dahrk-node 0.1.25 → 0.1.26

package/dist/main.js

@@ -245,12 +245,12 @@ function documentsBlock(ctx) {
     const truncated = body.length > cap;
     const excerpt = truncated ? body.slice(0, cap) : body;
     budget -= excerpt.length;
-    const tail2 = truncated ? `
+    const tail3 = truncated ? `
 ...(truncated; full text at ${path})` : "";
     const title = doc.title.replace(/[<>"]/g, "'");
     parts.push(
       `<document title="${title}" file="${path}">
-${neutraliseDelimiters(excerpt)}${tail2}
+${neutraliseDelimiters(excerpt)}${tail3}
 </document>`
     );
     if (budget <= 0) break;
@@ -303,6 +303,18 @@ ${neutraliseGateFeedbackDelimiters(content)}
 ${parts.join("\n")}
 </gate-feedback>`;
 }
+function checkFailuresBlock(ctx) {
+  const failures = ctx.checkFailures;
+  if (!failures) return "";
+  const { stageId, attempt, verifications } = failures;
+  if (verifications.length === 0) return "";
+  const safeStage = stageId.replace(/[^A-Za-z0-9._-]/g, "-");
+  const rows = verifications.map((v) => `  ${v.name}: ${v.status === "failed" ? "FAILED" : v.status}`).join("\n");
+  return `<check-failures stage="${stageId.replace(/[<>"]/g, "'")}" attempt="${attempt}">
+${rows}
+  Full output: .dahrk/scratch/checks/${safeStage}-${attempt}.md
+</check-failures>`;
+}
 function resolveStagePrompt(ctx) {
   const instruction = stageInstruction(ctx);
   const ticket = ctx.issueContext?.trim() ? `<ticket>
@@ -311,14 +323,15 @@ ${ctx.issueContext.trim()}
   const guidance = guidanceBlock(ctx);
   const gateFeedback = gateFeedbackBlock(ctx);
   const docs = documentsBlock(ctx);
-  const preamble = [ticket, guidance, gateFeedback, docs].filter(Boolean).join("\n\n");
+  const checkFailures = checkFailuresBlock(ctx);
+  const preamble = [ticket, guidance, gateFeedback, docs, checkFailures].filter(Boolean).join("\n\n");
   return preamble ? `${preamble}
 
 ${instruction}` : instruction;
 }
 function hasSystemPrompt(ctx) {
   return Boolean(
-    ctx.config.prompt || ctx.config.promptFile || ctx.issueContext?.trim() || ctx.guidance && ctx.guidance.length > 0 || ctx.gateFeedback && ctx.gateFeedback.length > 0 || ctx.attachedDocuments && ctx.attachedDocuments.length > 0
+    ctx.config.prompt || ctx.config.promptFile || ctx.issueContext?.trim() || ctx.guidance && ctx.guidance.length > 0 || ctx.gateFeedback && ctx.gateFeedback.length > 0 || Boolean(ctx.checkFailures) || ctx.attachedDocuments && ctx.attachedDocuments.length > 0
   );
 }
 var OPENING_KICKOFF = "Begin now. Using the ticket context and your instructions already provided, ask the human your first question. Do not wait for further input before sending your first message.";
@@ -2617,6 +2630,169 @@ function runRepoSetup(opts) {
   }
 }
 
+// ../../packages/executor-worktree/src/check-runner.ts
+import { spawn } from "child_process";
+var DEFAULT_TIMEOUT_MS2 = 6e5;
+var OUTPUT_CAP2 = 16384;
+function tail2(output) {
+  return output.length > OUTPUT_CAP2 ? output.slice(output.length - OUTPUT_CAP2) : output;
+}
+async function runOne(check, cwd, startedAt) {
+  const timeoutMs = (check.timeoutSeconds ?? DEFAULT_TIMEOUT_MS2 / 1e3) * 1e3;
+  return await new Promise((resolve3) => {
+    let chunks = "";
+    let timedOut = false;
+    let settled = false;
+    const child = spawn("sh", ["-c", check.command], { cwd, env: process.env, stdio: ["ignore", "pipe", "pipe"] });
+    const append = (buf) => {
+      chunks = tail2(chunks + buf.toString("utf8"));
+    };
+    child.stdout?.on("data", append);
+    child.stderr?.on("data", append);
+    const timer = setTimeout(() => {
+      timedOut = true;
+      child.kill("SIGKILL");
+    }, timeoutMs);
+    const settle = (exitCode) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      resolve3({
+        name: check.name,
+        command: check.command,
+        exitCode,
+        output: chunks,
+        status: exitCode === 0 ? "passed" : "failed",
+        durationMs: Date.now() - startedAt,
+        timedOut
+      });
+    };
+    child.on("close", (code) => settle(code));
+    child.on("error", (err) => {
+      chunks = tail2(`${chunks}
+check could not start: ${err.message}`);
+      settle(null);
+    });
+  });
+}
+function summariseChecks(outcomes) {
+  const failed = outcomes.filter((o) => o.status === "failed");
+  const skipped = outcomes.filter((o) => o.status === "skipped");
+  if (outcomes.length === 0) return "no checks declared";
+  const suffix = skipped.length > 0 ? `; ${skipped.length} not run` : "";
+  if (failed.length === 0) return `all ${outcomes.length} checks passed${suffix}`;
+  return `${failed.length} of ${outcomes.length} checks failed: ${failed.map((o) => o.name).join(", ")}${suffix}`;
+}
+function createCheckRunner(checks, onOutcomes) {
+  let cancelled = false;
+  let lastSummary = "";
+  return {
+    // A check stage runs no agent, so claiming an agent runtime here would corrupt the trace record
+    // the optimiser and the observability CLI both read.
+    runtime: "check",
+    async runBatch(ctx, onTrace) {
+      const cwd = ctx.workspace.worktreePath;
+      const outcomes = [];
+      let seq = 0;
+      for (const check of checks) {
+        if (cancelled) {
+          outcomes.push({
+            name: check.name,
+            command: check.command,
+            exitCode: null,
+            output: "",
+            status: "skipped",
+            durationMs: 0,
+            timedOut: false
+          });
+          continue;
+        }
+        onTrace({
+          seq: seq++,
+          runtime: "check",
+          type: "action",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          tool: "check",
+          toolUseId: check.name,
+          input: { name: check.name, command: check.command }
+        });
+        const outcome = await runOne(check, cwd, Date.now());
+        outcomes.push(outcome);
+        onTrace({
+          seq: seq++,
+          runtime: "check",
+          type: "observation",
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          toolUseId: check.name,
+          isError: outcome.status === "failed",
+          output: {
+            name: outcome.name,
+            exitCode: outcome.exitCode,
+            timedOut: outcome.timedOut,
+            durationMs: outcome.durationMs,
+            output: outcome.output
+          }
+        });
+      }
+      lastSummary = summariseChecks(outcomes);
+      onTrace({
+        seq: seq++,
+        runtime: "check",
+        type: "response",
+        ts: (/* @__PURE__ */ new Date()).toISOString(),
+        text: lastSummary
+      });
+      onOutcomes?.(outcomes);
+      const verifications = outcomes.map((o) => ({ name: o.name, status: o.status }));
+      const anyFailed = outcomes.some((o) => o.status === "failed");
+      return {
+        status: cancelled ? "timeout" : anyFailed ? "fail" : "ok",
+        verifications
+      };
+    },
+    async runInteractive() {
+      throw new Error("a check stage cannot be interactive");
+    },
+    /** Deterministic, and free: no model is asked to describe a lint run. */
+    async summarise() {
+      return lastSummary || summariseChecks([]);
+    },
+    async cancel() {
+      cancelled = true;
+    }
+  };
+}
+var CHECK_NOTE_CAP_BYTES = 64 * 1024;
+var safeStageSegment = (stageId) => stageId.replace(/[^A-Za-z0-9._-]/g, "-");
+function renderCheckNote(stageId, attempt, outcomes) {
+  const failed = outcomes.filter((o) => o.status === "failed");
+  const head = `# checks/${stageId} (attempt ${attempt}) - ${failed.length === 0 ? "PASSED" : "FAILED"}
+
+${summariseChecks(outcomes)}
+`;
+  const ordered = [...outcomes].sort((a, b) => Number(b.status === "failed") - Number(a.status === "failed"));
+  let body = "";
+  let budget = CHECK_NOTE_CAP_BYTES - head.length;
+  for (const o of ordered) {
+    const verdict2 = o.status === "skipped" ? "not run (the stage was cancelled before it started)" : o.timedOut ? `TIMED OUT after ${Math.round(o.durationMs / 1e3)}s` : `exit ${o.exitCode}`;
+    const header = `
+## ${o.name} - ${o.status} (${verdict2})
+
+$ ${o.command}
+`;
+    const output = o.output.trim();
+    const includeOutput = output.length > 0 && (o.status === "failed" || header.length + output.length < budget);
+    const chunk = includeOutput ? `${header}
+\`\`\`
+${output}
+\`\`\`
+` : header;
+    body += chunk;
+    budget -= chunk.length;
+  }
+  return head + body;
+}
+
 // ../../packages/executor-worktree/src/index.ts
 function makeRunner(runtime) {
   if ((process.env.DAHRK_RUNNER ?? process.env.SKAKEL_RUNNER ?? "real") === "mock") return createMockRunner(runtime);
@@ -3103,7 +3279,7 @@ import { createHash as createHash4 } from "crypto";
 import { mkdirSync as mkdirSync8, readdirSync as readdirSync3, readFileSync as readFileSync6, rmSync as rmSync6, writeFileSync as writeFileSync8 } from "fs";
 import { tmpdir as tmpdir5 } from "os";
 import { isAbsolute as isAbsolute3, join as join14, relative as relative3, resolve as resolve2, sep as sep3 } from "path";
-import { attachedDocBasename as attachedDocBasename2 } from "@dahrk/contracts";
+import { attachedDocBasename as attachedDocBasename2, isCheckJob } from "@dahrk/contracts";
 
 // ../../packages/edge/src/builtins.ts
 import { execFileSync as execFileSync5 } from "child_process";
@@ -3124,16 +3300,16 @@ function expandPath(raw, cwd) {
 }
 function realish(p) {
   let head = p;
-  const tail2 = [];
+  const tail3 = [];
   while (head !== dirname6(head)) {
     if (existsSync8(head)) {
       try {
-        return join13(realpathSync2.native(head), ...tail2.reverse());
+        return join13(realpathSync2.native(head), ...tail3.reverse());
       } catch {
         return p;
       }
     }
-    tail2.push(head.slice(dirname6(head).length + 1));
+    tail3.push(head.slice(dirname6(head).length + 1));
     head = dirname6(head);
   }
   return p;
@@ -3920,6 +4096,15 @@ function writeGuidance(ref, guidance) {
   } catch {
   }
 }
+function writeCheckNote(ref, stageId, attempt, outcomes) {
+  if (outcomes.length === 0) return;
+  try {
+    const dir = join14(ref.scratchPath, "checks");
+    mkdirSync8(dir, { recursive: true });
+    writeFileSync8(join14(dir, `${safeStageSegment(stageId)}-${attempt}.md`), renderCheckNote(stageId, attempt, outcomes));
+  } catch {
+  }
+}
 var ARTIFACT_CAP_BYTES = 64 * 1024;
 var SCRATCH_OUTPUT_DIR = ".dahrk/scratch/output";
 function capContent(raw) {
@@ -4068,7 +4253,10 @@ function createStageRunner(deps) {
       return reaper.reap(reaperDryRun ? { dryRun: true } : {});
     },
     async runJob(job) {
-      const { stageId, jobId, runId, agentConfig } = job;
+      const { stageId, jobId, runId } = job;
+      const isCheck = isCheckJob(job);
+      const agentConfig = job.agentConfig;
+      const traceRuntime = isCheck ? "check" : agentConfig.runtime;
       const attempt = attemptOf(jobId);
       if (deps.tenantId && job.tenantId !== deps.tenantId) {
         return {
@@ -4115,12 +4303,12 @@ function createStageRunner(deps) {
         writeIssueContext(ref, job.issueContext);
         writeGuidance(ref, job.guidance);
         writeAttachedDocuments(ref, job.attachedDocuments);
-        if (job.agentConfig.emitArtifact) {
-          const artifactDir = resolveWorktreeRelativePath(ref, job.agentConfig.emitArtifact);
-          const slash = job.agentConfig.emitArtifact.lastIndexOf("/");
+        if (agentConfig?.emitArtifact) {
+          const artifactDir = resolveWorktreeRelativePath(ref, agentConfig.emitArtifact);
+          const slash = agentConfig.emitArtifact.lastIndexOf("/");
           if (artifactDir && slash > 0) {
             try {
-              mkdirSync8(join14(ref.worktreePath, job.agentConfig.emitArtifact.slice(0, slash)), { recursive: true });
+              mkdirSync8(join14(ref.worktreePath, agentConfig.emitArtifact.slice(0, slash)), { recursive: true });
             } catch {
             }
           }
@@ -4132,16 +4320,16 @@ function createStageRunner(deps) {
           stageId,
           jobId,
           attempt,
-          runtime: agentConfig.runtime,
-          model: agentConfig.model,
+          runtime: traceRuntime,
+          model: agentConfig?.model,
           sessionId: job.sessionId,
-          configDigest: digest2(agentConfig),
+          configDigest: digest2(isCheck ? job.checks : agentConfig),
           startedAt: nowIso2()
         };
         const writer = createTraceWriter(ref.scratchPath, meta);
         const streamEvent = (e) => deps.trace?.event({ runId, stageId, attempt, tenantId: job.tenantId, event: e });
         streamEvent(
-          writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "attempt-start" })
+          writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "attempt-start" })
         );
         const shipFinalTrace = async (finalMeta) => {
           const sink = deps.trace;
@@ -4178,13 +4366,13 @@ function createStageRunner(deps) {
           }
           sink.finalised({ ...base, meta: finalMeta, eventCount: writer.count(), ...archiveKey ? { archiveKey } : {} });
         };
-        const finish = async (status2, summary2, sessionId, costUsd, handedBackDoc, failureClass2) => {
+        const finish = async (status2, summary2, sessionId, costUsd, handedBackDoc, failureClass2, verifications) => {
           active.delete(jobId);
           turnQueues.delete(jobId);
           await gateway?.stop().catch((e) => log.warn({ err: e, jobId }, "mcp gateway: stop failed"));
           gateway = void 0;
           streamEvent(
-            writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "stage-exit", status: status2 })
+            writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "stage-exit", status: status2 })
           );
           const endedAt = nowIso2();
           writer.finalise({ status: status2, endedAt, ...sessionId ? { sessionId } : {} });
@@ -4201,12 +4389,12 @@ function createStageRunner(deps) {
           );
           lastUsed.set(runId, Date.now());
           await applyRetention(runId).catch((e) => log.warn({ err: e, runId }, "retention: pass failed"));
-          const wantsArtifact = agentConfig.emitArtifact !== void 0 || handedBackDoc !== void 0;
-          const resolved = status2 === "ok" && wantsArtifact ? resolveStageArtifact(ref, agentConfig.emitArtifact, handedBackDoc) : void 0;
+          const wantsArtifact = agentConfig?.emitArtifact !== void 0 || handedBackDoc !== void 0;
+          const resolved = status2 === "ok" && wantsArtifact ? resolveStageArtifact(ref, agentConfig?.emitArtifact, handedBackDoc) : void 0;
           if (status2 === "ok" && wantsArtifact) {
             const detail = resolved ? `source=${resolved.source} path=${resolved.artifact.path} bytes=${resolved.artifact.content.length}` : "no document resolved (declared path, tool handoff, and scratch/changed-file scans all empty)";
             streamEvent(
-              writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "artifact", detail })
+              writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "artifact", detail })
             );
           }
           return {
@@ -4216,7 +4404,12 @@ function createStageRunner(deps) {
             ...sessionId ? { sessionId } : {},
             ...costUsd !== void 0 ? { costUsd } : {},
             ...resolved ? { artifact: resolved.artifact } : {},
-            ...failureClass2 ? { failureClass: failureClass2 } : {}
+            ...failureClass2 ? { failureClass: failureClass2 } : {},
+            // DHK-666: `JobResult.verifications` shipped with a contract, a projection fold, a Card
+            // renderer and tests - but this object never forwarded it, which is the entire reason the
+            // field has had no producer. Forwarded for EVERY stage, not just check jobs, so a hook or
+            // an agent-run gate can populate it too.
+            ...verifications?.length ? { verifications } : {}
           };
         };
         if (deps.packCache && job.provision && job.provision.length > 0) {
@@ -4229,30 +4422,30 @@ function createStageRunner(deps) {
             });
             const detail = `provision: ${overlay.written.length} written, ${overlay.skippedRepoLocal.length} repo-local, ${overlay.warnings.length} warning(s)`;
             streamEvent(
-              writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "provision", detail })
+              writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "provision", detail })
             );
             const noteText = overlay.warnings.length > 0 ? `${detail}; ${overlay.warnings.join("; ")}` : detail;
             deps.sendProgress({ jobId, kind: "observation", ts: nowIso2(), text: noteText });
           } catch (e) {
             const msg = `component provisioning failed: ${e.message}`;
-            writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: agentConfig.runtime, kind: "provision-failed", message: msg });
+            writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: traceRuntime, kind: "provision-failed", message: msg });
             deps.sendProgress({ jobId, kind: "error", ts: nowIso2(), text: msg });
             return finish("fail", `${stageId}: ${msg}`, job.sessionId);
           }
         }
-        const setup = job.setup;
+        const setup = job.workspaceRef?.setup;
         if (setup?.command && ref) {
           const outcome = runRepoSetup({ worktreePath: ref.worktreePath, command: setup.command });
           if (outcome.status === "failed") {
             const msg = `repo setup failed (exit ${outcome.exitCode ?? "null"})`;
             const detail2 = outcome.output ? `${msg}: ${outcome.output}` : msg;
-            writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: agentConfig.runtime, kind: "setup-failed", message: detail2 });
+            writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: traceRuntime, kind: "setup-failed", message: detail2 });
             deps.sendProgress({ jobId, kind: "error", ts: nowIso2(), text: detail2 });
             return finish("fail", `${stageId}: ${msg}`, job.sessionId, void 0, void 0, "harness");
           }
           const detail = outcome.status === "cached" ? "setup: cached (already installed)" : `setup: ran (exit 0, ${outcome.output.length} bytes)`;
           streamEvent(
-            writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "setup", detail })
+            writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "setup", detail })
           );
           if (outcome.status === "ran") {
             deps.sendProgress({ jobId, kind: "observation", ts: nowIso2(), text: outcome.output || detail });
@@ -4275,14 +4468,14 @@ function createStageRunner(deps) {
         const rules = [...jobRules, ...deps.rules];
         const entry = evaluatePolicies({ kind: "stage-entry", stageId }, rules);
         if (entry.verdict === "deny") {
-          writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: agentConfig.runtime, event: "policy-deny", detail: entry.reason });
+          writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "policy-deny", detail: entry.reason });
           return finish("fail", `${stageId}: denied at stage entry (${entry.policy})`, job.sessionId);
         }
         let denied = false;
         const surfacedDenyReasons = /* @__PURE__ */ new Set();
         let escapedUnblocked = false;
         const authorisedActions = [];
-        const runtime = agentConfig.runtime;
+        const runtime = agentConfig?.runtime;
         const actionKey = (tool3, input) => {
           try {
             return `${tool3}\0${JSON.stringify(input)}`;
@@ -4295,9 +4488,9 @@ function createStageRunner(deps) {
           denied = true;
           const reason = policyReason(verdict2);
           if (toolUseId) {
-            streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "observation", runtime, toolUseId, isError: true, output: { error: reason } }));
+            streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "observation", runtime: traceRuntime, toolUseId, isError: true, output: { error: reason } }));
           }
-          streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime, event: "policy-deny", detail: reason }));
+          streamEvent(writer.append({ seq: 0, ts: nowIso2(), type: "state", runtime: traceRuntime, event: "policy-deny", detail: reason }));
           const surfaceKey = `${verdict2.policy}\0${reason}`;
           if (!surfacedDenyReasons.has(surfaceKey)) {
             surfacedDenyReasons.add(surfaceKey);
@@ -4338,19 +4531,28 @@ function createStageRunner(deps) {
           streamEvent(writer.append(event));
           if (event.type !== "state") deps.sendProgress({ jobId, kind: event.type, ts: event.ts, ...previewOf(event) });
         };
-        const mcpServers = agentConfig.mcpServers;
-        if (mcpServers && mcpServers.length > 0 && runtimeUsesMcpGateway(runtime)) {
+        const mcpServers = agentConfig?.mcpServers;
+        if (runtime && mcpServers && mcpServers.length > 0 && runtimeUsesMcpGateway(runtime)) {
           gateway = await startMcpGateway({ servers: mcpServers, creds: job.brokeredCreds ?? {} });
         }
-        const runner = deps.makeRunner(runtime);
+        let checkOutcomes = [];
+        const runner = isCheck ? (deps.makeCheckRunner ?? createCheckRunner)(job.checks, (o) => {
+          checkOutcomes = o;
+        }) : deps.makeRunner(runtime);
         active.set(jobId, runner);
         const ctx = {
-          config: agentConfig,
+          // A check runner reads only `workspace.worktreePath`; the empty config keeps the shared
+          // RunnerContext shape without inventing a runtime the stage does not have.
+          config: agentConfig ?? { runtime: "claude-code" },
           workspace: ref,
           sessionId: job.sessionId,
           ...job.issueContext !== void 0 ? { issueContext: job.issueContext } : {},
           ...job.guidance !== void 0 ? { guidance: job.guidance } : {},
           ...job.gateFeedback !== void 0 ? { gateFeedback: job.gateFeedback } : {},
+          // Why this stage is running again, when it is. Without this passthrough the failing checks
+          // reach the node and stop dead here, and the looped-back agent gets the stage's static prompt
+          // with no hint of what it is meant to fix.
+          ...job.checkFailures !== void 0 ? { checkFailures: job.checkFailures } : {},
           ...job.attachedDocuments !== void 0 ? { attachedDocuments: job.attachedDocuments } : {},
           ...gateway ? { mcpProxyBaseUrl: gateway.baseUrl } : {},
           // brokered inference env for a managed node (no operator login). The runtime adapter
@@ -4380,7 +4582,7 @@ function createStageRunner(deps) {
             })
           } : {}
         };
-        const interactive = agentConfig.interaction === "interactive";
+        const interactive = agentConfig?.interaction === "interactive";
         let result;
         let timedOut = false;
         const killMs = Math.max(0, Math.floor((job.timeout ?? 0) * 1e3));
@@ -4391,7 +4593,7 @@ function createStageRunner(deps) {
         let stalled = false;
         let stallTimer;
         const stallSource = agentConfig.stallMs ?? Number(process.env.DAHRK_BATCH_STALL_MS ?? process.env.SKAKEL_BATCH_STALL_MS ?? 3e5);
-        const stallMs = interactive ? 0 : Math.max(0, Math.floor(stallSource));
+        const stallMs = interactive || isCheck ? 0 : Math.max(0, Math.floor(stallSource));
         if (stallMs > 0) {
           bumpStall = () => {
             if (stallTimer) clearTimeout(stallTimer);
@@ -4418,7 +4620,7 @@ function createStageRunner(deps) {
         if (status === "ok" && escapedUnblocked) {
           status = "fail";
           const msg = `stage reached outside the run's worktree and the ${runtime} runtime could not block it before it ran`;
-          writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime, kind: "fs-confine-escape", message: msg });
+          writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: traceRuntime, kind: "fs-confine-escape", message: msg });
           deps.sendProgress({ jobId, kind: "error", ts: nowIso2(), text: msg });
         }
         if (status === "ok" && job.hooks && job.hooks.length > 0) {
@@ -4427,7 +4629,7 @@ function createStageRunner(deps) {
               execFileSync6("sh", ["-c", cmd], { cwd: ref.worktreePath, stdio: ["pipe", "pipe", "pipe"] });
             } catch (e) {
               status = "fail";
-              writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime, kind: "hook-failed", message: `hook "${cmd}" failed: ${e.message}` });
+              writer.append({ seq: 0, ts: nowIso2(), type: "error", runtime: traceRuntime, kind: "hook-failed", message: `hook "${cmd}" failed: ${e.message}` });
               break;
             }
           }
@@ -4444,7 +4646,16 @@ function createStageRunner(deps) {
         }
         if (denied) summary += "\n\n(note: one or more tool actions were blocked by a deny-only policy guard.)";
         const failureClass = timedOut || stalled ? "harness" : result.failureClass;
-        return finish(status, summary, result.sessionId ?? job.sessionId, result.costUsd, result.artifact, failureClass);
+        if (isCheck && ref) writeCheckNote(ref, stageId, attempt, checkOutcomes);
+        return finish(
+          status,
+          summary,
+          result.sessionId ?? job.sessionId,
+          result.costUsd,
+          result.artifact,
+          failureClass,
+          result.verifications
+        );
       } finally {
         inFlight.set(runId, Math.max(0, (inFlight.get(runId) ?? 1) - 1));
       }
@@ -4531,6 +4742,7 @@ function createStageRunner(deps) {
 var ENROLMENT_REJECTED_EXIT_CODE = 78;
 var RECONNECT_BASE_MS = 500;
 var RECONNECT_MAX_MS = 3e4;
+var NODE_CAPABILITIES = ["check"];
 var PARK_POLL_MS = 6e4;
 function classifyError(e) {
   const msg = e instanceof Error ? e.message : String(e);
@@ -4714,6 +4926,12 @@ async function startEdgeNode(opts) {
       os: osPlatform(),
       arch: osArch(),
       clientVersion: opts.clientVersion ?? "0.0.0",
+      // Non-runtime job kinds this build can execute. The hub REFUSES to place a check job on a node
+      // that does not advertise `check`, and that refusal is a safety gate rather than an optimisation:
+      // `makeRunner()` defaults to Claude rather than erroring on an unknown job shape, so an old client
+      // handed a check job would boot an unbounded write-access agent with the fallback instruction
+      // "Begin the stage.", report ok, and let the run reach deliver green having run no checks.
+      capabilities: NODE_CAPABILITIES,
       // Advertise the resolved worktree base so the hub records each run's real worktree location in
       // the projection instead of an advisory placeholder. Single-sourced from the git service so it
       // always matches where worktrees actually land.
@@ -5046,7 +5264,7 @@ var PROBES = [
   { runtime: "claude-code", cmd: "claude" },
   { runtime: "pi", cmd: "pi" }
 ];
-var DEFAULT_TIMEOUT_MS2 = 5e3;
+var DEFAULT_TIMEOUT_MS3 = 5e3;
 var DEFAULT_ATTEMPTS = 2;
 function probeOnce(cmd, timeoutMs) {
   return new Promise((resolve3) => {
@@ -5068,14 +5286,14 @@ async function probe(cmd, timeoutMs, attempts) {
   }
   return void 0;
 }
-async function probeRuntimeStatuses(timeoutMs = DEFAULT_TIMEOUT_MS2, attempts = DEFAULT_ATTEMPTS) {
+async function probeRuntimeStatuses(timeoutMs = DEFAULT_TIMEOUT_MS3, attempts = DEFAULT_ATTEMPTS) {
   const versions = await Promise.all(PROBES.map((p) => probe(p.cmd, timeoutMs, attempts)));
   return PROBES.map((p, i) => {
     const version = versions[i];
     return version === void 0 ? { runtime: p.runtime, cmd: p.cmd, installed: false } : { runtime: p.runtime, cmd: p.cmd, installed: true, version };
   });
 }
-async function detectRuntimes(timeoutMs = DEFAULT_TIMEOUT_MS2, attempts = DEFAULT_ATTEMPTS) {
+async function detectRuntimes(timeoutMs = DEFAULT_TIMEOUT_MS3, attempts = DEFAULT_ATTEMPTS) {
   const statuses = await probeRuntimeStatuses(timeoutMs, attempts);
   return statuses.filter((s) => s.installed).map((s) => s.runtime);
 }
@@ -6132,7 +6350,7 @@ var defaultLockDeps = (file) => ({
 });
 
 // src/logs.ts
-import { spawn } from "child_process";
+import { spawn as spawn2 } from "child_process";
 import { copyFileSync, existsSync as existsSync11, readFileSync as readFileSync9, statSync as statSync4, truncateSync } from "fs";
 var MAX_LOG_BYTES = 10 * 1024 * 1024;
 function logsCommand(inputs) {
@@ -6227,7 +6445,7 @@ var defaultLogsDeps = (files, jsonlFile) => ({
   readFile: (path) => readFileSync9(path, "utf8"),
   run: (argv) => new Promise((resolve3) => {
     const [cmd, ...args] = argv;
-    const child = spawn(cmd, args, { stdio: "inherit" });
+    const child = spawn2(cmd, args, { stdio: "inherit" });
     child.on("error", () => resolve3(1));
     child.on("close", (code) => resolve3(code ?? 0));
   }),
@@ -7509,7 +7727,7 @@ async function runStatus(inputs, deps) {
 }
 
 // src/main.ts
-var CLIENT_VERSION = "0.1.25";
+var CLIENT_VERSION = "0.1.26";
 var DEFAULT_HUB_URL = "wss://api.dahrk.ai";
 var list = (v) => (v ?? "").split(",").map((s) => s.trim()).filter(Boolean);
 var RUNTIMES2 = ["claude-code", "codex", "pi"];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dahrk-node",
-  "version": "0.1.25",
+  "version": "0.1.26",
   "private": false,
   "license": "Apache-2.0",
   "type": "module",
@@ -34,7 +34,7 @@
   "exports": "./dist/main.js",
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "0.3.183",
-    "@dahrk/contracts": "^0.7.0",
+    "@dahrk/contracts": "^0.8.2",
     "pino": "^10.3.1",
     "ws": "^8.18.0",
     "zod": "^3.23.8"