@humwick/runner 0.130.1 → 0.130.3

package/package.json

@@ -1,15 +1,15 @@
 {
   "name": "@humwick/runner",
-  "version": "0.130.1",
+  "version": "0.130.3",
   "description": "Unified provider lifecycle runner for Humwick",
   "type": "module",
   "bin": {
-    "claude-relay": "src/index.ts",
-    "codex-relay": "src/index.ts",
-    "opencode-relay": "src/index.ts",
-    "claude-humwick": "src/index.ts",
-    "codex-humwick": "src/index.ts",
-    "opencode-humwick": "src/index.ts"
+    "claude-relay": "src/bin/claude.ts",
+    "codex-relay": "src/bin/codex.ts",
+    "opencode-relay": "src/bin/opencode.ts",
+    "claude-humwick": "src/bin/claude.ts",
+    "codex-humwick": "src/bin/codex.ts",
+    "opencode-humwick": "src/bin/opencode.ts"
   },
   "files": [
     "src/**/*.ts",
@@ -29,12 +29,11 @@
     "directory": "runner"
   },
   "dependencies": {
-    "@humwick/offload": "0.0.0",
-    "@humwick/providers": "0.104.7",
-    "@humwick/sdk": "0.2.136",
+    "@humwick/offload": "0.130.3",
+    "@humwick/providers": "0.104.9",
+    "@humwick/sdk": "0.2.138",
     "callmux": "0.25.0",
-    "unbash": "6.0.0",
-    "p-queue": "^9.3.3"
+    "unbash": "6.0.0"
   },
   "devDependencies": {
     "@types/bun": "1.4.2",
@@ -42,8 +41,5 @@
   },
   "engines": {
     "bun": ">=1.4.4"
-  },
-  "bundleDependencies": [
-    "@humwick/offload"
-  ]
+  }
 }

package/plugins/claude/.claude-plugin/plugin.json

@@ -1,7 +1,7 @@
 {
   "name": "agent-relay-runner",
   "description": "Thin Humwick runner bridge for Claude Code",
-  "version": "0.130.1",
+  "version": "0.130.3",
   "agentRelayContracts": {
     "providerPluginProtocol": 1
   }

package/plugins/claude/hooks/gate-run-guard.provisioned.mjs

@@ -260,6 +260,9 @@ function classifyGateRun(command, commands = {}) {
   return null;
 }
 
+// sdk/src/types/host.ts
+var HOST_GATE_KINDS = ["land", "iterate", "validation"];
+
 // sdk/src/land-gates.ts
 import { isAbsolute as isAbsolute2, relative as relative2, resolve as resolve3 } from "path";
 
@@ -420,7 +423,34 @@ function cleanLandGatesConfigFull(value, worktreePath) {
   const requirements = cleanLandGateRequirements(value);
   const cd = value.cd === true;
   const scope = cleanLandGateScope(value);
-  return { gates, ...deliveryPolicy, ...iterate ? { iterate } : {}, ...cd ? { cd } : {}, ...placement ? { placement } : {}, ...requirements ? { requirements } : {}, ...scope };
+  const resources = cleanGateResources(value);
+  return { gates, ...resources ? { resources } : {}, ...deliveryPolicy, ...iterate ? { iterate } : {}, ...cd ? { cd } : {}, ...placement ? { placement } : {}, ...requirements ? { requirements } : {}, ...scope };
+}
+function cleanGateResources(value) {
+  if (!isRecord(value))
+    throw new ValidationError("land-gates config must be an object");
+  if (value.resources === undefined)
+    return;
+  if (!isRecord(value.resources))
+    throw new ValidationError("resources must be an object");
+  const resources = {};
+  for (const [kind, request] of Object.entries(value.resources)) {
+    if (!HOST_GATE_KINDS.includes(kind))
+      throw new ValidationError(`resources: unknown gate kind '${kind}'; use land, iterate or validation`);
+    if (!isRecord(request))
+      throw new ValidationError(`resources.${kind} must be an object`);
+    const parsed = {};
+    for (const [key, n] of Object.entries(request)) {
+      if (key !== "cpus" && key !== "memoryBytes")
+        throw new ValidationError(`resources.${kind}: unknown field '${key}'`);
+      if (typeof n !== "number" || !Number.isFinite(n) || n <= 0 || key === "memoryBytes" && !Number.isSafeInteger(n)) {
+        throw new ValidationError(`resources.${kind}.${key} must be a positive ${key === "memoryBytes" ? "safe integer" : "finite number"}`);
+      }
+      parsed[key] = n;
+    }
+    resources[kind] = parsed;
+  }
+  return resources;
 }
 function cleanDeliveryGatePolicy(value) {
   if (!isRecord(value))

package/src/adapters/claude-effort.ts

@@ -1,5 +1,5 @@
 import { relayEnv, writeChildEnv } from "@humwick/sdk/env";
-import { findProviderCatalog, findProviderCatalogModel, type SpawnProvider } from "@humwick/sdk";
+import { type SpawnProvider } from "@humwick/sdk";
 import { tmuxCommand, tmuxHasSession } from "@humwick/sdk/tmux-utils";
 import type { ManagedProcess, RunnerSpawnConfig } from "../adapter";
 import { effortSwitchEnabledFromEnv } from "../config";
@@ -24,9 +24,7 @@ export function claudeEffortLaunch(effort: string | undefined, inheritedEnv: Rec
 
 /** Persistent transports can switch effort. Host-base `/effort` would save into the human's own settings. */
 export function claudeEffortSwitchMeta(provider: SpawnProvider, config: RunnerSpawnConfig, oneShot: boolean): { effortSwitch?: true } {
-  const catalog = findProviderCatalog(provider);
-  const model = catalog && findProviderCatalogModel(catalog, config.model ?? catalog.defaultModel);
-  return effortSwitchEnabledFromEnv() && !oneShot && providerHomePathFor(provider, config) && model?.efforts.length ? { effortSwitch: true } : {};
+  return effortSwitchEnabledFromEnv() && !oneShot && providerHomePathFor(provider, config) && (config.modelRecord?.efforts?.length || config.effort) ? { effortSwitch: true } : {};
 }
 
 interface ClaudeEffortOutcome { applied?: string; message: string }

package/src/adapters/claude-headless.ts

@@ -137,7 +137,7 @@ export class ClaudeHeadlessAdapter implements ProviderAdapter {
     if (!config.headless) throw new Error("Claude stream-json transport requires --headless");
     // Use the existing provisioning, permission policy and credential-isolation seam.
     // Prompts enter through stdin only; no positional/one-shot prompt at launch.
-    const args = this.launch.buildSpawnArgs({ ...config, prompt: undefined, rig: undefined }, { ...providerConfig, command: "claude" });
+    const args = this.launch.buildSpawnArgs({ ...config, prompt: undefined, rig: undefined }, providerConfig);
     const transportArgs: string[] = [];
     for (let i = 0; i < args.args.length; i++) {
       const arg = args.args[i]!;

package/src/adapters/claude-launch-exit.ts

@@ -0,0 +1,26 @@
+import { readIncrementalFileRange, statIncrementalFile } from "./incremental-file";
+import type { ProviderStatusUpdate } from "../adapter";
+import { readOneShotExitCode } from "../session-scratch";
+
+/** Read only the diagnostic tail, even after a long provider session. */
+async function stderrTail(path: string): Promise<string> {
+  try {
+    const { size } = await statIncrementalFile(path);
+    return new TextDecoder().decode(await readIncrementalFileRange(path, Math.max(0, size - 4096), size)).trim();
+  } catch { return ""; }
+}
+
+// #3830 — a vanished pane is not evidence of a successful provider launch.
+export async function claudeLaunchExitStatus(exitCodeFile: string | undefined, ready: boolean, oneShot: boolean, paneTail = ""): Promise<ProviderStatusUpdate> {
+  const code = exitCodeFile ? await readOneShotExitCode(exitCodeFile) : undefined;
+  // A successful interactive exec replaces the shell and its EXIT trap.
+  if ((code === undefined && ready && !oneShot) || (code === "0" && (ready || oneShot))) return "offline";
+  const tail = exitCodeFile ? await stderrTail(`${exitCodeFile}.stderr`) : "";
+  const reason = ready || oneShot ? "provider-exited" : "spawn_failed";
+  const message = `Claude ${ready || oneShot ? "provider exited" : "launch failed before ready"} (${code === undefined ? "exit code unavailable" : `exit code ${code}`})${tail || paneTail ? `: ${tail || paneTail.slice(-4096)}` : ""}`;
+  return {
+    status: "error",
+    providerState: { state: "failed", reason, message, source: "provider", terminal: true },
+    metadata: { terminalFailureReason: reason, terminalFailureMessage: message },
+  };
+}

package/src/adapters/claude-session-probe.ts

@@ -10,7 +10,7 @@
 // This is the single home (DRY) for reading + version-gating + mapping that probe.
 // `probeActivity`, the BusyReconciler backstop, and the monitorless turn-watch all
 // delegate here; the legacy pane-scrape stays only as the graceful fallback for
-// pre-2.1.119 / probe-missing sessions (e.g. a claude-rig host whose real config
+// pre-2.1.119 / probe-missing sessions (e.g. a host whose real config
 // home the runner can't resolve). Schema is reverse-engineered (pbauermeister/
 // claude-busy-monitor), so we gate on `version`/presence and degrade gracefully if
 // Anthropic ever drifts it.

package/src/adapters/claude-tmux.ts

@@ -1,4 +1,4 @@
-import { relayEnv } from "@humwick/sdk/env";
+import { relayEnv, writeChildEnv } from "@humwick/sdk/env";
 import { envPipeSource, prepareEnvPipe, providerSecretEnvKeys } from "@humwick/sdk/child-env";
 import { PROVIDER_SCRATCH_ENV_KEYS } from "@humwick/sdk/provider-scratch";
 // Claude tmux transport plumbing (extracted from ./claude for the file-size
@@ -15,12 +15,12 @@ import { TMUX_SESSION_OWNER_OPTION, managedTmuxSocketName, renderTmuxSessionTarg
 import { claudeClearCommitted, claudeConversationAnchor, claudePaneIsBusy, claudePaneLooksReady } from "./claude-status-detectors";
 import { ClaudeSubmitFence, ClaudeSubmitTranscriptProbe, claudeSubmitRecoveryConfirmed, submitClaudePromptConfirmed } from "./claude-submit-confirmation";
 import type { ClaudePromptHookExpectation, ClaudePromptHookLedger } from "./claude-prompt-hook";
-import type { ProviderInputObserver } from "../adapter";
+import type { ProviderInputObserver, RunnerSpawnConfig, SpawnArgs } from "../adapter";
 import { logger } from "../logger";
 import { claudeClearSessionVerdict, type ClaudeClearSessionReading } from "./claude-session-probe";
 import { tmuxOwnerIdFromEnv } from "../config";
 import { spawnSyncBounded } from "../bounded-spawn-sync";
-import { launcherGatePathForSession, launcherScriptPathForSession, readOneShotExitCode } from "../session-scratch";
+import { launcherGatePathForSession, launcherScriptPathForSession } from "../session-scratch";
 import { captureTmuxPaneAsync, captureTmuxVisiblePaneAsync, loadTmuxBufferFromStdin, runTmuxInput, tmuxSessionPresence, type TmuxReadOpts, type TmuxSessionPresence } from "./tmux-offload";
 
 export const CLAUDE_TMUX_SUBMIT_DELAY_MS = 250;
@@ -50,11 +50,6 @@ export function seedClaudeInitialPrompt(args: string[], prompt: string, options:
   return { stdinFile: promptFile, exitCodeFile, stdinContents: prompt };
 }
 
-/** A missing sentinel means the one-shot process was killed before its shell could report success. */
-export async function claudeOneShotExitStatus(exitCodeFile?: string): Promise<"offline" | "error"> {
-  if (!exitCodeFile) return "offline";
-  return (await readOneShotExitCode(exitCodeFile)) === "0" ? "offline" : "error";
-}
 
 export function tmuxSessionName(prefix: string, instanceId: string, label?: string): string {
   if (label) return `${prefix}-${sanitizeFsName(label, { replacement: "-", collapse: false, lowercase: true })}`;
@@ -487,8 +482,12 @@ export function writeLauncherScript(sessionName: string, env: Record<string, str
   const unsets = unsetKeys.map((key) => `unset ${shellEnvKey(key)}`).join("\n");
   const gate = gateFifo ? `read -r _ < ${shellQuote(gateFifo)} || true\n` : "";
   const stdin = stdinFile ? `exec < ${shellQuote(stdinFile)}\n` : "";
-  const command = exitCodeFile ? `${shellCmd}\nexit_code=$?\nprintf '%s' "$exit_code" > ${shellQuote(exitCodeFile)}\nexit "$exit_code"` : `exec ${shellCmd}`;
-  writeFileSync(scriptPath, `#!/usr/bin/env bash\n${exports ? `${exports}\n` : ""}${Object.keys(env).length ? `${envPipeSource()}\n` : ""}${unsets ? `${unsets}\n` : ""}rm -f -- "$0"\n${gate}${stdin}${command}\n`, { mode: 0o700 });
+  const codeFile = exitCodeFile ?? `${scriptPath}.exit-code`;
+  // Interactive Claude must own pane_pid for its session probe. execfail lets a
+  // failed exec return to EXIT; print mode keeps a parent to record completion (#3830).
+  const recordExit = `trap ${shellQuote(`exit_code=$?; printf '%s' "$exit_code" > ${shellQuote(codeFile)}; exit "$exit_code"`)} EXIT`;
+  const command = exitCodeFile ? `( ${shellCmd} )` : `exec ${shellCmd}`;
+  writeFileSync(scriptPath, `#!/usr/bin/env bash\numask 077\nshopt -s execfail\nrm -f -- ${shellQuote(codeFile)} ${shellQuote(`${codeFile}.stderr`)}\n${recordExit}\nexec 2> >(tee ${shellQuote(`${codeFile}.stderr`)} >&2)\n${exports ? `${exports}\n` : ""}${Object.keys(env).length ? `${envPipeSource()}\n` : ""}${unsets ? `${unsets}\n` : ""}rm -f -- "$0"\n${gate}${stdin}${command}\n`, { mode: 0o700 });
   return scriptPath;
 }
 
@@ -546,3 +545,32 @@ export function tmuxEnvKeys(env: Record<string, string>, providerEnv: Record<str
   }
   return [...keys].sort();
 }
+
+export function buildClaudeTmuxArgs(config: RunnerSpawnConfig, spawnArgs: SpawnArgs, provider: string): { sessionName: string; socketName: string; args: string[]; launcherScript: string; gateFifo?: string; printMode: boolean } {
+    const requestedSessionName = config.tmuxSession || tmuxSessionName(config.providerConfig.headless.tmuxPrefix, config.instanceId, config.label);
+    // Keep the socket derived from the orchestrator's stable identity, but carry
+    // tmux's rendered session name everywhere we later target the pane. Without
+    // this, `opus-4.8` is created as `opus-4_8` and every watcher/restart lookup
+    // immediately misses it.
+    const socketName = tmuxSocketName(requestedSessionName); const sessionName = tmuxSessionTargetName(requestedSessionName);
+    const shellCmd = [spawnArgs.command, ...spawnArgs.args].map(shellQuote).join(" ");
+    const tmuxArgs = ["new-session", "-d", "-s", sessionName, "-x", "200", "-y", "50"];
+
+    const envKeys = tmuxEnvKeys(spawnArgs.env, config.providerConfig.env, provider);
+    const env: Record<string, string> = {};
+    for (const key of envKeys) if (relayEnv(spawnArgs.env, key) !== undefined) writeChildEnv(env, { [key]: relayEnv(spawnArgs.env, key)! });
+
+    // Only gate the launch behind pipe-pane attachment when there's a log file to
+    // protect (#1317) — no point serializing dev/interactive spawns that never
+    // read AGENT_RELAY_LOG_FILE.
+    const gateFifo = relayEnv(spawnArgs.env, "AGENT_RELAY_LOG_FILE") ? launcherGatePathForSession(sessionName) : undefined;
+
+    // tmux new-session has a hard command-length limit that includes every argv item,
+    // including `-e KEY=value`. The script holds the command; its private FIFO
+    // carries env values without writing credentials to disk or argv.
+    const printMode = spawnArgs.args.some(arg => arg === "-p" || arg === "--print");
+    const exitCodeFile = spawnArgs.exitCodeFile ?? (printMode ? `${launcherScriptPathForSession(sessionName)}.exit-code` : undefined);
+    const launcherScript = writeLauncherScript(sessionName, env, shellCmd, gateFifo, spawnArgs.stdinFile, exitCodeFile, spawnArgs.envUnset);
+    tmuxArgs.push("-c", spawnArgs.cwd, `bash ${shellQuote(launcherScript)}`);
+    return { sessionName, socketName, args: tmuxArgs, launcherScript, gateFifo, printMode };
+}

package/src/adapters/claude.ts

@@ -3,9 +3,9 @@ import { claudeSubagentEnv, claudeSubagentPolicy, configureClaudeSubagentLaunch,
 import { submitClaudeContextCommand } from "./claude-context-command";
 import { scopeClaudeCredentialEnv } from "./claude-credentials";
 import { claudeEffortLaunch, claudeEffortSwitchMeta, switchClaudeEffort } from "./claude-effort";
-import { existsSync } from "node:fs";
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
+import { claudeLaunchExitStatus } from "./claude-launch-exit";
+import { claudeCallerAppends } from "../claude-system-prompt";
+import { resolveLaunchCommand } from "../provider-command";
 import { fireAndForget, sanitizeLaunchBoundary, sanitizeLaunchText, type LivenessSignal, type Message } from "@humwick/sdk";
 import { shellEscape as shellQuote } from "@humwick/sdk/shell-utils";
 import { tmuxCommand, tmuxHasSession } from "@humwick/sdk/tmux-utils";
@@ -25,13 +25,13 @@ import { claudeActivityFromProbeAndPane, claudeBypassDialogDisplayGate, claudeBy
 import { ClaudeSessionCapture, collectClaudeTranscriptArchiveSegment, collectClaudeTranscriptSessionEvents } from "./claude-session-capture";
 import { claudeToolHookPaths, extractLatestContextUsage } from "./claude-transcript";
 import { ClaudeTranscriptTokenUsageCapture } from "./claude-token-usage-capture";
-import { CLAUDE_CLEAR_COMMIT_CAPTURE, CLAUDE_TMUX_READY_TIMEOUT_MS, claudeOneShotExitStatus, confirmClaudeSubmitRecovery, confirmTmuxSessionGone, createLauncherGate, createTmuxSessionWithEnv, releaseClaudeSubmitFence, releaseLauncherGate, seedClaudeInitialPrompt, submitTextToTmux, tmuxEnvKeys, tmuxSessionName, tmuxSessionTargetName, tmuxSocketName, waitForClaudeClearCommitted, waitForClaudeInputReady, writeLauncherScript } from "./claude-tmux";
+import { CLAUDE_CLEAR_COMMIT_CAPTURE, CLAUDE_TMUX_READY_TIMEOUT_MS, buildClaudeTmuxArgs, confirmClaudeSubmitRecovery, confirmTmuxSessionGone, createLauncherGate, createTmuxSessionWithEnv, releaseClaudeSubmitFence, releaseLauncherGate, seedClaudeInitialPrompt, submitTextToTmux, waitForClaudeClearCommitted, waitForClaudeInputReady } from "./claude-tmux";
 import { captureTmuxPaneAsync, captureTmuxVisiblePaneAsync, resolveClaudePanePidAsync, tmuxSessionPresence } from "./tmux-offload";
 import { claudeShutdownGraceMs, shutdownClaudeTmux, type ClaudeShutdownDeps } from "./claude-shutdown";
 import { claudePermissionPromptHandler } from "./claude-permission";
 import { claudeHarnessTrim, claudeProfileDisallowedToolsArgs } from "./claude-tool-policy";
 import { claudeProjectShellEnv } from "./project-shell";
-import { launcherGatePathForSession, stageOneShotPrompt } from "../session-scratch";
+import { stageOneShotPrompt } from "../session-scratch";
 
 type MonitorlessTurnWatchDeps = {
   resolvePanePid: typeof resolveClaudePanePidAsync;
@@ -635,32 +635,22 @@ export class ClaudeAdapter implements ProviderAdapter {
     // #557 — ONE assembler owns the provisioning/vanilla/instruction launch surface
     // (--setting-sources, --plugin-dir, --mcp-config, status-line, --append-system-prompt);
     // profile-projection describes the SAME assembled result, so report == launch. The
-    // adapter only adds the bits the assembler does not own: claude-rig command resolution,
+    // adapter only adds the bits the assembler does not own: launch command resolution,
     // headless permission flags, --model, and the positional prompt. materializeLaunchAssembly
     // writes the provisioned skills/plugins the assembled args point at.
     const assembled = assembleLaunch(this.provider, config, providerConfig);
-    materializeLaunchAssembly(this.provider, config);
+    materializeLaunchAssembly(this.provider, config, assembled);
     const defaultArgs = assembled.hostDefaultArgs;
-    const isClaudeRig = /claude-rig/.test(providerConfig.command);
-    // Profiled launches run their own CLAUDE_CONFIG_DIR (#3387) and must never route through
-    // claude-rig — claude-rig resolves host rig config and would redirect the assembled home.
-    // Only a profile-less (user-wrapped) session may use claude-rig.
-    const usesClaudeRig = isClaudeRig && !assembled.configHome;
-    const bypassRigDefaults = config.headless && usesClaudeRig && config.approvalMode !== "open";
-    const rigPrefix = usesClaudeRig && !bypassRigDefaults && config.rig ? ["launch", config.rig] : [];
-    const command = !usesClaudeRig || bypassRigDefaults || (!config.rig && !findClaudeRigRC(config.cwd))
-      ? "claude"
-      : providerConfig.command;
-    const providerArgs = config.headless
+    const command = resolveLaunchCommand(providerConfig.command);
+    const providerArgs = claudeCallerAppends(config.headless
       ? claudeLaunchArgs(defaultArgs, config.providerArgs, config.approvalMode)
-      : [...defaultArgs, ...config.providerArgs];
+      : [...defaultArgs, ...config.providerArgs]).args;
     // #1096 — when the assembler merged the caller's own `--settings` into relay's (so the
     // baseline hooks/projectSettings/statusLine survive), drop the caller's now-redundant
     // `--settings` here so exactly ONE reaches the launch (relay's merged copy in assembled.args).
     // #2453 — the coding/review profiles' --disallowedTools trim unions in at this single
     // claude-family launch seam (helpers + per-profile config in ./claude-tool-policy).
     const args = claudeProfileDisallowedToolsArgs([
-      ...rigPrefix,
       ...assembled.args,
       ...(assembled.callerSettingsConsumed ? stripSettingsArgs(providerArgs) : providerArgs),
     ], config);
@@ -673,12 +663,10 @@ export class ClaudeAdapter implements ProviderAdapter {
       ...config.env,
       // #557 — the assembler owns the isolated config-home env (CLAUDE_CONFIG_DIR).
       ...assembled.env,
-      // Plain `claude` (isolated profiles) runs its own CLAUDE_CONFIG_DIR and never
-      // routes through claude-rig, so it never inherits the host's long-lived
-      // CLAUDE_CODE_OAUTH_TOKEN. Without it, claude falls back to the (often stale)
-      // file-based .credentials.json and bails to /login (401). claude-rig launches
-      // inject their own token, so only thread it for the plain-claude path, and
-      // never override an explicit per-launch value.
+      // Bare `claude` runs its own CLAUDE_CONFIG_DIR and so never inherits the host's long-lived
+      // CLAUDE_CODE_OAUTH_TOKEN; without it claude falls back to the (often stale) file-based
+      // .credentials.json and bails to /login (401). A custom wrapper command manages its own
+      // token, and an explicit per-launch value always wins.
       ...(command === "claude" && process.env.CLAUDE_CODE_OAUTH_TOKEN && !config.env?.CLAUDE_CODE_OAUTH_TOKEN
         ? { CLAUDE_CODE_OAUTH_TOKEN: process.env.CLAUDE_CODE_OAUTH_TOKEN }
         : {}),
@@ -758,36 +746,13 @@ export class ClaudeAdapter implements ProviderAdapter {
     });
   }
 
-  buildTmuxArgs(config: RunnerSpawnConfig, spawnArgs: SpawnArgs): { sessionName: string; socketName: string; args: string[]; launcherScript: string; gateFifo?: string } {
-    const requestedSessionName = config.tmuxSession || tmuxSessionName(config.providerConfig.headless.tmuxPrefix, config.instanceId, config.label);
-    // Keep the socket derived from the orchestrator's stable identity, but carry
-    // tmux's rendered session name everywhere we later target the pane. Without
-    // this, `opus-4.8` is created as `opus-4_8` and every watcher/restart lookup
-    // immediately misses it.
-    const socketName = tmuxSocketName(requestedSessionName); const sessionName = tmuxSessionTargetName(requestedSessionName);
-    const shellCmd = [spawnArgs.command, ...spawnArgs.args].map(shellQuote).join(" ");
-    const tmuxArgs = ["new-session", "-d", "-s", sessionName, "-x", "200", "-y", "50"];
-
-    const envKeys = tmuxEnvKeys(spawnArgs.env, config.providerConfig.env, this.provider);
-    const env: Record<string, string> = {};
-    for (const key of envKeys) if (relayEnv(spawnArgs.env, key) !== undefined) writeChildEnv(env, { [key]: relayEnv(spawnArgs.env, key)! });
-
-    // Only gate the launch behind pipe-pane attachment when there's a log file to
-    // protect (#1317) — no point serializing dev/interactive spawns that never
-    // read AGENT_RELAY_LOG_FILE.
-    const gateFifo = relayEnv(spawnArgs.env, "AGENT_RELAY_LOG_FILE") ? launcherGatePathForSession(sessionName) : undefined;
-
-    // tmux new-session has a hard command-length limit that includes every argv item,
-    // including `-e KEY=value`. The script holds the command; its private FIFO
-    // carries env values without writing credentials to disk or argv.
-    const launcherScript = writeLauncherScript(sessionName, env, shellCmd, gateFifo, spawnArgs.stdinFile, spawnArgs.exitCodeFile, spawnArgs.envUnset);
-    tmuxArgs.push("-c", spawnArgs.cwd, `bash ${shellQuote(launcherScript)}`);
-    return { sessionName, socketName, args: tmuxArgs, launcherScript, gateFifo };
+  buildTmuxArgs(config: RunnerSpawnConfig, spawnArgs: SpawnArgs): ReturnType<typeof buildClaudeTmuxArgs> {
+    return buildClaudeTmuxArgs(config, spawnArgs, this.provider);
   }
 
   private async spawnHeadless(config: RunnerSpawnConfig, spawnArgs: SpawnArgs): Promise<ManagedProcess> {
     if (spawnArgs.stdinFile && spawnArgs.exitCodeFile && spawnArgs.stdinContents !== undefined) await stageOneShotPrompt(spawnArgs.stdinFile, spawnArgs.exitCodeFile, spawnArgs.stdinContents);
-    const { sessionName, socketName, args: tmuxArgs, launcherScript, gateFifo } = this.buildTmuxArgs(config, spawnArgs);
+    const { sessionName, socketName, args: tmuxArgs, launcherScript, gateFifo, printMode } = this.buildTmuxArgs(config, spawnArgs);
     const providerEpoch = ++this.providerEpoch;
     this.modelUnavailableObservationState = initialClaudeModelUnavailableObservationState();
     this.connectionRetryActive = false;
@@ -802,7 +767,8 @@ export class ClaudeAdapter implements ProviderAdapter {
 
     await createTmuxSessionWithEnv(sessionName, socketName, tmuxArgs, launcherScript, spawnArgs.env, config.providerConfig.env, gateFifo, this.provider);
 
-    this.watchTmuxSession(sessionName, socketName, spawnArgs.exitCodeFile);
+    const exitCodeFile = spawnArgs.exitCodeFile ?? `${launcherScript}.exit-code`;
+    this.watchTmuxSession(sessionName, socketName, exitCodeFile, printMode);
     // #1838 review MED — resolve the pane pid OFF the loop now that the session exists and cache
     // it, so the synchronous resolveBusyPid() never has to shell out on a hot busy edge. Fenced
     // on providerEpoch so a resolve that lands after a restart can't stamp a stale pid.
@@ -832,14 +798,15 @@ export class ClaudeAdapter implements ProviderAdapter {
         tmuxSession: sessionName,
         tmuxSocket: socketName,
         launcherScript,
-        ...claudeEffortSwitchMeta(this.provider, config, Boolean(spawnArgs.exitCodeFile)),
-        ...(spawnArgs.exitCodeFile ? { oneShotExitCodeFile: spawnArgs.exitCodeFile } : {}),
+        exitCodeFile,
+        ...claudeEffortSwitchMeta(this.provider, config, printMode),
+        printMode,
         providerEpoch,
       },
     };
   }
 
-  private watchTmuxSession(sessionName: string, socketName?: string, oneShotExitCodeFile?: string): void {
+  private watchTmuxSession(sessionName: string, socketName?: string, exitCodeFile?: string, oneShot = false): void {
     if (this.tmuxWatcher) clearInterval(this.tmuxWatcher);
     // #1838 row 12 — the highest-frequency blocking site in the runner (every 2s for the
     // agent's whole lifetime). Its two tmux subprocesses (has-session + capture-pane) now run
@@ -849,6 +816,7 @@ export class ClaudeAdapter implements ProviderAdapter {
     // probe on the same pane. `this.tmuxWatcher !== watcher` still fences a predecessor tick
     // whose session was replaced by a respawn.
     let tickInFlight = false;
+    let lastPane = "";
     const watcher = setInterval(() => {
       if (this.tmuxWatcher !== watcher || tickInFlight) return;
       tickInFlight = true;
@@ -866,7 +834,7 @@ export class ClaudeAdapter implements ProviderAdapter {
           // confirm itself only returns true when BOTH reads are `absent` (#1838 HIGH-2).
           const gone = await confirmTmuxSessionGone(sessionName, socketName).catch(() => false);
           if (this.tmuxWatcher !== watcher || !gone) return;
-          const exitStatus = await claudeOneShotExitStatus(oneShotExitCodeFile);
+          const exitStatus = await claudeLaunchExitStatus(exitCodeFile, this.startupReadyObserved, oneShot, lastPane);
           if (this.tmuxWatcher !== watcher) return;
           clearInterval(watcher); this.tmuxWatcher = undefined; this.publishConfirmedTmuxExit(exitStatus);
           return;
@@ -879,6 +847,7 @@ export class ClaudeAdapter implements ProviderAdapter {
         }
         // #1838 HIGH-1: fence again after the capture await, before any observation/status emit.
         if (this.tmuxWatcher !== watcher) return;
+        lastPane = pane;
         // A reused tmux pane can leave an old ready footer in scrollback. Until the
         // current launch is visibly ready, derive both readiness and modal state
         // from the visible grid. After that, avoid an extra capture every tick.
@@ -938,7 +907,7 @@ export class ClaudeAdapter implements ProviderAdapter {
     this.tmuxWatcher = watcher;
   }
 
-  private publishConfirmedTmuxExit(status: "offline" | "error"): void {
+  private publishConfirmedTmuxExit(status: ProviderStatusUpdate): void {
     // The pane and turn pollers are independent. Invalidate the turn generation BEFORE publishing
     // the terminal edge so an in-flight incarnation/activity read cannot land a later idle and
     // resurrect the row with its shutting-down lifecycle pill still latched (#2505).
@@ -962,7 +931,7 @@ export class ClaudeAdapter implements ProviderAdapter {
     const socketName = process.meta?.tmuxSocket as string | undefined;
     const turnWatchResume = this.turnWatchResume?.process === process ? this.turnWatchResume : undefined;
     this.statusWatchersStopped = false;
-    if (sessionName) this.watchTmuxSession(sessionName, socketName, process.meta?.oneShotExitCodeFile as string | undefined);
+    if (sessionName) this.watchTmuxSession(sessionName, socketName, process.meta?.exitCodeFile as string | undefined, process.meta?.printMode === true);
     if (turnWatchResume) await this.beginMonitorlessTurnWatch(process, turnWatchResume.sessionName, turnWatchResume.socketName, false);
   }
 
@@ -1058,22 +1027,6 @@ export { claudeActivityFromProbeAndPane, claudePaneLooksReady, claudePaneIsBusy,
 // Shared shell-quoting; re-exported so `./claude` consumers + tests resolve it.
 export { shellQuote };
 
-export function findClaudeRigRC(cwd: string): string | null {
-  const home = homedir();
-  let dir = resolve(cwd);
-  while (true) {
-    // Stop at $HOME without inspecting it: ~/.claude-rig is the claude-rig tool's
-    // own config home, not a per-project rc marker. Matching it would make every
-    // project under $HOME look like a claude-rig project.
-    if (dir === home) return null;
-    const rc = join(dir, ".claude-rig");
-    if (existsSync(rc)) return rc;
-    const parent = resolve(dir, "..");
-    if (parent === dir) return null;
-    dir = parent;
-  }
-}
-
 async function terminateSingleProcess(process: ManagedProcess, opts: { graceful: boolean; timeoutMs: number }): Promise<ShutdownOutcome> {
   const proc = process.process;
   if (!proc) return "killed"; // nothing to kill — vacuously terminal

package/src/adapters/codex-launch-config.ts

@@ -10,6 +10,7 @@ import { hostProviderDefaultArgs } from "../host-asset-plan";
 import { bundledSkillConfigArgs } from "../launch-assembly";
 import { codexRetiredMcpConfigArgs } from "./codex-effective-config";
 import { codexWebToolsConfigArgs } from "../web-tools";
+import type { ResolvedModelRecord } from "@humwick/sdk/provider-catalog";
 import { tomlString } from "../relay-mcp";
 
 export const DEFAULT_CODEX_TOOL_OUTPUT_TOKEN_LIMIT = 12_000;
@@ -31,14 +32,12 @@ export const DEFAULT_CODEX_TOOL_OUTPUT_TOKEN_LIMIT = 12_000;
 // advertise longer polls to the model (#2776): agents are steered to end the turn and take the wake.
 const CODEX_BACKGROUND_TERMINAL_MAX_TIMEOUT_MS = 900000;
 
-export function codexModelConfigArgs(model?: string, effort?: string): string[] {
+export function codexModelConfigArgs(model?: string, effort?: string, record?: ResolvedModelRecord): string[] {
   const args: string[] = [];
   if (model) args.push("-c", `model=${tomlString(model)}`);
   if (effort) args.push("-c", `model_reasoning_effort=${tomlString(effort)}`);
-  // The catalog alias `astra` resolves to this provider model before runner launch.
-  if (model === "gpt-6-astra") {
-    args.push("-c", "model_context_window=1000000", "-c", "model_auto_compact_token_limit=272000");
-  }
+  if (record?.contextWindowTokens) args.push("-c", `model_context_window=${record.contextWindowTokens}`);
+  if (record?.contextWindowTokens && record.contextThreshold) args.push("-c", `model_auto_compact_token_limit=${Math.floor(record.contextWindowTokens * record.contextThreshold.selfCompactUtilization)}`);
   return args;
 }
 

package/src/adapters/codex.ts

@@ -688,7 +688,7 @@ export class CodexAdapter implements ProviderAdapter {
       ? [
         "app-server",
         ...codexAppServerConfigArgs(defaultArgs, config.providerArgs),
-        ...codexModelConfigArgs(config.model, config.effort),
+        ...codexModelConfigArgs(config.model, config.effort, config.modelRecord),
         ...codexApprovalConfigArgs(config.approvalMode),
         ...codexToolOutputTokenLimitConfigArgs(config), ...codexHarnessConfigArgs(config), ...codexWebToolsConfigArgs(config),
         ...assembled.args,

package/src/adapters/opencode-provider.ts

@@ -35,14 +35,6 @@ export function openCodeBackendApiKeyEnvVar(backendID: string): string | undefin
   return OPENCODE_STATIC_BACKENDS[backendID]?.envVar;
 }
 
-/** Catalog alias → provider model (older runner protocols carry the alias without a record). */
-function openCodeAliasResolved(model: string | undefined, manifest: ProviderManifest, provider: string): string {
-  const alias = model?.trim() || manifest.catalog.defaultModel;
-  const raw = manifest.catalog.models.find((entry) => entry.alias === alias)?.providerModel || alias;
-  if (!raw) throw new Error(`OpenCode provider ${provider} has no default model.`);
-  return raw;
-}
-
 /**
  * #2659 — the launch model: THE one normalization of a spawn's model through the shared seam
  * (`resolveOpenCodeModelId`). A server-threaded record's qualified name wins over the alias.
@@ -51,8 +43,9 @@ function openCodeAliasResolved(model: string | undefined, manifest: ProviderMani
  * default-backend model id.
  */
 export function openCodeLaunchModel(model: string | undefined, provider = "opencode", record?: ResolvedModelRecord, registry?: OpenCodeModelRegistry): OpenCodeModelId {
-  const { manifest, backend } = openCodeBackend(provider);
-  const input = record?.qualifiedModel || openCodeAliasResolved(model, manifest, provider);
+  const { backend } = openCodeBackend(provider);
+  const input = record?.qualifiedModel || model?.trim();
+  if (!input) throw new Error(`OpenCode provider ${provider} requires a hub-resolved model.`);
   return resolveOpenCodeModelId(input, backend.opencodeProviderID, registry);
 }
 
@@ -111,18 +104,10 @@ export function openCodeCustomBackendIDs(): string[] {
   return getAllManifests().flatMap((entry) => entry.opencode && OPENCODE_STATIC_BACKENDS[entry.opencode.opencodeProviderID]?.custom ? [entry.opencode.opencodeProviderID] : []);
 }
 
-/** Read the current backend's declared context window from the manifest catalog. */
-export function openCodeContextWindowTokens(model: string | undefined, provider = "opencode", record?: ResolvedModelRecord): number | undefined {
-  // #2599 — precedence payload > manifest > undefined: the record's window wins; a malformed
-  // record window never reaches here (the shared parser drops it), so no second gate is needed.
-  if (typeof record?.contextWindowTokens === "number" && Number.isFinite(record.contextWindowTokens) && record.contextWindowTokens > 0) {
-    openCodeBackend(provider); // keep the unknown-provider hard error on the record path too.
-    return record.contextWindowTokens;
-  }
-  const { manifest } = openCodeBackend(provider);
-  const { modelID } = openCodeLaunchModel(model, provider);
-  const value = manifest.catalog.models.find((entry) => entry.alias === modelID || entry.providerModel === modelID)?.limits?.contextWindowTokens?.value;
-  return typeof value === "number" && Number.isFinite(value) ? value : undefined;
+/** Context limits come from the hub-resolved launch record. */
+export function openCodeContextWindowTokens(_model: string | undefined, provider = "opencode", record?: ResolvedModelRecord): number | undefined {
+  openCodeBackend(provider);
+  return record?.contextWindowTokens;
 }
 
 /**

package/src/adapters/opencode.ts

@@ -1505,7 +1505,7 @@ export class OpenCodeAdapter implements ProviderAdapter {
       const tokens = countTokens(info?.tokens);
       const sessionUnattributable = Boolean(activeSessionId && sessionID !== activeSessionId);
       if (process && role === "assistant" && tokens !== undefined && !sessionUnattributable) {
-        const model = stringValue(process.meta?.model) ?? openCodeQualifiedModel(undefined, this.provider);
+        const model = stringValue(process.meta?.model);
         this.reportContextUsage(process, model, tokens);
       }
       // #2484 — same door, reused for the spine report: model/createdAt prefer the message's
@@ -1516,7 +1516,7 @@ export class OpenCodeAdapter implements ProviderAdapter {
         scheduleOpenCodeTokenUsage(this.tokenUsagePoster, {
           provider: this.provider,
           sessionId: activeSessionId ?? sessionID,
-          model: openCodeMessageModel(info) ?? stringValue(process.meta?.model) ?? openCodeQualifiedModel(undefined, this.provider),
+          model: openCodeMessageModel(info) ?? stringValue(process.meta?.model),
           messageId: id,
           tokens: info?.tokens,
           createdAt: openCodeMessageObservedAt(info),
@@ -1832,8 +1832,8 @@ export class OpenCodeAdapter implements ProviderAdapter {
       for (const relayContextInput = prepareOpenCodeRelayContext(process, text);;) {
         const client = process.meta?.client as OpenCodeClient | undefined;
         const sessionId = stringValue(process.meta?.sessionId);
-        const model = stringValue(process.meta?.model) ?? openCodeQualifiedModel(undefined, this.provider);
-        if (!client || !sessionId) throw new Error("OpenCode session is not ready");
+        const model = stringValue(process.meta?.model);
+        if (!client || !sessionId || !model) throw new Error("OpenCode session is not ready with a hub-resolved model");
         // #2397 round 5 review (LOW-2) — raised only once we're actually about to run an attempt
         // (past the guard above), so a "session not ready" throw never emits a close for a turn
         // that never started (never emitted its own busy edge below).