@amistio/cli 0.1.6 → 0.1.8

package/dist/index.js

@@ -1,10 +1,10 @@
 #!/usr/bin/env node
 
 // src/index.ts
-import { createHash as createHash5, randomUUID } from "node:crypto";
-import { writeFile as writeFile8 } from "node:fs/promises";
-import os5 from "node:os";
-import path12 from "node:path";
+import { createHash as createHash6, randomUUID } from "node:crypto";
+import { writeFile as writeFile9 } from "node:fs/promises";
+import os7 from "node:os";
+import path13 from "node:path";
 import { Command } from "commander";
 
 // ../shared/src/schemas.ts
@@ -141,6 +141,21 @@ var runnerToolCapabilitySchema = z.object({
   supportsBranchIsolation: z.boolean().optional(),
   supportsGitWorktreeIsolation: z.boolean().optional()
 });
+var runnerResourceUsageSchema = z.object({
+  sampledAt: isoDateTimeSchema,
+  processUptimeSeconds: z.number().nonnegative().optional(),
+  processMemoryRssBytes: z.number().int().nonnegative().optional(),
+  processMemoryHeapUsedBytes: z.number().int().nonnegative().optional(),
+  processMemoryHeapTotalBytes: z.number().int().nonnegative().optional(),
+  processCpuUserMicros: z.number().int().nonnegative().optional(),
+  processCpuSystemMicros: z.number().int().nonnegative().optional(),
+  processCpuPercent: z.number().nonnegative().optional(),
+  systemMemoryTotalBytes: z.number().int().nonnegative().optional(),
+  systemMemoryFreeBytes: z.number().int().nonnegative().optional(),
+  systemLoadAverage1m: z.number().nonnegative().optional(),
+  systemLoadAverage5m: z.number().nonnegative().optional(),
+  systemLoadAverage15m: z.number().nonnegative().optional()
+});
 var workIsolationModeSchema = z.enum(["none", "primaryCheckout", "branch", "gitWorktree"]);
 var repositoryLinkSourceSchema = z.enum(["web", "cli"]);
 var repositoryCloneStatusSchema = z.enum(["notCloned", "cloned", "validated", "failed"]);
@@ -341,6 +356,7 @@ var runnerHeartbeatItemSchema = baseItemSchema.extend({
   preferenceSource: runnerPreferenceSourceSchema.optional(),
   preferenceStatus: runnerPreferenceStatusSchema.optional(),
   preferenceMessage: z.string().optional(),
+  resourceUsage: runnerResourceUsageSchema.optional(),
   lastSeenAt: isoDateTimeSchema
 });
 var runnerSettingsItemSchema = baseItemSchema.extend({
@@ -394,6 +410,7 @@ var runnerCredentialItemSchema = baseItemSchema.extend({
   projectId: z.string().min(1),
   runnerCredentialId: z.string().min(1),
   repositoryLinkId: z.string().min(1),
+  runnerId: z.string().min(1).optional(),
   pairedByUserId: z.string().min(1).optional(),
   machineId: z.string().min(1).optional(),
   tokenHash: z.string().min(32),
@@ -703,6 +720,8 @@ var pairingSessionItemSchema = baseItemSchema.extend({
   projectId: z.string().min(1),
   createdByUserId: z.string().min(1),
   expiresAt: isoDateTimeSchema,
+  failedAttemptCount: z.number().int().nonnegative().optional(),
+  lastFailedAttemptAt: isoDateTimeSchema.optional(),
   status: z.enum(["pending", "confirmed", "expired", "revoked"])
 });
 var projectItemUnionSchema = z.discriminatedUnion("type", [
@@ -1231,8 +1250,11 @@ function credentialKey(accountId, projectId, repositoryLinkId) {
 }
 
 // src/control-plane.ts
+import { execFile as execFile2 } from "node:child_process";
 import { mkdir as mkdir3, readFile as readFile2, stat as stat2, writeFile as writeFile2 } from "node:fs/promises";
 import path3 from "node:path";
+import { promisify as promisify2 } from "node:util";
+var execFileAsync2 = promisify2(execFile2);
 var controlPlaneFolders = [
   path3.join("docs", "architecture"),
   path3.join("docs", "context"),
@@ -1279,6 +1301,17 @@ async function writeProjectLink(rootDir, metadata) {
   await writeFile2(filePath, createProjectLinkMarkdown(metadata), "utf8");
   return filePath;
 }
+async function resolvePairingRoot(rootDir, options = {}) {
+  const requestedRoot = path3.resolve(rootDir);
+  const gitRoot = await readGitTopLevel(requestedRoot).catch(() => void 0);
+  if (gitRoot) {
+    return gitRoot;
+  }
+  if (options.explicitRoot) {
+    return requestedRoot;
+  }
+  throw new Error("Run `amistio pair` from inside the repository checkout, or pass --root <repo-root> explicitly.");
+}
 async function readProjectLink(rootDir) {
   const candidatePaths = [
     path3.join(rootDir, "docs", "context", "amistio-project.md"),
@@ -1327,6 +1360,14 @@ async function exists(filePath) {
     return false;
   }
 }
+async function readGitTopLevel(rootDir) {
+  const { stdout } = await execFileAsync2("git", ["-C", rootDir, "rev-parse", "--show-toplevel"], { maxBuffer: 1024 * 1024 });
+  const gitRoot = stdout.trim();
+  if (!gitRoot) {
+    throw new Error("Git top-level path was empty.");
+  }
+  return path3.resolve(gitRoot);
+}
 
 // src/api-client.ts
 import { z as z3 } from "zod";
@@ -1617,8 +1658,8 @@ var toolSessionMutationSchema = z3.object({
 });
 function resolveApiUrl(apiUrl, urlPath) {
   const base = apiUrl.endsWith("/") ? apiUrl.slice(0, -1) : apiUrl;
-  const path13 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
-  return new URL(`${base}${path13}`);
+  const path14 = urlPath.startsWith("/") ? urlPath : `/${urlPath}`;
+  return new URL(`${base}${path14}`);
 }
 
 // src/orchestrator.ts
@@ -1827,7 +1868,7 @@ async function runLocalTool(options) {
       promptFilePath,
       streamOutput: Boolean(options.streamOutput),
       ...options.session ? { session: options.session } : {}
-    });
+    }, options.timeoutMs);
     return {
       toolName: runner2.toolName,
       displayCommand: runner2.kind === "sdk" ? runner2.displayCommand : runner2.invocation.displayCommand,
@@ -1912,16 +1953,16 @@ async function createToolRunner(options) {
   }
   throw new Error(`The ${adapter.name} SDK or executable was not found. Install the SDK/runtime or pass --tool-command.`);
 }
-async function executeToolRunner(runner2, input) {
+async function executeToolRunner(runner2, input, timeoutMs) {
   if (runner2.kind === "command") {
-    return executeToolInvocation(runner2.invocation, input.rootDir, input.streamOutput);
+    return executeToolInvocation(runner2.invocation, input.rootDir, input.streamOutput, timeoutMs);
   }
   try {
-    return await runner2.adapter.runWithSdk(input);
+    return await withTimeout(runner2.adapter.runWithSdk(input), timeoutMs, runner2.displayCommand);
   } catch (error) {
     if (runner2.allowCommandFallback && runner2.adapter.buildInvocation && runner2.adapter.executable && await commandExists(runner2.adapter.executable)) {
       const fallback = runner2.adapter.buildInvocation(input);
-      const result = await executeToolInvocation(fallback, input.rootDir, input.streamOutput);
+      const result = await executeToolInvocation(fallback, input.rootDir, input.streamOutput, timeoutMs);
       const sdkFailure = `SDK execution for ${runner2.adapter.name} failed, fell back to ${fallback.displayCommand}: ${errorMessage(error)}`;
       return {
         ...result,
@@ -2010,7 +2051,7 @@ async function commandExists(command) {
     lookup.on("close", (exitCode) => resolve(exitCode === 0));
   });
 }
-async function executeToolInvocation(invocation, rootDir, streamOutput) {
+async function executeToolInvocation(invocation, rootDir, streamOutput, timeoutMs) {
   return new Promise((resolve, reject) => {
     const child = spawn(invocation.command, invocation.args, {
       cwd: rootDir,
@@ -2020,7 +2061,33 @@ async function executeToolInvocation(invocation, rootDir, streamOutput) {
     });
     let stdout = "";
     let stderr = "";
-    child.on("error", reject);
+    let settled = false;
+    let forceKillTimer;
+    const timeout = timeoutMs && timeoutMs > 0 ? setTimeout(() => {
+      if (settled) return;
+      stderr += `${toolTimeoutMessage(invocation.displayCommand, timeoutMs)}
+`;
+      child.kill("SIGTERM");
+      forceKillTimer = setTimeout(() => child.kill("SIGKILL"), 5e3);
+      forceKillTimer.unref?.();
+      rejectOnce(new Error(toolTimeoutMessage(invocation.displayCommand, timeoutMs)));
+    }, timeoutMs) : void 0;
+    timeout?.unref?.();
+    const resolveOnce = (value) => {
+      if (settled) return;
+      settled = true;
+      if (timeout) clearTimeout(timeout);
+      if (forceKillTimer) clearTimeout(forceKillTimer);
+      resolve(value);
+    };
+    const rejectOnce = (error) => {
+      if (settled) return;
+      settled = true;
+      if (timeout) clearTimeout(timeout);
+      if (forceKillTimer) clearTimeout(forceKillTimer);
+      reject(error);
+    };
+    child.on("error", rejectOnce);
     child.stdout.setEncoding("utf8");
     child.stderr.setEncoding("utf8");
     child.stdout.on("data", (chunk) => {
@@ -2041,10 +2108,40 @@ async function executeToolInvocation(invocation, rootDir, streamOutput) {
     }
     child.stdin.end();
     child.on("close", (exitCode) => {
-      resolve({ exitCode: exitCode ?? 1, stdout, stderr });
+      if (forceKillTimer) clearTimeout(forceKillTimer);
+      resolveOnce({ exitCode: exitCode ?? 1, stdout, stderr });
     });
   });
 }
+async function withTimeout(promise, timeoutMs, displayCommand) {
+  if (!timeoutMs || timeoutMs <= 0) {
+    return promise;
+  }
+  return new Promise((resolve, reject) => {
+    const timeout = setTimeout(() => reject(new Error(toolTimeoutMessage(displayCommand, timeoutMs))), timeoutMs);
+    timeout.unref?.();
+    promise.then(
+      (value) => {
+        clearTimeout(timeout);
+        resolve(value);
+      },
+      (error) => {
+        clearTimeout(timeout);
+        reject(error);
+      }
+    );
+  });
+}
+function toolTimeoutMessage(displayCommand, timeoutMs) {
+  return `Local tool timed out after ${formatTimeoutDuration(timeoutMs)}: ${displayCommand}`;
+}
+function formatTimeoutDuration(timeoutMs) {
+  if (timeoutMs < 1e3) {
+    return `${timeoutMs}ms`;
+  }
+  const seconds = timeoutMs / 1e3;
+  return Number.isInteger(seconds) ? `${seconds}s` : `${seconds.toFixed(1)}s`;
+}
 async function runOpencodeSdk(input) {
   const { createOpencode } = await import("@opencode-ai/sdk");
   const previousDirectory = process.cwd();
@@ -2132,7 +2229,7 @@ async function runCodexSdk(input) {
   return { exitCode: 0, stdout: result.finalResponse, stderr: "" };
 }
 async function runCopilotSdk(input) {
-  const { CopilotClient, approveAll } = await import("@github/copilot-sdk");
+  const { CopilotClient } = await import("@github/copilot-sdk");
   const client = new CopilotClient({
     cwd: input.rootDir,
     logLevel: "error"
@@ -2145,7 +2242,7 @@ async function runCopilotSdk(input) {
       workingDirectory: input.rootDir,
       enableConfigDiscovery: true,
       streaming: input.streamOutput,
-      onPermissionRequest: approveAll
+      onPermissionRequest: createCopilotPermissionHandler()
     });
     try {
       let streamedOutput = "";
@@ -2167,6 +2264,18 @@ async function runCopilotSdk(input) {
     await client.stop();
   }
 }
+function createCopilotPermissionHandler(env = process.env) {
+  const allowAllPermissions = isCopilotApproveAllEnabled(env);
+  return (request) => {
+    if (allowAllPermissions || request.kind === "read") {
+      return { kind: "approve-once" };
+    }
+    return { kind: "reject" };
+  };
+}
+function isCopilotApproveAllEnabled(env = process.env) {
+  return /^(1|true|yes)$/i.test(env.AMISTIO_COPILOT_APPROVE_ALL ?? "");
+}
 function extractTextParts(parts) {
   if (!Array.isArray(parts)) {
     return "";
@@ -2364,6 +2473,221 @@ async function readRunnerDaemonMetadataFile(filePath) {
   }
 }
 
+// src/runner-service.ts
+import { spawn as spawn3 } from "node:child_process";
+import { createHash as createHash3 } from "node:crypto";
+import { mkdir as mkdir6, readFile as readFile4, rm as rm2, writeFile as writeFile6 } from "node:fs/promises";
+import os4 from "node:os";
+import path7 from "node:path";
+function detectRunnerServicePlatform(platform = process.platform) {
+  if (platform === "darwin") return "launchd";
+  if (platform === "linux") return "systemd";
+  return "unsupported";
+}
+function createRunnerServiceDescriptor(input) {
+  const platform = input.platform ?? detectRunnerServicePlatform();
+  if (platform === "unsupported") {
+    throw new Error("Startup services are supported for user-level launchd on macOS and systemd user services on Linux.");
+  }
+  const homeDir = input.homeDir ?? os4.homedir();
+  const serviceName = runnerServiceName(input);
+  const serviceFilePath = runnerServiceFilePath(platform, serviceName, homeDir);
+  const now = (/* @__PURE__ */ new Date()).toISOString();
+  const command = [input.executablePath ?? process.execPath, input.scriptPath ?? process.argv[1], ...input.args];
+  const logPath = path7.join(input.metadataDir ?? defaultRunnerMetadataDir(), `${runnerServiceKey(input)}.service.log`);
+  const metadata = {
+    schemaVersion: 1,
+    accountId: input.accountId,
+    projectId: input.projectId,
+    repositoryLinkId: input.repositoryLinkId,
+    runnerId: input.runnerId,
+    rootDir: path7.resolve(input.rootDir),
+    apiUrl: input.apiUrl,
+    serviceName,
+    serviceFilePath,
+    platform,
+    status: "installed",
+    createdAt: now,
+    updatedAt: now,
+    args: input.args
+  };
+  return {
+    metadata,
+    content: platform === "launchd" ? createLaunchdPlist({ command, label: serviceName, logPath, rootDir: metadata.rootDir }) : createSystemdUnit({ command, description: `Amistio runner ${input.runnerId}`, logPath, rootDir: metadata.rootDir })
+  };
+}
+async function installRunnerService(input, options = {}) {
+  const descriptor = createRunnerServiceDescriptor(input);
+  await mkdir6(path7.dirname(descriptor.metadata.serviceFilePath), { recursive: true });
+  await mkdir6(input.metadataDir ?? defaultRunnerMetadataDir(), { recursive: true });
+  await writeFile6(descriptor.metadata.serviceFilePath, descriptor.content, { encoding: "utf8", mode: 384 });
+  await writeRunnerServiceMetadata(descriptor.metadata, input.metadataDir);
+  if (options.activate !== false) {
+    const activation = await activateRunnerService(descriptor.metadata);
+    if (!activation.succeeded) {
+      throw new Error(`Startup service file was written to ${descriptor.metadata.serviceFilePath}, but activation failed: ${activation.message}`);
+    }
+  }
+  return descriptor.metadata;
+}
+async function removeRunnerService(input) {
+  const metadata = await readRunnerServiceMetadata(input, input.metadataDir);
+  if (!metadata) {
+    return void 0;
+  }
+  await deactivateRunnerService(metadata).catch(() => void 0);
+  await rm2(metadata.serviceFilePath, { force: true });
+  await rm2(runnerServiceMetadataPath(input, input.metadataDir ?? defaultRunnerMetadataDir()), { force: true });
+  return { ...metadata, status: "removed", updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
+}
+async function readRunnerServiceMetadata(input, metadataDir = defaultRunnerMetadataDir()) {
+  try {
+    const parsed = JSON.parse(await readFile4(runnerServiceMetadataPath(input, metadataDir), "utf8"));
+    if (parsed.schemaVersion !== 1 || !parsed.serviceName || !parsed.serviceFilePath) {
+      return void 0;
+    }
+    return parsed;
+  } catch {
+    return void 0;
+  }
+}
+async function writeRunnerServiceMetadata(metadata, metadataDir = defaultRunnerMetadataDir()) {
+  await mkdir6(metadataDir, { recursive: true });
+  await writeFile6(runnerServiceMetadataPath(metadata, metadataDir), JSON.stringify(metadata, null, 2), { encoding: "utf8", mode: 384 });
+}
+async function runnerServiceRuntimeStatus(metadata) {
+  if (metadata.platform === "launchd") {
+    const target = launchdTarget(metadata);
+    const result2 = await runProcess("launchctl", ["print", target], 5e3);
+    return result2.exitCode === 0 ? "loaded" : "not loaded";
+  }
+  const result = await runProcess("systemctl", ["--user", "is-active", metadata.serviceName], 5e3);
+  return result.exitCode === 0 ? result.output.trim() || "active" : "not active";
+}
+async function activateRunnerService(metadata) {
+  if (metadata.platform === "launchd") {
+    await runProcess("launchctl", ["bootout", launchdDomain(), metadata.serviceFilePath], 5e3).catch(() => void 0);
+    const result = await runProcess("launchctl", ["bootstrap", launchdDomain(), metadata.serviceFilePath], 1e4);
+    return result.exitCode === 0 ? { succeeded: true, message: "launchd service loaded." } : { succeeded: false, message: result.output || `launchctl exited with ${result.exitCode}.` };
+  }
+  const reload = await runProcess("systemctl", ["--user", "daemon-reload"], 1e4);
+  if (reload.exitCode !== 0) {
+    return { succeeded: false, message: reload.output || `systemctl daemon-reload exited with ${reload.exitCode}.` };
+  }
+  const enable = await runProcess("systemctl", ["--user", "enable", "--now", metadata.serviceName], 2e4);
+  return enable.exitCode === 0 ? { succeeded: true, message: "systemd user service enabled." } : { succeeded: false, message: enable.output || `systemctl enable exited with ${enable.exitCode}.` };
+}
+async function deactivateRunnerService(metadata) {
+  if (metadata.platform === "launchd") {
+    await runProcess("launchctl", ["bootout", launchdDomain(), metadata.serviceFilePath], 1e4);
+    return;
+  }
+  await runProcess("systemctl", ["--user", "disable", "--now", metadata.serviceName], 2e4);
+  await runProcess("systemctl", ["--user", "daemon-reload"], 1e4).catch(() => void 0);
+}
+function createLaunchdPlist(input) {
+  const commandItems = input.command.map((item) => `        <string>${xmlEscape(item)}</string>`).join("\n");
+  return `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+    <key>Label</key>
+    <string>${xmlEscape(input.label)}</string>
+    <key>ProgramArguments</key>
+    <array>
+${commandItems}
+    </array>
+    <key>WorkingDirectory</key>
+    <string>${xmlEscape(input.rootDir)}</string>
+    <key>EnvironmentVariables</key>
+    <dict>
+        <key>AMISTIO_RUNNER_MODE</key>
+        <string>background</string>
+    </dict>
+    <key>RunAtLoad</key>
+    <true/>
+    <key>KeepAlive</key>
+    <true/>
+    <key>StandardOutPath</key>
+    <string>${xmlEscape(input.logPath)}</string>
+    <key>StandardErrorPath</key>
+    <string>${xmlEscape(input.logPath)}</string>
+</dict>
+</plist>
+`;
+}
+function createSystemdUnit(input) {
+  return `[Unit]
+Description=${input.description}
+
+[Service]
+Type=simple
+WorkingDirectory=${systemdEscape(input.rootDir)}
+Environment=AMISTIO_RUNNER_MODE=background
+ExecStart=${input.command.map(systemdEscape).join(" ")}
+Restart=always
+RestartSec=5
+StandardOutput=append:${systemdEscape(input.logPath)}
+StandardError=append:${systemdEscape(input.logPath)}
+
+[Install]
+WantedBy=default.target
+`;
+}
+function runnerServiceFilePath(platform, serviceName, homeDir) {
+  if (platform === "launchd") {
+    return path7.join(homeDir, "Library", "LaunchAgents", `${serviceName}.plist`);
+  }
+  return path7.join(homeDir, ".config", "systemd", "user", `${serviceName}.service`);
+}
+function runnerServiceMetadataPath(input, metadataDir) {
+  return path7.join(metadataDir, `${runnerServiceKey(input)}.service.json`);
+}
+function runnerServiceName(input) {
+  return `com.amistio.runner.${runnerServiceKey(input).slice(0, 20)}`;
+}
+function runnerServiceKey(input) {
+  return createHash3("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.runnerId}`).digest("hex");
+}
+function launchdDomain() {
+  const uid = typeof process.getuid === "function" ? process.getuid() : void 0;
+  return uid === void 0 ? "gui/0" : `gui/${uid}`;
+}
+function launchdTarget(metadata) {
+  return `${launchdDomain()}/${metadata.serviceName}`;
+}
+function xmlEscape(value) {
+  return value.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/\"/g, "&quot;").replace(/'/g, "&apos;");
+}
+function systemdEscape(value) {
+  return value.includes(" ") || value.includes("	") || value.includes('"') ? `"${value.replace(/\\/g, "\\\\").replace(/\"/g, '\\"')}"` : value;
+}
+function runProcess(command, args, timeoutMs) {
+  return new Promise((resolve) => {
+    const child = spawn3(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+    let output = "";
+    const timeout = setTimeout(() => {
+      output += `Timed out while running ${command}.
+`;
+      child.kill("SIGTERM");
+    }, timeoutMs);
+    child.stdout?.on("data", (chunk) => {
+      output += chunk.toString("utf8");
+    });
+    child.stderr?.on("data", (chunk) => {
+      output += chunk.toString("utf8");
+    });
+    child.on("error", (error) => {
+      clearTimeout(timeout);
+      resolve({ exitCode: 1, output: error.message });
+    });
+    child.on("close", (code) => {
+      clearTimeout(timeout);
+      resolve({ exitCode: code ?? 1, output: output.trim() });
+    });
+  });
+}
+
 // src/session-policy.ts
 var maxIdleMs = 24 * 60 * 60 * 1e3;
 var maxTotalMs = 7 * 24 * 60 * 60 * 1e3;
@@ -2498,8 +2822,8 @@ function tokens(value) {
 }
 
 // src/sync.ts
-import { mkdir as mkdir6, readdir as readdir3, readFile as readFile4, stat as stat3, writeFile as writeFile6 } from "node:fs/promises";
-import path7 from "node:path";
+import { mkdir as mkdir7, readdir as readdir3, readFile as readFile5, stat as stat3, writeFile as writeFile7 } from "node:fs/promises";
+import path8 from "node:path";
 var legacySyncRoots = ["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"];
 var syncRoots = legacySyncRoots.map((syncRoot) => `docs/${syncRoot}`);
 async function collectSyncStatus(rootDir, webDocuments = []) {
@@ -2578,7 +2902,7 @@ async function readLocalSyncedDocuments(rootDir) {
   const markdownFiles = await findMarkdownFiles(rootDir);
   const documents = [];
   for (const fullPath of markdownFiles) {
-    const raw = await readFile4(fullPath, "utf8");
+    const raw = await readFile5(fullPath, "utf8");
     const parsed = parseSyncedMarkdown(raw);
     if (!parsed) {
       continue;
@@ -2628,8 +2952,8 @@ async function materializeBrainDocuments(rootDir, documents, options = {}) {
       result.skipped.push(document.repoPath);
       continue;
     }
-    await mkdir6(path7.dirname(fullPath), { recursive: true });
-    await writeFile6(fullPath, createSyncedDocumentMarkdown(document), "utf8");
+    await mkdir7(path8.dirname(fullPath), { recursive: true });
+    await writeFile7(fullPath, createSyncedDocumentMarkdown(document), "utf8");
     result.written.push(document.repoPath);
   }
   return result;
@@ -2690,7 +3014,7 @@ function parseSyncedMarkdown(content) {
 }
 async function readExistingSyncedDocument(fullPath) {
   try {
-    const raw = await readFile4(fullPath, "utf8");
+    const raw = await readFile5(fullPath, "utf8");
     const parsed = parseSyncedMarkdown(raw);
     if (!parsed) {
       return { exists: true };
@@ -2715,7 +3039,7 @@ async function readExistingSyncedDocument(fullPath) {
 async function findMarkdownFiles(rootDir) {
   const files = [];
   for (const syncRoot of syncRoots) {
-    const fullRoot = path7.join(rootDir, syncRoot);
+    const fullRoot = path8.join(rootDir, syncRoot);
     if (!await exists2(fullRoot)) {
       continue;
     }
@@ -2725,7 +3049,7 @@ async function findMarkdownFiles(rootDir) {
 }
 async function walkMarkdownFiles(directory, files) {
   for (const entry of await readdir3(directory, { withFileTypes: true })) {
-    const fullPath = path7.join(directory, entry.name);
+    const fullPath = path8.join(directory, entry.name);
     if (entry.isDirectory()) {
       await walkMarkdownFiles(fullPath, files);
     } else if (entry.isFile() && entry.name.endsWith(".md")) {
@@ -2734,23 +3058,23 @@ async function walkMarkdownFiles(directory, files) {
   }
 }
 function safeRepoPath(rootDir, repoPath) {
-  if (path7.isAbsolute(repoPath)) {
+  if (path8.isAbsolute(repoPath)) {
     throw new Error(`Refusing to use absolute repo path: ${repoPath}`);
   }
-  const normalized = path7.normalize(repoPath);
-  if (normalized === ".." || normalized.startsWith(`..${path7.sep}`)) {
+  const normalized = path8.normalize(repoPath);
+  if (normalized === ".." || normalized.startsWith(`..${path8.sep}`)) {
     throw new Error(`Refusing to use path outside the repository: ${repoPath}`);
   }
-  const root = path7.resolve(rootDir);
-  const fullPath = path7.resolve(root, normalized);
-  if (!fullPath.startsWith(`${root}${path7.sep}`)) {
+  const root = path8.resolve(rootDir);
+  const fullPath = path8.resolve(root, normalized);
+  if (!fullPath.startsWith(`${root}${path8.sep}`)) {
     throw new Error(`Refusing to use path outside the repository: ${repoPath}`);
   }
   return fullPath;
 }
 function isControlPlanePath(repoPath) {
-  const normalized = path7.normalize(repoPath);
-  return syncRoots.some((syncRoot) => normalized === syncRoot || normalized.startsWith(`${syncRoot}${path7.sep}`));
+  const normalized = path8.normalize(repoPath);
+  return syncRoots.some((syncRoot) => normalized === syncRoot || normalized.startsWith(`${syncRoot}${path8.sep}`));
 }
 function canonicalControlPlaneRepoPath(repoPath) {
   const normalized = repoPath.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
@@ -2761,11 +3085,11 @@ function canonicalControlPlaneRepoPath(repoPath) {
   return normalized;
 }
 function toRepoPath(rootDir, fullPath) {
-  return path7.relative(rootDir, fullPath).split(path7.sep).join("/");
+  return path8.relative(rootDir, fullPath).split(path8.sep).join("/");
 }
 function inferTitle(content, repoPath) {
   const heading = content.split("\n").find((line) => line.startsWith("# "))?.replace(/^#\s+/, "").trim();
-  return heading || path7.basename(repoPath, path7.extname(repoPath));
+  return heading || path8.basename(repoPath, path8.extname(repoPath));
 }
 function parseFrontmatterFromSyncedDocument(frontmatter) {
   return {
@@ -2786,9 +3110,9 @@ async function exists2(filePath) {
 }
 
 // src/tool-session-store.ts
-import { mkdir as mkdir7, readFile as readFile5, writeFile as writeFile7 } from "node:fs/promises";
-import os4 from "node:os";
-import path8 from "node:path";
+import { mkdir as mkdir8, readFile as readFile6, writeFile as writeFile8 } from "node:fs/promises";
+import os5 from "node:os";
+import path9 from "node:path";
 var LocalToolSessionStore = class {
   constructor(filePath = defaultSessionStorePath()) {
     this.filePath = filePath;
@@ -2802,12 +3126,12 @@ var LocalToolSessionStore = class {
   async setProviderSessionId(toolSessionId, toolName, providerSessionId) {
     const data = await this.read();
     data[toolSessionId] = { toolName, providerSessionId, updatedAt: (/* @__PURE__ */ new Date()).toISOString() };
-    await mkdir7(path8.dirname(this.filePath), { recursive: true });
-    await writeFile7(this.filePath, JSON.stringify(data, null, 2), "utf8");
+    await mkdir8(path9.dirname(this.filePath), { recursive: true });
+    await writeFile8(this.filePath, JSON.stringify(data, null, 2), "utf8");
   }
   async read() {
     try {
-      return JSON.parse(await readFile5(this.filePath, "utf8"));
+      return JSON.parse(await readFile6(this.filePath, "utf8"));
     } catch {
       return {};
     }
@@ -2815,12 +3139,12 @@ var LocalToolSessionStore = class {
 };
 function defaultSessionStorePath() {
   if (process.platform === "darwin") {
-    return path8.join(os4.homedir(), "Library", "Application Support", "Amistio", "tool-sessions.json");
+    return path9.join(os5.homedir(), "Library", "Application Support", "Amistio", "tool-sessions.json");
   }
   if (process.platform === "win32") {
-    return path8.join(process.env.APPDATA ?? os4.homedir(), "Amistio", "tool-sessions.json");
+    return path9.join(process.env.APPDATA ?? os5.homedir(), "Amistio", "tool-sessions.json");
   }
-  return path8.join(process.env.XDG_STATE_HOME ?? path8.join(os4.homedir(), ".local", "state"), "amistio", "tool-sessions.json");
+  return path9.join(process.env.XDG_STATE_HOME ?? path9.join(os5.homedir(), ".local", "state"), "amistio", "tool-sessions.json");
 }
 
 // src/work-runner.ts
@@ -3107,7 +3431,7 @@ function stripJsonFence(value) {
 }
 
 // src/runner-status.ts
-import { createHash as createHash3 } from "node:crypto";
+import { createHash as createHash4 } from "node:crypto";
 var watchStateReminderMs = 60 * 1e3;
 function formatWatchStartupContext(input) {
   return [
@@ -3128,17 +3452,136 @@ function watchStateKey(action) {
   return [action.kind, action.message, action.workItemId, action.documentId, action.runnerId].filter(Boolean).join(":");
 }
 function stableRunnerId(input) {
-  const digest = createHash3("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.machineId}`).digest("hex").slice(0, 20);
+  const digest = createHash4("sha256").update(`${input.accountId}:${input.projectId}:${input.repositoryLinkId}:${input.machineId}`).digest("hex").slice(0, 20);
   return `runner_${digest}`;
 }
 
+// src/runner-resources.ts
+import os6 from "node:os";
+var defaultRuntime = {
+  nowMs: () => Date.now(),
+  memoryUsage: () => process.memoryUsage(),
+  uptime: () => process.uptime(),
+  cpuUsage: () => process.cpuUsage(),
+  totalmem: () => os6.totalmem(),
+  freemem: () => os6.freemem(),
+  loadavg: () => os6.loadavg()
+};
+var previousRunnerResourceSample;
+function sampleCurrentRunnerResourceUsage() {
+  const sample = collectRunnerResourceUsage(previousRunnerResourceSample);
+  previousRunnerResourceSample = sample.state;
+  return sample.resourceUsage;
+}
+function collectRunnerResourceUsage(previous, runtime = defaultRuntime) {
+  const sampledAtMs = runtime.nowMs();
+  const memory = runtime.memoryUsage();
+  const cpu = runtime.cpuUsage();
+  const load = runtime.loadavg();
+  const totalMemory = runtime.totalmem();
+  const freeMemory = runtime.freemem();
+  const resourceUsage = {
+    sampledAt: new Date(sampledAtMs).toISOString(),
+    processUptimeSeconds: roundNumber(runtime.uptime(), 3),
+    processMemoryRssBytes: Math.round(memory.rss),
+    processMemoryHeapUsedBytes: Math.round(memory.heapUsed),
+    processMemoryHeapTotalBytes: Math.round(memory.heapTotal),
+    processCpuUserMicros: Math.round(cpu.user),
+    processCpuSystemMicros: Math.round(cpu.system),
+    systemMemoryTotalBytes: Math.round(totalMemory),
+    systemMemoryFreeBytes: Math.round(freeMemory)
+  };
+  const cpuPercent = processCpuPercent(previous, { sampledAtMs, processCpuUserMicros: cpu.user, processCpuSystemMicros: cpu.system });
+  if (cpuPercent !== void 0) {
+    resourceUsage.processCpuPercent = cpuPercent;
+  }
+  if (load.length >= 3) {
+    resourceUsage.systemLoadAverage1m = roundNumber(load[0], 2);
+    resourceUsage.systemLoadAverage5m = roundNumber(load[1], 2);
+    resourceUsage.systemLoadAverage15m = roundNumber(load[2], 2);
+  }
+  return {
+    resourceUsage,
+    state: {
+      sampledAtMs,
+      processCpuUserMicros: cpu.user,
+      processCpuSystemMicros: cpu.system
+    }
+  };
+}
+function formatRunnerResourceUsage(resourceUsage) {
+  if (!resourceUsage) {
+    return "unavailable until this runner reports a sample.";
+  }
+  const parts = [
+    resourceUsage.processMemoryRssBytes !== void 0 ? `RSS ${formatBytes(resourceUsage.processMemoryRssBytes)}` : void 0,
+    heapSummary(resourceUsage),
+    resourceUsage.processCpuPercent !== void 0 ? `CPU ${formatPercent(resourceUsage.processCpuPercent)}` : "CPU warming up",
+    systemMemorySummary(resourceUsage),
+    loadSummary(resourceUsage),
+    `sampled ${resourceUsage.sampledAt}`
+  ].filter(Boolean);
+  return parts.length ? parts.join("; ") : "unavailable until this runner reports a complete sample.";
+}
+function formatBytes(bytes) {
+  if (bytes === void 0 || !Number.isFinite(bytes)) {
+    return "unknown";
+  }
+  const units = ["B", "KiB", "MiB", "GiB", "TiB"];
+  let value = Math.max(0, bytes);
+  let unitIndex = 0;
+  while (value >= 1024 && unitIndex < units.length - 1) {
+    value /= 1024;
+    unitIndex += 1;
+  }
+  const digits = Number.isInteger(value) || value >= 10 || unitIndex === 0 ? 0 : 1;
+  return `${value.toFixed(digits)} ${units[unitIndex]}`;
+}
+function formatPercent(value) {
+  if (value === void 0 || !Number.isFinite(value)) {
+    return "unknown";
+  }
+  return `${roundNumber(value, 1).toFixed(1)}%`;
+}
+function processCpuPercent(previous, current) {
+  if (!previous) return void 0;
+  const elapsedMicros = (current.sampledAtMs - previous.sampledAtMs) * 1e3;
+  const cpuDeltaMicros = current.processCpuUserMicros + current.processCpuSystemMicros - previous.processCpuUserMicros - previous.processCpuSystemMicros;
+  if (elapsedMicros <= 0 || cpuDeltaMicros < 0) return void 0;
+  return roundNumber(cpuDeltaMicros / elapsedMicros * 100, 1);
+}
+function heapSummary(resourceUsage) {
+  if (resourceUsage.processMemoryHeapUsedBytes === void 0 && resourceUsage.processMemoryHeapTotalBytes === void 0) {
+    return void 0;
+  }
+  return `heap ${formatBytes(resourceUsage.processMemoryHeapUsedBytes)} / ${formatBytes(resourceUsage.processMemoryHeapTotalBytes)}`;
+}
+function systemMemorySummary(resourceUsage) {
+  if (resourceUsage.systemMemoryTotalBytes === void 0 || resourceUsage.systemMemoryFreeBytes === void 0 || resourceUsage.systemMemoryTotalBytes <= 0) {
+    return void 0;
+  }
+  const usedBytes = Math.max(0, resourceUsage.systemMemoryTotalBytes - resourceUsage.systemMemoryFreeBytes);
+  const usedPercent = usedBytes / resourceUsage.systemMemoryTotalBytes * 100;
+  return `system memory ${formatBytes(usedBytes)} / ${formatBytes(resourceUsage.systemMemoryTotalBytes)} used (${formatPercent(usedPercent)})`;
+}
+function loadSummary(resourceUsage) {
+  if (resourceUsage.systemLoadAverage1m === void 0 || resourceUsage.systemLoadAverage5m === void 0 || resourceUsage.systemLoadAverage15m === void 0) {
+    return void 0;
+  }
+  return `load ${resourceUsage.systemLoadAverage1m.toFixed(2)} / ${resourceUsage.systemLoadAverage5m.toFixed(2)} / ${resourceUsage.systemLoadAverage15m.toFixed(2)}`;
+}
+function roundNumber(value, digits) {
+  const factor = 10 ** digits;
+  return Math.round(value * factor) / factor;
+}
+
 // src/importer.ts
-import { execFile as execFile2 } from "node:child_process";
-import { createHash as createHash4 } from "node:crypto";
-import { readdir as readdir4, readFile as readFile6, stat as stat4 } from "node:fs/promises";
-import path9 from "node:path";
-import { promisify as promisify2 } from "node:util";
-var execFileAsync2 = promisify2(execFile2);
+import { execFile as execFile3 } from "node:child_process";
+import { createHash as createHash5 } from "node:crypto";
+import { readdir as readdir4, readFile as readFile7, stat as stat4 } from "node:fs/promises";
+import path10 from "node:path";
+import { promisify as promisify3 } from "node:util";
+var execFileAsync3 = promisify3(execFile3);
 var defaultMaxFileKb = 256;
 var controlPlaneRoots2 = ["architecture", "context", "decisions", "features", "memory", "plans", "prompts", "workflows"];
 var excludedDirectoryNames = /* @__PURE__ */ new Set([".git", "node_modules", ".pnpm-store", ".next", "dist", "build", "coverage", ".cache", "cache", "tmp", "temp", "vendor"]);
@@ -3155,12 +3598,12 @@ var documentFolderByType = {
   workflow: "docs/workflows"
 };
 async function inspectLocalRepository(rootDir, defaultBranch) {
-  const requestedRoot = path9.resolve(rootDir);
+  const requestedRoot = path10.resolve(rootDir);
   const root = await runGit2(["-C", requestedRoot, "rev-parse", "--show-toplevel"]).catch(() => requestedRoot);
   const detectedBranch = await runGit2(["-C", root, "symbolic-ref", "--quiet", "--short", "HEAD"]).catch(() => defaultBranch);
   const originUrl = await runGit2(["-C", root, "remote", "get-url", "origin"]).catch(() => void 0);
   const parsedCloneUrl = originUrl ? parseOptionalOriginCloneUrl(originUrl) : void 0;
-  const repoName = (parsedCloneUrl?.repoName ?? path9.basename(root)) || "repository";
+  const repoName = (parsedCloneUrl?.repoName ?? path10.basename(root)) || "repository";
   const fingerprintSeed = parsedCloneUrl ? `origin:${parsedCloneUrl.normalizedKey}` : `repo:${repoName}:${detectedBranch || defaultBranch}`;
   return {
     rootDir: root,
@@ -3172,7 +3615,7 @@ async function inspectLocalRepository(rootDir, defaultBranch) {
   };
 }
 async function scanLegacyDocuments(options) {
-  const rootDir = path9.resolve(options.rootDir);
+  const rootDir = path10.resolve(options.rootDir);
   const maxBytes = (options.maxFileKb ?? defaultMaxFileKb) * 1024;
   const skipped = [];
   const candidates = [];
@@ -3191,7 +3634,7 @@ async function scanLegacyDocuments(options) {
       skipped.push({ repoPath, reason: "excluded" });
       continue;
     }
-    const fullPath = path9.join(rootDir, ...repoPath.split("/"));
+    const fullPath = path10.join(rootDir, ...repoPath.split("/"));
     const fileStat = await stat4(fullPath).catch(() => void 0);
     if (!fileStat?.isFile()) {
       skipped.push({ repoPath, reason: "unreadable" });
@@ -3201,7 +3644,7 @@ async function scanLegacyDocuments(options) {
       skipped.push({ repoPath, reason: "tooLarge" });
       continue;
     }
-    const content = await readFile6(fullPath, "utf8").catch(() => void 0);
+    const content = await readFile7(fullPath, "utf8").catch(() => void 0);
     if (content === void 0) {
       skipped.push({ repoPath, reason: "unreadable" });
       continue;
@@ -3291,8 +3734,8 @@ async function listRepositoryPaths(rootDir) {
 async function walkRepository(rootDir, directory, files) {
   const entries = await readdir4(directory, { withFileTypes: true }).catch(() => []);
   for (const entry of entries) {
-    const fullPath = path9.join(directory, entry.name);
-    const repoPath = normalizeRepoPath3(path9.relative(rootDir, fullPath));
+    const fullPath = path10.join(directory, entry.name);
+    const repoPath = normalizeRepoPath3(path10.relative(rootDir, fullPath));
     if (entry.isDirectory()) {
       if (!excludedDirectoryNames.has(entry.name)) {
         await walkRepository(rootDir, fullPath, files);
@@ -3357,9 +3800,9 @@ function uniqueDestinationPath(basePath, sourcePath, usedPaths) {
     usedPaths.add(basePath);
     return basePath;
   }
-  const extension = path9.posix.extname(basePath) || ".md";
-  const directory = path9.posix.dirname(basePath);
-  const basename = path9.posix.basename(basePath, extension);
+  const extension = path10.posix.extname(basePath) || ".md";
+  const directory = path10.posix.dirname(basePath);
+  const basename = path10.posix.basename(basePath, extension);
   const uniquePath = `${directory}/${basename}-${hashText(sourcePath, 8)}${extension}`;
   usedPaths.add(uniquePath);
   return uniquePath;
@@ -3376,7 +3819,7 @@ function inferTitle2(content, repoPath) {
   const body = stripFrontmatter(content);
   const heading = body.split("\n").find((line) => /^#\s+/.test(line))?.replace(/^#\s+/, "").trim();
   if (heading) return heading;
-  const basename = path9.posix.basename(repoPath, path9.posix.extname(repoPath)).replace(/[-_]+/g, " ").trim();
+  const basename = path10.posix.basename(repoPath, path10.posix.extname(repoPath)).replace(/[-_]+/g, " ").trim();
   return titleCase(basename || "Imported Document");
 }
 function stripFrontmatter(content) {
@@ -3398,19 +3841,19 @@ function stableImportDocumentId(accountId, projectId, repositoryLinkId, sourcePa
   return `doc_import_${hashText(`${accountId}\0${projectId}\0${repositoryLinkId}\0${sourcePath}`, 24)}`;
 }
 function hashText(value, length) {
-  return createHash4("sha256").update(value).digest("hex").slice(0, length);
+  return createHash5("sha256").update(value).digest("hex").slice(0, length);
 }
 function normalizeRepoPath3(value) {
   return value.replace(/\\/g, "/").replace(/^\.\//, "").replace(/^\/+/, "");
 }
 async function runGit2(args) {
-  const { stdout } = await execFileAsync2("git", args, { maxBuffer: 10 * 1024 * 1024 });
+  const { stdout } = await execFileAsync3("git", args, { maxBuffer: 10 * 1024 * 1024 });
   return stdout.trim();
 }
 
 // src/runner-actions.ts
-import { spawn as spawn3 } from "node:child_process";
-import path10 from "node:path";
+import { spawn as spawn4 } from "node:child_process";
+import path11 from "node:path";
 function buildBackgroundRunnerArgs(options) {
   const args = [
     "run",
@@ -3420,7 +3863,7 @@ function buildBackgroundRunnerArgs(options) {
     "--runner-id",
     options.runnerId,
     "--root",
-    path10.resolve(options.root),
+    path11.resolve(options.root),
     "--session",
     options.session,
     "--interval-seconds",
@@ -3441,6 +3884,8 @@ function buildBackgroundRunnerArgs(options) {
   if (options.maxIterations !== void 0) {
     args.push("--max-iterations", String(options.maxIterations));
   }
+  args.push("--max-preflight-attempts", String(options.maxPreflightAttempts));
+  args.push("--tool-timeout-seconds", String(options.toolTimeoutSeconds));
   if (!options.stream) {
     args.push("--no-stream");
   }
@@ -3458,7 +3903,7 @@ async function runOfficialCliUpdate() {
 }
 function runOfficialUpdateProcess(command, args, timeoutMs) {
   return new Promise((resolve) => {
-    const child = spawn3(command, args, { stdio: ["ignore", "pipe", "pipe"] });
+    const child = spawn4(command, args, { stdio: ["ignore", "pipe", "pipe"] });
     let output = "";
     const updateTimeout = setTimeout(() => {
       output += "Timed out while running official CLI update.\n";
@@ -3486,11 +3931,11 @@ function truncateProcessOutput(value) {
 }
 
 // src/git-worktree.ts
-import { execFile as execFile3 } from "node:child_process";
-import { mkdir as mkdir8, stat as stat5 } from "node:fs/promises";
-import path11 from "node:path";
-import { promisify as promisify3 } from "node:util";
-var execFileAsync3 = promisify3(execFile3);
+import { execFile as execFile4 } from "node:child_process";
+import { mkdir as mkdir9, stat as stat5 } from "node:fs/promises";
+import path12 from "node:path";
+import { promisify as promisify4 } from "node:util";
+var execFileAsync4 = promisify4(execFile4);
 function needsGitWorktreeIsolation(workItem) {
   return (workItem.workKind ?? "implementation") === "implementation";
 }
@@ -3517,7 +3962,7 @@ async function prepareGitWorktreeIsolation(rootDir, workItem) {
     await assertExistingWorktree(worktreePath, identity.branch);
     return { ...identity, baseRevision, worktreePath };
   }
-  await mkdir8(path11.dirname(worktreePath), { recursive: true });
+  await mkdir9(path12.dirname(worktreePath), { recursive: true });
   const branchExists = await gitCommandSucceeds(repoRoot, ["show-ref", "--verify", "--quiet", `refs/heads/${identity.branch}`]);
   const worktreeArgs = branchExists ? ["worktree", "add", worktreePath, identity.branch] : ["worktree", "add", "-b", identity.branch, worktreePath, baseRevision];
   await gitOutput(repoRoot, worktreeArgs).catch((error) => {
@@ -3526,9 +3971,9 @@ async function prepareGitWorktreeIsolation(rootDir, workItem) {
   return { ...identity, baseRevision, worktreePath };
 }
 function localWorktreePath(repoRoot, worktreeKey) {
-  const repoName = path11.basename(repoRoot);
+  const repoName = path12.basename(repoRoot);
   const worktreeSlug = worktreeKey.split("/").filter(Boolean).pop() ?? "work";
-  return path11.join(path11.dirname(repoRoot), `${repoName}.worktrees`, worktreeSlug);
+  return path12.join(path12.dirname(repoRoot), `${repoName}.worktrees`, worktreeSlug);
 }
 async function assertExistingWorktree(worktreePath, branch) {
   await gitOutput(worktreePath, ["rev-parse", "--is-inside-work-tree"]);
@@ -3551,11 +3996,11 @@ async function assertBaseRevision(repoRoot, baseRevision, currentHead) {
   }
 }
 async function gitOutput(cwd, args) {
-  const { stdout } = await execFileAsync3("git", args, { cwd, maxBuffer: 1024 * 1024 });
+  const { stdout } = await execFileAsync4("git", args, { cwd, maxBuffer: 1024 * 1024 });
   return stdout.trim();
 }
 async function gitCommandSucceeds(cwd, args) {
-  return execFileAsync3("git", args, { cwd }).then(() => true, () => false);
+  return execFileAsync4("git", args, { cwd }).then(() => true, () => false);
 }
 async function pathExists(value) {
   return stat5(value).then(() => true, () => false);
@@ -3588,6 +4033,10 @@ var CLI_VERSION = readCliPackageVersion();
 var program = new Command();
 var defaultRoot = process.env.INIT_CWD ?? process.cwd();
 var apiUrlOptionDescription = `Amistio API URL override (or ${AMISTIO_API_URL_ENV})`;
+var DEFAULT_MAX_PREFLIGHT_ATTEMPTS = 3;
+var DEFAULT_TOOL_TIMEOUT_SECONDS = 30 * 60;
+var RUNNER_WORK_LEASE_SECONDS = 300;
+var RUNNER_WORK_LEASE_RENEWAL_MS = 12e4;
 program.name("amistio").description("Amistio project brain CLI").version(CLI_VERSION);
 program.command("init").description("Create Amistio control-plane folders for a new project").option("--root <path>", "Repository root", defaultRoot).action(async (options) => {
   const created = await initControlPlane(options.root);
@@ -3614,7 +4063,8 @@ program.command("bootstrap").description("Clone a linked repository locally, pre
     repositoryLinkId: options.repositoryLink,
     repoName: parsedRepoUrl.repoName,
     repoFingerprint: createRepoFingerprint(options.account, options.project, options.repositoryLink),
-    defaultBranch: options.defaultBranch
+    defaultBranch: options.defaultBranch,
+    machineId: runnerMachineId()
   });
   const filePath = await writeProjectLink(checkout.targetDir, {
     amistioAccountId: options.account,
@@ -3666,6 +4116,7 @@ program.command("import").description("Pair an existing checkout and import lega
     repoName: repository.repoName,
     repoFingerprint: repository.repoFingerprint,
     defaultBranch: repository.defaultBranch,
+    machineId: runnerMachineId(),
     ...parsedCloneUrl ? { cloneUrl: parsedCloneUrl.cloneUrl } : {},
     ...parsedCloneUrl?.provider ? { provider: parsedCloneUrl.provider } : {},
     ...parsedCloneUrl?.repoOwner ? { repoOwner: parsedCloneUrl.repoOwner } : {},
@@ -3698,6 +4149,7 @@ program.command("import").description("Pair an existing checkout and import lega
   console.log(`Next: amistio sync status${formatApiUrlFlag(options.apiUrl)}`);
 });
 program.command("pair").description("Pair this repository with an Amistio web project").requiredOption("--account <accountId>", "Amistio account ID").requiredOption("--project <projectId>", "Amistio project ID").option("--repository-link <repositoryLinkId>", "Existing repository link ID").option("--default-branch <branch>", "Default branch", "main").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--pairing-code <code>", "Short-lived pairing code from the Amistio app").option("--token <token>", "Runner/device credential to store outside the repository").option("--root <path>", "Repository root", defaultRoot).action(async (options, command) => {
+  const pairingRoot = await resolvePairingRoot(options.root, { explicitRoot: command.getOptionValueSource("root") === "cli" });
   let repositoryLinkId = options.repositoryLink ?? `repo_${randomUUID()}`;
   let credential = options.token;
   if (options.pairingCode) {
@@ -3709,15 +4161,16 @@ program.command("pair").description("Pair this repository with an Amistio web pr
       projectId: options.project,
       pairingCode: options.pairingCode,
       repositoryLinkId,
-      repoName: inferRepoName(options.root),
+      repoName: inferRepoName(pairingRoot),
       repoFingerprint: createRepoFingerprint(options.account, options.project, repositoryLinkId),
-      defaultBranch: options.defaultBranch
+      defaultBranch: options.defaultBranch,
+      machineId: runnerMachineId()
     });
     repositoryLinkId = pairing.repositoryLink.repositoryLinkId;
     credential = credential ?? pairing.token;
     console.log(`Pairing confirmed for ${pairing.repositoryLink.repoName}.`);
   }
-  const filePath = await writeProjectLink(options.root, {
+  const filePath = await writeProjectLink(pairingRoot, {
     amistioAccountId: options.account,
     amistioProjectId: options.project,
     repositoryLinkId,
@@ -3844,7 +4297,7 @@ work.command("prompt").description("Print or write an approved work prompt witho
   }
   const prompt = await createRunnerWorkPrompt(context.client, context.metadata.amistioProjectId, workItem);
   if (options.out) {
-    await writeFile8(options.out, prompt, "utf8");
+    await writeFile9(options.out, prompt, "utf8");
     console.log(`Wrote work prompt to ${options.out}.`);
   } else {
     console.log(prompt);
@@ -3892,7 +4345,7 @@ program.command("orchestrate").description("Update the Amistio control plane thr
     process.exitCode = result.exitCode;
   }
 });
-program.command("run").description("Claim and run approved Amistio work locally").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--runner-id <runnerId>", "Stable runner ID").option("--root <path>", "Repository root", defaultRoot).option("--tool <name>", "Local tool to use: auto, none, opencode, claude, codex, copilot, gemini, aider, cursor-agent").option("--invocation-channel <channel>", "Local invocation channel: auto, sdk, or command", parseInvocationChannel).option("--model <model>", "Model to request when the selected local tool supports model selection").option("--tool-command <command>", "Custom local command. Use {promptFile} and {root} placeholders when supported").option("--session <policy>", "Tool session policy: auto, new, continue:<toolSessionId>, or none", "auto").option("--dry-run", "Claim work and print the generated execution prompt without running a tool").option("--watch", "Keep polling for approved work until stopped").option("--background", "Start a detached background runner that watches for approved work").option("--interval-seconds <seconds>", "Polling interval for --watch", parsePositiveInteger, 10).option("--max-iterations <count>", "Stop watch mode after this many polling attempts", parsePositiveInteger).option("--no-stream", "Capture local tool output instead of streaming it").option("--verbose", "Print detailed runner errors while watching").action(async (options, command) => {
+program.command("run").description("Claim and run approved Amistio work locally").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--runner-id <runnerId>", "Stable runner ID").option("--root <path>", "Repository root", defaultRoot).option("--tool <name>", "Local tool to use: auto, none, opencode, claude, codex, copilot, gemini, aider, cursor-agent").option("--invocation-channel <channel>", "Local invocation channel: auto, sdk, or command", parseInvocationChannel).option("--model <model>", "Model to request when the selected local tool supports model selection").option("--tool-command <command>", "Custom local command. Use {promptFile} and {root} placeholders when supported").option("--session <policy>", "Tool session policy: auto, new, continue:<toolSessionId>, or none", "auto").option("--dry-run", "Claim work and print the generated execution prompt without running a tool").option("--watch", "Keep polling for approved work until stopped").option("--background", "Start a detached background runner that watches for approved work").option("--interval-seconds <seconds>", "Polling interval for --watch", parsePositiveInteger, 10).option("--max-iterations <count>", "Stop watch mode after this many polling attempts", parsePositiveInteger).option("--max-preflight-attempts <count>", "Fail setup/preflight failures after this many claimed attempts", parsePositiveInteger, DEFAULT_MAX_PREFLIGHT_ATTEMPTS).option("--tool-timeout-seconds <seconds>", "Fail local tool execution after this many seconds", parsePositiveInteger, DEFAULT_TOOL_TIMEOUT_SECONDS).option("--no-stream", "Capture local tool output instead of streaming it").option("--verbose", "Print detailed runner errors while watching").action(async (options, command) => {
   const context = await loadPairedApiContext(options.root, options.apiUrl);
   if (!context) {
     console.log("Repository is not paired. Run `amistio pair` first.");
@@ -3921,7 +4374,7 @@ program.command("run").description("Claim and run approved Amistio work locally"
       projectId: context.metadata.amistioProjectId,
       repositoryLinkId: context.metadata.repositoryLinkId,
       runnerId,
-      rootDir: path12.resolve(options.root),
+      rootDir: path13.resolve(options.root),
       apiUrl: options.apiUrl,
       args: buildBackgroundRunnerArgs(resolvedOptions)
     });
@@ -4006,6 +4459,7 @@ runner.command("status").description("Show background runner status for the pair
     console.log("No background runner metadata found for this paired repository.");
     if (runners.length) {
       console.log(`Last runner heartbeat: ${runners[0].runnerId} ${runners[0].status} at ${runners[0].lastSeenAt}.`);
+      console.log(`Resource usage: ${formatRunnerResourceUsage(runners[0].resourceUsage)}`);
     }
     return;
   }
@@ -4026,6 +4480,7 @@ runner.command("status").description("Show background runner status for the pair
     if (heartbeat) {
       console.log(`  Last heartbeat: ${heartbeat.status} at ${heartbeat.lastSeenAt}${heartbeat.version ? ` (${heartbeat.version})` : ""}`);
     }
+    console.log(`  Resource usage: ${formatRunnerResourceUsage(heartbeat?.resourceUsage)}`);
   }
 });
 runner.command("stop").description("Stop a background runner for the paired repository").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--root <path>", "Repository root", defaultRoot).option("--runner-id <runnerId>", "Runner ID to stop when multiple background runners exist").action(async (options) => {
@@ -4050,15 +4505,106 @@ runner.command("stop").description("Stop a background runner for the paired repo
     return;
   }
   const record = records[0];
+  const existingRunner = await context.client.listRunners(context.metadata.amistioProjectId).then((result) => result.runners.find((runner2) => runner2.runnerId === record.runnerId && runner2.repositoryLinkId === context.metadata.repositoryLinkId)).catch(() => void 0);
   const stopResult = await stopRunnerDaemonProcess(record);
   await markRunnerDaemonStopped(record);
   await context.client.sendRunnerHeartbeat(context.metadata.amistioProjectId, record.runnerId, context.metadata.repositoryLinkId, "offline", {
     version: CLI_VERSION,
     mode: "background",
-    hostname: record.hostname
+    hostname: record.hostname,
+    ...existingRunner?.resourceUsage ? { resourceUsage: existingRunner.resourceUsage } : {}
   }).catch(() => void 0);
   console.log(stopResult === "stopped" ? `Stopped background runner ${record.runnerId}.` : `Marked background runner ${record.runnerId} stopped; process was not running.`);
 });
+var runnerService = runner.command("service").description("Manage a user-level startup service for the paired runner");
+runnerService.command("install").description("Install a user-level startup service for this paired repository runner").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--root <path>", "Repository root", defaultRoot).option("--runner-id <runnerId>", "Stable runner ID").option("--tool <name>", "Local tool to use: auto, opencode, claude, codex, copilot, gemini, aider, cursor-agent").option("--invocation-channel <channel>", "Local invocation channel: auto, sdk, or command", parseInvocationChannel).option("--model <model>", "Model to request when the selected local tool supports model selection").option("--session <policy>", "Tool session policy: auto, new, continue:<toolSessionId>, or none", "auto").option("--interval-seconds <seconds>", "Polling interval for the service runner", parsePositiveInteger, 10).option("--max-preflight-attempts <count>", "Fail setup/preflight failures after this many claimed attempts", parsePositiveInteger, DEFAULT_MAX_PREFLIGHT_ATTEMPTS).option("--tool-timeout-seconds <seconds>", "Fail local tool execution after this many seconds", parsePositiveInteger, DEFAULT_TOOL_TIMEOUT_SECONDS).option("--no-stream", "Capture local tool output instead of streaming it").option("--verbose", "Print detailed runner errors").option("--dry-run", "Print the startup service descriptor without installing it").action(async (options) => {
+  const context = await loadPairedApiContext(options.root, options.apiUrl);
+  if (!context) {
+    console.log("Repository is not paired. Run `amistio pair` first.");
+    return;
+  }
+  if (!context.token) {
+    console.log("No local runner credential found. Run `amistio pair --pairing-code <code>` to store this machine credential.");
+    process.exitCode = 1;
+    return;
+  }
+  const platform = detectRunnerServicePlatform();
+  if (platform === "unsupported") {
+    console.log("Startup services are supported for user-level launchd on macOS and systemd user services on Linux.");
+    process.exitCode = 1;
+    return;
+  }
+  const runnerId = options.runnerId ?? stableRunnerId({
+    accountId: context.metadata.amistioAccountId,
+    projectId: context.metadata.amistioProjectId,
+    repositoryLinkId: context.metadata.repositoryLinkId,
+    machineId: runnerMachineId()
+  });
+  const args = buildBackgroundRunnerArgs({ ...options, runnerId, apiUrl: options.apiUrl, root: options.root });
+  const serviceInput = {
+    accountId: context.metadata.amistioAccountId,
+    projectId: context.metadata.amistioProjectId,
+    repositoryLinkId: context.metadata.repositoryLinkId,
+    runnerId,
+    rootDir: path13.resolve(options.root),
+    apiUrl: options.apiUrl,
+    args,
+    platform
+  };
+  if (options.dryRun) {
+    const descriptor = createRunnerServiceDescriptor(serviceInput);
+    console.log(`Startup service file: ${descriptor.metadata.serviceFilePath}`);
+    console.log(descriptor.content.trim());
+    return;
+  }
+  try {
+    const metadata = await installRunnerService(serviceInput);
+    console.log(`Installed startup service ${metadata.serviceName}.`);
+    console.log(`Service file: ${metadata.serviceFilePath}`);
+  } catch (error) {
+    console.error(errorMessage3(error));
+    process.exitCode = 1;
+  }
+});
+runnerService.command("status").description("Show the startup service status for this paired repository runner").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--root <path>", "Repository root", defaultRoot).option("--runner-id <runnerId>", "Stable runner ID").action(async (options) => {
+  const context = await loadPairedApiContext(options.root, options.apiUrl);
+  if (!context) {
+    console.log("Repository is not paired. Run `amistio pair` first.");
+    return;
+  }
+  const runnerId = options.runnerId ?? stableRunnerId({
+    accountId: context.metadata.amistioAccountId,
+    projectId: context.metadata.amistioProjectId,
+    repositoryLinkId: context.metadata.repositoryLinkId,
+    machineId: runnerMachineId()
+  });
+  const metadata = await readRunnerServiceMetadata({ accountId: context.metadata.amistioAccountId, projectId: context.metadata.amistioProjectId, repositoryLinkId: context.metadata.repositoryLinkId, runnerId });
+  if (!metadata) {
+    console.log("No startup service metadata found for this paired repository runner.");
+    return;
+  }
+  const runtimeStatus = await runnerServiceRuntimeStatus(metadata);
+  console.log(`Startup service ${metadata.serviceName}: ${runtimeStatus}`);
+  console.log(`  Platform: ${metadata.platform}`);
+  console.log(`  File: ${metadata.serviceFilePath}`);
+  console.log(`  Root: ${metadata.rootDir}`);
+  console.log(`  API: ${metadata.apiUrl}`);
+});
+runnerService.command("remove").description("Remove the startup service for this paired repository runner").option("--api-url <url>", apiUrlOptionDescription, defaultApiUrl()).option("--root <path>", "Repository root", defaultRoot).option("--runner-id <runnerId>", "Stable runner ID").action(async (options) => {
+  const context = await loadPairedApiContext(options.root, options.apiUrl);
+  if (!context) {
+    console.log("Repository is not paired. Run `amistio pair` first.");
+    return;
+  }
+  const runnerId = options.runnerId ?? stableRunnerId({
+    accountId: context.metadata.amistioAccountId,
+    projectId: context.metadata.amistioProjectId,
+    repositoryLinkId: context.metadata.repositoryLinkId,
+    machineId: runnerMachineId()
+  });
+  const removed = await removeRunnerService({ accountId: context.metadata.amistioAccountId, projectId: context.metadata.amistioProjectId, repositoryLinkId: context.metadata.repositoryLinkId, runnerId });
+  console.log(removed ? `Removed startup service ${removed.serviceName}.` : "No startup service metadata found for this paired repository runner.");
+});
 async function runWatchIteration({ command, context, options, runnerId }) {
   try {
     return await runNextWorkItem({
@@ -4084,6 +4630,8 @@ async function runWatchIteration({ command, context, options, runnerId }) {
         runnerId
       },
       suppressIdleOutput: Boolean(options.watch),
+      maxPreflightAttempts: options.maxPreflightAttempts,
+      toolTimeoutMs: options.toolTimeoutSeconds * 1e3,
       verbose: Boolean(options.verbose)
     });
   } catch (error) {
@@ -4098,7 +4646,7 @@ ${detail}`);
     } else {
       console.error(`${message} Run with --verbose for details.`);
     }
-    await Promise.allSettled([
+    const settlements = await Promise.allSettled([
       context.client.sendRunnerHeartbeat(context.metadata.amistioProjectId, runnerId, context.metadata.repositoryLinkId, "blocked", { ...runnerHeartbeatMetadata(), preferenceMessage: message }),
       context.client.recordRunnerLog(context.metadata.amistioProjectId, {
         runnerId,
@@ -4109,6 +4657,7 @@ ${detail}`);
         machineId: runnerMachineId()
       })
     ]);
+    logRejectedSettlements("record watch error", settlements);
     return { status: "failed", exitCode: 1, message };
   }
 }
@@ -4124,9 +4673,11 @@ async function runNextWorkItem({
   explicitModel,
   explicitInvocationChannel,
   explicitTool,
+  maxPreflightAttempts,
   toolCommand,
   commandContext,
   suppressIdleOutput,
+  toolTimeoutMs,
   verbose
 }) {
   const toolConfig = await resolveRunnerToolConfig({
@@ -4149,7 +4700,7 @@ async function runNextWorkItem({
     console.log(toolConfig.message);
     return { status: "blocked", exitCode: 1 };
   }
-  const result = await apiClient.claimWork(projectId, runnerId, repositoryLinkId, 300, runnerIsolationCapabilityMetadata());
+  const result = await apiClient.claimWork(projectId, runnerId, repositoryLinkId, RUNNER_WORK_LEASE_SECONDS, runnerIsolationCapabilityMetadata());
   if (!result.workItem) {
     const nextAction = await loadProjectNextAction(apiClient, projectId, repositoryLinkId, root);
     const message = formatProjectNextAction(nextAction);
@@ -4159,14 +4710,20 @@ async function runNextWorkItem({
     return { status: "idle", exitCode: 0, nextAction, message };
   }
   const prompt = await createRunnerWorkPrompt(apiClient, projectId, result.workItem);
+  await recordRunnerMilestone(apiClient, projectId, result.workItem, runnerId, repositoryLinkId, {
+    status: "running",
+    summary: "Prepared local runner execution prompt.",
+    idempotencyKey: `runner_milestone_prompt_${result.workItem.workItemId}_${result.workItem.attempt}`,
+    metadata: { workKind: result.workItem.workKind ?? "implementation", attempt: result.workItem.attempt }
+  });
   if (dryRun || toolConfig.tool === "none") {
     console.log(prompt);
     await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig));
     return { status: "preview", exitCode: 0 };
   }
-  const worktreeIsolation = await prepareWorktreeForClaimedItem({ apiClient, projectId, repositoryLinkId, root, runnerId, toolConfig, workItem: result.workItem });
-  if (worktreeIsolation.status === "blocked") {
-    return { status: "blocked", exitCode: 1, message: worktreeIsolation.message };
+  const worktreeIsolation = await prepareWorktreeForClaimedItem({ apiClient, maxPreflightAttempts, projectId, repositoryLinkId, root, runnerId, toolConfig, workItem: result.workItem });
+  if (worktreeIsolation.status !== "ready") {
+    return { status: worktreeIsolation.status === "failed" ? "failed" : "blocked", exitCode: 1, message: worktreeIsolation.message };
   }
   const executionRoot = worktreeIsolation.isolation?.worktreePath ?? root;
   const isolationTelemetry = workItemIsolationTelemetry(result.workItem, worktreeIsolation.isolation);
@@ -4203,6 +4760,7 @@ async function runNextWorkItem({
   const providerSessionStore = new LocalToolSessionStore();
   const providerSessionId = sessionContext.toolSession ? await providerSessionStore.getProviderSessionId(sessionContext.toolSession.toolSessionId, preview.toolName) : void 0;
   let toolResult;
+  const stopLeaseRenewal = startWorkLeaseRenewal({ apiClient, projectId, repositoryLinkId, runnerId, toolConfig, workItem: result.workItem, telemetry: isolationTelemetry });
   try {
     toolResult = await runLocalTool({
       rootDir: executionRoot,
@@ -4212,6 +4770,7 @@ async function runNextWorkItem({
       ...toolCommand ? { toolCommand } : {},
       ...toolConfig.model ? { model: toolConfig.model } : {},
       streamOutput: stream,
+      timeoutMs: toolTimeoutMs,
       ...sessionContext.toolSession ? {
         session: {
           toolSessionId: sessionContext.toolSession.toolSessionId,
@@ -4222,10 +4781,11 @@ async function runNextWorkItem({
       } : {}
     });
   } catch (error) {
+    stopLeaseRenewal();
     const detail = truncateLogExcerpt(errorDetail(error));
     const durationMs2 = Date.now() - startedAt;
     const message = `${preview.toolName} failed before returning a result.`;
-    await Promise.allSettled([
+    const settlements = await Promise.allSettled([
       apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig)),
       markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage3(error)),
       apiClient.updateWorkStatus(projectId, result.workItem.workItemId, "failed", `run_failed_${result.workItem.workItemId}_${result.workItem.attempt}_${runnerId}`, runnerId, {
@@ -4247,11 +4807,13 @@ async function runNextWorkItem({
         metadata: { tool: preview.toolName, error: detail }
       })
     ]);
+    logRejectedSettlements("record local tool failure", settlements);
     if (verbose || !stream) {
       console.error(detail);
     }
     return { status: "failed", exitCode: 1, message };
   }
+  stopLeaseRenewal();
   if (sessionContext.toolSession && toolResult.providerSessionId) {
     await providerSessionStore.setProviderSessionId(sessionContext.toolSession.toolSessionId, preview.toolName, toolResult.providerSessionId);
   }
@@ -4262,47 +4824,59 @@ async function runNextWorkItem({
     console.error(toolResult.stderr.trim());
   }
   if (result.workItem.workKind === "brainGeneration" || result.workItem.workKind === "planRevision") {
-    return finalizeBrainGenerationWork({
-      apiClient,
-      durationMs: Date.now() - startedAt,
-      projectId,
-      repositoryLinkId,
-      runnerId,
-      sessionContext,
-      toolConfig,
-      toolName: preview.toolName,
-      toolResult,
-      workItem: result.workItem
-    });
+    try {
+      return await finalizeBrainGenerationWork({
+        apiClient,
+        durationMs: Date.now() - startedAt,
+        projectId,
+        repositoryLinkId,
+        runnerId,
+        sessionContext,
+        toolConfig,
+        toolName: preview.toolName,
+        toolResult,
+        workItem: result.workItem
+      });
+    } catch (error) {
+      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    }
   }
   if (result.workItem.workKind === "assistantQuestion") {
-    return finalizeAssistantQuestionWork({
-      apiClient,
-      durationMs: Date.now() - startedAt,
-      projectId,
-      repositoryLinkId,
-      runnerId,
-      sessionContext,
-      toolConfig,
-      toolName: preview.toolName,
-      toolResult,
-      workItem: result.workItem
-    });
+    try {
+      return await finalizeAssistantQuestionWork({
+        apiClient,
+        durationMs: Date.now() - startedAt,
+        projectId,
+        repositoryLinkId,
+        runnerId,
+        sessionContext,
+        toolConfig,
+        toolName: preview.toolName,
+        toolResult,
+        workItem: result.workItem
+      });
+    } catch (error) {
+      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    }
   }
   if (result.workItem.workKind === "impactPreview") {
-    return finalizeImpactPreviewWork({
-      apiClient,
-      durationMs: Date.now() - startedAt,
-      projectId,
-      repositoryLinkId,
-      root,
-      runnerId,
-      sessionContext,
-      toolConfig,
-      toolName: preview.toolName,
-      toolResult,
-      workItem: result.workItem
-    });
+    try {
+      return await finalizeImpactPreviewWork({
+        apiClient,
+        durationMs: Date.now() - startedAt,
+        projectId,
+        repositoryLinkId,
+        root,
+        runnerId,
+        sessionContext,
+        toolConfig,
+        toolName: preview.toolName,
+        toolResult,
+        workItem: result.workItem
+      });
+    } catch (error) {
+      return recordFinalizationFailure({ apiClient, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName: preview.toolName, workItem: result.workItem, durationMs: Date.now() - startedAt });
+    }
   }
   const finalStatus = toolResult.exitCode === 0 ? "completed" : "failed";
   const durationMs = Date.now() - startedAt;
@@ -4354,11 +4928,17 @@ async function runNextWorkItem({
   console.log(`Marked ${statusResult.workItem.workItemId} ${statusResult.workItem.status} after ${durationSeconds}s.`);
   return { status: finalStatus, exitCode: toolResult.exitCode };
 }
-async function prepareWorktreeForClaimedItem({ apiClient, projectId, repositoryLinkId, root, runnerId, toolConfig, workItem }) {
+async function prepareWorktreeForClaimedItem({ apiClient, maxPreflightAttempts, projectId, repositoryLinkId, root, runnerId, toolConfig, workItem }) {
   if (!needsGitWorktreeIsolation(workItem)) {
     return { status: "ready" };
   }
   const identity = resolveWorktreeIdentity(workItem);
+  await recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
+    status: "running",
+    summary: `Checking Git worktree isolation for attempt ${workItem.attempt}/${maxPreflightAttempts}.`,
+    idempotencyKey: `runner_milestone_worktree_preflight_${workItem.workItemId}_${workItem.attempt}`,
+    metadata: { executionWorktreeKey: identity.worktreeKey, executionBranch: identity.branch, implementationScopeId: identity.implementationScopeId, attempt: workItem.attempt, maxAttempts: maxPreflightAttempts }
+  });
   try {
     const isolation = await prepareGitWorktreeIsolation(root, workItem);
     await recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
@@ -4371,29 +4951,111 @@ async function prepareWorktreeForClaimedItem({ apiClient, projectId, repositoryL
   } catch (error) {
     const message = errorMessage3(error);
     const telemetry = workItemIsolationTelemetry(workItem, { ...identity, baseRevision: workItem.baseRevision ?? "unknown", worktreePath: "" });
-    const statusResult = await apiClient.updateWorkStatus(projectId, workItem.workItemId, "blocked", `worktree_${workItem.workItemId}_${randomUUID()}`, runnerId, {
+    const finalAttempt = workItem.attempt >= maxPreflightAttempts;
+    const statusMessage = finalAttempt ? `Git worktree preflight failed after ${workItem.attempt}/${maxPreflightAttempts} attempts. ${message}` : `Git worktree preflight attempt ${workItem.attempt}/${maxPreflightAttempts} failed. Requeueing for retry. ${message}`;
+    const statusResult = await apiClient.updateWorkStatus(projectId, workItem.workItemId, finalAttempt ? "failed" : "approved", `worktree_${finalAttempt ? "failed" : "retry"}_${workItem.workItemId}_${workItem.attempt}_${randomUUID()}`, runnerId, {
       ...telemetry,
-      message,
-      blockerReason: message,
+      message: statusMessage,
+      ...finalAttempt ? { blockerReason: message } : { releaseClaim: true },
       error: message
     });
     await recordRunnerMilestone(apiClient, projectId, statusResult.workItem, runnerId, repositoryLinkId, {
-      status: "blocked",
-      summary: message,
-      idempotencyKey: `runner_milestone_worktree_blocked_${workItem.workItemId}_${statusResult.workItem.idempotencyKey}`,
-      metadata: { executionWorktreeKey: telemetry.executionWorktreeKey ?? "", executionBranch: telemetry.executionBranch ?? "", implementationScopeId: telemetry.implementationScopeId ?? "" }
+      status: finalAttempt ? "failed" : "warning",
+      summary: statusMessage,
+      idempotencyKey: `runner_milestone_worktree_${finalAttempt ? "failed" : "retry"}_${workItem.workItemId}_${statusResult.workItem.idempotencyKey}`,
+      metadata: { executionWorktreeKey: telemetry.executionWorktreeKey ?? "", executionBranch: telemetry.executionBranch ?? "", implementationScopeId: telemetry.implementationScopeId ?? "", attempt: workItem.attempt, maxAttempts: maxPreflightAttempts, error: message }
     });
-    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "blocked", {
+    await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", {
       ...runnerHeartbeatMetadata(toolConfig),
-      currentWorkItemId: workItem.workItemId,
-      ...telemetry.implementationScopeId ? { currentImplementationScopeId: telemetry.implementationScopeId } : {},
-      ...telemetry.executionWorktreeKey ? { currentWorktreeKey: telemetry.executionWorktreeKey } : {},
-      ...telemetry.executionBranch ? { currentBranch: telemetry.executionBranch } : {}
+      preferenceMessage: statusMessage
     });
-    console.error(message);
-    return { status: "blocked", message };
+    console.error(statusMessage);
+    return { status: finalAttempt ? "failed" : "retrying", message: statusMessage };
   }
 }
+function startWorkLeaseRenewal({ apiClient, projectId, repositoryLinkId, runnerId, toolConfig, workItem, telemetry }) {
+  let stopped = false;
+  const renew = async () => {
+    if (stopped) return;
+    const leaseExpiresAt = new Date(Date.now() + RUNNER_WORK_LEASE_SECONDS * 1e3).toISOString();
+    try {
+      await apiClient.updateWorkStatus(projectId, workItem.workItemId, "running", `lease_renewal_${workItem.workItemId}_${workItem.attempt}_${Date.now()}`, runnerId, {
+        ...telemetry,
+        leaseExpiresAt
+      });
+      await apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "running", {
+        ...runnerHeartbeatMetadata(toolConfig),
+        currentWorkItemId: workItem.workItemId,
+        ...telemetry.implementationScopeId ? { currentImplementationScopeId: telemetry.implementationScopeId } : {},
+        ...telemetry.executionWorktreeKey ? { currentWorktreeKey: telemetry.executionWorktreeKey } : {},
+        ...telemetry.executionBranch ? { currentBranch: telemetry.executionBranch } : {}
+      });
+    } catch (error) {
+      const detail = truncateLogExcerpt(errorDetail(error));
+      console.error(`Could not renew Amistio work lease for ${workItem.workItemId}: ${detail}`);
+      await apiClient.recordRunnerLog(projectId, {
+        runnerId,
+        repositoryLinkId,
+        status: "failed",
+        workItemId: workItem.workItemId,
+        workTitle: workItem.title,
+        ...workItem.workKind ? { workKind: workItem.workKind } : {},
+        message: "Runner could not renew the active work lease.",
+        error: detail,
+        machineId: runnerMachineId()
+      }).catch(() => void 0);
+    }
+  };
+  const timer = setInterval(() => {
+    void renew();
+  }, RUNNER_WORK_LEASE_RENEWAL_MS);
+  timer.unref?.();
+  return () => {
+    stopped = true;
+    clearInterval(timer);
+  };
+}
+async function recordFinalizationFailure({ apiClient, durationMs, error, isolationTelemetry, projectId, repositoryLinkId, runnerId, sessionContext, toolConfig, toolName, workItem }) {
+  const detail = truncateLogExcerpt(errorDetail(error));
+  const message = `${toolName} completed, but Amistio could not finalize the result.`;
+  const settlements = await Promise.allSettled([
+    apiClient.sendRunnerHeartbeat(projectId, runnerId, repositoryLinkId, "online", runnerHeartbeatMetadata(toolConfig)),
+    markToolSessionBlocked(apiClient, projectId, sessionContext.toolSession, errorMessage3(error)),
+    apiClient.updateWorkStatus(projectId, workItem.workItemId, "failed", `finalize_failed_${workItem.workItemId}_${workItem.attempt}_${randomUUID()}`, runnerId, {
+      ...isolationTelemetry,
+      tool: toolName,
+      durationMs,
+      message,
+      error: detail,
+      ...sessionContext.toolSession ? { toolSessionId: sessionContext.toolSession.toolSessionId } : {},
+      sessionPolicy: sessionContext.policy,
+      sessionDecision: sessionContext.decision,
+      sessionDecisionReason: sessionContext.reason
+    }),
+    apiClient.recordRunnerLog(projectId, {
+      runnerId,
+      repositoryLinkId,
+      status: "failed",
+      workItemId: workItem.workItemId,
+      workTitle: workItem.title,
+      ...workItem.workKind ? { workKind: workItem.workKind } : {},
+      tool: toolName,
+      durationMs,
+      message,
+      error: detail,
+      machineId: runnerMachineId()
+    }),
+    recordRunnerMilestone(apiClient, projectId, workItem, runnerId, repositoryLinkId, {
+      status: "failed",
+      summary: message,
+      idempotencyKey: `runner_milestone_finalization_failed_${workItem.workItemId}_${workItem.attempt}`,
+      metadata: { tool: toolName, durationMs, error: detail }
+    })
+  ]);
+  logRejectedSettlements("record finalization failure", settlements);
+  console.error(detail);
+  return { status: "failed", exitCode: 1, message };
+}
 function workItemIsolationTelemetry(workItem, isolation) {
   const implementationScopeId = isolation?.implementationScopeId ?? workItem.implementationScopeId;
   const executionBranch = isolation?.branch ?? workItem.executionBranch;
@@ -4422,6 +5084,13 @@ async function recordRunnerMilestone(apiClient, projectId, workItem, runnerId, r
     ...input
   }).catch(() => void 0);
 }
+function logRejectedSettlements(action, settlements) {
+  for (const settlement of settlements) {
+    if (settlement.status === "rejected") {
+      console.error(`${action} failed: ${errorMessage3(settlement.reason)}`);
+    }
+  }
+}
 async function runPendingRunnerCommand(apiClient, context, heartbeatMetadata) {
   const { commands } = await apiClient.listRunnerCommands(context.projectId, context.runnerId, context.repositoryLinkId).catch(() => ({ commands: [] }));
   const command = commands.filter((item) => item.status === "pending" || item.status === "acknowledged" || item.status === "running").sort((first, second) => Date.parse(first.createdAt) - Date.parse(second.createdAt))[0];
@@ -4988,10 +5657,10 @@ function parseInvocationChannel(value) {
   throw new Error(`Expected invocation channel auto, sdk, or command; received ${value}.`);
 }
 function inferRepoName(root) {
-  return path12.basename(path12.resolve(root)) || "repository";
+  return path13.basename(path13.resolve(root)) || "repository";
 }
 function createRepoFingerprint(accountId, projectId, repositoryLinkId) {
-  return createHash5("sha256").update(`${accountId}:${projectId}:${repositoryLinkId}`).digest("hex");
+  return createHash6("sha256").update(`${accountId}:${projectId}:${repositoryLinkId}`).digest("hex");
 }
 function defaultApiUrl() {
   const envApiUrl = process.env[AMISTIO_API_URL_ENV]?.trim();
@@ -5121,8 +5790,9 @@ function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode()) {
   return {
     version: CLI_VERSION,
     mode,
-    hostname: os5.hostname(),
+    hostname: os7.hostname(),
     ...runnerIsolationCapabilityMetadata(),
+    resourceUsage: sampleCurrentRunnerResourceUsage(),
     ...toolConfig?.capabilities ? { capabilities: toolConfig.capabilities } : {},
     ...toolConfig?.requestedTool ? { requestedTool: toolConfig.requestedTool } : {},
     ...toolConfig?.requestedInvocationChannel ? { requestedInvocationChannel: toolConfig.requestedInvocationChannel } : {},
@@ -5135,7 +5805,7 @@ function runnerHeartbeatMetadata(toolConfig, mode = currentRunnerMode()) {
   };
 }
 function runnerMachineId() {
-  return createHash5("sha256").update(`${os5.hostname()}:${os5.platform()}:${os5.arch()}`).digest("hex").slice(0, 20);
+  return createHash6("sha256").update(`${os7.hostname()}:${os7.platform()}:${os7.arch()}`).digest("hex").slice(0, 20);
 }
 async function delay(milliseconds) {
   await new Promise((resolve) => setTimeout(resolve, milliseconds));