@open-agent-toolkit/cli 0.2.23 → 0.2.24

package/assets/docs/cli-utilities/workflow-gates.md

@@ -717,8 +717,21 @@ Each liveness tick keeps stdout-idle time and also reports `processAlive` plus
 the latest metadata-only transcript activity as `lastActivityEvidence` when
 available. The probe performs bounded depth-two traversal and compares newest
 mtime plus total size with its spawn baseline. It never reads transcript
-contents, never extends a budget, and never changes pass/fail or receive
-eligibility.
+contents and never changes pass/fail or receive eligibility.
+
+When the hard timeout fires, OAT stops periodic liveness ticks, sends `SIGTERM`,
+schedules the existing `SIGKILL` fallback, and then starts one final transcript
+observation with the timeout timestamp. Once the child closes, result resolution
+waits no longer than the one-second observation grace and does not delay either
+signal. A final sample available before result resolution supersedes older
+in-flight periodic work; otherwise OAT retains the latest valid periodic
+evidence.
+
+On a normal child close, OAT waits within the same one-second grace only when a
+periodic transcript observation is already in flight. This preserves late
+evidence but can add up to one second to an otherwise successful execution. The
+one-second observation grace and five-second force-kill fallback are fixed
+safety bounds, not environment-tunable settings.
 
 Claude and Cursor evidence has `scope: project-dir`. Codex's date-sharded
 sessions directory is shared across the runtime, so its evidence has
@@ -726,7 +739,18 @@ sessions directory is shared across the runtime, so its evidence has
 attributable to this gate child).” Probe errors fail soft to process and stdout
 telemetry.
 
-Timeout and child-failure envelopes include the latest `activityEvidence`.
+Timeout and child-failure JSON envelopes include the latest `activityEvidence`.
+For human timeout and non-refusal child-failure output, OAT prints a second line
+with this shape:
+
+```text
+Activity evidence: <runtime> <project|ambient> transcript metadata <changed|did not change> since baseline; observed <milliseconds>ms ago; latest transcript change was <milliseconds>ms before observation.
+```
+
+When the evidence scope is ambient, the line ends with `This activity is not
+attributable to this gate child.` Structured refusals omit the extra human
+diagnostic because the refusal itself explains why execution stopped.
+
 Before spawn, the gate also writes a transient marker under the system temp
 directory at `oat-gate-runs/<runId>.json`; startup diagnostics print its path.
 The marker records target, runtime, project, review type/scope, start time,

package/assets/public-package-versions.json

@@ -1,6 +1,6 @@
 {
-  "cli": "0.2.23",
-  "docs-config": "0.2.23",
-  "docs-theme": "0.2.23",
-  "docs-transforms": "0.2.23"
+  "cli": "0.2.24",
+  "docs-config": "0.2.24",
+  "docs-theme": "0.2.24",
+  "docs-transforms": "0.2.24"
 }

package/dist/commands/gate/child-process.d.ts

@@ -0,0 +1,32 @@
+import type { GateActivityEvidence, GateActivityProbe, GateActivityProbeStatus } from './activity-probes.js';
+export interface ProcessRunOptions {
+    activityProbe?: GateActivityProbe;
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    livenessIntervalMs?: number;
+    onLiveness?: (snapshot: GateLivenessSnapshot) => void;
+    purpose: 'host-detection' | 'availability' | 'execute';
+    stdin: 'ignore' | 'inherit';
+    stdio: 'ignore' | 'inherit' | 'pipe';
+    stdoutDestination?: 'stdout' | 'stderr';
+    timeoutMs: number;
+}
+export interface ProcessRunResult {
+    activityEvidence?: GateActivityEvidence;
+    exitCode: number;
+    refusal?: string;
+    stderrBytes: number;
+    stdoutBytes: number;
+    timedOut?: boolean;
+}
+export interface GateLivenessSnapshot {
+    elapsedMs: number;
+    hardBudgetMs: number;
+    idleMs: number;
+    processAlive: boolean;
+    activityProbeStatus?: GateActivityProbeStatus;
+    lastActivityEvidence?: GateActivityEvidence;
+}
+export declare function runChildProcess(command: string, args: string[], options: ProcessRunOptions): Promise<ProcessRunResult>;
+export declare function extractStructuredRefusal(output: string): string | undefined;
+//# sourceMappingURL=child-process.d.ts.map

package/dist/commands/gate/child-process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"child-process.d.ts","sourceRoot":"","sources":["../../../src/commands/gate/child-process.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EACV,oBAAoB,EACpB,iBAAiB,EACjB,uBAAuB,EACxB,MAAM,mBAAmB,CAAC;AAS3B,MAAM,WAAW,iBAAiB;IAChC,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACtD,OAAO,EAAE,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAAC;IACvD,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IACrC,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,gBAAgB;IAC/B,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,oBAAoB;IACnC,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED,wBAAsB,eAAe,CACnC,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,iBAAiB,GACzB,OAAO,CAAC,gBAAgB,CAAC,CAgN3B;AAED,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG3E"}

package/dist/commands/gate/child-process.js

@@ -0,0 +1,210 @@
+import { spawn } from 'node:child_process';
+// Keep these safety bounds fixed rather than environment-tunable. In particular,
+// changing the force-kill fallback would alter the hard-timeout contract.
+// Revisit the observation grace only if field evidence shows large transcript
+// directories routinely exceed it.
+const FORCE_KILL_GRACE_MS = 5_000;
+const ACTIVITY_OBSERVATION_GRACE_MS = 1_000;
+export async function runChildProcess(command, args, options) {
+    return new Promise((resolve, reject) => {
+        let timedOut = false;
+        let suppressLiveness = false;
+        let killTimeout = null;
+        let stderrBytes = 0;
+        let stdoutBytes = 0;
+        let refusal;
+        let stdoutLineBuffer = '';
+        let stderrLineBuffer = '';
+        let latestActivityEvidence;
+        let latestActivityProbeStatus;
+        let activityObservationSequence = 0;
+        let latestActivityEvidenceSequence = 0;
+        let livenessProbePending = false;
+        let pendingPeriodicObservation;
+        let finalActivityObservation;
+        const startedAt = Date.now();
+        let lastActivityAt = startedAt;
+        const child = spawn(command, args, {
+            cwd: options.cwd,
+            env: options.env,
+            stdio: options.stdio === 'pipe'
+                ? [options.stdin, 'pipe', 'pipe']
+                : options.stdio,
+        });
+        const recordActivity = () => {
+            lastActivityAt = Date.now();
+        };
+        const scanChunk = (buffer, chunk) => {
+            const combined = buffer + chunk.toString('utf8');
+            const lines = combined.split('\n');
+            const remainder = lines.pop() ?? '';
+            if (!refusal) {
+                for (const line of lines) {
+                    refusal = extractStructuredRefusal(line.replace(/\r$/, ''));
+                    if (refusal) {
+                        break;
+                    }
+                }
+            }
+            return remainder;
+        };
+        child.stdout?.on('data', (chunk) => {
+            stdoutBytes += chunk.byteLength;
+            stdoutLineBuffer = scanChunk(stdoutLineBuffer, chunk);
+            recordActivity();
+            const destination = options.stdoutDestination === 'stderr'
+                ? process.stderr
+                : process.stdout;
+            destination.write(chunk);
+        });
+        child.stderr?.on('data', (chunk) => {
+            stderrBytes += chunk.byteLength;
+            stderrLineBuffer = scanChunk(stderrLineBuffer, chunk);
+            recordActivity();
+            process.stderr.write(chunk);
+        });
+        const processAlive = () => {
+            if (child.pid === undefined)
+                return false;
+            try {
+                process.kill(child.pid, 0);
+                return true;
+            }
+            catch {
+                return false;
+            }
+        };
+        const observeActivity = async (observedAt) => {
+            if (!options.activityProbe)
+                return undefined;
+            const sequence = ++activityObservationSequence;
+            try {
+                const activityProbeStatus = await options.activityProbe.observe(observedAt);
+                const evidence = activityProbeStatus.evidence;
+                if (evidence && sequence > latestActivityEvidenceSequence) {
+                    latestActivityEvidence = evidence;
+                    latestActivityEvidenceSequence = sequence;
+                }
+                return activityProbeStatus;
+            }
+            catch {
+                // Activity evidence is diagnostic only. Preserve the last valid sample.
+                return undefined;
+            }
+        };
+        const settleWithinActivityGrace = (observation) => new Promise((resolveObservation) => {
+            // Keep this timer referenced so a closed child cannot end the process
+            // before the bounded diagnostic observation settles.
+            const graceTimeout = setTimeout(resolveObservation, ACTIVITY_OBSERVATION_GRACE_MS);
+            const settle = () => {
+                clearTimeout(graceTimeout);
+                resolveObservation();
+            };
+            void observation.then(settle, settle);
+        });
+        const livenessInterval = options.onLiveness && options.livenessIntervalMs
+            ? setInterval(() => {
+                if (livenessProbePending)
+                    return;
+                livenessProbePending = true;
+                const now = Date.now();
+                const observation = (async () => {
+                    const activityProbeStatus = await observeActivity(now);
+                    if (activityProbeStatus) {
+                        latestActivityProbeStatus = activityProbeStatus;
+                    }
+                    if (suppressLiveness)
+                        return;
+                    options.onLiveness?.({
+                        elapsedMs: now - startedAt,
+                        hardBudgetMs: options.timeoutMs,
+                        idleMs: now - lastActivityAt,
+                        processAlive: processAlive(),
+                        ...(latestActivityProbeStatus
+                            ? { activityProbeStatus: latestActivityProbeStatus }
+                            : {}),
+                        ...(latestActivityEvidence
+                            ? { lastActivityEvidence: latestActivityEvidence }
+                            : {}),
+                    });
+                })();
+                pendingPeriodicObservation = observation;
+                const clearPending = () => {
+                    if (pendingPeriodicObservation === observation) {
+                        pendingPeriodicObservation = undefined;
+                    }
+                    livenessProbePending = false;
+                };
+                void observation.then(clearPending, clearPending);
+            }, options.livenessIntervalMs)
+            : null;
+        livenessInterval?.unref();
+        const timeout = setTimeout(() => {
+            timedOut = true;
+            suppressLiveness = true;
+            if (livenessInterval) {
+                clearInterval(livenessInterval);
+            }
+            child.kill('SIGTERM');
+            killTimeout = setTimeout(() => {
+                child.kill('SIGKILL');
+            }, FORCE_KILL_GRACE_MS);
+            killTimeout.unref();
+            finalActivityObservation = observeActivity(Date.now());
+        }, options.timeoutMs);
+        timeout.unref();
+        child.on('error', (error) => {
+            clearTimeout(timeout);
+            if (livenessInterval) {
+                clearInterval(livenessInterval);
+            }
+            if (killTimeout) {
+                clearTimeout(killTimeout);
+            }
+            reject(error);
+        });
+        child.on('close', (code) => {
+            suppressLiveness = true;
+            clearTimeout(timeout);
+            if (livenessInterval) {
+                clearInterval(livenessInterval);
+            }
+            if (killTimeout) {
+                clearTimeout(killTimeout);
+            }
+            void (async () => {
+                if (finalActivityObservation) {
+                    const periodicObservation = pendingPeriodicObservation;
+                    const finalThenFallback = finalActivityObservation.then(async (activityProbeStatus) => {
+                        if (!activityProbeStatus?.evidence && periodicObservation) {
+                            await periodicObservation;
+                        }
+                    });
+                    await settleWithinActivityGrace(finalThenFallback);
+                }
+                else if (pendingPeriodicObservation) {
+                    // Preserve evidence already in flight on a normal close. This can add
+                    // up to the bounded grace to an otherwise successful execution.
+                    await settleWithinActivityGrace(pendingPeriodicObservation);
+                }
+                refusal ??=
+                    extractStructuredRefusal(stdoutLineBuffer.replace(/\r$/, '')) ??
+                        extractStructuredRefusal(stderrLineBuffer.replace(/\r$/, ''));
+                resolve({
+                    ...(latestActivityEvidence
+                        ? { activityEvidence: latestActivityEvidence }
+                        : {}),
+                    exitCode: timedOut ? 124 : (code ?? 1),
+                    ...(refusal ? { refusal } : {}),
+                    stderrBytes,
+                    stdoutBytes,
+                    ...(timedOut ? { timedOut: true } : {}),
+                });
+            })();
+        });
+    });
+}
+export function extractStructuredRefusal(output) {
+    const match = output.match(/^OAT_GATE_REFUSAL: (.*)$/m);
+    return match?.[1]?.replace(/\r$/, '');
+}

package/dist/commands/gate/index.d.ts

@@ -5,8 +5,9 @@ import { type ResolvedConfig } from '../../config/resolve.js';
 import { type ModelFamily } from '../../providers/identity/family.js';
 import { type IdentityConfidence, type IdentityProvenance } from '../../providers/identity/provenance.js';
 import { Command } from 'commander';
-import { createGateActivityProbe, type GateActivityEvidence, type GateActivityProbe, type GateActivityProbeStatus } from './activity-probes.js';
+import { createGateActivityProbe } from './activity-probes.js';
 import { createBranchLocalGateCli, currentGateCliLaunch, readGateRouteReceipt, removeBranchLocalGateCli } from './branch-local-cli.js';
+import { type ProcessRunOptions, type ProcessRunResult } from './child-process.js';
 import { parseReviewGateVerdict } from './review-verdict.js';
 interface GateCommandDependencies {
     buildCommandContext: (options: GlobalOptions) => CommandContext;
@@ -31,36 +32,6 @@ interface GateCommandDependencies {
     removeGateRunMarker: (path: string, warn: (message: string) => void) => Promise<void>;
     writeDiagnostic: (message: string) => void;
 }
-interface ProcessRunOptions {
-    activityProbe?: GateActivityProbe;
-    cwd: string;
-    env: NodeJS.ProcessEnv;
-    livenessIntervalMs?: number;
-    onLiveness?: (snapshot: GateLivenessSnapshot) => void;
-    purpose: 'host-detection' | 'availability' | 'execute';
-    stdin: 'ignore' | 'inherit';
-    stdio: 'ignore' | 'inherit' | 'pipe';
-    stdoutDestination?: 'stdout' | 'stderr';
-    timeoutMs: number;
-}
-interface ProcessRunResult {
-    activityEvidence?: GateActivityEvidence;
-    activityProbeStatus?: GateActivityProbeStatus;
-    capturedOutput?: string;
-    exitCode: number;
-    refusal?: string;
-    stderrBytes: number;
-    stdoutBytes: number;
-    timedOut?: boolean;
-}
-interface GateLivenessSnapshot {
-    elapsedMs: number;
-    hardBudgetMs: number;
-    idleMs: number;
-    processAlive: boolean;
-    activityProbeStatus?: GateActivityProbeStatus;
-    lastActivityEvidence?: GateActivityEvidence;
-}
 type GateTimeoutSource = 'cli' | 'target' | 'config' | 'env' | 'scope-default' | 'default';
 interface GateRunMarker {
     runId: string;

package/dist/commands/gate/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/gate/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAShE,OAAO,EAWL,KAAK,UAAU,EAIf,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,UAAU,EAEhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAWzB,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EAExB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,uBAAuB,EACvB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,uBAAuB,EAC7B,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EAEzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,sBAAsB,EAIvB,MAAM,kBAAkB,CAAC;AAG1B,UAAU,uBAAuB;IAC/B,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,cAAc,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,eAAe,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IAC1D,oBAAoB,EAAE,OAAO,oBAAoB,CAAC;IAClD,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IAC1D,oBAAoB,EAAE,OAAO,oBAAoB,CAAC;IAClD,UAAU,EAAE,CACV,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IACtD,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;IAC9B,kBAAkB,EAAE,CAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAC5B,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AA+CD,UAAU,iBAAiB;IACzB,aAAa,CAAC,EAAE,iBAAiB,CAAC;IAClC,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IACvB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,UAAU,CAAC,EAAE,CAAC,QAAQ,EAAE,oBAAoB,KAAK,IAAI,CAAC;IACtD,OAAO,EAAE,gBAAgB,GAAG,cAAc,GAAG,SAAS,CAAC;IACvD,KAAK,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC5B,KAAK,EAAE,QAAQ,GAAG,SAAS,GAAG,MAAM,CAAC;IACrC,iBAAiB,CAAC,EAAE,QAAQ,GAAG,QAAQ,CAAC;IACxC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,UAAU,gBAAgB;IACxB,gBAAgB,CAAC,EAAE,oBAAoB,CAAC;IACxC,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,UAAU,oBAAoB;IAC5B,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,OAAO,CAAC;IACtB,mBAAmB,CAAC,EAAE,uBAAuB,CAAC;IAC9C,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;CAC7C;AAED,KAAK,iBAAiB,GAClB,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,KAAK,GACL,eAAe,GACf,SAAS,CAAC;AAOd,UAAU,aAAa;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AAcD,KAAK,kBAAkB,GAAG,aAAa,GAAG,cAAc,GAAG,MAAM,CAAC;AAClE,KAAK,qBAAqB,GACtB,kBAAkB,GAClB,4BAA4B,GAC5B,2CAA2C,GAC3C,kBAAkB,CAAC;AA4BvB,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,UAAU,oBAAoB;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,kBAAkB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,WAAW,CAAC;IACpB,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,mBAAmB,GAAG,aAAa,GAAG,SAAS,CAAC;CAC5E;AAED,UAAU,qBAAqB;IAC7B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,kBAAkB,CAAC;QAC/B,UAAU,EAAE,kBAAkB,CAAC;QAC/B,MAAM,EAAE,WAAW,CAAC;QACpB,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACvC,aAAa,EAAE,WAAW,EAAE,CAAC;QAC7B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,WAAW,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAu7CD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAC9C,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,kBAAkB,EACzB,gBAAgB,CAAC,EAAE,oBAAoB,GACtC,kBAAkB,GAAG,IAAI,CAS3B;AA49DD,wBAAgB,iBAAiB,CAC/B,SAAS,GAAE,OAAO,CAAC,uBAAuB,CAAM,GAC/C,OAAO,CA4NT"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/commands/gate/index.ts"],"names":[],"mappings":"AAMA,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,gBAAgB,EAAE,MAAM,8BAA8B,CAAC;AAShE,OAAO,EAWL,KAAK,UAAU,EAIf,KAAK,SAAS,EACd,KAAK,cAAc,EACnB,KAAK,UAAU,EAEhB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAKL,KAAK,cAAc,EACpB,MAAM,iBAAiB,CAAC;AAWzB,OAAO,EAEL,KAAK,WAAW,EACjB,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAEL,KAAK,kBAAkB,EACvB,KAAK,kBAAkB,EAExB,MAAM,gCAAgC,CAAC;AAExC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGpC,OAAO,EACL,uBAAuB,EAExB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,wBAAwB,EACxB,oBAAoB,EACpB,oBAAoB,EACpB,wBAAwB,EAEzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAEL,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACtB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,sBAAsB,EAIvB,MAAM,kBAAkB,CAAC;AAG1B,UAAU,uBAAuB;IAC/B,mBAAmB,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,cAAc,CAAC;IAChE,kBAAkB,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;IACrD,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,SAAS,CAAC,CAAC;IACxD,cAAc,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACvE,kBAAkB,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,cAAc,CAAC,CAAC;IAClE,mBAAmB,EAAE,CACnB,QAAQ,EAAE,MAAM,EAChB,MAAM,EAAE,cAAc,KACnB,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,cAAc,EAAE,CAAC,aAAa,EAAE,MAAM,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;IAC/D,eAAe,EAAE,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9E,sBAAsB,EAAE,CACtB,QAAQ,EAAE,MAAM,EAChB,aAAa,EAAE,MAAM,EACrB,GAAG,EAAE,MAAM,CAAC,UAAU,KACnB,OAAO,CAAC,cAAc,CAAC,CAAC;IAC7B,uBAAuB,EAAE,OAAO,uBAAuB,CAAC;IACxD,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IAC1D,oBAAoB,EAAE,OAAO,oBAAoB,CAAC;IAClD,wBAAwB,EAAE,OAAO,wBAAwB,CAAC;IAC1D,oBAAoB,EAAE,OAAO,oBAAoB,CAAC;IAClD,UAAU,EAAE,CACV,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE,iBAAiB,KACvB,OAAO,CAAC,gBAAgB,CAAC,CAAC;IAC/B,sBAAsB,EAAE,OAAO,sBAAsB,CAAC;IACtD,gBAAgB,EAAE,OAAO,gBAAgB,CAAC;IAC1C,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;IAC9B,kBAAkB,EAAE,CAClB,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,aAAa,EACrB,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAC5B,OAAO,CAAC,OAAO,CAAC,CAAC;IACtB,mBAAmB,EAAE,CACnB,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,KAC5B,OAAO,CAAC,IAAI,CAAC,CAAC;IACnB,eAAe,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CAC5C;AA+CD,KAAK,iBAAiB,GAClB,KAAK,GACL,QAAQ,GACR,QAAQ,GACR,KAAK,GACL,eAAe,GACf,SAAS,CAAC;AAOd,UAAU,aAAa;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,iBAAiB,CAAC;CACjC;AAcD,KAAK,kBAAkB,GAAG,aAAa,GAAG,cAAc,GAAG,MAAM,CAAC;AAClE,KAAK,qBAAqB,GACtB,kBAAkB,GAClB,4BAA4B,GAC5B,2CAA2C,GAC3C,kBAAkB,CAAC;AA4BvB,MAAM,WAAW,kBAAkB;IACjC,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,UAAU,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,WAAW,CAAC;IACpB,SAAS,CAAC,EAAE,qBAAqB,CAAC;IAClC,uBAAuB,CAAC,EAAE,OAAO,CAAC;CACnC;AAED,UAAU,oBAAoB;IAC5B,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,kBAAkB,CAAC;IAC/B,UAAU,EAAE,kBAAkB,CAAC;IAC/B,MAAM,EAAE,WAAW,CAAC;IACpB,aAAa,EAAE,WAAW,EAAE,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,kBAAkB,EAAE,OAAO,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,mBAAmB,GAAG,aAAa,GAAG,SAAS,CAAC;CAC5E;AAED,UAAU,qBAAqB;IAC7B,KAAK,EAAE,kBAAkB,CAAC;IAC1B,QAAQ,EAAE,qBAAqB,CAAC;IAChC,QAAQ,EAAE;QACR,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,kBAAkB,CAAC;QAC/B,UAAU,EAAE,kBAAkB,CAAC;QAC/B,MAAM,EAAE,WAAW,CAAC;QACpB,MAAM,EAAE,oBAAoB,CAAC,QAAQ,CAAC,CAAC;QACvC,aAAa,EAAE,WAAW,EAAE,CAAC;QAC7B,kBAAkB,CAAC,EAAE,MAAM,EAAE,CAAC;QAC9B,sBAAsB,CAAC,EAAE,MAAM,CAAC;KACjC,CAAC;IACF,QAAQ,EAAE;QACR,MAAM,EAAE,MAAM,CAAC;QACf,OAAO,EAAE,MAAM,CAAC;QAChB,MAAM,EAAE,WAAW,CAAC;QACpB,KAAK,CAAC,EAAE,MAAM,CAAC;KAChB,CAAC;IACF,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AA+xCD,wBAAgB,gBAAgB,CAC9B,QAAQ,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,EAC9C,cAAc,EAAE,MAAM,EACtB,KAAK,EAAE,kBAAkB,EACzB,gBAAgB,CAAC,EAAE,oBAAoB,GACtC,kBAAkB,GAAG,IAAI,CAS3B;AAy/DD,wBAAgB,iBAAiB,CAC/B,SAAS,GAAE,OAAO,CAAC,uBAAuB,CAAM,GAC/C,OAAO,CA4NT"}

package/dist/commands/gate/index.js

@@ -1,4 +1,4 @@
-import { execFileSync, spawn } from 'node:child_process';
+import { execFileSync } from 'node:child_process';
 import { createHash, randomUUID } from 'node:crypto';
 import { mkdir, readdir, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
@@ -20,6 +20,7 @@ import { Command } from 'commander';
 import YAML from 'yaml';
 import { createGateActivityProbe, } from './activity-probes.js';
 import { createBranchLocalGateCli, currentGateCliLaunch, readGateRouteReceipt, removeBranchLocalGateCli, } from './branch-local-cli.js';
+import { runChildProcess, } from './child-process.js';
 import { parseReviewGateVerdict, severityDisplayName, } from './review-verdict.js';
 import { createGateRouteCommand } from './route.js';
 const DEFAULT_DEPENDENCIES = {
@@ -75,6 +76,7 @@ const REVIEW_GATE_CONTEXT_NOTE = [
 const GATE_CHECK_TIMEOUT_MS = 5_000;
 const GATE_EXEC_TIMEOUT_MS = 15 * 60 * 1_000;
 const GATE_LIVENESS_INTERVAL_MS = 30_000;
+const AMBIENT_ACTIVITY_ATTRIBUTION = 'not attributable to this gate child';
 async function writeGateRunMarker(path, marker, warn) {
     try {
         await mkdir(join(tmpdir(), 'oat-gate-runs'), { recursive: true });
@@ -239,152 +241,6 @@ function corroborateGateInvocation(expected, actual, targetCorroboration) {
         },
     };
 }
-async function runChildProcess(command, args, options) {
-    return new Promise((resolve, reject) => {
-        let timedOut = false;
-        let killTimeout = null;
-        let stderrBytes = 0;
-        let stdoutBytes = 0;
-        let refusal;
-        let stdoutLineBuffer = '';
-        let stderrLineBuffer = '';
-        let latestActivityEvidence;
-        let latestActivityProbeStatus;
-        let livenessProbePending = false;
-        const startedAt = Date.now();
-        let lastActivityAt = startedAt;
-        const child = spawn(command, args, {
-            cwd: options.cwd,
-            env: options.env,
-            stdio: options.stdio === 'pipe'
-                ? [options.stdin, 'pipe', 'pipe']
-                : options.stdio,
-        });
-        const recordActivity = () => {
-            lastActivityAt = Date.now();
-        };
-        const scanChunk = (buffer, chunk) => {
-            const combined = buffer + chunk.toString('utf8');
-            const lines = combined.split('\n');
-            const remainder = lines.pop() ?? '';
-            if (!refusal) {
-                for (const line of lines) {
-                    refusal = extractStructuredRefusal(line.replace(/\r$/, ''));
-                    if (refusal) {
-                        break;
-                    }
-                }
-            }
-            return remainder;
-        };
-        child.stdout?.on('data', (chunk) => {
-            stdoutBytes += chunk.byteLength;
-            stdoutLineBuffer = scanChunk(stdoutLineBuffer, chunk);
-            recordActivity();
-            const destination = options.stdoutDestination === 'stderr'
-                ? process.stderr
-                : process.stdout;
-            destination.write(chunk);
-        });
-        child.stderr?.on('data', (chunk) => {
-            stderrBytes += chunk.byteLength;
-            stderrLineBuffer = scanChunk(stderrLineBuffer, chunk);
-            recordActivity();
-            process.stderr.write(chunk);
-        });
-        const processAlive = () => {
-            if (child.pid === undefined)
-                return false;
-            try {
-                process.kill(child.pid, 0);
-                return true;
-            }
-            catch {
-                return false;
-            }
-        };
-        const livenessInterval = options.onLiveness && options.livenessIntervalMs
-            ? setInterval(() => {
-                if (livenessProbePending)
-                    return;
-                livenessProbePending = true;
-                const now = Date.now();
-                void (async () => {
-                    const activityProbeStatus = await options.activityProbe?.observe(now);
-                    const evidence = activityProbeStatus?.evidence;
-                    if (activityProbeStatus) {
-                        latestActivityProbeStatus = activityProbeStatus;
-                    }
-                    if (evidence)
-                        latestActivityEvidence = evidence;
-                    options.onLiveness?.({
-                        elapsedMs: now - startedAt,
-                        hardBudgetMs: options.timeoutMs,
-                        idleMs: now - lastActivityAt,
-                        processAlive: processAlive(),
-                        ...(latestActivityProbeStatus
-                            ? { activityProbeStatus: latestActivityProbeStatus }
-                            : {}),
-                        ...(latestActivityEvidence
-                            ? { lastActivityEvidence: latestActivityEvidence }
-                            : {}),
-                    });
-                })().finally(() => {
-                    livenessProbePending = false;
-                });
-            }, options.livenessIntervalMs)
-            : null;
-        livenessInterval?.unref();
-        const timeout = setTimeout(() => {
-            timedOut = true;
-            child.kill('SIGTERM');
-            killTimeout = setTimeout(() => {
-                child.kill('SIGKILL');
-            }, 5_000);
-            killTimeout.unref();
-        }, options.timeoutMs);
-        timeout.unref();
-        child.on('error', (error) => {
-            clearTimeout(timeout);
-            if (livenessInterval) {
-                clearInterval(livenessInterval);
-            }
-            if (killTimeout) {
-                clearTimeout(killTimeout);
-            }
-            reject(error);
-        });
-        child.on('close', (code) => {
-            clearTimeout(timeout);
-            if (livenessInterval) {
-                clearInterval(livenessInterval);
-            }
-            if (killTimeout) {
-                clearTimeout(killTimeout);
-            }
-            refusal ??=
-                extractStructuredRefusal(stdoutLineBuffer.replace(/\r$/, '')) ??
-                    extractStructuredRefusal(stderrLineBuffer.replace(/\r$/, ''));
-            resolve({
-                ...(latestActivityEvidence
-                    ? { activityEvidence: latestActivityEvidence }
-                    : {}),
-                ...(latestActivityProbeStatus
-                    ? { activityProbeStatus: latestActivityProbeStatus }
-                    : {}),
-                exitCode: timedOut ? 124 : (code ?? 1),
-                ...(refusal ? { refusal } : {}),
-                stderrBytes,
-                stdoutBytes,
-                ...(timedOut ? { timedOut: true } : {}),
-            });
-        });
-    });
-}
-function extractStructuredRefusal(output) {
-    const match = output.match(/^OAT_GATE_REFUSAL: (.*)$/m);
-    return match?.[1]?.replace(/\r$/, '');
-}
 function isGateWriteLayer(value) {
     return VALID_WRITE_LAYERS.includes(value);
 }
@@ -1184,7 +1040,7 @@ async function executeTarget(selected, prompt, context, dependencies, timeout) {
                 else {
                     const activityDescription = lastActivityEvidence
                         ? lastActivityEvidence.scope === 'ambient-runtime'
-                            ? 'ambient runtime activity (not attributable to this gate child)'
+                            ? `ambient runtime activity (${AMBIENT_ACTIVITY_ATTRIBUTION})`
                             : 'project-directory activity'
                         : `${activityProbeStatus?.status ?? 'unavailable'} (${activityProbeStatus?.attemptedPath ?? 'no path'})`;
                     context.logger.info(`Gate liveness: target=${selected.id} elapsed_ms=${elapsedMs} idle_ms=${idleMs} hard_budget_ms=${hardBudgetMs} process_alive=${processAlive} activity_evidence=${activityDescription}.`);
@@ -1606,6 +1462,25 @@ function writeReviewGateExecutionFailure(context, payload) {
         return;
     }
     context.logger.error(message);
+    if (payload.activityEvidence && !payload.refusal) {
+        context.logger.error(formatGateActivityEvidenceDiagnostic(payload.activityEvidence));
+    }
+}
+function formatGateActivityEvidenceDiagnostic(evidence, now = Date.now()) {
+    const transcriptScope = evidence.scope === 'ambient-runtime'
+        ? `${evidence.runtime} ambient transcript`
+        : `${evidence.runtime} project transcript`;
+    const baselineState = evidence.changedSinceBaseline
+        ? 'changed since baseline'
+        : 'did not change since baseline';
+    const observedAgoMs = Math.max(0, now - evidence.observedAt);
+    const lastChangeTiming = evidence.lastChangeAt === null
+        ? 'latest transcript change time unavailable'
+        : `latest transcript change was ${Math.max(0, evidence.observedAt - evidence.lastChangeAt)}ms before observation`;
+    const attributionWarning = evidence.scope === 'ambient-runtime'
+        ? ` This activity is ${AMBIENT_ACTIVITY_ATTRIBUTION}.`
+        : '';
+    return `Activity evidence: ${transcriptScope} metadata ${baselineState}; observed ${observedAgoMs}ms ago; ${lastChangeTiming}.${attributionWarning}`;
 }
 function writeReviewGateUnexpectedFailure(context, payload) {
     const message = payload.error instanceof Error
@@ -2085,8 +1960,7 @@ async function runReviewGate(prompt, options, context, dependencies) {
             ...routeReceipt,
         })}\n`);
         const childExitCode = childResult.exitCode;
-        const refusal = childResult.refusal ??
-            extractStructuredRefusal(childResult.capturedOutput ?? '');
+        const refusal = childResult.refusal;
         const writeRefusalFailure = () => {
             if (!refusal) {
                 return false;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-agent-toolkit/cli",
-  "version": "0.2.23",
+  "version": "0.2.24",
   "private": false,
   "description": "Open Agent Toolkit CLI",
   "homepage": "https://github.com/voxmedia/open-agent-toolkit/tree/main/packages/cli",
@@ -34,7 +34,7 @@
     "ora": "^9.0.0",
     "yaml": "2.8.2",
     "zod": "^3.25.76",
-    "@open-agent-toolkit/control-plane": "0.2.23"
+    "@open-agent-toolkit/control-plane": "0.2.24"
   },
   "devDependencies": {
     "@types/node": "^22.10.0",