@cat-factory/executor-harness 1.94.0 → 1.98.0

package/src/agent-runner.ts

@@ -9,26 +9,30 @@ import {
   type TrackedToolCall,
   recordClaudeToolResults,
 } from './tool-trajectory.js'
-import type { Logger } from './logger.js'
+import { log, type Logger } from './logger.js'
+import { NO_TOOL_WINDOW, type ToolProgressWindow } from './tool-silence.js'
 import {
   createCallMetricPublisher,
   publishCallMetric,
   type CallMetricPublisher,
   type HarnessCallMetric,
   type PiRunOutcome,
-  type PiRunStats,
   type TodoProgress,
   type ToolSpan,
 } from './pi.js'
+import type { PiRunStats } from './pi-reduction.js'
 import {
   claudeAllowedToolPatterns,
   codexMcpConfigToml,
   mcpServerSecretValues,
+  observeClaudeMcpInit,
   writeClaudeMcpConfig,
   type McpServerSpec,
+  type ObservedMcpServer,
   type SkillSpec,
 } from './agent-capabilities.js'
 import { ProgressGuard, type ProgressGuardLimits } from './progress-guard.js'
+import { BoundedTail, JsonlLineReader } from './jsonl-stream.js'
 import { killChildProcess, spawnDetached } from './process.js'
 import { describeProcessExit } from './process-exit.js'
 import { redact, registerKnownSecrets, secretsToRedact } from './redact.js'
@@ -136,6 +140,18 @@ export interface SubscriptionRunOptions {
    * DID dies with the container.
    */
   onSpan?: (span: ToolSpan) => void
+  /**
+   * Opens this stream's tool-silence window (see `RunOptions.beginToolWindow`), closed when the
+   * CLI exits. Both subscription CLIs report tool activity — claude-code on the `tool_result`
+   * turn that answers each call, codex on its tool/command/exec events — so a window either
+   * opens is one the run can beat. It is deliberately NOT tied to {@link onSpan}: the trajectory
+   * is an observability opt-in, and the codex stream produces none at all while still doing tool
+   * work, which a span-keyed window would have read as a run making no progress.
+   *
+   * A caller with no tool loop (the inline one-shot completion) passes nothing; see the note at
+   * `handleInline`.
+   */
+  beginToolWindow?: () => ToolProgressWindow
   /**
    * Called with the FULL set of per-slice reviews each time one lands, so the backend can persist
    * a parallel review's completed work as it happens instead of only from the terminal result.
@@ -149,6 +165,21 @@ export interface SubscriptionRunOptions {
    * same row still rides the result, so a lost poll response costs nothing.
    */
   onCallMetric?: (call: HarnessCallMetric) => void
+  /**
+   * Called once with what the CLI reported about the tool servers it loaded, the moment it
+   * announces its resolved session (see {@link observeClaudeMcpInit}).
+   *
+   * The one thing the backend's own dispatch record cannot answer: it knows why it WITHHELD a
+   * tool, and this says a server it wired failed to start anyway. Reported even when every server
+   * came up, because "observed, all healthy" and "this image observed nothing" are different
+   * facts about a run and only the first one clears a wired server of suspicion.
+   *
+   * Whole-value latest-wins, not a delta — the CLI announces its session once, so a second call
+   * would only ever be a re-announcement of the same set. A harness whose CLI reports nothing
+   * (codex today) never calls this, which is what leaves the backend's record honestly empty
+   * rather than claiming every server failed.
+   */
+  onToolServers?: (observed: ObservedMcpServer[]) => void
   /**
    * The per-job child logger (jobId/repo/branch correlation). Threaded so the retained
    * session-transcript path is logged for the run when the isolated config home is torn down.
@@ -210,9 +241,10 @@ function streamCli(
     child.stdin.on('error', () => {})
     child.stdin.end(prompt)
 
-    let stderr = ''
+    // 8 KB is well over the 700 B tail anyone quotes below, and the CLI's stderr is diagnostic
+    // noise rather than a product, so a bounded tail is all this ever needed to be.
+    const stderr = new BoundedTail(8_000)
     let aborted = false
-    let lineBuffer = ''
 
     const killChild = (): void => killChildProcess(child)
 
@@ -236,16 +268,9 @@ function streamCli(
       }
     }
 
-    const consumeStdout = (text: string): void => {
-      lineBuffer += text
-      let nl = lineBuffer.indexOf('\n')
-      while (nl !== -1) {
-        const line = lineBuffer.slice(0, nl).trim()
-        lineBuffer = lineBuffer.slice(nl + 1)
-        nl = lineBuffer.indexOf('\n')
-        processLine(line)
-      }
-    }
+    // Bounded framing, shared with `runPi`: an unterminated record must not be able to grow
+    // until parsing it stalls the loop the watchdogs and poll handlers run on (audit F6).
+    const reader = new JsonlLineReader(processLine)
 
     const onAbort = (): void => {
       aborted = true
@@ -255,12 +280,11 @@ function streamCli(
 
     child.stdout.on('data', (chunk: Buffer) => {
       opts.onActivity?.()
-      consumeStdout(chunk.toString())
+      reader.push(chunk.toString())
     })
     child.stderr.on('data', (chunk: Buffer) => {
       opts.onActivity?.()
-      stderr += chunk.toString()
-      if (stderr.length > 8_000) stderr = stderr.slice(-8_000)
+      stderr.push(chunk.toString())
     })
 
     child.on('error', (err) => {
@@ -269,8 +293,19 @@ function streamCli(
     })
     child.on('close', (code, signal) => {
       opts.signal?.removeEventListener('abort', onAbort)
-      const stderrTail = redact(stderr, secrets).slice(-700)
-      if (lineBuffer.trim()) processLine(lineBuffer.trim(), true)
+      const stderrTail = redact(stderr.toString(), secrets).slice(-700)
+      reader.flush()
+      // Surface an oversized record the reader refused to buffer ONCE (a count, not per line),
+      // for the same reason `runPi` does: a dropped record costs this run its progress, its
+      // trajectory and its per-call telemetry for that turn, and a silent loss reads exactly
+      // like a CLI that never emitted it. Falls back to the module logger so the report cannot
+      // depend on a caller having wired a per-job one.
+      if (reader.droppedLines > 0) {
+        ;(opts.log ?? log).warn('agent CLI: skipped oversized JSONL records', {
+          command,
+          oversizedLines: reader.droppedLines,
+        })
+      }
       if (aborted) {
         // Carry the tail on the rejection so a caller that REPLACES this generic message with a
         // more specific cause (the no-progress guard's diagnostic) can still append it — the
@@ -501,6 +536,67 @@ async function setUpClaudeMcp(
   }
 }
 
+/**
+ * The LIVE publishers of a claude-code run: everything the stream has revealed so far that the
+ * backend should see before the run ends, rather than only in its terminal result.
+ *
+ * They are grouped because they share one rule and differ on everything else. The rule: each
+ * publishes a WHOLE current value (never a delta), so a dropped poll response costs nothing and
+ * the caller may fire them as often as it likes. What differs is what is at stake — progress is a
+ * disposable count the UI renders, while the slice reviews carry the slices' actual review WORK
+ * and are the only thing a resume of a wedged review can be rebuilt from, which is why they are
+ * published on the turn a slice lands rather than on the next progress tick.
+ *
+ * `lastTodo` is a GETTER because the event handler assigns it as the stream goes; taking the value
+ * would freeze the plan at construction time.
+ *
+ * Split out of {@link runClaudeCode} for the per-function line budget.
+ */
+function createClaudeLivePublishers(deps: {
+  opts: SubscriptionRunOptions
+  planTracker: ReturnType<typeof createTaskPlanTracker>
+  sliceTracker: ReturnType<typeof createSliceTracker>
+  lastTodo: () => TodoProgress | undefined
+}): { emitProgress: () => void; emitSliceReviews: () => void } {
+  const { opts, planTracker, sliceTracker } = deps
+  return {
+    emitProgress: () => {
+      if (!opts.onProgress) return
+      const progress = mergeProgress(
+        pickProgress(deps.lastTodo(), planTracker.progress()),
+        sliceTracker.progress(),
+      )
+      if (progress) opts.onProgress(progress)
+    },
+    emitSliceReviews: () => {
+      if (!opts.onSliceReviews) return
+      const reviews = sliceTracker.sliceReviews()
+      if (reviews.length > 0) opts.onSliceReviews(reviews)
+    },
+  }
+}
+
+/**
+ * Publish the CLI's own startup report about the tool servers it loaded — the OBSERVED half of the
+ * run's tool-server record.
+ *
+ * Handed every event because it is the one thing `runClaudeCode` reads that is neither a turn nor
+ * a result: it arrives once, ahead of the first model call, and says whether the servers the
+ * backend wired actually came up. {@link observeClaudeMcpInit} answers `undefined` for every other
+ * event and for a run that wired none, so a server-less run reports nothing and the caller's
+ * record stays honestly absent rather than empty.
+ *
+ * Split out of {@link runClaudeCode} for the per-function line budget.
+ */
+function reportToolServerStartup(
+  event: Record<string, unknown>,
+  onToolServers: ((observed: ObservedMcpServer[]) => void) | undefined,
+): void {
+  if (!onToolServers) return
+  const observed = observeClaudeMcpInit(event)
+  if (observed) onToolServers(observed)
+}
+
 /**
  * No-progress guard on the CLI's own tool stream — the claude-code analogue of runPi's guard,
  * which cannot see the CLI's internal turns. The caller remembers each `tool_use` id's name off
@@ -581,6 +677,25 @@ function createClaudeToolTrajectory(
   }
 }
 
+/**
+ * Open this run's tool-silence window, or the inert one when the caller wired no watchdog. One
+ * definition so both runners resolve "is there a watchdog?" identically, and so neither carries
+ * the optional-call noise at the point where it should simply have a window.
+ */
+function openToolWindow(opts: SubscriptionRunOptions): ToolProgressWindow {
+  return opts.beginToolWindow ? opts.beginToolWindow() : NO_TOOL_WINDOW
+}
+
+/**
+ * Whether a claude-code `user` turn carries a `tool_result` block, i.e. whether a tool call just
+ * COMPLETED — the progress the tool-silence watchdog measures. Tested explicitly rather than
+ * taken from "the model sent a user turn", which a plain follow-up prompt also is: a watchdog
+ * reset handed out for work that did nothing is the same as no watchdog.
+ */
+function carriesToolResult(content: unknown[]): boolean {
+  return content.some((block) => isObject(block) && block.type === 'tool_result')
+}
+
 export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRunOutcome> {
   const stats: PiRunStats = { toolCalls: 0, assistantChars: 0 }
   let summary = ''
@@ -645,23 +760,12 @@ export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRun
   const sliceTracker = createSliceTracker(secrets)
   const planTracker = createTaskPlanTracker()
   let lastTodo: TodoProgress | undefined
-  const emitProgress = (): void => {
-    if (!opts.onProgress) return
-    const progress = mergeProgress(
-      pickProgress(lastTodo, planTracker.progress()),
-      sliceTracker.progress(),
-    )
-    if (progress) opts.onProgress(progress)
-  }
-  // Publish the per-slice reviews the tracker has captured. Separate from `emitProgress` because
-  // the two answer different questions and have different lifetimes: progress is a disposable
-  // count the UI renders, while these carry the slices' actual review WORK and are persisted so a
-  // run that dies before its aggregation can be resumed from them.
-  const emitSliceReviews = (): void => {
-    if (!opts.onSliceReviews) return
-    const reviews = sliceTracker.sliceReviews()
-    if (reviews.length > 0) opts.onSliceReviews(reviews)
-  }
+  const { emitProgress, emitSliceReviews } = createClaudeLivePublishers({
+    opts,
+    planTracker,
+    sliceTracker,
+    lastTodo: () => lastTodo,
+  })
 
   // No-progress guard on the CLI's own tool stream — the claude-code analogue of runPi's guard,
   // absent on this path until now. Claude Code reports a tool CALL (its name) on the `assistant`
@@ -672,9 +776,13 @@ export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRun
   const progressGuard = createClaudeProgressGuard(opts)
   const { rememberTool, feedGuard, guardAbort } = progressGuard
   const trajectory = createClaudeToolTrajectory(opts, secrets)
+  // This stream's tool-silence window; opened just before the CLI starts and closed in the
+  // `finally` below, so it can only ever be armed while the CLI it watches is running.
+  let toolWindow: ToolProgressWindow = NO_TOOL_WINDOW
 
   const onEvent = (event: Record<string, unknown>, meta?: { final?: boolean }): void => {
     const type = event.type
+    reportToolServerStartup(event, opts.onToolServers)
     // A subagent's turns ride the parent's stdout tagged with the dispatch that spawned them;
     // `telemetry` routes them off the parent's chain (and decides who bills them). Progress, slice
     // tracking, the guard and `stats` below deliberately see EVERY event: a subagent grinding on
@@ -708,6 +816,7 @@ export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRun
       // tool_result blocks the harness fed back to the model — part of the next prompt.
       const content = (event.message as Record<string, unknown>).content
       if (Array.isArray(content)) {
+        if (carriesToolResult(content)) toolWindow.toolCompleted()
         sliceTracker.onUser(content)
         planTracker.onUser(content)
         emitProgress()
@@ -756,6 +865,9 @@ export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRun
     ? AbortSignal.any([opts.signal, guardAbort.signal])
     : guardAbort.signal
 
+  // Opened around the CLI itself, not around this function: everything above is per-run setup
+  // (the config home, the skills, the MCP config) which completes no tool calls by nature.
+  toolWindow = openToolWindow(opts)
   try {
     const { stderrTail } = await streamCli(
       {
@@ -827,6 +939,7 @@ export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRun
     }
     throw withAgentReport(err, terminalReport, secrets)
   } finally {
+    toolWindow.close()
     await subagents?.stop()
     await home.dispose()
   }
@@ -1029,6 +1142,30 @@ function claudeUsage(raw: unknown): { inputTokens: number; outputTokens: number
 // Codex
 // ---------------------------------------------------------------------------
 
+/**
+ * The assistant text a codex event carries, or `''`. Two shapes because the CLI changed its
+ * stream between versions and the harness serves both: the flat `agent_message*` events and the
+ * newer `item.completed` envelope around a message item.
+ */
+function codexAssistantText(event: Record<string, unknown>, type: string): string {
+  const isMessage =
+    type.includes('agent_message') || (type === 'item.completed' && isCodexMessageItem(event))
+  return (isMessage ? extractText(event) : '') ?? ''
+}
+
+/**
+ * Whether a codex event reports tool activity — a substring test because the CLI names these
+ * events differently across versions (`exec_command_end`, `item.*` around a command execution,
+ * `tool_*`) and the harness cares only that SOMETHING ran.
+ *
+ * This is also the tool-silence watchdog's only signal on this stream. Codex exposes no
+ * structured tool bodies, so `runCodex` produces no `ToolSpan` at all, and a window keyed on the
+ * trajectory would have force-failed every codex pass that outran it while the run was working.
+ */
+function isCodexToolActivity(type: string): boolean {
+  return type.includes('tool') || type.includes('command') || type.includes('exec')
+}
+
 /**
  * Run the Codex CLI headlessly against `opts.cwd`, authenticated with the leased
  * ChatGPT `auth.json` bundle written to an isolated CODEX_HOME, talking direct to
@@ -1090,6 +1227,9 @@ export async function runCodex(opts: SubscriptionRunOptions): Promise<PiRunOutco
   // context into the prompt itself (Claude Code instead rides --append-system-prompt,
   // falling back to this same fold when the prompt overflows argv).
   const prompt = foldSystemPrompt(opts.systemPrompt, opts.userPrompt)
+  // This stream's tool-silence window (see the claude runner for the shape); opened just before
+  // the CLI starts and closed in the `finally` below.
+  let toolWindow: ToolProgressWindow = NO_TOOL_WINDOW
 
   // Codex's `exec --json` is far thinner than Claude Code's stream: it surfaces only
   // flat assistant text and (on `token_count` events) the per-turn `last_token_usage`
@@ -1103,19 +1243,15 @@ export async function runCodex(opts: SubscriptionRunOptions): Promise<PiRunOutco
 
   const onEvent = (event: Record<string, unknown>): void => {
     const type = typeof event.type === 'string' ? event.type : ''
-    if (
-      type.includes('agent_message') ||
-      (type === 'item.completed' && isCodexMessageItem(event))
-    ) {
-      const text = extractText(event)
-      if (text) {
-        stats.assistantChars += text.length
-        summary = text
-        pendingText = text
-      }
+    const text = codexAssistantText(event, type)
+    if (text) {
+      stats.assistantChars += text.length
+      summary = text
+      pendingText = text
     }
-    if (type.includes('tool') || type.includes('command') || type.includes('exec')) {
+    if (isCodexToolActivity(type)) {
       stats.toolCalls += 1
+      toolWindow.toolCompleted()
     }
     const progress = codexPlanProgress(event)
     if (progress && opts.onProgress) opts.onProgress(progress)
@@ -1146,6 +1282,7 @@ export async function runCodex(opts: SubscriptionRunOptions): Promise<PiRunOutco
     }
   }
 
+  toolWindow = openToolWindow(opts)
   try {
     const { stderrTail } = await streamCli(
       {
@@ -1213,6 +1350,7 @@ export async function runCodex(opts: SubscriptionRunOptions): Promise<PiRunOutco
     // stream, not on stderr — so a bad exit carries the last thing the agent said.
     throw withAgentReport(err, summary, secrets)
   } finally {
+    toolWindow.close()
     if (codexHome) {
       // Lift the CLI session transcripts (`sessions/`) out for short-lived retention BEFORE the
       // home is deleted — the credential (`auth.json`) lives at the home root, never in

package/src/agent.ts

@@ -27,7 +27,7 @@ import {
   unmergedPaths,
 } from './git.js'
 import { inferVcsProvider, openPullRequest } from './vcs-api.js'
-import type { PiRunStats, RunDiagnostics } from './pi.js'
+import type { PiRunStats, RunDiagnostics } from './pi-reduction.js'
 import { applyPrDescription } from './pr-description.js'
 import {
   makeDirClaimer,

package/src/bootstrap-mode.ts

@@ -1,7 +1,7 @@
 import { opendir } from 'node:fs/promises'
 import { join } from 'node:path'
 import type { AgentJob, AgentResult } from './job.js'
-import type { PiRunStats } from './pi.js'
+import type { PiRunStats } from './pi-reduction.js'
 import type { RunOptions } from './runner.js'
 import {
   NEVER_ACTED_CAUSE,
@@ -101,6 +101,7 @@ export async function runBootstrap(job: AgentJob, opts: RunOptions): Promise<Age
       dir,
       target: boot.target,
       ghToken: job.ghToken,
+      signal,
       message: fromScratch
         ? 'Bootstrap new repository'
         : `Bootstrap from ${job.repo.owner}/${job.repo.name}`,

package/src/coding-agent.ts

@@ -30,7 +30,8 @@ import {
 } from './git.js'
 import { openPullRequest } from './vcs-api.js'
 import { FOLLOW_UPS_FILENAME, FollowUpTailer } from './follow-ups.js'
-import type { HarnessCallMetric, PiRunStats } from './pi.js'
+import type { HarnessCallMetric } from './pi.js'
+import type { PiRunStats } from './pi-reduction.js'
 import { EFFORT_REPORT_FILE, type EffortReport } from './effort.js'
 import {
   type AgentPrDescription,

package/src/embed.ts

@@ -6,19 +6,22 @@
 // only the reusable primitives are exposed here.
 
 export {
-  PI_MAX_OUTPUT_TOKENS,
   writePiModelsConfig,
   writeAgentsContext,
   runPi,
-  summarizePiRun,
-  parsePiOutput,
   parseTodoProgress,
-  terminalRunError,
   type PiRunOutcome,
-  type PiRunStats,
   type TodoItem,
   type TodoProgress,
 } from './pi.js'
+export {
+  PI_MAX_OUTPUT_TOKENS,
+  parsePiOutput,
+  summarizePiRun,
+  terminalRunError,
+  type PiRunReduction,
+  type PiRunStats,
+} from './pi-reduction.js'
 export {
   DEFAULT_PROGRESS_GUARD_LIMITS,
   progressGuardLimitsFromEnv,

package/src/failure.ts

@@ -20,6 +20,10 @@
  *
  *  - `inactivity-timeout` — the inactivity watchdog fired (no agent output for the window).
  *  - `max-duration`       — the overall wall-clock cap fired.
+ *  - `no-tool-progress`   — the tool-silence watchdog fired: the agent kept TALKING but completed
+ *                           no tool call for the window. Distinct from `inactivity-timeout` on
+ *                           purpose, because the two need different fixes: one says the container
+ *                           went quiet, this one says the model rabbit-holed while streaming.
  *  - `agent`              — the agent ran but produced an unusable/failed result, or threw.
  *  - `git`                — a git operation failed (clone/push/merge/PR).
  *  - `api`                — an upstream API call failed (e.g. the GitHub/GitLab PR/MR REST call).
@@ -28,15 +32,25 @@
  *  - `no-usable-output`   — the agent finished but returned no usable report / structured output.
  *  - `no-changes`         — a coding agent finished without producing any change to push.
  */
-export type FailureCause =
-  | 'inactivity-timeout'
-  | 'max-duration'
-  | 'agent'
-  | 'git'
-  | 'api'
-  | 'llm-upstream'
-  | 'no-usable-output'
-  | 'no-changes'
+export const FAILURE_CAUSES = [
+  'inactivity-timeout',
+  'max-duration',
+  'no-tool-progress',
+  'agent',
+  'git',
+  'api',
+  'llm-upstream',
+  'no-usable-output',
+  'no-changes',
+] as const
+
+/**
+ * See {@link FAILURE_CAUSES}. Derived from the array rather than declared beside it so the two
+ * cannot disagree, and so the list is ENUMERABLE at runtime — which is what lets
+ * `failure-cause.conformity.test.ts` check this image's vocabulary against the kernel union that
+ * has to classify it (the two are kept in step by hand; the image can carry no workspace dep).
+ */
+export type FailureCause = (typeof FAILURE_CAUSES)[number]
 
 /**
  * A thrown failure that carries a structured {@link FailureCause}, so a `git` / `api`
@@ -77,3 +91,16 @@ export function inactivityAbortMessage(inactivityMs: number): string {
 export function maxDurationAbortMessage(maxDurationMs: number): string {
   return `Aborted: exceeded max duration of ${Math.round(maxDurationMs / 1000)}s`
 }
+
+/**
+ * The tool-silence-watchdog abort message. Human-readable only, like its two siblings — the
+ * backend reads the structured `no-tool-progress` {@link FailureCause}. Says what it observed
+ * (output, but no completed tool call) rather than "hung": the run was demonstrably alive, which
+ * is exactly why the inactivity watchdog never fired.
+ */
+export function toolSilenceAbortMessage(toolSilenceMs: number): string {
+  return (
+    `Aborted: the agent produced output but completed no tool call for ` +
+    `${Math.round(toolSilenceMs / 1000)}s`
+  )
+}

package/src/git.ts

@@ -1081,25 +1081,33 @@ export async function pushBranch(
  * .gitignore and/or license picked on the new-repo page), so a fast-forward is
  * impossible. The Worker pre-flights that the target is empty or holds only that
  * boilerplate, so overwriting it is safe and intended.
+ *
+ * `signal` is the job watchdog's, and threading it is load-bearing rather than tidy: without
+ * it the six commands below are bounded only by their own per-command timeouts, so an abort
+ * raised during the push phase cannot interrupt them and the job keeps working for up to
+ * ~6 × `GIT_TIMEOUT_MS` past its max-duration kill. Every other git helper here threads it.
  */
 export async function reinitAndPush(opts: {
   dir: string
   target: BootstrapTargetSpec
   ghToken: string
   message: string
+  signal?: AbortSignal
 }): Promise<void> {
-  await rm(join(opts.dir, '.git'), { recursive: true, force: true })
-  await git(['init'], { cwd: opts.dir })
+  const { dir, signal } = opts
+  await rm(join(dir, '.git'), { recursive: true, force: true })
+  await git(['init'], { cwd: dir, signal })
   // Start the history on the target's default branch (init may default to master).
-  await git(['checkout', '-b', opts.target.defaultBranch], { cwd: opts.dir })
-  await git(['config', 'user.name', GIT_AUTHOR], { cwd: opts.dir })
-  await git(['config', 'user.email', GIT_EMAIL], { cwd: opts.dir })
-  await git(['add', '-A'], { cwd: opts.dir })
-  await git(['commit', '-m', opts.message], { cwd: opts.dir })
+  await git(['checkout', '-b', opts.target.defaultBranch], { cwd: dir, signal })
+  await git(['config', 'user.name', GIT_AUTHOR], { cwd: dir, signal })
+  await git(['config', 'user.email', GIT_EMAIL], { cwd: dir, signal })
+  await git(['add', '-A'], { cwd: dir, signal })
+  await git(['commit', '-m', opts.message], { cwd: dir, signal })
   const url = authenticatedCloneUrl(opts.target.cloneUrl)
-  await git(['remote', 'add', 'origin', url], { cwd: opts.dir })
+  await git(['remote', 'add', 'origin', url], { cwd: dir, signal })
   await git(['push', '--force', '-u', 'origin', opts.target.defaultBranch], {
-    cwd: opts.dir,
+    cwd: dir,
+    signal,
     env: await authEnv(opts.ghToken),
   })
 }

package/src/inline.ts

@@ -35,6 +35,12 @@ function deriveFinishReason(calls: HarnessCallMetric[] | undefined): 'stop' | 'l
  * directory. The job's watchdog (inactivity + max-duration, see {@link JobRegistry}) bounds
  * it through `opts.signal`; `opts.onActivity` keeps the inactivity timer alive while the CLI
  * streams. The temp cwd is always removed.
+ *
+ * `opts.beginToolWindow` is deliberately NOT forwarded. An inline completion is a one-shot
+ * answer with no checkout and no tool loop, so the tool-silence watchdog would arm a window this
+ * run could never beat and could only ever expire — force-failing a healthy completion under a
+ * cause ("kept talking, completed no tool call") that misdescribes what it is. The inactivity and
+ * max-duration watchdogs still bound it, which is the whole bound this work ever had.
  */
 export async function handleInline(job: InlineJob, opts: RunOptions): Promise<InlineResult> {
   opts.onPhase?.('agent')

package/src/job.ts

@@ -1,4 +1,5 @@
-import type { HarnessCallMetric, PiRunStats } from './pi.js'
+import type { HarnessCallMetric } from './pi.js'
+import type { PiRunStats } from './pi-reduction.js'
 import type { HarnessKind } from './pi-workspace.js'
 import type { FailureCause } from './failure.js'
 import type { EffortReport } from './effort.js'