@oh-my-matrix/autopilot 2.1.2 → 3.0.2

package/dist/index.js

@@ -11,6 +11,7 @@ const continuation_engine_1 = require("./src/continuation-engine");
 const tool_error_tracker_1 = require("./src/tool-error-tracker");
 const stall_detector_1 = require("./src/stall-detector");
 const effort_injection_1 = require("./src/effort-injection");
+const model_routing_1 = require("./src/model-routing");
 const logger_1 = require("./src/logger");
 const autopilot_state_1 = require("./src/autopilot-state");
 const goal_manager_1 = require("./src/goal-manager");
@@ -48,7 +49,9 @@ function validateWorkspacePath(p) {
 }
 exports.id = 'autopilot';
 exports.name = 'Autopilot Continuous Mode';
-exports.version = '2.0.0';
+// S14 (audit 2026-06-30): keep in sync with package.json + openclaw.plugin.json.
+// These three are the release-time single source of truth for the plugin version.
+exports.version = '3.0.0';
 /** GAP-25: Maximum number of concurrent run states before eviction kicks in */
 const MAX_RUN_STATES = 50;
 /** GAP-26: Health check threshold — sessions inactive for 24h are orphaned */
@@ -57,7 +60,51 @@ let stateByRun = new Map();
 let sessionIdToKey = new Map();
 let sessionKeyToRunId = new Map();
 let canaryFired = new Set();
+// S10: one-shot "host not reporting usage" warn per session — avoids log spam
+// while making the silent tokenBudget no-op observable to operators.
+let noUsageWarned = new Set();
 let stallInterval = null;
+let enqueueInjectionFn;
+/**
+ * PROD-7 / LOGIC-4: actuator for stall / programmatic-resume recovery. The
+ * reducer moves a run to `claimed` (retry_due or resume_requested) and marks
+ * needsCrossTurnResume, but a claimed run cannot start an agent turn on its own —
+ * the host only fires agent_turn_prepare when it dispatches a turn. For a
+ * genuinely dead agent (stall) or a gateway resume with no follow-up user
+ * message, no turn ever comes, so the run would sit in `claimed` until the 24h
+ * orphan sweep. This kicks a cross-turn injection so the host actually restarts
+ * execution. idempotencyKey (keyed on lastActivityAt) dedupes double-injection
+ * of the same recovery event while allowing successive retries to each fire.
+ */
+function kickResumedTurn(runId, state) {
+    if (state.orchestrationState !== 'claimed')
+        return;
+    const enqueue = enqueueInjectionFn;
+    if (typeof enqueue !== 'function')
+        return;
+    void Promise.resolve(enqueue({
+        sessionKey: state.sessionKey,
+        text: (0, continuation_engine_1.buildRetryInstruction)(state),
+        idempotencyKey: `autopilot-resume-${runId}-${state.lastActivityAt ?? state.totalContinuations}`,
+        placement: 'prepend_context',
+        // REV-2 fix: match the stall timeout, not the raw default. A no-budget run
+        // stalls at ×2 (600s); the injection TTL must outlive it or the host boots
+        // a resumed turn after the injection already expired.
+        ttlMs: state.workflow?.stallTimeoutMs ?? defaultStallTimeoutMs(!!state.tokenBudget),
+    })).catch((err) => (0, logger_1.warn)(`[autopilot] resume kick enqueue failed for session=${state.sessionKey}: ${err}`));
+}
+/**
+ * L3: resolve the stall timeout fallback when a run has no per-run config.
+ * Runs without a token budget get double the default (undocumented ops tuning —
+ * no-budget runs tend to be long-running and tolerate longer silence before
+ * being declared stalled). Extracted to a named helper so the ×2 rationale is
+ * documented in one place, not duplicated at two call sites.
+ */
+function defaultStallTimeoutMs(hasTokenBudget) {
+    return hasTokenBudget
+        ? workflow_config_1.DEFAULT_WORKFLOW_CONFIG.stallTimeoutMs
+        : workflow_config_1.DEFAULT_WORKFLOW_CONFIG.stallTimeoutMs * 2;
+}
 /**
  * before_tool_call priority — must be higher than matrixassistant-audit (priority 9).
  * Ensures autopilot audit trail is recorded before audit can short-circuit.
@@ -97,6 +144,8 @@ function _resetForTest() {
     sessionIdToKey = new Map();
     sessionKeyToRunId = new Map();
     canaryFired = new Set();
+    noUsageWarned = new Set();
+    enqueueInjectionFn = undefined;
     if (stallInterval) {
         clearInterval(stallInterval);
         stallInterval = null;
@@ -161,28 +210,37 @@ function _triggerRetryCheckForTest(overrides) {
         state.retry.nextRetryAt <= now) {
         const updated = (0, orchestrator_1.orchestratorReducer)(state, { type: 'retry_due', runId, now });
         setState(runId, updated);
+        // PROD-7: retry_due→claimed is a dead end without an actuator — kick a turn.
+        if (updated.orchestrationState === 'claimed')
+            kickResumedTurn(runId, updated);
     }
     return stateByRun.get(runId);
 }
-/** GAP-25: Evict oldest runs when Map exceeds MAX_RUN_STATES */
+/** GAP-25: Evict least-recently-active runs when Map exceeds MAX_RUN_STATES */
 function evictOldestRuns() {
     while (stateByRun.size > MAX_RUN_STATES) {
-        // Find the run with the earliest startedAt (FIFO eviction)
+        // Find the run with the earliest lastActivityAt (LRU eviction).
+        // Falls back to startedAt when lastActivityAt is unset (pre-orchestrator runs).
         let oldestRunId = null;
         let oldestAt = Infinity;
         for (const [runId, state] of stateByRun) {
-            if ((state.startedAt ?? Infinity) < oldestAt) {
-                oldestAt = state.startedAt ?? Infinity;
+            const at = state.lastActivityAt ?? state.startedAt ?? Infinity;
+            if (at < oldestAt) {
+                oldestAt = at;
                 oldestRunId = runId;
             }
         }
         if (oldestRunId == null)
             break;
         const oldestState = stateByRun.get(oldestRunId);
+        // S8: release audit refCount for an evicted still-running run before delete.
+        if (oldestState?.status === 'running')
+            setAuditMode('active');
         stateByRun.delete(oldestRunId);
         if (oldestState) {
             sessionKeyToRunId.delete(oldestState.sessionKey);
             canaryFired.delete(oldestState.sessionKey);
+            noUsageWarned.delete(oldestState.sessionKey);
             // GAP-25: also clean up sessionIdToKey to prevent orphaned sid→skey entries
             for (const [sid, skey] of sessionIdToKey) {
                 if (skey === oldestState.sessionKey) {
@@ -200,15 +258,20 @@ function setState(runId, state) {
 }
 /** GAP-23: Cleanup all state on shutdown */
 function cleanupAll() {
-    // Release audit monitor refCount for every active run before clearing state.
-    // Each run acquired one refCount via setAuditMode('monitor'), so each needs a matching release.
-    for (let i = 0; i < stateByRun.size; i++) {
-        setAuditMode('active');
+    // Release audit monitor refCount ONLY for runs that still hold one. A run
+    // acquires it on activate and releases on pause/complete/stop, so only
+    // status==='running' runs still hold an unreleased refCount. Releasing for
+    // paused/done/idle runs would over-release — the audit plugin's refCount could
+    // go negative depending on its clamp semantics.
+    for (const state of stateByRun.values()) {
+        if (state.status === 'running')
+            setAuditMode('active');
     }
     stateByRun.clear();
     sessionIdToKey.clear();
     sessionKeyToRunId.clear();
     canaryFired.clear();
+    noUsageWarned.clear();
     if (stallInterval) {
         clearInterval(stallInterval);
         stallInterval = null;
@@ -221,18 +284,63 @@ function findRunBySession(sessionKey) {
     const state = stateByRun.get(runId);
     return state ? [runId, state] : undefined;
 }
+/**
+ * Resolve an autopilot run for a session key, transparently following a
+ * subagent key back to its parent run. Subagent keys have the shape
+ * `agent:<main>:subagent:<sub>`; the parent prefix is the run owner.
+ * Used by before_model_resolve and llm_output so both treat subagent
+ * activity as belonging to the parent run.
+ */
+function findRunBySessionOrParent(sessionKey) {
+    return findRunBySession(sessionKey)
+        ?? ((0, model_routing_1.isSubagentSession)(sessionKey)
+            ? findRunBySession((0, model_routing_1.extractParentSessionKey)(sessionKey) ?? '')
+            : undefined);
+}
+// ponytail: production passes sessionKey on ctx, test mocks put it on event — one helper handles both
+function resolveSessionKey(event, ctx) {
+    // Session key can arrive on ctx (production host) or event (test mocks + some
+    // hook signatures where the host populates the event payload). Both are
+    // host-controlled surfaces — the event is NOT user-influenceable. Code-review
+    // M1 flagged the dual-source as a foot-gun, but removing the event fallback
+    // breaks 8 tests that simulate the production pattern (some hooks only
+    // populate sessionKey on event). Leaving as-is until a deeper audit of
+    // per-hook sessionKey provenance is done.
+    const c = ctx;
+    const e = event;
+    const sessionId = c?.sessionId ?? e?.sessionId;
+    return c?.sessionKey ?? e?.sessionKey ?? (sessionId != null ? sessionIdToKey.get(sessionId) : undefined);
+}
+const CROSS_TURN_FALLBACK_TEXT = 'Continue from where you left off.';
+function buildCrossTurnReviseFallback(runId, state, instruction) {
+    const fallbackState = { ...(0, autopilot_state_1.incrementTotal)(state), turnAttempts: 0 };
+    setState(runId, fallbackState);
+    return {
+        action: 'revise',
+        retry: {
+            instruction: instruction || CROSS_TURN_FALLBACK_TEXT,
+            idempotencyKey: `autopilot-${runId}-${fallbackState.totalContinuations}`,
+            maxAttempts: fallbackState.maxAttemptsPerTurn,
+        },
+    };
+}
 /** Generate a unique run ID using crypto.randomUUID (exported for testing). */
 function _generateRunIdForTest() {
     return `run-${crypto.randomUUID()}`;
 }
 function generateRunId() {
-    return _generateRunIdForTest();
+    return `run-${crypto.randomUUID()}`;
 }
 function register(api) {
+    // PROD-7 / LOGIC-4: stash the cross-turn injection actuator so the stall
+    // interval and gateway resume (both outside per-call closures) can restart a
+    // claimed run. Optional-chained: undefined on hosts without the 5.28+ facade.
+    enqueueInjectionFn = api.session?.workflow?.enqueueNextTurnInjection;
     // Read user config from OpenClaw, merge with defaults
     // pluginConfig is Record<string, unknown> — coerce values to expected types
     const uc = api.pluginConfig ?? {};
     const numOrUndefined = (v) => typeof v === 'number' ? v : undefined;
+    const modelRouting = (0, model_routing_1.parseModelRouting)(uc.modelRouting);
     const config = {
         ...types_1.DEFAULT_CONFIG,
         ...(numOrUndefined(uc.maxAttemptsPerTurn) != null ? { maxAttemptsPerTurn: numOrUndefined(uc.maxAttemptsPerTurn) } : {}),
@@ -242,6 +350,11 @@ function register(api) {
         ...(Array.isArray(uc.highRiskTools) ? { highRiskTools: uc.highRiskTools } : {}),
         ...(numOrUndefined(uc.tokenBudget) != null ? { tokenBudget: numOrUndefined(uc.tokenBudget) } : {}),
         ...(numOrUndefined(uc.maxConcurrentAutopilot) != null ? { maxConcurrentAutopilot: numOrUndefined(uc.maxConcurrentAutopilot) } : {}),
+        ...(typeof uc.thinkingIntensity === 'string' && ['low', 'medium', 'high'].includes(uc.thinkingIntensity)
+            ? { thinkingIntensity: uc.thinkingIntensity }
+            : {}),
+        ...(modelRouting ? { modelRouting } : {}),
+        ...(typeof uc.trustWorkspace === 'boolean' ? { trustWorkspace: uc.trustWorkspace } : {}),
     };
     (0, logger_1.log)(`[autopilot] config: maxAttemptsPerTurn=${config.maxAttemptsPerTurn} maxTotalContinuations=${config.maxTotalContinuations} toolErrorThreshold=${config.toolErrorThreshold} excludedAgents=${JSON.stringify(config.excludedAgents)} highRiskTools=${JSON.stringify(config.highRiskTools)} tokenBudget=${config.tokenBudget}`);
     // --- Hooks (use api.on for typed hooks when available, registerHook as fallback) ---
@@ -251,7 +364,7 @@ function register(api) {
         return;
     }
     registerHook('before_agent_finalize', async (event) => {
-        const sessionKey = event.sessionKey ?? sessionIdToKey.get(event.sessionId);
+        const sessionKey = resolveSessionKey(event);
         if (sessionKey)
             canaryFired.add(sessionKey);
         if (!sessionKey)
@@ -273,6 +386,15 @@ function register(api) {
         });
         (0, logger_1.log)(`[autopilot] before_agent_finalize: session=${sessionKey} action=${decision.action} turn=${state.turnAttempts}/${state.maxAttemptsPerTurn} total=${state.totalContinuations}/${state.maxTotalContinuations}`);
         switch (decision.action) {
+            case 'finalize': {
+                // S3 (audit 2026-06-30): decideContinuation returns 'finalize' when the
+                // run is disabled/non-running, or when stopHookActive is set (user hit
+                // stop). Previously this fell through to default and was silently
+                // rewritten to 'continue', leaving status='running' so stall/agent_end
+                // could revive a run the user had asked to stop. Match pause/complete:
+                // emit {action:'finalize'} so the host stops injecting revisions.
+                return { action: 'finalize' };
+            }
             case 'revise': {
                 const updated = (0, autopilot_state_1.incrementTotal)((0, autopilot_state_1.incrementTurn)(state));
                 setState(runId, updated);
@@ -295,49 +417,21 @@ function register(api) {
                             text: decision.retryInstruction || 'Continue from where you left off.',
                             idempotencyKey: `autopilot-cross-${sessionKey}-${updated.totalContinuations}`,
                             placement: 'prepend_context',
-                            ttlMs: 300000,
+                            ttlMs: workflow_config_1.DEFAULT_WORKFLOW_CONFIG.stallTimeoutMs,
                         });
                         if (result && typeof result === 'object' && result.enqueued === false) {
                             (0, logger_1.warn)(`[autopilot] enqueueNextTurnInjection rejected for session=${sessionKey}, falling back to revise`);
-                            const fallbackState = { ...(0, autopilot_state_1.incrementTotal)(state), turnAttempts: 0 };
-                            setState(runId, fallbackState);
-                            return {
-                                action: 'revise',
-                                retry: {
-                                    instruction: decision.retryInstruction || 'Continue from where you left off.',
-                                    idempotencyKey: `autopilot-${runId}-${fallbackState.totalContinuations}`,
-                                    maxAttempts: fallbackState.maxAttemptsPerTurn,
-                                },
-                            };
+                            return buildCrossTurnReviseFallback(runId, state, decision.retryInstruction);
                         }
                         setState(runId, updated);
                         return { action: 'finalize' };
                     }
                     catch (err) {
                         (0, logger_1.warn)(`[autopilot] enqueueNextTurnInjection failed for session=${sessionKey}: ${err}, falling back to revise`);
-                        const fallbackState = { ...(0, autopilot_state_1.incrementTotal)(state), turnAttempts: 0 };
-                        setState(runId, fallbackState);
-                        return {
-                            action: 'revise',
-                            retry: {
-                                instruction: decision.retryInstruction || '请从上次中断的位置继续执行。',
-                                idempotencyKey: `autopilot-${runId}-${fallbackState.totalContinuations}`,
-                                maxAttempts: fallbackState.maxAttemptsPerTurn,
-                            },
-                        };
+                        return buildCrossTurnReviseFallback(runId, state, decision.retryInstruction);
                     }
                 }
-                // Fallback: injection API unavailable, use same-turn revise instead
-                const fallbackState = { ...(0, autopilot_state_1.incrementTotal)(state), turnAttempts: 0 };
-                setState(runId, fallbackState);
-                return {
-                    action: 'revise',
-                    retry: {
-                        instruction: decision.retryInstruction || '请从上次中断的位置继续执行。',
-                        idempotencyKey: `autopilot-${runId}-${fallbackState.totalContinuations}`,
-                        maxAttempts: fallbackState.maxAttemptsPerTurn,
-                    },
-                };
+                return buildCrossTurnReviseFallback(runId, state, decision.retryInstruction);
             }
             case 'pause': {
                 setState(runId, (0, autopilot_state_1.pause)(state, decision.pauseReason));
@@ -363,14 +457,24 @@ function register(api) {
                     });
                 }
                 catch (err) {
-                    // Fail-open: if evidence evaluation throws, treat as skipped to avoid zombie sessions
-                    (0, logger_1.warn)(`[autopilot] evidence gate error (failing open): ${err} session=${sessionKey}`);
+                    // Fail-open (skipped) to avoid zombie sessions — runValidationCommands
+                    // never throws and evaluateEvidence is pure, so this only trips on a
+                    // future bug. But do NOT let that bug pass silently: emit it at error
+                    // level with the failureReason so a monitor can tell an evaluation
+                    // failure apart from a normal no-commands skip (both end as 'skipped').
+                    (0, logger_1.logWithContext)('error', 'evidence gate evaluation error (failing open → skipped)', { sessionKey, runId, error: String(err) });
                     evidenceSummary = { status: 'skipped', diffSummary: '', commands: [], completedAt: now, failureReason: 'evaluation error' };
                 }
-                // Dispatch evidence events only when orchestration state machine is active (released state)
+                // Dispatch orchestrator events to advance orchState to 'done'.
+                // Close the agent turn (running → released) so evidence events can fire.
                 let updated = state;
-                if (state.orchestrationState === 'released') {
-                    updated = (0, orchestrator_1.orchestratorReducer)(state, { type: 'evidence_started', runId, now });
+                if (updated.orchestrationState === 'running') {
+                    updated = (0, orchestrator_1.orchestratorReducer)(updated, {
+                        type: 'agent_turn_finished', runId, success: true, now,
+                    });
+                }
+                if (updated.orchestrationState === 'released') {
+                    updated = (0, orchestrator_1.orchestratorReducer)(updated, { type: 'evidence_started', runId, now });
                     updated = (0, orchestrator_1.orchestratorReducer)(updated, {
                         type: 'evidence_finished',
                         runId,
@@ -378,13 +482,29 @@ function register(api) {
                         evidence: evidenceSummary,
                     });
                 }
-                // Apply evidence to state + mark done.
-                // Guard (H1): evidence_finished (passed/skipped) already sets status:'done' via orchestrator.
-                // complete() requires status='running' and would throw — skip it when orchestrator completed.
-                setState(runId, updated.status === 'done'
+                // Apply evidence result to state. The decision branches on evidence outcome:
+                // passed/skipped → mark the run done; failed → retry or block (NOT done).
+                // Before this fix (H1), the code checked `updated.status === 'done'`, but the
+                // reducer leaves status='running' on evidence FAILURE, so failed evidence fell
+                // into complete() — producing a false 'done' + enabled:false, which stranded
+                // the run (the stall interval's retry_due guard checks state.enabled).
+                // See docs/audits/autopilot-correctness-review-2026-07-04.md HIGH finding.
+                setState(runId, 
+                // failed → the reducer moved to retry_queued (will retry) or blocked (max
+                // retries). Keep the run enabled in retry_queued so the stall interval can
+                // fire retry_due. When blocked, the reducer already set orchState='blocked'
+                // + blockedReason + derived status='paused' — do NOT call pause() (it would
+                // throw: pause() requires status='running' but the reducer derived 'paused').
+                // Just attach the evidence summary; the state is already correct.
+                evidenceSummary.status === 'failed'
                     ? { ...updated, evidence: evidenceSummary }
-                    : (0, autopilot_state_1.complete)({ ...updated, evidence: evidenceSummary }));
-                (0, logger_1.logWithContext)('info', 'evidence gate result', { sessionKey, runId, evidenceStatus: evidenceSummary.status });
+                    // passed/skipped → reducer already set orchState='done' + status='done'
+                    // when the evidence reducer ran; if it didn't run (orchState unchanged),
+                    // complete() advances status to done. Either way the run finishes.
+                    : updated.status === 'done'
+                        ? { ...updated, evidence: evidenceSummary }
+                        : (0, autopilot_state_1.complete)({ ...updated, evidence: evidenceSummary }));
+                (0, logger_1.logWithContext)('info', 'evidence gate result', { sessionKey, runId, evidenceStatus: evidenceSummary.status, failureReason: evidenceSummary.failureReason });
                 // Release audit monitor when task completes — session is done, no more tool calls needed.
                 setAuditMode('active');
                 return { action: 'finalize' };
@@ -393,8 +513,8 @@ function register(api) {
                 return { action: 'continue' };
         }
     });
-    registerHook('after_tool_call', (event) => {
-        const sessionKey = event.sessionKey ?? sessionIdToKey.get(event.sessionId);
+    registerHook('after_tool_call', (event, ctx) => {
+        const sessionKey = resolveSessionKey(event, ctx);
         if (!sessionKey)
             return;
         const entry = findRunBySession(sessionKey);
@@ -419,10 +539,10 @@ function register(api) {
             error: (event.error ?? '').substring(0, 200),
         });
         setState(runId, withError);
-        (0, logger_1.log)(`[autopilot] after_tool_call error: session=${sessionKey} tool=${event.toolName} errCount=${withError.toolErrorCount}/${state.toolErrorThreshold}`);
+        (0, logger_1.warn)(`[autopilot] after_tool_call error: session=${sessionKey} tool=${event.toolName} errCount=${withError.toolErrorCount}/${state.toolErrorThreshold}`);
     });
-    registerHook('before_compaction', (event) => {
-        const sessionKey = event.sessionKey ?? sessionIdToKey.get(event.sessionId);
+    registerHook('before_compaction', (_event, ctx) => {
+        const sessionKey = resolveSessionKey(_event, ctx);
         if (!sessionKey)
             return;
         const entry = findRunBySession(sessionKey);
@@ -431,8 +551,8 @@ function register(api) {
             setState(entry[0], (0, goal_manager_1.preserveGoalBeforeCompaction)(entry[1]));
         }
     });
-    registerHook('after_compaction', (event) => {
-        const sessionKey = event.sessionKey ?? sessionIdToKey.get(event.sessionId);
+    registerHook('after_compaction', (_event, ctx) => {
+        const sessionKey = resolveSessionKey(_event, ctx);
         if (!sessionKey)
             return;
         const entry = findRunBySession(sessionKey);
@@ -442,7 +562,7 @@ function register(api) {
         }
     });
     registerHook('agent_turn_prepare', (event, ctx) => {
-        const sessionKey = ctx?.sessionKey ?? event.sessionKey;
+        const sessionKey = ctx?.sessionKey;
         if (!sessionKey)
             return;
         const entry = findRunBySession(sessionKey);
@@ -456,6 +576,9 @@ function register(api) {
             runId,
             now: Date.now(),
         });
+        // Persist the orchState transition (claimed → running) immediately.
+        if (updated !== state)
+            setState(runId, updated);
         // Capture goal from first user prompt if not already set
         if (!updated.goal && event.prompt) {
             updated = (0, goal_manager_1.captureGoal)(updated, event.prompt);
@@ -489,14 +612,52 @@ function register(api) {
         }
         if (parts.length === 0)
             return;
-        // Effort injection: ensure high effort for every autopilot turn (TD-1)
-        const effortCtx = (0, effort_injection_1.buildEffortInjection)(updated.status);
+        // Effort injection: graduated intensity by execution phase (TD-1)
+        const intensity = (0, effort_injection_1.resolveThinkingIntensity)(updated.totalContinuations, updated.evidence?.status, config.thinkingIntensity);
+        const effortCtx = (0, effort_injection_1.buildEffortInjection)(updated.status, intensity);
         if (effortCtx)
             parts.push(effortCtx);
         // Completion awareness instruction
         parts.push('[Autopilot] When all tasks are complete, explicitly state "All tasks completed".');
         return { appendContext: parts.join('\n') };
     });
+    // Model routing: override model per execution phase. Consumed by Gateway via
+    // before_model_resolve -> { modelOverride }. No modelIds => no override (inherit).
+    // Read-only: state is read without a lock while other hooks mutate it — a turn
+    // straddling an evidence-status transition may pick the wrong tier for one turn.
+    // Acceptable for a routing heuristic (no data loss, self-corrects next turn).
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    registerHook('before_model_resolve', (_event, ctx) => {
+        const sessionKey = ctx?.sessionKey;
+        if (!sessionKey)
+            return;
+        // Find the autopilot run: direct, or via parent session for subagents
+        // (subagent keys: agent:<main>:subagent:<sub>).
+        const entry = findRunBySessionOrParent(sessionKey);
+        if (!entry?.[1].enabled || entry[1].status !== 'running')
+            return;
+        const [, state] = entry;
+        // WORKFLOW.md model_routing wins over plugin config when present.
+        const routing = state.workflow?.modelRouting ?? modelRouting;
+        if (!routing?.modelIds)
+            return;
+        // INT-3 (ADR-017): a subagent's own declared model wins over the parent
+        // run's subagentTier. The host resolves the child's `.prose model:` (or
+        // agent-definition model) BEFORE firing this hook and surfaces it via
+        // ctx.modelId. When a subagent carries an explicit declared model, we
+        // return without an override so the host keeps it; the parent
+        // subagentTier then only applies to children that declared nothing.
+        if ((0, model_routing_1.isSubagentSession)(sessionKey) && ctx.modelId) {
+            (0, logger_1.log)(`[autopilot] before_model_resolve: session=${sessionKey} inherit child model=${ctx.modelId}`);
+            return;
+        }
+        const tier = (0, model_routing_1.resolveModelTier)(state.totalContinuations, state.evidence?.status, (0, model_routing_1.isSubagentSession)(sessionKey), routing);
+        const modelId = (0, model_routing_1.resolveModelId)(tier, routing);
+        if (modelId) {
+            (0, logger_1.log)(`[autopilot] before_model_resolve: session=${sessionKey} tier=${tier} model=${modelId}`);
+            return { modelOverride: modelId };
+        }
+    });
     // eslint-disable-next-line @typescript-eslint/no-explicit-any
     registerHook('before_agent_run', (_event, ctx) => {
         const sessionKey = ctx?.sessionKey;
@@ -556,6 +717,10 @@ function register(api) {
             commandClass,
             outcome: decision.outcome,
             reason: decision.reason,
+            // F3: persist the per-call working dir so the audit trail is forensically
+            // useful — aligns with dynamic-workflows' audit entry. eventCwd already
+            // resolved above (params.workdir / cd / git -C); fall back to the workspace.
+            cwd: eventCwd ?? state.workspace?.path,
         };
         const MAX_AUDIT = 200;
         const prevAudit = withActivity.permissionAudit ?? [];
@@ -575,7 +740,7 @@ function register(api) {
         // Using requireApproval+timeoutMs:1 was broken — it still walked the approval
         // pipeline which has no handler, causing 10s+ "Approval timed out" errors.
         if (decision.outcome === 'block') {
-            (0, logger_1.logWithContext)('info', 'before_tool_call BLOCKED', { sessionKey, runId, toolName, reason: decision.reason });
+            (0, logger_1.logWithContext)('warn', 'before_tool_call BLOCKED', { sessionKey, runId, toolName, reason: decision.reason });
             return {
                 block: true,
                 blockReason: decision.message,
@@ -586,12 +751,25 @@ function register(api) {
         const sessionKey = ctx?.sessionKey;
         if (!sessionKey)
             return;
-        const entry = findRunBySession(sessionKey);
+        // Count subagent tokens toward the PARENT run's budget. before_model_resolve
+        // already resolves subagents via their parent (agent:<main>:subagent:<id>);
+        // token accounting must match, or a run's tokenBudget under-counts real spend
+        // (the budget is enforced at the parent's before_agent_finalize turn boundary).
+        const entry = findRunBySessionOrParent(sessionKey);
         if (!entry?.[1].enabled)
             return;
         const usage = event.usage;
-        if (!usage?.total)
+        if (!usage?.total) {
+            // S10: when the host omits usage on a run WITH a configured tokenBudget,
+            // the budget silently never enforces (totalTokensUsed stays 0). Warn once
+            // per session so operators can diagnose "budget not working" instead of
+            // silently burning tokens. Skip when no budget is configured (irrelevant).
+            if (entry[1].tokenBudget && !noUsageWarned.has(sessionKey)) {
+                noUsageWarned.add(sessionKey);
+                (0, logger_1.warn)(`[autopilot] llm_output: host did not report token usage for session=${sessionKey} but a tokenBudget is configured — budget enforcement is a no-op until the host reports usage`);
+            }
             return;
+        }
         // H4: Guard against NaN / negative / non-finite token counts
         const added = typeof usage.total === 'number' && Number.isFinite(usage.total) && usage.total >= 0
             ? usage.total : 0;
@@ -622,15 +800,20 @@ function register(api) {
             return;
         const entry = findRunBySession(sessionKey);
         if (entry) {
-            const [runId] = entry;
+            const [runId, state] = entry;
+            // S8: release the audit monitor refCount for still-running runs before
+            // deleting state, mirroring cleanupAll. A leak here pins monitor mode.
+            if (state.status === 'running')
+                setAuditMode('active');
             stateByRun.delete(runId);
             sessionKeyToRunId.delete(sessionKey);
             canaryFired.delete(sessionKey);
+            noUsageWarned.delete(sessionKey);
         }
         (0, logger_1.log)(`[autopilot] session_end: session=${sessionKey} state cleaned up`);
     });
-    registerHook('agent_end', async (event) => {
-        const sessionKey = event.sessionKey ?? sessionIdToKey.get(event.sessionId);
+    registerHook('agent_end', async (event, ctx) => {
+        const sessionKey = resolveSessionKey(event, ctx);
         if (!sessionKey)
             return;
         const entry = findRunBySession(sessionKey);
@@ -660,7 +843,7 @@ function register(api) {
                             text: (0, continuation_engine_1.buildRetryInstruction)(continued),
                             idempotencyKey: `autopilot-degraded-${sessionKey}-${continued.totalContinuations}`,
                             placement: 'prepend_context',
-                            ttlMs: 300000,
+                            ttlMs: workflow_config_1.DEFAULT_WORKFLOW_CONFIG.stallTimeoutMs,
                         });
                         if (injectResult && typeof injectResult === 'object' && injectResult.enqueued === false) {
                             (0, logger_1.warn)(`[autopilot] agent_end: degraded fallback enqueue rejected for session=${sessionKey}`);
@@ -728,7 +911,7 @@ function register(api) {
                     return undefined;
                 const entry = findRunBySession(ctx.sessionKey);
                 if (entry)
-                    return (0, projection_1.projectState)(entry[1]);
+                    return (0, projection_1.projectState)(entry[1], config);
                 return {
                     status: 'idle',
                     enabled: false,
@@ -746,8 +929,17 @@ function register(api) {
             cleanup: (ctx) => {
                 if (ctx.sessionKey) {
                     const entry = findRunBySession(ctx.sessionKey);
-                    if (entry)
+                    if (entry) {
+                        // S8: release audit refCount for still-running runs before delete.
+                        if (entry[1].status === 'running')
+                            setAuditMode('active');
                         stateByRun.delete(entry[0]);
+                    }
+                    // PROD-2: clear the reverse-index and canary set too, else session-key
+                    // teardown (without a session_end) leaves dangling map entries.
+                    sessionKeyToRunId.delete(ctx.sessionKey);
+                    canaryFired.delete(ctx.sessionKey);
+                    noUsageWarned.delete(ctx.sessionKey);
                 }
             },
         });
@@ -769,6 +961,9 @@ function register(api) {
             const payloadMaxContinuations = ctx.maxTotalContinuations;
             const payloadWorkspacePath = validateWorkspacePath(ctx.workspacePath);
             const payloadTokenBudget = typeof ctx.tokenBudget === 'number' && ctx.tokenBudget > 0 ? ctx.tokenBudget : undefined;
+            // S1-residual A: per-activate opt-in to execute workspace-sourced validation
+            // commands. Undefined → fall back to plugin config; both undefined → false.
+            const payloadTrustWorkspace = typeof ctx.trustWorkspace === 'boolean' ? ctx.trustWorkspace : undefined;
             // Concurrency guard: count sessions with status === 'running'
             const maxConcurrent = config.maxConcurrentAutopilot ?? 5;
             const runningCount = Array.from(stateByRun.values()).filter(s => s.status === 'running').length;
@@ -791,21 +986,42 @@ function register(api) {
             };
             // GAP-6: Load workflow config from WORKFLOW.md
             const applyWorkflowConfig = (s) => {
+                // S1-residual A: workspace-sourced validation commands (WORKFLOW.md +
+                // auto-detected `npm test` / `node …`) are NOT executed unless the operator
+                // trusts this workspace. Untrusted → commands empty + warning. This is the
+                // root-cause boundary: the binary allowlist cannot stop `npm run <script>` /
+                // `node evil.js` when the workspace owns the script.
+                const trustWorkspace = payloadTrustWorkspace ?? config.trustWorkspace ?? false;
                 try {
                     // Use payloadWorkspacePath (validated in outer scope by validateWorkspacePath) rather than
                     // re-reading ctx.workspacePath raw — prevents path-traversal via WORKFLOW.md loading.
                     const result = (0, workflow_config_1.loadWorkflowConfig)(process.cwd(), payloadWorkspacePath);
-                    // R-3: Auto-fill validation commands when WORKFLOW.md has none.
-                    // Only auto-detect when an explicit workspace path is provided (not cwd fallback)
-                    // to avoid running project tests in unexpected directories during tests/CI.
-                    const autoCommands = result.config.validation.commands.length === 0 && payloadWorkspacePath
-                        ? (0, project_detector_1.detectValidationCommands)(payloadWorkspacePath)
-                        : result.config.validation.commands;
+                    let commands = result.config.validation.commands;
+                    if (!trustWorkspace) {
+                        commands = [];
+                    }
+                    else if (commands.length === 0 && payloadWorkspacePath) {
+                        // R-3: Auto-fill validation commands when WORKFLOW.md has none.
+                        // Only auto-detect when an explicit workspace path is provided AND trusted
+                        // (not cwd fallback) to avoid running project tests in unexpected dirs.
+                        commands = (0, project_detector_1.detectValidationCommands)(payloadWorkspacePath);
+                    }
+                    const warnings = trustWorkspace
+                        ? result.warnings
+                        : [...result.warnings, 'untrusted workspace — validation commands + model_routing disabled (enable via trustWorkspace:true)'];
+                    // L1: an untrusted workspace must not influence model selection either.
+                    // validation.commands are cleared above (RCE boundary); model_routing
+                    // from the same WORKFLOW.md is dropped here so an attacker-controlled
+                    // workspace cannot force a different/cheaper model tier. Plugin-level
+                    // modelRouting (operator config) still applies regardless.
+                    const { modelRouting: _ignoredModelRouting, ...configWithoutRouting } = result.config;
+                    const trustedConfig = trustWorkspace ? result.config : configWithoutRouting;
                     return {
                         ...s,
                         workflow: {
-                            ...result.config,
-                            validation: { ...result.config.validation, commands: autoCommands },
+                            ...trustedConfig,
+                            validation: { ...result.config.validation, commands },
+                            warnings,
                         },
                         maxTotalContinuations: s.maxTotalContinuations,
                     };
@@ -826,13 +1042,23 @@ function register(api) {
                 // A stuck run would otherwise block every future activation until a
                 // gateway restart, because the stall handler leaves status='running'.
                 // Genuinely-active runs (recent activity) still fall through to reject.
-                const stuckRecovery = (0, autopilot_state_1.isRunStuck)(state, Date.now(), config.tokenBudget ? 300_000 : 600_000);
+                // M1: use the run's own stallTimeoutMs if configured, not just the global default.
+                const stuckStallMs = state.workflow?.stallTimeoutMs
+                    ?? defaultStallTimeoutMs(!!config.tokenBudget);
+                const stuckRecovery = (0, autopilot_state_1.isRunStuck)(state, Date.now(), stuckStallMs);
                 if (state.status === 'idle' || state.status === 'done' || stuckRecovery) {
                     if (stuckRecovery) {
                         (0, logger_1.warn)(`[autopilot] activate: recovering stuck session=${sessionKey} (status=${state.status}, orchState=${state.orchestrationState ?? 'none'}) — discarding stale run ${oldRunId}`);
                     }
-                    // Release audit monitor for the old run before discarding it.
-                    setAuditMode('active');
+                    // Release audit monitor refcount ONLY if the old run still holds one.
+                    // Per GAP-23 invariant: only status==='running' runs hold an unreleased
+                    // refCount (acquire on activate, release on pause/complete/stop). The
+                    // stuckRecovery branch is the only one where oldRunId may still be
+                    // 'running'. idle/done runs were already released at complete/stop —
+                    // releasing again would over-release the shared audit refcount (S8).
+                    if (stuckRecovery) {
+                        setAuditMode('active');
+                    }
                     stateByRun.delete(oldRunId);
                     sessionKeyToRunId.delete(sessionKey);
                     const runId = generateRunId();
@@ -850,7 +1076,7 @@ function register(api) {
                     });
                     setState(runId, newState);
                     sessionKeyToRunId.set(sessionKey, runId);
-                    (0, logger_1.log)(`[autopilot] activate: session=${sessionKey} new run=${runId} (was ${state.status}, goal=${goalForEvent ?? 'none'})`);
+                    (0, logger_1.log)(`[autopilot] activate: session=${sessionKey} new run=${runId} (was ${state.status}, goalLen=${goalForEvent?.length ?? 0})`);
                 }
                 else {
                     (0, logger_1.warn)(`[autopilot] activate rejected: session=${sessionKey} status=${state.status}`);
@@ -859,7 +1085,7 @@ function register(api) {
                 }
             }
             else {
-                const runId = `run-${Math.random().toString(36).slice(2, 10)}`;
+                const runId = generateRunId();
                 let state = (0, autopilot_state_1.activate)((0, types_1.createInitialState)(sessionKey, runId, config));
                 state = (0, orchestrator_1.orchestratorReducer)(state, { type: 'activate_requested', sessionKey, goal: payloadGoal, now: Date.now() });
                 state = applyPayload(state);
@@ -897,7 +1123,11 @@ function register(api) {
             }
             // M2: Dispatch resume_requested through orchestrator reducer
             const orchestrated = (0, orchestrator_1.orchestratorReducer)(state, { type: 'resume_requested', runId, now: Date.now() });
-            setState(runId, (0, autopilot_state_1.resume)(orchestrated));
+            const resumed = (0, autopilot_state_1.resume)(orchestrated);
+            setState(runId, resumed);
+            // LOGIC-4: a programmatic resume has no follow-up user message to trigger
+            // agent_turn_prepare, so kick a cross-turn injection to actually continue.
+            kickResumedTurn(runId, resumed);
             (0, logger_1.log)(`[autopilot] resume: session=${sessionKey} paused→running, errors reset`);
             // Re-acquire audit monitor mode on resume.
             setAuditMode('monitor');
@@ -928,7 +1158,7 @@ function register(api) {
         api.registerGatewayMethod('autopilot.status', async ({ params: ctx, respond }) => {
             const sessionKey = ctx.sessionKey;
             const entry = sessionKey ? findRunBySession(sessionKey) : undefined;
-            const projection = entry ? (0, projection_1.projectState)(entry[1]) : undefined;
+            const projection = entry ? (0, projection_1.projectState)(entry[1], config) : undefined;
             // Also expose raw state fields not in projection (progress, permissionAudit)
             const state = entry ? entry[1] : undefined;
             respond(true, {
@@ -960,7 +1190,7 @@ function register(api) {
             }
             const [runId, state] = entry;
             setState(runId, (0, autopilot_state_1.setGoal)(state, goal));
-            (0, logger_1.log)(`[autopilot] setGoal: session=${sessionKey} goal="${goal.substring(0, 80)}"`);
+            (0, logger_1.log)(`[autopilot] setGoal: session=${sessionKey} goalLen=${goal.length}`);
             respond(true, { ok: true });
         });
         // GAP-23: Cleanup action for graceful shutdown
@@ -974,8 +1204,7 @@ function register(api) {
     // Periodically check all active runs for stall (no activity for stallTimeoutMs).
     // When a stall is detected, dispatch stall_timeout through the orchestrator reducer.
     const stallCheckIntervalMs = 60_000; // Check every 60 seconds
-    const stallTimeoutMs = config.tokenBudget ? 300_000 : 600_000; // 5min or 10min default
-    // M-7: Clear previous interval before creating new one (HMR / double-register safety)
+    // M-7: Clear previous interval before creating a new one (HMR / double-register safety)
     if (stallInterval) {
         clearInterval(stallInterval);
         stallInterval = null;
@@ -984,8 +1213,13 @@ function register(api) {
         const now = Date.now();
         const orphanRunIds = [];
         for (const [runId, state] of stateByRun.entries()) {
-            // GAP-4: Stall detection for active runs
-            if (state.enabled && state.status === 'running' && state.orchestrationState === 'running') {
+            // GAP-4: Stall detection for active runs.
+            // M1 fix: read stallTimeoutMs PER-RUN from the run's workflow config, not
+            // the global default. An operator setting `stall_timeout_ms` in WORKFLOW.md
+            // expects it to take effect; the global fallback was silently ignoring it.
+            const stallTimeoutMs = state.workflow?.stallTimeoutMs
+                ?? defaultStallTimeoutMs(!!config.tokenBudget);
+            if (state.enabled && state.status === 'running' && (state.orchestrationState === 'running' || state.orchestrationState === 'claimed')) {
                 const stallResult = (0, stall_detector_1.checkStall)({
                     lastActivityAt: state.lastActivityAt ?? state.startedAt ?? now,
                     now,
@@ -1011,6 +1245,10 @@ function register(api) {
                     now,
                 });
                 setState(runId, updated);
+                // PROD-7: a claimed run cannot self-start a turn — kick one so a genuinely
+                // dead agent restarts instead of sitting in claimed until the 24h sweep.
+                if (updated.orchestrationState === 'claimed')
+                    kickResumedTurn(runId, updated);
                 (0, logger_1.log)(`[autopilot] retry_due: session=${state.sessionKey} run=${runId} attempt=${state.retry?.attempt ?? 1}`);
             }
             // GAP-26: Health check — detect orphaned sessions (no activity for 24h)
@@ -1024,11 +1262,18 @@ function register(api) {
             const state = stateByRun.get(runId);
             if (state) {
                 (0, logger_1.warn)(`[autopilot] health check: cleaning orphaned session=${state.sessionKey} run=${runId}`);
+                // S8: release audit refCount for orphaned still-running runs before delete.
+                if (state.status === 'running')
+                    setAuditMode('active');
                 stateByRun.delete(runId);
                 sessionKeyToRunId.delete(state.sessionKey);
                 canaryFired.delete(state.sessionKey);
+                noUsageWarned.delete(state.sessionKey);
             }
         }
     }, stallCheckIntervalMs);
+    // PROD-6: don't let the stall timer keep the event loop alive if the host
+    // exits without calling cleanup — unref so the process can drain naturally.
+    stallInterval?.unref?.();
 }
 //# sourceMappingURL=index.js.map