Delete scripts

scripts/entrypoint.sh

@@ -1,94 +0,0 @@
-#!/bin/bash
-set -e
-
-# --- Configuration ---
-OPENCORE_ISO="/vm/OpenCore.iso"
-SOURCE_IMG="/vm/source.qcow2"
-EPISODE_DISK="/run/episode.qcow2"
-
-# UEFI Firmware
-OVMF_CODE="/vm/OVMF_CODE.fd"
-OVMF_VARS_ORIG="/vm/OVMF_VARS.fd"
-OVMF_VARS_RUN="/run/OVMF_VARS.fd"
-
-# Apple OSK Key
-OSK="ourhardworkbythesewordsguardedpleasedontsteal(c)AppleComputerInc"
-
-echo "--- macOS 15 Standard Boot ---"
-
-# 1. Create Ephemeral Overlay (Reset State)
-echo "Creating ephemeral overlay..."
-qemu-img create -f qcow2 -b "$SOURCE_IMG" -F qcow2 "$EPISODE_DISK"
-
-# 2. Prepare UEFI Variables
-if [ ! -f "$OVMF_VARS_RUN" ]; then
-    cp "$OVMF_VARS_ORIG" "$OVMF_VARS_RUN"
-fi
-
-# 3. Start Web Viewer
-echo "Starting web viewer..."
-websockify -D --web=/usr/share/novnc/ 8006 localhost:5900 &
-
-# 4. Automated Boot Menu Interaction
-cat <<EOF > /run/boot_robot.py
-import socket, time
-print("ROBOT: Looking for QEMU Monitor on port 4445...")
-while True:
-    try:
-        s = socket.socket()
-        s.connect(("127.0.0.1", 4445))
-        print("ROBOT: Connected! Waiting 2 seconds for BIOS splash to clear...")
-        time.sleep(2)
-
-        # Spam Enter for 20 seconds to guarantee selection
-        for i in range(8):
-            print(f"ROBOT: Sending Boot Command {i+1}/1...")
-            try:
-                s.send(b"sendkey ret\n")
-            except:
-                pass
-            time.sleep(0.5)
-            
-        print("ROBOT: Boot sequence finished. Closing.")
-        s.close()
-        break
-    except ConnectionRefusedError:
-        # QEMU not ready yet, keep waiting
-        time.sleep(1)
-    except Exception as e:
-        print(f"ROBOT: Error {e}")
-        time.sleep(1)
-EOF
-
-python3 /run/boot_robot.py &
-
-echo "Booting macOS..."
-
-exec qemu-system-x86_64 \
-  -enable-kvm \
-  -m 24G \
-  -smp 4,cores=4,threads=1,sockets=1 \
-  -machine q35,accel=kvm \
-  -no-reboot \
-  -boot menu=on,splash-time=0 \
-  -cpu Skylake-Client-noTSX-IBRS,vendor=GenuineIntel,+invtsc,+pcid,+ssse3,+sse4.2,+popcnt,+avx,+avx2,+aes,+fma,+bmi1,+bmi2,+xsave,+xsaveopt,check \
-  -smbios type=2 \
-  -device isa-applesmc,osk="$OSK" \
-  -drive if=pflash,format=raw,readonly=on,file="$OVMF_CODE" \
-  -drive if=pflash,format=raw,file="$OVMF_VARS_RUN" \
-  -vga vmware \
-  -device ide-hd,bus=ide.0,drive=OpenCoreDisk,bootindex=0 \
-  -drive id=OpenCoreDisk,if=none,format=raw,file="$OPENCORE_ISO" \
-  -device virtio-blk-pci,drive=SystemDisk,bootindex=1,serial=bootdisk \
-  -drive id=SystemDisk,if=none,format=qcow2,file="$EPISODE_DISK",cache=writeback,aio=threads \
-  -netdev user,id=net0,hostfwd=tcp::2222-:22,hostfwd=tcp::4000-:4000,hostfwd=tcp::9090-:9090 \
-  -device vmxnet3,netdev=net0,id=net0,mac=52:54:00:c9:18:27 \
-  -audiodev id=snd0,driver=none \
-  -device ich9-intel-hda \
-  -device hda-duplex,audiodev=snd0 \
-  -vnc 0.0.0.0:0 \
-  -device qemu-xhci,id=usb \
-  -device usb-kbd,bus=usb.0 \
-  -device usb-tablet,bus=usb.0 \
-  -qmp tcp:0.0.0.0:4444,server,nowait \
-  -monitor tcp:0.0.0.0:4445,server,nowait

scripts/mac15.yaml

@@ -1,31 +0,0 @@
-services:
-  macos:
-    image: dockurr/macos
-    container_name: macos
-    environment:
-      VERSION: "15"
-      DHCP: "N"
-      DISK_SIZE: "4T"
-      RAM_SIZE: "8G"
-      CPU_CORES: "4"
-      ARGUMENTS: "-device usb-tablet -qmp tcp:0.0.0.0:4444,server,nowait"
-    devices:
-      - /dev/kvm
-      - /dev/net/tun
-      - /dev/vhost-net
-    device_cgroup_rules:
-      - 'c *:* rwm'
-    cap_add:
-      - NET_ADMIN
-    ports:
-      - 8006:8006
-      - 5900:5900/tcp
-      - 5900:5900/udp
-      - 4444:4444
-      - 4000:4000
-      - 9090:9090
-      - 2222:22
-    volumes:
-      - ./macos:/storage
-    restart: "no"
-    stop_grace_period: 2m

scripts/setup-mac15.ps1

@@ -1,84 +0,0 @@
-# =============================================================================
-# setup.mac15.ps1
-# One-command clone + automatic download of mac15 files into mac15-image/
-# =============================================================================
-
-$ErrorActionPreference = 'Stop' # Exit immediately if any command fails
-
-$GithubRepo = "https://github.com/nullvoider07/mac15-base"
-$RepoName = Split-Path $GithubRepo -Leaf
-
-Write-Host "🚀 Cloning GitHub repo: $GithubRepo"
-
-# ----------------------------- Clone with GitHub CLI -----------------------
-Write-Host "🔧 Checking GitHub CLI..."
-
-if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
-    Write-Host "   GitHub CLI not found. Installing via winget..."
-    
-    # Install gh silently, accepting agreements automatically
-    winget install --id GitHub.cli --exact --accept-source-agreements --accept-package-agreements
-    
-    # Refresh the PATH variables in the current session so 'gh' is recognized immediately
-    $env:Path = [System.Environment]::GetEnvironmentVariable("Path", "Machine") + ";" + [System.Environment]::GetEnvironmentVariable("Path", "User")
-    
-    # Verify installation succeeded
-    if (-not (Get-Command gh -ErrorAction SilentlyContinue)) {
-        throw "❌ Failed to install GitHub CLI automatically. Please install it manually from https://cli.github.com"
-    }
-    Write-Host "   ✅ GitHub CLI installed successfully."
-} else {
-    Write-Host "   ✅ GitHub CLI already available."
-}
-
-gh repo clone $GithubRepo $RepoName -- --depth=1
-
-# ----------------------------- Create folder -------------------------------
-Write-Host "📁 Creating folder: mac15-image/"
-$ImagePath = Join-Path $RepoName "mac15-image"
-New-Item -ItemType Directory -Force -Path $ImagePath | Out-Null
-
-# ----------------------------- Ensure uv is available ---------------------
-Write-Host "🔧 Checking uv..."
-
-if (Get-Command uv -ErrorAction SilentlyContinue) {
-    Write-Host "   ✅ uv already available — skipping installation."
-} else {
-    Write-Host "   Installing uv package manager..."
-    Invoke-RestMethod -Uri https://astral.sh/uv/install.ps1 | Invoke-Expression
-    $env:Path += ";$HOME\.cargo\bin;$HOME\.local\bin"
-}
-
-# ----------------------------- Ephemeral venv for hf -----------------------
-Write-Host "🔧 Creating ephemeral venv for hf..."
-
-$TempDir = [System.IO.Path]::GetTempPath()
-$HfVenv = Join-Path $TempDir "hf-venv-$(New-Guid)"
-
-# uv venv picks the correct current Python automatically
-uv venv $HfVenv --quiet
-
-# Install huggingface_hub (lighter than transformers) directly into the venv
-uv pip install --python "$HfVenv\Scripts\python.exe" huggingface_hub --quiet
-
-Write-Host "   ✅ hf installed in ephemeral venv."
-
-# ----------------------------- Download Files ------------------------------
-Write-Host "📥 Downloading base.dmg and mac15.qcow2 (large files) into $RepoName\mac15-image\ ..."
-Write-Host "    (This may take a while — progress bar will show)"
-
-# Call the 'hf' command directly by its venv path for both files
-& "$HfVenv\Scripts\hf.exe" download NullVoider/mac15-base base.dmg --local-dir $ImagePath
-& "$HfVenv\Scripts\hf.exe" download NullVoider/mac15-base mac15.qcow2 --local-dir $ImagePath
-
-# ----------------------------- Cleanup venv --------------------------------
-Write-Host "🧹 Cleaning up ephemeral venv..."
-Remove-Item -Recurse -Force $HfVenv
-
-# ----------------------------- Final message -------------------------------
-Write-Host ""
-Write-Host "✅ SUCCESS!" -ForegroundColor Green
-Write-Host "   Repository cloned → $RepoName\"
-Write-Host "   Images ready at: $RepoName\mac15-image\"
-Write-Host ""
-Write-Host "   Next time just run: cd $RepoName ; git pull"

scripts/setup-mac15.sh

@@ -1,93 +0,0 @@
-#!/bin/bash
-# =============================================================================
-# setup-mac15.sh
-# One-command clone + automatic download of mac15.qcow2 into mac15-image/
-# =============================================================================
-
-set -e  # Exit immediately if any command fails
-
-GITHUB_REPO="https://github.com/nullvoider07/mac15-base"
-REPO_NAME=$(basename "$GITHUB_REPO")
-
-echo "🚀 Cloning GitHub repo: $GITHUB_REPO"
-
-# ----------------------------- Clone with GitHub CLI -----------------------
-echo "🔧 Checking GitHub CLI..."
-
-if ! command -v gh >/dev/null 2>&1; then
-    echo "   GitHub CLI not found. Attempting to install..."
-    
-    # Try Homebrew (macOS/Linux)
-    if command -v brew >/dev/null 2>&1; then
-        brew install gh
-    # Try APT (Debian/Ubuntu)
-    elif command -v apt-get >/dev/null 2>&1; then
-        curl -fsSL https://cli.github.com/packages/githubcli-archive-keyring.gpg | sudo dd of=/usr/share/keyrings/githubcli-archive-keyring.gpg && \
-        sudo chmod go+r /usr/share/keyrings/githubcli-archive-keyring.gpg && \
-        echo "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/githubcli-archive-keyring.gpg] https://cli.github.com/packages stable main" | sudo tee /etc/apt/sources.list.d/github-cli.list > /dev/null && \
-        sudo apt-get update && sudo apt-get install gh -y
-    else
-        echo "❌ Unsupported package manager. Please install GitHub CLI manually:"
-        echo "   https://cli.github.com"
-        exit 1
-    fi
-else
-    echo "   ✅ GitHub CLI already available."
-fi
-
-gh repo clone "$GITHUB_REPO" "$REPO_NAME" -- --depth=1
-
-# ----------------------------- Create folder -------------------------------
-echo "📁 Creating folder: mac15-image/"
-mkdir -p "$REPO_NAME/mac15-image"
-
-# ----------------------------- Ensure uv is available ---------------------
-echo "🔧 Checking uv..."
-
-if command -v uv >/dev/null 2>&1; then
-    echo "   uv already available — skipping installation."
-else
-    echo "   Installing uv package manager..."
-    curl -LsSf https://astral.sh/uv/install.sh | sh
-    export PATH="$HOME/.cargo/bin:$HOME/.local/bin:$PATH"
-    hash -r
-fi
-
-# ----------------------------- Ephemeral venv for huggingface-cli ----------
-# Create a temporary venv, install huggingface-hub into it, run the download,
-# then delete the venv. This avoids all PATH/hash-cache/interpreter-mismatch
-# issues caused by stale system-wide or tool-level installs.
-echo "🔧 Creating ephemeral venv for huggingface-cli..."
-
-HF_VENV="$(mktemp -d)/hf-venv"
-
-# uv venv picks the correct current Python automatically
-uv venv "$HF_VENV" --quiet
-
-# Install directly into the venv — no --system, no activation needed
-uv pip install --python "$HF_VENV/bin/python" transformers --quiet
-
-echo "   ✅ huggingface-hub installed in ephemeral venv."
-
-# ----------------------------- Download QCOW2 ------------------------------
-echo "📥 Downloading mac15.qcow2 (large file) into $REPO_NAME/mac15-image/ ..."
-echo "    (This may take a while — progress bar will show)"
-
-# Call huggingface-cli directly by its venv path — no PATH lookup, no cache
-"$HF_VENV/bin/hf" download NullVoider/mac15-base base.dmg \
-    --local-dir "$REPO_NAME/mac15-image"
-
-"$HF_VENV/bin/hf" download NullVoider/mac15-base mac15.qcow2 \
-    --local-dir "$REPO_NAME/mac15-image"
-
-# ----------------------------- Cleanup venv --------------------------------
-echo "🧹 Cleaning up ephemeral venv..."
-rm -rf "$HF_VENV"
-
-# ----------------------------- Final message -------------------------------
-echo ""
-echo "✅ SUCCESS!"
-echo "   Repository cloned → $REPO_NAME/"
-echo "   QCOW2 image ready at: $REPO_NAME/mac15-image/mac15.qcow2"
-echo ""
-echo "   Next time just run: cd $REPO_NAME && git pull"

scripts/task_executor.py

@@ -1,716 +0,0 @@
-"""
-task_executor.py — REST API task executor for the macOS AI Agent environment.
-"""
-
-import difflib
-import logging
-import os
-import re
-import shutil
-import signal
-import subprocess
-import threading
-import time
-import uuid
-from http import HTTPStatus
-
-from flask import Flask, jsonify, request
-from waitress import serve
-
-# ---------------------------------------------------------------------------
-# Configuration
-# ---------------------------------------------------------------------------
-
-TASK_BASE_DIR = os.environ.get("TASK_BASE_DIR", "/Users/AgentUser/tasks")
-API_PORT      = int(os.environ.get("API_PORT", "9090"))
-API_TOKEN     = os.environ.get("API_TOKEN", "")
-
-# ---------------------------------------------------------------------------
-# Logging
-# ---------------------------------------------------------------------------
-os.makedirs(TASK_BASE_DIR, exist_ok=True)
-LOG_FILE = os.path.join(TASK_BASE_DIR, "task_executor.log")
-
-logging.basicConfig(
-    level=logging.INFO,
-    format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
-    handlers=[
-        logging.FileHandler(LOG_FILE, encoding="utf-8"),
-        logging.StreamHandler(),
-    ],
-)
-log = logging.getLogger("task_executor")
-
-# ---------------------------------------------------------------------------
-# In-memory task store
-# ---------------------------------------------------------------------------
-_tasks: dict[str, dict] = {}
-_tasks_lock = threading.Lock()
-_TASK_MAX_AGE = int(os.environ.get("TASK_MAX_AGE", "3600"))  # 1 hour default
-
-
-def _evict_old_tasks() -> None:
-    """Drop completed/failed tasks older than TASK_MAX_AGE seconds."""
-    cutoff = time.monotonic() - _TASK_MAX_AGE
-    with _tasks_lock:
-        stale = [
-            tid for tid, t in _tasks.items()
-            if t["status"] not in ("pending", "running")
-            and t.get("_created", 0) < cutoff
-        ]
-        for tid in stale:
-            _tasks.pop(tid)
-
-app = Flask(__name__)
-
-def _check_auth() -> bool:
-    """Return True if the request is authorised (or auth is disabled)."""
-    if not API_TOKEN:
-        return True  # auth disabled if no token configured
-    auth = request.headers.get("Authorization", "")
-    return auth == f"Bearer {API_TOKEN}"
-
-# ===========================================================================
-# Custom exceptions
-# ===========================================================================
-
-class _TaskTimeoutError(RuntimeError):
-    """Raised by _run() when a subprocess exceeds its allotted time."""
-
-
-# ===========================================================================
-# Subprocess helper
-# ===========================================================================
-
-def _run(
-    command: list[str] | str,
-    cwd: str | None = None,
-    timeout: int = 120,
-    shell: bool = False,
-) -> tuple[int, str, str]:
-    """
-    Run a command in a new process group so the entire child tree can be
-    killed on timeout via os.killpg + SIGKILL (POSIX).
-
-    • list[str]  →  all internal commands (git clone/checkout/apply/diff).
-                    argv passed directly to execvp; no shell, no injection.
-    • shell=True →  user-supplied test_command and lint_command only.
-
-    Raises _TaskTimeoutError on timeout.
-    Returns (exit_code, stdout, stderr).
-    """
-    proc = subprocess.Popen(
-        command,
-        cwd=cwd,
-        shell=shell,
-        stdout=subprocess.PIPE,
-        stderr=subprocess.PIPE,
-        text=True,
-        env=os.environ.copy(),
-        start_new_session=True,
-    )
-    try:
-        out, err = proc.communicate(timeout=timeout)
-        return proc.returncode, out, err
-    except subprocess.TimeoutExpired:
-        try:
-            os.killpg(os.getpgid(proc.pid), signal.SIGKILL)
-        except ProcessLookupError:
-            pass
-        proc.wait()
-        raise _TaskTimeoutError(f"Command timed out after {timeout}s")
-
-
-# ===========================================================================
-# Test result parsers
-# ===========================================================================
-
-def _parse_pytest(text: str) -> tuple[int, int]:
-    """pytest: '5 passed, 2 failed, 1 error in 3.14s'"""
-    passed, failed = 0, 0
-    m = re.search(r"(\d+)\s+passed", text)
-    if m:
-        passed = int(m.group(1))
-    m = re.search(r"(\d+)\s+failed", text)
-    if m:
-        failed = int(m.group(1))
-    m = re.search(r"(\d+)\s+error", text)
-    if m:
-        failed += int(m.group(1))
-    return passed, failed
-
-
-def _parse_cargo(text: str) -> tuple[int, int]:
-    """cargo test: 'test result: ok. 5 passed; 0 failed; ...' — sums across binaries."""
-    passed, failed = 0, 0
-    for m in re.finditer(r"test result:.*?(\d+)\s+passed;\s*(\d+)\s+failed", text):
-        passed += int(m.group(1))
-        failed += int(m.group(2))
-    return passed, failed
-
-
-def _parse_go(text: str) -> tuple[int, int]:
-    """go test: '--- PASS/FAIL:' lines; falls back to package-level ok/FAIL."""
-    passed = len(re.findall(r"^--- PASS:", text, re.MULTILINE))
-    failed = len(re.findall(r"^--- FAIL:", text, re.MULTILINE))
-    if passed == 0 and failed == 0:
-        passed = len(re.findall(r"^ok\s+\S+",   text, re.MULTILINE))
-        failed = len(re.findall(r"^FAIL\s+\S+", text, re.MULTILINE))
-    return passed, failed
-
-
-def _parse_jest(text: str) -> tuple[int, int]:
-    """Jest: 'Tests: 2 failed, 5 passed, 7 total'"""
-    passed, failed = 0, 0
-    m = re.search(r"^Tests:\s+(.+)$", text, re.MULTILINE)
-    if m:
-        summary = m.group(1)
-        p = re.search(r"(\d+)\s+passed", summary)
-        f = re.search(r"(\d+)\s+failed", summary)
-        if p:
-            passed = int(p.group(1))
-        if f:
-            failed = int(f.group(1))
-    return passed, failed
-
-
-def _parse_dotnet(text: str) -> tuple[int, int]:
-    """dotnet test: 'Failed: 2, Passed: 3, Skipped: 0, Total: 5'"""
-    passed, failed = 0, 0
-    m = re.search(r"Failed:\s*(\d+),\s*Passed:\s*(\d+)", text)
-    if m:
-        failed = int(m.group(1))
-        passed = int(m.group(2))
-    return passed, failed
-
-
-def _parse_junit(text: str) -> tuple[int, int]:
-    """Maven / Gradle / sbt: 'Tests run: 7, Failures: 2, Errors: 0, Skipped: 0'"""
-    passed_total = failed_total = 0
-    for m in re.finditer(
-        r"Tests run:\s*(\d+),\s*Failures:\s*(\d+),\s*Errors:\s*(\d+)", text
-    ):
-        run      = int(m.group(1))
-        failures = int(m.group(2))
-        errors   = int(m.group(3))
-        failed_total += failures + errors
-        passed_total += max(run - failures - errors, 0)
-    return passed_total, failed_total
-
-
-def _dispatch_test_parser(test_command: str, text: str) -> tuple[int, int]:
-    """Route to the correct test parser; falls back to trying all."""
-    cmd = test_command.lower()
-    if "pytest" in cmd or "py.test" in cmd:
-        return _parse_pytest(text)
-    if "cargo" in cmd:
-        return _parse_cargo(text)
-    if "go test" in cmd:
-        return _parse_go(text)
-    if (
-        "jest" in cmd
-        or ("npm" in cmd and "test" in cmd)
-        or ("yarn" in cmd and "test" in cmd)
-        or ("pnpm" in cmd and "test" in cmd)
-    ):
-        return _parse_jest(text)
-    if "dotnet" in cmd:
-        return _parse_dotnet(text)
-    if "mvn" in cmd or "gradle" in cmd or "sbt" in cmd or "junit" in cmd:
-        return _parse_junit(text)
-    for parser in (
-        _parse_pytest, _parse_cargo, _parse_go,
-        _parse_jest, _parse_dotnet, _parse_junit,
-    ):
-        p, f = parser(text)
-        if p or f:
-            return p, f
-    return 0, 0
-
-
-# ===========================================================================
-# Lint error parser
-# ===========================================================================
-
-def _parse_lint_errors(lint_command: str, text: str, exit_code: int) -> int:
-    """
-    Extract an error count from linter output.
-
-    Each branch targets the canonical output format of the most common CLI
-    linters.  The fallback counts lines that contain the word 'error'
-    (case-insensitive), which covers the long tail of less common tools.
-
-    Soft scoring only — the result is stored but never changes task status.
-    """
-    cmd = lint_command.lower()
-
-    # ── ruff ────────────────────────────────────────────────────────────────
-    # "Found 3 errors." on the final summary line.
-    if "ruff" in cmd:
-        m = re.search(r"Found\s+(\d+)\s+error", text)
-        if m:
-            return int(m.group(1))
-        # ruff check --output-format json → array length
-        if "--output-format json" in cmd or "-o json" in cmd:
-            try:
-                import json
-                return len(json.loads(text))
-            except Exception:
-                pass
-
-    # ── flake8 ──────────────────────────────────────────────────────────────
-    # One error per output line: "path/to/file.py:10:1: E302 ..."
-    if "flake8" in cmd:
-        return len([l for l in text.splitlines() if re.match(r".+:\d+:\d+:\s+[EWF]", l)])
-
-    # ── mypy ────────────────────────────────────────────────────────────────
-    # "Found 4 errors in 2 files" on the summary line.
-    if "mypy" in cmd:
-        m = re.search(r"Found\s+(\d+)\s+error", text)
-        if m:
-            return int(m.group(1))
-        return text.count(": error:")
-
-    # ── pylint ──────────────────────────────────────────────────────────────
-    # "Your code has been rated at X/10" — count E/F severity messages.
-    if "pylint" in cmd:
-        return len(re.findall(r"^\S+:\d+:\d+:\s+[EF]\d{4}:", text, re.MULTILINE))
-
-    # ── cargo clippy ────────────────────────────────────────────────────────
-    # "error[E...]" lines; distinguish from "error: aborting" summary lines.
-    if "clippy" in cmd or ("cargo" in cmd and "check" in cmd):
-        return len(re.findall(r"^error\[", text, re.MULTILINE))
-
-    # ── eslint ──────────────────────────────────────────────────────────────
-    # Summary line: "3 errors, 1 warning"
-    # JSON mode: array of objects each with messages array filtered by severity=2.
-    if "eslint" in cmd:
-        if "--format json" in cmd or "-f json" in cmd:
-            try:
-                import json
-                data = json.loads(text)
-                return sum(
-                    sum(1 for msg in f.get("messages", []) if msg.get("severity") == 2)
-                    for f in data
-                )
-            except Exception:
-                pass
-        m = re.search(r"(\d+)\s+error", text)
-        return int(m.group(1)) if m else 0
-
-    # ── go vet / staticcheck ─────────────────────────────────────────────────
-    # Each non-empty output line is a diagnostic.
-    if "go vet" in cmd or "staticcheck" in cmd:
-        return len([l for l in text.splitlines() if l.strip()])
-
-    # ── clang-tidy / cppcheck ────────────────────────────────────────────────
-    if "clang-tidy" in cmd or "cppcheck" in cmd:
-        return len(re.findall(r"\berror\b", text, re.IGNORECASE))
-
-    # ── dotnet build (lint-as-build) ─────────────────────────────────────────
-    if "dotnet" in cmd and "build" in cmd:
-        m = re.search(r"(\d+)\s+Error\(s\)", text)
-        return int(m.group(1)) if m else 0
-
-    # ── generic fallback ────────────────────────────────────────────────────
-    # Non-zero exit + no recognised pattern → count 'error' occurrences.
-    if exit_code != 0:
-        return len(re.findall(r"\berror\b", text, re.IGNORECASE))
-    return 0
-
-
-# ===========================================================================
-# Patch normaliser + similarity scorer
-# ===========================================================================
-
-def _normalise_patch(patch: str) -> list[str]:
-    """
-    Strip unified-diff metadata lines and return only the content lines
-    (lines starting with +, -, or space) with leading +/- preserved.
-
-    Lines stripped:
-      diff --git ...
-      index ...
-      --- a/...
-      +++ b/...
-      @@ ... @@  (hunk headers)
-
-    This lets difflib compare the actual code changes regardless of line
-    numbers, file paths, or git object hashes — so minor reformatting of
-    the patch header doesn't penalise an otherwise identical solution.
-    """
-    kept: list[str] = []
-    for line in patch.splitlines():
-        if (
-            line.startswith("diff ")
-            or line.startswith("index ")
-            or line.startswith("--- ")
-            or line.startswith("+++ ")
-            or line.startswith("@@ ")
-        ):
-            continue
-        kept.append(line)
-    return kept
-
-
-def _patch_similarity(agent_patch: str, reference_patch: str) -> float:
-    """
-    Return a similarity ratio in [0.0, 1.0] between two unified diffs after
-    normalisation.  Uses difflib.SequenceMatcher (Ratcliff/Obershelp algorithm).
-
-    1.0  = identical changes after stripping metadata.
-    0.0  = completely different changes.
-
-    This is an informational signal — the caller decides what threshold
-    constitutes an acceptable match.
-    """
-    a = _normalise_patch(agent_patch)
-    b = _normalise_patch(reference_patch)
-    if not a and not b:
-        return 1.0
-    if not a or not b:
-        return 0.0
-    return difflib.SequenceMatcher(None, a, b).ratio()
-
-
-# ===========================================================================
-# Core task executor
-# ===========================================================================
-
-def _execute(
-    task_id:          str,
-    repo_url:         str,
-    base_commit:      str,
-    patch:            str,
-    test_command:     str,
-    timeout:          int,
-    lint_command:     str,
-    capture_diff:     bool,
-    reference_patch:  str,
-) -> None:
-    """
-    Full task lifecycle:
-
-        1. Create isolated workspace
-        2. git clone
-        3. git checkout <base_commit>
-        4. git apply <agent patch>          (if patch provided)
-        5. Run test_command                  → pass/fail counts
-        6. Run lint_command                  (if provided; soft score)
-        7. git diff <base_commit>            (if capture_diff or reference_patch)
-        8. Compute patch_similarity          (if reference_patch provided)
-        9. Single atomic _update             (status + all signals)
-       10. shutil.rmtree cleanup
-    """
-    task_dir   = os.path.join(TASK_BASE_DIR, task_id)
-    repo_dir   = os.path.join(task_dir, "repo")
-    patch_file = os.path.join(task_dir, "task.patch")
-
-    stdout_parts: list[str] = []
-    stderr_parts: list[str] = []
-    start = time.monotonic()
-
-    # Failure sentinel — overwritten on success.
-    final_update: dict = {
-        "status":           "failed",
-        "exit_code":        -1,
-        "stdout":           "",
-        "stderr":           "",
-        "tests_passed":     0,
-        "tests_failed":     0,
-        "lint_errors":      None,
-        "lint_output":      None,
-        "patch_diff":       None,
-        "patch_similarity": None,
-        "execution_time":   0.0,
-    }
-
-    def _update(**kw: object) -> None:
-        with _tasks_lock:
-            _tasks[task_id].update(kw)
-
-    _update(status="running")
-
-    try:
-        os.makedirs(task_dir, exist_ok=True)
-
-        # ── 1. Clone ───────────────────────────────────────────────────────
-        rc, out, err = _run(["git", "clone", repo_url, repo_dir], timeout=120)
-        stdout_parts.append(out); stderr_parts.append(err)
-        if rc != 0:
-            raise RuntimeError(f"git clone failed (rc={rc}): {err.strip()}")
-
-        # ── 2. Checkout ────────────────────────────────────────────────────
-        rc, out, err = _run(["git", "checkout", base_commit], cwd=repo_dir, timeout=60)
-        stdout_parts.append(out); stderr_parts.append(err)
-        if rc != 0:
-            raise RuntimeError(f"git checkout failed (rc={rc}): {err.strip()}")
-
-        # ── 3. Apply agent patch ───────────────────────────────────────────
-        if patch and patch.strip():
-            with open(patch_file, "w", encoding="utf-8") as fh:
-                fh.write(patch)
-            rc, out, err = _run(["git", "apply", patch_file], cwd=repo_dir, timeout=30)
-            stdout_parts.append(out); stderr_parts.append(err)
-            if rc != 0:
-                raise RuntimeError(f"git apply failed (rc={rc}): {err.strip()}")
-
-        # ── 4. Run tests ───────────────────────────────────────────────────
-        rc, out, err = _run(test_command, cwd=repo_dir, timeout=timeout, shell=True)
-        stdout_parts.append(out); stderr_parts.append(err)
-        test_exit_code = rc
-
-        combined_stdout = "\n".join(filter(None, stdout_parts))
-        combined_stderr = "\n".join(filter(None, stderr_parts))
-        passed, failed  = _dispatch_test_parser(
-            test_command, combined_stdout + "\n" + combined_stderr
-        )
-
-        # ── 5. Lint (soft score — never mutates status) ────────────────────
-        lint_errors_count: int | None = None
-        lint_out:          str | None = None
-
-        if lint_command and lint_command.strip():
-            try:
-                lint_rc, l_out, l_err = _run(
-                    lint_command, cwd=repo_dir, timeout=120, shell=True
-                )
-                lint_out          = (l_out + "\n" + l_err).strip() or None
-                lint_errors_count = _parse_lint_errors(
-                    lint_command, lint_out or "", lint_rc
-                )
-                log.info(
-                    "Task %s lint finished — rc=%d errors=%s",
-                    task_id, lint_rc, lint_errors_count,
-                )
-            except _TaskTimeoutError:
-                lint_out          = "Lint timed out after 120s"
-                lint_errors_count = None
-                log.warning("Task %s lint timed out", task_id)
-            except Exception as exc:
-                lint_out          = f"Lint error: {exc}"
-                lint_errors_count = None
-                log.warning("Task %s lint exception: %s", task_id, exc)
-
-        # ── 6. Capture git diff ────────────────────────────────────────────
-        # Always run when reference_patch is provided (needed for similarity).
-        # Also run when capture_diff=True (agent-produced code path).
-        patch_diff_text: str | None = None
-
-        if capture_diff or (reference_patch and reference_patch.strip()):
-            try:
-                _, diff_out, _ = _run(
-                    ["git", "diff", base_commit], cwd=repo_dir, timeout=30
-                )
-                patch_diff_text = diff_out.strip() or None
-            except Exception as exc:
-                log.warning("Task %s git diff failed: %s", task_id, exc)
-
-        # ── 7. Reference patch similarity ─────────────────────────────────
-        similarity: float | None = None
-
-        if reference_patch and reference_patch.strip():
-            try:
-                agent_diff = patch_diff_text or (patch if patch and patch.strip() else "")
-                if agent_diff:
-                    similarity = round(
-                        _patch_similarity(agent_diff, reference_patch), 4
-                    )
-                    log.info("Task %s patch_similarity=%.4f", task_id, similarity)
-            except Exception as exc:
-                log.warning("Task %s similarity computation failed: %s", task_id, exc)
-
-        # ── 8. Build success record ────────────────────────────────────────
-        final_update = {
-            "status":           "completed",
-            "exit_code":        test_exit_code,
-            "stdout":           combined_stdout,
-            "stderr":           combined_stderr,
-            "tests_passed":     passed,
-            "tests_failed":     failed,
-            "lint_errors":      lint_errors_count,
-            "lint_output":      lint_out,
-            "patch_diff":       patch_diff_text,
-            "patch_similarity": similarity,
-            "execution_time":   round(time.monotonic() - start, 3),
-        }
-
-    except _TaskTimeoutError as exc:
-        stderr_parts.append(str(exc))
-        log.error("Task %s timed out after %ds", task_id, timeout)
-        final_update.update({
-            "stdout":         "\n".join(filter(None, stdout_parts)),
-            "stderr":         "\n".join(filter(None, stderr_parts)),
-            "execution_time": round(time.monotonic() - start, 3),
-        })
-
-    except Exception as exc:
-        stderr_parts.append(str(exc))
-        log.exception("Task %s failed: %s", task_id, exc)
-        final_update.update({
-            "stdout":         "\n".join(filter(None, stdout_parts)),
-            "stderr":         "\n".join(filter(None, stderr_parts)),
-            "execution_time": round(time.monotonic() - start, 3),
-        })
-
-    finally:
-        _update(**final_update)
-        try:
-            shutil.rmtree(task_dir, ignore_errors=True)
-        except Exception:
-            pass
-
-
-# ===========================================================================
-# REST endpoints
-# ===========================================================================
-
-@app.route("/task/submit", methods=["POST"])
-def submit():
-    """
-    POST /task/submit
-
-    Body (JSON):
-        repo_url          str   required
-        base_commit       str   optional  (default: HEAD)
-        patch             str   optional  — agent's unified diff
-        test_command      str   required  — e.g. "python3 -m pytest tests/ -x"
-        timeout           int   optional  (default: 300)
-        lint_command      str   optional  — e.g. "ruff check . --output-format json"
-        capture_diff      bool  optional  (default: false)
-        reference_patch   str   optional  — ground-truth unified diff
-
-    Returns 202: { "task_id": "<uuid>", "status": "pending" }
-    """
-    if not _check_auth():
-        return jsonify(error="Unauthorized"), HTTPStatus.UNAUTHORIZED
-
-    _evict_old_tasks()
-
-    body = request.get_json(force=True, silent=True)
-    if not body:
-        return jsonify(error="Request body must be valid JSON"), HTTPStatus.BAD_REQUEST
-
-    missing = [f for f in ("repo_url", "test_command") if not body.get(f)]
-    if missing:
-        return jsonify(error=f"Missing required fields: {missing}"), HTTPStatus.BAD_REQUEST
-
-    task_id = str(uuid.uuid4())
-    record: dict = {
-        "task_id":          task_id,
-        "status":           "pending",
-        "_created":         time.monotonic(),
-        "repo_url":         body["repo_url"],
-        "base_commit":      body.get("base_commit", "HEAD"),
-        "test_command":     body["test_command"],
-        "timeout":          int(body.get("timeout", 300)),
-        "exit_code":        None,
-        "stdout":           None,
-        "stderr":           None,
-        "tests_passed":     None,
-        "tests_failed":     None,
-        "lint_errors":      None,
-        "lint_output":      None,
-        "patch_diff":       None,
-        "patch_similarity": None,
-        "execution_time":   None,
-    }
-
-    with _tasks_lock:
-        _tasks[task_id] = record
-
-    threading.Thread(
-        target=_execute,
-        args=(
-            task_id,
-            body["repo_url"],
-            body.get("base_commit", "HEAD"),
-            body.get("patch", ""),
-            body["test_command"],
-            int(body.get("timeout", 300)),
-            body.get("lint_command", ""),
-            bool(body.get("capture_diff", False)),
-            body.get("reference_patch", ""),
-        ),
-        daemon=True,
-    ).start()
-
-    log.info("Task %s submitted — repo=%s", task_id, body["repo_url"])
-    return jsonify(task_id=task_id, status="pending"), HTTPStatus.ACCEPTED
-
-
-@app.route("/task/<task_id>", methods=["GET"])
-def status(task_id: str):
-    """
-    GET /task/<task_id>
-    Returns: { "task_id": "...", "status": "pending|running|completed|failed" }
-    """
-    if not _check_auth():
-        return jsonify(error="Unauthorized"), HTTPStatus.UNAUTHORIZED
-    with _tasks_lock:
-        t = _tasks.get(task_id)
-    if t is None:
-        return jsonify(error="Task not found"), HTTPStatus.NOT_FOUND
-    return jsonify(task_id=t["task_id"], status=t["status"])
-
-
-@app.route("/task/<task_id>/result", methods=["GET"])
-def result(task_id: str):
-    """
-    GET /task/<task_id>/result
-
-    Returns 202 while running.
-    Returns 200 with full record on completion:
-        {
-            "task_id":          "...",
-            "status":           "completed|failed",
-            "exit_code":        0,
-            "stdout":           "...",
-            "stderr":           "...",
-            "tests_passed":     5,
-            "tests_failed":     1,
-            "lint_errors":      3,
-            "lint_output":      "...",
-            "patch_diff":       "...",
-            "patch_similarity": 0.9412,
-            "execution_time":   14.2
-        }
-    """
-    if not _check_auth():
-        return jsonify(error="Unauthorized"), HTTPStatus.UNAUTHORIZED
-    with _tasks_lock:
-        t = _tasks.get(task_id)
-    if t is None:
-        return jsonify(error="Task not found"), HTTPStatus.NOT_FOUND
-    if t["status"] in ("pending", "running"):
-        return jsonify(
-            task_id=task_id,
-            status=t["status"],
-            message="Task not yet complete — poll again shortly",
-        ), HTTPStatus.ACCEPTED
-    return jsonify(t)
-
-
-@app.route("/task/<task_id>", methods=["DELETE"])
-def delete(task_id: str):
-    """
-    DELETE /task/<task_id>
-    Returns: { "task_id": "...", "deleted": true }
-    """
-    if not _check_auth():
-        return jsonify(error="Unauthorized"), HTTPStatus.UNAUTHORIZED
-    with _tasks_lock:
-        if task_id not in _tasks:
-            return jsonify(error="Task not found"), HTTPStatus.NOT_FOUND
-        _tasks.pop(task_id)
-    log.info("Task %s deleted", task_id)
-    return jsonify(task_id=task_id, deleted=True)
-
-
-# ===========================================================================
-# Entry point
-# ===========================================================================
-
-if __name__ == "__main__":
-    log.info("Task executor starting on 0.0.0.0:%d", API_PORT)
-    serve(app, host="0.0.0.0", port=API_PORT, threads=16)