@rallycry/conveyor-agent 10.13.65 → 10.13.66

package/dist/{chunk-BAQ2OAKB.js → chunk-75FUOUYX.js}

@@ -7,7 +7,7 @@ import {
   readAgentVersion,
   registerBootMilestoneSocketFallback,
   reportBootMilestone
-} from "./chunk-QZN6HVUY.js";
+} from "./chunk-KG4ORL3Y.js";
 import {
   LoopLagMonitor,
   buildConveyorSocketOptions,
@@ -15,14 +15,14 @@ import {
   heartbeatStatusFor,
   loopStatusForRunnerStatus,
   waitForConnected
-} from "./chunk-5OQQSDVT.js";
+} from "./chunk-IA45XHOA.js";
 import {
   WorkbenchError,
   getWorkbenchClient
-} from "./chunk-QOJTJCYZ.js";
+} from "./chunk-EXQ6AHOY.js";
 import {
   workbenchEnabled
-} from "./chunk-4VUQ2NPF.js";
+} from "./chunk-KMB3BU4S.js";
 import {
   MAX_BETWEEN_TURN_BUFFER,
   MAX_DIAGNOSTIC_OUTPUT,
@@ -30,6 +30,7 @@ import {
   buildPromptBytes,
   buildSpawnArgs,
   cleanTerminalOutput,
+  describeTokenFile,
   ghHostsExternallyOwned,
   gitCredentialHelper,
   githubTokenFilePath,
@@ -54,7 +55,7 @@ import {
   transcriptSize,
   turnOptionsFrom,
   writeGitCredential
-} from "./chunk-NAK6FY5U.js";
+} from "./chunk-LE6ZUDZT.js";
 
 // src/setup/bootstrap.ts
 var BOOTSTRAP_TIMEOUT_MS = 3e4;
@@ -73,11 +74,11 @@ async function singleBootstrapAttempt(apiUrl, instanceName, bootstrapToken, time
       signal: controller.signal
     });
     if (!response.ok) {
-      const errorText = await response.text().catch(() => "");
+      const errorText2 = await response.text().catch(() => "");
       return {
         ok: false,
         status: response.status,
-        errorText: errorText.slice(0, 500),
+        errorText: errorText2.slice(0, 500),
         reason: response.status === 401 || response.status === 403 ? "auth_rejected" : "http_error"
       };
     }
@@ -167,6 +168,28 @@ function applyBootstrapToEnv(config) {
   if (config.taskBranch) process.env.CONVEYOR_TASK_BRANCH = config.taskBranch;
 }
 
+// src/utils/logger.ts
+function createServiceLogger(service) {
+  const prefix = `[conveyor-agent:${service}]`;
+  return {
+    info(message, data) {
+      const extra = data ? ` ${JSON.stringify(data)}` : "";
+      process.stderr.write(`${prefix} ${message}${extra}
+`);
+    },
+    warn(message, data) {
+      const extra = data ? ` ${JSON.stringify(data)}` : "";
+      process.stderr.write(`${prefix} WARN ${message}${extra}
+`);
+    },
+    error(message, data) {
+      const extra = data ? ` ${JSON.stringify(data)}` : "";
+      process.stderr.write(`${prefix} ERROR ${message}${extra}
+`);
+    }
+  };
+}
+
 // src/connection/agent-connection.ts
 import { existsSync } from "fs";
 import { fileURLToPath } from "url";
@@ -204,7 +227,53 @@ async function pollUntilBound(opts) {
   }
 }
 
+// src/connection/bundle-credentials.ts
+function readBundleIdentity(sessionJwt) {
+  if (!sessionJwt) return {};
+  const segments = sessionJwt.split(".");
+  if (segments.length !== 3) return {};
+  try {
+    const json = Buffer.from(segments[1], "base64url").toString("utf8");
+    const claims = JSON.parse(json);
+    return {
+      ...typeof claims.sessionId === "string" ? { sessionId: claims.sessionId } : {},
+      ...typeof claims.role === "string" ? { role: claims.role } : {}
+    };
+  } catch {
+    return {};
+  }
+}
+function bundleMayWriteGithubFiles(bundle, self) {
+  const identity = readBundleIdentity(bundle.sessionJwt);
+  if (identity.sessionId && self.sessionId && identity.sessionId !== self.sessionId) {
+    return {
+      allowed: false,
+      reason: `bundle resolved to session ${identity.sessionId}, not ours (${self.sessionId})`
+    };
+  }
+  if (identity.role === "reader" && self.role && self.role !== "reader") {
+    return {
+      allowed: false,
+      reason: `bundle carries a reader-scoped token but this session is a ${self.role}`
+    };
+  }
+  return { allowed: true };
+}
+function applyBundleGithubToken(bundle, self) {
+  if (!bundle.githubToken) return { written: false, reason: "bundle carried no GitHub token" };
+  const permitted = bundleMayWriteGithubFiles(bundle, self);
+  if (!permitted.allowed) {
+    return { written: false, ...permitted.reason ? { reason: permitted.reason } : {} };
+  }
+  syncGithubTokenFiles(bundle.githubToken);
+  return { written: true };
+}
+function syncBundleGithubToken(token) {
+  syncGithubTokenFiles(token);
+}
+
 // src/connection/agent-connection.ts
+var logger = createServiceLogger("agent-connection");
 var EVENT_BATCH_MS = 500;
 var MAX_EVENT_BUFFER = 5e3;
 var TOKEN_REFRESH_INTERVAL_MS = 45 * 60 * 1e3;
@@ -237,6 +306,7 @@ var AgentConnection = class _AgentConnection {
   apiKeyUpdateCallback = null;
   pullBranchCallback = null;
   runStartCommandCallback = null;
+  earlyRunStartCommand = false;
   earlyPullBranches = [];
   spawnReviewCallback = null;
   earlySpawnReviews = [];
@@ -426,7 +496,8 @@ var AgentConnection = class _AgentConnection {
         else this.earlyProbeUsage = true;
       });
       this.socket.on("session:runStartCommand", () => {
-        this.runStartCommandCallback?.();
+        if (this.runStartCommandCallback) this.runStartCommandCallback();
+        else this.earlyRunStartCommand = true;
       });
       this.socket.on("pty:input", (data) => {
         if (data.sessionId && data.sessionId !== this.config.sessionId) return;
@@ -728,6 +799,26 @@ var AgentConnection = class _AgentConnection {
     }).catch(() => {
     });
   }
+  /**
+   * Report that this pod's git credential is dead and refreshing did not fix
+   * it (fire-and-forget).
+   *
+   * Purely diagnostic. Until this existed a pod could lose git entirely and
+   * leave no server-side trace at all — the refresh RPC succeeded every time,
+   * so the failure was visible only in pod stderr, which is why it took two
+   * investigations to attribute. `tokenShape` describes the served credential
+   * (length, prefix class, mtime) and NEVER carries its value.
+   */
+  reportCredentialFailure(details) {
+    if (!this.socket) return;
+    void this.call("reportCredentialFailure", {
+      sessionId: this.config.sessionId,
+      ...details.error ? { error: details.error.slice(0, 2e3) } : {},
+      ...details.tokenShape ? { tokenShape: details.tokenShape.slice(0, 500) } : {},
+      ...details.healed === void 0 ? {} : { healed: details.healed }
+    }).catch(() => {
+    });
+  }
   /**
    * Ask the server to destroy and recreate this pod (fire-and-forget). The
    * agent calls this only when it has proven it cannot recover in place — the
@@ -772,8 +863,15 @@ var AgentConnection = class _AgentConnection {
     }).catch(() => {
     });
   }
+  /** Register the restart handler, draining a `session:runStartCommand` that
+   *  arrived before the supervisor was ready. Collapsed to one drain: two
+   *  clicks during boot should produce one restart, not two competing ones. */
   onRunStartCommand(callback) {
     this.runStartCommandCallback = callback;
+    if (this.earlyRunStartCommand) {
+      this.earlyRunStartCommand = false;
+      callback();
+    }
   }
   // ── PTY relay (S5 Connected-TUI terminal) ──────────────────────────
   /**
@@ -1159,11 +1257,20 @@ ${q.question}${q.options.length ? "\n" + q.options.map((o) => `- ${o.label}: ${o
       // means the token is consumed / session terminal and retrying won't
       // help. Network/timeout still retry inside fetchBootstrap.
     });
-    if (!result.ok) return { refreshedClaude: false, refreshedTaskToken: false };
+    if (!result.ok) {
+      logger.warn("bootstrap refresh abandoned \u2014 pod credentials will go stale", {
+        path: "codespace",
+        reason: result.reason,
+        status: result.status,
+        attempts: result.attempts,
+        detail: result.detail
+      });
+      return { refreshedClaude: false, refreshedTaskToken: false };
+    }
     const previousTaskToken = process.env.CONVEYOR_TASK_TOKEN;
     applyBootstrapToEnv(result.config);
     const env = result.config.envVars ?? {};
-    syncGithubTokenFiles(env.CONVEYOR_GITHUB_TOKEN ?? env.GH_TOKEN ?? env.GITHUB_TOKEN);
+    syncBundleGithubToken(env.CONVEYOR_GITHUB_TOKEN ?? env.GH_TOKEN ?? env.GITHUB_TOKEN);
     const refreshedTaskToken = result.config.mode !== "project" && Boolean(result.config.taskToken) && result.config.taskToken !== previousTaskToken;
     if (refreshedTaskToken && result.config.taskToken) {
       this.config.taskToken = result.config.taskToken;
@@ -1195,7 +1302,7 @@ ${q.question}${q.options.length ? "\n" + q.options.map((o) => `- ${o.label}: ${o
     }
     if (bundle.githubToken) {
       process.env.CONVEYOR_GITHUB_TOKEN = bundle.githubToken;
-      syncGithubTokenFiles(bundle.githubToken);
+      this.applyBundleCredentialFiles(bundle, previousTaskToken);
     }
     if (bundle.anthropicKey) process.env.ANTHROPIC_API_KEY = bundle.anthropicKey;
     if (bundle.gcpToken) process.env.CLOUDSDK_AUTH_ACCESS_TOKEN = bundle.gcpToken;
@@ -1214,6 +1321,32 @@ ${q.question}${q.options.length ? "\n" + q.options.map((o) => `- ${o.label}: ${o
     const refreshedClaude = Boolean(bundle.envVars?.CLAUDE_CODE_OAUTH_TOKEN);
     return { refreshedClaude, refreshedTaskToken };
   }
+  /**
+   * Write the bundle's GitHub token to the shared credential files — unless the
+   * bundle belongs to another session.
+   *
+   * The bootstrap GET is keyed by the POD, so on a pod also hosting a same-pod
+   * review it can resolve to the reader session, whose token is read-only.
+   * Writing that over the shared files silently downgrades the builder's push
+   * credential. Our own taskToken carries the same claims, so it is what we
+   * compare against.
+   *
+   * The legitimate case this path exists for — our own session's bundle
+   * refreshing the token when the RPC is failing — is unaffected.
+   */
+  applyBundleCredentialFiles(bundle, previousTaskToken) {
+    const self = readBundleIdentity(previousTaskToken);
+    const result = applyBundleGithubToken(bundle, {
+      sessionId: this.config.sessionId || self.sessionId,
+      ...self.role ? { role: self.role } : {}
+    });
+    if (!result.written && result.reason) {
+      process.stderr.write(
+        `[conveyor-agent] Skipped writing GitHub credential files from the bootstrap bundle: ${result.reason}
+`
+      );
+    }
+  }
   /**
    * Poll the bootstrap bundle once (maxWaitMs 0), retrying only on a transient
    * 429 (standby-pool pods share one Cloud NAT IP against podBootstrapLimiter)
@@ -1229,6 +1362,12 @@ ${q.question}${q.options.length ? "\n" + q.options.map((o) => `- ${o.label}: ${o
       } catch (err) {
         const isRateLimited = err instanceof PollUntilBoundHttpError && err.status === 429;
         if (!isRateLimited || attempt >= retryDelaysMs.length) {
+          logger.warn("bootstrap refresh abandoned \u2014 pod credentials will go stale", {
+            path: "v3",
+            attempt,
+            rateLimited: isRateLimited,
+            error: err instanceof Error ? err.message : String(err)
+          });
           return null;
         }
         await new Promise((resolve) => {
@@ -1290,31 +1429,8 @@ function isPermissionDeniedError(err) {
   return /insufficient permissions|authentication required/i.test(message);
 }
 
-// src/utils/logger.ts
-function createServiceLogger(service) {
-  const prefix = `[conveyor-agent:${service}]`;
-  return {
-    info(message, data) {
-      const extra = data ? ` ${JSON.stringify(data)}` : "";
-      process.stderr.write(`${prefix} ${message}${extra}
-`);
-    },
-    warn(message, data) {
-      const extra = data ? ` ${JSON.stringify(data)}` : "";
-      process.stderr.write(`${prefix} WARN ${message}${extra}
-`);
-    },
-    error(message, data) {
-      const extra = data ? ` ${JSON.stringify(data)}` : "";
-      process.stderr.write(`${prefix} ERROR ${message}${extra}
-`);
-    }
-  };
-}
-
-// src/runner/git-utils.ts
+// src/runner/git-run.ts
 import { execFile } from "child_process";
-import { realpathSync } from "fs";
 import { promisify } from "util";
 var execFileAsync = promisify(execFile);
 var GIT_TIMEOUT_MS = 6e4;
@@ -1322,12 +1438,19 @@ var GIT_SLOW_TIMEOUT_MS = 12e4;
 var GIT_MAX_BUFFER = 16 * 1024 * 1024;
 async function git(cwd, args, timeoutMs = GIT_TIMEOUT_MS) {
   if (workbenchEnabled()) {
-    const { stdout: stdout2 } = await getWorkbenchClient().execFile("git", args, {
-      cwd,
-      timeout: timeoutMs,
-      maxBuffer: GIT_MAX_BUFFER
-    });
-    return stdout2.trim();
+    try {
+      const { stdout: stdout2 } = await getWorkbenchClient().execFile("git", args, {
+        cwd,
+        timeout: timeoutMs,
+        maxBuffer: GIT_MAX_BUFFER
+      });
+      return stdout2.trim();
+    } catch (err) {
+      if (err instanceof Error && err.message.startsWith("Command timed out:")) {
+        err.killed = true;
+      }
+      throw err;
+    }
   }
   const { stdout } = await execFileAsync("git", args, {
     cwd,
@@ -1336,6 +1459,54 @@ async function git(cwd, args, timeoutMs = GIT_TIMEOUT_MS) {
   });
   return stdout.toString().trim();
 }
+
+// src/runner/git-credential-ops.ts
+function credentialErrorText(err) {
+  const raw = err instanceof Error ? err.message : String(err);
+  return raw.replace(/\/\/[^@\s]+@/g, "//***@");
+}
+async function updateRemoteCredential(cwd, credential) {
+  const result = { ok: false, storeWritten: false, helperConfigured: false };
+  try {
+    const currentUrl = await git(cwd, ["remote", "get-url", "origin"]);
+    const cloneUrl = credential.cloneUrl ?? currentUrl;
+    const normalizedUrl = writeGitCredential(cwd, cloneUrl, credential);
+    result.storeWritten = true;
+    if (currentUrl !== normalizedUrl) {
+      await git(cwd, ["remote", "set-url", "origin", normalizedUrl]);
+    }
+    await git(cwd, ["config", "--local", "credential.helper", gitCredentialHelper(cwd)]);
+    result.helperConfigured = true;
+    result.ok = true;
+  } catch (err) {
+    result.error = credentialErrorText(err);
+  }
+  return result;
+}
+async function updateRemoteToken(cwd, token) {
+  const username = process.env.CONVEYOR_GIT_USERNAME || "x-access-token";
+  const cloneUrl = process.env.CONVEYOR_GIT_CLONE_URL || void 0;
+  const credential = await updateRemoteCredential(cwd, { username, secret: token, cloneUrl });
+  process.env.CONVEYOR_GIT_SECRET = token;
+  const files = syncGithubTokenFiles(token);
+  return { credential, files };
+}
+async function verifyGitCredential(cwd) {
+  try {
+    await git(cwd, ["ls-remote", "--heads", "origin"], 3e4);
+    return { ok: true, outcome: "ok" };
+  } catch (err) {
+    const killed = err.killed === true;
+    return {
+      ok: false,
+      outcome: killed ? "timeout" : "denied",
+      error: credentialErrorText(err)
+    };
+  }
+}
+
+// src/runner/git-utils.ts
+import { realpathSync } from "fs";
 async function ensureOnTaskBranch(cwd, taskBranch, baseBranch) {
   if (!taskBranch) return true;
   try {
@@ -1464,44 +1635,6 @@ async function isAuthError(cwd) {
     return errLooksLikeAuth(err);
   }
 }
-function credentialErrorText(err) {
-  const raw = err instanceof Error ? err.message : String(err);
-  return raw.replace(/\/\/[^@\s]+@/g, "//***@");
-}
-async function updateRemoteCredential(cwd, credential) {
-  const result = { ok: false, storeWritten: false, helperConfigured: false };
-  try {
-    const currentUrl = await git(cwd, ["remote", "get-url", "origin"]);
-    const cloneUrl = credential.cloneUrl ?? currentUrl;
-    const normalizedUrl = writeGitCredential(cwd, cloneUrl, credential);
-    result.storeWritten = true;
-    if (currentUrl !== normalizedUrl) {
-      await git(cwd, ["remote", "set-url", "origin", normalizedUrl]);
-    }
-    await git(cwd, ["config", "--local", "credential.helper", gitCredentialHelper(cwd)]);
-    result.helperConfigured = true;
-    result.ok = true;
-  } catch (err) {
-    result.error = credentialErrorText(err);
-  }
-  return result;
-}
-async function updateRemoteToken(cwd, token) {
-  const username = process.env.CONVEYOR_GIT_USERNAME || "x-access-token";
-  const cloneUrl = process.env.CONVEYOR_GIT_CLONE_URL || void 0;
-  const credential = await updateRemoteCredential(cwd, { username, secret: token, cloneUrl });
-  process.env.CONVEYOR_GIT_SECRET = token;
-  const files = syncGithubTokenFiles(token);
-  return { credential, files };
-}
-async function verifyGitCredential(cwd) {
-  try {
-    await git(cwd, ["ls-remote", "--heads", "origin"], 3e4);
-    return { ok: true };
-  } catch (err) {
-    return { ok: false, error: credentialErrorText(err) };
-  }
-}
 function wipRefForBranch(branch) {
   return `conveyor-wip/${branch}`;
 }
@@ -1645,7 +1778,7 @@ async function pushToOrigin(cwd, refreshToken, skipVerify = false) {
     }
     if (await tryPush(cwd, currentBranch, skipVerify)) return true;
     if (refreshToken && await isAuthError(cwd)) {
-      const token = await refreshToken();
+      const token = await refreshToken({ forceFresh: true });
       if (token) {
         await updateRemoteToken(cwd, token);
         process.env.GITHUB_TOKEN = token;
@@ -2021,16 +2154,19 @@ var KnownAgentEventSchema = z3.discriminatedUnion("type", [
     cacheCreationInputTokens: z3.number().optional(),
     totalTokensUsed: z3.number().optional()
   }).passthrough(),
-  // Three producer shapes share this type: {rateLimitType, utilization, status}
-  // (SDK rate_limit_event), {resetsAt} (agent-connection resume notice), and
-  // the usage-sampler ({rateLimitType, utilization, status, resetsAt, gauges}
-  // — resetsAt matches rateLimitType; gauges survives via .passthrough()).
+  // Four producer shapes share this type: {rateLimitType, utilization, status}
+  // (SDK rate_limit_event), {resetsAt} (agent-connection resume notice), the
+  // usage-sampler ({rateLimitType, utilization, status, resetsAt, gauges}
+  // — resetsAt matches rateLimitType; gauges survives via .passthrough()), and
+  // {unmeasurable, reason} (the sampler reporting it cannot read this key).
   z3.object({
     type: z3.literal("rate_limit_update"),
     rateLimitType: z3.string().optional(),
     utilization: z3.number().optional(),
     status: z3.string().optional(),
-    resetsAt: z3.string().optional()
+    resetsAt: z3.string().optional(),
+    unmeasurable: z3.boolean().optional(),
+    reason: z3.string().optional()
   }).passthrough(),
   z3.object({
     type: z3.literal("context_compacted"),
@@ -2074,6 +2210,7 @@ var KnownAgentEventSchema = z3.discriminatedUnion("type", [
   z3.object({
     type: z3.literal("setup_complete"),
     startCommandRunning: z3.boolean().optional(),
+    startCommandConfigured: z3.boolean().optional(),
     // Sanitized server-side by sanitizeSessionPreviewPorts — stays unknown.
     previewPorts: z3.unknown().optional()
   }).passthrough(),
@@ -2481,7 +2618,14 @@ var EmitAgentEventRequestSchema = z4.object({
   events: z4.array(AgentEventSchema).max(500)
 });
 var RefreshGithubTokenRequestSchema = z4.object({
-  sessionId: z4.string()
+  sessionId: z4.string(),
+  forceFresh: z4.boolean().optional()
+});
+var ReportCredentialFailureRequestSchema = z4.object({
+  sessionId: z4.string(),
+  error: z4.string().max(2e3).optional(),
+  tokenShape: z4.string().max(500).optional(),
+  healed: z4.boolean().optional()
 });
 var ReportReviewSpawnFailureRequestSchema = z4.object({
   sessionId: z4.string(),
@@ -2621,6 +2765,18 @@ var SessionStopResponseSchema = z4.object({
 var DeleteSubtaskResponseSchema = z4.object({
   deleted: z4.boolean()
 });
+var GIT_BRANCH_NAME_MAX = 255;
+var GIT_BRANCH_NAME_MESSAGE = "Invalid git branch name \u2014 use only letters, numbers, '.', '_', '/' and '-', starting with a letter or number, with no '..', '@{' or '//', and no trailing '/', '-', '.' or '.lock'";
+var ALLOWED_REF = /^[A-Za-z0-9][A-Za-z0-9._/-]*$/;
+function isValidGitBranchName(name) {
+  if (typeof name !== "string") return false;
+  if (name.length === 0 || name.length > GIT_BRANCH_NAME_MAX) return false;
+  if (!ALLOWED_REF.test(name)) return false;
+  if (name.includes("..") || name.includes("@{") || name.includes("//")) return false;
+  if (name.endsWith("/") || name.endsWith("-")) return false;
+  if (name.endsWith(".") || name.endsWith(".lock")) return false;
+  return true;
+}
 var cardDescription2 = z5.string().max(CARD_DESCRIPTION_MAX, CARD_DESCRIPTION_LIMIT_MESSAGE).optional();
 var ListAccessibleProjectsRequestSchema = z5.object({
   pageSize: z5.number().int().positive().max(100).optional().default(100)
@@ -2758,11 +2914,17 @@ var UpdateProjectTaskRequestSchema = z5.object({
   // Move to a different sub-project board, or null to move to the parent board.
   // Validated to belong to `projectId` in the handler.
   subProjectId: z5.string().nullable().optional(),
+  // Record the task's ACTUAL working branch (e.g. a locally-driven pack's
+  // branch, so identification never mints a competing name and pack-child
+  // merge handling matches reality), or null to detach. Guarded in the
+  // handler: the ref must exist on origin and no live workspace may be bound
+  // to a different branch.
+  githubBranch: z5.string().min(1).max(GIT_BRANCH_NAME_MAX).refine(isValidGitBranchName, { message: GIT_BRANCH_NAME_MESSAGE }).nullable().optional(),
   requestingUserId: z5.string().optional()
 }).strict().refine(
-  (v) => v.title !== void 0 || v.description !== void 0 || v.plan !== void 0 || v.status !== void 0 || v.risk !== void 0 || v.storyPointValue !== void 0 || v.assignedUserId !== void 0 || v.subProjectId !== void 0,
+  (v) => v.title !== void 0 || v.description !== void 0 || v.plan !== void 0 || v.status !== void 0 || v.risk !== void 0 || v.storyPointValue !== void 0 || v.assignedUserId !== void 0 || v.subProjectId !== void 0 || v.githubBranch !== void 0,
   {
-    message: "update_task requires at least one field to change (title, description, plan, status, risk, storyPointValue, assignedUserId, or subProjectId)"
+    message: "update_task requires at least one field to change (title, description, plan, status, risk, storyPointValue, assignedUserId, subProjectId, or githubBranch)"
   }
 );
 var TransitionProjectTaskStatusRequestSchema = z5.object({
@@ -3306,7 +3468,7 @@ var AGENT_CHAT_HISTORY_FETCH_LIMIT = Math.max(TASK_CHAT_HISTORY_LIMIT, PM_CHAT_H
 function formatModelId(provider, model) {
   return `${provider}/${model}`;
 }
-function anthropicEntry(model, label, inputPerMillion, outputPerMillion, experimental = false) {
+function anthropicEntry(model, label, inputPerMillion, outputPerMillion, opts = {}) {
   return {
     provider: "anthropic",
     model,
@@ -3316,7 +3478,8 @@ function anthropicEntry(model, label, inputPerMillion, outputPerMillion, experim
     inputPrice: inputPerMillion / 1e6,
     outputPrice: outputPerMillion / 1e6,
     supportsTools: true,
-    ...experimental ? { experimental: true } : {}
+    supportsEffort: opts.supportsEffort ?? true,
+    ...opts.experimental ? { experimental: true } : {}
   };
 }
 var ANTHROPIC_CATALOG = [
@@ -3324,8 +3487,9 @@ var ANTHROPIC_CATALOG = [
   anthropicEntry(PREVIOUS_OPUS_MODEL, "Opus 4.8", 5, 25),
   anthropicEntry(DEFAULT_SONNET_MODEL, "Sonnet 5 Latest", 3, 15),
   anthropicEntry(PREVIOUS_SONNET_MODEL, "Sonnet 4.6", 3, 15),
-  anthropicEntry(DEFAULT_HAIKU_MODEL, "Haiku 4.5", 1, 5),
-  anthropicEntry(FABLE_MODEL, "Fable 5 (experimental)", 10, 50, true)
+  // The Haiku line (4.5 and older) predates the tuning surface and 400s on it.
+  anthropicEntry(DEFAULT_HAIKU_MODEL, "Haiku 4.5", 1, 5, { supportsEffort: false }),
+  anthropicEntry(FABLE_MODEL, "Fable 5 (experimental)", 10, 50, { experimental: true })
 ];
 var HUMAN_PROSE_WRITING_STYLE = `## Writing style for humans
 When you write prose a person will read \u2014 chat messages, plan updates, PR titles and bodies, PR review guides (the \`publish_review_guide\` overview and section explanations), review comments \u2014 follow these rules (based on ASD-STE100 Simplified Technical English):
@@ -7378,7 +7542,7 @@ function findOnPath(binary, env = process.env) {
 import { promises as fs } from "fs";
 import { dirname as dirname2, join as join9 } from "path";
 import { homedir as homedir4 } from "os";
-var logger = createServiceLogger("opencode-auth");
+var logger2 = createServiceLogger("opencode-auth");
 var OPENCODE_CODEX_PLUGIN = "opencode-openai-codex-auth@4.4.0";
 var PLUGIN_PACKAGE = "opencode-openai-codex-auth";
 function opencodeAuthPath(env) {
@@ -7425,7 +7589,7 @@ async function ensureAuthEntry(env, seed) {
   const path2 = opencodeAuthPath(env);
   const store = await readJsonFile(path2);
   if (!shouldSeed(store.openai, seed)) {
-    logger.info("opencode oauth store is fresher than the seed; leaving it alone");
+    logger2.info("opencode oauth store is fresher than the seed; leaving it alone");
     return;
   }
   store.openai = {
@@ -7435,7 +7599,7 @@ async function ensureAuthEntry(env, seed) {
     expires: seed.expires
   };
   await writeJsonFile(path2, store);
-  logger.info("seeded opencode oauth store entry");
+  logger2.info("seeded opencode oauth store entry");
 }
 async function ensurePluginConfig(env) {
   const path2 = opencodeConfigPath(env);
@@ -7448,7 +7612,7 @@ async function ensurePluginConfig(env) {
   const kept = plugins.filter((p) => !isOurs(p));
   config.plugin = [...kept, OPENCODE_CODEX_PLUGIN];
   await writeJsonFile(path2, config);
-  logger.info("ensured opencode codex-auth plugin in config");
+  logger2.info("ensured opencode codex-auth plugin in config");
 }
 async function seedOpenCodeOauth(env) {
   const seed = parseOauthSeed(env.CONVEYOR_OPENCODE_OAUTH);
@@ -7457,7 +7621,7 @@ async function seedOpenCodeOauth(env) {
     await ensureAuthEntry(env, seed);
     await ensurePluginConfig(env);
   } catch (err) {
-    logger.warn(
+    logger2.warn(
       `failed to seed opencode oauth store: ${err instanceof Error ? err.message : String(err)}`
     );
   }
@@ -7826,14 +7990,14 @@ function resolveTuiAdapter(kind = "claude-code") {
 
 // src/harness/pty/stream-server.ts
 import net from "net";
-var logger2 = createServiceLogger("PtyStreamServer");
+var logger3 = createServiceLogger("PtyStreamServer");
 var RING_MAX_CHARS = 256 * 1024;
 var PtyStreamServer = class {
   constructor(options) {
     this.options = options;
     this.server = net.createServer((socket) => this.handleConnection(socket));
     this.server.on("error", (err) => {
-      logger2.warn(`PTY stream server error: ${err.message}`);
+      logger3.warn(`PTY stream server error: ${err.message}`);
     });
   }
   options;
@@ -7874,7 +8038,7 @@ var PtyStreamServer = class {
         return port;
       }
     }
-    logger2.warn(`PTY stream server could not bind any port in ${base}..${base + attempts - 1}`);
+    logger3.warn(`PTY stream server could not bind any port in ${base}..${base + attempts - 1}`);
     return null;
   }
   tryListen(port) {
@@ -7995,7 +8159,7 @@ var PtyStreamServer = class {
 };
 
 // src/harness/pty/direct-stream.ts
-var logger3 = createServiceLogger("PtyDirectStream");
+var logger4 = createServiceLogger("PtyDirectStream");
 var RELAY_COALESCE_MS = 2e3;
 var RELAY_MAX_BUFFER_CHARS = 48 * 1024;
 var DirectStreamController = class {
@@ -8044,7 +8208,7 @@ var DirectStreamController = class {
     });
     void created.listen().then((port) => this.onListening(created, port)).catch((err) => {
       this.starting = false;
-      logger3.warn(
+      logger4.warn(
         `PTY stream server failed to start: ${err instanceof Error ? err.message : String(err)}`
       );
     });
@@ -8057,7 +8221,7 @@ var DirectStreamController = class {
     }
     this.server = created;
     this.reporter.reportPtyStream(port);
-    logger3.info(`PTY stream server listening on ${port} (session ${this.reporter.sessionId})`);
+    logger4.info(`PTY stream server listening on ${port} (session ${this.reporter.sessionId})`);
   }
   /** Push the min box across both transports to the pty. */
   applyDims() {
@@ -10083,7 +10247,10 @@ var getTaskContract = defineToolContract({
     fields: {
       projectId: mcpProjectId,
       taskId: f.string({
-        desc: "The task ID or slug (the value in a card URL, /cards/<slug>)"
+        // The path form is MCP-only on purpose: an in-pod agent is bound to one
+        // project, where a bare slug already resolves, so the `agent` half of
+        // this contract deliberately says nothing about it.
+        desc: "The task ID or slug (the value in a card URL, /cards/<slug>), or a path-form reference '<project-slug>/<card-slug>' from the board's Copy path action"
       })
     }
   }
@@ -11064,6 +11231,80 @@ function buildGetSuggestionsTool(connection) {
 
 // src/tools/mutation-tools.ts
 import { z as z13 } from "zod";
+
+// src/runner/refresh-verify-heal.ts
+async function refreshAndVerifyGithubCredential(cwd, mint) {
+  const first = await mintWriteProbe(cwd, mint, false);
+  if (first.probe.ok) return first;
+  if (first.probe.outcome !== "denied") return first;
+  if (!first.written) return first;
+  const healed = await mintWriteProbe(cwd, mint, true);
+  return { ...healed, healAttempted: true };
+}
+async function mintWriteProbe(cwd, mint, forceFresh) {
+  let token;
+  try {
+    token = await mint(forceFresh ? { forceFresh: true } : {});
+  } catch (err) {
+    return {
+      ok: false,
+      probe: { ok: false, outcome: "unavailable", error: errorText(err) },
+      healAttempted: false,
+      failures: [`- could not mint a GitHub token: ${errorText(err)}`]
+    };
+  }
+  if (!token) {
+    return {
+      ok: false,
+      probe: { ok: false, outcome: "unavailable", error: "no token returned" },
+      healAttempted: false,
+      failures: ["- the server returned no GitHub token"]
+    };
+  }
+  const written = await updateRemoteToken(cwd, token);
+  process.env.GITHUB_TOKEN = token;
+  process.env.GH_TOKEN = token;
+  const probe = await verifyGitCredential(cwd);
+  const failures = describeFailures(written, probe);
+  return {
+    ok: probe.ok && failures.length === 0,
+    probe,
+    written,
+    healAttempted: false,
+    failures,
+    ...probe.ok ? {} : { tokenShape: describeTokenFile() }
+  };
+}
+function describeFailures(written, probe) {
+  const failures = [];
+  const credentialError = written.credential.error ? `: ${written.credential.error}` : "";
+  if (!written.credential.storeWritten) {
+    failures.push(`- git credential store NOT written${credentialError}`);
+  } else if (!written.credential.helperConfigured) {
+    failures.push(`- git credential helper NOT configured${credentialError}`);
+  }
+  if (!written.files.tokenFile) {
+    const why = written.files.errors?.tokenFile;
+    failures.push(`- token file NOT written${why ? `: ${why}` : ""}`);
+  }
+  if (!written.files.ghHosts && !ghHostsExternallyOwned()) {
+    const why = written.files.errors?.ghHosts;
+    failures.push(`- gh CLI config NOT written${why ? `: ${why}` : ""}`);
+  }
+  if (probe.outcome === "denied") {
+    failures.push(`- git could not authenticate to origin: ${probe.error ?? "unknown error"}`);
+  } else if (probe.outcome === "timeout") {
+    failures.push(
+      `- the credential is UNPROVEN: the check against origin timed out (${probe.error ?? "killed"}). The pod is likely under load \u2014 this is not evidence the token is bad.`
+    );
+  }
+  return failures;
+}
+function errorText(err) {
+  return err instanceof Error ? err.message : String(err);
+}
+
+// src/tools/mutation-tools.ts
 function buildPostToChatTool(connection) {
   return defineContractTool(
     postToChatContract,
@@ -11353,60 +11594,85 @@ function buildVoteSuggestionTool(connection) {
     }
   );
 }
+function describeRefreshOutcome(outcome, tokenFile) {
+  const healedNote = outcome.healAttempted ? " (the first attempt was rejected; a force-fresh retry fixed it)" : "";
+  if (outcome.probe.ok) {
+    if (outcome.failures.length === 0) {
+      return {
+        report: false,
+        text: [
+          `GitHub token refreshed and verified against origin${healedNote}.`,
+          "- git: the credential store and helper are updated, so `git push` works now with no extra step.",
+          "- gh: the CLI config is updated, so `gh` works now with no extra step.",
+          `- shell/scripts: read the current token from ${tokenFile}.`,
+          `  For a command that needs it in the environment: GITHUB_TOKEN=$(cat ${tokenFile}) <command>`,
+          "Retry the failed command."
+        ].join("\n")
+      };
+    }
+    return {
+      report: false,
+      text: [
+        `GitHub token refreshed, but some credential copies did not update.`,
+        ...outcome.failures,
+        `A current token is available at ${tokenFile} when that file was written.`
+      ].join("\n")
+    };
+  }
+  if (outcome.probe.outcome === "timeout") {
+    return {
+      report: false,
+      text: [
+        "GitHub token refreshed, but the check against origin timed out \u2014 the credential is UNPROVEN, not known bad.",
+        ...outcome.failures,
+        "The pod is probably under load (a heavy gate). Retry your git command directly; if it succeeds, nothing is wrong."
+      ].join("\n")
+    };
+  }
+  if (outcome.probe.outcome === "unavailable") {
+    return {
+      report: false,
+      text: [
+        "The server did not hand back a GitHub token, so nothing was refreshed and nothing was tested.",
+        ...outcome.failures,
+        "The agent's connection to the API may be down, or this project may have no GitHub App installed. Wait for the connection to recover and try again."
+      ].join("\n")
+    };
+  }
+  return {
+    report: true,
+    text: [
+      `GitHub token refresh did NOT produce a working git credential${outcome.healAttempted ? ", including after a force-fresh retry" : ""}.`,
+      ...outcome.failures,
+      ...outcome.tokenShape ? [`- credential in play: ${outcome.tokenShape}`] : [],
+      "This has been reported to the card, so the team can see it.",
+      "Do not retry this tool. **Your unpushed work is only on this pod** \u2014 the WIP snapshot needs the same credential, so it is not being saved either. Preserve it before anything else: `git bundle create /tmp/work.bundle --all` (or `git format-patch`), then attach that file to the card with `upload_attachment`."
+    ].join("\n")
+  };
+}
 function buildRefreshGithubTokenTool(connection, config) {
   return defineTool(
     "refresh_github_token",
-    "Mint a fresh GitHub token for this pod when git or gh fails with a 401 / 'Bad credentials'. The pod's token expires about every hour. This updates the git credential store and the gh CLI config, and returns the shell command that puts a current token in your environment.",
+    "Mint a fresh GitHub token for this pod when git or gh fails with a 401 / 'Bad credentials'. The pod's token expires about every hour. This updates the git credential store and the gh CLI config, verifies the result against origin, and returns the shell command that puts a current token in your environment.",
     {},
     async () => {
       try {
-        const result = await connection.call("refreshGithubToken", {
-          sessionId: connection.sessionId
-        });
-        const written = await updateRemoteToken(config.workspaceDir, result.token);
-        process.env.GITHUB_TOKEN = result.token;
-        process.env.GH_TOKEN = result.token;
-        const tokenFile = githubTokenFilePath();
-        const failures = [];
-        if (!written.credential.storeWritten) {
-          failures.push(
-            `- git credential store NOT written${written.credential.error ? `: ${written.credential.error}` : ""}`
-          );
-        } else if (!written.credential.helperConfigured) {
-          failures.push(
-            `- git credential helper NOT configured${written.credential.error ? `: ${written.credential.error}` : ""}`
-          );
-        }
-        if (!written.files.tokenFile) failures.push(`- token file ${tokenFile} NOT written`);
-        if (!written.files.ghHosts && !ghHostsExternallyOwned()) {
-          failures.push("- gh CLI config NOT written");
-        }
-        const probe = await verifyGitCredential(config.workspaceDir);
-        if (!probe.ok) {
-          failures.push(
-            `- git could not authenticate to origin: ${probe.error ?? "unknown error"}`
-          );
-        }
-        if (failures.length > 0) {
-          return textResult(
-            [
-              probe.ok ? "GitHub token refreshed, but some credential copies did not update." : "GitHub token refresh did NOT produce a working git credential.",
-              ...failures,
-              `A current token is available at ${tokenFile} when that file was written.`,
-              "Do not retry this tool more than once. Report the failing lines above to the team \u2014 the GitHub App install may be missing for this project, or the pod's credential directory may not be writable."
-            ].join("\n")
-          );
-        }
-        return textResult(
-          [
-            "GitHub token refreshed and verified against origin.",
-            "- git: the credential store and helper are updated, so `git push` works now with no extra step.",
-            "- gh: the CLI config is updated, so `gh` works now with no extra step.",
-            `- shell/scripts: read the current token from ${tokenFile}.`,
-            `  For a command that needs it in the environment: GITHUB_TOKEN=$(cat ${tokenFile}) <command>`,
-            "Retry the failed command."
-          ].join("\n")
+        const outcome = await refreshAndVerifyGithubCredential(
+          config.workspaceDir,
+          (opts) => connection.call("refreshGithubToken", {
+            sessionId: connection.sessionId,
+            ...opts?.forceFresh ? { forceFresh: true } : {}
+          }).then((r) => r.token)
         );
+        const { text, report } = describeRefreshOutcome(outcome, githubTokenFilePath());
+        if (report) {
+          connection.reportCredentialFailure({
+            error: outcome.failures.join("\n"),
+            ...outcome.tokenShape ? { tokenShape: outcome.tokenShape } : {},
+            healed: outcome.healAttempted
+          });
+        }
+        return textResult(text);
       } catch (error) {
         return textResult(
           `Failed to refresh the GitHub token: ${error instanceof Error ? error.message : "Unknown error"}
@@ -12893,7 +13159,7 @@ function resolvePlaywrightMcpServer(env = process.env) {
 }
 
 // src/execution/event-handlers.ts
-var logger4 = createServiceLogger("event-handlers");
+var logger5 = createServiceLogger("event-handlers");
 function safeVoid(promise, context) {
   if (promise && typeof promise.catch === "function") {
     promise.catch((err) => {
@@ -13048,7 +13314,7 @@ async function emitResultEvent(event, host, context, startTime, lastAssistantUsa
 }
 function handleRateLimitEvent(event, host) {
   const { rate_limit_info } = event;
-  logger4.info("Rate limit event received", { rate_limit_info });
+  logger5.info("Rate limit event received", { rate_limit_info });
   const status = rate_limit_info.status;
   const utilization = rate_limit_info.utilization ?? (status === "rejected" ? 1 : void 0);
   if (utilization !== void 0 && rate_limit_info.rateLimitType) {
@@ -13772,7 +14038,7 @@ function buildCanUseTool(host) {
 }
 
 // src/execution/query-executor.ts
-var logger5 = createServiceLogger("QueryExecutor");
+var logger6 = createServiceLogger("QueryExecutor");
 var IMAGE_ERROR_PATTERN2 = /Could not process image/i;
 var RETRY_DELAYS_MS2 = [6e4, 12e4, 18e4, 3e5];
 function buildHooks(host) {
@@ -13864,7 +14130,7 @@ function repairTornSessionFile(path2) {
     }
     if (keepEnd === content.length) return false;
     truncateSync(path2, Buffer.byteLength(content.slice(0, keepEnd), "utf8"));
-    logger5.warn("Repaired torn transcript before resume", {
+    logger6.warn("Repaired torn transcript before resume", {
       path: path2,
       trimmedBytes: content.length - keepEnd
     });
@@ -13945,7 +14211,7 @@ function buildQueryOptions(host, context) {
     disallowedTools: buildDisallowedTools(settings, mode, host.hasExitedPlanMode),
     enableFileCheckpointing: settings.enableFileCheckpointing,
     stderr: (data) => {
-      logger5.warn("Claude Code stderr", { data: data.trimEnd() });
+      logger6.warn("Claude Code stderr", { data: data.trimEnd() });
     }
   };
 }
@@ -14501,7 +14767,7 @@ async function runWithRetry(initialQuery, context, host, options) {
 }
 
 // src/runner/query-bridge.ts
-var logger6 = createServiceLogger("QueryBridge");
+var logger7 = createServiceLogger("QueryBridge");
 function resolveHarnessKind() {
   if (process.env.CONVEYOR_FORCE_SDK_CARDS === "1") return "sdk";
   return "pty";
@@ -14683,9 +14949,9 @@ var QueryBridge = class {
       const msg = err instanceof Error ? err.message : String(err);
       const isAbort = this._stopped || /abort/i.test(msg);
       if (isAbort) {
-        logger6.info("Query stopped by user", { error: msg });
+        logger7.info("Query stopped by user", { error: msg });
       } else {
-        logger6.error("Query execution failed", { error: msg });
+        logger7.error("Query execution failed", { error: msg });
         this.connection.sendEvent({ type: "error", message: msg });
       }
     } finally {
@@ -14711,9 +14977,9 @@ var QueryBridge = class {
       const msg = err instanceof Error ? err.message : String(err);
       const isAbort = this._stopped || /abort/i.test(msg);
       if (isAbort) {
-        logger6.info("Passive turn stopped", { error: msg });
+        logger7.info("Passive turn stopped", { error: msg });
       } else {
-        logger6.error("Passive turn failed", { error: msg });
+        logger7.error("Passive turn failed", { error: msg });
         this.connection.sendEvent({ type: "error", message: msg });
       }
     } finally {
@@ -15040,7 +15306,8 @@ async function runUsageProbe(deps = {}) {
 }
 
 // src/execution/usage-sampler.ts
-var logger7 = createServiceLogger("usage-sampler");
+var logger8 = createServiceLogger("usage-sampler");
+var NO_SAMPLES = { samples: [], unmeasurable: null };
 function isAttributable(identity, sessionToken) {
   if (!identity) return { ok: true };
   if (identity.hasRefreshToken) {
@@ -15052,14 +15319,14 @@ function isAttributable(identity, sessionToken) {
   return { ok: true };
 }
 async function sampleKeyUsage(token, probe = () => runUsageProbe(), hasSubscriptionCredentials = () => existsSync3(claudeCredentialsPath()), readIdentity = readCredentialsIdentity) {
-  if (!token && !hasSubscriptionCredentials()) return [];
+  if (!token && !hasSubscriptionCredentials()) return NO_SAMPLES;
   try {
     const attributable = isAttributable(await readIdentity(), token);
     if (!attributable.ok) {
-      logger7.info("usage sample skipped \u2014 credentials not attributable to this session's key", {
+      logger8.info("usage sample skipped \u2014 credentials not attributable to this session's key", {
         reason: attributable.reason
       });
-      return [];
+      return { samples: [], unmeasurable: { reason: attributable.reason ?? "unattributable" } };
     }
     const stdout = await probe();
     const { sessionUsage, weeklyUsage, sessionResetsAt, weeklyResetsAt, gauges } = parseUsageGauges(stdout);
@@ -15083,18 +15350,37 @@ async function sampleKeyUsage(token, probe = () => runUsageProbe(), hasSubscript
       });
     }
     if (samples.length === 0) {
-      logger7.info("usage sample produced no gauges", {
+      logger8.info("usage sample produced no gauges", {
         stdoutLength: stdout.length,
         stdoutHead: stdout.slice(0, 200).replaceAll("\n", " ")
       });
     }
-    return samples;
+    return { samples, unmeasurable: null };
   } catch (error) {
-    logger7.info("usage sample failed", {
+    logger8.info("usage sample failed", {
       error: error instanceof Error ? error.message : String(error)
     });
-    return [];
-  }
+    return NO_SAMPLES;
+  }
+}
+function buildRateLimitEvents(samples, codingAgentKeyId) {
+  return samples.map((sample) => ({
+    type: "rate_limit_update",
+    rateLimitType: sample.rateLimitType,
+    utilization: sample.utilization,
+    status: sample.status,
+    resetsAt: sample.resetsAt ?? void 0,
+    gauges: sample.gauges,
+    ...codingAgentKeyId ? { codingAgentKeyId } : {}
+  }));
+}
+function buildUnmeasurableEvent(reason, codingAgentKeyId) {
+  return {
+    type: "rate_limit_update",
+    unmeasurable: true,
+    reason,
+    ...codingAgentKeyId ? { codingAgentKeyId } : {}
+  };
 }
 
 // src/setup/git-ready.ts
@@ -16243,12 +16529,9 @@ var SessionRunner = class _SessionRunner {
   /** Shared token-refresh closure for the git-flush call sites (periodic
    *  backstop + per-turn flush). Never throws — returns undefined so the
    *  caller falls back to its existing remote credentials. */
-  async refreshGithubTokenForFlush() {
+  async refreshGithubTokenForFlush(opts) {
     try {
-      const res = await this.connection.call("refreshGithubToken", {
-        sessionId: this.connection.sessionId
-      });
-      return res.token;
+      return await this.mintGithubToken(opts);
     } catch {
       return void 0;
     }
@@ -16263,7 +16546,7 @@ var SessionRunner = class _SessionRunner {
     try {
       await flushPendingChanges(this.config.workspaceDir, {
         wipMessage,
-        refreshToken: () => this.refreshGithubTokenForFlush()
+        refreshToken: (opts) => this.refreshGithubTokenForFlush(opts)
       });
     } catch {
     } finally {
@@ -16288,7 +16571,7 @@ var SessionRunner = class _SessionRunner {
     try {
       const result = await flushAllPendingWork(this.config.workspaceDir, {
         wipMessage: "WIP: periodic auto-commit",
-        refreshToken: () => this.refreshGithubTokenForFlush()
+        refreshToken: (opts) => this.refreshGithubTokenForFlush(opts)
       });
       if (result.hadWork) {
         process.stderr.write(
@@ -16303,22 +16586,20 @@ var SessionRunner = class _SessionRunner {
   }
   /** Sample the running Claude subscription key's rate-limit utilization from
    *  the Claude CLI `/usage` command and report it as `rate_limit_update` events.
-   *  The API (`persistRateLimitSnapshot`) attributes them to the key this session
-   *  launched under, keeping User Settings + the PtY-tab usage widget fresh and
+   *  The API (`persistRateLimitSnapshot`) attributes them to the key named on the
+   *  event, keeping User Settings + the PtY-tab usage widget fresh and
    *  `selectBestKey` rotation honest. Best-effort — never throws, no-op when the
    *  pod has no OAuth token (e.g. API-key projects). */
   async sampleAndReportKeyUsage() {
     if (this.stopped) return;
-    const samples = await sampleKeyUsage(process.env.CLAUDE_CODE_OAUTH_TOKEN);
-    for (const sample of samples) {
-      this.connection.sendEvent({
-        type: "rate_limit_update",
-        rateLimitType: sample.rateLimitType,
-        utilization: sample.utilization,
-        status: sample.status,
-        resetsAt: sample.resetsAt ?? void 0,
-        gauges: sample.gauges
-      });
+    const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
+    const { samples, unmeasurable } = await sampleKeyUsage(process.env.CLAUDE_CODE_OAUTH_TOKEN);
+    if (unmeasurable) {
+      this.connection.sendEvent(buildUnmeasurableEvent(unmeasurable.reason, codingAgentKeyId));
+      return;
+    }
+    for (const event of buildRateLimitEvents(samples, codingAgentKeyId)) {
+      this.connection.sendEvent(event);
     }
   }
   /** Wait (bounded) for any in-flight periodic/turn flush to release the shared
@@ -16347,16 +16628,7 @@ var SessionRunner = class _SessionRunner {
     try {
       const result = await flushAllPendingWork(this.config.workspaceDir, {
         wipMessage: "WIP: auto-commit on conveyor-agent shutdown",
-        refreshToken: async () => {
-          try {
-            const res = await this.connection.call("refreshGithubToken", {
-              sessionId: this.connection.sessionId
-            });
-            return res.token;
-          } catch {
-            return void 0;
-          }
-        }
+        refreshToken: (opts) => this.refreshGithubTokenForFlush(opts)
       });
       if (result.hadWork) {
         process.stderr.write(
@@ -16537,22 +16809,42 @@ var SessionRunner = class _SessionRunner {
       void handlePullBranch(this.config.workspaceDir, branch);
     });
   }
-  /** Proactively refresh the GitHub token before the 1-hour expiry. */
+  /**
+   * Proactively refresh the GitHub token before the 1-hour expiry — and PROVE
+   * the result works.
+   *
+   * The old version logged "Proactively refreshed GitHub token" whenever the
+   * credential store write succeeded. It never inspected the token-file write
+   * and never asked git anything, so a pod whose token file was stale printed
+   * that line every 45 minutes while every push 401'd. Three of those lines,
+   * perfectly spaced, are what made the 2026-08-19 occurrence unreadable. A
+   * success line here now means the credential authenticated against origin.
+   */
   async refreshGithubToken() {
     try {
-      const res = await this.connection.call("refreshGithubToken", {
-        sessionId: this.connection.sessionId
-      });
-      const written = await updateRemoteToken(this.config.workspaceDir, res.token);
-      process.env.GITHUB_TOKEN = res.token;
-      process.env.GH_TOKEN = res.token;
-      if (written.credential.ok) {
-        process.stderr.write("[conveyor-agent] Proactively refreshed GitHub token\n");
-      } else {
+      const outcome = await refreshAndVerifyGithubCredential(
+        this.config.workspaceDir,
+        (opts) => this.mintGithubToken(opts)
+      );
+      if (outcome.ok) {
         process.stderr.write(
-          `[conveyor-agent] Warning: refreshed GitHub token but the git credential did not update: ${written.credential.error ?? "unknown error"}
+          `[conveyor-agent] Proactively refreshed GitHub token \u2014 verified against origin${outcome.healAttempted ? " (after a force-fresh retry)" : ""}
 `
         );
+        return;
+      }
+      process.stderr.write(
+        `[conveyor-agent] Warning: proactive GitHub token refresh did not produce a working credential:
+${outcome.failures.join("\n")}
+` + (outcome.tokenShape ? `  token file: ${outcome.tokenShape}
+` : "")
+      );
+      if (outcome.probe.outcome === "denied") {
+        this.connection.reportCredentialFailure({
+          error: outcome.failures.join("\n"),
+          ...outcome.tokenShape ? { tokenShape: outcome.tokenShape } : {},
+          healed: outcome.healAttempted
+        });
       }
     } catch (err) {
       const msg = err instanceof Error ? err.message : String(err);
@@ -16560,6 +16852,14 @@ var SessionRunner = class _SessionRunner {
 `);
     }
   }
+  /** Mint a GitHub token over the RPC. `forceFresh` bypasses the API's cache. */
+  async mintGithubToken(opts) {
+    const res = await this.connection.call("refreshGithubToken", {
+      sessionId: this.connection.sessionId,
+      ...opts?.forceFresh ? { forceFresh: true } : {}
+    });
+    return res.token;
+  }
   /** Re-fetch task context to pick up a newly created branch and check it out. */
   async refreshBranchForBuilding() {
     try {
@@ -16732,6 +17032,7 @@ function unshallowRepo(workspaceDir) {
 export {
   fetchBootstrap,
   applyBootstrapToEnv,
+  createServiceLogger,
   AgentConnection,
   DEFAULT_SONNET_MODEL,
   isPermissionDeniedError,
@@ -16739,7 +17040,6 @@ export {
   Lifecycle,
   buildSynthesizedCredentials,
   claudeJsonPath,
-  createServiceLogger,
   PtyHarness,
   resolveTuiKindFromEnv,
   resolveTuiAdapter,
@@ -16747,11 +17047,11 @@ export {
   statWorkspacePath,
   workspacePathExists,
   GIT_TIMEOUT_MS,
+  updateRemoteToken,
   hasUncommittedChanges,
   getCurrentBranch,
   hasUnpushedCommits,
   stageAndCommit,
-  updateRemoteToken,
   flushPendingChanges,
   pushToOrigin,
   buildProjectTools,
@@ -16760,6 +17060,8 @@ export {
   parseUsageGauges,
   runUsageProbe,
   sampleKeyUsage,
+  buildRateLimitEvents,
+  buildUnmeasurableEvent,
   awaitGitReady,
   PortDiscovery,
   CodespacePortVisibility,
@@ -16769,4 +17071,3 @@ export {
   loadConveyorConfig,
   unshallowRepo
 };
-//# sourceMappingURL=chunk-BAQ2OAKB.js.map