@cat-factory/executor-harness 1.96.0 → 1.98.0

package/README.md

@@ -210,9 +210,12 @@ Kimi / DeepSeek) and meters spend. The provider key never enters the container.
 | File               | Responsibility                                                                                          |
 | ------------------ | ------------------------------------------------------------------------------------------------------- |
 | `src/server.ts`    | HTTP entry point; routes `/health`, `/run`, `/bootstrap`, `/blueprint`, `/jobs/{id}`.                   |
-| `src/runner.ts`    | `JobRegistry`: async job lifecycle, idempotent on `jobId`, progress tracking.                          |
+| `src/runner.ts`    | `JobRegistry`: async job lifecycle, idempotent on `jobId`, progress tracking, and the three per-job watchdogs (max-duration, inactivity, tool-silence).                          |
+| `src/jsonl-stream.ts` | The BOUNDS on a child CLI's streams, shared by both runners: `JsonlLineReader` frames its JSONL stdout while refusing to buffer a runaway record, `BoundedTail` keeps a capped tail of raw output for failure quoting. Both watchdog timers and the poll endpoints share one event loop with this parsing, so an unbounded buffer here is how a container stops answering polls with no watchdog having fired. |
 | `src/job.ts`       | Request types + validators for the job specs.                                                           |
 | `src/pi.ts`        | Pi provider config, non-interactive run, JSON-line event + todo-progress parsing, global `AGENTS.md` guidance. |
+| `src/pi-reduction.ts` | Reducing a Pi event stream to what the run PRODUCED (summary, stats, diagnostics, terminal failure), FOLDED as records stream rather than over a retained array — memory is O(largest record), not O(records). The array-taking entry points offline tooling uses are defined in terms of the same reducer. |
+| `src/tool-silence.ts` | The tool-silence watchdog (F13) and the `ToolProgressWindow` an agent stream opens, beats and closes. Separate from the phase marker on purpose: a window is only meaningful while something able to reset it is running. |
 | `src/git.ts`       | clone / branch / commit / push + GitHub PR creation; bootstrap history reset + force-push.              |
 | `src/bootstrap.ts` | The `/bootstrap` handler (clone-or-empty → adapt → reinit + force-push).                                |
 | `src/blueprint.ts` | The `/blueprint` handler (decompose → render `blueprints/` → commit on branch).                         |
@@ -240,6 +243,7 @@ runner):
 | `PORT`                | `8080`          | HTTP port the harness listens on.                           |
 | `JOB_MAX_DURATION_MS` | `3600000` (60m) | Hard ceiling on a job's wall-clock time; force-fails after. |
 | `JOB_INACTIVITY_MS`   | `600000` (10m)  | Kills a hung agent that produces no output for this long.   |
+| `JOB_TOOL_SILENCE_MS` | half `JOB_MAX_DURATION_MS` (30m at its default) | Kills an agent that keeps producing output but completes no tool call for this long: the "chatty hang" neither watchdog above can see, since streamed output resets the inactivity timer on every chunk while nothing gets done (stuck-run audit F13). Armed ONLY while an agent CLI that reports completed tool calls is running (each runner opens its own window and closes it on exit), so clone / dependency install / push / a validation loop's check commands sit outside it — they are activity-silent by nature and bounded by their own per-command timeouts — and each repair pass opens a fresh window. Derived from the job ceiling rather than fixed. It fires only when output arrived during the window that elapsed, which is what leaves a genuinely quiet run to `JOB_INACTIVITY_MS` and its clearer diagnostic. `0` disables it. |
 | `JOB_MAX_CONSECUTIVE_MCP_CALLS` | `40` | Consecutive tool-server (`mcp__*`) calls with no other tool call between before the run counts as a lookup loop. The counter-bound the no-edit exemption above owes; a per-kind `tuning.guardLimits` entry can only RAISE it. |
 | `JOB_MAX_CONSECUTIVE_NON_ACTION_CALLS` | `200` | Consecutive calls of ANY no-edit-exempt family (reads, searches, web, tool servers, subagent dispatches) with no action call between them. The backstop above the per-family caps, since each of those resets on a call outside its own family; sized as a backstop rather than a research judgement, and reset by any `bash`/edit. |
 | `JOB_COLD_START_MS`   | `120000` (2m)   | First-output window (ADR 0026 D4). A job that has produced nothing this long records a cold-start diagnostic (a likely onboarding/auth wedge) WITHOUT being killed: logged, exposed on `GET /jobs/{id}`, and folded into the failure `detail` if the job goes on to fail. `0` disables it. |

package/dist/agent-runner.d.ts

@@ -1,4 +1,5 @@
-import type { Logger } from './logger.js';
+import { type Logger } from './logger.js';
+import { type ToolProgressWindow } from './tool-silence.js';
 import { type HarnessCallMetric, type PiRunOutcome, type TodoProgress, type ToolSpan } from './pi.js';
 import { type McpServerSpec, type ObservedMcpServer, type SkillSpec } from './agent-capabilities.js';
 import { type ProgressGuardLimits } from './progress-guard.js';
@@ -79,6 +80,18 @@ export interface SubscriptionRunOptions {
      * DID dies with the container.
      */
     onSpan?: (span: ToolSpan) => void;
+    /**
+     * Opens this stream's tool-silence window (see `RunOptions.beginToolWindow`), closed when the
+     * CLI exits. Both subscription CLIs report tool activity — claude-code on the `tool_result`
+     * turn that answers each call, codex on its tool/command/exec events — so a window either
+     * opens is one the run can beat. It is deliberately NOT tied to {@link onSpan}: the trajectory
+     * is an observability opt-in, and the codex stream produces none at all while still doing tool
+     * work, which a span-keyed window would have read as a run making no progress.
+     *
+     * A caller with no tool loop (the inline one-shot completion) passes nothing; see the note at
+     * `handleInline`.
+     */
+    beginToolWindow?: () => ToolProgressWindow;
     /**
      * Called with the FULL set of per-slice reviews each time one lands, so the backend can persist
      * a parallel review's completed work as it happens instead of only from the terminal result.

package/dist/agent-runner.js

@@ -5,9 +5,12 @@ import { dirname, join } from 'node:path';
 import { claudeAssistantContent, isObject, numberOf, redactBody } from './claude-stream.js';
 import { createClaudeRunTelemetry, subagentDispatchId } from './claude-call-aggregator.js';
 import { ToolCallTracker, recordClaudeToolResults, } from './tool-trajectory.js';
+import { log } from './logger.js';
+import { NO_TOOL_WINDOW } from './tool-silence.js';
 import { createCallMetricPublisher, publishCallMetric, } from './pi.js';
 import { claudeAllowedToolPatterns, codexMcpConfigToml, mcpServerSecretValues, observeClaudeMcpInit, writeClaudeMcpConfig, } from './agent-capabilities.js';
 import { ProgressGuard } from './progress-guard.js';
+import { BoundedTail, JsonlLineReader } from './jsonl-stream.js';
 import { killChildProcess, spawnDetached } from './process.js';
 import { describeProcessExit } from './process-exit.js';
 import { redact, registerKnownSecrets, secretsToRedact } from './redact.js';
@@ -59,9 +62,10 @@ function streamCli(cli, prompt, opts, env, secrets, onEvent) {
         });
         child.stdin.on('error', () => { });
         child.stdin.end(prompt);
-        let stderr = '';
+        // 8 KB is well over the 700 B tail anyone quotes below, and the CLI's stderr is diagnostic
+        // noise rather than a product, so a bounded tail is all this ever needed to be.
+        const stderr = new BoundedTail(8_000);
         let aborted = false;
-        let lineBuffer = '';
         const killChild = () => killChildProcess(child);
         // `final` marks the at-close flush of a trailing unterminated line: the CLI has already
         // exited, so an observer must not act on that record in a way that KILLS the run (mirrors
@@ -85,16 +89,9 @@ function streamCli(cli, prompt, opts, env, secrets, onEvent) {
                 // A faulty observer must never break the run.
             }
         };
-        const consumeStdout = (text) => {
-            lineBuffer += text;
-            let nl = lineBuffer.indexOf('\n');
-            while (nl !== -1) {
-                const line = lineBuffer.slice(0, nl).trim();
-                lineBuffer = lineBuffer.slice(nl + 1);
-                nl = lineBuffer.indexOf('\n');
-                processLine(line);
-            }
-        };
+        // Bounded framing, shared with `runPi`: an unterminated record must not be able to grow
+        // until parsing it stalls the loop the watchdogs and poll handlers run on (audit F6).
+        const reader = new JsonlLineReader(processLine);
         const onAbort = () => {
             aborted = true;
             killChild();
@@ -102,13 +99,11 @@ function streamCli(cli, prompt, opts, env, secrets, onEvent) {
         opts.signal?.addEventListener('abort', onAbort, { once: true });
         child.stdout.on('data', (chunk) => {
             opts.onActivity?.();
-            consumeStdout(chunk.toString());
+            reader.push(chunk.toString());
         });
         child.stderr.on('data', (chunk) => {
             opts.onActivity?.();
-            stderr += chunk.toString();
-            if (stderr.length > 8_000)
-                stderr = stderr.slice(-8_000);
+            stderr.push(chunk.toString());
         });
         child.on('error', (err) => {
             opts.signal?.removeEventListener('abort', onAbort);
@@ -116,9 +111,20 @@ function streamCli(cli, prompt, opts, env, secrets, onEvent) {
         });
         child.on('close', (code, signal) => {
             opts.signal?.removeEventListener('abort', onAbort);
-            const stderrTail = redact(stderr, secrets).slice(-700);
-            if (lineBuffer.trim())
-                processLine(lineBuffer.trim(), true);
+            const stderrTail = redact(stderr.toString(), secrets).slice(-700);
+            reader.flush();
+            // Surface an oversized record the reader refused to buffer ONCE (a count, not per line),
+            // for the same reason `runPi` does: a dropped record costs this run its progress, its
+            // trajectory and its per-call telemetry for that turn, and a silent loss reads exactly
+            // like a CLI that never emitted it. Falls back to the module logger so the report cannot
+            // depend on a caller having wired a per-job one.
+            if (reader.droppedLines > 0) {
+                ;
+                (opts.log ?? log).warn('agent CLI: skipped oversized JSONL records', {
+                    command,
+                    oversizedLines: reader.droppedLines,
+                });
+            }
             if (aborted) {
                 // Carry the tail on the rejection so a caller that REPLACES this generic message with a
                 // more specific cause (the no-progress guard's diagnostic) can still append it — the
@@ -448,6 +454,23 @@ function createClaudeToolTrajectory(opts, secrets) {
         onToolResults: (content) => recordClaudeToolResults(tracker, content, (call) => onSpan({ ...call, bodies: 'stored' })),
     };
 }
+/**
+ * Open this run's tool-silence window, or the inert one when the caller wired no watchdog. One
+ * definition so both runners resolve "is there a watchdog?" identically, and so neither carries
+ * the optional-call noise at the point where it should simply have a window.
+ */
+function openToolWindow(opts) {
+    return opts.beginToolWindow ? opts.beginToolWindow() : NO_TOOL_WINDOW;
+}
+/**
+ * Whether a claude-code `user` turn carries a `tool_result` block, i.e. whether a tool call just
+ * COMPLETED — the progress the tool-silence watchdog measures. Tested explicitly rather than
+ * taken from "the model sent a user turn", which a plain follow-up prompt also is: a watchdog
+ * reset handed out for work that did nothing is the same as no watchdog.
+ */
+function carriesToolResult(content) {
+    return content.some((block) => isObject(block) && block.type === 'tool_result');
+}
 export async function runClaudeCode(opts) {
     const stats = { toolCalls: 0, assistantChars: 0 };
     let summary = '';
@@ -524,6 +547,9 @@ export async function runClaudeCode(opts) {
     const progressGuard = createClaudeProgressGuard(opts);
     const { rememberTool, feedGuard, guardAbort } = progressGuard;
     const trajectory = createClaudeToolTrajectory(opts, secrets);
+    // This stream's tool-silence window; opened just before the CLI starts and closed in the
+    // `finally` below, so it can only ever be armed while the CLI it watches is running.
+    let toolWindow = NO_TOOL_WINDOW;
     const onEvent = (event, meta) => {
         const type = event.type;
         reportToolServerStartup(event, opts.onToolServers);
@@ -563,6 +589,8 @@ export async function runClaudeCode(opts) {
             // tool_result blocks the harness fed back to the model — part of the next prompt.
             const content = event.message.content;
             if (Array.isArray(content)) {
+                if (carriesToolResult(content))
+                    toolWindow.toolCompleted();
                 sliceTracker.onUser(content);
                 planTracker.onUser(content);
                 emitProgress();
@@ -610,6 +638,9 @@ export async function runClaudeCode(opts) {
     const runSignal = opts.signal
         ? AbortSignal.any([opts.signal, guardAbort.signal])
         : guardAbort.signal;
+    // Opened around the CLI itself, not around this function: everything above is per-run setup
+    // (the config home, the skills, the MCP config) which completes no tool calls by nature.
+    toolWindow = openToolWindow(opts);
     try {
         const { stderrTail } = await streamCli({
             command: 'claude',
@@ -673,6 +704,7 @@ export async function runClaudeCode(opts) {
         throw withAgentReport(err, terminalReport, secrets);
     }
     finally {
+        toolWindow.close();
         await subagents?.stop();
         await home.dispose();
     }
@@ -825,6 +857,27 @@ function claudeUsage(raw) {
 // ---------------------------------------------------------------------------
 // Codex
 // ---------------------------------------------------------------------------
+/**
+ * The assistant text a codex event carries, or `''`. Two shapes because the CLI changed its
+ * stream between versions and the harness serves both: the flat `agent_message*` events and the
+ * newer `item.completed` envelope around a message item.
+ */
+function codexAssistantText(event, type) {
+    const isMessage = type.includes('agent_message') || (type === 'item.completed' && isCodexMessageItem(event));
+    return (isMessage ? extractText(event) : '') ?? '';
+}
+/**
+ * Whether a codex event reports tool activity — a substring test because the CLI names these
+ * events differently across versions (`exec_command_end`, `item.*` around a command execution,
+ * `tool_*`) and the harness cares only that SOMETHING ran.
+ *
+ * This is also the tool-silence watchdog's only signal on this stream. Codex exposes no
+ * structured tool bodies, so `runCodex` produces no `ToolSpan` at all, and a window keyed on the
+ * trajectory would have force-failed every codex pass that outran it while the run was working.
+ */
+function isCodexToolActivity(type) {
+    return type.includes('tool') || type.includes('command') || type.includes('exec');
+}
 /**
  * Run the Codex CLI headlessly against `opts.cwd`, authenticated with the leased
  * ChatGPT `auth.json` bundle written to an isolated CODEX_HOME, talking direct to
@@ -881,6 +934,9 @@ export async function runCodex(opts) {
     // context into the prompt itself (Claude Code instead rides --append-system-prompt,
     // falling back to this same fold when the prompt overflows argv).
     const prompt = foldSystemPrompt(opts.systemPrompt, opts.userPrompt);
+    // This stream's tool-silence window (see the claude runner for the shape); opened just before
+    // the CLI starts and closed in the `finally` below.
+    let toolWindow = NO_TOOL_WINDOW;
     // Codex's `exec --json` is far thinner than Claude Code's stream: it surfaces only
     // flat assistant text and (on `token_count` events) the per-turn `last_token_usage`
     // plus a cumulative total. It never exposes the request transcript or structured
@@ -892,17 +948,15 @@ export async function runCodex(opts) {
     let pendingText = '';
     const onEvent = (event) => {
         const type = typeof event.type === 'string' ? event.type : '';
-        if (type.includes('agent_message') ||
-            (type === 'item.completed' && isCodexMessageItem(event))) {
-            const text = extractText(event);
-            if (text) {
-                stats.assistantChars += text.length;
-                summary = text;
-                pendingText = text;
-            }
+        const text = codexAssistantText(event, type);
+        if (text) {
+            stats.assistantChars += text.length;
+            summary = text;
+            pendingText = text;
         }
-        if (type.includes('tool') || type.includes('command') || type.includes('exec')) {
+        if (isCodexToolActivity(type)) {
             stats.toolCalls += 1;
+            toolWindow.toolCompleted();
         }
         const progress = codexPlanProgress(event);
         if (progress && opts.onProgress)
@@ -931,6 +985,7 @@ export async function runCodex(opts) {
             pendingText = '';
         }
     };
+    toolWindow = openToolWindow(opts);
     try {
         const { stderrTail } = await streamCli({
             command: 'codex',
@@ -985,6 +1040,7 @@ export async function runCodex(opts) {
         throw withAgentReport(err, summary, secrets);
     }
     finally {
+        toolWindow.close();
         if (codexHome) {
             // Lift the CLI session transcripts (`sessions/`) out for short-lived retention BEFORE the
             // home is deleted — the credential (`auth.json`) lives at the home root, never in

package/dist/bootstrap-mode.js

@@ -81,6 +81,7 @@ export async function runBootstrap(job, opts) {
             dir,
             target: boot.target,
             ghToken: job.ghToken,
+            signal,
             message: fromScratch
                 ? 'Bootstrap new repository'
                 : `Bootstrap from ${job.repo.owner}/${job.repo.name}`,

package/dist/coding-agent.d.ts

@@ -1,5 +1,6 @@
 import type { AgentJob, AgentResult, HarnessAuthFields, RepoSpec, SkillSpec, McpServerSpec } from './job.js';
-import type { HarnessCallMetric, PiRunStats } from './pi.js';
+import type { HarnessCallMetric } from './pi.js';
+import type { PiRunStats } from './pi-reduction.js';
 import { type EffortReport } from './effort.js';
 import { type AgentPrDescription } from './pr-description.js';
 import type { ProgressGuardLimits } from './progress-guard.js';

package/dist/embed.d.ts

@@ -1,4 +1,5 @@
-export { PI_MAX_OUTPUT_TOKENS, writePiModelsConfig, writeAgentsContext, runPi, summarizePiRun, parsePiOutput, parseTodoProgress, terminalRunError, type PiRunOutcome, type PiRunStats, type TodoItem, type TodoProgress, } from './pi.js';
+export { writePiModelsConfig, writeAgentsContext, runPi, parseTodoProgress, type PiRunOutcome, type TodoItem, type TodoProgress, } from './pi.js';
+export { PI_MAX_OUTPUT_TOKENS, parsePiOutput, summarizePiRun, terminalRunError, type PiRunReduction, type PiRunStats, } from './pi-reduction.js';
 export { DEFAULT_PROGRESS_GUARD_LIMITS, progressGuardLimitsFromEnv, type ProgressGuardLimits, } from './progress-guard.js';
 export { cloneRepo, createBranch, changedPathsFromPorcelain, hasAgentChanges, redactSecrets, } from './git.js';
 export type { RepoSpec } from './job.js';

package/dist/embed.js

@@ -4,6 +4,7 @@
 // repo, write the agent context, point Pi at an OpenAI-compatible endpoint, run
 // it, and inspect what changed. The HTTP server / job lifecycle stays internal;
 // only the reusable primitives are exposed here.
-export { PI_MAX_OUTPUT_TOKENS, writePiModelsConfig, writeAgentsContext, runPi, summarizePiRun, parsePiOutput, parseTodoProgress, terminalRunError, } from './pi.js';
+export { writePiModelsConfig, writeAgentsContext, runPi, parseTodoProgress, } from './pi.js';
+export { PI_MAX_OUTPUT_TOKENS, parsePiOutput, summarizePiRun, terminalRunError, } from './pi-reduction.js';
 export { DEFAULT_PROGRESS_GUARD_LIMITS, progressGuardLimitsFromEnv, } from './progress-guard.js';
 export { cloneRepo, createBranch, changedPathsFromPorcelain, hasAgentChanges, redactSecrets, } from './git.js';

package/dist/failure.d.ts

@@ -5,6 +5,10 @@
  *
  *  - `inactivity-timeout` — the inactivity watchdog fired (no agent output for the window).
  *  - `max-duration`       — the overall wall-clock cap fired.
+ *  - `no-tool-progress`   — the tool-silence watchdog fired: the agent kept TALKING but completed
+ *                           no tool call for the window. Distinct from `inactivity-timeout` on
+ *                           purpose, because the two need different fixes: one says the container
+ *                           went quiet, this one says the model rabbit-holed while streaming.
  *  - `agent`              — the agent ran but produced an unusable/failed result, or threw.
  *  - `git`                — a git operation failed (clone/push/merge/PR).
  *  - `api`                — an upstream API call failed (e.g. the GitHub/GitLab PR/MR REST call).
@@ -13,7 +17,14 @@
  *  - `no-usable-output`   — the agent finished but returned no usable report / structured output.
  *  - `no-changes`         — a coding agent finished without producing any change to push.
  */
-export type FailureCause = 'inactivity-timeout' | 'max-duration' | 'agent' | 'git' | 'api' | 'llm-upstream' | 'no-usable-output' | 'no-changes';
+export declare const FAILURE_CAUSES: readonly ['inactivity-timeout', 'max-duration', 'no-tool-progress', 'agent', 'git', 'api', 'llm-upstream', 'no-usable-output', 'no-changes'];
+/**
+ * See {@link FAILURE_CAUSES}. Derived from the array rather than declared beside it so the two
+ * cannot disagree, and so the list is ENUMERABLE at runtime — which is what lets
+ * `failure-cause.conformity.test.ts` check this image's vocabulary against the kernel union that
+ * has to classify it (the two are kept in step by hand; the image can carry no workspace dep).
+ */
+export type FailureCause = (typeof FAILURE_CAUSES)[number];
 /**
  * A thrown failure that carries a structured {@link FailureCause}, so a `git` / `api`
  * operation that fails deep in a helper surfaces its real cause instead of being flattened
@@ -40,3 +51,10 @@ export declare function inactivityAbortMessage(inactivityMs: number): string;
  * in error-message coverage I5), so it is free to change.
  */
 export declare function maxDurationAbortMessage(maxDurationMs: number): string;
+/**
+ * The tool-silence-watchdog abort message. Human-readable only, like its two siblings — the
+ * backend reads the structured `no-tool-progress` {@link FailureCause}. Says what it observed
+ * (output, but no completed tool call) rather than "hung": the run was demonstrably alive, which
+ * is exactly why the inactivity watchdog never fired.
+ */
+export declare function toolSilenceAbortMessage(toolSilenceMs: number): string;

package/dist/failure.js

@@ -12,6 +12,36 @@
 // the facade-owned eviction sentinel `(container evicted or crashed)`, which
 // `job.logic.isContainerEvictionError` still matches for a DISPATCH-time throw that carries no job
 // view — and which the harness must keep NOT emitting for a non-eviction failure.
+/**
+ * The structured reason a harness job failed, surfaced on the job view's `failureCause`.
+ * Covers only HARNESS-owned failures — container eviction is detected by the runtime facade
+ * (a vanished container → `(container evicted or crashed)`), never set here.
+ *
+ *  - `inactivity-timeout` — the inactivity watchdog fired (no agent output for the window).
+ *  - `max-duration`       — the overall wall-clock cap fired.
+ *  - `no-tool-progress`   — the tool-silence watchdog fired: the agent kept TALKING but completed
+ *                           no tool call for the window. Distinct from `inactivity-timeout` on
+ *                           purpose, because the two need different fixes: one says the container
+ *                           went quiet, this one says the model rabbit-holed while streaming.
+ *  - `agent`              — the agent ran but produced an unusable/failed result, or threw.
+ *  - `git`                — a git operation failed (clone/push/merge/PR).
+ *  - `api`                — an upstream API call failed (e.g. the GitHub/GitLab PR/MR REST call).
+ *  - `llm-upstream`       — the model provider rejected every call (auth/quota/rate-limit) and Pi
+ *                           exhausted its retries, so the run never produced a result.
+ *  - `no-usable-output`   — the agent finished but returned no usable report / structured output.
+ *  - `no-changes`         — a coding agent finished without producing any change to push.
+ */
+export const FAILURE_CAUSES = [
+    'inactivity-timeout',
+    'max-duration',
+    'no-tool-progress',
+    'agent',
+    'git',
+    'api',
+    'llm-upstream',
+    'no-usable-output',
+    'no-changes',
+];
 /**
  * A thrown failure that carries a structured {@link FailureCause}, so a `git` / `api`
  * operation that fails deep in a helper surfaces its real cause instead of being flattened
@@ -48,3 +78,13 @@ export function inactivityAbortMessage(inactivityMs) {
 export function maxDurationAbortMessage(maxDurationMs) {
     return `Aborted: exceeded max duration of ${Math.round(maxDurationMs / 1000)}s`;
 }
+/**
+ * The tool-silence-watchdog abort message. Human-readable only, like its two siblings — the
+ * backend reads the structured `no-tool-progress` {@link FailureCause}. Says what it observed
+ * (output, but no completed tool call) rather than "hung": the run was demonstrably alive, which
+ * is exactly why the inactivity watchdog never fired.
+ */
+export function toolSilenceAbortMessage(toolSilenceMs) {
+    return (`Aborted: the agent produced output but completed no tool call for ` +
+        `${Math.round(toolSilenceMs / 1000)}s`);
+}

package/dist/git.d.ts

@@ -385,10 +385,16 @@ export declare function pushBranch(dir: string, branch: string, ghToken: string,
  * .gitignore and/or license picked on the new-repo page), so a fast-forward is
  * impossible. The Worker pre-flights that the target is empty or holds only that
  * boilerplate, so overwriting it is safe and intended.
+ *
+ * `signal` is the job watchdog's, and threading it is load-bearing rather than tidy: without
+ * it the six commands below are bounded only by their own per-command timeouts, so an abort
+ * raised during the push phase cannot interrupt them and the job keeps working for up to
+ * ~6 × `GIT_TIMEOUT_MS` past its max-duration kill. Every other git helper here threads it.
  */
 export declare function reinitAndPush(opts: {
     dir: string;
     target: BootstrapTargetSpec;
     ghToken: string;
     message: string;
+    signal?: AbortSignal;
 }): Promise<void>;

package/dist/git.js

@@ -872,20 +872,27 @@ export async function pushBranch(dir, branch, ghToken, signal) {
  * .gitignore and/or license picked on the new-repo page), so a fast-forward is
  * impossible. The Worker pre-flights that the target is empty or holds only that
  * boilerplate, so overwriting it is safe and intended.
+ *
+ * `signal` is the job watchdog's, and threading it is load-bearing rather than tidy: without
+ * it the six commands below are bounded only by their own per-command timeouts, so an abort
+ * raised during the push phase cannot interrupt them and the job keeps working for up to
+ * ~6 × `GIT_TIMEOUT_MS` past its max-duration kill. Every other git helper here threads it.
  */
 export async function reinitAndPush(opts) {
-    await rm(join(opts.dir, '.git'), { recursive: true, force: true });
-    await git(['init'], { cwd: opts.dir });
+    const { dir, signal } = opts;
+    await rm(join(dir, '.git'), { recursive: true, force: true });
+    await git(['init'], { cwd: dir, signal });
     // Start the history on the target's default branch (init may default to master).
-    await git(['checkout', '-b', opts.target.defaultBranch], { cwd: opts.dir });
-    await git(['config', 'user.name', GIT_AUTHOR], { cwd: opts.dir });
-    await git(['config', 'user.email', GIT_EMAIL], { cwd: opts.dir });
-    await git(['add', '-A'], { cwd: opts.dir });
-    await git(['commit', '-m', opts.message], { cwd: opts.dir });
+    await git(['checkout', '-b', opts.target.defaultBranch], { cwd: dir, signal });
+    await git(['config', 'user.name', GIT_AUTHOR], { cwd: dir, signal });
+    await git(['config', 'user.email', GIT_EMAIL], { cwd: dir, signal });
+    await git(['add', '-A'], { cwd: dir, signal });
+    await git(['commit', '-m', opts.message], { cwd: dir, signal });
     const url = authenticatedCloneUrl(opts.target.cloneUrl);
-    await git(['remote', 'add', 'origin', url], { cwd: opts.dir });
+    await git(['remote', 'add', 'origin', url], { cwd: dir, signal });
     await git(['push', '--force', '-u', 'origin', opts.target.defaultBranch], {
-        cwd: opts.dir,
+        cwd: dir,
+        signal,
         env: await authEnv(opts.ghToken),
     });
 }

package/dist/inline.d.ts

@@ -6,5 +6,11 @@ import type { RunOptions } from './runner.js';
  * directory. The job's watchdog (inactivity + max-duration, see {@link JobRegistry}) bounds
  * it through `opts.signal`; `opts.onActivity` keeps the inactivity timer alive while the CLI
  * streams. The temp cwd is always removed.
+ *
+ * `opts.beginToolWindow` is deliberately NOT forwarded. An inline completion is a one-shot
+ * answer with no checkout and no tool loop, so the tool-silence watchdog would arm a window this
+ * run could never beat and could only ever expire — force-failing a healthy completion under a
+ * cause ("kept talking, completed no tool call") that misdescribes what it is. The inactivity and
+ * max-duration watchdogs still bound it, which is the whole bound this work ever had.
  */
 export declare function handleInline(job: InlineJob, opts: RunOptions): Promise<InlineResult>;

package/dist/inline.js

@@ -29,6 +29,12 @@ function deriveFinishReason(calls) {
  * directory. The job's watchdog (inactivity + max-duration, see {@link JobRegistry}) bounds
  * it through `opts.signal`; `opts.onActivity` keeps the inactivity timer alive while the CLI
  * streams. The temp cwd is always removed.
+ *
+ * `opts.beginToolWindow` is deliberately NOT forwarded. An inline completion is a one-shot
+ * answer with no checkout and no tool loop, so the tool-silence watchdog would arm a window this
+ * run could never beat and could only ever expire — force-failing a healthy completion under a
+ * cause ("kept talking, completed no tool call") that misdescribes what it is. The inactivity and
+ * max-duration watchdogs still bound it, which is the whole bound this work ever had.
  */
 export async function handleInline(job, opts) {
     opts.onPhase?.('agent');

package/dist/job.d.ts

@@ -1,4 +1,5 @@
-import type { HarnessCallMetric, PiRunStats } from './pi.js';
+import type { HarnessCallMetric } from './pi.js';
+import type { PiRunStats } from './pi-reduction.js';
 import type { HarnessKind } from './pi-workspace.js';
 import type { FailureCause } from './failure.js';
 import type { EffortReport } from './effort.js';

package/dist/jsonl-stream.d.ts

@@ -0,0 +1,70 @@
+/**
+ * Longest single JSONL record either CLI may emit before the reader stops buffering it.
+ *
+ * Deliberately far above the largest LEGITIMATE record — the terminal `agent_end`, which carries
+ * the run's whole message transcript including tool results — because dropping that one costs the
+ * run its summary and stats. The cap is not a size policy, it is the ceiling that keeps a
+ * runaway producer from growing the buffer until parsing it wedges the event loop, so it only
+ * has to be low enough that one parse of it stays well inside the poll cadence.
+ */
+export declare const MAX_JSONL_LINE_CHARS: number;
+/**
+ * A fixed-size tail of a text stream, for output kept ONLY to quote back on a failure.
+ *
+ * Retaining a whole run's stdout to slice the last 2 KB off it at close is the memory half of
+ * F6: a chatty agent's output is unbounded, and the container OOMing is another way for a job to
+ * stop answering polls with no watchdog having fired. The tail is trimmed lazily — only once it
+ * has grown past twice the bound — so a run that streams thousands of chunks pays an amortized
+ * O(1) copy per chunk rather than an O(maxChars) slice on every one of them.
+ */
+export declare class BoundedTail {
+    private readonly maxChars;
+    private text;
+    private total;
+    constructor(maxChars: number);
+    push(chunk: string): void;
+    /** The last `maxChars` characters seen. */
+    toString(): string;
+    /** Everything ever pushed, whether or not it is still retained. */
+    get totalChars(): number;
+    /**
+     * Characters dropped off the FRONT because the tail is bounded; 0 while everything still fits.
+     *
+     * A caller that renders the tail to a human owes them this: a bounded tail is the opposite of a
+     * prefix, so a reader who assumes one concludes the producer stopped where the text begins.
+     * Diagnostic quotes (a stderr tail) need no such note — being a tail is what they are for.
+     */
+    get droppedChars(): number;
+}
+/**
+ * Frames a child's LF-delimited JSONL stdout into complete records, bounding what it will buffer
+ * for any one of them.
+ *
+ * `onLine` is invoked per complete record with `final: false`, and once more from {@link flush}
+ * with `final: true` for a trailing record that arrived without its newline (a clean exit can
+ * leave the last event unterminated). `final` is what lets a caller deliver the record's
+ * progress/telemetry signal while suppressing any decision that would KILL the run: the process
+ * has already exited, so a guard tripping on that last buffered record would turn a clean exit
+ * into a spurious failure.
+ *
+ * A record that outgrows {@link MAX_JSONL_LINE_CHARS} is DROPPED, not truncated: a partial JSON
+ * document is not a record, and handing the parser half of one would report it as corrupt output
+ * rather than as the bound firing. The reader then resynchronises on the next newline, so the
+ * oversized record costs its own signal and nothing after it. Callers report {@link droppedLines}
+ * at close (never per line) so the loss is diagnosable instead of silent.
+ */
+export declare class JsonlLineReader {
+    private readonly onLine;
+    private readonly maxLineChars;
+    private buffer;
+    /** True while discarding the tail of a record that already blew the cap. */
+    private skipping;
+    private dropped;
+    constructor(onLine: (line: string, final: boolean) => void, maxLineChars?: number);
+    /** Feed one stdout chunk, emitting every complete record it finishes. */
+    push(text: string): void;
+    /** Emit any trailing unterminated record (see the class doc); call once, after the child exits. */
+    flush(): void;
+    /** Records dropped for exceeding the line cap; 0 on every ordinary run. */
+    get droppedLines(): number;
+}