@kelceyp/caw-server 1.0.281 → 1.0.282

package/dist/pty-wrapper.mjs

@@ -19,13 +19,16 @@
  */
 
 import * as pty from 'node-pty';
-import { mkdtempSync, readFileSync, existsSync, writeFileSync, rmSync, realpathSync, statSync, chmodSync, renameSync, unlinkSync, lstatSync, readlinkSync, readdirSync } from 'fs';
-import { join, dirname, basename, resolve } from 'path';
+import { mkdtempSync, readFileSync, existsSync, writeFileSync, rmSync, realpathSync } from 'fs';
+import { join } from 'path';
 import { tmpdir, homedir } from 'os';
 import { execSync } from 'child_process';
 import { readSentinelPayload, hasPendingWork } from './pty-deferred-teardown.mjs';
 import { emitResult as emitResultLine } from './pty-emit-result.mjs';
 import { TEARDOWN_REASONS } from './teardownReasons.mjs';
+import { ensureNonInteractiveSetup } from './pty-non-interactive-setup.mjs';
+import { createTranscriptTailer } from './transcript-tailer.mjs';
+import { createPromptRejectionDetector } from './prompt-rejection-detector.mjs';
 
 // --- Arg parsing ---
 
@@ -78,242 +81,77 @@ try {
 }
 
 // --- Pre-seed ~/.claude.json to avoid interactive dialogs ---
-// Sets hasCompletedOnboarding and trusts the working directory.
-// Uses realpathSync to handle macOS /tmp → /private/tmp symlinks.
+// The function is defined in the sibling module
+// `./pty-non-interactive-setup.mjs` (statically imported above). Post-As1050
+// Commit B the direct-mode CAW server calls that function ONCE, before
+// spawning this wrapper, under a module-level mutex singleton in
+// `JobRunner.runDirectJob` (see `claude-session.js#prepareDirectHost`), and
+// signals suppression here via the `--skip-non-interactive-setup` CLI arg
+// emitted by `buildDirectCommand`. The Docker path does NOT emit that flag
+// (`claude-session.js#getDockerConfig`'s `commandParts` omits it by
+// design), so the in-container wrapper still runs the setup itself. This
+// wrapper's local call site preserves the same discriminating catch that
+// re-emits classified `CLAUDE_JSON_UNREADABLE` errors byte-for-byte with
+// today's stderr + exit contract and rethrows every other error. See As1016
+// for the fail-fast / atomic / idempotent invariants that module preserves.
 //
-// Fail-fast / atomic / idempotent write contract (As1016):
-//   - Absent  → seed with data = {} and mode 0o644, then atomic write.
-//   - Present but stat/read/parse fails (with one-shot SyntaxError retry) →
-//     print classified `CLAUDE_JSON_UNREADABLE (<code>): <path>. ...` to
-//     stderr and exit 1. No `[pty-wrapper]` prefix. No write.
-//   - Present and read succeeded → apply the guarded mutations; short-circuit
-//     via the idempotent guard when both onboarding and every trust-set entry
-//     are already recorded.
-//   - Writes go via unique `<target>.tmp.<pid>.<counter>` in the SAME
-//     directory (`renameSync` must stay on one filesystem), preserving the
-//     target's existing mode (belt-and-braces `chmodSync` against umask),
-//     cleaning up (`unlinkSync` + rethrow the original error) on any
-//     temp-write / chmod / rename failure so the underlying cause is not
-//     masked.
-//   - A dangling symlink materialises the file at the link's own target;
-//     `lstatSync` classifies the nominal path (single-hop only).
-//   - At function top, sweeps `<basename>.tmp.*` siblings older than 60 s
-//     from `<dirname>` so a crashed prior writer never accumulates cruft;
-//     sweep failures are logged and ignored (never the caller's failure).
-//
-// Declared here (post log()/stdin-drain/claude-binary, immediately before
-// mkdtempSync) so an early `process.exit(1)` cannot EPIPE the parent's
-// stdin.write at JobRunner.js:747/:1145 (no 'error' listener there).
-// Relocating only the invocation and not the declaration would trip the
-// const binding's TDZ — `ReferenceError: Cannot access
-// 'ensureNonInteractiveSetup' before initialization` on every direct PTY
-// turn.
+// The invocation stays here (post log()/stdin-drain/claude-binary,
+// immediately before mkdtempSync) so a Docker-mode `process.exit(1)` on a
+// classified fail-fast cannot EPIPE the parent's stdin.write. The
+// direct-mode early-exit exposure the D16 ordering constraint was
+// originally motivated by is closed by two independent halves: As1050
+// Commit B moves the direct-mode call out of the wrapper entirely (the
+// `--skip-non-interactive-setup` gate below), and As1048 landed a
+// `stdin.on('error')` handler immediately before `stdin.write(promptToSend)`
+// inside `JobRunner.js#writePromptToChildStdin` (see `JobRunner.js:130`
+// registering the listener and `:141` performing the write) so any residual
+// Docker EPIPE surfaces as a caught error rather than an uncaught. The
+// Docker path retains the six exit sites, so this comment's ordering
+// constraint stands for Docker.
 //
 // Matched by shared/jobErrorPrefixes.js's `CLAUDE_JSON_UNREADABLE_PREFIX`
-// export (not imported here — `shared/` is not published from
-// `server/dist/`; keep the two literals in sync).
+// export AND by the extracted module's own inline copy at
+// `pty-non-interactive-setup.mjs`. Task 2 (Commit A) created the third
+// co-located literal (shared / wrapper / extracted); the extracted module
+// carries its own copy because `shared/` is not published from
+// `server/dist/`, and the wrapper keeps this local const so the
+// discriminating catch below can classify without importing the sibling's
+// export. Keep all three literals in sync per As1016 D8.
 const CLAUDE_JSON_UNREADABLE_PREFIX = 'CLAUDE_JSON_UNREADABLE';
 
-// Module-local counter so each write produces a unique temp path
-// (`<target>.tmp.<pid>.<counter>`, first temp is `.tmp.<pid>.1`).
-let claudeJsonTempCounter = 0;
-
-const ensureNonInteractiveSetup = (cwd) => {
-    const nominal = join(homedir(), '.claude.json');
-
-    // D15: classify the nominal path via lstatSync (not existsSync).
-    //   - not-a-symlink or absent → target = nominal
-    //   - live symlink            → target = realpathSync(nominal)
-    //   - dangling symlink        → target = resolve(dirname(nominal), readlinkSync(nominal))
-    // Single-hop only. Dangling symlink materialises the file at the link's
-    // OWN target rather than replacing the link with a regular file.
-    let target = nominal;
+// As1050 Commit B (C3) — the `--skip-non-interactive-setup` CLI arg is
+// emitted by `claude-session.js#buildDirectCommand` only for direct-mode
+// spawns; `getDockerConfig`'s `commandParts` omits it. `hasFlag` (not
+// `getArg`) is the correct helper: `getArg` is value-extracting and would
+// fail *open* on a valueless flag. Sibling idiom: `hasFlag('--skip-permissions')`.
+if (!hasFlag('--skip-non-interactive-setup')) {
     try {
-        const linkSt = lstatSync(nominal);
-        if (linkSt.isSymbolicLink()) {
-            try {
-                target = realpathSync(nominal);
-            } catch {
-                const linkText = readlinkSync(nominal);
-                target = resolve(dirname(nominal), linkText);
-            }
-        }
+        // As1050 AC 19 — forward `CLAUDE_CONFIG_DIR` from the wrapper's env so
+        // the in-container Docker path (which still runs this local call —
+        // `getDockerConfig`'s `commandParts` omits `--skip-non-interactive-setup`)
+        // routes the seed to the same file the container-side `claude`
+        // reads. Absent variable → falls back to `homedir()` inside the
+        // sibling module, matching pre-AC-19 behaviour.
+        ensureNonInteractiveSetup(process.cwd(), {
+            home: homedir(),
+            configDir: process.env.CLAUDE_CONFIG_DIR,
+            log
+        });
     } catch (err) {
-        if (err.code !== 'ENOENT') {
-            // A stat failure on the nominal path itself that is not "absent"
-            // (EACCES on the parent dir, ELOOP, ENOTDIR, ...) is unclassifiable
-            // — fail-fast rather than write blindly.
-            process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${nominal}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
+        // Discriminating catch: only classified `CLAUDE_JSON_UNREADABLE`-prefixed
+        // throws are re-emitted to stderr as a fail-fast (matching today's
+        // process.stderr.write + process.exit(1) contract byte-for-byte; the
+        // extracted module's `.message` omits the trailing `\n` that the wrapper
+        // concatenates here). All other errors are RETHROWN — the wrapper does
+        // NOT swallow them, so today's uncaught-exception behaviour on
+        // non-`CLAUDE_JSON_UNREADABLE` failures is preserved.
+        if (err && typeof err.message === 'string' && err.message.startsWith(CLAUDE_JSON_UNREADABLE_PREFIX)) {
+            process.stderr.write(err.message + '\n');
             process.exit(1);
         }
-        // ENOENT on the nominal path is the absent case; target stays nominal.
-    }
-
-    // D17: sweep stale <basename>.tmp.* siblings older than 60 s. Best-effort
-    // cleanup; failures are logged and never surfaced (a broken sweep must
-    // not fail the wrapper turn).
-    try {
-        const parentDir = dirname(target);
-        const prefix = `${basename(target)}.tmp.`;
-        const now = Date.now();
-        for (const name of readdirSync(parentDir)) {
-            if (!name.startsWith(prefix)) continue;
-            const stalePath = join(parentDir, name);
-            try {
-                const staleSt = statSync(stalePath);
-                if (now - staleSt.mtimeMs > 60_000) {
-                    unlinkSync(stalePath);
-                }
-            } catch (sweepErr) {
-                log(`Warning: stale temp sweep of ${stalePath} failed: ${sweepErr.message}`);
-            }
-        }
-    } catch (sweepErr) {
-        log(`Warning: stale temp sweep of ${dirname(target)} failed: ${sweepErr.message}`);
-    }
-
-    // Classified read. `statSync(target)` classifies ENOENT as absent
-    // (data = {}, existingMode = 0o644); any other stat error fails fast.
-    // On SyntaxError from the initial JSON.parse a single re-stat +
-    // re-readFileSync + re-JSON.parse retry runs with no sleep (reclassifies
-    // to absent if the re-stat returns ENOENT). Other read failures fail
-    // immediately with no retry.
-    let data;
-    let existingMode;
-    let readSucceeded = false;
-
-    let st;
-    try {
-        st = statSync(target);
-    } catch (err) {
-        if (err.code === 'ENOENT') {
-            data = {};
-            existingMode = 0o644;
-        } else {
-            process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
-            process.exit(1);
-        }
-    }
-
-    if (st) {
-        existingMode = st.mode & 0o777;
-        let raw;
-        try {
-            raw = readFileSync(target, 'utf-8');
-        } catch (err) {
-            process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${err.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
-            process.exit(1);
-        }
-        try {
-            data = JSON.parse(raw);
-            readSucceeded = true;
-        } catch {
-            // D1: one-shot SyntaxError retry (no sleep). A concurrent
-            // in-flight write from a peer can momentarily present a partial
-            // JSON snapshot; a single re-stat + re-read gives it a chance to
-            // land. Deliberately untested per D1 ("best-effort insurance for
-            // the deploy, not a standing guarantee").
-            let retrySt;
-            try {
-                retrySt = statSync(target);
-            } catch (retryErr) {
-                if (retryErr.code === 'ENOENT') {
-                    data = {};
-                    existingMode = 0o644;
-                } else {
-                    process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${retryErr.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
-                    process.exit(1);
-                }
-            }
-            if (retrySt) {
-                existingMode = retrySt.mode & 0o777;
-                let retryRaw;
-                try {
-                    retryRaw = readFileSync(target, 'utf-8');
-                } catch (retryErr) {
-                    process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (${retryErr.code}): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
-                    process.exit(1);
-                }
-                try {
-                    data = JSON.parse(retryRaw);
-                    readSucceeded = true;
-                } catch (retryErr) {
-                    process.stderr.write(`${CLAUDE_JSON_UNREADABLE_PREFIX} (SyntaxError): ${target}. Restore from ~/.claude/backups/ or repair the file, then retry.\n`);
-                    process.exit(1);
-                }
-            }
-        }
-    }
-
-    // Trust both the raw and real cwd paths (handles macOS /tmp symlink).
-    // The inner try/ignore on realpathSync(cwd) is preserved — a stat failure
-    // on cwd is a defensible reduction of the trust set, not the anti-pattern
-    // rewritten out above.
-    const paths = new Set([cwd]);
-    try { paths.add(realpathSync(cwd)); } catch { /* ignore */ }
-
-    // D3/D4 idempotent guard — predicated on a SUCCESSFUL read, never on the
-    // shape of `data` alone.
-    //
-    // Closes: steady-state lost updates — the reproduced mechanism where two
-    //   concurrent turns race a read-modify-write when neither had any change
-    //   to make in the first place (e.g. `mcpServers` emptied for one project
-    //   with onboarding intact).
-    // Does NOT close: concurrent first initialization. If N wrapper turns
-    //   start against a fresh cwd before any one has completed its write,
-    //   all N read the pre-setup state and all N write; only locking or
-    //   per-session config isolation can close that residual.
-    // Note: `CLAUDE_CONFIG_DIR` isolation is empirically verified on Claude
-    //   Code 2.1.245 (relocates `.claude.json`, `projects/`, `sessions/`,
-    //   `backups/`) rather than a published contract; future upstream
-    //   changes are breaking evidence to re-verify.
-    if (readSucceeded && data.hasCompletedOnboarding) {
-        const alreadyTrusted = [...paths].every(
-            (p) => data.projects?.[p]?.hasTrustDialogAccepted
-        );
-        if (alreadyTrusted) {
-            return;
-        }
-    }
-
-    // Guarded mutations — preserved exactly:
-    //   (i)  onboarding is set ONCE; an already-onboarded seed's
-    //        `lastOnboardingVersion` is not re-stamped.
-    //   (ii) per-project trust is set ONCE; the spread preserves any
-    //        pre-existing keys (e.g. `mcpServers`) on the project's entry.
-    if (!data.hasCompletedOnboarding) {
-        data.hasCompletedOnboarding = true;
-        data.lastOnboardingVersion = '9.9.9';
-    }
-    data.projects = data.projects || {};
-    for (const p of paths) {
-        if (!data.projects[p]?.hasTrustDialogAccepted) {
-            data.projects[p] = {
-                ...(data.projects[p] || {}),
-                hasTrustDialogAccepted: true,
-                projectOnboardingSeenCount: 10
-            };
-        }
-    }
-
-    // D5/D6/D7/D19: atomic mode-preserving temp+rename.
-    // Unique temp name per (pid, counter). Same directory as `target` so
-    // `renameSync` stays on one filesystem. Belt-and-braces `chmodSync`
-    // against umask. On any error on write / chmod / rename, cleanup and
-    // rethrow the ORIGINAL error so the underlying cause is not masked.
-    const tmp = `${target}.tmp.${process.pid}.${++claudeJsonTempCounter}`;
-    try {
-        writeFileSync(tmp, JSON.stringify(data), { mode: existingMode });
-        chmodSync(tmp, existingMode);
-        renameSync(tmp, target);
-    } catch (err) {
-        try { unlinkSync(tmp); } catch { /* temp may not exist; ignore */ }
         throw err;
     }
-    log(`Non-interactive setup complete for: ${cwd}`);
-};
-
-ensureNonInteractiveSetup(process.cwd());
+}
 
 // --- Temp directory for settings, hook script, and sentinel file ---
 
@@ -359,10 +197,11 @@ writeFileSync(settingsPath, JSON.stringify(settings));
 const WATCHDOG_TIMEOUT_MS = Number.parseInt(process.env.CAW_PTY_WATCHDOG_TIMEOUT_MS, 10) || (90 * 60 * 1000);
 
 // D11 test-only env overrides (default off). Precedent: CAW_PTY_WATCHDOG_TIMEOUT_MS above.
-// CAW_PTY_DISABLE_TRANSCRIPT_TAIL: skip all tailTranscript() work (both the
-//   1s polling loop's calls and the final onExit call), so wrapper stdout
-//   carries no `transcript` lines. Used to prove downstream (Task 5) fallback
-//   consumes `result` instead of the missing transcript stream.
+// CAW_PTY_DISABLE_TRANSCRIPT_TAIL: skip all TranscriptTailer drains (the 1s
+//   polling loop, the SIGUSR1 handler, and the final onExit tick), so
+//   wrapper stdout carries no `transcript` lines and PromptRejectionDetector
+//   never sees an entry via `consider()`. Used to prove downstream (Task 5)
+//   fallback consumes `result` instead of the missing transcript stream.
 // CAW_PTY_SUPPRESS_STOP_FALLBACK: blank the emitted `result` field on the
 //   success branch of pty-emit-result (only when hookData is non-null and
 //   the success branch runs). Used to prove the AC-5 gate downstream.
@@ -380,10 +219,9 @@ let teardownReason = null;
 // Duration capture: wall clock from `pty.spawn` to top of `teardown()`.
 // `endedAt` is set by whichever teardown path fires first (normal SIGUSR1
 // completion or watchdog force-kill — both routed through `teardown()`,
-// per design Decision D1). The prompt-too-long branch in `onExit` does NOT
-// go through `teardown()`, so `endedAt` remains null and no `durationMs`
-// is emitted (per Decision D3 — service appends the pre-existing `'0'`
-// duration sentinel).
+// per design Decision D1). If the child exits before `teardown()` runs,
+// `endedAt` remains null and no `durationMs` is emitted (per Decision D3 —
+// service appends the pre-existing `'0'` duration sentinel).
 let startedAt = null;
 let endedAt = null;
 
@@ -515,7 +353,7 @@ const teardown = (reason = TEARDOWN_REASONS.STOP) => {
 
 process.on('SIGUSR1', () => {
     log('Received SIGUSR1 (stop signal)');
-    tailTranscript();
+    drainTailerAndForward();
     const payload = readSentinelPayload(sentinelPath);
     if (!payload) {
         log(`Warning: failed to read sentinel, proceeding with teardown`);
@@ -578,7 +416,12 @@ if (effortLevel) {
     claudeArgs.push('--effort', effortLevel);
 }
 claudeArgs.push('--settings', settingsPath);
-claudeArgs.push(prompt);
+// The prompt is content. `--` bounds option parsing so a leading-dash
+// prompt ("- could you…") is not parsed as a CLI flag. This bound does
+// *not* cover subcommand dispatch, and the exposure is against the
+// trimmed prompt (pty-wrapper.mjs:63 trims before this point) — see
+// technical-debt-register.md for the recorded subcommand-shadowing debt.
+claudeArgs.push('--', prompt);
 
 log(`Session: ${effectiveSessionId}`);
 log(`Prompt length: ${prompt.length} chars`);
@@ -604,59 +447,25 @@ writeFileSync(claudePidPath, String(ptyProcess.pid));
 let ttyBuffer = '';
 let permissionConfirmed = false;
 
-// As1063 Task 3 item 5: streaming prompt-too-long detection (mechanism (d) fix).
-//
-// Named mechanism from Task 1 evidence ([Aj20482 trace](Ad84181)): Claude Code
-// CLI treats "Prompt is too long" from the Anthropic API as an assistant-message
-// response — it writes the text to the transcript, prints it to the tty, and
-// awaits the next user input rather than exiting. No Stop hook fires (this is
-// not a normal completion). The wrapper's onExit-side detection at :822 depends
-// on the child exiting, so it never runs. This streaming detection catches the
-// phrase during onData and forces the pty child to exit via SIGTERM, which then
-// drives the existing onExit path (emitResult / prompt-too-long fallback /
-// process exit) unchanged.
+// onData responsibilities after As1080 Increment A:
 //
-// Debounce (500 ms of tty silence after the phrase is seen) reduces the
-// false-positive risk of a legitimate Claude response that mentions the
-// phrase mid-stream — a real response keeps writing (streaming JSON events,
-// further text) and pushes the timer out; only an idle tty — the observed
-// prompt-too-long signature — lets the timer fire. `seenPromptTooLong` is
-// persistent because `ttyBuffer` is trimmed to the last 5000 chars on
-// overflow, and we do not want to lose the signal to a later burst of output.
-// Budget rationale: the observed prod trace (Aj20482) had no post-phrase tty
-// output for 5+ minutes; 500 ms is comfortably above any streaming inter-chunk
-// gap for a real turn and well below any human-perceptible terminal-transition
-// latency erosion (AC5).
+// (1) Auto-confirm the `--dangerously-skip-permissions` "Yes/No" dialog once
+//     the rendered tty contains both "Yes" and "No". The wrapper sends a
+//     down-arrow to select "Yes" followed by Enter, then latches
+//     `permissionConfirmed` so subsequent chunks do not re-trigger.
+// (2) Keep `ttyBuffer` bounded — trimmed to the last 5000 chars once it
+//     exceeds 10000. `ttyBuffer` itself is retained because the onExit
+//     diagnostic-label branch reads a bounded tail of it for a single log
+//     line at process exit.
 //
-// `CAW_PTY_PROMPT_TOO_LONG_DEBOUNCE_MS` overrides the default (test-only
-// configuration knob per Task 3 item 17 — fault-injection for the pre-fix /
-// post-fix pairing regression test; production leaves the default in place).
-const PROMPT_TOO_LONG_DEBOUNCE_MS = (() => {
-    const raw = process.env.CAW_PTY_PROMPT_TOO_LONG_DEBOUNCE_MS;
-    if (!raw) return 500;
-    const parsed = parseInt(raw, 10);
-    return Number.isFinite(parsed) && parsed >= 0 ? parsed : 500;
-})();
-let seenPromptTooLong = false;
-let streamingPromptTooLongEmitted = false;
-let promptTooLongTimer = null;
-const schedulePromptTooLongEmit = () => {
-    if (promptTooLongTimer) clearTimeout(promptTooLongTimer);
-    promptTooLongTimer = setTimeout(() => {
-        promptTooLongTimer = null;
-        if (resultEmitted || failureEmitted) return;
-        log('Prompt-too-long: detected in streaming path — emitting failure and killing pty');
-        process.stdout.write(JSON.stringify({
-            type: 'error',
-            error: 'prompt_too_long',
-            message: 'Prompt is too long'
-        }) + '\n');
-        failureEmitted = true;
-        streamingPromptTooLongEmitted = true;
-        // Kill the pty so onExit fires and the wrapper shuts down cleanly.
-        try { ptyProcess.kill('SIGTERM'); } catch { /* ignore */ }
-    }, PROMPT_TOO_LONG_DEBOUNCE_MS);
-};
+// The onData handler no longer scans `ttyBuffer` for the literal
+// "Prompt is too long" trigger phrase. Rendered tty flattens authorship —
+// echoed job prompt, tool results, rendered CAW documents, agent prose, and
+// genuine API rejections all land in the same stream — so any text-based
+// predicate here fires on things the agent said and kills healthy sessions.
+// Prompt-rejection classification is now driven exclusively by the Stop-hook
+// sentinel's structured error payload consumed in `emitResult` and by
+// `claude-session.js` `classifyExit` Step 2 (`errorInfo.error === 'prompt_too_long'`).
 
 ptyProcess.onData((data) => {
     ttyBuffer += data;
@@ -666,169 +475,212 @@ ptyProcess.onData((data) => {
         setTimeout(() => ptyProcess.write('\r'), 200); // Enter
         permissionConfirmed = true;
     }
-    // As1063 Task 3: streaming prompt-too-long detection with debounce.
-    // Latch `seenPromptTooLong` on first observation, then reset the debounce
-    // on every subsequent onData chunk — the timer only fires after tty has
-    // been idle for PROMPT_TOO_LONG_DEBOUNCE_MS.
-    if (!seenPromptTooLong && ttyBuffer.includes('Prompt is too long')) {
-        seenPromptTooLong = true;
-        schedulePromptTooLongEmit();
-    } else if (seenPromptTooLong && !resultEmitted && !failureEmitted) {
-        schedulePromptTooLongEmit();
-    }
     // Keep buffer bounded
     if (ttyBuffer.length > 10000) ttyBuffer = ttyBuffer.slice(-5000);
 });
 
-// --- Transcript tailing ---
-// Claude writes session transcript to ~/.claude/projects/<cwd-hash>/<session-id>.jsonl.
-// We poll it every 1 second and forward new entries to stdout as streaming events.
+// --- Transcript tailing (TranscriptTailer + PromptRejectionDetector wiring) ---
+// Task 6 (As1080 Increment B) replaced the inline tail-state block that lived
+// here with a two-module split. `transcript-tailer.mjs` owns cursor / (dev,ino)
+// / preBaselineUUIDs / processedUUIDs bookkeeping and torn-line + file-
+// replacement recovery; `prompt-rejection-detector.mjs` owns the conjunctive-
+// predicate evaluation on `isApiErrorMessage:true` transcript entries and the
+// one-shot `{"type":"error","error":"prompt_too_long", …}` stdout emission
+// that JobRunner.js:363 consumes. The wrapper is now a thin coordinator:
+//   • establishes the tailer boundary pre-spawn (Case A fresh session →
+//     cursor:0 / empty preBaselineUUIDs; Case B `--resume` with a readable
+//     transcript file at the cwd-hash candidate → (dev,ino) + cursor:size
+//     + regex-uuid pre-baseline walk with no size limit);
+//   • forwards each `tick()` entry into `detector.consider(entry)` from the
+//     poll callback (in file order, exactly once);
+//   • notifies the detector at the tailer's `unusable` transition with
+//     `cause ∈ {'readError','reopenFailed'}` — the venue matches the
+//     transition (readError from initialiseBoundary Case B, reopenFailed
+//     from a tick()-time reopenAndRewalkBoundary);
+//   • at onExit, when `transcriptPath === null`, calls
+//     `detector.noteTranscriptUnresolved()` exactly once before
+//     `emitResult(hookData)`.
+//
+// The detector's live-accessor coupling reads `resultEmitted` and
+// `failureEmitted` via closure — NOT snapshots at construction — so a
+// concurrent Stop-hook `emitResult()` that flips the flags mid-`consider()`
+// is caught by the detector's re-check-before-write guard (Task 5 item 10;
+// unit-tested in `prompt-rejection-detector.test.js` case (e)).
+//
+// Path resolution stays a polling-time concern: no pre-spawn retry loop.
+// For fresh sessions where the cwd-hash guess is wrong, the D14 late-
+// adoption path at onExit constructs a fresh tailer against
+// `hookData.transcript_path` (cursor rule keyed off `resumeId`, mirroring
+// today's retired resume-baseline snapshot guard).
 
 let transcriptPath = null;
-let transcriptLinesRead = 0;
 let transcriptPathResolutionAttempts = 0;
-const processedEntryUUIDs = new Set();
-let lastReadEntryUUID = null;
-
-// Snapshot the pre-existing line count on --resume so only new content streams.
-// Shared by the cwd-hash-hit branch and the D14 hook-path adoption branch —
-// keeping the snapshot in one place avoids duplicating the readFileSync/count
-// logic and satisfies the checklist rule ("Do not duplicate the snapshot
-// logic into the D14 branch").
-const snapshotResumeBaseline = (path) => {
-    if (!resumeId) return;
-    try {
-        const content = readFileSync(path, 'utf-8');
-        transcriptLinesRead = content.trim().split('\n').filter(Boolean).length;
-        log(`Resume: skipping ${transcriptLinesRead} existing transcript lines`);
-    } catch { /* ignore */ }
-};
-
-// Resolve transcript path, handling macOS /tmp → /private/tmp symlinks.
-// Returns null if not yet found (retried on next poll).
-//
-// D14 (guarded hook-path adoption): callers may pass an `overridePath` — the
-// Stop hook's `hookData.transcript_path`. When supplied, the function bypasses
-// the cwd-hash candidate search and adopts the override path directly (after
-// an existsSync guard). The caller must already have gated on `!transcriptPath`
-// so this is only used when the polling loop never memoised a path — which
-// preserves today's behaviour on every turn the hash convention worked for.
-const resolveTranscriptPath = (overridePath = null) => {
-    if (!overridePath && transcriptPath) return transcriptPath;
-
-    if (overridePath) {
-        if (!existsSync(overridePath)) return null;
-        transcriptPath = overridePath;
-        snapshotResumeBaseline(overridePath);
-        return transcriptPath;
-    }
+let transcriptPathMemoised = false;
+
+// Emission-state flags — declared here so the detector's live accessors
+// can close over them. `promptRejectionEmitted` distinguishes a detector-
+// initiated failure (branchTaken='prompt-rejection') from a Stop-hook
+// StopFailure (branchTaken='emitted-failure'); both paths set
+// `failureEmitted=true` so the exit branch `if (failureEmitted) { process.exit(1); }`
+// stays byte-identical to its pre-task state.
+let resultEmitted = false;
+let failureEmitted = false;
+let promptRejectionEmitted = false;
 
-    transcriptPathResolutionAttempts++;
+// Compute the pre-spawn candidate transcript path via the cwd-hash
+// convention. Fresh sessions don't have the file yet at pre-spawn (claude
+// creates it after `pty.spawn`), so we do NOT require existsSync — the
+// tailer's `tick()` safely returns [] on ENOENT.
+const computeCandidateTranscriptPath = () => {
     const claudeProjectsDir = join(homedir(), '.claude', 'projects');
     const cwd = process.cwd();
-    const paths = new Set([cwd]);
-    try { paths.add(realpathSync(cwd)); } catch { /* ignore */ }
-
-    for (const dir of paths) {
+    const candidates = [cwd];
+    try {
+        const rp = realpathSync(cwd);
+        if (rp !== cwd) candidates.push(rp);
+    } catch { /* ignore */ }
+    // Prefer a candidate that already resolves on disk (relevant for
+    // --resume where the transcript file exists at spawn time). Otherwise
+    // fall back to the first (cwd-hash) candidate; D14 late-adoption at
+    // onExit corrects if this guess was wrong.
+    for (const dir of candidates) {
         const hash = dir.replace(/[/.]/g, '-');
-        const candidate = join(claudeProjectsDir, hash, `${effectiveSessionId}.jsonl`);
-        if (existsSync(candidate)) {
-            transcriptPath = candidate;
-            log(`Transcript found (attempt ${transcriptPathResolutionAttempts}): ${transcriptPath}`);
-            snapshotResumeBaseline(candidate);
-            return transcriptPath;
-        }
-    }
-    if (transcriptPathResolutionAttempts === 1 || transcriptPathResolutionAttempts % 10 === 0) {
-        log(`Transcript not found (attempt ${transcriptPathResolutionAttempts}), cwd=${cwd}, session=${effectiveSessionId}`);
+        const p = join(claudeProjectsDir, hash, `${effectiveSessionId}.jsonl`);
+        if (existsSync(p)) return p;
     }
-    return null;
+    const hash = candidates[0].replace(/[/.]/g, '-');
+    return join(claudeProjectsDir, hash, `${effectiveSessionId}.jsonl`);
 };
 
-// Read new transcript entries and forward to stdout. Returns count of new lines emitted.
-const tailTranscript = () => {
-    // D11 test-only override: skip all tail work so wrapper stdout carries no
-    // `transcript` lines. Both the 1s polling loop's calls and the final
-    // onExit call short-circuit here — the fallback-consumption case downstream
-    // (Task 5) needs a wire with no transcript stream at all.
-    if (DISABLE_TRANSCRIPT_TAIL) return 0;
-    const path = resolveTranscriptPath();
-    if (!path) return 0;
-
-    let newLines = 0;
-    try {
-        const content = readFileSync(path, 'utf-8');
-        const lines = content.trim().split('\n').filter(Boolean);
-        const fileLineCount = lines.length;
-
-        if (fileLineCount < transcriptLinesRead) {
-            log(`tailTranscript: FILE SHRINK — transcriptLinesRead=${transcriptLinesRead}, fileLines=${fileLineCount} (file replaced or truncated), resetting to 0`);
-            transcriptLinesRead = 0;
-        } else if (transcriptLinesRead > 0 && lastReadEntryUUID) {
-            try {
-                const checkEntry = JSON.parse(lines[transcriptLinesRead - 1]);
-                if (checkEntry.uuid && checkEntry.uuid !== lastReadEntryUUID) {
-                    log(`tailTranscript: FILE REPLACED — UUID mismatch at position ${transcriptLinesRead - 1} (expected ${lastReadEntryUUID}, got ${checkEntry.uuid}), resetting to 0`);
-                    transcriptLinesRead = 0;
-                }
-            } catch { /* parse error during write — skip validation this poll */ }
-        }
+const candidateTranscriptPath = computeCandidateTranscriptPath();
+
+// Tailer + detector construction. `boundaryUnusableNotified` mirrors the
+// tailer's one-shot invariant on the wrapper side so
+// `detector.noteBoundaryUnusable(cause)` fires exactly once per transition
+// with the cause matched to the transition venue. The detector's
+// defensive `cause=unknown` fallback (Task 5 wire-format contract) is
+// unreachable on this wired-up path.
+const tailer = createTranscriptTailer({ log });
+let boundaryUnusableNotified = false;
+const notifyBoundaryUnusable = (cause) => {
+    if (boundaryUnusableNotified) return;
+    boundaryUnusableNotified = true;
+    detector.noteBoundaryUnusable(cause);
+};
 
-        const pending = fileLineCount - transcriptLinesRead;
-        if (pending > 0) {
-            log(`tailTranscript: ${pending} new lines (fileLines=${fileLineCount}, read=${transcriptLinesRead})`);
+const detector = createPromptRejectionDetector({
+    log,
+    getEmissionState: () =>
+        resultEmitted ? 'result'
+        : failureEmitted ? 'failure'
+        : 'clear',
+    setEmissionState: (flag) => {
+        if (flag === 'failure') {
+            failureEmitted = true;
+            promptRejectionEmitted = true;
+        } else if (flag === 'result') {
+            resultEmitted = true;
         }
+    },
+    tailer,
+});
 
-        const typeCounts = {};
-        let skipped = 0;
-        for (let i = transcriptLinesRead; i < lines.length; i++) {
-            try {
-                const entry = JSON.parse(lines[i]);
-                if (entry.type === 'progress' && entry.data?.type === 'hook_progress') {
-                    skipped++;
-                    continue;
-                }
-                if (entry.uuid && processedEntryUUIDs.has(entry.uuid)) {
-                    skipped++;
-                    continue;
-                }
-                process.stdout.write(JSON.stringify({ type: 'transcript', entry }) + '\n');
-                if (entry.uuid) processedEntryUUIDs.add(entry.uuid);
-                newLines++;
-                const key = entry.type || 'unknown';
-                typeCounts[key] = (typeCounts[key] || 0) + 1;
-            } catch {
-                skipped++;
-            }
-        }
-        transcriptLinesRead = lines.length;
-        if (lines.length > 0) {
-            try {
-                const lastEntry = JSON.parse(lines[lines.length - 1]);
-                if (lastEntry.uuid) lastReadEntryUUID = lastEntry.uuid;
-            } catch { /* ignore */ }
+// Pre-spawn boundary establishment.
+if (resumeId) {
+    // Case B (--resume): with a readable transcript file at the cwd-hash
+    // candidate, snapshot (dev, ino) + cursor=size + pre-baseline walk.
+    // Unresolvable path → defer to D14 (tailer stays uninitialised;
+    // `tick()` short-circuits on `!boundaryEstablished`).
+    if (existsSync(candidateTranscriptPath)) {
+        tailer.initialiseBoundary(candidateTranscriptPath, { resume: true });
+        if (tailer.unusable) {
+            // Case B's only fail-closed cause is a read error.
+            notifyBoundaryUnusable('readError');
+        } else {
+            transcriptPath = candidateTranscriptPath;
+            transcriptPathMemoised = true;
+            log(`Resume: initialised boundary against ${candidateTranscriptPath}`);
         }
+    } else {
+        log(`Resume: transcript not yet resolvable via cwd-hash (candidate=${candidateTranscriptPath}); deferring to D14 hook-path adoption`);
+    }
+} else {
+    // Case A (fresh session, no --resume): cursor=0, empty preBaselineUUIDs.
+    // initialiseBoundary with resume:false does no I/O and cannot flip
+    // `unusable`. Path may not exist yet; `tick()` returns [] on ENOENT.
+    tailer.initialiseBoundary(candidateTranscriptPath, { resume: false });
+}
 
-        if (newLines > 0 || skipped > 0) {
-            const types = Object.entries(typeCounts).map(([k, v]) => `${k}=${v}`).join(', ');
-            log(`tailTranscript: forwarded=${newLines}, skipped=${skipped}${types ? `, types: ${types}` : ''}`);
+// Poll-callback helper. Called from the 1s interval AND from the SIGUSR1
+// handler (Stop-hook fired) AND from onExit (final drain). Every entry
+// the tailer forwards from `tick()` reaches `detector.consider(entry)`
+// exactly once, in file order, and is also written to stdout as the
+// `{"type":"transcript",entry:…}` line JobRunner's stream handler consumes.
+// Preserves the load-bearing `Transcript found (attempt N):` log line
+// (asserted by the `pty-wrapper D14 memoised-branch preserves today`
+// integration test) the first time the tailer's file resolves on disk.
+const drainTailerAndForward = () => {
+    if (DISABLE_TRANSCRIPT_TAIL) return;
+    if (!tailer.boundaryEstablished) {
+        // --resume + unresolvable pre-spawn path — waiting for D14 adoption.
+        return;
+    }
+    if (!transcriptPathMemoised) {
+        transcriptPathResolutionAttempts++;
+        if (tailer.path && existsSync(tailer.path)) {
+            transcriptPath = tailer.path;
+            transcriptPathMemoised = true;
+            log(`Transcript found (attempt ${transcriptPathResolutionAttempts}): ${transcriptPath}`);
+        } else if (transcriptPathResolutionAttempts === 1 || transcriptPathResolutionAttempts % 10 === 0) {
+            log(`Transcript not found (attempt ${transcriptPathResolutionAttempts}), cwd=${process.cwd()}, session=${effectiveSessionId}`);
         }
+    }
+    const preUnusable = tailer.unusable;
+    let entries = [];
+    try {
+        entries = tailer.tick();
     } catch (err) {
-        log(`tailTranscript: read error: ${err.message}`);
+        log(`tailer.tick() threw: ${err && err.message ? err.message : String(err)}`);
+        return;
+    }
+    if (tailer.unusable && !preUnusable) {
+        // Only reopenAndRewalkBoundary can flip `unusable` inside tick().
+        notifyBoundaryUnusable('reopenFailed');
+    }
+    for (const entry of entries) {
+        try {
+            process.stdout.write(JSON.stringify({ type: 'transcript', entry }) + '\n');
+        } catch (err) {
+            if (err && err.code !== 'EPIPE') throw err;
+        }
+        detector.consider(entry);
+        if (promptRejectionEmitted) {
+            // Detector wrote the `{"type":"error","error":"prompt_too_long",...}`
+            // line synchronously inside consider(). SIGTERM the pty so its
+            // exit unwinds the wrapper's onExit path (which re-drains and
+            // then no-ops emitResult under the emission guard).
+            log(`prompt-rejection: matched — SIGTERM to pty (pid=${ptyProcess?.pid})`);
+            if (ptyProcess) {
+                try { ptyProcess.kill('SIGTERM'); } catch { /* pty already gone */ }
+            }
+            break;
+        }
     }
-    return newLines;
 };
 
 // --- Sentinel / result emission ---
 // Called from onExit after polling stops. The Stop-hook sentinel is read once
 // at the onExit seam (hoisted out of this delegator) so the parsed payload
-// drives both the D14 hook-path adoption guard AND this emission. On the
-// null-hookData path (ENOENT / JSON-parse failure): resultEmitted /
-// failureEmitted stay false and the prompt-too-long branch below fires as
-// today.
-
-let resultEmitted = false;
-let failureEmitted = false;
+// drives both the D14 hook-path adoption guard AND this emission. Null-
+// hookData path: the delegator no-ops, `resultEmitted` / `failureEmitted`
+// stay false unless the detector fired first, and `branchTaken` records
+// `no-emission` (or `prompt-rejection` if the detector fired) for the onExit
+// diagnostic line.
+//
+// The `if (resultEmitted || failureEmitted) return;` guard below is
+// load-bearing for the detector's live-accessor contract: it lets a
+// detector-initiated `failureEmitted=true` short-circuit any subsequent
+// Stop-hook `emitResult` so the wire carries exactly one emission.
 
 const emitResult = (hookData) => {
     if (resultEmitted || failureEmitted) return;
@@ -863,7 +715,7 @@ const stopPolling = () => {
 };
 
 transcriptPollInterval = setInterval(() => {
-    tailTranscript();
+    drainTailerAndForward();
 }, 1000);
 
 // --- Signal forwarding ---
@@ -889,11 +741,6 @@ ptyProcess.onExit(({ exitCode }) => {
 
     // Clear watchdog and stop polling (sentinelPath still exists on disk at this point)
     if (watchdogTimer) { clearTimeout(watchdogTimer); watchdogTimer = null; }
-    // As1063 Task 3: cancel any pending streaming-prompt-too-long debounce
-    // timer — the child has exited, so either the streaming detection already
-    // fired (failureEmitted is true and its guard would no-op) or a normal
-    // exit path is running (do not want a late stale emission).
-    if (promptTooLongTimer) { clearTimeout(promptTooLongTimer); promptTooLongTimer = null; }
     stopPolling();
 
     // Hoisted Stop-hook sentinel read at the onExit → pre-emitResult seam.
@@ -901,8 +748,9 @@ ptyProcess.onExit(({ exitCode }) => {
     // the D14 hook-path adoption guard below and the emitResult() delegator —
     // the extracted pty-emit-result.mjs no longer re-reads the sentinel from
     // disk. Null-hookData path: D14 guard is a no-op (`hookData?.transcript_path`
-    // short-circuits); emitResult() no-ops on the null input; prompt-too-long
-    // branch below fires as today (resultEmitted/failureEmitted stay false).
+    // short-circuits), emitResult() no-ops on the null input, and the onExit
+    // diagnostic below records `no-emission` (or `prompt-rejection` if the
+    // detector fired before onExit).
     const hookData = readSentinelPayload(sentinelPath);
 
     // D14 (guarded hook-path adoption): when the 1s polling loop never
@@ -912,57 +760,84 @@ ptyProcess.onExit(({ exitCode }) => {
     // Stop hook's `hookData.transcript_path` for the final tail. Gated on
     // `!transcriptPath` so every turn the hash convention worked for keeps
     // its pre-D14 behaviour byte-for-byte.
-    if (hookData?.transcript_path && !transcriptPath) {
-        const adopted = resolveTranscriptPath(hookData.transcript_path);
-        if (adopted) {
+    //
+    // Cursor rule keyed off `resumeId` (semantic mirror of today's retired
+    // resume-baseline snapshot guard `if (!resumeId) return;`): a fresh
+    // session adopts with cursor=0 so AC-1 / AC-2 entries still forward;
+    // --resume adopts with cursor=size so 0 entries forward. Expressed via
+    // a fresh `TranscriptTailer` instance because Task 4's
+    // `initialiseBoundary` guard is one-way — the primary tailer's
+    // `boundaryEstablished` flag has already latched.
+    if (!DISABLE_TRANSCRIPT_TAIL && hookData?.transcript_path && !transcriptPath) {
+        const adopted = hookData.transcript_path;
+        if (existsSync(adopted)) {
+            transcriptPath = adopted;
             log(`Final tail using hook-supplied transcript_path (hash resolution produced nothing, hook-supplied=${adopted})`);
+            const d14Tailer = createTranscriptTailer({ log });
+            d14Tailer.initialiseBoundary(adopted, { resume: !!resumeId });
+            if (d14Tailer.unusable) {
+                notifyBoundaryUnusable('readError');
+            } else {
+                let d14Entries = [];
+                try {
+                    d14Entries = d14Tailer.tick();
+                } catch (err) {
+                    log(`D14 tailer.tick() threw: ${err && err.message ? err.message : String(err)}`);
+                }
+                for (const entry of d14Entries) {
+                    try {
+                        process.stdout.write(JSON.stringify({ type: 'transcript', entry }) + '\n');
+                    } catch (err) {
+                        if (err && err.code !== 'EPIPE') throw err;
+                    }
+                    detector.consider(entry);
+                    if (promptRejectionEmitted) break;
+                }
+            }
+            d14Tailer.close();
         }
     }
 
-    // Do a final transcript tail to capture any last entries
-    tailTranscript();
+    // Final tick on the primary tailer captures anything the 1s poll's last
+    // interval missed. drainTailerAndForward() feeds every forwarded entry
+    // into detector.consider() before emitResult() runs (item 9).
+    drainTailerAndForward();
+
+    // Refusal emission when we truly never had a transcript to consider.
+    // The wrapper is the sole site that owns the `transcript-unresolved`
+    // refusal — the detector never observes `transcriptPath` itself
+    // (item 10).
+    if (transcriptPath === null) {
+        detector.noteTranscriptUnresolved();
+    }
 
     // Emit result or error from the pre-parsed sentinel payload (tempDir still
-    // present — deleted below)
+    // present — deleted below). If the detector fired before onExit
+    // (`failureEmitted=true`), the guard at the top of emitResult short-
+    // circuits so the wire carries exactly one emission.
     emitResult(hookData);
 
-    // Prompt-too-long detection: no sentinel written, ttyBuffer has the error text.
-    // teardown() never ran on this path (Stop hook did not fire), so `endedAt` is
-    // unset and `durationMs` is deliberately omitted from the emission — the
-    // service appends the pre-existing `'0'` duration sentinel (Decision D3).
-    // As1063 Task 1 item 9: track whether this branch was the one that set
-    // failureEmitted so the onExit-branch diagnostic below can distinguish
-    // `matched-prompt-too-long` from `emitted-failure` (both set the flag).
-    let matchedPromptTooLong = false;
-    if (!resultEmitted && !failureEmitted && ttyBuffer.includes('Prompt is too long')) {
-        log('Prompt-too-long: omitting durationMs (teardown() never ran, endedAt unset)');
-        process.stdout.write(JSON.stringify({
-            type: 'error',
-            error: 'prompt_too_long',
-            message: 'Prompt is too long'
-        }) + '\n');
-        failureEmitted = true;
-        matchedPromptTooLong = true;
-    }
-
     // Clean up temp directory
     try { rmSync(tempDir, { recursive: true, force: true }); } catch {}
 
-    // As1063 Task 1 item 9: emit which onExit branch was taken along with
-    // the wrapper exit reason (teardownReason) and a bounded ttyBuffer tail.
-    // Bounded per lifecycle event by the `exited` guard at the top of onExit
-    // (no unbounded per-turn accumulation). Written to stderr via log() so
-    // JobRunner's stderr splitter captures it into the outputTail without
-    // affecting the wrapper's stdout emission contract.
-    const branchTaken = resultEmitted
-        ? 'emitted-result'
-        : streamingPromptTooLongEmitted
-            ? 'streaming-prompt-too-long'
-            : matchedPromptTooLong
-                ? 'matched-prompt-too-long'
-                : failureEmitted
-                    ? 'emitted-failure'
-                    : 'no-emission';
+    // As1063 Task 1 item 9 / As1080 Task 6 item 17: closed diagnostic-label
+    // set is exactly `emitted-result`, `emitted-failure`, `prompt-rejection`,
+    // `no-emission`. `prompt-rejection` is the detector-initiated failure
+    // branch (`promptRejectionEmitted=true`, which implies
+    // `failureEmitted=true`). `emitted-failure` is the Stop-hook StopFailure
+    // branch. `emitted-result` is the clean-Stop success branch.
+    // `no-emission` is the terminal fall-through. Bounded per lifecycle event
+    // by the `exited` guard at the top of onExit (no unbounded per-turn
+    // accumulation). Written to stderr via log() so JobRunner's stderr
+    // splitter captures it into the outputTail without affecting the
+    // wrapper's stdout emission contract.
+    const branchTaken = promptRejectionEmitted
+        ? 'prompt-rejection'
+        : resultEmitted
+            ? 'emitted-result'
+            : failureEmitted
+                ? 'emitted-failure'
+                : 'no-emission';
     // Cap the tty tail to 256 chars and escape newlines so the line stays on
     // one log entry regardless of what claude last wrote.
     const ttyTail = ttyBuffer.slice(-256).replace(/\n/g, '\\n').replace(/\r/g, '\\r');