@dynamicagents/plugins 0.11.1 → 0.12.0

package/dist/claude-code/run.js

@@ -1,5 +1,5 @@
 import { shellQuote } from "@cloudflare/computer";
-import { parseStream, toProgress } from "./events.js";
+import { parseStream, toProgress, RATE_LIMIT_OK } from "./events.js";
 import { DEFAULT_PERMISSION_MODE } from "./config.js";
 /** Namespace for every session exec id in a workspace. */
 export const CLAUDE_EXEC_PREFIX = "claude-code-run";
@@ -25,11 +25,10 @@ export function execIdFor(subtaskId) {
 /**
  * What the container is given instead of a credential.
  *
- * Claude Code does not validate it locally — proven in the Phase 0c spike, where
- * a run with this exact value succeeded and the proxy log confirmed the
- * container only ever sent the placeholder. The egress gateway swaps in the real
- * credential on the way out, so a `postinstall` script that dumps the
- * environment learns this and nothing else.
+ * Claude Code does not validate it locally: a run with this exact value
+ * succeeds, and the container only ever sends the placeholder. The egress
+ * gateway swaps in the real credential on the way out, so a `postinstall` script
+ * that dumps the environment learns this and nothing else.
  *
  * Shaped like a real token deliberately: something that looks obviously fake
  * invites a future reader to "fix" it by putting the real one there.
@@ -45,6 +44,31 @@ export const CREDENTIAL_PLACEHOLDER = "sk-ant-oat01-" + "0".repeat(24);
  * is refused rather than overridden.
  */
 const RESERVED_ENV_KEY = "CLAUDE_CODE_OAUTH_TOKEN";
+/**
+ * Git's identity as an *environment*, not a `git config`.
+ *
+ * The session's cwd is one checkout, and what it commits in is not: a
+ * superproject's submodules, a scratch clone, anything it initialises are all
+ * separate repositories with separate configs, and `/repo` only ever configured
+ * the one it cloned. A config write would have to find each of them; the
+ * environment is inherited by every git the session starts, and it outranks all
+ * four config levels — so a checkout carrying a name from whenever it was
+ * created no longer decides who commits today.
+ *
+ * Both pairs, because they answer different questions: an amend or a rebase
+ * keeps the original author and stamps a fresh committer, and with only
+ * `GIT_AUTHOR_*` set that commit ends up half attributed.
+ */
+function gitIdentityEnv(author) {
+    if (!author)
+        return {};
+    return {
+        GIT_AUTHOR_NAME: author.name,
+        GIT_AUTHOR_EMAIL: author.email,
+        GIT_COMMITTER_NAME: author.name,
+        GIT_COMMITTER_EMAIL: author.email
+    };
+}
 /**
  * Build the command and environment for one session.
  *
@@ -59,27 +83,20 @@ const RESERVED_ENV_KEY = "CLAUDE_CODE_OAUTH_TOKEN";
  * container is already an arbitrary-code-execution environment by design — the
  * install runs the repo's `postinstall`, the agent runs its test suite. Stripping
  * one door while the others stand open buys nothing and costs the agent its
- * context. (§4 of the design plan, cancelled 2026-08-21.)
+ * context.
  *
- * No `ANTHROPIC_BASE_URL` either, and that one is a genuine simplification over
- * the spike: `http-gateway` egress intercepts transparently, so the client talks
- * to the real hostname and the gateway sees it. Nothing has to be told to use a
- * proxy, which means nothing in the container can be told *not* to.
+ * No `ANTHROPIC_BASE_URL` either: `http-gateway` egress intercepts
+ * transparently, so the client talks to the real hostname and the gateway sees
+ * it. Nothing has to be told to use a proxy, which means nothing in the
+ * container can be told *not* to.
  *
  * ## `--permission-mode`, and the root guard behind it
  *
- * `-p` is headless. There is no terminal, so there is nobody to answer a
- * permission prompt — and Claude Code's headless path does not wait for one, it
- * **auto-denies**. Left unset the mode is `default`, and `default` gates Write,
- * Edit and every Bash command. A session in that state reads the repository
- * perfectly and cannot change one byte of it, while reporting prose that reads
- * like considered reluctance rather than a blocked tool. That cost this
- * deployment a day of "the container is fixed but nothing lands".
- *
- * So the mode is passed explicitly, and {@link DEFAULT_PERMISSION_MODE} is
- * `bypassPermissions` — see
- * {@link file://./config.ts ClaudeCodeConfig.permissionMode} for why the
- * permissive value is the correct default here rather than a concession.
+ * The mode is always passed explicitly, never left to the CLI's `default` — see
+ * {@link file://./config.ts ClaudeCodeConfig.permissionMode} for what an
+ * unset mode does to a headless session, and why
+ * {@link DEFAULT_PERMISSION_MODE} is the permissive value rather than a
+ * concession.
  *
  * **`IS_SANDBOX=1` ships in the same branch as the flag, and separating the two
  * breaks a session harder than passing no flag at all.** The container runs as
@@ -121,8 +138,8 @@ export function buildLaunch(options) {
     argv.push("--permission-mode", permissionMode);
     if (options.model)
         argv.push("--model", shellQuote(options.model));
-    if (options.maxTurns !== undefined)
-        argv.push("--max-turns", String(options.maxTurns));
+    if (options.effort)
+        argv.push("--effort", options.effort);
     const env = {
         // Pinned image; an autoupdate would move the wire shape the gateway and the
         // parser are both written against, mid-run and without a deploy.
@@ -138,16 +155,23 @@ export function buildLaunch(options) {
         env.CLAUDE_CODE_MAX_CONCURRENT_SUBAGENTS = String(options.maxConcurrentSubagents);
     return {
         command: argv.join(" "),
-        // The last two are applied **after** the host's environment rather than
+        // The last three are applied **after** the host's environment rather than
         // before it. For the placeholder that makes the guard above a second line
         // rather than the only one; for `IS_SANDBOX` it means a host cannot unset
         // the variable its own permission mode depends on — see the note above.
+        //
+        // For the identity it is what keeps the four keys one answer. Spread before
+        // `env`, a host that set `GIT_AUTHOR_NAME` there and `author` here would
+        // get the author from one and the committer from the other — a commit
+        // attributed to two people, which is the exact failure `author` exists to
+        // end. Last, `author` is simply the answer whenever a host gives one.
         env: {
             ...env,
             ...options.env,
             ...(permissionMode === "bypassPermissions"
                 ? { IS_SANDBOX: "1" }
                 : undefined),
+            ...gitIdentityEnv(options.author),
             [RESERVED_ENV_KEY]: CREDENTIAL_PLACEHOLDER
         }
     };
@@ -156,12 +180,109 @@ export function buildLaunch(options) {
 export function freshCursor(execId) {
     return { execId, seq: 0, carry: "", emitted: 0 };
 }
+/**
+ * Whether a bucket reading says anything the last one did not.
+ *
+ * Every field, because each is separately actionable: the status decides whether
+ * a credential is worth using, `resetsAt` is when it recovers, the type says
+ * which bucket is talking, and the overage pair says whether spending past it is
+ * allowed and why not. Comparing only the status would hold a rollover — a new
+ * `resetsAt` under an unchanged `allowed` — out of the logs entirely.
+ *
+ * **Over the keys rather than a written-out list**, which is the difference
+ * between one bug and a class of them: a field added to
+ * {@link RateLimitInfo} and forgotten here does not make a smaller log, it makes
+ * a change to the reading that never reaches a log at all — the one failure this
+ * function exists to prevent, and a silent one. Shallow is exact because the
+ * reading is flat and every value on it is a primitive; a nested field would
+ * need this revisited, and the parser is where that would be decided.
+ */
+function changedReading(previous, next) {
+    if (previous === undefined)
+        return true;
+    const before = { ...previous };
+    const after = { ...next };
+    return [...new Set([...Object.keys(before), ...Object.keys(after)])].some((key) => before[key] !== after[key]);
+}
 /** Distinguishes "the window ran out" from a real stream event in the race below. */
 const WINDOW_EXPIRED = Symbol("window-expired");
+/**
+ * How rarely a drain offers a cursor to persist.
+ *
+ * A checkpoint is a Durable Object storage write, and the stream can carry many
+ * events a second while a session reads files — so this is a floor on the writes,
+ * not a schedule for them. Sized against what it is protecting: the loss it
+ * bounds is re-drained in seconds, so buying a smaller bound with a write per
+ * event would cost more than the bound is worth.
+ */
+const CHECKPOINT_MIN_MS = 30_000;
 /** Whether a thrown value is the runtime refusing to reuse a live exec id. */
 function isExecBusy(err) {
     return err?.code === "EEXEC_BUSY";
 }
+/**
+ * Whether a thrown value means the session this cursor names is gone for good.
+ *
+ * `EEXEC_LOST` is the runtime saying the container that held the execution was
+ * replaced. The session died with it, and no attachment will ever find it — so
+ * unlike `EEXEC_BUSY`, which is a live session reached the wrong way, there is
+ * nothing to recover and retrying only spends chunks discovering that again.
+ */
+export function isExecLost(err) {
+    return err?.code === "EEXEC_LOST";
+}
+/**
+ * Whether a thrown value is the *previous* window's attachment, not yet released.
+ *
+ * An exec's event stream admits one subscriber at a time. A chunk boundary asks
+ * for the next one within milliseconds of the last one returning, and the
+ * release on the far side is asynchronous and unobservable from here — the
+ * workspace client carries `Symbol.dispose`, not `Symbol.asyncDispose`, so
+ * there is nothing a caller can await to know the attachment is gone. So the
+ * boundary races the teardown every time, and {@link attachRun} answers by
+ * waiting rather than by failing.
+ *
+ * **Matched on the message, not on a code, and that is not laziness.** This one
+ * is raised inside the container image rather than by the runtime client: the
+ * string appears nowhere in the Worker bundle, and it arrives at a Workflow step
+ * as a plain `Error` with no `code` — unlike `EEXEC_BUSY` and `EEXEC_LOST`
+ * above, which the client throws and codes. The code is checked first anyway, so
+ * the day the container starts sending one this keeps working and the string
+ * test becomes the fallback it should have been.
+ */
+function isExecSubscribed(err) {
+    const e = err;
+    if (e?.code === "EEXEC_SUBSCRIBED")
+        return true;
+    return (typeof e?.message === "string" &&
+        e.message.includes("already has a live subscriber"));
+}
+/**
+ * How long {@link attachRun} waits out a subscriber that has not been released.
+ *
+ * Bounded, because what it is waiting on may not be a teardown at all: an
+ * isolate that is genuinely wedged holding the stream releases it when it dies,
+ * and nothing here can tell that apart from one that is a moment from
+ * finishing. Exceeding this rethrows, so the Workflow step retries with a fresh
+ * isolate — which is the right escalation, and the one this whole mechanism
+ * exists to stop being the *first* resort.
+ *
+ * Sized well above what the race costs in practice. The boundary normally clears
+ * on the first or second look, and a deployment where it took fifteen seconds is
+ * what this is sized to outlast.
+ */
+const ATTACH_MAX_MS = 30_000;
+/** The first gap between attach attempts, doubled up to {@link ATTACH_CAP_MS}. */
+const ATTACH_BACKOFF_MS = 250;
+/**
+ * The ceiling on that doubling.
+ *
+ * Without it the last gap before {@link ATTACH_MAX_MS} would be most of the
+ * budget, so a subscriber released early in it would still be waited out to the
+ * end. What this buys is that the wait ends soon after the release, rather than
+ * at the next power of two.
+ */
+const ATTACH_CAP_MS = 2_000;
 /**
  * Start a session, detached.
  *
@@ -172,6 +293,12 @@ function isExecBusy(err) {
  * still running (`EEXEC_BUSY`). Without this the retry throws, every later retry
  * throws the same way, and a perfectly healthy session in the container becomes
  * unreachable.
+ *
+ * **The sync stays on the default, and `defer` is not an option here.** A
+ * deferred exec skips the post-command pull entirely and settles the outcome
+ * from the cursor instead — and its `cancel` reads the stream to the end first,
+ * so ending a window would block until the session exits rather than yielding
+ * the chunk. Both halves are exactly what this drain is built not to do.
  */
 export async function startRun(runtime, options) {
     const { command, env } = buildLaunch(options);
@@ -191,14 +318,56 @@ export async function startRun(runtime, options) {
         return await attachRun(runtime, freshCursor(options.execId));
     }
 }
-/** Re-attach to a session this isolate did not start. */
-export async function attachRun(runtime, cursor) {
-    return await runtime.getExec(cursor.execId, {
-        encoding: "utf8",
-        // `0` is a legal seq and also the beginning, so a fresh cursor resumes from
-        // the start either way. Later chunks name their own place.
-        resume: cursor.seq
-    });
+/**
+ * Re-attach to a session this isolate did not start.
+ *
+ * **Waits out a subscriber the previous window has not released yet**, and that
+ * wait is the point of this function rather than a refinement of it. The
+ * alternative is not "fail fast" — it is spending a Workflow retry to discover a
+ * condition that clears on its own in a second, when a chunk step's retries are
+ * what a deploy, a severed stub and a network drop have to be covered out of.
+ * Core sizes that budget and says why; what matters here is that this must not
+ * be charged to it. A deployment lost a twenty-one-minute session exactly that
+ * way — consecutive attach races used the retries up, and the redeploy that
+ * followed had no attempt left to be retried on. See {@link isExecSubscribed}.
+ *
+ * Everything else is rethrown on the first look, `EEXEC_LOST` above all: it is
+ * the runtime saying the container was replaced, `resume` turns it into a report
+ * for the model, and a retry loop would sit on it for {@link ATTACH_MAX_MS}
+ * learning nothing.
+ */
+export async function attachRun(runtime, cursor, options = {}) {
+    const now = options.now ?? Date.now;
+    const wait = options.wait ?? sleep;
+    const deadline = now() + ATTACH_MAX_MS;
+    let backoff = ATTACH_BACKOFF_MS;
+    for (;;) {
+        try {
+            return await runtime.getExec(cursor.execId, {
+                encoding: "utf8",
+                // `0` is a legal seq and also the beginning, so a fresh cursor resumes
+                // from the start either way. Later chunks name their own place.
+                resume: cursor.seq
+            });
+        }
+        catch (err) {
+            // Rethrown rather than retried once the budget is gone, so the step still
+            // fails on a subscriber that is never coming back — just not first.
+            if (!isExecSubscribed(err) || now() >= deadline)
+                throw err;
+            // Clamped to what is left, so the last gap lands *on* the deadline rather
+            // than past it. Uncapped, a schedule whose final doubling straddles the
+            // bound would take one more look on the far side of it — and the bound
+            // would be a number in a comment rather than one the code keeps.
+            const waitMs = Math.min(backoff, deadline - now());
+            // One line per wait, not per attempt: this is the condition whose
+            // frequency is worth watching, and it went unnamed in the logs for as
+            // long as the Workflow was absorbing it a retry at a time.
+            console.info("[claude-code] the previous window is still attached — waiting", { execId: cursor.execId, waitMs });
+            await wait(waitMs);
+            backoff = Math.min(backoff * 2, ATTACH_CAP_MS);
+        }
+    }
 }
 /**
  * Drain a session for one bounded window.
@@ -211,18 +380,39 @@ export async function drainRun(handle, cursor, options) {
     const now = options.now ?? Date.now;
     const deadline = now() + options.windowMs;
     const reader = handle.getReader();
-    const events = [];
+    /**
+     * The window's notes, in order — built as the stream is parsed rather than
+     * from a list of events at the end, so there is one place a note is numbered
+     * and the sink below cannot disagree with what is returned.
+     */
+    const progress = [];
+    let emitted = cursor.emitted;
     let buffer = cursor.carry;
     let seq = cursor.seq;
     let result = cursor.result;
+    // This window's reading only — see `DrainOutcome`. Starting undefined also
+    // means the first reading of each window reaches the log, which is what keeps
+    // a resumed session's bucket visible without carrying a stale one forward.
+    let rateLimit;
     let stderr = cursor.stderr ?? "";
     let exitCode;
+    let checkpointedAt = now();
+    /**
+     * The sink's calls, chained rather than awaited.
+     *
+     * Ordering matters — these are sentences in a conversation — and a post is a
+     * signed round trip, so awaiting one inside the read loop would stall the
+     * drain for as long as the session keeps talking. Failures are swallowed here
+     * because the sink's own contract is best-effort; settled before the drain
+     * returns, so nothing is cut short when the RPC unwinds.
+     */
+    let sunk = Promise.resolve();
     /**
      * Parse whatever complete lines the buffer now holds.
      *
      * Called after **every** stdout event rather than once at the end. Claude
      * Code's stream carries whole tool results, so a chunk that only parsed on the
-     * way out would hold an eight-minute transcript of a noisy build in a Durable
+     * way out would hold a whole window's transcript of a noisy build in a Durable
      * Object's memory; parsing eagerly keeps only `carry`, which is at most one
      * incomplete line.
      */
@@ -230,9 +420,47 @@ export async function drainRun(handle, cursor, options) {
         const parsed = parseStream(buffer);
         buffer = parsed.carry;
         for (const event of parsed.events) {
-            events.push(event);
             if (event.kind === "result")
                 result = event.result;
+            if (event.kind === "rateLimit") {
+                /**
+                 * Logged when the reading **changes**, not per line — and a change is
+                 * any field of it, not just the status: a bucket rolling over moves
+                 * `resetsAt` while saying `allowed` throughout, and the new reset is
+                 * the useful half of that line.
+                 *
+                 * The client repeats itself for as long as a session runs, so a log per
+                 * event would be the noisiest thing this package writes and every copy
+                 * after the first would say the same thing. A change is the whole signal:
+                 * the first reading names the bucket and when it refills, and the only
+                 * other one that can happen is the bucket saying no — which is the line
+                 * nobody has captured yet, and the one the pool needs before it can be
+                 * trusted to act on a status rather than on a refused request.
+                 */
+                if (changedReading(rateLimit, event.info)) {
+                    const at = { execId: cursor.execId, ...event.info };
+                    // An unrecognised status is **not** reported as a refusal. Nothing
+                    // here knows what one means, and a log that calls it exhaustion is
+                    // how a healthy credential gets retired by the next person to read
+                    // it. See `RATE_LIMIT_OK`.
+                    if (event.info.status === RATE_LIMIT_OK)
+                        console.info("[claude-code] subscription bucket", at);
+                    else
+                        console.warn("[claude-code] unrecognised subscription status", at);
+                }
+                rateLimit = event.info;
+            }
+        }
+        // Numbered from the running total, so a note has the same key whether it is
+        // posted from here or returned on the outcome — and the same key again when
+        // a retry replays this part of the stream, which is what makes the duplicate
+        // harmless. See `toProgress`.
+        for (const note of toProgress(parsed.events, emitted)) {
+            progress.push(note);
+            emitted++;
+            const sink = options.onProgress;
+            if (sink)
+                sunk = sunk.then(() => sink(note)).catch(() => { });
         }
         if (parsed.skipped > 0) {
             // Not fatal, and deliberately not silent: a systematic schema change
@@ -251,22 +479,63 @@ export async function drainRun(handle, cursor, options) {
             });
         }
     };
-    const finish = (code) => {
-        const progress = toProgress(events, cursor.emitted);
-        const next = {
-            execId: cursor.execId,
-            seq,
-            carry: buffer,
-            emitted: cursor.emitted + progress.length,
-            ...(result ? { result } : {}),
-            ...(stderr ? { stderr } : {})
-        };
+    /**
+     * Where the drain has got to, as something safe to persist.
+     *
+     * One object, so `seq`, `carry` and `emitted` are written together — a cursor
+     * that advanced its position without its note count would renumber every key
+     * after it, and a replay would then post the whole tail again under keys the
+     * gatekeeper has never seen.
+     */
+    const checkpoint = () => ({
+        execId: cursor.execId,
+        seq,
+        carry: buffer,
+        emitted,
+        ...(result ? { result } : {}),
+        ...(stderr ? { stderr } : {})
+    });
+    /**
+     * Offer the caller a cursor to persist, at most every
+     * {@link CHECKPOINT_MIN_MS}.
+     *
+     * Fire-and-forget onto the same chain the notes ride, so a storage write
+     * cannot stall the read loop and cannot land before the notes it claims are
+     * already posted.
+     */
+    const offerCheckpoint = () => {
+        const sink = options.onCheckpoint;
+        // **Refused without `onProgress`, not merely discouraged.** A checkpoint is
+        // only safe because the notes behind it have been posted; offered to a
+        // caller that posts nothing, it advances a cursor past notes that were never
+        // delivered, and a chunk dying after it loses them permanently. The
+        // documented unsafe combination is one nothing can reach.
+        if (!sink || !options.onProgress)
+            return;
+        if (now() - checkpointedAt < CHECKPOINT_MIN_MS)
+            return;
+        checkpointedAt = now();
+        const at = checkpoint();
+        sunk = sunk.then(() => sink(at)).catch(() => { });
+    };
+    const finish = async (code) => {
+        const next = checkpoint();
+        // Everything the sink was given has been delivered before the outcome
+        // naming it is returned, so a caller cannot commit a cursor that claims
+        // notes nobody posted.
+        await sunk;
         return code === undefined
-            ? { done: false, cursor: next, progress }
+            ? {
+                done: false,
+                cursor: next,
+                progress,
+                ...(rateLimit ? { rateLimit } : {})
+            }
             : {
                 done: true,
                 cursor: next,
                 progress,
+                ...(rateLimit ? { rateLimit } : {}),
                 exitCode: code,
                 ...(result ? { result } : {}),
                 // Only when there is no result. A session that reported for itself has
@@ -290,30 +559,41 @@ export async function drainRun(handle, cursor, options) {
              * simply not there.
              *
              * Reading on is also how the sync gets *awaited*: the wrapper resolves its
-             * pull before it closes the stream, so observing `done` means the sync has
-             * already finished.
+             * pull before it closes the stream, so observing `done` means the pull was
+             * attempted. Attempted, not guaranteed — a pull that fails leaves the
+             * stream closing normally and reports itself on the result the host does
+             * not see here, and nothing retries it on its own. The host drives any
+             * outstanding pull; see this plugin's README.
+             *
+             * It is also unbounded, deliberately: the pull carries whatever the
+             * session wrote, an install's dependency tree included, so this last read
+             * can outlast the window that was left — and the step with it. Cutting it
+             * short to keep the window would trade a late chunk for edits that never
+             * land, and that trade is not close: a step killed with the pull still in
+             * flight is retried, and the sync resumes from the blocks it has already
+             * committed. A pull that *fails* is the case above, and nothing retries
+             * that. See {@link file://./config.ts ClaudeCodeConfig.windowMs} for how
+             * the window is sized around an unbounded tail.
              */
             if (exitCode !== undefined) {
                 const next = await reader.read();
                 if (next.done)
-                    return finish(exitCode);
+                    return await finish(exitCode);
                 consume(next.value);
                 continue;
             }
             const remaining = deadline - now();
             if (remaining <= 0)
                 return await yieldWindow();
-            const next = await Promise.race([
-                reader.read(),
-                sleep(remaining).then(() => WINDOW_EXPIRED)
-            ]);
+            const timer = windowTimer(remaining);
+            const next = await Promise.race([reader.read(), timer.expired]).finally(timer.clear);
             if (next === WINDOW_EXPIRED)
                 return await yieldWindow();
             if (next.done) {
                 // The stream ended without an `exit` event — the container went away
                 // under the run. Report it as a failure rather than as still-running,
                 // or the caller waits out its whole chunk budget on a dead process.
-                return finish(-1);
+                return await finish(-1);
             }
             consume(next.value);
         }
@@ -326,6 +606,9 @@ export async function drainRun(handle, cursor, options) {
         if (event.name === "stdout" && event.value !== undefined) {
             buffer += event.value;
             absorb();
+            // After absorbing, never before: the position offered has to be one whose
+            // notes are already on the sink's queue.
+            offerCheckpoint();
         }
         // stderr is Claude Code's own diagnostics, not the protocol stream. Kept out
         // of the parser so a warning line cannot be mistaken for an event — but
@@ -346,17 +629,39 @@ export async function drainRun(handle, cursor, options) {
      * it settles the pending read, resolves the sync outcome as `pending`, and
      * lets the next chunk's `getExec` open a fresh attachment that will run the
      * real sync when the session finally ends.
+     *
+     * **Cancels before settling the sinks, not after.** `finish` awaits every
+     * progress post this window queued — signed round trips to the gatekeeper, one
+     * per note — and holding the attachment open across them handed the next chunk
+     * a subscriber that was still live for no reason but ordering. Safe in this
+     * order because `finish` reads only what `consume` already put in local state,
+     * and takes nothing off the stream. It does not close the race that
+     * {@link attachRun} waits out — the release is still asynchronous on the far
+     * side — it just stops this end adding to it.
      */
     async function yieldWindow() {
         absorb();
-        const outcome = finish();
         await reader.cancel("chunk window expired").catch(() => { });
-        return outcome;
+        return await finish();
     }
 }
 function sleep(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
+/**
+ * What's left of the window, as a race a read can win.
+ *
+ * Cleared by the caller whichever side wins: one is armed per read, and a timer
+ * left pending holds the facet's `executeChunk` open until the window's end, so
+ * a session that finishes in seconds would still cost the whole window.
+ */
+function windowTimer(ms) {
+    let id;
+    const expired = new Promise((resolve) => {
+        id = setTimeout(() => resolve(WINDOW_EXPIRED), ms);
+    });
+    return { expired, clear: () => clearTimeout(id) };
+}
 /** How much stderr is worth carrying, in characters. */
 const STDERR_MAX = 2_000;
 /**
@@ -372,9 +677,9 @@ const STDERR_MAX = 2_000;
  * gives up prints one line and exits, making that line the last thing there is.
  * Keeping both ends costs a few hundred characters and removes the guess.
  *
- * Not a re-implementation of `/computer`'s `truncateOutput`: reaching across the
- * subpath boundary for it would merge two realms `verify:exports` keeps apart,
- * which is the same reason `/repo` carries its own.
+ * Not `truncateOutput`, and the difference is the marker: this runs on every
+ * append, so the cut has to stay a single character rather than a sentence that
+ * would be re-cut and nested on the next one.
  */
 function boundStderr(text) {
     if (text.length <= STDERR_MAX)