@agentskit/harness 0.11.0 → 0.13.0

package/dist/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { createHash, randomUUID, createPrivateKey, createPublicKey, sign, verify } from 'crypto';
-import { readFileSync, mkdirSync, existsSync, unlinkSync, openSync, writeFileSync, closeSync, readdirSync, statSync, writeSync, appendFileSync, mkdtempSync, renameSync, rmSync } from 'fs';
+import { readFileSync, mkdirSync, existsSync, unlinkSync, openSync, writeFileSync, closeSync, readdirSync, statSync, writeSync, appendFileSync, mkdtempSync, renameSync, rmSync, accessSync, constants } from 'fs';
 import { resolve, dirname, relative, basename, join, extname, isAbsolute, delimiter, sep } from 'path';
 import { Command } from 'commander';
 import { execFile, spawn, execFileSync } from 'child_process';
@@ -970,9 +970,9 @@ var createDocBridgeContextProvider = ({ root, indexPath = ".doc-bridge/index.jso
     const started = Date.now();
     const ageBudget = maxAgeHours ?? 0;
     const inspection = ageBudget > 0 ? inspectDocBridgeIndex(root, indexPath, now4()) : null;
-    if (inspection?.error) throw new Error(`Doc Bridge index is unreadable: ${inspection.error}`);
+    if (inspection?.error) fail(`Doc Bridge index is unreadable: ${inspection.error}`, "INVALID_STATE");
     if (inspection?.ageHours !== null && inspection?.ageHours !== void 0 && inspection.ageHours > ageBudget) {
-      throw new Error(`Doc Bridge index is ${inspection.ageHours.toFixed(1)}h old; refresh it before resolving context.`);
+      fail(`Doc Bridge index is ${inspection.ageHours.toFixed(1)}h old; refresh it before resolving context.`, "STALE");
     }
     const document = index(root, indexPath);
     const contentHash = sourceHash(document);
@@ -993,7 +993,9 @@ var createDocBridgeContextProvider = ({ root, indexPath = ".doc-bridge/index.jso
 });
 var executable = (path) => {
   try {
-    return statSync(path).isFile();
+    if (!statSync(path).isFile()) return false;
+    accessSync(path, constants.X_OK);
+    return true;
   } catch {
     return false;
   }
@@ -1524,7 +1526,7 @@ var validateIteration = (iteration, index2) => {
     if (typeof result !== "object" || result === null || Array.isArray(result)) return fail(`iterations[${index2}].steps[${stepIndex}] must be an object.`, "INVALID_INPUT");
     if (result.step !== IMPROVEMENT_CYCLE_STEPS[stepIndex]) return fail(`iterations[${index2}].steps[${stepIndex}] must be ${IMPROVEMENT_CYCLE_STEPS[stepIndex]}.`, "INVALID_INPUT");
     if (!["passed", "failed", "blocked", "pending"].includes(result.status)) return fail(`iterations[${index2}].steps[${stepIndex}].status is invalid.`, "INVALID_INPUT");
-    if (result.status !== "passed" && !nonEmpty(result.reason, `iterations[${index2}].steps[${stepIndex}].reason`)) return fail(`iterations[${index2}].steps[${stepIndex}].reason is required when the step does not pass.`, "INVALID_INPUT");
+    if (result.status !== "passed" && (typeof result.reason !== "string" || !result.reason.trim())) return fail(`iterations[${index2}].steps[${stepIndex}].reason is required when the step does not pass.`, "INVALID_INPUT");
   });
   if (iteration.adjustment !== void 0) nonEmpty(iteration.adjustment, `iterations[${index2}].adjustment`);
   return { ...iteration, metrics: validateMetrics(iteration.metrics, index2) };
@@ -1538,8 +1540,10 @@ var assessImprovementCycle = (input) => {
   const iterations = input.iterations.map(validateIteration);
   iterations.forEach((iteration, index2) => {
     if (iteration.iteration !== index2 + 1) return fail("iterations must be sequential and start at 1.", "INVALID_INPUT");
-    if (index2 > 0 && iterations[index2 - 1]?.steps.every((step) => step.status === "passed")) return fail("a completed cycle cannot have later iterations.", "INVALID_INPUT");
-    if (index2 < iterations.length - 1 && !iteration.adjustment) return fail(`iterations[${index2}].adjustment is required before repeating.`, "INVALID_INPUT");
+    const isLast = index2 === iterations.length - 1;
+    const iterationComplete = iteration.steps.every((step) => step.status === "passed");
+    if (iterationComplete && !isLast) return fail("a completed cycle cannot have later iterations.", "INVALID_INPUT");
+    if (!isLast && !iteration.adjustment) return fail(`iterations[${index2}].adjustment is required before repeating.`, "INVALID_INPUT");
   });
   const matrix = iterations.map((iteration) => {
     const statuses = Object.fromEntries(iteration.steps.map((step) => [step.step, step.status]));
@@ -2241,7 +2245,17 @@ var MODEL_ROLES = ["orchestrator", "reviewer", "builder", "watcher"];
 
 // src/kernel/pii.ts
 var PATTERNS = [
-  { kind: "api-key", regex: /\b(?:sk-[A-Za-z0-9]{16,}|gh[opsu]_[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g },
+  // PEM key blocks first: large, unambiguous, and must claim their content before any narrower pattern below
+  // could otherwise match a substring inside the base64 body (unlikely, but claimed-range order matters).
+  { kind: "private-key", regex: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----[\s\S]*?-----END (?:RSA |EC |DSA |OPENSSH |ENCRYPTED |)PRIVATE KEY-----/g },
+  // `sk-` body allows `-`/`_` (not just alnum) so a project/scoped key like `sk-proj-...`/`sk-live-...` matches
+  // as one token instead of the hyphen splitting it into a too-short fragment. `github_pat_` (fine-grained PAT)
+  // and `AIza…` (Google API key) are current real-world formats missing from the original list entirely.
+  { kind: "api-key", regex: /\b(?:sk-[A-Za-z0-9_-]{16,}|sk_(?:live|test)_[A-Za-z0-9]{16,}|pk_(?:live|test)_[A-Za-z0-9]{16,}|gh[opsu]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,}|AKIA[0-9A-Z]{16}|AIza[A-Za-z0-9_-]{30,}|xox[baprs]-[A-Za-z0-9-]{10,})\b/g },
+  // The AWS *secret* half (as opposed to the `AKIA…` access-key id above) has no recognizable prefix — a bare
+  // 40-char base64-shaped run is too generic to scan for on its own (matches hashes, tokens, arbitrary base64).
+  // Anchoring on the conventional key name it's almost always assigned to/from keeps this pattern high-signal.
+  { kind: "api-key", regex: /\b(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY|SecretAccessKey)\s*[:=]\s*["']?([A-Za-z0-9/+=]{40})["']?/g },
   { kind: "email", regex: /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g },
   { kind: "credit-card", regex: /\b(?:\d[ -]?){13,16}\b/g },
   { kind: "phone", regex: /\b\+?\d{1,3}?[\s().-]?\(?\d{2,4}\)?[\s.-]?\d{3,4}[\s.-]?\d{4}\b/g }
@@ -2389,7 +2403,9 @@ var exportEvidenceBundle = async ({ configPath, runId, outputPath, privateKeyPat
 `, "utf8");
   return bundle;
 };
-var verifyEvidenceBundle = (path, { trustedKeys = [] } = {}) => {
+var EVIDENCE_MAX_FILE_BYTES = 25 * 1048576;
+var EVIDENCE_MAX_TOTAL_BYTES = 200 * 1048576;
+var verifyEvidenceBundle = (path, { trustedKeys = [], maxFileBytes = EVIDENCE_MAX_FILE_BYTES, maxTotalBytes = EVIDENCE_MAX_TOTAL_BYTES } = {}) => {
   const bundle = parseBundle(path);
   if (bundle.type !== "agentskit-harness-evidence-bundle" || bundle.schemaVersion !== EVIDENCE_BUNDLE_SCHEMA_VERSION || !bundle.runId || !validKeyId(bundle.signerKeyId) || !validDigest(bundle.payloadHash) || bundle.signature?.algorithm !== "ed25519" || bundle.signature.keyId !== bundle.signerKeyId || typeof bundle.signature.publicKeyPem !== "string" || typeof bundle.signature.signatureBase64 !== "string" || !Array.isArray(bundle.files)) fail("Evidence bundle metadata is invalid.", "HARNESS_ERROR");
   if (trustedKeys.length) {
@@ -2399,10 +2415,14 @@ var verifyEvidenceBundle = (path, { trustedKeys = [] } = {}) => {
     if (trusted.publicKeyPem !== bundle.signature.publicKeyPem) fail(`Evidence bundle key does not match trust store: ${bundle.signerKeyId}`, "HARNESS_ERROR");
   }
   const paths = /* @__PURE__ */ new Set();
+  let totalBytes = 0;
   for (const file of bundle.files) {
     if (!file || typeof file.path !== "string" || paths.has(file.path) || !validDigest(file.sha256) || typeof file.contentBase64 !== "string") fail("Evidence bundle file metadata is invalid.", "HARNESS_ERROR");
     paths.add(file.path);
+    if (file.contentBase64.length > Math.ceil(maxFileBytes / 3) * 4) fail(`Evidence bundle file exceeds the maximum allowed size: ${file.path}`, "HARNESS_ERROR");
     const content = Buffer.from(file.contentBase64, "base64");
+    totalBytes += content.length;
+    if (totalBytes > maxTotalBytes) fail("Evidence bundle exceeds the maximum total allowed size.", "HARNESS_ERROR");
     if (sha256(content) !== file.sha256) fail(`Evidence bundle file hash mismatch: ${file.path}`, "HARNESS_ERROR");
   }
   if (!paths.has(`runs/${bundle.runId}/run.json`) || !paths.has(`runs/${bundle.runId}/events.ndjson`)) fail("Evidence bundle is missing the run projection or event log.", "HARNESS_ERROR");
@@ -2503,6 +2523,21 @@ var orcaStatus = async (runner, options2 = {}) => parseOrcaStatus(await orcaJson
 var orcaWorktrees = async (runner, options2 = {}) => parseOrcaWorktrees(await orcaJson(runner, ["worktree", "ps"], options2));
 var orcaAgentHooks = async (runner, options2 = {}) => parseOrcaAgentHooks(await orcaJson(runner, ["agent", "hooks", "status"], options2));
 var orcaAccountList = async (runner, options2 = {}) => orcaJson(runner, ["account", "list"], options2);
+var orcaDiagnosticsMemory = async (runner, options2 = {}) => {
+  try {
+    const result = await orcaJson(runner, ["diagnostics", "memory"], options2);
+    if (!isRecord7(result)) return null;
+    const host = isRecord7(result["host"]) ? result["host"] : {};
+    const availableBytes = host["availableMemory"];
+    if (typeof availableBytes !== "number" || !Number.isFinite(availableBytes) || availableBytes <= 0) return null;
+    const totalBytes = typeof host["totalMemory"] === "number" ? host["totalMemory"] : null;
+    const worktrees = Array.isArray(result["worktrees"]) ? result["worktrees"] : [];
+    const agentRssSamples = worktrees.filter(isRecord7).flatMap((worktree) => Array.isArray(worktree["sessions"]) ? worktree["sessions"] : []).filter(isRecord7).map((session) => session["memory"]).filter((value) => typeof value === "number" && Number.isFinite(value) && value > 0);
+    return { availableBytes, totalBytes, agentRssSamples };
+  } catch {
+    return null;
+  }
+};
 var parseOrcaWorktreeCreate = (result) => {
   const record3 = isRecord7(result) ? result : {};
   const nested = isRecord7(record3["worktree"]) ? record3["worktree"] : record3;
@@ -2578,6 +2613,12 @@ var orcaTerminalWait = async (runner, input, options2 = {}) => {
   const wait = isRecord7(record3["wait"]) ? record3["wait"] : record3;
   return { satisfied: wait["satisfied"] === true, raw: result };
 };
+var orcaTerminalScreen = async (runner, input, options2 = {}) => {
+  const result = await orcaJson(runner, ["terminal", "read", "--terminal", input.terminal, "--screen"], options2);
+  const record3 = isRecord7(result) ? isRecord7(result["terminal"]) ? result["terminal"] : result : {};
+  const screen = record3["tail"] ?? record3["screen"] ?? record3["lines"] ?? record3["text"] ?? record3["output"];
+  return Array.isArray(screen) ? screen.map((line2) => isRecord7(line2) ? str(line2["text"], str(line2["line"])) : String(line2)).join("\n") : typeof screen === "string" ? screen : "";
+};
 var parseOrcaAutomations = (result) => {
   const list2 = isRecord7(result) ? Array.isArray(result["automations"]) ? result["automations"] : Array.isArray(result["items"]) ? result["items"] : [] : Array.isArray(result) ? result : [];
   return list2.filter(isRecord7).map((item) => ({ id: str(item["id"]), name: str(item["name"]), enabled: item["enabled"] !== false && item["disabled"] !== true, trigger: str(item["rrule"], str(item["trigger"], str(item["schedule"], typeof item["schedule"] === "object" && item["schedule"] !== null ? JSON.stringify(item["schedule"]) : ""))), provider: str(item["agentId"], str(item["provider"], str(item["agent"]))) || null, raw: item })).filter((item) => item.id);
@@ -3194,8 +3235,8 @@ var isWsl = (platform = process.platform, osRelease = release(), env = process.e
 var assessSlots = (input) => {
   const platform = input.platform ?? process.platform;
   const wsl = isWsl(platform, input.osRelease);
-  const freeBytes = input.freeBytes ?? availableMemoryBytes(platform);
-  const totalBytes = input.totalBytes ?? totalmem();
+  const freeBytes = input.freeBytes ?? input.orcaMemory?.availableBytes ?? availableMemoryBytes(platform);
+  const totalBytes = input.totalBytes ?? input.orcaMemory?.totalBytes ?? totalmem();
   const sample = input.sample ?? { ...sampleMachine(), memoryUsedPercent: Number(Math.max(0, Math.min(100, (1 - freeBytes / Math.max(1, totalBytes)) * 100)).toFixed(2)) };
   const freeRamGb = Number((freeBytes / 1024 ** 3).toFixed(2));
   const reasons = [];
@@ -3203,9 +3244,11 @@ var assessSlots = (input) => {
   const adaptive = adaptiveConcurrency(ceiling, sample, { warningPercent: input.machine.warningPercent, criticalPercent: input.machine.criticalPercent });
   if (adaptive < ceiling) reasons.push(`machine pressure capped concurrency at ${adaptive} (load ${sample.load1PerCpuPercent}%, memory ${sample.memoryUsedPercent}%)`);
   const reservedBytes = input.machine.minFreeRamGb * 1024 ** 3;
-  const perAgentBytes = input.machine.agentRssMb * 1024 ** 2;
+  const measuredAgentBytes = input.orcaMemory?.agentRssSamples.length ? input.orcaMemory.agentRssSamples.reduce((total, value) => total + value, 0) / input.orcaMemory.agentRssSamples.length : null;
+  const perAgentBytes = measuredAgentBytes ?? input.machine.agentRssMb * 1024 ** 2;
+  const perAgentMb = Math.round(perAgentBytes / 1024 ** 2);
   const ramBound = Math.max(0, Math.floor((freeBytes - reservedBytes) / perAgentBytes)) + input.running;
-  if (ramBound < adaptive) reasons.push(`free RAM ${freeRamGb} GB minus ${input.machine.minFreeRamGb} GB reserve fits ${Math.max(0, ramBound - input.running)} more agent(s) at ${input.machine.agentRssMb} MB each`);
+  if (ramBound < adaptive) reasons.push(`free RAM ${freeRamGb} GB minus ${input.machine.minFreeRamGb} GB reserve fits ${Math.max(0, ramBound - input.running)} more agent(s) at ${perAgentMb} MB each${measuredAgentBytes ? " (measured)" : ""}`);
   let maxAgents = Math.min(adaptive, ramBound);
   if (wsl && maxAgents > input.machine.wslCap) {
     maxAgents = input.machine.wslCap;
@@ -3855,7 +3898,8 @@ var runLoopDoctor = async (input) => {
     push("orca.worktrees", "warning", `worktree ps unavailable: ${workersError}`);
   }
   const running = countRunningWorkers(worktrees);
-  const machine = assessSlots({ machine: config.machine, running, platform: input.platform });
+  const orcaMemory = await orcaDiagnosticsMemory(input.runner, orcaOptions2);
+  const machine = assessSlots({ machine: config.machine, running, platform: input.platform, orcaMemory });
   push("machine.slots", machine.free > 0 ? "passed" : "warning", `${machine.free} free of ${machine.maxAgents} (running ${running}, cpus ${machine.sample.cpus}, load ${machine.sample.load1PerCpuPercent}%, free RAM ${machine.freeRamGb} GB)${machine.reasons.length ? `; ${machine.reasons.join("; ")}` : ""}`);
   let queue = [];
   let queueError = null;
@@ -4076,6 +4120,14 @@ var githubCommentExists = async (runner, input, options2 = {}) => {
   const list2 = await ghJson(runner, ["api", "--paginate", `repos/${input.repo}/issues/${input.number}/comments`, "--jq", "[.[].body]"], options2);
   return Array.isArray(list2) && list2.some((body2) => typeof body2 === "string" && body2.includes(input.marker));
 };
+var writeJsonAtomic = (path, value) => {
+  const dir = dirname(path);
+  mkdirSync(dir, { recursive: true });
+  const tmp = join(dir, `.${basename(path)}.${process.pid}.${Date.now()}.tmp`);
+  writeFileSync(tmp, `${JSON.stringify(value, null, 2)}
+`, "utf8");
+  renameSync(tmp, path);
+};
 var clip = (text6, max) => text6.length <= max ? text6 : `${text6.slice(0, Math.max(0, max - 1))}\u2026`;
 var createFileMemoryKvStore = (dir) => {
   mkdirSync(dir, { recursive: true });
@@ -4285,9 +4337,7 @@ var readStoredContract = (stateDir, identifier) => {
 };
 var writeStoredContract = (stateDir, stored) => {
   const path = contractPath(stateDir, stored.issue);
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(stored, null, 2)}
-`, "utf8");
+  writeJsonAtomic(path, stored);
   return path;
 };
 var contractIsFresh = (stored, issue, reuseHours, now4, memoryDigest) => stored.issueUpdatedAt === issue.updatedAt && (reuseHours === 0 || now4.getTime() - Date.parse(stored.generatedAt) <= reuseHours * 36e5) && (memoryDigest === void 0 || (stored.memoryDigest ?? hashJson([])) === memoryDigest);
@@ -4721,37 +4771,68 @@ var readDispatchRecord = (stateDir, identifier) => {
     return null;
   }
 };
-var writeJson2 = (path, value) => {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-};
 var writeDispatchRecord = (stateDir, record3) => {
   const path = dispatchRecordPath(stateDir, record3.issue);
-  writeJson2(path, record3);
+  writeJsonAtomic(path, record3);
   return path;
 };
 var EVENTS_ROTATE_AT_BYTES = 10 * 1024 * 1024;
+var EVENTS_LOCK_STALE_MS = 5e3;
+var EVENTS_LOCK_MAX_ATTEMPTS = 100;
+var EVENTS_LOCK_RETRY_MS = 10;
+var acquireEventsLock = (lockFilePath) => {
+  for (let attempt = 0; attempt < EVENTS_LOCK_MAX_ATTEMPTS; attempt += 1) {
+    try {
+      return openSync(lockFilePath, "wx");
+    } catch (error) {
+      if (error.code !== "EEXIST") throw error;
+      try {
+        if (Date.now() - statSync(lockFilePath).mtimeMs > EVENTS_LOCK_STALE_MS) unlinkSync(lockFilePath);
+      } catch {
+      }
+      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, EVENTS_LOCK_RETRY_MS);
+    }
+  }
+  return null;
+};
 var appendLoopEvent = (stateDir, event2, bus, now4 = () => /* @__PURE__ */ new Date()) => {
   const path = join(stateDir, "events.ndjson");
   mkdirSync(dirname(path), { recursive: true });
+  const lockFilePath = `${path}.lock`;
+  const lockFd = acquireEventsLock(lockFilePath);
   try {
-    if (statSync(path).size > EVENTS_ROTATE_AT_BYTES) renameSync(path, join(stateDir, `events-archive-${now4().getTime()}.ndjson`));
-  } catch {
-  }
-  appendFileSync(path, `${JSON.stringify(event2)}
+    if (lockFd !== null) {
+      try {
+        if (statSync(path).size > EVENTS_ROTATE_AT_BYTES) renameSync(path, join(stateDir, `events-archive-${now4().getTime()}.ndjson`));
+      } catch {
+      }
+    }
+    appendFileSync(path, `${JSON.stringify(event2)}
 `, "utf8");
+  } finally {
+    if (lockFd !== null) {
+      try {
+        closeSync(lockFd);
+      } catch {
+      }
+      try {
+        unlinkSync(lockFilePath);
+      } catch {
+      }
+    }
+  }
   if (bus && typeof event2["type"] === "string") bus.emit(event2);
 };
 var gatherLoopState = async (input) => {
   const { config } = input.loaded;
   const person = queueOwner(input.loaded);
   const orca = { bin: config.orca.bin, timeoutMs: config.orca.timeoutMs };
-  const [accountList, agentHooks, worktrees, queue] = await Promise.all([
+  const [accountList, agentHooks, worktrees, queue, orcaMemory] = await Promise.all([
     orcaAccountList(input.runner, orca).catch(() => ({})),
     orcaAgentHooks(input.runner, orca).catch(() => ({})),
     orcaWorktrees(input.runner, orca),
-    fetchLinearQueue(input.runner, { bin: config.orca.bin, workspaceId: config.linear.workspaceId, teamKey: config.linear.teamKey, assignee: person, filter: config.linear, orca })
+    fetchLinearQueue(input.runner, { bin: config.orca.bin, workspaceId: config.linear.workspaceId, teamKey: config.linear.teamKey, assignee: person, filter: config.linear, orca }),
+    orcaDiagnosticsMemory(input.runner, orca)
   ]);
   const providers = await detectProviders({ providers: providerSpecs(config), accountList, agentHooks, env: input.env, platform: input.platform, exhaustedPercent: config.models.cooldown.exhaustedPercent, cooldowns: activeCooldowns(readCooldowns(input.loaded.stateDir), input.now()), now: input.now });
   const availableIds = providers.filter((provider) => provider.available).map((provider) => provider.id);
@@ -4766,7 +4847,7 @@ var gatherLoopState = async (input) => {
   })]))) : {};
   const routing = routeAllRoles(config, providers, extrasByRole);
   const running = countRunningWorkers(worktrees);
-  const slots = assessSlots({ machine: config.machine, running, platform: input.platform, ...input.machine });
+  const slots = assessSlots({ machine: config.machine, running, platform: input.platform, orcaMemory, ...input.machine });
   const leases = input.ledger.active();
   const busy = busyIssues(queue, leases, worktrees, person);
   const candidates = queue.filter((issue) => !busy.has(issue.identifier) && (!input.onlyIssue || issue.identifier === input.onlyIssue));
@@ -5035,7 +5116,7 @@ The loop will not retry this issue until you remove the \`${config.resilience.pa
       if (!launched.accepted) notes.push(`${detail.identifier}: terminal ${launched.terminal} did not confirm the brief; deliver will nudge it if it stays idle`);
       ledger.recordDispatch({ lease: claim.lease, idempotencyKey: plan.idempotencyKey, commandDigest: plan.commandDigest });
       const record3 = { issue: detail.identifier, worktreeId: created.id, worktree, branch: actualBranch, terminal: launched.terminal, provider: builder.provider, model: builder.model, contractDigest: stored.digest, leaseKey: claim.lease.key, leaseId: claim.lease.leaseId, dispatchedAt: now4().toISOString(), url: detail.url, briefDigest, skills: skillRefs(pinnedSkills), setup: setupResult, effort: builder.effort, initialRemainingPercent: builder.remainingPercent, worktreePath: created.path };
-      writeJson2(dispatchRecordPath(loaded.stateDir, detail.identifier), record3);
+      writeJsonAtomic(dispatchRecordPath(loaded.stateDir, detail.identifier), record3);
       appendLoopEvent(loaded.stateDir, { at: record3.dispatchedAt, type: "worker.dispatched", ...record3, command: builder.tui, briefAccepted: launched.accepted, tuiIdle: launched.idle }, bus);
       await bus.runHook("afterDispatch", { issue: detail.identifier, provider: record3.provider, model: record3.model, branch: record3.branch, worktreeId: record3.worktreeId });
       clearIssueFailures(loaded.stateDir, detail.identifier);
@@ -5152,11 +5233,6 @@ var discoverIntake = async (runner, input, options2 = {}) => {
 // src/loop/deliver.ts
 var message3 = (error) => error instanceof HarnessError ? `${error.code}: ${error.message}` : error instanceof Error ? error.message : String(error);
 var isMissingOrcaWorktree = (error) => message3(error).includes("selector_not_found");
-var writeJson3 = (path, value) => {
-  mkdirSync(dirname(path), { recursive: true });
-  writeFileSync(path, `${JSON.stringify(value, null, 2)}
-`, "utf8");
-};
 var deliveryStatePath = (stateDir, identifier) => join(stateDir, "issues", identifier, "delivery.json");
 var readDeliveryState = (stateDir, identifier) => {
   const path = deliveryStatePath(stateDir, identifier);
@@ -5183,7 +5259,7 @@ var minutesBetween = (later, earlier) => earlier === null ? Number.POSITIVE_INFI
 var orcaOptions = (config) => ({ bin: config.orca.bin, timeoutMs: config.orca.timeoutMs });
 var linearOptions = (config) => ({ bin: config.orca.bin, workspaceId: config.linear.workspaceId, orca: { timeoutMs: config.orca.timeoutMs } });
 var saveState = (ctx, state) => {
-  if (!ctx.dryRun) writeJson3(deliveryStatePath(ctx.loaded.stateDir, state.issue), state);
+  if (!ctx.dryRun) writeJsonAtomic(deliveryStatePath(ctx.loaded.stateDir, state.issue), state);
 };
 var event = (ctx, payload) => {
   if (!ctx.dryRun) appendLoopEvent(ctx.loaded.stateDir, { at: ctx.now().toISOString(), ...payload }, ctx.bus);
@@ -5278,14 +5354,34 @@ ${JSON.stringify(stored.contract, null, 2)}
     return false;
   }
 };
+var captureWorkerOutput = async (ctx, terminal2) => {
+  if (!terminal2) return null;
+  try {
+    const screen = (await orcaTerminalScreen(ctx.runner, { terminal: terminal2 }, orcaOptions(ctx.config))).trim();
+    return screen ? screen.slice(-2e3) : null;
+  } catch {
+    return null;
+  }
+};
 var escalateLinear = async (ctx, record3, kind, body2, actions) => {
   if (ctx.dryRun) {
     actions.push(`would mark ${kind} in Linear and Orca`);
     return;
   }
+  const workerOutput = await captureWorkerOutput(ctx, record3.terminal);
+  const fullBody = workerOutput ? `${body2}
+
+<details><summary>Worker's last terminal output</summary>
+
+\`\`\`
+${workerOutput}
+\`\`\`
+
+</details>` : body2;
+  if (workerOutput) actions.push("captured worker terminal output for the escalation");
   const linear = linearOptions(ctx.config);
   try {
-    await linearCommentAdd(ctx.runner, { issue: record3.issue, body: `${body2}
+    await linearCommentAdd(ctx.runner, { issue: record3.issue, body: `${fullBody}
 
 <!-- loop:${kind}:${record3.leaseId} -->`, dedupeKey: `${kind}:${record3.issue}:${record3.leaseId}` }, linear);
     await linearLabelAdd(ctx.runner, { issue: record3.issue, labels: [ctx.config.linear.blockedLabel] }, linear);
@@ -5835,7 +5931,7 @@ var runDeliver = async (input) => {
         const candidates = (await githubOpenPullRequests(input.runner, { repo: config.project.repo, limit: 100 })).filter((item) => item.headRef === record3.branch || item.headRef.endsWith(`/${record3.worktree}`) || item.headRef === record3.worktree);
         if (candidates.length) {
           open = candidates;
-          if (!dryRun) writeJson3(dispatchRecordPath(loaded.stateDir, record3.issue), { ...record3, branch: candidates[0].headRef });
+          if (!dryRun) writeJsonAtomic(dispatchRecordPath(loaded.stateDir, record3.issue), { ...record3, branch: candidates[0].headRef });
           notes.push(`${record3.issue}: PR found on branch ${candidates[0].headRef}; dispatch record updated`);
         }
       }
@@ -6444,7 +6540,7 @@ var parseSince = (value, now4) => {
     return new Date(now4.getTime() - amount * unit);
   }
   const parsed = Date.parse(value);
-  if (Number.isNaN(parsed)) throw new Error(`Unrecognised --since value: ${value} (use 7d, 12h, 30m or an ISO date)`);
+  if (Number.isNaN(parsed)) fail(`Unrecognised --since value: ${value} (use 7d, 12h, 30m or an ISO date)`, "INVALID_INPUT");
   return new Date(parsed);
 };
 var median2 = (values) => {
@@ -6693,6 +6789,7 @@ var phaseOf = (dispatch, delivery2) => {
   return "in-flight";
 };
 var summarize2 = (phase, delivery2, dispatch) => {
+  if (phase === "idle") return "Not yet dispatched";
   if (phase === "merged") return `Merged PR #${delivery2.prNumber ?? "?"}`;
   if (phase === "held" || phase === "held-incomplete-review") {
     if (delivery2.heldFor) return `Held for a human (self-edit or protected path at ${delivery2.heldFor.slice(0, 7)})`;
@@ -6779,7 +6876,7 @@ var buildDebriefReport = (input) => {
         });
         continue;
       }
-      continue;
+      if (!input.issue) continue;
     }
     rows.push(rowFor({ issue, dispatch, delivery: delivery2, intent, repo: config.project.repo, now: now4 }));
   }
@@ -6947,7 +7044,7 @@ var runObservability = async (input) => {
   const events2 = readLoopEvents(loaded.stateDir).filter((event2) => Date.parse(event2.at) >= since.getTime() && Date.parse(event2.at) <= at.getTime());
   const ledger = createDispatchLedger(loaded.stateDir);
   const active = ledger.active();
-  const missingDeliveryIssues = active.filter((lease) => !existsSync(deliveryStatePath(loaded.stateDir, lease.issue))).map((lease) => lease.issue);
+  const missingDeliveryIssues = active.filter((lease) => !existsSync(deliveryStatePath(loaded.stateDir, lease.issue)) && !existsSync(dispatchRecordPath(loaded.stateDir, lease.issue))).map((lease) => lease.issue);
   const records = listDispatched(loaded.stateDir);
   const completed = records.map((record3) => ({ record: record3, state: readDeliveryState(loaded.stateDir, record3.issue) })).filter(({ state }) => state.finishedAt && Date.parse(state.finishedAt) >= since.getTime());
   const leadTimes = completed.map(({ record: record3, state }) => state.finishedAt ? (Date.parse(state.finishedAt) - Date.parse(record3.dispatchedAt)) / 6e4 : null).filter((value) => value !== null && Number.isFinite(value)).sort((a, b) => a - b);
@@ -7470,7 +7567,7 @@ benchmark.command("baseline <taskId>").description("Record one controlled baseli
 program.command("clean").description("Remove only configured task-owned temporary artifacts.").action(() => print(cleanTaskArtifacts(options().config)));
 process.on("SIGINT", () => {
   process.stderr.write("Cancelled.\n");
-  process.exitCode = 130;
+  process.exit(130);
 });
 try {
   await program.parseAsync(process.argv);