@iowarp/clio-coder 0.4.3 → 0.4.5

package/src/cli/evidence-detail.ts

@@ -1,78 +1,4 @@
-/**
- * Fixed machine-readable projection of one evidence bundle's trust record.
- *
- * `evidence inspect <id>` prints an operator record that quotes the task text,
- * the bundle's file list, and per-finding prose. This is the same bundle read
- * down to the one thing a GUI can carry safely and usefully: which runs the
- * bundle covers, what verdict each run earned, and which axis produced it.
- *
- * Every value here comes from a closed vocabulary. The axis names, the axis
- * states, and the verdicts are all enumerations the harness owns, so there is
- * no free-form text on this surface at all, which is what lets it answer the
- * question the inventory raises without reopening the boundary the inventory
- * closed.
- *
- * Unlike the other fixed reads this one takes an identifier, because an
- * operator names the bundle. The GUI host may only pass back an id it served
- * inside its current bounded window; see `apps/workbench/artifact-allowlist.ts`.
- */
-
-import { clioDataDir } from "../core/xdg.js";
-import {
-	inspectEvidence,
-	TRUST_STATUS_AXES,
-	type TrustStatusAxis,
-	type TrustVerdict,
-	trustVerdict,
-} from "../domains/evidence/index.js";
-
-export const EVIDENCE_DETAIL_MAX_RUNS = 16;
-
-export interface EvidenceDetailRun {
-	readonly runId: string;
-	readonly verdict: TrustVerdict;
-	/** Every axis, always all six, so an absent axis is stated rather than missing. */
-	readonly axes: Readonly<Record<TrustStatusAxis, string>>;
-}
-
-export interface EvidenceDetailSnapshot {
-	readonly version: 1;
-	readonly generatedAt: string;
-	readonly evidenceId: string;
-	readonly sourceKind: "run" | "session" | "eval";
-	/** False when the bundle predates the canonical trust projection. */
-	readonly canonical: boolean;
-	readonly runs: readonly EvidenceDetailRun[];
-	readonly runsTruncated: boolean;
-}
-
-async function evidenceDetailSnapshot(
-	evidenceId: string,
-	now: () => number = Date.now,
-	dataDir: string = clioDataDir(),
-): Promise<EvidenceDetailSnapshot> {
-	const inspected = await inspectEvidence(dataDir, evidenceId);
-	const all = inspected.trustStatus.runs;
-	const window = all.slice(0, EVIDENCE_DETAIL_MAX_RUNS);
-	return {
-		version: 1,
-		generatedAt: new Date(now()).toISOString(),
-		evidenceId: inspected.overview.evidenceId,
-		sourceKind: inspected.overview.source.kind,
-		canonical: inspected.trustStatus.projection === "canonical",
-		runs: window.map(
-			(run): EvidenceDetailRun => ({
-				runId: run.runId,
-				verdict: trustVerdict(run.status),
-				axes: Object.fromEntries(TRUST_STATUS_AXES.map((axis) => [axis, run.status[axis].state])) as Record<
-					TrustStatusAxis,
-					string
-				>,
-			}),
-		),
-		runsTruncated: all.length > window.length,
-	};
-}
+import { evidenceDetailSnapshot } from "../domains/evidence/detail.js";
 
 /**
  * `clio-coder evidence inspect <id> --json`.

package/src/cli/evidence-inventory.ts

@@ -1,170 +1,4 @@
-/**
- * Fixed machine-readable projection of recent evidence artifacts.
- *
- * `evidence list` is an operator table and `evidence inspect <id>` needs an id,
- * so neither is a transport a GUI host can invoke blind. This command accepts
- * no identifier, path, or limit, selects a bounded newest-first window itself,
- * and emits provenance, tags, totals, and a trust verdict.
- *
- * An overview carries the working directories the runs executed in, the task
- * text the operator typed, and the file names inside the bundle. None of that
- * appears here. What does is the shape of the artifact and how far it can be
- * trusted, which is what an operator picks a bundle by.
- */
-
-import { clioDataDir } from "../core/xdg.js";
-import {
-	EVIDENCE_TAGS,
-	type EvidenceOverview,
-	type EvidenceTag,
-	listEvidenceOverviews,
-	loadEvidenceTrustStatus,
-	type TrustVerdict,
-	trustVerdict,
-} from "../domains/evidence/index.js";
-import { sanitizeCallTargetText } from "../domains/safety/call-target.js";
-import { truncateToWidth } from "../engine/tui-primitives.js";
-
-export const EVIDENCE_INVENTORY_MAX_ARTIFACTS = 12;
-export const EVIDENCE_INVENTORY_MAX_IDS = 8;
-
-const IDENTITY_WIDTH = 128;
-
-/**
- * Worst verdict first.
- *
- * An artifact covering several runs is only as trustworthy as its weakest run,
- * so the fold takes the worst rather than the newest or the most common. A
- * `compromised` run inside an otherwise clean bundle is the fact the operator
- * needs, and averaging it away would be the one summary worth not printing.
- */
-const VERDICT_SEVERITY: ReadonlyArray<TrustVerdict> = ["compromised", "unverified", "unknown", "grounded", "reviewed"];
-
-export interface EvidenceInventoryArtifact {
-	readonly evidenceId: string;
-	readonly sourceKind: "run" | "session" | "eval";
-	readonly generatedAt: string;
-	readonly startedAt: string | null;
-	readonly endedAt: string | null;
-	readonly runIds: readonly string[];
-	readonly runIdsTruncated: boolean;
-	readonly agentIds: readonly string[];
-	readonly statuses: readonly string[];
-	readonly tags: readonly EvidenceTag[];
-	readonly totals: Readonly<{
-		runs: number;
-		receipts: number;
-		toolCalls: number;
-		toolErrors: number;
-		blockedToolCalls: number;
-		protectedArtifacts: number;
-		tokens: number;
-		costUsd: number;
-		wallTimeMs: number;
-	}>;
-	/** Secret-shaped values the builder replaced across the bundle's exports. */
-	readonly redactionCount: number;
-	readonly trust: Readonly<{
-		verdict: TrustVerdict;
-		/** Runs whose canonical trust status the bundle actually recorded. */
-		runsCovered: number;
-		/** True when the bundle predates the canonical trust projection. */
-		historical: boolean;
-	}>;
-}
-
-export interface EvidenceInventorySnapshot {
-	readonly version: 1;
-	readonly generatedAt: string;
-	readonly artifacts: readonly EvidenceInventoryArtifact[];
-	readonly truncated: boolean;
-}
-
-function bounded(value: string, width: number): string {
-	const sanitized = sanitizeCallTargetText(value);
-	if (sanitized.length === 0) return "unavailable";
-	return sanitizeCallTargetText(truncateToWidth(sanitized, width, "…", false));
-}
-
-/** Distinct, sanitized, bounded, in first-seen order. */
-function identities(values: ReadonlyArray<string>): string[] {
-	const seen: string[] = [];
-	for (const value of values) {
-		const text = bounded(value, IDENTITY_WIDTH);
-		if (!seen.includes(text)) seen.push(text);
-		if (seen.length >= EVIDENCE_INVENTORY_MAX_IDS) break;
-	}
-	return seen;
-}
-
-function tally(value: number | undefined): number {
-	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? Math.trunc(value) : 0;
-}
-
-function amount(value: number | undefined): number {
-	return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
-}
-
-/** Newest generation first. An unparseable stamp sorts oldest rather than throwing. */
-function byNewest(a: EvidenceOverview, b: EvidenceOverview): number {
-	return (Date.parse(b.generatedAt) || 0) - (Date.parse(a.generatedAt) || 0);
-}
-
-async function evidenceInventorySnapshot(
-	now: () => number = Date.now,
-	dataDir: string = clioDataDir(),
-): Promise<EvidenceInventorySnapshot> {
-	const all = (await listEvidenceOverviews(dataDir)).sort(byNewest);
-	const window = all.slice(0, EVIDENCE_INVENTORY_MAX_ARTIFACTS);
-	const artifacts: EvidenceInventoryArtifact[] = [];
-	for (const overview of window) {
-		// One unreadable trust file costs that artifact its verdict, never the
-		// whole inventory: the bundle itself is still the thing being listed.
-		let verdict: TrustVerdict = "unknown";
-		let runsCovered = 0;
-		let historical = true;
-		try {
-			const status = await loadEvidenceTrustStatus(dataDir, overview.evidenceId);
-			historical = status.projection !== "canonical";
-			runsCovered = status.runs.length;
-			const verdicts = status.runs.map((run) => trustVerdict(run.status));
-			verdict = VERDICT_SEVERITY.find((candidate) => verdicts.includes(candidate)) ?? "unknown";
-		} catch {
-			verdict = "unknown";
-		}
-		artifacts.push({
-			evidenceId: bounded(overview.evidenceId, IDENTITY_WIDTH),
-			sourceKind: overview.source.kind,
-			generatedAt: overview.generatedAt,
-			startedAt: overview.startedAt,
-			endedAt: overview.endedAt,
-			runIds: identities(overview.runIds),
-			runIdsTruncated: overview.runIds.length > EVIDENCE_INVENTORY_MAX_IDS,
-			agentIds: identities(overview.agentIds),
-			statuses: identities(overview.statuses),
-			tags: overview.tags.filter((tag) => EVIDENCE_TAGS.includes(tag)),
-			totals: {
-				runs: tally(overview.totals.runs),
-				receipts: tally(overview.totals.receipts),
-				toolCalls: tally(overview.totals.toolCalls),
-				toolErrors: tally(overview.totals.toolErrors),
-				blockedToolCalls: tally(overview.totals.blockedToolCalls),
-				protectedArtifacts: tally(overview.totals.protectedArtifacts),
-				tokens: tally(overview.totals.tokens),
-				costUsd: amount(overview.totals.costUsd),
-				wallTimeMs: tally(overview.totals.wallTimeMs),
-			},
-			redactionCount: tally(overview.redactionCount),
-			trust: { verdict, runsCovered, historical },
-		});
-	}
-	return {
-		version: 1,
-		generatedAt: new Date(now()).toISOString(),
-		artifacts,
-		truncated: all.length > window.length,
-	};
-}
+import { evidenceInventorySnapshot } from "../domains/evidence/inventory.js";
 
 /**
  * `clio-coder evidence inventory --json`, and nothing else.

package/src/cli/index.ts

@@ -71,6 +71,7 @@ Usage:
   clio-coder extensions           install, list, enable, disable, or remove extension packages
   clio-coder skills               list, inspect, validate, or install skills
   clio-coder library              list, search, add, or sync agents, prompts, fleets, and skills from catalogs
+  clio-coder tasks                list, add, hand, finish, or drop project operator tasks
   clio-coder verifiers            discover, inspect, author, validate, edit, or dry-run project checks
   clio-coder tools list|status|install|remove <id>  pinned external programs Clio can drive
   clio-coder interop inspect --json  detected external coding agents and how far each one is wired
@@ -259,6 +260,7 @@ const COMMAND_HANDLERS = new Map<string, CommandHandler>([
 	["fleet", async (subArgs) => (await import("./fleet.js")).runFleetCommand(subArgs)],
 	["skills", async (subArgs) => (await import("./skills.js")).runSkillsCommand(subArgs)],
 	["library", async (subArgs) => (await import("./library.js")).runLibraryCommand(subArgs)],
+	["tasks", async (subArgs) => (await import("./tasks.js")).runTasksCommand(subArgs)],
 	["verifiers", async (subArgs) => (await import("./verifiers.js")).runVerifiersCommand(subArgs)],
 	["docs", async (subArgs) => (await import("./docs.js")).runDocsCommand(subArgs)],
 	["share", async (subArgs) => (await import("./share.js")).runShareCommand(subArgs)],

package/src/cli/modes/print.ts

@@ -12,7 +12,7 @@ import {
 import { getTerminationCoordinator } from "../../core/termination.js";
 import { ToolNames } from "../../core/tool-names.js";
 import { createRunReceiptQuality } from "../../domains/dispatch/receipt-findings.js";
-import { openLedger } from "../../domains/dispatch/state.js";
+import { newRunId, openLedger } from "../../domains/dispatch/state.js";
 import type { RunKind, RunOutcome, RunReceiptDraft, RunStatus, ToolCallStat } from "../../domains/dispatch/types.js";
 import type { AgentMessage, ImageContent } from "../../engine/types.js";
 import type { ChatLoop, ChatLoopEvent } from "../../interactive/chat-loop.js";
@@ -58,6 +58,8 @@ export interface HeadlessMainAgentOptions {
 }
 
 interface HeadlessMainAgentResult {
+	/** Latest assistant stop, superseded by subsequent continuation messages. */
+	outputExhausted: boolean;
 	text: string;
 	error: string | null;
 	/**
@@ -154,6 +156,7 @@ function resultFromEvent(event: ChatLoopEvent, current: HeadlessMainAgentResult)
 	if (event.type !== "message_end") return current;
 	const message = event.message;
 	if (message?.role !== "assistant") return current;
+	current = { ...current, outputExhausted: message.stopReason === "length", sawTerminatingToolResult: false };
 	const error = assistantError(message);
 	if (error) return { ...current, text: "", error };
 	const text = assistantText(message).trimEnd();
@@ -180,8 +183,15 @@ function recordToolEnd(stats: HeadlessMainAgentReceiptStats, event: ChatLoopEven
 	stat.count += 1;
 	const durationMs = durationMsFromEvent(event);
 	if (durationMs !== undefined) stat.totalDurationMs += durationMs;
-	if (event.isError) stat.errors += 1;
-	else stat.ok += 1;
+	// Registry settlement is authoritative; legacy producers only expose isError.
+	const outcome = (event as { outcome?: unknown }).outcome;
+	if (outcome === "blocked") stat.blocked += 1;
+	else if (outcome === "error") stat.errors += 1;
+	else if (outcome === "ok") stat.ok += 1;
+	else if (outcome === undefined) {
+		if (event.isError) stat.errors += 1;
+		else stat.ok += 1;
+	}
 	stats.toolStats.set(tool, stat);
 	if (tool === ToolNames.Context) {
 		const rawTurnId = (event as { turnId?: unknown }).turnId;
@@ -267,6 +277,7 @@ interface HeadlessTerminalOutcome {
 }
 
 async function recordHeadlessMainAgentReceipt(input: {
+	runId: string;
 	chat: ChatLoop;
 	task: string;
 	startedAt: string;
@@ -289,6 +300,7 @@ async function recordHeadlessMainAgentReceipt(input: {
 	const outcomeDetail = input.terminal.failureMessage;
 	const ledger = openLedger();
 	const envelope = ledger.create({
+		id: input.runId,
 		agentId: "main-agent",
 		executionRole: "builder",
 		requestOrigin: "user",
@@ -394,10 +406,14 @@ function defaultShutdownHooks(): HeadlessShutdownHooks {
 }
 
 export async function runHeadlessMainAgent(chat: ChatLoop, options: HeadlessMainAgentOptions): Promise<number> {
+	// Children need the authoritative parent before submit can invoke dispatch.
+	// The terminal writer reuses this identity whichever settlement path wins.
+	const runId = newRunId();
 	const mode = options.mode ?? "text";
 	const jsonEvents = options.jsonEvents ?? "full";
 	const startedAt = new Date().toISOString();
 	let result: HeadlessMainAgentResult = {
+		outputExhausted: false,
 		text: "",
 		error: null,
 		sawTerminatingToolResult: false,
@@ -422,6 +438,7 @@ export async function runHeadlessMainAgent(chat: ChatLoop, options: HeadlessMain
 		if (sealed !== null) return sealed;
 		const endedAt = new Date().toISOString();
 		sealed = recordHeadlessMainAgentReceipt({
+			runId,
 			chat,
 			task: options.prompt,
 			startedAt,
@@ -526,6 +543,7 @@ export async function runHeadlessMainAgent(chat: ChatLoop, options: HeadlessMain
 	try {
 		if (mode === "json" && jsonEvents === "terminal") writeTerminalTurnStart();
 		const submitOptions = {
+			hostRun: { runId, lineage: { parentRunId: null, rootRunId: runId, depth: 0, attempt: 0 } },
 			...(options.images && options.images.length > 0 ? { images: options.images } : {}),
 			...(options.workingContextPaths && options.workingContextPaths.length > 0
 				? { workingContextPaths: options.workingContextPaths }
@@ -573,6 +591,15 @@ export async function runHeadlessMainAgent(chat: ChatLoop, options: HeadlessMain
 	} else if (result.error) {
 		terminal = { exitCode: 1, outcome: "failed", status: "failed", failureMessage: result.error };
 		stderrMessage = prefixHeadlessFailure(chat, result.error);
+	} else if (result.outputExhausted && !result.sawTerminatingToolResult) {
+		// The provider returned normally, but generation exhausted its budget.
+		// Earlier chatter and partial prose cannot turn that terminal cause into
+		// success. A later assistant message or terminating tool supersedes it.
+		const failureMessage =
+			"clio-coder run: output token limit reached (stopReason=length); generation incomplete. Consider resuming with a narrower task, lower reasoning effort, or a larger output budget.";
+		terminal = { exitCode: 1, outcome: "failed", status: "failed", failureMessage };
+		stderrMessage = failureMessage;
+		if (mode === "text" && result.text.length > 0) stdoutMessage = result.text;
 	} else if (result.text.length === 0 && !result.sawTerminatingToolResult) {
 		const failureMessage =
 			result.lastNotice !== null
@@ -611,7 +638,8 @@ export async function runHeadlessMainAgent(chat: ChatLoop, options: HeadlessMain
 
 	if (stderrMessage !== null) {
 		process.stderr.write(`${stderrMessage}\n`);
-	} else if (stdoutMessage !== null) {
+	}
+	if (stdoutMessage !== null) {
 		writeRawStdout(`${stdoutMessage}\n`);
 	}
 	await flushRawStdout();

package/src/cli/run.ts

@@ -2,6 +2,7 @@ import { type ClioSettings, readSettings } from "../core/config.js";
 import { loadDomains } from "../core/domain-loader.js";
 import { readFileArgsAsync } from "../core/file-references.js";
 import { withRunOverrides } from "../core/run-overrides.js";
+import { readStrictLayeredSettings } from "../core/settings-layers.js";
 import { clioDataDir } from "../core/xdg.js";
 import type { AgentsContract } from "../domains/agents/contract.js";
 import { AgentsDomainModule } from "../domains/agents/index.js";
@@ -62,7 +63,6 @@ Flags:
   --frequency-penalty <N>   one-run frequency penalty override
   --repeat-penalty <N>      one-run repeat penalty override
   --max-context-tokens <N>  one-run context-window override for supported local runtimes
-  --kv-cache-mode <mode>    one-run KV-cache mode override: f16|f32|none|false|q8_0|q4_0|q4_1|iq4_nl|q5_0|q5_1
   --json                    stream JSONL events for the main-agent path; dispatch streams events and receipt JSON
   --json-events <mode>      main-agent JSON stream mode: full|terminal; implies --json
   --steer-channel <path>    read live steering lines from a FIFO or appended regular file
@@ -102,15 +102,15 @@ function hasDispatchOnlyOptions(parsed: RunCliArgs): boolean {
 
 /**
  * True when an explicit --target override names a target that is not in
- * settings.targets. `readSettings().targets` is the same source the runtime
- * resolver checks (providers.getTarget), so this mirrors its `target-not-found`
+ * effective settings.targets. Include project overlays just as the runtime
+ * resolver does (providers.getTarget), so this mirrors its `target-not-found`
  * verdict without booting the providers domain. Unreadable/invalid settings
  * fall through (returns false) so the normal boot path surfaces that error
  * instead of a misleading "target not found".
  */
-function explicitTargetMissing(targetId: string): boolean {
+export function explicitTargetMissing(targetId: string): boolean {
 	try {
-		return !readSettings().targets.some((target) => target.id === targetId);
+		return !readStrictLayeredSettings(process.cwd()).settings.targets.some((target) => target.id === targetId);
 	} catch {
 		return false;
 	}
@@ -164,9 +164,9 @@ function explicitSkillPathErrors(skillPaths: ReadonlyArray<string>): string[] {
 }
 
 /**
- * The TUI's verdict for a command-shaped token the registry does not own,
- * applied to a headless task. Returns the refusal message, or null when the
- * task is not an unknown command.
+ * Refuse commands the headless prompt path cannot execute. Skill invocations
+ * and prompt templates have production expansion paths; interactive commands
+ * do not, so accepting them would send their literal text to the model.
  *
  * `parseSlashCommand` is the canonical shape test and the canonical registry
  * walk, so a token that is one word of letters, digits, hyphens, or colons and
@@ -191,11 +191,14 @@ function explicitSkillPathErrors(skillPaths: ReadonlyArray<string>): string[] {
  * closure sits on. Boundaries rule6 in `tests/boundaries/check-boundaries.ts`
  * holds both halves of that.
  */
-async function unknownSlashCommandRefusal(task: string): Promise<string | null> {
+async function headlessSlashCommandRefusal(task: string): Promise<string | null> {
 	if (!task.trim().startsWith("/")) return null;
 	const { parseSlashCommand } = await import("../interactive/slash-commands.js");
 	const command = parseSlashCommand(task);
-	if (command.kind !== "unknown-command") return null;
+	if (command.kind === "skill-invocation" || command.kind === "unknown" || command.kind === "empty") return null;
+	if (command.kind !== "unknown-command") {
+		return "interactive commands are not supported by clio-coder run; use interactive chat or the corresponding CLI command";
+	}
 	const { loadPromptTemplates } = await import("../domains/resources/index.js");
 	const templates = loadPromptTemplates({ cwd: process.cwd() });
 	if (templates.items.some((template) => template.name === command.token)) return null;
@@ -213,7 +216,6 @@ export async function runClioRun(
 	return withRunOverrides(
 		{
 			...(parsed.maxContextTokens !== undefined ? { maxContextTokens: parsed.maxContextTokens } : {}),
-			...(parsed.kvCacheMode !== undefined ? { kvCacheMode: parsed.kvCacheMode } : {}),
 		},
 		async () => {
 			if (parsed.help) {
@@ -262,11 +264,9 @@ export async function runClioRun(
 			if (!assembled) return 2;
 
 			if (parsed.agentId === undefined) {
-				// A mistyped slash command is a usage error, not a task. Refusing it
-				// here keeps it from booting a session and spending a model turn on a
-				// command that was never run, which is what the TUI has always done
-				// and what docs/guide/extensions-and-sharing.md documents for both surfaces.
-				const slashRefusal = await unknownSlashCommandRefusal(assembled.prompt);
+				// Reject unknown and unsupported interactive commands before boot;
+				// neither has a headless handler that could honor the request.
+				const slashRefusal = await headlessSlashCommandRefusal(assembled.prompt);
 				if (slashRefusal !== null) {
 					process.stderr.write(`clio-coder run: ${slashRefusal}\n`);
 					return 2;

package/src/cli/skills-eval.ts

@@ -272,10 +272,10 @@ export async function runSkillsEvalCommand(nameOrPath: string, options: SkillsEv
 	return anyUnmeasured || evidenceErrors.length > 0 ? 3 : 0;
 }
 
-export type NetworkPolicyLabel = "hermetic" | "allowed";
+export type NetworkPolicyLabel = "retrieve-disabled" | "allowed";
 
 function networkPolicyLabel(allowNetwork: boolean): NetworkPolicyLabel {
-	return allowNetwork ? "allowed" : "hermetic";
+	return allowNetwork ? "allowed" : "retrieve-disabled";
 }
 
 /**
@@ -287,7 +287,7 @@ function networkPolicyLabel(allowNetwork: boolean): NetworkPolicyLabel {
 function describeArmPolicy(allowNetwork: boolean): string {
 	const network = allowNetwork
 		? "network allowed (--allow-network), so arm runs keep the web tools"
-		: "network hermetic, so the web tools are stripped from every arm run (pass --allow-network to keep them)";
+		: "retrieval tools disabled in every arm run; bash networking requires OS isolation (pass --allow-network to keep web tools)";
 	return `policy: autonomy ${ARM_AUTONOMY} for the baseline and treatment arms in per-run disposable workspaces; ${network}`;
 }
 
@@ -295,7 +295,7 @@ function describeArmPolicy(allowNetwork: boolean): string {
 function describeArmPolicyOutcome(allowNetwork: boolean): string {
 	const network = allowNetwork
 		? "network: allowed (--allow-network); arm runs kept the web tools"
-		: "network: hermetic; the web tools were stripped from every arm run";
+		: "retrieval: disabled; bash networking was not constrained";
 	return `policy: the baseline and treatment arms ran at autonomy ${ARM_AUTONOMY}; ${network}`;
 }
 
@@ -353,17 +353,19 @@ function unmeasuredBullets(scenario: SkillEvalScenario, reason: string): ScoredB
 
 /**
  * The environment each arm's child `clio-coder run` inherits. Absent
- * `--allow-network` the hermetic switch is set, which strips the RETRIEVE
+ * `--allow-network` the retrieval registration switch is set, which strips the RETRIEVE
  * plane from every registry the child and its descendants build. With the flag
  * the variable is removed rather than left alone, so an ambient setting in the
  * operator's shell cannot make `--allow-network` a claim the run does not keep.
  *
  * @internal Exported for contract tests.
  */
-function evalChildEnv(allowNetwork: boolean, env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
+export function evalChildEnv(allowNetwork: boolean, env: NodeJS.ProcessEnv = process.env): NodeJS.ProcessEnv {
 	const childEnv: NodeJS.ProcessEnv = { ...env };
-	if (allowNetwork) Reflect.deleteProperty(childEnv, NO_NETWORK_TOOLS_ENV);
-	else childEnv[NO_NETWORK_TOOLS_ENV] = "1";
+	if (allowNetwork) {
+		Reflect.deleteProperty(childEnv, NO_NETWORK_TOOLS_ENV);
+		Reflect.deleteProperty(childEnv, "CLIO_CODER_NO_NETWORK_TOOLS");
+	} else childEnv[NO_NETWORK_TOOLS_ENV] = "1";
 	return childEnv;
 }
 

package/src/cli/steer-channel.ts

@@ -1,18 +1,44 @@
 import * as fs from "node:fs";
+import { Socket } from "node:net";
 import * as readline from "node:readline";
 
 export function setupSteerChannel(filePath: string, onLine: (line: string) => void): () => void {
 	let closed = false;
 	let watcher: fs.FSWatcher | null = null;
-	let stream: fs.ReadStream | null = null;
+	let stream: Socket | null = null;
 	let rl: readline.Interface | null = null;
+	const cleanup = () => {
+		if (closed) return;
+		closed = true;
+		watcher?.close();
+		rl?.close();
+		stream?.destroy();
+	};
+	const reportError = (err: unknown) => {
+		if (closed) return;
+		process.stderr.write(
+			`clio-coder run: failed to setup steer channel: ${err instanceof Error ? err.message : String(err)}\n`,
+		);
+		cleanup();
+	};
 
 	try {
 		const stats = fs.statSync(filePath);
 		if (stats.isFIFO()) {
-			// Named pipe: we can just read from the stream
-			stream = fs.createReadStream(filePath);
+			// A blocking fs read cannot be cancelled while a FIFO writer stays
+			// open. Socket uses readiness-driven pipe reads that destroy() closes.
+			// Keep read-only access and the existing first-writer-EOF behavior.
+			const fd = fs.openSync(filePath, fs.constants.O_RDONLY | fs.constants.O_NONBLOCK);
+			try {
+				stream = new Socket({ fd, readable: true, writable: false });
+			} catch (err) {
+				// Ownership transfers to Socket only after successful construction.
+				fs.closeSync(fd);
+				throw err;
+			}
+			stream.on("error", reportError);
 			rl = readline.createInterface({ input: stream, crlfDelay: Infinity });
+			rl.on("error", reportError);
 			rl.on("line", (line) => {
 				if (closed) return;
 				const trimmed = line.trim();
@@ -66,21 +92,8 @@ export function setupSteerChannel(filePath: string, onLine: (line: string) => vo
 			});
 		}
 	} catch (err) {
-		process.stderr.write(
-			`clio-coder run: failed to setup steer channel: ${err instanceof Error ? err.message : String(err)}\n`,
-		);
+		reportError(err);
 	}
 
-	return () => {
-		closed = true;
-		if (watcher) {
-			watcher.close();
-		}
-		if (rl) {
-			rl.close();
-		}
-		if (stream) {
-			stream.destroy();
-		}
-	};
+	return cleanup;
 }