@commonlyai/cli 0.1.197 → 0.1.199

package/node_modules/@commonlyai/seats/README.md

@@ -20,6 +20,6 @@ It is private and is not published on its own. `@commonlyai/cli` depends on it a
 
 **Rule:** nothing here imports Commonly code. An adapter that needs Commonly policy (the memory preamble, the legacy sandbox-trust names, the fleet seat-model switch) takes it as a host object through its factory, for example `createHermesAdapter(host)`. The CLI binds that host in `cli/src/lib/adapters/<name>.js`. `cli/__tests__/seats-package.test.mjs` enforces the import rule and checks that the tarball carries every source file.
 
-The extraction plan is D62, extract-in-place.
+The extraction plan is extract-in-place.
 
 **Run record.** The trace store writes each run as a versioned, hash-chained JSONL record. It covers who granted which agent what access for which task, who approved each call, what was attempted, and the result. A tool outside this package can read, verify and export it to OTLP. The format is specified in [`docs/record-v1.md`](docs/record-v1.md), and a generated sample is in [`docs/examples/`](docs/examples/).

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@commonlyai/cli",
-  "version": "0.1.197",
+  "version": "0.1.199",
   "license": "Apache-2.0",
   "description": "The Commonly CLI — connect agents, manage pods, iterate fast",
   "type": "module",

package/src/commands/agent.js

@@ -178,8 +178,7 @@ export const NO_AGENT_CLI_CODE = 'no_agent_cli';
  * workspace, and an environment that is absent or enforces nothing (a record
  * from before bootstrap applied the default, or one attached without an
  * environment file). Such a record is told how to pick the default up; it is
- * not rewritten here (Cofounder, 2026-10-16: none were found outside our own
- * tests).
+ * not rewritten here.
  */
 export const savedSeatLacksDefaultSandbox = (record) => Boolean(record)
   && ADAPTERS_WITH_DEFAULT_SANDBOX.has(record.adapter)
@@ -717,7 +716,7 @@ export const assertSandboxDeclaredForPublicPod = async ({
     );
   }
 
-  // Normalized FIRST (Vera 71715, Wren 71718): the predicate below reads a
+  // Normalized FIRST: the predicate below reads a
   // legacy `internal` record as the `public` it means, the same mapping the
   // attach gate and both adapters use. Reading it raw refused a record that
   // means public one call before the gate #1840 fixes — TASK-113 claims
@@ -904,7 +903,7 @@ export const updateAgentConfiguration = async ({
  * The sandbox an attach will actually run under — derived, then gated.
  *
  * The trust is normalized ONCE, before it is used for anything. A stored
- * `internal` means `public` (environment.js, Wren 69585), and resolving the mode
+ * `internal` means `public` (environment.js), and resolving the mode
  * off the raw value made this gate disagree with the adapters in BOTH
  * directions: `{ trust: 'internal' }` with no declared mode left the attach-time
  * mode at `'none'` and refused nothing here, and `internal` beside
@@ -917,8 +916,7 @@ export const updateAgentConfiguration = async ({
  * either way; what was wrong is that this gate's verdict contradicted theirs, and
  * its refusal for the `mode: 'none'` shape landed later, at adapter spawn, after
  * attach had already published and minted. Normalizing here makes the two agree
- * and puts the refusal where the user can see it (Kai, TASK-113; re-measured at
- * source after Vera 71664).
+ * and puts the refusal where the user can see it (TASK-113).
  *
  * Whether the resolved mode is AVAILABLE here — bwrap installed, macOS for
  * Seatbelt, the codex permission-profile version — is deliberately not this
@@ -932,7 +930,7 @@ export const updateAgentConfiguration = async ({
  * codex.js:546) and passed the normalized object on, which is why their suites
  * confined a legacy record all along; the grant-broker guard normalized for its
  * own trust check and then handed the resolver the raw object, so its symptom was
- * a false `sandbox_mode_unenforceable` refusal (Vera 71676). Both are settled on
+ * a false `sandbox_mode_unenforceable` refusal. Both are settled on
  * main now — the resolver reads the effective trust (mode.js:38) and the guard
  * imports the same reader from environment.js (grant-broker-guard.js:186) — so
  * this helper needs no coupling to them: it normalizes once, here, before its own
@@ -944,7 +942,7 @@ export const resolveAttachSandbox = ({
   // An adapter that enforces one confined shape of its own (dsh: Seatbelt with a
   // restricted network and NO trust) says so here, and its check is the one that
   // decides: the trust-keyed gates below cannot express that shape, so before
-  // this they refused the only environment dsh accepts (D106). The adapter's
+  // this they refused the only environment dsh accepts. The adapter's
   // check throws on every other shape, so this admits nothing it would refuse.
   if (typeof adapter?.confinesOwnSandbox === 'function' && adapter.confinesOwnSandbox(environment)) {
     return { mode: environment.sandbox.mode, trust: environment.sandbox.trust };
@@ -967,7 +965,7 @@ export const resolveAttachSandbox = ({
       `sandbox.trust=${trust} requires an enforced sandbox mode; refusing to attach unsandboxed`,
     );
   }
-  // Moved in from the call site (Vera 71675): this is the check the raw compare
+  // Moved in from the call site: this is the check the raw compare
   // used to fail closed on, refusing `internal` beside `mode: 'workspace'`. It is
   // pure — a mode and an adapter name — so it belongs with the derivation, and
   // its witnesses live beside it.
@@ -1490,7 +1488,7 @@ export const performRun = ({
   // (`daemon-supervisor.js`); this is the same predicate at the only other site
   // that can see the record — same code, so one refusal with two emitters.
   //
-  // IN MEMORY, RECORD UNTOUCHED (wren 71641): the withheld environment is what
+  // IN MEMORY, RECORD UNTOUCHED: the withheld environment is what
   // the adapter spawns with, and the stored record keeps its broker, so the
   // daemon stays the layer that judges a host it knows. Applied once for the
   // run rather than per turn: `agent run` reads its record once at boot.
@@ -1903,7 +1901,7 @@ export const performRun = ({
     const memoryWithheld = Boolean(placement.reason);
     const memoryLongTerm = memoryWithheld ? undefined : await readLongTerm(client, { onError });
 
-    // Sharpen TASK-129: focus is a turn-start read, not an enqueue-time
+    // TASK-129: focus is a turn-start read, not an enqueue-time
     // snapshot. Read through the authorized runtime context route immediately
     // before spawn so queued events observe the current revision. The helper
     // disables pod-skill synthesis and throws on failure; the surrounding
@@ -1997,8 +1995,8 @@ export const performRun = ({
     try {
       opened = await lease.open();
     } catch (err) {
-      // A VERDICT IS NOT A CRASH, AND IT IS NOT A NO-OP (wren 72153, vera
-      // 72157). Letting it escape as a bare throw left `turnResult` undefined,
+      // A VERDICT IS NOT A CRASH, AND IT IS NOT A NO-OP.
+      // Letting it escape as a bare throw left `turnResult` undefined,
       // so `claimReleaseFor` returned the legacy holder-only DELETE — right for
       // a transient failure, wrong for a refusal that recurs on every
       // redelivery: the wake loops forever with one local log line as its only
@@ -2409,7 +2407,7 @@ export const performRun = ({
     // its batch and chose silence; one that printed nothing may have crashed,
     // timed out or lost its route without saying so. The bare `no_action`
     // stays the sentinel's alone, because a digest counts as read only on
-    // that (sable, #2753). Release, hand-off and spawn counting treat
+    // that (#2753). Release, hand-off and spawn counting treat
     // `empty-output` exactly as they treat a bare decline.
     if (!delivered && !replyText) return { outcome: 'no_action', reason: EMPTY_OUTPUT };
     return { outcome: delivered ? 'posted' : 'no_action' };

package/src/lib/adapters/claude.js

@@ -1,6 +1,11 @@
 import { claudeRuntimeInventory } from '../native-runtime-inventory.js';
 import { observeSpawn, controlsFromArguments } from '../runtime-observation.js';
-import { spawnInOwnGroup, wantsOwnProcessGroup } from '@commonlyai/seats/process-group';
+import {
+  firstOutputWindowMs, killStallSurvivors, physicalPath, spawnStalledError, STALL_KILL_GRACE_MS, watchFirstOutput,
+} from '../first-output-watchdog.js';
+import {
+  descendantsOf, killProcessTree, readProcessTable, spawnInOwnGroup, wantsOwnProcessGroup,
+} from '@commonlyai/seats/process-group';
 /**
  * claude adapter — wraps the local `claude` CLI as a Commonly agent.
  *
@@ -88,7 +93,7 @@ import {
   prepareMcpSpawn, PUBLIC_MCP_UNAVAILABLE_CODE, publicMcpUnavailableError, selectedMcpVersionDir,
 } from '../mcp-home.js';
 import { buildMemoryPreamble, ROW_SLICING_CUE } from '../memory-bridge.js';
-import { claudeConfigDirFor, claudeContextTokens } from '../session-recycle.js';
+import { claudeConfigDirFor, claudeContextTokens, claudeTranscriptPath } from '../session-recycle.js';
 import { skillsAsText } from '../skill-prompt.js';
 import { adapterFailure, spawnCredentials } from '../upstream-refusal.js';
 
@@ -105,8 +110,8 @@ const DEFAULT_TIMEOUT_MS = (() => {
 
 const buildPrompt = buildMemoryPreamble;
 
-// The working habits a private claude seat is taught on a fresh session (D48,
-// TASK-545). Parallel reads live here because only this CLI has a subagent
+// The working habits a private claude seat is taught on a fresh session
+// (TASK-545). Parallel reads live here because only this CLI has a subagent
 // tool; codex is passed row slicing alone. A public seat is passed neither: its
 // argv allows Read and the MCP under dontAsk, so it has no subagent to spawn,
 // and it answers strangers rather than working board rows.
@@ -484,7 +489,11 @@ const publicSkillPromptArgs = async (skillSources) => {
 
 // `ownGroup` is set only under the run supervisor, which kills the child's
 // whole group; unsupervised, the spawn options are exactly what they were.
-const runClaude = ({ cmd, args, cwd, env, timeoutMs, credentials = [], spawnImpl = childSpawn, onSpawn, controls = {}, ownGroup = false }) => new Promise((resolve, reject) => {
+const runClaude = ({
+  cmd, args, cwd, env, timeoutMs, credentials = [], spawnImpl = childSpawn, onSpawn, controls = {}, ownGroup = false,
+  transcriptPath = null, firstOutputMs = firstOutputWindowMs(), lockProbe, stallKillGraceMs = STALL_KILL_GRACE_MS,
+  processTable = readProcessTable, survivorIo,
+}) => new Promise((resolve, reject) => {
   const proc = spawnInOwnGroup(spawnImpl, cmd, args, {
     cwd,
     env,
@@ -499,15 +508,57 @@ const runClaude = ({ cmd, args, cwd, env, timeoutMs, credentials = [], spawnImpl
     timedOut = true;
     proc.kill('SIGTERM');
   }, timeoutMs);
+  // A turn that never starts is killed long before the run timeout.
+  let stalled = null;
+  let stallKill = null;
+  let stallSnapshot = [];
+  // SIGKILL snapshotted descendants that are still alive. Safe to repeat. It
+  // runs when the spawn exits, at the grace deadline and on close: a survivor
+  // still holding the spawn's stdout or stderr keeps close from ever firing,
+  // and once the spawn is reaped killProcessTree can no longer reach it.
+  const sweepStallSurvivors = () => {
+    if (stalled) killStallSurvivors(stallSnapshot, survivorIo);
+  };
+  const treeIo = (table) => ({ table, ...(survivorIo?.read ? { read: survivorIo.read } : {}) });
+  const watchdog = watchFirstOutput({
+    proc,
+    windowMs: firstOutputMs,
+    transcriptPath,
+    lockProbe,
+    onStall: (reason) => {
+      stalled = spawnStalledError({ label: 'claude', windowMs: firstOutputMs, reason });
+      // Snapshot the descendants first: once the spawn exits they are
+      // reparented and can no longer be found from it.
+      const table = Number.isInteger(proc.pid) ? processTable() : null;
+      if (table) stallSnapshot = descendantsOf(table, proc.pid);
+      killProcessTree(proc, 'SIGTERM', treeIo(() => table));
+      // A process parked in a system call may not act on SIGTERM. SIGKILL the
+      // child, its group when it leads one, and its descendants.
+      stallKill = setTimeout(() => {
+        killProcessTree(proc, 'SIGKILL', treeIo(processTable));
+        sweepStallSurvivors();
+      }, stallKillGraceMs);
+      stallKill.unref?.();
+    },
+  });
+  proc.on('exit', sweepStallSurvivors);
 
   proc.stdout?.on('data', (chunk) => { stdout += chunk.toString(); });
   proc.stderr?.on('data', (chunk) => { stderr += chunk.toString(); });
   proc.on('error', (err) => {
     clearTimeout(timer);
+    clearTimeout(stallKill);
+    watchdog.stop();
     reject(err);
   });
   proc.on('close', (code) => {
     clearTimeout(timer);
+    clearTimeout(stallKill);
+    watchdog.stop();
+    if (stalled) {
+      sweepStallSurvivors();
+      return reject(stalled);
+    }
     if (timedOut) return reject(new Error(`claude timed out after ${timeoutMs}ms`));
     if (code !== 0) {
       // Report stdout too, not just stderr. In `-p` mode claude writes terminal
@@ -841,7 +892,7 @@ const prepareArgv = async (innerArgv, ctx) => {
   // A public trust is ONE contract on both platforms: the jail bounds the
   // filesystem and the policy bounds the tools. The bwrap branch below used to
   // get the jail only — a derived Linux seat kept Bash/Write/WebFetch and ran on
-  // the operator's own Claude settings inside the namespace (Vera 69578).
+  // the operator's own Claude settings inside the namespace.
   const publicBwrapSandbox = sandboxTrust === 'public' && sandboxMode === 'bwrap';
   // A workspace seat on Linux: the same jail, with the workspace tier's policy
   // and a HOME of its own outside the project.
@@ -867,7 +918,7 @@ const prepareArgv = async (innerArgv, ctx) => {
   // above; anything else that lands here (the literal 'none', a typo, a
   // non-string) used to fall through to the bare `claude` spawn below — an
   // unconfined seat with a public record, which is how a record can claim
-  // confinement it never applies (Vera 69548).
+  // confinement it never applies.
   if (isConfinedTrust(sandboxTrust) && !publicNativeSandbox && sandboxMode !== 'bwrap') {
     throw new Error(
       `${sandboxTrust} Claude agents require an enforced sandbox mode `
@@ -929,7 +980,7 @@ const prepareArgv = async (innerArgv, ctx) => {
   if (publicBwrapSandbox || workspaceBwrapSandbox) {
     // The mode is chosen here, so the mechanism is verified here: a missing
     // bwrap must fail the seat's derivation with an actionable message, not
-    // every one of its spawns with a bare ENOENT (Wren 69586). On a non-Linux
+    // every one of its spawns with a bare ENOENT. On a non-Linux
     // host this reports the macOS-only message, same as the wrapper would.
     const bwrap = (ctx._detectBwrap || detectBwrap)();
     if (!bwrap.available) {
@@ -1043,7 +1094,7 @@ export default {
     const seatModel = requireSeatModel(rawCtx.environment, 'claude');
     // `sandbox.trust: 'internal'` is refused for new declarations and read as
     // `public` for a record that already carries it; such a seat is confined
-    // where it can be and refuses to derive where it cannot (Wren 69585).
+    // where it can be and refuses to derive where it cannot.
     // Resolved ONCE here and threaded to BOTH consumers — the public-state
     // preparation below and the argv builder — because two independent reads of
     // one declaration is exactly how this seat crashed with "public Claude
@@ -1091,9 +1142,9 @@ export default {
     // present in one but not the other means a retry silently runs a different
     // model than the turn it is replacing — the same drifting-copy shape that
     // has bitten this codebase repeatedly.
-    // `effort` rides in the same array for the same reason: Sam's 2026-09-01
-    // order ("flip all fable agents into fable 5.1 with high or above
-    // effort") needs both facts to reach every spawn, including the
+    // `effort` rides in the same array for the same reason: an order
+    // like "flip all fable agents into fable 5.1 with high or above
+    // effort" needs both facts to reach every spawn, including the
     // session-recovery retry, or a retry runs at a different effort than the
     // turn it replaces.
     const modelArgs = [
@@ -1133,7 +1184,7 @@ export default {
       // Trust is normalized at entry (legacy `internal` reads as public). The
       // MCP policy follows trust alone, whatever confines the seat: a public
       // bwrap seat needs a host-prepared build exactly as a Seatbelt one does
-      // (Rhea on #2247).
+      // (#2247).
       if (publicNativeSandbox) {
         publicClaudeState = await preparePublicClaudeState(ctx);
       } else if (workspaceBwrapSandbox) {
@@ -1200,6 +1251,13 @@ export default {
         credentials: spawnCredentials(spawnCtx),
         spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(modelArgs, { modelFlag: '--model', effortFlag: '--effort' }), // test seam only — do not use in production
         ownGroup: wantsOwnProcessGroup(ctx),
+        transcriptPath: claudeTranscriptPath({
+          cwd: physicalPath(ctx.cwd), sessionId, configDir: claudeConfigDirFor({ ...env, HOME: childHome || env?.HOME }),
+        }),
+        lockProbe: ctx._lockProbe, // test seams only
+        stallKillGraceMs: ctx._stallKillGraceMs,
+        processTable: ctx._processTable,
+        survivorIo: ctx._survivorIo,
       });
       // TASK-440: the context this turn left, read from the transcript the
       // child wrote under its own env (an isolated HOME for public seats).
@@ -1210,7 +1268,7 @@ export default {
     } catch (err) {
       // A public seat's refusal is not a session-store failure, whatever its
       // message happens to contain: it must reach the run loop, never the
-      // fresh-session retry below (Rhea on #2247).
+      // fresh-session retry below (#2247).
       if (err?.code === PUBLIC_MCP_UNAVAILABLE_CODE) throw err;
       // Self-heal against a corrupted session store. If the persisted id is
       // already in use (or claude has forgotten about it), discard it and
@@ -1256,6 +1314,14 @@ export default {
           credentials: spawnCredentials(retryCtx),
           spawnImpl: ctx._spawnImpl, onSpawn: ctx.onSpawn, controls: controlsFromArguments(modelArgs, { modelFlag: '--model', effortFlag: '--effort' }),
           ownGroup: wantsOwnProcessGroup(ctx),
+          transcriptPath: claudeTranscriptPath({
+            cwd: physicalPath(ctx.cwd), sessionId: freshId,
+            configDir: claudeConfigDirFor({ ...retry.env, HOME: retry.childHome || retry.env?.HOME }),
+          }),
+          lockProbe: ctx._lockProbe,
+          stallKillGraceMs: ctx._stallKillGraceMs,
+          processTable: ctx._processTable,
+          survivorIo: ctx._survivorIo,
         });
         const contextTokens = claudeContextTokens({
           cwd: ctx.cwd, sessionId: freshId,

package/src/lib/adapters/codex.js

@@ -115,7 +115,7 @@ const buildPrompt = buildMemoryPreamble;
 //     when they also carry a `command`. `auditDeclaredMcp` classifies by
 //     `transport` and never judges the command of an entry that declared an
 //     http one, so emitting it here executes a command the guard did not
-//     approve — the case Vera measured on 2026-09-18 (Connectors 69774).
+//     approve — a case measured on 2026-09-18.
 //   - Token-bearing values ride through `env_vars`, never a `-c ...env=...`
 //     argv override. Command lines are visible to other same-user processes
 //     unless the OS sandbox blocks process inspection; keeping bearer tokens
@@ -661,7 +661,7 @@ export default {
     // undefined and '' as absence itself; it does not need a guard, it needs
     // the value.
     //
-    // Codex has no subagent tool, so of D48's two habits (TASK-545) it is
+    // Codex has no subagent tool, so of the two habits (TASK-545) it is
     // taught row slicing alone; claude.js adds parallel reads. A public seat
     // answers strangers rather than working board rows, so it is taught neither.
     const fullPrompt = buildPrompt(prompt, ctx.memoryLongTerm, {

package/src/lib/adapters/dsh.js

@@ -59,7 +59,7 @@ export const assertPrivateDsh = (environment = {}) => { isConfinedDsh(environmen
  * The macOS developer tools a confined writer needs for git, granted read-only.
  * /usr/bin/git is an xcrun shim: inside the sandbox it cannot read the tools it
  * forwards to, so `git` fails with "No developer tools were found" and a writer
- * cannot commit (D106). Returns null when no tools are installed; the seat then
+ * cannot commit. Returns null when no tools are installed; the seat then
  * runs without git rather than failing.
  *
  * DEVELOPER_DIR and xcode-select are both settable by whoever starts the seat,
@@ -333,7 +333,7 @@ export default {
   requiresModel: true,
   name: 'dsh', runtimeType: 'dsh', supportsProvider: true,
 
-  // The attach gate defers to this for dsh's one confined shape (D106).
+  // The attach gate defers to this for dsh's one confined shape.
   confinesOwnSandbox: (environment) => isConfinedDsh(environment),
 
   async validateEnvironment(environment, workspacePath) {

package/src/lib/adapters/pi.js

@@ -100,7 +100,7 @@ const substitutePlaceholders = (value, ctx) => {
  * deliberately not friendlier than the guard's — a normalized `'HTTP'` or a
  * padded `' http '` is a shape the guard refuses as an unknown transport, and an
  * adapter that accepted one would be running something the guard never judged
- * (Vera, Connectors 69776). The schema admits `http`/`stdio`/`sse`
+ * The schema admits `http`/`stdio`/`sse`
  * (environment.js:236) and admits an ABSENT transport, which the guard reads as
  * stdio; that is what this reads too.
  */
@@ -129,8 +129,7 @@ const originOf = (value) => {
  * environment is not usable for this: the kernel keeps the copy the process was
  * started with, so a same-user child could read the token back with
  * `ps eww $PPID` / `/proc/$PPID/environ` even after the bridge deleted its own
- * copy — which is what the previous channel did, and the row this closes
- * (Vera, Connectors).
+ * copy — which is what the previous channel did, and the row this closes.
  *
  * WHICH shape an entry becomes is decided by `transport` — the same field, read
  * with the same default and the same exact comparison the daemon's
@@ -141,7 +140,7 @@ const originOf = (value) => {
  * `${COMMONLY_AGENT_TOKEN}` in the command is one of the known placeholders), and
  * a presence-classifier then ran that command as stdio with the real token
  * substituted. The guard's judgement and the adapter's disagreed, and the adapter
- * is what executes (Vera, Connectors 69774).
+ * is what executes.
  *
  * The http half also enforces the guard's own origin rule, so the HTTP half does
  * not depend on a guard that may not be on the machine: `auditDeclaredMcp`
@@ -153,7 +152,7 @@ const originOf = (value) => {
  *
  * The grant broker is refused outright, by PATH rather than by entry name: it is
  * the one http entry that carries authority rather than data, and pi confines on
- * no host. wren's ruling for TASK-063 (`isGrantBrokerUrl` in pi-mcp-client.mjs),
+ * no host. The ruling for TASK-063 (`isGrantBrokerUrl` in pi-mcp-client.mjs),
  * the daemon-side half of the same refusal the server makes at the projection —
  * this is the half that holds on deploy skew, when the row names no adapter for
  * the server to key on, and in any backend older than the refusal.
@@ -162,7 +161,7 @@ const originOf = (value) => {
  * a declared stdio command is executed with no allowlist check, here and in both
  * sibling adapters, so it depends entirely on the guard — `auditDeclaredMcp`
  * admits only the shipped commonly MCP server or a command already present in the
- * local record, and that rule exists nowhere else (Vera, 69778; TASK-069).
+ * local record, and that rule exists nowhere else (TASK-069).
  */
 export const resolveMcpServers = (mcpServers, ctx = {}) => {
   const carried = [];
@@ -295,7 +294,7 @@ export const sessionExists = async (sessionDir, sessionId) => {
  * one does not start.
  *
  * The trust is read THROUGH the legacy table (`effectiveSandboxTrust`), not
- * raw. A stored `internal` means `public` (Vera 69592, Wren 69585) and every
+ * raw. A stored `internal` means `public` and every
  * other gate in this package resolves it that way: the attach path
  * (`agent.js`), the mode resolver (`sandbox/mode.js`) and the grant-broker
  * guard. Reading it raw here made this gate the one site that failed OPEN — a

package/src/lib/daemon-supervisor.js

@@ -238,7 +238,7 @@ export const createDaemonSupervisor = ({
     // seat RUNS under, and `withholdGrantBroker` asks the same question the
     // server asks (`can this seat confine a granter's authority?`) for the cases
     // the server cannot see — a row naming no adapter, a backend older than the
-    // refusal, a record written by hand. Entry-level per wren 69829: the broker
+    // refusal, a record written by hand. Entry-level: the broker
     // entry is withheld and the seat still starts, because it was never promised
     // confinement. `record.instanceUrl` is what makes the injected url
     // identifiable at all — the record holds the UNRESOLVED

package/src/lib/enforcement.js

@@ -635,7 +635,7 @@ export const splitForChat = (text, { limit = 400 } = {}) => {
  *                                    text and post one message — the reply's
  *                                    own opening plus the file card.
  *
- * The thread rung is new (Sam 57691) and it replaces attachment as the answer
+ * The thread rung is new and it replaces attachment as the answer
  * for PROSE overflow. Before threads existed, a long analysis had nowhere to
  * go but a file, and that was the right workaround. It is now the wrong one:
  * an attachment is un-quotable, un-followable, and an all-or-nothing read,
@@ -678,7 +678,7 @@ export const deliverChatReply = async ({
   //
   // TASK-535 — the send-time freshness hold. The backend answers 409
   // `unseen_messages` when other members posted after this seat's last
-  // recorded tail read. A turn that ran ~43 minutes (rhea, 2026-10-25 10:01Z)
+  // recorded tail read. A turn that ran ~43 minutes
   // hit it on the thread headline, the attach card and the split fallback in
   // turn, so the reply was lost and its 10 events re-ran. A retry without an
   // override cannot succeed — every rung posts to the same guarded route.
@@ -771,7 +771,7 @@ export const deliverChatReply = async ({
   // its rendering. The tone contract's own rule covers it: over ~800 chars of
   // ONE indivisible thing is a document, not a message — attach it. Without
   // this check a 659-char fence rode the single/split branches straight past
-  // the gate (found by the fleet's implementation audit, Sharpen msg 53018).
+  // the gate (found by the fleet's implementation audit).
   const hasIndivisibleOversize = chunks.some((c) => c.length > attachThreshold);
   if (chunks.length <= 1 && !hasIndivisibleOversize) {
     const response = await postMessage({ content: chunks[0] ?? text });

package/src/lib/environment.js

@@ -75,9 +75,9 @@ const findInlineProviderCredentialField = (value, path) => {
 // daemon path it was silently inert — claude fell through to a bare unconfined
 // spawn and codex took `--dangerously-bypass-approvals-and-sandbox` — so a
 // declaration that reads as "confine me, not as a public agent" meant the
-// opposite of what it said (Vera 69592). It is refused for new declarations
+// opposite of what it said. It is refused for new declarations
 // above, and a record that already carries it is resolved TOWARD confinement,
-// never toward the bare spawn (Wren 69585): `internal` is read as `public`, so
+// never toward the bare spawn: `internal` is read as `public`, so
 // such a seat is confined where it can be and refuses to derive where it
 // cannot. A real middle trust arrives as its own adapter that reads it — and
 // `workspace` (above) is that trust, which is why it is NOT a legacy alias.
@@ -100,7 +100,7 @@ export const normalizeSandboxTrust = (sandbox) => (
  * compares the trust and must not write anything back. The server spells the
  * same predicate `effectiveSandboxTrust` (`grantBrokerConfinement.ts`) — the two
  * sides have to read `internal` the same way or one of them confines a seat the
- * other withholds from (Wren 71662).
+ * other withholds from.
  */
 export const effectiveSandboxTrust = (trust) => (
   typeof trust === 'string' && Object.prototype.hasOwnProperty.call(LEGACY_SANDBOX_TRUST, trust)
@@ -112,7 +112,7 @@ export const effectiveSandboxTrust = (trust) => (
  * Throw when an adapter that does not implement the `workspace` tier is handed
  * one (TASK-294). Only claude reads it. Every other adapter branches on
  * `trust === 'public'`, so an unread `workspace` would fall into its
- * non-public branch — the same silent widening `internal` was (Vera 69592).
+ * non-public branch — the same silent widening `internal` was.
  * Called at each adapter's spawn entry, before any other sandbox read.
  */
 export const refuseWorkspaceTrust = (sandbox, adapterLabel) => {
@@ -391,8 +391,8 @@ export const validateEnvironmentSpec = (spec) => {
     }
   }
 
-  // A TRANSPORT DECIDES THE ENTRY, so the fields must agree with it (TASK-071,
-  // Vera's ruling 2026-09-19). This block is MIRRORED, not shared: the other
+  // A TRANSPORT DECIDES THE ENTRY, so the fields must agree with it (TASK-071).
+  // This block is MIRRORED, not shared: the other
   // writer-side check is the backend's, in
   // backend/utils/environmentSpecValidation.ts, called from the
   // `PATCH /api/registry/pods/:podId/agents/:name` handler that stores

package/src/lib/first-output-watchdog.js

@@ -0,0 +1,141 @@
+/**
+ * First-output watchdog for a seat's model CLI spawn.
+ *
+ * On 2026-10-30 every launchd seat's `claude -p` turn parked while the Mac's
+ * console was locked: no transcript row, no stdout, no stderr, for the full
+ * 45-minute run timeout. Each one held its delivery the whole time, the retry
+ * respawned it into the same hang, and the log said only "claude timed out
+ * after 2700000ms", which names nothing.
+ *
+ * The signal is not stdout. A seat runs `claude -p --output-format text`,
+ * which writes stdout once, at the end, so a healthy 20-minute turn has zero
+ * stdout bytes for 20 minutes. What a healthy turn does write is its session
+ * transcript: measured on the dart seat, the first row landed 0.7 s after the
+ * spawn, and the hung spawns that night wrote no row at all. So a spawn counts
+ * as started when it writes any stdout or stderr byte OR its transcript grows.
+ * A spawn that does neither inside the window is killed with a reason. When
+ * the transcript is missing altogether, the path may simply be wrong, so the
+ * spawn is killed only if the console is also locked.
+ */
+import { realpathSync, statSync } from 'fs';
+import { readProcess } from '@commonlyai/seats/process-group';
+
+export const DEFAULT_FIRST_OUTPUT_WINDOW_MS = 180_000;
+
+// 0 turns the watchdog off; anything unparseable keeps the default.
+export const firstOutputWindowMs = (env = process.env) => {
+  const raw = env?.COMMONLY_FIRST_OUTPUT_WINDOW_MS;
+  if (raw === undefined || raw === '') return DEFAULT_FIRST_OUTPUT_WINDOW_MS;
+  const parsed = Number(raw);
+  return Number.isFinite(parsed) && parsed >= 0 ? parsed : DEFAULT_FIRST_OUTPUT_WINDOW_MS;
+};
+
+export const SPAWN_STALLED_CODE = 'spawn_stalled';
+
+// The message carries the class word spawn-retry.js matches, so the stall gets
+// its own backoff rather than RUNTIME's 5-second retry.
+export const spawnStalledError = ({ label, windowMs, reason }) => {
+  const error = new Error(
+    `${label} produced no output in ${Math.round(windowMs / 1000)}s (${reason}); killed before the run timeout`,
+  );
+  error.code = SPAWN_STALLED_CODE;
+  error.stallReason = reason;
+  return error;
+};
+
+// `ioreg -n Root -d1` prints `"IOConsoleLocked" = Yes` while the screen is
+// locked. True, false, or null when it cannot tell (not darwin, ioreg failed).
+// child_process is loaded on demand: suites that mock it with only `spawn`
+// would otherwise fail to import every adapter that uses this module.
+export const consoleLocked = async ({ platform = process.platform, execFileImpl } = {}) => {
+  if (platform !== 'darwin') return null;
+  const run = execFileImpl || (await import('child_process')).execFile;
+  if (typeof run !== 'function') return null;
+  return new Promise((resolve) => {
+    run('/usr/sbin/ioreg', ['-n', 'Root', '-d1'], { timeout: 5000 }, (error, stdout) => {
+      if (error) return resolve(null);
+      const match = String(stdout).match(/"IOConsoleLocked"\s*=\s*(Yes|No)/);
+      return resolve(match ? match[1] === 'Yes' : null);
+    });
+  });
+};
+
+// Claude names its project folder after process.cwd(), which on macOS is the
+// physical path (/tmp is /private/tmp), so the transcript is looked for there.
+export const physicalPath = (dir) => {
+  if (!dir) return dir;
+  try {
+    return realpathSync(dir);
+  } catch {
+    return dir;
+  }
+};
+
+// How long a stalled spawn gets to exit after SIGTERM before SIGKILL.
+export const STALL_KILL_GRACE_MS = 10_000;
+
+/**
+ * SIGKILL each snapshotted descendant of a stalled spawn that is still alive
+ * once the spawn itself has exited. Its parent may have exited, so it may now
+ * belong to launchd: only the pid and start time are matched, which still
+ * rules out a reused pid. Returns the pids signalled.
+ */
+export const killStallSurvivors = (snapshot, { read = readProcess, kill = process.kill.bind(process) } = {}) => {
+  const killed = [];
+  for (const row of snapshot || []) {
+    const now = read(row.pid);
+    if (!now || now.started !== row.started) continue;
+    try { kill(row.pid, 'SIGKILL'); killed.push(row.pid); } catch { /* gone */ }
+  }
+  return killed;
+};
+
+const sizeOf = (file) => {
+  if (!file) return -1;
+  try {
+    return statSync(file).size;
+  } catch {
+    return -1;
+  }
+};
+
+/**
+ * Watch `proc` for its first sign of life. Returns `{ stop }`; call it when the
+ * process closes. `onStall(reason)` fires at most once, after the caller should
+ * kill the process.
+ */
+export const watchFirstOutput = ({
+  proc,
+  windowMs,
+  transcriptPath = null,
+  onStall,
+  lockProbe = consoleLocked,
+  setTimeoutImpl = setTimeout,
+  clearTimeoutImpl = clearTimeout,
+}) => {
+  if (!windowMs) return { stop: () => {} };
+  let started = false;
+  let stopped = false;
+  const markStarted = () => { started = true; };
+  proc.stdout?.on('data', markStarted);
+  proc.stderr?.on('data', markStarted);
+  // A missing file counts as empty, so creating an empty one is not growth.
+  const baseline = Math.max(0, sizeOf(transcriptPath));
+  const timer = setTimeoutImpl(async () => {
+    const size = sizeOf(transcriptPath);
+    if (started || size > baseline) return;
+    const locked = await lockProbe().catch(() => null);
+    if (stopped) return;
+    // No transcript where one was expected may only mean the path is wrong, so
+    // that alone never kills a turn: it takes a locked console as well.
+    if (size < 0 && locked !== true) return;
+    onStall(locked ? 'console locked' : 'no transcript, stdout or stderr');
+  }, windowMs);
+  timer?.unref?.();
+  return {
+    stop: () => {
+      stopped = true;
+      clearTimeoutImpl(timer);
+    },
+  };
+};

package/src/lib/memory-bridge.js

@@ -23,7 +23,7 @@
 export const SOURCE_RUNTIME = 'local-cli';
 
 /**
- * Row slicing, the runtime-agnostic half of D48 (TASK-545). A row too large
+ * Row slicing, the runtime-agnostic half of TASK-545. A row too large
  * for one turn drifts when one seat carries it whole, so the seat splits it on
  * the board before any code. It names the exact call and field for the reason
  * the memory cue below names `long_term`: a seat adopts a habit through a

package/src/lib/public-tool-error.js

@@ -1,6 +1,6 @@
 /**
  * Which failed Commonly tool calls a public seat's model may answer in plain
- * words. Everything else withholds the turn (#2374, Vera 79595, Wren 79596).
+ * words. Everything else withholds the turn (#2374).
  *
  * The rule is inverted on purpose. Matching known connection failures let an
  * API 5xx through: the shipped MCP turns a non-2xx into a tool error carrying

package/src/lib/sandbox/mode.js

@@ -5,15 +5,14 @@
  * derives `sandbox: { trust: 'public' }` with NO mode (lib/default-environment.js)
  * because `mode: 'workspace'` is Seatbelt on macOS and is refused on Linux,
  * while `mode: 'bwrap'` is meaningless on macOS — writing either into the row
- * moves a host fact into the database and breaks the day the seat is re-homed
- * (Wren 69545).
+ * moves a host fact into the database and breaks the day the seat is re-homed.
  *
  * So the mode is resolved here, at the point that knows the host:
  *   darwin  → 'workspace' (the claude adapter maps it to Seatbelt)
  *   else    → 'bwrap'     (bubblewrap; attach checks it is installed)
  *
  * Resolution is PUBLIC-only on purpose, and PUBLIC IS THE EFFECTIVE TRUST: a
- * legacy `internal` declaration reads as `public` (environment.js, Wren 69585),
+ * legacy `internal` declaration reads as `public` (environment.js),
  * so the mapping is applied before this comparison. Comparing the raw value
  * made `{ trust: 'internal' }` resolve to no mode at all — the mapping was
  * applied in `confinementReason` and not here, which is half a rule, and the
@@ -22,7 +21,7 @@
  * whatever mode it wrote, and an adapter that cannot enforce it is expected to
  * refuse rather than quietly spawn unconfined. An explicit mode on a public
  * declaration still wins — including a wrong one, which the caller then refuses
- * (Vera 69548: an unresolvable public mode must not fall through to a bare,
+ * (an unresolvable public mode must not fall through to a bare,
  * unconfined spawn).
  *
  * NOT used by the codex adapter. Codex's `mode` is read-vs-write access, not a

package/src/lib/sandbox/seatbelt.js

@@ -301,7 +301,7 @@ const OPEN_NETWORK = String.raw`
 // Resolver is constructed. Denied, that lookup does not always fail: at
 // times it blocks the main thread forever. dsh builds a Resolver as it loads,
 // so confined turns ran to their 900 s timeout without sending a request
-// (D106). Admitted, resolution fails fast, because mDNSResponder and port 53
+// Admitted, resolution fails fast, because mDNSResponder and port 53
 // stay unreachable in a loopback profile. The service returns configuration
 // and opens no channel out.
 const RESOLVER_CONFIG = String.raw`

package/src/lib/spawn-retry.js

@@ -16,8 +16,16 @@ export const SPAWN_FAILURE_CLASS = Object.freeze({
   RATE_LIMIT: 'rate_limit',
   CONFIGURATION: 'configuration',
   RUNTIME: 'runtime',
+  // The spawn never started: no transcript row, stdout or stderr inside the
+  // first-output window (lib/first-output-watchdog.js). A host condition such as
+  // a locked console, so the circuit opens at once and the probe waits.
+  STALLED: 'stalled',
 });
 
+// A stalled probe costs one first-output window, so the wait starts short and
+// doubles to the usual ceiling: 2, 4, 8, then 15 minutes.
+export const SPAWN_STALL_RETRY_BASE_MS = 2 * 60 * 1000;
+
 export const SPAWN_CIRCUIT_THRESHOLD = 3;
 // Base ceiling before the stable per-agent 0–20% anti-herd offset.
 export const SPAWN_RETRY_MAX_MS = 15 * 60 * 1000;
@@ -116,6 +124,7 @@ export const classifySpawnFailure = (error) => {
   // First: the refusal text carries none of the words below today, but a
   // refusal must never be read as a transient condition and retried.
   if (CONTENT_REFUSED_RE.test(text)) return SPAWN_FAILURE_CLASS.CONTENT_REFUSED;
+  if (error?.code === 'spawn_stalled') return SPAWN_FAILURE_CLASS.STALLED;
   // Provider APIs commonly report an exhausted account quota as HTTP 429.
   // Prefer the more specific body/message over the generic status code so a
   // hard quota failure gets the long cooldown rather than a one-minute probe.
@@ -124,7 +133,7 @@ export const classifySpawnFailure = (error) => {
   // and "limit", and its `(?!rate[ -]?limit)` lookahead only guards the word
   // IMMEDIATELY after "your" — so "you've hit your API rate limit" walked past
   // it into the 15-minute circuit, where main correctly gives the 60-second
-  // rate-limit probe (otto, gate on #2491; it was a regression, not a gap).
+  // rate-limit probe (gate on #2491; it was a regression, not a gap).
   // A throttle wording anywhere in the text therefore wins over the shape.
   // QUOTA_RE is still tested first, so an explicit quota word keeps QUOTA even
   // when the same message also mentions rate limits.
@@ -194,6 +203,17 @@ export const spawnRetryPolicy = ({
     };
   }
 
+  if (failureClass === SPAWN_FAILURE_CLASS.STALLED) {
+    return {
+      failureClass,
+      circuitOpen: true,
+      delayMs: applyJitter(
+        Math.min(SPAWN_RETRY_MAX_MS, SPAWN_STALL_RETRY_BASE_MS * (2 ** (failureCount - 1))),
+        jitterRatio,
+      ),
+    };
+  }
+
   if (failureClass === SPAWN_FAILURE_CLASS.RATE_LIMIT) {
     return {
       failureClass,

package/src/lib/webhook-server.js

@@ -73,7 +73,7 @@ export const startWebhookServer = ({
  * The handler `agent connect` serves on its own port. It only logs what
  * arrives, and no agent has read the event, so it states no outcome a read
  * would count as: the wake still settles, and the pod digest stays unread
- * (Sable, #2753).
+ * (#2753).
  */
 export const logOnlyHandler = async (event) => {
   console.log(`[local] ${event.type} from pod ${event.podId}`);
@@ -99,7 +99,7 @@ export const forwardToLocalWebhook = async (event, webhookUrl, secret = null) =>
   if (!res.ok) throw new Error(`Local webhook returned HTTP ${res.status}`);
   // Only a stated outcome counts. An empty or non-JSON body, or one without
   // an outcome, is a handler that said nothing, the same as a CLI turn that
-  // printed nothing, so it must not read the pod digest (Rhea, #2753).
+  // printed nothing, so it must not read the pod digest (#2753).
   let body = null;
   try { body = await res.json(); } catch { body = null; }
   if (!body || typeof body !== 'object' || typeof body.outcome !== 'string') {