@rallycry/conveyor-agent 11.0.5 → 11.0.6

package/dist/{chunk-J2NPWBVZ.js → chunk-GUYMLASA.js}

@@ -57,7 +57,7 @@ import {
   statWorkspacePath,
   updateRemoteToken,
   verifyGitCredential
-} from "./chunk-SLUBOIYE.js";
+} from "./chunk-HFUVAHII.js";
 import {
   registerBootMilestoneSocketFallback,
   reportBootMilestone
@@ -4640,6 +4640,12 @@ var PtySession = class {
   // synthetic id so the card flips to answered.
   pendingSyntheticQuestionIds = [];
   questionResultRemap = /* @__PURE__ */ new Map();
+  // An AskUserQuestion questionnaire is parked on screen (PreToolUse hook
+  // fired, no PostToolUse envelope yet). While set the parked process must
+  // not be reused: feeding follow-up prompt bytes into the live dialog would
+  // type chat text into the questionnaire. Fail-safe — a stale flag only
+  // costs a teardown + respawn (`--resume` recovers the conversation).
+  questionnairePending = false;
   // Per-turn state: the prompt to feed and the per-turn options subset. Both
   // start from the constructor args (turn 1) and are replaced by beginTurn.
   turnPrompt;
@@ -4732,7 +4738,9 @@ var PtySession = class {
    */
   canReuse(resume, fingerprint) {
     const resumeMatches = resume === void 0 ? this.reportedOpenCodeId !== null : resume === this.sessionUuid;
-    return !this._toreDown && !this.exited && this.activeQueue === null && resumeMatches && fingerprint === this.spawnFingerprint;
+    return !this._toreDown && !this.exited && this.activeQueue === null && // A parked questionnaire owns the terminal — a fed prompt would type
+    // into the dialog. Force teardown + respawn instead.
+    !this.questionnairePending && resumeMatches && fingerprint === this.spawnFingerprint;
   }
   get hookSocketPath() {
     return this.socket ? this.socket.socketPath : null;
@@ -4807,6 +4815,7 @@ var PtySession = class {
     this.deliveredTexts = [];
     this.disarmSubmitNudge();
     this.disarmPlanDialogAutoAccept();
+    this.questionnairePending = false;
     this.closeSyntheticQuestionCards();
   }
   /**
@@ -5116,6 +5125,7 @@ var PtySession = class {
   async teardown() {
     if (this._toreDown) return;
     this._toreDown = true;
+    this.questionnairePending = false;
     this.disarmPlanDialogAutoAccept();
     this.disarmSubmitNudge();
     this.closeSyntheticQuestionCards();
@@ -5391,6 +5401,7 @@ var PtySession = class {
     if (this.pendingPlanApproval && progress.tool_name === "ExitPlanMode") {
       this.disarmPlanDialogAutoAccept();
     }
+    if (progress.tool_name === "AskUserQuestion") this.questionnairePending = false;
     if (this.pendingSubmitNudge) this.disarmSubmitNudge();
     this.pushEvent({
       type: "tool_progress",
@@ -5411,6 +5422,7 @@ var PtySession = class {
     if (request.tool_name === "AskUserQuestion") {
       this.disarmSubmitNudge();
       this.disarmPlanDialogAutoAccept();
+      this.questionnairePending = true;
       const questions = parseUserQuestions(request.tool_input);
       this.pushEvent({ type: "user_question", questions });
       this.emitSyntheticQuestionCard(questions);
@@ -5519,6 +5531,7 @@ var PtySession = class {
   async finalizeOnExit(exitCode) {
     this.coalescer?.flush();
     this.exited = true;
+    this.questionnairePending = false;
     if (this._toreDown) return;
     if (this.tailer) {
       this.tailer.close();
@@ -12539,16 +12552,22 @@ function questionTextFromEvent(event) {
 }
 async function armQuestionPending(host, state, event) {
   state.questionPending = true;
+  const questionText = questionTextFromEvent(event);
+  host.callbacks.onUserQuestion?.({
+    kind: "armed",
+    ...questionText === void 0 ? {} : { questionText }
+  });
   await host.connection.emitStatus(
     "waiting_for_input",
     AGENT_STATUS_REASON_USER_QUESTION,
-    questionTextFromEvent(event)
+    questionText
   );
   await host.callbacks.onStatusChange("waiting_for_input");
 }
 async function clearQuestionPending(host, state, options) {
   if (!state.questionPending) return;
   state.questionPending = false;
+  host.callbacks.onUserQuestion?.({ kind: options.emitRunning ? "answered" : "turn_ended" });
   if (options.emitRunning) {
     await host.connection.emitStatus("running");
     await host.callbacks.onStatusChange("running");
@@ -14740,6 +14759,15 @@ function findLiveChild(sources) {
 var AUTO_RUN_MODES = /* @__PURE__ */ new Set(["building", "auto", "review", "discovery", "chat"]);
 var CHILD_DEFER_RECHECK_MS = 60 * 1e3;
 var ORPHAN_WAKE_GRACE_MS = 3 * 60 * 1e3;
+var QUESTION_GRACE_MS = 10 * 6e4;
+var QUESTION_HOLD_SLACK_MS = 6e4;
+function resolveQuestionGraceMs() {
+  const raw = Number(process.env.CONVEYOR_QUESTION_GRACE_MS ?? "");
+  return Number.isFinite(raw) && raw > 0 ? raw : QUESTION_GRACE_MS;
+}
+var QUESTION_TYPING_RECENT_MS = 6e4;
+var QUESTION_TYPING_DEFER_MS = 2 * 6e4;
+var QUESTION_TIMEOUT_PROMPT = 'No one answered your clarifying questions within 10 minutes. Do this now: (1) Save your findings-so-far as the card plan (`update_task`). (2) Post the unanswered questions to chat with `post_to_chat` using `milestone: "blocked"`, stating the assumption you would make for each. (3) If you can safely proceed on your best-judgment answers, state the assumptions and continue; otherwise end your turn \u2014 answers posted in chat will be delivered when you resume.';
 var SessionRunner = class _SessionRunner {
   connection;
   mode;
@@ -14793,6 +14821,18 @@ var SessionRunner = class _SessionRunner {
   /** Guards the one-shot `agent_live` boot-milestone report — fired on the
    *  first harness event (createQueryBridge's onEvent hook). */
   agentLiveReported = false;
+  /** Epoch ms since a TUI questionnaire has been parked on a human with no
+   *  answer; null when none is pending. While set (and within the grace +
+   *  slack bound) `resolveLoopStatus` reports `waiting`, which reaches the API
+   *  as `active` and keeps the workspace activity clock fresh — the pod must
+   *  not be slept out from under an unanswered question. Deliberately KEPT
+   *  when the turn ends with the questionnaire still parked (the Shape-B
+   *  silent death this hold exists for). */
+  questionPendingSince = null;
+  /** Single-shot unref'd timer driving `handleQuestionGraceExpiry`. The
+   *  liveness hold above is bounded by timestamp arithmetic, so a lost timer
+   *  still expires the hold — it just skips the un-park injection. */
+  questionGraceTimer = null;
   constructor(config, callbacks, deps = {}) {
     this.config = config;
     this.callbacks = callbacks;
@@ -15495,6 +15535,7 @@ var SessionRunner = class _SessionRunner {
   }
   /** Inject a message (from connection callback or external source) */
   injectMessage(msg) {
+    this.clearQuestionHold();
     if (this.inputResolver) {
       const resolve = this.inputResolver;
       this.inputResolver = null;
@@ -15702,6 +15743,7 @@ var SessionRunner = class _SessionRunner {
   }
   stop() {
     this.stopped = true;
+    this.clearQuestionHold();
     this.queryBridge?.stop();
     void this.queryBridge?.dispose().catch(() => {
     });
@@ -15796,7 +15838,8 @@ var SessionRunner = class _SessionRunner {
           void this.connection.sendHeartbeat();
         }
         return this.callbacks.onEvent(event);
-      }
+      },
+      onUserQuestion: (signal) => this.handleUserQuestionSignal(signal)
     });
     bridge.isParentTask = this.fullContext?.isParentTask ?? false;
     bridge.onBackgroundTaskDone = () => this.backgroundWork.noteCompletion();
@@ -15947,8 +15990,72 @@ ${outcome.failures.join("\n")}
    */
   resolveLoopStatus() {
     if (loopStatusForRunnerStatus(this._state) === "active") return "active";
+    if (this.questionPendingSince !== null && Date.now() - this.questionPendingSince < resolveQuestionGraceMs() + QUESTION_HOLD_SLACK_MS) {
+      return "waiting";
+    }
     return this.backgroundWork.hasPending() || isHeavyGateActive() ? "waiting" : "idle";
   }
+  // ── Question grace hold ────────────────────────────────────────────
+  /**
+   * Question-pending transitions from the event loop. `armed` starts the
+   * bounded liveness hold + the grace timer; `answered` clears both.
+   * `turn_ended` — the turn's result arrived with the questionnaire still
+   * parked — deliberately KEEPS them: that is the Shape-B silent death
+   * (idle heartbeats stop bumping the activity clock and the reconciler
+   * sleeps the pod minutes later) this hold exists to prevent.
+   */
+  handleUserQuestionSignal(signal) {
+    if (signal.kind === "armed") {
+      this.questionPendingSince = Date.now();
+      this.armQuestionGraceTimer(resolveQuestionGraceMs());
+      this.refreshLoopStatus();
+    } else if (signal.kind === "answered") {
+      this.clearQuestionHold();
+    }
+  }
+  armQuestionGraceTimer(delayMs) {
+    if (this.questionGraceTimer) clearTimeout(this.questionGraceTimer);
+    this.questionGraceTimer = setTimeout(() => this.handleQuestionGraceExpiry(), delayMs);
+    this.questionGraceTimer.unref();
+  }
+  clearQuestionHold() {
+    if (this.questionGraceTimer) {
+      clearTimeout(this.questionGraceTimer);
+      this.questionGraceTimer = null;
+    }
+    if (this.questionPendingSince === null) return;
+    this.questionPendingSince = null;
+    this.refreshLoopStatus();
+  }
+  /**
+   * The grace expired with the questionnaire still unanswered. Un-park the
+   * agent by injecting the timeout prompt as a superseding system message —
+   * the proven supersede path (mid-turn: queue + queryBridge.stop(), teardown
+   * kills the parked dialog and the respawn `--resume`s cleanly; idle: the
+   * inputResolver picks it up). Never synthetic keypresses: Enter would
+   * fabricate an answer and Esc handling is CLI-version-dependent.
+   *
+   * A human actively typing in the Connected-TUI defers the expiry — they may
+   * be mid-answer, and superseding would yank the dialog out from under them.
+   */
+  handleQuestionGraceExpiry() {
+    this.questionGraceTimer = null;
+    if (this.questionPendingSince === null || this.stopped) return;
+    const lastInput = this.connection.lastPtyInputAt;
+    if (lastInput !== null && Date.now() - lastInput < QUESTION_TYPING_RECENT_MS) {
+      this.questionPendingSince = Date.now();
+      this.armQuestionGraceTimer(QUESTION_TYPING_DEFER_MS);
+      return;
+    }
+    process.stderr.write(
+      "[conveyor-agent] Question grace expired with no answer \u2014 un-parking the agent\n"
+    );
+    this.injectMessage({
+      content: QUESTION_TIMEOUT_PROMPT,
+      userId: "system",
+      source: "question_timeout"
+    });
+  }
   /** Mirror the resolved status into the loop-lag buffer so the starvation-proof
    *  heartbeat worker reports it too. Returns what it wrote. */
   refreshLoopStatus() {
@@ -15977,6 +16084,7 @@ ${outcome.failures.join("\n")}
     process.stderr.write(`[conveyor-agent] Shutdown: reason=${finalState}
 `);
     this.connection.sendEvent({ type: "shutdown", reason: finalState });
+    this.clearQuestionHold();
     this.portDiscovery.stop();
     this.backgroundWork.clear();
     this.loopLag.stop();

package/dist/{chunk-SLUBOIYE.js → chunk-HFUVAHII.js}

@@ -287,6 +287,10 @@ var AgentConnection = class _AgentConnection {
   // PTY relay (S5 terminal). Single-slot callbacks, set per PtySession run.
   ptyInputCallback = null;
   ptyResizeCallback = null;
+  /** Epoch ms of the last relayed keystroke, or null before any input. The
+   *  question-grace expiry reads it to defer un-parking while a human is
+   *  actively typing into the Connected-TUI (they may be mid-answer). */
+  _lastPtyInputAt = null;
   constructor(config) {
     this.config = config;
   }
@@ -475,6 +479,7 @@ var AgentConnection = class _AgentConnection {
       });
       this.socket.on("pty:input", (data) => {
         if (data.sessionId && data.sessionId !== this.config.sessionId) return;
+        this._lastPtyInputAt = Date.now();
         this.ptyInputCallback?.(data.data);
       });
       this.socket.on("pty:resize", (data) => {
@@ -925,6 +930,10 @@ var AgentConnection = class _AgentConnection {
     }).catch(() => {
     });
   }
+  /** Epoch ms of the last relayed TUI keystroke, or null before any. */
+  get lastPtyInputAt() {
+    return this._lastPtyInputAt;
+  }
   /** Subscribe to relayed keystrokes. Returns an unsubscribe fn. */
   onPtyInput(handler) {
     this.ptyInputCallback = handler;

package/dist/{chunk-URYBO32C.js → chunk-UHMCBCQL.js}

@@ -5,7 +5,7 @@ import {
   readWorkspaceBytes,
   statWorkspacePath,
   workspacePathExists
-} from "./chunk-SLUBOIYE.js";
+} from "./chunk-HFUVAHII.js";
 import {
   reportBootMilestone
 } from "./chunk-GL2DIQEQ.js";

package/dist/cli.js

@@ -7,7 +7,7 @@ import {
   WorkspaceCommandSupervisor,
   startWorkspaceCommandsAfterConnect,
   stopWorkspaceCommands
-} from "./chunk-URYBO32C.js";
+} from "./chunk-UHMCBCQL.js";
 import {
   DEFAULT_SONNET_MODEL,
   PtyHarness,
@@ -27,7 +27,7 @@ import {
   resolveTuiKindFromEnv,
   runUsageProbe,
   sampleKeyUsage
-} from "./chunk-J2NPWBVZ.js";
+} from "./chunk-GUYMLASA.js";
 import "./chunk-XORJ6SII.js";
 import {
   inheritedEnv,
@@ -44,7 +44,7 @@ import {
   createServiceLogger,
   fetchBootstrap,
   loadConveyorConfig
-} from "./chunk-SLUBOIYE.js";
+} from "./chunk-HFUVAHII.js";
 import "./chunk-GL2DIQEQ.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-7P6QZHXZ.js";
@@ -1454,7 +1454,7 @@ if (!RUNNER_MODES.includes(CONVEYOR_MODE)) {
   process.exit(1);
 }
 if (CONVEYOR_MODE === "serving") {
-  const { runServingSession } = await import("./serve-boot-B4BIZMNB.js");
+  const { runServingSession } = await import("./serve-boot-IFUIGFEH.js");
   exitContext.runnerMode = "serving";
   exitContext.sessionId = process.env.CONVEYOR_SESSION_ID ?? exitContext.sessionId;
   const outcome = await runServingSession({

package/dist/index.d.ts

@@ -131,6 +131,10 @@ declare class AgentConnection {
     private earlyProbeUsage;
     private ptyInputCallback;
     private ptyResizeCallback;
+    /** Epoch ms of the last relayed keystroke, or null before any input. The
+     *  question-grace expiry reads it to defer un-parking while a human is
+     *  actively typing into the Connected-TUI (they may be mid-answer). */
+    private _lastPtyInputAt;
     constructor(config: AgentConnectionConfig);
     get sessionId(): string;
     get connected(): boolean;
@@ -282,6 +286,8 @@ declare class AgentConnection {
      * just stays on the relay transport.
      */
     reportPtyStream(port: number | null): void;
+    /** Epoch ms of the last relayed TUI keystroke, or null before any. */
+    get lastPtyInputAt(): number | null;
     /** Subscribe to relayed keystrokes. Returns an unsubscribe fn. */
     onPtyInput(handler: (data: string) => void): () => void;
     /** Subscribe to relayed (reconciled) terminal resizes. Returns an unsubscribe fn. */
@@ -729,6 +735,18 @@ declare class SessionRunner {
     /** Guards the one-shot `agent_live` boot-milestone report — fired on the
      *  first harness event (createQueryBridge's onEvent hook). */
     private agentLiveReported;
+    /** Epoch ms since a TUI questionnaire has been parked on a human with no
+     *  answer; null when none is pending. While set (and within the grace +
+     *  slack bound) `resolveLoopStatus` reports `waiting`, which reaches the API
+     *  as `active` and keeps the workspace activity clock fresh — the pod must
+     *  not be slept out from under an unanswered question. Deliberately KEPT
+     *  when the turn ends with the questionnaire still parked (the Shape-B
+     *  silent death this hold exists for). */
+    private questionPendingSince;
+    /** Single-shot unref'd timer driving `handleQuestionGraceExpiry`. The
+     *  liveness hold above is bounded by timestamp arithmetic, so a lost timer
+     *  still expires the hold — it just skips the un-park injection. */
+    private questionGraceTimer;
     constructor(config: SessionRunnerConfig, callbacks: SessionRunnerCallbacks, deps?: SessionRunnerDependencies);
     get state(): AgentRunnerStatus;
     /**
@@ -1016,6 +1034,29 @@ declare class SessionRunner {
      * for why an unknown status still fails open to `active`.
      */
     private resolveLoopStatus;
+    /**
+     * Question-pending transitions from the event loop. `armed` starts the
+     * bounded liveness hold + the grace timer; `answered` clears both.
+     * `turn_ended` — the turn's result arrived with the questionnaire still
+     * parked — deliberately KEEPS them: that is the Shape-B silent death
+     * (idle heartbeats stop bumping the activity clock and the reconciler
+     * sleeps the pod minutes later) this hold exists to prevent.
+     */
+    private handleUserQuestionSignal;
+    private armQuestionGraceTimer;
+    private clearQuestionHold;
+    /**
+     * The grace expired with the questionnaire still unanswered. Un-park the
+     * agent by injecting the timeout prompt as a superseding system message —
+     * the proven supersede path (mid-turn: queue + queryBridge.stop(), teardown
+     * kills the parked dialog and the respawn `--resume`s cleanly; idle: the
+     * inputResolver picks it up). Never synthetic keypresses: Enter would
+     * fabricate an answer and Esc handling is CLI-version-dependent.
+     *
+     * A human actively typing in the Connected-TUI defers the expiry — they may
+     * be mid-answer, and superseding would yank the dialog out from under them.
+     */
+    private handleQuestionGraceExpiry;
     /** Mirror the resolved status into the loop-lag buffer so the starvation-proof
      *  heartbeat worker reports it too. Returns what it wrote. */
     private refreshLoopStatus;
@@ -1055,9 +1096,31 @@ interface AgentRunnerConfig {
      */
     packExecution?: _project_shared.PackExecution;
 }
+/**
+ * Question-pending transitions surfaced to the runner by the event loop
+ * (`applyQuestionTransitions` in execution/event-processor.ts):
+ *  - `armed` — the PTY hook observed an AskUserQuestion; a questionnaire is
+ *    parked on a human.
+ *  - `answered` — the questionnaire resolved (PostToolUse envelope, or a new
+ *    assistant record without the question block).
+ *  - `turn_ended` — the turn's `result` arrived while the questionnaire was
+ *    still parked. The dialog is still on screen with nobody answering — the
+ *    silent-death shape the question grace hold exists for — so the runner
+ *    must KEEP its pending hold rather than clear it.
+ */
+type UserQuestionSignal = {
+    kind: "armed";
+    questionText?: string;
+} | {
+    kind: "answered";
+} | {
+    kind: "turn_ended";
+};
 interface AgentRunnerCallbacks {
     onEvent: (event: Record<string, unknown>) => void | Promise<void>;
     onStatusChange: (status: string) => void | Promise<void>;
+    /** Optional — fired on question-pending transitions (see UserQuestionSignal). */
+    onUserQuestion?: (signal: UserQuestionSignal) => void;
 }
 
 interface GithubTokenFileSync {

package/dist/index.js

@@ -1,7 +1,7 @@
 import {
   SessionRunner,
   unshallowRepo
-} from "./chunk-J2NPWBVZ.js";
+} from "./chunk-GUYMLASA.js";
 import "./chunk-XORJ6SII.js";
 import "./chunk-W6VILPQE.js";
 import {
@@ -17,7 +17,7 @@ import {
   stageAndCommit,
   updateRemoteToken,
   workspacePathExists
-} from "./chunk-SLUBOIYE.js";
+} from "./chunk-HFUVAHII.js";
 import "./chunk-GL2DIQEQ.js";
 import {
   runAuthTokenCommand,

package/dist/{serve-boot-B4BIZMNB.js → serve-boot-IFUIGFEH.js}

@@ -1,6 +1,6 @@
 import {
   WorkspaceCommandSupervisor
-} from "./chunk-URYBO32C.js";
+} from "./chunk-UHMCBCQL.js";
 import {
   AgentConnection,
   CodespacePortVisibility,
@@ -11,7 +11,7 @@ import {
   createServiceLogger,
   ensureOnTaskBranch,
   loadConveyorConfig
-} from "./chunk-SLUBOIYE.js";
+} from "./chunk-HFUVAHII.js";
 import "./chunk-GL2DIQEQ.js";
 import "./chunk-W4LZ7R6Z.js";
 import "./chunk-IA45XHOA.js";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@rallycry/conveyor-agent",
-  "version": "11.0.5",
+  "version": "11.0.6",
   "description": "Conveyor Agent Runner v10 - PTY harness for the task chat (SDK harness for audit/project-chat). Agent-as-User architecture with BaseService patterns. Works locally too.",
   "keywords": [
     "agent",