@rallycry/conveyor-agent 10.13.70 → 10.13.72

package/dist/{chunk-E6WWH4WJ.js → chunk-2SN32LM6.js}

@@ -1,1930 +1,87 @@
 import {
-  CLONE_TIMEOUT_MS,
-  DEFAULT_RETRY_DELAY_MS,
-  FETCH_TIMEOUT_MS,
-  GIT_PREP_MAX_RETRIES,
   mapChatHistory,
-  readAgentVersion,
-  registerBootMilestoneSocketFallback,
-  reportBootMilestone
-} from "./chunk-QU53HND5.js";
-import {
-  LoopLagMonitor,
-  buildConveyorSocketOptions,
-  callWithAck,
-  heartbeatStatusFor,
-  loopStatusForRunnerStatus,
-  waitForConnected
-} from "./chunk-IA45XHOA.js";
-import {
-  WorkbenchError,
-  getWorkbenchClient
-} from "./chunk-EXQ6AHOY.js";
-import {
-  workbenchEnabled
-} from "./chunk-KMB3BU4S.js";
-import {
-  MAX_BETWEEN_TURN_BUFFER,
-  MAX_DIAGNOSTIC_OUTPUT,
-  buildExitErrors,
-  buildPromptBytes,
-  buildSpawnArgs,
-  cleanTerminalOutput,
-  describeTokenFile,
-  ghHostsExternallyOwned,
-  gitCredentialHelper,
-  githubTokenFilePath,
-  inheritedEnv,
-  killPtyWithEscalation,
-  needsRawReadyGate,
-  parseUserQuestions,
-  renderPromptContentText,
-  resolveClaudeBinary,
-  resolvePlanDialogTiming,
-  resolvePtySpawn,
-  resolveRawTuiProbeTiming,
-  resolveSubmitNudgeTiming,
-  resolveSubmitRedeliveryMaxAttempts,
-  resolveSubmitSettleMs,
-  sawTerminalSetup,
-  sentinelEchoed,
-  sessionTempBase,
-  sleep,
-  spawnOptionsFingerprint,
-  syncGithubTokenFiles,
-  transcriptSize,
-  turnOptionsFrom,
-  writeGitCredential
-} from "./chunk-GJXAAPJ6.js";
-
-// src/setup/bootstrap.ts
-var BOOTSTRAP_TIMEOUT_MS = 3e4;
-var RETRY_DELAYS_MS = [5e3, 1e4, 2e4];
-function emitFailureEvent(payload) {
-  process.stderr.write(JSON.stringify(payload) + "\n");
-}
-async function singleBootstrapAttempt(apiUrl, instanceName, bootstrapToken, timeoutMs) {
-  const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
-  try {
-    const headers = {};
-    if (bootstrapToken) headers["x-codespace-token"] = bootstrapToken;
-    const response = await fetch(`${apiUrl}/api/codespace/bootstrap/${instanceName}`, {
-      headers,
-      signal: controller.signal
-    });
-    if (!response.ok) {
-      const errorText2 = await response.text().catch(() => "");
-      return {
-        ok: false,
-        status: response.status,
-        errorText: errorText2.slice(0, 500),
-        reason: response.status === 401 || response.status === 403 ? "auth_rejected" : "http_error"
-      };
-    }
-    const body = await response.json();
-    return { ok: true, body };
-  } catch (err) {
-    const message = err instanceof Error ? err.message : String(err);
-    const reason = controller.signal.aborted ? "timeout" : "network_error";
-    return { ok: false, errorText: message.slice(0, 500), reason };
-  } finally {
-    clearTimeout(timer);
-  }
-}
-function buildFailure(reason, attempts, status, detail) {
-  const out = { ok: false, reason, attempts };
-  if (status === void 0) {
-  } else {
-    out.status = status;
-  }
-  if (detail) out.detail = detail;
-  return out;
-}
-function isRetryable(reason, retryOnHttpError) {
-  if (reason === "timeout" || reason === "network_error") return true;
-  return retryOnHttpError === true && reason === "http_error";
-}
-async function fetchBootstrap(opts) {
-  const timeoutMs = opts.timeoutMs ?? BOOTSTRAP_TIMEOUT_MS;
-  const delays = opts.retryDelaysMs ?? RETRY_DELAYS_MS;
-  const maxAttempts = delays.length + 1;
-  const hasBootstrapToken = Boolean(opts.bootstrapToken);
-  const hasTaskToken = Boolean(process.env.CONVEYOR_TASK_TOKEN);
-  let lastReason = "unknown";
-  let lastStatus;
-  let lastDetail;
-  for (let attempt = 1; attempt <= maxAttempts; attempt++) {
-    const result = await singleBootstrapAttempt(
-      opts.apiUrl,
-      opts.instanceName,
-      opts.bootstrapToken,
-      timeoutMs
-    );
-    if (result.ok && result.body) {
-      return { ok: true, config: result.body, attempts: attempt };
-    }
-    lastReason = result.reason ?? "unknown";
-    lastStatus = result.status;
-    lastDetail = result.errorText;
-    const failurePayload = {
-      event: "bootstrap_failed",
-      reason: lastReason,
-      apiUrl: opts.apiUrl,
-      instanceName: opts.instanceName,
-      hasBootstrapToken,
-      hasTaskToken,
-      attempt
-    };
-    if (lastStatus === void 0) {
-    } else {
-      failurePayload.status = lastStatus;
-    }
-    if (lastDetail) failurePayload.detail = lastDetail;
-    emitFailureEvent(failurePayload);
-    if (!isRetryable(lastReason, opts.retryOnHttpError) || attempt >= maxAttempts) {
-      return buildFailure(lastReason, attempt, lastStatus, lastDetail);
-    }
-    await sleep(delays[attempt - 1]);
-  }
-  return buildFailure(lastReason, maxAttempts, lastStatus, lastDetail);
-}
-function applyBootstrapToEnv(config) {
-  for (const [key, value] of Object.entries(config.envVars ?? {})) {
-    process.env[key] = value;
-  }
-  if (config.mode === "project") {
-    if (config.projectToken) process.env.CONVEYOR_PROJECT_TOKEN = config.projectToken;
-    if (config.projectId) process.env.CONVEYOR_PROJECT_ID = config.projectId;
-    if (config.workspaceBranch) process.env.CONVEYOR_WORKSPACE_BRANCH = config.workspaceBranch;
-    return;
-  }
-  if (config.taskId) process.env.CONVEYOR_TASK_ID = config.taskId;
-  if (config.sessionId) process.env.CONVEYOR_SESSION_ID = config.sessionId;
-  if (config.taskToken) process.env.CONVEYOR_TASK_TOKEN = config.taskToken;
-  if (config.agentMode !== void 0) process.env.CONVEYOR_AGENT_MODE = config.agentMode;
-  if (config.isAuto !== void 0) process.env.CONVEYOR_IS_AUTO = config.isAuto;
-  if (config.runnerMode) process.env.CONVEYOR_MODE = config.runnerMode;
-  if (config.taskBranch) process.env.CONVEYOR_TASK_BRANCH = config.taskBranch;
-}
-
-// src/utils/logger.ts
-function createServiceLogger(service) {
-  const prefix = `[conveyor-agent:${service}]`;
-  return {
-    info(message, data) {
-      const extra = data ? ` ${JSON.stringify(data)}` : "";
-      process.stderr.write(`${prefix} ${message}${extra}
-`);
-    },
-    warn(message, data) {
-      const extra = data ? ` ${JSON.stringify(data)}` : "";
-      process.stderr.write(`${prefix} WARN ${message}${extra}
-`);
-    },
-    error(message, data) {
-      const extra = data ? ` ${JSON.stringify(data)}` : "";
-      process.stderr.write(`${prefix} ERROR ${message}${extra}
-`);
-    }
-  };
-}
-
-// src/connection/agent-connection.ts
-import { existsSync } from "fs";
-import { fileURLToPath } from "url";
-import { Worker } from "worker_threads";
-import { io } from "socket.io-client";
-
-// src/setup/bootstrap-poll.ts
-var PollUntilBoundHttpError = class extends Error {
-  constructor(status) {
-    super(`pollUntilBound got unexpected status ${status}`);
-    this.status = status;
-    this.name = "PollUntilBoundHttpError";
-  }
-  status;
-};
-async function pollUntilBound(opts) {
-  const pollIntervalMs = opts.pollIntervalMs ?? 2e3;
-  const maxWaitMs = opts.maxWaitMs ?? 30 * 60 * 1e3;
-  const deadline = Date.now() + maxWaitMs;
-  while (true) {
-    const response = await fetch(`${opts.apiUrl}/api/v3/pods/bootstrap`, {
-      headers: { Authorization: `Bearer ${opts.bootstrapToken}` }
-    });
-    if (response.status === 200) {
-      return await response.json();
-    }
-    if (response.status === 204) {
-      if (Date.now() >= deadline) {
-        throw new Error(`pollUntilBound timed out after ${maxWaitMs}ms waiting for pod bind`);
-      }
-      await sleep(pollIntervalMs);
-      continue;
-    }
-    throw new PollUntilBoundHttpError(response.status);
-  }
-}
-
-// src/connection/bundle-credentials.ts
-function readBundleIdentity(sessionJwt) {
-  if (!sessionJwt) return {};
-  const segments = sessionJwt.split(".");
-  if (segments.length !== 3) return {};
-  try {
-    const json = Buffer.from(segments[1], "base64url").toString("utf8");
-    const claims = JSON.parse(json);
-    return {
-      ...typeof claims.sessionId === "string" ? { sessionId: claims.sessionId } : {},
-      ...typeof claims.role === "string" ? { role: claims.role } : {}
-    };
-  } catch {
-    return {};
-  }
-}
-function bundleMayWriteGithubFiles(bundle, self) {
-  const identity = readBundleIdentity(bundle.sessionJwt);
-  if (identity.sessionId && self.sessionId && identity.sessionId !== self.sessionId) {
-    return {
-      allowed: false,
-      reason: `bundle resolved to session ${identity.sessionId}, not ours (${self.sessionId})`
-    };
-  }
-  if (identity.role === "reader" && self.role && self.role !== "reader") {
-    return {
-      allowed: false,
-      reason: `bundle carries a reader-scoped token but this session is a ${self.role}`
-    };
-  }
-  return { allowed: true };
-}
-function applyBundleGithubToken(bundle, self) {
-  if (!bundle.githubToken) return { written: false, reason: "bundle carried no GitHub token" };
-  const permitted = bundleMayWriteGithubFiles(bundle, self);
-  if (!permitted.allowed) {
-    return { written: false, ...permitted.reason ? { reason: permitted.reason } : {} };
-  }
-  syncGithubTokenFiles(bundle.githubToken);
-  return { written: true };
-}
-function syncBundleGithubToken(token) {
-  syncGithubTokenFiles(token);
-}
-
-// src/connection/agent-connection.ts
-var logger = createServiceLogger("agent-connection");
-var EVENT_BATCH_MS = 500;
-var MAX_EVENT_BUFFER = 5e3;
-var TOKEN_REFRESH_INTERVAL_MS = 45 * 60 * 1e3;
-var AgentConnection = class _AgentConnection {
-  socket = null;
-  config;
-  eventBuffer = [];
-  flushTimer = null;
-  tokenRefreshTimer = null;
-  lastEmittedStatus = null;
-  lastReportedStatus = null;
-  droppedEventCount = 0;
-  // Pending answer resolvers for askUserQuestion room-event fallback
-  pendingAnswerResolvers = /* @__PURE__ */ new Map();
-  // Dedup: suppress near-identical messages within a short window
-  recentMessages = [];
-  static DEDUP_WINDOW_MS = 3e4;
-  static DEDUP_SIMILARITY_THRESHOLD = 0.7;
-  static DEDUP_PREVIEW_LIMIT = 120;
-  // Early-buffering: events that arrive before callbacks are registered
-  earlyMessages = [];
-  earlyStop = false;
-  earlySoftStop = false;
-  earlyModeChanges = [];
-  // Registered callbacks
-  messageCallback = null;
-  stopCallback = null;
-  softStopCallback = null;
-  modeChangeCallback = null;
-  apiKeyUpdateCallback = null;
-  pullBranchCallback = null;
-  runStartCommandCallback = null;
-  earlyRunStartCommand = false;
-  earlyPullBranches = [];
-  spawnReviewCallback = null;
-  earlySpawnReviews = [];
-  spawnTuiCallback = null;
-  earlySpawnTuis = [];
-  probeUsageCallback = null;
-  earlyProbeUsage = false;
-  // PTY relay (S5 terminal). Single-slot callbacks, set per PtySession run.
-  ptyInputCallback = null;
-  ptyResizeCallback = null;
-  constructor(config) {
-    this.config = config;
-  }
-  get sessionId() {
-    return this.config.sessionId;
-  }
-  get connected() {
-    return this.socket?.connected ?? false;
-  }
-  // ── Typed service method call ──────────────────────────────────────────
-  // Socket.IO keeps the SAME Socket instance across transport-level
-  // reconnects (it only goes null on an explicit disconnect() teardown), so a
-  // brief flap leaves `this.socket` non-null but `.connected === false`. Rather
-  // than failing a tool call instantly (which the spawned `claude` surfaces as
-  // "Conveyor MCP disconnected" and an excuse to go idle), we wait out a short
-  // reconnect window, then emit with an ack timeout so a buffered packet whose
-  // ack never returns can't hang the call forever. We do NOT auto-retry the
-  // emit — re-sending a write could double-apply it; the agent prompt instructs
-  // the model to retry the tool, which is the safe place to decide idempotency.
-  static CALL_CONNECT_WAIT_MS = 2e4;
-  static CALL_ACK_TIMEOUT_MS = 3e4;
-  // ── Proactive socket recycle ───────────────────────────────────────────
-  // Cloud Run severs every WebSocket at its request timeout (3600s is the
-  // platform ceiling), so a socket that lives past ~60 minutes is killed at a
-  // random moment — historically mid-tool-call, which let the spawned CLI
-  // abandon its MCP session. Recycle the transport at a QUIET moment (no
-  // in-flight RPC) before the platform deadline instead: an engine-level close
-  // looks like a transport drop, so Socket.IO's auto-reconnect and the
-  // io "reconnect" → reconnectToSession() recovery path run unchanged. Jitter
-  // keeps a fleet of pods from recycling in one thundering herd.
-  static SOCKET_RECYCLE_BASE_MS = 52 * 60 * 1e3;
-  static SOCKET_RECYCLE_JITTER_MS = 4 * 60 * 1e3;
-  static SOCKET_RECYCLE_BUSY_POLL_MS = 15e3;
-  recycleTimer = null;
-  pendingCalls = 0;
-  async call(method, payload) {
-    const socket = this.socket;
-    if (!socket) {
-      throw new Error(
-        `Not connected (method: ${String(method)}, session: ${this.config.sessionId})`
-      );
-    }
-    this.pendingCalls++;
-    try {
-      if (!socket.connected) {
-        await this.waitForConnected(socket, _AgentConnection.CALL_CONNECT_WAIT_MS, String(method));
-      }
-      return await this.emitWithAck(socket, method, payload);
-    } finally {
-      this.pendingCalls--;
-    }
-  }
-  /** (Re)arm the recycle timer — called on every successful (re)connect. */
-  scheduleSocketRecycle() {
-    this.clearSocketRecycle();
-    const delay2 = _AgentConnection.SOCKET_RECYCLE_BASE_MS + Math.random() * _AgentConnection.SOCKET_RECYCLE_JITTER_MS;
-    this.armRecycleTimer(delay2);
-  }
-  clearSocketRecycle() {
-    if (this.recycleTimer) {
-      clearTimeout(this.recycleTimer);
-      this.recycleTimer = null;
-    }
-  }
-  armRecycleTimer(delay2) {
-    this.recycleTimer = setTimeout(() => {
-      this.recycleTimer = null;
-      this.attemptSocketRecycle();
-    }, delay2);
-    this.recycleTimer.unref?.();
-  }
-  attemptSocketRecycle() {
-    const socket = this.socket;
-    if (!socket?.connected) return;
-    if (this.pendingCalls > 0) {
-      this.armRecycleTimer(_AgentConnection.SOCKET_RECYCLE_BUSY_POLL_MS);
-      return;
-    }
-    process.stderr.write(
-      "[conveyor-agent] Recycling socket ahead of the platform request timeout\n"
-    );
-    socket.io.engine?.close?.();
-  }
-  /** Resolve once `socket` reports connected, or reject after `timeoutMs`. */
-  waitForConnected(socket, timeoutMs, method) {
-    return waitForConnected(socket, timeoutMs, () => {
-      return new Error(
-        `Not connected \u2014 socket did not reconnect within ${timeoutMs / 1e3}s (method: ${method}, session: ${this.config.sessionId}). Transient; retry.`
-      );
-    });
-  }
-  /** Emit an RPC and resolve on ack, rejecting if no ack arrives in time. */
-  emitWithAck(socket, method, payload) {
-    return callWithAck(
-      socket,
-      `agentSessionService:${String(method)}`,
-      payload,
-      {
-        timeoutMs: _AgentConnection.CALL_ACK_TIMEOUT_MS,
-        requireData: true,
-        makeTimeoutError: () => new Error(
-          `Service call timed out after ${_AgentConnection.CALL_ACK_TIMEOUT_MS / 1e3}s (method: ${String(method)}, session: ${this.config.sessionId}). Usually a transient reconnect; retry.`
-        ),
-        makeFailureError: (error) => new Error(error ?? `Service call failed: ${String(method)}`)
-      }
-    );
-  }
-  // ── Connection lifecycle ───────────────────────────────────────────────
-  // oxlint-disable-next-line max-lines-per-function -- socket setup requires registering many co-located event handlers
-  connect() {
-    if (!this.config.apiUrl) {
-      return Promise.reject(new Error("Cannot connect: apiUrl is empty"));
-    }
-    this.startProactiveTokenRefresh();
-    return new Promise((resolve, reject) => {
-      let settled = false;
-      let attempts = 0;
-      const maxInitialAttempts = 30;
-      process.stderr.write(
-        `[conveyor-agent] Connecting to ${this.config.apiUrl} (mode: ${this.config.runnerMode ?? "task"}, session: ${this.config.sessionId})
-`
-      );
-      this.socket = io(
-        this.config.apiUrl,
-        buildConveyorSocketOptions({
-          taskToken: this.config.taskToken,
-          runnerMode: this.config.runnerMode ?? "task"
-        })
-      );
-      this.socket.on("session:message", (msg) => {
-        const incoming = {
-          content: msg.content,
-          userId: msg.userId,
-          ...msg.source && { source: msg.source },
-          ...msg.files && { files: msg.files },
-          ...msg.delivery === "prefill" && { delivery: msg.delivery }
-        };
-        if (this.messageCallback) this.messageCallback(incoming);
-        else this.earlyMessages.push(incoming);
-      });
-      this.socket.on("session:stop", () => {
-        if (this.stopCallback) this.stopCallback();
-        else this.earlyStop = true;
-      });
-      this.socket.on("session:softStop", () => {
-        if (this.softStopCallback) this.softStopCallback();
-        else this.earlySoftStop = true;
-      });
-      this.socket.on("session:modeChange", (data) => {
-        if (this.modeChangeCallback) this.modeChangeCallback(data);
-        else this.earlyModeChanges.push(data);
-      });
-      this.socket.on(
-        "session:answerQuestion",
-        (data) => {
-          const resolver = this.pendingAnswerResolvers.get(data.requestId);
-          if (resolver) resolver(data.answers);
-        }
-      );
-      this.socket.on("agentRunner:updateApiKey", (data) => {
-        if (this.apiKeyUpdateCallback) this.apiKeyUpdateCallback(data);
-      });
-      this.socket.on("session:pullBranch", (data) => {
-        if (this.pullBranchCallback) this.pullBranchCallback(data);
-        else this.earlyPullBranches.push(data);
-      });
-      this.socket.on("session:spawnReview", (data) => {
-        if (this.spawnReviewCallback) this.spawnReviewCallback(data);
-        else this.earlySpawnReviews.push(data);
-      });
-      this.socket.on("session:spawnTui", (data) => {
-        if (this.spawnTuiCallback) this.spawnTuiCallback(data);
-        else this.earlySpawnTuis.push(data);
-      });
-      this.socket.on("session:probeUsage", () => {
-        if (this.probeUsageCallback) this.probeUsageCallback();
-        else this.earlyProbeUsage = true;
-      });
-      this.socket.on("session:runStartCommand", () => {
-        if (this.runStartCommandCallback) this.runStartCommandCallback();
-        else this.earlyRunStartCommand = true;
-      });
-      this.socket.on("pty:input", (data) => {
-        if (data.sessionId && data.sessionId !== this.config.sessionId) return;
-        this.ptyInputCallback?.(data.data);
-      });
-      this.socket.on("pty:resize", (data) => {
-        if (data.sessionId && data.sessionId !== this.config.sessionId) return;
-        this.ptyResizeCallback?.(data.cols, data.rows);
-      });
-      this.socket.on("connect", () => {
-        process.stderr.write("[conveyor-agent] Socket connected\n");
-        this.scheduleSocketRecycle();
-        if (!settled) {
-          settled = true;
-          resolve();
-        }
-      });
-      this.socket.on("connect_error", (err) => {
-        attempts++;
-        process.stderr.write(
-          `[conveyor-agent] Connection error (attempt ${attempts}/${maxInitialAttempts}): ${err.message}
-`
-        );
-        if (!settled && attempts >= maxInitialAttempts) {
-          settled = true;
-          reject(
-            new Error(
-              `Failed to connect to ${this.config.apiUrl} after ${maxInitialAttempts} attempts: ${err.message}`
-            )
-          );
-        }
-      });
-      this.socket.on("disconnect", (reason) => {
-        process.stderr.write(`[conveyor-agent] Disconnected: ${reason}
-`);
-        if (reason === "io server disconnect" || reason === "server namespace disconnect") {
-          this.scheduleReconnectAfterServerDisconnect();
-        }
-      });
-      this.socket.on("auth:rejected", () => {
-        process.stderr.write("[conveyor-agent] Auth rejected by server, refreshing taskToken\n");
-        void this.refreshTaskTokenFromBootstrap().catch(() => {
-        });
-      });
-      this.socket.io.on("reconnect", (reconnectAttempts) => {
-        process.stderr.write(
-          `[conveyor-agent] Reconnected (attempts: ${reconnectAttempts}, ${(/* @__PURE__ */ new Date()).toISOString()})
-`
-        );
-        this.sendHeartbeat();
-        void this.reconnectToSession();
-      });
-      this.socket.io.on("reconnect_attempt", () => {
-      });
-    });
-  }
-  disconnect() {
-    this.stopProactiveTokenRefresh();
-    this.clearSocketRecycle();
-    this.stopHeartbeatWorker();
-    void this.flushEvents();
-    if (this.socket) {
-      this.socket.io.reconnection(false);
-      this.socket.removeAllListeners();
-      this.socket.disconnect();
-      this.socket = null;
-    }
-  }
-  // ── Reconnect with retry ────────────────────────────────────────────
-  //
-  // Socket.IO already retries the transport forever. This higher-level helper
-  // re-issues the `connectAgent` RPC after a successful reconnect to re-join
-  // the session room and drain pending messages. We retry indefinitely with a
-  // capped exponential backoff — a stranded codespace with a missing agent is
-  // worse than a long-running reconnect loop, and a transient API outage
-  // shouldn't kill the agent process.
-  static RECONNECT_BASE_DELAY_MS = 2e3;
-  static RECONNECT_MAX_DELAY_MS = 6e4;
-  static RECONNECT_STATUS_EVERY_N = 3;
-  isReconnecting = false;
-  reconnectingAfterServerDisconnect = false;
-  /** Capped exponential backoff (2s, 4s, 8s, 16s, 32s, then 60s steady) shared
-   *  by both reconnect loops (connectAgent-RPC and server-disconnect). */
-  static backoffDelayMs(attempt) {
-    return Math.min(
-      _AgentConnection.RECONNECT_BASE_DELAY_MS * 2 ** Math.min(attempt - 1, 5),
-      _AgentConnection.RECONNECT_MAX_DELAY_MS
-    );
-  }
-  /** Sleep `ms`, unref'd so it never holds the process open on its own. */
-  static delay(ms) {
-    return new Promise((resolve) => {
-      const timer = setTimeout(resolve, ms);
-      timer.unref?.();
-    });
-  }
-  /**
-   * Invoked after every successful session reconnect (the `connectAgent` RPC
-   * re-established the session room). The runner uses this to force a TUI
-   * repaint: the reconnect may have landed on a different/restarted API
-   * process whose PTY scrollback ring is empty, and a quiet terminal would
-   * otherwise never re-seed it.
-   */
-  onReconnected;
-  async reconnectToSession() {
-    if (this.isReconnecting) return;
-    this.isReconnecting = true;
-    try {
-      let attempt = 0;
-      while (this.socket) {
-        attempt++;
-        try {
-          const { pendingMessages } = await this.call("connectAgent", {
-            sessionId: this.config.sessionId
-          });
-          this.drainPendingMessages(pendingMessages);
-          process.stderr.write(
-            `[conveyor-agent] Reconnected to session successfully (attempts: ${attempt})
-`
-          );
-          if (this.lastEmittedStatus && this.lastEmittedStatus !== this.lastReportedStatus) {
-            const status = this.lastEmittedStatus;
-            void this.call("reportAgentStatus", {
-              sessionId: this.config.sessionId,
-              status
-            }).then(() => {
-              this.lastReportedStatus = status;
-            }).catch(() => {
-            });
-          }
-          this.sendEvent({
-            type: "agent_runner_status",
-            reason: "reconnected",
-            attempts: attempt
-          });
-          try {
-            this.onReconnected?.();
-          } catch {
-          }
-          return;
-        } catch (err) {
-          const errMsg = err instanceof Error ? err.message : String(err);
-          const delayMs = _AgentConnection.backoffDelayMs(attempt);
-          process.stderr.write(
-            `[conveyor-agent] connectAgent failed (attempt ${attempt}): ${errMsg} \u2014 retrying in ${delayMs / 1e3}s
-`
-          );
-          if (this.looksLikeAuthError(errMsg)) {
-            void this.refreshTaskTokenFromBootstrap().catch(() => {
-            });
-          }
-          if (attempt % _AgentConnection.RECONNECT_STATUS_EVERY_N === 0) {
-            this.sendEvent({
-              type: "agent_runner_status",
-              reason: "reconnecting",
-              attempt
-            });
-          }
-          await _AgentConnection.delay(delayMs);
-        }
-      }
-    } finally {
-      this.isReconnecting = false;
-    }
-  }
-  /**
-   * Drive a bounded reconnect after a server-initiated disconnect. Loops until
-   * the socket reconnects or is torn down, nudging socket.connect() on each
-   * pass with a capped exponential backoff. A token refresh is attempted every
-   * pass (rate-limited to once/60s inside refreshTaskTokenFromBootstrap) but
-   * its result NEVER gates the reconnect — the socket must recover even when
-   * there is no fresh token to apply.
-   */
-  scheduleReconnectAfterServerDisconnect() {
-    if (this.reconnectingAfterServerDisconnect) return;
-    this.reconnectingAfterServerDisconnect = true;
-    void this.reconnectAfterServerDisconnect().finally(() => {
-      this.reconnectingAfterServerDisconnect = false;
-    });
-  }
-  async reconnectAfterServerDisconnect() {
-    let attempt = 0;
-    while (this.socket && !this.socket.connected) {
-      attempt++;
-      try {
-        await this.refreshTaskTokenFromBootstrap();
-      } catch {
-      }
-      const socket = this.socket;
-      if (!socket || socket.connected) return;
-      socket.connect();
-      try {
-        await this.waitForConnected(
-          socket,
-          _AgentConnection.CALL_CONNECT_WAIT_MS,
-          "server-disconnect-reconnect"
-        );
-        this.sendHeartbeat();
-        void this.reconnectToSession();
-        return;
-      } catch {
-        const delayMs = _AgentConnection.backoffDelayMs(attempt);
-        process.stderr.write(
-          `[conveyor-agent] server-disconnect reconnect attempt ${attempt} did not connect within ${_AgentConnection.CALL_CONNECT_WAIT_MS / 1e3}s \u2014 retrying in ${delayMs / 1e3}s
-`
-        );
-        await _AgentConnection.delay(delayMs);
-      }
-    }
-  }
-  looksLikeAuthError(message) {
-    return /unauthor|forbid|auth|token|session (?:not found|expired|invalid)|invalid session/i.test(
-      message
-    );
-  }
-  // ── Proactive task-token refresh ────────────────────────────────────────
-  //
-  // Socket.IO only re-presents the taskToken on a (re)connect handshake, and
-  // the server only re-validates the JWT then. So a token that expires while
-  // the socket stays connected goes unnoticed until the next RPC fails. Re-mint
-  // periodically from the bootstrap endpoint — refreshFromBootstrap() updates
-  // both this.config.taskToken and socket.auth.taskToken, so any later
-  // reconnect carries a fresh token. No-ops for project mode / missing
-  // codespace env, and is rate-limited to once/60s inside refreshFromBootstrap.
-  startProactiveTokenRefresh() {
-    if (this.tokenRefreshTimer) return;
-    this.tokenRefreshTimer = setInterval(() => {
-      void this.refreshTaskTokenFromBootstrap().catch(() => {
-      });
-    }, TOKEN_REFRESH_INTERVAL_MS);
-    this.tokenRefreshTimer.unref?.();
-  }
-  stopProactiveTokenRefresh() {
-    if (this.tokenRefreshTimer) {
-      clearInterval(this.tokenRefreshTimer);
-      this.tokenRefreshTimer = null;
-    }
-  }
-  drainPendingMessages(messages) {
-    for (const msg of messages) {
-      if (!msg.content) continue;
-      if (this.messageCallback) {
-        this.messageCallback({ content: msg.content, userId: msg.userId });
-      } else {
-        this.earlyMessages.push({ content: msg.content, userId: msg.userId });
-      }
-    }
-  }
-  // ── Callback registration with early-buffer draining ───────────────
-  onMessage(callback) {
-    this.messageCallback = callback;
-    for (const msg of this.earlyMessages) callback(msg);
-    this.earlyMessages = [];
-  }
-  onStop(callback) {
-    this.stopCallback = callback;
-    if (this.earlyStop) {
-      callback();
-      this.earlyStop = false;
-    }
-  }
-  onSoftStop(callback) {
-    this.softStopCallback = callback;
-    if (this.earlySoftStop) {
-      callback();
-      this.earlySoftStop = false;
-    }
-  }
-  onModeChange(callback) {
-    this.modeChangeCallback = callback;
-    for (const data of this.earlyModeChanges) callback(data);
-    this.earlyModeChanges = [];
-  }
-  onApiKeyUpdate(callback) {
-    this.apiKeyUpdateCallback = callback;
-  }
-  onPullBranch(callback) {
-    this.pullBranchCallback = callback;
-    for (const data of this.earlyPullBranches) callback(data);
-    this.earlyPullBranches = [];
-  }
-  onSpawnReview(callback) {
-    this.spawnReviewCallback = callback;
-    for (const data of this.earlySpawnReviews) callback(data);
-    this.earlySpawnReviews = [];
-  }
-  /**
-   * Report that a same-pod review child failed to spawn (fire-and-forget).
-   * The server Ends the orphaned review session and falls back to a dedicated
-   * review pod. sessionId is OUR (builder) session — the task-identity guard runs on
-   * it; the review session is identified separately.
-   */
-  reportReviewSpawnFailure(reviewSessionId, error) {
-    if (!this.socket) return;
-    void this.call("reportReviewSpawnFailure", {
-      sessionId: this.config.sessionId,
-      reviewSessionId,
-      ...error ? { error: error.slice(0, 2e3) } : {}
-    }).catch(() => {
-    });
-  }
-  /**
-   * Report that this pod's git credential is dead and refreshing did not fix
-   * it (fire-and-forget).
-   *
-   * Purely diagnostic. Until this existed a pod could lose git entirely and
-   * leave no server-side trace at all — the refresh RPC succeeded every time,
-   * so the failure was visible only in pod stderr, which is why it took two
-   * investigations to attribute. `tokenShape` describes the served credential
-   * (length, prefix class, mtime) and NEVER carries its value.
-   */
-  reportCredentialFailure(details) {
-    if (!this.socket) return;
-    void this.call("reportCredentialFailure", {
-      sessionId: this.config.sessionId,
-      ...details.error ? { error: details.error.slice(0, 2e3) } : {},
-      ...details.tokenShape ? { tokenShape: details.tokenShape.slice(0, 500) } : {},
-      ...details.healed === void 0 ? {} : { healed: details.healed }
-    }).catch(() => {
-    });
-  }
-  /**
-   * Ask the server to destroy and recreate this pod (fire-and-forget). The
-   * agent calls this only when it has proven it cannot recover in place — the
-   * shared `~/.claude` GCS FUSE mount is dead and no in-container action can
-   * remount it. The server rate-limits the recycle and posts `reason` to the
-   * card; old servers that don't know the method reject harmlessly, leaving
-   * today's behavior (a failed turn with a chat warning).
-   */
-  requestWorkspaceRecycle(reason) {
-    if (!this.socket) return;
-    void this.call("requestWorkspaceRecycle", {
-      sessionId: this.config.sessionId,
-      reason: reason.slice(0, 2e3)
-    }).catch(() => {
-    });
-  }
-  onSpawnTui(callback) {
-    this.spawnTuiCallback = callback;
-    for (const data of this.earlySpawnTuis) callback(data);
-    this.earlySpawnTuis = [];
-  }
-  /** Register the on-demand usage-refresh handler; drains an early-buffered
-   *  `session:probeUsage` that arrived before the runner was ready. */
-  onProbeUsage(callback) {
-    this.probeUsageCallback = callback;
-    if (this.earlyProbeUsage) {
-      this.earlyProbeUsage = false;
-      callback();
-    }
-  }
-  /**
-   * Report that a same-pod TUI/shell child failed to spawn (fire-and-forget).
-   * The server Ends the orphaned session — no fallback pod (unlike review).
-   * sessionId is OUR (builder) session — the task-identity guard runs on it.
-   */
-  reportSessionSpawnFailure(spawnedSessionId, error) {
-    if (!this.socket) return;
-    void this.call("reportSessionSpawnFailure", {
-      sessionId: this.config.sessionId,
-      spawnedSessionId,
-      ...error ? { error: error.slice(0, 2e3) } : {}
-    }).catch(() => {
-    });
-  }
-  /** Register the restart handler, draining a `session:runStartCommand` that
-   *  arrived before the supervisor was ready. Collapsed to one drain: two
-   *  clicks during boot should produce one restart, not two competing ones. */
-  onRunStartCommand(callback) {
-    this.runStartCommandCallback = callback;
-    if (this.earlyRunStartCommand) {
-      this.earlyRunStartCommand = false;
-      callback();
-    }
-  }
-  // ── PTY relay (S5 Connected-TUI terminal) ──────────────────────────
-  /**
-   * Forward a raw chunk of terminal output to the S2 relay (fire-and-forget).
-   * The first chunk creates the server-side scrollback ring, which is what
-   * surfaces the terminal in the UI. `dims` seed/refresh the ring geometry.
-   */
-  sendPtyOutput(data, dims) {
-    if (!this.socket) return;
-    void this.call("ptyOutput", {
-      sessionId: this.config.sessionId,
-      data,
-      ...dims ? { cols: dims.cols, rows: dims.rows } : {}
-    }).catch(() => {
-    });
-  }
-  /**
-   * Forward one compact chat-proxy event derived from the transcript JSONL to
-   * the relay (fire-and-forget). Feeds the experimental chat PTY proxy ring.
-   * Old servers that don't know the method reject harmlessly.
-   */
-  sendPtyChatEvent(event) {
-    if (!this.socket) return;
-    void this.call("ptyChatEvent", {
-      sessionId: this.config.sessionId,
-      event
-    }).catch(() => {
-    });
-  }
-  /**
-   * Report that the interactive CLI process for this session has died and no
-   * respawn is imminent (fire-and-forget). The server clears the scrollback
-   * ring and broadcasts pty:ended so clients hide the Connected-TUI tab. Old
-   * servers that don't know the method reject harmlessly.
-   */
-  sendPtyEnded() {
-    if (!this.socket) return;
-    void this.call("ptyEnded", { sessionId: this.config.sessionId }).catch(() => {
-    });
-  }
-  /**
-   * Report the port this pod's in-pod PTY stream server bound to, or null when
-   * it stopped (fire-and-forget). The server persists it so a viewer can be
-   * handed a port-scoped tunnel URL and stream the TUI straight from the pod.
-   * Old servers that don't know the method reject harmlessly — the session then
-   * just stays on the relay transport.
-   */
-  reportPtyStream(port) {
-    if (!this.socket) return;
-    void this.call("reportPtyStream", {
-      sessionId: this.config.sessionId,
-      port
-    }).catch(() => {
-    });
-  }
-  /** Subscribe to relayed keystrokes. Returns an unsubscribe fn. */
-  onPtyInput(handler) {
-    this.ptyInputCallback = handler;
-    return () => {
-      if (this.ptyInputCallback === handler) this.ptyInputCallback = null;
-    };
-  }
-  /** Subscribe to relayed (reconciled) terminal resizes. Returns an unsubscribe fn. */
-  onPtyResize(handler) {
-    this.ptyResizeCallback = handler;
-    return () => {
-      if (this.ptyResizeCallback === handler) this.ptyResizeCallback = null;
-    };
-  }
-  // ── Convenience methods (thin wrappers around call / emit) ─────────
-  async emitStatus(status, reason, questionText) {
-    this.lastEmittedStatus = status;
-    await this.flushEvents();
-    const payload = {
-      sessionId: this.config.sessionId,
-      status,
-      ...reason ? { reason } : {},
-      // Only sent with a pending TUI questionnaire (reason "user_question") so
-      // the server can surface the real question text in the notification.
-      ...questionText ? { questionText } : {}
-    };
-    const AWAIT_STATUSES = ["idle", "waiting_for_input", "connected"];
-    if (AWAIT_STATUSES.includes(status)) {
-      try {
-        await this.call("reportAgentStatus", payload);
-        this.lastReportedStatus = status;
-      } catch {
-      }
-    } else {
-      void this.call("reportAgentStatus", payload).then(() => {
-        this.lastReportedStatus = status;
-      }).catch(() => {
-      });
-    }
-  }
-  postChatMessage(content, milestone) {
-    if (!this.socket) return;
-    if (this.suppressIfDuplicate(content)) return;
-    void this.call("postAgentMessage", {
-      sessionId: this.config.sessionId,
-      content,
-      milestone
-    }).catch(() => {
-    });
-  }
-  // Awaitable variant of postChatMessage for callers that need to guarantee
-  // the message is acknowledged by the server before proceeding (e.g. before
-  // aborting the session). Dedup still applies; a suppressed message resolves
-  // immediately without hitting the wire.
-  async postChatMessageAwait(content, milestone) {
-    if (!this.socket) return;
-    if (this.suppressIfDuplicate(content)) return;
-    try {
-      await this.call("postAgentMessage", {
-        sessionId: this.config.sessionId,
-        content,
-        milestone
-      });
-    } catch (err) {
-      process.stderr.write(
-        `[conveyor-agent] postChatMessageAwait failed: ${err instanceof Error ? err.message : String(err)}
-`
-      );
-    }
-  }
-  suppressIfDuplicate(content) {
-    const d = this.checkAndTrackDuplicate(content);
-    if (!d.duplicate) return false;
-    process.stderr.write(
-      `[dedup] Suppressed near-duplicate (matched: "${d.matchedMessagePreview}")
-`
-    );
-    return true;
-  }
-  // Exposed so `post_to_chat` can surface suppression back to the agent.
-  checkAndTrackDuplicate(content) {
-    const now = Date.now();
-    this.recentMessages = this.recentMessages.filter(
-      (m) => now - m.timestamp < _AgentConnection.DEDUP_WINDOW_MS
-    );
-    const words = new Set(
-      content.toLowerCase().replace(/[^\w\s]/g, "").split(/\s+/).filter((w) => w.length >= 3)
-    );
-    if (words.size === 0) return { duplicate: false };
-    for (const recent of this.recentMessages) {
-      let intersection = 0;
-      for (const w of words) if (recent.words.has(w)) intersection++;
-      const union = (/* @__PURE__ */ new Set([...words, ...recent.words])).size;
-      if (union > 0 && intersection / union > _AgentConnection.DEDUP_SIMILARITY_THRESHOLD) {
-        return { duplicate: true, matchedMessagePreview: recent.preview };
-      }
-    }
-    const max = _AgentConnection.DEDUP_PREVIEW_LIMIT;
-    const preview = content.length > max ? content.slice(0, max) + "\u2026" : content;
-    this.recentMessages.push({ words, timestamp: now, preview });
-    if (this.recentMessages.length > 3) this.recentMessages.shift();
-    return { duplicate: false };
-  }
-  /**
-   * @param loopStatus overrides the status derived from the last emitted
-   *   runner status. SessionRunner passes it so an idle runner that still has
-   *   background work outstanding in the pod beats as `waiting` (→ `active` on
-   *   the wire) rather than `idle`, which would let the workspace activity
-   *   clock expire mid-gate. See connection/loop-lag.ts `heartbeatStatusFor`.
-   *
-   * Without an override the status comes from `loopStatusForRunnerStatus`, the
-   * same total classifier SessionRunner uses, so both paths agree. This used to
-   * be a partial map covering 5 of the 11 `AgentRunnerStatus` values with a
-   * `?? "active"` fallback, which meant a parked runner (`waiting_for_input`,
-   * `finished`, `error`, `stopping`, `disconnected`) beat as ACTIVE on every
-   * no-arg call site — the reconnect paths below, and the shell/project/adhoc
-   * runners, which never pass a loop status at all. That renewed the workspace
-   * activity clock for an agent doing nothing, so the card stayed "active" and
-   * its pod stayed up long past the project's inactivity window.
-   */
-  sendHeartbeat(loopLagMs, loopStatus) {
-    if (!this.socket) return;
-    const heartbeatStatus = heartbeatStatusFor(
-      loopStatus ?? loopStatusForRunnerStatus(this.lastEmittedStatus)
-    );
-    void this.call("heartbeat", {
-      sessionId: this.config.sessionId,
-      timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-      status: heartbeatStatus,
-      ...loopLagMs !== void 0 && loopLagMs > 0 ? { loopLagMs: Math.round(loopLagMs) } : {}
-    }).catch(() => {
-    });
-  }
-  // ── Starvation-proof heartbeat worker ────────────────────────────────
-  //
-  // A worker thread with its own event loop + Socket.IO connection keeps the
-  // v3 session lease renewed even when the MAIN loop is stalled (the failure
-  // mode where a heavy gate got the session declared stranded and restarted
-  // mid-run). Best-effort by design: any spawn/runtime failure just degrades
-  // heartbeats to main-loop-only. See heartbeat-worker.ts for the policy.
-  heartbeatWorker = null;
-  startHeartbeatWorker(sharedBuffer, intervalMs = 3e4) {
-    if (this.heartbeatWorker) return;
-    try {
-      const workerUrl = new URL("./heartbeat-worker.js", import.meta.url);
-      if (!existsSync(fileURLToPath(workerUrl))) {
-        process.stderr.write(
-          "[conveyor-agent] heartbeat worker bundle not found \u2014 main-loop heartbeat only\n"
-        );
-        return;
-      }
-      const worker = new Worker(workerUrl, {
-        workerData: {
-          apiUrl: this.config.apiUrl,
-          taskToken: this.config.taskToken,
-          sessionId: this.config.sessionId,
-          runnerMode: this.config.runnerMode ?? "task",
-          sharedBuffer,
-          intervalMs
-        }
-      });
-      worker.unref();
-      worker.on("error", (err) => {
-        const message = err instanceof Error ? err.message : String(err);
-        process.stderr.write(`[conveyor-agent] heartbeat worker error: ${message}
-`);
-        this.heartbeatWorker = null;
-      });
-      worker.on("exit", (code) => {
-        if (code !== 0) {
-          process.stderr.write(`[conveyor-agent] heartbeat worker exited (code ${code})
-`);
-        }
-        this.heartbeatWorker = null;
-      });
-      this.heartbeatWorker = worker;
-      process.stderr.write("[conveyor-agent] heartbeat worker started\n");
-    } catch (err) {
-      process.stderr.write(
-        `[conveyor-agent] heartbeat worker failed to start: ${err instanceof Error ? err.message : String(err)}
-`
-      );
-      this.heartbeatWorker = null;
-    }
-  }
-  stopHeartbeatWorker() {
-    const worker = this.heartbeatWorker;
-    this.heartbeatWorker = null;
-    if (worker) void worker.terminate();
-  }
-  emitModeChanged(agentMode) {
-    this.sendEvent({ type: "mode_changed", agentMode });
-  }
-  async updateTaskFields(fields) {
-    if (!this.socket) return { ok: false, error: "socket not connected" };
-    try {
-      await this.call("updateTaskFields", { sessionId: this.config.sessionId, ...fields });
-      return { ok: true };
-    } catch (err) {
-      return { ok: false, error: err instanceof Error ? err.message : String(err) };
-    }
-  }
-  storeSessionId(sdkSessionId) {
-    void this.call("storeSessionId", { sessionId: this.config.sessionId, sdkSessionId }).catch(
-      () => {
-      }
-    );
-  }
-  /** Report the full current set of runtime-discovered listening ports.
-   *  Throws on failure so the PortDiscovery poller can retry on its next
-   *  tick (a swallowed error here would silently drop the delta). */
-  async reportDiscoveredPorts(ports) {
-    await this.call("reportDiscoveredPorts", { sessionId: this.config.sessionId, ports });
-  }
-  /** Boot-milestone report over the socket — the codespace-parity fallback
-   *  for the GKE pod bootstrap-token route. Fire-and-forget: a failed report
-   *  must never delay or fail the boot path. */
-  reportBootMilestone(key) {
-    void this.call("reportBootMilestone", { sessionId: this.config.sessionId, key }).catch(
-      () => {
-      }
-    );
-  }
-  // ── Typing indicators ───────────────────────────────────────────────
-  sendTypingStart() {
-    this.sendEvent({ type: "agent_typing_start" });
-  }
-  sendTypingStop() {
-    this.sendEvent({ type: "agent_typing_stop" });
-  }
-  // ── RPC convenience wrappers (v6 compat, will migrate to call()) ───
-  emitRateLimitPause(resetsAt) {
-    this.sendEvent({ type: "rate_limit_update", resetsAt });
-  }
-  updateStatus(status) {
-    this.emitStatus(status);
-  }
-  /**
-   * The session's key hit a hard usage cap — ask the server to stamp it
-   * limited and hand back the best remaining key's credential env (or a
-   * requeue confirmation when none is left). Awaited: the caller swaps
-   * credentials and resumes on success, so it needs the real response.
-   */
-  async cycleCodingAgentKey(rateLimitType, resetsAt) {
-    return await this.call("cycleCodingAgentKey", {
-      sessionId: this.config.sessionId,
-      rateLimitType,
-      ...resetsAt ? { resetsAt } : {}
-    });
-  }
-  // ── Question handling ──────────────────────────────────────────────
-  async askUserQuestion(questions) {
-    const questionText = questions.map(
-      (q) => `**${q.header}**
-${q.question}${q.options.length ? "\n" + q.options.map((o) => `- ${o.label}: ${o.description}`).join("\n") : ""}`
-    ).join("\n\n");
-    const requestId = crypto.randomUUID();
-    const roomEventPromise = new Promise((resolve) => {
-      this.pendingAnswerResolvers.set(requestId, resolve);
-    });
-    const rpcPromise = this.call("askUserQuestion", {
-      sessionId: this.config.sessionId,
-      question: questionText,
-      requestId,
-      questions
-    }).then((res) => res.answers);
-    try {
-      return await Promise.race([rpcPromise, roomEventPromise]);
-    } finally {
-      this.pendingAnswerResolvers.delete(requestId);
-    }
-  }
-  // ── Typed service method wrappers ───────────────────────────────────
-  getTaskProperties() {
-    return this.call("getTaskProperties", { sessionId: this.config.sessionId });
-  }
-  triggerIdentification() {
-    return this.call("triggerIdentification", { sessionId: this.config.sessionId });
-  }
-  handoffToImplementer(payload) {
-    return this.call("handoffToImplementer", {
-      sessionId: this.config.sessionId,
-      ...payload
-    });
-  }
-  async refreshAuthToken() {
-    const result = await this.refreshFromBootstrap();
-    return result.refreshedClaude;
-  }
-  /**
-   * Refresh the in-process `CONVEYOR_TASK_TOKEN` from the bootstrap endpoint.
-   * Returns true if a new token was applied. Rate-limited locally to once per
-   * 60s so a tight auth-rejected loop can't hammer the bootstrap endpoint —
-   * the server enforces the same window via `lastBootstrapAt`.
-   */
-  lastTaskTokenRefreshAt = 0;
-  async refreshTaskTokenFromBootstrap() {
-    const result = await this.refreshFromBootstrap();
-    return result.refreshedTaskToken;
-  }
-  refreshFromBootstrap() {
-    const none = Promise.resolve({ refreshedClaude: false, refreshedTaskToken: false });
-    const podBootstrapToken = process.env.POD_BOOTSTRAP_TOKEN;
-    const codespaceName = process.env.CODESPACE_NAME;
-    const apiUrl = this.config.apiUrl;
-    if (!apiUrl || !podBootstrapToken && !codespaceName) {
-      return none;
-    }
-    const now = Date.now();
-    if (now - this.lastTaskTokenRefreshAt < 6e4) {
-      return none;
-    }
-    this.lastTaskTokenRefreshAt = now;
-    if (podBootstrapToken) {
-      return this.refreshFromV3Bootstrap(apiUrl, podBootstrapToken);
-    }
-    if (!codespaceName) return none;
-    return this.refreshFromCodespaceBootstrap(apiUrl, codespaceName);
-  }
-  /** Legacy GitHub Codespaces refresh path — keys on instance name. */
-  async refreshFromCodespaceBootstrap(apiUrl, codespaceName) {
-    const bootstrapToken = process.env.CONVEYOR_BOOTSTRAP_TOKEN;
-    const result = await fetchBootstrap({
-      apiUrl,
-      instanceName: codespaceName,
-      bootstrapToken
-      // Do not retry on http errors during a runtime refresh — a 401/403
-      // means the token is consumed / session terminal and retrying won't
-      // help. Network/timeout still retry inside fetchBootstrap.
-    });
-    if (!result.ok) {
-      logger.warn("bootstrap refresh abandoned \u2014 pod credentials will go stale", {
-        path: "codespace",
-        reason: result.reason,
-        status: result.status,
-        attempts: result.attempts,
-        detail: result.detail
-      });
-      return { refreshedClaude: false, refreshedTaskToken: false };
-    }
-    const previousTaskToken = process.env.CONVEYOR_TASK_TOKEN;
-    applyBootstrapToEnv(result.config);
-    const env = result.config.envVars ?? {};
-    syncBundleGithubToken(env.CONVEYOR_GITHUB_TOKEN ?? env.GH_TOKEN ?? env.GITHUB_TOKEN);
-    const refreshedTaskToken = result.config.mode !== "project" && Boolean(result.config.taskToken) && result.config.taskToken !== previousTaskToken;
-    if (refreshedTaskToken && result.config.taskToken) {
-      this.config.taskToken = result.config.taskToken;
-      if (this.socket) {
-        const auth = this.socket.auth;
-        if (auth && typeof auth === "object") {
-          auth.taskToken = result.config.taskToken;
-        }
-      }
-      this.heartbeatWorker?.postMessage({ taskToken: result.config.taskToken });
-    }
-    const refreshedClaude = Boolean(result.config.envVars?.CLAUDE_CODE_OAUTH_TOKEN);
-    return { refreshedClaude, refreshedTaskToken };
-  }
-  /**
-   * v3 refresh: re-fetch the full bootstrap bundle from the pod's bound v3
-   * route and swap the credentials in place. The GitHub installation token
-   * dies at ~1h and the sessionJwt at 24h; re-polling the bootstrap GET with
-   * the same pod token is the designed refresh mechanism.
-   */
-  async refreshFromV3Bootstrap(apiUrl, bootstrapToken) {
-    const bundle = await this.pollBundleWithRateLimitRetry(apiUrl, bootstrapToken);
-    if (!bundle) {
-      return { refreshedClaude: false, refreshedTaskToken: false };
-    }
-    const previousTaskToken = process.env.CONVEYOR_TASK_TOKEN;
-    for (const [key, value] of Object.entries(bundle.envVars ?? {})) {
-      process.env[key] = value;
-    }
-    if (bundle.githubToken) {
-      process.env.CONVEYOR_GITHUB_TOKEN = bundle.githubToken;
-      this.applyBundleCredentialFiles(bundle, previousTaskToken);
-    }
-    if (bundle.anthropicKey) process.env.ANTHROPIC_API_KEY = bundle.anthropicKey;
-    if (bundle.gcpToken) process.env.CLOUDSDK_AUTH_ACCESS_TOKEN = bundle.gcpToken;
-    const refreshedTaskToken = Boolean(bundle.sessionJwt) && bundle.sessionJwt !== previousTaskToken;
-    if (refreshedTaskToken) {
-      process.env.CONVEYOR_TASK_TOKEN = bundle.sessionJwt;
-      this.config.taskToken = bundle.sessionJwt;
-      if (this.socket) {
-        const auth = this.socket.auth;
-        if (auth && typeof auth === "object") {
-          auth.taskToken = bundle.sessionJwt;
-        }
-      }
-      this.heartbeatWorker?.postMessage({ taskToken: bundle.sessionJwt });
-    }
-    const refreshedClaude = Boolean(bundle.envVars?.CLAUDE_CODE_OAUTH_TOKEN);
-    return { refreshedClaude, refreshedTaskToken };
-  }
-  /**
-   * Write the bundle's GitHub token to the shared credential files — unless the
-   * bundle belongs to another session.
-   *
-   * The bootstrap GET is keyed by the POD, so on a pod also hosting a same-pod
-   * review it can resolve to the reader session, whose token is read-only.
-   * Writing that over the shared files silently downgrades the builder's push
-   * credential. Our own taskToken carries the same claims, so it is what we
-   * compare against.
-   *
-   * The legitimate case this path exists for — our own session's bundle
-   * refreshing the token when the RPC is failing — is unaffected.
-   */
-  applyBundleCredentialFiles(bundle, previousTaskToken) {
-    const self = readBundleIdentity(previousTaskToken);
-    const result = applyBundleGithubToken(bundle, {
-      sessionId: this.config.sessionId || self.sessionId,
-      ...self.role ? { role: self.role } : {}
-    });
-    if (!result.written && result.reason) {
-      process.stderr.write(
-        `[conveyor-agent] Skipped writing GitHub credential files from the bootstrap bundle: ${result.reason}
-`
-      );
-    }
-  }
-  /**
-   * Poll the bootstrap bundle once (maxWaitMs 0), retrying only on a transient
-   * 429 (standby-pool pods share one Cloud NAT IP against podBootstrapLimiter)
-   * with a short backoff. Returns null when the refresh should be abandoned —
-   * a non-429 error, or 429s past the retry budget — so the caller no-ops
-   * instead of parking a RUNNING pod in a poll loop.
-   */
-  async pollBundleWithRateLimitRetry(apiUrl, bootstrapToken) {
-    const retryDelaysMs = [1e3, 3e3];
-    for (let attempt = 0; ; attempt++) {
-      try {
-        return await pollUntilBound({ apiUrl, bootstrapToken, maxWaitMs: 0 });
-      } catch (err) {
-        const isRateLimited = err instanceof PollUntilBoundHttpError && err.status === 429;
-        if (!isRateLimited || attempt >= retryDelaysMs.length) {
-          logger.warn("bootstrap refresh abandoned \u2014 pod credentials will go stale", {
-            path: "v3",
-            attempt,
-            rateLimited: isRateLimited,
-            error: err instanceof Error ? err.message : String(err)
-          });
-          return null;
-        }
-        await new Promise((resolve) => {
-          setTimeout(resolve, retryDelaysMs[attempt]);
-        });
-      }
-    }
-  }
-  // ── Event buffering ────────────────────────────────────────────────
-  sendEvent(event) {
-    if (!this.socket) return;
-    this.enqueueEvents([{ event }], false);
-  }
-  /** Append (or, on `toFront`, prepend for a failed-flush re-queue) events to
-   *  the buffer, then cap + arm the flush timer. Single owner of the overflow
-   *  policy so append and re-queue can't diverge on the drop accounting. */
-  enqueueEvents(entries, toFront) {
-    if (toFront) this.eventBuffer.unshift(...entries);
-    else this.eventBuffer.push(...entries);
-    while (this.eventBuffer.length > MAX_EVENT_BUFFER) {
-      this.eventBuffer.shift();
-      this.droppedEventCount++;
-      if (this.droppedEventCount === 1 || this.droppedEventCount % 500 === 0) {
-        process.stderr.write(
-          `[conveyor-agent] eventBuffer overflow \u2014 dropped ${this.droppedEventCount} event(s) (cap: ${MAX_EVENT_BUFFER})
-`
-        );
-      }
-    }
-    if (this.socket && !this.flushTimer) {
-      this.flushTimer = setTimeout(() => void this.flushEvents(), EVENT_BATCH_MS);
-    }
-  }
-  async flushEvents() {
-    if (this.flushTimer) {
-      clearTimeout(this.flushTimer);
-      this.flushTimer = null;
-    }
-    if (!this.socket || this.eventBuffer.length === 0) return;
-    const entries = this.eventBuffer;
-    this.eventBuffer = [];
-    const events = entries.map((entry) => entry.event);
-    try {
-      await this.call("emitAgentEvent", { sessionId: this.config.sessionId, events });
-    } catch {
-      this.requeueFailedEvents(entries);
-    }
-  }
-  /** Put a failed flush's events back at the FRONT of the buffer, preserving
-   *  order, via the shared cap-and-arm path. */
-  requeueFailedEvents(entries) {
-    this.enqueueEvents(entries, true);
-  }
-};
-
-// src/connection/auth-errors.ts
-function isPermissionDeniedError(err) {
-  const message = err instanceof Error ? err.message : String(err);
-  return /insufficient permissions|authentication required/i.test(message);
-}
-
-// src/runner/git-run.ts
-import { execFile } from "child_process";
-import { promisify } from "util";
-var execFileAsync = promisify(execFile);
-var GIT_TIMEOUT_MS = 6e4;
-var GIT_SLOW_TIMEOUT_MS = 12e4;
-var GIT_MAX_BUFFER = 16 * 1024 * 1024;
-async function git(cwd, args, timeoutMs = GIT_TIMEOUT_MS) {
-  if (workbenchEnabled()) {
-    try {
-      const { stdout: stdout2 } = await getWorkbenchClient().execFile("git", args, {
-        cwd,
-        timeout: timeoutMs,
-        maxBuffer: GIT_MAX_BUFFER
-      });
-      return stdout2.trim();
-    } catch (err) {
-      if (err instanceof Error && err.message.startsWith("Command timed out:")) {
-        err.killed = true;
-      }
-      throw err;
-    }
-  }
-  const { stdout } = await execFileAsync("git", args, {
-    cwd,
-    timeout: timeoutMs,
-    maxBuffer: GIT_MAX_BUFFER
-  });
-  return stdout.toString().trim();
-}
-
-// src/runner/git-credential-ops.ts
-function credentialErrorText(err) {
-  const raw = err instanceof Error ? err.message : String(err);
-  return raw.replace(/\/\/[^@\s]+@/g, "//***@");
-}
-async function updateRemoteCredential(cwd, credential) {
-  const result = { ok: false, storeWritten: false, helperConfigured: false };
-  try {
-    const currentUrl = await git(cwd, ["remote", "get-url", "origin"]);
-    const cloneUrl = credential.cloneUrl ?? currentUrl;
-    const normalizedUrl = writeGitCredential(cwd, cloneUrl, credential);
-    result.storeWritten = true;
-    if (currentUrl !== normalizedUrl) {
-      await git(cwd, ["remote", "set-url", "origin", normalizedUrl]);
-    }
-    await git(cwd, ["config", "--local", "credential.helper", gitCredentialHelper(cwd)]);
-    result.helperConfigured = true;
-    result.ok = true;
-  } catch (err) {
-    result.error = credentialErrorText(err);
-  }
-  return result;
-}
-async function updateRemoteToken(cwd, token) {
-  const username = process.env.CONVEYOR_GIT_USERNAME || "x-access-token";
-  const cloneUrl = process.env.CONVEYOR_GIT_CLONE_URL || void 0;
-  const credential = await updateRemoteCredential(cwd, { username, secret: token, cloneUrl });
-  process.env.CONVEYOR_GIT_SECRET = token;
-  const files = syncGithubTokenFiles(token);
-  return { credential, files };
-}
-async function verifyGitCredential(cwd) {
-  try {
-    await git(cwd, ["ls-remote", "--heads", "origin"], 3e4);
-    return { ok: true, outcome: "ok" };
-  } catch (err) {
-    const killed = err.killed === true;
-    return {
-      ok: false,
-      outcome: killed ? "timeout" : "denied",
-      error: credentialErrorText(err)
-    };
-  }
-}
-
-// src/runner/git-utils.ts
-import { realpathSync } from "fs";
-
-// src/runner/force-fresh-cooldown.ts
-var FORCE_FRESH_COOLDOWN_MS = 30 * 60 * 1e3;
-var blockedUntil = 0;
-function forceFreshCooldownRemainingMs() {
-  return Math.max(0, blockedUntil - Date.now());
-}
-function forceFreshMintBlocked() {
-  return forceFreshCooldownRemainingMs() > 0;
-}
-function recordForceFreshFailure() {
-  blockedUntil = Date.now() + FORCE_FRESH_COOLDOWN_MS;
-}
-function clearForceFreshCooldown() {
-  blockedUntil = 0;
-}
-function forceFreshCooldownNotice() {
-  const minutes = Math.ceil(forceFreshCooldownRemainingMs() / 6e4);
-  return `- the force-fresh retry was SKIPPED: one already failed against this pod, so it is on a ${Math.round(FORCE_FRESH_COOLDOWN_MS / 6e4)}-minute cooldown (${minutes} min left). Re-minting cannot fix a credential the pod cannot serve.`;
-}
-
-// src/runner/git-utils.ts
-async function ensureOnTaskBranch(cwd, taskBranch, baseBranch) {
-  if (!taskBranch) return true;
-  try {
-    if (await getCurrentBranch(cwd) === taskBranch) return true;
-    let existsOnOrigin = true;
-    try {
-      await git(cwd, [
-        "fetch",
-        "origin",
-        `+refs/heads/${taskBranch}:refs/remotes/origin/${taskBranch}`
-      ]);
-    } catch (err) {
-      if (String(err).includes("couldn't find remote ref")) existsOnOrigin = false;
-      else throw err;
-    }
-    if (existsOnOrigin) {
-      await git(cwd, ["checkout", "-B", taskBranch, `origin/${taskBranch}`], 3e4);
-      process.stderr.write(`[conveyor-agent] Checked out task branch ${taskBranch}
-`);
-      return true;
-    }
-    if (!baseBranch) {
-      process.stderr.write(
-        `[conveyor-agent] Warning: task branch ${taskBranch} missing on origin and no base branch given
-`
-      );
-      return false;
-    }
-    await git(cwd, [
-      "fetch",
-      "origin",
-      `+refs/heads/${baseBranch}:refs/remotes/origin/${baseBranch}`
-    ]);
-    await git(cwd, ["checkout", "-B", taskBranch, `origin/${baseBranch}`], 3e4);
-    await git(cwd, ["push", "-u", "origin", taskBranch], 3e4);
-    process.stderr.write(
-      `[conveyor-agent] Created task branch ${taskBranch} from origin/${baseBranch} and pushed
-`
-    );
-    return true;
-  } catch {
-    process.stderr.write(`[conveyor-agent] Warning: ensureOnTaskBranch(${taskBranch}) failed
-`);
-    return false;
-  }
-}
-async function hasUncommittedChanges(cwd) {
-  const status = await git(cwd, ["status", "--porcelain"], GIT_SLOW_TIMEOUT_MS);
-  return status.length > 0;
-}
-async function getCurrentBranch(cwd) {
-  try {
-    const branch = await git(cwd, ["branch", "--show-current"]);
-    return branch || null;
-  } catch {
-    return null;
-  }
-}
-async function hasUnpushedCommits(cwd) {
-  try {
-    const currentBranch = await getCurrentBranch(cwd);
-    if (!currentBranch) return false;
-    try {
-      await git(cwd, ["rev-parse", `origin/${currentBranch}`]);
-    } catch {
-      try {
-        await git(cwd, ["rev-parse", "HEAD"]);
-        return true;
-      } catch {
-        return false;
-      }
-    }
-    const ahead = await git(cwd, [
-      "rev-list",
-      "--count",
-      "HEAD",
-      "--not",
-      `origin/${currentBranch}`
-    ]);
-    return parseInt(ahead, 10) > 0;
-  } catch {
-    return false;
-  }
-}
-async function remoteMatchesLocalHead(cwd, branch) {
-  try {
-    const [remote, local] = await Promise.all([
-      git(cwd, ["ls-remote", "origin", `refs/heads/${branch}`], GIT_SLOW_TIMEOUT_MS),
-      git(cwd, ["rev-parse", "HEAD"])
-    ]);
-    const remoteSha = remote.split(/\s+/)[0] ?? "";
-    return /^[0-9a-f]{40}$/i.test(remoteSha) && remoteSha === local.trim();
-  } catch {
-    return false;
-  }
-}
-async function stageAndCommit(cwd, message) {
-  try {
-    await git(cwd, ["add", "-A"], GIT_SLOW_TIMEOUT_MS);
-    if (!await hasUncommittedChanges(cwd)) return null;
-    await git(cwd, ["commit", "-m", message], GIT_SLOW_TIMEOUT_MS);
-    return await git(cwd, ["rev-parse", "HEAD"]);
-  } catch {
-    return null;
-  }
-}
-function errLooksLikeAuth(err) {
-  if (err.killed) return true;
-  const stderr = err.stderr?.toString() ?? "";
-  const stdout = err.stdout?.toString() ?? "";
-  const msg = stderr || stdout || (err instanceof Error ? err.message : "");
-  return /authentication|authorization|403|401|token/i.test(msg);
-}
-async function tryPush(cwd, branch, skipVerify = false) {
-  const noVerify = skipVerify ? ["--no-verify"] : [];
-  try {
-    await git(cwd, ["push", ...noVerify, "origin", branch], 3e4);
-    return true;
-  } catch (err) {
-    if (errLooksLikeAuth(err)) return false;
-    process.stderr.write(
-      `[conveyor-agent] Plain push of ${branch} failed \u2014 retrying with --force-with-lease
-`
-    );
-    try {
-      await git(cwd, ["push", ...noVerify, "--force-with-lease", "origin", branch], 3e4);
-      return true;
-    } catch {
-      return false;
-    }
-  }
-}
-async function isAuthError(cwd) {
-  try {
-    await git(cwd, ["push", "--dry-run"], 3e4);
-    return false;
-  } catch (err) {
-    return errLooksLikeAuth(err);
-  }
-}
-function wipRefForBranch(branch) {
-  return `conveyor-wip/${branch}`;
-}
-var wipRefPushed = /* @__PURE__ */ new Set();
-var wipRefPreserved = /* @__PURE__ */ new Set();
-async function createWipSnapshot(cwd, message) {
-  let savedIndexTree;
-  try {
-    savedIndexTree = await git(cwd, ["write-tree"], GIT_SLOW_TIMEOUT_MS);
-  } catch {
-    return null;
-  }
-  try {
-    await git(cwd, ["add", "-A"], GIT_SLOW_TIMEOUT_MS);
-    const sha = await git(cwd, ["stash", "create", message], GIT_SLOW_TIMEOUT_MS);
-    return sha || null;
-  } catch {
-    return null;
-  } finally {
-    try {
-      await git(cwd, ["read-tree", savedIndexTree], GIT_SLOW_TIMEOUT_MS);
-    } catch {
-    }
-  }
-}
-async function tryPushRefspec(cwd, refspec, force = false) {
-  try {
-    const forceArgs = force ? ["--force"] : [];
-    await git(cwd, ["push", "--no-verify", ...forceArgs, "origin", refspec], 3e4);
-    return true;
-  } catch {
-    return false;
-  }
-}
-async function refreshRemoteToken(cwd, refreshToken) {
-  if (!refreshToken) return;
-  try {
-    const token = await refreshToken();
-    if (token) {
-      await updateRemoteToken(cwd, token);
-      process.env.GITHUB_TOKEN = token;
-      process.env.GH_TOKEN = token;
-    }
-  } catch {
-  }
-}
-async function restoreWipSnapshot(cwd, branch) {
-  if (!branch) return "none";
-  const ref = wipRefForBranch(branch);
-  try {
-    await git(cwd, ["fetch", "origin", `+refs/heads/${ref}:refs/remotes/origin/${ref}`]);
-  } catch (err) {
-    if (isMissingRefError(err)) return "none";
-    wipRefPreserved.add(cwd);
-    return "failed";
-  }
-  try {
-    const sha = await git(cwd, ["rev-parse", `refs/remotes/origin/${ref}`]);
-    const parent = await git(cwd, ["rev-parse", `${sha}^`]);
-    const head = await git(cwd, ["rev-parse", "HEAD"]);
-    if (parent !== head) {
-      try {
-        await git(cwd, ["stash", "apply", sha], GIT_SLOW_TIMEOUT_MS);
-        wipRefPushed.add(cwd);
-        wipRefPreserved.delete(cwd);
-        return "applied";
-      } catch {
-        try {
-          await git(cwd, ["reset", "--merge"], GIT_SLOW_TIMEOUT_MS);
-        } catch {
-        }
-        wipRefPreserved.add(cwd);
-        return "stale";
-      }
-    }
-    await git(cwd, ["stash", "apply", sha], GIT_SLOW_TIMEOUT_MS);
-    wipRefPushed.add(cwd);
-    wipRefPreserved.delete(cwd);
-    return "applied";
-  } catch {
-    wipRefPreserved.add(cwd);
-    return "failed";
-  }
-}
-function isMissingRefError(err) {
-  const stderr = err.stderr?.toString() ?? "";
-  const msg = stderr || (err instanceof Error ? err.message : String(err));
-  return /couldn't find remote ref|couldn't find remote|no such ref|not our ref/i.test(msg);
-}
-async function flushPendingChanges(cwd, opts) {
-  let committed = false;
-  let pushed = false;
-  let hadWork = false;
-  try {
-    const branch = await getCurrentBranch(cwd);
-    if (!branch) return { committed, pushed, hadWork };
-    const dirty = await hasUncommittedChanges(cwd);
-    const unpushed = await hasUnpushedCommits(cwd);
-    if (!dirty && !unpushed) {
-      await dropStaleWipRef(cwd, branch, opts?.refreshToken);
-      return { committed, pushed, hadWork };
-    }
-    hadWork = true;
-    await refreshRemoteToken(cwd, opts?.refreshToken);
-    if (unpushed) {
-      pushed = await pushToOrigin(cwd, opts?.refreshToken);
-    }
-    if (dirty && !wipRefPreserved.has(cwd)) {
-      const message = opts?.wipMessage ?? "WIP: conveyor-agent snapshot";
-      const sha = await createWipSnapshot(cwd, message);
-      if (sha) {
-        committed = await tryPushRefspec(cwd, `${sha}:refs/heads/${wipRefForBranch(branch)}`, true);
-        if (committed) wipRefPushed.add(cwd);
-      }
-    }
-  } catch {
-  }
-  return { committed, pushed, hadWork };
-}
-async function dropStaleWipRef(cwd, branch, refreshToken) {
-  if (wipRefPreserved.has(cwd) || !wipRefPushed.has(cwd)) return;
-  await refreshRemoteToken(cwd, refreshToken);
-  if (await tryPushRefspec(cwd, `:refs/heads/${wipRefForBranch(branch)}`)) {
-    wipRefPushed.delete(cwd);
-  }
-}
-async function pushToOrigin(cwd, refreshToken, skipVerify = false) {
-  try {
-    const currentBranch = await getCurrentBranch(cwd);
-    if (!currentBranch) return false;
-    if (refreshToken) {
-      try {
-        const token = await refreshToken();
-        if (token) {
-          await updateRemoteToken(cwd, token);
-          process.env.GITHUB_TOKEN = token;
-          process.env.GH_TOKEN = token;
-        }
-      } catch {
-      }
-    }
-    if (await tryPush(cwd, currentBranch, skipVerify)) {
-      clearForceFreshCooldown();
-      return true;
-    }
-    if (refreshToken && !forceFreshMintBlocked() && await isAuthError(cwd)) {
-      const token = await refreshToken({ forceFresh: true });
-      if (token) {
-        await updateRemoteToken(cwd, token);
-        process.env.GITHUB_TOKEN = token;
-        process.env.GH_TOKEN = token;
-        const pushed = await tryPush(cwd, currentBranch, skipVerify);
-        if (pushed) clearForceFreshCooldown();
-        else recordForceFreshFailure();
-        return pushed;
-      }
-    }
-    return false;
-  } catch {
-    return false;
-  }
-}
-function branchBackupRef(branch) {
-  return `conveyor-wip/branches/${branch}`;
-}
-async function listWorktrees(cwd) {
-  try {
-    const out = await git(cwd, ["worktree", "list", "--porcelain"]);
-    const result = [];
-    for (const entry of out.split("\n\n")) {
-      const lines = entry.trim().split("\n");
-      const wl = lines.find((l) => l.startsWith("worktree "));
-      if (!wl) continue;
-      const bl = lines.find((l) => l.startsWith("branch "));
-      result.push({
-        path: wl.slice("worktree ".length),
-        branch: bl ? bl.slice("branch refs/heads/".length) : null
-      });
-    }
-    return result;
-  } catch {
-    return [];
-  }
-}
-async function listLocalBranches(cwd) {
-  try {
-    const out = await git(cwd, ["for-each-ref", "--format=%(refname:short)", "refs/heads/"]);
-    return out.split("\n").map((s) => s.trim()).filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-async function branchUnpushedCount(cwd, branch) {
-  try {
-    const n = await git(cwd, ["rev-list", "--count", branch, "--not", "--remotes=origin"]);
-    return Number.parseInt(n, 10) || 0;
-  } catch {
-    return 0;
-  }
-}
-function samePath(a, b) {
-  try {
-    return realpathSync(a) === realpathSync(b);
-  } catch {
-    return a === b;
-  }
-}
-async function flushAllPendingWork(cwd, opts) {
-  try {
-    const primary = await flushPendingChanges(cwd, opts);
-    await refreshRemoteToken(cwd, opts?.refreshToken);
-    const currentBranch = await getCurrentBranch(cwd);
-    const worktreesSnapshotted = await snapshotOtherWorktrees(cwd, opts?.wipMessage);
-    const branchesBackedUp = await backupOtherBranches(cwd, currentBranch);
-    return {
-      hadWork: primary.hadWork || worktreesSnapshotted > 0 || branchesBackedUp > 0,
-      branchesBackedUp,
-      worktreesSnapshotted
-    };
-  } catch {
-    return { hadWork: false, branchesBackedUp: 0, worktreesSnapshotted: 0 };
-  }
-}
-async function snapshotOtherWorktrees(cwd, wipMessage) {
-  let count = 0;
-  for (const wt of await listWorktrees(cwd)) {
-    if (samePath(wt.path, cwd) || !wt.branch) continue;
-    try {
-      if (!await hasUncommittedChanges(wt.path)) continue;
-      const sha = await createWipSnapshot(wt.path, wipMessage ?? "WIP: conveyor-agent snapshot");
-      if (sha && await tryPushRefspec(wt.path, `${sha}:refs/heads/${wipRefForBranch(wt.branch)}`, true)) {
-        wipRefPushed.add(wt.path);
-        count++;
-      }
-    } catch {
-    }
-  }
-  return count;
-}
-async function backupOtherBranches(cwd, currentBranch) {
-  let count = 0;
-  for (const branch of await listLocalBranches(cwd)) {
-    if (branch === currentBranch || branch.startsWith("conveyor-wip/")) continue;
-    try {
-      if (await branchUnpushedCount(cwd, branch) === 0) continue;
-      if (await tryPushRefspec(
-        cwd,
-        `refs/heads/${branch}:refs/heads/${branchBackupRef(branch)}`,
-        true
-      )) {
-        count++;
-      }
-    } catch {
-    }
-  }
-  return count;
+  readAgentVersion
+} from "./chunk-XORJ6SII.js";
+import {
+  AgentConnection,
+  CodespacePortVisibility,
+  DEFAULT_LIFECYCLE_CONFIG,
+  Lifecycle,
+  PortDiscovery,
+  awaitGitReady,
+  clearForceFreshCooldown,
+  createServiceLogger,
+  ensureOnTaskBranch,
+  flushAllPendingWork,
+  flushPendingChanges,
+  forceFreshCooldownNotice,
+  forceFreshMintBlocked,
+  getCurrentBranch,
+  hasUncommittedChanges,
+  hasUnpushedCommits,
+  pushToOrigin,
+  readWorkspaceBytes,
+  readWorkspaceDir,
+  readWorkspaceFile,
+  recordForceFreshFailure,
+  remoteMatchesLocalHead,
+  restoreWipSnapshot,
+  stageAndCommit,
+  statWorkspacePath,
+  updateRemoteToken,
+  verifyGitCredential
+} from "./chunk-LSZ2KLJY.js";
+import {
+  registerBootMilestoneSocketFallback,
+  reportBootMilestone
+} from "./chunk-WMMBAKPE.js";
+import {
+  LoopLagMonitor,
+  loopStatusForRunnerStatus
+} from "./chunk-IA45XHOA.js";
+import {
+  getWorkbenchClient
+} from "./chunk-EXQ6AHOY.js";
+import {
+  workbenchEnabled
+} from "./chunk-KMB3BU4S.js";
+import {
+  MAX_BETWEEN_TURN_BUFFER,
+  MAX_DIAGNOSTIC_OUTPUT,
+  buildExitErrors,
+  buildPromptBytes,
+  buildSpawnArgs,
+  cleanTerminalOutput,
+  inheritedEnv,
+  killPtyWithEscalation,
+  needsRawReadyGate,
+  parseUserQuestions,
+  renderPromptContentText,
+  resolveClaudeBinary,
+  resolvePlanDialogTiming,
+  resolvePtySpawn,
+  resolveRawTuiProbeTiming,
+  resolveSubmitNudgeTiming,
+  resolveSubmitRedeliveryMaxAttempts,
+  resolveSubmitSettleMs,
+  sawTerminalSetup,
+  sentinelEchoed,
+  sessionTempBase,
+  spawnOptionsFingerprint,
+  transcriptSize,
+  turnOptionsFrom
+} from "./chunk-3F4ZZKCA.js";
+import {
+  describeTokenFile,
+  ghHostsExternallyOwned,
+  githubTokenFilePath,
+  sleep
+} from "./chunk-W4LZ7R6Z.js";
+
+// src/connection/auth-errors.ts
+function isPermissionDeniedError(err) {
+  const message = err instanceof Error ? err.message : String(err);
+  return /insufficient permissions|authentication required/i.test(message);
 }
 
 // ../shared/dist/chunk-6RHVH33O.js
@@ -2041,7 +198,8 @@ var projectCheckpointSettingsSchema = z.object({
   finalizeCommand: z.string().trim().min(1),
   credentialEpoch: z.string().trim().min(1),
   requiredSecretNames: uniqueSortedArray(secretNameSchema).optional(),
-  optionalSecretNames: uniqueSortedArray(secretNameSchema).optional()
+  optionalSecretNames: uniqueSortedArray(secretNameSchema).optional(),
+  bakeWebAppBuild: z.boolean().optional()
 }).superRefine((checkpoint, ctx) => {
   const required = new Set(checkpoint.requiredSecretNames ?? []);
   for (const name of checkpoint.optionalSecretNames ?? []) {
@@ -2291,7 +449,15 @@ var PostToChatInputSchema = z4.object({
 });
 var GetTaskContextRequestSchema = z4.object({
   sessionId: z4.string(),
-  includeHistory: z4.boolean().optional().default(false)
+  includeHistory: z4.boolean().optional().default(false),
+  /**
+   * Read the plan-revised marker WITHOUT consuming it. Bookkeeping fetches
+   * (the session-identity check, the branch refresh) pass true so they cannot
+   * race the boot fetch and swallow the notice before it reaches the prompt.
+   * Defaults to false — consuming — so a pod running an older agent build still
+   * clears the marker instead of showing the notice on every boot forever.
+   */
+  peekPlanRevision: z4.boolean().optional().default(false)
 });
 var GetChatMessagesRequestSchema = z4.object({
   sessionId: z4.string(),
@@ -3856,6 +2022,17 @@ var PRE_BUILD_TASK_STATUSES = /* @__PURE__ */ new Set(["Planning", "Open"]);
 function hasTaskPlan(plan) {
   return !!plan?.trim();
 }
+var CARD_TYPE_SURFACE = {
+  task: "board",
+  chat: "board",
+  incident: "report",
+  suggestion: "report"
+};
+var surfaceTypes = (surface) => Object.keys(CARD_TYPE_SURFACE).filter(
+  (type) => CARD_TYPE_SURFACE[type] === surface
+);
+var BOARD_CARD_TYPES = surfaceTypes("board");
+var REPORT_CARD_TYPES = surfaceTypes("report");
 
 // src/runner/mode-controller.ts
 var ModeController = class {
@@ -4007,141 +2184,6 @@ var ModeController = class {
   }
 };
 
-// src/runner/lifecycle.ts
-var DEFAULT_LIFECYCLE_CONFIG = {
-  idleTimeoutMs: 30 * 60 * 1e3,
-  dormantTimeoutMs: 60 * 60 * 1e3,
-  heartbeatIntervalMs: 3e4,
-  tokenRefreshIntervalMs: 45 * 60 * 1e3,
-  gitFlushIntervalMs: 2 * 60 * 1e3,
-  usageSampleIntervalMs: 5 * 60 * 1e3,
-  usageSampleInitialDelayMs: 3e4
-};
-var Lifecycle = class {
-  config;
-  callbacks;
-  heartbeatTimer = null;
-  tokenRefreshTimer = null;
-  idleTimer = null;
-  idleCheckInterval = null;
-  dormantTimer = null;
-  gitFlushTimer = null;
-  usageSampleTimer = null;
-  constructor(config, callbacks) {
-    this.config = config;
-    this.callbacks = callbacks;
-  }
-  // ── Heartbeat ──────────────────────────────────────────────────────
-  startHeartbeat() {
-    this.stopHeartbeat();
-    this.heartbeatTimer = setInterval(() => {
-      this.callbacks.onHeartbeat();
-    }, this.config.heartbeatIntervalMs);
-  }
-  stopHeartbeat() {
-    if (this.heartbeatTimer) {
-      clearInterval(this.heartbeatTimer);
-      this.heartbeatTimer = null;
-    }
-  }
-  // ── Token refresh ─────────────────────────────────────────────────
-  startTokenRefresh() {
-    this.stopTokenRefresh();
-    this.callbacks.onTokenRefresh();
-    this.tokenRefreshTimer = setInterval(() => {
-      this.callbacks.onTokenRefresh();
-    }, this.config.tokenRefreshIntervalMs);
-  }
-  stopTokenRefresh() {
-    if (this.tokenRefreshTimer) {
-      clearInterval(this.tokenRefreshTimer);
-      this.tokenRefreshTimer = null;
-    }
-  }
-  // ── Periodic git flush ────────────────────────────────────────────
-  startGitFlush() {
-    this.stopGitFlush();
-    if (this.config.gitFlushIntervalMs <= 0) return;
-    this.gitFlushTimer = setInterval(() => {
-      this.callbacks.onGitFlush();
-    }, this.config.gitFlushIntervalMs);
-  }
-  stopGitFlush() {
-    if (this.gitFlushTimer) {
-      clearInterval(this.gitFlushTimer);
-      this.gitFlushTimer = null;
-    }
-  }
-  // ── Claude key usage sampling ─────────────────────────────────────
-  startUsageSample() {
-    this.stopUsageSample();
-    if (this.config.usageSampleIntervalMs <= 0) return;
-    this.usageSampleTimer = setTimeout(() => {
-      this.callbacks.onUsageSample();
-      this.usageSampleTimer = setInterval(() => {
-        this.callbacks.onUsageSample();
-      }, this.config.usageSampleIntervalMs);
-    }, this.config.usageSampleInitialDelayMs);
-  }
-  stopUsageSample() {
-    if (this.usageSampleTimer) {
-      clearInterval(this.usageSampleTimer);
-      this.usageSampleTimer = null;
-    }
-  }
-  // ── Idle timer ─────────────────────────────────────────────────────
-  startIdleTimer() {
-    this.clearIdleTimers();
-    this.idleTimer = setTimeout(() => {
-      this.callbacks.onIdleTimeout();
-    }, this.config.idleTimeoutMs);
-  }
-  cancelIdleTimer() {
-    this.clearIdleTimers();
-  }
-  // ── Dormant timer ──────────────────────────────────────────────────
-  /** Start (or restart) the dormant timer.
-   *  @param overrideMs Optional custom delay in ms. When provided, the timer
-   *  fires after exactly that delay instead of `dormantTimeoutMs`. SessionRunner
-   *  uses this to enforce an *absolute* deadline across cycles: even if the
-   *  dormant wait is interrupted by an inbound message, the next iteration
-   *  passes the remaining time, so the agent shuts down at the original
-   *  deadline regardless of message volume. */
-  startDormantTimer(overrideMs) {
-    this.cancelDormantTimer();
-    const delay2 = Math.max(0, overrideMs ?? this.config.dormantTimeoutMs);
-    this.dormantTimer = setTimeout(() => {
-      this.callbacks.onDormantTimeout();
-    }, delay2);
-  }
-  cancelDormantTimer() {
-    if (this.dormantTimer) {
-      clearTimeout(this.dormantTimer);
-      this.dormantTimer = null;
-    }
-  }
-  // ── Cleanup ────────────────────────────────────────────────────────
-  destroy() {
-    this.stopHeartbeat();
-    this.stopTokenRefresh();
-    this.stopGitFlush();
-    this.stopUsageSample();
-    this.clearIdleTimers();
-    this.cancelDormantTimer();
-  }
-  // ── Private ────────────────────────────────────────────────────────
-  clearIdleTimers() {
-    if (this.idleTimer) {
-      clearTimeout(this.idleTimer);
-      this.idleTimer = null;
-    }
-    if (this.idleCheckInterval) {
-      clearInterval(this.idleCheckInterval);
-      this.idleCheckInterval = null;
-    }
-  }
-};
-
 // src/harness/types.ts
 function isExternalMcpStdioServer(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -5813,11 +3855,11 @@ var READ_BACK_DELAYS_MS = [250, 500, 1e3, 2e3];
 var defaultSleep = (ms) => new Promise((resolve) => {
   setTimeout(resolve, ms);
 });
-async function writeWithReadBackRetry(io2, contents, delaysMs = READ_BACK_DELAYS_MS) {
-  const sleep2 = io2.sleep ?? defaultSleep;
+async function writeWithReadBackRetry(io, contents, delaysMs = READ_BACK_DELAYS_MS) {
+  const sleep2 = io.sleep ?? defaultSleep;
   for (let attempt = 0; ; attempt++) {
-    await io2.write(contents);
-    if (await io2.read() === contents) return true;
+    await io.write(contents);
+    if (await io.read() === contents) return true;
     if (attempt >= delaysMs.length) return false;
     await sleep2(delaysMs[attempt]);
   }
@@ -7599,7 +5641,7 @@ function findOnPath(binary, env = process.env) {
 import { promises as fs } from "fs";
 import { dirname as dirname2, join as join9 } from "path";
 import { homedir as homedir4 } from "os";
-var logger2 = createServiceLogger("opencode-auth");
+var logger = createServiceLogger("opencode-auth");
 var OPENCODE_CODEX_PLUGIN = "opencode-openai-codex-auth@4.4.0";
 var PLUGIN_PACKAGE = "opencode-openai-codex-auth";
 function opencodeAuthPath(env) {
@@ -7646,7 +5688,7 @@ async function ensureAuthEntry(env, seed) {
   const path2 = opencodeAuthPath(env);
   const store = await readJsonFile(path2);
   if (!shouldSeed(store.openai, seed)) {
-    logger2.info("opencode oauth store is fresher than the seed; leaving it alone");
+    logger.info("opencode oauth store is fresher than the seed; leaving it alone");
     return;
   }
   store.openai = {
@@ -7656,7 +5698,7 @@ async function ensureAuthEntry(env, seed) {
     expires: seed.expires
   };
   await writeJsonFile(path2, store);
-  logger2.info("seeded opencode oauth store entry");
+  logger.info("seeded opencode oauth store entry");
 }
 async function ensurePluginConfig(env) {
   const path2 = opencodeConfigPath(env);
@@ -7669,7 +5711,7 @@ async function ensurePluginConfig(env) {
   const kept = plugins.filter((p) => !isOurs(p));
   config.plugin = [...kept, OPENCODE_CODEX_PLUGIN];
   await writeJsonFile(path2, config);
-  logger2.info("ensured opencode codex-auth plugin in config");
+  logger.info("ensured opencode codex-auth plugin in config");
 }
 async function seedOpenCodeOauth(env) {
   const seed = parseOauthSeed(env.CONVEYOR_OPENCODE_OAUTH);
@@ -7678,7 +5720,7 @@ async function seedOpenCodeOauth(env) {
     await ensureAuthEntry(env, seed);
     await ensurePluginConfig(env);
   } catch (err) {
-    logger2.warn(
+    logger.warn(
       `failed to seed opencode oauth store: ${err instanceof Error ? err.message : String(err)}`
     );
   }
@@ -8047,14 +6089,14 @@ function resolveTuiAdapter(kind = "claude-code") {
 
 // src/harness/pty/stream-server.ts
 import net from "net";
-var logger3 = createServiceLogger("PtyStreamServer");
+var logger2 = createServiceLogger("PtyStreamServer");
 var RING_MAX_CHARS = 256 * 1024;
 var PtyStreamServer = class {
   constructor(options) {
     this.options = options;
     this.server = net.createServer((socket) => this.handleConnection(socket));
     this.server.on("error", (err) => {
-      logger3.warn(`PTY stream server error: ${err.message}`);
+      logger2.warn(`PTY stream server error: ${err.message}`);
     });
   }
   options;
@@ -8095,7 +6137,7 @@ var PtyStreamServer = class {
         return port;
       }
     }
-    logger3.warn(`PTY stream server could not bind any port in ${base}..${base + attempts - 1}`);
+    logger2.warn(`PTY stream server could not bind any port in ${base}..${base + attempts - 1}`);
     return null;
   }
   tryListen(port) {
@@ -8216,7 +6258,7 @@ var PtyStreamServer = class {
 };
 
 // src/harness/pty/direct-stream.ts
-var logger4 = createServiceLogger("PtyDirectStream");
+var logger3 = createServiceLogger("PtyDirectStream");
 var RELAY_COALESCE_MS = 2e3;
 var RELAY_MAX_BUFFER_CHARS = 48 * 1024;
 var DirectStreamController = class {
@@ -8265,7 +6307,7 @@ var DirectStreamController = class {
     });
     void created.listen().then((port) => this.onListening(created, port)).catch((err) => {
       this.starting = false;
-      logger4.warn(
+      logger3.warn(
         `PTY stream server failed to start: ${err instanceof Error ? err.message : String(err)}`
       );
     });
@@ -8278,7 +6320,7 @@ var DirectStreamController = class {
     }
     this.server = created;
     this.reporter.reportPtyStream(port);
-    logger4.info(`PTY stream server listening on ${port} (session ${this.reporter.sessionId})`);
+    logger3.info(`PTY stream server listening on ${port} (session ${this.reporter.sessionId})`);
   }
   /** Push the min box across both transports to the pty. */
   applyDims() {
@@ -8355,7 +6397,7 @@ function wrapBridgeWithDirectStream(inner, reporter, options = {}) {
 
 // src/execution/query-executor.ts
 import { createHash as createHash2 } from "crypto";
-import { existsSync as existsSync2, readFileSync as readFileSync3, truncateSync } from "fs";
+import { existsSync, readFileSync as readFileSync3, truncateSync } from "fs";
 
 // src/execution/chat-instructions.ts
 function buildChatInstructions(context, scenario, newMessages) {
@@ -8615,6 +6657,36 @@ After addressing the feedback, resume your autonomous loop: call list_subtasks a
   return parts;
 }
 
+// src/execution/plan-revision-notice.ts
+var MINUTE_MS = 60 * 1e3;
+var HOUR_MS = 60 * MINUTE_MS;
+var DAY_MS = 24 * HOUR_MS;
+function describeAge(revisedAt, now) {
+  const at = Date.parse(revisedAt);
+  if (Number.isNaN(at)) return "";
+  const ago = now - at;
+  if (ago < MINUTE_MS) return "just now";
+  if (ago < HOUR_MS) return `${Math.round(ago / MINUTE_MS)} minutes ago`;
+  if (ago < DAY_MS) return `${Math.round(ago / HOUR_MS)} hours ago`;
+  return `${Math.round(ago / DAY_MS)} days ago`;
+}
+function buildPlanRevisionNotice(context, now = Date.now()) {
+  const revisedAt = context.planRevisedAt;
+  if (!revisedAt) return [];
+  const age = describeAge(revisedAt, now);
+  const when = age ? `${age} (${revisedAt})` : revisedAt;
+  return [
+    `
+## \u26A0\uFE0F The plan changed since this build was dispatched`,
+    `Someone revised this card's plan ${when}. It was NOT you \u2014 an agent is never told about its own plan edit.`,
+    `Before your next Write or Edit:`,
+    `1. Call \`get_current_plan\` and read the current plan in full.`,
+    `2. Compare it against the plan you were launched with. Treat the current plan as the truth.`,
+    `3. Drop or redo any work the revision supersedes. Do NOT keep building the old plan.`,
+    `If the revision invalidates work you already committed, say so with post_to_chat before you continue.`
+  ];
+}
+
 // src/execution/prompt-formatters.ts
 function baseDiffCommand(baseBranch, flags) {
   const base = baseBranch ?? "dev";
@@ -8780,45 +6852,6 @@ function formatIncidents(incidents) {
   return parts;
 }
 
-// src/workbench/fs.ts
-import {
-  readFile as localReadFile,
-  readdir as localReaddir,
-  stat as localStat
-} from "fs/promises";
-async function readWorkspaceFile(path2) {
-  if (workbenchEnabled()) {
-    return (await getWorkbenchClient().readFile(path2)).toString("utf8");
-  }
-  return localReadFile(path2, "utf-8");
-}
-function readWorkspaceBytes(path2) {
-  if (workbenchEnabled()) return getWorkbenchClient().readFile(path2);
-  return localReadFile(path2);
-}
-function readWorkspaceDir(path2) {
-  if (workbenchEnabled()) return getWorkbenchClient().readdir(path2);
-  return localReaddir(path2);
-}
-async function statWorkspacePath(path2) {
-  if (workbenchEnabled()) return getWorkbenchClient().stat(path2);
-  try {
-    const s = await localStat(path2);
-    return {
-      exists: true,
-      isFile: s.isFile(),
-      isDirectory: s.isDirectory(),
-      size: s.size,
-      mtimeMs: s.mtimeMs
-    };
-  } catch {
-    return { exists: false, isFile: false, isDirectory: false, size: 0, mtimeMs: 0 };
-  }
-}
-async function workspacePathExists(path2) {
-  return (await statWorkspacePath(path2)).exists;
-}
-
 // src/execution/tag-context-resolver.ts
 var TYPE_PRIORITY = { rule: 0, doc: 1, file: 2, folder: 3 };
 var SUMMARY_SCAN_CHARS = 4e3;
@@ -9265,6 +7298,17 @@ function buildPlanDocumentationSection(context) {
     `- Identification auto-fills title, story points, and icon with quick AI guesses. After exploring, refine the title, story points, and risk with update_task_properties whenever they no longer match what the work actually is \u2014 adjust in either direction. Icons are automatic \u2014 never set them.`
   ];
 }
+function buildPlanRevisionSection() {
+  return [
+    ``,
+    `### The plan can change while you sleep`,
+    `If a turn opens with "The plan changed since this build was dispatched", honor it BEFORE your next Write or Edit:`,
+    `1. Call get_current_plan and read the current plan in full.`,
+    `2. Compare it against the plan you were launched with \u2014 the current plan wins.`,
+    `3. Drop or redo whatever the revision supersedes, and say so with post_to_chat if it invalidates work you already committed.`,
+    `Building on a superseded plan is the most expensive mistake a resumed card can make.`
+  ];
+}
 function buildNoPrWhenNoCodeSection(baseBranch) {
   const diffCommand = baseDiffCommand(baseBranch);
   return [
@@ -9464,6 +7508,7 @@ function buildAutoPrompt(context, runnerMode) {
       ...buildPrGuideSection(),
       ...buildNoPrWhenNoCodeSection(context?.baseBranch)
     ],
+    ...buildPlanRevisionSection(),
     ``,
     `### Autonomous Guidelines:`,
     `- Make decisions independently \u2014 do not ask the team for approval at each step`,
@@ -9493,7 +7538,8 @@ function buildBuildingPrompt(context) {
       ...buildPrGuideSection(),
       ...buildNoPrWhenNoCodeSection(context?.baseBranch),
       ...context?.isAuto || !context?.plan?.trim() ? buildPlanDocumentationSection(context) : []
-    ]
+    ],
+    ...buildPlanRevisionSection()
   ];
   if (context) parts.push(...buildPropertyInstructions(context));
   return parts.join("\n");
@@ -9939,6 +7985,7 @@ ${context.description}`);
 ## Plan
 ${truncatePlanForPrompt(context.plan)}`);
   }
+  parts.push(...buildPlanRevisionNotice(context));
   if (context.files && context.files.length > 0) {
     parts.push(`
 ## Attached Files`);
@@ -10209,7 +8256,9 @@ async function buildInitialPrompt(mode, context, isAuto, agentMode) {
   const isPackRunner = mode === "pack" || mode === "pm" && !!isAuto && !!context.isParentTask;
   if (!isPackRunner) {
     const sessionRelaunch = buildRelaunchWithSession(mode, context, agentMode, isAuto);
-    if (sessionRelaunch) return sessionRelaunch;
+    if (sessionRelaunch) {
+      return [...buildPlanRevisionNotice(context), sessionRelaunch].join("\n");
+    }
   }
   const isPm = mode === "pm";
   let scenario = detectRelaunchScenario(context, isPm);
@@ -11160,7 +9209,12 @@ function buildGetCurrentPlanTool(connection) {
         const ctx = await connection.call("getTaskContext", {
           sessionId: connection.sessionId
         });
-        return textResult(ctx.plan ?? "No plan available.");
+        const plan = ctx.plan ?? "No plan available.";
+        return textResult(
+          ctx.planRevisedAt ? `\u26A0\uFE0F This plan was revised ${ctx.planRevisedAt}, after your build was dispatched. Treat it as the truth and drop any work it supersedes.
+
+${plan}` : plan
+        );
       } catch {
         return textResult("Could not fetch updated plan.");
       }
@@ -12980,8 +11034,8 @@ function buildDriveTools(connection, projectId) {
 }
 
 // src/tools/code-review-tools.ts
-import { execFile as execFile2 } from "child_process";
-import { promisify as promisify2 } from "util";
+import { execFile } from "child_process";
+import { promisify } from "util";
 import { z as z18 } from "zod";
 async function endReviewSession(connection, reason) {
   await connection.call("endReviewSession", {
@@ -13045,7 +11099,7 @@ async function resolveGitHeadSha(cwd) {
     const stdout = workbenchEnabled() ? (await getWorkbenchClient().execFile("git", ["rev-parse", "HEAD"], {
       cwd,
       timeout: 1e4
-    })).stdout : (await promisify2(execFile2)("git", ["rev-parse", "HEAD"], { cwd, timeout: 1e4 })).stdout;
+    })).stdout : (await promisify(execFile)("git", ["rev-parse", "HEAD"], { cwd, timeout: 1e4 })).stdout;
     const sha = stdout.trim();
     return /^[0-9a-f]{40}$/i.test(sha) ? sha : null;
   } catch {
@@ -13314,7 +11368,7 @@ function resolvePlaywrightMcpServer(env = process.env) {
 }
 
 // src/execution/event-handlers.ts
-var logger5 = createServiceLogger("event-handlers");
+var logger4 = createServiceLogger("event-handlers");
 function safeVoid(promise, context) {
   if (promise && typeof promise.catch === "function") {
     promise.catch((err) => {
@@ -13355,7 +11409,7 @@ async function processAssistantEvent(event, host, turnToolCalls) {
 var API_ERROR_PATTERN = /API Error: (?:[45]\d\d|terminated)/;
 var IMAGE_ERROR_PATTERN = /Could not process image/i;
 var AUTH_ERROR_PATTERN = /Not logged in|Please run \/login|authentication failed|invalid.*token|unauthorized/i;
-function isAuthError2(msg) {
+function isAuthError(msg) {
   return AUTH_ERROR_PATTERN.test(msg);
 }
 function isRetriableMessage(msg) {
@@ -13421,7 +11475,7 @@ function handleErrorResult(event, host) {
   if (isStaleSession) {
     return { retriable: false, staleSession: true };
   }
-  if (isAuthError2(errorMsg)) {
+  if (isAuthError(errorMsg)) {
     host.connection.sendEvent({ type: "error", message: errorMsg });
     return { retriable: false, authError: true };
   }
@@ -13469,7 +11523,7 @@ async function emitResultEvent(event, host, context, startTime, lastAssistantUsa
 }
 function handleRateLimitEvent(event, host) {
   const { rate_limit_info } = event;
-  logger5.info("Rate limit event received", { rate_limit_info });
+  logger4.info("Rate limit event received", { rate_limit_info });
   const status = rate_limit_info.status;
   const utilization = rate_limit_info.utilization ?? (status === "rejected" ? 1 : void 0);
   if (utilization !== void 0 && rate_limit_info.rateLimitType) {
@@ -14238,9 +12292,9 @@ function buildCanUseTool(host) {
 }
 
 // src/execution/query-executor.ts
-var logger6 = createServiceLogger("QueryExecutor");
+var logger5 = createServiceLogger("QueryExecutor");
 var IMAGE_ERROR_PATTERN2 = /Could not process image/i;
-var RETRY_DELAYS_MS2 = [6e4, 12e4, 18e4, 3e5];
+var RETRY_DELAYS_MS = [6e4, 12e4, 18e4, 3e5];
 function buildHooks(host) {
   return {
     PostToolUse: [
@@ -14290,7 +12344,7 @@ function sessionLineageKey(taskId, agentMode, runnerMode) {
 }
 function sessionFileExists(sessionUuid, cwd) {
   try {
-    return existsSync2(sessionTranscriptPath(cwd, sessionUuid));
+    return existsSync(sessionTranscriptPath(cwd, sessionUuid));
   } catch {
     return false;
   }
@@ -14309,7 +12363,7 @@ function resolveSessionStart(lineageKey, cwd) {
 }
 function repairTornSessionFile(path2) {
   try {
-    if (!existsSync2(path2)) return false;
+    if (!existsSync(path2)) return false;
     const content = readFileSync3(path2, "utf8");
     if (content.length === 0) return false;
     let keepEnd = content.length;
@@ -14330,7 +12384,7 @@ function repairTornSessionFile(path2) {
     }
     if (keepEnd === content.length) return false;
     truncateSync(path2, Buffer.byteLength(content.slice(0, keepEnd), "utf8"));
-    logger6.warn("Repaired torn transcript before resume", {
+    logger5.warn("Repaired torn transcript before resume", {
       path: path2,
       trimmedBytes: content.length - keepEnd
     });
@@ -14411,7 +12465,7 @@ function buildQueryOptions(host, context) {
     disallowedTools: buildDisallowedTools(settings, mode, host.hasExitedPlanMode),
     enableFileCheckpointing: settings.enableFileCheckpointing,
     stderr: (data) => {
-      logger6.warn("Claude Code stderr", { data: data.trimEnd() });
+      logger5.warn("Claude Code stderr", { data: data.trimEnd() });
     }
   };
 }
@@ -14842,11 +12896,11 @@ function classifyImageError(error) {
 async function emitRetryStatus(host, attempt, delayMs) {
   const delayMin = Math.round(delayMs / 6e4);
   host.connection.postChatMessage(
-    `API error encountered. Retrying in ${delayMin} minute${delayMin > 1 ? "s" : ""}... (attempt ${attempt + 1}/${RETRY_DELAYS_MS2.length})`
+    `API error encountered. Retrying in ${delayMin} minute${delayMin > 1 ? "s" : ""}... (attempt ${attempt + 1}/${RETRY_DELAYS_MS.length})`
   );
   host.connection.sendEvent({
     type: "error",
-    message: `API error, retrying in ${delayMin}m (${attempt + 1}/${RETRY_DELAYS_MS2.length})`
+    message: `API error, retrying in ${delayMin}m (${attempt + 1}/${RETRY_DELAYS_MS.length})`
   });
   host.connection.emitStatus("waiting_for_input");
   await host.callbacks.onStatusChange("waiting_for_input");
@@ -14907,7 +12961,7 @@ function handleRetryError(error, context, host, options, prevImageError) {
   if (isStaleOrExitedSession(error, context) && context.claudeSessionId) {
     return handleStaleSession(context, host, options);
   }
-  if (isAuthError2(getErrorMessage(error))) {
+  if (isAuthError(getErrorMessage(error))) {
     return handleAuthError(context, host, options);
   }
   if (!isRetriableError(error)) throw error;
@@ -14941,7 +12995,7 @@ function handleProcessResult(result, context, host, options) {
 }
 async function runWithRetry(initialQuery, context, host, options) {
   let lastErrorWasImage = false;
-  for (let attempt = 0; attempt <= RETRY_DELAYS_MS2.length; attempt++) {
+  for (let attempt = 0; attempt <= RETRY_DELAYS_MS.length; attempt++) {
     if (host.isStopped()) return;
     const agentQuery = attempt === 0 ? initialQuery : await buildRetryQuery(host, context, options, lastErrorWasImage);
     try {
@@ -14956,18 +13010,18 @@ async function runWithRetry(initialQuery, context, host, options) {
       if (outcome.action === "return") return;
       lastErrorWasImage = outcome.lastErrorWasImage;
     }
-    if (attempt >= RETRY_DELAYS_MS2.length) {
+    if (attempt >= RETRY_DELAYS_MS.length) {
       host.connection.postChatMessage(
-        `Agent shutting down after ${RETRY_DELAYS_MS2.length} failed retry attempts due to API errors. The task will resume automatically when the codespace restarts.`
+        `Agent shutting down after ${RETRY_DELAYS_MS.length} failed retry attempts due to API errors. The task will resume automatically when the codespace restarts.`
       );
       return;
     }
-    await emitRetryStatus(host, attempt, RETRY_DELAYS_MS2[attempt]);
+    await emitRetryStatus(host, attempt, RETRY_DELAYS_MS[attempt]);
   }
 }
 
 // src/runner/query-bridge.ts
-var logger7 = createServiceLogger("QueryBridge");
+var logger6 = createServiceLogger("QueryBridge");
 function resolveHarnessKind() {
   if (process.env.CONVEYOR_FORCE_SDK_CARDS === "1") return "sdk";
   return "pty";
@@ -15149,9 +13203,9 @@ var QueryBridge = class {
       const msg = err instanceof Error ? err.message : String(err);
       const isAbort = this._stopped || /abort/i.test(msg);
       if (isAbort) {
-        logger7.info("Query stopped by user", { error: msg });
+        logger6.info("Query stopped by user", { error: msg });
       } else {
-        logger7.error("Query execution failed", { error: msg });
+        logger6.error("Query execution failed", { error: msg });
         this.connection.sendEvent({ type: "error", message: msg });
       }
     } finally {
@@ -15177,9 +13231,9 @@ var QueryBridge = class {
       const msg = err instanceof Error ? err.message : String(err);
       const isAbort = this._stopped || /abort/i.test(msg);
       if (isAbort) {
-        logger7.info("Passive turn stopped", { error: msg });
+        logger6.info("Passive turn stopped", { error: msg });
       } else {
-        logger7.error("Passive turn failed", { error: msg });
+        logger6.error("Passive turn failed", { error: msg });
         this.connection.sendEvent({ type: "error", message: msg });
       }
     } finally {
@@ -15275,7 +13329,7 @@ var QueryBridge = class {
 };
 
 // src/execution/usage-sampler.ts
-import { existsSync as existsSync3 } from "fs";
+import { existsSync as existsSync2 } from "fs";
 
 // src/usage/reset-parse.ts
 var MONTHS = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
@@ -15506,7 +13560,7 @@ async function runUsageProbe(deps = {}) {
 }
 
 // src/execution/usage-sampler.ts
-var logger8 = createServiceLogger("usage-sampler");
+var logger7 = createServiceLogger("usage-sampler");
 var NO_SAMPLES = { samples: [], unmeasurable: null };
 function isAttributable(identity, sessionToken) {
   if (!identity) return { ok: true };
@@ -15518,12 +13572,12 @@ function isAttributable(identity, sessionToken) {
   }
   return { ok: true };
 }
-async function sampleKeyUsage(token, probe = () => runUsageProbe(), hasSubscriptionCredentials = () => existsSync3(claudeCredentialsPath()), readIdentity = readCredentialsIdentity) {
+async function sampleKeyUsage(token, probe = () => runUsageProbe(), hasSubscriptionCredentials = () => existsSync2(claudeCredentialsPath()), readIdentity = readCredentialsIdentity) {
   if (!token && !hasSubscriptionCredentials()) return NO_SAMPLES;
   try {
     const attributable = isAttributable(await readIdentity(), token);
     if (!attributable.ok) {
-      logger8.info("usage sample skipped \u2014 credentials not attributable to this session's key", {
+      logger7.info("usage sample skipped \u2014 credentials not attributable to this session's key", {
         reason: attributable.reason
       });
       return { samples: [], unmeasurable: { reason: attributable.reason ?? "unattributable" } };
@@ -15550,14 +13604,14 @@ async function sampleKeyUsage(token, probe = () => runUsageProbe(), hasSubscript
       });
     }
     if (samples.length === 0) {
-      logger8.info("usage sample produced no gauges", {
+      logger7.info("usage sample produced no gauges", {
         stdoutLength: stdout.length,
         stdoutHead: stdout.slice(0, 200).replaceAll("\n", " ")
       });
     }
     return { samples, unmeasurable: null };
   } catch (error) {
-    logger8.info("usage sample failed", {
+    logger7.info("usage sample failed", {
       error: error instanceof Error ? error.message : String(error)
     });
     return NO_SAMPLES;
@@ -15583,391 +13637,10 @@ function buildUnmeasurableEvent(reason, codingAgentKeyId) {
   };
 }
 
-// src/setup/git-ready.ts
-var GATE_MARGIN_MS = 5 * 6e4;
-var DEFAULT_TIMEOUT_MS = GIT_PREP_MAX_RETRIES * (CLONE_TIMEOUT_MS + FETCH_TIMEOUT_MS) + (GIT_PREP_MAX_RETRIES - 1) * DEFAULT_RETRY_DELAY_MS + GATE_MARGIN_MS;
-var DEFAULT_POLL_MS = 200;
-function awaitGitReady(opts = {}) {
-  if (!workbenchEnabled()) {
-    return Promise.resolve("not-gated");
-  }
-  const clientFn = opts.clientFn ?? getWorkbenchClient;
-  const timeoutMs = opts.timeoutMs ?? DEFAULT_TIMEOUT_MS;
-  const pollMs = opts.pollMs ?? DEFAULT_POLL_MS;
-  opts.onLog?.("waiting for workspace git (workbench daemon)");
-  return pollDaemon(clientFn, timeoutMs, pollMs, opts.onLog, opts.signal);
-}
-function delay(ms, signal) {
-  if (!signal) {
-    return new Promise((resolve) => {
-      setTimeout(resolve, ms);
-    });
-  }
-  if (signal.aborted) return Promise.resolve();
-  return new Promise((resolve) => {
-    const timer = setTimeout(() => {
-      signal.removeEventListener("abort", onAbort);
-      resolve();
-    }, ms);
-    const onAbort = () => {
-      clearTimeout(timer);
-      resolve();
-    };
-    signal.addEventListener("abort", onAbort, { once: true });
-  });
-}
-async function pollOnce(clientFn, reportError) {
-  try {
-    const frame = await clientFn().gitStatus();
-    if (frame.state === "ready") return { state: "ready", log: "workspace git ready" };
-    if (frame.state === "failed") {
-      return {
-        state: "failed",
-        log: `workspace git preparation failed: ${frame.reason ?? "unknown reason"}`
-      };
-    }
-    return { state: null };
-  } catch (err) {
-    if (err instanceof WorkbenchError && err.code === "unauthorized") {
-      return {
-        state: "failed",
-        log: "workspace git gate unauthorized \u2014 workbench token missing or invalid, giving up"
-      };
-    }
-    const message = err instanceof Error ? err.message : String(err);
-    return reportError ? { state: null, log: `workspace git poll error (retrying): ${message}` } : { state: null };
-  }
-}
-async function pollDaemon(clientFn, timeoutMs, pollMs, onLog, signal) {
-  const deadline = Date.now() + timeoutMs;
-  let loggedError = false;
-  for (; ; ) {
-    if (signal?.aborted) {
-      onLog?.("workspace git wait aborted \u2014 giving up");
-      return "timeout";
-    }
-    const outcome = await pollOnce(clientFn, !loggedError);
-    if (outcome.log !== void 0) {
-      loggedError = true;
-      onLog?.(outcome.log);
-    }
-    if (outcome.state !== null) return outcome.state;
-    if (Date.now() >= deadline) {
-      onLog?.(`workspace git not ready after ${timeoutMs}ms \u2014 giving up`);
-      return "timeout";
-    }
-    await delay(pollMs, signal);
-  }
-}
-
-// src/runner/port-discovery.ts
-import { readFile as readFile3 } from "fs/promises";
-import { execFile as execFile3 } from "child_process";
-var PROC_TCP_LISTEN_STATE = "0A";
-function isLoopbackHexAddress(hex) {
-  const addr = hex.toUpperCase();
-  if (addr.length === 8) {
-    return addr.slice(6, 8) === "7F";
-  }
-  if (addr.length === 32) {
-    if (addr === "00000000000000000000000001000000") return true;
-    if (addr.slice(0, 16) === "0000000000000000" && addr.slice(16, 24) === "FFFF0000") {
-      return addr.slice(30, 32) === "7F";
-    }
-    return false;
-  }
-  return false;
-}
-function parseProcNetTcpListeners(content) {
-  const sockets = [];
-  const lines = content.split("\n");
-  for (let i = 1; i < lines.length; i++) {
-    const line = lines[i];
-    if (!line) continue;
-    const cols = line.trim().split(/\s+/);
-    if (cols.length < 4 || cols[3] !== PROC_TCP_LISTEN_STATE) continue;
-    const local = cols[1];
-    if (!local) continue;
-    const [addrHex, portHex] = local.split(":");
-    if (!addrHex || !portHex) continue;
-    const port = Number.parseInt(portHex, 16);
-    if (!Number.isInteger(port) || port < 1 || port > 65535) continue;
-    sockets.push({ port, loopback: isLoopbackHexAddress(addrHex) });
-  }
-  return sockets;
-}
-function collectScan(sockets) {
-  const ports = /* @__PURE__ */ new Set();
-  const hasExternal = /* @__PURE__ */ new Set();
-  for (const { port, loopback } of sockets) {
-    ports.add(port);
-    if (!loopback) hasExternal.add(port);
-  }
-  const loopbackOnly = /* @__PURE__ */ new Set();
-  for (const port of ports) {
-    if (!hasExternal.has(port)) loopbackOnly.add(port);
-  }
-  return { ports, loopbackOnly };
-}
-var DEFAULT_PROC_PATHS = ["/proc/net/tcp", "/proc/net/tcp6"];
-async function readProcListeningPorts(procPaths = DEFAULT_PROC_PATHS) {
-  const sockets = [];
-  let readable = false;
-  for (const path2 of procPaths) {
-    try {
-      const content = await readFile3(path2, "utf8");
-      readable = true;
-      sockets.push(...parseProcNetTcpListeners(content));
-    } catch {
-    }
-  }
-  return readable ? collectScan(sockets) : null;
-}
-async function readNetstatListeningPorts() {
-  const output = await new Promise((resolve) => {
-    execFile3("netstat", ["-an", "-p", "tcp"], { timeout: 5e3 }, (err, stdout) => {
-      resolve(err ? null : stdout);
-    });
-  });
-  if (output === null) return null;
-  const sockets = [];
-  for (const line of output.split("\n")) {
-    if (!line.includes("LISTEN")) continue;
-    const cols = line.trim().split(/\s+/);
-    const local = cols[3];
-    if (!local) continue;
-    const lastDot = local.lastIndexOf(".");
-    if (lastDot < 0) continue;
-    const host = local.slice(0, lastDot);
-    const port = Number(local.slice(lastDot + 1));
-    if (!Number.isInteger(port) || port < 1 || port > 65535) continue;
-    const loopback = host.startsWith("127.") || host === "::1" || host === "localhost";
-    sockets.push({ port, loopback });
-  }
-  return collectScan(sockets);
-}
-async function readListeningPorts() {
-  const proc = await readProcListeningPorts();
-  if (proc !== null) return proc;
-  if (process.platform !== "linux") return readNetstatListeningPorts();
-  return null;
-}
-var DEFAULT_EXCLUDED_PORTS = [2222, 5432, 6379, 9200];
-var DEFAULT_EPHEMERAL_PORT_MIN = 32768;
-var DEFAULT_DISCOVERY_INTERVAL_MS = 15e3;
-var DEFAULT_MAX_PORTS = 16;
-var CONFIRM_SCANS = 2;
-var PortDiscovery = class {
-  opts;
-  intervalMs;
-  maxPorts;
-  excluded;
-  ephemeralPortMin;
-  scan;
-  now;
-  log;
-  baseline = null;
-  tracked = /* @__PURE__ */ new Map();
-  /** Loopback-only candidates already warned about (once per port). */
-  warnedLoopback = /* @__PURE__ */ new Set();
-  timer = null;
-  ticking = false;
-  disabled = false;
-  stopped = false;
-  /** Set when the confirmed set changed (or a report failed) — cleared only
-   *  after a successful report, so transient RPC failures retry next tick. */
-  reportPending = false;
-  lastReportedKey = "";
-  constructor(options) {
-    this.opts = options;
-    this.intervalMs = options.intervalMs ?? DEFAULT_DISCOVERY_INTERVAL_MS;
-    this.maxPorts = options.maxPorts ?? DEFAULT_MAX_PORTS;
-    this.excluded = new Set(options.excludedPorts ?? DEFAULT_EXCLUDED_PORTS);
-    this.ephemeralPortMin = options.ephemeralPortMin ?? DEFAULT_EPHEMERAL_PORT_MIN;
-    this.scan = options.scan ?? readListeningPorts;
-    this.now = options.now ?? (() => /* @__PURE__ */ new Date());
-    this.log = options.log ?? ((m) => process.stderr.write(`[conveyor-agent] ${m}
-`));
-  }
-  /** Take the baseline scan and start polling. Safe to call once. */
-  async start() {
-    if (this.timer || this.disabled || this.stopped) return;
-    const baseline = await this.scanSafe();
-    if (this.stopped) return;
-    if (baseline === null) {
-      this.disabled = true;
-      this.log("Port discovery disabled: no listening-socket source available");
-      return;
-    }
-    this.baseline = baseline.ports;
-    this.timer = setInterval(() => void this.tick(), this.intervalMs);
-    this.timer.unref?.();
-  }
-  stop() {
-    this.stopped = true;
-    if (this.timer) {
-      clearInterval(this.timer);
-      this.timer = null;
-    }
-  }
-  /** One poll cycle. Exposed for tests (deterministic, no timers needed). */
-  async tick() {
-    if (this.ticking || this.disabled || !this.baseline) return;
-    this.ticking = true;
-    try {
-      const current = await this.scanSafe();
-      if (current === null) return;
-      this.updateTracking(current);
-      if (this.reportPending) await this.flushReport();
-    } finally {
-      this.ticking = false;
-    }
-  }
-  async scanSafe() {
-    try {
-      return await this.scan();
-    } catch {
-      return null;
-    }
-  }
-  isCandidate(port) {
-    if (this.baseline?.has(port)) return false;
-    if (this.excluded.has(port)) return false;
-    if (port >= this.ephemeralPortMin) return false;
-    return true;
-  }
-  updateTracking(current) {
-    const reachable = /* @__PURE__ */ new Set();
-    for (const port of current.ports) {
-      if (!this.isCandidate(port)) continue;
-      if (current.loopbackOnly.has(port)) {
-        if (!this.warnedLoopback.has(port)) {
-          this.warnedLoopback.add(port);
-          this.log(
-            `Port ${port} is listening on loopback only and cannot be previewed \u2014 bind 0.0.0.0 (or the pod IP) to make it reachable through the preview proxy`
-          );
-        }
-        continue;
-      }
-      reachable.add(port);
-    }
-    for (const port of reachable) {
-      const entry = this.tracked.get(port);
-      if (!entry) {
-        this.tracked.set(port, { seen: 1, missed: 0, confirmed: false, detectedAt: "" });
-        continue;
-      }
-      entry.seen += 1;
-      entry.missed = 0;
-      if (!entry.confirmed && entry.seen >= CONFIRM_SCANS) {
-        entry.confirmed = true;
-        entry.detectedAt = this.now().toISOString();
-      }
-    }
-    for (const [port, entry] of this.tracked) {
-      if (reachable.has(port)) continue;
-      entry.missed += 1;
-      entry.seen = 0;
-      if (entry.missed >= CONFIRM_SCANS || !entry.confirmed) this.tracked.delete(port);
-    }
-    const key = this.confirmedKey();
-    if (key !== this.lastReportedKey) this.reportPending = true;
-  }
-  confirmedPorts() {
-    const confirmed = [...this.tracked.entries()].filter(([, entry]) => entry.confirmed).sort(([a], [b]) => a - b).slice(0, this.maxPorts);
-    return confirmed.map(([port, entry]) => ({
-      port,
-      protocol: "tcp",
-      detectedAt: entry.detectedAt
-    }));
-  }
-  confirmedKey() {
-    return this.confirmedPorts().map(({ port }) => port).join(",");
-  }
-  async flushReport() {
-    const ports = this.confirmedPorts();
-    const key = ports.map(({ port }) => port).join(",");
-    try {
-      await this.opts.report(ports);
-      this.lastReportedKey = key;
-      this.reportPending = false;
-      this.log(`Discovered preview ports: [${key || "none"}]`);
-    } catch {
-      return;
-    }
-    try {
-      await this.opts.onReported?.(ports);
-    } catch {
-    }
-  }
-};
-
-// src/runner/codespace-port-visibility.ts
-import { execFile as execFile4 } from "child_process";
-var GH_TIMEOUT_MS = 15e3;
-var VISIBILITIES = ["org", "public"];
-function runGh(args) {
-  return new Promise((resolve) => {
-    execFile4("gh", [...args], { timeout: GH_TIMEOUT_MS }, (error, _stdout, stderr) => {
-      resolve({ ok: !error, stderr: (stderr || (error ? String(error.message) : "")).trim() });
-    });
-  });
-}
-function isCodespaceEnvironment(env = process.env) {
-  return env.CODESPACES === "true" && !!env.CODESPACE_NAME;
-}
-var CodespacePortVisibility = class {
-  env;
-  run;
-  log;
-  /** Ports already attempted (success or failure) — one try per process. */
-  attempted = /* @__PURE__ */ new Set();
-  constructor(options = {}) {
-    this.env = options.env ?? process.env;
-    this.run = options.run ?? runGh;
-    this.log = options.log ?? ((m) => process.stderr.write(`[conveyor-agent] ${m}
-`));
-  }
-  /** Flip every not-yet-attempted port. Resolves even when everything fails. */
-  async ensureVisible(ports) {
-    if (!isCodespaceEnvironment(this.env)) return;
-    const codespaceName = this.env.CODESPACE_NAME;
-    for (const port of ports) {
-      if (this.attempted.has(port)) continue;
-      this.attempted.add(port);
-      await this.flip(port, codespaceName);
-    }
-  }
-  async flip(port, codespaceName) {
-    let lastError = "";
-    for (const visibility of VISIBILITIES) {
-      const result = await this.run([
-        "codespace",
-        "ports",
-        "visibility",
-        `${port}:${visibility}`,
-        "-c",
-        codespaceName
-      ]).catch((error) => ({
-        ok: false,
-        stderr: error instanceof Error ? error.message : String(error)
-      }));
-      if (result.ok) {
-        this.log(`Forwarded port ${port} set to ${visibility} visibility`);
-        return;
-      }
-      lastError = result.stderr;
-    }
-    this.log(
-      `Could not change visibility of forwarded port ${port} \u2014 the preview URL may 404 for other users${lastError ? `: ${lastError}` : ""}`
-    );
-  }
-};
-
 // src/runner/parent-pull-handler.ts
-import { execFile as execFile5 } from "child_process";
-import { promisify as promisify3 } from "util";
-var execFileAsync2 = promisify3(execFile5);
+import { execFile as execFile2 } from "child_process";
+import { promisify as promisify2 } from "util";
+var execFileAsync = promisify2(execFile2);
 async function handlePullBranch(workDir, branch) {
   if (!branch) return;
   const current = await getCurrentBranch(workDir);
@@ -15986,14 +13659,14 @@ async function handlePullBranch(workDir, branch) {
     return;
   }
   try {
-    await execFileAsync2("git", ["fetch", "origin", branch], { cwd: workDir, timeout: 6e4 });
+    await execFileAsync("git", ["fetch", "origin", branch], { cwd: workDir, timeout: 6e4 });
   } catch {
     process.stderr.write(`[conveyor-agent] pull_branch: fetch failed for ${branch}
 `);
     return;
   }
   try {
-    await execFileAsync2("git", ["pull", "--ff-only", "origin", branch], {
+    await execFileAsync("git", ["pull", "--ff-only", "origin", branch], {
       cwd: workDir,
       timeout: 6e4
     });
@@ -16893,6 +14566,9 @@ var SessionRunner = class _SessionRunner {
       title: ctx.title,
       description: ctx.description,
       plan: ctx.plan,
+      // The server hands this to exactly one context fetch per revision, so it
+      // must survive the mapping or the notice is lost.
+      planRevisedAt: ctx.planRevisedAt ?? null,
       status: ctx.status,
       chatHistory,
       agentId: ctx.agentId ?? null,
@@ -17065,7 +14741,10 @@ ${outcome.failures.join("\n")}
     try {
       const ctx = await this.connection.call("getTaskContext", {
         sessionId: this.sessionId,
-        includeHistory: false
+        includeHistory: false,
+        // Bookkeeping fetch — it must not swallow a plan-revised notice the
+        // next prompt is about to carry.
+        peekPlanRevision: true
       });
       if (ctx?.githubBranch && this.fullContext) {
         this.fullContext.githubBranch = ctx.githubBranch;
@@ -17173,49 +14852,6 @@ ${outcome.failures.join("\n")}
   }
 };
 
-// src/setup/config.ts
-import { join as join14 } from "path";
-var DEVCONTAINER_PATH = ".devcontainer/conveyor/devcontainer.json";
-var DEVCONTAINER_PORT_DENY_LIST = /* @__PURE__ */ new Set([5432, 6379, 9200]);
-async function loadForwardPorts(workspaceDir) {
-  try {
-    const raw = await readWorkspaceFile(join14(workspaceDir, DEVCONTAINER_PATH));
-    const parsed = JSON.parse(raw);
-    const ports = (parsed.forwardPorts ?? []).filter(
-      (p) => typeof p === "number" && !DEVCONTAINER_PORT_DENY_LIST.has(p)
-    );
-    const attributes = {};
-    for (const [key, value] of Object.entries(parsed.portsAttributes ?? {})) {
-      if (!value || typeof value !== "object") continue;
-      const entry = {};
-      if (typeof value.label === "string") entry.label = value.label;
-      if (value.visibility === "public" || value.visibility === "private") {
-        entry.visibility = value.visibility;
-      }
-      attributes[key] = entry;
-    }
-    return { ports, attributes };
-  } catch {
-    return { ports: [], attributes: {} };
-  }
-}
-function buildSessionPreviewPorts(result) {
-  return result.ports.filter((port) => !DEVCONTAINER_PORT_DENY_LIST.has(port)).map((port) => {
-    const attr = result.attributes[String(port)];
-    const entry = { port };
-    if (attr?.label) entry.label = attr.label;
-    if (attr?.visibility) entry.visibility = attr.visibility;
-    return entry;
-  });
-}
-function loadConveyorConfig() {
-  const envStart = process.env.CONVEYOR_START_COMMAND;
-  if (envStart) {
-    return { startCommand: envStart };
-  }
-  return null;
-}
-
 // src/setup/codespace.ts
 import { execSync } from "child_process";
 function unshallowRepo(workspaceDir) {
@@ -17230,30 +14866,13 @@ function unshallowRepo(workspaceDir) {
 }
 
 export {
-  fetchBootstrap,
-  applyBootstrapToEnv,
-  createServiceLogger,
-  AgentConnection,
   DEFAULT_SONNET_MODEL,
   isPermissionDeniedError,
-  DEFAULT_LIFECYCLE_CONFIG,
-  Lifecycle,
   buildSynthesizedCredentials,
   claudeJsonPath,
   PtyHarness,
   resolveTuiKindFromEnv,
   resolveTuiAdapter,
-  readWorkspaceBytes,
-  statWorkspacePath,
-  workspacePathExists,
-  GIT_TIMEOUT_MS,
-  updateRemoteToken,
-  hasUncommittedChanges,
-  getCurrentBranch,
-  hasUnpushedCommits,
-  stageAndCommit,
-  flushPendingChanges,
-  pushToOrigin,
   buildProjectTools,
   resolvePlaywrightMcpServer,
   resolveSessionStart,
@@ -17262,12 +14881,6 @@ export {
   sampleKeyUsage,
   buildRateLimitEvents,
   buildUnmeasurableEvent,
-  awaitGitReady,
-  PortDiscovery,
-  CodespacePortVisibility,
   SessionRunner,
-  loadForwardPorts,
-  buildSessionPreviewPorts,
-  loadConveyorConfig,
   unshallowRepo
 };