Lines 1-23javascript
1var Cb=Object.defineProperty;var U=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};var wb=(e,r)=>{for(var t in r)Cb(e,t,{get:r[t],enumerable:!0})};import{existsSync as Ib,mkdirSync as Ob,readFileSync as xl,readdirSync as aM,statSync as Wp,writeFileSync as Nb}from"node:fs";import Lp from"node:path";function Or(e){console.error(e),process.exit(1)}function me(e){return process.platform!=="win32"?e:{windowsHide:!0,...e}}function D(e,r){return e||Or(`missing ${r}`),e}function Gt(e){try{return JSON.parse(e)}catch{return null}}function _(e,r){try{return JSON.parse(xl ...
2`)}function b(e){return String(e||"").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"")||"worker"}function Hp(e){return b(`${new Date().toISOString().replace(/[-:]/g,"").replace(/\..+/,"Z")}-${e}`)}function ur(e){return String(e).replace(/\/+$/,"")}function Ms(e){return String(e||"").replace(/\s+/g," ").trim()}function Us(e){try{return Wp(e).size}catch{return 0}}function Ws(e){try{return Wp(e).mtime.toISOString()}catch{return null}}function Ls(e,r){return Ib(e)?xl(e,"utf8").split(`
4`):""}function Bp(e){return e?xl(Lp.resolve(e),"utf8"):""}function zr(e){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,e)}function Nr(e){return new Promise(r=>setTimeout(r,e))}function $(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}function Tr(e,r){try{process.kill(-e,r)}catch{process.kill(e,r)}}function Fp(e){let r=null,t=-1/0;for(let n of e){if(!n)continue;let o=Date.parse(n);Number.isFinite(o)&&o>t&&(t=o,r=n)}return r}function El(e){return Math.max(0,Math.round((Date.now()-e)/1e3))}var w=U(()=>{"use strict"});function Pl(e){return Tb.has(e)?!0:Db.some(r=>e.e ...
5`).map(r=>r.trim()).filter(Boolean)}function se(e,r){try{let t=Gp("git",r,me({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||""
6`).filter(Boolean);for(let s of o){let i=Gt(s);if(!i||typeof i!="object"||Array.isArray(i))continue;let a=i;if(r.heartbeatCount++,a.ts){let l=String(a.ts),c=Date.parse(l);Number.isFinite(c)&&c>t?r.timestampAnomalies.push({kind:"future_heartbeat_timestamp",observedAt:l,clampedTo:n}):r.lastHeartbeatAt=l}a.phase!==void 0&&a.phase!==null&&(r.lastHeartbeatPhase=String(a.phase)),a.summary!==void 0&&a.summary!==null&&(r.lastHeartbeatSummary=String(a.summary)),ql(r.lastHeartbeatPhase)&&(r.terminalFinalResult=Rm(a)),r.heartbeatBlocker=a.blocker?String(a.blocker):null,a.boxResourceSnapshot&&typeof a.box ...
7`).find(Boolean)??o,160):"npm audit failed"}function Pm(e){let r=`${e.stdout}
8${e.stderr}`.trim(),t=FS(r);if(!t||!no(t)){let o=to(r||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:
9`).filter(Boolean);for(let n of t){let o=Gt(n);if(!o)continue;let s=qS(o);if(s&&(r.firstEventAt||=s,r.lastEventAt=s),o.type==="stream_event"&&o.event&&typeof o.event=="object"&&o.event.type==="content_block_start"){let a=o.event.content_block;a?.type==="tool_use"&&(r.currentTool=String(a.name||"tool"))}if(o.type==="assistant"&&o.message&&typeof o.message=="object"){let a=o.message.content;if(Array.isArray(a)){let l=a.find(c=>c?.type==="tool_use");l&&(r.currentTool=String(l.name||r.currentTool))}}if(o.type==="tool_call"&&o.subtype==="started"){let a=o.tool_call&&typeof o.tool_call=="object"&&!A ...
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L1 10`){let t=[r.trimEnd(),""];for(let[n,o]of[...e.entries()].sort(([s],[i])=>s.localeCompare(i))){let s=o.includes(" ")||o.includes(
11`)}function ut(e=ye){return Vm(e)?ac(Gm(e,"utf8")):new Map}function uo(e=ye,r={}){let t=ut(e),n=0,o=0;for(let[s,i]of t){if(!
12`)}function di(e,r){if(!un())return{supported:!1,unitPath:null,written:!1,enabled:!1,started:!1,note:process.platform==="linux"?"systemd-run not available \u2014 install user service manually or run `kynver daemon` under your supervisor.":"systemd user units are only supported on Linux; use `kynver daemon` manually on macOS/Windows."};let t=AC(),n=Xm.join(t,fo),o=IC(e);if(!r)return{supported:!0,unitPath:n,written:!1,enabled:!1,started:!1,note:"Dry-run \u2014 pass --execute to write and enable the user unit."};xC(t,{recursive:!0});let s=_C(n);EC(n,o,"utf8");let i=zm("systemctl",["--user","daemo ...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L3 13`,{mode:384})}function hc(e){return{...e,...e.harnessRoot?.trim()?{harnessRoot:Ce(e.harnessRoot.trim())}:{},...e.defaultRepo?.trim()?{defaultRepo:Ce(e.defaultRepo.trim
14`,{mode:384})}function Q(){return process.env.KYNVER_API_KEY?process.env.KYNVER_API_KEY:vo().apiKey}function yo(e){cf({...vo(),apiKey:e})}function of(e){let r=process.env.KYNVER_RUNNER_TOKEN?.trim();if(r)return r;let t=vo();if(t.runnerToken&&!(e&&t.runnerTokenAgentOsId&&t.runnerTokenAgentOsId!==e))return t.runnerToken}function Ur(e,r){cf({...vo(),runnerToken:r,runnerTokenAgentOsId:e})}function B(e){let r=bo(e);return r||Ie("requires --base-url, KYNVER_API_URL, KYNVER_CRON_FIRE_BASE_URL, or ~/.kynver/config.json apiBaseUrl"),r}function kc(e){return bo(e)}function bo(e){let r=e||process.env.KYNV ...
15`)),this.name="MemoryCostPackageVersionGuardError",this.result=r}};function Bl(e={}){let r=Fs(e);if(!r.ok)throw new Qn(r);return r}function
16`),"worker.prompt.progress.compact":"Plan progress: when planId is set, report progress with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`. Do not mark rows done from the worker CLI.","worker.prompt.progress.full":["Structured plan progress (required when planId is set):","- Report checkpoints with `kynver plan progress --plan <planId>
17`),"worker.prompt.merge_gate.compact":"Verification cost control: prefer local verification before requesting CI runs; do not push empty commits to re-trigger CI; record verification evidence on the PR.","worker.prompt.merge_gate.full":["Verification cost control:","- Prefer local verification of touched paths before requesting any CI run.","- Do not push empty commits to re-trigger CI.","- Record verification evidence on the PR before requesting review."].join(`
18`),"worker.prompt.plan_artifacts.compact":"Plan artifacts: when authoring or revising plan documents, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in a local worktree.","worker.prompt.plan_artifacts.full":["Plan artifacts (when authoring or revising plan documents):","- Create a feature branch and open a GitHub PR (draft OK) before substantial drafting; commit and push the plan file.","- Iterate on that PR branch and link the PR URL on the related task and progress evidence."].join(`
19`)},qC={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},pt={version:wf,generatedAt:"1970-01-01T00:00:00.000Z",personas:YC,instructions:JC,policyThresholds:qC};var gn=pt,_f="embedded";function zC(){return gn}function Lr(){return gn.version}function yr(){return _f}function Rc(e,r){gn=e,_f=r}function hn(e){let r=gn.instructions[e];if
21${n}`;return Ww.some(s=>s.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":Lw.some(s=>s.test(o))?"low":"elevated"}function Hw(e){let r=ft(e.provider),t=e.escalatedFrom&&e.escalatedReason?`Escalated from ${e.escalatedFrom} (${e.escalatedReason}); using ${r.displayName} (${r.costTier} tier)`:`${r.displayName} selected for ${e.riskClass} orchestration (${r.costTier} tier, auth=${e.authSource}) ...
23${Rr(e,"executorRef")}`.match(/\[(?:worker-)?model:\s*([^\]\n]+)\]/i)?.[1]?.trim()||void 0}function zf(e){return e.toLowerCase()}function Hc(e=y()){let r=e.defaultModel?.trim();if(r)return r;let t=process.env.KYNVER_DEFAULT_MODEL?.trim();return t||Zw}function Lc(e){let r=(e??"").toLowerCase();return!r||r.includes("composer")||r.includes("cursor")||r.includes("codex")||r.startsWith("gpt-")||r.startsWith("gpt5")?"cursor":/^claude[-_]/i.test(r)||/^(?:opus|sonnet|haiku)\b/i.test(r)?"claude":"cursor"}function r_(e,r){let t=e.trim().toLowerCase(),n=r?.trim();return t==="cursor"?{model:_c,provider:"c ...
Long lines were clipped for display.