@kelceyp/caw-server 1.0.290 → 1.1.0

package/dist/pty-wrapper.mjs

@@ -1,875 +0,0 @@
-#!/usr/bin/env node
-/**
- * PTY Wrapper — spawns interactive claude via node-pty, streams transcript, emits result.
- *
- * Spawned by JobRunner as a normal child process. Internally uses node-pty to run
- * interactive `claude` (no -p flag), uses a Stop hook for completion detection via
- * a sentinel file, and tails Claude's transcript JSONL for live streaming.
- *
- * Args:
- *   --session-id <uuid>   Session ID (first run)
- *   --resume <uuid>       Resume session (continuation)
- *   --model <model>       Model override
- *   --effort <level>      Effort level override
- *   --skip-permissions    Enable --dangerously-skip-permissions
- *
- * Stdin:  The prompt text (piped by JobRunner before spawn)
- * Stdout: JSONL: {type:"transcript",entry:{...}} per line, then {type:"result",...}
- * Exit:   0 on success (or SIGINT with valid sentinel), non-zero on failure
- */
-
-import * as pty from 'node-pty';
-import { mkdtempSync, readFileSync, existsSync, writeFileSync, rmSync, realpathSync } from 'fs';
-import { join } from 'path';
-import { tmpdir, homedir } from 'os';
-import { execSync } from 'child_process';
-import { readSentinelPayload, hasPendingWork } from './pty-deferred-teardown.mjs';
-import { emitResult as emitResultLine } from './pty-emit-result.mjs';
-import { TEARDOWN_REASONS } from './teardownReasons.mjs';
-import { ensureNonInteractiveSetup } from './pty-non-interactive-setup.mjs';
-import { CLAUDE_CONFIG_DIR_REFUSED_PREFIX } from './claude-config-dir-guard.mjs';
-import { createTranscriptTailer } from './transcript-tailer.mjs';
-import { createPromptRejectionDetector } from './prompt-rejection-detector.mjs';
-
-// --- Arg parsing ---
-
-const args = process.argv.slice(2);
-const getArg = (name) => {
-    const idx = args.indexOf(name);
-    return idx !== -1 && idx + 1 < args.length ? args[idx + 1] : null;
-};
-const hasFlag = (name) => args.includes(name);
-
-const sessionId = getArg('--session-id');
-const resumeId = getArg('--resume');
-const model = getArg('--model');
-const effortLevel = getArg('--effort');
-const skipPermissions = hasFlag('--skip-permissions');
-
-if (!sessionId && !resumeId) {
-    process.stderr.write('Error: Either --session-id or --resume must be provided\n');
-    process.exit(1);
-}
-
-const effectiveSessionId = sessionId || resumeId;
-
-// --- Logging (stderr only — stdout is reserved for streaming output) ---
-
-const log = (msg) => process.stderr.write(`[pty-wrapper] ${msg}\n`);
-
-// --- Read prompt from stdin ---
-
-const promptChunks = [];
-for await (const chunk of process.stdin) {
-    promptChunks.push(chunk);
-}
-const prompt = Buffer.concat(promptChunks).toString('utf-8').trim();
-
-if (!prompt) {
-    process.stderr.write('Error: No prompt provided on stdin\n');
-    process.exit(1);
-}
-
-// --- Resolve claude binary ---
-
-let claudePath;
-try {
-    claudePath = execSync('which claude', { encoding: 'utf-8' }).trim();
-    if (!claudePath) throw new Error('empty result');
-} catch {
-    process.stderr.write('Error: claude binary not found in PATH\n');
-    process.exit(1);
-}
-
-// --- Pre-seed ~/.claude.json to avoid interactive dialogs ---
-// The function is defined in the sibling module
-// `./pty-non-interactive-setup.mjs` (statically imported above). Post-As1050
-// Commit B the direct-mode CAW server calls that function ONCE, before
-// spawning this wrapper, under a module-level mutex singleton in
-// `JobRunner.runDirectJob` (see `claude-session.js#prepareDirectHost`), and
-// signals suppression here via the `--skip-non-interactive-setup` CLI arg
-// emitted by `buildDirectCommand`. The Docker path does NOT emit that flag
-// (`claude-session.js#getDockerConfig`'s `commandParts` omits it by
-// design), so the in-container wrapper still runs the setup itself. This
-// wrapper's local call site preserves the same discriminating catch that
-// re-emits classified errors byte-for-byte with today's stderr + exit
-// contract and rethrows every other error. Two prefixes are classified:
-// `CLAUDE_JSON_UNREADABLE` (As1016) and `CLAUDE_CONFIG_DIR_REFUSED` (As1065,
-// the guard's refusal of the container's own `CLAUDE_CONFIG_DIR`). See As1016
-// for the fail-fast / atomic / idempotent invariants that module preserves.
-//
-// The invocation stays here (post log()/stdin-drain/claude-binary,
-// immediately before mkdtempSync) so a Docker-mode `process.exit(1)` on a
-// classified fail-fast cannot EPIPE the parent's stdin.write. The
-// direct-mode early-exit exposure the D16 ordering constraint was
-// originally motivated by is closed by two independent halves: As1050
-// Commit B moves the direct-mode call out of the wrapper entirely (the
-// `--skip-non-interactive-setup` gate below), and As1048 landed a
-// `stdin.on('error')` handler immediately before `stdin.write(promptToSend)`
-// inside `JobRunner.js#writePromptToChildStdin` (see `JobRunner.js:130`
-// registering the listener and `:141` performing the write) so any residual
-// Docker EPIPE surfaces as a caught error rather than an uncaught. The
-// Docker path retains the six exit sites, so this comment's ordering
-// constraint stands for Docker.
-//
-// Matched by shared/jobErrorPrefixes.js's `CLAUDE_JSON_UNREADABLE_PREFIX`
-// export AND by the extracted module's own inline copy at
-// `pty-non-interactive-setup.mjs`. Task 2 (Commit A) created the third
-// co-located literal (shared / wrapper / extracted); the extracted module
-// carries its own copy because `shared/` is not published from
-// `server/dist/`, and the wrapper keeps this local const so the
-// discriminating catch below can classify without importing the sibling's
-// export. Keep all three literals in sync per As1016 D8.
-//
-// The second classified prefix, `CLAUDE_CONFIG_DIR_REFUSED_PREFIX`, is NOT
-// carried as a literal here: it is imported above from
-// `./claude-config-dir-guard.mjs`, which is already in this wrapper's
-// closure via `pty-non-interactive-setup.mjs`. It has exactly two literals
-// (`shared/jobErrorPrefixes.js` and the guard; As1065 KD4).
-const CLAUDE_JSON_UNREADABLE_PREFIX = 'CLAUDE_JSON_UNREADABLE';
-
-// As1050 Commit B (C3) — the `--skip-non-interactive-setup` CLI arg is
-// emitted by `claude-session.js#buildDirectCommand` only for direct-mode
-// spawns; `getDockerConfig`'s `commandParts` omits it. `hasFlag` (not
-// `getArg`) is the correct helper: `getArg` is value-extracting and would
-// fail *open* on a valueless flag. Sibling idiom: `hasFlag('--skip-permissions')`.
-if (!hasFlag('--skip-non-interactive-setup')) {
-    try {
-        // As1050 AC 19 — forward `CLAUDE_CONFIG_DIR` from the wrapper's env so
-        // the in-container Docker path (which still runs this local call —
-        // `getDockerConfig`'s `commandParts` omits `--skip-non-interactive-setup`)
-        // routes the seed to the same file the container-side `claude`
-        // reads. Absent variable → falls back to `homedir()` inside the
-        // sibling module, matching pre-AC-19 behaviour.
-        ensureNonInteractiveSetup(process.cwd(), {
-            home: homedir(),
-            configDir: process.env.CLAUDE_CONFIG_DIR,
-            log
-        });
-    } catch (err) {
-        // Discriminating catch: only throws with one of the two classified
-        // prefixes are re-emitted to stderr as a fail-fast (matching today's
-        // process.stderr.write + process.exit(1) contract byte-for-byte; the
-        // extracted module's `.message` omits the trailing `\n` that the wrapper
-        // concatenates here):
-        //   - `CLAUDE_JSON_UNREADABLE` — the As1016 file-level and `HOME_UNSET`
-        //     fail-fast branches;
-        //   - `CLAUDE_CONFIG_DIR_REFUSED` — the As1065 guard refusing the
-        //     container's own `CLAUDE_CONFIG_DIR` (`ensureNonInteractiveSetup`
-        //     delegates its config-dir check to `assertClaudeConfigDirForwardable`).
-        // All other errors are RETHROWN — the wrapper does NOT swallow them, so
-        // today's uncaught-exception behaviour on unclassified failures is
-        // preserved.
-        if (err && typeof err.message === 'string' && (err.message.startsWith(CLAUDE_JSON_UNREADABLE_PREFIX) || err.message.startsWith(CLAUDE_CONFIG_DIR_REFUSED_PREFIX))) {
-            process.stderr.write(err.message + '\n');
-            process.exit(1);
-        }
-        throw err;
-    }
-}
-
-// --- Temp directory for settings, hook script, and sentinel file ---
-
-const tempDir = mkdtempSync(join(tmpdir(), 'caw-pty-'));
-const sentinelPath = join(tempDir, 'result.json');
-const hookScriptPath = join(tempDir, 'stop-hook.sh');
-const settingsPath = join(tempDir, 'settings.json');
-const claudePidPath = join(tempDir, 'claude.pid');
-const wrapperPidPath = join(tempDir, 'wrapper.pid');
-
-// --- Write Stop hook script ---
-// The hook: (1) cats Stop hook JSON (on stdin) to sentinel file, then
-// (2) sends SIGUSR1 to the wrapper PID so it can check whether teardown is safe.
-
-const hookScript = [
-    '#!/bin/bash',
-    `cat > '${sentinelPath}'`,
-    `kill -USR1 $(cat '${wrapperPidPath}') 2>/dev/null`,
-    ''
-].join('\n');
-writeFileSync(hookScriptPath, hookScript, { mode: 0o755 });
-
-// --- Write settings file with Stop hook config ---
-
-const hookEntry = {
-    matcher: '',
-    hooks: [{ type: 'command', command: hookScriptPath }]
-};
-
-const settings = {
-    hooks: {
-        Stop: [hookEntry],
-        StopFailure: [hookEntry]
-    }
-};
-writeFileSync(settingsPath, JSON.stringify(settings));
-
-// --- Deferred teardown state ---
-
-// 90 minutes — covers full ScheduleWakeup range (up to 3600s) with 30m headroom.
-// The env override (`CAW_PTY_WATCHDOG_TIMEOUT_MS`) exists only so integration
-// tests can exercise the watchdog force-kill path without waiting the full 90m.
-const WATCHDOG_TIMEOUT_MS = Number.parseInt(process.env.CAW_PTY_WATCHDOG_TIMEOUT_MS, 10) || (90 * 60 * 1000);
-
-// D11 test-only env overrides (default off). Precedent: CAW_PTY_WATCHDOG_TIMEOUT_MS above.
-// CAW_PTY_DISABLE_TRANSCRIPT_TAIL: skip all TranscriptTailer drains (the 1s
-//   polling loop, the SIGUSR1 handler, and the final onExit tick), so
-//   wrapper stdout carries no `transcript` lines and PromptRejectionDetector
-//   never sees an entry via `consider()`. Used to prove downstream (Task 5)
-//   fallback consumes `result` instead of the missing transcript stream.
-// CAW_PTY_SUPPRESS_STOP_FALLBACK: blank the emitted `result` field on the
-//   success branch of pty-emit-result (only when hookData is non-null and
-//   the success branch runs). The line declares the override as
-//   `stopFallback: 'suppressed'` (As1072), so it is not mistaken for a real
-//   empty-message turn; the error branch is never affected. Used to prove the
-//   AC-5 gate downstream: `result` is still `''`, so with
-//   CAW_PTY_DISABLE_TRANSCRIPT_TAIL the turn still reaches the loud empty-turn
-//   failure.
-const DISABLE_TRANSCRIPT_TAIL = process.env.CAW_PTY_DISABLE_TRANSCRIPT_TAIL === '1';
-const SUPPRESS_STOP_FALLBACK = process.env.CAW_PTY_SUPPRESS_STOP_FALLBACK === '1';
-
-let watchdogTimer = null;
-let teardownInitiated = false;
-// Captured at the top of teardown() on both paths (clean-Stop passes 'stop',
-// watchdog callback passes 'watchdog'). Read by emitResult() on the success
-// branch and written to metadata.teardownReason so the downstream
-// stream-handler and classifier (Task 7) can distinguish the two paths.
-let teardownReason = null;
-
-// Duration capture: wall clock from `pty.spawn` to top of `teardown()`.
-// `endedAt` is set by whichever teardown path fires first (normal SIGUSR1
-// completion or watchdog force-kill — both routed through `teardown()`,
-// per design Decision D1). If the child exits before `teardown()` runs,
-// `endedAt` remains null and no `durationMs` is emitted (per Decision D3 —
-// service appends the pre-existing `'0'` duration sentinel).
-let startedAt = null;
-let endedAt = null;
-
-// Module-scope armed timestamp for the watchdog observability channel (As1012
-// Task 7). Written by `startOrResetWatchdog` on every call (initial arm and
-// each subsequent reset) and read by both `teardown()` and the setTimeout
-// expiry closure so `elapsedSinceArmMs` can be computed after the timer has
-// released. On a `reset` call the elapsed value is captured BEFORE `armedAt`
-// is overwritten so the emitted event carries the duration of the *previous*
-// armed interval (see item 4's ordering invariant).
-let armedAt = null;
-
-// Module-scope snapshot of the sentinel counts observed at the most recent
-// deferral, for the `WATCHDOG` observability channel (As1012 Task 13). Written
-// in the SIGUSR1 handler's defer branch BEFORE `startOrResetWatchdog()` so the
-// counts are in place if the watchdog subsequently fires; read from
-// `teardown()` when `reason === TEARDOWN_REASONS.WATCHDOG`. Lifted for the
-// same reason as `armedAt`: the SIGUSR1 handler's `bgCount` / `cronCount`
-// locals are block-scoped and out of scope inside the `setTimeout` closure
-// that eventually calls `teardown(TEARDOWN_REASONS.WATCHDOG)`. Overwritten on
-// every deferral, so it always holds the LAST deferral's counts — that is the
-// documented last-seen-snapshot semantic (design.md §Data on the wire).
-//
-// As1062 Task 9 extends the binding with a third property, `types` — a
-// `Map<label,count>` histogram derived from the SAME `background_tasks` array
-// the count was computed from. Normalisation collapses whitespace in friendly
-// labels (`"MCP task"` → `MCP_task`) so the emitted `pendingBgTypes` token
-// stays a single greppable word per label. Missing/empty types become
-// `unknown`. Layered onto the same object rather than a parallel binding so
-// the LAST-deferral-wins semantic covers types too.
-let lastDeferredCounts = null;
-
-// As1062 Task 9 — renders `lastDeferredCounts.types` (a `Map<label,count>`)
-// into the single-token form emitted as `pendingBgTypes` on the WATCHDOG
-// teardown line: sorted alphabetically by label for deterministic output,
-// comma-joined `label:count` pairs, whitespace-free by construction. Returns
-// the literal `'none'` on an empty histogram (crons-only deferral) so the
-// rendered line reads `pendingBgTypes=none` — distinct from the splitter's
-// `-` sentinel that flags non-watchdog reasons. Never returns `''` — the
-// wrapper-side empty-string guard the design calls for.
-const renderPendingBgTypes = (types) => {
-    if (!types || types.size === 0) return 'none';
-    const rendered = [...types.entries()]
-        .sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0))
-        .map(([label, count]) => `${label}:${count}`)
-        .join(',');
-    return rendered || 'none';
-};
-
-// Forward declarations (assigned after ptyProcess is created)
-let ptyProcess = null;
-
-// --- Tagged event channel (As1012 Task 7) ---
-// Structured lifecycle events on stderr: `[caw:pty:event] <json>\n`. Consumed
-// downstream by JobRunner's `createStderrSplitter` (Task 6), which routes
-// matching lines through the operational tier (`caw:ops:pty:info`). Prose
-// stderr (every `log()` line above) is untouched — the splitter forwards
-// non-tagged bytes byte-identically to today's `stderrChunks` collector.
-// EPIPE is swallowed so a closed downstream pipe cannot crash the wrapper
-// (stderr is diagnostic; the tagged channel is best-effort).
-const EVENT_TAG = '[caw:pty:event] ';
-const emitEvent = (type, fields = {}) => {
-    const payload = {
-        type,
-        wrapperPid: process.pid,
-        claudePid: ptyProcess?.pid,
-        agentSessionId: effectiveSessionId,
-        ...fields
-    };
-    try {
-        process.stderr.write(`${EVENT_TAG}${JSON.stringify(payload)}\n`);
-    } catch (err) {
-        if (err && err.code !== 'EPIPE') throw err;
-    }
-};
-
-const startOrResetWatchdog = () => {
-    const wasArmed = watchdogTimer !== null;
-    if (wasArmed) clearTimeout(watchdogTimer);
-    log(`Watchdog ${wasArmed ? 'reset' : 'armed'}: ${WATCHDOG_TIMEOUT_MS / 60000}m timeout`);
-    // Ordering invariant (item 4): capture elapsedSinceArmMs BEFORE `armedAt`
-    // is overwritten so the `reset` event carries the duration of the previous
-    // armed interval. `armed` (first call) carries no elapsed value.
-    if (wasArmed) {
-        emitEvent('reset', { elapsedSinceArmMs: Date.now() - armedAt });
-    } else {
-        emitEvent('armed');
-    }
-    armedAt = Date.now();
-    watchdogTimer = setTimeout(() => {
-        log(`Watchdog expired: ${WATCHDOG_TIMEOUT_MS / 60000}m elapsed since last deferred Stop, force-killing claude`);
-        emitEvent('expired', { elapsedSinceArmMs: Date.now() - armedAt });
-        teardown(TEARDOWN_REASONS.WATCHDOG);
-    }, WATCHDOG_TIMEOUT_MS);
-};
-
-const teardown = (reason = TEARDOWN_REASONS.STOP) => {
-    if (teardownInitiated) return;
-    teardownInitiated = true;
-    endedAt = Date.now();
-    teardownReason = reason;
-    log(`Teardown (reason=${reason}): killing claude`);
-    log(`Duration: ${startedAt !== null ? (endedAt - startedAt) : 'unknown'} ms (startedAt=${startedAt}, endedAt=${endedAt})`);
-    // As1012 Task 13 — `pendingBgCount` / `pendingCronCount` ride only on the
-    // `reason=watchdog` teardown, using the same conditional-spread idiom as
-    // `elapsedSinceArmMs`. No null-guard is needed: `startOrResetWatchdog()`
-    // has exactly one call site (the defer branch below), and that branch
-    // always writes `lastDeferredCounts` BEFORE arming the timer — so a
-    // `reason=watchdog` teardown is only reachable after at least one
-    // deferral, and at least one of the two counts is guaranteed ≥ 1.
-    emitEvent('teardown', {
-        reason,
-        ...(armedAt !== null ? { elapsedSinceArmMs: Date.now() - armedAt } : {}),
-        ...(reason === TEARDOWN_REASONS.WATCHDOG && lastDeferredCounts !== null
-            ? {
-                pendingBgCount: lastDeferredCounts.bgCount,
-                pendingCronCount: lastDeferredCounts.cronCount,
-                pendingBgTypes: renderPendingBgTypes(lastDeferredCounts.types)
-            }
-            : {})
-    });
-    if (watchdogTimer) { clearTimeout(watchdogTimer); watchdogTimer = null; }
-    stopPolling();
-    if (ptyProcess) ptyProcess.kill('SIGINT');
-};
-
-// --- Register SIGUSR1 handler and write wrapper PID ---
-// Must happen BEFORE spawning claude so the handler is ready when the first Stop fires.
-
-process.on('SIGUSR1', () => {
-    log('Received SIGUSR1 (stop signal)');
-    drainTailerAndForward();
-    const payload = readSentinelPayload(sentinelPath);
-    if (!payload) {
-        log(`Warning: failed to read sentinel, proceeding with teardown`);
-        teardown(TEARDOWN_REASONS.SENTINEL_UNREADABLE);
-        return;
-    }
-    if (payload.error) {
-        log(`StopFailure received: error=${payload.error}`);
-        teardown(TEARDOWN_REASONS.STOP_FAILURE);
-        return;
-    }
-    const bgCount = Array.isArray(payload.background_tasks) ? payload.background_tasks.length : 0;
-    const cronCount = Array.isArray(payload.session_crons) ? payload.session_crons.length : 0;
-    log(`Sentinel: background_tasks=${bgCount}, session_crons=${cronCount}`);
-    if (hasPendingWork(payload)) {
-        log('Deferring teardown: pending background work');
-        // As1012 Task 13 — capture BEFORE arming so the counts are already in
-        // place if the timer subsequently fires. Members named to match the
-        // locals above; the lift is a zero-translation copy.
-        //
-        // As1062 Task 9 — extend the same capture with a normalised `type`
-        // histogram of `background_tasks` entries so the WATCHDOG line's
-        // `pendingBgTypes=` token can carry a per-label breakdown. Normalisation
-        // (`String(entry?.type ?? '').trim().replace(/\s+/g, '_') || 'unknown'`)
-        // collapses whitespace in friendly labels (`"MCP task"` → `MCP_task`,
-        // `"auto-mode scan"` → `auto-mode_scan`) so the emitted token stays
-        // greppable as one word per label, and rescues missing/empty types to
-        // `unknown` rather than dropping them silently.
-        const types = new Map();
-        if (Array.isArray(payload.background_tasks)) {
-            for (const entry of payload.background_tasks) {
-                const label = String(entry?.type ?? '').trim().replace(/\s+/g, '_') || 'unknown';
-                types.set(label, (types.get(label) ?? 0) + 1);
-            }
-        }
-        lastDeferredCounts = { bgCount, cronCount, types };
-        startOrResetWatchdog();
-        return;
-    }
-    teardown(TEARDOWN_REASONS.STOP);
-});
-
-writeFileSync(wrapperPidPath, String(process.pid));
-
-// --- Build claude args ---
-
-const claudeArgs = [];
-if (resumeId) {
-    claudeArgs.push('--resume', resumeId);
-} else {
-    claudeArgs.push('--session-id', sessionId);
-}
-if (skipPermissions) {
-    claudeArgs.push('--dangerously-skip-permissions');
-}
-if (model) {
-    claudeArgs.push('--model', model);
-}
-if (effortLevel) {
-    claudeArgs.push('--effort', effortLevel);
-}
-claudeArgs.push('--settings', settingsPath);
-// The prompt is content. `--` bounds option parsing so a leading-dash
-// prompt ("- could you…") is not parsed as a CLI flag. This bound does
-// *not* cover subcommand dispatch, and the exposure is against the
-// trimmed prompt (pty-wrapper.mjs:63 trims before this point) — see
-// technical-debt-register.md for the recorded subcommand-shadowing debt.
-claudeArgs.push('--', prompt);
-
-log(`Session: ${effectiveSessionId}`);
-log(`Prompt length: ${prompt.length} chars`);
-
-// --- Spawn claude via PTY ---
-
-startedAt = Date.now();
-ptyProcess = pty.spawn(claudePath, claudeArgs, {
-    name: 'xterm-256color',
-    cols: 120,
-    rows: 40,
-    cwd: process.cwd(),
-    env: { ...process.env, CLAUBBIT: '1', CLAUDE_CODE_MCP_AUTO_BACKGROUND_MS: '0' }
-});
-
-log(`PID: ${ptyProcess.pid}`);
-writeFileSync(claudePidPath, String(ptyProcess.pid));
-
-// --- Auto-confirm --dangerously-skip-permissions dialog ---
-// Claude shows a "Yes/No" dialog when --dangerously-skip-permissions is used.
-// Detect it in PTY output and send down-arrow (select "Yes") + Enter.
-
-let ttyBuffer = '';
-let permissionConfirmed = false;
-
-// onData responsibilities after As1080 Increment A:
-//
-// (1) Auto-confirm the `--dangerously-skip-permissions` "Yes/No" dialog once
-//     the rendered tty contains both "Yes" and "No". The wrapper sends a
-//     down-arrow to select "Yes" followed by Enter, then latches
-//     `permissionConfirmed` so subsequent chunks do not re-trigger.
-// (2) Keep `ttyBuffer` bounded — trimmed to the last 5000 chars once it
-//     exceeds 10000. `ttyBuffer` itself is retained because the onExit
-//     diagnostic-label branch reads a bounded tail of it for a single log
-//     line at process exit.
-//
-// The onData handler no longer scans `ttyBuffer` for the literal
-// "Prompt is too long" trigger phrase. Rendered tty flattens authorship —
-// echoed job prompt, tool results, rendered CAW documents, agent prose, and
-// genuine API rejections all land in the same stream — so any text-based
-// predicate here fires on things the agent said and kills healthy sessions.
-// Prompt-rejection classification is now driven exclusively by the Stop-hook
-// sentinel's structured error payload consumed in `emitResult` and by
-// `claude-session.js` `classifyExit` Step 2 (`errorInfo.error === 'prompt_too_long'`).
-
-ptyProcess.onData((data) => {
-    ttyBuffer += data;
-    if (!permissionConfirmed && ttyBuffer.includes('Yes') && ttyBuffer.includes('No')) {
-        log('Auto-confirming bypass permissions dialog');
-        ptyProcess.write('\x1b[B'); // down arrow to select "Yes"
-        setTimeout(() => ptyProcess.write('\r'), 200); // Enter
-        permissionConfirmed = true;
-    }
-    // Keep buffer bounded
-    if (ttyBuffer.length > 10000) ttyBuffer = ttyBuffer.slice(-5000);
-});
-
-// --- Transcript tailing (TranscriptTailer + PromptRejectionDetector wiring) ---
-// Task 6 (As1080 Increment B) replaced the inline tail-state block that lived
-// here with a two-module split. `transcript-tailer.mjs` owns cursor / (dev,ino)
-// / preBaselineUUIDs / processedUUIDs bookkeeping and torn-line + file-
-// replacement recovery; `prompt-rejection-detector.mjs` owns the conjunctive-
-// predicate evaluation on `isApiErrorMessage:true` transcript entries and the
-// one-shot `{"type":"error","error":"prompt_too_long", …}` stdout emission
-// that JobRunner.js:363 consumes. The wrapper is now a thin coordinator:
-//   • establishes the tailer boundary pre-spawn (Case A fresh session →
-//     cursor:0 / empty preBaselineUUIDs; Case B `--resume` with a readable
-//     transcript file at the cwd-hash candidate → (dev,ino) + cursor:size
-//     + regex-uuid pre-baseline walk with no size limit);
-//   • forwards each `tick()` entry into `detector.consider(entry)` from the
-//     poll callback (in file order, exactly once);
-//   • notifies the detector at the tailer's `unusable` transition with
-//     `cause ∈ {'readError','reopenFailed'}` — the venue matches the
-//     transition (readError from initialiseBoundary Case B, reopenFailed
-//     from a tick()-time reopenAndRewalkBoundary);
-//   • at onExit, when `transcriptPath === null`, calls
-//     `detector.noteTranscriptUnresolved()` exactly once before
-//     `emitResult(hookData)`.
-//
-// The detector's live-accessor coupling reads `resultEmitted` and
-// `failureEmitted` via closure — NOT snapshots at construction — so a
-// concurrent Stop-hook `emitResult()` that flips the flags mid-`consider()`
-// is caught by the detector's re-check-before-write guard (Task 5 item 10;
-// unit-tested in `prompt-rejection-detector.test.js` case (e)).
-//
-// Path resolution stays a polling-time concern: no pre-spawn retry loop.
-// For fresh sessions where the cwd-hash guess is wrong, the D14 late-
-// adoption path at onExit constructs a fresh tailer against
-// `hookData.transcript_path` (cursor rule keyed off `resumeId`, mirroring
-// today's retired resume-baseline snapshot guard).
-
-let transcriptPath = null;
-let transcriptPathResolutionAttempts = 0;
-let transcriptPathMemoised = false;
-
-// Emission-state flags — declared here so the detector's live accessors
-// can close over them. `promptRejectionEmitted` distinguishes a detector-
-// initiated failure (branchTaken='prompt-rejection') from a Stop-hook
-// StopFailure (branchTaken='emitted-failure'); both paths set
-// `failureEmitted=true` so the exit branch `if (failureEmitted) { process.exit(1); }`
-// stays byte-identical to its pre-task state.
-let resultEmitted = false;
-let failureEmitted = false;
-let promptRejectionEmitted = false;
-
-// Compute the pre-spawn candidate transcript path via the cwd-hash
-// convention. Fresh sessions don't have the file yet at pre-spawn (claude
-// creates it after `pty.spawn`), so we do NOT require existsSync — the
-// tailer's `tick()` safely returns [] on ENOENT.
-const computeCandidateTranscriptPath = () => {
-    const claudeProjectsDir = join(homedir(), '.claude', 'projects');
-    const cwd = process.cwd();
-    const candidates = [cwd];
-    try {
-        const rp = realpathSync(cwd);
-        if (rp !== cwd) candidates.push(rp);
-    } catch { /* ignore */ }
-    // Prefer a candidate that already resolves on disk (relevant for
-    // --resume where the transcript file exists at spawn time). Otherwise
-    // fall back to the first (cwd-hash) candidate; D14 late-adoption at
-    // onExit corrects if this guess was wrong.
-    for (const dir of candidates) {
-        const hash = dir.replace(/[/.]/g, '-');
-        const p = join(claudeProjectsDir, hash, `${effectiveSessionId}.jsonl`);
-        if (existsSync(p)) return p;
-    }
-    const hash = candidates[0].replace(/[/.]/g, '-');
-    return join(claudeProjectsDir, hash, `${effectiveSessionId}.jsonl`);
-};
-
-const candidateTranscriptPath = computeCandidateTranscriptPath();
-
-// Tailer + detector construction. `boundaryUnusableNotified` mirrors the
-// tailer's one-shot invariant on the wrapper side so
-// `detector.noteBoundaryUnusable(cause)` fires exactly once per transition
-// with the cause matched to the transition venue. The detector's
-// defensive `cause=unknown` fallback (Task 5 wire-format contract) is
-// unreachable on this wired-up path.
-const tailer = createTranscriptTailer({ log });
-let boundaryUnusableNotified = false;
-const notifyBoundaryUnusable = (cause) => {
-    if (boundaryUnusableNotified) return;
-    boundaryUnusableNotified = true;
-    detector.noteBoundaryUnusable(cause);
-};
-
-const detector = createPromptRejectionDetector({
-    log,
-    getEmissionState: () =>
-        resultEmitted ? 'result'
-        : failureEmitted ? 'failure'
-        : 'clear',
-    setEmissionState: (flag) => {
-        if (flag === 'failure') {
-            failureEmitted = true;
-            promptRejectionEmitted = true;
-        } else if (flag === 'result') {
-            resultEmitted = true;
-        }
-    },
-    tailer,
-});
-
-// Pre-spawn boundary establishment.
-if (resumeId) {
-    // Case B (--resume): with a readable transcript file at the cwd-hash
-    // candidate, snapshot (dev, ino) + cursor=size + pre-baseline walk.
-    // Unresolvable path → defer to D14 (tailer stays uninitialised;
-    // `tick()` short-circuits on `!boundaryEstablished`).
-    if (existsSync(candidateTranscriptPath)) {
-        tailer.initialiseBoundary(candidateTranscriptPath, { resume: true });
-        if (tailer.unusable) {
-            // Case B's only fail-closed cause is a read error.
-            notifyBoundaryUnusable('readError');
-        } else {
-            transcriptPath = candidateTranscriptPath;
-            transcriptPathMemoised = true;
-            log(`Resume: initialised boundary against ${candidateTranscriptPath}`);
-        }
-    } else {
-        log(`Resume: transcript not yet resolvable via cwd-hash (candidate=${candidateTranscriptPath}); deferring to D14 hook-path adoption`);
-    }
-} else {
-    // Case A (fresh session, no --resume): cursor=0, empty preBaselineUUIDs.
-    // initialiseBoundary with resume:false does no I/O and cannot flip
-    // `unusable`. Path may not exist yet; `tick()` returns [] on ENOENT.
-    tailer.initialiseBoundary(candidateTranscriptPath, { resume: false });
-}
-
-// Poll-callback helper. Called from the 1s interval AND from the SIGUSR1
-// handler (Stop-hook fired) AND from onExit (final drain). Every entry
-// the tailer forwards from `tick()` reaches `detector.consider(entry)`
-// exactly once, in file order, and is also written to stdout as the
-// `{"type":"transcript",entry:…}` line JobRunner's stream handler consumes.
-// Preserves the load-bearing `Transcript found (attempt N):` log line
-// (asserted by the `pty-wrapper D14 memoised-branch preserves today`
-// integration test) the first time the tailer's file resolves on disk.
-const drainTailerAndForward = () => {
-    if (DISABLE_TRANSCRIPT_TAIL) return;
-    if (!tailer.boundaryEstablished) {
-        // --resume + unresolvable pre-spawn path — waiting for D14 adoption.
-        return;
-    }
-    if (!transcriptPathMemoised) {
-        transcriptPathResolutionAttempts++;
-        if (tailer.path && existsSync(tailer.path)) {
-            transcriptPath = tailer.path;
-            transcriptPathMemoised = true;
-            log(`Transcript found (attempt ${transcriptPathResolutionAttempts}): ${transcriptPath}`);
-        } else if (transcriptPathResolutionAttempts === 1 || transcriptPathResolutionAttempts % 10 === 0) {
-            log(`Transcript not found (attempt ${transcriptPathResolutionAttempts}), cwd=${process.cwd()}, session=${effectiveSessionId}`);
-        }
-    }
-    const preUnusable = tailer.unusable;
-    let entries = [];
-    try {
-        entries = tailer.tick();
-    } catch (err) {
-        log(`tailer.tick() threw: ${err && err.message ? err.message : String(err)}`);
-        return;
-    }
-    if (tailer.unusable && !preUnusable) {
-        // Only reopenAndRewalkBoundary can flip `unusable` inside tick().
-        notifyBoundaryUnusable('reopenFailed');
-    }
-    for (const entry of entries) {
-        try {
-            process.stdout.write(JSON.stringify({ type: 'transcript', entry }) + '\n');
-        } catch (err) {
-            if (err && err.code !== 'EPIPE') throw err;
-        }
-        detector.consider(entry);
-        if (promptRejectionEmitted) {
-            // Detector wrote the `{"type":"error","error":"prompt_too_long",...}`
-            // line synchronously inside consider(). SIGTERM the pty so its
-            // exit unwinds the wrapper's onExit path (which re-drains and
-            // then no-ops emitResult under the emission guard).
-            log(`prompt-rejection: matched — SIGTERM to pty (pid=${ptyProcess?.pid})`);
-            if (ptyProcess) {
-                try { ptyProcess.kill('SIGTERM'); } catch { /* pty already gone */ }
-            }
-            break;
-        }
-    }
-};
-
-// --- Sentinel / result emission ---
-// Called from onExit after polling stops. The Stop-hook sentinel is read once
-// at the onExit seam (hoisted out of this delegator) so the parsed payload
-// drives both the D14 hook-path adoption guard AND this emission. Null-
-// hookData path: the delegator no-ops, `resultEmitted` / `failureEmitted`
-// stay false unless the detector fired first, and `branchTaken` records
-// `no-emission` (or `prompt-rejection` if the detector fired) for the onExit
-// diagnostic line.
-//
-// The `if (resultEmitted || failureEmitted) return;` guard below is
-// load-bearing for the detector's live-accessor contract: it lets a
-// detector-initiated `failureEmitted=true` short-circuit any subsequent
-// Stop-hook `emitResult` so the wire carries exactly one emission.
-
-const emitResult = (hookData) => {
-    if (resultEmitted || failureEmitted) return;
-    if (!hookData) return;
-
-    // durationMs: wall clock from pty.spawn to teardown(). Both the normal
-    // SIGUSR1 path and the watchdog force-kill path route through teardown()
-    // (Decision D1), so both report an honest real elapsed time. Only omitted
-    // when startedAt/endedAt are unset — which never happens on the success
-    // branch because teardown() runs before onExit calls emitResult().
-    const { emitted } = emitResultLine({
-        hookData,
-        transcriptPath,
-        effectiveSessionId,
-        startedAt,
-        endedAt,
-        teardownReason,
-        alreadyEmitted: resultEmitted || failureEmitted,
-        suppressFallback: SUPPRESS_STOP_FALLBACK,
-        log
-    });
-    if (emitted === 'result') resultEmitted = true;
-    else if (emitted === 'error') failureEmitted = true;
-};
-
-// --- Transcript poll interval ---
-
-let transcriptPollInterval;
-
-const stopPolling = () => {
-    if (transcriptPollInterval) { clearInterval(transcriptPollInterval); transcriptPollInterval = null; }
-};
-
-transcriptPollInterval = setInterval(() => {
-    drainTailerAndForward();
-}, 1000);
-
-// --- Signal forwarding ---
-// Forward SIGTERM/SIGINT to the claude process inside the PTY.
-// onExit fires when ptyProcess exits, handling cleanup.
-
-process.on('SIGTERM', () => {
-    log('Received SIGTERM, forwarding to claude');
-    ptyProcess.kill('SIGTERM');
-});
-
-process.on('SIGINT', () => {
-    log('Received SIGINT, forwarding to claude');
-    ptyProcess.kill('SIGINT');
-});
-
-// --- Process exit handler ---
-
-let exited = false;
-ptyProcess.onExit(({ exitCode }) => {
-    if (exited) return;
-    exited = true;
-
-    // Clear watchdog and stop polling (sentinelPath still exists on disk at this point)
-    if (watchdogTimer) { clearTimeout(watchdogTimer); watchdogTimer = null; }
-    stopPolling();
-
-    // Hoisted Stop-hook sentinel read at the onExit → pre-emitResult seam.
-    // The parsed payload (or null on ENOENT / JSON-parse failure) drives both
-    // the D14 hook-path adoption guard below and the emitResult() delegator —
-    // the extracted pty-emit-result.mjs no longer re-reads the sentinel from
-    // disk. Null-hookData path: D14 guard is a no-op (`hookData?.transcript_path`
-    // short-circuits), emitResult() no-ops on the null input, and the onExit
-    // diagnostic below records `no-emission` (or `prompt-rejection` if the
-    // detector fired before onExit).
-    const hookData = readSentinelPayload(sentinelPath);
-
-    // D14 (guarded hook-path adoption): when the 1s polling loop never
-    // memoised a `transcriptPath` (cwd-hash convention produced nothing —
-    // e.g., a client that writes elsewhere, an out-of-tree working directory
-    // hashed differently, or a project-scoped transcript root), adopt the
-    // Stop hook's `hookData.transcript_path` for the final tail. Gated on
-    // `!transcriptPath` so every turn the hash convention worked for keeps
-    // its pre-D14 behaviour byte-for-byte.
-    //
-    // Cursor rule keyed off `resumeId` (semantic mirror of today's retired
-    // resume-baseline snapshot guard `if (!resumeId) return;`): a fresh
-    // session adopts with cursor=0 so AC-1 / AC-2 entries still forward;
-    // --resume adopts with cursor=size so 0 entries forward. Expressed via
-    // a fresh `TranscriptTailer` instance because Task 4's
-    // `initialiseBoundary` guard is one-way — the primary tailer's
-    // `boundaryEstablished` flag has already latched.
-    if (!DISABLE_TRANSCRIPT_TAIL && hookData?.transcript_path && !transcriptPath) {
-        const adopted = hookData.transcript_path;
-        if (existsSync(adopted)) {
-            transcriptPath = adopted;
-            log(`Final tail using hook-supplied transcript_path (hash resolution produced nothing, hook-supplied=${adopted})`);
-            const d14Tailer = createTranscriptTailer({ log });
-            d14Tailer.initialiseBoundary(adopted, { resume: !!resumeId });
-            if (d14Tailer.unusable) {
-                notifyBoundaryUnusable('readError');
-            } else {
-                let d14Entries = [];
-                try {
-                    d14Entries = d14Tailer.tick();
-                } catch (err) {
-                    log(`D14 tailer.tick() threw: ${err && err.message ? err.message : String(err)}`);
-                }
-                for (const entry of d14Entries) {
-                    try {
-                        process.stdout.write(JSON.stringify({ type: 'transcript', entry }) + '\n');
-                    } catch (err) {
-                        if (err && err.code !== 'EPIPE') throw err;
-                    }
-                    detector.consider(entry);
-                    if (promptRejectionEmitted) break;
-                }
-            }
-            d14Tailer.close();
-        }
-    }
-
-    // Final tick on the primary tailer captures anything the 1s poll's last
-    // interval missed. drainTailerAndForward() feeds every forwarded entry
-    // into detector.consider() before emitResult() runs (item 9).
-    drainTailerAndForward();
-
-    // Refusal emission when we truly never had a transcript to consider.
-    // The wrapper is the sole site that owns the `transcript-unresolved`
-    // refusal — the detector never observes `transcriptPath` itself
-    // (item 10).
-    if (transcriptPath === null) {
-        detector.noteTranscriptUnresolved();
-    }
-
-    // Emit result or error from the pre-parsed sentinel payload (tempDir still
-    // present — deleted below). If the detector fired before onExit
-    // (`failureEmitted=true`), the guard at the top of emitResult short-
-    // circuits so the wire carries exactly one emission.
-    emitResult(hookData);
-
-    // Clean up temp directory
-    try { rmSync(tempDir, { recursive: true, force: true }); } catch {}
-
-    // As1063 Task 1 item 9 / As1080 Task 6 item 17: closed diagnostic-label
-    // set is exactly `emitted-result`, `emitted-failure`, `prompt-rejection`,
-    // `no-emission`. `prompt-rejection` is the detector-initiated failure
-    // branch (`promptRejectionEmitted=true`, which implies
-    // `failureEmitted=true`). `emitted-failure` is the Stop-hook StopFailure
-    // branch. `emitted-result` is the clean-Stop success branch.
-    // `no-emission` is the terminal fall-through. Bounded per lifecycle event
-    // by the `exited` guard at the top of onExit (no unbounded per-turn
-    // accumulation). Written to stderr via log() so JobRunner's stderr
-    // splitter captures it into the outputTail without affecting the
-    // wrapper's stdout emission contract.
-    const branchTaken = promptRejectionEmitted
-        ? 'prompt-rejection'
-        : resultEmitted
-            ? 'emitted-result'
-            : failureEmitted
-                ? 'emitted-failure'
-                : 'no-emission';
-    // Cap the tty tail to 256 chars and escape newlines so the line stays on
-    // one log entry regardless of what claude last wrote.
-    const ttyTail = ttyBuffer.slice(-256).replace(/\n/g, '\\n').replace(/\r/g, '\\r');
-    log(`onExit-branch: ${branchTaken} exitCode=${exitCode} teardownReason=${teardownReason ?? 'unset'} ttyTail="${ttyTail}"`);
-
-    log(`Claude exited (code: ${exitCode})`);
-
-    if (failureEmitted) {
-        process.exit(1);
-    }
-    if (resultEmitted || exitCode === 0) {
-        process.exit(0);
-    }
-    process.exit(exitCode ?? 1);
-});