teamloop 0.1.0

package/bin/teamloop-runner.mjs

@@ -0,0 +1,1615 @@
+#!/usr/bin/env node
+
+import os from "node:os";
+import net from "node:net";
+import tls from "node:tls";
+import path from "node:path";
+import { createHash } from "node:crypto";
+import { existsSync, mkdirSync, readdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { execFileSync, spawn } from "node:child_process";
+import { fileURLToPath } from "node:url";
+
+const DEFAULT_URL = "https://teamloop.kangkona.workers.dev";
+const DEFAULT_CAPABILITIES = ["local repo", "tests", "diff summary"];
+const DEFAULT_AGENT_TIMEOUT_MS = 30 * 60 * 1000;
+const DEFAULT_COMMAND_TIMEOUT_MS = 10 * 60 * 1000;
+const DEFAULT_WATCH_INTERVAL_MS = 15 * 1000;
+const OUTPUT_CAPTURE_LIMIT = 64 * 1024;
+const SERVICE_LABEL_PREFIX = "com.teamloop.runner";
+const SCRIPT_PATH = fileURLToPath(import.meta.url);
+
+main().catch((error) => {
+  console.error(`TeamLoop runner error: ${error.message}`);
+  if (error.cause) console.error(`Cause: ${error.cause.message ?? error.cause}`);
+  process.exit(1);
+});
+
+async function main() {
+  const [command = "help", ...args] = process.argv.slice(2);
+  const flags = parseFlags(args);
+
+  if (command === "connect") return connect(flags);
+  if (command === "poll") return poll(flags);
+  if (command === "work") return work(flags);
+  if (command === "setup") return setupService(flags);
+  if (command === "start") return startService(flags);
+  if (command === "stop") return stopService(flags);
+  if (command === "uninstall") return uninstallService(flags);
+  if (command === "status") return statusService(flags);
+  if (command === "logs") return logsService(flags);
+  if (command === "resume") return resumeWork(flags);
+  if (command === "doctor") return doctor(flags);
+  if (command === "heartbeat") return heartbeat(flags);
+  if (command === "evidence") return evidence(flags);
+  if (command === "complete") return complete(flags);
+  return help();
+}
+
+async function connect(flags) {
+  const baseUrl = normalizeUrl(flags.url ?? process.env.TEAMLOOP_URL ?? DEFAULT_URL);
+  const proxy = flags.proxy ?? process.env.TEAMLOOP_PROXY;
+  const pair = flags.pair ?? process.env.TEAMLOOP_PAIR;
+  if (!pair) throw new Error("Missing --pair. Create a pairing token in TeamLoop first.");
+
+  const name = flags.name ?? process.env.TEAMLOOP_RUNNER_NAME ?? `${os.hostname()} / Codex`;
+  const agentKind = flags.agent ?? flags.agentKind ?? process.env.TEAMLOOP_AGENT ?? "codex";
+  const capabilities = normalizeCapabilities(flags.capabilities ?? process.env.TEAMLOOP_CAPABILITIES);
+  const repoPath = resolveRepoPath(flags.repo ?? process.env.TEAMLOOP_REPO ?? process.cwd());
+
+  console.log(`Connecting ${name} to ${baseUrl}...`);
+  console.log(`Repo: ${repoPath}`);
+  const result = await request(`${baseUrl}/api/runners/register`, {
+    method: "POST",
+    body: { pair, name, agentKind, capabilities, repoPath },
+    proxy
+  });
+
+  if (!result.ok) throw new Error(result.error ?? "Runner registration failed.");
+
+  console.log("Connected.");
+  console.log(`Runner ID: ${result.runner.id}`);
+  console.log(`Workspace ID: ${result.runner.workspaceId}`);
+  console.log("");
+  console.log("Next:");
+  console.log(`  pnpm --dir /Users/mingyoo/repos/teamloop runner:poll -- --url ${baseUrl} --runner ${result.runner.id}`);
+}
+
+async function poll(flags) {
+  const baseUrl = normalizeUrl(flags.url ?? process.env.TEAMLOOP_URL ?? DEFAULT_URL);
+  const proxy = flags.proxy ?? process.env.TEAMLOOP_PROXY;
+  const runnerId = flags.runner ?? flags.runnerId ?? process.env.TEAMLOOP_RUNNER_ID;
+  if (!runnerId) throw new Error("Missing --runner. Run connect first and use the printed Runner ID.");
+
+  const result = await claimNextTask(baseUrl, proxy, runnerId);
+  if (!result.task) {
+    console.log("No queued task yet. Create a task in TeamLoop, then poll again.");
+    return;
+  }
+
+  console.log(`Task: ${result.task.title}`);
+  console.log(`Task ID: ${result.task.taskId}`);
+  console.log(`Description: ${result.task.description}`);
+  console.log("");
+  console.log("Definition of done:");
+  for (const item of result.task.definitionOfDone) console.log(`  - ${item}`);
+  console.log("");
+  console.log("Claim:");
+  console.log(JSON.stringify(result.claim, null, 2));
+  const repoPath = resolveRepoPath(flags.repo ?? process.env.TEAMLOOP_REPO ?? process.cwd());
+  const claimPath = saveClaim(repoPath, result.claim);
+  console.log("");
+  console.log(`Saved claim: ${claimPath}`);
+  console.log("");
+  console.log("Next:");
+  console.log(`  pnpm --dir ${repoPath} runner:evidence -- --claim ${claimPath} --kind test --status pass --title "Verification" --summary "Describe the passing check"`);
+  console.log(`  pnpm --dir ${repoPath} runner:complete -- --claim ${claimPath} --summary "Describe what changed"`);
+}
+
+async function work(flags) {
+  flags = withRunnerConfig(flags);
+  const baseUrl = normalizeUrl(flags.url ?? process.env.TEAMLOOP_URL ?? DEFAULT_URL);
+  const proxy = flags.proxy ?? process.env.TEAMLOOP_PROXY;
+  const runnerId = flags.runner ?? flags.runnerId ?? process.env.TEAMLOOP_RUNNER_ID;
+  if (!runnerId) throw new Error("Missing --runner. Run connect first and use the printed Runner ID.");
+
+  const repoPath = resolveRepoPath(flags.repo ?? process.env.TEAMLOOP_REPO ?? process.cwd());
+  const watch = flagEnabled(flags.watch);
+  const intervalMs = parseDurationMs(flags.interval ?? process.env.TEAMLOOP_WORK_INTERVAL, DEFAULT_WATCH_INTERVAL_MS);
+  const lock = acquireWorkLock(repoPath, runnerId);
+  let stopping = false;
+  const stop = () => {
+    stopping = true;
+    console.log("Stopping TeamLoop worker after the current step...");
+  };
+
+  process.once("SIGINT", stop);
+  process.once("SIGTERM", stop);
+
+  try {
+    console.log(`TeamLoop work runner started in ${watch ? "watch" : "once"} mode.`);
+    console.log(`Runner: ${runnerId}`);
+    console.log(`Repo: ${repoPath}`);
+    console.log(`URL: ${baseUrl}`);
+
+    do {
+      try {
+        await flushOutbox(repoPath, baseUrl, proxy);
+        await request(`${baseUrl}/api/runners/${encodeURIComponent(runnerId)}/heartbeat`, {
+          method: "POST",
+          body: { repoPath },
+          proxy
+        });
+        const didWork = await workOnce({ baseUrl, proxy, runnerId, repoPath, flags });
+        if (!watch || stopping) break;
+        if (!didWork) {
+          console.log(`No queued task. Waiting ${Math.round(intervalMs / 1000)}s...`);
+          await sleep(intervalMs);
+        }
+      } catch (error) {
+        if (!watch) throw error;
+        console.error(`TeamLoop worker iteration failed: ${error.message}`);
+        await sleep(intervalMs);
+      }
+    } while (!stopping);
+  } finally {
+    process.removeListener("SIGINT", stop);
+    process.removeListener("SIGTERM", stop);
+    lock.release();
+  }
+}
+
+async function setupService(flags) {
+  const saved = saveRunnerConfig(flags);
+  const definition = buildServiceDefinition(saved.configPath, saved.config);
+  installOrUpdateService(definition);
+  console.log("TeamLoop runner service configured and started.");
+  printServiceDefinition(definition);
+}
+
+async function startService(flags) {
+  const saved = flags.runner && flags.repo ? saveRunnerConfig(flags) : loadRunnerConfigRequired(flags);
+  const definition = buildServiceDefinition(saved.configPath, saved.config);
+  installOrUpdateService(definition);
+  console.log("TeamLoop runner service started.");
+  printServiceDefinition(definition);
+}
+
+async function stopService(flags) {
+  const saved = loadRunnerConfigRequired(flags);
+  const definition = buildServiceDefinition(saved.configPath, saved.config);
+  stopPlatformService(definition);
+  console.log("TeamLoop runner service stopped.");
+  printServiceDefinition(definition);
+}
+
+async function uninstallService(flags) {
+  const saved = loadRunnerConfigRequired(flags);
+  const definition = buildServiceDefinition(saved.configPath, saved.config);
+  stopPlatformService(definition);
+  removePlatformService(definition);
+  console.log("TeamLoop runner service uninstalled. Config and logs were left in place.");
+  printServiceDefinition(definition);
+}
+
+async function statusService(flags) {
+  const saved = loadRunnerConfigOptional(flags);
+  if (!saved) {
+    console.log("TeamLoop runner service is not configured for this repo.");
+    console.log(`Expected config: ${runnerConfigPath(flags, path.resolve(flags.repo ?? process.cwd()))}`);
+    return;
+  }
+
+  const definition = buildServiceDefinition(saved.configPath, saved.config);
+  const status = platformServiceStatus(definition);
+  console.log(`Configured: yes`);
+  console.log(`Platform: ${status.platform}`);
+  console.log(`Installed: ${status.installed ? "yes" : "no"}`);
+  console.log(`Running: ${status.running ? "yes" : "no"}`);
+  if (status.pid) console.log(`PID: ${status.pid}`);
+  printServiceDefinition(definition);
+  printOutboxStatus(saved.config.repo);
+}
+
+async function logsService(flags) {
+  const saved = loadRunnerConfigRequired(flags);
+  const definition = buildServiceDefinition(saved.configPath, saved.config);
+  const lines = Number(flags.lines ?? 80);
+  console.log(`Log: ${definition.logPath}`);
+  console.log("");
+  console.log(tailFile(definition.logPath, Number.isFinite(lines) ? lines : 80));
+}
+
+async function resumeWork(flags) {
+  flags = withRunnerConfig(flags);
+  const baseUrl = normalizeUrl(flags.url ?? process.env.TEAMLOOP_URL ?? DEFAULT_URL);
+  const proxy = flags.proxy ?? process.env.TEAMLOOP_PROXY;
+  const repoPath = resolveRepoPath(flags.repo ?? process.env.TEAMLOOP_REPO ?? process.cwd());
+  const result = await flushOutbox(repoPath, baseUrl, proxy, { verbose: true });
+  clearCurrentWorkIfOutboxEmpty(repoPath);
+  console.log(`Resume complete. Sent ${result.sent} pending item(s); ${pendingOutboxCount(repoPath)} remain.`);
+}
+
+async function doctor(flags) {
+  flags = withRunnerConfig(flags, { optional: true });
+  const repoValue = flags.repo ?? process.env.TEAMLOOP_REPO ?? process.cwd();
+  const baseUrl = normalizeUrl(flags.url ?? process.env.TEAMLOOP_URL ?? DEFAULT_URL);
+  const agentKind = flags.agent ?? flags.agentKind ?? process.env.TEAMLOOP_AGENT ?? "codex";
+  let repoPath;
+  console.log("TeamLoop runner doctor");
+  console.log(`URL: ${baseUrl}`);
+  try {
+    repoPath = resolveRepoPath(repoValue);
+    console.log(`Repo: ${repoPath}`);
+  } catch (error) {
+    console.log(`Repo: FAIL - ${error.message}`);
+  }
+
+  console.log(`Node: ${process.version} (${process.execPath})`);
+  console.log(`PATH: ${process.env.PATH ?? ""}`);
+  console.log(`Proxy: ${proxyForUrl(baseUrl, flags.proxy ?? process.env.TEAMLOOP_PROXY) ?? "none"}`);
+
+  if (repoPath) {
+    const config = loadRunnerConfigOptional({ ...flags, repo: repoPath });
+    console.log(`Config: ${config?.configPath ?? "not found"}`);
+    printOutboxStatus(repoPath);
+    const testCommand = verificationCommand(flags.test, detectTestCommand(repoPath));
+    console.log(`Detected test command: ${testCommand ?? "none"}`);
+  }
+
+  if (flags.agentCommand && !flagEnabled(flags.allowAgentCommand)) {
+    console.log("Custom agent command: FAIL - pass --allow-agent-command to acknowledge local command execution.");
+  } else if (flags.agentCommand) {
+    console.log(`Custom agent command: allowed (${flags.agentCommand})`);
+  }
+
+  const agentCommand = agentKind === "claude-code" || agentKind === "claude" ? "claude" : agentKind === "codex" ? "codex" : agentKind;
+  if (agentKind === "noop") {
+    console.log("Agent: noop");
+  } else if (commandExists(agentCommand)) {
+    const version = await runProcess(agentCommand, ["--version"], { cwd: repoPath ?? process.cwd(), timeoutMs: 5000 });
+    console.log(`Agent: ${agentCommand} found`);
+    console.log(`Agent version: ${truncateText((version.stdout || version.stderr || "").trim(), 500) || "unknown"}`);
+  } else {
+    console.log(`Agent: FAIL - ${agentCommand} not found on PATH`);
+  }
+
+  if (flagEnabled(flags.network) && flags.runner) {
+    await request(`${baseUrl}/api/runners/${encodeURIComponent(flags.runner)}/heartbeat`, {
+      method: "POST",
+      body: repoPath ? { repoPath } : undefined,
+      proxy: flags.proxy ?? process.env.TEAMLOOP_PROXY
+    });
+    console.log("Network heartbeat: ok");
+  }
+}
+
+async function heartbeat(flags) {
+  const baseUrl = normalizeUrl(flags.url ?? process.env.TEAMLOOP_URL ?? DEFAULT_URL);
+  const proxy = flags.proxy ?? process.env.TEAMLOOP_PROXY;
+  const runnerId = flags.runner ?? flags.runnerId ?? process.env.TEAMLOOP_RUNNER_ID;
+  const repoPath = flags.repo || process.env.TEAMLOOP_REPO ? resolveRepoPath(flags.repo ?? process.env.TEAMLOOP_REPO) : undefined;
+  if (!runnerId) throw new Error("Missing --runner. Run connect first and use the printed Runner ID.");
+
+  await request(`${baseUrl}/api/runners/${encodeURIComponent(runnerId)}/heartbeat`, { method: "POST", body: repoPath ? { repoPath } : undefined, proxy });
+  console.log("Heartbeat accepted.");
+}
+
+async function evidence(flags) {
+  const baseUrl = normalizeUrl(flags.url ?? process.env.TEAMLOOP_URL ?? DEFAULT_URL);
+  const proxy = flags.proxy ?? process.env.TEAMLOOP_PROXY;
+  const claim = readClaim(flags);
+  const title = flags.title ?? "Runner evidence";
+  const kind = flags.kind ?? "manual_note";
+  const status = flags.status ?? "info";
+  const body = {
+    ...claim,
+    idempotencyKey: flags.idempotency ?? buildIdempotencyKey([claim.runnerId, claim.taskId, "evidence", kind, title]),
+    kind,
+    status,
+    title,
+    summary: flags.summary ?? title,
+    rawRef: flags.rawRef
+  };
+  const result = await request(`${baseUrl}/api/runs/${encodeURIComponent(claim.runId)}/evidence`, { method: "POST", body, proxy });
+  if (!result.ok) throw new Error(result.error ?? "Evidence post failed.");
+  console.log(`Evidence accepted: ${result.evidence.id}`);
+}
+
+async function complete(flags) {
+  const baseUrl = normalizeUrl(flags.url ?? process.env.TEAMLOOP_URL ?? DEFAULT_URL);
+  const proxy = flags.proxy ?? process.env.TEAMLOOP_PROXY;
+  const claim = readClaim(flags);
+  const body = {
+    ...claim,
+    idempotencyKey: flags.idempotency ?? buildIdempotencyKey([claim.runnerId, claim.taskId, "complete"]),
+    status: flags.status ?? "success",
+    summary: flags.summary ?? "Runner completed the task.",
+    errorType: flags.errorType,
+    failureCode: flags.failureCode
+  };
+  const result = await request(`${baseUrl}/api/runs/${encodeURIComponent(claim.runId)}/complete`, { method: "POST", body, proxy });
+  if (!result.ok) throw new Error(result.error ?? "Completion post failed.");
+  console.log(`Run completed: ${result.envelope.runId}`);
+  console.log(`Readiness status: ${result.state.reviews.find((review) => review.runId === claim.runId)?.readiness ?? "pending"}`);
+}
+
+async function claimNextTask(baseUrl, proxy, runnerId) {
+  return request(`${baseUrl}/api/runners/${encodeURIComponent(runnerId)}/next-task`, { method: "GET", proxy });
+}
+
+async function workOnce(context) {
+  const { baseUrl, proxy, runnerId, repoPath, flags } = context;
+  const result = await claimNextTask(baseUrl, proxy, runnerId);
+  if (!result.task) return false;
+
+  const claimPath = saveClaim(repoPath, result.claim);
+  const workPath = saveCurrentWork(repoPath, result);
+  console.log(`Claimed task: ${result.task.title}`);
+  console.log(`Claim: ${claimPath}`);
+
+  const agentKind = flags.agent ?? flags.agentKind ?? process.env.TEAMLOOP_AGENT ?? "codex";
+  const task = result.task;
+  const claim = result.claim;
+  const logParts = [];
+  let finalStatus = "success";
+  let failureCode;
+  let errorType;
+  let completionSummary = "Runner completed the task and attached evidence.";
+
+  try {
+    await postRunEvent(baseUrl, proxy, claim, {
+      type: "agent_started",
+      title: "Loop executor started",
+      summary: `TeamLoop started ${agentKind} for ${task.title}.`,
+      metadata: { repoPath, agentKind }
+    }, repoPath);
+
+    const agentPrompt = buildAgentPrompt(task, repoPath);
+    const agentResult = await runAgent(agentKind, agentPrompt, repoPath, flags);
+    logParts.push(formatCommandLog("agent", agentResult));
+
+    const agentLogRef = writeWorkLog(repoPath, claim.runId, logParts.join("\n\n"));
+    await postEvidence(baseUrl, proxy, claim, {
+      kind: "agent_message",
+      status: agentResult.ok ? "info" : "fail",
+      title: `${agentLabel(agentKind)} result`,
+      summary: summarizeAgentResult(agentResult),
+      rawRef: agentLogRef
+    }, repoPath);
+
+    if (!agentResult.ok) {
+      finalStatus = "failed";
+      failureCode = agentResult.failureCode ?? "result_missing";
+      errorType = agentResult.timedOut ? "timeout" : "agent";
+      completionSummary = `${agentLabel(agentKind)} did not complete successfully. Evidence and logs are attached.`;
+    }
+
+    const diffResult = await collectDiff(repoPath);
+    logParts.push(formatCommandLog("diff", diffResult));
+    const diffLogRef = writeWorkLog(repoPath, claim.runId, logParts.join("\n\n"));
+    await postEvidence(baseUrl, proxy, claim, {
+      kind: "diff",
+      status: diffResult.summary.includes("No git diff") ? "warning" : "info",
+      title: "Diff summary",
+      summary: diffResult.summary,
+      rawRef: diffLogRef
+    }, repoPath);
+
+    const checks = await runVerificationChecks(repoPath, flags);
+    for (const check of checks) {
+      logParts.push(formatCommandLog(check.title, check.result));
+      const checkLogRef = writeWorkLog(repoPath, claim.runId, logParts.join("\n\n"));
+      await postEvidence(baseUrl, proxy, claim, {
+        kind: check.kind,
+        status: check.result.ok ? "pass" : "fail",
+        title: check.title,
+        summary: summarizeCommandResult(check.result),
+        rawRef: checkLogRef
+      }, repoPath);
+    }
+
+    if (checks.length === 0 && finalStatus === "success") {
+      finalStatus = "partial_success";
+      failureCode = "missing_evidence";
+      completionSummary = "Runner finished the agent pass, but no verification command was configured or detected.";
+      await postEvidence(baseUrl, proxy, claim, {
+        kind: "test",
+        status: "warning",
+        title: "Verification not configured",
+        summary: "No test command was provided and package.json did not expose a test script."
+      }, repoPath);
+    } else if (checks.some((check) => !check.result.ok)) {
+      finalStatus = "failed";
+      failureCode = "test_failed";
+      errorType = "internal";
+      completionSummary = "Runner completed the agent pass, but verification failed. Evidence is attached.";
+    }
+
+    await completeRun(baseUrl, proxy, claim, {
+      status: finalStatus,
+      summary: completionSummary,
+      failureCode,
+      errorType
+    }, repoPath);
+    clearCurrentWork(workPath);
+    console.log(`Completed task: ${task.title} (${finalStatus})`);
+    return true;
+  } catch (error) {
+    await tryPostFailure(baseUrl, proxy, claim, error, repoPath);
+    throw error;
+  }
+}
+
+async function runAgent(agentKind, prompt, repoPath, flags) {
+  const timeoutMs = parseDurationMs(flags.agentTimeout ?? process.env.TEAMLOOP_AGENT_TIMEOUT, DEFAULT_AGENT_TIMEOUT_MS);
+  if (agentKind === "noop") {
+    return {
+      command: "noop",
+      args: [],
+      ok: true,
+      exitCode: 0,
+      stdout: "Noop agent selected. TeamLoop skipped local code generation.",
+      stderr: "",
+      durationMs: 0,
+      timedOut: false
+    };
+  }
+
+  if (flags.agentCommand) {
+    if (!flagEnabled(flags.allowAgentCommand)) {
+      return {
+        command: "agent-command",
+        args: [],
+        ok: false,
+        exitCode: null,
+        stdout: "",
+        stderr: "Refusing --agent-command without --allow-agent-command. TeamLoop never runs custom local commands unless the local operator explicitly opts in.",
+        durationMs: 0,
+        timedOut: false,
+        failureCode: "agent_needs_repair"
+      };
+    }
+    return runShell(flags.agentCommand, { cwd: repoPath, timeoutMs, input: prompt });
+  }
+
+  if (agentKind === "claude-code" || agentKind === "claude") {
+    if (!commandExists("claude")) return missingAgentResult("claude");
+    const args = ["--print", "--permission-mode", flags.permissionMode ?? "auto", prompt];
+    if (flags.model) args.unshift("--model", flags.model);
+    return runProcess("claude", args, { cwd: repoPath, timeoutMs });
+  }
+
+  if (agentKind === "codex") {
+    if (!commandExists("codex")) return missingAgentResult("codex");
+    const args = ["exec", "--cd", repoPath, "--full-auto", "-"];
+    if (flags.model) args.splice(1, 0, "--model", flags.model);
+    return runProcess("codex", args, { cwd: repoPath, timeoutMs, input: prompt });
+  }
+
+  return missingAgentResult(agentKind);
+}
+
+async function runVerificationChecks(repoPath, flags) {
+  const checks = [];
+  const timeoutMs = parseDurationMs(flags.commandTimeout ?? process.env.TEAMLOOP_COMMAND_TIMEOUT, DEFAULT_COMMAND_TIMEOUT_MS);
+  const testCommand = verificationCommand(flags.test, detectTestCommand(repoPath));
+  const typecheckCommand = verificationCommand(flags.typecheck, null);
+  const lintCommand = verificationCommand(flags.lint, null);
+
+  if (testCommand) {
+    checks.push({ kind: "test", title: `Test: ${testCommand}`, result: await runShell(testCommand, { cwd: repoPath, timeoutMs }) });
+  }
+  if (typecheckCommand) {
+    checks.push({ kind: "typecheck", title: `Typecheck: ${typecheckCommand}`, result: await runShell(typecheckCommand, { cwd: repoPath, timeoutMs }) });
+  }
+  if (lintCommand) {
+    checks.push({ kind: "lint", title: `Lint: ${lintCommand}`, result: await runShell(lintCommand, { cwd: repoPath, timeoutMs }) });
+  }
+
+  return checks;
+}
+
+function verificationCommand(value, fallback) {
+  if (value === "none" || value === "false" || value === "0") return null;
+  return value ?? fallback;
+}
+
+function detectTestCommand(repoPath) {
+  const packageJson = path.join(repoPath, "package.json");
+  if (!existsSync(packageJson)) return null;
+  try {
+    const pkg = JSON.parse(readFileSync(packageJson, "utf8"));
+    if (!pkg.scripts?.test) return null;
+    if (existsSync(path.join(repoPath, "pnpm-lock.yaml"))) return "pnpm test";
+    if (existsSync(path.join(repoPath, "yarn.lock"))) return "yarn test";
+    return "npm test";
+  } catch {
+    return null;
+  }
+}
+
+async function collectDiff(repoPath) {
+  if (!existsSync(path.join(repoPath, ".git"))) {
+    return {
+      command: "git diff",
+      args: [],
+      ok: true,
+      exitCode: 0,
+      stdout: "",
+      stderr: "",
+      durationMs: 0,
+      timedOut: false,
+      summary: "No git repository detected, so TeamLoop could not collect a diff summary."
+    };
+  }
+
+  const stat = await runProcess("git", ["diff", "--stat"], { cwd: repoPath, timeoutMs: 30_000 });
+  const names = await runProcess("git", ["diff", "--name-only"], { cwd: repoPath, timeoutMs: 30_000 });
+  const changedFiles = names.stdout.split("\n").map((line) => line.trim()).filter(Boolean);
+  const statText = stat.stdout.trim();
+  const summary = statText
+    ? `${changedFiles.length} changed file(s): ${changedFiles.slice(0, 12).join(", ")}\n${statText}`
+    : "No git diff detected after the agent pass.";
+  return { ...stat, summary };
+}
+
+async function postRunEvent(baseUrl, proxy, claim, event, repoPath) {
+  const body = {
+    ...claim,
+    idempotencyKey: buildIdempotencyKey([claim.runnerId, claim.taskId, "event", event.type, event.title]),
+    type: event.type,
+    title: event.title,
+    summary: event.summary,
+    metadata: event.metadata
+  };
+  const result = await sendRunnerPost(baseUrl, proxy, repoPath, {
+    method: "POST",
+    path: `/api/runs/${encodeURIComponent(claim.runId)}/events`,
+    body
+  });
+  if (!result.ok) throw new Error(result.error ?? "Runner event post failed.");
+  return result;
+}
+
+async function postEvidence(baseUrl, proxy, claim, evidence, repoPath) {
+  const body = {
+    ...claim,
+    idempotencyKey: evidence.idempotencyKey ?? buildIdempotencyKey([claim.runnerId, claim.taskId, "evidence", evidence.kind, evidence.title]),
+    kind: evidence.kind,
+    status: evidence.status,
+    title: evidence.title,
+    summary: evidence.summary,
+    rawRef: evidence.rawRef
+  };
+  const result = await sendRunnerPost(baseUrl, proxy, repoPath, {
+    method: "POST",
+    path: `/api/runs/${encodeURIComponent(claim.runId)}/evidence`,
+    body
+  });
+  if (!result.ok) throw new Error(result.error ?? "Evidence post failed.");
+  return result;
+}
+
+async function completeRun(baseUrl, proxy, claim, completion, repoPath) {
+  const body = {
+    ...claim,
+    idempotencyKey: buildIdempotencyKey([claim.runnerId, claim.taskId, "complete"]),
+    status: completion.status,
+    summary: completion.summary,
+    errorType: completion.errorType,
+    failureCode: completion.failureCode
+  };
+  const result = await sendRunnerPost(baseUrl, proxy, repoPath, {
+    method: "POST",
+    path: `/api/runs/${encodeURIComponent(claim.runId)}/complete`,
+    body
+  });
+  if (!result.ok) throw new Error(result.error ?? "Completion post failed.");
+  return result;
+}
+
+async function tryPostFailure(baseUrl, proxy, claim, error, repoPath) {
+  let evidenceError;
+  try {
+    await postEvidence(baseUrl, proxy, claim, {
+      kind: "risk",
+      status: "fail",
+      title: "Runner work failed",
+      summary: truncateText(error instanceof Error ? error.message : String(error), 2000)
+    }, repoPath);
+  } catch (postError) {
+    evidenceError = postError;
+  }
+
+  try {
+    await completeRun(baseUrl, proxy, claim, {
+      status: "failed",
+      summary: "Runner failed before completing the local loop. Failure evidence is attached.",
+      errorType: "internal",
+      failureCode: "result_missing"
+    }, repoPath);
+  } catch (postError) {
+    console.error(`Could not post failure completion: ${postError.message}`);
+  }
+
+  if (evidenceError) {
+    console.error(`Could not post failure evidence: ${evidenceError.message}`);
+  }
+}
+
+async function sendRunnerPost(baseUrl, proxy, repoPath, post) {
+  if (!repoPath) return request(`${baseUrl}${post.path}`, { method: post.method, body: post.body, proxy });
+  const record = queueOutbound(repoPath, post);
+  try {
+    const result = await sendOutbound(baseUrl, proxy, record);
+    removeOutbound(repoPath, record.id);
+    return result;
+  } catch (error) {
+    throw new Error(`Queued outbound runner post for retry (${record.id}): ${error.message}`);
+  }
+}
+
+async function request(url, options) {
+  const proxy = proxyForUrl(url, options.proxy);
+  if (proxy) {
+    return requestViaHttpProxy(url, options, proxy);
+  }
+
+  const controller = new AbortController();
+  const timeout = setTimeout(() => controller.abort(), 20_000);
+
+  try {
+    const response = await fetch(url, {
+      method: options.method,
+      headers: options.body ? { "content-type": "application/json" } : undefined,
+      body: options.body ? JSON.stringify(options.body) : undefined,
+      signal: controller.signal
+    });
+    const text = await response.text();
+    const payload = text ? JSON.parse(text) : {};
+    if (!response.ok) throw new Error(payload.error ?? `HTTP ${response.status}`);
+    return payload;
+  } catch (error) {
+    const causeMessage = error.cause?.message ?? "";
+    const causeCode = error.cause?.code ?? "";
+    if (error.name === "AbortError" || causeCode === "UND_ERR_CONNECT_TIMEOUT" || /timeout/i.test(causeMessage)) {
+      throw new Error(
+        "Timed out while reaching TeamLoop. If the browser works but CLI does not, check terminal proxy/VPN settings such as HTTPS_PROXY."
+      );
+    }
+    throw error;
+  } finally {
+    clearTimeout(timeout);
+  }
+}
+
+async function requestViaHttpProxy(url, options, proxyUrl) {
+  const target = new URL(url);
+  const proxy = new URL(proxyUrl);
+  if (target.protocol !== "https:") throw new Error(`Proxy mode only supports HTTPS targets, got ${target.protocol}`);
+
+  const body = options.body ? JSON.stringify(options.body) : "";
+  const requestText = [
+    `${options.method} ${target.pathname}${target.search} HTTP/1.1`,
+    `Host: ${target.host}`,
+    "User-Agent: teamloop-runner/0.1",
+    "Accept: application/json",
+    "Connection: close",
+    ...(body ? ["content-type: application/json", `content-length: ${Buffer.byteLength(body)}`] : []),
+    "",
+    body
+  ].join("\r\n");
+
+  const socket = await connectProxyTunnel(target, proxy);
+  const secureSocket = await connectTls(socket, target.hostname);
+  return new Promise((resolve, reject) => {
+    const chunks = [];
+    secureSocket.setTimeout(20_000, () => {
+      secureSocket.destroy();
+      reject(new Error("Timed out while waiting for TeamLoop through the configured proxy."));
+    });
+    secureSocket.on("data", (chunk) => chunks.push(chunk));
+    secureSocket.on("error", reject);
+    secureSocket.on("end", () => {
+      try {
+        const { status, body: responseBody } = parseHttpResponse(Buffer.concat(chunks).toString("utf8"));
+        const payload = responseBody ? JSON.parse(responseBody) : {};
+        if (status < 200 || status >= 300) reject(new Error(payload.error ?? `HTTP ${status}`));
+        else resolve(payload);
+      } catch (error) {
+        reject(error);
+      }
+    });
+    secureSocket.write(requestText);
+  });
+}
+
+function connectProxyTunnel(target, proxy) {
+  return new Promise((resolve, reject) => {
+    const port = Number(proxy.port || 8080);
+    const socket = net.createConnection({ host: proxy.hostname, port });
+    const auth = proxy.username ? `Proxy-Authorization: Basic ${Buffer.from(`${decodeURIComponent(proxy.username)}:${decodeURIComponent(proxy.password)}`).toString("base64")}\r\n` : "";
+    let buffer = "";
+
+    socket.setTimeout(20_000, () => {
+      socket.destroy();
+      reject(new Error(`Timed out while connecting to proxy ${proxy.hostname}:${port}.`));
+    });
+    socket.on("connect", () => {
+      socket.write(`CONNECT ${target.hostname}:${target.port || 443} HTTP/1.1\r\nHost: ${target.hostname}:${target.port || 443}\r\n${auth}\r\n`);
+    });
+    socket.on("data", (chunk) => {
+      buffer += chunk.toString("utf8");
+      if (!buffer.includes("\r\n\r\n")) return;
+      const statusLine = buffer.split("\r\n", 1)[0] ?? "";
+      if (!statusLine.includes(" 200 ")) {
+        socket.destroy();
+        reject(new Error(`Proxy CONNECT failed: ${statusLine}`));
+        return;
+      }
+      socket.removeAllListeners("data");
+      socket.setTimeout(0);
+      resolve(socket);
+    });
+    socket.on("error", reject);
+  });
+}
+
+function connectTls(socket, hostname) {
+  return new Promise((resolve, reject) => {
+    const secureSocket = tls.connect({ socket, servername: hostname });
+    secureSocket.once("secureConnect", () => resolve(secureSocket));
+    secureSocket.once("error", reject);
+  });
+}
+
+function parseHttpResponse(raw) {
+  const headerEnd = raw.indexOf("\r\n\r\n");
+  if (headerEnd === -1) throw new Error("Invalid HTTP response from TeamLoop.");
+  const header = raw.slice(0, headerEnd);
+  const body = raw.slice(headerEnd + 4);
+  const status = Number(header.split("\r\n", 1)[0]?.split(" ")[1]);
+  if (!Number.isFinite(status)) throw new Error("Missing HTTP status from TeamLoop response.");
+  return { status, body };
+}
+
+function withRunnerConfig(flags, options = {}) {
+  const loaded = loadRunnerConfigOptional(flags);
+  if (!loaded) {
+    if (options.optional) return flags;
+    return flags;
+  }
+  return { ...loaded.config, ...flags, config: flags.config ?? loaded.configPath };
+}
+
+function saveRunnerConfig(flags) {
+  const merged = withRunnerConfig(flags, { optional: true });
+  const repo = resolveRepoPath(merged.repo ?? process.env.TEAMLOOP_REPO ?? process.cwd());
+  const runner = merged.runner ?? merged.runnerId ?? process.env.TEAMLOOP_RUNNER_ID;
+  if (!runner) throw new Error("Missing --runner. Run connect first and use the printed Runner ID.");
+  if (merged.agentCommand && !flagEnabled(merged.allowAgentCommand)) {
+    throw new Error("Refusing to save --agent-command without --allow-agent-command. Custom agent commands are local operator trust decisions.");
+  }
+
+  const configPath = runnerConfigPath(merged, repo);
+  const existing = readJsonFile(configPath, {});
+  const config = {
+    schemaVersion: 1,
+    url: normalizeUrl(merged.url ?? process.env.TEAMLOOP_URL ?? DEFAULT_URL),
+    runner,
+    repo,
+    agent: merged.agent ?? merged.agentKind ?? process.env.TEAMLOOP_AGENT ?? "codex",
+    capabilities: normalizeCapabilities(merged.capabilities ?? process.env.TEAMLOOP_CAPABILITIES),
+    interval: String(merged.interval ?? process.env.TEAMLOOP_WORK_INTERVAL ?? Math.round(DEFAULT_WATCH_INTERVAL_MS / 1000)),
+    test: merged.test ?? detectTestCommand(repo) ?? "none",
+    typecheck: merged.typecheck,
+    lint: merged.lint,
+    model: merged.model,
+    proxy: merged.proxy ?? process.env.TEAMLOOP_PROXY,
+    agentTimeout: merged.agentTimeout,
+    commandTimeout: merged.commandTimeout,
+    permissionMode: merged.permissionMode,
+    agentCommand: merged.agentCommand,
+    allowAgentCommand: flagEnabled(merged.allowAgentCommand),
+    createdAt: existing.createdAt ?? new Date().toISOString(),
+    updatedAt: new Date().toISOString()
+  };
+
+  if (!config.agentCommand) delete config.agentCommand;
+  if (!config.allowAgentCommand) delete config.allowAgentCommand;
+  for (const key of ["typecheck", "lint", "model", "proxy", "agentTimeout", "commandTimeout", "permissionMode"]) {
+    if (!config[key]) delete config[key];
+  }
+
+  mkdirSync(path.dirname(configPath), { recursive: true });
+  writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, "utf8");
+  return { configPath, config };
+}
+
+function loadRunnerConfigRequired(flags) {
+  const loaded = loadRunnerConfigOptional(flags);
+  if (!loaded) throw new Error(`Runner service config not found. Run runner:setup first or pass --config.`);
+  return loaded;
+}
+
+function loadRunnerConfigOptional(flags) {
+  const repoBase = path.resolve(flags.repo ?? process.env.TEAMLOOP_REPO ?? process.cwd());
+  const configPath = runnerConfigPath(flags, repoBase);
+  if (!existsSync(configPath)) return null;
+  const raw = JSON.parse(readFileSync(configPath, "utf8"));
+  if (raw.schemaVersion !== 1) throw new Error(`Unsupported runner config schema in ${configPath}.`);
+  if (!raw.runner) throw new Error(`Runner config is missing runner: ${configPath}`);
+  if (!raw.repo) throw new Error(`Runner config is missing repo: ${configPath}`);
+  return { configPath, config: { ...raw, repo: path.resolve(raw.repo) } };
+}
+
+function runnerConfigPath(flags, repoPath) {
+  return path.resolve(flags.config ?? process.env.TEAMLOOP_RUNNER_CONFIG ?? path.join(repoPath, ".teamloop", "runner-service.json"));
+}
+
+function buildServiceDefinition(configPath, config) {
+  const repoPath = resolveRepoPath(config.repo);
+  const serviceId = runnerServiceId(config.runner, repoPath);
+  const label = `${SERVICE_LABEL_PREFIX}.${serviceId}`;
+  const serviceName = `teamloop-runner-${serviceId}.service`;
+  const logPath = path.join(repoPath, ".teamloop", "service.log");
+  return {
+    config,
+    configPath: path.resolve(configPath),
+    repoPath,
+    serviceId,
+    label,
+    serviceName,
+    logPath,
+    nodePath: process.execPath,
+    scriptPath: SCRIPT_PATH,
+    envPath: process.env.PATH || defaultServicePath()
+  };
+}
+
+function runnerServiceId(runnerId, repoPath) {
+  return createHash("sha256").update(`${runnerId}\n${repoPath}`).digest("hex").slice(0, 12);
+}
+
+function installOrUpdateService(definition) {
+  mkdirSync(path.dirname(definition.logPath), { recursive: true });
+  if (process.platform === "darwin") return installLaunchAgent(definition);
+  if (process.platform === "linux") return installSystemdUserService(definition);
+  throw new Error(`TeamLoop service install is not implemented for ${process.platform}. Use runner:work --watch in the foreground.`);
+}
+
+function stopPlatformService(definition) {
+  if (process.platform === "darwin") return stopLaunchAgent(definition);
+  if (process.platform === "linux") return stopSystemdUserService(definition);
+  throw new Error(`TeamLoop service stop is not implemented for ${process.platform}. Stop the foreground runner:work --watch process manually.`);
+}
+
+function removePlatformService(definition) {
+  if (process.platform === "darwin") {
+    removeFileIfExists(launchAgentPath(definition));
+    return;
+  }
+  if (process.platform === "linux") {
+    removeFileIfExists(systemdUserUnitPath(definition));
+    tryExec("systemctl", ["--user", "daemon-reload"]);
+    return;
+  }
+  throw new Error(`TeamLoop service uninstall is not implemented for ${process.platform}.`);
+}
+
+function platformServiceStatus(definition) {
+  if (process.platform === "darwin") return launchAgentStatus(definition);
+  if (process.platform === "linux") return systemdUserServiceStatus(definition);
+  return { platform: process.platform, installed: false, running: false, pid: null };
+}
+
+function installLaunchAgent(definition) {
+  const plistPath = launchAgentPath(definition);
+  mkdirSync(path.dirname(plistPath), { recursive: true });
+  writeFileSync(plistPath, buildLaunchAgentPlist(definition), "utf8");
+  const domain = preferredLaunchdDomain();
+  const target = `${domain}/${definition.label}`;
+  stopLaunchAgent(definition);
+  execFileSync("launchctl", ["bootstrap", domain, plistPath], { stdio: "pipe" });
+  tryExec("launchctl", ["kickstart", "-kp", target]);
+}
+
+function stopLaunchAgent(definition) {
+  for (const domain of launchdDomains()) {
+    tryExec("launchctl", ["bootout", `${domain}/${definition.label}`]);
+  }
+}
+
+function launchAgentStatus(definition) {
+  const plistPath = launchAgentPath(definition);
+  const installed = existsSync(plistPath);
+  for (const domain of launchdDomains()) {
+    const output = tryExec("launchctl", ["print", `${domain}/${definition.label}`]);
+    if (!output.ok) continue;
+    const pid = Number(output.text.match(/\bpid\s*=\s*(\d+)/)?.[1] ?? "");
+    return {
+      platform: "launchd",
+      installed,
+      running: /state\s*=\s*running/.test(output.text) || Number.isFinite(pid),
+      pid: Number.isFinite(pid) ? pid : null
+    };
+  }
+  return { platform: "launchd", installed, running: false, pid: null };
+}
+
+function buildLaunchAgentPlist(definition) {
+  const args = [definition.nodePath, definition.scriptPath, "work", "--config", definition.configPath, "--watch"];
+  const argXml = args.map((item) => `    <string>${xmlEscape(item)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key>
+  <string>${xmlEscape(definition.label)}</string>
+  <key>ProgramArguments</key>
+  <array>
+${argXml}
+  </array>
+  <key>WorkingDirectory</key>
+  <string>${xmlEscape(definition.repoPath)}</string>
+  <key>RunAtLoad</key>
+  <true/>
+  <key>KeepAlive</key>
+  <true/>
+  <key>StandardOutPath</key>
+  <string>${xmlEscape(definition.logPath)}</string>
+  <key>StandardErrorPath</key>
+  <string>${xmlEscape(definition.logPath)}</string>
+  <key>EnvironmentVariables</key>
+  <dict>
+    <key>HOME</key>
+    <string>${xmlEscape(os.homedir())}</string>
+    <key>PATH</key>
+    <string>${xmlEscape(definition.envPath)}</string>
+  </dict>
+</dict>
+</plist>
+`;
+}
+
+function launchAgentPath(definition) {
+  return path.join(os.homedir(), "Library", "LaunchAgents", `${definition.label}.plist`);
+}
+
+function launchdDomains() {
+  const uid = currentUid();
+  return [`gui/${uid}`, `user/${uid}`];
+}
+
+function preferredLaunchdDomain() {
+  const [gui, user] = launchdDomains();
+  return tryExec("launchctl", ["print", gui]).ok ? gui : user;
+}
+
+function currentUid() {
+  return execFileSync("id", ["-u"], { encoding: "utf8" }).trim();
+}
+
+function installSystemdUserService(definition) {
+  const unitPath = systemdUserUnitPath(definition);
+  mkdirSync(path.dirname(unitPath), { recursive: true });
+  writeFileSync(unitPath, buildSystemdUserUnit(definition), "utf8");
+  execFileSync("systemctl", ["--user", "daemon-reload"], { stdio: "pipe" });
+  execFileSync("systemctl", ["--user", "enable", "--now", definition.serviceName], { stdio: "pipe" });
+}
+
+function stopSystemdUserService(definition) {
+  tryExec("systemctl", ["--user", "stop", definition.serviceName]);
+}
+
+function systemdUserServiceStatus(definition) {
+  const unitPath = systemdUserUnitPath(definition);
+  const installed = existsSync(unitPath);
+  const active = tryExec("systemctl", ["--user", "is-active", "--quiet", definition.serviceName]).ok;
+  const show = tryExec("systemctl", ["--user", "show", definition.serviceName, "--property=MainPID", "--value"]);
+  const pid = Number(show.text.trim());
+  return { platform: "systemd user", installed, running: installed && active, pid: Number.isFinite(pid) && pid > 0 ? pid : null };
+}
+
+function buildSystemdUserUnit(definition) {
+  const execStart = [definition.nodePath, definition.scriptPath, "work", "--config", definition.configPath, "--watch"].map(systemdQuote).join(" ");
+  return `[Unit]
+Description=TeamLoop local runner ${definition.config.runner}
+
+[Service]
+Type=simple
+WorkingDirectory=${systemdQuote(definition.repoPath)}
+Environment=PATH=${systemdQuote(definition.envPath)}
+ExecStart=${execStart}
+Restart=always
+RestartSec=5
+StandardOutput=append:${definition.logPath}
+StandardError=append:${definition.logPath}
+
+[Install]
+WantedBy=default.target
+`;
+}
+
+function systemdUserUnitPath(definition) {
+  return path.join(os.homedir(), ".config", "systemd", "user", definition.serviceName);
+}
+
+function systemdQuote(value) {
+  return `"${String(value).replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
+}
+
+function printServiceDefinition(definition) {
+  console.log(`Config: ${definition.configPath}`);
+  console.log(`Repo: ${definition.repoPath}`);
+  console.log(`Runner: ${definition.config.runner}`);
+  console.log(`Agent: ${definition.config.agent}`);
+  console.log(`Log: ${definition.logPath}`);
+  if (process.platform === "darwin") console.log(`LaunchAgent: ${launchAgentPath(definition)}`);
+  if (process.platform === "linux") console.log(`Systemd unit: ${systemdUserUnitPath(definition)}`);
+}
+
+function defaultServicePath() {
+  return "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin";
+}
+
+function xmlEscape(value) {
+  return String(value)
+    .replaceAll("&", "&amp;")
+    .replaceAll("<", "&lt;")
+    .replaceAll(">", "&gt;")
+    .replaceAll('"', "&quot;")
+    .replaceAll("'", "&apos;");
+}
+
+function tryExec(command, args) {
+  try {
+    return { ok: true, text: execFileSync(command, args, { encoding: "utf8", stdio: ["ignore", "pipe", "pipe"], timeout: 10_000 }) };
+  } catch (error) {
+    return { ok: false, text: `${error.stdout ?? ""}${error.stderr ?? ""}` };
+  }
+}
+
+function queueOutbound(repoPath, post) {
+  const id = outboundId(post);
+  const filePath = outboundPath(repoPath, id);
+  const record = {
+    id,
+    schemaVersion: 1,
+    method: post.method,
+    path: post.path,
+    body: post.body,
+    createdAt: new Date().toISOString()
+  };
+  mkdirSync(path.dirname(filePath), { recursive: true });
+  if (!existsSync(filePath)) {
+    writeFileSync(filePath, `${JSON.stringify(record, null, 2)}\n`, "utf8");
+  }
+  return readJsonFile(filePath, record);
+}
+
+async function flushOutbox(repoPath, baseUrl, proxy, options = {}) {
+  let sent = 0;
+  const records = outboxFiles(repoPath)
+    .map((filePath) => ({ filePath, record: JSON.parse(readFileSync(filePath, "utf8")) }))
+    .sort((left, right) => Date.parse(left.record.createdAt) - Date.parse(right.record.createdAt));
+  for (const { filePath, record } of records) {
+    try {
+      await sendOutbound(baseUrl, proxy, record);
+      unlinkSync(filePath);
+      sent += 1;
+      if (options.verbose) console.log(`Sent pending runner post: ${record.id}`);
+    } catch (error) {
+      if (options.verbose) console.error(`Could not send pending runner post ${record.id}: ${error.message}`);
+      throw error;
+    }
+  }
+  return { sent };
+}
+
+async function sendOutbound(baseUrl, proxy, record) {
+  return request(`${baseUrl}${record.path}`, { method: record.method, body: record.body, proxy });
+}
+
+function removeOutbound(repoPath, id) {
+  try {
+    unlinkSync(outboundPath(repoPath, id));
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+
+function outboundId(post) {
+  return createHash("sha256")
+    .update(`${post.method}\n${post.path}\n${post.body?.idempotencyKey ?? JSON.stringify(post.body)}`)
+    .digest("hex")
+    .slice(0, 24);
+}
+
+function outboxDir(repoPath) {
+  return path.join(repoPath, ".teamloop", "outbox");
+}
+
+function outboundPath(repoPath, id) {
+  return path.join(outboxDir(repoPath), `${safeFileName(id)}.json`);
+}
+
+function outboxFiles(repoPath) {
+  const dir = outboxDir(repoPath);
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir)
+    .filter((file) => file.endsWith(".json"))
+    .sort()
+    .map((file) => path.join(dir, file));
+}
+
+function pendingOutboxCount(repoPath) {
+  return outboxFiles(repoPath).length;
+}
+
+function clearCurrentWorkIfOutboxEmpty(repoPath) {
+  if (pendingOutboxCount(repoPath) > 0) return;
+  clearCurrentWork(path.join(repoPath, ".teamloop", "current-work.json"));
+}
+
+function printOutboxStatus(repoPath) {
+  console.log(`Outbox pending: ${pendingOutboxCount(repoPath)}`);
+}
+
+function tailFile(filePath, lines) {
+  if (!existsSync(filePath)) return "No log file yet.";
+  const content = readFileSync(filePath, "utf8");
+  return content.split(/\r?\n/).slice(-Math.max(1, lines)).join("\n");
+}
+
+function removeFileIfExists(filePath) {
+  try {
+    unlinkSync(filePath);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+
+function runProcess(command, args, options = {}) {
+  const started = Date.now();
+  const timeoutMs = options.timeoutMs ?? DEFAULT_COMMAND_TIMEOUT_MS;
+  return new Promise((resolve) => {
+    let stdout = "";
+    let stderr = "";
+    let stdoutTruncated = false;
+    let stderrTruncated = false;
+    let settled = false;
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: process.env,
+      shell: options.shell ?? false,
+      stdio: ["pipe", "pipe", "pipe"]
+    });
+
+    const timeout = setTimeout(() => {
+      if (settled) return;
+      child.kill("SIGTERM");
+      resolveOnce({
+        command,
+        args,
+        ok: false,
+        exitCode: null,
+        stdout,
+        stderr: appendLimited(stderr, `\nTimed out after ${Math.round(timeoutMs / 1000)}s.`, OUTPUT_CAPTURE_LIMIT).value,
+        durationMs: Date.now() - started,
+        timedOut: true,
+        stdoutTruncated,
+        stderrTruncated
+      });
+    }, timeoutMs);
+
+    function resolveOnce(result) {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timeout);
+      resolve(result);
+    }
+
+    child.stdout.on("data", (chunk) => {
+      const next = appendLimited(stdout, chunk.toString("utf8"), OUTPUT_CAPTURE_LIMIT);
+      stdout = next.value;
+      stdoutTruncated ||= next.truncated;
+    });
+    child.stderr.on("data", (chunk) => {
+      const next = appendLimited(stderr, chunk.toString("utf8"), OUTPUT_CAPTURE_LIMIT);
+      stderr = next.value;
+      stderrTruncated ||= next.truncated;
+    });
+    child.on("error", (error) => {
+      resolveOnce({
+        command,
+        args,
+        ok: false,
+        exitCode: null,
+        stdout,
+        stderr: error.message,
+        durationMs: Date.now() - started,
+        timedOut: false,
+        stdoutTruncated,
+        stderrTruncated,
+        failureCode: error.code === "ENOENT" ? "agent_not_detected" : "result_missing"
+      });
+    });
+    child.on("close", (code) => {
+      resolveOnce({
+        command,
+        args,
+        ok: code === 0,
+        exitCode: code,
+        stdout,
+        stderr,
+        durationMs: Date.now() - started,
+        timedOut: false,
+        stdoutTruncated,
+        stderrTruncated
+      });
+    });
+
+    if (options.input) {
+      child.stdin.write(options.input);
+    }
+    child.stdin.end();
+  });
+}
+
+function runShell(command, options = {}) {
+  return runProcess(command, [], { ...options, shell: true });
+}
+
+function appendLimited(current, addition, limit) {
+  if (current.length >= limit) return { value: current, truncated: true };
+  const remaining = limit - current.length;
+  const text = addition.length > remaining ? addition.slice(0, remaining) : addition;
+  return { value: current + text, truncated: addition.length > remaining };
+}
+
+function commandExists(command) {
+  try {
+    execFileSync("which", [command], { encoding: "utf8", stdio: "ignore", timeout: 2000 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function missingAgentResult(command) {
+  return {
+    command,
+    args: [],
+    ok: false,
+    exitCode: null,
+    stdout: "",
+    stderr: `Agent command not found on PATH: ${command}`,
+    durationMs: 0,
+    timedOut: false,
+    failureCode: "agent_not_detected"
+  };
+}
+
+function proxyForUrl(url, explicitProxy) {
+  const target = new URL(url);
+  if (isLocalTarget(target.hostname)) return null;
+  return explicitProxy || process.env.HTTPS_PROXY || process.env.HTTP_PROXY || process.env.ALL_PROXY || macSystemProxy();
+}
+
+function isLocalTarget(hostname) {
+  return hostname === "localhost" || hostname === "127.0.0.1" || hostname === "::1" || hostname.endsWith(".local");
+}
+
+function macSystemProxy() {
+  if (process.platform !== "darwin") return null;
+  try {
+    const output = execFileSync("scutil", ["--proxy"], { encoding: "utf8", timeout: 2000 });
+    if (!/\bHTTPSEnable\s*:\s*1\b/.test(output)) return null;
+    const host = output.match(/\bHTTPSProxy\s*:\s*(\S+)/)?.[1];
+    const port = output.match(/\bHTTPSPort\s*:\s*(\d+)/)?.[1];
+    return host && port ? `http://${host}:${port}` : null;
+  } catch {
+    return null;
+  }
+}
+
+function parseFlags(args) {
+  const flags = {};
+  for (let index = 0; index < args.length; index += 1) {
+    const arg = args[index];
+    if (arg === "--") continue;
+    if (!arg.startsWith("--")) continue;
+    const key = arg.slice(2);
+    const next = args[index + 1];
+    if (!next || next.startsWith("--")) {
+      flags[key] = "true";
+      flags[toCamelFlag(key)] = "true";
+      continue;
+    }
+    flags[key] = next;
+    flags[toCamelFlag(key)] = next;
+    index += 1;
+  }
+  return flags;
+}
+
+function toCamelFlag(key) {
+  return key.replace(/-([a-z])/g, (_, letter) => letter.toUpperCase());
+}
+
+function normalizeUrl(value) {
+  return value.replace(/\/+$/, "");
+}
+
+function normalizeCapabilities(value) {
+  if (!value) return DEFAULT_CAPABILITIES;
+  return value
+    .split(",")
+    .map((item) => item.trim())
+    .filter(Boolean);
+}
+
+function resolveRepoPath(value) {
+  const repoPath = path.resolve(value);
+  if (!existsSync(repoPath)) throw new Error(`Repo path does not exist: ${repoPath}`);
+  if (!statSync(repoPath).isDirectory()) throw new Error(`Repo path is not a directory: ${repoPath}`);
+  if (!looksLikeRepo(repoPath)) {
+    console.warn(`Warning: ${repoPath} does not contain .git or package.json. TeamLoop will store it, but it may not be a runnable repo.`);
+  }
+  return repoPath;
+}
+
+function looksLikeRepo(repoPath) {
+  return existsSync(path.join(repoPath, ".git")) || existsSync(path.join(repoPath, "package.json"));
+}
+
+function saveClaim(repoPath, claim) {
+  const stateDir = path.join(repoPath, ".teamloop");
+  mkdirSync(stateDir, { recursive: true });
+  const claimPath = path.join(stateDir, "last-claim.json");
+  writeFileSync(claimPath, `${JSON.stringify(claim, null, 2)}\n`, "utf8");
+  return claimPath;
+}
+
+function readClaim(flags) {
+  const repoPath = flags.repo || process.env.TEAMLOOP_REPO ? resolveRepoPath(flags.repo ?? process.env.TEAMLOOP_REPO) : process.cwd();
+  const claimPath = path.resolve(flags.claim ?? process.env.TEAMLOOP_CLAIM_FILE ?? path.join(repoPath, ".teamloop", "last-claim.json"));
+  if (!existsSync(claimPath)) throw new Error(`Claim file does not exist: ${claimPath}. Run runner:poll first.`);
+  const claim = JSON.parse(readFileSync(claimPath, "utf8"));
+  for (const key of ["workspaceId", "runnerId", "taskId", "runId", "attemptId", "claimToken"]) {
+    if (!claim[key]) throw new Error(`Claim file is missing ${key}: ${claimPath}`);
+  }
+  return claim;
+}
+
+function buildIdempotencyKey(parts) {
+  return parts
+    .map((part) => String(part ?? "").trim().toLowerCase().replace(/[^a-z0-9_-]+/g, "-"))
+    .filter(Boolean)
+    .join(":");
+}
+
+function buildAgentPrompt(task, repoPath) {
+  const definition = (task.definitionOfDone ?? []).map((item) => `- ${item}`).join("\n") || "- Implementation is complete\n- Verification evidence is attached";
+  return `You are running as a local TeamLoop loop executor.
+
+Repository:
+${repoPath}
+
+Task:
+${task.title}
+
+Description:
+${task.description || "No description provided."}
+
+Definition of done:
+${definition}
+
+Execution rules:
+- Work only inside the repository above.
+- Do not commit, push, create pull requests, or change remote services.
+- Keep the change focused on the task.
+- Prefer small, reviewable edits.
+- If you cannot complete the task, leave the repository in the safest state you can and explain the blocker.
+
+Final response:
+- Summarize what changed.
+- List verification you ran or explain why it could not run.
+- Call out remaining risks.`;
+}
+
+function summarizeAgentResult(result) {
+  if (result.ok) {
+    const summary = result.stdout.trim() || result.stderr.trim() || "Agent completed without output.";
+    return truncateText(summary, 4000);
+  }
+  return truncateText(result.stderr.trim() || result.stdout.trim() || `Agent exited with ${result.exitCode ?? "no exit code"}.`, 4000);
+}
+
+function summarizeCommandResult(result) {
+  const status = result.ok ? "passed" : result.timedOut ? "timed out" : "failed";
+  const output = result.stdout.trim() || result.stderr.trim() || "No output.";
+  return truncateText(`${result.command} ${result.args.join(" ")} ${status} in ${Math.round(result.durationMs / 1000)}s.\n${output}`, 4000);
+}
+
+function formatCommandLog(label, result) {
+  return [
+    `# ${label}`,
+    `$ ${result.command} ${result.args.join(" ")}`.trim(),
+    `exit: ${result.exitCode ?? "none"}`,
+    `duration_ms: ${result.durationMs}`,
+    result.timedOut ? "timed_out: true" : "timed_out: false",
+    "",
+    "## stdout",
+    result.stdout || "",
+    "",
+    "## stderr",
+    result.stderr || ""
+  ].join("\n");
+}
+
+function writeWorkLog(repoPath, runId, content) {
+  const logsDir = path.join(repoPath, ".teamloop", "logs");
+  mkdirSync(logsDir, { recursive: true });
+  const logPath = path.join(logsDir, `${safeFileName(runId)}.log`);
+  writeFileSync(logPath, `${content}\n`, "utf8");
+  return path.relative(repoPath, logPath);
+}
+
+function saveCurrentWork(repoPath, workItem) {
+  const stateDir = path.join(repoPath, ".teamloop");
+  mkdirSync(stateDir, { recursive: true });
+  const workPath = path.join(stateDir, "current-work.json");
+  writeFileSync(workPath, `${JSON.stringify({ ...workItem, updatedAt: new Date().toISOString() }, null, 2)}\n`, "utf8");
+  return workPath;
+}
+
+function clearCurrentWork(workPath) {
+  try {
+    unlinkSync(workPath);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+  }
+}
+
+function acquireWorkLock(repoPath, runnerId) {
+  const stateDir = path.join(repoPath, ".teamloop");
+  mkdirSync(stateDir, { recursive: true });
+  const lockPath = path.join(stateDir, "runner-work.lock");
+  const payload = {
+    pid: process.pid,
+    runnerId,
+    repoPath,
+    startedAt: new Date().toISOString()
+  };
+  for (let attempt = 0; attempt < 2; attempt += 1) {
+    try {
+      writeFileSync(lockPath, `${JSON.stringify(payload, null, 2)}\n`, { encoding: "utf8", flag: "wx" });
+      return {
+        release() {
+          try {
+            const existing = JSON.parse(readFileSync(lockPath, "utf8"));
+            if (existing.pid === process.pid) unlinkSync(lockPath);
+          } catch {
+            // Best-effort lock cleanup.
+          }
+        }
+      };
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      const existing = readJsonFile(lockPath, null);
+      if (existing?.pid && !processAlive(existing.pid)) {
+        unlinkSync(lockPath);
+        continue;
+      }
+      throw new Error(`Another TeamLoop worker is already active for this repo. Lock: ${lockPath}`);
+    }
+  }
+  throw new Error(`Could not acquire TeamLoop worker lock: ${lockPath}`);
+}
+
+function readJsonFile(filePath, fallback) {
+  try {
+    return JSON.parse(readFileSync(filePath, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
+
+function processAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (error) {
+    return error.code === "EPERM";
+  }
+}
+
+function flagEnabled(value) {
+  return value === true || value === "true" || value === "1" || value === "yes";
+}
+
+function parseDurationMs(value, fallback) {
+  if (!value) return fallback;
+  const numeric = Number(value);
+  if (!Number.isFinite(numeric) || numeric <= 0) return fallback;
+  return numeric < 1000 ? numeric * 1000 : numeric;
+}
+
+function truncateText(value, limit) {
+  return value.length > limit ? `${value.slice(0, limit)}\n...truncated...` : value;
+}
+
+function safeFileName(value) {
+  return String(value).replace(/[^a-zA-Z0-9_.-]+/g, "-");
+}
+
+function agentLabel(agentKind) {
+  if (agentKind === "claude-code" || agentKind === "claude") return "Claude Code";
+  if (agentKind === "codex") return "Codex";
+  return agentKind;
+}
+
+function sleep(ms) {
+  return new Promise((resolve) => setTimeout(resolve, ms));
+}
+
+function help() {
+  console.log(`TeamLoop runner CLI
+
+Commands:
+  connect    Register this machine as a TeamLoop runner.
+  poll       Claim the next queued task for a connected runner.
+  work       Claim and execute tasks with a local Codex or Claude loop.
+  setup      Write local runner config and install/start a background service.
+  start      Start or update the configured background service.
+  stop       Stop the configured background service.
+  uninstall  Stop and remove the configured background service file.
+  status     Show service, config, and outbox status.
+  logs       Print the service log tail.
+  resume     Retry queued runner posts after a network or service interruption.
+  doctor     Diagnose repo, agent, proxy, config, and optional network heartbeat.
+  heartbeat  Mark a connected runner online.
+  evidence   Attach evidence to the last claimed task.
+  complete   Complete the last claimed task and generate readiness.
+
+Examples:
+  pnpm --dir /Users/mingyoo/repos/teamloop runner:connect -- --pair tlp_xxx
+  pnpm --dir /Users/mingyoo/repos/teamloop runner:poll -- --runner runner_xxx
+  pnpm --dir /Users/mingyoo/repos/teamloop runner:work -- --runner runner_xxx --repo /Users/mingyoo/repos/teamloop --agent codex --once
+  pnpm --dir /Users/mingyoo/repos/teamloop runner:setup -- --runner runner_xxx --repo /Users/mingyoo/repos/teamloop --agent codex --test "pnpm test"
+  pnpm --dir /Users/mingyoo/repos/teamloop runner:resume -- --repo /Users/mingyoo/repos/teamloop
+  pnpm --dir /Users/mingyoo/repos/teamloop runner:doctor -- --repo /Users/mingyoo/repos/teamloop --agent codex
+  pnpm --dir /Users/mingyoo/repos/teamloop runner:evidence -- --kind test --status pass --title "Typecheck" --summary "pnpm typecheck passed"
+  pnpm --dir /Users/mingyoo/repos/teamloop runner:complete -- --summary "Implementation and verification are attached"
+
+Options:
+  --url           TeamLoop URL. Defaults to ${DEFAULT_URL}
+  --config        Runner service config. Defaults to <repo>/.teamloop/runner-service.json.
+  --pair          One-time pairing token from the TeamLoop UI.
+  --runner        Runner ID printed by connect.
+  --name          Runner display name. Defaults to "<hostname> / Codex".
+  --agent         Agent kind: codex, claude-code, or custom.
+  --agent-command Shell command for a custom local agent. Receives the TeamLoop prompt on stdin.
+  --allow-agent-command Required acknowledgement before TeamLoop runs --agent-command.
+  --agent-timeout Agent timeout in seconds. Defaults to 1800.
+  --capabilities  Comma-separated capability labels.
+  --repo          Local repository path. Defaults to the current working directory.
+  --once          Run a single claim/execute/complete cycle. This is the default.
+  --watch         Keep polling in the foreground.
+  --interval      Watch polling interval in seconds. Defaults to 15.
+  --test          Test command. Defaults to package.json test script when present. Use "none" to skip.
+  --typecheck     Optional typecheck command to run after the agent.
+  --lint          Optional lint command to run after the agent.
+  --command-timeout Verification command timeout in seconds. Defaults to 600.
+  --claim         Claim JSON saved by runner:poll. Defaults to .teamloop/last-claim.json.
+  --kind          Evidence kind: test, lint, typecheck, diff, screenshot, agent_message, risk, manual_note.
+  --status        Evidence status or completion status.
+  --title         Evidence or event title.
+  --summary       Evidence or completion summary.
+  --idempotency   Stable idempotency key for repeated posts.
+  --proxy         Optional HTTP proxy, for example http://127.0.0.1:7897.
+  --network       doctor only: send a safe runner heartbeat to verify network/auth.
+`);
+}