@cat-factory/executor-harness 1.96.0 → 1.98.0

package/dist/runner.d.ts

@@ -5,6 +5,7 @@ import type { SliceReview } from './subagents.js';
 import type { ObservedMcpServer } from './agent-capabilities.js';
 import type { HarnessCallMetric, TodoProgress, ToolSpan } from './pi.js';
 import { type Logger } from './logger.js';
+import { type ToolProgressWindow } from './tool-silence.js';
 import { type FailureCause } from './failure.js';
 /** Non-secret correlation fields a job carries on every log line (jobId, repo, branch, …). */
 type LogFields = Record<string, unknown>;
@@ -16,6 +17,22 @@ export interface RunOptions {
     onProgress?: (progress: TodoProgress) => void;
     /** Receives one compact {@link ToolSpan} per completed tool call (observability). */
     onSpan?: (span: ToolSpan) => void;
+    /**
+     * Opens the tool-silence window (stuck-run audit F13) for ONE agent stream, returning the
+     * handle that stream beats on every completed tool call and closes when it ends.
+     *
+     * Called by the agent-CLI runners themselves rather than by the phase marker, because the
+     * window is only meaningful while something able to RESET it is running and only the runner
+     * knows whether its CLI reports completed tool calls at all. A caller that runs no tool loop
+     * (the inline one-shot completion) simply does not forward this, which is a statement, not an
+     * omission: the run stays bounded by the inactivity and max-duration watchdogs, and a window
+     * nothing could ever beat would only be able to expire.
+     *
+     * Absent ⇒ no window is opened and this watchdog is silent for that work. It fails toward NOT
+     * killing on purpose: this audit exists as much to stop recovery machinery ending healthy runs
+     * as to bound wedged ones, and the wall-clock cap is underneath either way.
+     */
+    beginToolWindow?: () => ToolProgressWindow;
     /** Receives the forward-looking follow-up / question items the Coder streamed since the last poll. */
     onFollowUp?: (items: FollowUpLine[]) => void;
     /**
@@ -246,6 +263,20 @@ export interface RunnerLimits {
      * progress, which counts as activity). Set to 0 to disable.
      */
     coldStartMs: number;
+    /**
+     * Stuck-run audit F13: force-fail the job if a running agent stream completes no tool call for
+     * this long. The gap the other two watchdogs structurally cannot see — a model that keeps
+     * talking (or thinking out loud) resets the inactivity timer on every chunk while completing
+     * nothing, so the only remaining bound was the full wall-clock cap and the engine's
+     * ~70-minute poll budget behind it.
+     *
+     * Armed only for as long as a stream that REPORTS completed tool calls is running (see
+     * {@link RunOptions.beginToolWindow}), so the activity-silent stretches — clone, dependency
+     * install, push, a validation loop's check commands — are outside it by construction: they
+     * legitimately complete no tool calls, and they are bounded by their own per-command timeouts.
+     * Set to 0 to disable.
+     */
+    toolSilenceMs: number;
 }
 export declare function loadRunnerLimits(env?: NodeJS.ProcessEnv): RunnerLimits;
 /**

package/dist/runner.js

@@ -1,6 +1,7 @@
 import { redactSecrets } from './redact.js';
 import { log } from './logger.js';
-import { failureCauseOf, inactivityAbortMessage, maxDurationAbortMessage, } from './failure.js';
+import { ToolSilenceWatchdog } from './tool-silence.js';
+import { failureCauseOf, inactivityAbortMessage, maxDurationAbortMessage, toolSilenceAbortMessage, } from './failure.js';
 function intEnv(value, fallback) {
     const n = value ? Number(value) : NaN;
     return Number.isFinite(n) && n > 0 ? n : fallback;
@@ -13,22 +14,43 @@ function intEnvAllowZero(value, fallback) {
     return Number.isFinite(n) && n >= 0 ? n : fallback;
 }
 export function loadRunnerLimits(env = process.env) {
+    const maxDurationMs = intEnv(env.JOB_MAX_DURATION_MS, 60 * 60_000);
+    const inactivityMs = intEnv(env.JOB_INACTIVITY_MS, 10 * 60_000);
     return {
         // 60 minutes: generous headroom for serious multi-file coding tasks while
         // still bounding a runaway container.
-        maxDurationMs: intEnv(env.JOB_MAX_DURATION_MS, 60 * 60_000),
+        maxDurationMs,
         // 10 minutes of zero output is treated as hung (a single long LLM/tool call
         // is far shorter; Pi streams events as it works). The per-git command ceiling
         // (`GIT_TIMEOUT_MS` in git.ts) is DERIVED from this value — a fixed margin below
         // it — so a slow clone/push (which emits no activity events) always times out
         // with git's own clear reason rather than this watchdog's "likely hung" message,
         // for any configured window. See the invariant note in git.ts.
-        inactivityMs: intEnv(env.JOB_INACTIVITY_MS, 10 * 60_000),
+        inactivityMs,
         // 2 minutes: comfortably longer than a warm agent's time-to-first-token yet far
         // under the 10-minute inactivity kill, so a truly output-less start is flagged early.
         coldStartMs: intEnvAllowZero(env.JOB_COLD_START_MS, 2 * 60_000),
+        toolSilenceMs: intEnvAllowZero(env.JOB_TOOL_SILENCE_MS, toolSilenceDefault(maxDurationMs, inactivityMs)),
     };
 }
+/**
+ * The tool-silence window when the operator has not set one: HALF the configured wall-clock cap,
+ * DERIVED rather than a constant so lowering `JOB_MAX_DURATION_MS` tightens it too (a fixed
+ * 30 minutes would sit past the whole budget of a deployment that runs 20-minute jobs, i.e. be
+ * silently disabled).
+ *
+ * Floored at the inactivity window so the default never races the gone-quiet diagnostic more
+ * often than it has to. The floor is a sizing choice, NOT the thing that keeps the two watchdogs
+ * apart: they anchor on different events (the last completed tool call vs the last byte of
+ * output), so the tool-silence anchor is always the earlier of the two and equal windows would
+ * still have it firing first. What actually keeps this watchdog off a hang is the expiry test in
+ * {@link ToolSilenceWatchdog}, which fires only when output arrived DURING the window that
+ * elapsed — and which also holds for an operator who sets `JOB_TOOL_SILENCE_MS` below
+ * `JOB_INACTIVITY_MS`, where no default-side clamp applies at all.
+ */
+function toolSilenceDefault(maxDurationMs, inactivityMs) {
+    return Math.max(Math.round(maxDurationMs / 2), inactivityMs);
+}
 function toView(entry) {
     const { promise: _promise, spanBuffer: _spanBuffer, followUpBuffer: _followUpBuffer, callMetricBuffer: _callMetricBuffer, callMetricSeq: _callMetricSeq, abort: _abort, ...view } = entry;
     return { ...view };
@@ -224,6 +246,20 @@ export class JobRegistry {
         // spoken yet" test and, on a failure, the difference between a run that died mid-work and one
         // that never got going at all.
         let lastActivityAt;
+        // Stuck-run audit F13: the third watchdog, and the only one that can see a model which keeps
+        // TALKING while completing nothing — its output resets the inactivity timer on every chunk,
+        // and it is nowhere near the wall-clock cap. It is armed by the agent stream itself rather
+        // than by the phase marker (see `RunOptions.beginToolWindow`) and reads `lastActivityAt` at
+        // expiry, which is what keeps the gone-quiet case with the inactivity watchdog that owns it.
+        const toolSilence = new ToolSilenceWatchdog({
+            windowMs: this.limits.toolSilenceMs,
+            lastActivityAt: () => lastActivityAt,
+            onExpired: () => {
+                // First watchdog to fire wins the reason (see `resetInactivity` above).
+                killReason ??= 'no-tool-progress';
+                controller.abort(new Error('no tool progress'));
+            },
+        });
         // ADR 0026 D4: a one-shot cold-start watchdog. If the job produces no activity within
         // `coldStartMs`, record a structured diagnostic (a likely onboarding/auth wedge) so it
         // is legible early — it does NOT abort the run (the inactivity watchdog still owns
@@ -261,6 +297,7 @@ export class JobRegistry {
                     entry.spanBuffer.push(span);
                     lastTool = { name: span.tool, at: span.endedAt };
                 },
+                beginToolWindow: () => toolSilence.open(),
                 onFollowUp: (items) => {
                     entry.followUpBuffer.push(...items);
                 },
@@ -338,6 +375,7 @@ export class JobRegistry {
             clearTimeout(inactivity);
             clearTimeout(cap);
             clearTimeout(coldStart);
+            toolSilence.stop();
             entry.abort = undefined;
             entry.heartbeatAt = Date.now();
         }
@@ -376,6 +414,15 @@ export class JobRegistry {
                 detail: redactSecrets(`Phase timings: ${phaseBreakdown || '(none)'}. ${breadcrumb}.${cold}`),
             };
         }
+        if (ctx.killReason === 'no-tool-progress') {
+            return {
+                // The breadcrumb carries the last completed tool, which is the whole diagnostic here:
+                // it names what the agent was doing when it stopped doing anything.
+                message: redactSecrets(`${toolSilenceAbortMessage(this.limits.toolSilenceMs)} (${breadcrumb})`),
+                cause: 'no-tool-progress',
+                detail: redactSecrets(`Phase timings: ${phaseBreakdown || '(none)'}. ${breadcrumb}.${cold}`),
+            };
+        }
         const raw = ctx.error instanceof Error ? ctx.error.message : String(ctx.error);
         // A thrown error tagged with a structured cause (a git op / an upstream API call) keeps
         // it; an untagged throw is a generic agent failure.

package/dist/structured-output.js

@@ -1,6 +1,7 @@
 import { redact, redactSecrets, secretsToRedact } from './redact.js';
 import { log } from './logger.js';
-import { PI_MAX_OUTPUT_TOKENS, phasedProxyBaseUrl } from './pi.js';
+import { phasedProxyBaseUrl } from './pi.js';
+import { PI_MAX_OUTPUT_TOKENS } from './pi-reduction.js';
 // A reusable abstraction for the "agent returns a structured JSON document as its
 // final assistant message" pattern (requirements, blueprint, merger — and any future
 // kind). An agent of this kind emits its result as text, not a tool call, and the

package/dist/tool-silence.d.ts

@@ -0,0 +1,74 @@
+/**
+ * The live window for ONE tool-reporting agent stream. Opened by the stream, beaten by each
+ * completed tool call, closed when the stream ends (cleanly or not) — so the window can never
+ * outlive the only thing able to reset it.
+ */
+export interface ToolProgressWindow {
+    /** A tool call completed: the only evidence this watchdog accepts as progress. */
+    toolCompleted(): void;
+    /** The stream ended; the window closes with it. Idempotent. */
+    close(): void;
+}
+/**
+ * A window that measures nothing: what the watchdog hands out when disabled, and what a producer
+ * substitutes when its caller wired no watchdog at all. Having one means every producer holds a
+ * real window and states its tool progress unconditionally, rather than guarding each call site
+ * with a `?.` that reads as though beating the window were optional.
+ */
+export declare const NO_TOOL_WINDOW: ToolProgressWindow;
+export interface ToolSilenceDeps {
+    /** The window length. `<= 0` disables the watchdog entirely (every window is inert). */
+    windowMs: number;
+    /**
+     * When the run last produced ANY output, or undefined if it never has — the same clock the
+     * inactivity watchdog resets on. Read at EXPIRY (see {@link ToolSilenceWatchdog.open}), which
+     * is what keeps this watchdog off the gone-quiet case.
+     */
+    lastActivityAt: () => number | undefined;
+    /** Called when a window expires with the run demonstrably still talking. */
+    onExpired: () => void;
+}
+/**
+ * Hands out {@link ToolProgressWindow}s and fires `onExpired` for one that goes a full window
+ * without a completed tool call while the run keeps producing output.
+ *
+ * ONE window is open at a time (a job runs one agent stream at a time, and a repair loop runs
+ * them in sequence). Opening a second supersedes the first, and a superseded handle's calls are
+ * ignored rather than reaching back into the live window — a stale `close()` from a stream that
+ * finished after its successor started would otherwise disarm the watchdog for the rest of the job.
+ */
+export declare class ToolSilenceWatchdog {
+    private readonly deps;
+    private timer;
+    /** Identity of the window currently open; every handout takes the next number. */
+    private openId;
+    /** When the live window was last armed — the start of the span `onExpired` is a verdict about. */
+    private armedAt;
+    constructor(deps: ToolSilenceDeps);
+    /** Open a window for one agent stream. Returns an inert handle when the watchdog is disabled. */
+    open(): ToolProgressWindow;
+    /** Disarm for good (the job settled). Safe to call with no window open. */
+    stop(): void;
+    private arm;
+    /**
+     * A window elapsed with no completed tool call. Fire ONLY if the run was talking through it.
+     *
+     * `no-tool-progress` claims something specific — output arrived, but nothing got done — and
+     * that is only a truthful reading when output actually arrived DURING the window that just
+     * expired. A window that passed in total silence is the INACTIVITY watchdog's fact, whose
+     * diagnostic ("the container went quiet") is the one an operator can act on; relabelling it as
+     * a rabbit-hole would send them looking at the model instead of at the hang.
+     *
+     * This is a structural guard, not a tie-breaker: the two timers anchor on different events (the
+     * last tool call vs the last byte of output), so no arithmetic between the two window LENGTHS
+     * can order them. Equal windows put the tool-silence anchor strictly earlier — it fires first —
+     * and an operator setting `JOB_TOOL_SILENCE_MS` below `JOB_INACTIVITY_MS` gets that on every
+     * quiet run. Deciding from what the expired window actually SAW is independent of both numbers.
+     *
+     * A deferred window re-arms rather than standing down, so a run that goes quiet and then
+     * resumes its monologue is still caught, one full window later. The deferral terminates:
+     * either output resumes (the next expiry has output in its window and fires) or it does not
+     * (inactivity fires).
+     */
+    private expire;
+}

package/dist/tool-silence.js

@@ -0,0 +1,99 @@
+// The tool-silence watchdog (stuck-run audit F13): the third bound on a job, and the only one
+// that can see a model which keeps TALKING while completing nothing. Its output resets the
+// inactivity timer on every chunk, and it is nowhere near the wall-clock cap.
+//
+// WHY THIS IS ITS OWN MODULE — the window is only meaningful while something that REPORTS
+// completed tool calls is running, and only that producer knows whether it does. Keying the
+// window on the job's coarse phase label instead looked equivalent and was not: `agent` is a
+// telemetry breadcrumb several call sites mark for several different things (a Codex pass, a
+// tool-less inline completion, the label restored around a repair loop's shell commands), so a
+// phase-armed window spent most of its time armed over work that could not possibly reset it.
+// The producer opens its own window instead, which makes "armed" and "can beat" the same fact by
+// construction rather than by two call sites agreeing.
+/**
+ * A window that measures nothing: what the watchdog hands out when disabled, and what a producer
+ * substitutes when its caller wired no watchdog at all. Having one means every producer holds a
+ * real window and states its tool progress unconditionally, rather than guarding each call site
+ * with a `?.` that reads as though beating the window were optional.
+ */
+export const NO_TOOL_WINDOW = { toolCompleted: () => { }, close: () => { } };
+/**
+ * Hands out {@link ToolProgressWindow}s and fires `onExpired` for one that goes a full window
+ * without a completed tool call while the run keeps producing output.
+ *
+ * ONE window is open at a time (a job runs one agent stream at a time, and a repair loop runs
+ * them in sequence). Opening a second supersedes the first, and a superseded handle's calls are
+ * ignored rather than reaching back into the live window — a stale `close()` from a stream that
+ * finished after its successor started would otherwise disarm the watchdog for the rest of the job.
+ */
+export class ToolSilenceWatchdog {
+    deps;
+    timer;
+    /** Identity of the window currently open; every handout takes the next number. */
+    openId = 0;
+    /** When the live window was last armed — the start of the span `onExpired` is a verdict about. */
+    armedAt = 0;
+    constructor(deps) {
+        this.deps = deps;
+    }
+    /** Open a window for one agent stream. Returns an inert handle when the watchdog is disabled. */
+    open() {
+        if (this.deps.windowMs <= 0)
+            return NO_TOOL_WINDOW;
+        const id = ++this.openId;
+        this.arm();
+        const live = () => this.openId === id;
+        return {
+            toolCompleted: () => {
+                if (live())
+                    this.arm();
+            },
+            close: () => {
+                if (!live())
+                    return;
+                // Retire the id as well as the timer, so a late `toolCompleted()` from this stream
+                // cannot re-arm a window whose producer has already gone.
+                this.openId++;
+                this.stop();
+            },
+        };
+    }
+    /** Disarm for good (the job settled). Safe to call with no window open. */
+    stop() {
+        clearTimeout(this.timer);
+        this.timer = undefined;
+    }
+    arm() {
+        clearTimeout(this.timer);
+        this.armedAt = Date.now();
+        this.timer = setTimeout(() => this.expire(), this.deps.windowMs);
+    }
+    /**
+     * A window elapsed with no completed tool call. Fire ONLY if the run was talking through it.
+     *
+     * `no-tool-progress` claims something specific — output arrived, but nothing got done — and
+     * that is only a truthful reading when output actually arrived DURING the window that just
+     * expired. A window that passed in total silence is the INACTIVITY watchdog's fact, whose
+     * diagnostic ("the container went quiet") is the one an operator can act on; relabelling it as
+     * a rabbit-hole would send them looking at the model instead of at the hang.
+     *
+     * This is a structural guard, not a tie-breaker: the two timers anchor on different events (the
+     * last tool call vs the last byte of output), so no arithmetic between the two window LENGTHS
+     * can order them. Equal windows put the tool-silence anchor strictly earlier — it fires first —
+     * and an operator setting `JOB_TOOL_SILENCE_MS` below `JOB_INACTIVITY_MS` gets that on every
+     * quiet run. Deciding from what the expired window actually SAW is independent of both numbers.
+     *
+     * A deferred window re-arms rather than standing down, so a run that goes quiet and then
+     * resumes its monologue is still caught, one full window later. The deferral terminates:
+     * either output resumes (the next expiry has output in its window and fires) or it does not
+     * (inactivity fires).
+     */
+    expire() {
+        const lastActivityAt = this.deps.lastActivityAt();
+        if (lastActivityAt === undefined || lastActivityAt <= this.armedAt) {
+            this.arm();
+            return;
+        }
+        this.deps.onExpired();
+    }
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cat-factory/executor-harness",
-  "version": "1.96.0",
+  "version": "1.98.0",
   "description": "Container payload: a thin TypeScript wrapper that runs the Pi coding agent against a cloned repo and opens a PR. Runs in the Cloudflare Container (and, in local native mode, as a host process); carries no secrets.",
   "repository": {
     "type": "git",
@@ -30,9 +30,9 @@
     "hono": "^4.13.0",
     "typescript": "7.0.2",
     "vitest": "^4.1.10",
-    "@cat-factory/kernel": "0.264.0",
-    "@cat-factory/server": "0.244.0",
-    "@cat-factory/spend": "0.15.32"
+    "@cat-factory/kernel": "0.267.0",
+    "@cat-factory/server": "0.247.0",
+    "@cat-factory/spend": "0.15.35"
   },
   "scripts": {
     "build": "tsc -p tsconfig.json",

package/src/agent-runner.ts

@@ -9,17 +9,18 @@ import {
   type TrackedToolCall,
   recordClaudeToolResults,
 } from './tool-trajectory.js'
-import type { Logger } from './logger.js'
+import { log, type Logger } from './logger.js'
+import { NO_TOOL_WINDOW, type ToolProgressWindow } from './tool-silence.js'
 import {
   createCallMetricPublisher,
   publishCallMetric,
   type CallMetricPublisher,
   type HarnessCallMetric,
   type PiRunOutcome,
-  type PiRunStats,
   type TodoProgress,
   type ToolSpan,
 } from './pi.js'
+import type { PiRunStats } from './pi-reduction.js'
 import {
   claudeAllowedToolPatterns,
   codexMcpConfigToml,
@@ -31,6 +32,7 @@ import {
   type SkillSpec,
 } from './agent-capabilities.js'
 import { ProgressGuard, type ProgressGuardLimits } from './progress-guard.js'
+import { BoundedTail, JsonlLineReader } from './jsonl-stream.js'
 import { killChildProcess, spawnDetached } from './process.js'
 import { describeProcessExit } from './process-exit.js'
 import { redact, registerKnownSecrets, secretsToRedact } from './redact.js'
@@ -138,6 +140,18 @@ export interface SubscriptionRunOptions {
    * DID dies with the container.
    */
   onSpan?: (span: ToolSpan) => void
+  /**
+   * Opens this stream's tool-silence window (see `RunOptions.beginToolWindow`), closed when the
+   * CLI exits. Both subscription CLIs report tool activity — claude-code on the `tool_result`
+   * turn that answers each call, codex on its tool/command/exec events — so a window either
+   * opens is one the run can beat. It is deliberately NOT tied to {@link onSpan}: the trajectory
+   * is an observability opt-in, and the codex stream produces none at all while still doing tool
+   * work, which a span-keyed window would have read as a run making no progress.
+   *
+   * A caller with no tool loop (the inline one-shot completion) passes nothing; see the note at
+   * `handleInline`.
+   */
+  beginToolWindow?: () => ToolProgressWindow
   /**
    * Called with the FULL set of per-slice reviews each time one lands, so the backend can persist
    * a parallel review's completed work as it happens instead of only from the terminal result.
@@ -227,9 +241,10 @@ function streamCli(
     child.stdin.on('error', () => {})
     child.stdin.end(prompt)
 
-    let stderr = ''
+    // 8 KB is well over the 700 B tail anyone quotes below, and the CLI's stderr is diagnostic
+    // noise rather than a product, so a bounded tail is all this ever needed to be.
+    const stderr = new BoundedTail(8_000)
     let aborted = false
-    let lineBuffer = ''
 
     const killChild = (): void => killChildProcess(child)
 
@@ -253,16 +268,9 @@ function streamCli(
       }
     }
 
-    const consumeStdout = (text: string): void => {
-      lineBuffer += text
-      let nl = lineBuffer.indexOf('\n')
-      while (nl !== -1) {
-        const line = lineBuffer.slice(0, nl).trim()
-        lineBuffer = lineBuffer.slice(nl + 1)
-        nl = lineBuffer.indexOf('\n')
-        processLine(line)
-      }
-    }
+    // Bounded framing, shared with `runPi`: an unterminated record must not be able to grow
+    // until parsing it stalls the loop the watchdogs and poll handlers run on (audit F6).
+    const reader = new JsonlLineReader(processLine)
 
     const onAbort = (): void => {
       aborted = true
@@ -272,12 +280,11 @@ function streamCli(
 
     child.stdout.on('data', (chunk: Buffer) => {
       opts.onActivity?.()
-      consumeStdout(chunk.toString())
+      reader.push(chunk.toString())
     })
     child.stderr.on('data', (chunk: Buffer) => {
       opts.onActivity?.()
-      stderr += chunk.toString()
-      if (stderr.length > 8_000) stderr = stderr.slice(-8_000)
+      stderr.push(chunk.toString())
     })
 
     child.on('error', (err) => {
@@ -286,8 +293,19 @@ function streamCli(
     })
     child.on('close', (code, signal) => {
       opts.signal?.removeEventListener('abort', onAbort)
-      const stderrTail = redact(stderr, secrets).slice(-700)
-      if (lineBuffer.trim()) processLine(lineBuffer.trim(), true)
+      const stderrTail = redact(stderr.toString(), secrets).slice(-700)
+      reader.flush()
+      // Surface an oversized record the reader refused to buffer ONCE (a count, not per line),
+      // for the same reason `runPi` does: a dropped record costs this run its progress, its
+      // trajectory and its per-call telemetry for that turn, and a silent loss reads exactly
+      // like a CLI that never emitted it. Falls back to the module logger so the report cannot
+      // depend on a caller having wired a per-job one.
+      if (reader.droppedLines > 0) {
+        ;(opts.log ?? log).warn('agent CLI: skipped oversized JSONL records', {
+          command,
+          oversizedLines: reader.droppedLines,
+        })
+      }
       if (aborted) {
         // Carry the tail on the rejection so a caller that REPLACES this generic message with a
         // more specific cause (the no-progress guard's diagnostic) can still append it — the
@@ -659,6 +677,25 @@ function createClaudeToolTrajectory(
   }
 }
 
+/**
+ * Open this run's tool-silence window, or the inert one when the caller wired no watchdog. One
+ * definition so both runners resolve "is there a watchdog?" identically, and so neither carries
+ * the optional-call noise at the point where it should simply have a window.
+ */
+function openToolWindow(opts: SubscriptionRunOptions): ToolProgressWindow {
+  return opts.beginToolWindow ? opts.beginToolWindow() : NO_TOOL_WINDOW
+}
+
+/**
+ * Whether a claude-code `user` turn carries a `tool_result` block, i.e. whether a tool call just
+ * COMPLETED — the progress the tool-silence watchdog measures. Tested explicitly rather than
+ * taken from "the model sent a user turn", which a plain follow-up prompt also is: a watchdog
+ * reset handed out for work that did nothing is the same as no watchdog.
+ */
+function carriesToolResult(content: unknown[]): boolean {
+  return content.some((block) => isObject(block) && block.type === 'tool_result')
+}
+
 export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRunOutcome> {
   const stats: PiRunStats = { toolCalls: 0, assistantChars: 0 }
   let summary = ''
@@ -739,6 +776,9 @@ export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRun
   const progressGuard = createClaudeProgressGuard(opts)
   const { rememberTool, feedGuard, guardAbort } = progressGuard
   const trajectory = createClaudeToolTrajectory(opts, secrets)
+  // This stream's tool-silence window; opened just before the CLI starts and closed in the
+  // `finally` below, so it can only ever be armed while the CLI it watches is running.
+  let toolWindow: ToolProgressWindow = NO_TOOL_WINDOW
 
   const onEvent = (event: Record<string, unknown>, meta?: { final?: boolean }): void => {
     const type = event.type
@@ -776,6 +816,7 @@ export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRun
       // tool_result blocks the harness fed back to the model — part of the next prompt.
       const content = (event.message as Record<string, unknown>).content
       if (Array.isArray(content)) {
+        if (carriesToolResult(content)) toolWindow.toolCompleted()
         sliceTracker.onUser(content)
         planTracker.onUser(content)
         emitProgress()
@@ -824,6 +865,9 @@ export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRun
     ? AbortSignal.any([opts.signal, guardAbort.signal])
     : guardAbort.signal
 
+  // Opened around the CLI itself, not around this function: everything above is per-run setup
+  // (the config home, the skills, the MCP config) which completes no tool calls by nature.
+  toolWindow = openToolWindow(opts)
   try {
     const { stderrTail } = await streamCli(
       {
@@ -895,6 +939,7 @@ export async function runClaudeCode(opts: SubscriptionRunOptions): Promise<PiRun
     }
     throw withAgentReport(err, terminalReport, secrets)
   } finally {
+    toolWindow.close()
     await subagents?.stop()
     await home.dispose()
   }
@@ -1097,6 +1142,30 @@ function claudeUsage(raw: unknown): { inputTokens: number; outputTokens: number
 // Codex
 // ---------------------------------------------------------------------------
 
+/**
+ * The assistant text a codex event carries, or `''`. Two shapes because the CLI changed its
+ * stream between versions and the harness serves both: the flat `agent_message*` events and the
+ * newer `item.completed` envelope around a message item.
+ */
+function codexAssistantText(event: Record<string, unknown>, type: string): string {
+  const isMessage =
+    type.includes('agent_message') || (type === 'item.completed' && isCodexMessageItem(event))
+  return (isMessage ? extractText(event) : '') ?? ''
+}
+
+/**
+ * Whether a codex event reports tool activity — a substring test because the CLI names these
+ * events differently across versions (`exec_command_end`, `item.*` around a command execution,
+ * `tool_*`) and the harness cares only that SOMETHING ran.
+ *
+ * This is also the tool-silence watchdog's only signal on this stream. Codex exposes no
+ * structured tool bodies, so `runCodex` produces no `ToolSpan` at all, and a window keyed on the
+ * trajectory would have force-failed every codex pass that outran it while the run was working.
+ */
+function isCodexToolActivity(type: string): boolean {
+  return type.includes('tool') || type.includes('command') || type.includes('exec')
+}
+
 /**
  * Run the Codex CLI headlessly against `opts.cwd`, authenticated with the leased
  * ChatGPT `auth.json` bundle written to an isolated CODEX_HOME, talking direct to
@@ -1158,6 +1227,9 @@ export async function runCodex(opts: SubscriptionRunOptions): Promise<PiRunOutco
   // context into the prompt itself (Claude Code instead rides --append-system-prompt,
   // falling back to this same fold when the prompt overflows argv).
   const prompt = foldSystemPrompt(opts.systemPrompt, opts.userPrompt)
+  // This stream's tool-silence window (see the claude runner for the shape); opened just before
+  // the CLI starts and closed in the `finally` below.
+  let toolWindow: ToolProgressWindow = NO_TOOL_WINDOW
 
   // Codex's `exec --json` is far thinner than Claude Code's stream: it surfaces only
   // flat assistant text and (on `token_count` events) the per-turn `last_token_usage`
@@ -1171,19 +1243,15 @@ export async function runCodex(opts: SubscriptionRunOptions): Promise<PiRunOutco
 
   const onEvent = (event: Record<string, unknown>): void => {
     const type = typeof event.type === 'string' ? event.type : ''
-    if (
-      type.includes('agent_message') ||
-      (type === 'item.completed' && isCodexMessageItem(event))
-    ) {
-      const text = extractText(event)
-      if (text) {
-        stats.assistantChars += text.length
-        summary = text
-        pendingText = text
-      }
+    const text = codexAssistantText(event, type)
+    if (text) {
+      stats.assistantChars += text.length
+      summary = text
+      pendingText = text
     }
-    if (type.includes('tool') || type.includes('command') || type.includes('exec')) {
+    if (isCodexToolActivity(type)) {
       stats.toolCalls += 1
+      toolWindow.toolCompleted()
     }
     const progress = codexPlanProgress(event)
     if (progress && opts.onProgress) opts.onProgress(progress)
@@ -1214,6 +1282,7 @@ export async function runCodex(opts: SubscriptionRunOptions): Promise<PiRunOutco
     }
   }
 
+  toolWindow = openToolWindow(opts)
   try {
     const { stderrTail } = await streamCli(
       {
@@ -1281,6 +1350,7 @@ export async function runCodex(opts: SubscriptionRunOptions): Promise<PiRunOutco
     // stream, not on stderr — so a bad exit carries the last thing the agent said.
     throw withAgentReport(err, summary, secrets)
   } finally {
+    toolWindow.close()
     if (codexHome) {
       // Lift the CLI session transcripts (`sessions/`) out for short-lived retention BEFORE the
       // home is deleted — the credential (`auth.json`) lives at the home root, never in

package/src/agent.ts

@@ -27,7 +27,7 @@ import {
   unmergedPaths,
 } from './git.js'
 import { inferVcsProvider, openPullRequest } from './vcs-api.js'
-import type { PiRunStats, RunDiagnostics } from './pi.js'
+import type { PiRunStats, RunDiagnostics } from './pi-reduction.js'
 import { applyPrDescription } from './pr-description.js'
 import {
   makeDirClaimer,

package/src/bootstrap-mode.ts

@@ -1,7 +1,7 @@
 import { opendir } from 'node:fs/promises'
 import { join } from 'node:path'
 import type { AgentJob, AgentResult } from './job.js'
-import type { PiRunStats } from './pi.js'
+import type { PiRunStats } from './pi-reduction.js'
 import type { RunOptions } from './runner.js'
 import {
   NEVER_ACTED_CAUSE,
@@ -101,6 +101,7 @@ export async function runBootstrap(job: AgentJob, opts: RunOptions): Promise<Age
       dir,
       target: boot.target,
       ghToken: job.ghToken,
+      signal,
       message: fromScratch
         ? 'Bootstrap new repository'
         : `Bootstrap from ${job.repo.owner}/${job.repo.name}`,

package/src/coding-agent.ts

@@ -30,7 +30,8 @@ import {
 } from './git.js'
 import { openPullRequest } from './vcs-api.js'
 import { FOLLOW_UPS_FILENAME, FollowUpTailer } from './follow-ups.js'
-import type { HarnessCallMetric, PiRunStats } from './pi.js'
+import type { HarnessCallMetric } from './pi.js'
+import type { PiRunStats } from './pi-reduction.js'
 import { EFFORT_REPORT_FILE, type EffortReport } from './effort.js'
 import {
   type AgentPrDescription,