@hecer/yoke 1.8.0 → 1.10.0

package/dist/loop/parallel-adapters.js

@@ -2,7 +2,7 @@ import { execFileSync, spawnSync } from 'node:child_process';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { dirname, join } from 'node:path';
 import { isProviderTreeAlive, reapProviderProcesses } from './cleanup.js';
-import { realGitOps, RUNTIME_EXCLUDES, RUNTIME_PATHS } from './git.js';
+import { realGitOps, stageImplementation } from './git.js';
 import { isPidAlive } from './lock.js';
 import { storyPathSegment } from './prd.js';
 import { killProcessTreeForCleanup } from './watchdog.js';
@@ -130,8 +130,7 @@ function rebaseCandidate(targetDir, input) {
         }
         let candidateTree;
         try {
-            execFileSync('git', ['reset', '--quiet', '--', ...RUNTIME_PATHS], { cwd: input.worktree.path, stdio: 'pipe' });
-            execFileSync('git', ['add', '-A', '--', '.', ...RUNTIME_EXCLUDES], { cwd: input.worktree.path, stdio: 'pipe' });
+            stageImplementation(input.worktree.path);
             const unstaged = spawnSync('git', ['diff', '--quiet', '--ignore-submodules=none'], { cwd: input.worktree.path, stdio: 'pipe' });
             if (unstaged.error || unstaged.status !== 0)
                 return { kind: 'reopen', reason: 'candidate contains changes Git cannot snapshot' };

package/dist/loop/parallel-command.js

@@ -1,6 +1,7 @@
 import { existsSync, rmSync } from 'node:fs';
 import { acceptanceProtectionProblem } from '../check/command.js';
 import { makeAsyncAdaptiveRunner } from '../routing/router.js';
+import { resolvePlanner } from '../routing/planning.js';
 import { startProviderProcess } from '../agents/process.js';
 import { runnerInvocation, isAgentAvailable } from './runner.js';
 import { createDispatcher } from './dispatcher.js';
@@ -253,13 +254,19 @@ function reportIntegrator(reporter, worker, phase) {
 function asyncRunner(input, provider, signal, workerId) {
     if (input.routing) {
         const routed = makeAsyncAdaptiveRunner({
-            parent: provider.provider,
-            parentSelection: { ...input.selection, model: provider.model, reasoningEffort: provider.reasoningEffort, ...(provider.provider === 'codex' ? { nativeMultiAgent: false } : {}) },
+            parent: input.routing.strategy === 'capability' ? input.runnerAgent : provider.provider,
+            parentSelection: input.routing.strategy === 'capability' ? input.selection : { ...input.selection, model: provider.model, reasoningEffort: provider.reasoningEffort, nativeMultiAgent: false },
             projectRoot: input.targetDir,
             workers: input.routing.workers,
             rules: input.routing.rules,
             strategy: input.routing.strategy,
             maxCandidates: input.routing.maxCandidates,
+            maxAttempts: input.routing.maxAttempts,
+            planner: resolvePlanner({ planning: input.planning }, input.runnerAgent, input.selection),
+            assessmentPolicy: input.routing.assessmentPolicy,
+            fallback: input.routing.fallback,
+            maxTier: input.routing.maxTier,
+            onDecision: (id, decision) => input.reporter.routingDecision?.(id, decision),
             orchestratorSelection: input.routing.orchestrator,
             isAvailable: input.isAvailable ?? isAgentAvailable,
             captureRoute: async (agent, context, prompt, selection) => {
@@ -275,7 +282,7 @@ function asyncRunner(input, provider, signal, workerId) {
                 return providerProcessResultToAgentResult(agent, context.story.id, await run(context).completion);
             },
         });
-        return context => context.story.agent
+        return context => context.story.agent && input.routing?.strategy !== 'capability'
             ? asyncRunner({ ...input, routing: undefined }, provider, signal, workerId)(context)
             : routed(context);
     }
@@ -305,10 +312,10 @@ export function providerProcessResultToAgentResult(agent, storyId, result) {
     const telemetry = tokens ? { tokens } : {};
     switch (result.kind) {
         case 'succeeded': return { success: true, summary: `${agent} implemented ${storyId}`, ...telemetry };
-        case 'cancelled': return { success: false, summary: result.reason, ...telemetry };
-        case 'timed-out': return { success: false, summary: result.reason, ...telemetry };
-        case 'spawn-failed': return { success: false, summary: result.error, ...telemetry };
-        case 'failed': return { success: false, summary: `${agent} exited ${result.exitCode ?? 'without a code'}`, ...telemetry };
+        case 'cancelled': return { success: false, infrastructureFailure: true, summary: result.reason, ...telemetry };
+        case 'timed-out': return { success: false, infrastructureFailure: true, summary: result.reason, ...telemetry };
+        case 'spawn-failed': return { success: false, infrastructureFailure: true, summary: result.error, ...telemetry };
+        case 'failed': return { success: false, infrastructureFailure: true, summary: `${agent} exited ${result.exitCode ?? 'without a code'}`, ...telemetry };
         default: return assertNever(result);
     }
 }

package/dist/loop/prd.js

@@ -4,6 +4,7 @@ import { parse, stringify } from 'yaml';
 import { z } from 'zod';
 import { StoryQualityDeclarationSchema } from '../quality/types.js';
 import { validWriteScope } from './scheduler.js';
+import { AssessmentSchema } from '../routing/assessment.js';
 export const AcceptanceCriterionSchema = z.object({
     id: z.string().regex(/^[A-Za-z0-9][A-Za-z0-9._-]*$/),
     text: z.string().min(1),
@@ -45,6 +46,9 @@ export const StorySchema = z.object({
     /** Inbox request that created this story. Used for idempotent append-only intake. */
     sourceChange: z.string().min(1).optional(),
     quality: StoryQualityDeclarationSchema.optional(),
+    assessment: AssessmentSchema.optional(),
+    /** Binding to the task, upstream contracts and approved planning brief. */
+    assessmentFor: z.string().regex(/^[a-f0-9]{64}$/).optional(),
 }).superRefine((story, ctx) => {
     const structured = story.acceptance.filter(isAcceptanceCriterion);
     const ids = structured.map(criterion => criterion.id);

package/dist/loop/reporter.js

@@ -1,3 +1,4 @@
+import { readSupervision } from "../agents/supervision.js";
 import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, appendFileSync, statSync, rmSync } from 'node:fs';
 import { join } from 'node:path';
 import { randomUUID } from 'node:crypto';
@@ -76,7 +77,9 @@ export function readStatus(dir) {
     if (!existsSync(file))
         return null;
     try {
-        return JSON.parse(readFileSync(file, 'utf8'));
+        const status = JSON.parse(readFileSync(file, 'utf8'));
+        const supervision = readSupervision(dir, status.startedAt);
+        return supervision.length ? { ...status, supervision } : status;
     }
     catch {
         return null;
@@ -182,6 +185,10 @@ export function makeReporter(dir, opts = {}, now = () => new Date()) {
             emitConsole(consoleLine);
     };
     return {
+        routingDecision(storyId, decision) {
+            if (current)
+                persist({ ...current, routingDecisions: { ...current.routingDecisions, [storyId]: decision }, updatedAt: now().toISOString() }, "routing", `  · route ${storyId}: ${decision.profile} (${decision.reason})`);
+        },
         execution(provider, requestedModel) {
             if (current)
                 persist({ ...current, execution: { provider, requestedModel, startedAt: now().toISOString() }, updatedAt: now().toISOString() }, 'execution', `  · ${provider}/${requestedModel ?? 'provider-default'}`);

package/dist/loop/run-command.js

@@ -1,3 +1,4 @@
+import { roleSelection } from "../routing/capability.js";
 import { join } from 'node:path';
 import { existsSync } from 'node:fs';
 import { loadConfig, saveConfig, defaultConfig, resolveOutputPolicy, resolveVerifyCommand } from '../retrofit/config.js';
@@ -16,6 +17,7 @@ import { buildTrustedDecisionResumeState, clearDecisionResume, decisionProcessin
 import { makeAdaptiveRunner } from '../routing/router.js';
 import { makeActionRunner } from '../execution/actions.js';
 import { runChangeApply } from '../change/inbox.js';
+import { resolvePlanner } from '../routing/planning.js';
 import { createQualityCommandHooks } from '../quality/command.js';
 import { resolveQualityPolicy } from '../quality/types.js';
 import { runParallelLoopCommand } from './parallel-command.js';
@@ -60,9 +62,12 @@ export function loopStatus(targetDir, now = () => new Date()) {
         return `Loop: ${enabled ? 'enabled' : 'disabled'}\nPRD: ${prog}`;
     const head = `Loop: ${st.state.toUpperCase()}${st.story ? ` on ${st.story}${st.storyTitle ? ` "${st.storyTitle}"` : ''}` : ''}`;
     const pct = st.percent !== undefined ? ` (${st.percent}%)` : '';
-    const meta = [st.phase, `iteration ${st.iteration}`, `${st.progress.passed}/${st.progress.total}${pct}`, `updated ${relativeTime(st.updatedAt, now())}`]
+    const meta = [st.phase, `iteration ${st.iteration}`, `backlog ${st.progress.passed}/${st.progress.total}${pct}`, `updated ${relativeTime(st.updatedAt, now())}`]
         .filter(Boolean).join(' · ');
     const lines = [head, `  ${meta}`];
+    for (const process of st.supervision ?? []) {
+        lines.push(`  provider PID ${process.childPid ?? 'not started'}: ${process.state} · attempt ${process.retry + 1} · identity/liveness ${process.liveness ?? 'unknown'} · supervisor heartbeat ${relativeTime(process.heartbeatAt, now())} · last output ${process.lastOutputAt ? relativeTime(process.lastOutputAt, now()) : 'none'} · last successful tool/edit ${process.lastProgressAt ? relativeTime(process.lastProgressAt, now()) : 'none'}${process.reason ? ' · ' + process.reason : ''}`);
+    }
     if (st.state === 'running' && st.eta && st.eta.remainingStories > 0) {
         lines.push(`  ~${fmtDuration(st.eta.etaMs)} remaining (Ø ${fmtDuration(st.eta.avgStoryMs)}/story)`);
     }
@@ -244,7 +249,7 @@ export function runLoopCommand(targetDir, opts) {
     let executionReporter;
     const quality = createQualityCommandHooks({
         targetDir,
-        config,
+        config: opts.routing === false ? { ...config, routing: undefined } : config,
         runnerAgent,
         idleMs,
         onUsage: usage => executionReporter?.addTokens(usage),
@@ -261,7 +266,7 @@ export function runLoopCommand(targetDir, opts) {
     }
     const permissions = opts.permissions ?? config.runner?.permissions ?? 'safe';
     const routingRequested = opts.routing ?? config.routing?.enabled ?? true;
-    const routingEnabled = routingRequested && Boolean(config.routing?.workers.length);
+    const routingEnabled = routingRequested && Boolean(config.routing && (config.routing.workers.length || config.routing.fallback === 'block' || config.routing.maxTier || config.routing.assessmentPolicy === 'prepared'));
     const runnerSelection = {
         model: config.runner?.model,
         reasoningEffort: config.runner?.reasoningEffort,
@@ -273,7 +278,7 @@ export function runLoopCommand(targetDir, opts) {
             ...(runnerSelection.model ? { model: runnerSelection.model } : {}),
             ...(runnerSelection.reasoningEffort ? { reasoningEffort: runnerSelection.reasoningEffort } : {}),
         }];
-    const parallelAffinityProviders = (config.routing?.workers ?? []).map(worker => ({
+    const parallelAffinityProviders = config.routing?.strategy === 'capability' ? config.agents.map(agent => ({ provider: agent, ...(agent === runnerAgent ? runnerSelection : {}) })) : (config.routing?.workers ?? []).map(worker => ({
         provider: worker.agent,
         ...(worker.model ? { model: worker.model } : {}),
         ...(worker.reasoningEffort ? { reasoningEffort: worker.reasoningEffort } : {}),
@@ -349,6 +354,12 @@ export function runLoopCommand(targetDir, opts) {
                 rules: config.routing.rules,
                 strategy: config.routing.strategy,
                 maxCandidates: config.routing.maxCandidates,
+                maxAttempts: config.routing.maxAttempts,
+                planner: resolvePlanner(config, runnerAgent, runnerSelection),
+                assessmentPolicy: config.routing.assessmentPolicy,
+                fallback: config.routing.fallback,
+                maxTier: config.routing.maxTier,
+                onDecision: (id, decision) => executionReporter?.routingDecision?.(id, decision),
                 idleTimeoutMs: idleMs,
                 permissions,
                 runnerOpts,
@@ -385,7 +396,15 @@ export function runLoopCommand(targetDir, opts) {
             console.error(`Reviewer agent CLI "${resolvedReviewer}" was not found on PATH. Install it, or pick another with --reviewer=<claude|codex|gemini>.`);
             return 2;
         }
-        review = makeReviewRunner(resolvedReviewer, idleMs);
+        review = context => {
+            const implementer = readStatus(targetDir)?.routingDecisions?.[context.story.id]?.provider ?? runnerAgent;
+            const selectedReviewer = !opts.reviewer && resolvedReviewer === implementer
+                ? ["codex", "claude", "gemini"].find(agent => agent !== implementer && available(agent)) ?? resolvedReviewer : resolvedReviewer;
+            if (selectedReviewer === implementer && !opts.allowSelfReview)
+                return { success: false, summary: "Independent review requires a provider distinct from the routed implementer", reviewOutcome: { kind: "infrastructure", summary: "Routed implementation and reviewer share a provider" } };
+            reviewProvider = selectedReviewer;
+            return makeReviewRunner(selectedReviewer, idleMs, undefined, routingEnabled ? roleSelection(targetDir, config, context.story, selectedReviewer, "reviewer") : undefined)(context);
+        };
     }
     if (review) {
         const reviewRunner = review;
@@ -471,6 +490,7 @@ export function runLoopCommand(targetDir, opts) {
             providers: parallelProviders,
             affinityProviders: parallelAffinityProviders,
             routing: routingEnabled ? config.routing : undefined,
+            planning: config.planning,
             isAvailable: available,
             onAmbiguity: ambiguityPolicy,
             git: opts.git,

package/dist/loop/runner.js

@@ -10,6 +10,8 @@ import { contextPacket } from '../context/packet.js';
 import { buildProviderInvocation, startProviderProcess } from '../agents/providers.js';
 import { parseProviderResult, parseProviderTelemetry } from '../agents/telemetry.js';
 import { formatReviewContract, formatReviewStdoutContract, parseReviewVerdict } from '../review/verdict.js';
+import { prepareWindowsInvocation } from '../agents/windows-launch.js';
+import { readSupervision } from '../agents/supervision.js';
 export function contextBlockFor(targetDir, story) {
     const context = loadContext(contextDir(targetDir));
     return story ? contextPacket(context, `${story.title} ${story.area ?? ''} ${story.acceptance.map(c => typeof c === 'string' ? c : c.text).join(' ')}`) : formatForPrompt(context);
@@ -29,7 +31,7 @@ export function buildClaudePrompt(story, context, onAmbiguity = 'resolve', perfC
     ];
     if (context)
         lines.push('', context);
-    lines.push('', `Story ${story.id}: ${story.title}`, 'Acceptance criteria (Definition of Done):', criteria, '', "When done, ensure the project's full test suite passes.", 'Do NOT commit — the loop commits on your behalf after verifying.', '', 'Working rules:', '- Add nothing beyond what the story requires: no extra features, abstractions, comments, or defensive code for cases that cannot happen.', '- Do not create summary, plan, or analysis documents — only files the story itself needs.', '- If a check fails, fix the root cause; never bypass it (e.g. --no-verify) or pass by weakening tests.', '- Report the outcome faithfully: if a criterion is unmet or tests fail, say so plainly instead of claiming success.', '- Never ask questions or wait for input — you run unattended and nobody can answer.', onAmbiguity === 'abort'
+    lines.push('', `Story ${story.id}: ${story.title}`, 'Acceptance criteria (Definition of Done):', criteria, ...(story.assessment ? ['Planner approach:', story.assessment.approach] : []), '', "When done, ensure the project's full test suite passes.", 'Do NOT commit — the loop commits on your behalf after verifying.', '', 'Working rules:', '- Add nothing beyond what the story requires: no extra features, abstractions, comments, or defensive code for cases that cannot happen.', '- Do not create summary, plan, or analysis documents — only files the story itself needs.', '- If a check fails, fix the root cause; never bypass it (e.g. --no-verify) or pass by weakening tests.', '- Report the outcome faithfully: if a criterion is unmet or tests fail, say so plainly instead of claiming success.', '- Never ask questions or wait for input — you run unattended and nobody can answer.', onAmbiguity === 'abort'
         ? '- If an acceptance criterion is genuinely undecidable, do NOT guess: write the open question(s) to .yoke/ambiguity.md, change nothing else, and stop.'
         : onAmbiguity === 'critical'
             ? [
@@ -167,8 +169,8 @@ function watchdogArgs() {
 // killing by process-name/command-line pattern takes down other projects'
 // runners too. (Plain repos, e.g. `yoke review` outside a yoke project, get
 // no pid file rather than a littered .yoke dir.)
-export function buildWatchdogInvocation(inv, idleTimeoutMs, ownershipRoot = inv.cwd) {
-    if (idleTimeoutMs <= 0)
+export function buildWatchdogInvocation(inv, idleTimeoutMs, ownershipRoot = inv.cwd, force = false) {
+    if (idleTimeoutMs <= 0 && !force)
         return inv;
     const yokeDir = join(ownershipRoot, '.yoke');
     const pidArgs = existsSync(yokeDir) ? [`--pid-file=${join(yokeDir, 'runner.pid')}`] : [];
@@ -193,20 +195,14 @@ export function win32CommandString(command, args) {
     return [command, ...args].map(q).join(' ');
 }
 function runCli(inv) {
-    if (process.platform === 'win32' && !/\.(?:exe|com)$/iu.test(inv.command) && inv.command !== process.execPath && inv.command !== 'node') {
-        execSync(win32CommandString(inv.command, inv.args), {
-            cwd: inv.cwd,
-            input: inv.input,
-            stdio: ['pipe', 'inherit', 'inherit'],
-        });
-    }
-    else {
-        execFileSync(inv.command, inv.args, {
-            cwd: inv.cwd,
-            input: inv.input,
-            stdio: ['pipe', 'inherit', 'inherit'],
-        });
-    }
+    const launch = process.platform === 'win32' ? prepareWindowsInvocation(inv) : inv;
+    execFileSync(launch.command, launch.args, {
+        cwd: inv.cwd,
+        input: inv.input,
+        stdio: ['pipe', 'inherit', 'inherit'],
+        ...('env' in launch ? { env: launch.env } : {}),
+        windowsHide: true,
+    });
 }
 // Like runCli, but with stdout PIPED and returned (stderr stays inherited) — for
 // token reporting, where the agent's stdout is a machine-readable stream-json feed.
@@ -214,9 +210,8 @@ function runCli(inv) {
 // through it. Throws on a non-zero exit; the error carries the partial stdout.
 function runCliCapture(inv) {
     const opts = { cwd: inv.cwd, input: inv.input, stdio: ['pipe', 'pipe', 'inherit'], encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 };
-    return process.platform === 'win32' && !/\.(?:exe|com)$/iu.test(inv.command) && inv.command !== process.execPath && inv.command !== 'node'
-        ? execSync(win32CommandString(inv.command, inv.args), opts)
-        : execFileSync(inv.command, inv.args, opts);
+    const launch = process.platform === 'win32' ? prepareWindowsInvocation(inv) : inv;
+    return execFileSync(launch.command, launch.args, { ...opts, ...('env' in launch ? { env: launch.env } : {}), windowsHide: true });
 }
 // Reviews have a machine-readable result file, so their console stream is not
 // the result channel. Buffer stderr to preserve the provider's actual failure
@@ -231,10 +226,8 @@ function runReviewCli(inv) {
         encoding: 'utf8',
         maxBuffer: 64 * 1024 * 1024,
     };
-    if (process.platform === 'win32' && !/\.(?:exe|com)$/iu.test(inv.command) && inv.command !== process.execPath && inv.command !== 'node')
-        execSync(win32CommandString(inv.command, inv.args), opts);
-    else
-        execFileSync(inv.command, inv.args, opts);
+    const launch = process.platform === 'win32' ? prepareWindowsInvocation(inv) : inv;
+    execFileSync(launch.command, launch.args, { ...opts, ...('env' in launch ? { env: launch.env } : {}), windowsHide: true });
 }
 function processFailureSummary(error) {
     const message = error instanceof Error ? error.message : String(error);
@@ -303,7 +296,7 @@ export function runReviewAgent(inv) {
     }
 }
 export function makeAsyncRunner(agent, opts = {}) {
-    return (ctx) => startProviderProcess(agent, runnerInvocation(agent, buildClaudePrompt(ctx.story, contextBlockFor(ctx.targetDir, ctx.story), opts.onAmbiguity, opts.perfCommand), ctx.targetDir, true, opts.permissions ?? 'safe', opts.selection), opts.process);
+    return (ctx) => startProviderProcess(agent, runnerInvocation(agent, buildClaudePrompt(ctx.story, contextBlockFor(ctx.targetDir, ctx.story) + (ctx.feedback ? "\nPrior independent failure; preserve useful existing changes and fix the root cause:\n" + ctx.feedback.slice(0, 8000) : ""), opts.onAmbiguity, opts.perfCommand), ctx.targetDir, true, opts.permissions ?? 'safe', opts.selection), { ...opts.process, attempt: ctx.attempt });
 }
 export function makeRunner(agent, idleTimeoutMs = 0, opts = {}) {
     // Claude always streams (see runnerInvocation) — capture the stream so tokens are
@@ -314,8 +307,10 @@ export function makeRunner(agent, idleTimeoutMs = 0, opts = {}) {
         opts.onStart?.(agent, opts.selection ?? {});
         const started = Date.now();
         const attributed = (tokens) => tokens ? { ...tokens, provider: agent, role: 'parent', storyId: ctx.story.id, durationMs: Date.now() - started } : undefined;
-        const base = runnerInvocation(agent, buildClaudePrompt(ctx.story, contextBlockFor(ctx.targetDir, ctx.story), opts.onAmbiguity, opts.perfCommand), ctx.targetDir, captureTokens, opts.permissions ?? 'safe', opts.selection);
-        const inv = buildWatchdogInvocation(base, idleTimeoutMs);
+        const base = runnerInvocation(agent, buildClaudePrompt(ctx.story, contextBlockFor(ctx.targetDir, ctx.story) + (ctx.feedback ? "\nPrior independent failure; preserve useful existing changes and fix the root cause:\n" + ctx.feedback.slice(0, 8000) : ""), opts.onAmbiguity, opts.perfCommand), ctx.targetDir, captureTokens, opts.permissions ?? 'safe', opts.selection);
+        const inv = buildWatchdogInvocation(base, idleTimeoutMs, ctx.targetDir, true);
+        if (ctx.attempt)
+            inv.args.splice(inv.args.indexOf('--'), 0, `--attempt=${ctx.attempt}`);
         if (captureTokens) {
             const capture = opts.execCapture ?? runCliCapture;
             try {
@@ -327,7 +322,8 @@ export function makeRunner(agent, idleTimeoutMs = 0, opts = {}) {
                 // Salvage usage from whatever the agent streamed before dying — those tokens were spent.
                 const partial = e.stdout;
                 const tokens = partial == null ? undefined : parseProviderTelemetry(agent, String(partial).split(/\r?\n/)).tokens;
-                return { success: false, summary: `${agent} failed on ${ctx.story.id}: ${e.message}`, tokens: attributed(tokens) };
+                const reason = readSupervision(ctx.targetDir, new Date(started).toISOString())[0]?.reason;
+                return { success: false, infrastructureFailure: true, summary: `${agent} failed on ${ctx.story.id}: ${reason ?? e.message}`, tokens: attributed(tokens) };
             }
         }
         try {
@@ -338,15 +334,15 @@ export function makeRunner(agent, idleTimeoutMs = 0, opts = {}) {
             return { success: true, summary: `${agent} implemented ${ctx.story.id}` };
         }
         catch (e) {
-            return { success: false, summary: `${agent} failed on ${ctx.story.id}: ${e.message}` };
+            return { success: false, infrastructureFailure: true, summary: `${agent} failed on ${ctx.story.id}: ${e.message}` };
         }
     };
 }
 export const claudeRunner = makeRunner('claude');
-export function makeReviewRunner(agent, idleTimeoutMs = 0, exec) {
+export function makeReviewRunner(agent, idleTimeoutMs = 0, exec, selection = {}) {
     return (ctx) => {
         const before = repositoryFingerprint(ctx.targetDir);
-        const base = agentInvocation(agent, buildReviewPrompt(ctx.story, contextBlockFor(ctx.targetDir, ctx.story), undefined, agent), ctx.targetDir, 'read-only', { nativeMultiAgent: false });
+        const base = agentInvocation(agent, buildReviewPrompt(ctx.story, contextBlockFor(ctx.targetDir, ctx.story), undefined, agent), ctx.targetDir, 'read-only', { ...selection, nativeMultiAgent: false });
         const inv = buildWatchdogInvocation(base, idleTimeoutMs);
         let processFailure;
         let actualModel;

package/dist/loop/watchdog.js

@@ -3,6 +3,8 @@ import { constants } from 'node:os';
 import { writeFileSync, rmSync } from 'node:fs';
 import { pathToFileURL } from 'node:url';
 import { processIncarnation } from '../agents/process-incarnation.js';
+import { prepareWindowsInvocation } from '../agents/windows-launch.js';
+import { createSupervision, supervisionLimits, assertPreviousProvidersStopped } from '../agents/supervision.js';
 // Kill one recorded process tree, platform-appropriately. Exported for
 // `yoke loop cleanup` (scoped reaping of recorded runner pids).
 export function killProcessTree(pid, force = true) {
@@ -30,7 +32,7 @@ function confirmProcessStopped(pid, isProcessAlive) {
     }
     return false;
 }
-export function killProcessForCleanup(pid, platform = process.platform, runTaskkill = (command, args) => spawnSync(command, args, { stdio: 'ignore' }).status, sendSignal = (target, signal) => { process.kill(target, signal); }, isProcessAlive = (target) => {
+export function killProcessForCleanup(pid, platform = process.platform, runTaskkill = (command, args) => spawnSync(command, args, { stdio: 'ignore', timeout: 5000, windowsHide: true }).status, sendSignal = (target, signal) => { process.kill(target, signal); }, isProcessAlive = (target) => {
     try {
         process.kill(target, 0);
         return true;
@@ -52,7 +54,7 @@ export function killProcessForCleanup(pid, platform = process.platform, runTaskk
     }
     return confirmProcessStopped(pid, isProcessAlive);
 }
-export function killProcessTreeForCleanup(pid, platform = process.platform, runTaskkill = (command, args) => spawnSync(command, args, { stdio: 'ignore' }).status, sendSignal = (target, signal) => { process.kill(target, signal); }, isProcessAlive = (target) => {
+export function killProcessTreeForCleanup(pid, platform = process.platform, runTaskkill = (command, args) => spawnSync(command, args, { stdio: 'ignore', timeout: 5000, windowsHide: true }).status, sendSignal = (target, signal) => { process.kill(target, signal); }, isProcessAlive = (target) => {
     try {
         process.kill(target, 0);
         return true;
@@ -91,7 +93,27 @@ export function runWatchdog(opts) {
     const spawnFn = opts.spawnFn ?? spawn;
     const out = opts.out ?? ((d) => process.stdout.write(d));
     const err = opts.err ?? ((d) => process.stderr.write(d));
-    const child = spawnFn(opts.command, opts.args, { shell: process.platform === 'win32', detached: process.platform !== 'win32' });
+    let fail = () => { };
+    let progress = () => { };
+    const limits = opts.spawnFn ? { totalMs: 30 * 60_000, progressMs: 20 * 60_000 } : supervisionLimits(process.cwd());
+    const supervision = opts.spawnFn ? undefined : createSupervision(process.cwd(), reason => fail(reason), () => progress(), opts.attempt);
+    let launch;
+    try {
+        if (!opts.spawnFn)
+            assertPreviousProvidersStopped(process.cwd());
+        launch = process.platform === 'win32' && !opts.spawnFn
+            ? prepareWindowsInvocation({ command: opts.command, args: opts.args, input: '', cwd: process.cwd() })
+            : { command: opts.command, args: opts.args, env: process.env };
+    }
+    catch (error) {
+        const reason = error.message;
+        supervision?.stop(reason);
+        err(`Yoke infrastructure: ${reason}\n`);
+        return Promise.resolve(125);
+    }
+    const child = spawnFn(launch.command, launch.args, { shell: false, detached: process.platform !== 'win32', env: launch.env, windowsHide: true });
+    const incarnation = child.pid === undefined || opts.spawnFn ? undefined : processIncarnation(child.pid);
+    supervision?.start(child.pid, 'shell' in launch ? launch.shell : undefined, incarnation);
     if (opts.stdin && child.stdin) {
         try {
             opts.stdin.pipe(child.stdin);
@@ -115,7 +137,17 @@ export function runWatchdog(opts) {
     const graceMs = opts.graceMs ?? 5000;
     // Explicitly-passed killTree wins (including an explicit undefined, which pins
     // the per-process signal path — tests use this to be platform-independent).
-    const killTree = 'killTree' in opts ? opts.killTree : (pid, _force) => killProcessTreeForCleanup(pid);
+    const killTree = 'killTree' in opts ? opts.killTree : opts.spawnFn ? undefined : (pid, _force) => {
+        try {
+            process.kill(pid, 0);
+        }
+        catch {
+            return true;
+        }
+        if (!opts.spawnFn && (!incarnation || processIncarnation(pid) !== incarnation))
+            return false;
+        return killProcessTreeForCleanup(pid);
+    };
     // Terminate the child — via the tree-killer when we have one and a pid,
     // otherwise per-process signals (POSIX default; SIGKILL is uncatchable).
     let terminationRequested = false;
@@ -135,6 +167,9 @@ export function runWatchdog(opts) {
         let timer;
         let graceTimer;
         let killedForIdle = false;
+        let reason;
+        let totalTimer;
+        let progressTimer;
         // Clear BOTH the idle timer and the post-SIGTERM grace timer so no dangling
         // timers survive on any terminal path (close/error) or on each re-arm.
         const clear = () => {
@@ -160,6 +195,7 @@ export function runWatchdog(opts) {
             timer = setTimeout(() => {
                 timer = undefined;
                 killedForIdle = true;
+                reason = 'provider-output-timeout';
                 terminate(child, false);
                 // Escalation: a child that catches/ignores the soft kill would never emit
                 // 'close' and the promise would hang forever — defeating the watchdog.
@@ -169,14 +205,52 @@ export function runWatchdog(opts) {
                 graceTimer = setTimeout(() => {
                     graceTimer = undefined;
                     terminate(child, true);
+                    supervision?.stop(reason, terminationConfirmed);
+                    if (totalTimer)
+                        clearTimeout(totalTimer);
+                    if (progressTimer)
+                        clearTimeout(progressTimer);
+                    resolve(124);
                 }, graceMs);
             }, opts.idleMs);
         };
-        child.stdout.on('data', (d) => { out(d); arm(); });
-        child.stderr.on('data', (d) => { err(d); arm(); });
-        child.on('error', () => { clear(); removePidFile(); resolve(127); });
-        child.on('close', (code, signal) => {
+        fail = (failure) => {
+            if (killedForIdle)
+                return;
+            killedForIdle = true;
+            reason = failure;
+            err(`Yoke infrastructure: ${failure}\n`);
             clear();
+            terminate(child, false);
+            graceTimer = setTimeout(() => {
+                terminate(child, true);
+                supervision?.stop(reason, terminationConfirmed);
+                if (totalTimer)
+                    clearTimeout(totalTimer);
+                if (progressTimer)
+                    clearTimeout(progressTimer);
+                resolve(125);
+            }, graceMs);
+        };
+        progress = () => {
+            if (progressTimer)
+                clearTimeout(progressTimer);
+            if ((opts.progressMs ?? limits.progressMs) > 0)
+                progressTimer = setTimeout(() => fail('provider-progress-timeout'), opts.progressMs ?? limits.progressMs);
+        };
+        if ((opts.totalMs ?? limits.totalMs) > 0)
+            totalTimer = setTimeout(() => fail('provider-total-timeout'), opts.totalMs ?? limits.totalMs);
+        progress();
+        child.stdout.on('data', (d) => { out(d); supervision?.output('stdout', String(d)); arm(); });
+        child.stderr.on('data', (d) => { err(d); supervision?.output('stderr', String(d)); arm(); });
+        const clearAll = () => { clear(); if (totalTimer)
+            clearTimeout(totalTimer); if (progressTimer)
+            clearTimeout(progressTimer); };
+        child.on('error', () => { clearAll(); supervision?.stop('provider-spawn-failed'); removePidFile(); resolve(127); });
+        child.on('close', (code, signal) => {
+            supervision?.flush();
+            clearAll();
+            supervision?.stop(reason ?? (code === 0 ? 'provider-exited' : 'provider-exit-failed'), !terminationRequested || terminationConfirmed);
             if (!terminationRequested || terminationConfirmed)
                 removePidFile();
             if (killedForIdle) {
@@ -199,16 +273,18 @@ export function parseWatchdogArgs(argv) {
     const rest = sep === -1 ? [] : argv.slice(sep + 1);
     const idleArg = flags.find((a) => a.startsWith('--idle-ms='));
     const idleMs = idleArg ? Number(idleArg.slice('--idle-ms='.length)) : 0;
+    const totalArg = flags.find(a => a.startsWith('--total-ms='))?.slice('--total-ms='.length);
+    const attempt = Number(flags.find(a => a.startsWith('--attempt='))?.slice('--attempt='.length));
     const pidFile = flags.find((a) => a.startsWith('--pid-file='))?.slice('--pid-file='.length);
     const [command, ...args] = rest;
-    return { idleMs: Number.isFinite(idleMs) ? idleMs : 0, command: command ?? '', args, ...(pidFile ? { pidFile } : {}) };
+    return { idleMs: Number.isFinite(idleMs) ? idleMs : 0, command: command ?? '', args, ...(pidFile ? { pidFile } : {}), ...(Number.isInteger(attempt) && attempt > 0 ? { attempt } : {}), ...(totalArg && Number.isFinite(Number(totalArg)) && Number(totalArg) > 0 ? { totalMs: Number(totalArg) } : {}) };
 }
 const isMain = process.argv[1] ? pathToFileURL(process.argv[1]).href === import.meta.url : false;
 if (isMain) {
-    const { idleMs, command, args, pidFile } = parseWatchdogArgs(process.argv.slice(2));
+    const { idleMs, totalMs, attempt, command, args, pidFile } = parseWatchdogArgs(process.argv.slice(2));
     if (!command) {
         process.stderr.write('watchdog: no command given\n');
         process.exit(2);
     }
-    runWatchdog({ command, args, idleMs, stdin: process.stdin, pidFile }).then((code) => process.exit(code));
+    runWatchdog({ command, args, idleMs, totalMs, attempt, stdin: process.stdin, pidFile }).then((code) => process.exit(code));
 }

package/dist/loop/worker.js

@@ -1,3 +1,7 @@
+import { knownInfrastructureFailure } from "../routing/capability.js";
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { acceptanceProtectionProblem } from "../check/command.js";
 import { isAcceptanceCriterion } from './prd.js';
 import { runQualityRepairLoop } from '../quality/loop.js';
 function emptyEvidence() { return { criteria: [] }; }
@@ -167,7 +171,7 @@ export async function runStoryWorker(input) {
     }
     let implementation;
     try {
-        implementation = await input.runner(context);
+        implementation = await runWorkerImplementation(input, context, evidence);
     }
     catch (error) {
         return finalResult(input, {
@@ -178,6 +182,10 @@ export async function runStoryWorker(input) {
     }
     if (implementation.tokens)
         input.reporter?.addTokens(implementation.tokens);
+    if (implementation.infrastructureFailure)
+        implementation.routing?.recordOutcome(false, 'infrastructure');
+    if (implementation.infrastructureFailure || implementation.routing?.blocked)
+        return finalResult(input, { ...baseResult(input, evidence, implementation.summary), kind: "mechanical-failure", stage: "implementation" });
     const afterImplementationCancellation = cancellationReason(input.cancellation);
     if (afterImplementationCancellation) {
         return finalResult(input, { ...baseResult(input, evidence, afterImplementationCancellation), kind: 'cancelled' });
@@ -263,3 +271,24 @@ export async function runStoryWorker(input) {
     }
     return finalResult(input, result);
 }
+async function runWorkerImplementation(input, context, evidence) {
+    let feedback;
+    for (let attempt = 0;; attempt++) {
+        const result = await input.runner({ ...context, feedback });
+        if (!result.routing?.canRetry || result.routing.blocked || attempt >= 7 || cancellationReason(input.cancellation) || input.pause?.())
+            return result;
+        if (["decision-request.yaml", "ambiguity.md", "loop.pause"].some(name => existsSync(join(context.targetDir, ".yoke", name))) || acceptanceProtectionProblem(context.targetDir))
+            return result;
+        const gates = runMechanicalGates(input, context, evidence);
+        if (gates.kind !== "failed")
+            return result;
+        if (knownInfrastructureFailure(gates.summary)) {
+            result.routing.recordOutcome(false, 'infrastructure');
+            return { ...result, success: false, infrastructureFailure: true, summary: gates.summary, routing: { ...result.routing, blocked: true, canRetry: false } };
+        }
+        result.routing.recordOutcome(false);
+        if (result.tokens)
+            input.reporter?.addTokens(result.tokens);
+        feedback = gates.summary;
+    }
+}