@humwick/runner 0.130.4 → 0.130.6

package/src/adapters/claude-status-detectors.ts

@@ -3,7 +3,7 @@ import type { PaneObservation, ProviderStatusUpdate } from "../adapter";
 import type { ClaudeClearSessionVerdict, ClaudeProbeActivity } from "./claude-session-probe";
 import { buildRateLimitProviderState, parseClaudeRateLimitPane } from "../rate-limit";
 
-// LEGACY PANE-SCRAPE FALLBACK (#766/#768) — busy/idle is now driven primarily by
+// LEGACY PANE-SCRAPE FALLBACK — busy/idle is now driven primarily by
 // Claude Code's intrinsic session probe (readClaudeSessionStatusAsync, ./claude-session-probe):
 // `$CLAUDE_CONFIG_DIR/sessions/<pid>.json` carries a machine-readable `status` field
 // on CC ≥2.1.119. These two pane heuristics are the SOLE fallback for pre-2.1.119 /
@@ -61,7 +61,7 @@ export function claudeBypassDialogDisplayGate(sessionName: string, observedAt: n
 }
 
 // The live spinner: "✶ Perambulating… (2m 17s · ↓ 8.7k tokens)", "… (", optional hook or
-// tool status ("running PostToolUse hook · ", #3026), then "[Nh ][Nm ]Ns". Anchored on the
+// tool status, then "[Nh ][Nm ]Ns". Anchored on the
 // gerund ellipsis so it can't match the "… +N lines (ctrl+o to expand)" truncation marker,
 // the idle input box, or the "/btw … without interrupting Claude's current work" hint.
 const CLAUDE_BUSY_SPINNER_RE = /…\s*\((?:[^()\n]*·\s*)?(?:\d+h\s+)?(?:\d+m\s+)?\d+s\b/;
@@ -88,7 +88,7 @@ interface ClaudePaneRegions {
   activity?: string[];
 }
 
-// #2202 — find the composer instead of counting rows from the bottom. Inline rendering
+// find the composer instead of counting rows from the bottom. Inline rendering
 // (CLAUDE_CODE_DISABLE_ALTERNATE_SCREEN) pads the capture with blank rows below it, and a
 // completed "Thought for …" row can sit within any fixed window above it.
 function claudePaneRegions(text: string): ClaudePaneRegions {
@@ -120,7 +120,7 @@ function claudeRegionsAreBusy({ footer, activity }: ClaudePaneRegions): boolean
   // the pane veto works across those formats.
   if (footer.includes("esc to interrupt")) return true;
   if (!activity) return CLAUDE_BUSY_SPINNER_RE.test(footer) || CLAUDE_BUSY_THOUGHT_RE.test(footer);
-  // Rows rejoin so a counter Claude wrapped at a narrow width still reads (#3026). A thinking
+  // Rows rejoin so a counter Claude wrapped at a narrow width still reads. A thinking
   // row is live only as the block's head: a completed one stays above "⎿ Interrupted" or output.
   return CLAUDE_BUSY_SPINNER_RE.test(activity.join(" ")) || CLAUDE_BUSY_THOUGHT_RE.test(claudeActivityHead(activity));
 }
@@ -131,7 +131,7 @@ function claudeActivityHead(activity: string[]): string {
   return (tip >= 0 ? activity.slice(0, tip) : activity).at(-1) ?? "";
 }
 
-// #1588 — persistent TUI chrome that is present at the prompt regardless of whether a
+// persistent TUI chrome that is present at the prompt regardless of whether a
 // conversation is loaded, so it must NEVER be picked as a pre-clear conversation anchor.
 // (Includes the claudePaneLooksReady footer markers plus the box/hint chrome around them.)
 const CLAUDE_CHROME_MARKERS = [
@@ -148,14 +148,14 @@ const CLAUDE_CHROME_MARKERS = [
   "Tips for getting started",
 ];
 
-// #1588 — pick a distinctive line from the PRE-clear pane that belongs to the loaded
+// pick a distinctive line from the PRE-clear pane that belongs to the loaded
 // conversation body (not the persistent chrome/footer), so its DISAPPEARANCE after `/clear`
 // is positive evidence the conversation was actually wiped. claudePaneLooksReady alone can't
 // tell "before clear" from "after clear" — its footer markers are present in both — so the
 // self-resume barrier (waitForClaudeClearCommitted) keys off this anchor instead. Returns the
 // longest content-rich, chrome-free line, or undefined when the pane has no such line (e.g. an
 // already-empty conversation) — in which case the clear can't be positively confirmed and the
-// caller falls to continuationDelivered:false so the #1023 backstop covers it.
+// caller falls to continuationDelivered:false so the backstop covers it.
 export function claudeConversationAnchor(pane: string): string | undefined {
   let best: string | undefined;
   for (const raw of claudeConversationRows(pane)) {
@@ -175,7 +175,7 @@ const CLAUDE_BANNER_RE = /Claude Code v\d/;
 // A turn opens with the user's prompt or an assistant, tool or event bullet.
 const CLAUDE_TURN_ROW_RE = /^\s*[❯>⏺●]/;
 
-// #3151 — the rows `/clear` wipes: none of the startup header (banner, model, cwd, tip), which it
+// the rows `/clear` wipes: none of the startup header (banner, model, cwd, tip), which it
 // repaints, and nothing from the composer down, whose status rows change on their own.
 function claudeConversationRows(pane: string): string[] {
   const lines = pane.trimEnd().split("\n");
@@ -186,32 +186,32 @@ function claudeConversationRows(pane: string): string[] {
   return start < 0 ? [] : lines.slice(start, end);
 }
 
-// #1588 — CLEAR-AWARE completion check for the self-resume barrier. The `/clear` keystroke is
+// CLEAR-AWARE completion check for the self-resume barrier. The `/clear` keystroke is
 // async in the Claude TUI: submitTextToTmux returns as soon as the keys are typed, and the
 // persistent footer (claudePaneLooksReady) matches the STILL-UNCLEARED pane, so accepting the
-// first ready match let the continuation race the async clear and get wiped (the #1588 window).
+// first ready match let the continuation race the async clear and get wiped.
 // A clear is treated as COMMITTED only with positive evidence: the pane is (a) not busy (the
 // clear/redraw finished processing), (b) back at the input-ready footer, and (c) no longer shows
 // the pre-clear conversation anchor (the loaded conversation is gone). Any of these missing →
 // NOT committed → keep waiting (and, on timeout, the caller reports continuationDelivered:false
 // so the backstop re-injects — uncertainty resolves toward the backstop, never toward a wipe).
 //
-// #2261 — the anchor test above is the FALLBACK signal, not the primary one, and `currentPane`
+// the anchor test above is the FALLBACK signal, not the primary one, and `currentPane`
 // MUST be a VISIBLE-SCREEN capture (captureTmuxVisiblePaneAsync). Claude's `/clear` repaints only
 // the visible screen, so an anchor that had already scrolled into tmux history stays in a
 // scrollback capture forever and the barrier can never confirm a clear that plainly committed.
 export interface ClaudeClearEvidence {
   /**
-   * #2261 — the intrinsic probe's verdict on Claude's session id (./claude-session-probe), ALREADY
+   * the intrinsic probe's verdict on Claude's session id (./claude-session-probe), ALREADY
    * SETTLED by the caller across a poll interval. Default `unknown` (no probe / pre-2.1.119 /
    * unreadable / liveness-failed / pid changed) keeps the pure anchor behavior.
    */
   session?: ClaudeClearSessionVerdict;
-  /** #2849 — pre-clear pane captured AND anchorless: vacuous clear, so idle+ready
+  /** pre-clear pane captured AND anchorless: vacuous clear, so idle+ready
    * suffices. Never set from a failed capture — that stays fail-closed. */
   preClearEmpty?: boolean;
-  /** #2849r1/#2850 — the poller saw a CLAUDE_VACUOUS_CLEAR_READY_POLLS idle+ready streak.
-   * A ready pane can predate the /clear commit (#1588), and with no probe verdict this
+  /** the poller saw a CLAUDE_VACUOUS_CLEAR_READY_POLLS idle+ready streak.
+   * A ready pane can predate the /clear commit, and with no probe verdict this
    * streak is the only commit evidence. Set by the poller. */
   settledReady?: boolean;
 }
@@ -223,7 +223,7 @@ export function claudeClearCommitted(
 ): boolean {
   if (claudePaneIsBusy(currentPane)) return false;
   if (!claudePaneLooksReady(currentPane)) return false;
-  // #2261 PRIMARY signal — machine-readable and version-robust: committing `/clear` mints a NEW
+  // PRIMARY signal — machine-readable and version-robust: committing `/clear` mints a NEW
   // Claude session (fresh sessionId + fresh transcript file), so a same-pid session rotation is
   // direct proof the loaded conversation is gone, independent of any TUI chrome.
   //
@@ -231,31 +231,31 @@ export function claudeClearCommitted(
   // a relaxation. `unchanged` means the probe positively says the clear has not committed, so it
   // must VETO — never let the (visible-screen-only) anchor heuristic confirm over it, e.g. when
   // unrelated output has merely scrolled the anchor off the screen. The busy/ready gates above
-  // still gate both verdicts, so the #1588 ordering property (never inject while the clear is
+  // still gate both verdicts, so the ordering property (never inject while the clear is
   // still processing) is untouched. `unknown` is no evidence: it falls through to the anchor test,
-  // whose failure still resolves to false → the #1023 backstop re-injects.
+  // whose failure still resolves to false → the backstop re-injects.
   if (evidence.session === "rotated") return true;
   if (evidence.session === "unchanged") return false;
-  // #2849r1 — vacuous clear, BELOW the session veto: an unchanged session still
-  // refuses, and a lone ready poll may be the pre-clear footer (#1588), so both
-  // settledReady (a long consecutive-ready streak, #2850) and preClearEmpty are required.
+  // vacuous clear, BELOW the session veto: an unchanged session still
+  // refuses, and a lone ready poll may be the pre-clear footer, so both
+  // settledReady (a long consecutive-ready streak) and preClearEmpty are required.
   if (evidence.preClearEmpty === true && evidence.settledReady === true) return true;
   if (!preClearAnchor) return false;
   return !currentPane.includes(preClearAnchor);
 }
 
 export interface ClaudeActivityReadOptions {
-  /** #1621: the probe's busy assertion predates an interrupt relay sent (claudeProbeVerdict),
+  /** the probe's busy assertion predates an interrupt relay sent (claudeProbeVerdict),
    *  so it may describe a turn that was cancelled. */
   probeBusyStale?: boolean;
   /**
-   * #1980 U2 — when the intrinsic session probe is UNAVAILABLE (pre-2.1.119 / unresolvable
+   * U2 — when the intrinsic session probe is UNAVAILABLE (pre-2.1.119 / unresolvable
    * config-home), may a bare input-ready-looking pane be read as `idle`?
    *   true  (default) — legacy pane-scrape turn-boundary detection (the monitorless turn-watch):
    *                     an input-ready footer ends the turn.
    *   false — the busy BACKSTOP path: an input-ready-looking footer is NOT positive evidence a
    *           turn ended — a long foreground tool renders the exact same prompt box while fully
-   *           alive (#766/#1980) — so with no probe to corroborate it is SILENCE, reported as
+   *           alive — so with no probe to corroborate it is SILENCE, reported as
    *           `unknown` (the backstop holds the turn) rather than `idle` (which force-cancels it).
    *           This is what stops the `no-busy-observed` false-cancel from ever being reached.
    */
@@ -272,7 +272,7 @@ export function claudeActivityFromProbeAndPane(
   if (claudeRegionsAreBusy(regions)) return "busy";
   const ready = claudePaneLooksReady(regions.footer);
   if (probe === "busy") {
-    // Probe-busy is authoritative (#766, #3026). Only after relay's own interrupt (#1621) may a
+    // Probe-busy is authoritative. Only after relay's own interrupt may a
     // positively input-ready footer overrule it; a shelled-out or unreadable pane keeps it busy.
     return opts.probeBusyStale && ready ? "idle" : "busy";
   }
@@ -280,14 +280,14 @@ export function claudeActivityFromProbeAndPane(
   // input-ready pane corroborates it, an ambiguous pane holds as unknown.
   if (probe === "idle") return ready ? "idle" : "unknown";
   // probe is undefined/unknown here (unavailable, or Claude `waiting`): the pane-scrape fallback.
-  // #1980 U2 — an input-ready footer is only trustworthy as turn-end when the caller opts in
+  // U2 — an input-ready footer is only trustworthy as turn-end when the caller opts in
   // (paneFallbackIsIdle, the turn-boundary path). For the busy backstop (opt-out) it is silence,
   // held as `unknown`, so a live foreground tool the probe cannot see is never force-cancelled.
   if (ready && (opts.paneFallbackIsIdle ?? true)) return "idle";
   return "unknown";
 }
 
-// #286: detect the subscription usage-limit modal in the pane and turn it into the
+// detect the subscription usage-limit modal in the pane and turn it into the
 // provider-neutral rate-limit hold (idle + blocked) that the relay's resume sweep lifts
 // at reset. Unlike the pane model-rejection observation below, it remains a legacy status path.
 export function claudeRateLimitStatus(text: string, sessionName?: string): ProviderStatusUpdate | null {
@@ -305,7 +305,7 @@ export function claudeRateLimitStatus(text: string, sessionName?: string): Provi
   };
 }
 
-// #769 — detect the API connection-retry banner in the live terminal footer. Three stable
+// detect the API connection-retry banner in the live terminal footer. Three stable
 // anchors from the banner text: "Unable to connect to API", "Retrying in <N>s",
 // "attempt <N>/<M>". Gated on the LAST N lines so agent output that merely QUOTES these
 // strings (e.g. quoting this comment, or a discussion of retry logic) doesn't false-positive —
@@ -314,7 +314,7 @@ export function claudeRateLimitStatus(text: string, sessionName?: string): Provi
 // fast fix once the new footer wording is known, and one with no correctness consequence now
 // that this is advisory.
 //
-// #1651 — this returns a DIAGNOSTIC, not a status. It used to return
+// this returns a DIAGNOSTIC, not a status. It used to return
 // `status: "idle"` + `clear: ["subagent"]` + a blocked `conn_retry` providerState. The runner
 // treats an idle provider-turn as the turn ENDING (runner-core setProviderStatus), which
 // clears the work record and calls completeObservedTaskClaims(): retry chrome rendered in a
@@ -362,14 +362,14 @@ export function claudeConnectionRetryClearedObservation(sessionName?: string, no
   };
 }
 
-// #1651 — this returns a DIAGNOSTIC, not a status. It used to return `status: "error"` +
+// this returns a DIAGNOSTIC, not a status. It used to return `status: "error"` +
 // `clear: ["provider-turn", "subagent"]` + a TERMINAL failed provider state + suppressed
 // restart from a single pane match — reproduced live: the harmless sentence "The test fixture
 // says: not an available model" triggered every one of those, from a pane, where the matched
 // text may simply be an agent quoting a fixture, a code comment, or this very file.
 //
 // A pane match is never terminal. Only a correlated StopFailure whose native error type
-// explicitly denotes model-not-found/unavailable (not yet wired — see #1651's Direction
+// explicitly denotes model-not-found/unavailable (not yet wired — the Direction
 // section) may end a turn this way. This detector only notices.
 //
 // Scoped to the trailing modal/composer structural block: the same positional technique

package/src/adapters/claude-subagents.ts

@@ -15,22 +15,22 @@ export function claudeSubagentPolicy(config: Pick<RunnerSpawnConfig, "harnessSub
 
 export function claudeSubagentEnv(config: Pick<RunnerSpawnConfig, "harnessSubagents" | "agentProfile">): Record<string, string> {
   const policy = claudeSubagentPolicy(config);
-  const enabled = writeChildEnv({}, { AGENT_RELAY_HARNESS_SUBAGENTS: harnessSubagentsEnabled(config) ? "1" : "0" });
+  const enabled = writeChildEnv({}, { HUMWICK_HARNESS_SUBAGENTS: harnessSubagentsEnabled(config) ? "1" : "0" }, []);
   return policy ? writeChildEnv({}, { ...enabled,
     CLAUDE_CODE_SUBAGENT_MODEL: policy.model,
     CLAUDE_CODE_SUBAGENT_MODEL_FORCE: "1",
     CLAUDE_CODE_FORK_SUBAGENT: "0",
     CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS: "0",
     CLAUDE_CODE_DISABLE_WORKFLOWS: "1",
-    AGENT_RELAY_CLAUDE_SUBAGENT_CAP: "1",
-  }) : writeChildEnv({}, { ...enabled, AGENT_RELAY_CLAUDE_SUBAGENT_CAP: "0" });
+    HUMWICK_CLAUDE_SUBAGENT_CAP: "1",
+  }, []) : writeChildEnv({}, { ...enabled, HUMWICK_CLAUDE_SUBAGENT_CAP: "0" }, []);
 }
 
 export function claudeSubagentSettings(config: Pick<RunnerSpawnConfig, "harnessSubagents" | "agentProfile" | "model">): Record<string, unknown> {
   const policy = claudeSubagentPolicy(config);
   if (!policy) return harnessSubagentsEnabled(config) ? {} : { disableAllHooks: false };
   const mainFamily = claudeModelFamily(config.model);
-  // Model settings apply to both parent and children, including canonicalized aliases (#3424).
+  // Model settings apply to both parent and children, including canonicalized aliases.
   const modelSettings = mainFamily && mainFamily !== policy.model
     ? { [policy.model]: { maxEffortLevel: policy.effort, autoCompactWindow: policy.contextTokens } } : undefined;
   return { disableAllHooks: false, ...(modelSettings ? { modelSettings } : {}), autoCompactEnabled: true };
@@ -83,11 +83,11 @@ export function configureClaudeSubagentLaunch(config: Pick<RunnerSpawnConfig, "h
   if (!sources.includes("user")) throw new Error("Capped Claude profiles require user settings to load mandatory hooks");
   const settings = extractCallerSettings([launch.args], launch.cwd)?.settings ?? {};
   const callerEnv = settings.env as Record<string, unknown> | undefined;
-  const protectedEnv = [...Object.keys(claudeSubagentEnv(config)), "CLAUDE_CODE_SIMPLE", "CLAUDE_CODE_SAFE_MODE", "CLAUDE_CODE_AUTO_COMPACT_WINDOW", "DISABLE_AUTO_COMPACT", "AGENT_RELAY_CLAUDE_SKILL_SOURCES"];
+  const protectedEnv = [...Object.keys(claudeSubagentEnv(config)), "CLAUDE_CODE_SIMPLE", "CLAUDE_CODE_SAFE_MODE", "CLAUDE_CODE_AUTO_COMPACT_WINDOW", "DISABLE_AUTO_COMPACT", "HUMWICK_CLAUDE_SKILL_SOURCES"];
   if (callerEnv && protectedEnv.some((key) => key in callerEnv)) throw new Error("Capped Claude profiles cannot override child policy through --settings env");
-  writeChildEnv(launch.env, { AGENT_RELAY_CLAUDE_SKILL_SOURCES: JSON.stringify({ cwd: launch.cwd,
+  writeChildEnv(launch.env, { HUMWICK_CLAUDE_SKILL_SOURCES: JSON.stringify({ cwd: launch.cwd,
     sources,
     directories: values("--add-dir", true), plugins: values("--plugin-dir", true),
     settings: { enabledPlugins: settings.enabledPlugins, skillOverrides: settings.skillOverrides },
-  }) });
+  }) }, []);
 }

package/src/adapters/claude-submit-confirmation.ts

@@ -1,7 +1,7 @@
 // A tmux command exiting 0 only proves that tmux accepted a key. Claude can still
 // have the pasted prompt in its composer (for example when Enter lands in copy mode).
 // Claude's UserPromptSubmit hook proves acceptance; the composer only decides whether
-// another Enter is safe, and confirms alone only on hookless launches (#2664).
+// another Enter is safe, and confirms alone only on hookless launches.
 import { ProviderSubmitFailure } from "../provider-submit-failure";
 import type { ClaudePromptHookExpectation } from "./claude-prompt-hook";
 import { claudeHookPromptMatches } from "./claude-prompt-hook";
@@ -11,7 +11,7 @@ import { IncrementalClaudeTranscriptTail, type IncrementalTranscriptPollResult }
 
 export const CLAUDE_SUBMIT_MAX_ENTERS = 3;
 export const CLAUDE_SUBMIT_HOOK_WAIT_MS = 3_000;
-/** Extra hook wait once our Enter left the composer: a slow hook is still proof (#3081). */
+/** Extra hook wait once our Enter left the composer: a slow hook is still proof. */
 export const CLAUDE_SUBMIT_LATE_HOOK_WAIT_MS = 10_000;
 const PASTE_RENDER_TIMEOUT_MS = 3_000;
 const SUBMIT_SETTLE_MS = 1_200;
@@ -83,7 +83,7 @@ export class ClaudeSubmitTranscriptProbe {
   }
 
   async confirms(text: string, offeredAt: number, imagePaths: readonly string[] = []): Promise<boolean> {
-    // A consumption check must leave its read available to submit recovery (#2691).
+    // A consumption check must leave its read available to submit recovery.
     const result = this.recoveryPoll = (await this.poll()) ?? undefined;
     return result?.userPrompts.some((prompt, i) =>
       (result.userPromptOccurredAts[i] ?? -Infinity) >= offeredAt && claudeHookPromptMatches(prompt, text, imagePaths)) === true;
@@ -96,7 +96,7 @@ export class ClaudeSubmitFence {
 
   async run(session: string, submit: (markPasteStarted: () => void) => Promise<unknown>, recovery: (turnStarted: boolean) => Promise<boolean>): Promise<void> {
     // Probe here too: a dashboard prompt reaches the fence directly, and the turn that would
-    // otherwise trigger recovery may have started before the failure was recorded (#2664).
+    // otherwise trigger recovery may have started before the failure was recorded.
     if (this.uncertain.has(session) && !await this.recover(session)) {
       throw new ProviderSubmitFailure("Claude prompt submit remains unconfirmed from an earlier attempt; inspect the TUI before retrying", false);
     }
@@ -140,7 +140,7 @@ export interface ClaudeComposerReadDeps {
   now?: () => number;
 }
 
-// Hookless (degraded) composer acceptance (#2664): empty only after a readable empty composer
+// Hookless (degraded) composer acceptance: empty only after a readable empty composer
 // has lasted SUBMIT_SETTLE_MS from its FIRST empty frame, with no input re-shown meanwhile.
 // A torn frame neither confirms nor withdraws, but the window must end on a readable empty
 // frame; an unsettled or unreadable end is "unreadable", so no key goes into a dialog.
@@ -174,7 +174,7 @@ async function readComposer(deps: ClaudeComposerReadDeps, timeoutMs: number): Pr
 
 // Claude renders composer placeholders ("Press up to edit queued messages" after a
 // mid-turn submit, "Try …") dim; typed and pasted input never is. Reading a styled
-// capture keeps a placeholder from looking like an unsubmitted prompt (#2664).
+// capture keeps a placeholder from looking like an unsubmitted prompt.
 const TERMINAL_ESCAPE = /\x1b\[([0-9;:]*)m|\x1b\[[0-9;?]*[A-Za-z]|\x1b\][^\x07\x1b]*(?:\x07|\x1b\\)/g;
 
 function sgrDim(params: string, dim: boolean): boolean {

package/src/adapters/claude-tmux.ts

@@ -2,7 +2,7 @@ import { relayEnv, writeChildEnv } from "@humwick/sdk/env";
 import { envPipeSource, prepareEnvPipe, providerSecretEnvKeys } from "@humwick/sdk/child-env";
 import { PROVIDER_SCRATCH_ENV_KEYS } from "@humwick/sdk/provider-scratch";
 // Claude tmux transport plumbing (extracted from ./claude for the file-size
-// ratchet, #300/#291): session/socket naming, pane capture, input-ready gating,
+// ratchet): session/socket naming, pane capture, input-ready gating,
 // paste/submit injection, launcher-script materialization, and env-key selection.
 // The adapter (./claude) keeps the lifecycle decisions; this module owns the
 // mechanical tmux interactions they ride on. Public symbols are re-exported from
@@ -43,7 +43,7 @@ export function seedClaudeInitialPrompt(args: string[], prompt: string, options:
   if (!options.headless || options.lifecycle !== "transient") {
     throw new Error("oversized Claude initial prompt requires a transient headless launch; refusing a racy or role-changing fallback");
   }
-  if (!options.scratchDir) throw new Error("oversized Claude initial prompt requires AGENT_RELAY_SCRATCH_DIR");
+  if (!options.scratchDir) throw new Error("oversized Claude initial prompt requires HUMWICK_SCRATCH_DIR");
   const promptFile = join(options.scratchDir, "claude-initial-assignment.md");
   const exitCodeFile = join(options.scratchDir, "claude-initial-exit-code");
   args.push("-p", "--input-format", "text");
@@ -60,7 +60,7 @@ export function tmuxSessionName(prefix: string, instanceId: string, label?: stri
 // separates the session/window/pane portions of a target). All later `-t` lookups
 // must use the rendered name or `has-session` misses the session tmux just created.
 // Delegates to the shared SDK renderer so the runner and orchestrator (which must match
-// the rendered name when resolving a shutdown target, #1746 RC-1) can never diverge.
+// the rendered name when resolving a shutdown target, RC-1) can never diverge.
 export function tmuxSessionTargetName(sessionName: string): string {
   return renderTmuxSessionTarget(sessionName);
 }
@@ -76,7 +76,7 @@ export function tmuxSocketName(sessionName: string): string {
   return socketName;
 }
 
-// Pre-#1353 socket selector, used only for one-way cleanup when a runner first
+// Previous socket selector, used only for one-way cleanup when a runner first
 // starts after upgrading. Do not assert its path length: an overlong legacy
 // name is exactly what the new fixed-size selector is designed to escape.
 export function legacyTmuxSocketName(sessionName: string): string {
@@ -88,7 +88,7 @@ export function createOrReuseTmuxSession(sessionName: string, socketName: string
   spawnSyncBounded(tmuxCommand(socketName, "kill-session", "-t", targetSessionName), {
     stdin: "ignore", stdout: "ignore", stderr: "ignore",
   });
-  // Upgrade cleanup: a pre-#1353 runner used the readable session name as its
+  // Upgrade cleanup: a previous runner used the readable session name as its
   // selector. Best-effort removal prevents a legacy pane surviving beside its
   // replacement; an overlong legacy selector can fail here harmlessly.
   spawnSyncBounded(tmuxCommand(legacyTmuxSocketName(sessionName), "kill-session", "-t", targetSessionName), {
@@ -105,7 +105,7 @@ export function createOrReuseTmuxSession(sessionName: string, socketName: string
     throw new Error(`tmux session creation failed: ${stderr || (result.signalCode ? `signal ${result.signalCode}` : `exit code ${result.exitCode}`)}`);
   }
   if (result.exitCode === 0) promptSubmitFence.clear(promptSubmitSessionKey(targetSessionName, socketName));
-  // #1514 — stamp the owning orchestrator's state-home id (passed to this runner via
+  // stamp the owning orchestrator's state-home id (passed to this runner via
   // env) onto the session so the orchestrator's wedged-session reaper reaps ONLY the
   // sessions it positively owns, never a co-tenant orchestrator's on the same host.
   setTmuxSessionOwner(targetSessionName, tmuxOwnerIdFromEnv(), socketName);
@@ -135,7 +135,7 @@ export function tmuxSessionCreationFailureIsReusable(
     && hasSession(tmuxSessionTargetName(sessionName), socketName);
 }
 
-// #1514 — stamp the owning orchestrator's state-home id onto the tmux session as a
+// stamp the owning orchestrator's state-home id onto the tmux session as a
 // user-option. The orchestrator's wedged-session reaper reads it back and reaps ONLY
 // sessions whose owner id matches its own, so it can never reap a session belonging
 // to a different orchestrator that happens to share the UID + tmux prefix on this
@@ -166,7 +166,7 @@ export async function confirmTmuxSessionGone(
   sessionName: string,
   socketName?: string,
   delayMs = 250,
-  // #1838 row 12 — off the event loop via the tri-state `tmuxSessionPresence` (#1838 review
+  // row 12 — off the event loop via the tri-state `tmuxSessionPresence` (review
   // HIGH-2). Death is confirmed ONLY when BOTH the immediate and the delayed read are the
   // positive `absent` (tmux exited 1); a `present` OR an `unreadable` (timeout/abort on a
   // wedged-but-live server) at either point means NOT gone, so a slow read can never be
@@ -195,15 +195,15 @@ export function captureTmuxPane(sessionName: string, socketName?: string): strin
   return result.stdout.toString();
 }
 
-// #1514's exit-dialog confirmation used to live here as
+// exit-dialog confirmation used to live here as
 // `confirmClaudeExitDialogIfPresent(sessionName, socketName)` — an Enter writer that
-// any caller holding a session name could invoke. #1647 removed it: taking a session
+// any caller holding a session name could invoke. Removed it: taking a session
 // name meant nothing in the type system stopped a pane detector from calling it, and
 // the production kill was exactly that Enter answering an "Exit anyway" modal on a
 // live pane. It now lives in ./claude-exit, where both it and the `/exit` writer take
 // an unforgeable one-shot ClaudeExitGrant instead.
 
-// #1838 review BLOCKER + round-3 MED — this readiness poller runs on the hot delivery path
+// review BLOCKER + round-3 MED — this readiness poller runs on the hot delivery path
 // (every deliver / deliverInitialPrompt / monitor self-resume settle) and used to call the
 // SYNCHRONOUS tmuxHasSession + captureTmuxPane every 200ms; a single wedged tmux call froze the
 // whole runner event loop for the full 10s deadline. Both reads now go OFF the loop and use the
@@ -243,11 +243,11 @@ export async function waitForClaudeInputReady(sessionName: string, timeoutMs = C
 
 export const CLAUDE_CLEAR_COMMIT_POLL_MS = 200;
 
-/** #2850 — consecutive idle+ready polls (~1s) a vacuous clear needs when the probe can't attest. */
+/** consecutive idle+ready polls (~1s) a vacuous clear needs when the probe can't attest. */
 export const CLAUDE_VACUOUS_CLEAR_READY_POLLS = 5;
 
 /**
- * #2261 — the capture scope the clear-commit barrier reads, pinned as a named export so the
+ * the capture scope the clear-commit barrier reads, pinned as a named export so the
  * invariant is assertable. It MUST be the visible-screen capture: `/clear` repaints only the
  * visible screen (no `ESC[3J`), so a scrollback capture keeps returning the wiped conversation —
  * and with it the anchor — for the entire timeout, making a committed clear unconfirmable.
@@ -260,23 +260,23 @@ export interface ClaudeClearCommitDeps {
   capture?: (sessionName: string, socketName?: string, opts?: TmuxReadOpts) => string | Promise<string>;
   presence?: (sessionName: string, socketName?: string, opts?: TmuxReadOpts) => TmuxSessionPresence | Promise<TmuxSessionPresence>;
   sleep?: (ms: number) => Promise<unknown>;
-  /** #2261 — the probe reading taken immediately BEFORE the `/clear` submit (null = unavailable). */
+  /** the probe reading taken immediately BEFORE the `/clear` submit (null = unavailable). */
   preClearSession?: ClaudeClearSessionReading | null;
-  /** #2261 — re-read it each poll, pid-pinned by the caller. Absent → anchor-only (legacy). */
+  /** re-read it each poll, pid-pinned by the caller. Absent → anchor-only (legacy). */
   readSession?: () => Promise<ClaudeClearSessionReading | null>;
-  /** #2849 — true only when `preClearPane` is a successful capture (not the "" fallback
+  /** true only when `preClearPane` is a successful capture (not the "" fallback
    * left by a throw). Lets a provably-empty pre-clear pane confirm via idle+ready. */
   preClearCaptured?: boolean;
 }
 
-// #1588 — CLEAR-AWARE settle barrier for the self-resume clear+inject coupling. Unlike
+// CLEAR-AWARE settle barrier for the self-resume clear+inject coupling. Unlike
 // waitForClaudeInputReady (which returns on the first persistent-footer match — present BOTH
 // before and after `/clear`, the F2 race), this requires POSITIVE evidence the `/clear` actually
 // committed: it snapshots a distinctive pre-clear conversation anchor and only reports success
 // once the pane is idle, input-ready, AND that anchor is gone (the loaded conversation was wiped).
 // Returns a BOOLEAN rather than throwing: `true` = clear positively confirmed committed; `false` =
 // timed out / session vanished / capture failed / no anchor derivable (uncertain). The caller MUST
-// treat `false` as "not confirmed" and report continuationDelivered:false so the #1023 backstop
+// treat `false` as "not confirmed" and report continuationDelivered:false so the backstop
 // re-injects — never as a wipe. A settle timeout is therefore surfaced, not swallowed.
 export async function waitForClaudeClearCommitted(
   sessionName: string,
@@ -285,12 +285,12 @@ export async function waitForClaudeClearCommitted(
   socketName?: string,
   deps: ClaudeClearCommitDeps = {},
 ): Promise<boolean> {
-  // #1838 review — same off-loop + tri-state + ABSOLUTE-deadline treatment as
+  // review — same off-loop + tri-state + ABSOLUTE-deadline treatment as
   // waitForClaudeInputReady (this poller also ran sync captureTmuxPane on the clear path, and had
   // the same between-calls-only deadline, round-3 MED). A positive `absent` returns false (clear
-  // not confirmed → the #1023 backstop re-injects, the safe outcome); an `unreadable` read or a
+  // not confirmed → the backstop re-injects, the safe outcome); an `unreadable` read or a
   // transient capture failure retries until the deadline instead of blocking or giving up early.
-  // #2261 — the VISIBLE screen, never the `-S -80` scrollback window: `/clear` repaints only the
+  // the VISIBLE screen, never the `-S -80` scrollback window: `/clear` repaints only the
   // visible screen, so a scrollback capture keeps returning the wiped conversation (and with it the
   // anchor) for the whole timeout. That single mismatch made a committed clear unconfirmable on any
   // pane with history — proven live: the clear-inject at 22:15:10.185Z minted its new Claude
@@ -302,18 +302,18 @@ export async function waitForClaudeClearCommitted(
   const sleep = deps.sleep ?? Bun.sleep;
   const anchor = claudeConversationAnchor(preClearPane);
   const { preClearSession, readSession } = deps;
-  // #2849 — a positively-captured pane with no anchor held no conversation, so the
+  // a positively-captured pane with no anchor held no conversation, so the
   // clear is vacuous. A failed capture ("") also yields no anchor but must stay
   // fail-closed (preClearCaptured false). Confirmation still needs the settle below.
   const preClearEmpty = deps.preClearCaptured === true && anchor === undefined;
-  // #2849r1/#2850 — with no probe verdict a ready pane may predate the commit (#1588),
+  // with no probe verdict a ready pane may predate the commit,
   // so a vacuous clear needs a CLAUDE_VACUOUS_CLEAR_READY_POLLS streak. A failed capture,
   // a busy/non-ready pane or an `unchanged` probe reading resets it.
   let readyStreak = 0;
-  // #2261 — the new session is minted ~112ms BEFORE the TUI finishes repainting (measured on the
+  // the new session is minted ~112ms BEFORE the TUI finishes repainting (measured on the
   // live repro), and inside that window an un-cleared pane still reads non-busy + input-ready. So
   // a rotation only counts once it has been observed on TWO CONSECUTIVE polls, which lands the
-  // confirmation after the repaint rather than inside the #1588 injection window. One poll
+  // confirmation after the repaint rather than inside the injection window. One poll
   // interval (200ms) out of a 10s budget.
   let rotationSeen = false;
   const deadline = Date.now() + timeoutMs;
@@ -331,7 +331,7 @@ export async function waitForClaudeClearCommitted(
         pane = await capture(sessionName, socketName, readOpts);
       } catch {
         readyStreak = 0;
-        // #1838 round-4 MED — clamp the poll sleep to the remaining budget so a wait started
+        // round-4 MED — clamp the poll sleep to the remaining budget so a wait started
         // with < CLAUDE_CLEAR_COMMIT_POLL_MS left can't overshoot the absolute deadline.
         await sleep(Math.min(CLAUDE_CLEAR_COMMIT_POLL_MS, Math.max(0, deadline - Date.now())));
         continue;
@@ -344,7 +344,7 @@ export async function waitForClaudeClearCommitted(
       readyStreak = verdict !== "unchanged" && !claudePaneIsBusy(pane) && claudePaneLooksReady(pane) ? readyStreak + 1 : 0;
       const settledReady = readyStreak >= CLAUDE_VACUOUS_CLEAR_READY_POLLS;
       if (claudeClearCommitted(anchor, pane, { session: settled, preClearEmpty, settledReady })) return true;
-      // #1838 round-4 MED — same clamp on the steady-state poll.
+      // round-4 MED — same clamp on the steady-state poll.
       await sleep(Math.min(CLAUDE_CLEAR_COMMIT_POLL_MS, Math.max(0, deadline - Date.now())));
     }
     return false;
@@ -353,7 +353,7 @@ export async function waitForClaudeClearCommitted(
   }
 }
 
-// #1838 row 16 — the provider input transport (up to 50 spawns per delivered payload).
+// row 16 — the provider input transport (up to 50 spawns per delivered payload).
 // Wave 2a moves every tmux subprocess here OFF the event loop via the offload runner, and the
 // payload rides on STDIN (`load-buffer -`) rather than in argv.
 //
@@ -367,7 +367,7 @@ export async function waitForClaudeClearCommitted(
 // User prompts opt into visible-composer confirmation. Context commands retain their own
 // command-specific commit barriers; the tmux transport still sends those once.
 async function deleteTmuxBuffer(bufferName: string, socketName?: string): Promise<void> {
-  // Best-effort: a failed delete must never fail (or mask) the delivery outcome. #1838 review
+  // Best-effort: a failed delete must never fail (or mask) the delivery outcome. Review
   // LOW — always runs, so a buffer loaded-but-not-cleaned (e.g. a paste timeout) can't leak.
   await runTmuxInput("tmux-delete-buffer", tmuxCommand(socketName, "delete-buffer", "-b", bufferName)).catch(() => {});
 }
@@ -387,7 +387,7 @@ export function releaseClaudeSubmitFence(sessionName: string, socketName?: strin
 }
 
 export async function submitTextToTmux(sessionName: string, text: string, socketName?: string, options: { confirmSubmit?: boolean; transcriptPath?: string; resolveTranscriptPath?: () => Promise<string | undefined>; promptHooks?: ClaudePromptHookLedger; imagePaths?: readonly string[]; inputObserver?: ProviderInputObserver } = {}): Promise<void> {
-  const bufferName = `agent-relay-${crypto.randomUUID()}`;
+  const bufferName = `humwick-${crypto.randomUUID()}`;
   const paste = async () => {
     try {
       // Load via stdin so large prompts never hit the platform argv limit.
@@ -451,7 +451,7 @@ export async function submitTextToTmux(sessionName: string, text: string, socket
     return;
   }
   // Submit the pasted input with a SINGLE send-keys C-m: one send, throw-on-failure, no retry —
-  // delivery-acknowledgment semantics identical to main (see the header note + #1844).
+  // delivery-acknowledgment semantics identical to main (see the header note +).
   await paste();
   await Bun.sleep(CLAUDE_TMUX_SUBMIT_DELAY_MS);
   options.inputObserver?.offered(Date.now(), false);
@@ -461,7 +461,7 @@ export async function submitTextToTmux(sessionName: string, text: string, socket
 // The script keeps the provider command out of tmux argv. Environment values
 // arrive through a private FIFO; only the recovery identity is written here.
 // `gateFifo`, when given, is read from (blocking) before the real command execs
-// (#1317): the caller creates the FIFO before the tmux session exists, attaches
+// the caller creates the FIFO before the tmux session exists, attaches
 // `pipe-pane` once the pane is up, then writes to the FIFO to release the gate.
 // That guarantees no provider output can be produced before pipe-pane is capturing
 // it — a process that dies in milliseconds previously produced a 0-byte log because
@@ -473,10 +473,10 @@ export function writeLauncherScript(sessionName: string, env: Record<string, str
   const scriptPath = launcherScriptPathForSession(sessionName);
   const launcherDir = dirname(scriptPath); mkdirSync(launcherDir, { recursive: true, mode: 0o700 }); chmodSync(launcherDir, 0o700);
   const exports = Object.entries(env)
-    .filter(([key]) => key === "AGENT_RELAY_ID")
+    .filter(([key]) => key === "HUMWICK_ID")
     .map(([key, value]) => `export ${shellEnvKey(key)}=${shellQuote(value)}`)
     .join("\n");
-  // #2513 — exports only ADD to the tmux server's inherited environment; a key that must
+  // exports only ADD to the tmux server's inherited environment; a key that must
   // not reach the pane (an ambient credential a second-subscription launch must shed)
   // needs an explicit unset, absence from `env` is not enough.
   const unsets = unsetKeys.map((key) => `unset ${shellEnvKey(key)}`).join("\n");
@@ -484,7 +484,7 @@ export function writeLauncherScript(sessionName: string, env: Record<string, str
   const stdin = stdinFile ? `exec < ${shellQuote(stdinFile)}\n` : "";
   const codeFile = exitCodeFile ?? `${scriptPath}.exit-code`;
   // Interactive Claude must own pane_pid for its session probe. execfail lets a
-  // failed exec return to EXIT; print mode keeps a parent to record completion (#3830).
+  // failed exec return to EXIT; print mode keeps a parent to record completion.
   const recordExit = `trap ${shellQuote(`exit_code=$?; printf '%s' "$exit_code" > ${shellQuote(codeFile)}; exit "$exit_code"`)} EXIT`;
   const command = exitCodeFile ? `( ${shellCmd} )` : `exec ${shellCmd}`;
   writeFileSync(scriptPath, `#!/usr/bin/env bash\numask 077\nshopt -s execfail\nrm -f -- ${shellQuote(codeFile)} ${shellQuote(`${codeFile}.stderr`)}\n${recordExit}\nexec 2> >(tee ${shellQuote(`${codeFile}.stderr`)} >&2)\n${exports ? `${exports}\n` : ""}${Object.keys(env).length ? `${envPipeSource()}\n` : ""}${unsets ? `${unsets}\n` : ""}rm -f -- "$0"\n${gate}${stdin}${command}\n`, { mode: 0o700 });
@@ -517,7 +517,7 @@ export async function releaseLauncherGate(gateFifo: string, timeoutMs = 5_000):
       try { proc.kill(); } catch {}
     }
   } catch {
-    // best-effort — a stuck launcher gate is no worse than the pre-#1317 race.
+    // best-effort — a stuck launcher gate is no worse than the previous race.
   } finally {
     try { rmSync(gateFifo, { force: true }); } catch {}
   }
@@ -529,14 +529,14 @@ function shellEnvKey(key: string): string {
 }
 
 export function tmuxEnvKeys(env: Record<string, string>, providerEnv: Record<string, string>, provider = "claude"): string[] {
-  // #1222 — PATH is always carried through, not just AGENT_RELAY_/CLAUDE_ vars, so the
+  // PATH is always carried through, not just HUMWICK_/CLAUDE_ vars, so the
   // launcher script's exported session PATH (built by buildSpawnArgs) reaches
   // the tmux pane instead of whatever ambient PATH the tmux server happened to inherit.
-  // #3084 — likewise the agent's private TMPDIR/TMP/TEMP: without them the pane got the tmux
+  // likewise the agent's private TMPDIR/TMP/TEMP: without them the pane got the tmux
   // server's host-shared TMPDIR while only CLAUDE_CODE_TMPDIR was per-agent.
   const keys = new Set<string>(["PATH", ...PROVIDER_SCRATCH_ENV_KEYS, ...providerSecretEnvKeys(provider)]);
   for (const key of Object.keys(env)) {
-    if ((key.startsWith("AGENT_RELAY_") || key.startsWith("HUMWICK_")) || key.startsWith("CLAUDE_")) {
+    if (key.startsWith("HUMWICK_") || key.startsWith("CLAUDE_")) {
       keys.add(key);
     }
   }
@@ -558,12 +558,12 @@ export function buildClaudeTmuxArgs(config: RunnerSpawnConfig, spawnArgs: SpawnA
 
     const envKeys = tmuxEnvKeys(spawnArgs.env, config.providerConfig.env, provider);
     const env: Record<string, string> = {};
-    for (const key of envKeys) if (relayEnv(spawnArgs.env, key) !== undefined) writeChildEnv(env, { [key]: relayEnv(spawnArgs.env, key)! });
+    for (const key of envKeys) if (relayEnv(spawnArgs.env, key) !== undefined) writeChildEnv(env, { [key]: relayEnv(spawnArgs.env, key)! }, []);
 
     // Only gate the launch behind pipe-pane attachment when there's a log file to
-    // protect (#1317) — no point serializing dev/interactive spawns that never
-    // read AGENT_RELAY_LOG_FILE.
-    const gateFifo = relayEnv(spawnArgs.env, "AGENT_RELAY_LOG_FILE") ? launcherGatePathForSession(sessionName) : undefined;
+    // protect — no point serializing dev/interactive spawns that never
+    // read HUMWICK_LOG_FILE.
+    const gateFifo = relayEnv(spawnArgs.env, "HUMWICK_LOG_FILE") ? launcherGatePathForSession(sessionName) : undefined;
 
     // tmux new-session has a hard command-length limit that includes every argv item,
     // including `-e KEY=value`. The script holds the command; its private FIFO