@rallycry/conveyor-agent 10.13.18 → 10.13.51

package/dist/cli.js

@@ -1,53 +1,55 @@
 #!/usr/bin/env node
+import {
+  TOMBSTONE_MESSAGE,
+  isLegacyEntrypointLaunch
+} from "./chunk-6GS5ADIY.js";
 import {
   AgentConnection,
-  ClaudeTuiAdapter,
+  CodespacePortVisibility,
   DEFAULT_LIFECYCLE_CONFIG,
   DEFAULT_SONNET_MODEL,
   Lifecycle,
   PortDiscovery,
   PtyHarness,
   SessionRunner,
-  TUI_KINDS,
-  TuiUnavailableError,
   applyBootstrapToEnv,
   awaitGitReady,
+  buildProjectTools,
   buildSessionPreviewPorts,
   buildSynthesizedCredentials,
   claudeJsonPath,
-  cleanTerminalOutput,
   createServiceLogger,
-  defineTool,
   fetchBootstrap,
-  findOnPath,
+  isPermissionDeniedError,
   loadConveyorConfig,
   loadForwardPorts,
   parseUsageGauges,
   resolvePlaywrightMcpServer,
   resolveSessionStart,
+  resolveTuiAdapter,
+  resolveTuiKindFromEnv,
   runUsageProbe,
   sampleKeyUsage,
-  textResult
-} from "./chunk-3GDXX3OX.js";
-import "./chunk-7TQO4ZF4.js";
+  workspacePathExists
+} from "./chunk-EQO7QFGN.js";
 import {
-  getWorkbenchClient
-} from "./chunk-UDSRAHKP.js";
+  reportBootMilestone
+} from "./chunk-KCB7CSWJ.js";
+import "./chunk-5OQQSDVT.js";
 import {
-  TOMBSTONE_MESSAGE,
-  isLegacyEntrypointLaunch
-} from "./chunk-6GS5ADIY.js";
-import "./chunk-UZTJJD7Y.js";
+  getWorkbenchClient
+} from "./chunk-QOJTJCYZ.js";
 import {
   workbenchEnabled
 } from "./chunk-4VUQ2NPF.js";
 import {
-  buildPromptBytes,
   inheritedEnv,
-  loadPtySpawn,
+  resolvePtySpawn,
+  runSetupCommand,
   runStartCommand,
+  sessionTempBase,
   terminateProcessGroup
-} from "./chunk-72AEN6LB.js";
+} from "./chunk-KZQBYSMN.js";
 import "./chunk-JIGG755T.js";
 
 // src/cli.ts
@@ -202,31 +204,71 @@ async function waitForSidecars(opts = {}) {
   );
 }
 
-// src/setup/boot-milestone.ts
-var REPORT_TIMEOUT_MS = 5e3;
-async function reportBootMilestone(opts) {
-  const env = opts.env ?? process.env;
-  const apiUrl = env.CONVEYOR_API_URL;
-  const token = env.POD_BOOTSTRAP_TOKEN;
-  if (!apiUrl || !token) return false;
-  const fetchFn = opts.fetchFn ?? fetch;
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), opts.timeoutMs ?? REPORT_TIMEOUT_MS);
+// src/setup/db-schema-sync.ts
+import { basename, dirname, join } from "path";
+var PRISMA_SCHEMA_CANDIDATES = [
+  "packages/db/prisma/schema.prisma",
+  "prisma/schema.prisma",
+  "apps/api/prisma/schema.prisma",
+  "packages/db/schema.prisma"
+];
+var PRISMA_DB_PUSH = "bunx prisma db push";
+var SCHEMA_SYNC_TIMEOUT_MS = 18e4;
+function depsInclude(rawDeps, dep) {
+  return (rawDeps ?? "").split(",").map((entry) => entry.trim()).includes(dep);
+}
+function isDisabled(env) {
+  const flag = env.CONVEYOR_DB_SCHEMA_SYNC?.trim().toLowerCase();
+  return flag === "0" || flag === "false";
+}
+function packageRootForSchema(schemaPath) {
+  const dir = dirname(schemaPath);
+  return basename(dir) === "prisma" ? dirname(dir) : dir;
+}
+async function resolveSchemaSyncPlan(options) {
+  const { workspaceDir, env } = options;
+  const pathExists = options.pathExists ?? workspacePathExists;
+  if (isDisabled(env)) return null;
+  const override = env.CONVEYOR_DB_SCHEMA_SYNC_COMMAND?.trim();
+  if (override) return { command: override, cwd: workspaceDir, source: "override" };
+  if (!depsInclude(env.CONVEYOR_DEPS, "postgresql")) return null;
+  if (!env.DATABASE_URL?.trim()) return null;
+  for (const relative of PRISMA_SCHEMA_CANDIDATES) {
+    const schemaPath = join(workspaceDir, relative);
+    if (await pathExists(schemaPath)) {
+      return { command: PRISMA_DB_PUSH, cwd: packageRootForSchema(schemaPath), source: "prisma" };
+    }
+  }
+  return null;
+}
+async function runDbSchemaSync(options) {
+  let plan = null;
   try {
-    const res = await fetchFn(`${apiUrl.replace(/\/$/, "")}/api/v3/pods/boot-milestone`, {
-      method: "POST",
-      headers: {
-        "content-type": "application/json",
-        authorization: `Bearer ${token}`
-      },
-      body: JSON.stringify({ key: opts.key }),
-      signal: controller.signal
-    });
-    return res.ok;
+    plan = await resolveSchemaSyncPlan(options);
   } catch {
-    return false;
+    return "skipped";
+  }
+  if (!plan) return "skipped";
+  const { onOutput, runCommand } = options;
+  onOutput("stdout", `[db] syncing schema (${plan.source}): ${plan.command}
+`);
+  const controller = new AbortController();
+  const abort = () => controller.abort();
+  options.signal?.addEventListener("abort", abort, { once: true });
+  const timer = setTimeout(abort, options.timeoutMs ?? SCHEMA_SYNC_TIMEOUT_MS);
+  timer.unref();
+  try {
+    await runCommand(plan.command, plan.cwd, onOutput, controller.signal);
+    onOutput("stdout", "[db] schema in sync\n");
+    return "synced";
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    onOutput("stderr", `[db] schema sync failed: ${message}
+`);
+    return "failed";
   } finally {
     clearTimeout(timer);
+    options.signal?.removeEventListener("abort", abort);
   }
 }
 
@@ -235,10 +277,11 @@ function defaultCommandExecutors() {
   if (workbenchEnabled()) {
     const client = getWorkbenchClient();
     return {
-      runStartCommand: (cmd, cwd, onOutput) => client.runStartCommand(cmd, cwd, onOutput)
+      runStartCommand: (cmd, cwd, onOutput) => client.runStartCommand(cmd, cwd, onOutput),
+      runShellCommand: (cmd, cwd, onOutput, signal) => client.runSetupCommand(cmd, cwd, onOutput, signal)
     };
   }
-  return { runStartCommand };
+  return { runStartCommand, runShellCommand: runSetupCommand };
 }
 var defaultWriteOutput = (stream, data) => {
   (stream === "stderr" ? process.stderr : process.stdout).write(data);
@@ -263,6 +306,7 @@ var WorkspaceCommandSupervisor = class {
   awaitGitReadyFn;
   waitForSidecarsFn;
   runStartCommandFn;
+  syncDbSchemaFn;
   loadForwardPortsFn;
   writeOutput;
   terminateStartCommand;
@@ -301,6 +345,13 @@ var WorkspaceCommandSupervisor = class {
     this.waitForSidecarsFn = options.waitForSidecars ?? ((opts) => waitForSidecars({ onLog: opts.onLog, signal: opts.signal }));
     const executors = defaultCommandExecutors();
     this.runStartCommandFn = options.runStartCommand ?? executors.runStartCommand;
+    this.syncDbSchemaFn = options.syncDbSchema ?? ((opts) => runDbSchemaSync({
+      workspaceDir: this.workspaceDir,
+      env: this.env,
+      runCommand: executors.runShellCommand,
+      onOutput: opts.onOutput,
+      signal: opts.signal
+    }));
     this.loadForwardPortsFn = options.loadForwardPorts ?? loadForwardPorts;
     this.writeOutput = options.writeOutput ?? defaultWriteOutput;
     this.terminateStartCommand = options.terminateStartCommand ?? terminateProcessGroup;
@@ -352,7 +403,6 @@ var WorkspaceCommandSupervisor = class {
       });
       return;
     }
-    if (gitState === "ready") this.reportBootMilestoneFn("git_ready");
     await this.waitForSidecarsFn({
       onLog: (message) => this.forwardSetupOutput("stdout", `[sidecars] ${message}
 `),
@@ -362,6 +412,8 @@ var WorkspaceCommandSupervisor = class {
     this.reportBootMilestoneFn("sidecars_ready");
     await this.loopReady;
     if (this.stopped) return;
+    await this.syncDbSchema();
+    if (this.stopped) return;
     const startCommandRunning = this.config?.startCommand ? await this.ensureStartCommandLaunched(this.config.startCommand) : false;
     if (this.stopped) return;
     this.reportBootMilestoneFn("start_command_launched");
@@ -374,6 +426,20 @@ var WorkspaceCommandSupervisor = class {
       ...previewPorts.length > 0 ? { previewPorts } : {}
     });
   }
+  /** Run the schema sync, forwarding its output as setup output so it lands in
+   *  the card's setup log. A failure is announced rather than thrown: it is the
+   *  exact condition that used to render as a silent "Displaying 0 results". */
+  async syncDbSchema() {
+    const outcome = await this.syncDbSchemaFn({
+      onOutput: (stream, data) => this.forwardSetupOutput(stream, data),
+      signal: this.abortController.signal
+    });
+    if (outcome !== "failed" || this.stopped) return;
+    this.connection.sendEvent({
+      type: "setup_error",
+      message: "Database schema sync failed \u2014 the app may error on queries touching recently added columns (see pod logs)"
+    });
+  }
   restartStartCommand() {
     if (this.stopped || !this.config?.startCommand) return;
     this.connection.sendEvent({
@@ -497,14 +563,14 @@ var WorkspaceCommandSupervisor = class {
 
 // src/utils/session-identity.ts
 async function checkSessionTaskIdentity(params) {
-  const { sessionId, taskId, fetchSessionTaskId, logger: logger7 } = params;
+  const { sessionId, taskId, fetchSessionTaskId, logger: logger6 } = params;
   if (!sessionId || sessionId === taskId) return "skipped";
   let sessionTaskId;
   try {
     sessionTaskId = await fetchSessionTaskId(sessionId);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    logger7.warn("Could not verify session/task identity \u2014 continuing (defense-in-depth only)", {
+    logger6.warn("Could not verify session/task identity \u2014 continuing (defense-in-depth only)", {
       sessionId,
       taskId,
       error: message
@@ -512,7 +578,7 @@ async function checkSessionTaskIdentity(params) {
     return "error";
   }
   if (sessionTaskId !== taskId) {
-    logger7.warn(
+    logger6.warn(
       "!!! CONVEYOR_SESSION_ID is bound to a different task than CONVEYOR_TASK_ID \u2014 server-side guards should still block mutations, but this indicates a misconfiguration or replayed token.",
       { sessionId, envTaskId: taskId, sessionTaskId }
     );
@@ -696,8 +762,7 @@ var ProjectSessionRunner = class {
 
 // src/usage/multi-key-probe.ts
 import { mkdtemp, writeFile, copyFile, rm } from "fs/promises";
-import { tmpdir } from "os";
-import { join } from "path";
+import { join as join2 } from "path";
 var logger = createServiceLogger("multi-key-probe");
 function gaugesToSamples(stdout) {
   const { sessionUsage, weeklyUsage, sessionResetsAt, weeklyResetsAt, gauges } = parseUsageGauges(stdout);
@@ -725,12 +790,12 @@ function gaugesToSamples(stdout) {
 async function isolatedProbe(token, now) {
   let dir = null;
   try {
-    dir = await mkdtemp(join(tmpdir(), "conveyor-usage-"));
-    await writeFile(join(dir, ".credentials.json"), buildSynthesizedCredentials(token, now), {
+    dir = await mkdtemp(join2(sessionTempBase(), "conveyor-usage-"));
+    await writeFile(join2(dir, ".credentials.json"), buildSynthesizedCredentials(token, now), {
       encoding: "utf8",
       mode: 384
     });
-    await copyFile(claudeJsonPath(), join(dir, ".claude.json")).catch(() => {
+    await copyFile(claudeJsonPath(), join2(dir, ".claude.json")).catch(() => {
     });
     return await runUsageProbe({ env: { ...process.env, CLAUDE_CONFIG_DIR: dir } });
   } catch (error) {
@@ -765,428 +830,6 @@ async function probeKeysUsage(keys, deps = {}) {
   return results;
 }
 
-// src/harness/pty/adapters/opencode-auth.ts
-import { promises as fs } from "fs";
-import { dirname, join as join2 } from "path";
-import { homedir } from "os";
-var logger2 = createServiceLogger("opencode-auth");
-var OPENCODE_CODEX_PLUGIN = "opencode-openai-codex-auth@4.4.0";
-var PLUGIN_PACKAGE = "opencode-openai-codex-auth";
-function opencodeAuthPath(env) {
-  const dataHome = env.XDG_DATA_HOME ?? join2(env.HOME ?? homedir(), ".local", "share");
-  return join2(dataHome, "opencode", "auth.json");
-}
-function opencodeConfigPath(env) {
-  const configHome = env.XDG_CONFIG_HOME ?? join2(env.HOME ?? homedir(), ".config");
-  return join2(configHome, "opencode", "opencode.json");
-}
-function parseOauthSeed(b64) {
-  if (!b64) return null;
-  try {
-    const parsed = JSON.parse(Buffer.from(b64, "base64").toString("utf8"));
-    if (typeof parsed.access === "string" && typeof parsed.refresh === "string" && typeof parsed.expires === "number") {
-      return { access: parsed.access, refresh: parsed.refresh, expires: parsed.expires };
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function shouldSeed(existingEntry, seed) {
-  if (!existingEntry || typeof existingEntry !== "object") return true;
-  const entry = existingEntry;
-  if (entry.type !== "oauth") return true;
-  if (typeof entry.access !== "string" || typeof entry.refresh !== "string") return true;
-  if (typeof entry.expires !== "number") return true;
-  return entry.expires < seed.expires;
-}
-async function readJsonFile(path) {
-  try {
-    return JSON.parse(await fs.readFile(path, "utf8"));
-  } catch {
-    return {};
-  }
-}
-async function writeJsonFile(path, value) {
-  await fs.mkdir(dirname(path), { recursive: true });
-  await fs.writeFile(path, `${JSON.stringify(value, null, 2)}
-`, { mode: 384 });
-}
-async function ensureAuthEntry(env, seed) {
-  const path = opencodeAuthPath(env);
-  const store = await readJsonFile(path);
-  if (!shouldSeed(store.openai, seed)) {
-    logger2.info("opencode oauth store is fresher than the seed; leaving it alone");
-    return;
-  }
-  store.openai = {
-    type: "oauth",
-    access: seed.access,
-    refresh: seed.refresh,
-    expires: seed.expires
-  };
-  await writeJsonFile(path, store);
-  logger2.info("seeded opencode oauth store entry");
-}
-async function ensurePluginConfig(env) {
-  const path = opencodeConfigPath(env);
-  const config = await readJsonFile(path);
-  const plugins = Array.isArray(config.plugin) ? config.plugin : [];
-  const isOurs = (p) => typeof p === "string" && (p === PLUGIN_PACKAGE || p.startsWith(`${PLUGIN_PACKAGE}@`));
-  const hasExactPin = plugins.includes(OPENCODE_CODEX_PLUGIN);
-  const hasStalePin = plugins.some((p) => isOurs(p) && p !== OPENCODE_CODEX_PLUGIN);
-  if (hasExactPin && !hasStalePin) return;
-  const kept = plugins.filter((p) => !isOurs(p));
-  config.plugin = [...kept, OPENCODE_CODEX_PLUGIN];
-  await writeJsonFile(path, config);
-  logger2.info("ensured opencode codex-auth plugin in config");
-}
-async function seedOpenCodeOauth(env) {
-  const seed = parseOauthSeed(env.CONVEYOR_OPENCODE_OAUTH);
-  if (!seed) return;
-  try {
-    await ensureAuthEntry(env, seed);
-    await ensurePluginConfig(env);
-  } catch (err) {
-    logger2.warn(
-      `failed to seed opencode oauth store: ${err instanceof Error ? err.message : String(err)}`
-    );
-  }
-}
-
-// src/harness/pty/adapters/opencode.ts
-var PROVIDER_KEY_ENV = {
-  openai: "OPENAI_API_KEY",
-  anthropic: "ANTHROPIC_API_KEY"
-};
-var OpenCodeTuiAdapter = class {
-  constructor(env = process.env) {
-    this.env = env;
-  }
-  env;
-  id = "opencode";
-  capabilities = {
-    resume: false,
-    structuredEvents: false,
-    prefill: false,
-    passiveTurns: false
-  };
-  resolveBinary(env = this.env) {
-    const override = env.CONVEYOR_OPENCODE_BIN;
-    const found = override ? findOnPath(override, env) : findOnPath("opencode", env);
-    if (!found) {
-      throw new TuiUnavailableError(
-        "opencode",
-        "The opencode CLI is not available in this environment. It must be baked into the pod image (see Dockerfile.base) \u2014 re-run Build Image for this project, or set CONVEYOR_OPENCODE_BIN to its absolute path."
-      );
-    }
-    return found;
-  }
-  buildSpawn(input) {
-    const env = { ...inheritedEnv() };
-    delete env.CONVEYOR_AGENT_KEY;
-    delete env.CONVEYOR_OPENCODE_OAUTH;
-    const oauthActive = Boolean(this.env.CONVEYOR_OPENCODE_OAUTH);
-    const key = this.env.CONVEYOR_AGENT_KEY;
-    const provider = this.env.CONVEYOR_AGENT_PROVIDER ?? "openai";
-    const keyEnvVar = PROVIDER_KEY_ENV[provider];
-    if (key && keyEnvVar && !oauthActive) env[keyEnvVar] = key;
-    const model = this.env.CONVEYOR_AGENT_MODEL ?? input.options.model;
-    const args = [];
-    if (model) args.push("--model", model.includes("/") ? model : `${provider}/${model}`);
-    return { file: this.resolveBinary(), args, env };
-  }
-  async prepareEnvironment() {
-    await seedOpenCodeOauth(this.env);
-  }
-  spawnFingerprint(input) {
-    return JSON.stringify(["opencode", input.model, input.cwd]);
-  }
-  encodePromptBytes(text) {
-    return buildPromptBytes(text);
-  }
-  buildExitErrors(exitCode, rawOutput) {
-    const errors = [`opencode exited (code ${exitCode}) without a result`];
-    const tail = cleanTerminalOutput(rawOutput);
-    if (tail) errors.push(`Last terminal output before exit:
-${tail}`);
-    return errors;
-  }
-};
-
-// src/harness/pty/adapters/index.ts
-function resolveTuiAdapter(kind = "claude-code") {
-  switch (kind) {
-    case "claude-code":
-      return new ClaudeTuiAdapter();
-    case "opencode":
-      return new OpenCodeTuiAdapter();
-    default:
-      throw new Error(`Unknown TUI kind: ${kind}`);
-  }
-}
-
-// src/tools/project-tools.ts
-import { z } from "zod";
-var CONTEXT_PATH_SHAPE = z.object({
-  type: z.enum(["rule", "doc", "file", "folder"]).describe("Link kind"),
-  path: z.string().min(1).max(500).describe("Repo-relative path"),
-  label: z.string().max(100).optional()
-});
-function errText(prefix, error) {
-  return textResult(`${prefix}: ${error instanceof Error ? error.message : "Unknown error"}`);
-}
-function buildListTagsTool(connection, projectId) {
-  return defineTool(
-    "list_tags",
-    "List this project's tags (id, name, color). Use the ids with update_tag.",
-    {},
-    async () => {
-      try {
-        const tags = await connection.call("listProjectTags", { projectId });
-        return textResult(JSON.stringify(tags, null, 2));
-      } catch (error) {
-        return errText("Failed to list tags", error);
-      }
-    },
-    { annotations: { readOnlyHint: true } }
-  );
-}
-function buildCreateTagTool(connection, projectId) {
-  return defineTool(
-    "create_tag",
-    "Create a project tag. Include a crisp description and contextPaths (rule/doc/file/folder links agents auto-load when working on matching tasks). Fails if the name already exists.",
-    {
-      name: z.string().min(1).max(50),
-      color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional().describe("#RRGGBB (default gray)"),
-      description: z.string().max(500).optional(),
-      contextPaths: z.array(CONTEXT_PATH_SHAPE).max(20).optional()
-    },
-    async ({ name, color, description, contextPaths }) => {
-      try {
-        const result = await connection.call("createProjectTag", {
-          projectId,
-          name,
-          color,
-          description,
-          contextPaths
-        });
-        return textResult(`Tag created: ${result.id}`);
-      } catch (error) {
-        return errText("Failed to create tag", error);
-      }
-    }
-  );
-}
-function buildUpdateTagTool(connection, projectId) {
-  return defineTool(
-    "update_tag",
-    "Update a tag's name, color, description, or contextPaths. contextPaths is a FULL replacement \u2014 include existing links you want to keep. Verify paths exist in the repo first.",
-    {
-      tagId: z.string().describe("Tag id from list_tags"),
-      name: z.string().min(1).max(50).optional(),
-      color: z.string().regex(/^#[0-9a-fA-F]{6}$/).optional(),
-      description: z.string().max(500).optional(),
-      contextPaths: z.array(CONTEXT_PATH_SHAPE).max(20).optional()
-    },
-    async ({ tagId, name, color, description, contextPaths }) => {
-      try {
-        await connection.call("updateProjectTag", {
-          projectId,
-          tagId,
-          name,
-          color,
-          description,
-          contextPaths
-        });
-        return textResult(`Tag updated: ${tagId}`);
-      } catch (error) {
-        return errText("Failed to update tag", error);
-      }
-    }
-  );
-}
-function buildCreateSuggestionTool(connection, projectId) {
-  return defineTool(
-    "create_suggestion",
-    "File a project suggestion (idea/improvement for maintainers to review). Duplicates are AI-deduped into an existing suggestion with an upvote. Returns the suggestion id.",
-    {
-      title: z.string().min(1).describe("Short title"),
-      description: z.string().optional().describe("1-3 sentences: what should change and why"),
-      tag_names: z.array(z.string()).optional().describe("Tag names to categorize")
-    },
-    async ({ title, description, tag_names }) => {
-      try {
-        const result = await connection.call("createProjectSuggestion", {
-          projectId,
-          title,
-          description,
-          tagNames: tag_names
-        });
-        return textResult(
-          result.merged ? `Merged into existing suggestion ${result.mergedIntoId ?? result.id} (id: ${result.id})` : `Suggestion created: ${result.id}`
-        );
-      } catch (error) {
-        return errText("Failed to create suggestion", error);
-      }
-    }
-  );
-}
-function buildPostToProjectChatTool(connection, projectId) {
-  return defineTool(
-    "post_to_project_chat",
-    "Post a markdown message to the PROJECT chat \u2014 use once at the end of an audit for the summary the team reads.",
-    {
-      message: z.string().min(1).max(2e4),
-      kind: z.enum(["tag_audit_summary"]).optional().describe(
-        "Set to 'tag_audit_summary' when posting a tag-audit summary so it is also saved to the persistent tag history"
-      )
-    },
-    async ({ message, kind }) => {
-      try {
-        await connection.call("postToProjectChat", { projectId, content: message, kind });
-        return textResult("Posted to project chat");
-      } catch (error) {
-        return errText("Failed to post to project chat", error);
-      }
-    }
-  );
-}
-function buildGetProjectTaskTool(connection, projectId) {
-  return defineTool(
-    "get_project_task",
-    "Fetch any task in the project by id or slug: title, description, plan, status, and metadata. The audit evidence trail starts here.",
-    {
-      taskId: z.string().describe("Task id or slug")
-    },
-    async ({ taskId }) => {
-      try {
-        const task = await connection.call("getProjectTask", { projectId, taskId });
-        return textResult(JSON.stringify(task, null, 2));
-      } catch (error) {
-        return errText("Failed to get task", error);
-      }
-    },
-    { annotations: { readOnlyHint: true } }
-  );
-}
-function buildReadProjectTaskChatTool(connection, projectId) {
-  return defineTool(
-    "read_project_task_chat",
-    "Read any project task's chat messages (newest last). role 'user' rows are HUMAN turns; 'assistant'/'system' rows are agent posts and activity-log entries.",
-    {
-      taskId: z.string().describe("Task id or slug"),
-      limit: z.number().int().min(1).max(200).optional().describe("Messages to fetch (default 50)")
-    },
-    async ({ taskId, limit }) => {
-      try {
-        const chat = await connection.call("getProjectTaskChat", {
-          projectId,
-          taskId,
-          limit: limit ?? 50
-        });
-        return textResult(JSON.stringify(chat, null, 2));
-      } catch (error) {
-        return errText("Failed to read task chat", error);
-      }
-    },
-    { annotations: { readOnlyHint: true } }
-  );
-}
-function buildGetProjectTaskLogsTool(connection, projectId) {
-  return defineTool(
-    "get_project_task_logs",
-    "Read any project task's persisted agent event stream (message / tool_use / turn_end / error / completed). Turn boundaries are turn_end events. Entries are truncated to ~2KB each; max 500 per call.",
-    {
-      taskId: z.string().describe("Task id or slug"),
-      limit: z.number().int().min(1).max(500).optional().describe("Entries to fetch (default 50)"),
-      source: z.enum(["agent", "application"]).optional().describe("Filter: 'agent' = model events (default useful for grading)")
-    },
-    async ({ taskId, limit, source }) => {
-      try {
-        const logs = await connection.call("getProjectTaskCli", {
-          projectId,
-          taskId,
-          limit: limit ?? 50,
-          source
-        });
-        return textResult(JSON.stringify(logs, null, 2));
-      } catch (error) {
-        return errText("Failed to get task logs", error);
-      }
-    },
-    { annotations: { readOnlyHint: true } }
-  );
-}
-var TURN_GRADE_SHAPE = z.object({
-  turnIndex: z.number().int().min(0),
-  phase: z.enum(["planning", "building", "human"]),
-  grade: z.enum(["correct", "neutral", "blunder"]),
-  reasoning: z.string(),
-  eventType: z.string().describe('e.g. "message", "tool_use", "human_message"'),
-  eventSummary: z.string().max(200).describe("\u2264120 chars of what happened this turn")
-});
-var HUMAN_EVAL_SHAPE = z.object({
-  messageIndex: z.number().int().min(0).describe("Index into the task's human messages, oldest first"),
-  rating: z.number().int().min(-1).max(1),
-  reasoning: z.string()
-});
-function buildReportTaskAuditResultTool(connection, projectId) {
-  return defineTool(
-    "report_task_audit_result",
-    "Persist one audited task's grades (call once per task after grading it). Pass error instead to mark the audit failed when the evidence is unusable.",
-    {
-      taskId: z.string().describe("The audited task's id (NOT slug)"),
-      summary: z.string().describe("3-6 sentences: what went well, what was wasted"),
-      turnGrades: z.array(TURN_GRADE_SHAPE),
-      planningAccuracy: z.number().min(0).max(1).nullable(),
-      buildingAccuracy: z.number().min(0).max(1).nullable(),
-      humanAccuracy: z.number().min(0).max(1).nullable(),
-      planningCorrect: z.number().int().min(0),
-      planningNeutral: z.number().int().min(0),
-      planningBlunder: z.number().int().min(0),
-      buildingCorrect: z.number().int().min(0),
-      buildingNeutral: z.number().int().min(0),
-      buildingBlunder: z.number().int().min(0),
-      humanCorrect: z.number().int().min(0),
-      humanNeutral: z.number().int().min(0),
-      humanBlunder: z.number().int().min(0),
-      humanEvaluations: z.array(HUMAN_EVAL_SHAPE).optional(),
-      suggestionIds: z.array(z.string()).describe("Suggestion ids filed for this task, or []"),
-      auditCostUsd: z.number().nullable(),
-      model: z.string().nullable().describe("The model you are running as"),
-      error: z.string().optional().describe("Set ONLY to mark this task's audit failed")
-    },
-    async (input) => {
-      try {
-        await connection.call("reportTaskAuditResult", {
-          projectId,
-          ...input,
-          humanEvaluations: input.humanEvaluations ?? []
-        });
-        return textResult(
-          input.error ? `Audit for ${input.taskId} marked failed` : `Audit result saved for ${input.taskId}`
-        );
-      } catch (error) {
-        return errText("Failed to report audit result", error);
-      }
-    }
-  );
-}
-function buildProjectTools(connection, projectId) {
-  return [
-    buildListTagsTool(connection, projectId),
-    buildCreateTagTool(connection, projectId),
-    buildUpdateTagTool(connection, projectId),
-    buildCreateSuggestionTool(connection, projectId),
-    buildPostToProjectChatTool(connection, projectId),
-    buildGetProjectTaskTool(connection, projectId),
-    buildReadProjectTaskChatTool(connection, projectId),
-    buildGetProjectTaskLogsTool(connection, projectId),
-    buildReportTaskAuditResultTool(connection, projectId)
-  ];
-}
-
 // src/runner/adhoc-session-runner.ts
 var ADHOC_SYSTEM_NOTE = "You are running in an ad-hoc Conveyor scratch pod \u2014 an interactive terminal on the project's repository checked out at its default branch. There is no task or plan; help the human with whatever they ask directly.";
 var HEADLESS_SYSTEM_NOTE = "You are running a HEADLESS Conveyor session on the project's repository \u2014 your instructions were auto-submitted as the first message. Work them to completion autonomously and never wait for user input; a human may attach to this terminal to watch or interject, but none is required.";
@@ -1200,16 +843,15 @@ function resolveInitialPrompt(env = process.env) {
     return null;
   }
 }
-function resolveAdhocTui(env) {
-  const raw = env.CONVEYOR_TUI ?? "claude-code";
-  if (TUI_KINDS.includes(raw)) return raw;
-  throw new Error(`Unknown TUI "${raw}" in CONVEYOR_TUI (expected: ${TUI_KINDS.join(", ")})`);
-}
-function buildAdhocPtyBridge(connection) {
+var resolveAdhocTui = resolveTuiKindFromEnv;
+function buildAdhocPtyBridge(connection, onInputActivity) {
   return {
     sendOutput: (data, dims) => connection.sendPtyOutput(data, dims),
     sendChatEvent: (event) => connection.sendPtyChatEvent(event),
-    onInput: (handler) => connection.onPtyInput(handler),
+    onInput: (handler) => connection.onPtyInput((data) => {
+      onInputActivity?.();
+      handler(data);
+    }),
     onResize: (handler) => connection.onPtyResize(handler)
   };
 }
@@ -1258,11 +900,18 @@ var AdhocSessionRunner = class {
     this.callbacks = callbacks;
     this.connection = deps?.connection ?? new AgentConnection(config.connection);
     this.harness = deps?.harness ?? new PtyHarness(
-      buildAdhocPtyBridge(this.connection),
+      // A keystroke is real human activity — re-arm the idle backstop so an
+      // actively-typing human (or a >60-min audit run) is never hard-stopped
+      // by the idle timer, mirroring ShellSessionRunner. `this.lifecycle` is
+      // assigned later in this constructor but is always set by the time a
+      // keystroke can arrive at runtime.
+      buildAdhocPtyBridge(this.connection, () => this.lifecycle.startIdleTimer()),
       resolveTuiAdapter(resolveAdhocTui(process.env))
     );
+    const portVisibility = new CodespacePortVisibility();
     this.portDiscovery = deps?.portDiscovery ?? new PortDiscovery({
-      report: (ports) => this.connection.reportDiscoveredPorts(ports)
+      report: (ports) => this.connection.reportDiscoveredPorts(ports),
+      onReported: (ports) => portVisibility.ensureVisible(ports.map(({ port }) => port))
     });
     this.commandSupervisor = deps?.commandSupervisor ?? new WorkspaceCommandSupervisor({
       config: loadConveyorConfig(),
@@ -1344,7 +993,11 @@ var AdhocSessionRunner = class {
       initialPrompt,
       conveyorMcpServer: this.harness.createMcpServer({
         name: "conveyor",
-        tools: buildProjectTools(this.connection, this.config.projectId)
+        tools: buildProjectTools(
+          this.connection,
+          this.config.projectId,
+          this.config.workspaceDir
+        )
       })
     } : void 0;
     const options = buildAdhocQueryOptions(
@@ -1455,7 +1108,7 @@ var AdhocSessionRunner = class {
 import { spawn as nodeSpawn, execFile } from "child_process";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
-var logger3 = createServiceLogger("ReviewChild");
+var logger2 = createServiceLogger("ReviewChild");
 var SPAWN_FAILURE_GRACE_MS = 15e3;
 var KILL_WAIT_MS = 5e3;
 function buildReviewChildEnv(baseEnv, data) {
@@ -1463,14 +1116,15 @@ function buildReviewChildEnv(baseEnv, data) {
   env.CONVEYOR_TASK_TOKEN = data.sessionJwt;
   env.CONVEYOR_SESSION_ID = data.sessionId;
   env.CONVEYOR_MODE = "code-review";
+  env.CONVEYOR_WORKBENCH_TOKEN ??= baseEnv.POD_BOOTSTRAP_TOKEN;
   delete env.POD_BOOTSTRAP_TOKEN;
   delete env.CONVEYOR_BOOTSTRAP_TOKEN;
-  delete env.CONVEYOR_SETUP_COMMAND;
   delete env.CONVEYOR_START_COMMAND;
   delete env.CONVEYOR_GIT_READY;
   delete env.CONVEYOR_GIT_READY_MARKER;
   delete env.CONVEYOR_AGENT_MODE;
   delete env.CONVEYOR_IS_AUTO;
+  delete env.CONVEYOR_TUI;
   return env;
 }
 var ReviewChildSupervisor = class {
@@ -1486,7 +1140,7 @@ var ReviewChildSupervisor = class {
   childSessionId = null;
   /** Spawn (or replace) the review child for a `session:spawnReview` push. */
   async spawn(data) {
-    logger3.info("Spawning same-pod review child", {
+    logger2.info("Spawning same-pod review child", {
       reviewSessionId: data.sessionId,
       branch: data.branch ?? void 0,
       prNumber: data.prNumber ?? void 0
@@ -1529,7 +1183,7 @@ var ReviewChildSupervisor = class {
       process.stderr.write(`[review-child] ${chunk.toString()}`);
     });
     child.on("error", (err) => {
-      logger3.error("Review child spawn error", { error: err.message });
+      logger2.error("Review child spawn error", { error: err.message });
       if (this.child === child) {
         this.child = null;
         this.childSessionId = null;
@@ -1542,7 +1196,7 @@ var ReviewChildSupervisor = class {
         this.child = null;
         this.childSessionId = null;
       }
-      logger3.info("Review child exited", { code, signal, reviewSessionId: data.sessionId });
+      logger2.info("Review child exited", { code, signal, reviewSessionId: data.sessionId });
       const withinGrace = Date.now() - spawnedAt < SPAWN_FAILURE_GRACE_MS;
       if (wasCurrent && withinGrace && code !== null && code !== 0) {
         reportOnce(`review child exited with code ${code} within startup grace`);
@@ -1560,7 +1214,7 @@ var ReviewChildSupervisor = class {
       this.childSessionId = null;
       return;
     }
-    logger3.info("Stopping review child", { reason, reviewSessionId: this.childSessionId });
+    logger2.info("Stopping review child", { reason, reviewSessionId: this.childSessionId });
     this.child = null;
     this.childSessionId = null;
     await new Promise((resolve) => {
@@ -1602,7 +1256,7 @@ var ReviewChildSupervisor = class {
         timeout: 3e4
       });
     } catch (err) {
-      logger3.warn("Review checkout freshen skipped", {
+      logger2.warn("Review checkout freshen skipped", {
         branch,
         error: err instanceof Error ? err.message : String(err)
       });
@@ -1612,7 +1266,7 @@ var ReviewChildSupervisor = class {
 
 // src/runner/session-child.ts
 import { spawn as nodeSpawn2 } from "child_process";
-var logger4 = createServiceLogger("SessionChild");
+var logger3 = createServiceLogger("SessionChild");
 function buildSpawnedChildEnv(baseEnv, data) {
   const env = { ...baseEnv };
   env.CONVEYOR_TASK_TOKEN = data.sessionJwt;
@@ -1621,7 +1275,6 @@ function buildSpawnedChildEnv(baseEnv, data) {
   env.CONVEYOR_PROJECT_ID = data.projectId;
   delete env.POD_BOOTSTRAP_TOKEN;
   delete env.CONVEYOR_BOOTSTRAP_TOKEN;
-  delete env.CONVEYOR_SETUP_COMMAND;
   delete env.CONVEYOR_START_COMMAND;
   delete env.CONVEYOR_AGENT_MODE;
   delete env.CONVEYOR_IS_AUTO;
@@ -1643,7 +1296,7 @@ var SessionChildSupervisor = class {
   }
   /** Spawn a TUI/shell child for a `session:spawnTui` push. Additive per session. */
   async spawn(data) {
-    logger4.info("Spawning same-pod session child", {
+    logger3.info("Spawning same-pod session child", {
       spawnedSessionId: data.sessionId,
       mode: data.mode
     });
@@ -1684,7 +1337,7 @@ var SessionChildSupervisor = class {
       process.stderr.write(`${prefix} ${chunk.toString()}`);
     });
     child.on("error", (err) => {
-      logger4.error("Session child spawn error", { error: err.message });
+      logger3.error("Session child spawn error", { error: err.message });
       if (this.children.get(data.sessionId) === child) {
         this.children.delete(data.sessionId);
       }
@@ -1693,7 +1346,7 @@ var SessionChildSupervisor = class {
     child.on("exit", (code, signal) => {
       const wasCurrent = this.children.get(data.sessionId) === child;
       if (wasCurrent) this.children.delete(data.sessionId);
-      logger4.info("Session child exited", {
+      logger3.info("Session child exited", {
         code,
         signal,
         spawnedSessionId: data.sessionId,
@@ -1714,7 +1367,7 @@ var SessionChildSupervisor = class {
     const child = this.children.get(sessionId);
     this.children.delete(sessionId);
     if (!child || child.exitCode !== null || child.killed) return;
-    logger4.info("Stopping session child", { reason, spawnedSessionId: sessionId });
+    logger3.info("Stopping session child", { reason, spawnedSessionId: sessionId });
     await new Promise((resolve) => {
       const timer = setTimeout(() => {
         try {
@@ -1759,7 +1412,7 @@ var ShellSessionRunner = class {
   constructor(config, deps) {
     this.config = config;
     this.connection = deps?.connection ?? new AgentConnection(config.connection);
-    this.loadSpawn = deps?.loadSpawn ?? loadPtySpawn;
+    this.loadSpawn = deps?.loadSpawn ?? resolvePtySpawn;
     this.lifecycle = new Lifecycle(
       // No git flush — the human commits/pushes explicitly from the shell.
       { ...DEFAULT_LIFECYCLE_CONFIG, gitFlushIntervalMs: 0, ...config.lifecycle },
@@ -1862,7 +1515,7 @@ var ShellSessionRunner = class {
 };
 
 // src/runner/spawned-child-boot.ts
-var logger5 = createServiceLogger("SpawnedChildBoot");
+var logger4 = createServiceLogger("SpawnedChildBoot");
 function createSpawnedChildRunner(inputs) {
   if (inputs.mode === "shell") {
     return new ShellSessionRunner({
@@ -1892,15 +1545,20 @@ function createSpawnedChildRunner(inputs) {
     },
     {
       onEvent: (event) => {
-        logger5.info("Spawned TUI event", { eventType: event.type });
+        logger4.info("Spawned TUI event", { eventType: event.type });
       }
     }
   );
 }
 
+// src/runner/host-modes.ts
+function hostsSpawnedChildren(mode) {
+  return mode === "task" || mode === "pack";
+}
+
 // src/cli.ts
 if (process.argv[2] === "boot") {
-  const { runBoot } = await import("./boot-YZCOIV3Q.js");
+  const { runBoot } = await import("./boot-BZE36LT6.js");
   process.exit(await runBoot(process.argv.slice(3)));
 }
 if (isLegacyEntrypointLaunch(process.env)) {
@@ -1915,9 +1573,10 @@ if (process.argv.includes("--version")) {
   process.stdout.write(pkg.version + "\n");
   process.exit(0);
 }
-var logger6 = createServiceLogger("CLI");
+var logger5 = createServiceLogger("CLI");
 var exitContext = {};
 var exitLogged = false;
+var shuttingDown = false;
 function logAgentExit(reason, opts) {
   if (exitLogged) return;
   exitLogged = true;
@@ -1929,12 +1588,12 @@ function logAgentExit(reason, opts) {
     uptimeSec: process.uptime(),
     identity: exitContext
   });
-  logger6[exitLogLevel(reason)]("agent_exit", payload);
+  logger5[exitLogLevel(reason)]("agent_exit", payload);
 }
 async function bootstrapFromCodespace(apiUrl, instanceName) {
   const bootstrapToken = process.env.CONVEYOR_BOOTSTRAP_TOKEN;
   const apiUrlFromEnv = Boolean(process.env.CONVEYOR_API_URL);
-  logger6.info("Bootstrapping from codespace", {
+  logger5.info("Bootstrapping from codespace", {
     codespace: instanceName,
     apiUrl,
     apiUrlFromEnv,
@@ -1946,7 +1605,7 @@ async function bootstrapFromCodespace(apiUrl, instanceName) {
     bootstrapToken
   });
   if (!result.ok) {
-    logger6.error("Bootstrap failed after retries", {
+    logger5.error("Bootstrap failed after retries", {
       reason: result.reason,
       attempts: result.attempts,
       status: result.status,
@@ -1959,7 +1618,7 @@ async function bootstrapFromCodespace(apiUrl, instanceName) {
     process.exit(1);
   }
   applyBootstrapToEnv(result.config);
-  logger6.info("Bootstrap complete", {
+  logger5.info("Bootstrap complete", {
     taskId: result.config.taskId,
     attempts: result.attempts
   });
@@ -1970,33 +1629,44 @@ function isExpectedAbortError(error) {
   const hasAbortCode = !("code" in error) || error.code === void 0 || error.code === "ABORT_ERR";
   return hasAbortMessage && hasAbortCode;
 }
+function exitOnPermissionDenial(err) {
+  if (!isPermissionDeniedError(err)) return false;
+  logger5.error("Not authorized for this project \u2014 parking instead of crash-looping", {
+    error: err.message
+  });
+  logAgentExit("unauthorized", { exitCode: 0 });
+  process.exit(0);
+}
 process.on("uncaughtException", (err) => {
   if (err.code === "EPIPE") return;
-  if (isExpectedAbortError(err)) {
-    logger6.info("Ignored expected abort after shutdown", { error: err.message, code: err.code });
+  if (shuttingDown && isExpectedAbortError(err)) {
+    logger5.info("Ignored expected abort after shutdown", { error: err.message, code: err.code });
     return;
   }
-  logger6.error("Uncaught exception", { error: err.message, code: err.code });
+  if (exitOnPermissionDenial(err)) return;
+  logger5.error("Uncaught exception", { error: err.message, code: err.code });
   logAgentExit("uncaught_exception", { exitCode: 1 });
   process.exit(1);
 });
 process.on("unhandledRejection", (reason) => {
   const err = reason instanceof Error ? reason : new Error(String(reason));
-  if (isExpectedAbortError(err)) {
-    logger6.info("Ignored expected abort rejection after shutdown", { error: err.message });
+  if (shuttingDown && isExpectedAbortError(err)) {
+    logger5.info("Ignored expected abort rejection after shutdown", { error: err.message });
     return;
   }
-  logger6.error("Unhandled rejection", { error: err.message });
+  if (exitOnPermissionDenial(err)) return;
+  logger5.error("Unhandled rejection", { error: err.message });
   logAgentExit("unhandled_rejection", { exitCode: 1 });
   process.exit(1);
 });
 if (process.env.CONVEYOR_MODE === "workbench") {
-  const { startWorkbenchServer } = await import("./server-BXAFMYDM.js");
+  const { startWorkbenchServer } = await import("./server-PPTELJWY.js");
+  const { oomWatchdogOptionsFromEnv } = await import("./oom-watchdog-U7JERHA2.js");
   const { DEFAULT_WORKBENCH_PORT } = await import("./protocol-QLVS5W6O.js");
   const port = Number(process.env.CONVEYOR_WORKBENCH_PORT) || DEFAULT_WORKBENCH_PORT;
   const token = process.env.CONVEYOR_WORKBENCH_TOKEN ?? process.env.POD_BOOTSTRAP_TOKEN ?? "";
   if (!token) {
-    logger6.error("workbench mode requires POD_BOOTSTRAP_TOKEN (or CONVEYOR_WORKBENCH_TOKEN)");
+    logger5.error("workbench mode requires POD_BOOTSTRAP_TOKEN (or CONVEYOR_WORKBENCH_TOKEN)");
     process.exit(1);
   }
   const pkgDir = dirname2(fileURLToPath(import.meta.url));
@@ -2004,9 +1674,14 @@ if (process.env.CONVEYOR_MODE === "workbench") {
   const handle = await startWorkbenchServer({
     port,
     token,
-    version: pkg.version ?? "unknown"
+    version: pkg.version ?? "unknown",
+    oomWatchdog: oomWatchdogOptionsFromEnv({
+      info: (m) => logger5.info(m),
+      warn: (m) => logger5.warn(m),
+      error: (m) => logger5.error(m)
+    })
   });
-  logger6.info(`Workbench launcher listening on 127.0.0.1:${handle.port}`);
+  logger5.info(`Workbench launcher listening on 127.0.0.1:${handle.port}`);
   process.on("SIGTERM", () => process.exit(0));
   await new Promise(() => {
   });
@@ -2016,7 +1691,7 @@ var conveyorApiUrl = process.env.CONVEYOR_API_URL || DEFAULT_CONVEYOR_API_URL;
 var INSTANCE_NAME = process.env.CODESPACE_NAME || process.env.CLAUDESPACE_NAME;
 if (INSTANCE_NAME && !process.env.CONVEYOR_TASK_TOKEN) {
   if (!conveyorApiUrl) {
-    logger6.error("Could not resolve CONVEYOR_API_URL for codespace bootstrap");
+    logger5.error("Could not resolve CONVEYOR_API_URL for codespace bootstrap");
     process.exit(1);
   }
   await bootstrapFromCodespace(conveyorApiUrl, INSTANCE_NAME);
@@ -2034,7 +1709,7 @@ exitContext.runnerMode = CONVEYOR_MODE;
 exitContext.sessionId = process.env.CONVEYOR_SESSION_ID ?? CONVEYOR_TASK_ID;
 var projectIdentity = resolveProjectRunnerIdentity(process.env);
 if (!CONVEYOR_TASK_ID && projectIdentity && CONVEYOR_MODE === "adhoc") {
-  logger6.info("Starting ad-hoc agent", { projectId: projectIdentity.projectId });
+  logger5.info("Starting ad-hoc agent", { projectId: projectIdentity.projectId });
   const adhocRunner = new AdhocSessionRunner(
     {
       connection: {
@@ -2053,15 +1728,21 @@ if (!CONVEYOR_TASK_ID && projectIdentity && CONVEYOR_MODE === "adhoc") {
     },
     {
       onEvent: (event) => {
-        logger6.info("Ad-hoc runner event", { eventType: event.type });
+        logger5.info("Ad-hoc runner event", { eventType: event.type });
       }
     }
   );
   exitContext.sessionId = projectIdentity.sessionId;
   exitContext.workspaceId = projectIdentity.workspaceId;
   exitContext.runnerMode = "adhoc";
-  process.on("SIGTERM", () => adhocRunner.stop());
-  process.on("SIGINT", () => adhocRunner.stop());
+  process.on("SIGTERM", () => {
+    shuttingDown = true;
+    adhocRunner.stop();
+  });
+  process.on("SIGINT", () => {
+    shuttingDown = true;
+    adhocRunner.stop();
+  });
   await adhocRunner.run();
   const adhocError = adhocRunner.finalState === "error";
   logAgentExit(adhocError ? "error" : "clean", {
@@ -2071,7 +1752,7 @@ if (!CONVEYOR_TASK_ID && projectIdentity && CONVEYOR_MODE === "adhoc") {
   process.exit(adhocError ? 1 : 0);
 }
 if (!CONVEYOR_TASK_ID && projectIdentity) {
-  logger6.info("Starting project agent", { projectId: projectIdentity.projectId });
+  logger5.info("Starting project agent", { projectId: projectIdentity.projectId });
   const projectRunner = new ProjectSessionRunner(
     {
       connection: {
@@ -2086,15 +1767,21 @@ if (!CONVEYOR_TASK_ID && projectIdentity) {
     },
     {
       onEvent: (event) => {
-        logger6.info("Project runner event", { eventType: event.type });
+        logger5.info("Project runner event", { eventType: event.type });
       }
     }
   );
   exitContext.sessionId = projectIdentity.sessionId;
   exitContext.workspaceId = projectIdentity.workspaceId;
   exitContext.runnerMode = "pm";
-  process.on("SIGTERM", () => projectRunner.stop());
-  process.on("SIGINT", () => projectRunner.stop());
+  process.on("SIGTERM", () => {
+    shuttingDown = true;
+    projectRunner.stop();
+  });
+  process.on("SIGINT", () => {
+    shuttingDown = true;
+    projectRunner.stop();
+  });
   await projectRunner.run();
   const projectError = projectRunner.finalState === "error";
   logAgentExit(projectError ? "error" : "clean", {
@@ -2104,22 +1791,22 @@ if (!CONVEYOR_TASK_ID && projectIdentity) {
   process.exit(projectError ? 1 : 0);
 }
 if (!CONVEYOR_TASK_TOKEN || !CONVEYOR_TASK_ID) {
-  logger6.error("Missing required environment variables");
-  logger6.error("  CONVEYOR_TASK_TOKEN - JWT token for task authentication");
-  logger6.error("  CONVEYOR_TASK_ID - ID of the task to execute");
-  logger6.error("");
-  logger6.error("CONVEYOR_API_URL is provided via codespace secret or bootstrap.");
-  logger6.error("");
-  logger6.error("Optional:");
-  logger6.error("  CONVEYOR_MODE - Runner mode: 'task' (default), 'pack', or 'pm'");
-  logger6.error("  CONVEYOR_WORKSPACE - Working directory (defaults to cwd)");
-  logger6.error(
+  logger5.error("Missing required environment variables");
+  logger5.error("  CONVEYOR_TASK_TOKEN - JWT token for task authentication");
+  logger5.error("  CONVEYOR_TASK_ID - ID of the task to execute");
+  logger5.error("");
+  logger5.error("CONVEYOR_API_URL is provided via codespace secret or bootstrap.");
+  logger5.error("");
+  logger5.error("Optional:");
+  logger5.error("  CONVEYOR_MODE - Runner mode: 'task' (default), 'pack', or 'pm'");
+  logger5.error("  CONVEYOR_WORKSPACE - Working directory (defaults to cwd)");
+  logger5.error(
     "  Project pods instead require CONVEYOR_PROJECT_ID + CONVEYOR_SESSION_ID + CONVEYOR_MODE=pm"
   );
   process.exit(1);
 }
 if (CONVEYOR_MODE !== "task" && CONVEYOR_MODE !== "pm" && CONVEYOR_MODE !== "code-review" && CONVEYOR_MODE !== "adhoc" && CONVEYOR_MODE !== "pack" && CONVEYOR_MODE !== "shell") {
-  logger6.error("Invalid CONVEYOR_MODE", {
+  logger5.error("Invalid CONVEYOR_MODE", {
     mode: CONVEYOR_MODE,
     expected: ["task", "pm", "code-review", "adhoc", "pack", "shell"]
   });
@@ -2128,7 +1815,7 @@ if (CONVEYOR_MODE !== "task" && CONVEYOR_MODE !== "pm" && CONVEYOR_MODE !== "cod
 if (CONVEYOR_MODE === "shell" || CONVEYOR_MODE === "adhoc") {
   const spawnedSessionId = process.env.CONVEYOR_SESSION_ID;
   if (!spawnedSessionId) {
-    logger6.error("Spawned child requires CONVEYOR_SESSION_ID", { mode: CONVEYOR_MODE });
+    logger5.error("Spawned child requires CONVEYOR_SESSION_ID", { mode: CONVEYOR_MODE });
     process.exit(1);
   }
   exitContext.sessionId = spawnedSessionId;
@@ -2141,12 +1828,18 @@ if (CONVEYOR_MODE === "shell" || CONVEYOR_MODE === "adhoc") {
     workspaceDir: CONVEYOR_WORKSPACE,
     projectId: process.env.CONVEYOR_PROJECT_ID ?? ""
   });
-  logger6.info("Starting spawned session child", {
+  logger5.info("Starting spawned session child", {
     mode: CONVEYOR_MODE,
     sessionId: spawnedSessionId
   });
-  process.on("SIGTERM", () => childRunner.stop());
-  process.on("SIGINT", () => childRunner.stop());
+  process.on("SIGTERM", () => {
+    shuttingDown = true;
+    childRunner.stop();
+  });
+  process.on("SIGINT", () => {
+    shuttingDown = true;
+    childRunner.stop();
+  });
   await childRunner.run();
   const childError = childRunner.finalState === "error";
   logAgentExit(childError ? "error" : "clean", {
@@ -2155,7 +1848,7 @@ if (CONVEYOR_MODE === "shell" || CONVEYOR_MODE === "adhoc") {
   });
   process.exit(childError ? 1 : 0);
 }
-logger6.info("Starting agent", { mode: CONVEYOR_MODE });
+logger5.info("Starting agent", { mode: CONVEYOR_MODE });
 var lifecycleOverrides = process.env.CLAUDESPACE_NAME ? { idleTimeoutMs: 60 * 60 * 1e3 } : { gitFlushIntervalMs: 0 };
 var runner = new SessionRunner(
   {
@@ -2175,12 +1868,12 @@ var runner = new SessionRunner(
   },
   {
     onStatusChange: (status) => {
-      logger6.info("Status changed", { status });
+      logger5.info("Status changed", { status });
     },
     onEvent: (event) => {
       const detail = event.message ?? event.content ?? event.summary ?? "";
       if (detail) {
-        logger6.info(detail, { eventType: event.type });
+        logger5.info(detail, { eventType: event.type });
       }
     }
   }
@@ -2191,7 +1884,8 @@ var shutdownSignal;
 var workspaceCommandSupervisor = null;
 var shutdownCompletion = null;
 var shutdownAgent = (signal) => {
-  logger6.info(`Received ${signal}, flushing git and stopping agent`);
+  shuttingDown = true;
+  logger5.info(`Received ${signal}, flushing git and stopping agent`);
   const commandShutdown = stopWorkspaceCommands(workspaceCommandSupervisor);
   shutdownSignal = signal;
   shutdownCompletion ??= (async () => {
@@ -2208,8 +1902,8 @@ var shutdownAgent = (signal) => {
   })();
   void shutdownCompletion;
   setTimeout(() => {
-    logger6.warn(`Forcing exit after ${signal} timeout`);
-    logger6.warn(
+    logger5.warn(`Forcing exit after ${signal} timeout`);
+    logger5.warn(
       "agent_exit",
       buildAgentExitLog({
         reason: "force_timeout",
@@ -2235,7 +1929,7 @@ workspaceCommandSupervisor = await startWorkspaceCommandsAfterConnect({
   })
 });
 if (!workspaceCommandSupervisor) {
-  logger6.info("Agent stopped before workspace commands were started");
+  logger5.info("Agent stopped before workspace commands were started");
   if (shutdownCompletion) await shutdownCompletion;
   logAgentExit(shutdownSignal ? "signal" : "clean", {
     exitCode: 0,
@@ -2252,12 +1946,12 @@ void checkSessionTaskIdentity({
     const ctx = await runner.connection.call("getTaskContext", { sessionId });
     return ctx.id;
   },
-  logger: logger6
+  logger: logger5
 });
-if (CONVEYOR_MODE === "task") {
+if (hostsSpawnedChildren(CONVEYOR_MODE)) {
   runner.connection.onSpawnReview((data) => {
     void reviewChildren.spawn(data).catch((err) => {
-      logger6.error("Review child spawn threw", {
+      logger5.error("Review child spawn threw", {
         error: err instanceof Error ? err.message : String(err)
       });
       runner.connection.reportReviewSpawnFailure(
@@ -2267,10 +1961,10 @@ if (CONVEYOR_MODE === "task") {
     });
   });
 }
-if (CONVEYOR_MODE === "task" || CONVEYOR_MODE === "pack") {
+if (hostsSpawnedChildren(CONVEYOR_MODE)) {
   runner.connection.onSpawnTui((data) => {
     void sessionChildren.spawn(data).catch((err) => {
-      logger6.error("Session child spawn threw", {
+      logger5.error("Session child spawn threw", {
         error: err instanceof Error ? err.message : String(err)
       });
       runner.connection.reportSessionSpawnFailure(
@@ -2293,7 +1987,7 @@ runner.run().then(async () => {
 }).catch(async (error) => {
   await stopWorkspaceCommands(workspaceCommandSupervisor);
   const msg = error instanceof Error ? error.message : String(error);
-  logger6.error("Agent runner failed", { error: msg });
+  logger5.error("Agent runner failed", { error: msg });
   logAgentExit("error", { exitCode: 1, finalState: runner.finalState ?? void 0 });
   process.exit(1);
 });