@rallycry/conveyor-agent 10.13.18 → 10.13.50

package/dist/cli.js

@@ -1,7 +1,12 @@
 #!/usr/bin/env node
+import {
+  TOMBSTONE_MESSAGE,
+  isLegacyEntrypointLaunch
+} from "./chunk-6GS5ADIY.js";
 import {
   AgentConnection,
   ClaudeTuiAdapter,
+  CodespacePortVisibility,
   DEFAULT_LIFECYCLE_CONFIG,
   DEFAULT_SONNET_MODEL,
   Lifecycle,
@@ -12,14 +17,15 @@ import {
   TuiUnavailableError,
   applyBootstrapToEnv,
   awaitGitReady,
+  buildProjectTools,
   buildSessionPreviewPorts,
   buildSynthesizedCredentials,
   claudeJsonPath,
   cleanTerminalOutput,
   createServiceLogger,
-  defineTool,
   fetchBootstrap,
   findOnPath,
+  isPermissionDeniedError,
   loadConveyorConfig,
   loadForwardPorts,
   parseUsageGauges,
@@ -27,32 +33,32 @@ import {
   resolveSessionStart,
   runUsageProbe,
   sampleKeyUsage,
-  textResult
-} from "./chunk-3GDXX3OX.js";
-import "./chunk-7TQO4ZF4.js";
+  workspacePathExists
+} from "./chunk-36VMMHYD.js";
 import {
-  getWorkbenchClient
-} from "./chunk-UDSRAHKP.js";
+  reportBootMilestone
+} from "./chunk-KCB7CSWJ.js";
+import "./chunk-5OQQSDVT.js";
 import {
-  TOMBSTONE_MESSAGE,
-  isLegacyEntrypointLaunch
-} from "./chunk-6GS5ADIY.js";
-import "./chunk-UZTJJD7Y.js";
+  getWorkbenchClient
+} from "./chunk-QOJTJCYZ.js";
 import {
   workbenchEnabled
 } from "./chunk-4VUQ2NPF.js";
 import {
   buildPromptBytes,
   inheritedEnv,
-  loadPtySpawn,
+  resolvePtySpawn,
+  runSetupCommand,
   runStartCommand,
+  sessionTempBase,
   terminateProcessGroup
-} from "./chunk-72AEN6LB.js";
+} from "./chunk-XR6H326I.js";
 import "./chunk-JIGG755T.js";
 
 // src/cli.ts
 import { readFileSync } from "fs";
-import { join as join3, dirname as dirname2 } from "path";
+import { join as join4, dirname as dirname3 } from "path";
 import { fileURLToPath } from "url";
 
 // src/setup/sidecars.ts
@@ -202,31 +208,71 @@ async function waitForSidecars(opts = {}) {
   );
 }
 
-// src/setup/boot-milestone.ts
-var REPORT_TIMEOUT_MS = 5e3;
-async function reportBootMilestone(opts) {
-  const env = opts.env ?? process.env;
-  const apiUrl = env.CONVEYOR_API_URL;
-  const token = env.POD_BOOTSTRAP_TOKEN;
-  if (!apiUrl || !token) return false;
-  const fetchFn = opts.fetchFn ?? fetch;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? REPORT_TIMEOUT_MS);
+// src/setup/db-schema-sync.ts
+import { basename, dirname, join } from "path";
+var PRISMA_SCHEMA_CANDIDATES = [
+  "packages/db/prisma/schema.prisma",
+  "prisma/schema.prisma",
+  "apps/api/prisma/schema.prisma",
+  "packages/db/schema.prisma"
+];
+var PRISMA_DB_PUSH = "bunx prisma db push";
+var SCHEMA_SYNC_TIMEOUT_MS = 18e4;
+function depsInclude(rawDeps, dep) {
+  return (rawDeps ?? "").split(",").map((entry) => entry.trim()).includes(dep);
+}
+function isDisabled(env) {
+  const flag = env.CONVEYOR_DB_SCHEMA_SYNC?.trim().toLowerCase();
+  return flag === "0" || flag === "false";
+}
+function packageRootForSchema(schemaPath) {
+  const dir = dirname(schemaPath);
+  return basename(dir) === "prisma" ? dirname(dir) : dir;
+}
+async function resolveSchemaSyncPlan(options) {
+  const { workspaceDir, env } = options;
+  const pathExists = options.pathExists ?? workspacePathExists;
+  if (isDisabled(env)) return null;
+  const override = env.CONVEYOR_DB_SCHEMA_SYNC_COMMAND?.trim();
+  if (override) return { command: override, cwd: workspaceDir, source: "override" };
+  if (!depsInclude(env.CONVEYOR_DEPS, "postgresql")) return null;
+  if (!env.DATABASE_URL?.trim()) return null;
+  for (const relative of PRISMA_SCHEMA_CANDIDATES) {
+    const schemaPath = join(workspaceDir, relative);
+    if (await pathExists(schemaPath)) {
+      return { command: PRISMA_DB_PUSH, cwd: packageRootForSchema(schemaPath), source: "prisma" };
+    }
+  }
+  return null;
+}
+async function runDbSchemaSync(options) {
+  let plan = null;
   try {
-    const res = await fetchFn(`${apiUrl.replace(/\/$/, "")}/api/v3/pods/boot-milestone`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${token}`
-      },
-      body: JSON.stringify({ key: opts.key }),
-      signal: controller.signal
-    });
-    return res.ok;
+    plan = await resolveSchemaSyncPlan(options);
   } catch {
-    return false;
+    return "skipped";
+  }
+  if (!plan) return "skipped";
+  const { onOutput, runCommand } = options;
+  onOutput("stdout", `[db] syncing schema (${plan.source}): ${plan.command}
+`);
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const timer = setTimeout(abort, options.timeoutMs ?? SCHEMA_SYNC_TIMEOUT_MS);
+  timer.unref();
+  try {
+    await runCommand(plan.command, plan.cwd, onOutput, controller.signal);
+    onOutput("stdout", "[db] schema in sync\n");
+    return "synced";
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    onOutput("stderr", `[db] schema sync failed: ${message}
+`);
+    return "failed";
   } finally {
     clearTimeout(timer);
+    options.signal?.removeEventListener("abort", abort);
   }
 }
 
@@ -235,10 +281,11 @@ function defaultCommandExecutors() {
   if (workbenchEnabled()) {
     const client = getWorkbenchClient();
     return {
-      runStartCommand: (cmd, cwd, onOutput) => client.runStartCommand(cmd, cwd, onOutput)
+      runStartCommand: (cmd, cwd, onOutput) => client.runStartCommand(cmd, cwd, onOutput),
+      runShellCommand: (cmd, cwd, onOutput, signal) => client.runSetupCommand(cmd, cwd, onOutput, signal)
     };
   }
-  return { runStartCommand };
+  return { runStartCommand, runShellCommand: runSetupCommand };
 }
 var defaultWriteOutput = (stream, data) => {
   (stream === "stderr" ? process.stderr : process.stdout).write(data);
@@ -263,6 +310,7 @@ var WorkspaceCommandSupervisor = class {
   awaitGitReadyFn;
   waitForSidecarsFn;
   runStartCommandFn;
+  syncDbSchemaFn;
   loadForwardPortsFn;
   writeOutput;
   terminateStartCommand;
@@ -301,6 +349,13 @@ var WorkspaceCommandSupervisor = class {
     this.waitForSidecarsFn = options.waitForSidecars ?? ((opts) => waitForSidecars({ onLog: opts.onLog, signal: opts.signal }));
     const executors = defaultCommandExecutors();
     this.runStartCommandFn = options.runStartCommand ?? executors.runStartCommand;
+    this.syncDbSchemaFn = options.syncDbSchema ?? ((opts) => runDbSchemaSync({
+      workspaceDir: this.workspaceDir,
+      env: this.env,
+      runCommand: executors.runShellCommand,
+      onOutput: opts.onOutput,
+      signal: opts.signal
+    }));
     this.loadForwardPortsFn = options.loadForwardPorts ?? loadForwardPorts;
     this.writeOutput = options.writeOutput ?? defaultWriteOutput;
     this.terminateStartCommand = options.terminateStartCommand ?? terminateProcessGroup;
@@ -352,7 +407,6 @@ var WorkspaceCommandSupervisor = class {
       });
       return;
     }
-    if (gitState === "ready") this.reportBootMilestoneFn("git_ready");
     await this.waitForSidecarsFn({
       onLog: (message) => this.forwardSetupOutput("stdout", `[sidecars] ${message}
 `),
@@ -362,6 +416,8 @@ var WorkspaceCommandSupervisor = class {
     this.reportBootMilestoneFn("sidecars_ready");
     await this.loopReady;
     if (this.stopped) return;
+    await this.syncDbSchema();
+    if (this.stopped) return;
     const startCommandRunning = this.config?.startCommand ? await this.ensureStartCommandLaunched(this.config.startCommand) : false;
     if (this.stopped) return;
     this.reportBootMilestoneFn("start_command_launched");
@@ -374,6 +430,20 @@ var WorkspaceCommandSupervisor = class {
       ...previewPorts.length > 0 ? { previewPorts } : {}
     });
   }
+  /** Run the schema sync, forwarding its output as setup output so it lands in
+   *  the card's setup log. A failure is announced rather than thrown: it is the
+   *  exact condition that used to render as a silent "Displaying 0 results". */
+  async syncDbSchema() {
+    const outcome = await this.syncDbSchemaFn({
+      onOutput: (stream, data) => this.forwardSetupOutput(stream, data),
+      signal: this.abortController.signal
+    });
+    if (outcome !== "failed" || this.stopped) return;
+    this.connection.sendEvent({
+      type: "setup_error",
+      message: "Database schema sync failed \u2014 the app may error on queries touching recently added columns (see pod logs)"
+    });
+  }
   restartStartCommand() {
     if (this.stopped || !this.config?.startCommand) return;
     this.connection.sendEvent({
@@ -696,8 +766,7 @@ var ProjectSessionRunner = class {
 
 // src/usage/multi-key-probe.ts
 import { mkdtemp, writeFile, copyFile, rm } from "fs/promises";
-import { tmpdir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 var logger = createServiceLogger("multi-key-probe");
 function gaugesToSamples(stdout) {
   const { sessionUsage, weeklyUsage, sessionResetsAt, weeklyResetsAt, gauges } = parseUsageGauges(stdout);
@@ -725,12 +794,12 @@ function gaugesToSamples(stdout) {
 async function isolatedProbe(token, now) {
   let dir = null;
   try {
-    dir = await mkdtemp(join(tmpdir(), "conveyor-usage-"));
-    await writeFile(join(dir, ".credentials.json"), buildSynthesizedCredentials(token, now), {
+    dir = await mkdtemp(join2(sessionTempBase(), "conveyor-usage-"));
+    await writeFile(join2(dir, ".credentials.json"), buildSynthesizedCredentials(token, now), {
       encoding: "utf8",
       mode: 384
     });
-    await copyFile(claudeJsonPath(), join(dir, ".claude.json")).catch(() => {
+    await copyFile(claudeJsonPath(), join2(dir, ".claude.json")).catch(() => {
     });
     return await runUsageProbe({ env: { ...process.env, CLAUDE_CONFIG_DIR: dir } });
   } catch (error) {
@@ -767,18 +836,18 @@ async function probeKeysUsage(keys, deps = {}) {
 
 // src/harness/pty/adapters/opencode-auth.ts
 import { promises as fs } from "fs";
-import { dirname, join as join2 } from "path";
+import { dirname as dirname2, join as join3 } from "path";
 import { homedir } from "os";
 var logger2 = createServiceLogger("opencode-auth");
 var OPENCODE_CODEX_PLUGIN = "opencode-openai-codex-auth@4.4.0";
 var PLUGIN_PACKAGE = "opencode-openai-codex-auth";
 function opencodeAuthPath(env) {
-  const dataHome = env.XDG_DATA_HOME ?? join2(env.HOME ?? homedir(), ".local", "share");
-  return join2(dataHome, "opencode", "auth.json");
+  const dataHome = env.XDG_DATA_HOME ?? join3(env.HOME ?? homedir(), ".local", "share");
+  return join3(dataHome, "opencode", "auth.json");
 }
 function opencodeConfigPath(env) {
-  const configHome = env.XDG_CONFIG_HOME ?? join2(env.HOME ?? homedir(), ".config");
-  return join2(configHome, "opencode", "opencode.json");
+  const configHome = env.XDG_CONFIG_HOME ?? join3(env.HOME ?? homedir(), ".config");
+  return join3(configHome, "opencode", "opencode.json");
 }
 function parseOauthSeed(b64) {
   if (!b64) return null;
@@ -808,7 +877,7 @@ async function readJsonFile(path) {
   }
 }
 async function writeJsonFile(path, value) {
-  await fs.mkdir(dirname(path), { recursive: true });
+  await fs.mkdir(dirname2(path), { recursive: true });
   await fs.writeFile(path, `${JSON.stringify(value, null, 2)}
 `, { mode: 384 });
 }
@@ -926,267 +995,6 @@ function resolveTuiAdapter(kind = "claude-code") {
   }
 }
 
-// src/tools/project-tools.ts
-import { z } from "zod";
-var CONTEXT_PATH_SHAPE = z.object({
-  type: z.enum(["rule", "doc", "file", "folder"]).describe("Link kind"),
-  path: z.string().min(1).max(500).describe("Repo-relative path"),
-  label: z.string().max(100).optional()
-});
-function errText(prefix, error) {
-  return textResult(`${prefix}: ${error instanceof Error ? error.message : "Unknown error"}`);
-}
-function buildListTagsTool(connection, projectId) {
-  return defineTool(
-    "list_tags",
-    "List this project's tags (id, name, color). Use the ids with update_tag.",
-    {},
-    async () => {
-      try {
-        const tags = await connection.call("listProjectTags", { projectId });
-        return textResult(JSON.stringify(tags, null, 2));
-      } catch (error) {
-        return errText("Failed to list tags", error);
-      }
-    },
-    { annotations: { readOnlyHint: true } }
-  );
-}
-function buildCreateTagTool(connection, projectId) {
-  return defineTool(
-    "create_tag",
-    "Create a project tag. Include a crisp description and contextPaths (rule/doc/file/folder links agents auto-load when working on matching tasks). Fails if the name already exists.",
-    {
-      name: z.string().min(1).max(50),
-      color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional().describe("#RRGGBB (default gray)"),
-      description: z.string().max(500).optional(),
-      contextPaths: z.array(CONTEXT_PATH_SHAPE).max(20).optional()
-    },
-    async ({ name, color, description, contextPaths }) => {
-      try {
-        const result = await connection.call("createProjectTag", {
-          projectId,
-          name,
-          color,
-          description,
-          contextPaths
-        });
-        return textResult(`Tag created: ${result.id}`);
-      } catch (error) {
-        return errText("Failed to create tag", error);
-      }
-    }
-  );
-}
-function buildUpdateTagTool(connection, projectId) {
-  return defineTool(
-    "update_tag",
-    "Update a tag's name, color, description, or contextPaths. contextPaths is a FULL replacement \u2014 include existing links you want to keep. Verify paths exist in the repo first.",
-    {
-      tagId: z.string().describe("Tag id from list_tags"),
-      name: z.string().min(1).max(50).optional(),
-      color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
-      description: z.string().max(500).optional(),
-      contextPaths: z.array(CONTEXT_PATH_SHAPE).max(20).optional()
-    },
-    async ({ tagId, name, color, description, contextPaths }) => {
-      try {
-        await connection.call("updateProjectTag", {
-          projectId,
-          tagId,
-          name,
-          color,
-          description,
-          contextPaths
-        });
-        return textResult(`Tag updated: ${tagId}`);
-      } catch (error) {
-        return errText("Failed to update tag", error);
-      }
-    }
-  );
-}
-function buildCreateSuggestionTool(connection, projectId) {
-  return defineTool(
-    "create_suggestion",
-    "File a project suggestion (idea/improvement for maintainers to review). Duplicates are AI-deduped into an existing suggestion with an upvote. Returns the suggestion id.",
-    {
-      title: z.string().min(1).describe("Short title"),
-      description: z.string().optional().describe("1-3 sentences: what should change and why"),
-      tag_names: z.array(z.string()).optional().describe("Tag names to categorize")
-    },
-    async ({ title, description, tag_names }) => {
-      try {
-        const result = await connection.call("createProjectSuggestion", {
-          projectId,
-          title,
-          description,
-          tagNames: tag_names
-        });
-        return textResult(
-          result.merged ? `Merged into existing suggestion ${result.mergedIntoId ?? result.id} (id: ${result.id})` : `Suggestion created: ${result.id}`
-        );
-      } catch (error) {
-        return errText("Failed to create suggestion", error);
-      }
-    }
-  );
-}
-function buildPostToProjectChatTool(connection, projectId) {
-  return defineTool(
-    "post_to_project_chat",
-    "Post a markdown message to the PROJECT chat \u2014 use once at the end of an audit for the summary the team reads.",
-    {
-      message: z.string().min(1).max(2e4),
-      kind: z.enum(["tag_audit_summary"]).optional().describe(
-        "Set to 'tag_audit_summary' when posting a tag-audit summary so it is also saved to the persistent tag history"
-      )
-    },
-    async ({ message, kind }) => {
-      try {
-        await connection.call("postToProjectChat", { projectId, content: message, kind });
-        return textResult("Posted to project chat");
-      } catch (error) {
-        return errText("Failed to post to project chat", error);
-      }
-    }
-  );
-}
-function buildGetProjectTaskTool(connection, projectId) {
-  return defineTool(
-    "get_project_task",
-    "Fetch any task in the project by id or slug: title, description, plan, status, and metadata. The audit evidence trail starts here.",
-    {
-      taskId: z.string().describe("Task id or slug")
-    },
-    async ({ taskId }) => {
-      try {
-        const task = await connection.call("getProjectTask", { projectId, taskId });
-        return textResult(JSON.stringify(task, null, 2));
-      } catch (error) {
-        return errText("Failed to get task", error);
-      }
-    },
-    { annotations: { readOnlyHint: true } }
-  );
-}
-function buildReadProjectTaskChatTool(connection, projectId) {
-  return defineTool(
-    "read_project_task_chat",
-    "Read any project task's chat messages (newest last). role 'user' rows are HUMAN turns; 'assistant'/'system' rows are agent posts and activity-log entries.",
-    {
-      taskId: z.string().describe("Task id or slug"),
-      limit: z.number().int().min(1).max(200).optional().describe("Messages to fetch (default 50)")
-    },
-    async ({ taskId, limit }) => {
-      try {
-        const chat = await connection.call("getProjectTaskChat", {
-          projectId,
-          taskId,
-          limit: limit ?? 50
-        });
-        return textResult(JSON.stringify(chat, null, 2));
-      } catch (error) {
-        return errText("Failed to read task chat", error);
-      }
-    },
-    { annotations: { readOnlyHint: true } }
-  );
-}
-function buildGetProjectTaskLogsTool(connection, projectId) {
-  return defineTool(
-    "get_project_task_logs",
-    "Read any project task's persisted agent event stream (message / tool_use / turn_end / error / completed). Turn boundaries are turn_end events. Entries are truncated to ~2KB each; max 500 per call.",
-    {
-      taskId: z.string().describe("Task id or slug"),
-      limit: z.number().int().min(1).max(500).optional().describe("Entries to fetch (default 50)"),
-      source: z.enum(["agent", "application"]).optional().describe("Filter: 'agent' = model events (default useful for grading)")
-    },
-    async ({ taskId, limit, source }) => {
-      try {
-        const logs = await connection.call("getProjectTaskCli", {
-          projectId,
-          taskId,
-          limit: limit ?? 50,
-          source
-        });
-        return textResult(JSON.stringify(logs, null, 2));
-      } catch (error) {
-        return errText("Failed to get task logs", error);
-      }
-    },
-    { annotations: { readOnlyHint: true } }
-  );
-}
-var TURN_GRADE_SHAPE = z.object({
-  turnIndex: z.number().int().min(0),
-  phase: z.enum(["planning", "building", "human"]),
-  grade: z.enum(["correct", "neutral", "blunder"]),
-  reasoning: z.string(),
-  eventType: z.string().describe('e.g. "message", "tool_use", "human_message"'),
-  eventSummary: z.string().max(200).describe("\u2264120 chars of what happened this turn")
-});
-var HUMAN_EVAL_SHAPE = z.object({
-  messageIndex: z.number().int().min(0).describe("Index into the task's human messages, oldest first"),
-  rating: z.number().int().min(-1).max(1),
-  reasoning: z.string()
-});
-function buildReportTaskAuditResultTool(connection, projectId) {
-  return defineTool(
-    "report_task_audit_result",
-    "Persist one audited task's grades (call once per task after grading it). Pass error instead to mark the audit failed when the evidence is unusable.",
-    {
-      taskId: z.string().describe("The audited task's id (NOT slug)"),
-      summary: z.string().describe("3-6 sentences: what went well, what was wasted"),
-      turnGrades: z.array(TURN_GRADE_SHAPE),
-      planningAccuracy: z.number().min(0).max(1).nullable(),
-      buildingAccuracy: z.number().min(0).max(1).nullable(),
-      humanAccuracy: z.number().min(0).max(1).nullable(),
-      planningCorrect: z.number().int().min(0),
-      planningNeutral: z.number().int().min(0),
-      planningBlunder: z.number().int().min(0),
-      buildingCorrect: z.number().int().min(0),
-      buildingNeutral: z.number().int().min(0),
-      buildingBlunder: z.number().int().min(0),
-      humanCorrect: z.number().int().min(0),
-      humanNeutral: z.number().int().min(0),
-      humanBlunder: z.number().int().min(0),
-      humanEvaluations: z.array(HUMAN_EVAL_SHAPE).optional(),
-      suggestionIds: z.array(z.string()).describe("Suggestion ids filed for this task, or []"),
-      auditCostUsd: z.number().nullable(),
-      model: z.string().nullable().describe("The model you are running as"),
-      error: z.string().optional().describe("Set ONLY to mark this task's audit failed")
-    },
-    async (input) => {
-      try {
-        await connection.call("reportTaskAuditResult", {
-          projectId,
-          ...input,
-          humanEvaluations: input.humanEvaluations ?? []
-        });
-        return textResult(
-          input.error ? `Audit for ${input.taskId} marked failed` : `Audit result saved for ${input.taskId}`
-        );
-      } catch (error) {
-        return errText("Failed to report audit result", error);
-      }
-    }
-  );
-}
-function buildProjectTools(connection, projectId) {
-  return [
-    buildListTagsTool(connection, projectId),
-    buildCreateTagTool(connection, projectId),
-    buildUpdateTagTool(connection, projectId),
-    buildCreateSuggestionTool(connection, projectId),
-    buildPostToProjectChatTool(connection, projectId),
-    buildGetProjectTaskTool(connection, projectId),
-    buildReadProjectTaskChatTool(connection, projectId),
-    buildGetProjectTaskLogsTool(connection, projectId),
-    buildReportTaskAuditResultTool(connection, projectId)
-  ];
-}
-
 // src/runner/adhoc-session-runner.ts
 var ADHOC_SYSTEM_NOTE = "You are running in an ad-hoc Conveyor scratch pod \u2014 an interactive terminal on the project's repository checked out at its default branch. There is no task or plan; help the human with whatever they ask directly.";
 var HEADLESS_SYSTEM_NOTE = "You are running a HEADLESS Conveyor session on the project's repository \u2014 your instructions were auto-submitted as the first message. Work them to completion autonomously and never wait for user input; a human may attach to this terminal to watch or interject, but none is required.";
@@ -1205,11 +1013,14 @@ function resolveAdhocTui(env) {
   if (TUI_KINDS.includes(raw)) return raw;
   throw new Error(`Unknown TUI "${raw}" in CONVEYOR_TUI (expected: ${TUI_KINDS.join(", ")})`);
 }
-function buildAdhocPtyBridge(connection) {
+function buildAdhocPtyBridge(connection, onInputActivity) {
   return {
     sendOutput: (data, dims) => connection.sendPtyOutput(data, dims),
     sendChatEvent: (event) => connection.sendPtyChatEvent(event),
-    onInput: (handler) => connection.onPtyInput(handler),
+    onInput: (handler) => connection.onPtyInput((data) => {
+      onInputActivity?.();
+      handler(data);
+    }),
     onResize: (handler) => connection.onPtyResize(handler)
   };
 }
@@ -1258,11 +1069,18 @@ var AdhocSessionRunner = class {
     this.callbacks = callbacks;
     this.connection = deps?.connection ?? new AgentConnection(config.connection);
     this.harness = deps?.harness ?? new PtyHarness(
-      buildAdhocPtyBridge(this.connection),
+      // A keystroke is real human activity — re-arm the idle backstop so an
+      // actively-typing human (or a >60-min audit run) is never hard-stopped
+      // by the idle timer, mirroring ShellSessionRunner. `this.lifecycle` is
+      // assigned later in this constructor but is always set by the time a
+      // keystroke can arrive at runtime.
+      buildAdhocPtyBridge(this.connection, () => this.lifecycle.startIdleTimer()),
       resolveTuiAdapter(resolveAdhocTui(process.env))
     );
+    const portVisibility = new CodespacePortVisibility();
     this.portDiscovery = deps?.portDiscovery ?? new PortDiscovery({
-      report: (ports) => this.connection.reportDiscoveredPorts(ports)
+      report: (ports) => this.connection.reportDiscoveredPorts(ports),
+      onReported: (ports) => portVisibility.ensureVisible(ports.map(({ port }) => port))
     });
     this.commandSupervisor = deps?.commandSupervisor ?? new WorkspaceCommandSupervisor({
       config: loadConveyorConfig(),
@@ -1344,7 +1162,11 @@ var AdhocSessionRunner = class {
       initialPrompt,
       conveyorMcpServer: this.harness.createMcpServer({
         name: "conveyor",
-        tools: buildProjectTools(this.connection, this.config.projectId)
+        tools: buildProjectTools(
+          this.connection,
+          this.config.projectId,
+          this.config.workspaceDir
+        )
       })
     } : void 0;
     const options = buildAdhocQueryOptions(
@@ -1463,9 +1285,9 @@ function buildReviewChildEnv(baseEnv, data) {
   env.CONVEYOR_TASK_TOKEN = data.sessionJwt;
   env.CONVEYOR_SESSION_ID = data.sessionId;
   env.CONVEYOR_MODE = "code-review";
+  env.CONVEYOR_WORKBENCH_TOKEN ??= baseEnv.POD_BOOTSTRAP_TOKEN;
   delete env.POD_BOOTSTRAP_TOKEN;
   delete env.CONVEYOR_BOOTSTRAP_TOKEN;
-  delete env.CONVEYOR_SETUP_COMMAND;
   delete env.CONVEYOR_START_COMMAND;
   delete env.CONVEYOR_GIT_READY;
   delete env.CONVEYOR_GIT_READY_MARKER;
@@ -1621,7 +1443,6 @@ function buildSpawnedChildEnv(baseEnv, data) {
   env.CONVEYOR_PROJECT_ID = data.projectId;
   delete env.POD_BOOTSTRAP_TOKEN;
   delete env.CONVEYOR_BOOTSTRAP_TOKEN;
-  delete env.CONVEYOR_SETUP_COMMAND;
   delete env.CONVEYOR_START_COMMAND;
   delete env.CONVEYOR_AGENT_MODE;
   delete env.CONVEYOR_IS_AUTO;
@@ -1759,7 +1580,7 @@ var ShellSessionRunner = class {
   constructor(config, deps) {
     this.config = config;
     this.connection = deps?.connection ?? new AgentConnection(config.connection);
-    this.loadSpawn = deps?.loadSpawn ?? loadPtySpawn;
+    this.loadSpawn = deps?.loadSpawn ?? resolvePtySpawn;
     this.lifecycle = new Lifecycle(
       // No git flush — the human commits/pushes explicitly from the shell.
       { ...DEFAULT_LIFECYCLE_CONFIG, gitFlushIntervalMs: 0, ...config.lifecycle },
@@ -1898,9 +1719,14 @@ function createSpawnedChildRunner(inputs) {
   );
 }
 
+// src/runner/host-modes.ts
+function hostsSpawnedChildren(mode) {
+  return mode === "task" || mode === "pack";
+}
+
 // src/cli.ts
 if (process.argv[2] === "boot") {
-  const { runBoot } = await import("./boot-YZCOIV3Q.js");
+  const { runBoot } = await import("./boot-I353EAK6.js");
   process.exit(await runBoot(process.argv.slice(3)));
 }
 if (isLegacyEntrypointLaunch(process.env)) {
@@ -1909,8 +1735,8 @@ if (isLegacyEntrypointLaunch(process.env)) {
   process.exit(1);
 }
 if (process.argv.includes("--version")) {
-  const __dirname = dirname2(fileURLToPath(import.meta.url));
-  const pkgPath = join3(__dirname, "..", "package.json");
+  const __dirname = dirname3(fileURLToPath(import.meta.url));
+  const pkgPath = join4(__dirname, "..", "package.json");
   const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
   process.stdout.write(pkg.version + "\n");
   process.exit(0);
@@ -1918,6 +1744,7 @@ if (process.argv.includes("--version")) {
 var logger6 = createServiceLogger("CLI");
 var exitContext = {};
 var exitLogged = false;
+var shuttingDown = false;
 function logAgentExit(reason, opts) {
   if (exitLogged) return;
   exitLogged = true;
@@ -1970,28 +1797,39 @@ function isExpectedAbortError(error) {
   const hasAbortCode = !("code" in error) || error.code === void 0 || error.code === "ABORT_ERR";
   return hasAbortMessage && hasAbortCode;
 }
+function exitOnPermissionDenial(err) {
+  if (!isPermissionDeniedError(err)) return false;
+  logger6.error("Not authorized for this project \u2014 parking instead of crash-looping", {
+    error: err.message
+  });
+  logAgentExit("unauthorized", { exitCode: 0 });
+  process.exit(0);
+}
 process.on("uncaughtException", (err) => {
   if (err.code === "EPIPE") return;
-  if (isExpectedAbortError(err)) {
+  if (shuttingDown && isExpectedAbortError(err)) {
     logger6.info("Ignored expected abort after shutdown", { error: err.message, code: err.code });
     return;
   }
+  if (exitOnPermissionDenial(err)) return;
   logger6.error("Uncaught exception", { error: err.message, code: err.code });
   logAgentExit("uncaught_exception", { exitCode: 1 });
   process.exit(1);
 });
 process.on("unhandledRejection", (reason) => {
   const err = reason instanceof Error ? reason : new Error(String(reason));
-  if (isExpectedAbortError(err)) {
+  if (shuttingDown && isExpectedAbortError(err)) {
     logger6.info("Ignored expected abort rejection after shutdown", { error: err.message });
     return;
   }
+  if (exitOnPermissionDenial(err)) return;
   logger6.error("Unhandled rejection", { error: err.message });
   logAgentExit("unhandled_rejection", { exitCode: 1 });
   process.exit(1);
 });
 if (process.env.CONVEYOR_MODE === "workbench") {
-  const { startWorkbenchServer } = await import("./server-BXAFMYDM.js");
+  const { startWorkbenchServer } = await import("./server-NIOBJ46G.js");
+  const { oomWatchdogOptionsFromEnv } = await import("./oom-watchdog-U7JERHA2.js");
   const { DEFAULT_WORKBENCH_PORT } = await import("./protocol-QLVS5W6O.js");
   const port = Number(process.env.CONVEYOR_WORKBENCH_PORT) || DEFAULT_WORKBENCH_PORT;
   const token = process.env.CONVEYOR_WORKBENCH_TOKEN ?? process.env.POD_BOOTSTRAP_TOKEN ?? "";
@@ -1999,12 +1837,17 @@ if (process.env.CONVEYOR_MODE === "workbench") {
     logger6.error("workbench mode requires POD_BOOTSTRAP_TOKEN (or CONVEYOR_WORKBENCH_TOKEN)");
     process.exit(1);
   }
-  const pkgDir = dirname2(fileURLToPath(import.meta.url));
-  const pkg = JSON.parse(readFileSync(join3(pkgDir, "..", "package.json"), "utf-8"));
+  const pkgDir = dirname3(fileURLToPath(import.meta.url));
+  const pkg = JSON.parse(readFileSync(join4(pkgDir, "..", "package.json"), "utf-8"));
   const handle = await startWorkbenchServer({
     port,
     token,
-    version: pkg.version ?? "unknown"
+    version: pkg.version ?? "unknown",
+    oomWatchdog: oomWatchdogOptionsFromEnv({
+      info: (m) => logger6.info(m),
+      warn: (m) => logger6.warn(m),
+      error: (m) => logger6.error(m)
+    })
   });
   logger6.info(`Workbench launcher listening on 127.0.0.1:${handle.port}`);
   process.on("SIGTERM", () => process.exit(0));
@@ -2060,8 +1903,14 @@ if (!CONVEYOR_TASK_ID && projectIdentity && CONVEYOR_MODE === "adhoc") {
   exitContext.sessionId = projectIdentity.sessionId;
   exitContext.workspaceId = projectIdentity.workspaceId;
   exitContext.runnerMode = "adhoc";
-  process.on("SIGTERM", () => adhocRunner.stop());
-  process.on("SIGINT", () => adhocRunner.stop());
+  process.on("SIGTERM", () => {
+    shuttingDown = true;
+    adhocRunner.stop();
+  });
+  process.on("SIGINT", () => {
+    shuttingDown = true;
+    adhocRunner.stop();
+  });
   await adhocRunner.run();
   const adhocError = adhocRunner.finalState === "error";
   logAgentExit(adhocError ? "error" : "clean", {
@@ -2093,8 +1942,14 @@ if (!CONVEYOR_TASK_ID && projectIdentity) {
   exitContext.sessionId = projectIdentity.sessionId;
   exitContext.workspaceId = projectIdentity.workspaceId;
   exitContext.runnerMode = "pm";
-  process.on("SIGTERM", () => projectRunner.stop());
-  process.on("SIGINT", () => projectRunner.stop());
+  process.on("SIGTERM", () => {
+    shuttingDown = true;
+    projectRunner.stop();
+  });
+  process.on("SIGINT", () => {
+    shuttingDown = true;
+    projectRunner.stop();
+  });
   await projectRunner.run();
   const projectError = projectRunner.finalState === "error";
   logAgentExit(projectError ? "error" : "clean", {
@@ -2145,8 +2000,14 @@ if (CONVEYOR_MODE === "shell" || CONVEYOR_MODE === "adhoc") {
     mode: CONVEYOR_MODE,
     sessionId: spawnedSessionId
   });
-  process.on("SIGTERM", () => childRunner.stop());
-  process.on("SIGINT", () => childRunner.stop());
+  process.on("SIGTERM", () => {
+    shuttingDown = true;
+    childRunner.stop();
+  });
+  process.on("SIGINT", () => {
+    shuttingDown = true;
+    childRunner.stop();
+  });
   await childRunner.run();
   const childError = childRunner.finalState === "error";
   logAgentExit(childError ? "error" : "clean", {
@@ -2191,6 +2052,7 @@ var shutdownSignal;
 var workspaceCommandSupervisor = null;
 var shutdownCompletion = null;
 var shutdownAgent = (signal) => {
+  shuttingDown = true;
   logger6.info(`Received ${signal}, flushing git and stopping agent`);
   const commandShutdown = stopWorkspaceCommands(workspaceCommandSupervisor);
   shutdownSignal = signal;
@@ -2254,7 +2116,7 @@ void checkSessionTaskIdentity({
   },
   logger: logger6
 });
-if (CONVEYOR_MODE === "task") {
+if (hostsSpawnedChildren(CONVEYOR_MODE)) {
   runner.connection.onSpawnReview((data) => {
     void reviewChildren.spawn(data).catch((err) => {
       logger6.error("Review child spawn threw", {
@@ -2267,7 +2129,7 @@ if (CONVEYOR_MODE === "task") {
     });
   });
 }
-if (CONVEYOR_MODE === "task" || CONVEYOR_MODE === "pack") {
+if (hostsSpawnedChildren(CONVEYOR_MODE)) {
   runner.connection.onSpawnTui((data) => {
     void sessionChildren.spawn(data).catch((err) => {
       logger6.error("Session child spawn threw", {