@rallycry/conveyor-agent 10.0.6 → 10.2.0

package/dist/index.d.ts

@@ -1,5 +1,5 @@
 import * as _project_shared from '@project/shared';
-import { AgentSessionServiceMethods, AgentMode, WorkspaceDiscoveredPort, AgentQuestion, AgentRunnerStatus, BootstrapBundle } from '@project/shared';
+import { RunnerMode, AgentSessionServiceMethods, AgentMode, WorkspaceDiscoveredPort, AgentQuestion, AgentRunnerStatus, BootstrapBundle } from '@project/shared';
 export * from '@project/shared';
 import { ChildProcess } from 'node:child_process';
 
@@ -7,7 +7,7 @@ interface AgentConnectionConfig {
     apiUrl: string;
     taskToken: string;
     sessionId: string;
-    runnerMode?: "task" | "pm" | "code-review";
+    runnerMode?: RunnerMode;
 }
 interface IncomingMessage {
     content: string;
@@ -66,7 +66,17 @@ declare class AgentConnection {
     get connected(): boolean;
     private static readonly CALL_CONNECT_WAIT_MS;
     private static readonly CALL_ACK_TIMEOUT_MS;
+    private static readonly SOCKET_RECYCLE_BASE_MS;
+    private static readonly SOCKET_RECYCLE_JITTER_MS;
+    private static readonly SOCKET_RECYCLE_BUSY_POLL_MS;
+    private recycleTimer;
+    private pendingCalls;
     call<M extends keyof AgentSessionServiceMethods>(method: M, payload: AgentSessionServiceMethods[M]["payload"]): Promise<AgentSessionServiceMethods[M]["response"]>;
+    /** (Re)arm the recycle timer — called on every successful (re)connect. */
+    private scheduleSocketRecycle;
+    private clearSocketRecycle;
+    private armRecycleTimer;
+    private attemptSocketRecycle;
     /** Resolve once `socket` reports connected, or reject after `timeoutMs`. */
     private waitForConnected;
     /** Emit an RPC and resolve on ack, rejecting if no ack arrives in time. */
@@ -109,6 +119,13 @@ declare class AgentConnection {
         cols: number;
         rows: number;
     }): void;
+    /**
+     * Report that the interactive CLI process for this session has died and no
+     * respawn is imminent (fire-and-forget). The server clears the scrollback
+     * ring and broadcasts pty:ended so clients hide the Connected-TUI tab. Old
+     * servers that don't know the method reject harmlessly.
+     */
+    sendPtyEnded(): void;
     /** Subscribe to relayed keystrokes. Returns an unsubscribe fn. */
     onPtyInput(handler: (data: string) => void): () => void;
     /** Subscribe to relayed (reconciled) terminal resizes. Returns an unsubscribe fn. */
@@ -210,7 +227,7 @@ declare class ModeController {
     private _pendingModeRestart;
     private _runnerMode;
     private _isAuto;
-    constructor(initialMode: AgentMode, runnerMode?: "task" | "pm" | "code-review", isAuto?: boolean);
+    constructor(initialMode: AgentMode, runnerMode?: RunnerMode, isAuto?: boolean);
     get mode(): AgentMode;
     get isAuto(): boolean;
     get hasExitedPlanMode(): boolean;
@@ -231,7 +248,21 @@ declare class ModeController {
     applyServerMode(agentMode: AgentMode | null | undefined, isAuto: boolean | undefined): void;
     /** Resolve the initial mode based on task context */
     resolveInitialMode(context: ModeTaskContext): AgentMode;
-    /** Check if auto-mode can bypass planning (task already has plan + properties) */
+    /**
+     * A FRESH auto task runs the read-only plan turn first (`--permission-mode plan`):
+     * resolveInitialMode leaves it in `auto` with `_hasExitedPlanMode = false`, and
+     * once the agent finishes it calls ExitPlanMode → building. Only tasks that have
+     * already progressed past the fresh stage bypass planning and build immediately
+     * with `--dangerously-skip-permissions`:
+     *
+     * - a build already underway (status past `Planning`/`Open`),
+     * - a PR already open (safety net if status lags),
+     * - a release (booted `InProgress`), or
+     * - a pod restart mid-build (DB `agentMode` stays `"auto"` but status advanced).
+     *
+     * Runtime Build-after-Discovery never reaches this gate as `auto` — the server's
+     * `resolveModeToSend` rewrites it to `"building"` for any non-`Planning` task.
+     */
     canBypassPlanning(context: ModeTaskContext): boolean;
     /** Handle mode change from server */
     handleModeChange(newMode: AgentMode): ModeAction;
@@ -260,6 +291,11 @@ interface LifecycleConfig {
      *  persistent state (local, workspace, GitHub Codespaces) that don't lose
      *  in-flight work on a crash. */
     gitFlushIntervalMs: number;
+    /** Claude key usage sample interval (default: 5 min). Polls the Anthropic
+     *  OAuth usage endpoint and reports session/weekly rate-limit utilization for
+     *  the running subscription key. Deliberately NOT the heartbeat cadence — the
+     *  endpoint is rate-limited. Set to `0` to disable the timer entirely. */
+    usageSampleIntervalMs: number;
 }
 interface LifecycleCallbacks {
     onHeartbeat: () => void;
@@ -267,6 +303,7 @@ interface LifecycleCallbacks {
     onDormantTimeout: () => void;
     onTokenRefresh: () => void;
     onGitFlush: () => void;
+    onUsageSample: () => void;
 }
 declare class Lifecycle {
     readonly config: LifecycleConfig;
@@ -277,6 +314,7 @@ declare class Lifecycle {
     private idleCheckInterval;
     private dormantTimer;
     private gitFlushTimer;
+    private usageSampleTimer;
     constructor(config: LifecycleConfig, callbacks: LifecycleCallbacks);
     startHeartbeat(): void;
     stopHeartbeat(): void;
@@ -284,6 +322,8 @@ declare class Lifecycle {
     stopTokenRefresh(): void;
     startGitFlush(): void;
     stopGitFlush(): void;
+    startUsageSample(): void;
+    stopUsageSample(): void;
     startIdleTimer(): void;
     cancelIdleTimer(): void;
     /** Start (or restart) the dormant timer.
@@ -302,7 +342,7 @@ declare class Lifecycle {
 interface SessionRunnerConfig {
     connection: AgentConnectionConfig;
     agentMode?: AgentMode;
-    runnerMode?: "task" | "pm" | "code-review";
+    runnerMode?: RunnerMode;
     isAuto?: boolean;
     workspaceDir: string;
     model?: string;
@@ -415,11 +455,25 @@ declare class SessionRunner {
     injectMessage(msg: IncomingMessage): void;
     /** Run queryBridge.execute, swallowing abort errors from stop/softStop. */
     private executeQuery;
+    /**
+     * A human typed into the parked, idle Connected-TUI (keep-alive PTY). Wake the
+     * core loop with a sentinel so it drains a passive turn. No-op once stopped.
+     */
+    private onPassiveTuiActivity;
+    /** Run queryBridge.executePassive, swallowing abort errors from stop/softStop. */
+    private executePassive;
     /** Periodic best-effort WIP commit + push during normal agent execution.
      *  Covers ungraceful pod termination (OOMKilled, node crash/eviction) where
      *  the preStop hook + SIGTERM flush don't get a chance to run. No-ops on a
      *  clean tree. Guarded so two ticks can't overlap. Never throws. */
     private periodicGitFlush;
+    /** Sample the running Claude subscription key's rate-limit utilization from the
+     *  Anthropic OAuth usage endpoint and report it as `rate_limit_update` events.
+     *  The API (`persistRateLimitSnapshot`) attributes them to the key this session
+     *  launched under, keeping User Settings + the PtY-tab usage widget fresh and
+     *  `selectBestKey` rotation honest. Best-effort — never throws, no-op when the
+     *  pod has no OAuth token (e.g. API-key projects). */
+    private sampleAndReportKeyUsage;
     /** PUT the WorkPreservation snapshot tar to the bundle's capability URL
      *  when this pod is v3 (CONVEYOR_SNAPSHOT_UPLOAD_URL set). Never throws. */
     private uploadGcsSnapshotIfConfigured;

package/dist/index.js

@@ -21,7 +21,7 @@ import {
   unshallowRepo,
   updateRemoteToken,
   uploadSnapshotToGcs
-} from "./chunk-37ZIDX6S.js";
+} from "./chunk-EDEMOFUN.js";
 
 // src/runner/worktree.ts
 import { execSync } from "child_process";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rallycry/conveyor-agent",
-  "version": "10.0.6",
+  "version": "10.2.0",
   "description": "Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.",
   "keywords": [
     "agent",

package/runtime/entrypoint.sh

@@ -217,10 +217,16 @@ if [ "${SESSION_MODE}" = "review" ]; then
   # branch), so a role check can't identify them — gating on role=reader here
   # is what let review pods fall through to the default task runner and boot
   # the parent's task agent in discovery mode. The agent CLI's RunnerMode is
-  # spelled "code-review" (cli.ts validates task|pm|code-review); the bare
+  # spelled "code-review" (cli.ts validates task|pm|code-review|adhoc); the bare
   # "review" is the agentMode/tag axis, NOT a runner mode — passing it here
   # made the agent exit "Invalid CONVEYOR_MODE" and crash-loop every 10s.
   export CONVEYOR_MODE="code-review"
+elif [ "${SESSION_MODE}" = "adhoc" ]; then
+  # Task-less USER SCRATCH pod (Sessions view): the agent runs an interactive
+  # `claude` TUI relayed to the web terminal — no autonomous loop, no task. Must
+  # be checked BEFORE the project branch below: an adhoc session is also
+  # task-less with a projectId claim, but it must NOT boot the pm project runner.
+  export CONVEYOR_MODE="adhoc"
 elif [ -z "${CONVEYOR_TASK_ID:-}" ] && [ -n "${CONVEYOR_PROJECT_ID_CLAIM}" ]; then
   # Task-less project pod: the agent boots the project runner in pm mode
   # (see conveyor-agent setup/project-identity.ts — pm is required).
@@ -352,20 +358,21 @@ fi
 GIT_READY_MARKER="/workspaces/.conveyor-git-ready"
 GIT_FAILED_MARKER="/workspaces/.conveyor-git-failed"
 
-clean_repo_before_assignment_checkout() {
-  # The baked/pooled repo is not user-owned until this git gate succeeds. Clean
-  # stale image-generated dirt so assignment checkout can move to the requested
-  # branch/ref instead of being blocked by tracked files like dependency stamps.
+reset_tracked_repo_changes_before_assignment_checkout() {
+  # The baked/pooled repo is not user-owned until this git gate succeeds. Reset
+  # stale tracked image-generated dirt so assignment checkout can move to the
+  # requested branch/ref instead of being blocked by files like dependency
+  # stamps. Do not `git clean`: untracked prebake artifacts may be intentional.
+  # The assignment checkouts additionally pass -f: an UNTRACKED bake artifact
+  # can collide with a path the TARGET ref tracks (e.g. a dependency stamp
+  # committed on an older PR branch), which this reset cannot clear — checkout
+  # then refuses with "untracked working tree files would be overwritten".
+  # Forcing is safe here for the same not-user-owned reason.
   if ! _reset_out=$(git -C repo reset --hard HEAD 2>&1); then
     echo "[pool] ERROR: failed to clean tracked repo changes before checkout: ${_reset_out}" >&2
     printf '%s' "pre-checkout reset failed" > "$GIT_FAILED_MARKER"
     return 1
   fi
-  if ! _clean_out=$(git -C repo clean -ffd 2>&1); then
-    echo "[pool] ERROR: failed to clean untracked repo files before checkout: ${_clean_out}" >&2
-    printf '%s' "pre-checkout clean failed" > "$GIT_FAILED_MARKER"
-    return 1
-  fi
   return 0
 }
 
@@ -391,7 +398,7 @@ sync_task_branch_to_repo() {
     echo "[pool] WARN: fetch origin/${DEV_BRANCH} failed: ${_fetch_dev_out}" >&2
   fi
 
-  if ! clean_repo_before_assignment_checkout; then
+  if ! reset_tracked_repo_changes_before_assignment_checkout; then
     return 1
   fi
 
@@ -402,7 +409,7 @@ sync_task_branch_to_repo() {
       printf '%s' "fetch checkout ref ${CHECKOUT_REF} failed" > "$GIT_FAILED_MARKER"
       return 1
     fi
-    if ! _checkout_out=$(git -C repo checkout -B "${BRANCH}" "refs/remotes/origin/pr-checkout" 2>&1); then
+    if ! _checkout_out=$(git -C repo checkout -f -B "${BRANCH}" "refs/remotes/origin/pr-checkout" 2>&1); then
       echo "[pool] ERROR: Repo checkout of ${CHECKOUT_REF} failed: ${_checkout_out}" >&2
       printf '%s' "checkout of ${CHECKOUT_REF} failed" > "$GIT_FAILED_MARKER"
       return 1
@@ -417,7 +424,7 @@ sync_task_branch_to_repo() {
       if echo "${_fetch_out}" | grep -q "couldn't find remote ref"; then
         echo "[pool] Branch missing on origin — creating from base '${DEV_BRANCH}'"
         # Create the branch locally from the base branch
-        if ! _create_out=$(git -C repo checkout -B "${BRANCH}" "origin/${DEV_BRANCH}" 2>&1); then
+        if ! _create_out=$(git -C repo checkout -f -B "${BRANCH}" "origin/${DEV_BRANCH}" 2>&1); then
           echo "[pool] ERROR: Failed to create branch '${BRANCH}' from '${DEV_BRANCH}': ${_create_out}" >&2
           printf '%s' "create branch ${BRANCH} from ${DEV_BRANCH} failed" > "$GIT_FAILED_MARKER"
           return 1
@@ -439,7 +446,7 @@ sync_task_branch_to_repo() {
     # Use `checkout -B` to create or reset the local branch tracking origin.
     # This leaves HEAD attached to a real branch (not detached) so `git status`,
     # `git push`, and any tool that keys off branch state work correctly.
-    if ! _checkout_out=$(git -C repo checkout -B "${BRANCH}" "origin/${BRANCH}" 2>&1); then
+    if ! _checkout_out=$(git -C repo checkout -f -B "${BRANCH}" "origin/${BRANCH}" 2>&1); then
       echo "[pool] ERROR: Repo checkout of ${BRANCH} failed: ${_checkout_out}" >&2
       printf '%s' "checkout of ${BRANCH} failed" > "$GIT_FAILED_MARKER"
       return 1
@@ -512,7 +519,7 @@ prepare_workspace_git() {
         printf '%s' "post-assignment fetch of ${CHECKOUT_REF} failed" > "$GIT_FAILED_MARKER"
         return 1
       fi
-      if ! _checkout_out=$(git -C repo checkout -B "${BRANCH}" "refs/remotes/origin/pr-checkout" 2>&1); then
+      if ! _checkout_out=$(git -C repo checkout -f -B "${BRANCH}" "refs/remotes/origin/pr-checkout" 2>&1); then
         echo "[pool] ERROR: post-assignment checkout of ${CHECKOUT_REF} failed: ${_checkout_out}" >&2
         printf '%s' "post-assignment checkout of ${CHECKOUT_REF} failed" > "$GIT_FAILED_MARKER"
         return 1