@addai/node 0.4.0

package/dist/session-runner.js

@@ -0,0 +1,2271 @@
+"use strict";
+// Runs one Claude / Codex session for a Supabase-issued request.
+//
+// Three agent paths, picked by req.agent + req.mode:
+//   1. claude / claude-bypass + mode=tui    → PTY + JSONL tail (claude-spawn.ts)
+//   2. claude / claude-bypass + mode=print  → claude --print stream-json (claude-print.ts)
+//   3. codex                  + mode=*      → codex exec --json (codex-spawn.ts)
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.notifyFlowsIfFlowRequest = notifyFlowsIfFlowRequest;
+exports.notifyWidgetstudioIfWidgetRequest = notifyWidgetstudioIfWidgetRequest;
+exports.notifySelfImproveIfEnabled = notifySelfImproveIfEnabled;
+exports.resumeSessionIsVoid = resumeSessionIsVoid;
+exports.runRequest = runRequest;
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+const supabase_client_1 = require("./supabase-client");
+const git_identity_1 = require("./git-identity");
+const config_1 = require("./config");
+const store_1 = require("./store");
+const claude_spawn_1 = require("./claude-spawn");
+const claude_config_1 = require("./claude-config");
+const precompact_hook_1 = require("./precompact-hook");
+const jsonl_tail_1 = require("./jsonl-tail");
+const events_1 = require("./events");
+const paths_1 = require("./paths");
+const projects_1 = require("./projects");
+const claude_print_1 = require("./claude-print");
+const attachments_1 = require("./attachments");
+const codex_spawn_1 = require("./codex-spawn");
+const diskguard_1 = require("./diskguard");
+const kimi_spawn_1 = require("./kimi-spawn");
+const gemini_spawn_1 = require("./gemini-spawn");
+const grok_spawn_1 = require("./grok-spawn");
+const model_filter_1 = require("./model-filter");
+const agent_auth_1 = require("./agent-auth");
+const prompt_keystrokes_1 = require("./prompt-keystrokes");
+const projects_2 = require("./projects");
+const run_retry_1 = require("./run-retry");
+const hang_watchdog_1 = require("./hang-watchdog");
+const install_1 = require("./install");
+const memory_capture_1 = require("./memory-capture");
+const memory_pack_1 = require("./memory-pack");
+const guardrails_1 = require("./guardrails");
+const time_context_1 = require("./time-context");
+// Idle window after the LAST mid-turn event before we declare the turn
+// complete. Reset on JSONL events AND on raw PTY stdout activity from
+// claude (the "Brewing…" / "Thinking…" spinner emits bytes while claude
+// is processing — bytes mean claude is NOT idle, regardless of whether
+// JSONL events fire). When the spinner truly stops, no bytes for
+// TURN_IDLE_MS → fire turn_complete. 60s is comfortable for normal
+// inter-tool reasoning.
+const TURN_IDLE_MS = 60_000;
+// Prompts longer than this are NOT typed into the TUI keystroke-by-keystroke
+// (a large burst overflows the PTY input buffer under MCP load and drops
+// bytes — mangling the prompt). Instead the daemon writes the full prompt to
+// a file in the cwd and types only a short pointer; the agent reads the file
+// at full fidelity. Short prompts are still typed inline.
+const TUI_INLINE_PROMPT_MAX = 2000;
+// NOTE: there is intentionally NO wall-clock hard cap on a turn. An
+// actively-working agent keeps emitting PTY frames (which reset the idle
+// timer), so it is never killed by elapsed time — only by going idle
+// (turn finished) or by the node's configured timeout (armNodeTimeout).
+// Module-level registry of active claude-tui spawns keyed by their
+// claude session id. Lets continuation turns (chat sessions w/
+// resume_session_id) gracefully replace the prior spawn instead of
+// starting a SECOND claude that races the first one on the same
+// JSONL — two tails on the same file produced cross-attributed events
+// and apparent "replays" in entity studio chat.
+const activeClaudeTuiSpawns = new Map();
+// Set of request ids whose spawn was SIGHUP'd by a continuation turn's
+// pre-spawn teardown. Their `spawn.onExit` will fire with exitCode 129
+// — that's OUR teardown signal, not a real failure. The handler emits
+// a clean `session_end` event (or skips it) instead of one carrying
+// exitCode 129, which would otherwise show an "exit_129" badge in
+// entity studio chat on the prior message bubble.
+const supersededByContinuation = new Set();
+const TRANSCRIPT_TIMEOUT_MS = 30_000;
+// TUI settle tuning. The daemon waits for at least INITIAL_OUTPUT_MIN_BYTES
+// of stdout, then a TUI_SETTLE_MS quiet window, before typing the prompt.
+// Shorter values mean lower first-token latency but risk typing into a
+// half-drawn input box.
+//
+// Empirical: claude renders its initial frame in ~300-500ms on a fast box;
+// the quiet window only needs to outlast inter-frame redraws (~30-60ms).
+// 600ms is comfortable margin. INITIAL_OUTPUT_MIN_BYTES dropped to 60
+// since claude's first frame is sometimes very compact (~80 bytes) on
+// resume.
+const TUI_SETTLE_MS = 600;
+const INITIAL_OUTPUT_MIN_BYTES = 60;
+// Even shorter settle for --resume: claude already has the transcript
+// in memory and renders almost immediately.
+const TUI_SETTLE_MS_RESUME = 350;
+function token() {
+    const p = (0, store_1.readPairing)();
+    if (!p)
+        throw new Error('not_paired');
+    return p.daemonToken;
+}
+function startCancelWatcher(requestId, onCancel) {
+    let timer = null;
+    let stopped = false;
+    const tick = async () => {
+        if (stopped)
+            return;
+        try {
+            const status = await (0, supabase_client_1.rpc)('runtime_get_request_status', {
+                p_token: token(),
+                p_request_id: requestId,
+            });
+            if (stopped)
+                return;
+            if (status === 'canceled') {
+                stopped = true;
+                onCancel();
+                return;
+            }
+            // Terminal states besides canceled mean the caller already stopped
+            // the spawn — no point continuing to poll.
+            if (status === 'completed' || status === 'failed') {
+                stopped = true;
+                return;
+            }
+        }
+        catch (err) {
+            // Transient errors are fine; just keep polling.
+        }
+        if (!stopped)
+            timer = setTimeout(tick, 750);
+    };
+    timer = setTimeout(tick, 750);
+    return {
+        stop() {
+            stopped = true;
+            if (timer) {
+                clearTimeout(timer);
+                timer = null;
+            }
+        },
+    };
+}
+async function emit(requestId, type, payload) {
+    try {
+        await (0, supabase_client_1.rpc)('runtime_event_emit', {
+            p_token: token(),
+            p_request_id: requestId,
+            p_type: type,
+            p_payload: payload ?? null,
+        });
+    }
+    catch (err) {
+        console.error(`[session-runner] event_emit [reqId=${requestId}, type=${type}] failed: ${err.message}`);
+    }
+}
+async function setStatus(requestId, fields) {
+    try {
+        await (0, supabase_client_1.rpc)('runtime_request_update', {
+            p_token: token(),
+            p_request_id: requestId,
+            p_status: fields.status ?? null,
+            p_spawned_session_id: fields.spawnedSessionId ?? null,
+            p_jsonl_path: fields.jsonlPath ?? null,
+            p_error_code: fields.errorCode ?? null,
+            p_error_message: fields.errorMessage ?? null,
+            p_working_directory: fields.workingDirectory ?? null,
+        });
+    }
+    catch (err) {
+        console.error(`[session-runner] request_update [reqId=${requestId}, status=${fields.status ?? '-'}] failed: ${err.message}`);
+    }
+    // Async-pause completion hook — when a flow-issued request reaches a
+    // terminal status, ping addai-flows so it can resume the paused run.
+    // Fire-and-forget so a slow webhook never blocks the next request
+    // pickup. The function has its own retry / timeout logic.
+    if (fields.status === 'completed' || fields.status === 'failed' || fields.status === 'canceled') {
+        void notifyFlowsIfFlowRequest(requestId).catch(err => console.error(`[session-runner] notify flow [reqId=${requestId}] error: ${err.message}`));
+        void notifyWidgetstudioIfWidgetRequest(requestId).catch(err => console.error(`[session-runner] notify widgetstudio [reqId=${requestId}] error: ${err.message}`));
+    }
+    // Self-improve hook — ONLY on a clean `completed`. A failed/canceled run
+    // didn't produce a trustworthy outcome to learn from. Best-effort and
+    // fully non-fatal: a missing endpoint, disabled flag, or non-entity run
+    // all silently no-op.
+    if (fields.status === 'completed') {
+        void notifySelfImproveIfEnabled(requestId).catch(err => console.error(`[session-runner] notify self-improve [reqId=${requestId}] error: ${err.message}`));
+        // +Ai Memory (Task 5) — episode capture. Same gating rationale as
+        // self-improve above (only a clean completion is a trustworthy turn to
+        // remember), and the same best-effort/non-fatal contract.
+        void notifyCaptureIfEnabled(requestId).catch(err => console.error(`[session-runner] notify capture [reqId=${requestId}] error: ${err.message}`));
+    }
+}
+// Hard ceiling on any single run's execution time. Acts as the fallback
+// "max processing time" when the dispatching node / entity does NOT specify
+// req.timeout_seconds. Without an upper bound an agent that hangs (e.g. a
+// wedged MCP, an infinite tool loop, or a TUI that never goes idle) would
+// hold an inflight slot forever. An explicit positive req.timeout_seconds
+// always wins over this default; a sentinel of <0 means "truly unlimited"
+// for callers that opt out deliberately.
+const DEFAULT_RUN_TIMEOUT_SECONDS = 60 * 60; // 1h
+/**
+ * Node-configured execution timeout. When `req.timeout_seconds` is set,
+ * stop the agent after that many seconds via `onTimeout` (kill the spawn).
+ * The caller treats a timed-out run as a clean completion so whatever the
+ * agent produced is surfaced (complete-with-partial).
+ *
+ * Fallback semantics:
+ *   - req.timeout_seconds > 0  → honor it exactly (per-entity cap).
+ *   - req.timeout_seconds null/0 → fall back to DEFAULT_RUN_TIMEOUT_SECONDS
+ *     so a run can never hang forever and starve the inflight pool.
+ *   - req.timeout_seconds < 0  → opt out: truly unlimited, no timer armed.
+ *
+ * This replaces the daemon's old fixed caps (15-min TUI hard cap / 30-min
+ * pump cap) that killed healthy long-running agents while still giving the
+ * dispatching node / entity a real hard cap to enforce.
+ */
+function armNodeTimeout(req, onTimeout) {
+    let fired = false;
+    const raw = req.timeout_seconds;
+    // Explicit negative sentinel = caller deliberately opts out of any cap.
+    if (typeof raw === 'number' && raw < 0) {
+        return { clear: () => { }, timedOut: () => false };
+    }
+    // Positive value wins; null/0 falls back to the daemon's safety ceiling.
+    const secs = raw && raw > 0 ? raw : DEFAULT_RUN_TIMEOUT_SECONDS;
+    if (!secs || secs <= 0) {
+        return { clear: () => { }, timedOut: () => false };
+    }
+    const t = setTimeout(() => {
+        fired = true;
+        void emit(req.id, 'timeout', { seconds: secs, reason: 'node_timeout' });
+        try {
+            onTimeout();
+        }
+        catch { /* spawn already gone */ }
+    }, secs * 1000);
+    t.unref?.();
+    return { clear: () => clearTimeout(t), timedOut: () => fired };
+}
+// Per-run hang watchdog. Reset on every agent event; if the child goes fully
+// silent for HANG_WATCHDOG_IDLE_MS we emit an 'agent_hang' error (transient →
+// the run is retried) and kill the child, so a wedged spawn recovers in
+// minutes instead of dangling until the 1h node-timeout. Returns a no-op when
+// disabled (HANG_WATCHDOG_IDLE_MS=0). Caller must .touch() on each event and
+// .stop() once the run reaches a terminal point.
+function armHangWatchdog(req, lastError, kill, opts) {
+    if (!config_1.HANG_WATCHDOG_IDLE_MS || config_1.HANG_WATCHDOG_IDLE_MS <= 0) {
+        return { touch: () => { }, stop: () => { } };
+    }
+    return (0, hang_watchdog_1.createHangWatchdog)({
+        idleMs: config_1.HANG_WATCHDOG_IDLE_MS,
+        idleMsFn: opts?.idleMsFn,
+        onHang: () => {
+            // Compose the reason at fire time — the window and the silent-resume
+            // determination both depend on run state at the moment of the kill.
+            const idleMs = opts?.idleMsFn ? opts.idleMsFn() : config_1.HANG_WATCHDOG_IDLE_MS;
+            const silentResume = Boolean(req.resume_session_id) && opts?.sawActivity != null && !opts.sawActivity();
+            const err = {
+                code: 'agent_hang',
+                message: silentResume
+                    ? `agent produced no output for ${Math.round(idleMs / 60000)}m while resuming a session — killed by node hang-watchdog (silent resume hang; clearing the session and retrying fresh)`
+                    : `agent produced no output for ${Math.round(idleMs / 60000)}m — killed by node hang-watchdog`,
+            };
+            // Record + surface the reason so the terminal write classifies it
+            // 'agent_hang' (transient → retried) instead of a bare exit code.
+            lastError.current = err;
+            void emit(req.id, 'error', err);
+            try {
+                kill();
+            }
+            catch { /* already gone */ }
+        },
+    });
+}
+// Webhook delivery: bounded per-attempt timeout + exponential backoff.
+// We intentionally don't push to a dead-letter queue — the flows backend
+// can also reconcile state by polling entity_runtime_requests on a cron
+// if it cares about durability beyond best-effort.
+const WEBHOOK_ATTEMPT_TIMEOUT_MS = 5_000;
+const WEBHOOK_BACKOFF_MS = [500, 2_000, 8_000];
+async function notifyFlowsIfFlowRequest(requestId) {
+    let row = null;
+    try {
+        row = await (0, supabase_client_1.rpc)('runtime_request_get_meta', {
+            p_token: token(),
+            p_request_id: requestId,
+        });
+    }
+    catch (err) {
+        console.error(`[session-runner] flow resume meta lookup [reqId=${requestId}] error: ${err.message}`);
+        return;
+    }
+    if (!row?.flow_run_id)
+        return;
+    // flow_run_id is shared between issued_via='flow' and 'widgetstudio'
+    // (widgetstudio stuffs the widget session id in there for the resume
+    // webhook). Only flows should hit the flows endpoint — without this
+    // check, every widgetstudio request also pings flows and gets 404.
+    if (row.issued_via && row.issued_via !== 'flow')
+        return;
+    const flowsUrl = process.env.ADDAI_FLOWS_URL || 'https://addai-flows-backend-29522465016.europe-west2.run.app';
+    const endpoint = `${flowsUrl}/api/entity-request/complete`;
+    // Up to 1 + 3 = 4 attempts spaced by [0, 500, 2000, 8000] ms.
+    for (let attempt = 0; attempt < WEBHOOK_BACKOFF_MS.length + 1; attempt++) {
+        if (attempt > 0)
+            await new Promise(r => setTimeout(r, WEBHOOK_BACKOFF_MS[attempt - 1]));
+        try {
+            const res = await fetch(endpoint, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ requestId }),
+                signal: AbortSignal.timeout(WEBHOOK_ATTEMPT_TIMEOUT_MS),
+            });
+            if (res.ok)
+                return;
+            // 4xx (except 429) is non-retryable — the request is malformed
+            // or the flow run no longer exists. Stop and log.
+            if (res.status >= 400 && res.status < 500 && res.status !== 429) {
+                const text = await res.text().catch(() => '');
+                console.error(`[session-runner] flow resume notify [reqId=${requestId}] gave up (${res.status}, non-retryable): ${text.slice(0, 200)}`);
+                return;
+            }
+            // 5xx / 429 / network errors fall through to retry
+            const text = await res.text().catch(() => '');
+            console.warn(`[session-runner] flow resume notify [reqId=${requestId}] attempt ${attempt + 1} failed (${res.status}): ${text.slice(0, 120)}`);
+        }
+        catch (err) {
+            console.warn(`[session-runner] flow resume notify [reqId=${requestId}] attempt ${attempt + 1} error: ${err.message}`);
+        }
+    }
+    console.error(`[session-runner] flow resume notify [reqId=${requestId}] exhausted retries`);
+}
+// Async-pause completion hook for Widget Studio vibecode sessions. Mirrors
+// notifyFlowsIfFlowRequest but POSTs to the widget-vibecode-resume edge fn
+// when the request was issued by Widget Studio. Same backoff strategy.
+async function notifyWidgetstudioIfWidgetRequest(requestId) {
+    let row = null;
+    try {
+        row = await (0, supabase_client_1.rpc)('runtime_request_get_meta', { p_token: token(), p_request_id: requestId });
+    }
+    catch (err) {
+        console.error(`[session-runner] widgetstudio resume meta lookup [reqId=${requestId}] error: ${err.message}`);
+        return;
+    }
+    if (row?.issued_via !== 'widgetstudio')
+        return;
+    if (!row.flow_run_id)
+        return; // sanity — widgetstudio always populates flow_run_id=widget_id
+    const url = process.env.WIDGETSTUDIO_RESUME_URL
+        || 'https://syhzpqqvrplaqdipcymw.supabase.co/functions/v1/widget-vibecode-resume';
+    for (let attempt = 0; attempt < WEBHOOK_BACKOFF_MS.length + 1; attempt++) {
+        if (attempt > 0)
+            await new Promise(r => setTimeout(r, WEBHOOK_BACKOFF_MS[attempt - 1]));
+        try {
+            const res = await fetch(url, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ requestId }),
+                signal: AbortSignal.timeout(WEBHOOK_ATTEMPT_TIMEOUT_MS),
+            });
+            if (res.ok)
+                return;
+            if (res.status >= 400 && res.status < 500 && res.status !== 429) {
+                const text = await res.text().catch(() => '');
+                console.error(`[session-runner] widgetstudio resume notify [reqId=${requestId}] gave up (${res.status}, non-retryable): ${text.slice(0, 200)}`);
+                return;
+            }
+            const text = await res.text().catch(() => '');
+            console.warn(`[session-runner] widgetstudio resume notify [reqId=${requestId}] attempt ${attempt + 1} failed (${res.status}): ${text.slice(0, 120)}`);
+        }
+        catch (err) {
+            console.warn(`[session-runner] widgetstudio resume notify [reqId=${requestId}] attempt ${attempt + 1} error: ${err.message}`);
+        }
+    }
+    console.error(`[session-runner] widgetstudio resume notify [reqId=${requestId}] exhausted retries`);
+}
+// ── Self-improve hook ───────────────────────────────────────────────────────
+//
+// When an autonomous (Tommy) entity finishes a run cleanly, give the entity
+// a chance to update its OWN skill based on what just happened. The daemon is
+// deliberately thin here: it only fires a best-effort POST carrying the
+// request + session identifiers. The `entity-self-improve` edge function
+// (owned by the Studio) does the actual work — it can pull the full
+// transcript (assistant_text / tool events) and run summary from
+// entity_runtime_requests / the runtime event log using the requestId, then
+// mutate the entity's skill content in entity_studio_* tables.
+//
+// Endpoint contract (request the Studio must honor):
+//   POST {SELFIMPROVE_URL or syhzpqqvrplaqdipcymw .../entity-self-improve}
+//   body: {
+//     requestId:  string,        // entity_runtime_requests.id
+//     entityId:   string | null, // entity_studio_entities.id (the profile)
+//     sessionId:  string | null, // spawned agent session/thread id
+//     status:     'completed',
+//   }
+//   The endpoint owns: loading the run's assistant_text / activity_summary,
+//   deciding whether/what to learn, and writing the updated skill. The daemon
+//   does NOT block on the response — any 2xx is success, everything else is
+//   logged + retried with the shared backoff, and a final failure is
+//   swallowed (self-improve is an enhancement, never a hard dependency of
+//   the run).
+//
+// Flag plumbing the Studio/dispatch side must populate so this fires:
+//   - entity_runtime_requests.self_improve = true   (boolean column)
+//   - entity_runtime_requests.entity_id    = <entity profile id>  (optional
+//     but recommended so the endpoint doesn't have to re-derive it)
+//   - runtime_request_get_meta MUST also return those two columns (this
+//     function reads the flag via that RPC so it stays a single round-trip).
+async function notifySelfImproveIfEnabled(requestId) {
+    let row = null;
+    try {
+        row = await (0, supabase_client_1.rpc)('runtime_request_get_meta', {
+            p_token: token(),
+            p_request_id: requestId,
+        });
+    }
+    catch (err) {
+        console.error(`[session-runner] self-improve meta lookup [reqId=${requestId}] error: ${err.message}`);
+        return;
+    }
+    // Disabled / not an autonomous entity run → silent no-op. Older Studio
+    // builds that don't populate the column land here and cost one cheap RPC.
+    if (!row || row.self_improve !== true)
+        return;
+    const url = process.env.ENTITY_SELFIMPROVE_URL
+        || 'https://syhzpqqvrplaqdipcymw.supabase.co/functions/v1/entity-self-improve';
+    const body = JSON.stringify({
+        requestId,
+        entityId: row.entity_id ?? null,
+        sessionId: row.spawned_session_id ?? null,
+        status: 'completed',
+    });
+    for (let attempt = 0; attempt < WEBHOOK_BACKOFF_MS.length + 1; attempt++) {
+        if (attempt > 0)
+            await new Promise(r => setTimeout(r, WEBHOOK_BACKOFF_MS[attempt - 1]));
+        try {
+            const res = await fetch(url, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    // Supabase edge functions default to requiring a JWT. Send the
+                    // public anon key so the call works whether or not the function
+                    // is deployed with --no-verify-jwt; per-entity authorization
+                    // happens inside the function via the requestId/daemon context.
+                    apikey: config_1.SUPABASE_ANON_KEY,
+                    authorization: `Bearer ${config_1.SUPABASE_ANON_KEY}`,
+                },
+                body,
+                signal: AbortSignal.timeout(WEBHOOK_ATTEMPT_TIMEOUT_MS),
+            });
+            if (res.ok)
+                return;
+            // 4xx (except 429) is non-retryable — endpoint missing or request
+            // malformed. Give up quietly; self-improve must never wedge a run.
+            if (res.status >= 400 && res.status < 500 && res.status !== 429) {
+                const text = await res.text().catch(() => '');
+                console.error(`[session-runner] self-improve notify [reqId=${requestId}] gave up (${res.status}, non-retryable): ${text.slice(0, 200)}`);
+                return;
+            }
+            const text = await res.text().catch(() => '');
+            console.warn(`[session-runner] self-improve notify [reqId=${requestId}] attempt ${attempt + 1} failed (${res.status}): ${text.slice(0, 120)}`);
+        }
+        catch (err) {
+            console.warn(`[session-runner] self-improve notify [reqId=${requestId}] attempt ${attempt + 1} error: ${err.message}`);
+        }
+    }
+    console.error(`[session-runner] self-improve notify [reqId=${requestId}] exhausted retries`);
+}
+// ── Memory capture hook ─────────────────────────────────────────────────────
+//
+// +Ai Memory (Task 5): on every clean `completed` run tied to a Studio
+// entity, best-effort POST the turn to entity-memory-capture so it can be
+// distilled into an episode. Fires from the exact same place as
+// notifySelfImproveIfEnabled, for the same reason: entity_runtime_requests
+// only has a fully-aggregated `assistant_text` once the DB's
+// entity_studio_aggregate_assistant_text trigger (BEFORE UPDATE OF status)
+// has run — i.e. by the time the runtime_request_update RPC above
+// resolves. Reading turn text off any earlier client-side state (e.g. right
+// after emitting `turn_complete`) would race that trigger.
+//
+// Unlike self-improve, capture has no client-side enable flag to check —
+// entity_runtime_requests carries no memory_v2 column, and the daemon isn't
+// meant to know about it. The entity-memory-capture edge function is the
+// sole gate: it loads the entity's `autonomy.memory_v2` flag itself and
+// replies `{ skipped: "flag" }` when disabled. This hook only filters out
+// runs with no owning entity (nothing to attribute the episode to) and the
+// two internal housekeeping issued_via kinds that entity_memory_recall_inject
+// already excludes from memory (self_improve_distil, memory_consolidation)
+// — capturing those would create a noisy feedback loop of the memory system
+// remembering its own maintenance turns.
+async function notifyCaptureIfEnabled(requestId) {
+    let row = null;
+    try {
+        row = await (0, supabase_client_1.rpc)('runtime_request_get_meta', {
+            p_token: token(),
+            p_request_id: requestId,
+        });
+    }
+    catch (err) {
+        console.error(`[session-runner] capture meta lookup [reqId=${requestId}] error: ${err.message}`);
+        return;
+    }
+    if (!row || !row.entity_id)
+        return; // non-entity run → nothing to capture against
+    if (row.issued_via === 'self_improve_distil' || row.issued_via === 'memory_consolidation' || row.issued_via === 'guardrail_check')
+        return;
+    const assistantText = (row.assistant_text ?? '').trim();
+    if (!assistantText)
+        return; // nothing produced this turn
+    const payload = (0, memory_capture_1.buildCapturePayload)({ entityId: row.entity_id, requestId, surface: row.issued_via ?? 'chat' }, row.prompt ?? '', assistantText, row.jsonl_path ? { kind: 'jsonl_ref', path: row.jsonl_path, host: os.hostname() } : null);
+    await (0, memory_capture_1.postCapture)(config_1.SUPABASE_URL, config_1.SUPABASE_ANON_KEY, payload);
+}
+// ── Guardrails enforcement ─────────────────────────────────────────────────
+//
+// finalizeTerminal replaces the per-runner completed/failed setStatus call.
+// On a clean completion of an entity-attributed request it runs the
+// guardrail gate BEFORE the terminal status write — the whole enforcement
+// mechanism, since every delivery path triggers on terminal status. Failed
+// runs, canceled runs, non-entity runs, and guardrails_skip rows go straight
+// through exactly as before.
+const GUARDRAIL_CHECK_POLL_MS = 3_000;
+const GUARDRAIL_CHECK_WAIT_MS = 180_000;
+const GUARDRAIL_RETRY_TIMEOUT_MS = 300_000;
+// Every "this run did not finish" path funnels through here. Transient
+// failures (rate limits, 5xx, network) get requeued server-side for a
+// same-provider retry with backoff instead of going terminally 'failed';
+// terminal ones (auth, bad input, policy) fail exactly as before. The cap
+// lives in runtime_request_mark_retry (shares retry_count with the stale
+// reclaim), so a daemon crash mid-decision can't extend the budget.
+async function failRequest(req, errorCode, errorMessage) {
+    await (0, run_retry_1.failOrRetry)({
+        retryCount: req.retry_count ?? 0,
+        ladderCount: req.ladder_hops ?? 0,
+        markRetry: (code, message, delayMs) => (0, supabase_client_1.rpc)('runtime_request_mark_retry', {
+            p_token: token(),
+            p_request_id: req.id,
+            p_error_code: code ?? null,
+            p_error_message: message ? (0, projects_2.redactSecrets)(message).slice(0, 1000) : null,
+            p_delay_ms: delayMs,
+        }),
+        // Stale/invalid resume id: null the stored session (request row + parent
+        // chat) and requeue fresh, in one server-side RPC. Same retry_count<3
+        // budget as mark_retry, so it can't loop.
+        clearSessionAndRetry: (code, message, delayMs) => (0, supabase_client_1.rpc)('runtime_request_clear_session_and_retry', {
+            p_token: token(),
+            p_request_id: req.id,
+            p_error_code: code ?? null,
+            p_error_message: message ? (0, projects_2.redactSecrets)(message).slice(0, 1000) : null,
+            p_delay_ms: delayMs,
+        }),
+        ladderOrDeadLetter: (code, message) => (0, supabase_client_1.rpc)('runtime_request_failover_agent', {
+            p_token: token(),
+            p_request_id: req.id,
+            p_error_code: code ?? null,
+            p_error_message: message ? (0, projects_2.redactSecrets)(message).slice(0, 1000) : null,
+        }),
+        writeFailed: (code, message) => setStatus(req.id, { status: 'failed', errorCode: code, errorMessage: message }),
+        emit: (type, payload) => emit(req.id, type, payload),
+    }, errorCode, errorMessage);
+}
+async function finalizeTerminal(req, opts) {
+    if (!opts.clean) {
+        await failRequest(req, opts.errorCode, opts.errorMessage);
+        return;
+    }
+    const entityId = req.entity_studio_entity_id ?? req.entity_id ?? null;
+    const guardrailsRan = entityId != null && req.guardrails_skip !== true;
+    if (guardrailsRan) {
+        try {
+            if (opts.settleMs && opts.settleMs > 0)
+                await new Promise(r => setTimeout(r, opts.settleMs));
+            await (0, guardrails_1.enforceGuardrails)(makeGuardrailIo(req, opts));
+        }
+        catch (err) {
+            console.error(`[guardrails] [reqId=${req.id}] enforcement error (failing open): ${err.message}`);
+        }
+        // Enforcement can run for minutes (live-session checks + retry turns). The
+        // cancel watcher is already stopped and the runners' currentStatus!=='canceled'
+        // pre-checks happened BEFORE enforcement, so a cancel landing during this
+        // window would otherwise get clobbered to 'completed' below. Re-check now
+        // and bail if the user canceled mid-enforcement. This RPC only runs on the
+        // guardrail path (success OR fail-open) — the zero-guardrail fast path stays
+        // a single status write with no added round-trip.
+        const nowStatus = await (0, supabase_client_1.rpc)('runtime_get_request_status', { p_token: token(), p_request_id: req.id }).catch(() => null);
+        if (nowStatus === 'canceled')
+            return;
+    }
+    await setStatus(req.id, { status: 'completed' });
+}
+function makeGuardrailIo(req, opts) {
+    const checkUrl = process.env.ENTITY_GUARDRAILS_CHECK_URL
+        || `${config_1.SUPABASE_URL}/functions/v1/entity-guardrails-check`;
+    return {
+        async loadGuardrails() {
+            const res = await (0, supabase_client_1.rpc)('entity_guardrails_for_request', { p_token: token(), p_request_id: req.id });
+            return res?.guardrails ?? [];
+        },
+        async fetchOutput() {
+            return (0, supabase_client_1.rpc)('entity_guardrails_output', { p_token: token(), p_request_id: req.id });
+        },
+        async checkFast(output, defs) {
+            const res = await fetch(checkUrl, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    apikey: config_1.SUPABASE_ANON_KEY,
+                    authorization: `Bearer ${config_1.SUPABASE_ANON_KEY}`,
+                },
+                body: JSON.stringify({
+                    requestId: req.id,
+                    entityId: req.entity_studio_entity_id ?? req.entity_id,
+                    output,
+                    guardrails: defs.map(d => ({ id: d.id, name: d.name, rule: d.rule })),
+                }),
+                signal: AbortSignal.timeout(45_000),
+            });
+            if (!res.ok)
+                throw new Error(`guardrails-check ${res.status}`);
+            const body = await res.json();
+            return body.results ?? [];
+        },
+        async checkRuntime(output, def) {
+            const prompt = [
+                `You are a guardrail checker. Verify whether the following AI entity response complies with this rule. You may use your read-only tools to verify facts or inspect files.`,
+                ``,
+                `RULE "${def.name}": ${def.rule}`,
+                ``,
+                `<response>`,
+                output.slice(0, 24_000),
+                `</response>`,
+                ``,
+                `Reply with ONLY this JSON object and nothing else:`,
+                `{"verdict": "pass" | "fail", "reasoning": "<max 200 chars>"}`,
+            ].join('\n');
+            const checkId = await (0, supabase_client_1.rpc)('entity_guardrail_dispatch_check', {
+                p_token: token(), p_request_id: req.id, p_guardrail_id: def.id, p_prompt: prompt,
+            });
+            const deadline = Date.now() + GUARDRAIL_CHECK_WAIT_MS;
+            for (;;) {
+                if (Date.now() > deadline) {
+                    return { id: def.id, verdict: 'pass', reasoning: 'checker_error: checker timeout', checker_error: true };
+                }
+                await new Promise(r => setTimeout(r, GUARDRAIL_CHECK_POLL_MS));
+                const status = await (0, supabase_client_1.rpc)('runtime_get_request_status', {
+                    p_token: token(), p_request_id: checkId,
+                }).catch(() => null);
+                if (status === 'failed' || status === 'canceled') {
+                    return { id: def.id, verdict: 'pass', reasoning: `checker_error: checker ${status}`, checker_error: true };
+                }
+                if (status !== 'completed')
+                    continue;
+                const meta = await (0, supabase_client_1.rpc)('runtime_request_get_meta', {
+                    p_token: token(), p_request_id: checkId,
+                }).catch(() => null);
+                const text = meta?.assistant_text ?? '';
+                const match = text.match(/\{[\s\S]*?"verdict"[\s\S]*?\}/);
+                if (!match)
+                    return { id: def.id, verdict: 'pass', reasoning: 'checker_error: no verdict JSON', checker_error: true };
+                try {
+                    const v = JSON.parse(match[0]);
+                    return { id: def.id, verdict: v.verdict === 'fail' ? 'fail' : 'pass', reasoning: (v.reasoning ?? '').slice(0, 300) };
+                }
+                catch {
+                    return { id: def.id, verdict: 'pass', reasoning: 'checker_error: bad verdict JSON', checker_error: true };
+                }
+            }
+        },
+        async runRetry(feedback) {
+            if (!opts.sessionId)
+                return null;
+            return runGuardrailRetryTurn(req, opts.sessionId, opts.cwd, opts.installed, feedback);
+        },
+        async setResult(meta, events) {
+            await (0, supabase_client_1.rpc)('entity_guardrail_set_result', {
+                p_token: token(), p_request_id: req.id, p_meta: meta, p_events: events,
+            });
+        },
+        async emit(type, payload) { await emit(req.id, type, payload); },
+    };
+}
+/** One print-mode continuation turn on the SAME agent session, feeding the
+ *  guardrail violation back so the entity revises its reply. Events are
+ *  emitted onto the original request (the UI streams the revision live);
+ *  the revised text is also accumulated locally and returned so the state
+ *  machine can re-judge it and pin guardrail_meta.final_text to it. */
+async function runGuardrailRetryTurn(req, sessionId, cwd, installed, feedback) {
+    let handle;
+    try {
+        if (req.agent === 'codex') {
+            handle = (0, codex_spawn_1.spawnCodex)({
+                workingDirectory: cwd, prompt: feedback, model: (0, model_filter_1.modelForAgent)('codex', req.model),
+                effortLevel: req.effort ?? undefined, bypassPermissions: req.permission_mode === 'bypassPermissions',
+                skipGitRepoCheck: true, resumeThreadId: sessionId,
+                mcpServers: installed.mcps.map(m => ({ slug: m.slug, command: m.command, args: m.args ?? undefined, env: m.env ?? undefined })),
+            });
+        }
+        else if (req.agent === 'kimi') {
+            handle = (0, kimi_spawn_1.spawnKimi)({
+                workingDirectory: cwd, prompt: feedback, model: (0, model_filter_1.modelForAgent)('kimi', req.model),
+                effortLevel: req.effort ?? undefined, resumeSessionId: sessionId,
+                bypassPermissions: req.permission_mode === 'bypassPermissions',
+                appendSystemPrompt: (0, time_context_1.appendTimeContext)(req.system_prompt),
+                mcpServers: installed.mcps.map(m => ({ slug: m.slug, command: m.command, args: m.args ?? undefined, env: m.env ?? undefined })),
+            });
+        }
+        else if (req.agent === 'gemini') {
+            handle = (0, gemini_spawn_1.spawnGemini)({
+                workingDirectory: cwd, prompt: feedback, model: (0, model_filter_1.modelForAgent)('gemini', req.model),
+                effortLevel: req.effort ?? undefined, resumeSessionId: sessionId,
+                appendSystemPrompt: (0, time_context_1.appendTimeContext)(req.system_prompt),
+                mcpServers: installed.mcps.map(m => ({ slug: m.slug, command: m.command, args: m.args ?? undefined, env: m.env ?? undefined })),
+            });
+        }
+        else if (req.agent === 'grok') {
+            handle = (0, grok_spawn_1.spawnGrok)({
+                workingDirectory: cwd, prompt: feedback, model: (0, model_filter_1.modelForAgent)('grok', req.model),
+                effortLevel: req.effort ?? undefined, resumeSessionId: sessionId,
+                bypassPermissions: req.permission_mode === 'bypassPermissions',
+                appendSystemPrompt: (0, time_context_1.appendTimeContext)(req.system_prompt),
+                mcpServers: installed.mcps.map(m => ({ slug: m.slug, command: m.command, args: m.args ?? undefined, env: m.env ?? undefined })),
+            });
+        }
+        else {
+            // claude / claude-tui / claude-bypass — resume via claude --print.
+            handle = (0, claude_print_1.spawnClaudePrint)({
+                workingDirectory: cwd, prompt: feedback,
+                permissionMode: req.agent === 'claude-bypass' ? 'bypassPermissions' : (req.permission_mode ?? undefined),
+                effortLevel: req.effort ?? undefined, model: (0, model_filter_1.modelForAgent)('claude', req.model),
+                mcpConfigPath: installed.mcpConfigPath ?? undefined,
+                resumeSessionId: sessionId,
+                appendSystemPrompt: (0, time_context_1.appendTimeContext)(req.system_prompt),
+                allowedTools: req.allowed_tools ?? undefined,
+            });
+        }
+    }
+    catch (err) {
+        console.error(`[guardrails] retry spawn failed [reqId=${req.id}]: ${err.message}`);
+        return null;
+    }
+    let text = '';
+    let emitChain = Promise.resolve();
+    handle.onEvent(ev => {
+        if (ev.type === 'assistant_text') {
+            const delta = ev.delta;
+            if (typeof delta === 'string')
+                text += delta;
+        }
+        emitChain = emitChain.then(() => emit(req.id, ev.type, eventPayload(ev))).catch(() => { });
+    });
+    const killer = setTimeout(() => { try {
+        handle.kill();
+    }
+    catch { /* gone */ } }, GUARDRAIL_RETRY_TIMEOUT_MS);
+    try {
+        const exitCode = await handle.done;
+        await emitChain;
+        return { ok: exitCode === 0 && text.trim().length > 0, text };
+    }
+    catch (err) {
+        console.error(`[guardrails] retry turn error [reqId=${req.id}]: ${err.message}`);
+        return null;
+    }
+    finally {
+        clearTimeout(killer);
+    }
+}
+function ensureOrphanCwd(requestId) {
+    const dir = path.join(paths_1.RUNTIME_HOME, 'sessions', requestId);
+    fs.mkdirSync(dir, { recursive: true });
+    return dir;
+}
+/** True when `dir` is one of THIS runtime's own session directories.
+ *  Guards against re-creating a cross-machine path (e.g. a chat that moved
+ *  runtimes still carrying /Users/lenny/... while we run on Windows). */
+function isOwnSessionDir(dir) {
+    const root = path.resolve(paths_1.RUNTIME_HOME, 'sessions');
+    const resolved = path.resolve(dir);
+    return resolved.startsWith(root + path.sep);
+}
+function eventPayload(e) {
+    const { type: _type, ...rest } = e;
+    return rest;
+}
+/** A stored resume id is only valid TOGETHER WITH the cwd it was created in:
+ *  claude looks its transcript up under a cwd-derived project dir, grok buckets
+ *  its session store by cwd. So when the recorded working_directory is gone and
+ *  we could not re-create it (it belongs to another machine, or to this machine
+ *  before the runtime home moved — e.g. ~/.entities-runtime → ~/.ainode), the
+ *  session id is dead: resuming it can only fail with "No conversation found
+ *  with session ID: <id>". Start fresh instead of burning an attempt on a
+ *  guaranteed error and making the user read a failure we already expect.
+ *
+ *  Exported for tests. */
+function resumeSessionIsVoid(workingDirectory, resumeSessionId, cwdSubstituted) {
+    return Boolean(workingDirectory) && Boolean(resumeSessionId) && cwdSubstituted;
+}
+// GitHub tokens minted via vault have a finite lifetime (typically 1h
+// for installation tokens). Cache them for 5 min — well inside the
+// shortest expiry — so a burst of concurrent ephemeral clones from
+// the same credential doesn't pile up Supabase RPCs.
+const GIT_TOKEN_CACHE_TTL_MS = 5 * 60 * 1000;
+const gitTokenCache = new Map();
+async function fetchGitTokenForRequest(requestId, credentialId) {
+    const cached = gitTokenCache.get(credentialId);
+    if (cached && cached.expiresAt > Date.now())
+        return cached.token;
+    try {
+        const tok = await (0, supabase_client_1.rpc)('runtime_get_git_token_for_request', {
+            p_token: token(),
+            p_request_id: requestId,
+            p_credential_id: credentialId,
+        });
+        if (tok)
+            gitTokenCache.set(credentialId, { token: tok, expiresAt: Date.now() + GIT_TOKEN_CACHE_TTL_MS });
+        return tok ?? null;
+    }
+    catch (err) {
+        console.error(`[ephemeral-clone] failed to resolve token [reqId=${requestId}, credId=${credentialId}]: ${err.message}`);
+        return null;
+    }
+}
+/** Derive a workspace-subdirectory name from a git URL. Used by the
+ *  multi-repo path to stage each clone under a unique name. */
+function repoNameFromUrl(url) {
+    let name;
+    try {
+        const path = new URL(url).pathname; // /owner/repo[.git]
+        const last = path.split('/').filter(Boolean).pop() ?? 'repo';
+        name = last.replace(/\.git$/, '').replace(/[^a-zA-Z0-9._-]+/g, '-').slice(0, 64) || 'repo';
+    }
+    catch {
+        name = url.split('/').pop()?.replace(/\.git$/, '').replace(/[^a-zA-Z0-9._-]+/g, '-').slice(0, 64) || 'repo';
+    }
+    // Windows reserved device names (con, nul, com1…) are invalid dir names;
+    // trailing dots are silently stripped by Win32 which desyncs the path.
+    // win32-gated so POSIX staging paths stay byte-identical across upgrades.
+    if (process.platform === 'win32') {
+        name = name.replace(/\.+$/, '');
+        if (/^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/i.test(name))
+            name = `${name}-repo`;
+    }
+    return name || 'repo';
+}
+/** Normalise the ephemeral_git_remotes array. Returns [] when empty or
+ *  malformed. Each entry is shaped { remote, branch?, credential_id? }. */
+function normaliseRemotes(req) {
+    const out = [];
+    if (Array.isArray(req.ephemeral_git_remotes)) {
+        for (const e of req.ephemeral_git_remotes) {
+            if (!e || typeof e !== 'object' || typeof e.remote !== 'string' || !e.remote.trim())
+                continue;
+            out.push({
+                remote: e.remote.trim(),
+                branch: (e.branch && String(e.branch).trim()) || null,
+                credentialId: (e.credential_id && String(e.credential_id).trim()) || null,
+            });
+        }
+    }
+    // Older Studio + chat rows still use the singular trio. Treat as a
+    // single-element array so the rest of the daemon doesn't care which
+    // contract the chat was created under.
+    if (out.length === 0 && req.ephemeral_git_remote) {
+        out.push({
+            remote: req.ephemeral_git_remote,
+            branch: req.ephemeral_git_branch,
+            credentialId: req.ephemeral_git_credential_id,
+        });
+    }
+    return out;
+}
+async function shallowCloneInto(remote, branch, dir, gitToken, requestId) {
+    if (!fs.existsSync(path.dirname(dir)))
+        fs.mkdirSync(path.dirname(dir), { recursive: true, mode: 0o700 });
+    let url = remote;
+    if (gitToken) {
+        try {
+            const u = new URL(remote);
+            if (u.hostname === 'github.com') {
+                u.username = 'x-access-token';
+                u.password = gitToken;
+                url = u.toString();
+            }
+        }
+        catch { /* keep plain */ }
+    }
+    // core.longpaths lifts Windows' 260-char MAX_PATH for deep repo trees —
+    // the session base dir already eats ~100 chars. Harmless no-op elsewhere.
+    const longPaths = process.platform === 'win32' ? ['-c', 'core.longpaths=true'] : [];
+    const args = [...longPaths, 'clone', '--depth', '1', '--single-branch', ...(branch ? ['--branch', branch] : []), url, dir];
+    await new Promise((resolve, reject) => {
+        const { execFile } = require('child_process');
+        execFile('git', args, { timeout: 10 * 60 * 1000 }, (err) => err ? reject(err) : resolve());
+    });
+    // Strip token from saved remote
+    if (url !== remote) {
+        await new Promise(resolve => {
+            const { execFile } = require('child_process');
+            execFile('git', ['-C', dir, 'remote', 'set-url', 'origin', remote], { timeout: 10_000 }, () => resolve());
+        });
+    }
+    // Commit as the entity, crediting whoever asked. Best-effort by design.
+    if (requestId)
+        await (0, git_identity_1.applyGitIdentity)(dir, requestId, token());
+}
+/** Resolve the effective cwd + project-inherited MCP/skill/package lists. */
+async function resolveCwdAndProject(req) {
+    if (!req.project_id) {
+        // CRITICAL: continuation turns MUST reuse the prior turn's cwd so
+        // claude's --resume <id> can find the JSONL it wrote there. The
+        // propagate trigger copies working_directory back to the chat after
+        // turn 1, and chat_send forwards it onto turn 2's request — so this
+        // branch fires for every continuation. We check fs.existsSync to
+        // gracefully fall through if the dir got cleaned up.
+        if (req.working_directory && fs.existsSync(req.working_directory)) {
+            return { cwd: req.working_directory };
+        }
+        // The dir is gone but the chat still resumes a session KEYED TO THIS PATH:
+        // grok buckets its session store by cwd, claude by the cwd-derived project
+        // dir. Substituting a fresh cwd silently breaks that key — grok then finds
+        // no project-scoped MCP servers at all (it has no --mcp-config flag), and
+        // claude 404s its transcript. Everything inside a session dir is rewritten
+        // every run, so re-creating it empty is enough to restore the key.
+        if (req.working_directory && req.resume_session_id && isOwnSessionDir(req.working_directory)) {
+            try {
+                fs.mkdirSync(req.working_directory, { recursive: true });
+                console.log(`[cwd] re-created swept session dir for resumed session [reqId=${req.id}]: ${req.working_directory}`);
+                return { cwd: req.working_directory };
+            }
+            catch (err) {
+                console.error(`[cwd] could not re-create ${req.working_directory}: ${err.message}`);
+            }
+        }
+        // Everything below hands back a DIFFERENT cwd from the one this turn was
+        // recorded against, which voids any stored resume id.
+        const resumeSessionVoid = resumeSessionIsVoid(req.working_directory, req.resume_session_id, true);
+        const remotes = normaliseRemotes(req);
+        if (remotes.length === 0) {
+            // working_directory already failed existsSync above (or was null). Never
+            // return a cross-machine path like /Users/lenny/... that doesn't exist
+            // here — writeFileSync on .entities-runtime.mcp.json would ENOENT and
+            // leave the request stuck in "starting".
+            return { cwd: ensureOrphanCwd(req.id), resumeSessionVoid };
+        }
+        // Single-repo: clone INTO the cwd (cwd IS the repo root). This is
+        // the historical behaviour — preserved so existing chats with one
+        // repo still work the way they always did.
+        if (remotes.length === 1) {
+            const r = remotes[0];
+            const cwd = ensureOrphanCwd(req.id);
+            try {
+                const tok = r.credentialId ? await fetchGitTokenForRequest(req.id, r.credentialId) : null;
+                await shallowCloneInto(r.remote, r.branch, cwd, tok, req.id);
+            }
+            catch (err) {
+                return { error: { code: 'ephemeral_clone_failed', message: (0, projects_2.redactSecrets)(err.message).slice(0, 500) } };
+            }
+            return { cwd, resumeSessionVoid };
+        }
+        // Multi-repo: clone each into a subdirectory of the session cwd so
+        // claude sees a workspace with N repos as siblings. Names are
+        // derived from the URL and deduped so two remotes with the same
+        // basename don't collide.
+        const cwd = ensureOrphanCwd(req.id);
+        const used = new Set();
+        for (let i = 0; i < remotes.length; i++) {
+            const r = remotes[i];
+            let name = repoNameFromUrl(r.remote);
+            if (used.has(name))
+                name = `${name}-${i + 1}`;
+            used.add(name);
+            const subDir = path.join(cwd, name);
+            try {
+                const tok = r.credentialId ? await fetchGitTokenForRequest(req.id, r.credentialId) : null;
+                await shallowCloneInto(r.remote, r.branch, subDir, tok, req.id);
+            }
+            catch (err) {
+                return {
+                    error: {
+                        code: 'ephemeral_clone_failed',
+                        message: (0, projects_2.redactSecrets)(`while cloning ${r.remote}: ${err.message}`).slice(0, 500),
+                    },
+                };
+            }
+        }
+        return { cwd, resumeSessionVoid };
+    }
+    const project = await (0, projects_1.fetchProject)(req.project_id);
+    if (!project)
+        return { error: { code: 'project_not_found', message: 'project_id is not visible to this runtime' } };
+    if (project.status !== 'ready') {
+        return { error: { code: 'project_not_ready', message: `project status is "${project.status}"` } };
+    }
+    return {
+        cwd: project.working_directory,
+        enabledMcps: project.enabled_mcps,
+        enabledSkills: project.enabled_skills,
+        enabledPackages: project.enabled_packages,
+    };
+}
+/** inherit | none | override → install set (ids resolved against registry). */
+function resolveInstallSet(req, project) {
+    if (req.mcp_mode === 'override') {
+        return {
+            mcpIds: req.mcps_override ?? [],
+            skillIds: req.skills_override ?? [],
+            packageIds: req.packages_override ?? [],
+        };
+    }
+    if (req.mcp_mode === 'none') {
+        return { mcpIds: [], skillIds: [], packageIds: [] };
+    }
+    // inherit
+    return {
+        mcpIds: project.enabledMcps ?? [],
+        skillIds: project.enabledSkills ?? [],
+        packageIds: project.enabledPackages ?? [],
+    };
+}
+// ── claude TUI ─────────────────────────────────────────────────────────────
+async function runClaudeTui(req, cwd, installed) {
+    const permissionMode = req.agent === 'claude-bypass' ? 'bypassPermissions' : (req.permission_mode ?? undefined);
+    // Pre-trust the ephemeral session cwd in ~/.claude.json so the
+    // "Are you sure you want to trust this directory?" dialog doesn't
+    // block the daemon-spawned TUI. Idempotent + best-effort.
+    (0, claude_config_1.preTrustProject)(cwd);
+    // Phase 4 T7: PreCompact capture hook (Q7, claude agent only). Written
+    // ONLY for memory_v2-flagged entities (req.memoryV2Flagged, set above in
+    // runRequest right after the memory-pack fetch resolves) into THIS
+    // session's ephemeral cwd — never the shared host-wide
+    // ~/.claude/settings.json, so every non-flagged entity and every
+    // non-claude agent has byte-identical spawn env: this branch simply
+    // never runs for them, not merely a no-op inside it.
+    const entityIdForHook = req.entity_studio_entity_id ?? req.entity_id ?? null;
+    if (req.memoryV2Flagged === true && entityIdForHook) {
+        (0, precompact_hook_1.writeSessionPrecompactHook)(cwd);
+    }
+    // Continuation turn on a still-living TUI? Tear down the prior
+    // spawn FIRST so we don't end up with two claudes writing to the
+    // same JSONL — that produces cross-attributed events (events from
+    // turn N+1 leak into turn N's request row) AND makes
+    // `claude --resume` replay the prior transcript into the new JSONL
+    // as if it were fresh content. Without this you get the user
+    // reporting "the second message gets the same reply as the first,
+    // then both bubbles merge into a single concatenated reply".
+    if (req.resume_session_id) {
+        const prior = activeClaudeTuiSpawns.get(req.resume_session_id);
+        if (prior) {
+            console.log(`[session-runner] continuation turn — disposing prior TUI spawn [session=${req.resume_session_id}, priorReqId=${prior.requestId}]`);
+            // Pre-mark the prior request as 'completed'. Without this, the
+            // spawn.kill() below produces a non-zero exit which the prior
+            // request's spawn.onExit would interpret as a failure and write
+            // setStatus(status='failed'). Per-turn the user already saw a
+            // good response (the turn finished naturally) — calling it
+            // failed in the DB is misleading and pollutes the projects /
+            // runtime stats. Pre-marking races the onExit handler:
+            // whichever fires last wins, but our 'completed' will already
+            // be committed before kill takes effect.
+            void setStatus(prior.requestId, { status: 'completed' });
+            // Mark the prior request as superseded so its spawn.onExit
+            // handler doesn't emit a `session_end` event with exitCode 129
+            // — that's the SIGHUP we're about to send, and the UI would
+            // render an "exit_129" badge on the prior assistant message
+            // bubble. Emit a clean `session_end` with reason='superseded'
+            // + exitCode 0 instead so any UI status badge stays empty.
+            supersededByContinuation.add(prior.requestId);
+            void emit(prior.requestId, 'session_end', {
+                reason: 'superseded_by_continuation',
+                exitCode: 0,
+            });
+            prior.tail?.dispose();
+            try {
+                prior.spawn.kill();
+            }
+            catch { /* already dead */ }
+            activeClaudeTuiSpawns.delete(req.resume_session_id);
+            // Brief pause so the OS releases the JSONL file handle before
+            // the new spawn opens it. Without this the new tail can attach
+            // BEFORE the old spawn flushes its final bytes.
+            await new Promise(r => setTimeout(r, 250));
+        }
+    }
+    let spawn;
+    try {
+        spawn = (0, claude_spawn_1.spawnClaudeForRuntime)({
+            workingDirectory: cwd,
+            permissionMode,
+            effortLevel: req.effort ?? undefined,
+            initialPrompt: req.prompt ?? undefined,
+            mcpConfigPathOverride: installed.mcpConfigPath ?? undefined,
+            resumeSessionId: req.resume_session_id ?? undefined,
+            appendSystemPrompt: (0, time_context_1.appendTimeContext)(req.system_prompt),
+            allowedTools: req.allowed_tools ?? undefined,
+            model: (0, model_filter_1.modelForAgent)('claude', req.model),
+            // Phase 4 T7: only set when the PreCompact hook was actually written
+            // above — an unflagged entity's spawn gets no extraEnv at all, not
+            // just an unread one.
+            extraEnv: (req.memoryV2Flagged === true && entityIdForHook)
+                ? { ENTITY_STUDIO_ENTITY_ID: entityIdForHook, RUNTIME_REQUEST_ID: req.id }
+                : undefined,
+        });
+    }
+    catch (err) {
+        await failRequest(req, 'spawn_failed', err.message ?? 'spawn failed');
+        return;
+    }
+    await setStatus(req.id, { status: 'running', spawnedSessionId: spawn.sessionId, jsonlPath: spawn.jsonlPath, workingDirectory: cwd });
+    void emit(req.id, 'ready', { agent: req.agent, mode: 'tui' });
+    // Register so the NEXT continuation turn can find + tear down this
+    // spawn cleanly. Tail handle is set after startJsonlTail returns
+    // below; we patch it in then.
+    activeClaudeTuiSpawns.set(spawn.sessionId, { spawn, tail: undefined, requestId: req.id });
+    const watcher = startCancelWatcher(req.id, () => {
+        void emit(req.id, 'canceling', { reason: 'user_cancel' });
+        spawn.kill();
+    });
+    // Silence/hang watchdog for the TUI path. Unlike print/codex/grok, the TUI
+    // has no event stream that guarantees liveness — a prompt-submit that lands
+    // in an unfocused input box produces NO JSONL and NO further PTY frames, so
+    // nothing else would ever kill the run (and never, if timeout_seconds<0).
+    // We touch() on every PTY byte and every JSONL event; we stop() once a turn
+    // completes, because a chat session then idles LEGITIMATELY between user
+    // messages (the spawn is held open until the next continuation turn or
+    // cancel) and a fixed idle window must not kill that. A wedged submit never
+    // reaches turn-complete, so it stays armed and trips → agent_hang (transient
+    // → retried).
+    const lastError = { current: null };
+    const hang = armHangWatchdog(req, lastError, () => spawn.kill());
+    let turnTimer;
+    let hadAssistantSinceLastTurn = false;
+    // Flow-issued requests are single-turn: the engine resumes the flow
+    // run as soon as the assistant finishes. Chat-issued requests stay
+    // open for follow-up turns until the user cancels or the runtime
+    // owner closes the chat. The TUI binary never exits on its own, so
+    // for flow mode we kill the spawn after the first idle period and
+    // let spawn.onExit set status='completed' + fire the webhook.
+    const isSingleTurn = req.issued_via === 'flow' || req.issued_via === 'widgetstudio';
+    let autoClosed = false;
+    const fireTurnComplete = () => {
+        if (!hadAssistantSinceLastTurn)
+            return;
+        hadAssistantSinceLastTurn = false;
+        if (turnTimer) {
+            clearTimeout(turnTimer);
+            turnTimer = undefined;
+        }
+        // A completed turn means we got the reply; any further silence (chat
+        // sessions idle between user messages until superseded) is legitimate,
+        // so disarm the hang watchdog now.
+        hang.stop();
+        void emit(req.id, 'turn_complete', {});
+        if (isSingleTurn && !autoClosed) {
+            autoClosed = true;
+            // Small grace window so the JSONL tail flushes the last few
+            // bytes before we kill the spawn — keeps assistant_text in the
+            // request row complete.
+            setTimeout(() => spawn.kill(), 200);
+        }
+    };
+    const scheduleTurnComplete = () => {
+        if (turnTimer)
+            clearTimeout(turnTimer);
+        turnTimer = setTimeout(fireTurnComplete, TURN_IDLE_MS);
+    };
+    // No wall-clock hard cap: an actively-working agent (the TUI emits PTY
+    // frames while it thinks/runs tools, which reset turnTimer) is never
+    // killed by elapsed time. Turn-end is detected purely by going idle
+    // (TURN_IDLE_MS of no PTY activity). The only time limit is the node's
+    // configured timeout, armed below.
+    const nodeTimeout = armNodeTimeout(req, () => {
+        // Timeout hit → complete-with-partial. autoClosed=true makes onExit
+        // treat the kill as a clean completion so the assistant_text captured
+        // so far is preserved.
+        autoClosed = true;
+        spawn.kill();
+    });
+    // Widget Studio live-feed relay. For issued_via='widgetstudio' requests,
+    // each tool_use/tool_result pair is also POSTed to
+    // widget-vibecode-broadcast so the chat UI can render a play-by-play
+    // of what the agent is doing — covers ALL tools (Bash, WebFetch,
+    // every MCP), not just the addai-widgetstudio MCP that broadcasts
+    // itself. Without this the chat shows only "thinking…" the entire
+    // run and the final text drops in at session end.
+    const isWidgetstudio = req.issued_via === 'widgetstudio';
+    const widgetstudioEnv = req.mcp_env_overrides?.['addai-widgetstudio'] || {};
+    const widgetstudioBroadcastUrl = isWidgetstudio
+        ? (widgetstudioEnv.WIDGETSTUDIO_BROADCAST_URL || null)
+        : null;
+    const widgetstudioSessionId = isWidgetstudio
+        ? (widgetstudioEnv.WIDGETSTUDIO_SESSION_ID || null)
+        : null;
+    const pendingTools = new Map();
+    async function relayTool(payload) {
+        if (!widgetstudioBroadcastUrl || !widgetstudioSessionId)
+            return;
+        try {
+            await fetch(widgetstudioBroadcastUrl, {
+                method: 'POST',
+                headers: {
+                    'content-type': 'application/json',
+                    'x-vibecode-token': req.id,
+                },
+                body: JSON.stringify({
+                    session_id: widgetstudioSessionId,
+                    tool: payload.tool,
+                    args: payload.args,
+                    result: payload.result,
+                    error: payload.error,
+                    ok: payload.ok,
+                    duration_ms: payload.durationMs,
+                }),
+                signal: AbortSignal.timeout(5_000),
+            });
+        }
+        catch (err) {
+            // best effort — the user's chat history will be missing this
+            // bubble but the run itself proceeds. Log at debug so an outage
+            // of the broadcast endpoint is at least traceable.
+            console.debug(`[session-runner] widgetstudio relay skipped [reqId=${req.id}, tool=${payload.tool}]: ${err.message}`);
+        }
+    }
+    // Replay-suppression for resumed sessions. claude --resume re-emits
+    // the entire prior transcript into the new JSONL stream BEFORE the
+    // daemon types the next user prompt — those events look identical
+    // to live ones, but their content is the OLD assistant response, not
+    // the new one. We drop assistant_text / tool_use / tool_result
+    // events until the prompt is typed; the submit() function flips
+    // `promptSubmitted` true. Fresh sessions (no resume) submit() before
+    // claude has produced any output, so the flag is true from the
+    // moment any meaningful event could fire.
+    const isResumedSession = !!req.resume_session_id;
+    let promptSubmitted = !req.prompt; // no prompt → nothing to wait for
+    let tail;
+    tail = (0, jsonl_tail_1.startJsonlTail)(spawn.jsonlPath, line => {
+        hang.touch(); // JSONL activity = agent is alive
+        for (const ev of (0, events_1.normalizeJsonlLine)(line)) {
+            // Drop replayed messages claude --resume re-emits before the
+            // user's new prompt is typed. They carry the prior turn's
+            // content and otherwise produce ghost "Hello!" responses in
+            // entity studio chat plus cross-attribute the new reply onto
+            // the prior request row.
+            if (isResumedSession &&
+                !promptSubmitted &&
+                (ev.type === 'assistant_text' || ev.type === 'tool_use' || ev.type === 'tool_result')) {
+                continue;
+            }
+            // We used to treat `claude:last-prompt` as the definitive
+            // turn-end signal — that turned out to be wrong. claude TUI
+            // emits last-prompt MULTIPLE times during a single agent turn
+            // (between tool-call leaves in its conversation tree), so
+            // firing turn_complete on the first one SIGHUPs the spawn
+            // before subsequent tools run. Rely on idle detection only.
+            //
+            // Reset the idle timer on any mid-turn activity. assistant_text
+            // and tool_use also mark the turn as "had activity" so the
+            // turn_complete handler will actually fire when triggered.
+            // tool_result + claude:* mid-turn events extend the window
+            // without flipping the flag (claude was just emitting status,
+            // not generating a new message yet).
+            if (ev.type === 'assistant_text' ||
+                ev.type === 'tool_use' ||
+                ev.type === 'tool_result' ||
+                ev.type.startsWith('claude:')) {
+                if (ev.type === 'assistant_text' || ev.type === 'tool_use') {
+                    hadAssistantSinceLastTurn = true;
+                }
+                scheduleTurnComplete();
+            }
+            // Widget Studio live feed: pair tool_use with its tool_result
+            // and POST to the broadcast endpoint. Pairing is by tool-use id
+            // (claude includes a stable id on both halves of the cycle).
+            //
+            // Dedup with the MCP's own broadcasts: addai-widgetstudio MCP
+            // (≥ 0.4.0) already POSTs each of its tool calls to the same
+            // endpoint with nicer per-tool summaries. If we ALSO relay
+            // those, the chat shows two messages per call. Skip them here
+            // and only relay tools the MCP doesn't broadcast itself
+            // (Bash, WebFetch, ToolSearch, other MCPs, etc.).
+            if (isWidgetstudio) {
+                if (ev.type === 'tool_use') {
+                    const skipRelay = ev.name.startsWith('mcp__addai-widgetstudio__');
+                    if (!skipRelay) {
+                        pendingTools.set(ev.id, { tool: ev.name, args: ev.input, startedAt: Date.now() });
+                    }
+                }
+                else if (ev.type === 'tool_result') {
+                    const pending = pendingTools.get(ev.id);
+                    if (pending) {
+                        pendingTools.delete(ev.id);
+                        const ok = !ev.isError;
+                        const extractError = (c) => {
+                            if (typeof c === 'string')
+                                return c.slice(0, 500);
+                            if (Array.isArray(c)) {
+                                for (const block of c) {
+                                    const text = block?.text;
+                                    if (typeof text === 'string')
+                                        return text.slice(0, 500);
+                                }
+                            }
+                            return null;
+                        };
+                        void relayTool({
+                            tool: pending.tool,
+                            args: pending.args,
+                            result: ok ? ev.content : null,
+                            error: ok ? null : extractError(ev.content),
+                            ok,
+                            durationMs: Date.now() - pending.startedAt,
+                        });
+                    }
+                }
+            }
+            void emit(req.id, ev.type, eventPayload(ev));
+        }
+    }, {
+        timeoutMs: TRANSCRIPT_TIMEOUT_MS,
+        onTimeout: () => {
+            void emit(req.id, 'error', {
+                code: 'transcript_slow',
+                message: `Claude transcript not appearing after ${Math.round(TRANSCRIPT_TIMEOUT_MS / 1000)}s.`,
+            });
+        },
+        // When resuming, the JSONL already contains the prior transcript.
+        // Seek past it so we only emit events from THIS turn — otherwise
+        // the prior `claude:last-prompt` fires turn_complete the moment
+        // the spawn boots and we kill the session before it can act.
+        seekToEnd: !!req.resume_session_id,
+    });
+    // Now that the tail handle exists, patch it into the active-spawns
+    // entry so the next continuation turn disposes it before tearing
+    // down the spawn.
+    {
+        const entry = activeClaudeTuiSpawns.get(spawn.sessionId);
+        if (entry)
+            entry.tail = tail;
+    }
+    let promptFilePath = null;
+    if (req.prompt) {
+        // Type the prompt into the TUI as keystrokes once it's drawn.
+        // We wait for the TUI to settle (enough bytes streamed + a quiet
+        // window) so the input box is actually focused and ready. Newlines
+        // in the prompt become Shift+Enter (\e\r) inside claude — the TUI
+        // treats \n as "new line within message", while a bare \r submits.
+        let bytesSeen = 0;
+        let settleTimer;
+        let submitted = false;
+        // Large prompts: write the full text to a file and type only a short
+        // pointer (the agent reads it from disk). Typing a multi-KB prompt as
+        // keystrokes overflows the PTY input under MCP load and drops bytes.
+        // The file lives in the cwd so the agent can read it with a relative
+        // path; it's removed when the spawn exits.
+        let promptText = req.prompt;
+        if (req.prompt.length > TUI_INLINE_PROMPT_MAX) {
+            try {
+                const fname = `.entity-task-${req.id}.md`;
+                promptFilePath = path.join(cwd, fname);
+                fs.writeFileSync(promptFilePath, req.prompt, 'utf8');
+                promptText = `Your full instructions are in the file ./${fname} in the current working directory. Read that file now and follow its entire contents exactly as your task — do everything it specifies.`;
+                void emit(req.id, 'prompt_via_file', { path: fname, bytes: req.prompt.length });
+            }
+            catch (err) {
+                promptFilePath = null;
+                console.error(`[session-runner] prompt-file write failed [reqId=${req.id}]: ${err.message}; typing inline instead`);
+            }
+        }
+        const submit = () => {
+            if (submitted)
+                return;
+            submitted = true;
+            // Strip terminal control bytes from the prompt, then turn real
+            // newlines into the in-message line-break chord (ESC+CR). A literal
+            // ESC in the content would otherwise be parsed as an escape sequence
+            // and swallow surrounding text, truncating the prompt. See
+            // prompt-keystrokes.ts.
+            const withSoftBreaks = (0, prompt_keystrokes_1.encodeTuiPromptKeystrokes)(promptText);
+            spawn.write(withSoftBreaks);
+            // Tiny pause so the TUI has time to render the typed text, then
+            // press Enter to submit.
+            setTimeout(() => {
+                spawn.write('\r');
+                // Flip the replay gate AFTER Enter so any tail replay events
+                // still in flight (claude --resume can take up to ~100ms to
+                // finish emitting the prior transcript) stay suppressed.
+                // Everything after this is a response to the typed prompt.
+                promptSubmitted = true;
+            }, 80);
+        };
+        // Resumed sessions render fast (transcript already in memory) so we
+        // use a tighter settle window than first-spawn.
+        const settleMs = req.resume_session_id ? TUI_SETTLE_MS_RESUME : TUI_SETTLE_MS;
+        // Settle detection: once we've seen enough initial output (TUI has
+        // started rendering), wait `settleMs` of MAX wait — but DON'T reset
+        // the timer on every chunk. Claude TUI renders continuous spinner /
+        // MCP-startup status frames at ~100ms cadence; reset-on-chunk meant
+        // the settle window never closed during the (often multi-second)
+        // MCP boot and the hard fallback fired into a still-unfocused input
+        // box → keystrokes dropped → no JSONL → transcript_slow.
+        spawn.onData(chunk => {
+            hang.touch(); // any PTY byte (boot frames, spinner, tokens) = liveness
+            if (!submitted) {
+                bytesSeen += chunk.length;
+                if (bytesSeen >= INITIAL_OUTPUT_MIN_BYTES && !settleTimer) {
+                    settleTimer = setTimeout(submit, settleMs);
+                }
+                return;
+            }
+            // Post-submit: any byte from the PTY means claude is doing
+            // SOMETHING (animating a "Brewing…" spinner, redrawing the
+            // status line, streaming a token). Reset the idle timer so we
+            // don't SIGHUP a thinking agent. Without this, complex prompts
+            // (Three.js scene generation, big refactors) that have claude
+            // think >60s between tool calls hit the TURN_IDLE_MS cap and get
+            // killed mid-thought. Claude TUI does NOT emit spinner frames
+            // when truly idle — it shows a static prompt and the cursor
+            // blink is handled terminal-side, no bytes through the PTY — so
+            // this is safe.
+            if (hadAssistantSinceLastTurn)
+                scheduleTurnComplete();
+        });
+        // Hard fallback: if for some reason the byte threshold is never hit,
+        // still type+submit after a generous delay so the chat doesn't hang.
+        setTimeout(() => { if (!submitted)
+            submit(); }, settleMs * 6);
+    }
+    await new Promise(resolve => {
+        spawn.onExit(code => {
+            if (turnTimer)
+                clearTimeout(turnTimer);
+            hang.stop();
+            nodeTimeout.clear();
+            // Remove the large-prompt task file we dropped in the cwd (if any).
+            if (promptFilePath) {
+                try {
+                    fs.unlinkSync(promptFilePath);
+                }
+                catch { /* gone already */ }
+                promptFilePath = null;
+            }
+            tail?.dispose();
+            // Remove from active registry — only if WE are still the owner.
+            // A continuation turn may have already replaced us via the prior-
+            // spawn teardown above, in which case the entry now points to a
+            // newer requestId and we leave it alone.
+            const reg = activeClaudeTuiSpawns.get(spawn.sessionId);
+            if (reg && reg.requestId === req.id) {
+                activeClaudeTuiSpawns.delete(spawn.sessionId);
+            }
+            watcher.stop();
+            // Flush any pending widgetstudio tool_use events that never got a
+            // matching tool_result (claude crashed / SIGHUP'd mid-tool / network
+            // hiccup). Without this, on long-lived chat sessions the Map grows
+            // unbounded across turns. Also lets the UI render the failed bubble
+            // instead of a silently dangling spinner.
+            if (isWidgetstudio && pendingTools.size > 0) {
+                for (const [, p] of pendingTools) {
+                    void relayTool({
+                        tool: p.tool,
+                        args: p.args,
+                        error: 'agent_exited_before_tool_result',
+                        ok: false,
+                        durationMs: Date.now() - p.startedAt,
+                    });
+                }
+                pendingTools.clear();
+            }
+            // If a continuation turn already pre-emitted a clean session_end
+            // for us, skip the noisy one carrying SIGHUP's exitCode 129.
+            const wasSuperseded = supersededByContinuation.delete(req.id);
+            if (!wasSuperseded) {
+                void emit(req.id, 'session_end', { reason: 'claude_exit', exitCode: code });
+            }
+            // If the user cancelled, keep status='canceled' (set by vault). Don't
+            // overwrite to failed just because the kill produced a non-zero exit.
+            // Keep the outer promise (and thus the request-pump liveness heartbeat)
+            // alive until finalize settles. finalizeTerminal now runs guardrail
+            // enforcement — which can take minutes — before writing terminal status.
+            // Resolving synchronously here would let runRequest resolve while the row
+            // is still non-terminal, reopening the server-side reclaim double-spawn
+            // window. Resolve only after the chain settles, like the print runners
+            // which `await finalizeTerminal`.
+            const done = (0, supabase_client_1.rpc)('runtime_get_request_status', { p_token: token(), p_request_id: req.id })
+                .then(currentStatus => {
+                if (currentStatus === 'canceled')
+                    return;
+                // 'completed' may already be set by the continuation-turn
+                // teardown above (we pre-mark the prior request as completed
+                // before SIGHUP'ing it, since the user already got a good
+                // reply). Don't downgrade it back to 'failed' just because
+                // the spawn exited 129.
+                if (currentStatus === 'completed')
+                    return;
+                // Auto-close intentionally signals the TUI to exit after the
+                // assistant turn finishes. The non-zero exit code (typically
+                // 129/SIGHUP) is OUR signal, not a real failure — the
+                // assistant_text aggregator has already captured the response.
+                const cleanExit = code === 0 || autoClosed;
+                return finalizeTerminal(req, {
+                    clean: cleanExit,
+                    // Prefer the structured reason the hang-watchdog recorded (agent_hang,
+                    // transient → retried) over a bare SIGHUP exit code.
+                    errorCode: cleanExit ? undefined : (lastError.current?.code ?? `exit_${code}`),
+                    errorMessage: cleanExit ? undefined : lastError.current?.message,
+                    sessionId: spawn.sessionId ?? null, cwd, installed,
+                    settleMs: 750, // TUI emits are fire-and-forget; let the tail land
+                });
+            })
+                .catch(() => { });
+            void done.finally(() => resolve());
+        });
+    });
+}
+// ── claude --print ─────────────────────────────────────────────────────────
+async function runClaudePrint(req, cwd, installed) {
+    if (!req.prompt) {
+        await setStatus(req.id, { status: 'failed', errorCode: 'no_prompt', errorMessage: 'print mode requires a prompt' });
+        return;
+    }
+    const permissionMode = req.agent === 'claude-bypass' ? 'bypassPermissions' : (req.permission_mode ?? undefined);
+    let handle;
+    try {
+        handle = (0, claude_print_1.spawnClaudePrint)({
+            workingDirectory: cwd,
+            prompt: req.prompt,
+            permissionMode,
+            effortLevel: req.effort ?? undefined,
+            model: (0, model_filter_1.modelForAgent)('claude', req.model),
+            mcpConfigPath: installed.mcpConfigPath ?? undefined,
+            resumeSessionId: req.resume_session_id ?? undefined,
+            appendSystemPrompt: (0, time_context_1.appendTimeContext)(req.system_prompt),
+            allowedTools: req.allowed_tools ?? undefined,
+        });
+    }
+    catch (err) {
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    void emit(req.id, 'ready', { agent: req.agent, mode: 'print' });
+    await setStatus(req.id, { status: 'running', workingDirectory: cwd });
+    // Serialize event inserts. emit() writes fire-and-forget, so two rapid
+    // deltas can land in the DB out of order and the reply renders scrambled
+    // (observed live: "LAUDE-FINAL-OKC"). Chaining preserves stream order;
+    // only the DB writes queue — the child keeps streaming.
+    let emitChain = Promise.resolve();
+    // Remember the last structured error the agent surfaced (429s, 5xx,
+    // provider stderr) so a non-zero exit can report the real reason instead
+    // of a bare exit code — and so retry classification has something to read.
+    const lastError = { current: null };
+    // A result-level error (claude exiting 0 while reporting is_error:true or an
+    // error_* subtype) must NOT finalize clean — the parser tags these with a
+    // `claude_result_*` code so we can tell them apart from transient stderr.
+    const resultError = { current: false };
+    // Silence watchdog: reset on every event; kills a wedged child after
+    // HANG_WATCHDOG_IDLE_MS so it fails 'agent_hang' (transient → retried)
+    // rather than dangling until the 1h node timeout.
+    const hang = armHangWatchdog(req, lastError, () => handle.kill());
+    handle.onEvent(ev => {
+        hang.touch();
+        if (ev.type === 'error') {
+            lastError.current = { code: ev.code, message: ev.message };
+            if (ev.code.startsWith('claude_result'))
+                resultError.current = true;
+        }
+        emitChain = emitChain.then(() => emit(req.id, ev.type, eventPayload(ev))).catch(() => { });
+    });
+    const watcher = startCancelWatcher(req.id, () => {
+        void emit(req.id, 'canceling', { reason: 'user_cancel' });
+        handle.kill();
+    });
+    // Node-configured execution timeout (null/0 = unlimited). On timeout we
+    // kill the agent; the completion below treats it as complete-with-partial.
+    const nodeTimeout = armNodeTimeout(req, () => handle.kill());
+    let exitCode;
+    try {
+        exitCode = await handle.done;
+        await emitChain; // drain queued event inserts before terminal status
+    }
+    catch (err) {
+        // spawn() resolves synchronously even for a missing/unrunnable binary;
+        // ENOENT etc. arrive async on the child's 'error' event and reject
+        // handle.done. Catch it here so one bad spawn fails just this request
+        // instead of rejecting up through the daemon and killing every session.
+        nodeTimeout.clear();
+        watcher.stop();
+        hang.stop();
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    nodeTimeout.clear();
+    watcher.stop();
+    hang.stop();
+    if (handle.sessionId)
+        await setStatus(req.id, { spawnedSessionId: handle.sessionId });
+    void emit(req.id, 'session_end', { reason: 'claude_exit', exitCode });
+    const currentStatus = await (0, supabase_client_1.rpc)('runtime_get_request_status', { p_token: token(), p_request_id: req.id }).catch(() => null);
+    if (currentStatus !== 'canceled') {
+        // A timed-out run completes-with-partial: the node asked for a cap, not
+        // a failure, so surface whatever the agent produced. A result-error exit-0
+        // is NOT clean — surface the recorded reason instead of the banner text.
+        const cleanExit = (exitCode === 0 && !resultError.current) || nodeTimeout.timedOut();
+        await finalizeTerminal(req, {
+            clean: cleanExit,
+            errorCode: cleanExit ? undefined : (lastError.current?.code ?? `exit_${exitCode}`),
+            errorMessage: cleanExit ? undefined : lastError.current?.message,
+            sessionId: handle.sessionId ?? null, cwd, installed,
+        });
+    }
+}
+// ── codex ──────────────────────────────────────────────────────────────────
+async function runCodex(req, cwd, installed) {
+    if (!req.prompt) {
+        await setStatus(req.id, { status: 'failed', errorCode: 'no_prompt', errorMessage: 'codex requires a prompt' });
+        return;
+    }
+    // codex has no --append-system-prompt; we prepend it to the prompt as
+    // a "system instruction" preamble so entities still influence the run.
+    const codexSystem = (0, time_context_1.appendTimeContext)(req.system_prompt);
+    const finalPrompt = `System instructions:\n${codexSystem.trim()}\n\nUser:\n${req.prompt}`;
+    // Opportunistic reclaim right before we allocate a new scratch CODEX_HOME,
+    // so a burst of runs frees space proactively rather than waiting for the
+    // next periodic sweep. No-op below the high-water mark.
+    await (0, diskguard_1.getDiskGuard)().sweep('pre-spawn').catch(() => { });
+    let handle;
+    try {
+        handle = (0, codex_spawn_1.spawnCodex)({
+            workingDirectory: cwd,
+            prompt: finalPrompt,
+            model: (0, model_filter_1.modelForAgent)('codex', req.model),
+            effortLevel: req.effort ?? undefined,
+            bypassPermissions: req.permission_mode === 'bypassPermissions',
+            skipGitRepoCheck: true,
+            resumeThreadId: req.resume_session_id ?? undefined,
+            mcpServers: installed.mcps.map(m => ({
+                slug: m.slug,
+                command: m.command,
+                args: m.args ?? undefined,
+                env: m.env ?? undefined,
+            })),
+        });
+    }
+    catch (err) {
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    void emit(req.id, 'ready', { agent: 'codex', mode: req.mode });
+    await setStatus(req.id, { status: 'running', workingDirectory: cwd });
+    // Serialize event inserts — fire-and-forget emits can land out of order
+    // in the DB and scramble the reply (see runClaudePrint).
+    let emitChain = Promise.resolve();
+    // Remember the last structured error the agent surfaced (429s, 5xx,
+    // provider stderr) so a non-zero exit can report the real reason instead
+    // of a bare exit code — and so retry classification has something to read.
+    const lastError = { current: null };
+    // Silence watchdog, codex flavour (same shape as grok). codex emits NO
+    // per-tool progress during a `command_execution`, so a long silent tool
+    // call looks identical to a hang. Give it grok's leash: standard window
+    // before any output (a wedged spawn/resume trips fast), 3x after activity
+    // has been seen (silent tool work is expected, not a hang). Raw stdout/
+    // stderr bytes count as liveness via onActivity.
+    const sawActivity = { current: false };
+    const hang = armHangWatchdog(req, lastError, () => handle.kill(), {
+        sawActivity: () => sawActivity.current,
+        idleMsFn: () => (sawActivity.current ? config_1.HANG_WATCHDOG_IDLE_MS * 3 : config_1.HANG_WATCHDOG_IDLE_MS),
+    });
+    handle.onActivity(() => { sawActivity.current = true; hang.touch(); });
+    handle.onEvent(ev => {
+        sawActivity.current = true;
+        hang.touch();
+        if (ev.type === 'error')
+            lastError.current = { code: ev.code, message: ev.message };
+        emitChain = emitChain.then(() => emit(req.id, ev.type, eventPayload(ev))).catch(() => { });
+    });
+    const watcher = startCancelWatcher(req.id, () => {
+        void emit(req.id, 'canceling', { reason: 'user_cancel' });
+        handle.kill();
+    });
+    // Node-configured execution timeout (null/0 = unlimited). On timeout we
+    // kill the agent; the completion below treats it as complete-with-partial.
+    const nodeTimeout = armNodeTimeout(req, () => handle.kill());
+    let exitCode;
+    try {
+        exitCode = await handle.done;
+        await emitChain; // drain queued event inserts before terminal status
+    }
+    catch (err) {
+        // spawn() resolves synchronously even for a missing/unrunnable binary;
+        // ENOENT etc. arrive async on the child's 'error' event and reject
+        // handle.done. Catch it here so one bad spawn fails just this request
+        // instead of rejecting up through the daemon and killing every session.
+        nodeTimeout.clear();
+        watcher.stop();
+        hang.stop();
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    nodeTimeout.clear();
+    watcher.stop();
+    hang.stop();
+    if (handle.threadId)
+        await setStatus(req.id, { spawnedSessionId: handle.threadId });
+    void emit(req.id, 'session_end', { reason: 'codex_exit', exitCode });
+    const currentStatus = await (0, supabase_client_1.rpc)('runtime_get_request_status', { p_token: token(), p_request_id: req.id }).catch(() => null);
+    if (currentStatus !== 'canceled') {
+        // A timed-out run completes-with-partial: the node asked for a cap, not
+        // a failure, so surface whatever the agent produced.
+        const cleanExit = exitCode === 0 || nodeTimeout.timedOut();
+        await finalizeTerminal(req, {
+            clean: cleanExit,
+            errorCode: cleanExit ? undefined : (lastError.current?.code ?? `exit_${exitCode}`),
+            errorMessage: cleanExit ? undefined : lastError.current?.message,
+            sessionId: handle.threadId ?? null, cwd, installed,
+        });
+    }
+}
+async function runKimi(req, cwd, installed) {
+    if (!req.prompt) {
+        await setStatus(req.id, { status: 'failed', errorCode: 'no_prompt', errorMessage: 'kimi requires a prompt' });
+        return;
+    }
+    let handle;
+    try {
+        handle = (0, kimi_spawn_1.spawnKimi)({
+            workingDirectory: cwd,
+            prompt: req.prompt,
+            model: (0, model_filter_1.modelForAgent)('kimi', req.model),
+            effortLevel: req.effort ?? undefined,
+            resumeSessionId: req.resume_session_id ?? undefined,
+            // runKimi only runs for req.agent === 'kimi', so the '|| claude-bypass'
+            // that lived here was dead copy-paste — removed.
+            bypassPermissions: req.permission_mode === 'bypassPermissions',
+            appendSystemPrompt: (0, time_context_1.appendTimeContext)(req.system_prompt),
+            mcpServers: installed.mcps.map(m => ({
+                slug: m.slug,
+                command: m.command,
+                args: m.args ?? undefined,
+                env: m.env ?? undefined,
+            })),
+        });
+    }
+    catch (err) {
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    void emit(req.id, 'ready', { agent: 'kimi', mode: 'print' });
+    await setStatus(req.id, { status: 'running', workingDirectory: cwd });
+    // Serialize event inserts — fire-and-forget emits can land out of order
+    // in the DB and scramble the reply (see runClaudePrint).
+    let emitChain = Promise.resolve();
+    // Remember the last structured error the agent surfaced (429s, 5xx,
+    // provider stderr) so a non-zero exit can report the real reason instead
+    // of a bare exit code — and so retry classification has something to read.
+    const lastError = { current: null };
+    // Silence watchdog, kimi flavour (same shape as grok/codex). kimi emits no
+    // per-tool progress, so a long silent tool call looks like a hang. Standard
+    // window before any output; 3x once activity has been seen. Raw stdout/
+    // stderr bytes count as liveness via onActivity.
+    const sawActivity = { current: false };
+    const hang = armHangWatchdog(req, lastError, () => handle.kill(), {
+        sawActivity: () => sawActivity.current,
+        idleMsFn: () => (sawActivity.current ? config_1.HANG_WATCHDOG_IDLE_MS * 3 : config_1.HANG_WATCHDOG_IDLE_MS),
+    });
+    handle.onActivity(() => { sawActivity.current = true; hang.touch(); });
+    handle.onEvent(ev => {
+        sawActivity.current = true;
+        hang.touch();
+        if (ev.type === 'error')
+            lastError.current = { code: ev.code, message: ev.message };
+        emitChain = emitChain.then(() => emit(req.id, ev.type, eventPayload(ev))).catch(() => { });
+    });
+    const watcher = startCancelWatcher(req.id, () => {
+        void emit(req.id, 'canceling', { reason: 'user_cancel' });
+        handle.kill();
+    });
+    // Node-configured execution timeout (null/0 = unlimited). On timeout we
+    // kill the agent; the completion below treats it as complete-with-partial.
+    const nodeTimeout = armNodeTimeout(req, () => handle.kill());
+    let exitCode;
+    try {
+        exitCode = await handle.done;
+        await emitChain; // drain queued event inserts before terminal status
+    }
+    catch (err) {
+        // spawn() resolves synchronously even for a missing/unrunnable binary;
+        // ENOENT etc. arrive async on the child's 'error' event and reject
+        // handle.done. Catch it here so one bad spawn fails just this request
+        // instead of rejecting up through the daemon and killing every session.
+        nodeTimeout.clear();
+        watcher.stop();
+        hang.stop();
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    nodeTimeout.clear();
+    watcher.stop();
+    hang.stop();
+    if (handle.sessionId)
+        await setStatus(req.id, { spawnedSessionId: handle.sessionId });
+    void emit(req.id, 'session_end', { reason: 'kimi_exit', exitCode });
+    const currentStatus = await (0, supabase_client_1.rpc)('runtime_get_request_status', { p_token: token(), p_request_id: req.id }).catch(() => null);
+    if (currentStatus !== 'canceled') {
+        // A timed-out run completes-with-partial: the node asked for a cap, not
+        // a failure, so surface whatever the agent produced.
+        const cleanExit = exitCode === 0 || nodeTimeout.timedOut();
+        await finalizeTerminal(req, {
+            clean: cleanExit,
+            errorCode: cleanExit ? undefined : (lastError.current?.code ?? `exit_${exitCode}`),
+            errorMessage: cleanExit ? undefined : lastError.current?.message,
+            sessionId: handle.sessionId ?? null, cwd, installed,
+        });
+    }
+}
+async function runGemini(req, cwd, installed) {
+    if (!req.prompt) {
+        await setStatus(req.id, { status: 'failed', errorCode: 'no_prompt', errorMessage: 'gemini requires a prompt' });
+        return;
+    }
+    let handle;
+    try {
+        handle = (0, gemini_spawn_1.spawnGemini)({
+            workingDirectory: cwd,
+            prompt: req.prompt,
+            model: (0, model_filter_1.modelForAgent)('gemini', req.model),
+            effortLevel: req.effort ?? undefined,
+            resumeSessionId: req.resume_session_id ?? undefined,
+            appendSystemPrompt: (0, time_context_1.appendTimeContext)(req.system_prompt),
+            mcpServers: installed.mcps.map(m => ({
+                slug: m.slug, command: m.command,
+                args: m.args ?? undefined, env: m.env ?? undefined,
+            })),
+        });
+    }
+    catch (err) {
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    void emit(req.id, 'ready', { agent: 'gemini', mode: 'print' });
+    await setStatus(req.id, { status: 'running', workingDirectory: cwd });
+    // Serialize event inserts — fire-and-forget emits can land out of order
+    // in the DB and scramble the reply (see runClaudePrint).
+    let emitChain = Promise.resolve();
+    // Remember the last structured error the agent surfaced (429s, 5xx,
+    // provider stderr) so a non-zero exit can report the real reason instead
+    // of a bare exit code — and so retry classification has something to read.
+    const lastError = { current: null };
+    // Silence watchdog: reset on every event; kills a wedged child after
+    // HANG_WATCHDOG_IDLE_MS so it fails 'agent_hang' (transient → retried)
+    // rather than dangling until the 1h node timeout.
+    const hang = armHangWatchdog(req, lastError, () => handle.kill());
+    handle.onEvent(ev => {
+        hang.touch();
+        if (ev.type === 'error')
+            lastError.current = { code: ev.code, message: ev.message };
+        emitChain = emitChain.then(() => emit(req.id, ev.type, eventPayload(ev))).catch(() => { });
+    });
+    const watcher = startCancelWatcher(req.id, () => {
+        void emit(req.id, 'canceling', { reason: 'user_cancel' });
+        handle.kill();
+    });
+    // Node-configured execution timeout (null/0 = unlimited). On timeout we
+    // kill the agent; the completion below treats it as complete-with-partial.
+    const nodeTimeout = armNodeTimeout(req, () => handle.kill());
+    let exitCode;
+    try {
+        exitCode = await handle.done;
+        await emitChain; // drain queued event inserts before terminal status
+    }
+    catch (err) {
+        // spawn() resolves synchronously even for a missing/unrunnable binary;
+        // ENOENT etc. arrive async on the child's 'error' event and reject
+        // handle.done. Catch it here so one bad spawn fails just this request
+        // instead of rejecting up through the daemon and killing every session.
+        nodeTimeout.clear();
+        watcher.stop();
+        hang.stop();
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    nodeTimeout.clear();
+    watcher.stop();
+    hang.stop();
+    if (handle.sessionId)
+        await setStatus(req.id, { spawnedSessionId: handle.sessionId });
+    void emit(req.id, 'session_end', { reason: 'gemini_exit', exitCode });
+    const currentStatus = await (0, supabase_client_1.rpc)('runtime_get_request_status', { p_token: token(), p_request_id: req.id }).catch(() => null);
+    if (currentStatus !== 'canceled') {
+        // A timed-out run completes-with-partial: the node asked for a cap, not
+        // a failure, so surface whatever the agent produced.
+        const cleanExit = exitCode === 0 || nodeTimeout.timedOut();
+        await finalizeTerminal(req, {
+            clean: cleanExit,
+            errorCode: cleanExit ? undefined : (lastError.current?.code ?? `exit_${exitCode}`),
+            errorMessage: cleanExit ? undefined : lastError.current?.message,
+            sessionId: handle.sessionId ?? null, cwd, installed,
+        });
+    }
+}
+async function runGrok(req, cwd, installed) {
+    if (!req.prompt) {
+        await setStatus(req.id, { status: 'failed', errorCode: 'no_prompt', errorMessage: 'grok requires a prompt' });
+        return;
+    }
+    let handle;
+    try {
+        handle = (0, grok_spawn_1.spawnGrok)({
+            workingDirectory: cwd,
+            prompt: req.prompt,
+            model: (0, model_filter_1.modelForAgent)('grok', req.model),
+            effortLevel: req.effort ?? undefined,
+            resumeSessionId: req.resume_session_id ?? undefined,
+            bypassPermissions: req.permission_mode === 'bypassPermissions' || req.agent === 'claude-bypass',
+            appendSystemPrompt: (0, time_context_1.appendTimeContext)(req.system_prompt),
+            mcpServers: installed.mcps.map(m => ({
+                slug: m.slug, command: m.command,
+                args: m.args ?? undefined, env: m.env ?? undefined,
+            })),
+        });
+    }
+    catch (err) {
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    void emit(req.id, 'ready', { agent: 'grok', mode: 'print' });
+    await setStatus(req.id, { status: 'running', workingDirectory: cwd });
+    // Serialize event inserts. emit() writes fire-and-forget, so concurrent
+    // rapid events (grok streams fast) can land out of order and scramble the
+    // reply. Chaining each insert after the previous guarantees stored order
+    // matches stream order. The child keeps running; only the DB writes queue.
+    let emitChain = Promise.resolve();
+    // Remember the last structured error the agent surfaced (429s, 5xx,
+    // provider stderr) so a non-zero exit can report the real reason instead
+    // of a bare exit code — and so retry classification has something to read.
+    const lastError = { current: null };
+    // Silence watchdog, grok flavour. Grok emits NO per-tool events, so:
+    //  - before ANY output: standard window — a healthy spawn/resume produces
+    //    thoughts within seconds, so prolonged dead silence means the resume
+    //    itself is wedged (kill fast, clear session, retry fresh);
+    //  - after output has been seen: 3x window — long silent stretches are
+    //    normal tool execution we simply can't observe, not a hang.
+    // Raw stdout/stderr bytes also count as liveness via onActivity below.
+    const sawActivity = { current: false };
+    const hang = armHangWatchdog(req, lastError, () => handle.kill(), {
+        sawActivity: () => sawActivity.current,
+        idleMsFn: () => (sawActivity.current ? config_1.HANG_WATCHDOG_IDLE_MS * 3 : config_1.HANG_WATCHDOG_IDLE_MS),
+    });
+    handle.onActivity(() => { sawActivity.current = true; hang.touch(); });
+    handle.onEvent(ev => {
+        sawActivity.current = true;
+        hang.touch();
+        if (ev.type === 'error')
+            lastError.current = { code: ev.code, message: ev.message };
+        emitChain = emitChain.then(() => emit(req.id, ev.type, eventPayload(ev))).catch(() => { });
+    });
+    const watcher = startCancelWatcher(req.id, () => {
+        void emit(req.id, 'canceling', { reason: 'user_cancel' });
+        handle.kill();
+    });
+    // Node-configured execution timeout (null/0 = unlimited). On timeout we
+    // kill the agent; the completion below treats it as complete-with-partial.
+    const nodeTimeout = armNodeTimeout(req, () => handle.kill());
+    let exitCode;
+    try {
+        exitCode = await handle.done;
+        await emitChain; // drain queued event inserts before we mark terminal
+    }
+    catch (err) {
+        nodeTimeout.clear();
+        watcher.stop();
+        hang.stop();
+        await failRequest(req, 'spawn_failed', err.message);
+        return;
+    }
+    nodeTimeout.clear();
+    watcher.stop();
+    hang.stop();
+    if (handle.sessionId)
+        await setStatus(req.id, { spawnedSessionId: handle.sessionId });
+    void emit(req.id, 'session_end', { reason: 'grok_exit', exitCode });
+    const currentStatus = await (0, supabase_client_1.rpc)('runtime_get_request_status', { p_token: token(), p_request_id: req.id }).catch(() => null);
+    if (currentStatus !== 'canceled') {
+        const cleanExit = exitCode === 0 || nodeTimeout.timedOut();
+        await finalizeTerminal(req, {
+            clean: cleanExit,
+            errorCode: cleanExit ? undefined : (lastError.current?.code ?? `exit_${exitCode}`),
+            errorMessage: cleanExit ? undefined : lastError.current?.message,
+            sessionId: handle.sessionId ?? null, cwd, installed,
+        });
+    }
+}
+async function fetchDriveList(apiKey, workspaceId, folderId, signal) {
+    const url = `${config_1.SUPABASE_URL}/functions/v1/storage-list?workspaceId=${encodeURIComponent(workspaceId)}&folderId=${encodeURIComponent(folderId)}&pageSize=100`;
+    const res = await fetch(url, { headers: { 'x-api-key': apiKey }, signal });
+    if (!res.ok)
+        return null;
+    return (await res.json());
+}
+async function buildDriveManifest(installed) {
+    const drive = installed.mcps.find((m) => m.slug === 'addai-drive');
+    const env = drive?.env ?? null;
+    const apiKey = env?.ADDAI_DRIVE_API_KEY;
+    const workspaceId = env?.ADDAI_DRIVE_WORKSPACE_ID;
+    const rootFolderId = env?.ADDAI_DRIVE_FOLDER_ID;
+    if (!apiKey || !workspaceId || !rootFolderId)
+        return null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 4_000);
+    try {
+        const root = await fetchDriveList(apiKey, workspaceId, rootFolderId, controller.signal);
+        if (!root)
+            return null;
+        const lines = [];
+        const fmt = (f) => `  - ${f.name}${typeof f.size === 'number' ? ` (${Math.max(1, Math.round(f.size / 1024))} KB)` : ''}`;
+        for (const f of (root.files ?? []).slice(0, 50))
+            lines.push(fmt(f));
+        // One level of subfolders so the entity sees its structure, capped to keep
+        // the injection small and the listing fast.
+        for (const sub of (root.folders ?? []).slice(0, 12)) {
+            lines.push(`  - ${sub.name}/`);
+            const child = await fetchDriveList(apiKey, workspaceId, sub.id, controller.signal).catch(() => null);
+            for (const f of (child?.files ?? []).slice(0, 30))
+                lines.push(`    - ${sub.name}/${f.name}`);
+        }
+        const body = lines.length ? lines.join('\n') : '  (empty — nothing saved yet)';
+        return [
+            '## Your +Ai Drive',
+            "You have a private +Ai Drive — file storage for working files and artifacts (documents, exports, data you produce) that survives across runs. This is for FILES, not memory: to remember facts, preferences, decisions, or what you learned, use your DocFlows memory (see below), never the Drive and never a local file. Files currently in your Drive:",
+            body,
+            "Use your +Ai Drive tools (list_files, read_file, write_file, make_folder, …) to read, add, and organise files.",
+        ].join('\n');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// ── Memory awareness (DocFlows) ──────────────────────────────────────────────
+// When the entity has the DocFlows MCP installed (it always does — that's its
+// long-term memory), list the titles it has saved so it starts each run already
+// knowing what it remembers and can load the relevant note. Best-effort, 4s cap.
+async function buildMemoryManifest(installed) {
+    const mem = installed.mcps.find((m) => m.slug === 'docflows');
+    const env = mem?.env ?? null;
+    const apiKey = env?.DOCFLOWS_API_KEY;
+    const workspaceId = env?.DOCFLOWS_WORKSPACE_ID;
+    if (!apiKey || !workspaceId)
+        return null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 4_000);
+    try {
+        const url = `${config_1.SUPABASE_URL}/functions/v1/docflows-api/v1/documents?workspace_id=${encodeURIComponent(workspaceId)}`;
+        const res = await fetch(url, { headers: { 'x-api-key': apiKey }, signal: controller.signal });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const docs = body.data ?? [];
+        const lines = docs.slice(0, 60).map((d) => `  - ${d.title}`);
+        const list = lines.length ? lines.join('\n') : '  (empty — nothing saved yet)';
+        // Hidden system directive: every entity has a long-term DocFlows memory and
+        // MUST actively maintain it. Without an explicit instruction the model treats
+        // the memory tools as optional and rarely writes — so spell out exactly when
+        // to save, in imperative terms.
+        return [
+            '## Your memory — it lives in DocFlows, nowhere else',
+            'You have exactly ONE long-term memory: your DocFlows memory. It is the ONLY place anything you remember survives between runs. Your working directory, any local file, a MEMORY.md, scratch notes on disk — all of that is DELETED the moment this run ends and is NOT your memory. The ONLY way to remember something is to call your DocFlows memory tools. Keeping this memory up to date is your responsibility — it is not optional.',
+            '',
+            'Notes you have saved so far:',
+            list,
+            '',
+            'RECALL first: before you act, load the relevant note(s) with your DocFlows tools (search_documents / get_document) so you use what you already know.',
+            '',
+            'SAVE as you go — call your DocFlows tools WITHOUT being asked, the moment any of these happen:',
+            '- You learn a durable fact about the user or their world (a preference, a name, how their data/process is set up).',
+            '- You work out a method/approach that worked — or one that failed (record that too).',
+            '- You make or are given a decision, rule, or instruction to follow going forward.',
+            '- The user says "remember", "note", "save this", "keep in mind", or asks you to memorise something — call create_document or update_page IMMEDIATELY, in this same turn.',
+            '- You finish a task — append what you did and what you learned.',
+            '',
+            'How: create_document for a new memory (clear, descriptive title) or get_document + update_page to extend an existing one. These DocFlows tool calls ARE the act of remembering — writing to a file on disk is not, and does not count.',
+            'NEVER tell the user you saved, remembered, or noted something unless you actually called a DocFlows tool to do it in this same turn. Saying "saved ✅" without a DocFlows tool call loses the memory and is a failure.',
+        ].join('\n');
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+// ── Dispatcher ─────────────────────────────────────────────────────────────
+async function runRequest(req) {
+    // Auth pre-flight: cheap file/env check before we spawn so the user
+    // gets a clean `auth_required` event instead of cryptic stderr from
+    // the child (e.g. "Invalid API key", "401 unauthorized"). This also
+    // saves us from leaking inflight slots on auth-failed spawns.
+    const authCheck = (0, agent_auth_1.verifyAgentAuth)(req.agent);
+    if (!authCheck.ok) {
+        void emit(req.id, 'error', { code: authCheck.code, message: authCheck.message });
+        await setStatus(req.id, {
+            status: 'failed',
+            errorCode: authCheck.code,
+            errorMessage: authCheck.message,
+        });
+        return;
+    }
+    const resolved = await resolveCwdAndProject(req);
+    if ('error' in resolved) {
+        // ephemeral_clone_failed is often a network blip — classify + maybe retry.
+        await failRequest(req, resolved.error.code, resolved.error.message);
+        return;
+    }
+    const { cwd } = resolved;
+    // The cwd this turn's session id was created in is gone and could not be
+    // re-created, so the id cannot resolve — drop it here, once, rather than let
+    // every agent's spawn path pass a --resume that is certain to fail. The
+    // server-side self-heal still covers ids that die for other reasons.
+    if (resolved.resumeSessionVoid && req.resume_session_id) {
+        console.log(`[cwd] dropping resume session ${req.resume_session_id} — its cwd is gone (${req.working_directory}); starting fresh in ${cwd} [reqId=${req.id}]`);
+        void emit(req.id, 'session_dropped_dead_cwd', {
+            sessionId: req.resume_session_id,
+            priorCwd: req.working_directory,
+            cwd,
+        });
+        req.resume_session_id = null;
+    }
+    // Download chat attachments referenced in the prompt ([Image: url],
+    // [File: name — url], bare image URLs) into the session cwd so any
+    // agent/mode can Read them — replaces 0.2.36's unsupported --image flags.
+    // Best-effort: on any failure the prompt passes through unchanged.
+    if (req.prompt) {
+        try {
+            req.prompt = await (0, attachments_1.prepareAttachments)(req.prompt, cwd);
+        }
+        catch { /* keep original prompt */ }
+    }
+    // Resolve and install MCPs / skills / packages before spawn.
+    const installSet = resolveInstallSet(req, resolved);
+    const installed = await (0, install_1.install)(cwd, {
+        mcpIds: installSet.mcpIds,
+        skillIds: installSet.skillIds,
+        packageIds: installSet.packageIds,
+    }, undefined, 
+    // Per-session env overrides keyed by MCP slug — merged into each MCP's
+    // env after credential resolution. Used by widgetstudio to inject the
+    // dynamic streaming auth token (= the request row's id) into the MCP.
+    req.mcp_env_overrides ?? undefined, 
+    // Per-skill variable values keyed by skill id — substituted into each
+    // skill's {{var.<name>}} tokens before SKILL.md is written.
+    req.skill_var_values ?? {}, req.id);
+    if (installed.mcpConfigPath || installed.skillSlugs.length > 0) {
+        void emit(req.id, 'claude:install_complete', {
+            mcps_installed: installed.mcpConfigPath ? true : false,
+            skills_installed: installed.skillSlugs,
+        });
+    }
+    // Fold the entity's +Ai Drive contents into its system prompt (best-effort) so
+    // it begins the run already aware of the files it has. All spawn paths read
+    // req.system_prompt, so mutating it here reaches every agent variant.
+    try {
+        const driveManifest = await buildDriveManifest(installed);
+        if (driveManifest) {
+            req.system_prompt =
+                req.system_prompt && req.system_prompt.trim().length > 0
+                    ? `${req.system_prompt}\n\n${driveManifest}`
+                    : driveManifest;
+        }
+    }
+    catch {
+        /* drive manifest is best-effort — never block a run */
+    }
+    // Same for the entity's long-term memory: try the +Ai Memory semantic pack
+    // (T6's entity-memory-pack edge function) first — it replaces the flat
+    // DocFlows title list with a curated recall block for memory_v2-flagged
+    // entities. `block === ''` means the entity isn't on the pack (unflagged,
+    // or genuinely nothing to recall) → fall back to the legacy DocFlows
+    // manifest below, unchanged. A pack fetch failure is NOT swallowed like
+    // the legacy manifest's best-effort try/catch: it fails LOUD — the
+    // fallback marker is injected into the system prompt AND a
+    // `memory_fallback` runtime event is emitted so the degradation is
+    // observable, never silent.
+    //
+    // The gate/fetch/replace decision itself lives in memory-pack.ts's
+    // applyMemoryPack (extracted so it's unit-testable independent of the
+    // rest of this function's spawn/install machinery). It reads
+    // req.entity_studio_entity_id first — the runtime "entity_id alias" fix:
+    // runtime_pick_next_request returns the bare entity_runtime_requests
+    // rowtype (no jsonb aliasing), so that is the real field name; req.entity_id
+    // is kept only as a fallback (see resolvePackEntityId in memory-pack.ts).
+    try {
+        req.system_prompt = await (0, memory_pack_1.applyMemoryPack)(req, req.system_prompt ?? null, config_1.SUPABASE_URL, config_1.SUPABASE_ANON_KEY, {
+            buildLegacyManifest: () => buildMemoryManifest(installed),
+            onFallback: () => void emit(req.id, 'memory_fallback', { at: 'pack' }),
+            // Phase 4 T7: PreCompact hook gate (see precompact-hook.ts). Reuses
+            // this same pack fetch's `skipped:"flag"` signal instead of asking
+            // the flag question a second time.
+            onFlagged: (flagged) => { req.memoryV2Flagged = flagged; },
+        });
+    }
+    catch (err) {
+        /* memory manifest is best-effort — never block a run */
+        console.error('[memory-pack] wrapper failed:', err?.message);
+    }
+    try {
+        // Agent value now encodes the mode for claude variants:
+        //   'claude'      → claude --print  (one-shot stream)
+        //   'claude-tui'  → claude TUI      (long-lived spawn)
+        //   'claude-bypass' (legacy) → claude TUI with bypass perms
+        //   'codex' / 'kimi' / 'gemini' / 'grok' → those CLIs
+        if (req.agent === 'codex') {
+            await runCodex(req, cwd, installed);
+        }
+        else if (req.agent === 'kimi') {
+            await runKimi(req, cwd, installed);
+        }
+        else if (req.agent === 'gemini') {
+            await runGemini(req, cwd, installed);
+        }
+        else if (req.agent === 'grok') {
+            await runGrok(req, cwd, installed);
+        }
+        else if (req.agent === 'claude-tui' || req.agent === 'claude-bypass') {
+            await runClaudeTui(req, cwd, installed);
+        }
+        else if (req.mode === 'print') {
+            await runClaudePrint(req, cwd, installed);
+        }
+        else {
+            // Backwards compat: bare 'claude' with mode='tui' still works
+            await runClaudeTui(req, cwd, installed);
+        }
+    }
+    finally {
+        // Best-effort cleanup of installed files. If the request crashed
+        // mid-flight we may leak files; next install run for the same cwd
+        // will overwrite them.
+        try {
+            await installed.dispose();
+        }
+        catch { }
+    }
+}