@felixdotgo/aidlc-kit 0.2.0 → 0.3.0

package/dist/assets/.agents/aidlc/scripts/lib/loop-daemon.mjs

@@ -1,12 +1,14 @@
-import { randomUUID } from "node:crypto";
-import { lstatSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { lstatSync } from "node:fs";
 import { join } from "node:path";
 import { setTimeout as sleep } from "node:timers/promises";
 import { requireLocalAuthority } from "./authority.mjs";
 import { isLoopProvider, LOOP_PROVIDER_LIST } from "./loop-drivers.mjs";
+import { acquireHolder, describeHolder, LEASE_TTL_MS, readHolder } from "./loop-holder.mjs";
 import { validateLimits, validateRoot, readLoopRecord } from "./loop-runtime.mjs";
 import { createIsolatedLocalSupervisor } from "./loop-supervisor-run-local.mjs";
 import { loadState, nextAction } from "./store.mjs";
+import { resolveTaskRuntimeRead } from "./task-runtime.mjs";
+import { migrateAllTaskRuntime } from "./task-runtime-migrate.mjs";
 
 const ID = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
 
@@ -21,12 +23,12 @@ export function validateDaemonPollMs(value) {
 }
 
 /** A task is loop-owned when it was created through loop intake (CLI or web
- * dashboard: `.agents/data/tasks/<id>/loop-intake.json`) or already has a loop
+ * dashboard: `.agents/data/tasks/<id>/runtime/intake.json`) or already has a loop
  * run record. Tasks created by an interactive lead are not loop-owned, so the
  * daemon never runs them concurrently with that lead. */
 export function isLoopOwned(root, taskId) {
   if (!ID.test(taskId ?? "")) return false;
-  try { if (lstatSync(join(root, ".agents", "data", "tasks", taskId, "loop-intake.json")).isFile()) return true; }
+  try { if (lstatSync(resolveTaskRuntimeRead(root, taskId, "intake.json")).isFile()) return true; }
   catch (error) { if (error?.code !== "ENOENT") throw error; }
   return readLoopRecord(root, taskId) !== null;
 }
@@ -34,79 +36,29 @@ export function isLoopOwned(root, taskId) {
 /** Path of the singleton daemon lock (one local daemon per project root). */
 export const daemonLockPath = (root) => join(root, ".agents", "data", "loop", "daemon.lock");
 
-const pidAlive = (pid) => {
-  try { process.kill(pid, 0); return true; }
-  catch (error) { return error?.code !== "ESRCH"; }
-};
-
-const parseDaemonLock = (path) => {
-  let value;
-  try { value = JSON.parse(readFileSync(path, "utf8")); }
-  catch (error) { if (error?.code === "ENOENT") return null; return { corrupt: true }; }
-  if (!value || value.schemaVersion !== 1 || !Number.isSafeInteger(value.pid) || value.pid < 1 || typeof value.token !== "string" || !value.token) return { corrupt: true };
-  return value;
-};
-
-/** Read the daemon lock: `null` when absent, otherwise `{ pid, startedAt, alive }`. */
+/** Read the daemon lease: `null` when absent, otherwise `{ pid, startedAt,
+ * alive, state, holder }` where `state` is live|stale|corrupt (see
+ * `loop-holder.mjs`). `pid`/`startedAt` stay top-level for the web UI. */
 export function readDaemonLock(root) {
-  const lock = parseDaemonLock(daemonLockPath(root));
-  if (!lock) return null;
-  if (lock.corrupt) return { pid: null, startedAt: null, alive: false };
-  return { pid: lock.pid, startedAt: lock.startedAt ?? null, alive: pidAlive(lock.pid) };
+  const entry = readHolder(daemonLockPath(root), { ttlMs: LEASE_TTL_MS });
+  if (entry.state === "absent") return null;
+  if (entry.state === "corrupt") return { pid: null, startedAt: null, alive: false, state: "corrupt", holder: null };
+  const { holder } = entry;
+  return { pid: holder.pid, startedAt: holder.startedAt ?? null, alive: entry.state === "live", state: entry.state, holder };
 }
 
-/** Run `action` under a short-lived exclusive guard file so two starters
- * cannot both reclaim the same stale lock (one would delete the other's fresh
- * lock). A guard older than 10s is treated as abandoned. */
-function withReclaimGuard(path, action) {
-  const guard = `${path}.guard`;
-  const deadline = Date.now() + 5000;
-  for (;;) {
-    try { writeFileSync(guard, String(process.pid), { flag: "wx", mode: 0o600 }); break; }
-    catch (error) {
-      if (error?.code !== "EEXIST") throw error;
-      try { if (Date.now() - lstatSync(guard).mtimeMs > 10000) { unlinkSync(guard); continue; } }
-      catch (statError) { if (statError?.code === "ENOENT") continue; throw statError; }
-      if (Date.now() >= deadline) throw new Error("Timed out waiting for the loop daemon lock guard");
-      Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, 25);
-    }
-  }
-  try { return action(); }
-  finally { try { unlinkSync(guard); } catch (error) { if (error?.code !== "ENOENT") throw error; } }
-}
-
-/** Acquire the singleton daemon lock. A lock owned by a dead pid (or a corrupt
- * lock) is reclaimed under a guard after re-checking it is still the same stale
- * lock; a live owner fails closed. Liveness is a pid probe, like the loop and
- * supervisor leases, so a recycled pid can keep a stale lock "alive" until the
- * file is removed by hand. Returns a release function. */
-export function acquireDaemonLock(root) {
+/** Acquire the singleton daemon lease (`loop/daemon.lock`, kind lease, scope
+ * daemon, 60s TTL renewed every 15s). A stale holder (expired, or its pid is
+ * gone on this host) or an old corrupt file is reclaimed under the holder
+ * guard; a live owner or a recent corrupt file fails closed with the holder
+ * details and the `leases` command. Returns a release function. */
+export function acquireDaemonLock(root, { onWarning = () => {}, onLost } = {}) {
   const path = daemonLockPath(root);
-  mkdirSync(join(root, ".agents", "data", "loop"), { recursive: true });
-  const token = randomUUID();
-  for (let attempt = 0; attempt < 5; attempt += 1) {
-    try {
-      writeFileSync(path, `${JSON.stringify({ schemaVersion: 1, pid: process.pid, token, startedAt: new Date().toISOString() })}\n`, { flag: "wx", mode: 0o600 });
-      return () => {
-        const current = parseDaemonLock(path);
-        if (current && !current.corrupt && current.token === token) { try { unlinkSync(path); } catch (error) { if (error?.code !== "ENOENT") throw error; } }
-      };
-    } catch (error) {
-      if (error?.code !== "EEXIST") throw error;
-      let stat;
-      try { stat = lstatSync(path); } catch (statError) { if (statError?.code === "ENOENT") continue; throw statError; }
-      if (stat.isSymbolicLink()) throw new Error(`Daemon lock is a symlink: ${path}`);
-      const observed = parseDaemonLock(path);
-      if (!observed) continue;
-      if (!observed.corrupt && pidAlive(observed.pid)) throw new Error(`Loop daemon already running (pid ${observed.pid})`);
-      withReclaimGuard(path, () => {
-        const current = parseDaemonLock(path);
-        const same = current && (observed.corrupt ? current.corrupt : !current.corrupt && current.token === observed.token);
-        if (same) { try { unlinkSync(path); } catch (unlinkError) { if (unlinkError?.code !== "ENOENT") throw unlinkError; } }
-      });
-    }
-  }
-  throw new Error("Could not acquire the loop daemon lock");
+  const handle = acquireHolder({
+    path, kind: "lease", scope: "daemon", purpose: "loop daemon (one per project root)", onWarning, onLost,
+    busyMessage: (entry) => `Loop daemon already running (pid ${entry.holder.pid}): ${describeHolder(entry)}`,
+  });
+  return () => handle.release();
 }
 
 /** Enumerate actionable, loop-owned tasks from canonical state in a
@@ -122,6 +74,15 @@ export function actionableTasks(state, root, { isOwned = (id) => isLoopOwned(roo
     .sort((a, b) => String(a.updatedAt ?? "").localeCompare(String(b.updatedAt ?? "")) || a.id.localeCompare(b.id));
 }
 
+/** Move pre-runtime per-task files under `runtime/` once at daemon start; one
+ * diagnostic summarises the result, nothing when there was nothing to move. */
+function migrateTaskRuntimeOnStart(root, onEvent) {
+  let result;
+  try { result = migrateAllTaskRuntime(root); }
+  catch (error) { onEvent({ type: "diagnostic", message: `Task runtime migration failed: ${error.message}` }); return; }
+  if (result.moved || result.skipped) onEvent({ type: "diagnostic", message: `Task runtime migration: moved ${result.moved} file(s) under .agents/data/tasks/<id>/runtime/, skipped ${result.skipped} (run loop-entry.mjs migrate-data --dry-run --json for details)` });
+}
+
 export const DAEMON_BACKOFF_MAX_MS = 600000;
 
 /** Exponential retry delay for a task whose turn keeps throwing: the poll
@@ -162,10 +123,12 @@ export async function runLoopDaemon({ root: rootInput, authority, pollMs = DEFAU
   const root = validateRoot(rootInput);
   if (!authority || typeof authority.listActionable !== "function" || typeof authority.runTask !== "function") throw new Error("Loop daemon requires a loop authority");
   const poll = validateDaemonPollMs(pollMs);
-  const releaseLock = acquireDaemonLock(root);
+  const lost = new AbortController();
+  const releaseLock = acquireDaemonLock(root, { onWarning: onEvent, onLost: (reason) => { onEvent({ type: "daemon_lease_lost", message: `Daemon lease lost; stopping after the current turn: ${reason}` }); lost.abort(); } });
   try {
     onEvent({ type: "daemon_start", authority: authority.mode ?? "unknown", pid: process.pid });
-    return await daemonLoop({ root, poll, signal, cancelSignal, onEvent, now, listActionable: () => authority.listActionable(), turn: ({ taskId, signal: runSignal, cancelSignal: runCancel, onEvent: runEvent }) => authority.runTask({ taskId, signal: runSignal, cancelSignal: runCancel, onEvent: runEvent }) });
+    migrateTaskRuntimeOnStart(root, onEvent);
+    return await daemonLoop({ root, poll, signal: signal ? AbortSignal.any([signal, lost.signal]) : lost.signal, cancelSignal, onEvent, now, listActionable: () => authority.listActionable(), turn: ({ taskId, signal: runSignal, cancelSignal: runCancel, onEvent: runEvent }) => authority.runTask({ taskId, signal: runSignal, cancelSignal: runCancel, onEvent: runEvent }) });
   } finally { releaseLock(); }
 }
 
@@ -178,9 +141,11 @@ export async function runLocalDaemon({ root: rootInput, agent, workers = {}, wor
   const poll = validateDaemonPollMs(pollMs);
   // Fail fast on a bad config.loop.limits instead of failing every task turn.
   if (limits !== undefined) validateLimits(limits);
-  const releaseLock = acquireDaemonLock(root);
+  const lost = new AbortController();
+  const releaseLock = acquireDaemonLock(root, { onWarning: onEvent, onLost: (reason) => { onEvent({ type: "daemon_lease_lost", message: `Daemon lease lost; stopping after the current turn: ${reason}` }); lost.abort(); } });
   try {
-    return await daemonLoop({ root, agent, workers, workerImages, limits, poll, signal, cancelSignal, onEvent, now, turn: runTaskTurn });
+    migrateTaskRuntimeOnStart(root, onEvent);
+    return await daemonLoop({ root, agent, workers, workerImages, limits, poll, signal: signal ? AbortSignal.any([signal, lost.signal]) : lost.signal, cancelSignal, onEvent, now, turn: runTaskTurn });
   } finally { releaseLock(); }
 }
 
@@ -190,11 +155,13 @@ const RETRY_STATUSES = new Set(["blocked", "reconcile"]);
 /** Poll/run loop. Exported for tests (inject `turn`, `now`, and optionally `listActionable`). */
 export async function daemonLoop({ root, agent, workers, workerImages, limits, poll, signal, cancelSignal, onEvent, now = Date.now, turn = runTaskTurn, isOwned, listActionable }) {
   const backoff = new Map();
+  let lastPollKey = null; // null forces the next successful poll to be emitted
   for (;;) {
     if (signal?.aborted) return { status: "stopped" };
     let actionable;
     try { actionable = listActionable ? await listActionable() : actionableTasks(loadState(root), root, isOwned ? { isOwned } : {}); }
     catch (error) {
+      lastPollKey = null;
       // An unreachable authority (e.g. the fleet service) must not stop the daemon.
       onEvent({ type: "daemon_poll_error", message: error instanceof Error ? error.message : String(error) });
       try { await sleep(poll, undefined, { signal }); } catch (sleepError) { if (sleepError?.name === "AbortError") return { status: "stopped" }; throw sleepError; }
@@ -203,7 +170,14 @@ export async function daemonLoop({ root, agent, workers, workerImages, limits, p
     // Forget backoff for tasks that are no longer actionable (e.g. a human
     // paused or approved them), so they start fresh when they come back.
     for (const id of [...backoff.keys()]) if (!actionable.some((task) => task.id === id)) backoff.delete(id);
-    onEvent({ type: "daemon_poll", actionable: actionable.map((task) => task.id), ...(backoff.size ? { backingOff: [...backoff.keys()] } : {}) });
+    // Emit a poll only when it carries news: the first poll, the first poll
+    // after a poll error (that clears the dashboard's poll error), or a change
+    // in the actionable or backing-off sets (that clears stale turn errors).
+    const pollKey = JSON.stringify([actionable.map((task) => task.id).sort(), [...backoff.keys()].sort()]);
+    if (pollKey !== lastPollKey) {
+      onEvent({ type: "daemon_poll", actionable: actionable.map((task) => task.id), ...(backoff.size ? { backingOff: [...backoff.keys()] } : {}) });
+      lastPollKey = pollKey;
+    }
     for (const task of actionable) {
       if (signal?.aborted) return { status: "stopped" };
       const delay = backoff.get(task.id);

package/dist/assets/.agents/aidlc/scripts/lib/loop-drivers.mjs

@@ -11,20 +11,67 @@ const MAX_STDERR_BYTES = 4096;
 const MAX_RESULT_CHARS = 8192;
 const MAX_STREAM_CHARS = 4096;
 const MAX_DIAGNOSTICS = 16;
+/** Upper bound for the human-readable `summary` carried by live-log events. */
+export const MAX_SUMMARY_CHARS = 240;
 
 /** One runtime enumeration for every loop provider. Host gates import this
  * list; container paths reject providers that need file-based credentials. */
 export const LOOP_PROVIDERS = Object.freeze(["codex", "claude", "opencode"]);
 export const LOOP_PROVIDER_LIST = `${LOOP_PROVIDERS.slice(0, -1).join(", ")}, or ${LOOP_PROVIDERS[LOOP_PROVIDERS.length - 1]}`;
 export const isLoopProvider = (value) => typeof value === "string" && LOOP_PROVIDERS.includes(value);
-const OPENCODE_MODEL = /^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*(?:#[A-Za-z0-9][A-Za-z0-9._-]*)?$/;
+export const OPENCODE_MODEL = /^[A-Za-z0-9][A-Za-z0-9._-]*\/[A-Za-z0-9][A-Za-z0-9._-]*(?:#[A-Za-z0-9][A-Za-z0-9._-]*)?$/;
 
 const record = (value) => value && typeof value === "object" && !Array.isArray(value) ? value : null;
+// Best-effort secret redaction for diagnostics and live-log summaries (commands
+// now reach the event log). Over-redaction is acceptable; leaks are not.
+const SECRET_NAME = String.raw`[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|PASSWD|PASS|PWD|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|CREDENTIALS?|AUTH)[A-Z0-9_.-]*`;
 const redact = (value) => String(value ?? "")
-  .replace(/\b([A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD|API_KEY))=([^\s]+)/gi, "$1=[REDACTED]")
+  // HTTP auth headers first, so the scheme word is not mistaken for the secret.
+  .replace(/\b(Authorization\s*:\s*(?:Basic|Bearer|Token|Digest)?\s*)[^\s'"]+/gi, "$1[REDACTED]")
+  .replace(/\b(x-api-key|api-key|x-auth-token|private-token|x-access-token)(\s*:\s*)[^\s'"]+/gi, "$1$2[REDACTED]")
+  .replace(/\b(Bearer|Basic)\s+[A-Za-z0-9._~+/-]+=*/gi, "$1 [REDACTED]")
+  // NAME=value / NAME: value for secret-looking names (env assignments, config, JSON-ish).
+  .replace(new RegExp(`\\b(${SECRET_NAME})(\\s*[=:]\\s*)("[^"]*"|'[^']*'|[^\\s'"]+)`, "gi"), "$1$2[REDACTED]")
+  // --password value / --token=value style flags.
+  .replace(/((?<![\w-])--?(?:password|passwd|pass|pwd|token|secret|api-?key|access-?key|private-?key|auth|credentials?)(?:[= ]+))("[^"]*"|'[^']*'|[^\s'"]+)/gi, "$1[REDACTED]")
+  // Credentials embedded in URLs (scheme://user:pass@host).
+  .replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@:]+:[^\s/@]+@/gi, "$1[REDACTED]@")
+  // curl -u user:pass / --user user:pass.
+  .replace(/(\s(?:-u|--user)(?:\s+|=))[^\s:]+:[^\s]+/g, "$1[REDACTED]")
+  // mysql -pSECRET (password glued to -p).
+  .replace(/(\bmysql(?:dump|admin)?\b[^\n]*?\s-p)(\S+)/gi, "$1[REDACTED]")
+  // Well-known token formats.
   .replace(/\b(?:sk|ghp|github_pat)_[A-Za-z0-9_-]+\b/g, "[REDACTED]")
+  .replace(/\b(?:sk|gh[pousr]|github_pat|npm|pypi|glpat|hf|xox[abposr])[_-][A-Za-z0-9_-]{8,}/g, "[REDACTED]")
+  .replace(/\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g, "[REDACTED]")
+  .replace(/\bAIza[0-9A-Za-z_-]{30,}/g, "[REDACTED]")
+  .replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]+/g, "[REDACTED]")
+  .replace(/-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?(?:-----END [A-Z ]*PRIVATE KEY-----|$)/g, "[REDACTED]")
   .replace(/\s+/g, " ").trim();
 const diagnostic = (value) => redact(value).slice(0, 512);
+/** Human-readable, secret-redacted, single-line event summary (at most
+ * MAX_SUMMARY_CHARS). Returns undefined for empty input so callers can omit the
+ * field. Shared by every live-log event producer (lead drivers and workers). */
+const SUMMARY_SCAN_CHARS = 4096;
+export function summarize(value) {
+  if (value === undefined || value === null) return undefined;
+  // Only the first MAX_SUMMARY_CHARS survive, so redacting a bounded prefix leaks
+  // nothing and keeps the regexes linear-time on huge inputs (e.g. base64 blobs).
+  const raw = typeof value === "string" ? value : JSON.stringify(value) ?? "";
+  const text = redact(raw.slice(0, SUMMARY_SCAN_CHARS));
+  if (!text) return undefined;
+  return text.length > MAX_SUMMARY_CHARS ? `${text.slice(0, MAX_SUMMARY_CHARS - 1)}…` : text;
+}
+const SUMMARY_INPUT_FIELDS = ["command", "file_path", "filePath", "path", "notebook_path"];
+/** Summary of a tool invocation from its structured input: the shell command or
+ * the touched file when present, otherwise the tool name and its input keys
+ * (never the values of unknown inputs). */
+export function toolSummary(name, input) {
+  const fields = record(input);
+  for (const key of SUMMARY_INPUT_FIELDS) if (typeof fields?.[key] === "string" && fields[key].trim()) return summarize(fields[key]);
+  const keys = fields ? Object.keys(fields).slice(0, 8) : [];
+  return summarize(keys.length ? `${name ?? "tool"} ${JSON.stringify(keys)}` : name);
+}
 const isId = (value) => typeof value === "string" && value.length > 0 && value.length <= 256 && !/[\s\x00-\x1f]/.test(value);
 const emit = async (callback, event) => { if (callback) await callback(event); };
 
@@ -53,7 +100,15 @@ registerAgentAdapter("codex", {
     if (event.type === "turn.failed" || event.type === "error") throw new Error(`codex reported ${event.type}: ${diagnostic(JSON.stringify(event.error ?? event.message ?? "unknown"))}`);
     const item = record(event.item);
     if (event.type === "item.completed" && item?.type === "agent_message" && typeof item.text === "string") { context.result(item.text); await context.stream(item.text); }
-    if (event.type === "item.completed" && item?.type === "command_execution") await context.commandEvent(item.exit_code, item.status);
+    if (event.type === "item.completed" && item?.type === "command_execution") {
+      const command = typeof item.command === "string" ? item.command : undefined;
+      await context.tool("shell", summarize(command));
+      await context.commandEvent(item.exit_code, item.status, command);
+    }
+    if (event.type === "item.completed" && item?.type === "file_change" && Array.isArray(item.changes)) {
+      const paths = item.changes.map((change) => record(change)?.path).filter((path) => typeof path === "string" && path);
+      await context.tool("file_change", summarize(paths.join(", ")));
+    }
   }
 });
 registerAgentAdapter("claude", {
@@ -70,10 +125,15 @@ registerAgentAdapter("claude", {
     const message = record(event.message);
     if (Array.isArray(message?.content)) for (const block of message.content) {
       if (!record(block)) continue;
-      if (block.type === "tool_use" && typeof block.id === "string" && block.name === "Bash") context.toolUses.set(block.id, true);
+      if (block.type === "tool_use" && typeof block.name === "string" && block.name) {
+        await context.tool(block.name, toolSummary(block.name, block.input));
+        // Only shell commands map to lifecycle_command; remember the command for the result.
+        if (typeof block.id === "string" && block.name === "Bash") context.toolUses.set(block.id, typeof record(block.input)?.command === "string" ? block.input.command : "");
+      }
       if (block.type === "tool_result" && typeof block.tool_use_id === "string" && context.toolUses.has(block.tool_use_id)) {
+        const command = context.toolUses.get(block.tool_use_id);
         context.toolUses.delete(block.tool_use_id);
-        await context.commandEvent(block.is_error === true ? 1 : 0, block.is_error === true ? "failed" : "completed");
+        await context.commandEvent(block.is_error === true ? 1 : 0, block.is_error === true ? "failed" : "completed", command);
       }
     }
   }
@@ -95,11 +155,12 @@ registerAgentAdapter("opencode", {
     }
     const part = record(event.part);
     if (event.type === "text" && typeof part?.text === "string") { context.result(part.text); await context.stream(part.text); }
-    if (event.type === "tool_use" && typeof part?.tool === "string") await context.tool(part.tool);
+    const state = record(part?.state);
+    if (event.type === "tool_use" && typeof part?.tool === "string") await context.tool(part.tool, toolSummary(part.tool, state?.input));
     if (event.type === "tool_use" && part?.tool === "shell") {
-      const state = record(part.state);
       const metadata = record(record(state?.metadata)?.metadata);
-      await context.commandEvent(metadata?.exit, state?.status === "error" ? "failed" : state?.status);
+      const command = record(state?.input)?.command;
+      await context.commandEvent(metadata?.exit, state?.status === "error" ? "failed" : state?.status, typeof command === "string" ? command : undefined);
     }
     if (event.type === "step_finish" && part?.reason === "stop") context.complete();
   }
@@ -111,6 +172,16 @@ registerAgentAdapter("opencode", {
  * a checkpoint is durable. Transport and protocol failures reject with a bounded,
  * redacted error message.
  */
+/** Host turn environment: drops the worker credentials `loop-env.mjs` added from the env file
+ * or provider config (listed in AIDLC_LEAD_ENV_EXCLUDE); shell-exported values stay. */
+export function leadEnv(env) {
+  const exclude = String(env.AIDLC_LEAD_ENV_EXCLUDE ?? "").split(",").map((key) => key.trim()).filter(Boolean);
+  if (!exclude.length && env.AIDLC_LEAD_ENV_EXCLUDE === undefined) return env;
+  const copy = { ...env };
+  for (const key of [...exclude, "AIDLC_LEAD_ENV_EXCLUDE"]) delete copy[key];
+  return copy;
+}
+
 export async function runAgentTurn({ agent, root, sessionId, prompt, timeoutMs, onSessionId, onEvent, signal, env, spawnProcess = spawn } = {}) {
   // --- Validate inputs and resolve the adapter -------------------------------
   const adapter = adapters.get(agent);
@@ -129,7 +200,7 @@ export async function runAgentTurn({ agent, root, sessionId, prompt, timeoutMs,
   if (typeof spawnProcess !== "function") throw new Error("spawnProcess must be a function");
   const input = adapter.input?.(prompt);
   if (input !== undefined && typeof input !== "string") throw new Error("agent adapter input must be a string");
-  const child = spawnProcess(adapter.command, args, { cwd: root, shell: false, env: { ...(env ?? process.env), PWD: root }, stdio: [input === undefined ? "ignore" : "pipe", "pipe", "pipe"] });
+  const child = spawnProcess(adapter.command, args, { cwd: root, shell: false, env: { ...leadEnv(env ?? process.env), PWD: root }, stdio: [input === undefined ? "ignore" : "pipe", "pipe", "pipe"] });
   if (input !== undefined) {
     if (!child.stdin) throw new Error("agent transport lacks stdin");
     child.stdin.on("error", () => {});
@@ -168,24 +239,27 @@ export async function runAgentTurn({ agent, root, sessionId, prompt, timeoutMs,
       await emit(onSessionId, value);
     }
   };
-  const commandEvent = async (exitCode, status) => {
+  const commandEvent = async (exitCode, status, command) => {
     const safeExitCode = Number.isSafeInteger(exitCode) ? exitCode : null;
     const safeStatus = ["completed", "failed", "in_progress"].includes(status) ? status : "unknown";
-    await emit(onEvent, { type: "lifecycle_command", exitCode: safeExitCode, status: safeStatus });
+    // The command string is a redacted summary only; command output never leaves the adapter.
+    const summary = summarize(command);
+    await emit(onEvent, { type: "lifecycle_command", exitCode: safeExitCode, status: safeStatus, ...(summary ? { summary } : {}) });
     if ((safeExitCode !== null && safeExitCode !== 0) || safeStatus === "failed") addDiagnostic(`commandFailed exitCode=${String(safeExitCode ?? "unknown")} status=${safeStatus}`);
   };
   const stream = async (text) => {
     if (typeof text === "string" && text.trim()) await emit(onEvent, { type: "agent_text", text: text.slice(0, MAX_STREAM_CHARS) });
   };
-  const tool = async (name) => {
-    if (typeof name === "string" && name) await emit(onEvent, { type: "agent_tool", tool: name });
+  const tool = async (name, summary) => {
+    if (typeof name !== "string" || !name) return;
+    const safeSummary = typeof summary === "string" ? summarize(summary) : undefined;
+    await emit(onEvent, { type: "agent_tool", tool: name, ...(safeSummary ? { summary: safeSummary } : {}) });
   };
   const parseEvent = async (line) => {
     let event;
     try { event = JSON.parse(line); } catch { throw new Error(`${agent} emitted malformed JSONL`); }
     if (!record(event) || typeof event.type !== "string") throw new Error(`${agent} emitted malformed event`);
     await adapter.parse(event, { captureId, commandEvent, toolUses, stream, tool, complete: () => { completed = true; resultSeen = true; }, result: (value) => { resultText = value.slice(0, MAX_RESULT_CHARS); } });
-    await emit(onEvent, { type: "agent_event", eventType: event.type });
   };
   const queueLine = (line) => {
     processing = processing.then(() => parseEvent(line)).catch((error) => fail(error.message));