@cat-factory/executor-harness 1.94.0 → 1.98.0

package/dist/agent-runner.js

@@ -5,9 +5,12 @@ import { dirname, join } from 'node:path';
 import { claudeAssistantContent, isObject, numberOf, redactBody } from './claude-stream.js';
 import { createClaudeRunTelemetry, subagentDispatchId } from './claude-call-aggregator.js';
 import { ToolCallTracker, recordClaudeToolResults, } from './tool-trajectory.js';
+import { log } from './logger.js';
+import { NO_TOOL_WINDOW } from './tool-silence.js';
 import { createCallMetricPublisher, publishCallMetric, } from './pi.js';
-import { claudeAllowedToolPatterns, codexMcpConfigToml, mcpServerSecretValues, writeClaudeMcpConfig, } from './agent-capabilities.js';
+import { claudeAllowedToolPatterns, codexMcpConfigToml, mcpServerSecretValues, observeClaudeMcpInit, writeClaudeMcpConfig, } from './agent-capabilities.js';
 import { ProgressGuard } from './progress-guard.js';
+import { BoundedTail, JsonlLineReader } from './jsonl-stream.js';
 import { killChildProcess, spawnDetached } from './process.js';
 import { describeProcessExit } from './process-exit.js';
 import { redact, registerKnownSecrets, secretsToRedact } from './redact.js';
@@ -59,9 +62,10 @@ function streamCli(cli, prompt, opts, env, secrets, onEvent) {
         });
         child.stdin.on('error', () => { });
         child.stdin.end(prompt);
-        let stderr = '';
+        // 8 KB is well over the 700 B tail anyone quotes below, and the CLI's stderr is diagnostic
+        // noise rather than a product, so a bounded tail is all this ever needed to be.
+        const stderr = new BoundedTail(8_000);
         let aborted = false;
-        let lineBuffer = '';
         const killChild = () => killChildProcess(child);
         // `final` marks the at-close flush of a trailing unterminated line: the CLI has already
         // exited, so an observer must not act on that record in a way that KILLS the run (mirrors
@@ -85,16 +89,9 @@ function streamCli(cli, prompt, opts, env, secrets, onEvent) {
                 // A faulty observer must never break the run.
             }
         };
-        const consumeStdout = (text) => {
-            lineBuffer += text;
-            let nl = lineBuffer.indexOf('\n');
-            while (nl !== -1) {
-                const line = lineBuffer.slice(0, nl).trim();
-                lineBuffer = lineBuffer.slice(nl + 1);
-                nl = lineBuffer.indexOf('\n');
-                processLine(line);
-            }
-        };
+        // Bounded framing, shared with `runPi`: an unterminated record must not be able to grow
+        // until parsing it stalls the loop the watchdogs and poll handlers run on (audit F6).
+        const reader = new JsonlLineReader(processLine);
         const onAbort = () => {
             aborted = true;
             killChild();
@@ -102,13 +99,11 @@ function streamCli(cli, prompt, opts, env, secrets, onEvent) {
         opts.signal?.addEventListener('abort', onAbort, { once: true });
         child.stdout.on('data', (chunk) => {
             opts.onActivity?.();
-            consumeStdout(chunk.toString());
+            reader.push(chunk.toString());
         });
         child.stderr.on('data', (chunk) => {
             opts.onActivity?.();
-            stderr += chunk.toString();
-            if (stderr.length > 8_000)
-                stderr = stderr.slice(-8_000);
+            stderr.push(chunk.toString());
         });
         child.on('error', (err) => {
             opts.signal?.removeEventListener('abort', onAbort);
@@ -116,9 +111,20 @@ function streamCli(cli, prompt, opts, env, secrets, onEvent) {
         });
         child.on('close', (code, signal) => {
             opts.signal?.removeEventListener('abort', onAbort);
-            const stderrTail = redact(stderr, secrets).slice(-700);
-            if (lineBuffer.trim())
-                processLine(lineBuffer.trim(), true);
+            const stderrTail = redact(stderr.toString(), secrets).slice(-700);
+            reader.flush();
+            // Surface an oversized record the reader refused to buffer ONCE (a count, not per line),
+            // for the same reason `runPi` does: a dropped record costs this run its progress, its
+            // trajectory and its per-call telemetry for that turn, and a silent loss reads exactly
+            // like a CLI that never emitted it. Falls back to the module logger so the report cannot
+            // depend on a caller having wired a per-job one.
+            if (reader.droppedLines > 0) {
+                ;
+                (opts.log ?? log).warn('agent CLI: skipped oversized JSONL records', {
+                    command,
+                    oversizedLines: reader.droppedLines,
+                });
+            }
             if (aborted) {
                 // Carry the tail on the rejection so a caller that REPLACES this generic message with a
                 // more specific cause (the no-progress guard's diagnostic) can still append it — the
@@ -327,6 +333,60 @@ async function setUpClaudeMcp(servers, configHome) {
         cleanup,
     };
 }
+/**
+ * The LIVE publishers of a claude-code run: everything the stream has revealed so far that the
+ * backend should see before the run ends, rather than only in its terminal result.
+ *
+ * They are grouped because they share one rule and differ on everything else. The rule: each
+ * publishes a WHOLE current value (never a delta), so a dropped poll response costs nothing and
+ * the caller may fire them as often as it likes. What differs is what is at stake — progress is a
+ * disposable count the UI renders, while the slice reviews carry the slices' actual review WORK
+ * and are the only thing a resume of a wedged review can be rebuilt from, which is why they are
+ * published on the turn a slice lands rather than on the next progress tick.
+ *
+ * `lastTodo` is a GETTER because the event handler assigns it as the stream goes; taking the value
+ * would freeze the plan at construction time.
+ *
+ * Split out of {@link runClaudeCode} for the per-function line budget.
+ */
+function createClaudeLivePublishers(deps) {
+    const { opts, planTracker, sliceTracker } = deps;
+    return {
+        emitProgress: () => {
+            if (!opts.onProgress)
+                return;
+            const progress = mergeProgress(pickProgress(deps.lastTodo(), planTracker.progress()), sliceTracker.progress());
+            if (progress)
+                opts.onProgress(progress);
+        },
+        emitSliceReviews: () => {
+            if (!opts.onSliceReviews)
+                return;
+            const reviews = sliceTracker.sliceReviews();
+            if (reviews.length > 0)
+                opts.onSliceReviews(reviews);
+        },
+    };
+}
+/**
+ * Publish the CLI's own startup report about the tool servers it loaded — the OBSERVED half of the
+ * run's tool-server record.
+ *
+ * Handed every event because it is the one thing `runClaudeCode` reads that is neither a turn nor
+ * a result: it arrives once, ahead of the first model call, and says whether the servers the
+ * backend wired actually came up. {@link observeClaudeMcpInit} answers `undefined` for every other
+ * event and for a run that wired none, so a server-less run reports nothing and the caller's
+ * record stays honestly absent rather than empty.
+ *
+ * Split out of {@link runClaudeCode} for the per-function line budget.
+ */
+function reportToolServerStartup(event, onToolServers) {
+    if (!onToolServers)
+        return;
+    const observed = observeClaudeMcpInit(event);
+    if (observed)
+        onToolServers(observed);
+}
 /**
  * No-progress guard on the CLI's own tool stream — the claude-code analogue of runPi's guard,
  * which cannot see the CLI's internal turns. The caller remembers each `tool_use` id's name off
@@ -394,6 +454,23 @@ function createClaudeToolTrajectory(opts, secrets) {
         onToolResults: (content) => recordClaudeToolResults(tracker, content, (call) => onSpan({ ...call, bodies: 'stored' })),
     };
 }
+/**
+ * Open this run's tool-silence window, or the inert one when the caller wired no watchdog. One
+ * definition so both runners resolve "is there a watchdog?" identically, and so neither carries
+ * the optional-call noise at the point where it should simply have a window.
+ */
+function openToolWindow(opts) {
+    return opts.beginToolWindow ? opts.beginToolWindow() : NO_TOOL_WINDOW;
+}
+/**
+ * Whether a claude-code `user` turn carries a `tool_result` block, i.e. whether a tool call just
+ * COMPLETED — the progress the tool-silence watchdog measures. Tested explicitly rather than
+ * taken from "the model sent a user turn", which a plain follow-up prompt also is: a watchdog
+ * reset handed out for work that did nothing is the same as no watchdog.
+ */
+function carriesToolResult(content) {
+    return content.some((block) => isObject(block) && block.type === 'tool_result');
+}
 export async function runClaudeCode(opts) {
     const stats = { toolCalls: 0, assistantChars: 0 };
     let summary = '';
@@ -455,24 +532,12 @@ export async function runClaudeCode(opts) {
     const sliceTracker = createSliceTracker(secrets);
     const planTracker = createTaskPlanTracker();
     let lastTodo;
-    const emitProgress = () => {
-        if (!opts.onProgress)
-            return;
-        const progress = mergeProgress(pickProgress(lastTodo, planTracker.progress()), sliceTracker.progress());
-        if (progress)
-            opts.onProgress(progress);
-    };
-    // Publish the per-slice reviews the tracker has captured. Separate from `emitProgress` because
-    // the two answer different questions and have different lifetimes: progress is a disposable
-    // count the UI renders, while these carry the slices' actual review WORK and are persisted so a
-    // run that dies before its aggregation can be resumed from them.
-    const emitSliceReviews = () => {
-        if (!opts.onSliceReviews)
-            return;
-        const reviews = sliceTracker.sliceReviews();
-        if (reviews.length > 0)
-            opts.onSliceReviews(reviews);
-    };
+    const { emitProgress, emitSliceReviews } = createClaudeLivePublishers({
+        opts,
+        planTracker,
+        sliceTracker,
+        lastTodo: () => lastTodo,
+    });
     // No-progress guard on the CLI's own tool stream — the claude-code analogue of runPi's guard,
     // absent on this path until now. Claude Code reports a tool CALL (its name) on the `assistant`
     // turn and that call's RESULT (`is_error`) on the following `user` turn, so correlate them by
@@ -482,8 +547,12 @@ export async function runClaudeCode(opts) {
     const progressGuard = createClaudeProgressGuard(opts);
     const { rememberTool, feedGuard, guardAbort } = progressGuard;
     const trajectory = createClaudeToolTrajectory(opts, secrets);
+    // This stream's tool-silence window; opened just before the CLI starts and closed in the
+    // `finally` below, so it can only ever be armed while the CLI it watches is running.
+    let toolWindow = NO_TOOL_WINDOW;
     const onEvent = (event, meta) => {
         const type = event.type;
+        reportToolServerStartup(event, opts.onToolServers);
         // A subagent's turns ride the parent's stdout tagged with the dispatch that spawned them;
         // `telemetry` routes them off the parent's chain (and decides who bills them). Progress, slice
         // tracking, the guard and `stats` below deliberately see EVERY event: a subagent grinding on
@@ -520,6 +589,8 @@ export async function runClaudeCode(opts) {
             // tool_result blocks the harness fed back to the model — part of the next prompt.
             const content = event.message.content;
             if (Array.isArray(content)) {
+                if (carriesToolResult(content))
+                    toolWindow.toolCompleted();
                 sliceTracker.onUser(content);
                 planTracker.onUser(content);
                 emitProgress();
@@ -567,6 +638,9 @@ export async function runClaudeCode(opts) {
     const runSignal = opts.signal
         ? AbortSignal.any([opts.signal, guardAbort.signal])
         : guardAbort.signal;
+    // Opened around the CLI itself, not around this function: everything above is per-run setup
+    // (the config home, the skills, the MCP config) which completes no tool calls by nature.
+    toolWindow = openToolWindow(opts);
     try {
         const { stderrTail } = await streamCli({
             command: 'claude',
@@ -630,6 +704,7 @@ export async function runClaudeCode(opts) {
         throw withAgentReport(err, terminalReport, secrets);
     }
     finally {
+        toolWindow.close();
         await subagents?.stop();
         await home.dispose();
     }
@@ -782,6 +857,27 @@ function claudeUsage(raw) {
 // ---------------------------------------------------------------------------
 // Codex
 // ---------------------------------------------------------------------------
+/**
+ * The assistant text a codex event carries, or `''`. Two shapes because the CLI changed its
+ * stream between versions and the harness serves both: the flat `agent_message*` events and the
+ * newer `item.completed` envelope around a message item.
+ */
+function codexAssistantText(event, type) {
+    const isMessage = type.includes('agent_message') || (type === 'item.completed' && isCodexMessageItem(event));
+    return (isMessage ? extractText(event) : '') ?? '';
+}
+/**
+ * Whether a codex event reports tool activity — a substring test because the CLI names these
+ * events differently across versions (`exec_command_end`, `item.*` around a command execution,
+ * `tool_*`) and the harness cares only that SOMETHING ran.
+ *
+ * This is also the tool-silence watchdog's only signal on this stream. Codex exposes no
+ * structured tool bodies, so `runCodex` produces no `ToolSpan` at all, and a window keyed on the
+ * trajectory would have force-failed every codex pass that outran it while the run was working.
+ */
+function isCodexToolActivity(type) {
+    return type.includes('tool') || type.includes('command') || type.includes('exec');
+}
 /**
  * Run the Codex CLI headlessly against `opts.cwd`, authenticated with the leased
  * ChatGPT `auth.json` bundle written to an isolated CODEX_HOME, talking direct to
@@ -838,6 +934,9 @@ export async function runCodex(opts) {
     // context into the prompt itself (Claude Code instead rides --append-system-prompt,
     // falling back to this same fold when the prompt overflows argv).
     const prompt = foldSystemPrompt(opts.systemPrompt, opts.userPrompt);
+    // This stream's tool-silence window (see the claude runner for the shape); opened just before
+    // the CLI starts and closed in the `finally` below.
+    let toolWindow = NO_TOOL_WINDOW;
     // Codex's `exec --json` is far thinner than Claude Code's stream: it surfaces only
     // flat assistant text and (on `token_count` events) the per-turn `last_token_usage`
     // plus a cumulative total. It never exposes the request transcript or structured
@@ -849,17 +948,15 @@ export async function runCodex(opts) {
     let pendingText = '';
     const onEvent = (event) => {
         const type = typeof event.type === 'string' ? event.type : '';
-        if (type.includes('agent_message') ||
-            (type === 'item.completed' && isCodexMessageItem(event))) {
-            const text = extractText(event);
-            if (text) {
-                stats.assistantChars += text.length;
-                summary = text;
-                pendingText = text;
-            }
+        const text = codexAssistantText(event, type);
+        if (text) {
+            stats.assistantChars += text.length;
+            summary = text;
+            pendingText = text;
         }
-        if (type.includes('tool') || type.includes('command') || type.includes('exec')) {
+        if (isCodexToolActivity(type)) {
             stats.toolCalls += 1;
+            toolWindow.toolCompleted();
         }
         const progress = codexPlanProgress(event);
         if (progress && opts.onProgress)
@@ -888,6 +985,7 @@ export async function runCodex(opts) {
             pendingText = '';
         }
     };
+    toolWindow = openToolWindow(opts);
     try {
         const { stderrTail } = await streamCli({
             command: 'codex',
@@ -942,6 +1040,7 @@ export async function runCodex(opts) {
         throw withAgentReport(err, summary, secrets);
     }
     finally {
+        toolWindow.close();
         if (codexHome) {
             // Lift the CLI session transcripts (`sessions/`) out for short-lived retention BEFORE the
             // home is deleted — the credential (`auth.json`) lives at the home root, never in

package/dist/bootstrap-mode.js

@@ -81,6 +81,7 @@ export async function runBootstrap(job, opts) {
             dir,
             target: boot.target,
             ghToken: job.ghToken,
+            signal,
             message: fromScratch
                 ? 'Bootstrap new repository'
                 : `Bootstrap from ${job.repo.owner}/${job.repo.name}`,

package/dist/coding-agent.d.ts

@@ -1,5 +1,6 @@
 import type { AgentJob, AgentResult, HarnessAuthFields, RepoSpec, SkillSpec, McpServerSpec } from './job.js';
-import type { HarnessCallMetric, PiRunStats } from './pi.js';
+import type { HarnessCallMetric } from './pi.js';
+import type { PiRunStats } from './pi-reduction.js';
 import { type EffortReport } from './effort.js';
 import { type AgentPrDescription } from './pr-description.js';
 import type { ProgressGuardLimits } from './progress-guard.js';

package/dist/embed.d.ts

@@ -1,4 +1,5 @@
-export { PI_MAX_OUTPUT_TOKENS, writePiModelsConfig, writeAgentsContext, runPi, summarizePiRun, parsePiOutput, parseTodoProgress, terminalRunError, type PiRunOutcome, type PiRunStats, type TodoItem, type TodoProgress, } from './pi.js';
+export { writePiModelsConfig, writeAgentsContext, runPi, parseTodoProgress, type PiRunOutcome, type TodoItem, type TodoProgress, } from './pi.js';
+export { PI_MAX_OUTPUT_TOKENS, parsePiOutput, summarizePiRun, terminalRunError, type PiRunReduction, type PiRunStats, } from './pi-reduction.js';
 export { DEFAULT_PROGRESS_GUARD_LIMITS, progressGuardLimitsFromEnv, type ProgressGuardLimits, } from './progress-guard.js';
 export { cloneRepo, createBranch, changedPathsFromPorcelain, hasAgentChanges, redactSecrets, } from './git.js';
 export type { RepoSpec } from './job.js';

package/dist/embed.js

@@ -4,6 +4,7 @@
 // repo, write the agent context, point Pi at an OpenAI-compatible endpoint, run
 // it, and inspect what changed. The HTTP server / job lifecycle stays internal;
 // only the reusable primitives are exposed here.
-export { PI_MAX_OUTPUT_TOKENS, writePiModelsConfig, writeAgentsContext, runPi, summarizePiRun, parsePiOutput, parseTodoProgress, terminalRunError, } from './pi.js';
+export { writePiModelsConfig, writeAgentsContext, runPi, parseTodoProgress, } from './pi.js';
+export { PI_MAX_OUTPUT_TOKENS, parsePiOutput, summarizePiRun, terminalRunError, } from './pi-reduction.js';
 export { DEFAULT_PROGRESS_GUARD_LIMITS, progressGuardLimitsFromEnv, } from './progress-guard.js';
 export { cloneRepo, createBranch, changedPathsFromPorcelain, hasAgentChanges, redactSecrets, } from './git.js';

package/dist/failure.d.ts

@@ -5,6 +5,10 @@
  *
  *  - `inactivity-timeout` — the inactivity watchdog fired (no agent output for the window).
  *  - `max-duration`       — the overall wall-clock cap fired.
+ *  - `no-tool-progress`   — the tool-silence watchdog fired: the agent kept TALKING but completed
+ *                           no tool call for the window. Distinct from `inactivity-timeout` on
+ *                           purpose, because the two need different fixes: one says the container
+ *                           went quiet, this one says the model rabbit-holed while streaming.
  *  - `agent`              — the agent ran but produced an unusable/failed result, or threw.
  *  - `git`                — a git operation failed (clone/push/merge/PR).
  *  - `api`                — an upstream API call failed (e.g. the GitHub/GitLab PR/MR REST call).
@@ -13,7 +17,14 @@
  *  - `no-usable-output`   — the agent finished but returned no usable report / structured output.
  *  - `no-changes`         — a coding agent finished without producing any change to push.
  */
-export type FailureCause = 'inactivity-timeout' | 'max-duration' | 'agent' | 'git' | 'api' | 'llm-upstream' | 'no-usable-output' | 'no-changes';
+export declare const FAILURE_CAUSES: readonly ['inactivity-timeout', 'max-duration', 'no-tool-progress', 'agent', 'git', 'api', 'llm-upstream', 'no-usable-output', 'no-changes'];
+/**
+ * See {@link FAILURE_CAUSES}. Derived from the array rather than declared beside it so the two
+ * cannot disagree, and so the list is ENUMERABLE at runtime — which is what lets
+ * `failure-cause.conformity.test.ts` check this image's vocabulary against the kernel union that
+ * has to classify it (the two are kept in step by hand; the image can carry no workspace dep).
+ */
+export type FailureCause = (typeof FAILURE_CAUSES)[number];
 /**
  * A thrown failure that carries a structured {@link FailureCause}, so a `git` / `api`
  * operation that fails deep in a helper surfaces its real cause instead of being flattened
@@ -40,3 +51,10 @@ export declare function inactivityAbortMessage(inactivityMs: number): string;
  * in error-message coverage I5), so it is free to change.
  */
 export declare function maxDurationAbortMessage(maxDurationMs: number): string;
+/**
+ * The tool-silence-watchdog abort message. Human-readable only, like its two siblings — the
+ * backend reads the structured `no-tool-progress` {@link FailureCause}. Says what it observed
+ * (output, but no completed tool call) rather than "hung": the run was demonstrably alive, which
+ * is exactly why the inactivity watchdog never fired.
+ */
+export declare function toolSilenceAbortMessage(toolSilenceMs: number): string;

package/dist/failure.js

@@ -12,6 +12,36 @@
 // the facade-owned eviction sentinel `(container evicted or crashed)`, which
 // `job.logic.isContainerEvictionError` still matches for a DISPATCH-time throw that carries no job
 // view — and which the harness must keep NOT emitting for a non-eviction failure.
+/**
+ * The structured reason a harness job failed, surfaced on the job view's `failureCause`.
+ * Covers only HARNESS-owned failures — container eviction is detected by the runtime facade
+ * (a vanished container → `(container evicted or crashed)`), never set here.
+ *
+ *  - `inactivity-timeout` — the inactivity watchdog fired (no agent output for the window).
+ *  - `max-duration`       — the overall wall-clock cap fired.
+ *  - `no-tool-progress`   — the tool-silence watchdog fired: the agent kept TALKING but completed
+ *                           no tool call for the window. Distinct from `inactivity-timeout` on
+ *                           purpose, because the two need different fixes: one says the container
+ *                           went quiet, this one says the model rabbit-holed while streaming.
+ *  - `agent`              — the agent ran but produced an unusable/failed result, or threw.
+ *  - `git`                — a git operation failed (clone/push/merge/PR).
+ *  - `api`                — an upstream API call failed (e.g. the GitHub/GitLab PR/MR REST call).
+ *  - `llm-upstream`       — the model provider rejected every call (auth/quota/rate-limit) and Pi
+ *                           exhausted its retries, so the run never produced a result.
+ *  - `no-usable-output`   — the agent finished but returned no usable report / structured output.
+ *  - `no-changes`         — a coding agent finished without producing any change to push.
+ */
+export const FAILURE_CAUSES = [
+    'inactivity-timeout',
+    'max-duration',
+    'no-tool-progress',
+    'agent',
+    'git',
+    'api',
+    'llm-upstream',
+    'no-usable-output',
+    'no-changes',
+];
 /**
  * A thrown failure that carries a structured {@link FailureCause}, so a `git` / `api`
  * operation that fails deep in a helper surfaces its real cause instead of being flattened
@@ -48,3 +78,13 @@ export function inactivityAbortMessage(inactivityMs) {
 export function maxDurationAbortMessage(maxDurationMs) {
     return `Aborted: exceeded max duration of ${Math.round(maxDurationMs / 1000)}s`;
 }
+/**
+ * The tool-silence-watchdog abort message. Human-readable only, like its two siblings — the
+ * backend reads the structured `no-tool-progress` {@link FailureCause}. Says what it observed
+ * (output, but no completed tool call) rather than "hung": the run was demonstrably alive, which
+ * is exactly why the inactivity watchdog never fired.
+ */
+export function toolSilenceAbortMessage(toolSilenceMs) {
+    return (`Aborted: the agent produced output but completed no tool call for ` +
+        `${Math.round(toolSilenceMs / 1000)}s`);
+}

package/dist/git.d.ts

@@ -385,10 +385,16 @@ export declare function pushBranch(dir: string, branch: string, ghToken: string,
  * .gitignore and/or license picked on the new-repo page), so a fast-forward is
  * impossible. The Worker pre-flights that the target is empty or holds only that
  * boilerplate, so overwriting it is safe and intended.
+ *
+ * `signal` is the job watchdog's, and threading it is load-bearing rather than tidy: without
+ * it the six commands below are bounded only by their own per-command timeouts, so an abort
+ * raised during the push phase cannot interrupt them and the job keeps working for up to
+ * ~6 × `GIT_TIMEOUT_MS` past its max-duration kill. Every other git helper here threads it.
  */
 export declare function reinitAndPush(opts: {
     dir: string;
     target: BootstrapTargetSpec;
     ghToken: string;
     message: string;
+    signal?: AbortSignal;
 }): Promise<void>;

package/dist/git.js

@@ -872,20 +872,27 @@ export async function pushBranch(dir, branch, ghToken, signal) {
  * .gitignore and/or license picked on the new-repo page), so a fast-forward is
  * impossible. The Worker pre-flights that the target is empty or holds only that
  * boilerplate, so overwriting it is safe and intended.
+ *
+ * `signal` is the job watchdog's, and threading it is load-bearing rather than tidy: without
+ * it the six commands below are bounded only by their own per-command timeouts, so an abort
+ * raised during the push phase cannot interrupt them and the job keeps working for up to
+ * ~6 × `GIT_TIMEOUT_MS` past its max-duration kill. Every other git helper here threads it.
  */
 export async function reinitAndPush(opts) {
-    await rm(join(opts.dir, '.git'), { recursive: true, force: true });
-    await git(['init'], { cwd: opts.dir });
+    const { dir, signal } = opts;
+    await rm(join(dir, '.git'), { recursive: true, force: true });
+    await git(['init'], { cwd: dir, signal });
     // Start the history on the target's default branch (init may default to master).
-    await git(['checkout', '-b', opts.target.defaultBranch], { cwd: opts.dir });
-    await git(['config', 'user.name', GIT_AUTHOR], { cwd: opts.dir });
-    await git(['config', 'user.email', GIT_EMAIL], { cwd: opts.dir });
-    await git(['add', '-A'], { cwd: opts.dir });
-    await git(['commit', '-m', opts.message], { cwd: opts.dir });
+    await git(['checkout', '-b', opts.target.defaultBranch], { cwd: dir, signal });
+    await git(['config', 'user.name', GIT_AUTHOR], { cwd: dir, signal });
+    await git(['config', 'user.email', GIT_EMAIL], { cwd: dir, signal });
+    await git(['add', '-A'], { cwd: dir, signal });
+    await git(['commit', '-m', opts.message], { cwd: dir, signal });
     const url = authenticatedCloneUrl(opts.target.cloneUrl);
-    await git(['remote', 'add', 'origin', url], { cwd: opts.dir });
+    await git(['remote', 'add', 'origin', url], { cwd: dir, signal });
     await git(['push', '--force', '-u', 'origin', opts.target.defaultBranch], {
-        cwd: opts.dir,
+        cwd: dir,
+        signal,
         env: await authEnv(opts.ghToken),
     });
 }

package/dist/inline.d.ts

@@ -6,5 +6,11 @@ import type { RunOptions } from './runner.js';
  * directory. The job's watchdog (inactivity + max-duration, see {@link JobRegistry}) bounds
  * it through `opts.signal`; `opts.onActivity` keeps the inactivity timer alive while the CLI
  * streams. The temp cwd is always removed.
+ *
+ * `opts.beginToolWindow` is deliberately NOT forwarded. An inline completion is a one-shot
+ * answer with no checkout and no tool loop, so the tool-silence watchdog would arm a window this
+ * run could never beat and could only ever expire — force-failing a healthy completion under a
+ * cause ("kept talking, completed no tool call") that misdescribes what it is. The inactivity and
+ * max-duration watchdogs still bound it, which is the whole bound this work ever had.
  */
 export declare function handleInline(job: InlineJob, opts: RunOptions): Promise<InlineResult>;

package/dist/inline.js

@@ -29,6 +29,12 @@ function deriveFinishReason(calls) {
  * directory. The job's watchdog (inactivity + max-duration, see {@link JobRegistry}) bounds
  * it through `opts.signal`; `opts.onActivity` keeps the inactivity timer alive while the CLI
  * streams. The temp cwd is always removed.
+ *
+ * `opts.beginToolWindow` is deliberately NOT forwarded. An inline completion is a one-shot
+ * answer with no checkout and no tool loop, so the tool-silence watchdog would arm a window this
+ * run could never beat and could only ever expire — force-failing a healthy completion under a
+ * cause ("kept talking, completed no tool call") that misdescribes what it is. The inactivity and
+ * max-duration watchdogs still bound it, which is the whole bound this work ever had.
  */
 export async function handleInline(job, opts) {
     opts.onPhase?.('agent');

package/dist/job.d.ts

@@ -1,4 +1,5 @@
-import type { HarnessCallMetric, PiRunStats } from './pi.js';
+import type { HarnessCallMetric } from './pi.js';
+import type { PiRunStats } from './pi-reduction.js';
 import type { HarnessKind } from './pi-workspace.js';
 import type { FailureCause } from './failure.js';
 import type { EffortReport } from './effort.js';

package/dist/jsonl-stream.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Longest single JSONL record either CLI may emit before the reader stops buffering it.
+ *
+ * Deliberately far above the largest LEGITIMATE record — the terminal `agent_end`, which carries
+ * the run's whole message transcript including tool results — because dropping that one costs the
+ * run its summary and stats. The cap is not a size policy, it is the ceiling that keeps a
+ * runaway producer from growing the buffer until parsing it wedges the event loop, so it only
+ * has to be low enough that one parse of it stays well inside the poll cadence.
+ */
+export declare const MAX_JSONL_LINE_CHARS: number;
+/**
+ * A fixed-size tail of a text stream, for output kept ONLY to quote back on a failure.
+ *
+ * Retaining a whole run's stdout to slice the last 2 KB off it at close is the memory half of
+ * F6: a chatty agent's output is unbounded, and the container OOMing is another way for a job to
+ * stop answering polls with no watchdog having fired. The tail is trimmed lazily — only once it
+ * has grown past twice the bound — so a run that streams thousands of chunks pays an amortized
+ * O(1) copy per chunk rather than an O(maxChars) slice on every one of them.
+ */
+export declare class BoundedTail {
+    private readonly maxChars;
+    private text;
+    private total;
+    constructor(maxChars: number);
+    push(chunk: string): void;
+    /** The last `maxChars` characters seen. */
+    toString(): string;
+    /** Everything ever pushed, whether or not it is still retained. */
+    get totalChars(): number;
+    /**
+     * Characters dropped off the FRONT because the tail is bounded; 0 while everything still fits.
+     *
+     * A caller that renders the tail to a human owes them this: a bounded tail is the opposite of a
+     * prefix, so a reader who assumes one concludes the producer stopped where the text begins.
+     * Diagnostic quotes (a stderr tail) need no such note — being a tail is what they are for.
+     */
+    get droppedChars(): number;
+}
+/**
+ * Frames a child's LF-delimited JSONL stdout into complete records, bounding what it will buffer
+ * for any one of them.
+ *
+ * `onLine` is invoked per complete record with `final: false`, and once more from {@link flush}
+ * with `final: true` for a trailing record that arrived without its newline (a clean exit can
+ * leave the last event unterminated). `final` is what lets a caller deliver the record's
+ * progress/telemetry signal while suppressing any decision that would KILL the run: the process
+ * has already exited, so a guard tripping on that last buffered record would turn a clean exit
+ * into a spurious failure.
+ *
+ * A record that outgrows {@link MAX_JSONL_LINE_CHARS} is DROPPED, not truncated: a partial JSON
+ * document is not a record, and handing the parser half of one would report it as corrupt output
+ * rather than as the bound firing. The reader then resynchronises on the next newline, so the
+ * oversized record costs its own signal and nothing after it. Callers report {@link droppedLines}
+ * at close (never per line) so the loss is diagnosable instead of silent.
+ */
+export declare class JsonlLineReader {
+    private readonly onLine;
+    private readonly maxLineChars;
+    private buffer;
+    /** True while discarding the tail of a record that already blew the cap. */
+    private skipping;
+    private dropped;
+    constructor(onLine: (line: string, final: boolean) => void, maxLineChars?: number);
+    /** Feed one stdout chunk, emitting every complete record it finishes. */
+    push(text: string): void;
+    /** Emit any trailing unterminated record (see the class doc); call once, after the child exits. */
+    flush(): void;
+    /** Records dropped for exceeding the line cap; 0 on every ordinary run. */
+    get droppedLines(): number;
+}