@evomap/evolver-core 2.0.0-beta.5 → 2.0.0-beta.6

package/dist/events/ingest.js

@@ -1,4 +1,6 @@
+import { dirname, join } from 'node:path';
 import { EventStore } from './eventStore.js';
+import { createIssueDraftForEventBestEffort } from '../issueReporter/index.js';
 /** 已知事件类型 (军杰 §9; 可 registerEventType 扩展). */
 export const EVENT_TYPES = [
     'cycle.started', 'cycle.signals_collected', 'cycle.solidified', 'cycle.failed',
@@ -51,6 +53,11 @@ export class Ingestor {
         if (raw.actor?.kind === 'human' && !raw.actor.id)
             throw new IngestValidationError('actor.kind=human 必带 actor.id (审计, 军杰 §9.7)');
         const evt = await this.store.append(raw);
+        createIssueDraftForEventBestEffort(evt, {
+            rootDir: join(dirname(this.store.path), 'issue-reporter'),
+            workspaceScope: process.cwd(),
+            env: process.env,
+        });
         this.sink?.dispatch(evt);
         return evt;
     }

package/dist/exec/claudeBridge.d.ts

@@ -4,13 +4,16 @@ import type { ExecutionResult } from '../algo/cycleEngine.js';
 import { type GeneStrategyInfo } from './prompt.js';
 import type { PersonalityStore } from '../personality/store.js';
 import { type AgentRunner, type AgentRunnerOptions, type RunnerName } from './runnerRegistry.js';
-export { resolveSpawnCommand, spawnCapture, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, } from './runnerRegistry.js';
+export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
 export type { AgentRunContext, AgentRunResult, AgentRunner, RunnerName, AgentRunnerOptions, ClaudeRunnerOptions, CodexRunnerOptions, AgentRunnerSpec, } from './runnerRegistry.js';
 export interface GitRunnerOptions {
     processSignalMode?: 'cancel' | 'ignore';
 }
 /** Run a git subcommand in cwd and return its stdout. */
 export type GitRunner = (args: readonly string[], cwd: string, signal?: AbortSignal, options?: GitRunnerOptions) => Promise<string>;
+export type GitPatchWriter = (args: readonly string[], cwd: string, destination: string, signal?: AbortSignal, 
+/** Call immediately after this writer exclusively creates `destination`. */
+onDestinationOpened?: () => void) => Promise<void>;
 /** Resolve the selected gene's learned strategy (for prompt enrichment). */
 export type GeneResolver = (geneId: string) => Promise<GeneStrategyInfo | null> | GeneStrategyInfo | null;
 /** Decide success from the post-run working tree (e.g. run the gene's validation plan). */
@@ -32,6 +35,12 @@ export interface ExecBridgeOptions {
     agentOptions?: AgentRunnerOptions;
     /** Default: spawns `git`. Inject a fake in tests. */
     git?: GitRunner;
+    /** Optional complete-patch sink. The default streams built-in git output directly to disk. */
+    gitPatchWriter?: GitPatchWriter;
+    /** Test seam for fallback patch persistence; production callers should use the exclusive private writer. */
+    writePatchFile?: (path: string, patch: string) => void;
+    /** Test seam for temporary patch cleanup; production callers should use the filesystem default. */
+    removePatchFile?: (path: string) => void;
     /** Default: EVOLVE_EXEC_BRIDGE === '1'. Set true to force-enable (e.g. integration tests). */
     enabled?: boolean;
     /**
@@ -108,8 +117,9 @@ export declare function scrubAgentEnv(env: NodeJS.ProcessEnv, opts?: {
     allowKeys?: readonly string[];
     allowPrefixes?: readonly string[];
 }): NodeJS.ProcessEnv;
-/** Default git runner: spawn `git <args>` in cwd, return stdout (empty string on error). Env scrubbed — git never needs evolver/hub secrets. */
+/** Default git runner: every incomplete command result fails closed. */
 export declare const defaultGitRunner: GitRunner;
+export declare const defaultGitPatchWriter: GitPatchWriter;
 /**
  * Build the `execute` function CycleEngine/runEvolutionCycle consume. Default-off: throws
  * ExecBridgeDisabledError on first call unless enabled.

package/dist/exec/claudeBridge.js

@@ -11,19 +11,20 @@
 // SAFETY: default-OFF. The factory throws ExecBridgeDisabledError unless explicitly enabled (opts.enabled)
 // or EVOLVE_EXEC_BRIDGE === '1'. Wiring it in by accident must fail loudly rather than silently spawn an
 // autonomous agent.
+import { randomUUID } from 'node:crypto';
 import { resolve as resolvePath, sep, join as joinPath } from 'node:path';
 import { tmpdir } from 'node:os';
-import { writeFileSync } from 'node:fs';
+import { closeSync, existsSync, mkdtempSync, openSync, rmSync, writeFileSync } from 'node:fs';
 import { renderExecPrompt } from './prompt.js';
 import { parseGitShortstat, gitDiffProof } from './proofOfWork.js';
 // Policy enforcement core (#107): checkPolicy runs the always-on global guards (blast hard cap +
 // protected paths + destructive deletes) on EVERY exec — gene or not — plus the per-gene constraints when a
 // gene supplies them. It supersedes the old gene-gated `checkChangeConstraints` call (the no-gene-no-guard hole).
 import { checkPolicy, summarizeViolations } from './policy/index.js';
-import { spawnCapture, getRunnerSpec, DEFAULT_TIMEOUT_MS } from './runnerRegistry.js';
+import { spawnCapture, SpawnCaptureFinalizeError, getRunnerSpec, DEFAULT_TIMEOUT_MS } from './runnerRegistry.js';
 // Re-export the runner layer so existing importers of ./claudeBridge.js (and the `exec` namespace) keep their
 // surface after the #91-6 split — the registry simply has a clearer home now.
-export { resolveSpawnCommand, spawnCapture, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, } from './runnerRegistry.js';
+export { resolveSpawnCommand, spawnCapture, DEFAULT_MAX_CAPTURE_BYTES, UnboundedSkipPermissionsError, UnsupportedCursorSkipPermissionsError, UnsupportedGeminiPermissionOptionsError, claudeRunnerArgs, makeClaudeHeadlessRunner, claudeHeadlessRunner, codexRunnerArgs, makeCodexHeadlessRunner, cursorRunnerArgs, makeCursorHeadlessRunner, getRunnerSpec, geminiRunnerArgs, makeGeminiHeadlessRunner, classifyGeminiRunnerResult, } from './runnerRegistry.js';
 export class ExecBridgeDisabledError extends Error {
     constructor() {
         super('exec bridge is disabled — set EVOLVE_EXEC_BRIDGE=1 or pass { enabled: true } to enable agent execution');
@@ -130,6 +131,18 @@ class ExecBridgeRunCancelledError extends Error {
         this.name = 'ExecBridgeRunCancelledError';
     }
 }
+class GitProofError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'GitProofError';
+    }
+}
+class GitOutputTruncatedError extends GitProofError {
+    constructor(bytes) {
+        super(`git output exceeded the capture limit (${String(bytes ?? 'unknown')} bytes)`);
+        this.name = 'GitOutputTruncatedError';
+    }
+}
 function cancelledExecutionResult(run) {
     return {
         outcome: { status: 'failed', score: 0.1, reason: 'execution cancelled' },
@@ -139,26 +152,85 @@ function cancelledExecutionResult(run) {
         ...(run ? { sessionLog: run.error ? `${run.output}\n${run.error}` : run.output } : {}),
     };
 }
-/** Default git runner: spawn `git <args>` in cwd, return stdout (empty string on error). Env scrubbed — git never needs evolver/hub secrets. */
+function failedProofExecutionResult(run, error, proofOfWork) {
+    return {
+        outcome: { status: 'failed', score: 0.1, reason: `execution proof failed: ${error.message}` },
+        ...(proofOfWork ? { proofOfWork } : {}),
+        strongEvidence: false,
+        failureKind: run.failureKind ?? 'runtime_error',
+        exitCode: run.exitCode ?? null,
+        sessionLog: run.error ? `${run.output}\n${run.error}` : run.output,
+    };
+}
+/** Default git runner: every incomplete command result fails closed. */
 export const defaultGitRunner = async (args, cwd, signal, options) => {
+    let result;
     try {
-        const r = await spawnCapture('git', args, {
+        result = await spawnCapture('git', args, {
             cwd,
             timeoutMs: 30_000,
             env: scrubAgentEnv(process.env),
             ...(signal ? { signal } : {}),
             ...(options?.processSignalMode ? { processSignalMode: options.processSignalMode } : {}),
         });
-        if (r.termination === 'cancelled')
-            throw new ExecBridgeRunCancelledError();
-        return r.stdout;
     }
-    catch (error) {
-        if (error instanceof ExecBridgeRunCancelledError)
-            throw error;
-        return '';
+    catch {
+        throw new GitProofError('git command failed to start or capture output');
     }
+    if (result.termination === 'cancelled')
+        throw new ExecBridgeRunCancelledError();
+    if (result.termination === 'timeout')
+        throw new GitProofError('git command timed out');
+    if (result.stdoutTruncated)
+        throw new GitOutputTruncatedError(result.stdoutBytes);
+    if (result.code !== 0)
+        throw new GitProofError(`git command exited with code ${result.code}`);
+    return result.stdout;
 };
+/** Stream a complete git patch to disk so large diffs never need to be retained in the Node heap. */
+async function writeDefaultGitPatch(args, cwd, destination, signal, onDestinationOpened) {
+    const result = await spawnCapture('git', args, {
+        cwd,
+        timeoutMs: 30_000,
+        env: scrubAgentEnv(process.env),
+        stdoutFile: destination,
+        ...(onDestinationOpened ? { onStdoutFileOpened: onDestinationOpened } : {}),
+        ...(signal ? { signal } : {}),
+    });
+    if (result.termination === 'cancelled')
+        throw new ExecBridgeRunCancelledError();
+    if (result.termination === 'timeout')
+        throw new GitProofError('git patch capture timed out');
+    if (result.code !== 0)
+        throw new GitProofError(`git patch capture exited with code ${result.code}`);
+}
+export const defaultGitPatchWriter = (args, cwd, destination, signal, onDestinationOpened) => (writeDefaultGitPatch(args, cwd, destination, signal, onDestinationOpened));
+function writePrivatePatchFile(path, patch) {
+    let fd;
+    let ownsFile = false;
+    try {
+        fd = openSync(path, 'wx', 0o600);
+        ownsFile = true;
+        writeFileSync(fd, patch, { encoding: 'utf8' });
+        closeSync(fd);
+        fd = undefined;
+    }
+    catch (error) {
+        if (fd !== undefined) {
+            try {
+                closeSync(fd);
+            }
+            catch { /* best-effort close before removing our artifact */ }
+        }
+        if (ownsFile) {
+            try {
+                rmSync(path, { force: true });
+            }
+            catch { /* preserve the persistence failure */ }
+        }
+        throw error;
+    }
+}
 /**
  * Build the `execute` function CycleEngine/runEvolutionCycle consume. Default-off: throws
  * ExecBridgeDisabledError on first call unless enabled.
@@ -168,6 +240,7 @@ export function makeClaudeExecBridge(opts) {
     const spec = getRunnerSpec(opts.runner); // #66: claude (default, byte-identical) | codex
     const agent = opts.agent ?? spec.makeRunner(opts.agentOptions);
     const git = opts.git ?? defaultGitRunner;
+    const gitPatchWriter = opts.gitPatchWriter ?? (git === defaultGitRunner ? defaultGitPatchWriter : undefined);
     const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
     // secure by default; only THIS runner's auth env reaches it (claude never gets OPENAI_, codex never ANTHROPIC_, #66)
     const agentEnv = opts.scrubEnv === false ? undefined : scrubAgentEnv(process.env, { allowPrefixes: spec.envAllow.prefixes, ...(spec.envAllow.keys ? { allowKeys: spec.envAllow.keys } : {}) });
@@ -207,21 +280,40 @@ export function makeClaudeExecBridge(opts) {
         });
         // Isolation: run in a throwaway git worktree so the agent's edits never touch the real working tree.
         const isolate = opts.isolation === 'worktree';
-        const workDir = isolate ? joinPath(tmpdir(), `evolver-wt-${mutation.id}`) : opts.cwd;
         if (opts.signal?.aborted)
             return cancelledExecutionResult(undefined);
+        // Reserve a parent namespace atomically before handing its child path to Git. The parent stays owned until
+        // cleanup completes, so another run cannot reuse the worktree path between Git removal and disk cleanup.
+        const worktreeReservation = isolate ? mkdtempSync(joinPath(tmpdir(), 'evolver-wt-')) : undefined;
+        const workDir = worktreeReservation ? joinPath(worktreeReservation, 'worktree') : opts.cwd;
+        let worktreeRegistered = false;
         let observedRun;
-        const proofGit = async (args, cwd) => {
-            if (opts.signal?.aborted)
-                throw new ExecBridgeRunCancelledError();
-            const output = await git(args, cwd, opts.signal);
+        let patchRef;
+        let ownsPatchRef = false;
+        let preservePatchRef = false;
+        let failedProof;
+        const proofGit = async (args, cwd, onResolved) => {
             if (opts.signal?.aborted)
                 throw new ExecBridgeRunCancelledError();
-            return output;
+            try {
+                const output = await git(args, cwd, opts.signal);
+                onResolved?.();
+                if (opts.signal?.aborted)
+                    throw new ExecBridgeRunCancelledError();
+                return output;
+            }
+            catch (error) {
+                if (error instanceof ExecBridgeRunCancelledError || opts.signal?.aborted)
+                    throw error;
+                if (error instanceof GitProofError)
+                    throw error;
+                throw new GitProofError('git state proof failed');
+            }
         };
         try {
-            if (isolate)
-                await proofGit(['worktree', 'add', '--detach', workDir, 'HEAD'], opts.cwd);
+            if (isolate) {
+                await proofGit(['worktree', 'add', '--detach', workDir, 'HEAD'], opts.cwd, () => { worktreeRegistered = true; });
+            }
             const run = await agent(prompt, {
                 cwd: workDir,
                 timeoutMs,
@@ -245,17 +337,69 @@ export function makeClaudeExecBridge(opts) {
             let changedFiles;
             let numstat;
             let patch = '';
+            const resetIntentToAdd = async () => {
+                if (untrackedFiles.length > 0) {
+                    await git(['reset', '--quiet', '--', ...untrackedFiles], workDir);
+                }
+            };
             try {
                 stat = parseGitShortstat(await proofGit(['diff', '--shortstat', 'HEAD'], workDir));
                 changedFiles = (await proofGit(['diff', '--name-only', 'HEAD'], workDir)).split('\n').map((s) => s.trim()).filter(Boolean);
                 numstat = await proofGit(['diff', '--numstat', 'HEAD'], workDir);
-                if (isolate && stat.files > 0)
-                    patch = await proofGit(['diff', '--binary', '--full-index', 'HEAD'], workDir);
+                if (isolate && stat.files > 0) {
+                    if (gitPatchWriter) {
+                        patchRef = joinPath(tmpdir(), `evolver-patch-${randomUUID()}.diff`);
+                        try {
+                            await gitPatchWriter(['diff', '--binary', '--full-index', 'HEAD'], workDir, patchRef, opts.signal, () => { ownsPatchRef = true; });
+                            // A successful writer owns its result even when an older injected implementation ignores the
+                            // optional callback. On rejection, only the callback can prove that a partial file is ours.
+                            ownsPatchRef = true;
+                        }
+                        catch (error) {
+                            if (error instanceof ExecBridgeRunCancelledError || opts.signal?.aborted)
+                                throw error;
+                            if (error instanceof SpawnCaptureFinalizeError) {
+                                if (error.result.termination === 'cancelled')
+                                    throw new ExecBridgeRunCancelledError();
+                                if (error.result.termination === 'timeout')
+                                    throw new GitProofError('git patch capture timed out');
+                            }
+                            if (error instanceof GitProofError)
+                                throw error;
+                            throw new GitProofError('git patch capture failed');
+                        }
+                    }
+                    else {
+                        patch = await proofGit(['diff', '--binary', '--full-index', 'HEAD'], workDir);
+                    }
+                }
             }
-            finally {
-                if (untrackedFiles.length > 0)
-                    await git(['reset', '--quiet', '--', ...untrackedFiles], workDir);
+            catch (error) {
+                try {
+                    await resetIntentToAdd();
+                }
+                catch (cleanupError) {
+                    if (cleanupError instanceof ExecBridgeRunCancelledError || opts.signal?.aborted) {
+                        throw new ExecBridgeRunCancelledError();
+                    }
+                    // Preserve the primary proof failure for non-cancellation cleanup errors.
+                }
+                throw error;
+            }
+            try {
+                await resetIntentToAdd();
+            }
+            catch (error) {
+                if (error instanceof ExecBridgeRunCancelledError || opts.signal?.aborted)
+                    throw error;
+                if (patchRef && ownsPatchRef) {
+                    failedProof = gitDiffProof(stat, patchRef);
+                    preservePatchRef = true;
+                }
+                throw new GitProofError('git index cleanup failed');
             }
+            if (opts.signal?.aborted)
+                throw new ExecBridgeRunCancelledError();
             // ENFORCE policy against the ACTUAL diff (finding: prompt.ts only ADVISES the agent "touch at most N
             // file(s) / never modify X"; this is the hard gate). checkPolicy ALWAYS runs the global guards — the
             // system blast hard cap (EVOLVER_HARD_CAP_FILES/LINES), the critical-protected paths (.env, MEMORY.md,
@@ -263,11 +407,19 @@ export function makeClaudeExecBridge(opts) {
             // constraints run is no longer un-guarded. The gene's max_files/max_lines/forbidden_paths layer on top.
             // Any violation fails the cycle no matter what the agent did — even when validation would pass.
             const violations = checkPolicy({ stat, changedFiles, numstat, ...(gene?.constraints ? { constraints: gene.constraints } : {}) });
-            let patchRef;
-            if (isolate && stat.files > 0) {
+            if (isolate && stat.files > 0 && !patchRef) {
                 // preserve the isolated edits as a patch (the worktree itself is removed); the real repo is untouched
-                patchRef = joinPath(tmpdir(), `evolver-patch-${mutation.id}.diff`);
-                writeFileSync(patchRef, patch);
+                const destination = joinPath(tmpdir(), `evolver-patch-${randomUUID()}.diff`);
+                try {
+                    (opts.writePatchFile ?? writePrivatePatchFile)(destination, patch);
+                    patchRef = destination;
+                    ownsPatchRef = true;
+                }
+                catch (error) {
+                    if (error instanceof GitProofError)
+                        throw error;
+                    throw new GitProofError('git patch persistence failed');
+                }
             }
             const proof = gitDiffProof(stat, patchRef);
             // Success: prefer the authoritative validation hook; otherwise "agent succeeded AND produced a diff".
@@ -290,6 +442,7 @@ export function makeClaudeExecBridge(opts) {
                 score = Math.min(score, 0.1);
                 reason = summarizeViolations(violations);
             }
+            preservePatchRef = patchRef !== undefined && ownsPatchRef;
             return {
                 outcome: { status: passed ? 'success' : 'failed', score, ...(reason ? { reason } : {}) },
                 proofOfWork: proof,
@@ -306,14 +459,32 @@ export function makeClaudeExecBridge(opts) {
             if (error instanceof ExecBridgeRunCancelledError || opts.signal?.aborted) {
                 return cancelledExecutionResult(observedRun);
             }
+            if (error instanceof GitProofError && observedRun) {
+                return failedProofExecutionResult(observedRun, error, failedProof);
+            }
             throw error;
         }
         finally {
+            if (!preservePatchRef && ownsPatchRef && patchRef) {
+                try {
+                    (opts.removePatchFile ?? ((path) => rmSync(path, { force: true })))(patchRef);
+                }
+                catch { /* best-effort cleanup must not replace the execution result or its primary failure */ }
+            }
             if (isolate) {
+                let worktreeRemoved = false;
                 try {
                     await git(['worktree', 'remove', '--force', workDir], opts.cwd, undefined, { processSignalMode: 'ignore' });
+                    worktreeRemoved = true;
                 }
                 catch { /* best-effort cleanup */ }
+                const addFailedBeforeCreatingWorktree = !worktreeRegistered && !existsSync(workDir);
+                if (worktreeReservation && (worktreeRemoved || addFailedBeforeCreatingWorktree)) {
+                    try {
+                        rmSync(worktreeReservation, { recursive: true, force: true, maxRetries: 3, retryDelay: 50 });
+                    }
+                    catch { /* best-effort cleanup of the owned reservation */ }
+                }
             }
         }
     };

package/dist/exec/openPrRegistry.d.ts

@@ -44,9 +44,15 @@ export declare function findSignalHints(signals: readonly string[], prs: readonl
     threshold?: number;
     topN?: number;
 }): SignalHint[];
+export declare function parseGhOpenPrListResult(result: {
+    code: number | null;
+    stdout: string;
+    stdoutTruncated?: boolean;
+    termination?: 'exit' | 'timeout' | 'cancelled';
+}): OpenPr[];
 /**
- * Default lister: `gh pr list --state=open --json number,title,headRefName,files --limit 50`. Graceful —
- * returns [] on any failure (gh missing, unauthenticated, timeout, bad JSON) so dedup just turns off. gh is a
+ * Default lister: `gh pr list --state=open --json number,title,headRefName,files --limit 50`.
+ * Legacy fetch/parse failures return []; proven incomplete bounded capture rejects so dedup fails closed. gh is a
  * trusted infra tool, so its own auth (GH_TOKEN/GITHUB_TOKEN, or the gh config under $HOME) is passed through.
  */
 export declare function makeGhPrLister(): OpenPrLister;

package/dist/exec/openPrRegistry.js

@@ -77,34 +77,44 @@ export function findSignalHints(signals, prs, opts = {}) {
 }
 // ── gh lister seam + TTL cache ─────────────────────────────────────────────
 const GH_TIMEOUT_MS = 5000;
+export function parseGhOpenPrListResult(result) {
+    if (result.termination !== undefined && result.termination !== 'exit') {
+        throw new Error(`gh open PR list did not complete (${result.termination})`);
+    }
+    if (result.stdoutTruncated)
+        throw new Error('gh open PR list exceeded the capture limit');
+    if (result.code !== 0)
+        return [];
+    try {
+        const arr = JSON.parse(result.stdout || '[]');
+        if (!Array.isArray(arr))
+            return [];
+        return arr.map((pr) => ({
+            number: Number(pr.number),
+            title: String(pr.title ?? ''),
+            headRefName: String(pr.headRefName ?? ''),
+            files: Array.isArray(pr.files) ? pr.files.map((f) => String(f.path ?? '')).filter(Boolean) : [],
+        }));
+    }
+    catch {
+        return [];
+    }
+}
 /**
- * Default lister: `gh pr list --state=open --json number,title,headRefName,files --limit 50`. Graceful —
- * returns [] on any failure (gh missing, unauthenticated, timeout, bad JSON) so dedup just turns off. gh is a
+ * Default lister: `gh pr list --state=open --json number,title,headRefName,files --limit 50`.
+ * Legacy fetch/parse failures return []; proven incomplete bounded capture rejects so dedup fails closed. gh is a
  * trusted infra tool, so its own auth (GH_TOKEN/GITHUB_TOKEN, or the gh config under $HOME) is passed through.
  */
 export function makeGhPrLister() {
     return async (cwd) => {
-        try {
-            const r = await spawnCapture('gh', ['pr', 'list', '--state=open', '--json', 'number,title,headRefName,files', '--limit', '50'], {
-                cwd: cwd ?? process.cwd(),
-                timeoutMs: GH_TIMEOUT_MS,
-                env: scrubAgentEnv(process.env, { allowKeys: ['GH_TOKEN', 'GITHUB_TOKEN', 'GH_HOST', 'GH_CONFIG_DIR'] }),
-            });
-            if (r.code !== 0)
-                return [];
-            const arr = JSON.parse(r.stdout || '[]');
-            if (!Array.isArray(arr))
-                return [];
-            return arr.map((pr) => ({
-                number: Number(pr.number),
-                title: String(pr.title ?? ''),
-                headRefName: String(pr.headRefName ?? ''),
-                files: Array.isArray(pr.files) ? pr.files.map((f) => String(f.path ?? '')).filter(Boolean) : [],
-            }));
-        }
-        catch {
+        const r = await spawnCapture('gh', ['pr', 'list', '--state=open', '--json', 'number,title,headRefName,files', '--limit', '50'], {
+            cwd: cwd ?? process.cwd(),
+            timeoutMs: GH_TIMEOUT_MS,
+            env: scrubAgentEnv(process.env, { allowKeys: ['GH_TOKEN', 'GITHUB_TOKEN', 'GH_HOST', 'GH_CONFIG_DIR'] }),
+        }).catch(() => null);
+        if (!r)
             return [];
-        }
+        return parseGhOpenPrListResult(r);
     };
 }
 /**

package/dist/exec/runnerRegistry.d.ts

@@ -1,4 +1,6 @@
 export declare const DEFAULT_TIMEOUT_MS = 600000;
+/** Per-stream stdout/stderr capture ceiling. A child can emit indefinitely without growing the parent heap. */
+export declare const DEFAULT_MAX_CAPTURE_BYTES = 1048576;
 export interface AgentRunContext {
     cwd: string;
     timeoutMs?: number;
@@ -73,6 +75,17 @@ export interface SpawnCaptureOptions {
     signal?: AbortSignal;
     /** Cleanup subprocesses can shield themselves from repeated SIGINT/SIGTERM instead of cancelling. */
     processSignalMode?: 'cancel' | 'ignore';
+    /** Maximum retained bytes for each of stdout and stderr. The original byte count is still reported. */
+    maxOutputBytes?: number;
+    /** Stream stdout directly to a file when the complete artifact must outlive the subprocess. */
+    stdoutFile?: string;
+    /** Ownership hook fired only after an exclusive redirected stdout artifact is opened successfully. */
+    onStdoutFileOpened?: (path: string) => void;
+    /** Test seam for redirected stdout finalization; production callers should use the filesystem defaults. */
+    stdoutFileOps?: {
+        size(fd: number): number;
+        close(fd: number): void;
+    };
     resolvePlatform?: NodeJS.Platform;
     /** Test seam for Windows process behavior; production callers should use the default. */
     processPlatform?: NodeJS.Platform;
@@ -84,6 +97,17 @@ export interface SpawnCaptureResult {
     stdout: string;
     stderr: string;
     termination: 'exit' | 'timeout' | 'cancelled';
+    /** Present on real spawn results; optional so injected legacy test seams remain source-compatible. */
+    stdoutBytes?: number;
+    stderrBytes?: number;
+    stdoutTruncated?: boolean;
+    stderrTruncated?: boolean;
+    stdoutRedirected?: boolean;
+}
+/** A redirected stdout artifact could not be finalized; the subprocess outcome remains available for classification. */
+export declare class SpawnCaptureFinalizeError extends Error {
+    readonly result: SpawnCaptureResult;
+    constructor(result: SpawnCaptureResult, cause?: unknown);
 }
 /**
  * Promise wrapper over spawn (shell:false). Optionally writes `input` to stdin; resolves with stdout/exit.
@@ -136,6 +160,8 @@ export declare const claudeHeadlessRunner: AgentRunner;
 export declare function codexRunnerArgs(opts?: AgentRunnerOptions): string[];
 /** Headless `codex exec` runner. Working root pinned with `--cd`; prompt is the trailing positional arg (shell:false). */
 export declare function makeCodexHeadlessRunner(opts?: AgentRunnerOptions): AgentRunner;
+/** Interpret one bounded Gemini subprocess result. Structured output and diagnostics require complete capture. */
+export declare function classifyGeminiRunnerResult(result: SpawnCaptureResult, timeoutMs: number): AgentRunResult;
 /** Build verified Gemini CLI argv. The prompt is appended separately as one argv element with shell:false. */
 export declare function geminiRunnerArgs(opts?: AgentRunnerOptions): string[];
 /** Headless Gemini runner with structured failure classification; stdout text alone never proves execution success. */