@hyperdrive.bot/paseo-server 0.3.39 → 0.3.41

package/dist/server/server/agent/providers/claude/tool-allowlist.js

@@ -0,0 +1,133 @@
+/**
+ * Per-run tool allowlist enforcement for the claude provider.
+ *
+ * WHY A HOOK AND NOT `--allowedTools`
+ * -----------------------------------
+ * `--allowedTools` (CLI) and `options.allowedTools` (SDK) are *permission allow
+ * rules*: they pre-approve a tool so it does not prompt. They do not restrict
+ * anything. Both of paseo's claude transports also run the child with
+ * `--dangerously-skip-permissions` / `allowDangerouslySkipPermissions`, under
+ * which every permission rule is moot, so passing an allowlist there would be
+ * decorative: accepted, parsed, and silently unenforcing.
+ *
+ * A `PreToolUse` hook is the one gate that still fires in that state. The Agent
+ * SDK says so explicitly (sdk.d.ts, PermissionDeniedHookInput): "PreToolUse hook
+ * denies bypass canUseTool". Verified against claude 2.1.239 with
+ * `--permission-mode acceptEdits --dangerously-skip-permissions`: a hook exiting
+ * 2 blocked a Bash call while an allowlisted Read call went through.
+ *
+ * FAIL CLOSED
+ * -----------
+ * When an allowlist is configured, anything this module cannot positively match
+ * is DENIED. A matcher that is too strict fails loudly (the model is told which
+ * rule set rejected it, and the run keeps going), while a matcher that is too
+ * lax fails silently and hands back a guarantee that is not real. Strictness is
+ * the safe direction, so unknown rule shapes and unknown specifier sources deny.
+ *
+ * Note this is *stricter* than `claude-pool launch --allowedTools`, where tools
+ * that never request permission (Read, Grep, TodoWrite, ...) were unaffected by
+ * the allowlist. Here the allowlist means exactly what it says: a tool absent
+ * from it cannot run at all.
+ */
+/** Tools whose specifier (the `Tool(spec)` argument) we know how to read off the input. */
+export const SPECIFIER_SOURCES = {
+    Bash: "command",
+    BashOutput: "bash_id",
+    Read: "file_path",
+    Edit: "file_path",
+    Write: "file_path",
+    NotebookEdit: "notebook_path",
+    WebFetch: "url",
+    Glob: "pattern",
+    Grep: "pattern",
+};
+/**
+ * Parse CSV-or-array allowlist entries into rules. Entries are the same strings
+ * Claude Code permission rules use: `Bash`, `Bash(git:*)`, `Read`,
+ * `mcp__server__tool`. Blank entries are dropped.
+ */
+export function parseToolAllowlist(entries) {
+    const rules = [];
+    for (const raw of entries) {
+        for (const piece of raw.split(",")) {
+            const entry = piece.trim();
+            if (!entry)
+                continue;
+            const match = /^([^()\s]+)\((.*)\)$/.exec(entry);
+            if (match?.[1] !== undefined && match[2] !== undefined) {
+                rules.push({ tool: match[1], specifier: match[2].trim() });
+            }
+            else {
+                rules.push({ tool: entry });
+            }
+        }
+    }
+    return rules;
+}
+/** Escape a literal for use inside a RegExp, leaving `*` to be expanded by the caller. */
+export function escapeLiteral(value) {
+    return value.replace(/[.+?^${}()|[\]\\]/g, "\\$&");
+}
+/**
+ * Match a Claude-Code-style specifier pattern against a value.
+ *
+ * Supported shapes (anything else denies):
+ *  - `*`          any value
+ *  - `prefix:*`   value starts with `prefix` (Claude Code's command-prefix form)
+ *  - `glob`       `*` wildcards, everything else literal, anchored both ends
+ */
+export function specifierMatches(pattern, value) {
+    if (pattern === "*")
+        return true;
+    const prefixForm = /^(.*):\*$/.exec(pattern);
+    if (prefixForm?.[1] !== undefined) {
+        const prefix = prefixForm[1].trim();
+        if (!prefix)
+            return false;
+        return value === prefix || value.startsWith(`${prefix} `);
+    }
+    const expanded = pattern.split("*").map(escapeLiteral).join(".*");
+    return new RegExp(`^${expanded}$`).test(value);
+}
+/** Read the specifier value a `Tool(spec)` rule compares against, or null when unknown. */
+export function readSpecifierValue(toolName, input) {
+    const key = SPECIFIER_SOURCES[toolName];
+    if (!key)
+        return null;
+    if (typeof input !== "object" || input === null)
+        return null;
+    const value = input[key];
+    return typeof value === "string" ? value : null;
+}
+/**
+ * True when `toolName` (with `input`) is permitted by `rules`.
+ *
+ * An EMPTY rule list means "no allowlist configured" and allows everything; the
+ * caller is responsible for not installing the guard at all in that case.
+ */
+export function isToolAllowed(toolName, input, rules) {
+    if (rules.length === 0)
+        return true;
+    for (const rule of rules) {
+        if (rule.tool !== toolName)
+            continue;
+        if (rule.specifier === undefined)
+            return true;
+        const value = readSpecifierValue(toolName, input);
+        // Unknown specifier source: we cannot verify the rule, so we do not honor it.
+        if (value === null)
+            continue;
+        if (specifierMatches(rule.specifier, value))
+            return true;
+    }
+    return false;
+}
+/** The message handed back to the model when a call is blocked. */
+export function formatDenialMessage(toolName, rules) {
+    const listed = rules
+        .map((rule) => (rule.specifier === undefined ? rule.tool : `${rule.tool}(${rule.specifier})`))
+        .join(", ");
+    return (`Tool "${toolName}" is blocked by this run's tool allowlist and was not executed. ` +
+        `Allowed: ${listed}. Do not retry this tool; achieve the goal with an allowed tool or report that you cannot.`);
+}
+//# sourceMappingURL=tool-allowlist.js.map

package/dist/server/server/agent/providers/claude/transport/pty-query.d.ts

@@ -1,6 +1,6 @@
 import type { Logger } from "pino";
 import type { ModelInfo, SDKMessage, SDKSystemMessage, SDKUserMessage } from "@anthropic-ai/claude-agent-sdk";
-import type { PtyTransport } from "./pty.js";
+import { type PtyTransport } from "./pty.js";
 /** An interactive TUI dialog the user has to answer for the turn to continue. */
 export interface PtyInteractiveDialog {
     toolUseId: string;
@@ -58,6 +58,10 @@ export declare class PtyQuery implements AsyncGenerator<SDKMessage, void> {
     private done;
     private readonly readyPromise;
     private offReadyData;
+    /** Unsubscribes the transport exit tap. Teardown MUST call this. */
+    private offExitTap;
+    /** Set once the agent process has exited; the two remaining "still running" claims read it. */
+    private transportExited;
     /**
      * Cancels the readiness gate and its timers.
      *
@@ -133,6 +137,16 @@ export declare class PtyQuery implements AsyncGenerator<SDKMessage, void> {
      * agent running by the time the input loop sees it: silence here is a forever-spinner.
      */
     private buildNothingDeliverableResult;
+    /**
+     * " The session itself is still running." -- but only when it is.
+     *
+     * The exit tap fixes the in-flight turn and the stall message. These two other results
+     * asserted the same thing unconditionally and are reachable after the process is gone, so
+     * they need the same correction. Wording matches buildExitedResult: no "aborted", and
+     * "status" rather than "code", so isAbortError() cannot swallow it and
+     * buildTurnFailedEvent() cannot scrape a phantom exit code out of it.
+     */
+    private stillRunningClause;
     /** Tell the provider the dialog state changed; never let a listener throw into the loop. */
     private notifyDialogChange;
     /** The dialog the TUI is waiting on, if any. */
@@ -344,6 +358,24 @@ export declare class PtyQuery implements AsyncGenerator<SDKMessage, void> {
      */
     private readTerminalTail;
     private buildResult;
+    /**
+     * The agent process exited. Fail any in-flight turn immediately and end the query.
+     *
+     * Unlike a stall there is nothing to wait for: no retry, no recovery, no later transcript
+     * activity. Emitting here rather than letting the stall timer fire turns a ten-minute wait
+     * plus a false "still running" into an immediate, accurate failure, and finishing the query
+     * stops the layer above treating this transport as a live destination for prompts.
+     */
+    private onTransportExit;
+    /**
+     * A non-success `result` for an agent that exited.
+     *
+     * Wording constraints match {@link buildStalledResult}: `isAbortError()` drops results
+     * matching /\baborted\b/i and `buildTurnFailedEvent()` scrapes /\bcode\s+(\d+)\b/i for an
+     * exit code, so this says "status", never "code", and never says "aborted". It also must
+     * NOT claim the session is still running, which is the exact lie this change deletes.
+     */
+    private buildExitedResult;
     private buildStalledResult;
     interrupt(): Promise<void>;
     setPermissionMode(): Promise<void>;

package/dist/server/server/agent/providers/claude/transport/pty-query.js

@@ -2,6 +2,7 @@ import { randomUUID } from "node:crypto";
 import * as fs from "node:fs";
 import * as os from "node:os";
 import * as path from "node:path";
+import { PtyExitedError } from "./pty.js";
 import { TranscriptSdkReader } from "./transcript-sdk-reader.js";
 /**
  * PtyQuery — a `Query`-shaped adapter over an interactive `claude` PTY.
@@ -245,6 +246,10 @@ export class PtyQuery {
         this.outResolvers = [];
         this.done = false;
         this.offReadyData = null;
+        /** Unsubscribes the transport exit tap. Teardown MUST call this. */
+        this.offExitTap = null;
+        /** Set once the agent process has exited; the two remaining "still running" claims read it. */
+        this.transportExited = null;
         /**
          * Cancels the readiness gate and its timers.
          *
@@ -311,6 +316,12 @@ export class PtyQuery {
         // session so a stall has something to explain itself with. Chunks arrive already redacted (PtyTransport.onData
         // runs redactChunk), so nothing further is needed here.
         this.offTerminalTap = this.transport.onData((chunk) => this.appendTerminalTail(chunk));
+        // Learn about the agent process dying the moment it happens. Without this tap the only
+        // thing that ever noticed was the stall backstop, ten minutes later, and it then told the
+        // user the session was "still running and may recover" - of a process that had already
+        // printed its farewell banner and exited. The stall timer is for a live agent that is
+        // slow; it is the wrong instrument for a dead one.
+        this.offExitTap = this.transport.onExit((code, signal) => this.onTransportExit(code, signal));
         // The executor stays trivial and settlement lives outside it, so there is exactly one
         // resolve() call in the file. Timers and handlers below all funnel through settle(),
         // which is guarded by `settled`; expressing that inside the executor tripped
@@ -467,6 +478,8 @@ export class PtyQuery {
         this.offReadyData?.();
         this.offTerminalTap?.();
         this.offTerminalTap = null;
+        this.offExitTap?.();
+        this.offExitTap = null;
         this.stopHeartbeat();
         this.recordLine("--- PtyQuery detached ---");
         try {
@@ -533,6 +546,13 @@ export class PtyQuery {
                     this.emit(this.buildCommandRejectedResult(notice));
                     continue;
                 }
+                if (delivery === "exited") {
+                    // Dead, not deaf. `continue`, never `break`: the exit tap is what ends this query,
+                    // and breaking here would instead leave the input channel undrained, so a resend
+                    // would sit unread and the sender would watch a spinner - the symptom being fixed.
+                    this.emit(this.buildExitedResult(this.transportExited?.code ?? null, this.transportExited?.signal ?? null));
+                    continue;
+                }
                 if (delivery === "undelivered") {
                     // No transcript receipt for the whole budget: the message never became a turn,
                     // nothing was queued, and only the sender can decide what to do next.
@@ -620,11 +640,27 @@ export class PtyQuery {
             is_error: true,
             errors: [
                 `Your message had nothing the terminal transport could deliver: no text, and no ` +
-                    `image it could stage to disk. Nothing was sent, so please resend it with text. ` +
-                    `The session itself is still running.`,
+                    `image it could stage to disk. Nothing was sent, so please resend it with text.` +
+                    `${this.stillRunningClause()}`,
             ],
         };
     }
+    /**
+     * " The session itself is still running." -- but only when it is.
+     *
+     * The exit tap fixes the in-flight turn and the stall message. These two other results
+     * asserted the same thing unconditionally and are reachable after the process is gone, so
+     * they need the same correction. Wording matches buildExitedResult: no "aborted", and
+     * "status" rather than "code", so isAbortError() cannot swallow it and
+     * buildTurnFailedEvent() cannot scrape a phantom exit code out of it.
+     */
+    stillRunningClause() {
+        if (!this.transportExited)
+            return " The session itself is still running.";
+        return (` The agent process has exited, so the session is NOT running any more and will not ` +
+            `recover on its own; the conversation is still on disk, recover it with ` +
+            `"paseo import ${this.sessionId}".`);
+    }
     /** Tell the provider the dialog state changed; never let a listener throw into the loop. */
     notifyDialogChange() {
         if (!this.onDialogChange)
@@ -727,8 +763,7 @@ export class PtyQuery {
             is_error: true,
             errors: [
                 `Your message did not reach the agent: the terminal would not accept it. ` +
-                    `Nothing was sent, so please send it again. The session itself is still ` +
-                    `running.${tailLine}`,
+                    `Nothing was sent, so please send it again.${this.stillRunningClause()}${tailLine}`,
             ],
         };
     }
@@ -897,6 +932,11 @@ export class PtyQuery {
         let backoff = DEAF_RETRY_INITIAL_MS;
         let attempt = 0;
         while (!this.done && monotonicNowMs() < deadline) {
+            // Re-checked every attempt, not once up front: the child can die between attempts and
+            // this loop's budget is ten minutes. Retrying into a corpse is what produced the
+            // "no delivery receipt; retrying" storms that ended at the 20-retry cap.
+            if (this.transportExited)
+                return "exited";
             attempt += 1;
             const attemptStartedAt = monotonicNowMs();
             // Empty the input box first: whatever an earlier attempt may have left there is
@@ -904,7 +944,17 @@ export class PtyQuery {
             // became nine stacked paste blocks in production.
             if (attempt > 1)
                 await this.clearComposer();
-            await this.transport.write(text);
+            try {
+                await this.transport.write(text);
+            }
+            catch (err) {
+                // The transport now refuses a write into a dead pty. Without this catch the rejection
+                // escapes deliverPrompt into the input loop's handler, which only logs "input loop
+                // ended" -- so the sender would watch a spinner and never be told anything.
+                if (err instanceof PtyExitedError)
+                    return "exited";
+                throw err;
+            }
             const submitted = await this.submitTurn(text, watermark, fingerprint);
             if (submitted === "rejected")
                 return "rejected";
@@ -1426,7 +1476,62 @@ export class PtyQuery {
         };
         return result;
     }
+    /**
+     * The agent process exited. Fail any in-flight turn immediately and end the query.
+     *
+     * Unlike a stall there is nothing to wait for: no retry, no recovery, no later transcript
+     * activity. Emitting here rather than letting the stall timer fire turns a ten-minute wait
+     * plus a false "still running" into an immediate, accurate failure, and finishing the query
+     * stops the layer above treating this transport as a live destination for prompts.
+     */
+    onTransportExit(code, signal) {
+        // Recorded before the `done` bail: the wording helpers and the delivery guards must know
+        // the process is gone even when the query had already been torn down.
+        this.transportExited ?? (this.transportExited = { code, signal });
+        if (this.done)
+            return;
+        const wasInFlight = this.turnInFlight;
+        this.turnInFlight = false;
+        this.clearStallTimer();
+        this.logger.error({ sessionId: this.sessionId, exitCode: code, exitSignal: signal, wasInFlight }, "PtyQuery: the agent process exited");
+        this.recordLine(`--- agent process exited (status ${code ?? "none"}, signal ${signal ?? "none"}) ---`);
+        if (wasInFlight) {
+            this.numTurns += 1;
+            this.emit(this.buildExitedResult(code, signal));
+        }
+        this.finish();
+    }
+    /**
+     * A non-success `result` for an agent that exited.
+     *
+     * Wording constraints match {@link buildStalledResult}: `isAbortError()` drops results
+     * matching /\baborted\b/i and `buildTurnFailedEvent()` scrapes /\bcode\s+(\d+)\b/i for an
+     * exit code, so this says "status", never "code", and never says "aborted". It also must
+     * NOT claim the session is still running, which is the exact lie this change deletes.
+     */
+    buildExitedResult(code, signal) {
+        const base = this.buildResult("process_exited");
+        const how = signal ? `on signal ${signal}` : `with status ${code ?? "unknown"}`;
+        const excerpt = this.terminalTail.slice(-TERMINAL_TAIL_EXCERPT_CHARS).trim();
+        const tailLine = excerpt ? ` Last terminal output: ${JSON.stringify(excerpt)}.` : "";
+        return {
+            ...base,
+            subtype: "error_during_execution",
+            is_error: true,
+            errors: [
+                `The agent process exited ${how} before finishing this turn, so the session is NOT ` +
+                    `running any more and will not recover on its own. The conversation is still on ` +
+                    `disk: recover it with "paseo import ${this.sessionId}", then restore the agent's ` +
+                    `model, thinking budget and permission mode, which import does not carry over.` +
+                    tailLine,
+            ],
+        };
+    }
     buildStalledResult(silentForMs, terminalTail) {
+        // A dead process is not a stall, and must never be described as one that "may recover".
+        if (this.transportExited) {
+            return this.buildExitedResult(this.transportExited.code, this.transportExited.signal);
+        }
         const minutes = Math.round(silentForMs / 60000);
         const base = this.buildResult("stall_timeout");
         // The last thing the terminal showed is usually the whole diagnosis ("Compacting

package/dist/server/server/agent/providers/claude/transport/pty.d.ts

@@ -28,6 +28,23 @@ export interface PtyInputEvent {
 /** Install (or clear, with null) the input-provenance sink. */
 export declare function setPtyInputSink(sink: ((event: PtyInputEvent) => void) | null): void;
 export declare function __setNodePtyForTesting(stub: NodePtyModule | null): void;
+/**
+ * Thrown when something tries to write to a pty whose process has already exited.
+ *
+ * This has a dedicated type because the two failure modes read identically at the call site
+ * and must not: "never spawned" is a programming error, while "already exited" is a normal
+ * runtime event that the layer above has to react to by failing the turn. Before this class
+ * existed, `doWrite` happily called `_pty.write()` on a dead pty, node-pty swallowed it, and
+ * `waitForEcho()`'s fixed timer reported success - so paseo typed prompts into a corpse for
+ * fourteen retries and then told the user "the session itself is still running".
+ */
+export declare class PtyExitedError extends Error {
+    readonly code = "PTY_EXITED";
+    /** How the process died, so a caller can report it without a second lookup. */
+    readonly exitCode: number | null;
+    readonly exitSignal: NodeJS.Signals | null;
+    constructor(op: string, exitCode?: number | null, exitSignal?: NodeJS.Signals | null);
+}
 export declare class PtyTransport implements AgentTransport {
     private _pty;
     private _cwd;
@@ -35,11 +52,26 @@ export declare class PtyTransport implements AgentTransport {
     private _rows;
     private _killed;
     private _exited;
+    private _exitInfo;
+    private exitHandlers;
     private injectChain;
     private hookHandlers;
     private hookBuffer;
     private bridgeClose;
     private systemPromptFilePath;
+    /**
+     * Has the child process exited?
+     *
+     * Public because guarding the write paths fixes the symptom but leaves the question
+     * unanswerable: `_exited` was private, so no caller could ask a transport whether its
+     * child was alive without provoking an error. `AgentTransport` now declares it.
+     */
+    get exited(): boolean;
+    /** Exit status once the child is gone, else null. */
+    get exitInfo(): {
+        code: number | null;
+        signal: NodeJS.Signals | null;
+    } | null;
     /**
      * Bridge-side / test entry point — push a hook event into this transport's
      * stream. If no `onHookEvent` handler is registered yet, the event is

package/dist/server/server/agent/providers/claude/transport/pty.js

@@ -49,6 +49,25 @@ function getNodePty() {
 export function __setNodePtyForTesting(stub) {
     nodePty = stub;
 }
+/**
+ * Thrown when something tries to write to a pty whose process has already exited.
+ *
+ * This has a dedicated type because the two failure modes read identically at the call site
+ * and must not: "never spawned" is a programming error, while "already exited" is a normal
+ * runtime event that the layer above has to react to by failing the turn. Before this class
+ * existed, `doWrite` happily called `_pty.write()` on a dead pty, node-pty swallowed it, and
+ * `waitForEcho()`'s fixed timer reported success - so paseo typed prompts into a corpse for
+ * fourteen retries and then told the user "the session itself is still running".
+ */
+export class PtyExitedError extends Error {
+    constructor(op, exitCode = null, exitSignal = null) {
+        super(`PtyTransport.${op} called after the pty process exited`);
+        this.code = "PTY_EXITED";
+        this.name = "PtyExitedError";
+        this.exitCode = exitCode;
+        this.exitSignal = exitSignal;
+    }
+}
 export class PtyTransport {
     constructor() {
         this._pty = null;
@@ -57,12 +76,28 @@ export class PtyTransport {
         this._rows = DEFAULT_ROWS;
         this._killed = false;
         this._exited = false;
+        this._exitInfo = null;
+        this.exitHandlers = [];
         this.injectChain = Promise.resolve();
         this.hookHandlers = [];
         this.hookBuffer = [];
         this.bridgeClose = null;
         this.systemPromptFilePath = null;
     }
+    /**
+     * Has the child process exited?
+     *
+     * Public because guarding the write paths fixes the symptom but leaves the question
+     * unanswerable: `_exited` was private, so no caller could ask a transport whether its
+     * child was alive without provoking an error. `AgentTransport` now declares it.
+     */
+    get exited() {
+        return this._exited;
+    }
+    /** Exit status once the child is gone, else null. */
+    get exitInfo() {
+        return this._exitInfo ? { ...this._exitInfo } : null;
+    }
     /**
      * Bridge-side / test entry point — push a hook event into this transport's
      * stream. If no `onHookEvent` handler is registered yet, the event is
@@ -114,8 +149,24 @@ export class PtyTransport {
             cwd: opts.cwd,
             env: opts.env,
         });
-        this._pty.onExit(() => {
+        // ONE internal subscription owns exit state and fans it out to every public onExit()
+        // handler. Registering handlers straight onto node-pty (the previous shape) meant a
+        // subscriber that attached AFTER the child had already died heard nothing at all -- and
+        // a PtyQuery attaches to a long-lived terminal, not only to a fresh boot, so that is a
+        // reachable case and not a theoretical one.
+        this._pty.onExit(({ exitCode, signal }) => {
+            const code = typeof exitCode === "number" ? exitCode : null;
+            const sig = signal ?? null;
             this._exited = true;
+            this._exitInfo = { code, signal: sig };
+            for (const h of this.exitHandlers) {
+                try {
+                    h(code, sig);
+                }
+                catch {
+                    // one bad subscriber must not stop the others hearing about the death
+                }
+            }
         });
     }
     write(text) {
@@ -138,6 +189,9 @@ export class PtyTransport {
         if (!this._pty) {
             throw new Error("PtyTransport.writeRaw called before spawn()");
         }
+        if (this._exited) {
+            throw new PtyExitedError("writeRaw", this._exitInfo?.code ?? null, this._exitInfo?.signal ?? null);
+        }
         this._pty.write(data);
         await this.waitForEcho();
     }
@@ -148,6 +202,9 @@ export class PtyTransport {
         if (!this._pty) {
             throw new Error("PtyTransport.write called before spawn()");
         }
+        if (this._exited) {
+            throw new PtyExitedError("write", this._exitInfo?.code ?? null, this._exitInfo?.signal ?? null);
+        }
         this._pty.write(this.bracketedPaste(text));
         await this.waitForEcho();
     }
@@ -216,10 +273,17 @@ export class PtyTransport {
         if (!this._pty) {
             throw new Error("PtyTransport.onExit called before spawn()");
         }
-        const disposable = this._pty.onExit(({ exitCode, signal }) => {
-            handler(typeof exitCode === "number" ? exitCode : null, signal ?? null);
-        });
-        return () => disposable.dispose();
+        this.exitHandlers.push(handler);
+        // Already dead: fire, rather than never. Deferred a microtask so a subscriber that
+        // registers from a constructor (PtyQuery does) cannot be re-entered before it has
+        // finished building itself.
+        if (this._exited) {
+            const info = this._exitInfo;
+            queueMicrotask(() => handler(info?.code ?? null, info?.signal ?? null));
+        }
+        return () => {
+            this.exitHandlers = this.exitHandlers.filter((h) => h !== handler);
+        };
     }
     context() {
         if (!this._pty) {

package/dist/server/server/agent/providers/claude/transport/sdk.d.ts

@@ -53,6 +53,8 @@ export declare class SdkTransport implements AgentTransport {
     createQuery(input: ClaudeQueryInput): Query;
     spawn(opts: AgentTransportSpawnOptions): Promise<void>;
     write(text: string): Promise<void>;
+    /** True once the SDK query has been closed/returned. Mirrors PtyTransport.exited. */
+    get exited(): boolean;
     kill(timeoutMs?: number): Promise<void>;
     onHookEvent(_handler: (event: HookEvent) => void): () => void;
     onData(_handler: (chunk: string) => void): () => void;

package/dist/server/server/agent/providers/claude/transport/sdk.js

@@ -135,6 +135,10 @@ export class SdkTransport {
         const queryWithInput = this._query;
         await queryWithInput.input?.send(message);
     }
+    /** True once the SDK query has been closed/returned. Mirrors PtyTransport.exited. */
+    get exited() {
+        return this._exited;
+    }
     async kill(timeoutMs = 5000) {
         if (this._killed)
             return;

package/dist/server/server/agent/providers/claude/transport/types.d.ts

@@ -29,6 +29,14 @@ export type AgentTransportContext = {
     cwd: string;
 };
 export interface AgentTransport {
+    /**
+     * True once the underlying agent process has exited.
+     *
+     * Optional so a transport that genuinely cannot know stays honest by omitting it;
+     * `undefined` means "no liveness signal" and must not be read as "alive". Both shipped
+     * transports implement it.
+     */
+    readonly exited?: boolean;
     spawn(opts: AgentTransportSpawnOptions): Promise<void>;
     write(text: string): Promise<void>;
     /**

package/dist/server/server/agent/tools/paseo-tools.d.ts

@@ -8,6 +8,7 @@ import type { TerminalManager } from "../../../terminal/terminal-manager.js";
 import type { CreatePaseoWorktreeWorkflowFn } from "../../worktree-session.js";
 import type { JudgeRelayGate } from "../judge-relay-gate.js";
 import type { ScheduleService } from "../../schedule/service.js";
+import { type ScheduleCadence } from "@hyperdrive.bot/paseo-protocol/schedule/types";
 import type { ProviderSnapshotManager } from "../provider-snapshot-manager.js";
 import type { GitHubService } from "../../../services/github-service.js";
 import type { WorkspaceGitService } from "../../workspace-git-service.js";
@@ -62,5 +63,23 @@ export interface PaseoToolHostDependencies {
     judgeRelayGate?: JudgeRelayGate;
     logger: Logger;
 }
+export interface ScheduleCreateCadenceArgs {
+    at?: string;
+    every?: string;
+    cron?: string;
+    timezone?: string;
+}
+export interface ResolvedScheduleCreateCadence {
+    cadence: ScheduleCadence;
+    /**
+     * `at` is a one-off. It lowers to an `every` cadence whose interval is the
+     * distance to the instant, pinned to a single run. An `every` schedule stores
+     * the computed `nextRunAt`, so a daemon that was down at that moment fires it
+     * late on the next tick, which is what a reminder wants. A pinned cron would
+     * instead skip silently to the next calendar match a year away.
+     */
+    oneOff: boolean;
+}
+export declare function resolveScheduleCreateCadence(input: ScheduleCreateCadenceArgs, now: Date): ResolvedScheduleCreateCadence;
 export declare function createPaseoToolCatalog(options: PaseoToolHostDependencies): PaseoToolCatalog;
 //# sourceMappingURL=paseo-tools.d.ts.map