@rallycry/conveyor-agent 10.13.3 → 10.13.9

package/dist/index.d.ts

@@ -3,6 +3,11 @@ import { RunnerMode, AgentSessionServiceMethods, AgentMode, PtyChatEventPayload,
 export * from '@project/shared';
 import { ChildProcess } from 'node:child_process';
 
+/**
+ * The milestones an agent may declare — narrower than the server's full slug
+ * set, which also covers server-generated review verdicts.
+ */
+type AgentMilestone = NonNullable<AgentSessionServiceMethods["postAgentMessage"]["payload"]["milestone"]>;
 interface AgentConnectionConfig {
     apiUrl: string;
     taskToken: string;
@@ -90,6 +95,8 @@ declare class AgentConnection {
     private earlySpawnReviews;
     private spawnTuiCallback;
     private earlySpawnTuis;
+    private probeUsageCallback;
+    private earlyProbeUsage;
     private ptyInputCallback;
     private ptyResizeCallback;
     constructor(config: AgentConnectionConfig);
@@ -148,6 +155,9 @@ declare class AgentConnection {
      */
     reportReviewSpawnFailure(reviewSessionId: string, error?: string): void;
     onSpawnTui(callback: (data: SpawnTuiData) => void): void;
+    /** Register the on-demand usage-refresh handler; drains an early-buffered
+     *  `session:probeUsage` that arrived before the runner was ready. */
+    onProbeUsage(callback: () => void): void;
     /**
      * Report that a same-pod TUI/shell child failed to spawn (fire-and-forget).
      * The server Ends the orphaned session — no fallback pod (unlike review).
@@ -183,8 +193,8 @@ declare class AgentConnection {
     /** Subscribe to relayed (reconciled) terminal resizes. Returns an unsubscribe fn. */
     onPtyResize(handler: (cols: number, rows: number) => void): () => void;
     emitStatus(status: string, reason?: string, questionText?: string): Promise<void>;
-    postChatMessage(content: string): void;
-    postChatMessageAwait(content: string): Promise<void>;
+    postChatMessage(content: string, milestone?: AgentMilestone): void;
+    postChatMessageAwait(content: string, milestone?: AgentMilestone): Promise<void>;
     private suppressIfDuplicate;
     checkAndTrackDuplicate(content: string): {
         duplicate: false;
@@ -237,6 +247,15 @@ declare class AgentConnection {
     triggerIdentification(): Promise<{
         identified: boolean;
     }>;
+    handoffToImplementer(payload: {
+        storyPoints?: number;
+        message?: string;
+    }): Promise<{
+        handedOff: boolean;
+        agentName?: string;
+        model?: string;
+        reason?: string;
+    }>;
     refreshAuthToken(): Promise<boolean>;
     /**
      * Refresh the in-process `CONVEYOR_TASK_TOKEN` from the bootstrap endpoint.

package/dist/index.js

@@ -21,7 +21,7 @@ import {
   unshallowRepo,
   updateRemoteToken,
   uploadSnapshotToGcs
-} from "./chunk-P4VWWR5O.js";
+} from "./chunk-PXQJ4NVO.js";
 import "./chunk-7TQO4ZF4.js";
 
 // src/runner/worktree.ts

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rallycry/conveyor-agent",
-  "version": "10.13.3",
+  "version": "10.13.9",
   "description": "Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.",
   "keywords": [
     "agent",

package/runtime/entrypoint.sh

@@ -118,6 +118,31 @@ refresh_agent_version() {
   fi
 }
 
+# ── Reclaim any root-owned $HOME config/state entries (bake defense-in-depth) ──
+# Bake steps that run as root while ENV HOME points at /home/conveyor can leave
+# root-owned entries under ~/.config / ~/.local (a uv install receipt in
+# ~/.config once bricked every pod boot fleet-wide). This reclaims them so a
+# baked ownership slip can't EACCES the entrypoint under `set -e`.
+#
+# CONDITIONAL, not `chown -R`: a `find … ! -user conveyor` walk is stat-only when
+# the tree is already clean (the common case since the bake-side `HOME=/root`
+# fix in 9815c8915 — current images carry ZERO root-owned files here), so it
+# triggers no overlayfs copy-up. The former unconditional `chown -R` copied up
+# ALL ~3.9k baked files (~63MB, dominated by ~/.config/opencode's 3,652 files)
+# on EVERY boot even when nothing was root-owned — ~16s of I/O-bound
+# uninterruptible-disk-sleep that reclaimed nothing, and the true owner of the
+# "GCS-FUSE" boot gap. Runs in the PRE-BIND phase below (payload-independent, off
+# the time-to-agent critical path) and before any mount symlinks exist, so it
+# never follows into the FUSE mount. See
+# docs/investigations/gcs-fuse-user-home-boot-cost-2026-07-15.md.
+reclaim_home_ownership() {
+  local d
+  for d in /home/conveyor/.config /home/conveyor/.local; do
+    [ -d "${d}" ] || continue
+    sudo -n find "${d}" ! -user conveyor -exec chown conveyor:conveyor {} + 2>/dev/null || true
+  done
+}
+
 start_workspace_sshd
 
 # ── Required env vars (injected by pod spec — v3: exactly these two) ──
@@ -134,6 +159,10 @@ export CLAUDESPACE_NAME="${INSTANCE_NAME}"
 # ═══════════════════════════════════════════════════════════════════════════
 PREWARM_DEV_LOOP_PID=""
 refresh_agent_version
+# Reclaim root-owned $HOME entries here, during standby, so the common (clean)
+# case costs a stat-only walk off the critical path instead of a ~16s copy-up
+# `chown -R` after the bundle arrives.
+reclaim_home_ownership
 
 # ═══════════════════════════════════════════════════════════════════════════
 # PULL-BASED BOOTSTRAP — poll until the reconciler binds this pod to a
@@ -271,6 +300,27 @@ if [ -n "${ENV_KEYS}" ]; then
   done <<< "${ENV_KEYS}"
   echo "[boot] Injected ${ENV_COUNT} env vars from bootstrap bundle"
 fi
+
+# ── Boot timing instrumentation (env-inject → agent-launch breakdown) ──
+# A ~16s window between "Injected env vars" and "Linking Claude state" was
+# root-caused (2026-07-16) to the unconditional root-owned-$HOME `chown -R` that
+# used to run here — NOT GCS-FUSE (the mount is idle during the gap). That chown
+# is now a conditional pre-bind reclaim (see reclaim_home_ownership). These marks
+# stay as a regression probe: they attribute the gap to each sub-step —
+# mount-readiness stat vs first metadata write vs symlink wiring — so if the
+# total ever balloons again a canary boot shows WHERE. EPOCHREALTIME is
+# bash-native (no per-mark subprocess); the `//[.,]/` strip tolerates
+# comma-decimal locales. Grep the boot log for `[boot-timing]`. See
+# docs/investigations/gcs-fuse-user-home-boot-cost-2026-07-15.md.
+BOOT_MARK_T0_US="${EPOCHREALTIME//[.,]/}"
+boot_mark() {
+  if [ -z "${EPOCHREALTIME:-}" ]; then echo "[boot-timing] $1"; return 0; fi
+  local now_us="${EPOCHREALTIME//[.,]/}"
+  local delta_us=$(( now_us - BOOT_MARK_T0_US ))
+  printf '[boot-timing] +%d.%03ds %s\n' "$(( delta_us / 1000000 ))" "$(( (delta_us / 1000) % 1000 ))" "$1"
+}
+boot_mark "env injected — entering user-home wiring"
+
 export ANTHROPIC_API_KEY=$(echo "${BOOTSTRAP_JSON}" | jq -r '.anthropicKey // empty')
 export CLOUDSDK_AUTH_ACCESS_TOKEN=$(echo "${BOOTSTRAP_JSON}" | jq -r '.gcpToken // empty')
 # WorkPreservation GCS tier (spec §Durability & snapshots): the upload URL is
@@ -333,17 +383,22 @@ seed_claude_json() {
 USER_HOME_MOUNT="/mnt/conveyor-users"
 USER_HOME_PROJECT_ID="${CONVEYOR_PROJECT_ID_FROM_BUNDLE:-${PROJECT_ID:-}}"
 
-# Bake steps that run as root while ENV HOME points at /home/conveyor can leave
-# root-owned $HOME entries (a uv install receipt in ~/.config once bricked every
-# pod boot fleet-wide); reclaim them before the symlink work below so a baked
-# ownership slip cannot EACCES the entrypoint under `set -e`. Runs before any
-# symlinks exist, so there is nothing to follow into the FUSE mount.
-sudo -n chown -R conveyor:conveyor /home/conveyor/.config /home/conveyor/.local 2>/dev/null || true
+# Root-owned $HOME reclaim moved OFF this critical path into the pre-bind phase
+# (reclaim_home_ownership, called after refresh_agent_version) and made
+# conditional — the former unconditional `chown -R` here cost ~16s of copy-up on
+# every boot and was the real owner of this "GCS-FUSE" gap. See
+# docs/investigations/gcs-fuse-user-home-boot-cost-2026-07-15.md.
 
+# The `[ -d "${USER_HOME_MOUNT}" ]` test below is the first stat against the FUSE
+# mount — if the gcsfuse sidecar is still handshaking it blocks here, so the
+# mark straddles the readiness probe.
+boot_mark "probing user-home mount presence"
 if [ -n "${CONVEYOR_USER_ID}" ] && [ -n "${USER_HOME_PROJECT_ID}" ] && [ -d "${USER_HOME_MOUNT}" ]; then
   USER_HOME_ROOT="${USER_HOME_MOUNT}/users/${CONVEYOR_USER_ID}/${USER_HOME_PROJECT_ID}"
+  boot_mark "user-home mount ready — linking Claude state"
   echo "[pool] Linking Claude state to ${USER_HOME_ROOT}"
   mkdir -p "${USER_HOME_ROOT}/.claude" "${USER_HOME_ROOT}/.config/claude" 2>/dev/null || true
+  boot_mark "mkdir into mount done (first metadata write)"
 
   # Replace any image defaults with live symlinks into the mount for the SHARED,
   # append-mostly Claude state: transcripts/plans/memory under ~/.claude and
@@ -365,6 +420,7 @@ if [ -n "${CONVEYOR_USER_ID}" ] && [ -n "${USER_HOME_PROJECT_ID}" ] && [ -d "${U
   mkdir -p /home/conveyor/.config 2>/dev/null || true
   ln -sfn "${USER_HOME_ROOT}/.claude"        /home/conveyor/.claude
   ln -sfn "${USER_HOME_ROOT}/.config/claude" /home/conveyor/.config/claude
+  boot_mark "~/.claude + ~/.config/claude symlinks wired"
 
   # Pod-local ~/.claude.json: clear any symlink/file a prior boot or the image
   # baked in, then seed a fresh real file on the pod's OWN disk (local
@@ -394,6 +450,7 @@ if [ -n "${CONVEYOR_USER_ID}" ] && [ -n "${USER_HOME_PROJECT_ID}" ] && [ -d "${U
   fi
   ln -sfn "${CRED_POD_LOCAL}" "${CRED_SHARED}" 2>/dev/null || true
   chmod 600 "${CRED_POD_LOCAL}" 2>/dev/null || true
+  boot_mark "~/.claude.json seeded + credentials repointed"
 
   # OpenCode state (sessions + config) persists the same way as ~/.claude.
   mkdir -p "${USER_HOME_ROOT}/.local/share/opencode" "${USER_HOME_ROOT}/.config/opencode" 2>/dev/null || true
@@ -401,11 +458,13 @@ if [ -n "${CONVEYOR_USER_ID}" ] && [ -n "${USER_HOME_PROJECT_ID}" ] && [ -d "${U
   mkdir -p /home/conveyor/.local/share 2>/dev/null || true
   ln -sfn "${USER_HOME_ROOT}/.local/share/opencode" /home/conveyor/.local/share/opencode
   ln -sfn "${USER_HOME_ROOT}/.config/opencode"      /home/conveyor/.config/opencode
+  boot_mark "opencode state linked — user-home wiring complete"
 else
   echo "[pool] Skipping user-home symlink (userId='${CONVEYOR_USER_ID}', projectId='${USER_HOME_PROJECT_ID}', mount present: $([ -d "${USER_HOME_MOUNT}" ] && echo yes || echo no))"
   # No persistent home — the CLI reads the pod-local config; seed it there so
   # non-FUSE pods get the same first-run gate suppression as the mounted path.
   seed_claude_json /home/conveyor/.claude.json
+  boot_mark "no user-home mount — pod-local seed only"
 fi
 
 # ── Wire published graphify bundles from the shared user-home mount ──
@@ -842,6 +901,7 @@ export CONVEYOR_WORKSPACE=/workspaces/repo
 # Exit 0 = clean shutdown (idle timeout, task complete) — pod dies.
 # Non-zero = crash — retry after a brief pause.
 cd /workspaces/repo
+boot_mark "launching agent (env-inject → agent-launch total)"
 echo "[pool] Launching agent..."
 set +e
 # Belt-and-braces alongside the pod's preStop hook (which pkills the agent