Lines 1-23javascript
1var sC=Object.defineProperty;var T=(e,r,t)=>()=>{if(t)throw t[0];try{return e&&(r=e(e=0)),r}catch(n){throw t=[n],n}};var iC=(e,r)=>{for(var t in r)sC(e,t,{get:r[t],enumerable:!0})};import{existsSync as pC,mkdirSync as mC,readFileSync as pu,readdirSync as eB,statSync as Fm,writeFileSync as fC}from"node:fs";import Km from"node:path";function Vr(e){console.error(e),process.exit(1)}function ve(e){return process.platform!=="win32"?e:{windowsHide:!0,...e}}function W(e,r){return e||Vr(`missing ${r}`),e}function an(e){try{return JSON.parse(e)}catch{return null}}function x(e,r){try{return JSON.parse(pu ...
2`)}function S(e){return String(e||"").toLowerCase().replace(/[^a-z0-9._-]+/g,"-").replace(/^-+|-+$/g,"")||"worker"}function $m(e){return S(`${new Date().toISOString().replace(/[-:]/g,"").replace(/\..+/,"Z")}-${e}`)}function Cr(e){return String(e).replace(/\/+$/,"")}function si(e){return String(e||"").replace(/\s+/g," ").trim()}function ii(e){try{return Fm(e).size}catch{return 0}}function ai(e){try{return Fm(e).mtime.toISOString()}catch{return null}}function li(e,r){return pC(e)?pu(e,"utf8").split(`
4`):""}function Vm(e){return e?pu(Km.resolve(e),"utf8"):""}function ut(e){Atomics.wait(new Int32Array(new SharedArrayBuffer(4)),0,0,e)}function jr(e){return new Promise(r=>setTimeout(r,e))}function K(e){if(!e)return!1;try{return process.kill(e,0),!0}catch{return!1}}function ir(e,r){try{process.kill(-e,r)}catch{process.kill(e,r)}}function jm(e){let r=null,t=-1/0;for(let n of e){if(!n)continue;let o=Date.parse(n);Number.isFinite(o)&&o>t&&(t=o,r=n)}return r}function mu(e){return Math.max(0,Math.round((Date.now()-e)/1e3))}var w=T(()=>{"use strict"});function fu(e){return gC.has(e)?!0:hC.some(r=>e.e ...
5`).map(r=>r.trim()).filter(Boolean)}function ae(e,r){try{let t=zm("git",r,ve({cwd:e,encoding:"utf8"}));return{status:t.status,stdout:t.stdout||""
6`).filter(Boolean);for(let s of o){let i=an(s);if(!i||typeof i!="object"||Array.isArray(i))continue;let a=i;if(r.heartbeatCount++,a.ts){let l=String(a.ts),u=Date.parse(l);Number.isFinite(u)&&u>t?r.timestampAnomalies.push({kind:"future_heartbeat_timestamp",observedAt:l,clampedTo:n}):r.lastHeartbeatAt=l}a.phase!==void 0&&a.phase!==null&&(r.lastHeartbeatPhase=String(a.phase)),a.summary!==void 0&&a.summary!==null&&(r.lastHeartbeatSummary=String(a.summary)),Bu(r.lastHeartbeatPhase)&&(r.terminalFinalResult=If(a)),r.heartbeatBlocker=a.blocker?String(a.blocker):null,a.boxResourceSnapshot&&typeof a.box ...
7`).find(Boolean)??o,160):"npm audit failed"}function Bf(e){let r=`${e.stdout}
8${e.stderr}`.trim(),t=Mw(r);if(!t||!wo(t)){let o=Co(r||`exit ${e.exitCode}`,180);return{kind:"command_failure",exitCode:e.exitCode,summary:
9`).filter(Boolean);for(let n of t){let o=an(n);if(!o)continue;let s=$w(o);if(s&&(r.firstEventAt||=s,r.lastEventAt=s),o.type==="stream_event"&&o.event&&typeof o.event=="object"&&o.event.type==="content_block_start"){let a=o.event.content_block;a?.type==="tool_use"&&(r.currentTool=String(a.name||"tool"))}if(o.type==="assistant"&&o.message&&typeof o.message=="object"){let a=o.message.content;if(Array.isArray(a)){let l=a.find(u=>u?.type==="tool_use");l&&(r.currentTool=String(l.name||r.currentTool))}}if(o.type==="tool_call"&&o.subtype==="started"){let a=o.tool_call&&typeof o.tool_call=="object"&&!A ...
LowWeak Crypto
Package source references weak cryptographic algorithms.
dist/index.jsView on unpkg · L1 10`){let t=[r.trimEnd(),""];for(let[n,o]of[...e.entries()].sort(([s],[i])=>s.localeCompare(i))){let s=o.includes(" ")||o.includes(
11`)}function St(e=Ee){return rg(e)?zu(tg(e,"utf8")):new Map}function Oo(e=Ee,r={}){let t=St(e),n=0,o=0;for(let[s,i]of t){if(!
12`)}function Li(e,r){if(!_n())return{supported:!1,unitPath:null,written:!1,enabled:!1,started:!1,note:process.platform==="linux"?"systemd-run not available \u2014 install user service manually or run `kynver daemon` under your supervisor.":"systemd user units are only supported on Linux; use `kynver daemon` manually on macOS/Windows."};let t=Cx(),n=ag.join(t,Do),o=wx(e);if(!r)return{supported:!0,unitPath:n,written:!1,enabled:!1,started:!1,note:"Dry-run \u2014 pass --execute to write and enable the user unit."};vx(t,{recursive:!0});let s=Rx(n);bx(n,o,"utf8");let i=ig("systemctl",["--user","daemo ...
HighCommand Output Exfiltration
Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.
dist/index.jsView on unpkg · L3 13`,{mode:384})}function sc(e){return{...e,...e.harnessRoot?.trim()?{harnessRoot:Ae(e.harnessRoot.trim())}:{},...e.defaultRepo?.trim()?{defaultRepo:Ae(e.defaultRepo.trim
14`,{mode:384})}function q(){return process.env.KYNVER_API_KEY?process.env.KYNVER_API_KEY:Ho().apiKey}function Bo(e){kg({...Ho(),apiKey:e})}function Nr(e){let r=process.env.KYNVER_RUNNER_TOKEN?.trim();if(r)return r;let t=Ho();if(t.runnerToken&&!(e&&t.runnerTokenAgentOsId&&t.runnerTokenAgentOsId!==e))return t.runnerToken}function Jr(e,r){kg({...Ho(),runnerToken:r,runnerTokenAgentOsId:e})}function B(e){let r=Fo(e);return r||Be("requires --base-url, KYNVER_API_URL, KYNVER_CRON_FIRE_BASE_URL, or ~/.kynver/config.json apiBaseUrl"),r}function ic(e){return Fo(e)}function Fo(e){let r=e||process.env.KYNV ...
15`)),this.name="MemoryCostPackageVersionGuardError",this.result=r}};function _u(e={}){let r=pi(e);if(!r.ok)throw new yo(r);return r}function
16`),"worker.prompt.progress.compact":"Plan progress: when planId is set, report progress with `kynver plan progress --plan <planId> --row <rowKey> --role implementer --status in_progress|running|partial|blocked`. Do not mark rows done from the worker CLI.","worker.prompt.progress.full":["Structured plan progress (required when planId is set):","- Report checkpoints with `kynver plan progress --plan <planId>
17`),"worker.prompt.merge_gate.compact":"Verification cost control: prefer local verification before requesting CI runs; do not push empty commits to re-trigger CI; record verification evidence on the PR.","worker.prompt.merge_gate.full":["Verification cost control:","- Prefer local verification of touched paths before requesting any CI run.","- Do not push empty commits to re-trigger CI.","- Record verification evidence on the PR before requesting review."].join(`
18`),"worker.prompt.plan_artifacts.compact":"Plan artifacts: when authoring or revising plan documents, open a GitHub PR early and iterate from that PR branch; do not leave the canonical plan only in a local worktree.","worker.prompt.plan_artifacts.full":["Plan artifacts (when authoring or revising plan documents):","- Create a feature branch and open a GitHub PR (draft OK) before substantial drafting; commit and push the plan file.","- Iterate on that PR branch and link the PR URL on the related task and progress evidence."].join(`
19`)},Vx={"harness.maxTaskAttempts":4,"harness.dispatchCooldownMs":5e3,"daemon.idleIntervalMs":5*6e4,"daemon.maxIdleStreak":10},wt={version:Ng,generatedAt:"1970-01-01T00:00:00.000Z",personas:Kx,instructions:$x,policyThresholds:Vx};var Nn=wt,Tg="embedded";function jx(){return Nn}function zr(){return Nn.version}function Tr(){return Tg}function lc(e,r){Nn=e,Tg=r}function cr(e){let r=Nn.instructions[e];if(typeof r==
21${n}`;return H_.some(s=>s.test(o))?"privileged":r.includes("provider:claude")||r.includes("deep_review")||r.includes("security")||r.includes("landing")||r.includes("review")||t.startsWith("land:")||r.includes("implementer")||r.includes("repair")||t.includes("implement")?"elevated":F_.some(s=>s.test(o))?"low":"elevated"}function K_(e){let r=_t(e.provider),t=e.escalatedFrom&&e.escalatedReason?`Escalated from ${e.escalatedFrom} (${e.escalatedReason}); using ${r.displayName} (${r.costTier} tier)`:`${r.displayName} selected for ${e.riskClass} orchestration (${r.costTier} tier, auth=${e.authSource}) ...
23${fr(e,"executorRef")}`.match(/\[(?:worker-)?model:\s*([^\]\n]+)\]/i)?.[1]?.trim()||void 0}function uh(e){return e.toLowerCase()}function pa(e=R()){let r=e.defaultModel?.trim();if(r)return r;let t=process.env.KYNVER_DEFAULT_MODEL?.trim();return t||dh}function da(e){let r=(e??"").toLowerCase();return!r||r.includes("composer")||r.includes("cursor")||r.includes("codex")||r.startsWith("gpt-")||r.startsWith("gpt5")?"cursor":/^claude[-_]/i.test(r)||/^(?:opus|sonnet|haiku)\b/i.test(r)?"claude":"cursor"}function iE(e,r){let t=e.trim().toLowerCase(),n=r?.trim();return t==="cursor"?{model:ta,provider:"c ...
Long lines were clipped for display.