@rallycry/conveyor-agent 11.0.48 → 11.0.49

package/dist/{boot-KDC4OLVL.js → boot-GD5XMLPS.js}

@@ -1,6 +1,6 @@
 import {
   startWorkbenchServer
-} from "./chunk-F7XHSNU7.js";
+} from "./chunk-ATYCG6MT.js";
 import {
   TOMBSTONE_MESSAGE,
   isLegacyEntrypointLaunch
@@ -12,7 +12,7 @@ import {
   refreshSkillsAfterCheckout,
   runPreReadyBinds
 } from "./chunk-V5WR2F2P.js";
-import "./chunk-EKTPDG3G.js";
+import "./chunk-SXZS2R52.js";
 import {
   GitPrepJob,
   defaultGit,

package/dist/{chunk-F7XHSNU7.js → chunk-ATYCG6MT.js}

@@ -1,6 +1,6 @@
 import {
   loadPtySpawn
-} from "./chunk-EKTPDG3G.js";
+} from "./chunk-SXZS2R52.js";
 import {
   terminateProcessGroup
 } from "./chunk-W4LZ7R6Z.js";

package/dist/{chunk-UL6DAPTX.js → chunk-K35YJK2U.js}

@@ -8,7 +8,7 @@ import {
   readWorkspaceBytes,
   statWorkspacePath,
   workspacePathExists
-} from "./chunk-4RE6G2DZ.js";
+} from "./chunk-O3MXZHIS.js";
 import {
   reportBootMilestone
 } from "./chunk-VIUZS7V4.js";

package/dist/{chunk-4RE6G2DZ.js → chunk-O3MXZHIS.js}

@@ -3649,6 +3649,15 @@ function formatEvaluateQuestionsResult(res) {
   );
   return JSON.stringify({ model: res.model, results });
 }
+function subProjectScopePaths(subProject) {
+  return [
+    ...new Set(
+      [subProject.rootPath, ...subProject.additionalAllowedPaths ?? []].filter(
+        (path) => !!path
+      )
+    )
+  ];
+}
 var MEETING_CHECKLIST_TITLE_MAX = 300;
 var MEETING_TRANSCRIPT_MAX_CHARS = 2e6;
 var MEETING_TITLE_MAX = 200;
@@ -5356,6 +5365,7 @@ export {
   TAG_REASON_MAX,
   CRITICAL_AUTOMATED_SOURCES,
   formatEvaluateQuestionsResult,
+  subProjectScopePaths,
   AGENT_STATUS_REASON_USER_QUESTION,
   TASK_CHAT_HISTORY_LIMIT,
   PM_CHAT_HISTORY_LIMIT,

package/dist/{chunk-JUEHUVSD.js → chunk-RNE3JAF5.js}

@@ -12,6 +12,7 @@ import {
   buildSpawnArgs,
   cleanTerminalOutput,
   ensureSessionTarget,
+  flattenTerminalText,
   inheritedEnv,
   killPtyWithEscalation,
   needsRawReadyGate,
@@ -30,7 +31,7 @@ import {
   spawnOptionsFingerprint,
   transcriptSize,
   turnOptionsFrom
-} from "./chunk-EKTPDG3G.js";
+} from "./chunk-SXZS2R52.js";
 import {
   AGENT_STATUS_REASON_USER_QUESTION,
   AgentConnection,
@@ -95,9 +96,10 @@ import {
   runQueryGrafanaLogs,
   stageAndCommit,
   statWorkspacePath,
+  subProjectScopePaths,
   updateRemoteToken,
   verifyGitCredential
-} from "./chunk-4RE6G2DZ.js";
+} from "./chunk-O3MXZHIS.js";
 import {
   reportBootMilestone
 } from "./chunk-VIUZS7V4.js";
@@ -2600,12 +2602,11 @@ function conveyorCredentialsMarkerPath() {
 function tokenFingerprint(accessToken) {
   return createHash("sha256").update(accessToken).digest("hex");
 }
-function buildCredentialsMarker(accessToken, now, previousHash, refreshToken, codingAgentKeyId) {
+function buildCredentialsMarker(accessToken, now, previousHash, codingAgentKeyId) {
   const accessTokenSha256 = tokenFingerprint(accessToken);
   return JSON.stringify({
     accessTokenSha256,
     ...previousHash && previousHash !== accessTokenSha256 ? { previousAccessTokenSha256: previousHash } : {},
-    ...refreshToken ? { refreshTokenSha256: tokenFingerprint(refreshToken) } : {},
     ...codingAgentKeyId ? { codingAgentKeyId } : {},
     writtenAt: now
   });
@@ -2686,9 +2687,6 @@ function parseClaudeOauthEnv(blob) {
     const scopes = Array.isArray(record.scopes) ? record.scopes.filter((scope) => typeof scope === "string" && scope !== "") : [];
     return {
       access: record.access,
-      refresh: typeof record.refresh === "string" && record.refresh ? record.refresh : void 0,
-      expires: typeof record.expires === "number" ? record.expires : void 0,
-      refreshExpires: typeof record.refreshExpires === "number" ? record.refreshExpires : void 0,
       scopes: scopes.length > 0 ? scopes : void 0,
       rateLimitTier: typeof record.rateLimitTier === "string" ? record.rateLimitTier : void 0
     };
@@ -2714,13 +2712,10 @@ function parseClaudeAiOauth(raw) {
   }
 }
 function buildCredentialsFile(material, now) {
-  const refresh = material.refresh;
   return JSON.stringify({
     claudeAiOauth: {
       accessToken: material.access,
-      ...refresh ? { refreshToken: refresh } : {},
-      expiresAt: refresh && material.expires ? material.expires : now + SYNTH_TOKEN_TTL_MS,
-      ...material.refreshExpires ? { refreshTokenExpiresAt: material.refreshExpires } : {},
+      expiresAt: now + SYNTH_TOKEN_TTL_MS,
       scopes: material.scopes?.length ? material.scopes : LEGACY_SCOPES,
       ...material.rateLimitTier ? { rateLimitTier: material.rateLimitTier } : {},
       subscriptionType: "max"
@@ -2736,19 +2731,13 @@ function isConveyorOwnedCredentials(existing, markerHashes) {
   if (typeof existing.accessToken !== "string") return false;
   return markerHashes.includes(tokenFingerprint(existing.accessToken));
 }
-function hasStableRefreshOwnership(existing, markerRaw) {
-  return typeof existing.refreshToken === "string" && parseCredentialsRefreshMarker(markerRaw) === tokenFingerprint(existing.refreshToken);
-}
 function isCurrentCredential(existing, material, now) {
-  if (material.refresh) return existing.accessToken === material.access;
+  if (typeof existing.refreshToken === "string" && existing.refreshToken !== "") return false;
   return existing.accessToken === material.access && typeof existing.expiresAt === "number" && existing.expiresAt > now + REFRESH_SKEW_MS;
 }
-function needsMarkerUpgrade(input, material) {
+function needsMarkerUpgrade(input) {
   if (!input.codingAgentKeyId) return false;
-  if (parseCredentialsMarkerKeyId(input.markerRaw ?? null) !== input.codingAgentKeyId) return true;
-  return Boolean(
-    material.refresh && parseCredentialsRefreshMarker(input.markerRaw ?? null) !== tokenFingerprint(material.refresh)
-  );
+  return parseCredentialsMarkerKeyId(input.markerRaw ?? null) !== input.codingAgentKeyId;
 }
 function ownsExistingCredential(existing, markerRaw, markerHashes) {
   if (isConveyorOwnedCredentials(existing, markerHashes)) return true;
@@ -2756,11 +2745,6 @@ function ownsExistingCredential(existing, markerRaw, markerHashes) {
   const refreshToken = typeof existing.refreshToken === "string" ? existing.refreshToken : null;
   return credentialMarkerMatches(markerRaw, accessToken, refreshToken);
 }
-function cliRefreshedSameKey(input, material, existing, markerRaw) {
-  if (!material.refresh || !input.codingAgentKeyId) return false;
-  if (parseCredentialsMarkerKeyId(markerRaw) !== input.codingAgentKeyId) return false;
-  return hasStableRefreshOwnership(existing, markerRaw) && existing.accessToken !== material.access;
-}
 function planCredentialsWrite(input) {
   if (!input.isCloud) return { action: "skip", reason: "not-cloud" };
   const material = parseClaudeOauthEnv(input.oauthBlob) ?? (input.token ? { access: input.token } : null);
@@ -2772,7 +2756,6 @@ function planCredentialsWrite(input) {
     material.access,
     input.now,
     markerHashes[0] ?? null,
-    material.refresh,
     input.codingAgentKeyId
   );
   const existing = parseClaudeAiOauth(input.existingRaw);
@@ -2780,13 +2763,10 @@ function planCredentialsWrite(input) {
   if (!ownsExistingCredential(existing, markerRaw, markerHashes)) {
     return { action: "skip", reason: "foreign-credentials" };
   }
-  if (cliRefreshedSameKey(input, material, existing, markerRaw)) {
-    return { action: "skip", reason: "current" };
-  }
   if (!isCurrentCredential(existing, material, input.now)) {
     return { action: "write", contents, marker };
   }
-  return needsMarkerUpgrade(input, material) ? { action: "mark", marker } : { action: "skip", reason: "current" };
+  return needsMarkerUpgrade(input) ? { action: "mark", marker } : { action: "skip", reason: "current" };
 }
 
 // src/harness/pty/credentials.ts
@@ -7170,14 +7150,16 @@ ${context.projectDescription}` : "";
     parts.push(`
 ## Project: ${context.projectName}${descLine}`);
   }
-  if (context.subProject?.rootPath) {
+  const scopePaths = context.subProject ? subProjectScopePaths(context.subProject) : [];
+  if (context.subProject && scopePaths.length > 0) {
+    const folders = scopePaths.map((path) => `\`${path}\``).join(", ");
     parts.push(
       `
 ## Sub-project scope: ${context.subProject.name}`,
-      `This task belongs to the "${context.subProject.name}" sub-project, which owns \`${context.subProject.rootPath}\`.`,
+      `This task belongs to the "${context.subProject.name}" sub-project, which allows changes under ${folders}.`,
       `- Read and reference the whole repository freely.`,
-      `- Substantive code changes belong under \`${context.subProject.rootPath}\`. Trivial wiring elsewhere (exports, route registration) is fine when required.`,
-      `- If the work genuinely requires substantive changes outside that folder, do NOT make them here \u2014 create a task on the parent project board (as part of a pack with this one) describing the needed change.`
+      `- Substantive code changes belong under ${folders}. Trivial wiring elsewhere (exports, route registration) is fine when required.`,
+      `- If the work genuinely requires substantive changes outside those folders, do NOT make them here \u2014 create a task on the parent project board (as part of a pack with this one) describing the needed change.`
     );
   }
   if (context.description) {
@@ -14738,127 +14720,12 @@ var QueryBridge = class {
 // src/execution/usage-sampler.ts
 import { existsSync as existsSync2 } from "fs";
 
-// src/usage/reset-parse.ts
-var MONTHS = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
-function tzOffsetMs(utcMs, tz) {
-  const dtf = new Intl.DateTimeFormat("en-US", {
-    timeZone: tz,
-    hour12: false,
-    year: "numeric",
-    month: "2-digit",
-    day: "2-digit",
-    hour: "2-digit",
-    minute: "2-digit",
-    second: "2-digit"
-  });
-  const map = {};
-  for (const part of dtf.formatToParts(new Date(utcMs))) {
-    if (part.type !== "literal") map[part.type] = part.value;
-  }
-  const hour = map.hour === "24" ? 0 : Number(map.hour);
-  const asUtc = Date.UTC(
-    Number(map.year),
-    Number(map.month) - 1,
-    Number(map.day),
-    hour,
-    Number(map.minute),
-    Number(map.second)
-  );
-  return asUtc - utcMs;
-}
-function zonedWallClockToUtc(y, mo, d, h, mi, tz) {
-  if (tz === "UTC" || tz === "Etc/UTC") return Date.UTC(y, mo, d, h, mi);
-  const naiveUtc = Date.UTC(y, mo, d, h, mi);
-  const firstGuess = naiveUtc - tzOffsetMs(naiveUtc, tz);
-  return naiveUtc - tzOffsetMs(firstGuess, tz);
-}
-function localTimeZone() {
-  try {
-    return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
-  } catch {
-    return "UTC";
-  }
-}
-function parseResetInstant(rowText, now, defaultTz = localTimeZone()) {
-  const m = /resets\s+(?:by\s+)?(?:([a-z]{3})\s+(\d{1,2})(?:,|\s+at)?\s+)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\(([^)]+)\))?/i.exec(
-    rowText
-  );
-  if (!m) return null;
-  const [, monStr, dayStr, hourStr, minStr, meridiem, tzRaw] = m;
-  const tz = tzRaw ? tzRaw.trim() : defaultTz;
-  let hour = Number(hourStr) % 12;
-  if (/pm/i.test(meridiem)) hour += 12;
-  const minute = minStr ? Number(minStr) : 0;
-  const nowDate = new Date(now);
-  try {
-    if (monStr && dayStr) {
-      const month = MONTHS.indexOf(monStr.toLowerCase());
-      if (month < 0) return null;
-      const day = Number(dayStr);
-      let utc2 = zonedWallClockToUtc(nowDate.getUTCFullYear(), month, day, hour, minute, tz);
-      if (utc2 < now - 24 * 60 * 60 * 1e3) {
-        utc2 = zonedWallClockToUtc(nowDate.getUTCFullYear() + 1, month, day, hour, minute, tz);
-      }
-      return new Date(utc2).toISOString();
-    }
-    let utc = zonedWallClockToUtc(
-      nowDate.getUTCFullYear(),
-      nowDate.getUTCMonth(),
-      nowDate.getUTCDate(),
-      hour,
-      minute,
-      tz
-    );
-    if (utc <= now) {
-      utc = zonedWallClockToUtc(
-        nowDate.getUTCFullYear(),
-        nowDate.getUTCMonth(),
-        nowDate.getUTCDate() + 1,
-        hour,
-        minute,
-        tz
-      );
-    }
-    return new Date(utc).toISOString();
-  } catch {
-    return null;
-  }
-}
-
-// src/usage/parse-usage.ts
-var ESC = "\\u001b";
-var ANSI_CSI = new RegExp(`${ESC}\\[[0-9;?]*[ -/]*[@-~]`, "g");
-var ANSI_OSC = new RegExp(`${ESC}\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\)`, "g");
-var BAR_GLYPHS = /[─-▟]/g;
-function normalizeUsageText(stdout) {
-  return stdout.replace(ANSI_CSI, "").replace(ANSI_OSC, "").replace(BAR_GLYPHS, " ").replace(/\r/g, "");
-}
-function parseUsageGauges(stdout, now = Date.now(), defaultTz) {
-  const text = normalizeUsageText(stdout);
-  const rows = [
-    ...text.matchAll(
-      /Current (session|week)\s*(\([^)\n]*\))?[^%\n]*?(\d+(?:\.\d+)?)\s*%(?:\s*used)?([^\n]*?)(?=Current\s+(?:session|week)\b|\n|$)/gi
-    )
-  ];
-  const gauges = rows.map((m) => ({
-    label: `Current ${m[1].toLowerCase()}${m[2] ? ` ${m[2]}` : ""}`,
-    utilization: Number(m[3]) / 100,
-    resetsAt: parseResetInstant(m[4] ?? "", now, defaultTz)
-  }));
-  const session = gauges.find((g) => g.label.startsWith("Current session"));
-  const weekly = gauges.filter((g) => g.label.startsWith("Current week"));
-  const weeklyResets = weekly.map((g) => g.resetsAt).filter((r) => r !== null);
-  return {
-    sessionUsage: session ? session.utilization : null,
-    weeklyUsage: weekly.length ? Math.max(...weekly.map((g) => g.utilization)) : null,
-    sessionResetsAt: session?.resetsAt ?? null,
-    // Soonest weekly reset (all weekly rows share one instant in practice).
-    weeklyResetsAt: weeklyResets.length ? new Date(Math.min(...weeklyResets.map((r) => new Date(r).getTime()))).toISOString() : null,
-    gauges
-  };
-}
+// src/usage/isolated-probe.ts
+import { mkdtemp as mkdtemp3, writeFile as writeFile10, copyFile, rm as rm5 } from "fs/promises";
+import { join as join21 } from "path";
 
 // src/usage/run-probe.ts
+var logger8 = createServiceLogger("usage-probe");
 var PROBE_TIMEOUT_MS = 3e4;
 var FIRST_SEND_MS = 5e3;
 var RESEND_INTERVAL_MS = 4e3;
@@ -14875,7 +14742,8 @@ function buildProbeEnv(env = process.env) {
   return clean;
 }
 function panelRendering(buf) {
-  return /Current session/i.test(buf) && /%/.test(buf);
+  const text = flattenTerminalText(buf);
+  return /Current\s*session/i.test(text) && /%/.test(text);
 }
 var UsageProbeRun = class {
   constructor(resolve, timing) {
@@ -14899,7 +14767,7 @@ var UsageProbeRun = class {
       this.childExited = true;
       this.finishBestEffort();
     });
-    this.hardTimer = setTimeout(() => this.finishBestEffort(), timeoutMs);
+    this.hardTimer = setTimeout(() => this.finishOnTimeout(), timeoutMs);
     this.hardTimer.unref?.();
     const first = setTimeout(() => this.trySend(), this.timing.firstSendMs);
     first.unref?.();
@@ -14919,6 +14787,15 @@ var UsageProbeRun = class {
     if (this.settleTimer || !panelRendering(this.buf)) return;
     this.settleTimer = setTimeout(() => this.finish(this.buf), this.timing.settleMs);
   }
+  finishOnTimeout() {
+    if (!this.settled && !panelRendering(this.buf)) {
+      logger8.info("usage probe timed out before the panel rendered", {
+        bufferLength: this.buf.length,
+        sends: this.sends
+      });
+    }
+    this.finishBestEffort();
+  }
   finishBestEffort() {
     this.finish(panelRendering(this.buf) ? this.buf : cleanTerminalOutput(this.buf, 500));
   }
@@ -14974,62 +14851,210 @@ async function runUsageProbe(deps = {}) {
   });
 }
 
+// src/usage/isolated-probe.ts
+var logger9 = createServiceLogger("isolated-probe");
+async function probeUsageIsolated(token, opts = {}) {
+  let dir = null;
+  try {
+    dir = await mkdtemp3(join21(sessionTempBase(), "conveyor-usage-"));
+    const credentials = buildSynthesizedCredentials(token, opts.now ?? Date.now());
+    await writeFile10(join21(dir, ".credentials.json"), credentials, {
+      encoding: "utf8",
+      mode: 384
+    });
+    await copyFile(claudeJsonPath(), join21(dir, ".claude.json")).catch(() => {
+    });
+    return await runUsageProbe({ cwd: opts.cwd, env: { ...process.env, CLAUDE_CONFIG_DIR: dir } });
+  } catch (error) {
+    logger9.info("isolated usage probe failed", {
+      error: error instanceof Error ? error.message : String(error)
+    });
+    return "";
+  } finally {
+    if (dir) await rm5(dir, { recursive: true, force: true }).catch(() => {
+    });
+  }
+}
+
+// src/usage/reset-parse.ts
+var MONTHS = ["jan", "feb", "mar", "apr", "may", "jun", "jul", "aug", "sep", "oct", "nov", "dec"];
+function tzOffsetMs(utcMs, tz) {
+  const dtf = new Intl.DateTimeFormat("en-US", {
+    timeZone: tz,
+    hour12: false,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit"
+  });
+  const map = {};
+  for (const part of dtf.formatToParts(new Date(utcMs))) {
+    if (part.type !== "literal") map[part.type] = part.value;
+  }
+  const hour = map.hour === "24" ? 0 : Number(map.hour);
+  const asUtc = Date.UTC(
+    Number(map.year),
+    Number(map.month) - 1,
+    Number(map.day),
+    hour,
+    Number(map.minute),
+    Number(map.second)
+  );
+  return asUtc - utcMs;
+}
+function zonedWallClockToUtc(y, mo, d, h, mi, tz) {
+  if (tz === "UTC" || tz === "Etc/UTC") return Date.UTC(y, mo, d, h, mi);
+  const naiveUtc = Date.UTC(y, mo, d, h, mi);
+  const firstGuess = naiveUtc - tzOffsetMs(naiveUtc, tz);
+  return naiveUtc - tzOffsetMs(firstGuess, tz);
+}
+function localTimeZone() {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC";
+  } catch {
+    return "UTC";
+  }
+}
+function parseResetInstant(rowText, now, defaultTz = localTimeZone()) {
+  const m = /resets\s*(?:by\s*)?(?:([a-z]{3})\s*(\d{1,2})(?:,|\s*at)?\s*)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)(?:\s*\(([^)]+)\))?/i.exec(
+    rowText
+  );
+  if (!m) return null;
+  const [, monStr, dayStr, hourStr, minStr, meridiem, tzRaw] = m;
+  const tz = tzRaw ? tzRaw.trim() : defaultTz;
+  let hour = Number(hourStr) % 12;
+  if (/pm/i.test(meridiem)) hour += 12;
+  const minute = minStr ? Number(minStr) : 0;
+  const nowDate = new Date(now);
+  try {
+    if (monStr && dayStr) {
+      const month = MONTHS.indexOf(monStr.toLowerCase());
+      if (month < 0) return null;
+      const day = Number(dayStr);
+      let utc2 = zonedWallClockToUtc(nowDate.getUTCFullYear(), month, day, hour, minute, tz);
+      if (utc2 < now - 24 * 60 * 60 * 1e3) {
+        utc2 = zonedWallClockToUtc(nowDate.getUTCFullYear() + 1, month, day, hour, minute, tz);
+      }
+      return new Date(utc2).toISOString();
+    }
+    let utc = zonedWallClockToUtc(
+      nowDate.getUTCFullYear(),
+      nowDate.getUTCMonth(),
+      nowDate.getUTCDate(),
+      hour,
+      minute,
+      tz
+    );
+    if (utc <= now) {
+      utc = zonedWallClockToUtc(
+        nowDate.getUTCFullYear(),
+        nowDate.getUTCMonth(),
+        nowDate.getUTCDate() + 1,
+        hour,
+        minute,
+        tz
+      );
+    }
+    return new Date(utc).toISOString();
+  } catch {
+    return null;
+  }
+}
+
+// src/usage/parse-usage.ts
+var BAR_GLYPHS = /[─-▟]/g;
+function normalizeUsageText(stdout) {
+  return flattenTerminalText(stdout).replace(BAR_GLYPHS, " ").replace(/[\r\n]+/g, " ");
+}
+function parseUsageGauges(stdout, now = Date.now(), defaultTz) {
+  const text = normalizeUsageText(stdout);
+  const rows = [
+    ...text.matchAll(
+      /Current\s*(session|week)\s*(\([^)\n]*\))?[^%\n]*?(\d+(?:\.\d+)?)\s*%(?:\s*used)?([^\n]*?)(?=Current\s*(?:session|week)|\n|$)/gi
+    )
+  ];
+  const gauges = rows.map((m) => ({
+    label: `Current ${m[1].toLowerCase()}${m[2] ? ` ${m[2]}` : ""}`,
+    utilization: Number(m[3]) / 100,
+    resetsAt: parseResetInstant(m[4] ?? "", now, defaultTz)
+  }));
+  const session = gauges.find((g) => g.label.startsWith("Current session"));
+  const weekly = gauges.filter((g) => g.label.startsWith("Current week"));
+  const weeklyResets = weekly.map((g) => g.resetsAt).filter((r) => r !== null);
+  return {
+    sessionUsage: session ? session.utilization : null,
+    weeklyUsage: weekly.length ? Math.max(...weekly.map((g) => g.utilization)) : null,
+    sessionResetsAt: session?.resetsAt ?? null,
+    // Soonest weekly reset (all weekly rows share one instant in practice).
+    weeklyResetsAt: weeklyResets.length ? new Date(Math.min(...weeklyResets.map((r) => new Date(r).getTime()))).toISOString() : null,
+    gauges
+  };
+}
+
 // src/execution/usage-sampler.ts
-var logger8 = createServiceLogger("usage-sampler");
+var logger10 = createServiceLogger("usage-sampler");
 var NO_SAMPLES = { samples: [], unmeasurable: null };
 function usesNativeUsageReporting(env = process.env) {
   return env.CONVEYOR_TUI === "codex";
 }
-function isAttributable(identity, sessionToken) {
+function isAttributable(identity) {
   if (!identity) return { ok: true };
   if (identity.hasRefreshToken && !identity.isConveyorOwned) {
     return { ok: false, reason: "manual-login-credentials" };
   }
-  if (!(identity.hasRefreshToken && identity.isConveyorOwned) && sessionToken && identity.accessToken && identity.accessToken !== sessionToken) {
-    return { ok: false, reason: "credentials-token-mismatch" };
-  }
   return { ok: true };
 }
-async function sampleKeyUsage(token, probe = () => runUsageProbe(), hasSubscriptionCredentials = () => existsSync2(claudeCredentialsPath()), readIdentity = readCredentialsIdentity) {
-  if (!token && !hasSubscriptionCredentials()) return NO_SAMPLES;
+function samplesFromPanel(stdout) {
+  const { sessionUsage, weeklyUsage, sessionResetsAt, weeklyResetsAt, gauges } = parseUsageGauges(stdout);
+  const samples = [];
+  if (sessionUsage !== null) {
+    samples.push({
+      rateLimitType: "five_hour",
+      utilization: sessionUsage,
+      status: "allowed",
+      resetsAt: sessionResetsAt,
+      gauges
+    });
+  }
+  if (weeklyUsage !== null) {
+    samples.push({
+      rateLimitType: "seven_day",
+      utilization: weeklyUsage,
+      status: "allowed",
+      resetsAt: weeklyResetsAt,
+      gauges
+    });
+  }
+  if (samples.length === 0) {
+    logger10.info("usage sample produced no gauges", {
+      stdoutLength: stdout.length,
+      stdoutHead: stdout.slice(0, 200).replaceAll("\n", " ")
+    });
+  }
+  return samples;
+}
+async function sampleKeyUsage(opts = {}) {
+  const { token, cwd } = opts;
+  const hasCredentialsFile = opts.hasCredentialsFile ?? (() => existsSync2(claudeCredentialsPath()));
+  if (!token && !hasCredentialsFile()) return NO_SAMPLES;
   try {
-    const attributable = isAttributable(await readIdentity(), token);
+    if (token) {
+      const probeToken = opts.probeToken ?? ((own) => probeUsageIsolated(own, { cwd }));
+      return { samples: samplesFromPanel(await probeToken(token)), unmeasurable: null };
+    }
+    const attributable = isAttributable(await (opts.readIdentity ?? readCredentialsIdentity)());
     if (!attributable.ok) {
-      logger8.info("usage sample skipped \u2014 credentials not attributable to this session's key", {
+      logger10.info("usage sample skipped \u2014 credentials not attributable to this session's key", {
         reason: attributable.reason
       });
       return { samples: [], unmeasurable: { reason: attributable.reason ?? "unattributable" } };
     }
-    const stdout = await probe();
-    const { sessionUsage, weeklyUsage, sessionResetsAt, weeklyResetsAt, gauges } = parseUsageGauges(stdout);
-    const samples = [];
-    if (sessionUsage !== null) {
-      samples.push({
-        rateLimitType: "five_hour",
-        utilization: sessionUsage,
-        status: "allowed",
-        resetsAt: sessionResetsAt,
-        gauges
-      });
-    }
-    if (weeklyUsage !== null) {
-      samples.push({
-        rateLimitType: "seven_day",
-        utilization: weeklyUsage,
-        status: "allowed",
-        resetsAt: weeklyResetsAt,
-        gauges
-      });
-    }
-    if (samples.length === 0) {
-      logger8.info("usage sample produced no gauges", {
-        stdoutLength: stdout.length,
-        stdoutHead: stdout.slice(0, 200).replaceAll("\n", " ")
-      });
-    }
-    return { samples, unmeasurable: null };
+    const probeFile = opts.probeCredentialsFile ?? (() => runUsageProbe({ cwd }));
+    return { samples: samplesFromPanel(await probeFile()), unmeasurable: null };
   } catch (error) {
-    logger8.info("usage sample failed", {
+    logger10.info("usage sample failed", {
       error: error instanceof Error ? error.message : String(error)
     });
     return NO_SAMPLES;
@@ -16398,10 +16423,10 @@ var SessionRunner = class _SessionRunner {
   async sampleAndReportKeyUsage() {
     if (this.stopped || usesNativeUsageReporting()) return;
     const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
-    const { samples, unmeasurable } = await sampleKeyUsage(
-      process.env.CLAUDE_CODE_OAUTH_TOKEN,
-      () => runUsageProbe({ cwd: this.config.workspaceDir })
-    );
+    const { samples, unmeasurable } = await sampleKeyUsage({
+      token: process.env.CLAUDE_CODE_OAUTH_TOKEN,
+      cwd: this.config.workspaceDir
+    });
     if (unmeasurable) {
       this.connection.sendEvent(buildUnmeasurableEvent(unmeasurable.reason, codingAgentKeyId));
       return;
@@ -16928,8 +16953,6 @@ function unshallowRepo(workspaceDir) {
 
 export {
   isPermissionDeniedError,
-  buildSynthesizedCredentials,
-  claudeJsonPath,
   PtyHarness,
   resolveTuiKindFromEnv,
   resolveTuiAdapter,
@@ -16938,8 +16961,8 @@ export {
   buildProjectTools,
   resolvePlaywrightMcpServer,
   resolveSessionStart,
+  probeUsageIsolated,
   parseUsageGauges,
-  runUsageProbe,
   usesNativeUsageReporting,
   sampleKeyUsage,
   buildRateLimitEvents,

package/dist/{chunk-EKTPDG3G.js → chunk-SXZS2R52.js}

@@ -46,9 +46,32 @@ function spawnOptionsFingerprint(input) {
   if (input.effort) parts.push(input.effort);
   return JSON.stringify(parts);
 }
-var ANSI_CSI = new RegExp(`${String.fromCharCode(27)}\\[[0-9;?]*[ -/]*[@-~]`, "g");
+var ESC = String.fromCharCode(27);
+var ANSI_CSI = new RegExp(`${ESC}\\[([0-9;?]*)([ -/]*)([@-~])`, "g");
+var ANSI_OSC = new RegExp(`${ESC}\\][^\\u0007${ESC}]*(?:\\u0007|${ESC}\\\\)`, "g");
+var MAX_CURSOR_FORWARD = 300;
+function flattenTerminalText(raw) {
+  return raw.replace(ANSI_OSC, "").replace(ANSI_CSI, (_seq, params, inter, final) => {
+    if (inter || params.startsWith("?")) return "";
+    switch (final) {
+      case "C":
+        return " ".repeat(Math.min(Math.max(Number(params) || 1, 1), MAX_CURSOR_FORWARD));
+      case "G":
+        return " ";
+      case "A":
+      case "B":
+      case "E":
+      case "F":
+      case "H":
+      case "f":
+        return "\n";
+      default:
+        return "";
+    }
+  });
+}
 function cleanTerminalOutput(raw, maxChars = 1200) {
-  const noAnsi = raw.replace(ANSI_CSI, "");
+  const noAnsi = flattenTerminalText(raw);
   let out = "";
   for (const ch of noAnsi) {
     const code = ch.charCodeAt(0);
@@ -215,6 +238,7 @@ function inheritedEnv(socketPath) {
   if (env.CLAUDE_CODE_OAUTH_TOKEN) {
     delete env.ANTHROPIC_API_KEY;
   }
+  delete env.CONVEYOR_CLAUDE_OAUTH;
   if (ghHostsManagedByConveyor() && env.CONVEYOR_KEEP_GH_TOKEN_ENV !== "1") {
     delete env.GH_TOKEN;
     delete env.GITHUB_TOKEN;
@@ -272,6 +296,7 @@ export {
   resolveClaudeBinary,
   buildSpawnArgs,
   spawnOptionsFingerprint,
+  flattenTerminalText,
   cleanTerminalOutput,
   buildExitErrors,
   MAX_DIAGNOSTIC_OUTPUT,

package/dist/cli.js

@@ -7,33 +7,30 @@ import {
   WorkspaceCommandSupervisor,
   startWorkspaceCommandsAfterConnect,
   stopWorkspaceCommands
-} from "./chunk-UL6DAPTX.js";
+} from "./chunk-K35YJK2U.js";
 import {
   PtyHarness,
   SessionRunner,
   buildProjectTools,
   buildRateLimitEvents,
-  buildSynthesizedCredentials,
   buildUnmeasurableEvent,
-  claudeJsonPath,
   getEffortOverride,
   getModelOverride,
   isPermissionDeniedError,
   parseUsageGauges,
+  probeUsageIsolated,
   resolvePlaywrightMcpServer,
   resolveSessionStart,
   resolveTuiAdapter,
   resolveTuiKindFromEnv,
-  runUsageProbe,
   sampleKeyUsage,
   usesNativeUsageReporting
-} from "./chunk-JUEHUVSD.js";
+} from "./chunk-RNE3JAF5.js";
 import "./chunk-V5WR2F2P.js";
 import {
   inheritedEnv,
-  resolvePtySpawn,
-  sessionTempBase
-} from "./chunk-EKTPDG3G.js";
+  resolvePtySpawn
+} from "./chunk-SXZS2R52.js";
 import {
   AgentConnection,
   DEFAULT_LIFECYCLE_CONFIG,
@@ -44,7 +41,7 @@ import {
   createServiceLogger,
   loadAndAnnotateDiscoveredPorts,
   loadConveyorConfig
-} from "./chunk-4RE6G2DZ.js";
+} from "./chunk-O3MXZHIS.js";
 import "./chunk-VIUZS7V4.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-372R6E4C.js";
@@ -55,7 +52,7 @@ import "./chunk-6Q6LQBWO.js";
 
 // src/cli.ts
 import { readFileSync } from "fs";
-import { join as join2, dirname } from "path";
+import { join, dirname } from "path";
 import { fileURLToPath } from "url";
 
 // src/utils/session-identity.ts
@@ -238,10 +235,10 @@ var ProjectSessionRunner = class {
   async sampleAndReportKeyUsage() {
     if (this.stopped || usesNativeUsageReporting()) return;
     const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
-    const { samples, unmeasurable } = await sampleKeyUsage(
-      process.env.CLAUDE_CODE_OAUTH_TOKEN,
-      () => runUsageProbe({ cwd: this.config.workspaceDir })
-    );
+    const { samples, unmeasurable } = await sampleKeyUsage({
+      token: process.env.CLAUDE_CODE_OAUTH_TOKEN,
+      cwd: this.config.workspaceDir
+    });
     if (unmeasurable) {
       this.connection.sendEvent(buildUnmeasurableEvent(unmeasurable.reason, codingAgentKeyId));
       return;
@@ -259,8 +256,6 @@ var ProjectSessionRunner = class {
 };
 
 // src/usage/multi-key-probe.ts
-import { mkdtemp, writeFile, copyFile, rm } from "fs/promises";
-import { join } from "path";
 var logger = createServiceLogger("multi-key-probe");
 function gaugesToSamples(stdout) {
   const { sessionUsage, weeklyUsage, sessionResetsAt, weeklyResetsAt, gauges } = parseUsageGauges(stdout);
@@ -285,30 +280,9 @@ function gaugesToSamples(stdout) {
   }
   return samples;
 }
-async function isolatedProbe(token, now, cwd) {
-  let dir = null;
-  try {
-    dir = await mkdtemp(join(sessionTempBase(), "conveyor-usage-"));
-    await writeFile(join(dir, ".credentials.json"), buildSynthesizedCredentials(token, now), {
-      encoding: "utf8",
-      mode: 384
-    });
-    await copyFile(claudeJsonPath(), join(dir, ".claude.json")).catch(() => {
-    });
-    return await runUsageProbe({ cwd, env: { ...process.env, CLAUDE_CONFIG_DIR: dir } });
-  } catch (error) {
-    logger.info("isolated usage probe failed", {
-      error: error instanceof Error ? error.message : String(error)
-    });
-    return "";
-  } finally {
-    if (dir) await rm(dir, { recursive: true, force: true }).catch(() => {
-    });
-  }
-}
 async function probeKeysUsage(keys, deps = {}) {
   const now = deps.now ?? Date.now;
-  const probeOne = deps.probeOne ?? ((token) => isolatedProbe(token, now(), deps.cwd));
+  const probeOne = deps.probeOne ?? ((token) => probeUsageIsolated(token, { now: now(), cwd: deps.cwd }));
   const results = [];
   for (const key of keys) {
     if (!key.oauthToken) continue;
@@ -582,10 +556,10 @@ var AdhocSessionRunner = class {
   async sampleAndReportOwnKey() {
     if (this.stopped || usesNativeUsageReporting()) return;
     const codingAgentKeyId = process.env.CONVEYOR_CODING_AGENT_KEY_ID;
-    const { samples, unmeasurable } = await sampleKeyUsage(
-      process.env.CLAUDE_CODE_OAUTH_TOKEN,
-      () => runUsageProbe({ cwd: this.config.workspaceDir })
-    );
+    const { samples, unmeasurable } = await sampleKeyUsage({
+      token: process.env.CLAUDE_CODE_OAUTH_TOKEN,
+      cwd: this.config.workspaceDir
+    });
     if (unmeasurable) {
       this.connection.sendEvent(buildUnmeasurableEvent(unmeasurable.reason, codingAgentKeyId));
       return;
@@ -1212,7 +1186,7 @@ function wireSpawnChildren(mode, connection, supervisors, logger7) {
 
 // src/cli.ts
 if (process.argv[2] === "boot") {
-  const { runBoot } = await import("./boot-KDC4OLVL.js");
+  const { runBoot } = await import("./boot-GD5XMLPS.js");
   process.exit(await runBoot(process.argv.slice(3)));
 }
 if (isLegacyEntrypointLaunch(process.env)) {
@@ -1222,7 +1196,7 @@ if (isLegacyEntrypointLaunch(process.env)) {
 }
 if (process.argv.includes("--version")) {
   const __dirname = dirname(fileURLToPath(import.meta.url));
-  const pkgPath = join2(__dirname, "..", "package.json");
+  const pkgPath = join(__dirname, "..", "package.json");
   const pkg = JSON.parse(readFileSync(pkgPath, "utf-8"));
   process.stdout.write(pkg.version + "\n");
   process.exit(0);
@@ -1281,7 +1255,7 @@ process.on("unhandledRejection", (reason) => {
   process.exit(1);
 });
 if (process.env.CONVEYOR_MODE === "workbench") {
-  const { startWorkbenchServer } = await import("./server-GJZKUVBE.js");
+  const { startWorkbenchServer } = await import("./server-FPDS4CT5.js");
   const { oomWatchdogOptionsFromEnv } = await import("./oom-watchdog-PAC5OJJG.js");
   const { DEFAULT_WORKBENCH_PORT } = await import("./protocol-QBCYO4GI.js");
   const port = Number(process.env.CONVEYOR_WORKBENCH_PORT) || DEFAULT_WORKBENCH_PORT;
@@ -1291,7 +1265,7 @@ if (process.env.CONVEYOR_MODE === "workbench") {
     process.exit(1);
   }
   const pkgDir = dirname(fileURLToPath(import.meta.url));
-  const pkg = JSON.parse(readFileSync(join2(pkgDir, "..", "package.json"), "utf-8"));
+  const pkg = JSON.parse(readFileSync(join(pkgDir, "..", "package.json"), "utf-8"));
   const handle = await startWorkbenchServer({
     port,
     token,
@@ -1423,7 +1397,7 @@ if (!RUNNER_MODES.includes(CONVEYOR_MODE)) {
   process.exit(1);
 }
 if (CONVEYOR_MODE === "serving") {
-  const { runServingSession } = await import("./serve-boot-H72OIMFS.js");
+  const { runServingSession } = await import("./serve-boot-4QBD4LW4.js");
   exitContext.runnerMode = "serving";
   exitContext.sessionId = process.env.CONVEYOR_SESSION_ID ?? exitContext.sessionId;
   const outcome = await runServingSession({

package/dist/index.js

@@ -1,9 +1,9 @@
 import {
   SessionRunner,
   unshallowRepo
-} from "./chunk-JUEHUVSD.js";
+} from "./chunk-RNE3JAF5.js";
 import "./chunk-V5WR2F2P.js";
-import "./chunk-EKTPDG3G.js";
+import "./chunk-SXZS2R52.js";
 import {
   AgentConnection,
   GIT_TIMEOUT_MS,
@@ -17,7 +17,7 @@ import {
   stageAndCommit,
   updateRemoteToken,
   workspacePathExists
-} from "./chunk-4RE6G2DZ.js";
+} from "./chunk-O3MXZHIS.js";
 import "./chunk-VIUZS7V4.js";
 import {
   runAuthTokenCommand,

package/dist/{serve-boot-H72OIMFS.js → serve-boot-4QBD4LW4.js}

@@ -1,6 +1,6 @@
 import {
   WorkspaceCommandSupervisor
-} from "./chunk-UL6DAPTX.js";
+} from "./chunk-K35YJK2U.js";
 import {
   AgentConnection,
   DEFAULT_LIFECYCLE_CONFIG,
@@ -11,7 +11,7 @@ import {
   ensureOnTaskBranch,
   loadAndAnnotateDiscoveredPorts,
   loadConveyorConfig
-} from "./chunk-4RE6G2DZ.js";
+} from "./chunk-O3MXZHIS.js";
 import "./chunk-VIUZS7V4.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-IA45XHOA.js";

package/dist/{server-GJZKUVBE.js → server-FPDS4CT5.js}

@@ -1,7 +1,7 @@
 import {
   startWorkbenchServer
-} from "./chunk-F7XHSNU7.js";
-import "./chunk-EKTPDG3G.js";
+} from "./chunk-ATYCG6MT.js";
+import "./chunk-SXZS2R52.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-372R6E4C.js";
 import "./chunk-SQM2BQ7H.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rallycry/conveyor-agent",
-  "version": "11.0.48",
+  "version": "11.0.49",
   "description": "Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.",
   "keywords": [
     "agent",
@@ -34,7 +34,7 @@
     "test:watch": "vitest",
     "lint": "oxlint -c ../../.oxlintrc.json src",
     "lint:fix": "oxlint -c ../../.oxlintrc.json --fix src",
-    "typecheck": "tsgo --noEmit"
+    "typecheck": "bash ../../scripts/typecheck.sh"
   },
   "dependencies": {
     "@anthropic-ai/claude-agent-sdk": "^0.3.284",