@rallycry/conveyor-agent 10.13.65 → 10.13.67

package/dist/cli.js

@@ -2,7 +2,7 @@
 import {
   TOMBSTONE_MESSAGE,
   isLegacyEntrypointLaunch
-} from "./chunk-6GS5ADIY.js";
+} from "./chunk-R3FDJQL6.js";
 import {
   AgentConnection,
   CodespacePortVisibility,
@@ -15,8 +15,10 @@ import {
   applyBootstrapToEnv,
   awaitGitReady,
   buildProjectTools,
+  buildRateLimitEvents,
   buildSessionPreviewPorts,
   buildSynthesizedCredentials,
+  buildUnmeasurableEvent,
   claudeJsonPath,
   createServiceLogger,
   fetchBootstrap,
@@ -33,17 +35,17 @@ import {
   sampleKeyUsage,
   statWorkspacePath,
   workspacePathExists
-} from "./chunk-BAQ2OAKB.js";
+} from "./chunk-XPZPR6NS.js";
 import {
   reportBootMilestone
-} from "./chunk-QZN6HVUY.js";
-import "./chunk-5OQQSDVT.js";
+} from "./chunk-KG4ORL3Y.js";
+import "./chunk-IA45XHOA.js";
 import {
   getWorkbenchClient
-} from "./chunk-QOJTJCYZ.js";
+} from "./chunk-EXQ6AHOY.js";
 import {
   workbenchEnabled
-} from "./chunk-4VUQ2NPF.js";
+} from "./chunk-KMB3BU4S.js";
 import {
   inheritedEnv,
   resolvePtySpawn,
@@ -51,8 +53,8 @@ import {
   runStartCommand,
   sessionTempBase,
   terminateProcessGroup
-} from "./chunk-NAK6FY5U.js";
-import "./chunk-JIGG755T.js";
+} from "./chunk-LE6ZUDZT.js";
+import "./chunk-6Q6LQBWO.js";
 
 // src/cli.ts
 import { readFileSync } from "fs";
@@ -572,6 +574,9 @@ var WorkspaceCommandSupervisor = class {
     this.connection.sendEvent({
       type: "setup_complete",
       startCommandRunning,
+      // Reported separately so the server can tell "nothing to run" apart from
+      // "the dev server failed to launch" — both report startCommandRunning:false.
+      startCommandConfigured: Boolean(this.config?.startCommand),
       ...previewPorts.length > 0 ? { previewPorts } : {}
     });
   }
@@ -904,16 +909,14 @@ var ProjectSessionRunner = class {
    *  the task runner). Best-effort — never throws, no-op without an OAuth token. */
   async sampleAndReportKeyUsage() {
     if (this.stopped) return;
-    const samples = await sampleKeyUsage(process.env.CLAUDE_CODE_OAUTH_TOKEN);
-    for (const sample of samples) {
-      this.connection.sendEvent({
-        type: "rate_limit_update",
-        rateLimitType: sample.rateLimitType,
-        utilization: sample.utilization,
-        status: sample.status,
-        resetsAt: sample.resetsAt ?? void 0,
-        gauges: sample.gauges
-      });
+    const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
+    const { samples, unmeasurable } = await sampleKeyUsage(process.env.CLAUDE_CODE_OAUTH_TOKEN);
+    if (unmeasurable) {
+      this.connection.sendEvent(buildUnmeasurableEvent(unmeasurable.reason, codingAgentKeyId));
+      return;
+    }
+    for (const event of buildRateLimitEvents(samples, codingAgentKeyId)) {
+      this.connection.sendEvent(event);
     }
   }
   shutdown() {
@@ -1230,32 +1233,22 @@ var AdhocSessionRunner = class {
     }
     const probed = await probeKeysUsage(keys);
     for (const { codingAgentKeyId, samples } of probed) {
-      for (const sample of samples) {
-        this.connection.sendEvent({
-          type: "rate_limit_update",
-          rateLimitType: sample.rateLimitType,
-          utilization: sample.utilization,
-          status: sample.status,
-          resetsAt: sample.resetsAt ?? void 0,
-          gauges: sample.gauges,
-          codingAgentKeyId
-        });
+      for (const event of buildRateLimitEvents(samples, codingAgentKeyId)) {
+        this.connection.sendEvent(event);
       }
     }
   }
   /** Single-key fallback: sample only the key this pod booted under. */
   async sampleAndReportOwnKey() {
     if (this.stopped) return;
-    const samples = await sampleKeyUsage(process.env.CLAUDE_CODE_OAUTH_TOKEN);
-    for (const sample of samples) {
-      this.connection.sendEvent({
-        type: "rate_limit_update",
-        rateLimitType: sample.rateLimitType,
-        utilization: sample.utilization,
-        status: sample.status,
-        resetsAt: sample.resetsAt ?? void 0,
-        gauges: sample.gauges
-      });
+    const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
+    const { samples, unmeasurable } = await sampleKeyUsage(process.env.CLAUDE_CODE_OAUTH_TOKEN);
+    if (unmeasurable) {
+      this.connection.sendEvent(buildUnmeasurableEvent(unmeasurable.reason, codingAgentKeyId));
+      return;
+    }
+    for (const event of buildRateLimitEvents(samples, codingAgentKeyId)) {
+      this.connection.sendEvent(event);
     }
   }
   async shutdown() {
@@ -1722,7 +1715,7 @@ function hostsSpawnedChildren(mode) {
 
 // src/cli.ts
 if (process.argv[2] === "boot") {
-  const { runBoot } = await import("./boot-7OPX55AO.js");
+  const { runBoot } = await import("./boot-UUPTBQ6R.js");
   process.exit(await runBoot(process.argv.slice(3)));
 }
 if (isLegacyEntrypointLaunch(process.env)) {
@@ -1824,9 +1817,9 @@ process.on("unhandledRejection", (reason) => {
   process.exit(1);
 });
 if (process.env.CONVEYOR_MODE === "workbench") {
-  const { startWorkbenchServer } = await import("./server-ZACB5T5S.js");
-  const { oomWatchdogOptionsFromEnv } = await import("./oom-watchdog-U7JERHA2.js");
-  const { DEFAULT_WORKBENCH_PORT } = await import("./protocol-QLVS5W6O.js");
+  const { startWorkbenchServer } = await import("./server-US2DDQSW.js");
+  const { oomWatchdogOptionsFromEnv } = await import("./oom-watchdog-PAC5OJJG.js");
+  const { DEFAULT_WORKBENCH_PORT } = await import("./protocol-QBCYO4GI.js");
   const port = Number(process.env.CONVEYOR_WORKBENCH_PORT) || DEFAULT_WORKBENCH_PORT;
   const token = process.env.CONVEYOR_WORKBENCH_TOKEN ?? process.env.POD_BOOTSTRAP_TOKEN ?? "";
   if (!token) {
@@ -2155,4 +2148,3 @@ runner.run().then(async () => {
   logAgentExit("error", { exitCode: 1, finalState: runner.finalState ?? void 0 });
   process.exit(1);
 });
-//# sourceMappingURL=cli.js.map

package/dist/{client-LRVVHTNG.js → client-IG6C5F2G.js}

@@ -4,9 +4,9 @@ import {
   WorkbenchError,
   getWorkbenchClient,
   resetWorkbenchClient
-} from "./chunk-QOJTJCYZ.js";
-import "./chunk-4VUQ2NPF.js";
-import "./chunk-JIGG755T.js";
+} from "./chunk-EXQ6AHOY.js";
+import "./chunk-KMB3BU4S.js";
+import "./chunk-6Q6LQBWO.js";
 export {
   RemoteProcessHandle,
   WorkbenchClient,
@@ -14,4 +14,3 @@ export {
   getWorkbenchClient,
   resetWorkbenchClient
 };
-//# sourceMappingURL=client-LRVVHTNG.js.map

package/dist/heartbeat-worker.js

@@ -3,7 +3,7 @@ import {
   heartbeatStatusFor,
   lagFromBuffer,
   statusFromBuffer
-} from "./chunk-5OQQSDVT.js";
+} from "./chunk-IA45XHOA.js";
 
 // src/connection/heartbeat-worker.ts
 import { parentPort, workerData } from "worker_threads";
@@ -42,4 +42,3 @@ function beat() {
   );
 }
 setInterval(beat, data.intervalMs);
-//# sourceMappingURL=heartbeat-worker.js.map

package/dist/index.d.ts

@@ -94,6 +94,7 @@ declare class AgentConnection {
     private apiKeyUpdateCallback;
     private pullBranchCallback;
     private runStartCommandCallback;
+    private earlyRunStartCommand;
     private earlyPullBranches;
     private spawnReviewCallback;
     private earlySpawnReviews;
@@ -174,6 +175,21 @@ declare class AgentConnection {
      * it; the review session is identified separately.
      */
     reportReviewSpawnFailure(reviewSessionId: string, error?: string): void;
+    /**
+     * Report that this pod's git credential is dead and refreshing did not fix
+     * it (fire-and-forget).
+     *
+     * Purely diagnostic. Until this existed a pod could lose git entirely and
+     * leave no server-side trace at all — the refresh RPC succeeded every time,
+     * so the failure was visible only in pod stderr, which is why it took two
+     * investigations to attribute. `tokenShape` describes the served credential
+     * (length, prefix class, mtime) and NEVER carries its value.
+     */
+    reportCredentialFailure(details: {
+        error?: string;
+        tokenShape?: string;
+        healed?: boolean;
+    }): void;
     /**
      * Ask the server to destroy and recreate this pod (fire-and-forget). The
      * agent calls this only when it has proven it cannot recover in place — the
@@ -193,6 +209,9 @@ declare class AgentConnection {
      * sessionId is OUR (builder) session — the task-identity guard runs on it.
      */
     reportSessionSpawnFailure(spawnedSessionId: string, error?: string): void;
+    /** Register the restart handler, draining a `session:runStartCommand` that
+     *  arrived before the supervisor was ready. Collapsed to one drain: two
+     *  clicks during boot should produce one restart, not two competing ones. */
     onRunStartCommand(callback: () => void): void;
     /**
      * Forward a raw chunk of terminal output to the S2 relay (fire-and-forget).
@@ -332,6 +351,20 @@ declare class AgentConnection {
      * the same pod token is the designed refresh mechanism.
      */
     private refreshFromV3Bootstrap;
+    /**
+     * Write the bundle's GitHub token to the shared credential files — unless the
+     * bundle belongs to another session.
+     *
+     * The bootstrap GET is keyed by the POD, so on a pod also hosting a same-pod
+     * review it can resolve to the reader session, whose token is read-only.
+     * Writing that over the shared files silently downgrades the builder's push
+     * credential. Our own taskToken carries the same claims, so it is what we
+     * compare against.
+     *
+     * The legitimate case this path exists for — our own session's bundle
+     * refreshing the token when the RPC is failing — is unaffected.
+     */
+    private applyBundleCredentialFiles;
     /**
      * Poll the bootstrap bundle once (maxWaitMs 0), retrying only on a transient
      * 429 (standby-pool pods share one Cloud NAT IP against podBootstrapLimiter)
@@ -694,8 +727,8 @@ declare class SessionRunner {
     private periodicGitFlush;
     /** Sample the running Claude subscription key's rate-limit utilization from
      *  the Claude CLI `/usage` command and report it as `rate_limit_update` events.
-     *  The API (`persistRateLimitSnapshot`) attributes them to the key this session
-     *  launched under, keeping User Settings + the PtY-tab usage widget fresh and
+     *  The API (`persistRateLimitSnapshot`) attributes them to the key named on the
+     *  event, keeping User Settings + the PtY-tab usage widget fresh and
      *  `selectBestKey` rotation honest. Best-effort — never throws, no-op when the
      *  pod has no OAuth token (e.g. API-key projects). */
     private sampleAndReportKeyUsage;
@@ -720,8 +753,20 @@ declare class SessionRunner {
     private buildFullContext;
     private createQueryBridge;
     private wireConnectionCallbacks;
-    /** Proactively refresh the GitHub token before the 1-hour expiry. */
+    /**
+     * Proactively refresh the GitHub token before the 1-hour expiry — and PROVE
+     * the result works.
+     *
+     * The old version logged "Proactively refreshed GitHub token" whenever the
+     * credential store write succeeded. It never inspected the token-file write
+     * and never asked git anything, so a pod whose token file was stale printed
+     * that line every 45 minutes while every push 401'd. Three of those lines,
+     * perfectly spaced, are what made the 2026-08-19 occurrence unreadable. A
+     * success line here now means the credential authenticated against origin.
+     */
     private refreshGithubToken;
+    /** Mint a GitHub token over the RPC. `forceFresh` bypasses the API's cache. */
+    private mintGithubToken;
     /** Re-fetch task context to pick up a newly created branch and check it out. */
     private refreshBranchForBuilding;
     /**
@@ -779,16 +824,44 @@ interface AgentRunnerCallbacks {
 interface GithubTokenFileSync {
     tokenFile: boolean;
     ghHosts: boolean;
+    /**
+     * Why a copy is not current, when a write actually threw.
+     *
+     * A `false` flag alone is ambiguous — it also means "deliberately skipped"
+     * (a `gh` login we do not own, a vitest run without a temp-dir override).
+     * Callers that report on a refresh need to tell a skip from a failure, and
+     * until this existed the thrown error was discarded here and the caller had
+     * nothing to print but the flag.
+     */
+    errors?: {
+        tokenFile?: string;
+        ghHosts?: string;
+    };
 }
 
-/** Returns true if the working tree has uncommitted changes (staged or unstaged). */
-declare function hasUncommittedChanges(cwd: string): Promise<boolean>;
-/** Returns the current branch name, or null if on detached HEAD. */
-declare function getCurrentBranch(cwd: string): Promise<string | null>;
-/** Returns true if there are committed changes that haven't been pushed to origin. */
-declare function hasUnpushedCommits(cwd: string): Promise<boolean>;
-/** Stage all changes and create a commit. Returns the commit hash if successful. */
-declare function stageAndCommit(cwd: string, message: string): Promise<string | null>;
+/**
+ * Writing the pod's git credential, and proving it works.
+ *
+ * Split out of `git-utils.ts`: these four functions are one concern — what a
+ * token refresh WRITES (`updateRemoteCredential` / `updateRemoteToken`) and
+ * whether the result can actually authenticate (`verifyGitCredential`) — and
+ * `refresh-verify-heal.ts` is built entirely on them.
+ *
+ * Every git call here goes through the shared `git()` runner (`git-run.ts`),
+ * which carries the async-only / always-a-timeout / args-as-arrays rules.
+ */
+
+/**
+ * How a caller mints a fresh GitHub token.
+ *
+ * `forceFresh` skips the API's installation-token cache. It matters only on the
+ * retry after a rejection: the cache tracks expiry, never validity, so an
+ * ordinary re-mint hands back the very token GitHub just refused. Optional so
+ * every existing zero-argument closure still satisfies this type.
+ */
+type RefreshTokenFn = (opts?: {
+    forceFresh?: boolean;
+}) => Promise<string | undefined>;
 /** What a credential refresh actually managed to write. */
 interface GitCredentialUpdate {
     /** Both the credential file and the helper config are current. */
@@ -807,13 +880,22 @@ interface TokenRefreshResult {
 }
 /** Compatibility alias for the existing refreshGithubToken RPC. */
 declare function updateRemoteToken(cwd: string, token: string): Promise<TokenRefreshResult>;
+
+/** Returns true if the working tree has uncommitted changes (staged or unstaged). */
+declare function hasUncommittedChanges(cwd: string): Promise<boolean>;
+/** Returns the current branch name, or null if on detached HEAD. */
+declare function getCurrentBranch(cwd: string): Promise<string | null>;
+/** Returns true if there are committed changes that haven't been pushed to origin. */
+declare function hasUnpushedCommits(cwd: string): Promise<boolean>;
+/** Stage all changes and create a commit. Returns the commit hash if successful. */
+declare function stageAndCommit(cwd: string, message: string): Promise<string | null>;
 /** Best-effort flush of pending work: pushes any real (intentional) commits to
  *  the task branch, and captures uncommitted changes as a WIP snapshot on the
  *  `conveyor-wip/<branch>` ref — never as commits on the branch itself. When
  *  the tree is clean, a previously pushed WIP ref is deleted. Never throws. */
 declare function flushPendingChanges(cwd: string, opts?: {
     wipMessage?: string;
-    refreshToken?: () => Promise<string | undefined>;
+    refreshToken?: RefreshTokenFn;
 }): Promise<{
     committed: boolean;
     pushed: boolean;
@@ -821,7 +903,7 @@ declare function flushPendingChanges(cwd: string, opts?: {
 }>;
 /** Push current branch to origin. Proactively refreshes the GitHub token before
  *  attempting the push. On auth failure, refreshes again and retries. */
-declare function pushToOrigin(cwd: string, refreshToken?: () => Promise<string | undefined>, skipVerify?: boolean): Promise<boolean>;
+declare function pushToOrigin(cwd: string, refreshToken?: RefreshTokenFn, skipVerify?: boolean): Promise<boolean>;
 
 declare function ensureWorktree(projectDir: string, taskId: string, branch?: string): Promise<string>;
 /**

package/dist/index.js

@@ -13,21 +13,21 @@ import {
   unshallowRepo,
   updateRemoteToken,
   workspacePathExists
-} from "./chunk-BAQ2OAKB.js";
-import "./chunk-QZN6HVUY.js";
-import "./chunk-5OQQSDVT.js";
+} from "./chunk-XPZPR6NS.js";
+import "./chunk-KG4ORL3Y.js";
+import "./chunk-IA45XHOA.js";
 import {
   getWorkbenchClient
-} from "./chunk-QOJTJCYZ.js";
+} from "./chunk-EXQ6AHOY.js";
 import {
   workbenchEnabled
-} from "./chunk-4VUQ2NPF.js";
+} from "./chunk-KMB3BU4S.js";
 import {
   runAuthTokenCommand,
   runSetupCommand,
   runStartCommand
-} from "./chunk-NAK6FY5U.js";
-import "./chunk-JIGG755T.js";
+} from "./chunk-LE6ZUDZT.js";
+import "./chunk-6Q6LQBWO.js";
 
 // src/runner/worktree.ts
 import { execFile } from "child_process";
@@ -114,4 +114,3 @@ export {
   unshallowRepo,
   updateRemoteToken
 };
-//# sourceMappingURL=index.js.map

package/dist/{mode-6RL3SVMV.js → mode-ZJSOSLGU.js}

@@ -3,11 +3,10 @@ import {
   workbenchEnabled,
   workbenchPort,
   workbenchToken
-} from "./chunk-4VUQ2NPF.js";
+} from "./chunk-KMB3BU4S.js";
 export {
   sharedDir,
   workbenchEnabled,
   workbenchPort,
   workbenchToken
 };
-//# sourceMappingURL=mode-6RL3SVMV.js.map

package/dist/{oom-watchdog-U7JERHA2.js → oom-watchdog-PAC5OJJG.js}

@@ -2,10 +2,9 @@ import {
   biggestForeignProcessGroup,
   oomWatchdogOptionsFromEnv,
   startOomWatchdog
-} from "./chunk-ULS4QPRE.js";
+} from "./chunk-6W6UZ4SJ.js";
 export {
   biggestForeignProcessGroup,
   oomWatchdogOptionsFromEnv,
   startOomWatchdog
 };
-//# sourceMappingURL=oom-watchdog-U7JERHA2.js.map

package/dist/{protocol-QLVS5W6O.js → protocol-QBCYO4GI.js}

@@ -4,7 +4,7 @@ import {
   parseLine,
   timingSafeTokenEqual,
   writeFrame
-} from "./chunk-JIGG755T.js";
+} from "./chunk-6Q6LQBWO.js";
 export {
   DEFAULT_WORKBENCH_PORT,
   FrameReader,
@@ -12,4 +12,3 @@ export {
   timingSafeTokenEqual,
   writeFrame
 };
-//# sourceMappingURL=protocol-QLVS5W6O.js.map

package/dist/server-US2DDQSW.js

@@ -0,0 +1,9 @@
+import {
+  startWorkbenchServer
+} from "./chunk-E2SHIH6Y.js";
+import "./chunk-LE6ZUDZT.js";
+import "./chunk-6Q6LQBWO.js";
+import "./chunk-6W6UZ4SJ.js";
+export {
+  startWorkbenchServer
+};

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rallycry/conveyor-agent",
-  "version": "10.13.65",
+  "version": "10.13.67",
   "description": "Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.",
   "keywords": [
     "agent",
@@ -40,7 +40,7 @@
     "@modelcontextprotocol/sdk": "^1.12.1",
     "node-pty": "^1.0.0",
     "socket.io-client": "^4.8.3",
-    "tar": "^7.5.19",
+    "tar": "^7.5.21",
     "zod": "^4.0.0"
   },
   "devDependencies": {