dahrk-node 0.1.24 → 0.1.26

package/dist/main.js

@@ -2,11 +2,11 @@
 import "./chunk-FYS2JH42.js";
 
 // src/main.ts
-import { execFileSync as execFileSync9 } from "child_process";
-import { existsSync as existsSync14, readFileSync as readFileSync11, realpathSync as realpathSync5 } from "fs";
+import { execFileSync as execFileSync10 } from "child_process";
+import { existsSync as existsSync15, readFileSync as readFileSync12, realpathSync as realpathSync5 } from "fs";
 import { randomUUID as randomUUID3 } from "crypto";
 import { homedir as homedir7, platform as osPlatform4 } from "os";
-import { basename as basename2, join as join19 } from "path";
+import { basename as basename2, join as join20 } from "path";
 import { pathToFileURL } from "url";
 
 // ../../packages/edge/src/ws-client.ts
@@ -245,12 +245,12 @@ function documentsBlock(ctx) {
     const truncated = body.length > cap;
     const excerpt = truncated ? body.slice(0, cap) : body;
     budget -= excerpt.length;
-    const tail = truncated ? `
+    const tail3 = truncated ? `
 ...(truncated; full text at ${path})` : "";
     const title = doc.title.replace(/[<>"]/g, "'");
     parts.push(
       `<document title="${title}" file="${path}">
-${neutraliseDelimiters(excerpt)}${tail}
+${neutraliseDelimiters(excerpt)}${tail3}
 </document>`
     );
     if (budget <= 0) break;
@@ -303,6 +303,18 @@ ${neutraliseGateFeedbackDelimiters(content)}
 ${parts.join("\n")}
 </gate-feedback>`;
 }
+function checkFailuresBlock(ctx) {
+  const failures = ctx.checkFailures;
+  if (!failures) return "";
+  const { stageId, attempt, verifications } = failures;
+  if (verifications.length === 0) return "";
+  const safeStage = stageId.replace(/[^A-Za-z0-9._-]/g, "-");
+  const rows = verifications.map((v) => `  ${v.name}: ${v.status === "failed" ? "FAILED" : v.status}`).join("\n");
+  return `<check-failures stage="${stageId.replace(/[<>"]/g, "'")}" attempt="${attempt}">
+${rows}
+  Full output: .dahrk/scratch/checks/${safeStage}-${attempt}.md
+</check-failures>`;
+}
 function resolveStagePrompt(ctx) {
   const instruction = stageInstruction(ctx);
   const ticket = ctx.issueContext?.trim() ? `<ticket>
@@ -311,14 +323,15 @@ ${ctx.issueContext.trim()}
   const guidance = guidanceBlock(ctx);
   const gateFeedback = gateFeedbackBlock(ctx);
   const docs = documentsBlock(ctx);
-  const preamble = [ticket, guidance, gateFeedback, docs].filter(Boolean).join("\n\n");
+  const checkFailures = checkFailuresBlock(ctx);
+  const preamble = [ticket, guidance, gateFeedback, docs, checkFailures].filter(Boolean).join("\n\n");
   return preamble ? `${preamble}
 
 ${instruction}` : instruction;
 }
 function hasSystemPrompt(ctx) {
   return Boolean(
-    ctx.config.prompt || ctx.config.promptFile || ctx.issueContext?.trim() || ctx.guidance && ctx.guidance.length > 0 || ctx.gateFeedback && ctx.gateFeedback.length > 0 || ctx.attachedDocuments && ctx.attachedDocuments.length > 0
+    ctx.config.prompt || ctx.config.promptFile || ctx.issueContext?.trim() || ctx.guidance && ctx.guidance.length > 0 || ctx.gateFeedback && ctx.gateFeedback.length > 0 || Boolean(ctx.checkFailures) || ctx.attachedDocuments && ctx.attachedDocuments.length > 0
   );
 }
 var OPENING_KICKOFF = "Begin now. Using the ticket context and your instructions already provided, ask the human your first question. Do not wait for further input before sending your first message.";
@@ -2564,6 +2577,222 @@ async function overlayComponents(opts) {
   return result;
 }
 
+// ../../packages/executor-worktree/src/repo-setup.ts
+import { execFileSync as execFileSync3 } from "child_process";
+import { createHash as createHash3 } from "crypto";
+import { existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync4, writeFileSync as writeFileSync6 } from "fs";
+import { dirname as dirname4, join as join10 } from "path";
+var noopLogger2 = { info: () => {
+}, warn: () => {
+} };
+var SCRATCH_DIR2 = join10(".dahrk", "scratch");
+var MARKER_NAME = ".setup-done";
+var DEFAULT_TIMEOUT_MS = 6e5;
+var OUTPUT_CAP = 16384;
+function digest(command) {
+  return createHash3("sha256").update(command).digest("hex").slice(0, 16);
+}
+function tail(output) {
+  return output.length > OUTPUT_CAP ? output.slice(output.length - OUTPUT_CAP) : output;
+}
+function runRepoSetup(opts) {
+  const { worktreePath, command } = opts;
+  const log = opts.log ?? noopLogger2;
+  const markerPath = join10(worktreePath, SCRATCH_DIR2, MARKER_NAME);
+  const want = digest(command);
+  if (existsSync5(markerPath)) {
+    try {
+      if (readFileSync4(markerPath, "utf8").trim() === want) {
+        log.info(`repo setup: cached (marker matches), skipping`);
+        return { status: "cached" };
+      }
+    } catch {
+    }
+  }
+  log.info(`repo setup: running \`${command}\``);
+  try {
+    const stdout = execFileSync3("sh", ["-c", command], {
+      cwd: worktreePath,
+      env: opts.env ?? process.env,
+      timeout: opts.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      encoding: "utf8",
+      // Fold stderr into stdout so the captured trace shows what the installer said, in order.
+      stdio: ["ignore", "pipe", "pipe"]
+    });
+    mkdirSync5(dirname4(markerPath), { recursive: true });
+    writeFileSync6(markerPath, want);
+    return { status: "ran", output: tail(stdout ?? "") };
+  } catch (e) {
+    const err = e;
+    const combined = `${err.stdout?.toString() ?? ""}${err.stderr?.toString() ?? ""}` || e.message;
+    log.warn(`repo setup failed (exit ${err.status ?? "null"})`);
+    return { status: "failed", exitCode: err.status ?? null, output: tail(combined) };
+  }
+}
+
+// ../../packages/executor-worktree/src/check-runner.ts
+import { spawn } from "child_process";
+var DEFAULT_TIMEOUT_MS2 = 6e5;
+var OUTPUT_CAP2 = 16384;
+function tail2(output) {
+  return output.length > OUTPUT_CAP2 ? output.slice(output.length - OUTPUT_CAP2) : output;
+}
+async function runOne(check, cwd, startedAt) {
+  const timeoutMs = (check.timeoutSeconds ?? DEFAULT_TIMEOUT_MS2 / 1e3) * 1e3;
+  return await new Promise((resolve3) => {
+    let chunks = "";
+    let timedOut = false;
+    let settled = false;
+    const child = spawn("sh", ["-c", check.command], { cwd, env: process.env, stdio: ["ignore", "pipe", "pipe"] });
+    const append = (buf) => {
+      chunks = tail2(chunks + buf.toString("utf8"));
+    };
+    child.stdout?.on("data", append);
+    child.stderr?.on("data", append);
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, timeoutMs);
+    const settle = (exitCode) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve3({
+        name: check.name,
+        command: check.command,
+        exitCode,
+        output: chunks,
+        status: exitCode === 0 ? "passed" : "failed",
+        durationMs: Date.now() - startedAt,
+        timedOut
+      });
+    };
+    child.on("close", (code) => settle(code));
+    child.on("error", (err) => {
+      chunks = tail2(`${chunks}
+check could not start: ${err.message}`);
+      settle(null);
+    });
+  });
+}
+function summariseChecks(outcomes) {
+  const failed = outcomes.filter((o) => o.status === "failed");
+  const skipped = outcomes.filter((o) => o.status === "skipped");
+  if (outcomes.length === 0) return "no checks declared";
+  const suffix = skipped.length > 0 ? `; ${skipped.length} not run` : "";
+  if (failed.length === 0) return `all ${outcomes.length} checks passed${suffix}`;
+  return `${failed.length} of ${outcomes.length} checks failed: ${failed.map((o) => o.name).join(", ")}${suffix}`;
+}
+function createCheckRunner(checks, onOutcomes) {
+  let cancelled = false;
+  let lastSummary = "";
+  return {
+    // A check stage runs no agent, so claiming an agent runtime here would corrupt the trace record
+    // the optimiser and the observability CLI both read.
+    runtime: "check",
+    async runBatch(ctx, onTrace) {
+      const cwd = ctx.workspace.worktreePath;
+      const outcomes = [];
+      let seq = 0;
+      for (const check of checks) {
+        if (cancelled) {
+          outcomes.push({
+            name: check.name,
+            command: check.command,
+            exitCode: null,
+            output: "",
+            status: "skipped",
+            durationMs: 0,
+            timedOut: false
+          });
+          continue;
+        }
+        onTrace({
+          seq: seq++,
+          runtime: "check",
+          type: "action",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          tool: "check",
+          toolUseId: check.name,
+          input: { name: check.name, command: check.command }
+        });
+        const outcome = await runOne(check, cwd, Date.now());
+        outcomes.push(outcome);
+        onTrace({
+          seq: seq++,
+          runtime: "check",
+          type: "observation",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          toolUseId: check.name,
+          isError: outcome.status === "failed",
+          output: {
+            name: outcome.name,
+            exitCode: outcome.exitCode,
+            timedOut: outcome.timedOut,
+            durationMs: outcome.durationMs,
+            output: outcome.output
+          }
+        });
+      }
+      lastSummary = summariseChecks(outcomes);
+      onTrace({
+        seq: seq++,
+        runtime: "check",
+        type: "response",
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        text: lastSummary
+      });
+      onOutcomes?.(outcomes);
+      const verifications = outcomes.map((o) => ({ name: o.name, status: o.status }));
+      const anyFailed = outcomes.some((o) => o.status === "failed");
+      return {
+        status: cancelled ? "timeout" : anyFailed ? "fail" : "ok",
+        verifications
+      };
+    },
+    async runInteractive() {
+      throw new Error("a check stage cannot be interactive");
+    },
+    /** Deterministic, and free: no model is asked to describe a lint run. */
+    async summarise() {
+      return lastSummary || summariseChecks([]);
+    },
+    async cancel() {
+      cancelled = true;
+    }
+  };
+}
+var CHECK_NOTE_CAP_BYTES = 64 * 1024;
+var safeStageSegment = (stageId) => stageId.replace(/[^A-Za-z0-9._-]/g, "-");
+function renderCheckNote(stageId, attempt, outcomes) {
+  const failed = outcomes.filter((o) => o.status === "failed");
+  const head = `# checks/${stageId} (attempt ${attempt}) - ${failed.length === 0 ? "PASSED" : "FAILED"}
+
+${summariseChecks(outcomes)}
+`;
+  const ordered = [...outcomes].sort((a, b) => Number(b.status === "failed") - Number(a.status === "failed"));
+  let body = "";
+  let budget = CHECK_NOTE_CAP_BYTES - head.length;
+  for (const o of ordered) {
+    const verdict2 = o.status === "skipped" ? "not run (the stage was cancelled before it started)" : o.timedOut ? `TIMED OUT after ${Math.round(o.durationMs / 1e3)}s` : `exit ${o.exitCode}`;
+    const header = `
+## ${o.name} - ${o.status} (${verdict2})
+
+$ ${o.command}
+`;
+    const output = o.output.trim();
+    const includeOutput = output.length > 0 && (o.status === "failed" || header.length + output.length < budget);
+    const chunk = includeOutput ? `${header}
+\`\`\`
+${output}
+\`\`\`
+` : header;
+    body += chunk;
+    budget -= chunk.length;
+  }
+  return head + body;
+}
+
 // ../../packages/executor-worktree/src/index.ts
 function makeRunner(runtime) {
   if ((process.env.DAHRK_RUNNER ?? process.env.SKAKEL_RUNNER ?? "real") === "mock") return createMockRunner(runtime);
@@ -2630,8 +2859,8 @@ function collectHealth(inputs) {
 }
 
 // ../../packages/edge/src/job-ledger.ts
-import { chmodSync, existsSync as existsSync5, mkdirSync as mkdirSync5, readFileSync as readFileSync4, renameSync, unlinkSync, writeFileSync as writeFileSync6 } from "fs";
-import { dirname as dirname4, join as join10 } from "path";
+import { chmodSync, existsSync as existsSync6, mkdirSync as mkdirSync6, readFileSync as readFileSync5, renameSync, unlinkSync, writeFileSync as writeFileSync7 } from "fs";
+import { dirname as dirname5, join as join11 } from "path";
 var FILE_MODE = 384;
 var DIR_MODE = 448;
 function nullJobLedger() {
@@ -2647,9 +2876,9 @@ var isEntry = (v) => {
 };
 function fileJobLedger(file, warn = console.warn) {
   const read = () => {
-    if (!existsSync5(file)) return [];
+    if (!existsSync6(file)) return [];
     try {
-      const parsed = JSON.parse(readFileSync4(file, "utf8"));
+      const parsed = JSON.parse(readFileSync5(file, "utf8"));
       if (!Array.isArray(parsed)) return [];
       return parsed.filter(isEntry);
     } catch {
@@ -2659,15 +2888,15 @@ function fileJobLedger(file, warn = console.warn) {
   const write = (entries) => {
     const tmp = `${file}.${process.pid}.tmp`;
     try {
-      mkdirSync5(dirname4(file), { recursive: true, mode: DIR_MODE });
-      writeFileSync6(tmp, `${JSON.stringify(entries, null, 2)}
+      mkdirSync6(dirname5(file), { recursive: true, mode: DIR_MODE });
+      writeFileSync7(tmp, `${JSON.stringify(entries, null, 2)}
 `, { mode: FILE_MODE });
       chmodSync(tmp, FILE_MODE);
       renameSync(tmp, file);
     } catch (e) {
       warn(`could not persist the job ledger to ${file}: ${e.message}`);
       try {
-        if (existsSync5(tmp)) unlinkSync(tmp);
+        if (existsSync6(tmp)) unlinkSync(tmp);
       } catch {
       }
     }
@@ -2695,7 +2924,7 @@ function announceableJobs(entries) {
   return out2;
 }
 function jobLedgerFile(stateDir2) {
-  return join10(stateDir2, "jobs.json");
+  return join11(stateDir2, "jobs.json");
 }
 
 // ../../packages/edge/src/log-shipper.ts
@@ -2798,8 +3027,8 @@ function ceilingFromEnv(env) {
 }
 
 // ../../packages/edge/src/logger.ts
-import { closeSync, existsSync as existsSync6, mkdirSync as mkdirSync6, openSync, renameSync as renameSync2, rmSync as rmSync5, statSync as statSync2, writeSync } from "fs";
-import { join as join11 } from "path";
+import { closeSync, existsSync as existsSync7, mkdirSync as mkdirSync7, openSync, renameSync as renameSync2, rmSync as rmSync5, statSync as statSync2, writeSync } from "fs";
+import { join as join12 } from "path";
 import pino from "pino";
 
 // ../../packages/edge/src/redact.ts
@@ -2895,7 +3124,7 @@ var RotatingFile = class {
   open() {
     try {
       this.fd = openSync(this.path, "a");
-      this.size = existsSync6(this.path) ? statSync2(this.path).size : 0;
+      this.size = existsSync7(this.path) ? statSync2(this.path).size : 0;
     } catch (e) {
       this.disable(e);
     }
@@ -2923,12 +3152,12 @@ var RotatingFile = class {
       closeSync(this.fd);
       this.fd = void 0;
       const oldest = `${this.path}.${this.maxFiles}`;
-      if (existsSync6(oldest)) rmSync5(oldest, { force: true });
+      if (existsSync7(oldest)) rmSync5(oldest, { force: true });
       for (let i = this.maxFiles - 1; i >= 1; i--) {
         const from = `${this.path}.${i}`;
-        if (existsSync6(from)) renameSync2(from, `${this.path}.${i + 1}`);
+        if (existsSync7(from)) renameSync2(from, `${this.path}.${i + 1}`);
       }
-      if (existsSync6(this.path)) renameSync2(this.path, `${this.path}.1`);
+      if (existsSync7(this.path)) renameSync2(this.path, `${this.path}.1`);
       this.open();
     } catch (e) {
       this.disable(e);
@@ -2988,8 +3217,8 @@ function createNodeLogger(opts = {}) {
   if (level !== "silent") streams.push({ level, stream: humanSink });
   if (opts.dir && fileLevel !== "silent") {
     try {
-      mkdirSync6(opts.dir, { recursive: true, mode: 448 });
-      const file = new RotatingFile(join11(opts.dir, "node.jsonl"), opts.maxBytes ?? 10 * 1024 * 1024, opts.maxFiles ?? 5);
+      mkdirSync7(opts.dir, { recursive: true, mode: 448 });
+      const file = new RotatingFile(join12(opts.dir, "node.jsonl"), opts.maxBytes ?? 10 * 1024 * 1024, opts.maxFiles ?? 5);
       streams.push({ level: fileLevel, stream: file });
     } catch (e) {
       process.stderr.write(`dahrk: file logging disabled (${e.message})
@@ -3045,21 +3274,21 @@ function denyToolRule(tool3) {
 }
 
 // ../../packages/edge/src/stage-runner.ts
-import { execFileSync as execFileSync5 } from "child_process";
-import { createHash as createHash3 } from "crypto";
-import { mkdirSync as mkdirSync7, readdirSync as readdirSync3, readFileSync as readFileSync5, rmSync as rmSync6, writeFileSync as writeFileSync7 } from "fs";
+import { execFileSync as execFileSync6 } from "child_process";
+import { createHash as createHash4 } from "crypto";
+import { mkdirSync as mkdirSync8, readdirSync as readdirSync3, readFileSync as readFileSync6, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
-import { isAbsolute as isAbsolute3, join as join13, relative as relative3, resolve as resolve2, sep as sep3 } from "path";
-import { attachedDocBasename as attachedDocBasename2 } from "@dahrk/contracts";
+import { isAbsolute as isAbsolute3, join as join14, relative as relative3, resolve as resolve2, sep as sep3 } from "path";
+import { attachedDocBasename as attachedDocBasename2, isCheckJob } from "@dahrk/contracts";
 
 // ../../packages/edge/src/builtins.ts
-import { execFileSync as execFileSync4 } from "child_process";
+import { execFileSync as execFileSync5 } from "child_process";
 
 // ../../packages/edge/src/fs-roots.ts
-import { execFileSync as execFileSync3 } from "child_process";
-import { existsSync as existsSync7, realpathSync as realpathSync2 } from "fs";
+import { execFileSync as execFileSync4 } from "child_process";
+import { existsSync as existsSync8, realpathSync as realpathSync2 } from "fs";
 import { homedir as homedir3, tmpdir as tmpdir4 } from "os";
-import { dirname as dirname5, isAbsolute as isAbsolute2, join as join12, relative as relative2, resolve, sep as sep2 } from "path";
+import { dirname as dirname6, isAbsolute as isAbsolute2, join as join13, relative as relative2, resolve, sep as sep2 } from "path";
 function isUnder(root, target) {
   const rel = relative2(resolve(root), resolve(target));
   return rel === "" || !rel.startsWith(`..${sep2}`) && rel !== ".." && !isAbsolute2(rel);
@@ -3071,17 +3300,17 @@ function expandPath(raw, cwd) {
 }
 function realish(p) {
   let head = p;
-  const tail = [];
-  while (head !== dirname5(head)) {
-    if (existsSync7(head)) {
+  const tail3 = [];
+  while (head !== dirname6(head)) {
+    if (existsSync8(head)) {
       try {
-        return join12(realpathSync2.native(head), ...tail.reverse());
+        return join13(realpathSync2.native(head), ...tail3.reverse());
       } catch {
         return p;
       }
     }
-    tail.push(head.slice(dirname5(head).length + 1));
-    head = dirname5(head);
+    tail3.push(head.slice(dirname6(head).length + 1));
+    head = dirname6(head);
   }
   return p;
 }
@@ -3095,7 +3324,7 @@ function withinRoots(raw, roots, need) {
 }
 function gitCommonDir(worktreePath) {
   try {
-    const out2 = execFileSync3("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], {
+    const out2 = execFileSync4("git", ["rev-parse", "--path-format=absolute", "--git-common-dir"], {
       cwd: worktreePath,
       stdio: ["ignore", "pipe", "ignore"]
     }).toString().trim();
@@ -3108,7 +3337,7 @@ var pnpmStoreCache;
 function pnpmStore() {
   if (pnpmStoreCache) return pnpmStoreCache.path;
   try {
-    const out2 = execFileSync3("pnpm", ["store", "path"], { stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 }).toString().trim();
+    const out2 = execFileSync4("pnpm", ["store", "path"], { stdio: ["ignore", "pipe", "ignore"], timeout: 5e3 }).toString().trim();
     pnpmStoreCache = { path: out2 || void 0 };
   } catch {
     pnpmStoreCache = { path: void 0 };
@@ -3144,26 +3373,26 @@ function computeFsRoots(opts) {
     "/System",
     "/proc",
     "/sys",
-    join12(home, ".gitconfig"),
-    join12(home, ".config"),
-    join12(home, ".npmrc"),
-    join12(home, ".cache"),
-    join12(home, "Library", "Caches"),
-    join12(home, "Library", "pnpm"),
-    join12(home, ".local", "share"),
-    join12(home, ".nvm"),
-    join12(home, ".volta"),
-    join12(home, ".asdf"),
-    join12(home, ".cargo"),
-    join12(home, ".rustup"),
+    join13(home, ".gitconfig"),
+    join13(home, ".config"),
+    join13(home, ".npmrc"),
+    join13(home, ".cache"),
+    join13(home, "Library", "Caches"),
+    join13(home, "Library", "pnpm"),
+    join13(home, ".local", "share"),
+    join13(home, ".nvm"),
+    join13(home, ".volta"),
+    join13(home, ".asdf"),
+    join13(home, ".cargo"),
+    join13(home, ".rustup"),
     ...splitRoots(process.env.DAHRK_FS_EXTRA_READ_ROOTS).map((p) => realish(resolve(p)))
   ].map(realish);
   const deny = [
-    join12(home, ".ssh"),
-    join12(home, ".aws"),
-    join12(home, ".gnupg"),
-    join12(home, ".config", "gcloud"),
-    join12(home, "Library", "Keychains"),
+    join13(home, ".ssh"),
+    join13(home, ".aws"),
+    join13(home, ".gnupg"),
+    join13(home, ".config", "gcloud"),
+    join13(home, "Library", "Keychains"),
     "/Volumes",
     "/etc/shadow",
     "/etc/sudoers"
@@ -3515,7 +3744,7 @@ function isDangerousRm(cmd) {
 }
 function currentBranch(worktreePath) {
   try {
-    return execFileSync4("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: worktreePath }).toString().trim();
+    return execFileSync5("git", ["rev-parse", "--abbrev-ref", "HEAD"], { cwd: worktreePath }).toString().trim();
   } catch {
     return "";
   }
@@ -3817,34 +4046,34 @@ var attemptOf = (jobId) => {
   const m = /-(\d+)$/.exec(jobId);
   return m ? Number(m[1]) : 1;
 };
-var digest = (value) => `sha256:${createHash3("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 16)}`;
+var digest2 = (value) => `sha256:${createHash4("sha256").update(JSON.stringify(value)).digest("hex").slice(0, 16)}`;
 function writeScratchState(ref, job, attempt, status) {
-  const statePath = join13(ref.scratchPath, "state.json");
+  const statePath = join14(ref.scratchPath, "state.json");
   let state;
   try {
-    state = JSON.parse(readFileSync5(statePath, "utf8"));
+    state = JSON.parse(readFileSync6(statePath, "utf8"));
   } catch {
     state = { runId: job.runId, tenantId: job.tenantId, stages: {} };
   }
   state.stages[job.stageId] = { currentAttempt: attempt, status };
-  mkdirSync7(ref.scratchPath, { recursive: true });
-  writeFileSync7(statePath, JSON.stringify(state, null, 2));
+  mkdirSync8(ref.scratchPath, { recursive: true });
+  writeFileSync8(statePath, JSON.stringify(state, null, 2));
 }
 function writeIssueContext(ref, issueContext) {
   if (issueContext === void 0) return;
   try {
-    mkdirSync7(ref.scratchPath, { recursive: true });
-    writeFileSync7(join13(ref.scratchPath, "issue.md"), issueContext);
+    mkdirSync8(ref.scratchPath, { recursive: true });
+    writeFileSync8(join14(ref.scratchPath, "issue.md"), issueContext);
   } catch {
   }
 }
 function writeAttachedDocuments(ref, docs) {
   if (!docs || docs.length === 0) return;
   try {
-    const dir = join13(ref.scratchPath, "docs");
-    mkdirSync7(dir, { recursive: true });
+    const dir = join14(ref.scratchPath, "docs");
+    mkdirSync8(dir, { recursive: true });
     for (const doc of docs) {
-      writeFileSync7(join13(dir, `${attachedDocBasename2(doc)}.md`), doc.content);
+      writeFileSync8(join14(dir, `${attachedDocBasename2(doc)}.md`), doc.content);
     }
   } catch {
   }
@@ -3862,8 +4091,17 @@ ${lines.join("\n")}
 function writeGuidance(ref, guidance) {
   if (!guidance || guidance.length === 0) return;
   try {
-    mkdirSync7(ref.scratchPath, { recursive: true });
-    writeFileSync7(join13(ref.scratchPath, "guidance.md"), renderGuidanceMarkdown(guidance));
+    mkdirSync8(ref.scratchPath, { recursive: true });
+    writeFileSync8(join14(ref.scratchPath, "guidance.md"), renderGuidanceMarkdown(guidance));
+  } catch {
+  }
+}
+function writeCheckNote(ref, stageId, attempt, outcomes) {
+  if (outcomes.length === 0) return;
+  try {
+    const dir = join14(ref.scratchPath, "checks");
+    mkdirSync8(dir, { recursive: true });
+    writeFileSync8(join14(dir, `${safeStageSegment(stageId)}-${attempt}.md`), renderCheckNote(stageId, attempt, outcomes));
   } catch {
   }
 }
@@ -3889,7 +4127,7 @@ function readEmittedArtifact(ref, relPath) {
   const path = resolveWorktreeRelativePath(ref, relPath);
   if (!path) return void 0;
   try {
-    const raw = readFileSync5(path, "utf8");
+    const raw = readFileSync6(path, "utf8");
     return { path: relPath, content: capContent(raw) };
   } catch {
     return void 0;
@@ -3898,12 +4136,12 @@ function readEmittedArtifact(ref, relPath) {
 function scanScratchOutput(ref, preferRel) {
   const preferBase = preferRel?.split("/").pop();
   try {
-    const names = readdirSync3(join13(ref.worktreePath, SCRATCH_OUTPUT_DIR)).filter(
+    const names = readdirSync3(join14(ref.worktreePath, SCRATCH_OUTPUT_DIR)).filter(
       (n) => n.toLowerCase().endsWith(".md")
     );
     if (names.length === 0) return void 0;
     const pick = preferBase && names.includes(preferBase) ? preferBase : names[0];
-    const raw = readFileSync5(join13(ref.worktreePath, SCRATCH_OUTPUT_DIR, pick), "utf8");
+    const raw = readFileSync6(join14(ref.worktreePath, SCRATCH_OUTPUT_DIR, pick), "utf8");
     if (raw.trim().length === 0) return void 0;
     return { path: `${SCRATCH_OUTPUT_DIR}/${pick}`, content: capContent(raw) };
   } catch {
@@ -3913,7 +4151,7 @@ function scanScratchOutput(ref, preferRel) {
 function scanChangedMarkdown(ref) {
   const git = (args) => {
     try {
-      return execFileSync5("git", ["-C", ref.worktreePath, ...args], { encoding: "utf8" }).split("\n").map((s) => s.trim()).filter(Boolean);
+      return execFileSync6("git", ["-C", ref.worktreePath, ...args], { encoding: "utf8" }).split("\n").map((s) => s.trim()).filter(Boolean);
     } catch {
       return [];
     }
@@ -3923,7 +4161,7 @@ function scanChangedMarkdown(ref) {
   );
   for (const rel of rels) {
     try {
-      const raw = readFileSync5(join13(ref.worktreePath, rel), "utf8");
+      const raw = readFileSync6(join14(ref.worktreePath, rel), "utf8");
       if (raw.trim().length > 0) return { path: rel, content: capContent(raw) };
     } catch {
     }
@@ -4015,7 +4253,10 @@ function createStageRunner(deps) {
       return reaper.reap(reaperDryRun ? { dryRun: true } : {});
     },
     async runJob(job) {
-      const { stageId, jobId, runId, agentConfig } = job;
+      const { stageId, jobId, runId } = job;
+      const isCheck = isCheckJob(job);
+      const agentConfig = job.agentConfig;
+      const traceRuntime = isCheck ? "check" : agentConfig.runtime;
       const attempt = attemptOf(jobId);
       if (deps.tenantId && job.tenantId !== deps.tenantId) {
         return {
@@ -4049,10 +4290,10 @@ function createStageRunner(deps) {
               ...job.workspaceRef.credentialToken ? { credentialToken: job.workspaceRef.credentialToken } : {}
             });
           } else {
-            const base = deps.scratchRoot ?? join13(tmpdir5(), "dahrk", "scratch");
-            const worktreePath = join13(base, runId);
-            const scratchPath = join13(worktreePath, ".dahrk", "scratch");
-            mkdirSync7(scratchPath, { recursive: true });
+            const base = deps.scratchRoot ?? join14(tmpdir5(), "dahrk", "scratch");
+            const worktreePath = join14(base, runId);
+            const scratchPath = join14(worktreePath, ".dahrk", "scratch");
+            mkdirSync8(scratchPath, { recursive: true });
             ref = { repoId: "", gitUrl: "", repo: "", baseBranch: "", worktreePath, scratchPath };
             scratchOnly.add(runId);
           }
@@ -4062,12 +4303,12 @@ function createStageRunner(deps) {
         writeIssueContext(ref, job.issueContext);
         writeGuidance(ref, job.guidance);
         writeAttachedDocuments(ref, job.attachedDocuments);
-        if (job.agentConfig.emitArtifact) {
-          const artifactDir = resolveWorktreeRelativePath(ref, job.agentConfig.emitArtifact);
-          const slash = job.agentConfig.emitArtifact.lastIndexOf("/");
+        if (agentConfig?.emitArtifact) {
+          const artifactDir = resolveWorktreeRelativePath(ref, agentConfig.emitArtifact);
+          const slash = agentConfig.emitArtifact.lastIndexOf("/");
           if (artifactDir && slash > 0) {
             try {
-              mkdirSync7(join13(ref.worktreePath, job.agentConfig.emitArtifact.slice(0, slash)), { recursive: true });
+              mkdirSync8(join14(ref.worktreePath, agentConfig.emitArtifact.slice(0, slash)), { recursive: true });
             } catch {
             }
           }
@@ -4079,24 +4320,24 @@ function createStageRunner(deps) {
           stageId,
           jobId,
           attempt,
-          runtime: agentConfig.runtime,
-          model: agentConfig.model,
+          runtime: traceRuntime,
+          model: agentConfig?.model,
           sessionId: job.sessionId,
-          configDigest: digest(agentConfig),
+          configDigest: digest2(isCheck ? job.checks : agentConfig),
           startedAt: nowIso2()
         };
         const writer = createTraceWriter(ref.scratchPath, meta);
         const streamEvent = (e) => deps.trace?.event({ runId, stageId, attempt, tenantId: job.tenantId, event: e });
         streamEvent(
-          writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "attempt-start" })
+          writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "attempt-start" })
         );
         const shipFinalTrace = async (finalMeta) => {
           const sink = deps.trace;
           if (!sink) return;
           const base = { tenantId: job.tenantId, runId, stageId, attempt };
           try {
-            for (const name of readdirSync3(join13(writer.dir, "blobs"))) {
-              const bytes = readFileSync5(join13(writer.dir, "blobs", name));
+            for (const name of readdirSync3(join14(writer.dir, "blobs"))) {
+              const bytes = readFileSync6(join14(writer.dir, "blobs", name));
               const { url } = await sink.requestBlobUrl({
                 ...base,
                 sha256: name,
@@ -4110,8 +4351,8 @@ function createStageRunner(deps) {
           }
           let archiveKey;
           try {
-            const bytes = readFileSync5(join13(writer.dir, "trace.jsonl"));
-            const sha = createHash3("sha256").update(bytes).digest("hex");
+            const bytes = readFileSync6(join14(writer.dir, "trace.jsonl"));
+            const sha = createHash4("sha256").update(bytes).digest("hex");
             const { key, url } = await sink.requestBlobUrl({
               ...base,
               sha256: sha,
@@ -4125,13 +4366,13 @@ function createStageRunner(deps) {
           }
           sink.finalised({ ...base, meta: finalMeta, eventCount: writer.count(), ...archiveKey ? { archiveKey } : {} });
         };
-        const finish = async (status2, summary2, sessionId, costUsd, handedBackDoc, failureClass2) => {
+        const finish = async (status2, summary2, sessionId, costUsd, handedBackDoc, failureClass2, verifications) => {
           active.delete(jobId);
           turnQueues.delete(jobId);
           await gateway?.stop().catch((e) => log.warn({ err: e, jobId }, "mcp gateway: stop failed"));
           gateway = void 0;
           streamEvent(
-            writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "stage-exit", status: status2 })
+            writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "stage-exit", status: status2 })
           );
           const endedAt = nowIso2();
           writer.finalise({ status: status2, endedAt, ...sessionId ? { sessionId } : {} });
@@ -4148,12 +4389,12 @@ function createStageRunner(deps) {
           );
           lastUsed.set(runId, Date.now());
           await applyRetention(runId).catch((e) => log.warn({ err: e, runId }, "retention: pass failed"));
-          const wantsArtifact = agentConfig.emitArtifact !== void 0 || handedBackDoc !== void 0;
-          const resolved = status2 === "ok" && wantsArtifact ? resolveStageArtifact(ref, agentConfig.emitArtifact, handedBackDoc) : void 0;
+          const wantsArtifact = agentConfig?.emitArtifact !== void 0 || handedBackDoc !== void 0;
+          const resolved = status2 === "ok" && wantsArtifact ? resolveStageArtifact(ref, agentConfig?.emitArtifact, handedBackDoc) : void 0;
           if (status2 === "ok" && wantsArtifact) {
             const detail = resolved ? `source=${resolved.source} path=${resolved.artifact.path} bytes=${resolved.artifact.content.length}` : "no document resolved (declared path, tool handoff, and scratch/changed-file scans all empty)";
             streamEvent(
-              writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "artifact", detail })
+              writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "artifact", detail })
             );
           }
           return {
@@ -4163,7 +4404,12 @@ function createStageRunner(deps) {
             ...sessionId ? { sessionId } : {},
             ...costUsd !== void 0 ? { costUsd } : {},
             ...resolved ? { artifact: resolved.artifact } : {},
-            ...failureClass2 ? { failureClass: failureClass2 } : {}
+            ...failureClass2 ? { failureClass: failureClass2 } : {},
+            // DHK-666: `JobResult.verifications` shipped with a contract, a projection fold, a Card
+            // renderer and tests - but this object never forwarded it, which is the entire reason the
+            // field has had no producer. Forwarded for EVERY stage, not just check jobs, so a hook or
+            // an agent-run gate can populate it too.
+            ...verifications?.length ? { verifications } : {}
           };
         };
         if (deps.packCache && job.provision && job.provision.length > 0) {
@@ -4176,17 +4422,35 @@ function createStageRunner(deps) {
             });
             const detail = `provision: ${overlay.written.length} written, ${overlay.skippedRepoLocal.length} repo-local, ${overlay.warnings.length} warning(s)`;
             streamEvent(
-              writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "provision", detail })
+              writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "provision", detail })
             );
             const noteText = overlay.warnings.length > 0 ? `${detail}; ${overlay.warnings.join("; ")}` : detail;
             deps.sendProgress({ jobId, kind: "observation", ts: nowIso2(), text: noteText });
           } catch (e) {
             const msg = `component provisioning failed: ${e.message}`;
-            writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: agentConfig.runtime, kind: "provision-failed", message: msg });
+            writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: traceRuntime, kind: "provision-failed", message: msg });
             deps.sendProgress({ jobId, kind: "error", ts: nowIso2(), text: msg });
             return finish("fail", `${stageId}: ${msg}`, job.sessionId);
           }
         }
+        const setup = job.workspaceRef?.setup;
+        if (setup?.command && ref) {
+          const outcome = runRepoSetup({ worktreePath: ref.worktreePath, command: setup.command });
+          if (outcome.status === "failed") {
+            const msg = `repo setup failed (exit ${outcome.exitCode ?? "null"})`;
+            const detail2 = outcome.output ? `${msg}: ${outcome.output}` : msg;
+            writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: traceRuntime, kind: "setup-failed", message: detail2 });
+            deps.sendProgress({ jobId, kind: "error", ts: nowIso2(), text: detail2 });
+            return finish("fail", `${stageId}: ${msg}`, job.sessionId, void 0, void 0, "harness");
+          }
+          const detail = outcome.status === "cached" ? "setup: cached (already installed)" : `setup: ran (exit 0, ${outcome.output.length} bytes)`;
+          streamEvent(
+            writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "setup", detail })
+          );
+          if (outcome.status === "ran") {
+            deps.sendProgress({ jobId, kind: "observation", ts: nowIso2(), text: outcome.output || detail });
+          }
+        }
         let counter = runToolCalls.get(runId);
         if (!counter) {
           counter = { count: 0 };
@@ -4204,14 +4468,14 @@ function createStageRunner(deps) {
         const rules = [...jobRules, ...deps.rules];
         const entry = evaluatePolicies({ kind: "stage-entry", stageId }, rules);
         if (entry.verdict === "deny") {
-          writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "policy-deny", detail: entry.reason });
+          writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "policy-deny", detail: entry.reason });
           return finish("fail", `${stageId}: denied at stage entry (${entry.policy})`, job.sessionId);
         }
         let denied = false;
         const surfacedDenyReasons = /* @__PURE__ */ new Set();
         let escapedUnblocked = false;
         const authorisedActions = [];
-        const runtime = agentConfig.runtime;
+        const runtime = agentConfig?.runtime;
         const actionKey = (tool3, input) => {
           try {
             return `${tool3}\0${JSON.stringify(input)}`;
@@ -4224,9 +4488,9 @@ function createStageRunner(deps) {
           denied = true;
           const reason = policyReason(verdict2);
           if (toolUseId) {
-            streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "observation", runtime, toolUseId, isError: true, output: { error: reason } }));
+            streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "observation", runtime: traceRuntime, toolUseId, isError: true, output: { error: reason } }));
           }
-          streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime, event: "policy-deny", detail: reason }));
+          streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "policy-deny", detail: reason }));
           const surfaceKey = `${verdict2.policy}\0${reason}`;
           if (!surfacedDenyReasons.has(surfaceKey)) {
             surfacedDenyReasons.add(surfaceKey);
@@ -4267,19 +4531,28 @@ function createStageRunner(deps) {
           streamEvent(writer.append(event));
           if (event.type !== "state") deps.sendProgress({ jobId, kind: event.type, ts: event.ts, ...previewOf(event) });
         };
-        const mcpServers = agentConfig.mcpServers;
-        if (mcpServers && mcpServers.length > 0 && runtimeUsesMcpGateway(runtime)) {
+        const mcpServers = agentConfig?.mcpServers;
+        if (runtime && mcpServers && mcpServers.length > 0 && runtimeUsesMcpGateway(runtime)) {
           gateway = await startMcpGateway({ servers: mcpServers, creds: job.brokeredCreds ?? {} });
         }
-        const runner = deps.makeRunner(runtime);
+        let checkOutcomes = [];
+        const runner = isCheck ? (deps.makeCheckRunner ?? createCheckRunner)(job.checks, (o) => {
+          checkOutcomes = o;
+        }) : deps.makeRunner(runtime);
         active.set(jobId, runner);
         const ctx = {
-          config: agentConfig,
+          // A check runner reads only `workspace.worktreePath`; the empty config keeps the shared
+          // RunnerContext shape without inventing a runtime the stage does not have.
+          config: agentConfig ?? { runtime: "claude-code" },
           workspace: ref,
           sessionId: job.sessionId,
           ...job.issueContext !== void 0 ? { issueContext: job.issueContext } : {},
           ...job.guidance !== void 0 ? { guidance: job.guidance } : {},
           ...job.gateFeedback !== void 0 ? { gateFeedback: job.gateFeedback } : {},
+          // Why this stage is running again, when it is. Without this passthrough the failing checks
+          // reach the node and stop dead here, and the looped-back agent gets the stage's static prompt
+          // with no hint of what it is meant to fix.
+          ...job.checkFailures !== void 0 ? { checkFailures: job.checkFailures } : {},
           ...job.attachedDocuments !== void 0 ? { attachedDocuments: job.attachedDocuments } : {},
           ...gateway ? { mcpProxyBaseUrl: gateway.baseUrl } : {},
           // brokered inference env for a managed node (no operator login). The runtime adapter
@@ -4291,9 +4564,8 @@ function createStageRunner(deps) {
           // auth above belongs to, plus the model fallback. The adapter applies nothing for a provider
           // the hint does not name, so without this passthrough `runtimeEnv` arrives and is ignored -
           // a managed node then has no inference auth at all and falls through to whatever provider the
-          // runtime defaults to. Read through a narrow cast because the field is not in the published
-          // `@dahrk/contracts` (^0.4.0) yet; this line and `readAuthHint` are the only two seams, and
-          // both drop the cast when contracts ships.
+          // runtime defaults to. A plain typed read since `@dahrk/contracts` declares `runtimeAuth` on
+          // both `JobRequest` and `RunnerContext`.
           ...job.runtimeAuth ? { runtimeAuth: job.runtimeAuth } : {},
           // The adapter persists each runtime-native record under the attempt's raw/ sidecar
           // and stamps the rawRef onto the emitted event.
@@ -4310,7 +4582,7 @@ function createStageRunner(deps) {
             })
           } : {}
         };
-        const interactive = agentConfig.interaction === "interactive";
+        const interactive = agentConfig?.interaction === "interactive";
         let result;
         let timedOut = false;
         const killMs = Math.max(0, Math.floor((job.timeout ?? 0) * 1e3));
@@ -4321,7 +4593,7 @@ function createStageRunner(deps) {
         let stalled = false;
         let stallTimer;
         const stallSource = agentConfig.stallMs ?? Number(process.env.DAHRK_BATCH_STALL_MS ?? process.env.SKAKEL_BATCH_STALL_MS ?? 3e5);
-        const stallMs = interactive ? 0 : Math.max(0, Math.floor(stallSource));
+        const stallMs = interactive || isCheck ? 0 : Math.max(0, Math.floor(stallSource));
         if (stallMs > 0) {
           bumpStall = () => {
             if (stallTimer) clearTimeout(stallTimer);
@@ -4348,16 +4620,16 @@ function createStageRunner(deps) {
         if (status === "ok" && escapedUnblocked) {
           status = "fail";
           const msg = `stage reached outside the run's worktree and the ${runtime} runtime could not block it before it ran`;
-          writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime, kind: "fs-confine-escape", message: msg });
+          writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: traceRuntime, kind: "fs-confine-escape", message: msg });
           deps.sendProgress({ jobId, kind: "error", ts: nowIso2(), text: msg });
         }
         if (status === "ok" && job.hooks && job.hooks.length > 0) {
           for (const cmd of job.hooks) {
             try {
-              execFileSync5("sh", ["-c", cmd], { cwd: ref.worktreePath, stdio: ["pipe", "pipe", "pipe"] });
+              execFileSync6("sh", ["-c", cmd], { cwd: ref.worktreePath, stdio: ["pipe", "pipe", "pipe"] });
             } catch (e) {
               status = "fail";
-              writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime, kind: "hook-failed", message: `hook "${cmd}" failed: ${e.message}` });
+              writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: traceRuntime, kind: "hook-failed", message: `hook "${cmd}" failed: ${e.message}` });
               break;
             }
           }
@@ -4374,7 +4646,16 @@ function createStageRunner(deps) {
         }
         if (denied) summary += "\n\n(note: one or more tool actions were blocked by a deny-only policy guard.)";
         const failureClass = timedOut || stalled ? "harness" : result.failureClass;
-        return finish(status, summary, result.sessionId ?? job.sessionId, result.costUsd, result.artifact, failureClass);
+        if (isCheck && ref) writeCheckNote(ref, stageId, attempt, checkOutcomes);
+        return finish(
+          status,
+          summary,
+          result.sessionId ?? job.sessionId,
+          result.costUsd,
+          result.artifact,
+          failureClass,
+          result.verifications
+        );
       } finally {
         inFlight.set(runId, Math.max(0, (inFlight.get(runId) ?? 1) - 1));
       }
@@ -4461,6 +4742,7 @@ function createStageRunner(deps) {
 var ENROLMENT_REJECTED_EXIT_CODE = 78;
 var RECONNECT_BASE_MS = 500;
 var RECONNECT_MAX_MS = 3e4;
+var NODE_CAPABILITIES = ["check"];
 var PARK_POLL_MS = 6e4;
 function classifyError(e) {
   const msg = e instanceof Error ? e.message : String(e);
@@ -4644,6 +4926,12 @@ async function startEdgeNode(opts) {
       os: osPlatform(),
       arch: osArch(),
       clientVersion: opts.clientVersion ?? "0.0.0",
+      // Non-runtime job kinds this build can execute. The hub REFUSES to place a check job on a node
+      // that does not advertise `check`, and that refusal is a safety gate rather than an optimisation:
+      // `makeRunner()` defaults to Claude rather than erroring on an unknown job shape, so an old client
+      // handed a check job would boot an unbounded write-access agent with the fallback instruction
+      // "Begin the stage.", report ok, and let the run reach deliver green having run no checks.
+      capabilities: NODE_CAPABILITIES,
       // Advertise the resolved worktree base so the hub records each run's real worktree location in
       // the projection instead of an advisory placeholder. Single-sourced from the git service so it
       // always matches where worktrees actually land.
@@ -4976,7 +5264,7 @@ var PROBES = [
   { runtime: "claude-code", cmd: "claude" },
   { runtime: "pi", cmd: "pi" }
 ];
-var DEFAULT_TIMEOUT_MS = 5e3;
+var DEFAULT_TIMEOUT_MS3 = 5e3;
 var DEFAULT_ATTEMPTS = 2;
 function probeOnce(cmd, timeoutMs) {
   return new Promise((resolve3) => {
@@ -4998,14 +5286,14 @@ async function probe(cmd, timeoutMs, attempts) {
   }
   return void 0;
 }
-async function probeRuntimeStatuses(timeoutMs = DEFAULT_TIMEOUT_MS, attempts = DEFAULT_ATTEMPTS) {
+async function probeRuntimeStatuses(timeoutMs = DEFAULT_TIMEOUT_MS3, attempts = DEFAULT_ATTEMPTS) {
   const versions = await Promise.all(PROBES.map((p) => probe(p.cmd, timeoutMs, attempts)));
   return PROBES.map((p, i) => {
     const version = versions[i];
     return version === void 0 ? { runtime: p.runtime, cmd: p.cmd, installed: false } : { runtime: p.runtime, cmd: p.cmd, installed: true, version };
   });
 }
-async function detectRuntimes(timeoutMs = DEFAULT_TIMEOUT_MS, attempts = DEFAULT_ATTEMPTS) {
+async function detectRuntimes(timeoutMs = DEFAULT_TIMEOUT_MS3, attempts = DEFAULT_ATTEMPTS) {
   const statuses = await probeRuntimeStatuses(timeoutMs, attempts);
   return statuses.filter((s) => s.installed).map((s) => s.runtime);
 }
@@ -5611,8 +5899,8 @@ function usage(bin, command) {
 }
 
 // src/diagnose.ts
-import { existsSync as existsSync8, mkdirSync as mkdirSync8, readdirSync as readdirSync4, readFileSync as readFileSync6, statSync as statSync3, writeFileSync as writeFileSync8 } from "fs";
-import { join as join14 } from "path";
+import { existsSync as existsSync9, mkdirSync as mkdirSync9, readdirSync as readdirSync4, readFileSync as readFileSync7, statSync as statSync3, writeFileSync as writeFileSync9 } from "fs";
+import { join as join15 } from "path";
 
 // src/ui.ts
 import { styleText } from "util";
@@ -5727,7 +6015,7 @@ async function buildBundle(deps) {
   if (deps.exists(deps.crashDir)) {
     for (const name of deps.listDir(deps.crashDir).filter((f) => f.endsWith(".json")).sort()) {
       try {
-        crashes.push(JSON.parse(deps.readFile(join14(deps.crashDir, name))));
+        crashes.push(JSON.parse(deps.readFile(join15(deps.crashDir, name))));
       } catch (e) {
         warnings.push(`could not read crash record ${name} (${e.message})`);
       }
@@ -5784,18 +6072,18 @@ var defaultDiagnoseDeps = (paths, clientVersion, doctor) => ({
   ...paths,
   clientVersion,
   ...doctor ? { doctor } : {},
-  readFile: (p) => readFileSync6(p, "utf8"),
+  readFile: (p) => readFileSync7(p, "utf8"),
   listDir: (p) => readdirSync4(p),
-  exists: (p) => existsSync8(p),
+  exists: (p) => existsSync9(p),
   writeFile: (p, content) => {
-    const dir = join14(p, "..");
-    if (!existsSync8(dir)) mkdirSync8(dir, { recursive: true });
-    writeFileSync8(p, content, { mode: 384 });
+    const dir = join15(p, "..");
+    if (!existsSync9(dir)) mkdirSync9(dir, { recursive: true });
+    writeFileSync9(p, content, { mode: 384 });
   },
   out
 });
 function defaultBundlePath(cwd, now) {
-  return join14(cwd, `dahrk-diagnose-${now.toISOString().replace(/[:.]/g, "-")}.json`);
+  return join15(cwd, `dahrk-diagnose-${now.toISOString().replace(/[:.]/g, "-")}.json`);
 }
 
 // src/doctor.ts
@@ -5929,7 +6217,7 @@ async function runDoctor(inputs, deps = {}) {
 }
 
 // src/repo-add.ts
-import { createHash as createHash4 } from "crypto";
+import { createHash as createHash5 } from "crypto";
 var stripRepoSuffix = (s) => s.replace(/\.git$/i, "").replace(/\/+$/, "");
 function splitOwnerRepo(path) {
   const parts = stripRepoSuffix(path).split("/").filter(Boolean);
@@ -5967,7 +6255,7 @@ var deriveRepoName = (remote) => remote.repo;
 function deriveRepoId(gitUrl) {
   const parsed = parseGitRemote(gitUrl);
   const canonical2 = parsed ? `${parsed.host}/${parsed.owner}/${parsed.repo}`.toLowerCase() : gitUrl.trim().toLowerCase();
-  const hash = createHash4("sha256").update(canonical2).digest("hex").slice(0, 12);
+  const hash = createHash5("sha256").update(canonical2).digest("hex").slice(0, 12);
   const slug = (parsed ? parsed.repo : "repo").toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "") || "repo";
   return `${slug}-${hash}`;
 }
@@ -6015,8 +6303,8 @@ async function registerRepo(deps, args) {
 }
 
 // src/lock.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync9, readFileSync as readFileSync7, rmSync as rmSync7, writeFileSync as writeFileSync9 } from "fs";
-import { dirname as dirname6 } from "path";
+import { existsSync as existsSync10, mkdirSync as mkdirSync10, readFileSync as readFileSync8, rmSync as rmSync7, writeFileSync as writeFileSync10 } from "fs";
+import { dirname as dirname7 } from "path";
 function parseLock(content) {
   if (!content) return void 0;
   const pid = Number(content.trim());
@@ -6048,22 +6336,22 @@ var defaultLockDeps = (file) => ({
   pid: process.pid,
   readFile: (path) => {
     try {
-      return readFileSync7(path, "utf8");
+      return readFileSync8(path, "utf8");
     } catch {
       return void 0;
     }
   },
   writeFile: (path, content) => {
-    if (!existsSync9(dirname6(path))) mkdirSync9(dirname6(path), { recursive: true, mode: 448 });
-    writeFileSync9(path, content);
+    if (!existsSync10(dirname7(path))) mkdirSync10(dirname7(path), { recursive: true, mode: 448 });
+    writeFileSync10(path, content);
   },
   removeFile: (path) => rmSync7(path, { force: true }),
   isAlive
 });
 
 // src/logs.ts
-import { spawn } from "child_process";
-import { copyFileSync, existsSync as existsSync10, readFileSync as readFileSync8, statSync as statSync4, truncateSync } from "fs";
+import { spawn as spawn2 } from "child_process";
+import { copyFileSync, existsSync as existsSync11, readFileSync as readFileSync9, statSync as statSync4, truncateSync } from "fs";
 var MAX_LOG_BYTES = 10 * 1024 * 1024;
 function logsCommand(inputs) {
   return [
@@ -6144,7 +6432,7 @@ async function runStructuredLogs(inputs, deps) {
 }
 function rotateIfLarge(file, maxBytes = MAX_LOG_BYTES) {
   try {
-    if (!existsSync10(file) || statSync4(file).size <= maxBytes) return;
+    if (!existsSync11(file) || statSync4(file).size <= maxBytes) return;
     copyFileSync(file, `${file}.1`);
     truncateSync(file, 0);
   } catch {
@@ -6153,11 +6441,11 @@ function rotateIfLarge(file, maxBytes = MAX_LOG_BYTES) {
 var defaultLogsDeps = (files, jsonlFile) => ({
   files,
   jsonlFile,
-  fileExists: (path) => existsSync10(path),
-  readFile: (path) => readFileSync8(path, "utf8"),
+  fileExists: (path) => existsSync11(path),
+  readFile: (path) => readFileSync9(path, "utf8"),
   run: (argv) => new Promise((resolve3) => {
     const [cmd, ...args] = argv;
-    const child = spawn(cmd, args, { stdio: "inherit" });
+    const child = spawn2(cmd, args, { stdio: "inherit" });
     child.on("error", () => resolve3(1));
     child.on("close", (code) => resolve3(code ?? 0));
   }),
@@ -6165,13 +6453,13 @@ var defaultLogsDeps = (files, jsonlFile) => ({
 });
 
 // src/process-safety.ts
-import { mkdirSync as mkdirSync10, writeFileSync as writeFileSync10 } from "fs";
-import { join as join15 } from "path";
+import { mkdirSync as mkdirSync11, writeFileSync as writeFileSync11 } from "fs";
+import { join as join16 } from "path";
 function writeCrashRecord(dir, record) {
   try {
-    mkdirSync10(dir, { recursive: true, mode: 448 });
-    const file = join15(dir, `${record.at.replace(/[:.]/g, "-")}.json`);
-    writeFileSync10(file, `${JSON.stringify(record, null, 2)}
+    mkdirSync11(dir, { recursive: true, mode: 448 });
+    const file = join16(dir, `${record.at.replace(/[:.]/g, "-")}.json`);
+    writeFileSync11(file, `${JSON.stringify(record, null, 2)}
 `, { mode: 384 });
     return file;
   } catch {
@@ -6224,11 +6512,11 @@ function installProcessSafetyNet(opts) {
 }
 
 // src/preflight.ts
-import { execFileSync as execFileSync6 } from "child_process";
+import { execFileSync as execFileSync7 } from "child_process";
 import { randomUUID as randomUUID2 } from "crypto";
-import { accessSync, constants as fsConstants, existsSync as existsSync11, readdirSync as readdirSync5, statfsSync as statfsSync2 } from "fs";
+import { accessSync, constants as fsConstants, existsSync as existsSync12, readdirSync as readdirSync5, statfsSync as statfsSync2 } from "fs";
 import { homedir as homedir4 } from "os";
-import { join as join16 } from "path";
+import { join as join17 } from "path";
 var REPORT_BASE_URL = "https://app.dahrk.ai/r";
 var LOW_DISK_BYTES = 512 * 1024 * 1024;
 var PREFLIGHT_STAGES = [
@@ -6359,7 +6647,7 @@ var defaultDeps2 = () => ({
 });
 function commandPresent(cmd) {
   try {
-    execFileSync6("sh", ["-c", `command -v ${cmd}`], { stdio: "ignore" });
+    execFileSync7("sh", ["-c", `command -v ${cmd}`], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -6367,12 +6655,12 @@ function commandPresent(cmd) {
 }
 function sshKeyPresent() {
   try {
-    const dir = join16(homedir4(), ".ssh");
-    if (existsSync11(dir) && readdirSync5(dir).some((f) => f.endsWith(".pub"))) return true;
+    const dir = join17(homedir4(), ".ssh");
+    if (existsSync12(dir) && readdirSync5(dir).some((f) => f.endsWith(".pub"))) return true;
   } catch {
   }
   try {
-    execFileSync6("ssh-add", ["-l"], { stdio: "ignore" });
+    execFileSync7("ssh-add", ["-l"], { stdio: "ignore" });
     return true;
   } catch {
     return false;
@@ -6387,12 +6675,12 @@ function writable(dir) {
   }
 }
 function worktreeRoot(env) {
-  return env.DAHRK_WORKTREES_DIR ?? join16(env.DAHRK_STATE_DIR ?? join16(homedir4(), ".dahrk"), "worktrees");
+  return env.DAHRK_WORKTREES_DIR ?? join17(env.DAHRK_STATE_DIR ?? join17(homedir4(), ".dahrk"), "worktrees");
 }
 function nearestExisting(dir) {
   let cur = dir;
-  while (!existsSync11(cur)) {
-    const parent = join16(cur, "..");
+  while (!existsSync12(cur)) {
+    const parent = join17(cur, "..");
     if (parent === cur) break;
     cur = parent;
   }
@@ -6407,7 +6695,7 @@ function freeDiskBytes(dir) {
   }
 }
 function probeRepo(repoPath) {
-  const git = (args) => execFileSync6("git", ["-C", repoPath, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
+  const git = (args) => execFileSync7("git", ["-C", repoPath, ...args], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
   try {
     if (git(["rev-parse", "--is-inside-work-tree"]) !== "true") {
       return { path: repoPath, isGitRepo: false, headResolves: false, detail: "not inside a work tree" };
@@ -6453,15 +6741,15 @@ function gatherHostFacts(repoPath) {
 }
 
 // src/service.ts
-import { execFileSync as execFileSync7 } from "child_process";
-import { chmodSync as chmodSync3, existsSync as existsSync13, mkdirSync as mkdirSync12, readFileSync as readFileSync10, realpathSync as realpathSync3, rmSync as rmSync8, writeFileSync as writeFileSync12 } from "fs";
+import { execFileSync as execFileSync8 } from "child_process";
+import { chmodSync as chmodSync3, existsSync as existsSync14, mkdirSync as mkdirSync13, readFileSync as readFileSync11, realpathSync as realpathSync3, rmSync as rmSync8, writeFileSync as writeFileSync13 } from "fs";
 import { homedir as homedir6, platform as osPlatform3, userInfo } from "os";
-import { join as join18 } from "path";
+import { join as join19 } from "path";
 
 // src/state.ts
-import { chmodSync as chmodSync2, existsSync as existsSync12, mkdirSync as mkdirSync11, readFileSync as readFileSync9, writeFileSync as writeFileSync11 } from "fs";
+import { chmodSync as chmodSync2, existsSync as existsSync13, mkdirSync as mkdirSync12, readFileSync as readFileSync10, writeFileSync as writeFileSync12 } from "fs";
 import { homedir as homedir5 } from "os";
-import { join as join17 } from "path";
+import { join as join18 } from "path";
 var RUNTIMES = ["claude-code", "codex", "pi"];
 var isRuntime = (v) => RUNTIMES.includes(v);
 var STRING_FIELDS = ["nodeId", "enrolToken", "name", "tenantId", "updateCheckedAt", "updateLatest"];
@@ -6469,37 +6757,37 @@ var isDesired = (v) => v === "running" || v === "stopped";
 var FILE_MODE2 = 384;
 var DIR_MODE2 = 448;
 function stateDir(env) {
-  return env.DAHRK_STATE_DIR ?? join17(homedir5(), ".dahrk");
+  return env.DAHRK_STATE_DIR ?? join18(homedir5(), ".dahrk");
 }
 function legacyStateDir(env) {
-  return env.DAHRK_STATE_DIR ? void 0 : join17(homedir5(), ".skakel");
+  return env.DAHRK_STATE_DIR ? void 0 : join18(homedir5(), ".skakel");
 }
 function stateFile(env) {
-  return join17(stateDir(env), "node.json");
+  return join18(stateDir(env), "node.json");
 }
 function logDir(env) {
-  return join17(stateDir(env), "logs");
+  return join18(stateDir(env), "logs");
 }
 function logFiles(env) {
   const dir = logDir(env);
-  return { out: join17(dir, "node.out.log"), err: join17(dir, "node.err.log") };
+  return { out: join18(dir, "node.out.log"), err: join18(dir, "node.err.log") };
 }
 function jsonlLogFile(env) {
-  return join17(logDir(env), "node.jsonl");
+  return join18(logDir(env), "node.jsonl");
 }
 function crashDir(env) {
-  return join17(logDir(env), "crashes");
+  return join18(logDir(env), "crashes");
 }
 function lockFile(env) {
-  return join17(stateDir(env), "node.pid");
+  return join18(stateDir(env), "node.pid");
 }
 function setDesired(env, desired) {
   writeState(env, { desired });
 }
 function readState(file) {
-  if (!existsSync12(file)) return {};
+  if (!existsSync13(file)) return {};
   try {
-    const parsed = JSON.parse(readFileSync9(file, "utf8"));
+    const parsed = JSON.parse(readFileSync10(file, "utf8"));
     const state = {};
     for (const key of STRING_FIELDS) {
       const value = parsed[key];
@@ -6519,9 +6807,9 @@ function writeState(env, patch) {
   const dir = stateDir(env);
   const file = stateFile(env);
   try {
-    mkdirSync11(dir, { recursive: true, mode: DIR_MODE2 });
+    mkdirSync12(dir, { recursive: true, mode: DIR_MODE2 });
     const next = { ...readState(file), ...patch };
-    writeFileSync11(file, `${JSON.stringify(next, null, 2)}
+    writeFileSync12(file, `${JSON.stringify(next, null, 2)}
 `, { mode: FILE_MODE2 });
     chmodSync2(file, FILE_MODE2);
   } catch (e) {
@@ -6602,9 +6890,9 @@ ${envEntries}
   <key>ThrottleInterval</key>
   <integer>10</integer>
   <key>StandardOutPath</key>
-  <string>${xmlEscape(join18(inputs.logDir, "node.out.log"))}</string>
+  <string>${xmlEscape(join19(inputs.logDir, "node.out.log"))}</string>
   <key>StandardErrorPath</key>
-  <string>${xmlEscape(join18(inputs.logDir, "node.err.log"))}</string>
+  <string>${xmlEscape(join19(inputs.logDir, "node.err.log"))}</string>
 </dict>
 </plist>
 `;
@@ -6627,8 +6915,8 @@ Type=simple
 ExecStart=${exec}
 ${envLines}
 WorkingDirectory=${inputs.homeDir}
-StandardOutput=append:${join18(inputs.logDir, "node.out.log")}
-StandardError=append:${join18(inputs.logDir, "node.err.log")}
+StandardOutput=append:${join19(inputs.logDir, "node.out.log")}
+StandardError=append:${join19(inputs.logDir, "node.err.log")}
 Restart=on-failure
 RestartSec=3
 RestartPreventExitStatus=78
@@ -6639,7 +6927,7 @@ WantedBy=default.target
 }
 function buildPlan(inputs) {
   if (inputs.manager === "launchd") {
-    const filePath2 = join18(inputs.homeDir, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
+    const filePath2 = join19(inputs.homeDir, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`);
     return {
       manager: "launchd",
       label: LAUNCHD_LABEL,
@@ -6656,7 +6944,7 @@ function buildPlan(inputs) {
       logHint: "dahrk logs -f"
     };
   }
-  const filePath = join18(inputs.homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
+  const filePath = join19(inputs.homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
   const user = userInfo().username;
   return {
     manager: "systemd",
@@ -6686,7 +6974,7 @@ function unitIsCurrent(plan, onDisk) {
   return onDisk === plan.content;
 }
 function unitPath(manager, homeDir) {
-  return manager === "launchd" ? join18(homeDir, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`) : join18(homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
+  return manager === "launchd" ? join19(homeDir, "Library", "LaunchAgents", `${LAUNCHD_LABEL}.plist`) : join19(homeDir, ".config", "systemd", "user", SYSTEMD_UNIT);
 }
 function statusCommand(manager) {
   return manager === "launchd" ? ["launchctl", "list", LAUNCHD_LABEL] : ["systemctl", "--user", "show", SYSTEMD_UNIT, "-p", "ActiveState", "-p", "MainPID"];
@@ -6983,29 +7271,29 @@ var defaultDeps3 = () => ({
   // Snapshot the operator's PATH at install time so the daemon finds git + the runtime CLIs (Homebrew /
   // npm-global bins) that a supervisor's minimal PATH would otherwise hide.
   pathEnv: process.env.PATH,
-  mkdirp: (dir) => void mkdirSync12(dir, { recursive: true }),
+  mkdirp: (dir) => void mkdirSync13(dir, { recursive: true }),
   // The unit holds no secret any more, but it stays owner-only: it names paths on this host, and there is
   // no reason for it to be world-readable. `writeFileSync`'s `mode` applies only when it CREATES the file,
   // so chmod explicitly too - re-installing over a unit an older client left at 0644 must tighten it.
   writeFile: (path, content) => {
-    writeFileSync12(path, content, { mode: UNIT_FILE_MODE });
+    writeFileSync13(path, content, { mode: UNIT_FILE_MODE });
     chmodSync3(path, UNIT_FILE_MODE);
   },
   readFile: (path) => {
     try {
-      return readFileSync10(path, "utf8");
+      return readFileSync11(path, "utf8");
     } catch {
       return void 0;
     }
   },
   removeFile: (path) => rmSync8(path, { force: true }),
-  fileExists: (path) => existsSync13(path),
+  fileExists: (path) => existsSync14(path),
   // Captured, never inherited. A supervisor's stderr is ours to relay when it matters, not to leak
   // unconditionally: `runCommands` decides who needs to read it.
   run: (argv) => {
     const [cmd, ...args] = argv;
     try {
-      const stdout = execFileSync7(cmd, args, {
+      const stdout = execFileSync8(cmd, args, {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "pipe"]
       });
@@ -7020,7 +7308,7 @@ var defaultDeps3 = () => ({
   capture: (argv) => {
     const [cmd, ...args] = argv;
     try {
-      const stdout = execFileSync7(cmd, args, {
+      const stdout = execFileSync8(cmd, args, {
         encoding: "utf8",
         stdio: ["ignore", "pipe", "ignore"]
       });
@@ -7034,7 +7322,7 @@ var defaultDeps3 = () => ({
 });
 
 // src/update.ts
-import { execFileSync as execFileSync8 } from "child_process";
+import { execFileSync as execFileSync9 } from "child_process";
 import { realpathSync as realpathSync4 } from "fs";
 var LATEST_URL = "https://registry.npmjs.org/dahrk-node/latest";
 var CHANNEL_COMMANDS = {
@@ -7166,7 +7454,7 @@ async function fetchLatestVersion(signal) {
 function spawnUpgrade(argv) {
   const [cmd, ...args] = argv;
   try {
-    const stdout = execFileSync8(cmd, args, {
+    const stdout = execFileSync9(cmd, args, {
       encoding: "utf8",
       stdio: ["ignore", "pipe", "pipe"]
     });
@@ -7439,7 +7727,7 @@ async function runStatus(inputs, deps) {
 }
 
 // src/main.ts
-var CLIENT_VERSION = "0.1.24";
+var CLIENT_VERSION = "0.1.26";
 var DEFAULT_HUB_URL = "wss://api.dahrk.ai";
 var list = (v) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
 var RUNTIMES2 = ["claude-code", "codex", "pi"];
@@ -7451,7 +7739,7 @@ function resolveNodeId(env, opts = {}) {
   if (existing) return existing;
   const legacy = legacyStateDir(env);
   if (legacy) {
-    const legacyId = readState(join19(legacy, "node.json")).nodeId;
+    const legacyId = readState(join20(legacy, "node.json")).nodeId;
     if (legacyId) return legacyId;
   }
   const nodeId = randomUUID3();
@@ -7719,11 +8007,11 @@ function statusDeps(env) {
       }
       return probeRuntimeStatuses();
     },
-    fileExists: (path) => existsSync14(path),
+    fileExists: (path) => existsSync15(path),
     capture: (argv) => {
       const [cmd, ...args] = argv;
       try {
-        const stdout = execFileSync9(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+        const stdout = execFileSync10(cmd, args, { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
         return { code: 0, stdout };
       } catch (e) {
         const status = e.status;
@@ -7748,7 +8036,7 @@ function statusDeps(env) {
 }
 function readFileOrUndefined(path) {
   try {
-    return readFileSync11(path, "utf8");
+    return readFileSync12(path, "utf8");
   } catch {
     return void 0;
   }