@oh-my-pi/pi-coding-agent 17.0.7 → 17.0.8

package/src/dap/client.ts

@@ -75,6 +75,10 @@ export class DapClient {
 	#reverseRequestHandlers = new Map<string, DapReverseRequestHandler>();
 	#adapterExited = false;
 	#pendingWriteExitRejectors = new Set<() => void>();
+	/** Rejectors for in-flight {@link waitForEvent} calls, woken when the
+	 *  transport closes so an event that can never arrive fails fast instead of
+	 *  waiting out its own timeout. */
+	#eventWaiterRejectors = new Set<(error: Error) => void>();
 
 	constructor(
 		adapter: DapResolvedAdapter,
@@ -188,12 +192,17 @@ export class DapClient {
 		});
 
 		try {
-			const { readable, writeSink, socket } = await waitForTcpTransport(
-				host,
-				port,
-				socketReadyTimeoutMs ?? SOCKET_READY_TIMEOUT_MS,
-				proc,
-			);
+			// Wait for the adapter to announce it is listening on `port` before
+			// connecting. Without this gate the first connect can land in the
+			// window where a just-released reservation port still accepts
+			// connections (WSL2 mirrored networking, issue #6055): the transport
+			// then binds to a ghost of the reservation listener instead of the
+			// adapter. Draining stdout here also avoids a pipe-buffer deadlock —
+			// in tcp mode the DAP protocol flows over the socket, so nothing else
+			// consumes the adapter's stdout.
+			const readyTimeoutMs = socketReadyTimeoutMs ?? SOCKET_READY_TIMEOUT_MS;
+			await waitForTcpServerListening(proc, port, readyTimeoutMs);
+			const { readable, writeSink, socket } = await waitForTcpTransport(host, port, readyTimeoutMs, proc);
 			const client = new DapClient(adapter, cwd, proc, { readable, writeSink, socket, port });
 			proc.exited.then(() => client.#handleProcessExit());
 			void client.#startMessageReader();
@@ -389,6 +398,7 @@ export class DapClient {
 		let timeout: NodeJS.Timeout | undefined;
 		const cleanup = () => {
 			unsubscribe();
+			this.#eventWaiterRejectors.delete(closeHandler);
 			if (timeout) clearTimeout(timeout);
 			if (signal) {
 				signal.removeEventListener("abort", abortHandler);
@@ -398,6 +408,10 @@ export class DapClient {
 			cleanup();
 			reject(signal?.reason instanceof Error ? signal.reason : new ToolAbortError());
 		};
+		const closeHandler = (error: Error) => {
+			cleanup();
+			reject(error);
+		};
 		const unsubscribe = this.onEvent(event, body => {
 			const typedBody = body as TBody;
 			if (predicate && !predicate(typedBody)) {
@@ -406,6 +420,7 @@ export class DapClient {
 			cleanup();
 			resolve(typedBody);
 		});
+		this.#eventWaiterRejectors.add(closeHandler);
 		if (signal) {
 			signal.addEventListener("abort", abortHandler, { once: true });
 		}
@@ -580,6 +595,7 @@ export class DapClient {
 
 		const framer = new MessageFramer(this.#messageBuffer);
 
+		let closeError: Error | undefined;
 		try {
 			while (true) {
 				const { done, value } = await reader.read();
@@ -619,13 +635,19 @@ export class DapClient {
 				}
 			}
 		} catch (error) {
-			this.#rejectPendingRequests(new Error(`DAP connection closed: ${toErrorMessage(error)}`));
+			closeError = new Error(`DAP connection closed: ${toErrorMessage(error)}`);
 		} finally {
 			// Persist any unparsed remainder so a restarted reader resumes mid-message.
 			this.#messageBuffer = framer.remainder();
 			reader.releaseLock();
 			this.#isReading = false;
 		}
+		// The transport is gone once the reader loop exits — on a thrown error
+		// or a clean stream end (a socket the peer dropped after we wrote, e.g.
+		// the WSL2-mirrored ghost-accept race in issue #6055). Fail every
+		// in-flight request and event waiter so callers see an immediate error
+		// instead of waiting out their own timeout.
+		this.#failConnection(closeError ?? new Error(`DAP connection closed: ${this.adapter.name} transport ended`));
 	}
 
 	#handleResponse(message: DapResponseMessage): void {
@@ -712,7 +734,19 @@ export class DapClient {
 				? `DAP adapter exited (code ${exitCode}): ${stderr}`
 				: `DAP adapter exited unexpectedly (code ${exitCode})`,
 		);
+		this.#failConnection(error);
+	}
+
+	/** Reject every in-flight request and wake every event waiter with `error`.
+	 *  Called when the transport dies (reader end, socket close, adapter exit)
+	 *  so nothing sits pending until its own timeout. */
+	#failConnection(error: Error): void {
 		this.#rejectPendingRequests(error);
+		const waiters = Array.from(this.#eventWaiterRejectors);
+		this.#eventWaiterRejectors.clear();
+		for (const reject of waiters) {
+			reject(error);
+		}
 	}
 
 	#rejectPendingRequests(error: Error): void {
@@ -826,6 +860,51 @@ async function waitForTcpTransport(
 	throw new Error(`TCP port ${host}:${port} was not ready after ${timeoutMs}ms`);
 }
 
+/**
+ * Give the adapter a chance to announce it is listening on `port` before the
+ * first connect. vscode-js-debug prints `Debug server listening at HOST:PORT`
+ * to stdout from inside its `listen()` callback; waiting for the port to appear
+ * there means we only connect once the child genuinely owns the reserved port,
+ * which closes the WSL2-mirrored ghost-accept window (issue #6055) at its root.
+ *
+ * Best-effort: resolves on the banner, on process exit, or on timeout — the
+ * subsequent connect loop and `proc.exitCode` checks surface real failures, so
+ * an adapter that never prints a banner still proceeds (just without the gate).
+ * Also drains stdout for the wait's duration: in tcp mode the DAP protocol
+ * flows over the socket, so nothing else consumes the adapter's stdout.
+ *
+ * Exported so tests can drive the gate deterministically with a synthetic stdout.
+ */
+export async function waitForTcpServerListening(
+	proc: { stdout: ReadableStream<Uint8Array>; exitCode: number | null },
+	port: number,
+	timeoutMs: number,
+): Promise<void> {
+	const ready = Promise.withResolvers<void>();
+	const portText = String(port);
+	void (async () => {
+		try {
+			const decoder = new TextDecoder();
+			let buffered = "";
+			for await (const chunk of proc.stdout) {
+				buffered += decoder.decode(chunk, { stream: true });
+				if (buffered.includes(portText)) {
+					ready.resolve();
+				}
+				// Keep only the tail relevant for banner matching so a chatty
+				// adapter cannot grow this buffer without bound.
+				if (buffered.length > 4096) {
+					buffered = buffered.slice(-1024);
+				}
+			}
+		} catch {
+			/* stdout errored — the connect loop surfaces the real failure */
+		}
+		ready.resolve();
+	})();
+	await Promise.race([ready.promise, Bun.sleep(timeoutMs)]);
+}
+
 interface SocketTransport {
 	readable: ReadableStream<Uint8Array>;
 	writeSink: DapWriteSink;

package/src/edit/diff.ts

@@ -4,7 +4,7 @@
  * Provides diff string generation and the replace-mode edit logic
  * used when not in patch mode.
  */
-import * as Diff from "diff";
+import { diffLines, structuredPatchHunks } from "@oh-my-pi/pi-natives";
 import { resolveToCwd } from "../tools/path-utils";
 import { type BlockContextSource, findBlockContextLines } from "../utils/block-context";
 import { DEFAULT_FUZZY_THRESHOLD, EditMatchError, findMatch } from "./modes/replace";
@@ -235,7 +235,7 @@ export function generateDiffString(
 	contextLines = 2,
 	source: BlockContextSource = {},
 ): DiffResult {
-	const parts = Diff.diffLines(oldContent, newContent);
+	const parts = diffLines(oldContent, newContent);
 	const output: string[] = [];
 
 	let oldLineNum = 1;
@@ -373,10 +373,10 @@ export function generateUnifiedDiffString(
 	contextLines = 3,
 	source: BlockContextSource = {},
 ): DiffResult {
-	const patch = Diff.structuredPatch("", "", oldContent, newContent, "", "", { context: contextLines });
+	const hunks = structuredPatchHunks(oldContent, newContent, contextLines);
 	const output: string[] = [];
 	let firstChangedLine: number | undefined;
-	for (const hunk of patch.hunks) {
+	for (const hunk of hunks) {
 		output.push(`@@ -${hunk.oldStart},${hunk.oldLines} +${hunk.newStart},${hunk.newLines} @@`);
 		let oldLine = hunk.oldStart;
 		let newLine = hunk.newStart;

package/src/eval/py/prelude.py

@@ -153,7 +153,7 @@ if "__omp_prelude_loaded__" not in globals():
         """Read task/agent output by ID. Returns text or JSON depending on format.
 
         Args:
-            *ids: Output IDs to read (e.g., 'explore_0', 'reviewer_1')
+            *ids: Output IDs to read (e.g., 'scout_0', 'reviewer_1')
             format: 'raw' (default), 'json' (dict with metadata), 'stripped' (no ANSI)
             query: jq-like query for JSON outputs (e.g., '.endpoints[0].file')
             offset: Line number to start reading from (1-indexed)
@@ -164,11 +164,11 @@ if "__omp_prelude_loaded__" not in globals():
             Multiple IDs: list of dict with 'id' and 'content'/'data' keys
 
         Examples:
-            output('explore_0')  # Read as raw text
+            output('scout_0')  # Read as raw text
             output('reviewer_0', format='json')  # Read with metadata
-            output('explore_0', query='.files[0]')  # Extract JSON field
-            output('explore_0', offset=10, limit=20)  # Lines 10-29
-            output('explore_0', 'reviewer_1')  # Read multiple outputs
+            output('scout_0', query='.files[0]')  # Extract JSON field
+            output('scout_0', offset=10, limit=20)  # Lines 10-29
+            output('scout_0', 'reviewer_1')  # Read multiple outputs
         """
         # Prefer PI_ARTIFACTS_DIR so subagents resolve through the parent's
         # shared artifacts dir; fall back to deriving from PI_SESSION_FILE

package/src/export/html/template.js

@@ -102,14 +102,18 @@
           }
         }
 
-        // Sort children by timestamp
-        function sortChildren(node) {
+        // Sort children by timestamp. Use an explicit stack so valid, deep
+        // conversation chains do not exhaust the browser call stack.
+        const sortStack = [...roots];
+        while (sortStack.length > 0) {
+          const node = sortStack.pop();
           node.children.sort((a, b) =>
             new Date(a.entry.timestamp).getTime() - new Date(b.entry.timestamp).getTime()
           );
-          node.children.forEach(sortChildren);
+          for (let i = node.children.length - 1; i >= 0; i--) {
+            sortStack.push(node.children[i]);
+          }
         }
-        roots.forEach(sortChildren);
 
         return roots;
       }
@@ -157,17 +161,27 @@
         const result = [];
         const multipleRoots = roots.length > 1;
 
-        // Mark which subtrees contain the active leaf
+        // Mark which subtrees contain the active leaf. Use iterative post-order
+        // traversal so valid, deep conversation chains do not exhaust the
+        // browser call stack.
         const containsActive = new Map();
-        function markActive(node) {
+        const allNodes = [];
+        const activeStack = [...roots];
+        while (activeStack.length > 0) {
+          const node = activeStack.pop();
+          allNodes.push(node);
+          for (let i = node.children.length - 1; i >= 0; i--) {
+            activeStack.push(node.children[i]);
+          }
+        }
+        for (let i = allNodes.length - 1; i >= 0; i--) {
+          const node = allNodes[i];
           let has = activePathIds.has(node.entry.id);
           for (const child of node.children) {
-            if (markActive(child)) has = true;
+            if (containsActive.get(child)) has = true;
           }
           containsActive.set(node, has);
-          return has;
         }
-        roots.forEach(markActive);
 
         // Stack: [node, indent, justBranched, showConnector, isLast, gutters, isVirtualRootChild]
         const stack = [];

package/src/extensibility/extensions/runner.ts

@@ -179,17 +179,22 @@ export type SwitchSessionHandler = (sessionPath: string) => Promise<{ cancelled:
 export type ShutdownHandler = () => void;
 
 /**
- * Helper function to emit session_shutdown event to extensions.
- * Returns true if the event was emitted, false if there were no handlers.
+ * Emit `session_shutdown` and clear timers owned by an extension runner.
+ *
+ * Returns whether any shutdown handlers were present. Timer cleanup runs even
+ * when a handler fails so extension background work cannot outlive its host.
  */
 export async function emitSessionShutdownEvent(extensionRunner: ExtensionRunner | undefined): Promise<boolean> {
-	if (extensionRunner?.hasHandlers("session_shutdown")) {
+	if (!extensionRunner) return false;
+	try {
+		if (!extensionRunner.hasHandlers("session_shutdown")) return false;
 		await extensionRunner.emit({
 			type: "session_shutdown",
 		});
 		return true;
+	} finally {
+		extensionRunner.clearManagedTimers();
 	}
-	return false;
 }
 
 const noOpUIContext: ExtensionUIContext = {

package/src/extensibility/extensions/types.ts

@@ -543,6 +543,9 @@ export interface ToolDefinition<TParams extends TSchema = TSchema, TDetails = un
 	/** Tool approval tier. Defaults to `"exec"` when omitted.
 	 *  `"read"`: read-only operations. `"write"`: mutations. `"exec"`: code execution. */
 	approval?: ToolApproval;
+	/** Structured-output strict grammar opt-in/out. `false` is meaningful: OpenAI-family
+	 *  serializers preserve an explicit `strict: false` on the wire (#4336/#4340). */
+	strict?: boolean;
 	/** MCP server name for discovery/search metadata when this tool fronts an MCP server. */
 	mcpServerName?: string;
 	/** Original MCP tool name for discovery/search metadata. */

package/src/extensibility/typebox.ts

@@ -17,7 +17,7 @@
  * like a small validator at runtime.
  */
 
-import { areJsonValuesEqual } from "@oh-my-pi/pi-ai/utils/schema";
+import { areJsonValuesEqual, upgradeJsonSchemaTo202012, validateJsonSchemaValue } from "@oh-my-pi/pi-ai/utils/schema";
 
 // ---------------------------------------------------------------------------
 // Type aliases — exported so `import type { Static, TSchema } from "..."`
@@ -41,6 +41,8 @@ export type TOptional<_E extends ArkSchema> = ArkSchema;
 export type TUnion<_T extends readonly ArkSchema[] = readonly ArkSchema[]> = ArkSchema;
 export type TEnum<_T extends readonly (string | number)[] = readonly (string | number)[]> = ArkSchema;
 export type TRecord<_K extends ArkSchema, _V extends ArkSchema> = ArkSchema;
+/** TypeBox-compatible wrapper for raw JSON Schema documents. */
+export type TUnsafe<_T = unknown> = ArkSchema;
 
 // ---------------------------------------------------------------------------
 // ArkSchema wrapper — JSON Schema object with hidden validator metadata
@@ -560,18 +562,14 @@ function tNull(opts?: Meta): ArkSchema {
 	return applyMeta(createArkSchema(validator, { type: "null" }), opts);
 }
 
+const identityValidator = (data: unknown): unknown => data;
+
 function tAny(opts?: Meta): ArkSchema {
-	return applyMeta(
-		createArkSchema((data: unknown) => data, {}),
-		opts,
-	);
+	return applyMeta(createArkSchema(identityValidator, {}), opts);
 }
 
 function tUnknown(opts?: Meta): ArkSchema {
-	return applyMeta(
-		createArkSchema((data: unknown) => data, {}),
-		opts,
-	);
+	return applyMeta(createArkSchema(identityValidator, {}), opts);
 }
 
 function tNever(opts?: Meta): ArkSchema {
@@ -920,6 +918,21 @@ export const Type = {
 	Null: tNull,
 	Any: tAny,
 	Unknown: tUnknown,
+	Unsafe<T = unknown>(jsonSchema: Record<string, unknown> = {}): TUnsafe<T> {
+		// Validate against the same draft-2020-12 upgrade the wire/tool-call
+		// path applies, so legacy draft-07 documents (tuple `items`, etc.)
+		// behave identically in `safeParse` and `validateToolArguments`.
+		const upgradedSchema = upgradeJsonSchemaTo202012(jsonSchema);
+		const validator = (data: unknown): unknown => {
+			const result = validateJsonSchemaValue(upgradedSchema, data);
+			if (result.success) return data;
+			const messages = result.issues.map(issue =>
+				issue.path.length > 0 ? `${issue.path.join(".")}: ${issue.message}` : issue.message,
+			);
+			return validationFailure(messages.join("; ") || "Invalid value");
+		};
+		return createArkSchema(validator, jsonSchema);
+	},
 	Never: tNever,
 	Literal: tLiteral,
 	Union: tUnion,

package/src/hindsight/client.test.ts

@@ -31,3 +31,45 @@ describe("HindsightApi fetch cancellation", () => {
 		expect(requestSignal?.reason).toBe(caller.signal.reason);
 	});
 });
+
+describe("HindsightApi per-op timeouts", () => {
+	afterEach(() => {
+		vi.restoreAllMocks();
+	});
+
+	it("reports the effective per-op deadline in the timeout error", async () => {
+		vi.spyOn(globalThis, "fetch").mockImplementation(
+			Object.assign(
+				async (): Promise<Response> => {
+					throw new DOMException("The operation timed out.", "TimeoutError");
+				},
+				{ preconnect: globalThis.fetch.preconnect },
+			),
+		);
+
+		const client = new HindsightApi({
+			baseUrl: "https://hindsight.example",
+			timeouts: { reflect: 90_000, recall: 15_000 },
+		});
+
+		await expect(client.reflect("bank", "q")).rejects.toThrow("reflect request timed out after 90s");
+		await expect(client.recall("bank", "q")).rejects.toThrow("recall request timed out after 15s");
+	});
+
+	it("falls back to the client request default for ops without an override", async () => {
+		vi.spyOn(globalThis, "fetch").mockImplementation(
+			Object.assign(
+				async (): Promise<Response> => {
+					throw new DOMException("The operation timed out.", "TimeoutError");
+				},
+				{ preconnect: globalThis.fetch.preconnect },
+			),
+		);
+		const client = new HindsightApi({
+			baseUrl: "https://hindsight.example",
+			timeouts: { request: 45_000 },
+		});
+
+		await expect(client.createBank("bank")).rejects.toThrow("createBank request timed out after 45s");
+	});
+});

package/src/hindsight/client.ts

@@ -13,17 +13,32 @@ import type { HindsightConfig } from "./config";
 
 const USER_AGENT = "oh-my-pi-coding-agent";
 const DEFAULT_USER_AGENT = USER_AGENT;
-const HINDSIGHT_REQUEST_TIMEOUT_MS = 30_000;
+/** Fallback deadlines (ms) applied when the caller supplies no override. */
+const DEFAULT_REQUEST_TIMEOUT_MS = 30_000;
+const DEFAULT_REFLECT_TIMEOUT_MS = 120_000;
+const DEFAULT_RECALL_TIMEOUT_MS = 30_000;
+const DEFAULT_RETAIN_TIMEOUT_MS = 60_000;
 
 export type Budget = "low" | "mid" | "high" | string;
 export type TagsMatch = "any" | "all" | "any_strict" | "all_strict";
 export type UpdateMode = "replace" | "append";
 export type ConsolidationState = "failed" | "pending" | "done";
 
+/** Per-operation request deadlines (ms). Each falls back to a built-in default. */
+export interface HindsightTimeouts {
+	/** Default deadline for ops without a specific override. */
+	request?: number;
+	reflect?: number;
+	recall?: number;
+	retain?: number;
+}
+
 export interface HindsightApiOptions {
 	baseUrl: string;
 	apiKey?: string;
 	userAgent?: string;
+	/** Per-op deadlines; unset entries fall back to built-in defaults. */
+	timeouts?: HindsightTimeouts;
 }
 
 /** Caller cancellation shared by Hindsight request option bags. */
@@ -216,11 +231,17 @@ interface RequestOptions {
 	/** Return null instead of throwing on a 404 response. */
 	allow404?: boolean;
 	signal?: AbortSignal;
+	/** Op deadline (ms); defaults to the client's request timeout. */
+	timeoutMs?: number;
 }
 
 export class HindsightApi {
 	#baseUrl: string;
 	#headers: Record<string, string>;
+	#reflectTimeoutMs: number;
+	#recallTimeoutMs: number;
+	#retainTimeoutMs: number;
+	#requestTimeoutMs: number;
 
 	constructor(options: HindsightApiOptions) {
 		this.#baseUrl = options.baseUrl.replace(/\/+$/, "");
@@ -231,6 +252,11 @@ export class HindsightApi {
 		if (options.apiKey) {
 			this.#headers.Authorization = `Bearer ${options.apiKey}`;
 		}
+		const timeouts = options.timeouts;
+		this.#requestTimeoutMs = timeouts?.request ?? DEFAULT_REQUEST_TIMEOUT_MS;
+		this.#reflectTimeoutMs = timeouts?.reflect ?? DEFAULT_REFLECT_TIMEOUT_MS;
+		this.#recallTimeoutMs = timeouts?.recall ?? DEFAULT_RECALL_TIMEOUT_MS;
+		this.#retainTimeoutMs = timeouts?.retain ?? DEFAULT_RETAIN_TIMEOUT_MS;
 	}
 
 	async retain(bankId: string, content: string, options?: RetainOptions): Promise<RetainResponse> {
@@ -251,6 +277,7 @@ export class HindsightApi {
 			{
 				body: { items: [item], async: options?.async },
 				signal: options?.signal,
+				timeoutMs: this.#retainTimeoutMs,
 			},
 		);
 	}
@@ -282,6 +309,7 @@ export class HindsightApi {
 					async: options?.async,
 				},
 				signal: options?.signal,
+				timeoutMs: this.#retainTimeoutMs,
 			},
 		);
 	}
@@ -301,6 +329,7 @@ export class HindsightApi {
 					tags_match: options?.tagsMatch,
 				},
 				signal: options?.signal,
+				timeoutMs: this.#recallTimeoutMs,
 			},
 		);
 	}
@@ -319,6 +348,7 @@ export class HindsightApi {
 					tags_match: options?.tagsMatch,
 				},
 				signal: options?.signal,
+				timeoutMs: this.#reflectTimeoutMs,
 			},
 		);
 	}
@@ -506,10 +536,11 @@ export class HindsightApi {
 			if (qs) url += `?${qs}`;
 		}
 
+		const timeoutMs = opts?.timeoutMs ?? this.#requestTimeoutMs;
 		const init: RequestInit = {
 			method,
 			headers: this.#headers,
-			signal: withTimeoutSignal(HINDSIGHT_REQUEST_TIMEOUT_MS, opts?.signal),
+			signal: withTimeoutSignal(timeoutMs, opts?.signal),
 		};
 		if (opts?.body !== undefined) {
 			init.body = JSON.stringify(pruneUndefined(opts.body));
@@ -520,7 +551,7 @@ export class HindsightApi {
 			response = await fetch(url, init);
 		} catch (err) {
 			const message = isTimeoutError(err)
-				? `${operation} request timed out after 30s`
+				? `${operation} request timed out after ${Math.round(timeoutMs / 1000)}s`
 				: `${operation} request failed: ${err instanceof Error ? err.message : String(err)}`;
 			throw new HindsightError(message, undefined, err);
 		}
@@ -639,5 +670,11 @@ export function createHindsightClient(config: HindsightConfig & { hindsightApiUr
 		baseUrl: config.hindsightApiUrl,
 		apiKey: config.hindsightApiToken ?? undefined,
 		userAgent: USER_AGENT,
+		timeouts: {
+			request: config.requestTimeoutMs,
+			reflect: config.reflectTimeoutMs,
+			recall: config.recallTimeoutMs,
+			retain: config.retainTimeoutMs,
+		},
 	});
 }

package/src/hindsight/config.ts

@@ -42,6 +42,15 @@ export interface HindsightConfig {
 
 	debug: boolean;
 
+	/** Default per-request client deadline (ms) for ops without a specific override. */
+	requestTimeoutMs: number;
+	/** Client deadline (ms) for reflect (agentic synthesis; costlier than a metadata fetch). */
+	reflectTimeoutMs: number;
+	/** Client deadline (ms) for recall. */
+	recallTimeoutMs: number;
+	/** Client deadline (ms) for retain / retainBatch. */
+	retainTimeoutMs: number;
+
 	mentalModelsEnabled: boolean;
 	mentalModelAutoSeed: boolean;
 	mentalModelRefreshIntervalMs: number;
@@ -115,6 +124,10 @@ export function loadHindsightConfig(settings: Settings, env: NodeJS.ProcessEnv =
 	const recallContextTurnsEnv = envInt(env.HINDSIGHT_RECALL_CONTEXT_TURNS);
 	const recallMaxQueryCharsEnv = envInt(env.HINDSIGHT_RECALL_MAX_QUERY_CHARS);
 	const retainEveryNTurnsEnv = envInt(env.HINDSIGHT_RETAIN_EVERY_N_TURNS);
+	const requestTimeoutMsEnv = envInt(env.HINDSIGHT_REQUEST_TIMEOUT_MS);
+	const reflectTimeoutMsEnv = envInt(env.HINDSIGHT_REFLECT_TIMEOUT_MS);
+	const recallTimeoutMsEnv = envInt(env.HINDSIGHT_RECALL_TIMEOUT_MS);
+	const retainTimeoutMsEnv = envInt(env.HINDSIGHT_RETAIN_TIMEOUT_MS);
 
 	// Read from settings (each falls back to its schema default).
 	const settingsRetainMode = pickRetainMode(settings.get("hindsight.retainMode"));
@@ -158,6 +171,11 @@ export function loadHindsightConfig(settings: Settings, env: NodeJS.ProcessEnv =
 
 		debug: debugEnv ?? settings.get("hindsight.debug"),
 
+		requestTimeoutMs: requestTimeoutMsEnv ?? settings.get("hindsight.requestTimeoutMs"),
+		reflectTimeoutMs: reflectTimeoutMsEnv ?? settings.get("hindsight.reflectTimeoutMs"),
+		recallTimeoutMs: recallTimeoutMsEnv ?? settings.get("hindsight.recallTimeoutMs"),
+		retainTimeoutMs: retainTimeoutMsEnv ?? settings.get("hindsight.retainTimeoutMs"),
+
 		mentalModelsEnabled: settings.get("hindsight.mentalModelsEnabled"),
 		mentalModelAutoSeed: settings.get("hindsight.mentalModelAutoSeed"),
 		mentalModelRefreshIntervalMs: settings.get("hindsight.mentalModelRefreshIntervalMs"),

package/src/launch/broker.ts

@@ -491,8 +491,17 @@ class DaemonBroker {
 		await this.#launch(record);
 		let readyTimedOut = false;
 		if (spec.ready && !terminalState(record.snapshot.state)) {
-			const ready = await this.#waitUntil(record, () => record.snapshot.state === "ready", spec.ready.timeoutMs);
-			readyTimedOut = !ready && !terminalState(record.snapshot.state);
+			// Wake on the sticky readyAt marker or any terminal state, not the live
+			// state: a fast process flips starting→ready→exited within one poll
+			// interval, so sampling `state === "ready"` never observes readiness even
+			// though #markReady durably recorded readyAt. A pre-ready exit must also
+			// wake the wait rather than block for the full timeout.
+			const ready = await this.#waitUntil(
+				record,
+				() => record.snapshot.readyAt !== undefined || terminalState(record.snapshot.state),
+				spec.ready.timeoutMs,
+			);
+			readyTimedOut = !ready;
 		}
 		await record.persistQueue;
 		return { op: "start", daemon: record.snapshot, readyTimedOut };
@@ -748,6 +757,11 @@ class DaemonBroker {
 			const uptime = Date.now() - record.snapshot.startedAt;
 			record.consecutiveFailures = uptime >= 30_000 ? 0 : record.consecutiveFailures + 1;
 			record.snapshot.restartCount++;
+			// Readiness belongs to the exited generation; clear it before the backoff
+			// so start / for:"ready" waits don't treat a dead service as ready during
+			// the restart window (readyAt is re-set by #launch once the child is up).
+			record.snapshot.readyAt = undefined;
+			record.snapshot.readyMatch = undefined;
 			record.snapshot.state = "restarting";
 			const delay = Math.min(1_000 * 2 ** Math.min(record.consecutiveFailures, 5), RESTART_MAX_DELAY_MS);
 			record.log?.append(
@@ -812,6 +826,12 @@ class DaemonBroker {
 				throw new Error(`Invalid wait regex: ${error instanceof Error ? error.message : String(error)}`);
 			}
 		}
+		// Readiness was actually observed: the sticky readyAt survives a fast
+		// ready→exit, a live "ready" state, or a "running" daemon with no ready spec.
+		const readyObserved = (): boolean =>
+			record.snapshot.readyAt !== undefined ||
+			record.snapshot.state === "ready" ||
+			(record.snapshot.state === "running" && !record.spec.ready);
 		const condition = (): boolean => {
 			if (pattern) {
 				const match = pattern.exec(record.readinessBuffer);
@@ -820,10 +840,16 @@ class DaemonBroker {
 				return true;
 			}
 			if (operation.for === "exit") return terminalState(record.snapshot.state);
-			return record.snapshot.state === "ready" || (record.snapshot.state === "running" && !record.spec.ready);
+			// Wake on observed readiness or any terminal state so the wait never
+			// blocks for the full timeout; success is judged by readyObserved below.
+			return readyObserved() || terminalState(record.snapshot.state);
 		};
-		const reached = condition() || (await this.#waitUntil(record, condition, operation.timeoutMs));
-		return { op: "wait", daemon: record.snapshot, matched, timedOut: !reached };
+		const woke = condition() || (await this.#waitUntil(record, condition, operation.timeoutMs));
+		// A for:"ready" wait that woke on a terminal exit without ever observing
+		// readiness is still "not ready" — surface it as timed out so callers and the
+		// renderer don't chain work against a dead process.
+		const timedOut = operation.for === "ready" && !pattern ? !readyObserved() : !woke;
+		return { op: "wait", daemon: record.snapshot, matched, timedOut };
 	}
 
 	async #send(operation: Extract<DaemonOperation, { op: "send" }>): Promise<DaemonRpcResult> {

package/src/lsp/index.ts

@@ -1565,7 +1565,7 @@ export class LspTool implements AgentTool<typeof lspSchema, LspToolDetails, Them
 		_context?: AgentToolContext,
 	): Promise<AgentToolResult<LspToolDetails>> {
 		const { action, file, line, symbol, query, new_name, apply, timeout } = params;
-		const timeoutSec = clampTimeout("lsp", timeout);
+		const timeoutSec = clampTimeout("lsp", timeout, this.session.settings.get("tools.maxTimeout"));
 		const timeoutSignal = AbortSignal.timeout(timeoutSec * 1000);
 		const callerSignal = signal;
 		signal = callerSignal ? AbortSignal.any([callerSignal, timeoutSignal]) : timeoutSignal;