? { sessionId } : {},
+        ...costUsd !== void 0 ? { costUsd } : {},
+        ...artifact ? { artifact } : {}
+      };
+    },
+    async summarise(ctx) {
+      if (!sessionId) return "(no summary: session not established)";
+      const options = {
+        ...baseOptions(ctx),
+        resume: sessionId,
+        maxTurns: 4,
+        canUseTool: async () => ({
+          behavior: "deny",
+          message: "Summarise from the work you just did; reply with the sentence only, no tools."
+        })
+      };
+      try {
+        let out = "";
+        const q = query({ prompt: SUMMARISE_PROMPT, options });
+        active = q;
+        for await (const msg of q) {
+          const found = sessionIdOf(msg);
+          if (found) sessionId = found;
+          if (msg.type === "result" && msg.subtype === "success") out += msg.result;
+        }
+        return out.trim() || "(no summary produced)";
+      } catch (e) {
+        return `(summary unavailable: ${e.message})`;
+      } finally {
+        closeActive();
+      }
+    },
+    async cancel() {
+      if (cancelled) return;
+      cancelled = true;
+      try {
+        await active?.interrupt();
+      } catch {
+      }
+      abortController.abort();
+    }
+  };
+}
+
+// ../../packages/executor-worktree/src/codex-adapter.ts
+import { Codex } from "@openai/codex-sdk";
+
+// ../../packages/executor-worktree/src/codex-mappers.ts
+function mapItem(item) {
+  switch (item.type) {
+    case "reasoning":
+      return [{ type: "thought", subtype: "reasoning_text", text: item.text }];
+    case "agent_message":
+      return [{ type: "response", text: item.text }];
+    case "command_execution":
+      return [
+        { type: "action", tool: "command", toolUseId: item.id, input: { command: item.command } },
+        { type: "observation", toolUseId: item.id, output: item.aggregated_output, isError: item.status === "failed" }
+      ];
+    case "mcp_tool_call":
+      return [
+        { type: "action", tool: `${item.server}/${item.tool}`, toolUseId: item.id, input: item.arguments },
+        { type: "observation", toolUseId: item.id, output: item.result?.content ?? item.error, isError: Boolean(item.error) }
+      ];
+    case "web_search":
+      return [{ type: "action", tool: "web_search", toolUseId: item.id, input: { query: item.query } }];
+    case "file_change":
+      return [{ type: "action", tool: "apply_patch", toolUseId: item.id, input: item.changes }];
+    case "todo_list":
+      return [{ type: "thought", text: JSON.stringify(item.items) }];
+    case "error":
+      return [{ type: "error", kind: "item_error", message: item.message }];
+    default:
+      return [];
+  }
+}
+function mapCodexEvent(ev) {
+  switch (ev.type) {
+    case "item.completed":
+      return { events: mapItem(ev.item), recognised: true };
+    case "turn.completed":
+      return {
+        events: [
+          { type: "state", event: "stage-exit", status: "ok", usage: mapUsage2(ev.usage) }
+        ],
+        recognised: true
+      };
+    case "turn.failed":
+      return {
+        events: [
+          { type: "error", kind: "turn_failed", message: JSON.stringify(ev.error ?? {}) },
+          { type: "state", event: "stage-exit", status: "fail" }
+        ],
+        recognised: true
+      };
+    case "error":
+      return { events: [{ type: "error", kind: "thread_error", message: ev.message }], recognised: true };
+    // Lifecycle / interim updates: recognised, captured in raw sidecar, not normalised.
+    case "thread.started":
+    case "turn.started":
+    case "item.started":
+    case "item.updated":
+      return { events: [], recognised: true };
+    default:
+      return { events: [], recognised: false };
+  }
+}
+function mapUsage2(u) {
+  return {
+    input: u?.input_tokens ?? 0,
+    output: u?.output_tokens ?? 0,
+    cacheRead: u?.cached_input_tokens ?? 0,
+    cacheCreate: 0
+  };
+}
+
+// ../../packages/executor-worktree/src/codex-adapter.ts
+var COALESCE_MS2 = Number(process.env.DAHRK_COALESCE_MS ?? process.env.SKAKEL_COALESCE_MS ?? 40);
+function createCodexRunner() {
+  const abortController = new AbortController();
+  const signal = abortController.signal;
+  let cancelled = false;
+  let thread;
+  let sessionId;
+  const threadOptions = (ctx) => ({
+    workingDirectory: ctx.workspace.worktreePath,
+    sandboxMode: "workspace-write",
+    skipGitRepoCheck: true,
+    ...ctx.config.model ? { model: ctx.config.model } : {}
+  });
+  const openThread = (ctx) => {
+    const codex = new Codex();
+    const t = ctx.sessionId ? codex.resumeThread(ctx.sessionId, threadOptions(ctx)) : codex.startThread(threadOptions(ctx));
+    thread = t;
+    return t;
+  };
+  const pumpTurn = async (events, emit, ctx, suppressStageExit) => {
+    let failed = false;
+    for await (const ev of events) {
+      const rawRef = ctx.writeRaw?.(ev);
+      const { events: mapped } = mapCodexEvent(ev);
+      for (const e of mapped) {
+        if (suppressStageExit && e.type === "state") continue;
+        emit(e, rawRef);
+      }
+      if (ev.type === "thread.started") sessionId = ev.thread_id;
+      if (ev.type === "turn.failed") failed = true;
+    }
+    return failed;
+  };
+  const captureThreadId = (t) => {
+    if (t.id) sessionId = t.id;
+  };
+  return {
+    runtime: "codex",
+    async runBatch(ctx, onTrace) {
+      if (ctx.config.mcpServers && ctx.config.mcpServers.length > 0) {
+        process.stderr.write("codex-adapter: MCP servers not supported on Codex; ignoring\n");
+      }
+      const emit = makeEmit("codex", onTrace);
+      const t = openThread(ctx);
+      let status = "ok";
+      try {
+        const { events } = await t.runStreamed(resolveStagePrompt(ctx), { signal });
+        if (await pumpTurn(events, emit, ctx, false)) status = "fail";
+      } catch (e) {
+        if (!cancelled) emit({ type: "error", kind: "runtime_error", message: e.message });
+        status = "fail";
+      }
+      captureThreadId(t);
+      if (cancelled) status = "fail";
+      return { status, ...sessionId ? { sessionId } : {} };
+    },
+    async runInteractive(ctx, turns, onTrace) {
+      const emit = makeEmit("codex", onTrace);
+      const t = openThread(ctx);
+      const exit = ctx.config.exit ?? "gate";
+      if (exit === "tool" || exit === "either") {
+        process.stderr.write("codex-adapter: interactive tool-exit not supported in M4; using gate exit\n");
+      }
+      const humanIter = turns[Symbol.asyncIterator]();
+      const { firstReplyMs, idleMs } = interactiveIdleWindows(ctx);
+      let awaitingFirstReply = true;
+      let exited = "gate";
+      let pending = humanIter.next();
+      try {
+        const seed = await t.runStreamed(interactiveSeedText(ctx, false), { signal });
+        await pumpTurn(seed.events, emit, ctx, true);
+        for (; ; ) {
+          const race = await raceNextTurn(pending, awaitingFirstReply ? firstReplyMs : idleMs, signal);
+          awaitingFirstReply = false;
+          if (race.kind === "cancelled") {
+            exited = "cancelled";
+            break;
+          }
+          if (race.kind === "idle-timeout") {
+            exited = "timeout";
+            break;
+          }
+          if (race.kind === "turns-exhausted") {
+            exited = "gate";
+            break;
+          }
+          const texts = [race.value.text];
+          pending = humanIter.next();
+          for (; ; ) {
+            const more = await raceNextTurn(pending, COALESCE_MS2, signal);
+            if (more.kind === "turn") {
+              texts.push(more.value.text);
+              pending = humanIter.next();
+              continue;
+            }
+            if (more.kind === "cancelled") exited = "cancelled";
+            break;
+          }
+          if (exited === "cancelled") break;
+          const { events } = await t.runStreamed(texts.join("\n"), { signal });
+          await pumpTurn(events, emit, ctx, true);
+        }
+      } catch (e) {
+        if (!cancelled) emit({ type: "error", kind: "runtime_error", message: e.message });
+        exited = cancelled ? "cancelled" : "gate";
+      }
+      let status = "ok";
+      let summary = "";
+      if (exited === "gate") {
+        try {
+          const turn = await t.run(SUMMARISE_PROMPT, { signal });
+          summary = (turn.finalResponse ?? "").trim() || "(no summary produced)";
+        } catch {
+          summary = "(no summary produced)";
+        }
+      } else if (exited === "timeout") {
+        status = "timeout";
+        summary = "(stage timed out awaiting input)";
+        await this.cancel();
+      } else {
+        status = "fail";
+        summary = "(stage cancelled)";
+      }
+      captureThreadId(t);
+      return { status, summary, ...sessionId ? { sessionId } : {} };
+    },
+    async summarise(ctx) {
+      if (!thread) return "(no summary: thread not established)";
+      try {
+        const turn = await thread.run(SUMMARISE_PROMPT, { signal });
+        captureThreadId(thread);
+        return (turn.finalResponse ?? "").trim() || "(no summary produced)";
+      } catch (e) {
+        return `(summary unavailable: ${e.message})`;
+      }
+    },
+    async cancel() {
+      if (cancelled) return;
+      cancelled = true;
+      abortController.abort();
+    }
+  };
+}
+
+// ../../packages/executor-worktree/src/pi-mappers.ts
+function mapUsage3(u) {
+  return {
+    input: u?.input ?? 0,
+    output: u?.output ?? 0,
+    cacheRead: u?.cacheRead ?? 0,
+    cacheCreate: u?.cacheWrite ?? 0
+  };
+}
+function settleStatus(m) {
+  if (!m) return "ok";
+  if (m.errorMessage || m.stopReason === "error" || m.stopReason === "aborted") return "fail";
+  return "ok";
+}
+function settleMessage(ev) {
+  if (ev.type === "turn_end") return ev.message;
+  if (ev.type === "agent_end") return ev.messages?.[ev.messages.length - 1];
+  return void 0;
+}
+function mapPiEvent(ev) {
+  switch (ev.type) {
+    case "tool_execution_start":
+      return {
+        events: [{ type: "action", tool: ev.toolName, toolUseId: ev.toolCallId, input: ev.args }],
+        recognised: true
+      };
+    case "tool_execution_end":
+      return {
+        events: [
+          { type: "observation", toolUseId: ev.toolCallId, output: ev.content, isError: Boolean(ev.isError) }
+        ],
+        recognised: true
+      };
+    case "turn_end":
+    case "agent_end": {
+      const m = settleMessage(ev);
+      const status = settleStatus(m);
+      const events = [];
+      if (status !== "ok") {
+        const kind = ev.type === "agent_end" ? "agent_error" : "turn_error";
+        events.push({ type: "error", kind, message: m?.errorMessage ?? m?.stopReason ?? "failed" });
+      }
+      events.push({ type: "state", event: "stage-exit", status, usage: mapUsage3(m?.usage) });
+      return { events, recognised: true };
+    }
+    // Streamed deltas: owned by the buffered state machine, no discrete event here.
+    case "message_update":
+    // Lifecycle / interim noise: recognised, captured in the raw sidecar, not normalised.
+    case "message_start":
+    case "message_end":
+    case "agent_start":
+    case "turn_start":
+    case "tool_execution_update":
+    case "queue_update":
+    case "compaction_start":
+    case "compaction_end":
+    case "auto_retry_start":
+    case "auto_retry_end":
+      return { events: [], recognised: true };
+    default:
+      return { events: [], recognised: false };
+  }
+}
+var newPiBufferState = () => ({
+  bufferedText: "",
+  pendingThought: "",
+  turnEndedOnTool: false
+});
+function consumePiEvent(ev, state, suppressStageExit) {
+  const events = [];
+  if (ev.type === "message_update") {
+    const ame = ev.assistantMessageEvent;
+    if (ame.type === "text_delta") {
+      state.bufferedText += ame.delta ?? "";
+      state.turnEndedOnTool = false;
+    } else if (ame.type === "thinking_delta") {
+      state.pendingThought += ame.delta ?? "";
+    }
+    return { events, isResult: false };
+  }
+  if (ev.type === "tool_execution_start") {
+    if (state.pendingThought) {
+      events.push({ type: "thought", subtype: "reasoning_text", text: state.pendingThought });
+      state.pendingThought = "";
+    }
+    events.push(...mapPiEvent(ev).events);
+    state.turnEndedOnTool = true;
+    state.bufferedText = "";
+    return { events, isResult: false };
+  }
+  if (ev.type === "tool_execution_end") {
+    events.push(...mapPiEvent(ev).events);
+    return { events, isResult: false };
+  }
+  if (ev.type === "turn_end" || ev.type === "agent_end") {
+    const r = mapPiEvent(ev);
+    const status = settleStatus(settleMessage(ev));
+    let responseText;
+    const text = state.bufferedText.trim();
+    if (status === "ok" && text && !state.turnEndedOnTool) {
+      responseText = text;
+      events.push({ type: "response", text });
+    }
+    if (state.pendingThought) {
+      events.push({ type: "thought", subtype: "reasoning_text", text: state.pendingThought });
+    }
+    for (const e of r.events) {
+      if (suppressStageExit && e.type === "state") continue;
+      events.push(e);
+    }
+    state.bufferedText = "";
+    state.pendingThought = "";
+    state.turnEndedOnTool = false;
+    return { events, isResult: true, status, responseText };
+  }
+  return { events, isResult: false };
+}
+
+// ../../packages/executor-worktree/src/pi-adapter.ts
+var COALESCE_MS3 = Number(process.env.DAHRK_COALESCE_MS ?? process.env.SKAKEL_COALESCE_MS ?? 40);
+var PI_STAGE_COMPLETE_TOOL = "dahrk_stage_complete";
+function createPiRunner(deps = {}) {
+  const createSession = deps.createSession ?? defaultCreatePiSession;
+  const abortController = new AbortController();
+  const signal = abortController.signal;
+  let cancelled = false;
+  let session;
+  let sessionId;
+  const openSession = async (ctx) => {
+    if (!session) session = await createSession(ctx);
+    return session;
+  };
+  const captureSessionId = (s) => {
+    if (s.sessionId) sessionId = s.sessionId;
+  };
+  return {
+    runtime: "pi",
+    async runBatch(ctx, onTrace) {
+      const emit = makeEmit("pi", onTrace);
+      const s = await openSession(ctx);
+      const state = newPiBufferState();
+      let status = "ok";
+      const unsub = s.subscribe((ev) => {
+        const rawRef = ctx.writeRaw?.(ev);
+        const r = consumePiEvent(ev, state, false);
+        for (const e of r.events) emit(e, rawRef);
+        if (r.isResult && r.status) status = r.status;
+      });
+      try {
+        await s.prompt(resolveStagePrompt(ctx));
+      } catch (e) {
+        if (!cancelled) emit({ type: "error", kind: "runtime_error", message: e.message });
+        status = "fail";
+      } finally {
+        unsub();
+      }
+      captureSessionId(s);
+      if (cancelled) status = "fail";
+      return { status, ...sessionId ? { sessionId } : {} };
+    },
+    async runInteractive(ctx, turns, onTrace) {
+      const emit = makeEmit("pi", onTrace);
+      const s = await openSession(ctx);
+      const state = newPiBufferState();
+      const exit = ctx.config.exit ?? "gate";
+      const wantsTool = exit === "tool" || exit === "either";
+      let toolFired = false;
+      let toolSummary = null;
+      let stageCompleteCallId;
+      let lastResponseText;
+      const unsub = s.subscribe((ev) => {
+        const rawRef = ctx.writeRaw?.(ev);
+        if (ev.type === "tool_execution_start" && ev.toolName === PI_STAGE_COMPLETE_TOOL) {
+          toolFired = true;
+          stageCompleteCallId = ev.toolCallId;
+          const args = ev.args;
+          if (args?.summary) toolSummary = args.summary;
+          return;
+        }
+        if (ev.type === "tool_execution_end" && ev.toolCallId === stageCompleteCallId) return;
+        const r = consumePiEvent(ev, state, true);
+        for (const e of r.events) emit(e, rawRef);
+        if (r.responseText) lastResponseText = r.responseText;
+      });
+      const humanIter = turns[Symbol.asyncIterator]();
+      const { firstReplyMs, idleMs } = interactiveIdleWindows(ctx);
+      let awaitingFirstReply = true;
+      let exited = "gate";
+      let pending = humanIter.next();
+      try {
+        await s.prompt(interactiveSeedText(ctx, false));
+        if (toolFired && wantsTool) exited = "tool";
+        for (; ; ) {
+          if (exited === "tool") break;
+          const race = await raceNextTurn(pending, awaitingFirstReply ? firstReplyMs : idleMs, signal);
+          awaitingFirstReply = false;
+          if (race.kind === "cancelled") {
+            exited = "cancelled";
+            break;
+          }
+          if (race.kind === "idle-timeout") {
+            exited = "timeout";
+            break;
+          }
+          if (race.kind === "turns-exhausted") {
+            exited = "gate";
+            break;
+          }
+          const texts = [race.value.text];
+          pending = humanIter.next();
+          for (; ; ) {
+            const more = await raceNextTurn(pending, COALESCE_MS3, signal);
+            if (more.kind === "turn") {
+              texts.push(more.value.text);
+              pending = humanIter.next();
+              continue;
+            }
+            if (more.kind === "cancelled") exited = "cancelled";
+            break;
+          }
+          if (exited === "cancelled") break;
+          await s.prompt(texts.join("\n"));
+          if (toolFired && wantsTool) {
+            exited = "tool";
+            break;
+          }
+        }
+      } catch (e) {
+        if (!cancelled) emit({ type: "error", kind: "runtime_error", message: e.message });
+        exited = cancelled ? "cancelled" : "gate";
+      }
+      let status = "ok";
+      let summary = "";
+      if (exited === "tool") {
+        summary = toolSummary ?? "(stage marked complete)";
+      } else if (exited === "gate") {
+        lastResponseText = void 0;
+        try {
+          await s.prompt(SUMMARISE_PROMPT);
+          summary = (lastResponseText ?? "").trim() || "(no summary produced)";
+        } catch {
+          summary = "(no summary produced)";
+        }
+      } else if (exited === "timeout") {
+        status = "timeout";
+        summary = "(stage timed out awaiting input)";
+        await this.cancel();
+      } else {
+        status = "fail";
+        summary = "(stage cancelled)";
+      }
+      unsub();
+      captureSessionId(s);
+      return { status, summary, ...sessionId ? { sessionId } : {} };
+    },
+    async summarise(ctx) {
+      if (!session) return "(no summary: session not established)";
+      const s = session;
+      if (s.agent) s.agent.state.tools = [];
+      const state = newPiBufferState();
+      let out;
+      const unsub = s.subscribe((ev) => {
+        const r = consumePiEvent(ev, state, true);
+        if (r.responseText) out = r.responseText;
+      });
+      try {
+        await s.prompt(SUMMARISE_PROMPT);
+        captureSessionId(s);
+        return (out ?? "").trim() || "(no summary produced)";
+      } catch (e) {
+        return `(summary unavailable: ${e.message})`;
+      } finally {
+        unsub();
+      }
+    },
+    async cancel() {
+      if (cancelled) return;
+      cancelled = true;
+      abortController.abort();
+      try {
+        await session?.abort();
+      } catch {
+      }
+      try {
+        session?.dispose();
+      } catch {
+      }
+    }
+  };
+}
+async function defaultCreatePiSession(ctx) {
+  const spec = "@earendil-works/pi-coding-agent";
+  const mod = await import(spec);
+  const { AuthStorage, ModelRegistry, SessionManager, createAgentSession, defineTool, resolveCliModel } = mod;
+  const authStorage = AuthStorage.create();
+  for (const [key, value] of Object.entries(ctx.runtimeEnv ?? {})) {
+    const provider = PROVIDER_BY_ENV[key];
+    if (provider) authStorage.setRuntimeApiKey(provider, value);
+  }
+  const modelRegistry = ModelRegistry.create(authStorage);
+  let model;
+  if (ctx.config.model) {
+    const resolved = resolveCliModel({ cliModel: ctx.config.model, modelRegistry });
+    if (!resolved?.error) model = resolved?.model;
+  }
+  const stageComplete = defineTool({
+    name: PI_STAGE_COMPLETE_TOOL,
+    label: "Stage complete",
+    description: "End the current stage and hand off a one-sentence summary of what was accomplished.",
+    parameters: { type: "object", properties: { summary: { type: "string" } }, required: ["summary"] },
+    execute: async () => ({ content: [{ type: "text", text: "Stage marked complete." }], details: {} })
+  });
+  const { session } = await createAgentSession({
+    sessionManager: SessionManager.inMemory(ctx.workspace.worktreePath),
+    authStorage,
+    modelRegistry,
+    cwd: ctx.workspace.worktreePath,
+    customTools: [stageComplete],
+    ...model ? { model } : {}
+  });
+  return session;
+}
+var PROVIDER_BY_ENV = {
+  ANTHROPIC_API_KEY: "anthropic",
+  OPENAI_API_KEY: "openai",
+  GEMINI_API_KEY: "google",
+  GOOGLE_API_KEY: "google"
+};
+
+// ../../packages/executor-worktree/src/git-service.ts
+import { execFileSync } from "child_process";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { homedir, tmpdir } from "os";
+import { dirname, isAbsolute, join as join2 } from "path";
+var noopLogger = { info: () => {
+}, warn: () => {
+} };
+function parseOwnerRepo(gitUrl) {
+  const m = /[:/]([^/:]+)\/([^/]+?)(?:\.git)?$/.exec(gitUrl.trim());
+  return m ? `${m[1]}/${m[2]}` : void 0;
+}
+function sanitizeBranchName(name) {
+  if (!name) return name;
+  return name.replace(/[`~^:?*[\]\\@{}\s]/g, "-").replace(/\.{2,}/g, ".").replace(/\/{2,}/g, "/").replace(/\.lock(\/|$)/g, "$1").replace(/^[.\-/]+/, "").replace(/[.\-/]+$/, "").replace(/-{2,}/g, "-");
+}
+function createGitService(opts = {}) {
+  const worktreesDir = opts.worktreesDir ?? process.env.DAHRK_WORKTREES_DIR ?? process.env.SKAKEL_WORKTREES_DIR ?? join2(homedir(), ".dahrk", "worktrees");
+  const mirrorsDir = opts.mirrorsDir ?? process.env.DAHRK_MIRRORS_DIR ?? process.env.SKAKEL_MIRRORS_DIR ?? join2(homedir(), ".dahrk", "mirrors");
+  const authorName = opts.authorName ?? process.env.DAHRK_GIT_AUTHOR_NAME ?? "Dahrk";
+  const authorEmail = opts.authorEmail ?? process.env.DAHRK_GIT_AUTHOR_EMAIL ?? "noreply@dahrk.net";
+  const log2 = opts.logger ?? noopLogger;
+  const git = (cwd, args, env) => execFileSync("git", args, {
+    cwd,
+    stdio: ["pipe", "pipe", "pipe"],
+    encoding: "utf-8",
+    ...env ? { env } : {}
+  });
+  const gitBare = (args, env) => execFileSync("git", args, {
+    stdio: ["pipe", "pipe", "pipe"],
+    encoding: "utf-8",
+    ...env ? { env } : {}
+  });
+  const gitOk = (cwd, args) => {
+    try {
+      git(cwd, args);
+      return true;
+    } catch {
+      return false;
+    }
+  };
+  const gh = (cwd, args) => execFileSync("gh", args, { cwd, stdio: ["pipe", "pipe", "pipe"], encoding: "utf-8" });
+  const ghError = (e) => {
+    const err = e;
+    if (err?.code === "ENOENT") return "gh CLI not installed on this node";
+    const stderr = typeof err?.stderr === "string" ? err.stderr : err?.stderr?.toString();
+    return (stderr?.trim() || err?.message || String(e)).split("\n")[0] ?? String(e);
+  };
+  const excludeScratchLocally = (worktreePath) => {
+    const entry = ".skakel/scratch/";
+    try {
+      const rel = git(worktreePath, ["rev-parse", "--git-path", "info/exclude"]).trim();
+      const excludePath = isAbsolute(rel) ? rel : join2(worktreePath, rel);
+      const existing = existsSync(excludePath) ? readFileSync2(excludePath, "utf-8") : "";
+      if (existing.split("\n").some((l) => l.trim() === entry)) return;
+      mkdirSync(dirname(excludePath), { recursive: true });
+      const sep2 = existing && !existing.endsWith("\n") ? "\n" : "";
+      writeFileSync(excludePath, `${existing}${sep2}${entry}
+`);
+    } catch (e) {
+      log2.warn(`could not set worktree scratch exclude at ${worktreePath}: ${e.message}`);
+    }
+  };
+  const setupAuth = (token) => {
+    const dir = mkdtempSync(join2(tmpdir(), "dahrk-cred-"));
+    const script = join2(dir, "askpass.sh");
+    writeFileSync(script, '#!/bin/sh\nprintf "%s" "$DAHRK_GIT_TOKEN"\n', { mode: 448 });
+    return {
+      env: { ...process.env, GIT_ASKPASS: script, DAHRK_GIT_TOKEN: token, GIT_TERMINAL_PROMPT: "0" },
+      cleanup: () => rmSync(dir, { recursive: true, force: true })
+    };
+  };
+  const netEnv = (authEnv) => authEnv ?? { ...process.env, GIT_TERMINAL_PROMPT: "0" };
+  const withTokenUser = (gitUrl) => /^https:\/\/[^@/]+@/.test(gitUrl) ? gitUrl : gitUrl.replace(/^https:\/\//, "https://x-access-token@");
+  const mirrorPathFor = (repoId) => join2(mirrorsDir, sanitizeBranchName(repoId));
+  const ensureMirror = (repoId, gitUrl, authEnv) => {
+    const mirror = mirrorPathFor(repoId);
+    if (existsSync(mirror) && gitOk(mirror, ["rev-parse", "--git-dir"])) {
+      log2.info(`refreshing mirror ${repoId}`);
+      try {
+        git(mirror, ["remote", "update", "--prune"], netEnv(authEnv));
+        return { mirror, refreshed: true };
+      } catch (e) {
+        log2.warn(`mirror remote update failed for ${repoId}: ${e.message}`);
+        return { mirror, refreshed: false };
+      }
+    }
+    mkdirSync(mirrorsDir, { recursive: true });
+    const cloneUrl = authEnv ? withTokenUser(gitUrl) : gitUrl;
+    log2.info(`cloning mirror ${repoId} from ${gitUrl}`);
+    gitBare(["clone", "--mirror", cloneUrl, mirror], netEnv(authEnv));
+    return { mirror, refreshed: true };
+  };
+  const refFor = (spec, worktreePath) => ({
+    repoId: spec.repoId,
+    gitUrl: spec.gitUrl,
+    repo: spec.repo ?? spec.repoId,
+    baseBranch: spec.baseBranch,
+    worktreePath,
+    scratchPath: join2(worktreePath, ".skakel", "scratch")
+  });
+  return {
+    async createWorktree(spec) {
+      const { repoId, gitUrl, baseBranch, runId } = spec;
+      const branchName = sanitizeBranchName(spec.branch ?? `dahrk/${runId}`);
+      const worktreePath = join2(worktreesDir, runId);
+      mkdirSync(worktreesDir, { recursive: true });
+      if (existsSync(worktreePath) && gitOk(worktreePath, ["rev-parse", "--git-dir"])) {
+        log2.info(`reusing existing worktree at ${worktreePath}`);
+        mkdirSync(join2(worktreePath, ".skakel", "scratch"), { recursive: true });
+        return refFor(spec, worktreePath);
+      }
+      const auth = spec.credentialToken ? setupAuth(spec.credentialToken) : void 0;
+      try {
+        const { mirror, refreshed } = ensureMirror(repoId, gitUrl, auth?.env);
+        if (gitOk(mirror, ["rev-parse", "--verify", branchName])) {
+          git(mirror, ["worktree", "add", "--force", worktreePath, branchName]);
+        } else {
+          if (!refreshed) {
+            log2.info(`mirror refresh failed; fetching base ${baseBranch} before branching ${branchName}`);
+            git(mirror, ["fetch", "origin", `+refs/heads/${baseBranch}:refs/heads/${baseBranch}`], netEnv(auth?.env));
+          }
+          log2.info(`creating worktree at ${worktreePath} from ${baseBranch} on ${branchName}`);
+          git(mirror, ["worktree", "add", "-b", branchName, worktreePath, baseBranch]);
+        }
+      } finally {
+        auth?.cleanup();
+      }
+      mkdirSync(join2(worktreePath, ".skakel", "scratch"), { recursive: true });
+      return refFor(spec, worktreePath);
+    },
+    async commitAndPush(ref, opts2) {
+      const { worktreePath } = ref;
+      if (!existsSync(worktreePath) || !gitOk(worktreePath, ["rev-parse", "--git-dir"])) {
+        throw new Error(`worktree missing for push: ${worktreePath}`);
+      }
+      const branch = sanitizeBranchName(opts2.branch);
+      const SCRATCH = ".skakel/scratch";
+      excludeScratchLocally(worktreePath);
+      git(worktreePath, ["rm", "-r", "--cached", "--ignore-unmatch", "--quiet", SCRATCH]);
+      git(worktreePath, ["add", "-A", "--", "."]);
+      const hasStaged = !gitOk(worktreePath, ["diff", "--cached", "--quiet"]);
+      if (hasStaged) {
+        git(worktreePath, [
+          "-c",
+          `user.name=${authorName}`,
+          "-c",
+          `user.email=${authorEmail}`,
+          "commit",
+          "-m",
+          opts2.message
+        ]);
+      }
+      const dirty = hasStaged;
+      let headSha = git(worktreePath, ["rev-parse", "HEAD"]).trim();
+      let commitsAhead = 0;
+      for (const baseRef of [opts2.base, `origin/${opts2.base}`, `refs/heads/${opts2.base}`]) {
+        if (!baseRef) continue;
+        try {
+          commitsAhead = Number.parseInt(git(worktreePath, ["rev-list", "--count", `${baseRef}..HEAD`]).trim(), 10) || 0;
+          break;
+        } catch {
+        }
+      }
+      const auth = opts2.credentialToken ? setupAuth(opts2.credentialToken) : void 0;
+      const remote = opts2.credentialToken ? withTokenUser(ref.gitUrl) : ref.gitUrl;
+      let pushed = false;
+      let integration;
+      try {
+        let fetched = false;
+        if (opts2.base) {
+          try {
+            git(worktreePath, ["fetch", remote, opts2.base], netEnv(auth?.env));
+            fetched = true;
+          } catch (e) {
+            log2.warn(`base fetch failed for ${opts2.base}; skipping push-time integration: ${e.message}`);
+          }
+        }
+        if (fetched) {
+          try {
+            git(worktreePath, [
+              "-c",
+              `user.name=${authorName}`,
+              "-c",
+              `user.email=${authorEmail}`,
+              "merge",
+              "--no-edit",
+              "FETCH_HEAD"
+            ], auth?.env);
+            integration = "clean";
+            headSha = git(worktreePath, ["rev-parse", "HEAD"]).trim();
+          } catch {
+            const conflictFiles = git(worktreePath, ["diff", "--name-only", "--diff-filter=U"]).split("\n").map((l) => l.trim()).filter(Boolean);
+            git(worktreePath, ["merge", "--abort"]);
+            return { headSha, pushed: false, nothingToCommit: !dirty, commitsAhead, integration: "conflict", conflictFiles };
+          }
+        }
+        git(worktreePath, ["push", remote, `HEAD:refs/heads/${branch}`], netEnv(auth?.env));
+        pushed = true;
+      } finally {
+        auth?.cleanup();
+      }
+      return { headSha, pushed, nothingToCommit: !dirty, commitsAhead, ...integration ? { integration } : {} };
+    },
+    async openPrAmbient(ref, opts2) {
+      const ownerRepo = parseOwnerRepo(ref.gitUrl);
+      if (!ownerRepo) return { prError: `cannot derive owner/repo from ${ref.gitUrl}` };
+      const { worktreePath } = ref;
+      const branch = sanitizeBranchName(opts2.branch);
+      const repoArgs = ["--repo", ownerRepo];
+      const readBack = () => {
+        try {
+          const pr = JSON.parse(gh(worktreePath, ["pr", "view", branch, ...repoArgs, "--json", "number,url"]));
+          return pr.url ? { prUrl: pr.url, ...pr.number !== void 0 ? { prNumber: pr.number } : {} } : void 0;
+        } catch {
+          return void 0;
+        }
+      };
+      const tmp = mkdtempSync(join2(tmpdir(), "dahrk-pr-"));
+      const bodyFile = join2(tmp, "body.md");
+      try {
+        writeFileSync(bodyFile, opts2.body ?? "");
+        try {
+          gh(worktreePath, [
+            "pr",
+            "create",
+            ...repoArgs,
+            "--head",
+            branch,
+            "--base",
+            opts2.base,
+            "--title",
+            opts2.title,
+            "--body-file",
+            bodyFile
+          ]);
+        } catch (e) {
+          const existing = readBack();
+          if (existing) return existing;
+          return { prError: ghError(e) };
+        }
+        return readBack() ?? { prError: "gh pr create reported success but no PR was found" };
+      } finally {
+        rmSync(tmp, { recursive: true, force: true });
+      }
+    },
+    async teardownWorktree(ref) {
+      if (!existsSync(ref.worktreePath)) return;
+      const mirror = mirrorPathFor(ref.repoId);
+      try {
+        git(mirror, ["worktree", "remove", "--force", ref.worktreePath]);
+      } catch (e) {
+        log2.warn(`git worktree remove failed for ${ref.worktreePath}: ${e.message}`);
+      }
+      rmSync(ref.worktreePath, { recursive: true, force: true });
+      try {
+        git(mirror, ["worktree", "prune"]);
+      } catch {
+      }
+    }
+  };
+}
+
+// ../../packages/executor-worktree/src/trace-writer.ts
+import { createHash } from "crypto";
+import { appendFileSync, mkdirSync as mkdirSync2, writeFileSync as writeFileSync2 } from "fs";
+import { join as join3 } from "path";
+var DEFAULT_SPILL_BYTES = 8192;
+function createTraceWriter(scratchPath, meta, opts = {}) {
+  const spillBytes = opts.spillBytes ?? DEFAULT_SPILL_BYTES;
+  const dir = join3(scratchPath, "traces", meta.stageId, `attempt-${meta.attempt}`);
+  mkdirSync2(join3(dir, "blobs"), { recursive: true });
+  mkdirSync2(join3(dir, "raw"), { recursive: true });
+  const tracePath = join3(dir, "trace.jsonl");
+  const metaPath = join3(dir, "meta.json");
+  let current = { ...meta };
+  let nextSeq = 0;
+  let rawCount = 0;
+  writeFileSync2(metaPath, JSON.stringify(current, null, 2));
+  const tooBig = (value) => {
+    const s = typeof value === "string" ? value : JSON.stringify(value ?? "");
+    return s.length > spillBytes;
+  };
+  const spillValue = (value) => {
+    const data = typeof value === "string" ? value : JSON.stringify(value);
+    const sha = createHash("sha256").update(data).digest("hex");
+    writeFileSync2(join3(dir, "blobs", sha), data);
+    return join3("blobs", sha);
+  };
+  const spill = (event) => {
+    if (event.type === "thought" && event.text !== void 0 && tooBig(event.text)) {
+      const { text, ...rest } = event;
+      return { ...rest, textRef: spillValue(text) };
+    }
+    if (event.type === "response" && event.text !== void 0 && tooBig(event.text)) {
+      const { text, ...rest } = event;
+      return { ...rest, textRef: spillValue(text) };
+    }
+    if (event.type === "action" && event.input !== void 0 && tooBig(event.input)) {
+      const { input, ...rest } = event;
+      return { ...rest, inputRef: spillValue(input) };
+    }
+    if (event.type === "observation" && event.output !== void 0 && tooBig(event.output)) {
+      const { output, ...rest } = event;
+      return { ...rest, outputRef: spillValue(output) };
+    }
+    return event;
+  };
+  return {
+    dir,
+    append(event) {
+      const written = { ...spill(event), seq: nextSeq++ };
+      appendFileSync(tracePath, `${JSON.stringify(written)}
+`);
+      return written;
+    },
+    writeRaw(record) {
+      const rel = join3("raw", `${rawCount++}.json`);
+      writeFileSync2(join3(dir, rel), JSON.stringify(record, null, 2));
+      return rel;
+    },
+    finalise(patch = {}) {
+      current = { ...current, ...patch };
+      writeFileSync2(metaPath, JSON.stringify(current, null, 2));
+    },
+    count() {
+      return nextSeq;
+    }
+  };
+}
+
+// ../../packages/executor-worktree/src/pack-cache.ts
+import { createHash as createHash2 } from "crypto";
+import { cpSync, existsSync as existsSync2, mkdirSync as mkdirSync3, mkdtempSync as mkdtempSync2, readdirSync, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "fs";
+import { dirname as dirname2, join as join4, relative, sep } from "path";
+function readManifestFiles(dir) {
+  const out = [];
+  const walk = (cur) => {
+    for (const entry of readdirSync(cur, { withFileTypes: true })) {
+      const abs = join4(cur, entry.name);
+      if (entry.isDirectory()) walk(abs);
+      else out.push(relative(dir, abs).split(sep).join("/"));
+    }
+  };
+  walk(dir);
+  return out.sort();
+}
+
+// ../../packages/executor-worktree/src/overlay.ts
+import { existsSync as existsSync3, mkdirSync as mkdirSync4, readFileSync as readFileSync3, writeFileSync as writeFileSync4 } from "fs";
+import { dirname as dirname3, join as join5 } from "path";
+function sameBytes(dest, bytes) {
+  try {
+    return readFileSync3(dest).equals(bytes);
+  } catch {
+    return false;
+  }
+}
+async function overlayComponents(opts) {
+  const { worktreePath, runtime, components, cache } = opts;
+  const result = { written: [], skippedRepoLocal: [], warnings: [] };
+  for (const ref of components) {
+    if (runtime === "codex") {
+      result.warnings.push(
+        `codex runtime: ${ref.kind} \`${ref.name}@${ref.version}\` not materialised; inline into the prompt or use Claude`
+      );
+      continue;
+    }
+    const { dir } = await cache.materialise(ref);
+    for (const relPath of readManifestFiles(dir)) {
+      const src = join5(dir, relPath);
+      const dest = join5(worktreePath, relPath);
+      const bytes = readFileSync3(src);
+      if (existsSync3(dest)) {
+        if (sameBytes(dest, bytes)) continue;
+        result.skippedRepoLocal.push(relPath);
+        continue;
+      }
+      mkdirSync4(dirname3(dest), { recursive: true });
+      writeFileSync4(dest, bytes);
+      result.written.push(relPath);
+    }
+  }
+  return result;
+}
+
+// ../../packages/executor-worktree/src/pi-container.ts
+import { spawn as nodeSpawn } from "child_process";
+
+// ../../packages/executor-worktree/src/pi-rpc-client.ts
+import { StringDecoder } from "string_decoder";
+
+// ../../packages/executor-worktree/src/pi-container.ts
+var DEFAULT_IMAGE = process.env.DAHRK_PI_IMAGE ?? process.env.SKAKEL_PI_IMAGE ?? "dahrk/pi:latest";
+
+// ../../packages/executor-worktree/src/index.ts
+function makeRunner(runtime) {
+  if ((process.env.DAHRK_RUNNER ?? process.env.SKAKEL_RUNNER ?? "real") === "mock") return createMockRunner(runtime);
+  if (runtime === "pi") return createPiRunner();
+  return runtime === "codex" ? createCodexRunner() : createClaudeRunner();
+}
+
+// ../../packages/edge/src/policy.ts
+var ALLOW = { verdict: "allow", policy: "none" };
+function evaluatePolicies(event, rules) {
+  for (const rule of rules) {
+    const outcome = rule.evaluate(event);
+    if (outcome && outcome.verdict !== "allow") return outcome;
+  }
+  return ALLOW;
+}
+function denyToolRule(tool2) {
+  return {
+    name: "deny_tool",
+    evaluate(event) {
+      if (event.kind === "action" && event.tool === tool2) {
+        return { verdict: "deny", policy: "deny_tool", reason: `tool "${tool2}" is denied` };
+      }
+      return null;
+    }
+  };
+}
+
+// ../../packages/edge/src/stage-runner.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { mkdirSync as mkdirSync5, readdirSync as readdirSync2, readFileSync as readFileSync4, rmSync as rmSync3, writeFileSync as writeFileSync5 } from "fs";
+import { tmpdir as tmpdir2 } from "os";
+import { join as join6 } from "path";
+import { attachedDocBasename as attachedDocBasename2 } from "@dahrk/contracts";
+
+// ../../packages/edge/src/builtins.ts
+import { execFileSync as execFileSync2 } from "child_process";
+var WRITE_TOOLS = /* @__PURE__ */ new Set([
+  "Write",
+  "Edit",
+  "MultiEdit",
+  "NotebookEdit",
+  "apply_patch",
+  "Bash",
+  "command",
+  "shell"
+]);
+var SHELL_TOOLS = /* @__PURE__ */ new Set(["Bash", "command", "shell"]);
+var DANGEROUS = [
+  /\bsudo\b/,
+  /\bcurl\b[^\n|]*\|\s*sh\b/,
+  />\s*\/dev\/(?!null|stdout|stderr|tty|fd\/)/,
+  // write to a raw device, but allow the safe sinks (2>/dev/null etc.)
+  /\bgit\s+push\b[^\n]*--force/,
+  /\bchmod\s+777\b/,
+  /\bmkfs\b/,
+  /:\(\)\s*\{.*\};:/
+  // fork bomb
+];
+var CATASTROPHIC_RM_TARGET = /^(\/|~|\.|\.\.|\*|\$\{?HOME\}?|\/(usr|etc|var|bin|sbin|lib|lib64|opt|boot|root|home|users|system|library|private|dev|proc|sys|applications))$/i;
+function isDangerousRm(cmd) {
+  for (const seg of cmd.split(/[\n;&|]+/)) {
+    const m = seg.match(/\brm\b(.*)/s);
+    if (!m) continue;
+    const tokens = (m[1] ?? "").trim().split(/\s+/).filter(Boolean);
+    const recursive = tokens.some((t) => t === "--recursive" || /^-[a-z]*r/i.test(t));
+    if (!recursive) continue;
+    const targets = tokens.filter((t) => !t.startsWith("-"));
+    if (targets.length === 0) return true;
+    for (const raw of targets) {
+      const t = raw.replace(/^['"]|['"]$/g, "").replace(/\/+\*?$/, "");
+      if (t === "" || CATASTROPHIC_RM_TARGET.test(t)) return true;
+    }
+  }
+  return false;
+}
+function currentBranch(worktreePath) {
+  try {
+    return execFileSync2("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: worktreePath }).toString().trim();
+  } catch {
+    return "";
+  }
+}
+function globMatch(globs, value) {
+  return globs.some((g) => {
+    const re = new RegExp(`^${g.replace(/[.+?^${}()|[\]\\]/g, "\\$&").replace(/\*/g, ".*")}$`);
+    return re.test(value);
+  });
+}
+function commandOf(input) {
+  if (typeof input === "string") return input;
+  if (input && typeof input === "object") {
+    const o = input;
+    if (typeof o.command === "string") return o.command;
+  }
+  return "";
+}
+function buildRules(policies, ctx) {
+  const rules = [];
+  let stageToolCalls = 0;
+  for (const p of policies) {
+    if ("write_scope" in p) {
+      const { branches, repos } = p.write_scope;
+      rules.push({
+        name: "write_scope",
+        evaluate(event) {
+          if (event.kind !== "action" || !WRITE_TOOLS.has(event.tool)) return null;
+          if (repos && repos.length && !repos.includes(ctx.repoName)) {
+            return { verdict: "deny", policy: "write_scope", reason: `repo "${ctx.repoName}" is out of write scope` };
+          }
+          if (branches && branches.length) {
+            const b = currentBranch(ctx.worktreePath);
+            if (!globMatch(branches, b)) {
+              return {
+                verdict: "deny",
+                policy: "write_scope",
+                reason: `branch "${b}" is out of write scope (${branches.join(", ")})`
+              };
+            }
+          }
+          return null;
+        }
+      });
+    } else if ("max_tool_calls" in p) {
+      const { perStage, perRun } = p.max_tool_calls;
+      rules.push({
+        name: "max_tool_calls",
+        evaluate(event) {
+          if (event.kind !== "action") return null;
+          stageToolCalls++;
+          ctx.runToolCalls.count++;
+          if (perStage !== void 0 && stageToolCalls > perStage) {
+            return { verdict: "deny", policy: "max_tool_calls", reason: `exceeded ${perStage} tool calls this stage` };
+          }
+          if (perRun !== void 0 && ctx.runToolCalls.count > perRun) {
+            return { verdict: "deny", policy: "max_tool_calls", reason: `exceeded ${perRun} tool calls this run` };
+          }
+          return null;
+        }
+      });
+    } else if ("shell_guard" in p) {
+      rules.push({
+        name: "shell_guard",
+        evaluate(event) {
+          if (event.kind !== "action" || !SHELL_TOOLS.has(event.tool)) return null;
+          const cmd = commandOf(event.input);
+          if (isDangerousRm(cmd) || DANGEROUS.some((re) => re.test(cmd))) {
+            return { verdict: "deny", policy: "shell_guard", reason: `shell command blocked: ${cmd.slice(0, 80)}` };
+          }
+          return null;
+        }
+      });
+    }
+  }
+  return rules;
+}
+
+// ../../packages/edge/src/mcp-gateway.ts
+import http from "http";
+import { Readable } from "stream";
+import { pipeline } from "stream/promises";
+var STRIP_REQUEST_HEADERS = /* @__PURE__ */ new Set(["host", "connection", "content-length", "authorization"]);
+async function startMcpGateway(opts) {
+  const byId = new Map(opts.servers.map((s) => [s.id, s]));
+  const server = http.createServer((req, res) => {
+    void handle(req, res).catch(() => {
+      if (!res.headersSent) res.writeHead(502);
+      res.end();
+    });
+  });
+  const handle = async (req, res) => {
+    const url = new URL(req.url ?? "/", "http://127.0.0.1");
+    const segs = url.pathname.split("/").filter(Boolean);
+    const id = segs[0];
+    const target = id ? byId.get(id) : void 0;
+    if (!target) {
+      res.writeHead(404, { "content-type": "application/json" });
+      res.end(JSON.stringify({ error: "unknown mcp server" }));
+      return;
+    }
+    const restPath = segs.slice(1).join("/");
+    const base = target.url.replace(/\/+$/, "");
+    const finalUrl = restPath ? `${base}/${restPath}${url.search}` : `${base}${url.search}`;
+    const headers = new Headers();
+    for (const [k, v] of Object.entries(req.headers)) {
+      if (v === void 0 || STRIP_REQUEST_HEADERS.has(k.toLowerCase())) continue;
+      headers.set(k, Array.isArray(v) ? v.join(", ") : v);
+    }
+    const token = opts.creds[id];
+    if (token) headers.set("authorization", `Bearer ${token}`);
+    const method = req.method ?? "GET";
+    const hasBody = method !== "GET" && method !== "HEAD";
+    const upstream = await fetch(finalUrl, {
+      method,
+      headers,
+      ...hasBody ? { body: Readable.toWeb(req), duplex: "half" } : {}
+    });
+    const outHeaders = {};
+    upstream.headers.forEach((value, key) => {
+      if (key.toLowerCase() === "content-length") return;
+      outHeaders[key] = value;
+    });
+    res.writeHead(upstream.status, outHeaders);
+    if (upstream.body) await pipeline(Readable.fromWeb(upstream.body), res);
+    else res.end();
+  };
+  await new Promise((resolve) => server.listen(0, "127.0.0.1", resolve));
+  const { port } = server.address();
+  return {
+    baseUrl: `http://127.0.0.1:${port}`,
+    stop: () => new Promise((resolve) => server.close(() => resolve()))
+  };
+}
+
+// ../../packages/edge/src/stage-runner.ts
+var nowIso2 = () => (/* @__PURE__ */ new Date()).toISOString();
+var PREVIEW = 500;
+var putBytes = async (url, body, contentType) => {
+  await fetch(url, { method: "PUT", headers: { "content-type": contentType }, body: new Uint8Array(body) });
+};
+function previewOf(event) {
+  const clip = (v) => (typeof v === "string" ? v : JSON.stringify(v) ?? "").slice(0, PREVIEW);
+  switch (event.type) {
+    case "response":
+      return event.text !== void 0 ? { text: event.text } : {};
+    case "elicitation":
+      return { text: event.prompt };
+    case "thought":
+      return event.text !== void 0 ? { text: clip(event.text) } : {};
+    case "action":
+      return { tool: event.tool, ...event.input !== void 0 ? { text: clip(event.input) } : {} };
+    case "observation":
+      return event.output !== void 0 ? { text: clip(event.output) } : {};
+    case "error":
+      return { text: clip(event.message) };
+    default:
+      return {};
+  }
+}
+var attemptOf = (jobId) => {
+  const m = /-(\d+)$/.exec(jobId);
+  return m ? Number(m[1]) : 1;
+};
+var digest = (value) => `sha256:${createHash3("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 16)}`;
+function writeScratchState(ref, job, attempt, status) {
+  const statePath = join6(ref.scratchPath, "state.json");
+  let state;
+  try {
+    state = JSON.parse(readFileSync4(statePath, "utf8"));
+  } catch {
+    state = { runId: job.runId, tenantId: job.tenantId, stages: {} };
+  }
+  state.stages[job.stageId] = { currentAttempt: attempt, status };
+  mkdirSync5(ref.scratchPath, { recursive: true });
+  writeFileSync5(statePath, JSON.stringify(state, null, 2));
+}
+function writeIssueContext(ref, issueContext) {
+  if (issueContext === void 0) return;
+  try {
+    mkdirSync5(ref.scratchPath, { recursive: true });
+    writeFileSync5(join6(ref.scratchPath, "issue.md"), issueContext);
+  } catch {
+  }
+}
+function writeAttachedDocuments(ref, docs) {
+  if (!docs || docs.length === 0) return;
+  try {
+    const dir = join6(ref.scratchPath, "docs");
+    mkdirSync5(dir, { recursive: true });
+    for (const doc of docs) {
+      writeFileSync5(join6(dir, `${attachedDocBasename2(doc)}.md`), doc.content);
+    }
+  } catch {
+  }
+}
+function renderGuidanceMarkdown(guidance) {
+  const lines = guidance.map((rule) => {
+    const scope = rule.teamName ? `${rule.origin}: ${rule.teamName}` : rule.origin;
+    return `- (${scope}) ${rule.content.trim()}`;
+  });
+  return `# Workspace guidance
+
+${lines.join("\n")}
+`;
+}
+function writeGuidance(ref, guidance) {
+  if (!guidance || guidance.length === 0) return;
+  try {
+    mkdirSync5(ref.scratchPath, { recursive: true });
+    writeFileSync5(join6(ref.scratchPath, "guidance.md"), renderGuidanceMarkdown(guidance));
+  } catch {
+  }
+}
+var ARTIFACT_CAP_BYTES = 64 * 1024;
+var SCRATCH_OUTPUT_DIR = ".skakel/scratch/output";
+function capContent(raw) {
+  return raw.length > ARTIFACT_CAP_BYTES ? raw.slice(0, ARTIFACT_CAP_BYTES) : raw;
+}
+function readEmittedArtifact(ref, relPath) {
+  try {
+    const raw = readFileSync4(join6(ref.worktreePath, relPath), "utf8");
+    return { path: relPath, content: capContent(raw) };
+  } catch {
+    return void 0;
+  }
+}
+function scanScratchOutput(ref, preferRel) {
+  try {
+    const names = readdirSync2(join6(ref.worktreePath, SCRATCH_OUTPUT_DIR)).filter(
+      (n) => n.toLowerCase().endsWith(".md")
+    );
+    if (names.length === 0) return void 0;
+    const preferBase = preferRel?.split("/").pop();
+    const pick = preferBase && names.includes(preferBase) ? preferBase : names[0];
+    const raw = readFileSync4(join6(ref.worktreePath, SCRATCH_OUTPUT_DIR, pick), "utf8");
+    if (raw.trim().length === 0) return void 0;
+    return { path: `${SCRATCH_OUTPUT_DIR}/${pick}`, content: capContent(raw) };
+  } catch {
+    return void 0;
+  }
+}
+function scanChangedMarkdown(ref) {
+  const git = (args) => {
+    try {
+      return execFileSync3("git", ["-C", ref.worktreePath, ...args], { encoding: "utf8" }).split("\n").map((s) => s.trim()).filter(Boolean);
+    } catch {
+      return [];
+    }
+  };
+  const rels = [...git(["ls-files", "--others", "--exclude-standard"]), ...git(["diff", "--name-only"])].filter(
+    (p) => p.toLowerCase().endsWith(".md")
+  );
+  for (const rel of rels) {
+    try {
+      const raw = readFileSync4(join6(ref.worktreePath, rel), "utf8");
+      if (raw.trim().length > 0) return { path: rel, content: capContent(raw) };
+    } catch {
+    }
+  }
+  return void 0;
+}
+function resolveStageArtifact(ref, emitArtifact, handedBack) {
+  if (emitArtifact) {
+    const declared = readEmittedArtifact(ref, emitArtifact);
+    if (declared && declared.content.trim().length > 0) return { artifact: declared, source: "declared-file" };
+  }
+  if (handedBack && handedBack.content.trim().length > 0) {
+    return { artifact: { path: handedBack.path, content: capContent(handedBack.content) }, source: "tool-handoff" };
+  }
+  const scratch = scanScratchOutput(ref, emitArtifact);
+  if (scratch) return { artifact: scratch, source: "scratch-scan" };
+  const changed = scanChangedMarkdown(ref);
+  if (changed) return { artifact: changed, source: "changed-file" };
+  return void 0;
+}
+function createStageRunner(deps) {
+  const worktrees = /* @__PURE__ */ new Map();
+  const active = /* @__PURE__ */ new Map();
+  const turnQueues = /* @__PURE__ */ new Map();
+  const runToolCalls = /* @__PURE__ */ new Map();
+  const lastUsed = /* @__PURE__ */ new Map();
+  const inFlight = /* @__PURE__ */ new Map();
+  const scratchOnly = /* @__PURE__ */ new Set();
+  const teardownRun = async (runId) => {
+    const ref = worktrees.get(runId);
+    if (ref) {
+      if (scratchOnly.has(runId)) {
+        try {
+          rmSync3(ref.worktreePath, { recursive: true, force: true });
+        } catch {
+        }
+      } else {
+        await deps.gitService.teardownWorktree(ref).catch(() => void 0);
+      }
+    }
+    worktrees.delete(runId);
+    scratchOnly.delete(runId);
+    lastUsed.delete(runId);
+    runToolCalls.delete(runId);
+  };
+  const applyRetention = async (keepRunId) => {
+    const policy = deps.retention;
+    if (!policy) return;
+    const prunable = (id) => id !== keepRunId && (inFlight.get(id) ?? 0) === 0;
+    const now = Date.now();
+    if (policy.maxAgeMs !== void 0) {
+      for (const id of [...worktrees.keys()]) {
+        if (prunable(id) && now - (lastUsed.get(id) ?? 0) > policy.maxAgeMs) await teardownRun(id);
+      }
+    }
+    if (policy.maxRuns !== void 0 && worktrees.size > policy.maxRuns) {
+      const byOldest = [...worktrees.keys()].filter(prunable).sort((a, b) => (lastUsed.get(a) ?? 0) - (lastUsed.get(b) ?? 0));
+      let excess = worktrees.size - policy.maxRuns;
+      for (const id of byOldest) {
+        if (excess <= 0) break;
+        await teardownRun(id);
+        excess--;
+      }
+    }
+  };
+  return {
+    async runJob(job) {
+      const { stageId, jobId, runId, agentConfig } = job;
+      const attempt = attemptOf(jobId);
+      if (deps.tenantId && job.tenantId !== deps.tenantId) {
+        return {
+          jobId,
+          status: "fail",
+          summary: `node (tenant "${deps.tenantId}") refuses a job for tenant "${job.tenantId}"`
+        };
+      }
+      const allow = deps.servesRepoIds;
+      if (job.workspaceRef && allow && allow.length > 0 && !allow.includes(job.workspaceRef.repoId)) {
+        return { jobId, status: "fail", summary: `edge does not serve repo "${job.workspaceRef.repoId}"` };
+      }
+      inFlight.set(runId, (inFlight.get(runId) ?? 0) + 1);
+      lastUsed.set(runId, Date.now());
+      let ref = worktrees.get(runId);
+      if (!ref) {
+        if (job.workspaceRef) {
+          ref = await deps.gitService.createWorktree({
+            repoId: job.workspaceRef.repoId,
+            gitUrl: job.workspaceRef.gitUrl,
+            baseBranch: job.workspaceRef.baseBranch,
+            runId,
+            repo: job.workspaceRef.repo,
+            // Stable per-issue branch (continuation); absent = legacy dahrk/<runId>.
+            ...job.workspaceRef.branch ? { branch: job.workspaceRef.branch } : {},
+            // Brokered git credential for this job; absent on ambient nodes (host creds used).
+            ...job.workspaceRef.credentialToken ? { credentialToken: job.workspaceRef.credentialToken } : {}
+          });
+        } else {
+          const base = deps.scratchRoot ?? join6(tmpdir2(), "dahrk", "scratch");
+          const worktreePath = join6(base, runId);
+          const scratchPath = join6(worktreePath, ".skakel", "scratch");
+          mkdirSync5(scratchPath, { recursive: true });
+          ref = { repoId: "", gitUrl: "", repo: "", baseBranch: "", worktreePath, scratchPath };
+          scratchOnly.add(runId);
+        }
+        worktrees.set(runId, ref);
+      }
+      writeScratchState(ref, job, attempt, "in-flight");
+      writeIssueContext(ref, job.issueContext);
+      writeGuidance(ref, job.guidance);
+      writeAttachedDocuments(ref, job.attachedDocuments);
+      if (job.agentConfig.emitArtifact) {
+        const slash = job.agentConfig.emitArtifact.lastIndexOf("/");
+        if (slash > 0) {
+          try {
+            mkdirSync5(join6(ref.worktreePath, job.agentConfig.emitArtifact.slice(0, slash)), { recursive: true });
+          } catch {
+          }
+        }
+      }
+      let gateway;
+      const meta = {
+        tenantId: job.tenantId,
+        runId,
+        stageId,
+        jobId,
+        attempt,
+        runtime: agentConfig.runtime,
+        model: agentConfig.model,
+        sessionId: job.sessionId,
+        configDigest: digest(agentConfig),
+        startedAt: nowIso2()
+      };
+      const writer = createTraceWriter(ref.scratchPath, meta);
+      const streamEvent = (e) => deps.trace?.event({ runId, stageId, attempt, tenantId: job.tenantId, event: e });
+      streamEvent(
+        writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "attempt-start" })
+      );
+      const shipFinalTrace = async (finalMeta) => {
+        const sink = deps.trace;
+        if (!sink) return;
+        const base = { tenantId: job.tenantId, runId, stageId, attempt };
+        try {
+          for (const name of readdirSync2(join6(writer.dir, "blobs"))) {
+            const bytes = readFileSync4(join6(writer.dir, "blobs", name));
+            const { url } = await sink.requestBlobUrl({
+              ...base,
+              sha256: name,
+              size: bytes.length,
+              contentType: "application/octet-stream",
+              slot: "blob"
+            });
+            if (url) await putBytes(url, bytes, "application/octet-stream");
+          }
+        } catch {
+        }
+        let archiveKey;
+        try {
+          const bytes = readFileSync4(join6(writer.dir, "trace.jsonl"));
+          const sha = createHash3("sha256").update(bytes).digest("hex");
+          const { key, url } = await sink.requestBlobUrl({
+            ...base,
+            sha256: sha,
+            size: bytes.length,
+            contentType: "application/x-ndjson",
+            slot: "archive"
+          });
+          if (url) await putBytes(url, bytes, "application/x-ndjson");
+          archiveKey = key;
+        } catch {
+        }
+        sink.finalised({ ...base, meta: finalMeta, eventCount: writer.count(), ...archiveKey ? { archiveKey } : {} });
+      };
+      const finish = async (status2, summary2, sessionId, costUsd, handedBackDoc) => {
+        active.delete(jobId);
+        turnQueues.delete(jobId);
+        await gateway?.stop().catch(() => void 0);
+        gateway = void 0;
+        streamEvent(
+          writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "stage-exit", status: status2 })
+        );
+        const endedAt = nowIso2();
+        writer.finalise({ status: status2, endedAt, ...sessionId ? { sessionId } : {} });
+        writeScratchState(ref, job, attempt, status2);
+        const finalMeta = {
+          ...meta,
+          status: status2,
+          endedAt,
+          ...sessionId ? { sessionId } : {},
+          ...costUsd !== void 0 ? { costUsd } : {}
+        };
+        await shipFinalTrace(finalMeta).catch(() => void 0);
+        lastUsed.set(runId, Date.now());
+        inFlight.set(runId, Math.max(0, (inFlight.get(runId) ?? 1) - 1));
+        await applyRetention(runId).catch(() => void 0);
+        const wantsArtifact = agentConfig.emitArtifact !== void 0 || handedBackDoc !== void 0;
+        const resolved = status2 === "ok" && wantsArtifact ? resolveStageArtifact(ref, agentConfig.emitArtifact, handedBackDoc) : void 0;
+        if (status2 === "ok" && wantsArtifact) {
+          const detail = resolved ? `source=${resolved.source} path=${resolved.artifact.path} bytes=${resolved.artifact.content.length}` : "no document resolved (declared path, tool handoff, and scratch/changed-file scans all empty)";
+          streamEvent(
+            writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "artifact", detail })
+          );
+        }
+        return {
+          jobId,
+          status: status2,
+          summary: summary2,
+          ...sessionId ? { sessionId } : {},
+          ...costUsd !== void 0 ? { costUsd } : {},
+          ...resolved ? { artifact: resolved.artifact } : {}
+        };
+      };
+      if (deps.packCache && job.provision && job.provision.length > 0) {
+        try {
+          const overlay = await overlayComponents({
+            worktreePath: ref.worktreePath,
+            runtime: agentConfig.runtime,
+            components: job.provision,
+            cache: deps.packCache
+          });
+          const detail = `provision: ${overlay.written.length} written, ${overlay.skippedRepoLocal.length} repo-local, ${overlay.warnings.length} warning(s)`;
+          streamEvent(
+            writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "provision", detail })
+          );
+          const noteText = overlay.warnings.length > 0 ? `${detail}; ${overlay.warnings.join("; ")}` : detail;
+          deps.sendProgress({ jobId, kind: "observation", ts: nowIso2(), text: noteText });
+        } catch (e) {
+          const msg = `component provisioning failed: ${e.message}`;
+          writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: agentConfig.runtime, kind: "provision-failed", message: msg });
+          deps.sendProgress({ jobId, kind: "error", ts: nowIso2(), text: msg });
+          return finish("fail", `${stageId}: ${msg}`, job.sessionId);
+        }
+      }
+      let counter = runToolCalls.get(runId);
+      if (!counter) {
+        counter = { count: 0 };
+        runToolCalls.set(runId, counter);
+      }
+      const jobRules = buildRules(job.policies ?? [], {
+        worktreePath: ref.worktreePath,
+        repoName: job.workspaceRef?.repo ?? "",
+        runToolCalls: counter
+      });
+      const rules = [...jobRules, ...deps.rules];
+      const entry = evaluatePolicies({ kind: "stage-entry", stageId }, rules);
+      if (entry.verdict === "deny") {
+        writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "policy-deny", detail: entry.reason });
+        return finish("fail", `${stageId}: denied at stage entry (${entry.policy})`, job.sessionId);
+      }
+      let denied = false;
+      const runtime = agentConfig.runtime;
+      const onTrace = (event) => {
+        if (event.type === "action") {
+          const verdict = evaluatePolicies(
+            { kind: "action", stageId, tool: event.tool, input: event.input },
+            rules
+          );
+          if (verdict.verdict === "deny") {
+            denied = true;
+            streamEvent(writer.append(event));
+            streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "observation", runtime, toolUseId: event.toolUseId, isError: true, output: { error: verdict.reason } }));
+            streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime, event: "policy-deny", detail: verdict.reason }));
+            deps.sendProgress({ jobId, kind: "error", ts: nowIso2(), text: verdict.reason });
+            return;
+          }
+        }
+        streamEvent(writer.append(event));
+        if (event.type !== "state") deps.sendProgress({ jobId, kind: event.type, ts: event.ts, ...previewOf(event) });
+      };
+      const mcpServers = agentConfig.mcpServers;
+      if (mcpServers && mcpServers.length > 0 && runtime === "claude-code") {
+        gateway = await startMcpGateway({ servers: mcpServers, creds: job.brokeredCreds ?? {} });
+      }
+      const runner = deps.makeRunner(runtime);
+      active.set(jobId, runner);
+      const ctx = {
+        config: agentConfig,
+        workspace: ref,
+        sessionId: job.sessionId,
+        ...job.issueContext !== void 0 ? { issueContext: job.issueContext } : {},
+        ...job.guidance !== void 0 ? { guidance: job.guidance } : {},
+        ...job.gateFeedback !== void 0 ? { gateFeedback: job.gateFeedback } : {},
+        ...job.attachedDocuments !== void 0 ? { attachedDocuments: job.attachedDocuments } : {},
+        ...gateway ? { mcpProxyBaseUrl: gateway.baseUrl } : {},
+        // brokered inference env for a managed node (no operator login). The runtime adapter
+        // (Pi) / container executor apply it as the inference process env, so the raw key is
+        // never surfaced to the agent's own tool calls. Absent on ambient nodes; inert for the Claude/
+        // Codex adapters, which use ambient inference.
+        ...job.runtimeEnv ? { runtimeEnv: job.runtimeEnv } : {},
+        // The adapter persists each runtime-native record under the attempt's raw/ sidecar
+        // and stamps the rawRef onto the emitted event.
+        writeRaw: writer.writeRaw
+      };
+      const interactive = agentConfig.interaction === "interactive";
+      let result;
+      let timedOut = false;
+      const killMs = Math.max(0, Math.floor((job.timeout ?? 0) * 1e3));
+      const killTimer = killMs > 0 ? setTimeout(() => {
+        timedOut = true;
+        void runner.cancel();
+      }, killMs) : void 0;
+      try {
+        if (interactive) {
+          const mailbox = new ManagedMailbox();
+          turnQueues.set(jobId, mailbox);
+          result = await runner.runInteractive(ctx, mailbox, onTrace);
+        } else {
+          result = await runner.runBatch(ctx, onTrace);
+        }
+      } finally {
+        if (killTimer) clearTimeout(killTimer);
+      }
+      let status = timedOut ? "timeout" : result.status;
+      if (status === "ok" && job.hooks && job.hooks.length > 0) {
+        for (const cmd of job.hooks) {
+          try {
+            execFileSync3("sh", ["-c", cmd], { cwd: ref.worktreePath, stdio: ["pipe", "pipe", "pipe"] });
+          } catch (e) {
+            status = "fail";
+            writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime, kind: "hook-failed", message: `hook "${cmd}" failed: ${e.message}` });
+            break;
+          }
+        }
+      }
+      let summary = result.summary ?? `${stageId}: ${status}`;
+      if (!interactive && status === "ok") {
+        try {
+          summary = await runner.summarise(ctx);
+        } catch {
+        }
+      }
+      if (denied) summary += "\n\n(note: one or more tool actions were blocked by a deny-only policy guard.)";
+      return finish(status, summary, result.sessionId ?? job.sessionId, result.costUsd, result.artifact);
+    },
+    async runPush(job) {
+      const { runId, jobId } = job;
+      const allow = deps.servesRepoIds;
+      if (allow && allow.length > 0 && !allow.includes(job.workspaceRef.repoId)) {
+        return { jobId, status: "fail", summary: `edge does not serve repo "${job.workspaceRef.repoId}"` };
+      }
+      lastUsed.set(runId, Date.now());
+      let ref = worktrees.get(runId);
+      if (!ref) {
+        ref = await deps.gitService.createWorktree({
+          repoId: job.workspaceRef.repoId,
+          gitUrl: job.workspaceRef.gitUrl,
+          baseBranch: job.workspaceRef.baseBranch,
+          runId,
+          repo: job.workspaceRef.repo,
+          branch: job.branch,
+          ...job.workspaceRef.credentialToken ? { credentialToken: job.workspaceRef.credentialToken } : {}
+        });
+        worktrees.set(runId, ref);
+      }
+      try {
+        const r = await deps.gitService.commitAndPush(ref, {
+          message: job.message,
+          branch: job.branch,
+          base: job.base,
+          ...job.workspaceRef.credentialToken ? { credentialToken: job.workspaceRef.credentialToken } : {}
+        });
+        if (r.integration === "conflict") {
+          return {
+            jobId,
+            status: "ok",
+            branch: job.branch,
+            headSha: r.headSha,
+            pushed: false,
+            nothingToCommit: r.nothingToCommit,
+            commitsAhead: r.commitsAhead,
+            integration: "conflict",
+            ...r.conflictFiles ? { conflictFiles: r.conflictFiles } : {},
+            summary: `base advanced; merge conflict on ${job.branch} (manual merge needed)`
+          };
+        }
+        const pr = job.openPr && r.pushed ? await deps.gitService.openPrAmbient(ref, {
+          branch: job.branch,
+          base: job.base,
+          title: job.openPr.title,
+          body: job.openPr.body
+        }) : void 0;
+        return {
+          jobId,
+          status: "ok",
+          branch: job.branch,
+          headSha: r.headSha,
+          pushed: r.pushed,
+          nothingToCommit: r.nothingToCommit,
+          commitsAhead: r.commitsAhead,
+          ...r.integration ? { integration: r.integration } : {},
+          ...pr?.prUrl ? { prUrl: pr.prUrl } : {},
+          ...pr?.prNumber !== void 0 ? { prNumber: pr.prNumber } : {},
+          ...pr?.prError ? { prError: pr.prError } : {},
+          summary: r.nothingToCommit ? `no changes to commit; ${r.pushed ? "branch pushed" : "nothing pushed"}` : `committed ${r.headSha.slice(0, 7)} and pushed ${job.branch}`
+        };
+      } catch (e) {
+        return { jobId, status: "fail", summary: `push failed: ${e.message}` };
+      }
+    },
+    cancel(jobId) {
+      void active.get(jobId)?.cancel();
+      turnQueues.get(jobId)?.end();
+    },
+    enqueueTurn(jobId, turn) {
+      turnQueues.get(jobId)?.push(turn);
+    },
+    endTurns(jobId) {
+      turnQueues.get(jobId)?.end();
+    }
+  };
+}
+
+// ../../packages/edge/src/ws-client.ts
+var ENROLMENT_REJECTED_EXIT_CODE = 78;
+var log = (line) => void process.stdout.write(`${line}
+`);
+async function startEdgeNode(opts) {
+  const rules = opts.denyTool ? [denyToolRule(opts.denyTool)] : [];
+  const gitService = createGitService({
+    worktreesDir: opts.worktreesDir,
+    mirrorsDir: opts.mirrorsDir
+  });
+  let ws;
+  let heartbeat;
+  let shuttingDown = false;
+  let onFatal;
+  const send = (msg) => {
+    if (ws && ws.readyState === WebSocket.OPEN) ws.send(encode(msg));
+  };
+  const MAX_RESEND = 100;
+  const lastResults = /* @__PURE__ */ new Map();
+  const rememberResult = (jobId, frame) => {
+    lastResults.delete(jobId);
+    lastResults.set(jobId, frame);
+    if (lastResults.size > MAX_RESEND) {
+      const oldest = lastResults.keys().next().value;
+      if (oldest !== void 0) lastResults.delete(oldest);
+    }
+  };
+  const pendingBlob = /* @__PURE__ */ new Map();
+  let blobReqCounter = 0;
+  const trace = {
+    event: (frame) => send({ type: "trace-event", ...frame }),
+    finalised: (frame) => send({ type: "trace-finalised", ...frame }),
+    requestBlobUrl: (req) => new Promise((resolve) => {
+      const reqId = `${req.runId}:${req.stageId}:${req.attempt}:${blobReqCounter++}`;
+      pendingBlob.set(reqId, resolve);
+      send({ type: "blob-put-request", reqId, ...req });
+      setTimeout(() => {
+        if (pendingBlob.delete(reqId)) resolve({ key: "" });
+      }, 3e4).unref?.();
+    })
+  };
+  const stageDeps = {
+    gitService,
+    makeRunner,
+    ...opts.servesRepoIds ? { servesRepoIds: opts.servesRepoIds } : {},
+    ...opts.tenantId ? { tenantId: opts.tenantId } : {},
+    rules,
+    sendProgress: (progress) => send({ type: "progress", progress }),
+    trace,
+    ...opts.retention ? { retention: opts.retention } : {}
+  };
+  const stageRunner = createStageRunner(stageDeps);
+  const nodeId = opts.nodeId ?? randomUUID();
+  const running = /* @__PURE__ */ new Set();
+  const onMessage = async (raw) => {
+    const msg = decode(raw);
+    if (msg.type === "welcome") {
+      stageDeps.tenantId = msg.tenantId;
+      if (opts.retention === void 0 && msg.retention) stageDeps.retention = msg.retention;
+      if (opts.heartbeatMs === void 0 && msg.heartbeatMs > 0) {
+        if (heartbeat) clearInterval(heartbeat);
+        heartbeat = setInterval(() => send({ type: "heartbeat" }), msg.heartbeatMs);
+      }
+      log(`EDGE_WELCOMED:${msg.name} tenant=${msg.tenantId} credentialMode=${msg.credentialMode}`);
+      return;
+    }
+    if (msg.type === "blob-put-url") {
+      const resolve = pendingBlob.get(msg.reqId);
+      if (resolve) {
+        pendingBlob.delete(msg.reqId);
+        resolve({ key: msg.key, ...msg.url ? { url: msg.url } : {} });
+      }
+      return;
+    }
+    if (msg.type === "cancel") {
+      log(`JOB_CANCEL:${msg.jobId}`);
+      stageRunner.cancel(msg.jobId);
+      return;
+    }
+    if (msg.type === "turn") {
+      if (msg.end === "cancel") stageRunner.cancel(msg.jobId);
+      else if (msg.end === "complete") stageRunner.endTurns(msg.jobId);
+      else if (msg.turn) stageRunner.enqueueTurn(msg.jobId, msg.turn);
+      log(`JOB_TURN:${msg.jobId}${msg.end ? `:${msg.end}` : ""}`);
+      return;
+    }
+    if (msg.type === "push") {
+      const { job: job2 } = msg;
+      if (running.has(job2.jobId)) {
+        log(`PUSH_DUPLICATE:${job2.runId} ${job2.jobId}`);
+        return;
+      }
+      running.add(job2.jobId);
+      log(`PUSH_STARTED:${job2.runId} ${job2.branch}`);
+      try {
+        const result = await stageRunner.runPush(job2);
+        const frame = { type: "push-result", awakeableId: job2.awakeableId, result };
+        rememberResult(job2.jobId, frame);
+        send(frame);
+        log(`PUSH_DONE:${job2.runId} ${result.status}${result.status !== "ok" ? ` - ${result.summary}` : ""}`);
+      } catch (e) {
+        const frame = {
+          type: "push-result",
+          awakeableId: job2.awakeableId,
+          result: { jobId: job2.jobId, status: "fail", summary: `edge push error: ${e.message}` }
+        };
+        rememberResult(job2.jobId, frame);
+        send(frame);
+        log(`PUSH_ERROR:${job2.runId} ${e.message}`);
+      } finally {
+        running.delete(job2.jobId);
+      }
+      return;
+    }
+    if (msg.type !== "job") return;
+    const { job } = msg;
+    if (running.has(job.jobId)) {
+      log(`JOB_DUPLICATE:${job.stageId} ${job.jobId}`);
+      return;
+    }
+    running.add(job.jobId);
+    log(`JOB_STARTED:${job.stageId} ${job.jobId}`);
+    try {
+      const result = await stageRunner.runJob(job);
+      const frame = { type: "result", awakeableId: job.awakeableId, result };
+      rememberResult(job.jobId, frame);
+      send(frame);
+      log(`JOB_DONE:${job.stageId} ${result.status}`);
+    } catch (e) {
+      const frame = {
+        type: "result",
+        awakeableId: job.awakeableId,
+        result: { jobId: job.jobId, status: "fail", summary: `edge error: ${e.message}` }
+      };
+      rememberResult(job.jobId, frame);
+      send(frame);
+      log(`JOB_ERROR:${job.stageId} ${e.message}`);
+    } finally {
+      running.delete(job.jobId);
+    }
+  };
+  const connect = () => {
+    const sock = new WebSocket(opts.hubUrl);
+    ws = sock;
+    sock.on("open", () => {
+      log("EDGE_CONNECTED");
+      send({
+        type: "hello",
+        enrolToken: opts.enrolToken ?? "",
+        detectedRuntimes: opts.runtimes,
+        servesRepoIds: opts.servesRepoIds ?? [],
+        ...opts.credentialModeExplicit && opts.credentialMode ? { credentialMode: opts.credentialMode } : {},
+        nodeId,
+        ...opts.name ? { name: opts.name } : {},
+        os: osPlatform(),
+        arch: osArch(),
+        clientVersion: opts.clientVersion ?? "0.0.0"
+      });
+      for (const frame of lastResults.values()) send(frame);
+      heartbeat = setInterval(() => send({ type: "heartbeat" }), opts.heartbeatMs ?? 5e3);
+    });
+    sock.on("message", (raw) => void onMessage(raw.toString()));
+    sock.on("error", (e) => log(`EDGE_ERROR ${e.message}`));
+    sock.on("close", (code, reason) => {
+      if (heartbeat) clearInterval(heartbeat);
+      if (isEnrolmentRejection(code)) {
+        shuttingDown = true;
+        const detail = reason.toString() || "enrolment rejected";
+        log(`EDGE_REJECTED:${code} ${detail}`);
+        process.exitCode = ENROLMENT_REJECTED_EXIT_CODE;
+        onFatal?.(new Error(`hub rejected edge enrolment (${code}): ${detail}`));
+        return;
+      }
+      if (!shuttingDown) setTimeout(connect, 500);
+    });
+  };
+  connect();
+  await new Promise((resolve, reject) => {
+    const t = setInterval(() => {
+      if (ws && ws.readyState === WebSocket.OPEN) {
+        clearInterval(t);
+        resolve();
+      }
+    }, 50);
+    onFatal = (err) => {
+      clearInterval(t);
+      reject(err);
+    };
+  });
+}
+
+// ../../packages/edge/src/detect-runtimes.ts
+import { execFile } from "child_process";
+var PROBES = [
+  { runtime: "claude-code", cmd: "claude" },
+  { runtime: "codex", cmd: "codex" },
+  { runtime: "pi", cmd: "pi" }
+];
+function probe(cmd, timeoutMs) {
+  return new Promise((resolve) => {
+    execFile(cmd, ["--version"], { timeout: timeoutMs }, (err, stdout) => {
+      if (err) return resolve(void 0);
+      const line = stdout.split("\n").map((s) => s.trim()).find(Boolean);
+      resolve(line ?? "");
+    });
+  });
+}
+async function probeRuntimeStatuses(timeoutMs = 3e3) {
+  const versions = await Promise.all(PROBES.map((p) => probe(p.cmd, timeoutMs)));
+  return PROBES.map((p, i) => {
+    const version = versions[i];
+    return version === void 0 ? { runtime: p.runtime, cmd: p.cmd, installed: false } : { runtime: p.runtime, cmd: p.cmd, installed: true, version };
+  });
+}
+async function detectRuntimes(timeoutMs = 3e3) {
+  const statuses = await probeRuntimeStatuses(timeoutMs);
+  return statuses.filter((s) => s.installed).map((s) => s.runtime);
+}
+
+// ../../packages/edge/src/hub-probe.ts
+import { arch as osArch2, platform as osPlatform2 } from "os";
+import { WebSocket as WebSocket2 } from "ws";
+import { decode as decode2, encode as encode2, isEnrolmentRejection as isEnrolmentRejection2 } from "@dahrk/contracts";
+function enrolmentDetail(code) {
+  switch (code) {
+    case 4400:
+      return "no enrolment token was presented";
+    case 4401:
+      return "the enrolment token is invalid, expired, or revoked";
+    case 4404:
+      return "the token verified but its pool no longer exists";
+    case 4503:
+      return "the hub has no enrolment secret configured";
+    default:
+      return `enrolment rejected (${code})`;
+  }
+}
+function probeHub(opts) {
+  const {
+    hubUrl,
+    enrolToken,
+    runtimes = [],
+    nodeId = "dahrk-doctor",
+    clientVersion = "0.0.0",
+    timeoutMs = 8e3
+  } = opts;
+  return new Promise((resolve) => {
+    let settled = false;
+    let opened = false;
+    let ws;
+    const done = (result) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      try {
+        ws.terminate();
+      } catch {
+      }
+      resolve(result);
+    };
+    const timer = setTimeout(
+      () => done({ ok: false, reason: "timeout", detail: `no welcome within ${timeoutMs}ms` }),
+      timeoutMs
+    );
+    timer.unref?.();
+    try {
+      ws = new WebSocket2(hubUrl);
+    } catch (e) {
+      done({ ok: false, reason: "unreachable", detail: e.message });
+      return;
+    }
+    ws.on("open", () => {
+      opened = true;
+      ws.send(
+        encode2({
+          type: "hello",
+          enrolToken: enrolToken ?? "",
+          detectedRuntimes: runtimes,
+          servesRepoIds: [],
+          nodeId,
+          os: osPlatform2(),
+          arch: osArch2(),
+          clientVersion
+        })
+      );
+    });
+    ws.on("message", (raw) => {
+      let msg;
+      try {
+        msg = decode2(raw.toString());
+      } catch {
+        return;
+      }
+      if (msg.type === "welcome") {
+        done({
+          ok: true,
+          nodeId: msg.nodeId,
+          name: msg.name,
+          tenantId: msg.tenantId,
+          credentialMode: msg.credentialMode
+        });
+      }
+    });
+    ws.on("error", (e) => {
+      if (!opened) done({ ok: false, reason: "unreachable", detail: e.message });
+    });
+    ws.on("close", (code, reason) => {
+      const detail = reason?.toString() || "";
+      if (isEnrolmentRejection2(code)) {
+        done({ ok: false, reason: "rejected", code, detail: detail || enrolmentDetail(code) });
+      } else if (!opened) {
+        done({ ok: false, reason: "unreachable", detail: detail || `could not connect (${code})` });
+      } else {
+        done({ ok: false, reason: "closed", code, detail: detail || `hub closed the socket (${code})` });
+      }
+    });
+  });
+}
+
+// src/cli.ts
+import { parseArgs } from "util";
+var COMMANDS = /* @__PURE__ */ new Set(["start", "doctor"]);
+var isCommand = (s) => COMMANDS.has(s);
+function parseCli(argv) {
+  const [first, ...rest] = argv;
+  if (first === "help" || first === "--help" || first === "-h") {
+    const sub = rest[0];
+    return sub && isCommand(sub) ? { kind: "help", command: sub } : { kind: "help" };
+  }
+  if (first === "version" || first === "--version" || first === "-v") return { kind: "version" };
+  let command = "start";
+  let flagArgs = argv;
+  if (first !== void 0 && !first.startsWith("-")) {
+    if (!isCommand(first)) {
+      return { kind: "error", message: `unknown command: ${first}` };
+    }
+    command = first;
+    flagArgs = rest;
+  }
+  let values;
+  try {
+    ({ values } = parseArgs({
+      args: flagArgs,
+      options: {
+        token: { type: "string" },
+        name: { type: "string" },
+        "hub-url": { type: "string" },
+        ephemeral: { type: "boolean", default: false },
+        help: { type: "boolean", default: false }
+      },
+      allowPositionals: false
+    }));
+  } catch (e) {
+    return { kind: "error", message: e.message };
+  }
+  if (values.help) return { kind: "help", command };
+  const flags = {
+    ...values.token ? { token: values.token } : {},
+    ...values.name ? { name: values.name } : {},
+    ...values["hub-url"] ? { hubUrl: values["hub-url"] } : {},
+    ephemeral: values.ephemeral ?? false
+  };
+  return { kind: command, flags };
+}
+function usage(bin, command) {
+  if (command === "start") {
+    return [
+      `Usage: ${bin} start --token <token> [options]`,
+      "",
+      "Run the edge node: dial the hub over WebSocket and serve Jobs in git worktrees.",
+      "",
+      "Options:",
+      "  --token <token>    Enrolment token (required; or set DAHRK_ENROL_TOKEN).",
+      "  --hub-url <url>    Hub WebSocket URL (or set DAHRK_HUB_URL).",
+      "  --name <name>      Display-name override (else the hub assigns one).",
+      "  --ephemeral        Do not persist a node id; mint a throwaway one (CI / one-shot)."
+    ].join("\n");
+  }
+  if (command === "doctor") {
+    return [
+      `Usage: ${bin} doctor [options]`,
+      "",
+      "Run preflight checks: Node version, installed runtimes, hub reachability, token validity.",
+      "",
+      "Options:",
+      "  --token <token>    Enrolment token to validate (or set DAHRK_ENROL_TOKEN).",
+      "  --hub-url <url>    Hub WebSocket URL to reach (or set DAHRK_HUB_URL)."
+    ].join("\n");
+  }
+  return [
+    `Usage: ${bin} <command> [options]`,
+    "",
+    "Commands:",
+    "  start     Run the edge node (default). Needs a --token and a hub URL.",
+    "  doctor    Preflight checks: Node, runtimes, hub reachability, token validity.",
+    "  version   Print the client version.",
+    "  help      Show this help, or `help <command>` for a command's options.",
+    "",
+    `Run \`${bin} help <command>\` for command-specific options.`
+  ].join("\n");
+}
+
+// src/doctor.ts
+var MIN_NODE_MAJOR = 22;
+var TAG = { pass: "[PASS]", warn: "[WARN]", fail: "[FAIL]" };
+function checkNode(nodeVersion) {
+  const major = Number.parseInt(nodeVersion.replace(/^v/, "").split(".")[0] ?? "", 10);
+  if (Number.isNaN(major)) {
+    return { status: "warn", label: "Node version", detail: `could not parse "${nodeVersion}"` };
+  }
+  return major >= MIN_NODE_MAJOR ? { status: "pass", label: "Node version", detail: `v${major} (>= ${MIN_NODE_MAJOR})` } : {
+    status: "fail",
+    label: "Node version",
+    detail: `v${major} is too old; Dahrk needs Node ${MIN_NODE_MAJOR}+`
+  };
+}
+function checkRuntimes(statuses) {
+  const installed = statuses.filter((s) => s.installed);
+  if (installed.length === 0) {
+    return {
+      status: "warn",
+      label: "Agent runtimes",
+      detail: "none detected (claude/codex/pi not on PATH); the node will serve no Jobs. Install one or set DAHRK_RUNTIMES."
+    };
+  }
+  const detail = installed.map((s) => `${s.runtime}${s.version ? ` (${s.version})` : ""}`).join(", ");
+  return { status: "pass", label: "Agent runtimes", detail };
+}
+function checkHub(hubUrl, probe2) {
+  if (!hubUrl) {
+    return {
+      status: "fail",
+      label: "Hub reachability",
+      detail: "no hub URL configured (set DAHRK_HUB_URL or pass --hub-url)"
+    };
+  }
+  if (!probe2) {
+    return { status: "warn", label: "Hub reachability", detail: `not checked (${hubUrl})` };
+  }
+  if (probe2.ok) {
+    return { status: "pass", label: "Hub reachability", detail: `connected to ${hubUrl}` };
+  }
+  switch (probe2.reason) {
+    case "rejected":
+      return {
+        status: "pass",
+        label: "Hub reachability",
+        detail: `reachable at ${hubUrl} (enrolment rejected - see token check)`
+      };
+    case "unreachable":
+      return { status: "fail", label: "Hub reachability", detail: `cannot reach ${hubUrl}: ${probe2.detail}` };
+    case "timeout":
+      return {
+        status: "fail",
+        label: "Hub reachability",
+        detail: `${hubUrl} connected but sent no welcome: ${probe2.detail}`
+      };
+    case "closed":
+      return {
+        status: "fail",
+        label: "Hub reachability",
+        detail: `${hubUrl} closed the socket (${probe2.code}): ${probe2.detail}`
+      };
+  }
+}
+function checkToken(tokenPresent, hubUrl, probe2) {
+  if (!tokenPresent) {
+    return {
+      status: "fail",
+      label: "Enrolment token",
+      detail: "no token (pass --token or set DAHRK_ENROL_TOKEN)"
+    };
+  }
+  if (!hubUrl || !probe2) {
+    return { status: "warn", label: "Enrolment token", detail: "present but not verified (no hub to check against)" };
+  }
+  if (probe2.ok) {
+    return { status: "pass", label: "Enrolment token", detail: `valid (tenant ${probe2.tenantId})` };
+  }
+  if (probe2.reason === "rejected") {
+    switch (probe2.code) {
+      case 4400:
+        return { status: "fail", label: "Enrolment token", detail: `hub saw no token: ${probe2.detail}` };
+      case 4401:
+        return { status: "fail", label: "Enrolment token", detail: "invalid, expired, or revoked" };
+      case 4404:
+        return { status: "fail", label: "Enrolment token", detail: "the token's pool no longer exists" };
+      case 4503:
+        return {
+          status: "warn",
+          label: "Enrolment token",
+          detail: "cannot verify: the hub has no enrolment secret configured"
+        };
+      default:
+        return { status: "fail", label: "Enrolment token", detail: probe2.detail };
+    }
+  }
+  return { status: "warn", label: "Enrolment token", detail: "present but unverified (hub not reachable)" };
+}
+function formatReport(checks) {
+  const failed = checks.filter((c) => c.status === "fail").length;
+  const warned = checks.filter((c) => c.status === "warn").length;
+  const lines = checks.map((c) => `${TAG[c.status]} ${c.label}${c.detail ? `: ${c.detail}` : ""}`);
+  const summary = failed > 0 ? `FAIL - ${failed} check${failed === 1 ? "" : "s"} failed${warned ? `, ${warned} warning${warned === 1 ? "" : "s"}` : ""}.` : warned > 0 ? `PASS with ${warned} warning${warned === 1 ? "" : "s"}.` : "PASS - all checks green.";
+  return ["dahrk doctor", "", ...lines, "", summary].join("\n");
+}
+var defaultDeps = () => ({
+  nodeVersion: process.versions.node,
+  probeRuntimes: probeRuntimeStatuses,
+  probeHub,
+  out: (line) => void process.stdout.write(`${line}
+`)
+});
+async function runDoctor(inputs, deps = {}) {
+  const d = { ...defaultDeps(), ...deps };
+  const statuses = await d.probeRuntimes();
+  const installed = statuses.filter((s) => s.installed).map((s) => s.runtime);
+  const probe2 = inputs.hubUrl ? await d.probeHub({
+    hubUrl: inputs.hubUrl,
+    ...inputs.token ? { enrolToken: inputs.token } : {},
+    runtimes: installed,
+    ...inputs.clientVersion ? { clientVersion: inputs.clientVersion } : {}
+  }) : void 0;
+  const checks = [
+    checkNode(d.nodeVersion),
+    checkRuntimes(statuses),
+    checkHub(inputs.hubUrl, probe2),
+    checkToken(Boolean(inputs.token), inputs.hubUrl, probe2)
+  ];
+  d.out(formatReport(checks));
+  return checks.some((c) => c.status === "fail") ? 1 : 0;
+}
+
+// src/main.ts
+var CLIENT_VERSION = "0.1.0";
+var DEFAULT_HUB_URL = "wss://hub.dahrk.net";
+var list = (v) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
+var RUNTIMES = ["claude-code", "codex", "pi"];
+var isRuntime = (r) => RUNTIMES.includes(r);
+function stateDir(env) {
+  return env.DAHRK_STATE_DIR ?? join7(homedir2(), ".dahrk");
+}
+function legacyStateDir(env) {
+  return env.DAHRK_STATE_DIR ? void 0 : join7(homedir2(), ".skakel");
+}
+function readNodeId(file) {
+  if (!existsSync4(file)) return void 0;
+  try {
+    const parsed = JSON.parse(readFileSync5(file, "utf8"));
+    if (typeof parsed.nodeId === "string" && parsed.nodeId) return parsed.nodeId;
+  } catch {
+  }
+  return void 0;
+}
+function resolveNodeId(env, opts = {}) {
+  if (env.DAHRK_NODE_ID) return env.DAHRK_NODE_ID;
+  if (opts.ephemeral) return randomUUID2();
+  const dir = stateDir(env);
+  const file = join7(dir, "node.json");
+  const existing = readNodeId(file);
+  if (existing) return existing;
+  const legacy = legacyStateDir(env);
+  if (legacy) {
+    const legacyId = readNodeId(join7(legacy, "node.json"));
+    if (legacyId) return legacyId;
+  }
+  const nodeId = randomUUID2();
+  try {
+    mkdirSync6(dir, { recursive: true });
+    writeFileSync6(file, `${JSON.stringify({ nodeId }, null, 2)}
+`);
+  } catch (e) {
+    console.warn(`could not persist node id to ${file}: ${e.message}`);
+  }
+  return nodeId;
+}
+async function resolveRuntimes(env) {
+  const override = list(env.DAHRK_RUNTIMES).filter(isRuntime);
+  if (override.length > 0) return override;
+  if ((env.DAHRK_RUNNER ?? "real") === "mock") return ["claude-code"];
+  return detectRuntimes();
+}
+function buildEdgeOptions(env, resolved) {
+  const hubUrl = env.DAHRK_HUB_URL ?? DEFAULT_HUB_URL;
+  const servesRepoIds = list(env.DAHRK_REPOS);
+  const credentialModeExplicit = env.DAHRK_CREDENTIAL_MODE != null;
+  const credentialMode = env.DAHRK_CREDENTIAL_MODE === "brokered" ? "brokered" : "ambient";
+  const envRuntimes = list(env.DAHRK_RUNTIMES).filter(isRuntime);
+  const runtimes = resolved ? resolved.runtimes : envRuntimes.length > 0 ? envRuntimes : ["claude-code"];
+  const nodeId = resolved?.nodeId ?? env.DAHRK_NODE_ID;
+  const maxRuns = env.DAHRK_RETENTION_MAX_RUNS;
+  const maxAgeMs = env.DAHRK_RETENTION_MAX_AGE_MS;
+  const retention = maxRuns || maxAgeMs ? {
+    ...maxRuns ? { maxRuns: Number(maxRuns) } : {},
+    ...maxAgeMs ? { maxAgeMs: Number(maxAgeMs) } : {}
+  } : void 0;
+  return {
+    hubUrl,
+    ...servesRepoIds.length > 0 ? { servesRepoIds } : {},
+    runtimes,
+    credentialMode,
+    credentialModeExplicit,
+    // Identity: the persisted UUID (or an explicit id); the hub assigns a display name unless --name /
+    // DAHRK_NODE_NAME overrides it.
+    ...nodeId ? { nodeId } : {},
+    ...env.DAHRK_NODE_NAME ? { name: env.DAHRK_NODE_NAME } : {},
+    ...resolved ? { clientVersion: resolved.clientVersion } : {},
+    // Enrolment token (required); tenant is derived hub-side from its pool.
+    ...env.DAHRK_ENROL_TOKEN ? { enrolToken: env.DAHRK_ENROL_TOKEN } : {},
+    // DAHRK_TENANT_ID is no longer required (tenant comes from `welcome`) but is still honoured as a
+    // defence-in-depth override for the managed profile.
+    ...env.DAHRK_TENANT_ID ? { tenantId: env.DAHRK_TENANT_ID } : {},
+    worktreesDir: env.DAHRK_WORKTREES_DIR,
+    mirrorsDir: env.DAHRK_MIRRORS_DIR,
+    denyTool: env.DAHRK_DENY_TOOL,
+    heartbeatMs: env.DAHRK_HEARTBEAT_MS ? Number(env.DAHRK_HEARTBEAT_MS) : void 0,
+    ...retention ? { retention } : {}
+  };
+}
+function applyEnvAliases(env) {
+  const merged = { ...env };
+  for (const [key, value] of Object.entries(env)) {
+    if (key.startsWith("SKAKEL_") && value !== void 0) {
+      const dahrkKey = `DAHRK_${key.slice("SKAKEL_".length)}`;
+      merged[dahrkKey] ??= value;
+    }
+  }
+  return merged;
+}
+function envWithFlags(env, flags) {
+  const merged = applyEnvAliases(env);
+  if (flags.token) merged.DAHRK_ENROL_TOKEN = flags.token;
+  if (flags.name) merged.DAHRK_NODE_NAME = flags.name;
+  if (flags.hubUrl) merged.DAHRK_HUB_URL = flags.hubUrl;
+  return merged;
+}
+async function start(flags) {
+  const env = envWithFlags(process.env, flags);
+  const nodeId = resolveNodeId(env, { ephemeral: flags.ephemeral });
+  const runtimes = await resolveRuntimes(env);
+  if (runtimes.length === 0) {
+    console.warn(
+      "no agent runtimes detected on this host (claude/codex/pi not on PATH); the node will advertise none and serve no Jobs. Install a runtime or set DAHRK_RUNTIMES to override. Run `dahrk doctor` to check."
+    );
+  }
+  const resolved = { nodeId, runtimes, clientVersion: CLIENT_VERSION };
+  await startEdgeNode(buildEdgeOptions(env, resolved));
+}
+async function main() {
+  const invoked = basename(process.argv[1] ?? "");
+  const bin = !invoked || invoked.startsWith("main.") ? "dahrk" : invoked;
+  const parsed = parseCli(process.argv.slice(2));
+  switch (parsed.kind) {
+    case "error":
+      console.error(`${parsed.message}
+`);
+      console.error(usage(bin));
+      process.exit(2);
+      break;
+    case "help":
+      console.log(usage(bin, parsed.command));
+      break;
+    case "version":
+      console.log(CLIENT_VERSION);
+      break;
+    case "doctor": {
+      const env = envWithFlags(process.env, parsed.flags);
+      process.exitCode = await runDoctor({
+        hubUrl: env.DAHRK_HUB_URL,
+        token: env.DAHRK_ENROL_TOKEN,
+        clientVersion: CLIENT_VERSION
+      });
+      break;
+    }
+    case "start":
+      await start(parsed.flags);
+      break;
+  }
+}
+var invokedAsEntrypoint = (() => {
+  const argv1 = process.argv[1];
+  if (!argv1) return false;
+  try {
+    return pathToFileURL(realpathSync(argv1)).href === import.meta.url;
+  } catch {
+    return false;
+  }
+})();
+if (invokedAsEntrypoint) {
+  main().catch((err) => {
+    console.error(err instanceof Error ? err.message : String(err));
+    process.exit(process.exitCode || 1);
+  });
+}
+export {
+  DEFAULT_HUB_URL,
+  buildEdgeOptions,
+  resolveNodeId,
+  resolveRuntimes
+};