open-multi-agent-kit 0.98.5 → 1.0.0

package/dist/commands/neo-cli.js

@@ -0,0 +1,61 @@
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { NEO_MCP_PRESETS, NEO_SKILL_NAMES, neoMcpConfig, selectNeoMcpPresets } from "../core/neo/catalog.js";
+import { createNeoMcpConfig } from "../core/neo/setup.js";
+/** Local, keyless distribution/setup commands. Never starts a server or a browser. */
+export function runNeoCli(args, context) {
+    const [command = "list", ...rest] = args;
+    try {
+        if (command === "list" && rest.length === 0) {
+            const skills = NEO_SKILL_NAMES.map((name) => ({
+                name,
+                packaged: existsSync(join(context.packageDir, "resources", "neo", "skills", name, "SKILL.md")),
+            }));
+            context.output(JSON.stringify({
+                bundle: "neo-v1",
+                skills,
+                mcp: { offered: NEO_MCP_PRESETS, connected: null, connectionStatus: "not_probed" },
+                note: "Packaged does not mean selected. Offered does not mean installed, enabled, connected, or approved.",
+            }, null, 2));
+            return skills.every((skill) => skill.packaged) ? 0 : 1;
+        }
+        if (command === "mcp-config") {
+            context.output(JSON.stringify(neoMcpConfig(rest, false), null, 2));
+            return 0;
+        }
+        if (command === "setup") {
+            if (rest.filter((arg) => arg === "--apply").length > 1 ||
+                rest.filter((arg) => arg === "--global").length > 1) {
+                throw new Error("Duplicate setup flag");
+            }
+            const apply = rest.includes("--apply");
+            const root = rest.includes("--global") ? context.home : context.cwd;
+            const ids = rest.filter((arg) => arg !== "--apply" && arg !== "--global");
+            const presets = selectNeoMcpPresets(ids);
+            if (!apply) {
+                context.output(JSON.stringify({
+                    status: "dry_run",
+                    target: join(root, ".omk", "mcp.json"),
+                    presets,
+                    config: neoMcpConfig(ids, false),
+                    approval: "--apply creates enabled entries. On the next OMK startup npx may download and execute the pinned servers, which can access the network. No server is started by this command.",
+                }, null, 2));
+                return 0;
+            }
+            const target = createNeoMcpConfig(root, ids);
+            context.output(JSON.stringify({
+                status: "configured_not_connected",
+                target,
+                presets: ids,
+                next: "Restart OMK, inspect the MCP connection/tool roster, and run a read-only health check before acting. Existing .omk/mcp.json in a project can override global entries.",
+            }, null, 2));
+            return 0;
+        }
+        throw new Error("Usage: omk neo [list | mcp-config <presets...> | setup <presets...> [--global] [--apply]]");
+    }
+    catch (error) {
+        context.output(JSON.stringify({ status: "blocked", error: error instanceof Error ? error.message : "Neo command failed" }));
+        return 1;
+    }
+}
+//# sourceMappingURL=neo-cli.js.map

package/dist/commands/neo-cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"neo-cli.js","sourceRoot":"","sources":["../../src/commands/neo-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,eAAe,EAAE,eAAe,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAC7G,OAAO,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAS1D,sFAAsF;AACtF,MAAM,UAAU,SAAS,CAAC,IAAuB,EAAE,OAAsB,EAAU;IAClF,MAAM,CAAC,OAAO,GAAG,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IACzC,IAAI,CAAC;QACJ,IAAI,OAAO,KAAK,MAAM,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC7C,IAAI;gBACJ,QAAQ,EAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;aAC9F,CAAC,CAAC,CAAC;YACJ,OAAO,CAAC,MAAM,CACb,IAAI,CAAC,SAAS,CACb;gBACC,MAAM,EAAE,QAAQ;gBAChB,MAAM;gBACN,GAAG,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,YAAY,EAAE;gBAClF,IAAI,EAAE,oGAAoG;aAC1G,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;YACF,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;YACnE,OAAO,CAAC,CAAC;QACV,CAAC;QACD,IAAI,OAAO,KAAK,OAAO,EAAE,CAAC;YACzB,IACC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,MAAM,GAAG,CAAC;gBAClD,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,EAClD,CAAC;gBACF,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;YACzC,CAAC;YACD,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;YACpE,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,UAAU,CAAC,CAAC;YAC1E,MAAM,OAAO,GAAG,mBAAmB,CAAC,GAAG,CAAC,CAAC;YACzC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACZ,OAAO,CAAC,MAAM,CACb,IAAI,CAAC,SAAS,CACb;oBACC,MAAM,EAAE,SAAS;oBACjB,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC;oBACtC,OAAO;oBACP,MAAM,EAAE,YAAY,CAAC,GAAG,EAAE,KAAK,CAAC;oBAChC,QAAQ,EACP,+KAA+K;iBAChL,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;gBACF,OAAO,CAAC,CAAC;YACV,CAAC;YACD,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YAC7C,OAAO,CAAC,MAAM,CACb,IAAI,CAAC,SAAS,CACb;gBACC,MAAM,EAAE,0BAA0B;gBAClC,MAAM;gBACN,OAAO,EAAE,GAAG;gBACZ,IAAI,EAAE,uKAAuK;aAC7K,EACD,IAAI,EACJ,CAAC,CACD,CACD,CAAC;YACF,OAAO,CAAC,CAAC;QACV,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,2FAA2F,CAAC,CAAC;IAC9G,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,OAAO,CAAC,MAAM,CACb,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,oBAAoB,EAAE,CAAC,CAC3G,CAAC;QACF,OAAO,CAAC,CAAC;IACV,CAAC;AAAA,CACD","sourcesContent":["import { existsSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { NEO_MCP_PRESETS, NEO_SKILL_NAMES, neoMcpConfig, selectNeoMcpPresets } from \"../core/neo/catalog.ts\";\nimport { createNeoMcpConfig } from \"../core/neo/setup.ts\";\n\nexport interface NeoCliContext {\n\treadonly packageDir: string;\n\treadonly cwd: string;\n\treadonly home: string;\n\treadonly output: (text: string) => void;\n}\n\n/** Local, keyless distribution/setup commands. Never starts a server or a browser. */\nexport function runNeoCli(args: readonly string[], context: NeoCliContext): number {\n\tconst [command = \"list\", ...rest] = args;\n\ttry {\n\t\tif (command === \"list\" && rest.length === 0) {\n\t\t\tconst skills = NEO_SKILL_NAMES.map((name) => ({\n\t\t\t\tname,\n\t\t\t\tpackaged: existsSync(join(context.packageDir, \"resources\", \"neo\", \"skills\", name, \"SKILL.md\")),\n\t\t\t}));\n\t\t\tcontext.output(\n\t\t\t\tJSON.stringify(\n\t\t\t\t\t{\n\t\t\t\t\t\tbundle: \"neo-v1\",\n\t\t\t\t\t\tskills,\n\t\t\t\t\t\tmcp: { offered: NEO_MCP_PRESETS, connected: null, connectionStatus: \"not_probed\" },\n\t\t\t\t\t\tnote: \"Packaged does not mean selected. Offered does not mean installed, enabled, connected, or approved.\",\n\t\t\t\t\t},\n\t\t\t\t\tnull,\n\t\t\t\t\t2,\n\t\t\t\t),\n\t\t\t);\n\t\t\treturn skills.every((skill) => skill.packaged) ? 0 : 1;\n\t\t}\n\t\tif (command === \"mcp-config\") {\n\t\t\tcontext.output(JSON.stringify(neoMcpConfig(rest, false), null, 2));\n\t\t\treturn 0;\n\t\t}\n\t\tif (command === \"setup\") {\n\t\t\tif (\n\t\t\t\trest.filter((arg) => arg === \"--apply\").length > 1 ||\n\t\t\t\trest.filter((arg) => arg === \"--global\").length > 1\n\t\t\t) {\n\t\t\t\tthrow new Error(\"Duplicate setup flag\");\n\t\t\t}\n\t\t\tconst apply = rest.includes(\"--apply\");\n\t\t\tconst root = rest.includes(\"--global\") ? context.home : context.cwd;\n\t\t\tconst ids = rest.filter((arg) => arg !== \"--apply\" && arg !== \"--global\");\n\t\t\tconst presets = selectNeoMcpPresets(ids);\n\t\t\tif (!apply) {\n\t\t\t\tcontext.output(\n\t\t\t\t\tJSON.stringify(\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tstatus: \"dry_run\",\n\t\t\t\t\t\t\ttarget: join(root, \".omk\", \"mcp.json\"),\n\t\t\t\t\t\t\tpresets,\n\t\t\t\t\t\t\tconfig: neoMcpConfig(ids, false),\n\t\t\t\t\t\t\tapproval:\n\t\t\t\t\t\t\t\t\"--apply creates enabled entries. On the next OMK startup npx may download and execute the pinned servers, which can access the network. No server is started by this command.\",\n\t\t\t\t\t\t},\n\t\t\t\t\t\tnull,\n\t\t\t\t\t\t2,\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\treturn 0;\n\t\t\t}\n\t\t\tconst target = createNeoMcpConfig(root, ids);\n\t\t\tcontext.output(\n\t\t\t\tJSON.stringify(\n\t\t\t\t\t{\n\t\t\t\t\t\tstatus: \"configured_not_connected\",\n\t\t\t\t\t\ttarget,\n\t\t\t\t\t\tpresets: ids,\n\t\t\t\t\t\tnext: \"Restart OMK, inspect the MCP connection/tool roster, and run a read-only health check before acting. Existing .omk/mcp.json in a project can override global entries.\",\n\t\t\t\t\t},\n\t\t\t\t\tnull,\n\t\t\t\t\t2,\n\t\t\t\t),\n\t\t\t);\n\t\t\treturn 0;\n\t\t}\n\t\tthrow new Error(\"Usage: omk neo [list | mcp-config <presets...> | setup <presets...> [--global] [--apply]]\");\n\t} catch (error) {\n\t\tcontext.output(\n\t\t\tJSON.stringify({ status: \"blocked\", error: error instanceof Error ? error.message : \"Neo command failed\" }),\n\t\t);\n\t\treturn 1;\n\t}\n}\n"]}

package/dist/commands/verified-run-cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"verified-run-cli.d.ts","sourceRoot":"","sources":["../../src/commands/verified-run-cli.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAoG/E,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAyHnE","sourcesContent":["import { join } from \"node:path\";\nimport { parseRunContract, RunContractError, VERIFIED_COMMAND_VERSION } from \"omk-protocol\";\nimport { getAgentDir } from \"../config.ts\";\nimport { planVerifiedRun, RunCoordinator } from \"../core/verified-run/coordinator.ts\";\nimport type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { digestBytes, readJson, VerifiedRunError } from \"../core/verified-run/storage.ts\";\n\nconst USAGE = `Usage: omk run plan --contract FILE [--json]\n       omk run start --contract FILE --approve DIGEST --command-id ID [--state-dir DIR]\n       omk run inspect|evidence ID [--state-dir DIR] [--json]\n       omk run inspect ID --recovery|--writer-recovery|--task-recovery [--state-dir DIR]\n       omk run retry-tasks ID --execute --tasks ID[,ID...]|- --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]\nThe opt-in command, scripted-agent and serial command-DAG profiles never apply changes to the original workspace.\nResume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Parallel DAG, plan amendment, managed apply and TUI/RPC control are not implemented.`;\n\ninterface Parsed {\n\treadonly action:\n\t\t| \"plan\"\n\t\t| \"start\"\n\t\t| \"resume\"\n\t\t| \"restart-writer\"\n\t\t| \"retry-tasks\"\n\t\t| \"inspect\"\n\t\t| \"evidence\"\n\t\t| \"artifact\";\n\treadonly id: string | undefined;\n\treadonly flags: ReadonlyMap<string, string>;\n}\n\nfunction parse(args: readonly string[]): Parsed {\n\tconst action = args[1];\n\tif (\n\t\taction !== \"plan\" &&\n\t\taction !== \"start\" &&\n\t\taction !== \"resume\" &&\n\t\taction !== \"restart-writer\" &&\n\t\taction !== \"retry-tasks\" &&\n\t\taction !== \"inspect\" &&\n\t\taction !== \"evidence\" &&\n\t\taction !== \"artifact\"\n\t)\n\t\tthrow new VerifiedRunError(\"usage\");\n\tconst hasId = action !== \"plan\" && action !== \"start\";\n\tconst id = hasId ? args[2] : undefined;\n\tif (hasId && (!id || id.startsWith(\"--\"))) throw new VerifiedRunError(\"usage\");\n\tconst allowed =\n\t\taction === \"plan\"\n\t\t\t? [\"--contract\", \"--json\"]\n\t\t\t: action === \"start\"\n\t\t\t\t? [\"--contract\", \"--approve\", \"--command-id\", \"--state-dir\", \"--json\"]\n\t\t\t\t: action === \"resume\" || action === \"restart-writer\" || action === \"retry-tasks\"\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\taction === \"resume\" ? \"--candidate\" : \"--base\",\n\t\t\t\t\t\t\t...(action === \"retry-tasks\" ? [\"--tasks\"] : []),\n\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t]\n\t\t\t\t\t: action === \"artifact\"\n\t\t\t\t\t\t? [\"--candidate\", \"--path\", \"--state-dir\", \"--json\"]\n\t\t\t\t\t\t: action === \"inspect\"\n\t\t\t\t\t\t\t? [\"--state-dir\", \"--json\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"]\n\t\t\t\t\t\t\t: [\"--state-dir\", \"--json\"];\n\tconst flags = new Map<string, string>();\n\tfor (let index = hasId ? 3 : 2; index < args.length; index++) {\n\t\tconst flag = args[index];\n\t\tif (!allowed.includes(flag) || flags.has(flag)) throw new VerifiedRunError(\"usage\");\n\t\tconst value = [\"--json\", \"--execute\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"].includes(flag)\n\t\t\t? \"true\"\n\t\t\t: args[++index];\n\t\tif (!value || value.startsWith(\"--\")) throw new VerifiedRunError(\"usage\");\n\t\tflags.set(flag, value);\n\t}\n\tif ([\"--recovery\", \"--writer-recovery\", \"--task-recovery\"].filter((flag) => flags.has(flag)).length > 1)\n\t\tthrow new VerifiedRunError(\"usage\");\n\treturn { action, id, flags };\n}\n\nfunction required(parsed: Parsed, name: string): string {\n\tconst value = parsed.flags.get(name);\n\tif (!value) throw new VerifiedRunError(\"usage\");\n\treturn value;\n}\n\nasync function withRunSignal<T>(run: (signal: AbortSignal) => Promise<T>): Promise<T> {\n\tconst controller = new AbortController();\n\tconst cancel = (): void => controller.abort();\n\tprocess.once(\"SIGINT\", cancel);\n\tprocess.once(\"SIGTERM\", cancel);\n\ttry {\n\t\treturn await run(controller.signal);\n\t} finally {\n\t\tprocess.off(\"SIGINT\", cancel);\n\t\tprocess.off(\"SIGTERM\", cancel);\n\t}\n}\n\nexport async function runVerifiedRunCli(\n\targs: string[],\n\truntime?: VerifiedRunRuntime,\n): Promise<{ readonly handled: boolean; readonly exitCode: number }> {\n\tif (args[0] !== \"run\") return { handled: false, exitCode: 0 };\n\tif (args.length === 2 && args[1] === \"--help\") {\n\t\tprocess.stdout.write(`${USAGE}\\n`);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\ttry {\n\t\tconst parsed = parse(args);\n\t\tconst coordinator = new RunCoordinator(\n\t\t\tparsed.flags.get(\"--state-dir\") ?? join(getAgentDir(), \"verified-runs\"),\n\t\t\truntime,\n\t\t);\n\t\tlet result: unknown;\n\t\tlet exitCode = 0;\n\t\tswitch (parsed.action) {\n\t\t\tcase \"plan\":\n\t\t\t\tresult = planVerifiedRun(readJson(required(parsed, \"--contract\")));\n\t\t\t\tbreak;\n\t\t\tcase \"start\": {\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst commandId = required(parsed, \"--command-id\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.start(\n\t\t\t\t\t\tcontract,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"start\",\n\t\t\t\t\t\t\trunId: contract.runId,\n\t\t\t\t\t\t\tcommandId,\n\t\t\t\t\t\t\texpectedRevision: 0,\n\t\t\t\t\t\t\texpectedGeneration: 0,\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resume\":\n\t\t\tcase \"retry-tasks\":\n\t\t\tcase \"restart-writer\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst request = {\n\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t};\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tparsed.action === \"retry-tasks\"\n\t\t\t\t\t\t? coordinator.retryTasks(\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t...request,\n\t\t\t\t\t\t\t\t\tkind: \"retry_tasks\",\n\t\t\t\t\t\t\t\t\tbaseDigest: required(parsed, \"--base\"),\n\t\t\t\t\t\t\t\t\ttaskIds: required(parsed, \"--tasks\") === \"-\" ? [] : required(parsed, \"--tasks\").split(\",\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t: parsed.action === \"resume\"\n\t\t\t\t\t\t\t? coordinator.resume(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"resume\", candidateDigest: required(parsed, \"--candidate\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: coordinator.restartWriter(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"restart_writer\", baseDigest: required(parsed, \"--base\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"inspect\":\n\t\t\t\tresult = parsed.flags.has(\"--recovery\")\n\t\t\t\t\t? coordinator.inspectRecovery(parsed.id ?? \"\")\n\t\t\t\t\t: parsed.flags.has(\"--writer-recovery\")\n\t\t\t\t\t\t? coordinator.inspectWriterRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t: parsed.flags.has(\"--task-recovery\")\n\t\t\t\t\t\t\t? coordinator.inspectTaskRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t\t: coordinator.inspect(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"evidence\":\n\t\t\t\tresult = coordinator.evidence(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"artifact\": {\n\t\t\t\tconst candidate = required(parsed, \"--candidate\");\n\t\t\t\tconst path = required(parsed, \"--path\");\n\t\t\t\tconst bytes = coordinator.artifact(parsed.id ?? \"\", candidate, path);\n\t\t\t\tresult = {\n\t\t\t\t\tcandidateDigest: candidate,\n\t\t\t\t\tpath,\n\t\t\t\t\tdigest: digestBytes(bytes),\n\t\t\t\t\tbyteCount: bytes.length,\n\t\t\t\t\tencoding: \"base64\",\n\t\t\t\t\tdata: bytes.toString(\"base64\"),\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = parsed.action;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tprocess.stdout.write(`${JSON.stringify(result)}\\n`);\n\t\treturn { handled: true, exitCode };\n\t} catch (error) {\n\t\tconst usage = error instanceof RunContractError || (error instanceof VerifiedRunError && error.code === \"usage\");\n\t\tconst message =\n\t\t\terror instanceof VerifiedRunError || error instanceof RunContractError\n\t\t\t\t? error.message\n\t\t\t\t: \"verified-run: operation_failed\";\n\t\tprocess.stderr.write(`${message}\\n${usage ? `${USAGE}\\n` : \"\"}`);\n\t\treturn { handled: true, exitCode: usage ? 2 : 1 };\n\t}\n}\n"]}
+{"version":3,"file":"verified-run-cli.d.ts","sourceRoot":"","sources":["../../src/commands/verified-run-cli.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,sCAAsC,CAAC;AAoG/E,wBAAsB,iBAAiB,CACtC,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,CAAC,EAAE,kBAAkB,GAC1B,OAAO,CAAC;IAAE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAAC,CAyHnE","sourcesContent":["import { join } from \"node:path\";\nimport { parseRunContract, RunContractError, VERIFIED_COMMAND_VERSION } from \"omk-protocol\";\nimport { getAgentDir } from \"../config.ts\";\nimport { planVerifiedRun, RunCoordinator } from \"../core/verified-run/coordinator.ts\";\nimport type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { digestBytes, readJson, VerifiedRunError } from \"../core/verified-run/storage.ts\";\n\nconst USAGE = `Usage: omk run plan --contract FILE [--json]\n       omk run start --contract FILE --approve DIGEST --command-id ID [--state-dir DIR]\n       omk run inspect|evidence ID [--state-dir DIR] [--json]\n       omk run inspect ID --recovery|--writer-recovery|--task-recovery [--state-dir DIR]\n       omk run retry-tasks ID --execute --tasks ID[,ID...]|- --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]\nThe opt-in command, scripted-agent and bounded command-DAG profiles never apply changes to the original workspace.\nResume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Command-DAG concurrency defaults to 1 and supports an explicit cap of 2. Plan amendment, managed apply and TUI/RPC control are not implemented.`;\n\ninterface Parsed {\n\treadonly action:\n\t\t| \"plan\"\n\t\t| \"start\"\n\t\t| \"resume\"\n\t\t| \"restart-writer\"\n\t\t| \"retry-tasks\"\n\t\t| \"inspect\"\n\t\t| \"evidence\"\n\t\t| \"artifact\";\n\treadonly id: string | undefined;\n\treadonly flags: ReadonlyMap<string, string>;\n}\n\nfunction parse(args: readonly string[]): Parsed {\n\tconst action = args[1];\n\tif (\n\t\taction !== \"plan\" &&\n\t\taction !== \"start\" &&\n\t\taction !== \"resume\" &&\n\t\taction !== \"restart-writer\" &&\n\t\taction !== \"retry-tasks\" &&\n\t\taction !== \"inspect\" &&\n\t\taction !== \"evidence\" &&\n\t\taction !== \"artifact\"\n\t)\n\t\tthrow new VerifiedRunError(\"usage\");\n\tconst hasId = action !== \"plan\" && action !== \"start\";\n\tconst id = hasId ? args[2] : undefined;\n\tif (hasId && (!id || id.startsWith(\"--\"))) throw new VerifiedRunError(\"usage\");\n\tconst allowed =\n\t\taction === \"plan\"\n\t\t\t? [\"--contract\", \"--json\"]\n\t\t\t: action === \"start\"\n\t\t\t\t? [\"--contract\", \"--approve\", \"--command-id\", \"--state-dir\", \"--json\"]\n\t\t\t\t: action === \"resume\" || action === \"restart-writer\" || action === \"retry-tasks\"\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\taction === \"resume\" ? \"--candidate\" : \"--base\",\n\t\t\t\t\t\t\t...(action === \"retry-tasks\" ? [\"--tasks\"] : []),\n\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t]\n\t\t\t\t\t: action === \"artifact\"\n\t\t\t\t\t\t? [\"--candidate\", \"--path\", \"--state-dir\", \"--json\"]\n\t\t\t\t\t\t: action === \"inspect\"\n\t\t\t\t\t\t\t? [\"--state-dir\", \"--json\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"]\n\t\t\t\t\t\t\t: [\"--state-dir\", \"--json\"];\n\tconst flags = new Map<string, string>();\n\tfor (let index = hasId ? 3 : 2; index < args.length; index++) {\n\t\tconst flag = args[index];\n\t\tif (!allowed.includes(flag) || flags.has(flag)) throw new VerifiedRunError(\"usage\");\n\t\tconst value = [\"--json\", \"--execute\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"].includes(flag)\n\t\t\t? \"true\"\n\t\t\t: args[++index];\n\t\tif (!value || value.startsWith(\"--\")) throw new VerifiedRunError(\"usage\");\n\t\tflags.set(flag, value);\n\t}\n\tif ([\"--recovery\", \"--writer-recovery\", \"--task-recovery\"].filter((flag) => flags.has(flag)).length > 1)\n\t\tthrow new VerifiedRunError(\"usage\");\n\treturn { action, id, flags };\n}\n\nfunction required(parsed: Parsed, name: string): string {\n\tconst value = parsed.flags.get(name);\n\tif (!value) throw new VerifiedRunError(\"usage\");\n\treturn value;\n}\n\nasync function withRunSignal<T>(run: (signal: AbortSignal) => Promise<T>): Promise<T> {\n\tconst controller = new AbortController();\n\tconst cancel = (): void => controller.abort();\n\tprocess.once(\"SIGINT\", cancel);\n\tprocess.once(\"SIGTERM\", cancel);\n\ttry {\n\t\treturn await run(controller.signal);\n\t} finally {\n\t\tprocess.off(\"SIGINT\", cancel);\n\t\tprocess.off(\"SIGTERM\", cancel);\n\t}\n}\n\nexport async function runVerifiedRunCli(\n\targs: string[],\n\truntime?: VerifiedRunRuntime,\n): Promise<{ readonly handled: boolean; readonly exitCode: number }> {\n\tif (args[0] !== \"run\") return { handled: false, exitCode: 0 };\n\tif (args.length === 2 && args[1] === \"--help\") {\n\t\tprocess.stdout.write(`${USAGE}\\n`);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\ttry {\n\t\tconst parsed = parse(args);\n\t\tconst coordinator = new RunCoordinator(\n\t\t\tparsed.flags.get(\"--state-dir\") ?? join(getAgentDir(), \"verified-runs\"),\n\t\t\truntime,\n\t\t);\n\t\tlet result: unknown;\n\t\tlet exitCode = 0;\n\t\tswitch (parsed.action) {\n\t\t\tcase \"plan\":\n\t\t\t\tresult = planVerifiedRun(readJson(required(parsed, \"--contract\")));\n\t\t\t\tbreak;\n\t\t\tcase \"start\": {\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst commandId = required(parsed, \"--command-id\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.start(\n\t\t\t\t\t\tcontract,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"start\",\n\t\t\t\t\t\t\trunId: contract.runId,\n\t\t\t\t\t\t\tcommandId,\n\t\t\t\t\t\t\texpectedRevision: 0,\n\t\t\t\t\t\t\texpectedGeneration: 0,\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resume\":\n\t\t\tcase \"retry-tasks\":\n\t\t\tcase \"restart-writer\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst request = {\n\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t};\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tparsed.action === \"retry-tasks\"\n\t\t\t\t\t\t? coordinator.retryTasks(\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t...request,\n\t\t\t\t\t\t\t\t\tkind: \"retry_tasks\",\n\t\t\t\t\t\t\t\t\tbaseDigest: required(parsed, \"--base\"),\n\t\t\t\t\t\t\t\t\ttaskIds: required(parsed, \"--tasks\") === \"-\" ? [] : required(parsed, \"--tasks\").split(\",\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t: parsed.action === \"resume\"\n\t\t\t\t\t\t\t? coordinator.resume(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"resume\", candidateDigest: required(parsed, \"--candidate\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: coordinator.restartWriter(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"restart_writer\", baseDigest: required(parsed, \"--base\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"inspect\":\n\t\t\t\tresult = parsed.flags.has(\"--recovery\")\n\t\t\t\t\t? coordinator.inspectRecovery(parsed.id ?? \"\")\n\t\t\t\t\t: parsed.flags.has(\"--writer-recovery\")\n\t\t\t\t\t\t? coordinator.inspectWriterRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t: parsed.flags.has(\"--task-recovery\")\n\t\t\t\t\t\t\t? coordinator.inspectTaskRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t\t: coordinator.inspect(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"evidence\":\n\t\t\t\tresult = coordinator.evidence(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"artifact\": {\n\t\t\t\tconst candidate = required(parsed, \"--candidate\");\n\t\t\t\tconst path = required(parsed, \"--path\");\n\t\t\t\tconst bytes = coordinator.artifact(parsed.id ?? \"\", candidate, path);\n\t\t\t\tresult = {\n\t\t\t\t\tcandidateDigest: candidate,\n\t\t\t\t\tpath,\n\t\t\t\t\tdigest: digestBytes(bytes),\n\t\t\t\t\tbyteCount: bytes.length,\n\t\t\t\t\tencoding: \"base64\",\n\t\t\t\t\tdata: bytes.toString(\"base64\"),\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = parsed.action;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tprocess.stdout.write(`${JSON.stringify(result)}\\n`);\n\t\treturn { handled: true, exitCode };\n\t} catch (error) {\n\t\tconst usage = error instanceof RunContractError || (error instanceof VerifiedRunError && error.code === \"usage\");\n\t\tconst message =\n\t\t\terror instanceof VerifiedRunError || error instanceof RunContractError\n\t\t\t\t? error.message\n\t\t\t\t: \"verified-run: operation_failed\";\n\t\tprocess.stderr.write(`${message}\\n${usage ? `${USAGE}\\n` : \"\"}`);\n\t\treturn { handled: true, exitCode: usage ? 2 : 1 };\n\t}\n}\n"]}

package/dist/commands/verified-run-cli.js

@@ -11,8 +11,8 @@ const USAGE = `Usage: omk run plan --contract FILE [--json]
        omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]
        omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]
        omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]
-The opt-in command, scripted-agent and serial command-DAG profiles never apply changes to the original workspace.
-Resume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Parallel DAG, plan amendment, managed apply and TUI/RPC control are not implemented.`;
+The opt-in command, scripted-agent and bounded command-DAG profiles never apply changes to the original workspace.
+Resume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Command-DAG concurrency defaults to 1 and supports an explicit cap of 2. Plan amendment, managed apply and TUI/RPC control are not implemented.`;
 function parse(args) {
     const action = args[1];
     if (action !== "plan" &&

package/dist/commands/verified-run-cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"verified-run-cli.js","sourceRoot":"","sources":["../../src/commands/verified-run-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAEtF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAE1F,MAAM,KAAK,GAAG;;;;;;;;;sLASwK,CAAC;AAgBvL,SAAS,KAAK,CAAC,IAAuB,EAAU;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IACC,MAAM,KAAK,MAAM;QACjB,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,gBAAgB;QAC3B,MAAM,KAAK,aAAa;QACxB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,UAAU;QAErB,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC;IACtD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,OAAO,GACZ,MAAM,KAAK,MAAM;QAChB,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC1B,CAAC,CAAC,MAAM,KAAK,OAAO;YACnB,CAAC,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,CAAC;YACtE,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,aAAa;gBAC/E,CAAC,CAAC;oBACA,WAAW;oBACX,WAAW;oBACX,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;oBAC9C,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,YAAY;oBACZ,cAAc;oBACd,cAAc;oBACd,aAAa;oBACb,QAAQ;iBACR;gBACF,CAAC,CAAC,MAAM,KAAK,UAAU;oBACtB,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC;oBACpD,CAAC,CAAC,MAAM,KAAK,SAAS;wBACrB,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;wBACjF,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzG,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;QACtG,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAAA,CAC7B;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAU;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,KAAK,UAAU,aAAa,CAAI,GAAwC,EAAc;IACrF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;AAAA,CACD;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,IAAc,EACd,OAA4B,EACwC;IACpE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,cAAc,CACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EACvE,OAAO,CACP,CAAC;QACF,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,MAAM;gBACV,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBACnE,MAAM;YACP,KAAK,OAAO,EAAE,CAAC;gBACd,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC5E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,WAAW,CAAC,KAAK,CAChB,QAAQ,EACR;oBACC,aAAa,EAAE,wBAAwB;oBACvC,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,SAAS;oBACT,gBAAgB,EAAE,CAAC;oBACnB,kBAAkB,EAAE,CAAC;oBACrB,cAAc,EAAE,sBAAsB;iBACtC,EACD,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC,CACD,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,MAAM;YACP,CAAC;YACD,KAAK,QAAQ,CAAC;YACd,KAAK,aAAa,CAAC;YACnB,KAAK,gBAAgB,EAAE,CAAC;gBACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC9B,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM,OAAO,GAAG;oBACf,aAAa,EAAE,wBAAwB;oBACvC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE;oBACtB,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;oBAC3C,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;oBACxD,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAC5D,cAAc,EAAE,sBAAsB;iBACtC,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,MAAM,CAAC,MAAM,KAAK,aAAa;oBAC9B,CAAC,CAAC,WAAW,CAAC,UAAU,CACtB;wBACC,GAAG,OAAO;wBACV,IAAI,EAAE,aAAa;wBACnB,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;wBACtC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;qBAC1F,EACD,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC;oBACF,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;wBAC3B,CAAC,CAAC,WAAW,CAAC,MAAM,CAClB,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,EAChF,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC;wBACF,CAAC,CAAC,WAAW,CAAC,aAAa,CACzB,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAC9E,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC,CACJ,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,MAAM;YACP,CAAC;YACD,KAAK,SAAS;gBACb,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;oBACtC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;oBAC9C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;wBACtC,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;wBACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC;4BACpC,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;4BAClD,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1C,MAAM;YACP,KAAK,UAAU;gBACd,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,MAAM;YACP,KAAK,UAAU,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACrE,MAAM,GAAG;oBACR,eAAe,EAAE,SAAS;oBAC1B,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;oBAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;oBACvB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAC9B,CAAC;gBACF,MAAM;YACP,CAAC;YACD,SAAS,CAAC;gBACT,MAAM,UAAU,GAAU,MAAM,CAAC,MAAM,CAAC;gBACxC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,YAAY,gBAAgB,IAAI,CAAC,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACjH,MAAM,OAAO,GACZ,KAAK,YAAY,gBAAgB,IAAI,KAAK,YAAY,gBAAgB;YACrE,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,gCAAgC,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;AAAA,CACD","sourcesContent":["import { join } from \"node:path\";\nimport { parseRunContract, RunContractError, VERIFIED_COMMAND_VERSION } from \"omk-protocol\";\nimport { getAgentDir } from \"../config.ts\";\nimport { planVerifiedRun, RunCoordinator } from \"../core/verified-run/coordinator.ts\";\nimport type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { digestBytes, readJson, VerifiedRunError } from \"../core/verified-run/storage.ts\";\n\nconst USAGE = `Usage: omk run plan --contract FILE [--json]\n       omk run start --contract FILE --approve DIGEST --command-id ID [--state-dir DIR]\n       omk run inspect|evidence ID [--state-dir DIR] [--json]\n       omk run inspect ID --recovery|--writer-recovery|--task-recovery [--state-dir DIR]\n       omk run retry-tasks ID --execute --tasks ID[,ID...]|- --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]\nThe opt-in command, scripted-agent and serial command-DAG profiles never apply changes to the original workspace.\nResume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Parallel DAG, plan amendment, managed apply and TUI/RPC control are not implemented.`;\n\ninterface Parsed {\n\treadonly action:\n\t\t| \"plan\"\n\t\t| \"start\"\n\t\t| \"resume\"\n\t\t| \"restart-writer\"\n\t\t| \"retry-tasks\"\n\t\t| \"inspect\"\n\t\t| \"evidence\"\n\t\t| \"artifact\";\n\treadonly id: string | undefined;\n\treadonly flags: ReadonlyMap<string, string>;\n}\n\nfunction parse(args: readonly string[]): Parsed {\n\tconst action = args[1];\n\tif (\n\t\taction !== \"plan\" &&\n\t\taction !== \"start\" &&\n\t\taction !== \"resume\" &&\n\t\taction !== \"restart-writer\" &&\n\t\taction !== \"retry-tasks\" &&\n\t\taction !== \"inspect\" &&\n\t\taction !== \"evidence\" &&\n\t\taction !== \"artifact\"\n\t)\n\t\tthrow new VerifiedRunError(\"usage\");\n\tconst hasId = action !== \"plan\" && action !== \"start\";\n\tconst id = hasId ? args[2] : undefined;\n\tif (hasId && (!id || id.startsWith(\"--\"))) throw new VerifiedRunError(\"usage\");\n\tconst allowed =\n\t\taction === \"plan\"\n\t\t\t? [\"--contract\", \"--json\"]\n\t\t\t: action === \"start\"\n\t\t\t\t? [\"--contract\", \"--approve\", \"--command-id\", \"--state-dir\", \"--json\"]\n\t\t\t\t: action === \"resume\" || action === \"restart-writer\" || action === \"retry-tasks\"\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\taction === \"resume\" ? \"--candidate\" : \"--base\",\n\t\t\t\t\t\t\t...(action === \"retry-tasks\" ? [\"--tasks\"] : []),\n\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t]\n\t\t\t\t\t: action === \"artifact\"\n\t\t\t\t\t\t? [\"--candidate\", \"--path\", \"--state-dir\", \"--json\"]\n\t\t\t\t\t\t: action === \"inspect\"\n\t\t\t\t\t\t\t? [\"--state-dir\", \"--json\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"]\n\t\t\t\t\t\t\t: [\"--state-dir\", \"--json\"];\n\tconst flags = new Map<string, string>();\n\tfor (let index = hasId ? 3 : 2; index < args.length; index++) {\n\t\tconst flag = args[index];\n\t\tif (!allowed.includes(flag) || flags.has(flag)) throw new VerifiedRunError(\"usage\");\n\t\tconst value = [\"--json\", \"--execute\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"].includes(flag)\n\t\t\t? \"true\"\n\t\t\t: args[++index];\n\t\tif (!value || value.startsWith(\"--\")) throw new VerifiedRunError(\"usage\");\n\t\tflags.set(flag, value);\n\t}\n\tif ([\"--recovery\", \"--writer-recovery\", \"--task-recovery\"].filter((flag) => flags.has(flag)).length > 1)\n\t\tthrow new VerifiedRunError(\"usage\");\n\treturn { action, id, flags };\n}\n\nfunction required(parsed: Parsed, name: string): string {\n\tconst value = parsed.flags.get(name);\n\tif (!value) throw new VerifiedRunError(\"usage\");\n\treturn value;\n}\n\nasync function withRunSignal<T>(run: (signal: AbortSignal) => Promise<T>): Promise<T> {\n\tconst controller = new AbortController();\n\tconst cancel = (): void => controller.abort();\n\tprocess.once(\"SIGINT\", cancel);\n\tprocess.once(\"SIGTERM\", cancel);\n\ttry {\n\t\treturn await run(controller.signal);\n\t} finally {\n\t\tprocess.off(\"SIGINT\", cancel);\n\t\tprocess.off(\"SIGTERM\", cancel);\n\t}\n}\n\nexport async function runVerifiedRunCli(\n\targs: string[],\n\truntime?: VerifiedRunRuntime,\n): Promise<{ readonly handled: boolean; readonly exitCode: number }> {\n\tif (args[0] !== \"run\") return { handled: false, exitCode: 0 };\n\tif (args.length === 2 && args[1] === \"--help\") {\n\t\tprocess.stdout.write(`${USAGE}\\n`);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\ttry {\n\t\tconst parsed = parse(args);\n\t\tconst coordinator = new RunCoordinator(\n\t\t\tparsed.flags.get(\"--state-dir\") ?? join(getAgentDir(), \"verified-runs\"),\n\t\t\truntime,\n\t\t);\n\t\tlet result: unknown;\n\t\tlet exitCode = 0;\n\t\tswitch (parsed.action) {\n\t\t\tcase \"plan\":\n\t\t\t\tresult = planVerifiedRun(readJson(required(parsed, \"--contract\")));\n\t\t\t\tbreak;\n\t\t\tcase \"start\": {\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst commandId = required(parsed, \"--command-id\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.start(\n\t\t\t\t\t\tcontract,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"start\",\n\t\t\t\t\t\t\trunId: contract.runId,\n\t\t\t\t\t\t\tcommandId,\n\t\t\t\t\t\t\texpectedRevision: 0,\n\t\t\t\t\t\t\texpectedGeneration: 0,\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resume\":\n\t\t\tcase \"retry-tasks\":\n\t\t\tcase \"restart-writer\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst request = {\n\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t};\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tparsed.action === \"retry-tasks\"\n\t\t\t\t\t\t? coordinator.retryTasks(\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t...request,\n\t\t\t\t\t\t\t\t\tkind: \"retry_tasks\",\n\t\t\t\t\t\t\t\t\tbaseDigest: required(parsed, \"--base\"),\n\t\t\t\t\t\t\t\t\ttaskIds: required(parsed, \"--tasks\") === \"-\" ? [] : required(parsed, \"--tasks\").split(\",\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t: parsed.action === \"resume\"\n\t\t\t\t\t\t\t? coordinator.resume(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"resume\", candidateDigest: required(parsed, \"--candidate\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: coordinator.restartWriter(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"restart_writer\", baseDigest: required(parsed, \"--base\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"inspect\":\n\t\t\t\tresult = parsed.flags.has(\"--recovery\")\n\t\t\t\t\t? coordinator.inspectRecovery(parsed.id ?? \"\")\n\t\t\t\t\t: parsed.flags.has(\"--writer-recovery\")\n\t\t\t\t\t\t? coordinator.inspectWriterRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t: parsed.flags.has(\"--task-recovery\")\n\t\t\t\t\t\t\t? coordinator.inspectTaskRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t\t: coordinator.inspect(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"evidence\":\n\t\t\t\tresult = coordinator.evidence(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"artifact\": {\n\t\t\t\tconst candidate = required(parsed, \"--candidate\");\n\t\t\t\tconst path = required(parsed, \"--path\");\n\t\t\t\tconst bytes = coordinator.artifact(parsed.id ?? \"\", candidate, path);\n\t\t\t\tresult = {\n\t\t\t\t\tcandidateDigest: candidate,\n\t\t\t\t\tpath,\n\t\t\t\t\tdigest: digestBytes(bytes),\n\t\t\t\t\tbyteCount: bytes.length,\n\t\t\t\t\tencoding: \"base64\",\n\t\t\t\t\tdata: bytes.toString(\"base64\"),\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = parsed.action;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tprocess.stdout.write(`${JSON.stringify(result)}\\n`);\n\t\treturn { handled: true, exitCode };\n\t} catch (error) {\n\t\tconst usage = error instanceof RunContractError || (error instanceof VerifiedRunError && error.code === \"usage\");\n\t\tconst message =\n\t\t\terror instanceof VerifiedRunError || error instanceof RunContractError\n\t\t\t\t? error.message\n\t\t\t\t: \"verified-run: operation_failed\";\n\t\tprocess.stderr.write(`${message}\\n${usage ? `${USAGE}\\n` : \"\"}`);\n\t\treturn { handled: true, exitCode: usage ? 2 : 1 };\n\t}\n}\n"]}
+{"version":3,"file":"verified-run-cli.js","sourceRoot":"","sources":["../../src/commands/verified-run-cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,cAAc,CAAC;AAC5F,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qCAAqC,CAAC;AAEtF,OAAO,EAAE,WAAW,EAAE,QAAQ,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAC;AAE1F,MAAM,KAAK,GAAG;;;;;;;;;iPASmO,CAAC;AAgBlP,SAAS,KAAK,CAAC,IAAuB,EAAU;IAC/C,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IACC,MAAM,KAAK,MAAM;QACjB,MAAM,KAAK,OAAO;QAClB,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,gBAAgB;QAC3B,MAAM,KAAK,aAAa;QACxB,MAAM,KAAK,SAAS;QACpB,MAAM,KAAK,UAAU;QACrB,MAAM,KAAK,UAAU;QAErB,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,KAAK,OAAO,CAAC;IACtD,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACvC,IAAI,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC/E,MAAM,OAAO,GACZ,MAAM,KAAK,MAAM;QAChB,CAAC,CAAC,CAAC,YAAY,EAAE,QAAQ,CAAC;QAC1B,CAAC,CAAC,MAAM,KAAK,OAAO;YACnB,CAAC,CAAC,CAAC,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAE,QAAQ,CAAC;YACtE,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,gBAAgB,IAAI,MAAM,KAAK,aAAa;gBAC/E,CAAC,CAAC;oBACA,WAAW;oBACX,WAAW;oBACX,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,QAAQ;oBAC9C,GAAG,CAAC,MAAM,KAAK,aAAa,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,YAAY;oBACZ,cAAc;oBACd,cAAc;oBACd,aAAa;oBACb,QAAQ;iBACR;gBACF,CAAC,CAAC,MAAM,KAAK,UAAU;oBACtB,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE,QAAQ,CAAC;oBACpD,CAAC,CAAC,MAAM,KAAK,SAAS;wBACrB,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC;wBACjF,CAAC,CAAC,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAC;IACxC,KAAK,IAAI,KAAK,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACpF,MAAM,KAAK,GAAG,CAAC,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;YACzG,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACjB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC1E,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,CAAC;IACD,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC;QACtG,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC;AAAA,CAC7B;AAED,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY,EAAU;IACvD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACrC,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAChD,OAAO,KAAK,CAAC;AAAA,CACb;AAED,KAAK,UAAU,aAAa,CAAI,GAAwC,EAAc;IACrF,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,MAAM,GAAG,GAAS,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;IAC9C,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IAC/B,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC;QACJ,OAAO,MAAM,GAAG,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;QAC9B,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAChC,CAAC;AAAA,CACD;AAED,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACtC,IAAc,EACd,OAA4B,EACwC;IACpE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IAC9D,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,EAAE,CAAC;QAC/C,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC;QACnC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC;IACvC,CAAC;IACD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,WAAW,GAAG,IAAI,cAAc,CACrC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC,EACvE,OAAO,CACP,CAAC;QACF,IAAI,MAAe,CAAC;QACpB,IAAI,QAAQ,GAAG,CAAC,CAAC;QACjB,QAAQ,MAAM,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,MAAM;gBACV,MAAM,GAAG,eAAe,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBACnE,MAAM;YACP,KAAK,OAAO,EAAE,CAAC;gBACd,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;gBACnD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC;gBAC5E,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,WAAW,CAAC,KAAK,CAChB,QAAQ,EACR;oBACC,aAAa,EAAE,wBAAwB;oBACvC,IAAI,EAAE,OAAO;oBACb,KAAK,EAAE,QAAQ,CAAC,KAAK;oBACrB,SAAS;oBACT,gBAAgB,EAAE,CAAC;oBACnB,kBAAkB,EAAE,CAAC;oBACrB,cAAc,EAAE,sBAAsB;iBACtC,EACD,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC,CACD,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,MAAM;YACP,CAAC;YACD,KAAK,QAAQ,CAAC;YACd,KAAK,aAAa,CAAC;YACnB,KAAK,gBAAgB,EAAE,CAAC;gBACvB,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC9B,MAAM,sBAAsB,GAAG,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;gBAC7D,MAAM,OAAO,GAAG;oBACf,aAAa,EAAE,wBAAwB;oBACvC,KAAK,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE;oBACtB,SAAS,EAAE,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;oBAC3C,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;oBACxD,kBAAkB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;oBAC5D,cAAc,EAAE,sBAAsB;iBACtC,CAAC;gBACF,MAAM,KAAK,GAAG,MAAM,aAAa,CAAC,CAAC,MAAM,EAAE,EAAE,CAC5C,MAAM,CAAC,MAAM,KAAK,aAAa;oBAC9B,CAAC,CAAC,WAAW,CAAC,UAAU,CACtB;wBACC,GAAG,OAAO;wBACV,IAAI,EAAE,aAAa;wBACnB,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC;wBACtC,OAAO,EAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC;qBAC1F,EACD,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC;oBACF,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,QAAQ;wBAC3B,CAAC,CAAC,WAAW,CAAC,MAAM,CAClB,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,eAAe,EAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,EAAE,EAChF,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC;wBACF,CAAC,CAAC,WAAW,CAAC,aAAa,CACzB,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,EAC9E,EAAE,sBAAsB,EAAE,MAAM,EAAE,CAClC,CACJ,CAAC;gBACF,MAAM,GAAG,KAAK,CAAC;gBACf,QAAQ,GAAG,KAAK,CAAC,WAAW,KAAK,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBAC3D,MAAM;YACP,CAAC;YACD,KAAK,SAAS;gBACb,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC;oBACtC,CAAC,CAAC,WAAW,CAAC,eAAe,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;oBAC9C,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC;wBACtC,CAAC,CAAC,WAAW,CAAC,qBAAqB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;wBACpD,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC;4BACpC,CAAC,CAAC,WAAW,CAAC,mBAAmB,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC;4BAClD,CAAC,CAAC,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC1C,MAAM;YACP,KAAK,UAAU;gBACd,MAAM,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;gBAC/C,MAAM;YACP,KAAK,UAAU,EAAE,CAAC;gBACjB,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;gBAClD,MAAM,IAAI,GAAG,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBACxC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;gBACrE,MAAM,GAAG;oBACR,eAAe,EAAE,SAAS;oBAC1B,IAAI;oBACJ,MAAM,EAAE,WAAW,CAAC,KAAK,CAAC;oBAC1B,SAAS,EAAE,KAAK,CAAC,MAAM;oBACvB,QAAQ,EAAE,QAAQ;oBAClB,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;iBAC9B,CAAC;gBACF,MAAM;YACP,CAAC;YACD,SAAS,CAAC;gBACT,MAAM,UAAU,GAAU,MAAM,CAAC,MAAM,CAAC;gBACxC,MAAM,IAAI,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC;YAChD,CAAC;QACF,CAAC;QACD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACpD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACpC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,KAAK,GAAG,KAAK,YAAY,gBAAgB,IAAI,CAAC,KAAK,YAAY,gBAAgB,IAAI,KAAK,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC;QACjH,MAAM,OAAO,GACZ,KAAK,YAAY,gBAAgB,IAAI,KAAK,YAAY,gBAAgB;YACrE,CAAC,CAAC,KAAK,CAAC,OAAO;YACf,CAAC,CAAC,gCAAgC,CAAC;QACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,KAAK,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACjE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACnD,CAAC;AAAA,CACD","sourcesContent":["import { join } from \"node:path\";\nimport { parseRunContract, RunContractError, VERIFIED_COMMAND_VERSION } from \"omk-protocol\";\nimport { getAgentDir } from \"../config.ts\";\nimport { planVerifiedRun, RunCoordinator } from \"../core/verified-run/coordinator.ts\";\nimport type { VerifiedRunRuntime } from \"../core/verified-run/session-port.ts\";\nimport { digestBytes, readJson, VerifiedRunError } from \"../core/verified-run/storage.ts\";\n\nconst USAGE = `Usage: omk run plan --contract FILE [--json]\n       omk run start --contract FILE --approve DIGEST --command-id ID [--state-dir DIR]\n       omk run inspect|evidence ID [--state-dir DIR] [--json]\n       omk run inspect ID --recovery|--writer-recovery|--task-recovery [--state-dir DIR]\n       omk run retry-tasks ID --execute --tasks ID[,ID...]|- --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run restart-writer ID --execute --approve DIGEST --base DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run resume ID --execute --approve DIGEST --candidate DIGEST --revision N --generation N --command-id ID [--state-dir DIR]\n       omk run artifact ID --candidate DIGEST --path PATH [--state-dir DIR]\nThe opt-in command, scripted-agent and bounded command-DAG profiles never apply changes to the original workspace.\nResume rechecks a fixed candidate. Writer/task recovery preserves input checkpoints and budgets. Command-DAG concurrency defaults to 1 and supports an explicit cap of 2. Plan amendment, managed apply and TUI/RPC control are not implemented.`;\n\ninterface Parsed {\n\treadonly action:\n\t\t| \"plan\"\n\t\t| \"start\"\n\t\t| \"resume\"\n\t\t| \"restart-writer\"\n\t\t| \"retry-tasks\"\n\t\t| \"inspect\"\n\t\t| \"evidence\"\n\t\t| \"artifact\";\n\treadonly id: string | undefined;\n\treadonly flags: ReadonlyMap<string, string>;\n}\n\nfunction parse(args: readonly string[]): Parsed {\n\tconst action = args[1];\n\tif (\n\t\taction !== \"plan\" &&\n\t\taction !== \"start\" &&\n\t\taction !== \"resume\" &&\n\t\taction !== \"restart-writer\" &&\n\t\taction !== \"retry-tasks\" &&\n\t\taction !== \"inspect\" &&\n\t\taction !== \"evidence\" &&\n\t\taction !== \"artifact\"\n\t)\n\t\tthrow new VerifiedRunError(\"usage\");\n\tconst hasId = action !== \"plan\" && action !== \"start\";\n\tconst id = hasId ? args[2] : undefined;\n\tif (hasId && (!id || id.startsWith(\"--\"))) throw new VerifiedRunError(\"usage\");\n\tconst allowed =\n\t\taction === \"plan\"\n\t\t\t? [\"--contract\", \"--json\"]\n\t\t\t: action === \"start\"\n\t\t\t\t? [\"--contract\", \"--approve\", \"--command-id\", \"--state-dir\", \"--json\"]\n\t\t\t\t: action === \"resume\" || action === \"restart-writer\" || action === \"retry-tasks\"\n\t\t\t\t\t? [\n\t\t\t\t\t\t\t\"--execute\",\n\t\t\t\t\t\t\t\"--approve\",\n\t\t\t\t\t\t\taction === \"resume\" ? \"--candidate\" : \"--base\",\n\t\t\t\t\t\t\t...(action === \"retry-tasks\" ? [\"--tasks\"] : []),\n\t\t\t\t\t\t\t\"--revision\",\n\t\t\t\t\t\t\t\"--generation\",\n\t\t\t\t\t\t\t\"--command-id\",\n\t\t\t\t\t\t\t\"--state-dir\",\n\t\t\t\t\t\t\t\"--json\",\n\t\t\t\t\t\t]\n\t\t\t\t\t: action === \"artifact\"\n\t\t\t\t\t\t? [\"--candidate\", \"--path\", \"--state-dir\", \"--json\"]\n\t\t\t\t\t\t: action === \"inspect\"\n\t\t\t\t\t\t\t? [\"--state-dir\", \"--json\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"]\n\t\t\t\t\t\t\t: [\"--state-dir\", \"--json\"];\n\tconst flags = new Map<string, string>();\n\tfor (let index = hasId ? 3 : 2; index < args.length; index++) {\n\t\tconst flag = args[index];\n\t\tif (!allowed.includes(flag) || flags.has(flag)) throw new VerifiedRunError(\"usage\");\n\t\tconst value = [\"--json\", \"--execute\", \"--recovery\", \"--writer-recovery\", \"--task-recovery\"].includes(flag)\n\t\t\t? \"true\"\n\t\t\t: args[++index];\n\t\tif (!value || value.startsWith(\"--\")) throw new VerifiedRunError(\"usage\");\n\t\tflags.set(flag, value);\n\t}\n\tif ([\"--recovery\", \"--writer-recovery\", \"--task-recovery\"].filter((flag) => flags.has(flag)).length > 1)\n\t\tthrow new VerifiedRunError(\"usage\");\n\treturn { action, id, flags };\n}\n\nfunction required(parsed: Parsed, name: string): string {\n\tconst value = parsed.flags.get(name);\n\tif (!value) throw new VerifiedRunError(\"usage\");\n\treturn value;\n}\n\nasync function withRunSignal<T>(run: (signal: AbortSignal) => Promise<T>): Promise<T> {\n\tconst controller = new AbortController();\n\tconst cancel = (): void => controller.abort();\n\tprocess.once(\"SIGINT\", cancel);\n\tprocess.once(\"SIGTERM\", cancel);\n\ttry {\n\t\treturn await run(controller.signal);\n\t} finally {\n\t\tprocess.off(\"SIGINT\", cancel);\n\t\tprocess.off(\"SIGTERM\", cancel);\n\t}\n}\n\nexport async function runVerifiedRunCli(\n\targs: string[],\n\truntime?: VerifiedRunRuntime,\n): Promise<{ readonly handled: boolean; readonly exitCode: number }> {\n\tif (args[0] !== \"run\") return { handled: false, exitCode: 0 };\n\tif (args.length === 2 && args[1] === \"--help\") {\n\t\tprocess.stdout.write(`${USAGE}\\n`);\n\t\treturn { handled: true, exitCode: 0 };\n\t}\n\ttry {\n\t\tconst parsed = parse(args);\n\t\tconst coordinator = new RunCoordinator(\n\t\t\tparsed.flags.get(\"--state-dir\") ?? join(getAgentDir(), \"verified-runs\"),\n\t\t\truntime,\n\t\t);\n\t\tlet result: unknown;\n\t\tlet exitCode = 0;\n\t\tswitch (parsed.action) {\n\t\t\tcase \"plan\":\n\t\t\t\tresult = planVerifiedRun(readJson(required(parsed, \"--contract\")));\n\t\t\t\tbreak;\n\t\t\tcase \"start\": {\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst commandId = required(parsed, \"--command-id\");\n\t\t\t\tconst contract = parseRunContract(readJson(required(parsed, \"--contract\")));\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tcoordinator.start(\n\t\t\t\t\t\tcontract,\n\t\t\t\t\t\t{\n\t\t\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\t\t\tkind: \"start\",\n\t\t\t\t\t\t\trunId: contract.runId,\n\t\t\t\t\t\t\tcommandId,\n\t\t\t\t\t\t\texpectedRevision: 0,\n\t\t\t\t\t\t\texpectedGeneration: 0,\n\t\t\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t\t\t},\n\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"resume\":\n\t\t\tcase \"retry-tasks\":\n\t\t\tcase \"restart-writer\": {\n\t\t\t\trequired(parsed, \"--execute\");\n\t\t\t\tconst approvedContractDigest = required(parsed, \"--approve\");\n\t\t\t\tconst request = {\n\t\t\t\t\tschemaVersion: VERIFIED_COMMAND_VERSION,\n\t\t\t\t\trunId: parsed.id ?? \"\",\n\t\t\t\t\tcommandId: required(parsed, \"--command-id\"),\n\t\t\t\t\texpectedRevision: Number(required(parsed, \"--revision\")),\n\t\t\t\t\texpectedGeneration: Number(required(parsed, \"--generation\")),\n\t\t\t\t\tcontractDigest: approvedContractDigest,\n\t\t\t\t};\n\t\t\t\tconst state = await withRunSignal((signal) =>\n\t\t\t\t\tparsed.action === \"retry-tasks\"\n\t\t\t\t\t\t? coordinator.retryTasks(\n\t\t\t\t\t\t\t\t{\n\t\t\t\t\t\t\t\t\t...request,\n\t\t\t\t\t\t\t\t\tkind: \"retry_tasks\",\n\t\t\t\t\t\t\t\t\tbaseDigest: required(parsed, \"--base\"),\n\t\t\t\t\t\t\t\t\ttaskIds: required(parsed, \"--tasks\") === \"-\" ? [] : required(parsed, \"--tasks\").split(\",\"),\n\t\t\t\t\t\t\t\t},\n\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t)\n\t\t\t\t\t\t: parsed.action === \"resume\"\n\t\t\t\t\t\t\t? coordinator.resume(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"resume\", candidateDigest: required(parsed, \"--candidate\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t)\n\t\t\t\t\t\t\t: coordinator.restartWriter(\n\t\t\t\t\t\t\t\t\t{ ...request, kind: \"restart_writer\", baseDigest: required(parsed, \"--base\") },\n\t\t\t\t\t\t\t\t\t{ approvedContractDigest, signal },\n\t\t\t\t\t\t\t\t),\n\t\t\t\t);\n\t\t\t\tresult = state;\n\t\t\t\texitCode = state.application === \"candidate_ready\" ? 0 : 1;\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tcase \"inspect\":\n\t\t\t\tresult = parsed.flags.has(\"--recovery\")\n\t\t\t\t\t? coordinator.inspectRecovery(parsed.id ?? \"\")\n\t\t\t\t\t: parsed.flags.has(\"--writer-recovery\")\n\t\t\t\t\t\t? coordinator.inspectWriterRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t: parsed.flags.has(\"--task-recovery\")\n\t\t\t\t\t\t\t? coordinator.inspectTaskRecovery(parsed.id ?? \"\")\n\t\t\t\t\t\t\t: coordinator.inspect(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"evidence\":\n\t\t\t\tresult = coordinator.evidence(parsed.id ?? \"\");\n\t\t\t\tbreak;\n\t\t\tcase \"artifact\": {\n\t\t\t\tconst candidate = required(parsed, \"--candidate\");\n\t\t\t\tconst path = required(parsed, \"--path\");\n\t\t\t\tconst bytes = coordinator.artifact(parsed.id ?? \"\", candidate, path);\n\t\t\t\tresult = {\n\t\t\t\t\tcandidateDigest: candidate,\n\t\t\t\t\tpath,\n\t\t\t\t\tdigest: digestBytes(bytes),\n\t\t\t\t\tbyteCount: bytes.length,\n\t\t\t\t\tencoding: \"base64\",\n\t\t\t\t\tdata: bytes.toString(\"base64\"),\n\t\t\t\t};\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tdefault: {\n\t\t\t\tconst exhaustive: never = parsed.action;\n\t\t\t\tthrow new VerifiedRunError(String(exhaustive));\n\t\t\t}\n\t\t}\n\t\tprocess.stdout.write(`${JSON.stringify(result)}\\n`);\n\t\treturn { handled: true, exitCode };\n\t} catch (error) {\n\t\tconst usage = error instanceof RunContractError || (error instanceof VerifiedRunError && error.code === \"usage\");\n\t\tconst message =\n\t\t\terror instanceof VerifiedRunError || error instanceof RunContractError\n\t\t\t\t? error.message\n\t\t\t\t: \"verified-run: operation_failed\";\n\t\tprocess.stderr.write(`${message}\\n${usage ? `${USAGE}\\n` : \"\"}`);\n\t\treturn { handled: true, exitCode: usage ? 2 : 1 };\n\t}\n}\n"]}

package/dist/core/agent-session.d.ts

@@ -348,6 +348,7 @@ export declare class AgentSession {
     private readonly _resourceObservationJournals;
     private _latestResourcePromptRunId;
     private _lastResourceAdmission;
+    private _resourcePressureStabilizer;
     private _workloadPermitPool;
     private _pendingRuntimeTerminationCause;
     private _activeRunToolTermination;
@@ -550,6 +551,14 @@ export declare class AgentSession {
      * Extract the most recent user query text from conversation messages.
      * Returns undefined when no user message exists or content is empty.
      * Handles both string content and multimodal (array) content.
+     *
+     * The scan walks the whole transcript backwards and stops at the first user
+     * message. A fixed tail window cannot work here: tool results are their own
+     * messages, so a single turn that calls two tools already leaves
+     * `[user, assistant, toolResult, toolResult]` and buries the task four deep.
+     * Losing it mid-turn collapses every skill to the neutral relevance score and
+     * degrades ranking to catalogue order, precisely while tools are running and
+     * a matching skill matters most.
      */
     private _extractCurrentQuery;
     private _getContextBudgetOptions;
@@ -562,11 +571,24 @@ export declare class AgentSession {
     private _rebuildSystemPrompt;
     private _runAgentPrompt;
     private _beginResourceGovernedRun;
+    /**
+     * Feed one snapshot's raw pressure through the per-session stabilizer.
+     * Created lazily so sessions that never probe carry no state; the first
+     * observation installs its own level directly (no warmup lag).
+     */
+    private _stabilizeResourcePressure;
     private _openResourceObservations;
     /** §20.2: record the TUI-side completion sound result in its originating run journal. */
     recordCompletionSoundResult(promptRunId: string, result: import("./completion-sound.ts").CompletionSoundResult): void;
     /** §19.4 read-only SDK surface: the most recent resource admission decision, if any. */
     getCurrentResourceAdmission(): ResourceAdmissionDecision | null;
+    /**
+     * Spec 020 Req1 — canonical subagent lane authority bound to this session.
+     * Rebuilt on each call so it tracks the live admission decision, shared
+     * permit pool, and open prompt run. Extension tool contexts read it through
+     * `ctx.getSubagentLaneAuthority()`.
+     */
+    private _getSubagentLaneAuthority;
     /** §19.4 read-only SDK surface: capture a fresh host resource snapshot. */
     getHostResourceSnapshot(): Promise<HostResourceSnapshot>;
     /** §19.4 read-only SDK surface: shared workload permit pool state, if any. */
@@ -830,8 +852,13 @@ export declare class AgentSession {
     /**
      * Effective context window for the upcoming turn.
      * Image-bearing turns with a text-only session model are auto-routed to the
-     * vision model (gpt-5.6-luna, 1M) — that window is the real limit. Text-only
-     * turns keep the session model's (typically much larger) window.
+     * vision model (gpt-5.6-luna, 1M), so the request has to fit both windows and
+     * the binding limit is the smaller one. Session windows fall on both sides of
+     * 1M: most catalogued models are smaller (median near 300K) and keep their own
+     * window as the limit, while the larger-than-1M models are the ones the clamp
+     * exists for — without it their threshold is computed against a window the
+     * vision route will not honour, and the request overflows before compaction
+     * fires. Text-only turns keep the session model's window untouched.
      */
     private _effectiveTurnContextWindow;
     private _checkProjectedCompaction;