@prohost/cli 0.12.3 → 0.13.1

package/dist/agent/run.js

@@ -48,6 +48,7 @@ import { DEFAULT_CONCURRENCY, MAX_CONCURRENCY, RunScheduler } from './scheduler.
 import { RUNTIME_STATUS_FEATURE, RuntimeStatusReporter, claudeQuotaProvider, codexConfiguredModel, codexQuotaProvider, modelFromExec, parseVersion, readCodexObservation, } from './runtime_status.js';
 import { SessionStore, sessionKeyFor } from './sessionstore.js';
 import { verifySignature } from './signature.js';
+import { VENUE_RUN_TOKEN_CAPABILITY, apiForRun, claudeSupportsVenueSessions, claudeVenueCommand, VENUE_PROGRESS, VENUE_SESSION_FEATURE, VENUE_SESSION_FRAME, VENUE_SESSION_OPEN_FRAME, VENUE_GRANT_CHECK_MS, VENUE_EXPIRY_MARGIN_MS, VENUE_GRANT_ENDED_ERROR, VENUE_GRANT_EXPIRED_ERROR, isVenueRun, venueEnv, venueGrantLive, venueGrantRemainingMs, venueRunFromSession, venueWorkdir, } from './venue.js';
 import { RUN_REPOS_ENV_VAR, WorktreeManager } from './worktrees.js';
 import { isWebhookEvent } from '../forward.js';
 import { DEFAULT_WS_URL } from '../listen.js';
@@ -108,6 +109,10 @@ export const PAIRED_RUN_ENV_VAR = 'PROHOST_PAIRED_RUN';
 const ACK_ACCEPTED = 200;
 const ACK_IGNORED = 204;
 const ACK_REJECTED = 401;
+/** Received, but the run could not be taken on yet: the server keeps retrying the delivery. */
+const ACK_RETRY = 503;
+/** How long the harness waits for the server to answer a venue-session open. */
+const VENUE_SESSION_TIMEOUT_MS = 30_000;
 function newMetrics() {
     return {
         connections: 0,
@@ -379,6 +384,26 @@ function buildRuntime(options, log) {
         account,
     };
 }
+/**
+ * The preparation a venue run gets in place of {@link HarnessRuntime.prepareMcp}:
+ * the account that runs the brain, and nothing else — see `venue.ts`.
+ *
+ * Fails the run closed on a harness that cannot hold a venue session to that.
+ * The server sends venue runs only to a harness that declared it can, so this
+ * is reached only by a run that should never have arrived.
+ */
+function prepareVenueSession(runtime) {
+    if (runtime.brain !== 'claude' || !runtime.venueSessions || !runtime.account) {
+        return {
+            mcpWired: false,
+            error: "this harness cannot answer in a connected team's thread (it needs a Claude Code with --tools and --safe-mode)",
+        };
+    }
+    const resolved = runtime.account.resolveForSpawn();
+    if (!resolved.ok)
+        return { mcpWired: false, error: resolved.error };
+    return { mcpWired: false, execEnv: runtime.account.spawnEnv(), accountLabel: resolved.record.label };
+}
 /**
  * The `runtime` a status frame names. A plain command is `custom` unless it is
  * recognisably goose — the one other agent CLI people pair today.
@@ -611,7 +636,9 @@ async function runTurn(run, prompt, options, runtime, mcp, control, log,
  */
 toolEvents, 
 /** Harness-set variables for this run's command, over the brain's own. */
-runEnv) {
+runEnv, 
+/** A venue run's own empty working directory; marks the turn as a venue session. */
+venueCwd) {
     // `--timeout` is a ceiling on the run, not on each attempt: the retry below
     // must not let one run take twice what the operator allowed. Both attempts
     // share one deadline, which costs the retry nothing in practice — a rejected
@@ -635,7 +662,7 @@ runEnv) {
     // remembering the session would leave the next *real* run continuing from an
     // answer nobody saw. Resolved once, up here, because the streaming reader
     // records it mid-run rather than at the end of the turn.
-    const sessionKey = options.dryRun ? undefined : sessionKeyFor(run);
+    const sessionKey = options.dryRun || venueCwd !== undefined ? undefined : sessionKeyFor(run);
     let recordedSession;
     /** The reader for the attempt currently running, if this brain streams. */
     let stream;
@@ -687,6 +714,10 @@ runEnv) {
         runtime.sessions.forget(sessionKey);
         recordedSession = undefined;
     };
+    // A venue session (`venueCwd` set): its own empty directory, an environment
+    // with nothing of ProhostAI's in it, and no session to resume or remember —
+    // see `venue.ts`.
+    const venue = venueCwd !== undefined;
     const exec = (command) => {
         // A fresh reader per attempt: a retry without `--resume` is a different
         // session, and inheriting the failed attempt's id would resume nothing.
@@ -698,8 +729,9 @@ runEnv) {
             prompt,
             timeoutMs: capped ? Math.max(1, remainingMs()) : 0,
             idleTimeoutMs: idleMs,
-            cwd: runtime.workdir,
-            env: { ...mcp.execEnv, ...runEnv },
+            cwd: venue ? venueCwd : runtime.workdir,
+            env: venue ? venueEnv({ ...process.env, ...options.env, ...mcp.execEnv }) : { ...mcp.execEnv, ...runEnv },
+            ...(venue ? { inheritEnv: false } : {}),
             spawnImpl: options.spawnImpl,
             cancelSignal: control.signal,
             onStdout: reader
@@ -799,19 +831,22 @@ runEnv) {
     const sessionId = runtime.sessions.get(sessionKey);
     const codex = runtime.brain === 'codex';
     // Same three questions for both brains — resume this thread, wire these
-    // tools, gate or don't — asked with each one's own flags.
-    const build = (resume) => codex
-        ? codexCommand(options.exec, {
-            sessionId: resume,
-            mcpEntries: mcp.codexMcpEntries,
-            configOverrides: mcp.codexConfigOverrides,
-            skipPermissions: runtime.skipPermissions,
-        })
-        : claudeCommand(options.exec, {
-            sessionId: resume,
-            mcpConfigPath: mcp.mcpConfigPath,
-            skipPermissions: runtime.skipPermissions,
-        });
+    // tools, gate or don't — asked with each one's own flags. A venue session
+    // answers none of them the operator's way: see `claudeVenueCommand`.
+    const build = (resume) => venue
+        ? claudeVenueCommand(options.exec, modelFromExec(options.exec))
+        : codex
+            ? codexCommand(options.exec, {
+                sessionId: resume,
+                mcpEntries: mcp.codexMcpEntries,
+                configOverrides: mcp.codexConfigOverrides,
+                skipPermissions: runtime.skipPermissions,
+            })
+            : claudeCommand(options.exec, {
+                sessionId: resume,
+                mcpConfigPath: mcp.mcpConfigPath,
+                skipPermissions: runtime.skipPermissions,
+            });
     let result = await exec(build(sessionId));
     // A remembered session may simply be gone — transcripts are cleaned up and
     // the ledger can't know. One retry without it, because the alternative is a
@@ -913,10 +948,22 @@ async function handleRun(run, options, runtime, api, log, sleep, control, isolat
 mcp) {
     const label = `run ${run.run_id.slice(0, 12)}`;
     const surface = run.conversation_id ?? run.kind ?? 'no conversation';
-    log(`${timestamp()} ▶ ${label} started (${surface})`);
+    // Answered with the run's own token, by a session with no tools and none of
+    // this machine's ProhostAI credentials — see `venue.ts`.
+    const venue = isVenueRun(run);
+    log(`${timestamp()} ▶ ${label} started (${surface}${venue ? ", a connected team's thread" : ''})`);
+    if (venue && !run.venue_run_token) {
+        // Nothing this harness could do for it is allowed: the server refuses this
+        // machine's own key for a venue run, and running the agent without the
+        // token would hand a connected team's prompt to a session that holds it.
+        log(`    ! ${label} is in a connected team's thread but carries no run token — not running it`);
+        return 'unreported';
+    }
     // Before anything is spawned: the prompt names these paths. A dry run makes
-    // no writes, and a worktree is one.
-    const checkouts = isolation.worktrees.enabled && !options.dryRun ? await isolation.worktrees.prepare(isolation.lane) : undefined;
+    // no writes, and a worktree is one. A venue session gets none.
+    const checkouts = isolation.worktrees.enabled && !options.dryRun && !venue
+        ? await isolation.worktrees.prepare(isolation.lane)
+        : undefined;
     for (const failure of checkouts?.failures ?? []) {
         log(`    ! no private checkout of ${failure.source} for ${label} (${failure.reason})`);
     }
@@ -934,7 +981,7 @@ mcp) {
         // it is. See PromptContext.mcpToolPattern.
         mcpToolPattern: runtime.brain !== 'plain' && mcp.mcpWired ? MCP_TOOL_PATTERN : undefined,
         backofficeRead: capabilities.backofficeRead,
-        toolsGated: !runtime.skipPermissions,
+        toolsGated: venue || !runtime.skipPermissions,
         // The real numbers, not a vague "there is a limit" — see PromptContext.
         timeoutMs: options.timeoutMs ?? DEFAULT_EXEC_TIMEOUT_MS,
         idleTimeoutMs: options.idleTimeoutMs ?? DEFAULT_IDLE_TIMEOUT_MS,
@@ -953,7 +1000,37 @@ mcp) {
     const runEnv = { [PAIRED_RUN_ENV_VAR]: '1' };
     if (checkouts && checkouts.checkouts.length > 0)
         runEnv[RUN_REPOS_ENV_VAR] = checkouts.dir;
-    const result = await runTurn(run, prompt, options, runtime, mcp, control, log, toolEvents, runEnv);
+    // The last moment before the agent starts: a venue run that waited in the
+    // queue past its grant is not started at all, and nothing is posted.
+    if (venue && !venueGrantLive(run)) {
+        await toolEvents.flush();
+        toolEvents.stop();
+        log(`${timestamp()} ⏹ ${label}'s connected-team grant expired before it could start — not running it`);
+        if (options.dryRun) {
+            log('    [dry-run] would report the run as failed');
+            return 'skipped';
+        }
+        // Closed now, while the margin still leaves the token good: left open, the
+        // row would keep its thinking indicator until the stale-run sweep. No
+        // model: none ran.
+        const closed = await completeWithRetry(api, run.completion_path, { ok: false, error: VENUE_GRANT_EXPIRED_ERROR }, log, sleep);
+        return closed.ok ? 'failed' : 'unreported';
+    }
+    const venueDir = venue && !mcp.error ? venueWorkdir() : undefined;
+    // What a venue run says about itself lands on its row in this agent's home
+    // workspace, and on this machine's log: never the agent's words about the
+    // connected team's thread (see `VENUE_PROGRESS`).
+    const turnControl = venue ? { ...control, report: () => control.report(VENUE_PROGRESS) } : control;
+    let result;
+    try {
+        result = await runTurn(run, prompt, options, runtime, mcp, turnControl, log, toolEvents, runEnv, venueDir?.dir);
+    }
+    finally {
+        venueDir?.remove();
+    }
+    // A venue session is never continued: the next turn there starts fresh from
+    // the thread the server sends, so nothing of this one is remembered.
+    const sessionId = venue ? undefined : result.ok ? result.sessionId : undefined;
     // Whatever the turn did, the timeline is whole BEFORE the reply is posted or
     // the run is closed — a completion that beats its own last tool row would
     // leave a `calling` row on a finished run. Never rejects, and after `stop`
@@ -972,6 +1049,18 @@ mcp) {
         log(`${timestamp()} ⏹ ${label} was already closed server-side (${seconds}s) — nothing was posted`);
         return 'resolved';
     }
+    if (stopped === 'expired') {
+        // Stopped while the margin still leaves the token good, so it closes its
+        // own run rather than leaving the row to the stale-run sweep. Nothing of
+        // what it was saying is posted.
+        log(`${timestamp()} ⏹ ${label}'s connected-team grant ran out after ${seconds}s — nothing was posted`);
+        if (options.dryRun) {
+            log('    [dry-run] would report the run as failed');
+            return 'skipped';
+        }
+        const closed = await completeWithRetry(api, run.completion_path, { ok: false, error: VENUE_GRANT_ENDED_ERROR }, log, sleep, runtime.model());
+        return closed.ok ? 'failed' : 'unreported';
+    }
     if (stopped === 'cancelled') {
         log(`${timestamp()} ⏹ ${label} cancelled after ${seconds}s`);
         if (options.dryRun) {
@@ -990,7 +1079,9 @@ mcp) {
     }
     if (!result.ok) {
         const { reason } = result;
-        const detail = result.detail ?? '';
+        // A venue run's detail is stderr and the agent's unfinished answer — the
+        // connected team's thread, retold. It stays out of the home run and the log.
+        const detail = venue ? '' : (result.detail ?? '');
         log(`${timestamp()} ✗ ${label} failed after ${seconds}s — ${reason}`);
         if (detail)
             log(`    stderr: ${detail}`);
@@ -1010,8 +1101,9 @@ mcp) {
     if (options.dryRun) {
         const destination = run.reply_surface === 'none' ? '(no reply surface)' : `${run.reply_surface} ${run.reply_path}`;
         log(`${timestamp()} ◦ ${label} dry-run — would post to ${destination}:`);
-        for (const line of reply.split('\n'))
-            log(`    │ ${line}`);
+        if (!venue)
+            for (const line of reply.split('\n'))
+                log(`    │ ${line}`);
         log(`    [dry-run] nothing was sent and the run was left open`);
         return 'skipped';
     }
@@ -1027,8 +1119,8 @@ mcp) {
             log(`    ! could not mark the run complete (${describeFailure(completed)})`);
             return 'unreported';
         }
-        if (result.sessionId) {
-            runtime.sessions.remember(sessionKeyFor(run), result.sessionId);
+        if (sessionId) {
+            runtime.sessions.remember(sessionKeyFor(run), sessionId);
         }
         return 'succeeded';
     }
@@ -1041,15 +1133,16 @@ mcp) {
             ? 'no reply surface'
             : `${run.reply_surface} runs have nowhere to post yet`;
         log(`${timestamp()} ✓ ${label} finished in ${seconds}s (${why})`);
-        for (const line of reply.split('\n'))
-            log(`    │ ${line}`);
+        if (!venue)
+            for (const line of reply.split('\n'))
+                log(`    │ ${line}`);
         const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep, runtime.model());
         if (!completed.ok) {
             log(`    ! could not mark the run complete (${describeFailure(completed)})`);
             return 'unreported';
         }
-        if (result.sessionId) {
-            runtime.sessions.remember(sessionKeyFor(run), result.sessionId);
+        if (sessionId) {
+            runtime.sessions.remember(sessionKeyFor(run), sessionId);
         }
         return 'succeeded';
     }
@@ -1058,7 +1151,9 @@ mcp) {
     const posted = await postReplyWithReplay(api, () => postReply(api, replyPath, replyBodyKey, reply, run.run_id, run.reply_body_extra), label, log, sleep);
     if (!posted.ok) {
         const failure = describeFailure(posted);
-        const detail = posted.status === 0 ? '' : ` ${posted.error ?? ''}`;
+        // The server's reason can quote the thread (a reply-race refusal previews
+        // the other reply), so a venue run logs the status alone.
+        const detail = posted.status === 0 || venue ? '' : ` ${posted.error ?? ''}`;
         log(`${timestamp()} ✗ ${label} reply rejected (${failure})${detail}`);
         // Undo the mid-run recording. The session exists and the agent's transcript
         // holds this turn, but the conversation never received its answer, so
@@ -1072,8 +1167,8 @@ mcp) {
     // Advance continuity only after the answer is durable on its reply surface.
     // Remembering at process exit would strand the conversation behind an answer
     // it never received whenever this POST is rejected.
-    if (result.sessionId) {
-        runtime.sessions.remember(sessionKeyFor(run), result.sessionId);
+    if (sessionId) {
+        runtime.sessions.remember(sessionKeyFor(run), sessionId);
     }
     const completed = await completeWithRetry(api, run.completion_path, { ok: true }, log, sleep, runtime.model());
     if (!completed.ok) {
@@ -1124,6 +1219,12 @@ export async function runAgentHarness(options) {
     // duplicate — the run is in flight right here. Only a run in the ledger that
     // this process never handled is a candidate for restart recovery.
     const handledThisSession = new Set();
+    /**
+     * Venue runs whose session is still being opened, and whether it opened. A
+     * duplicate delivery in that window is acknowledged the way the original
+     * will be — never as accepted before a session exists.
+     */
+    const venueOpenings = new Map();
     /** Accepted, not yet reported — the executing run and everything queued. */
     const accepted = new Map();
     const heartbeats = new HeartbeatLoop({ api, log, intervalMs: options.heartbeatIntervalMs });
@@ -1138,6 +1239,7 @@ export async function runAgentHarness(options) {
         accountKeys: runtime.account ? () => runtime.account.keys() : undefined,
         // A run in flight reports fresh numbers when it ends; don't probe beside it.
         isBusy: () => [...accepted.values()].some((entry) => entry.executing),
+        capabilities: () => (runtime.venueSessions ? [VENUE_RUN_TOKEN_CAPABILITY] : []),
         log,
     });
     runtime.observe = (observation) => status.observe(observation);
@@ -1163,6 +1265,14 @@ export async function runAgentHarness(options) {
         catch {
             version = undefined;
         }
+        if (runtime.brain === 'claude') {
+            try {
+                runtime.venueSessions = claudeSupportsVenueSessions(probe(`${binary} --help`, runtime.workdir).stdout);
+            }
+            catch {
+                runtime.venueSessions = false;
+            }
+        }
         status.observe({
             runtime_version: version,
             model: modelFromExec(options.exec) ??
@@ -1247,7 +1357,7 @@ export async function runAgentHarness(options) {
             log('    [dry-run] would report the run as cancelled');
             return;
         }
-        const closed = await completeWithRetry(api, entry.run.completion_path, { ok: false, error: RUN_ERROR_CANCELLED_BY_USER }, log, sleep);
+        const closed = await completeWithRetry(apiForRun(api, entry.run), entry.run.completion_path, { ok: false, error: RUN_ERROR_CANCELLED_BY_USER }, log, sleep);
         if (closed.ok)
             runs.markCompleted(entry.run.run_id);
         metrics.runsFailed += 1;
@@ -1271,6 +1381,30 @@ export async function runAgentHarness(options) {
         runs.markCompleted(entry.run.run_id);
         log(`${timestamp()} ⏹ run ${entry.run.run_id.slice(0, 12)} was closed server-side before it started`);
     };
+    /**
+     * A venue run's grant is about to end. Stopped while the margin still
+     * leaves its token good, so the run is closed with it: an executing run is
+     * aborted and `handleRun` completes it; a queued one is closed out here.
+     */
+    const expireAccepted = async (entry) => {
+        if (entry.disposition)
+            return;
+        entry.disposition = 'expired';
+        if (entry.executing) {
+            entry.controller.abort();
+            return;
+        }
+        release(entry.run.run_id);
+        log(`${timestamp()} ⏹ run ${entry.run.run_id.slice(0, 12)}'s connected-team grant expired before it started`);
+        if (options.dryRun) {
+            log('    [dry-run] would report the run as failed');
+            return;
+        }
+        const closed = await completeWithRetry(apiForRun(api, entry.run), entry.run.completion_path, { ok: false, error: VENUE_GRANT_EXPIRED_ERROR }, log, sleep);
+        if (closed.ok)
+            runs.markCompleted(entry.run.run_id);
+        metrics.runsFailed += 1;
+    };
     const exhausted = () => options.maxConnections !== undefined && metrics.connections >= options.maxConnections;
     while (!options.signal?.aborted && fatal === undefined && !exhausted()) {
         metrics.connections += 1;
@@ -1343,6 +1477,36 @@ export async function runAgentHarness(options) {
                     log(`${timestamp()} ● connected — ${since}`);
                 },
             });
+            /** This server opens venue sessions over the socket (`auth_ok.features`). */
+            let venueSessionsOffered = false;
+            /** Venue-session opens awaiting the server's answer, by run. */
+            const venueWaiters = new Map();
+            /**
+             * Open a run's venue session over this socket. `null` means no answer —
+             * the socket went, or the server took too long — and the open can be
+             * tried again on a redelivery; any answer is final.
+             */
+            const askVenueSession = (runId) => {
+                if (!venueSessionsOffered)
+                    return Promise.resolve({ ok: false });
+                return new Promise((resolve) => {
+                    const timer = setTimeout(() => {
+                        venueWaiters.delete(runId);
+                        resolve(null);
+                    }, VENUE_SESSION_TIMEOUT_MS);
+                    venueWaiters.set(runId, (answer) => {
+                        clearTimeout(timer);
+                        resolve(answer);
+                    });
+                    try {
+                        ws.send(JSON.stringify({ type: VENUE_SESSION_OPEN_FRAME, run_id: runId }));
+                    }
+                    catch {
+                        venueWaiters.get(runId)?.(null);
+                        venueWaiters.delete(runId);
+                    }
+                });
+            };
             ws.on('open', () => {
                 // Kernel-level probe underneath the application-level one: a dead
                 // peer is detected by the TCP stack even while the socket is idle.
@@ -1404,6 +1568,7 @@ export async function runAgentHarness(options) {
                         }
                         runtime.account?.noteRequestedAt(pending.requested_at);
                     }
+                    venueSessionsOffered = Array.isArray(f.features) && f.features.includes(VENUE_SESSION_FEATURE);
                     if (Array.isArray(f.features) && f.features.includes(RUNTIME_STATUS_FEATURE)) {
                         primeStatus();
                         status.attach((frame) => ws.send(JSON.stringify(frame)));
@@ -1427,6 +1592,13 @@ export async function runAgentHarness(options) {
                     ws.send(JSON.stringify({ type: 'pong' }));
                     return;
                 }
+                if (f.type === VENUE_SESSION_FRAME) {
+                    const runId = String(f.run_id);
+                    const waiter = venueWaiters.get(runId);
+                    venueWaiters.delete(runId);
+                    waiter?.(f);
+                    return;
+                }
                 if (!isWebhookEvent(frame))
                     return;
                 metrics.eventsReceived += 1;
@@ -1483,129 +1655,204 @@ export async function runAgentHarness(options) {
                     return;
                 }
                 const previous = runs.get(run.run_id);
-                if (previous?.completed || handledThisSession.has(run.run_id)) {
+                const opening = venueOpenings.get(run.run_id);
+                if (opening) {
                     metrics.duplicates += 1;
-                    ack(ACK_ACCEPTED);
+                    void opening.then((opened) => ack(opened ? ACK_ACCEPTED : ACK_RETRY));
                     return;
                 }
-                ack(ACK_ACCEPTED);
-                handledThisSession.add(run.run_id);
-                if (previous) {
-                    // We ran this one before but never got a terminal state accepted —
-                    // most likely the process died between the command and the
-                    // completion. Retry only the completion: re-running the agent could
-                    // repeat whatever it did with its credential the first time.
+                if (previous?.completed || handledThisSession.has(run.run_id)) {
                     metrics.duplicates += 1;
-                    scheduler.submit(laneFor(run), async () => {
-                        log(`${timestamp()} ↻ run ${run.run_id.slice(0, 12)} was started before but never reported; ` +
-                            'reporting it now without re-running the agent');
-                        const recovered = await completeWithRetry(api, previous.completion_path || run.completion_path, { ok: false, error: 'the harness restarted before this run was reported' }, log, sleep);
-                        if (recovered.ok)
-                            runs.markCompleted(run.run_id);
-                    });
+                    ack(ACK_ACCEPTED);
                     return;
                 }
-                // Recorded BEFORE the command runs — a crash mid-run must not let a
-                // redelivery execute the agent a second time.
-                runs.markStarted(run.run_id, run.completion_path);
-                metrics.runsStarted += 1;
-                // Heartbeat from the moment it is accepted, not from the moment it
-                // starts. The row is `running` server-side either way, and a run that
-                // waits an hour behind a long job is reaped exactly like one that has
-                // been working for an hour.
-                const entry = { run, controller: new AbortController(), executing: false };
-                accepted.set(run.run_id, entry);
-                heartbeats.track(run.run_id, {
-                    path: heartbeatPathFor(run),
-                    progress: () => entry.progress,
-                    // Deliberately not awaited here — see `background`.
-                    onCancelRequested: () => {
-                        background.push(cancelAccepted(entry).catch((err) => {
-                            log(`${timestamp()} ✗ closing cancelled run ${run.run_id} failed: ${String(err)}`);
-                        }));
-                    },
-                    onResolved: () => resolveAccepted(entry),
-                });
-                // Queue execution but never block the socket reader: the ack and the
-                // heartbeat have to keep flowing while the agent thinks. The lane is
-                // what keeps two turns of one conversation from overlapping.
-                const lane = laneFor(run);
-                scheduler.submit(lane, async () => {
-                    // Settled while it waited — cancelled, or closed server-side. Both
-                    // were dealt with where they were decided; there is nothing to run
-                    // and nothing left to report.
-                    if (entry.disposition)
-                        return;
-                    // Shutdown was requested while this sat in the queue. Don't start a
-                    // fresh command the operator is waiting to be rid of — but do close
-                    // the run out, so the server isn't left waiting on it either.
-                    if (options.signal?.aborted) {
-                        release(run.run_id);
-                        log(`${timestamp()} ⏹ run ${run.run_id.slice(0, 12)} dropped — harness is shutting down`);
-                        const closed = await completeWithRetry(api, run.completion_path, { ok: false, error: 'the harness shut down before this run started' }, log, sleep);
-                        if (closed.ok)
-                            runs.markCompleted(run.run_id);
-                        metrics.runsFailed += 1;
+                handledThisSession.add(run.run_id);
+                /** Take the run on: track it, heartbeat it, queue it. */
+                const accept = (run) => {
+                    if (previous) {
+                        // We ran this one before but never got a terminal state accepted —
+                        // most likely the process died between the command and the
+                        // completion. Retry only the completion: re-running the agent could
+                        // repeat whatever it did with its credential the first time.
+                        metrics.duplicates += 1;
+                        scheduler.submit(laneFor(run), async () => {
+                            log(`${timestamp()} ↻ run ${run.run_id.slice(0, 12)} was started before but never reported; ` +
+                                'reporting it now without re-running the agent');
+                            const recovered = await completeWithRetry(apiForRun(api, run), previous.completion_path || run.completion_path, { ok: false, error: 'the harness restarted before this run was reported' }, log, sleep);
+                            if (recovered.ok)
+                                runs.markCompleted(run.run_id);
+                        });
                         return;
                     }
-                    // Set before the first `await`, so a cancellation arriving from the
-                    // heartbeat either sees a queued run (and closes it out itself) or an
-                    // executing one (and aborts it) — never both, and never neither.
-                    entry.executing = true;
-                    const control = {
-                        signal: entry.controller.signal,
-                        disposition: () => entry.disposition,
-                        report: (activity) => {
-                            entry.progress = activity;
+                    // Recorded BEFORE the command runs — a crash mid-run must not let a
+                    // redelivery execute the agent a second time.
+                    runs.markStarted(run.run_id, run.completion_path);
+                    metrics.runsStarted += 1;
+                    // Heartbeat from the moment it is accepted, not from the moment it
+                    // starts. The row is `running` server-side either way, and a run that
+                    // waits an hour behind a long job is reaped exactly like one that has
+                    // been working for an hour.
+                    const entry = { run, controller: new AbortController(), executing: false };
+                    accepted.set(run.run_id, entry);
+                    heartbeats.track(run.run_id, {
+                        path: heartbeatPathFor(run),
+                        api: apiForRun(api, run),
+                        venue: isVenueRun(run),
+                        progress: () => entry.progress,
+                        // Deliberately not awaited here — see `background`.
+                        onCancelRequested: () => {
+                            background.push(cancelAccepted(entry).catch((err) => {
+                                log(`${timestamp()} ✗ closing cancelled run ${run.run_id} failed: ${String(err)}`);
+                            }));
                         },
-                    };
-                    const isolation = { lane, parallel: concurrency > 1, worktrees };
-                    // Resolved here rather than inside `handleRun` so the account this
-                    // run is on can be handed back however the run ends.
-                    let mcp;
-                    try {
-                        mcp = runtime.prepareMcp();
-                    }
-                    catch (err) {
-                        // Fails the run closed, and — unlike a throw from here — still
-                        // reports it, so the server is not left waiting on it.
-                        mcp = { mcpWired: false, error: `could not prepare the run (${String(err)})` };
-                    }
-                    const outcome = await handleRun(run, options, runtime, api, log, sleep, control, isolation, mcp).catch((err) => {
-                        log(`${timestamp()} ✗ run ${run.run_id} crashed the harness handler: ${String(err)}`);
-                        return 'failed';
+                        onResolved: () => resolveAccepted(entry),
                     });
-                    if (mcp.accountLabel !== undefined)
-                        runtime.account?.finishSpawn(mcp.accountLabel);
-                    // Held until here on purpose: heartbeats keep the row alive for the
-                    // whole of `handleRun`, including the ten minutes of completion
-                    // retries at the end of it.
-                    release(run.run_id);
-                    // An account picked mid-run was held back from the status frame
-                    // until this run (on the old account) was done; report it now. Asked
-                    // about *this* run's account: a newer run may already be on the pick.
-                    if (runtime.account?.changedSinceSpawn(mcp.accountLabel))
-                        status.accountsChanged();
-                    // Both terminal outcomes reached the completion endpoint; only then
-                    // is the run settled and safe to skip on redelivery.
-                    if (outcome === 'succeeded')
-                        metrics.runsSucceeded += 1;
-                    // A cancellation is reported to the server as `failed`, and counted
-                    // the same way here — the run did not produce the answer it was for.
-                    if (outcome === 'failed' || outcome === 'unreported' || outcome === 'cancelled') {
-                        metrics.runsFailed += 1;
+                    // A venue run's grant ends at its expiry whether or not the server
+                    // can be reached to say so: stop it just before then, while the
+                    // margin still lets its token close the run (heartbeats stop it
+                    // sooner on any refusal). Re-checked at least every
+                    // VENUE_GRANT_CHECK_MS rather than timed once: a timer counts on the
+                    // monotonic clock, which can stand still while the machine sleeps,
+                    // and the grant does not.
+                    if (run.venue_deadline_ms !== undefined) {
+                        const checkGrant = () => {
+                            if (!accepted.has(run.run_id) || entry.disposition)
+                                return;
+                            const left = venueGrantRemainingMs(run) - VENUE_EXPIRY_MARGIN_MS;
+                            if (left > 0) {
+                                setTimeout(checkGrant, Math.min(VENUE_GRANT_CHECK_MS, left)).unref?.();
+                                return;
+                            }
+                            log(`${timestamp()} ⏹ run ${run.run_id.slice(0, 12)}'s connected-team grant is ending — stopping it`);
+                            background.push(expireAccepted(entry).catch((err) => {
+                                log(`${timestamp()} ✗ closing expired run ${run.run_id} failed: ${String(err)}`);
+                            }));
+                        };
+                        setTimeout(checkGrant, 0).unref?.();
                     }
-                    // Only a run the server acknowledged as terminal is settled; an
-                    // unreported one stays open so a redelivery can report it.
-                    if (outcome === 'succeeded' ||
-                        outcome === 'failed' ||
-                        outcome === 'cancelled' ||
-                        outcome === 'resolved') {
-                        runs.markCompleted(run.run_id);
+                    // Queue execution but never block the socket reader: the ack and the
+                    // heartbeat have to keep flowing while the agent thinks. The lane is
+                    // what keeps two turns of one conversation from overlapping.
+                    const lane = laneFor(run);
+                    scheduler.submit(lane, async () => {
+                        // Settled while it waited — cancelled, or closed server-side. Both
+                        // were dealt with where they were decided; there is nothing to run
+                        // and nothing left to report.
+                        if (entry.disposition)
+                            return;
+                        // Shutdown was requested while this sat in the queue. Don't start a
+                        // fresh command the operator is waiting to be rid of — but do close
+                        // the run out, so the server isn't left waiting on it either.
+                        if (options.signal?.aborted) {
+                            release(run.run_id);
+                            log(`${timestamp()} ⏹ run ${run.run_id.slice(0, 12)} dropped — harness is shutting down`);
+                            const closed = await completeWithRetry(apiForRun(api, run), run.completion_path, { ok: false, error: 'the harness shut down before this run started' }, log, sleep);
+                            if (closed.ok)
+                                runs.markCompleted(run.run_id);
+                            metrics.runsFailed += 1;
+                            return;
+                        }
+                        // Set before the first `await`, so a cancellation arriving from the
+                        // heartbeat either sees a queued run (and closes it out itself) or an
+                        // executing one (and aborts it) — never both, and never neither.
+                        entry.executing = true;
+                        const control = {
+                            signal: entry.controller.signal,
+                            disposition: () => entry.disposition,
+                            report: (activity) => {
+                                entry.progress = activity;
+                            },
+                        };
+                        const isolation = { lane, parallel: concurrency > 1, worktrees };
+                        // Resolved here rather than inside `handleRun` so the account this
+                        // run is on can be handed back however the run ends.
+                        let mcp;
+                        try {
+                            // A venue session gets no MCP at all — not the ProhostAI server, not
+                            // the operator's extras — only the account that runs the brain.
+                            mcp = isVenueRun(run) ? prepareVenueSession(runtime) : runtime.prepareMcp();
+                        }
+                        catch (err) {
+                            // Fails the run closed, and — unlike a throw from here — still
+                            // reports it, so the server is not left waiting on it.
+                            mcp = { mcpWired: false, error: `could not prepare the run (${String(err)})` };
+                        }
+                        const outcome = await handleRun(run, options, runtime, apiForRun(api, run), log, sleep, control, isolation, mcp).catch((err) => {
+                            log(`${timestamp()} ✗ run ${run.run_id} crashed the harness handler: ${String(err)}`);
+                            return 'failed';
+                        });
+                        if (mcp.accountLabel !== undefined)
+                            runtime.account?.finishSpawn(mcp.accountLabel);
+                        // Held until here on purpose: heartbeats keep the row alive for the
+                        // whole of `handleRun`, including the ten minutes of completion
+                        // retries at the end of it.
+                        release(run.run_id);
+                        // An account picked mid-run was held back from the status frame
+                        // until this run (on the old account) was done; report it now. Asked
+                        // about *this* run's account: a newer run may already be on the pick.
+                        if (runtime.account?.changedSinceSpawn(mcp.accountLabel))
+                            status.accountsChanged();
+                        // Both terminal outcomes reached the completion endpoint; only then
+                        // is the run settled and safe to skip on redelivery.
+                        if (outcome === 'succeeded')
+                            metrics.runsSucceeded += 1;
+                        // A cancellation is reported to the server as `failed`, and counted
+                        // the same way here — the run did not produce the answer it was for.
+                        if (outcome === 'failed' || outcome === 'unreported' || outcome === 'cancelled') {
+                            metrics.runsFailed += 1;
+                        }
+                        // Only a run the server acknowledged as terminal is settled; an
+                        // unreported one stays open so a redelivery can report it.
+                        if (outcome === 'succeeded' ||
+                            outcome === 'failed' ||
+                            outcome === 'cancelled' ||
+                            outcome === 'resolved') {
+                            runs.markCompleted(run.run_id);
+                        }
+                    });
+                };
+                if (!isVenueRun(run)) {
+                    ack(ACK_ACCEPTED);
+                    accept(run);
+                    return;
+                }
+                // A connected team's thread: the event carries none of it. Open the
+                // run's venue session over this socket for the thread and the run's
+                // own token before anything is tracked, so every request the run makes
+                // — heartbeats included — goes out with the token and never with this
+                // machine's key. The delivery is acknowledged only once the server has
+                // answered: with no answer it stays retryable, so a dropped socket or
+                // a slow server does not strand the run.
+                const runId = run.run_id;
+                let settleOpening = () => { };
+                venueOpenings.set(runId, new Promise((resolve) => {
+                    settleOpening = resolve;
+                }));
+                const openedAt = { openedAtMono: performance.now(), openedAtWall: Date.now() };
+                void askVenueSession(runId).then((answer) => {
+                    const opened = answer === null ? null : venueRunFromSession(run, eventData(frame.payload), answer, openedAt);
+                    venueOpenings.delete(runId);
+                    settleOpening(opened !== null && opened.ok);
+                    if (opened === null || !opened.ok) {
+                        // Not taken: the delivery stays retryable, and a redelivery comes
+                        // back through the server's socket check — which either hands the
+                        // run to this socket after all or ends it there. Acknowledging a
+                        // run this harness never took would leave it open with nobody on it.
+                        handledThisSession.delete(runId);
+                        ack(ACK_RETRY);
+                        log(`${timestamp()} … run ${runId.slice(0, 12)} is in a connected team's thread, but its venue ` +
+                            `session could not be opened (${opened === null ? 'no answer' : opened.error}) — not running it; ` +
+                            'the server will retry or end it');
+                        return;
                     }
+                    ack(ACK_ACCEPTED);
+                    accept(opened.run);
                 });
             });
             ws.on('close', () => {
+                for (const waiter of venueWaiters.values())
+                    waiter(null);
+                venueWaiters.clear();
                 liveness.stop();
                 status.detach();
                 if (options.signal)