@runuai/host 0.9.169 → 0.9.170

package/lib/agent-cli.ts

@@ -236,6 +236,7 @@ import { open, realpath } from "node:fs/promises";
 import { dirname, isAbsolute, join, relative, resolve, sep, basename } from "node:path";
 import { fileURLToPath } from "node:url";
 import { randomUUID, createHash } from "node:crypto";
+import { spawnSync } from "node:child_process";
 
 const here = dirname(fileURLToPath(import.meta.url));
 let cfg = {};
@@ -249,6 +250,14 @@ if (!TOKEN || !API_URL) {
   process.exit(1);
 }
 
+/** The task this agent's token names: its unsigned body, read for display
+ *  only; the cloud verifies the token and resolves the id itself. */
+function tokenTaskId() {
+  if (!TOKEN.startsWith("uai_")) return null;
+  try { return JSON.parse(Buffer.from(TOKEN.slice(4).split(".")[0], "base64url").toString("utf8")).t || null; }
+  catch { return null; }
+}
+
 function parseFlags(args) {
   const flags = {}; const rest = [];
   for (let i = 0; i < args.length; i++) {
@@ -852,6 +861,23 @@ async function main() {
       must: Number(flags.must), should: Number(flags.should), nits: Number(flags.nits), verdict: flags.verdict,
       summary: flags.summary, assignmentId: flags.assignment, expectedRevision: Number(flags.revision || 0) })); return;
   }
+  if (group === "branch" && action === "name") {
+    // uai/<taskId>/<name>: this task's server-issued branch namespace. A PR
+    // from it links to this task exactly like one from the task branch.
+    const name = pos[0] || "";
+    const valid = name.length > 0 && name.length <= 150 && !name.includes("..") &&
+      name.split("/").every(part => /^[A-Za-z0-9_][A-Za-z0-9._-]*$/.test(part) && !part.endsWith(".lock") && !part.endsWith("."));
+    if (pos.length !== 1 || Object.keys(flags).length || !valid) {
+      console.error("uai: branch name <name>   (letters, digits, '.', '_', '-' and '/'; no leading '-' or '.')"); process.exit(1);
+    }
+    const taskId = tokenTaskId();
+    if (!taskId || !/^[0-9a-hjkmnp-tv-z]{26}$/.test(taskId)) { console.error("uai: branch name: this task's id is unavailable"); process.exit(1); }
+    const branch = "uai/" + taskId + "/" + name;
+    // git's own rule, when git is here to ask.
+    const git = spawnSync("git", ["check-ref-format", "--branch", branch], { encoding: "utf8" });
+    if (!git.error && git.status !== 0) { console.error("uai: branch name: git refuses " + branch); process.exit(1); }
+    out(branch); return;
+  }
   if (group === "crew") {
     // ADR-157: the task's built-in Astronaut (the @astronaut Uai builds, never a
     // persona) changes its own crew. One agent per call, always with a --why.
@@ -1306,6 +1332,31 @@ async function main() {
       console.error("uai: task project add <projectId|slug> [--no-wait]  |  task project status <operationId>");
       process.exit(1);
     }
+    case "task rename": {
+      // The name is prose, not flags: read the raw tail, like todo text.
+      const name = rest.join(" ").trim();
+      if (!name || name.length > 120) { console.error('uai: task rename "<new name>"   (1-120 characters)'); process.exit(1); }
+      const r = await api("PATCH", "/api/agent/task", { name });
+      out(r.changed ? "renamed the task to " + r.task.name + " (branch stays " + r.task.branch + ")" : "the task is already named " + r.task.name);
+      break;
+    }
+    case "task label": {
+      const sub = rest[0];
+      // One shell argument is one label, literally: commas are valid in label
+      // names, so "bug, urgent" is a single label and bug urgent is two.
+      const names = rest.slice(1).map((n) => String(n).trim()).filter(Boolean);
+      if ((sub !== "add" && sub !== "remove") || !names.length) { console.error('uai: task label add <name> [<name>…]  |  task label remove <name> [<name>…]   (quote a name with spaces or commas)'); process.exit(1); }
+      const r = await api(sub === "add" ? "POST" : "DELETE", "/api/agent/task/labels", { names });
+      const changed = sub === "add" ? r.added : r.removed;
+      out((changed.length ? (sub === "add" ? "added " : "removed ") + changed.join(", ") : "no change") + " — labels: " + (r.labels.map((l) => l.name).join(", ") || "none"));
+      break;
+    }
+    case "task delete": {
+      if (pos.length !== 1 || Object.keys(flags).length) { console.error("uai: task delete <childId>   (a draft you created; close a started child instead)"); process.exit(1); }
+      const r = await api("DELETE", "/api/agent/tasks/" + encodeURIComponent(pos[0]));
+      out("deleted draft " + r.deleted);
+      break;
+    }
     case "task search": {
       const q = pos.join(" ") || flags.q || "";
       if (!q) { console.error("uai: task search <query>"); process.exit(1); }
@@ -1350,6 +1401,10 @@ async function main() {
         '  uai task send <childId> "text"',
         '  uai task answer <childId> <cardId> "option text"',
         '  uai task close [--child <childId>] --status finished|canceled [--reason "final report"]',
+        "  uai task delete <childId>          (delete a draft you created for this task; started children are closed instead)",
+        '  uai task rename "<new name>"       (rename this running task; its branch keeps its name)',
+        '  uai task label add <name> [<name>…]   (label this running task; one argument per label, quote "a, b" to keep it whole; missing labels are created)',
+        "  uai task label remove <name> [<name>…]",
         "  uai memory search <query> [--as handle] [--limit N|all]",
         "  uai memory save <text> [--project id] [--tags a,b]",
         "  uai memory delete <id>",
@@ -1358,6 +1413,7 @@ async function main() {
         "  uai todo edit <#id> <text>",
         "  uai todo remove <#id>",
         "  uai todo claim|done|reopen|unclaim <#id>",
+        '  uai branch name <name>   (prints uai/<taskId>/<name>; a PR from it links to this task: git switch -c "$(uai branch name fix-foo)")',
         "  uai review report --pr <number|URL> --head <full-sha> --must <n> --should <n> --nits <n> --verdict approve|changes [--summary text] [--assignment id] [--revision n]",
         "  uai crew outcome @agent accepted|reworked|failed [--note text] [--assignment id] [--revision n]",
         "      Review reports require an authorized exact-head assignment. Outcomes are Secretary assessments, never human acceptance.",

package/lib/agent-errors.ts

@@ -0,0 +1,22 @@
+import { stripVTControlCharacters } from "node:util";
+
+import { captureHostError, scrubHostString } from "./obs";
+
+/** Provider errors can quote requests. Keep chat copy short and on one line;
+ * diagnostic reporting retains the full length with the host's redaction. */
+export function agentErrorMessage(message: string): string {
+  const line = stripVTControlCharacters(scrubHostString(message))
+    .replace(/[\s\u0000-\u001f\u007f-\u009f]+/g, " ").trim();
+  return line.length > 300 ? `${line.slice(0, 299).trimEnd()}…` : line;
+}
+
+export function reportAgentError(
+  message: string,
+  context: { taskId: string; agentId: string; engine: string; rpcCode?: number },
+  { capture = true }: { capture?: boolean } = {},
+): void {
+  const diagnostic = scrubHostString(message);
+  console.warn(`[agent] ${context.taskId}/${context.agentId}: ${diagnostic}`);
+  // This uses the existing disclosure/opt-out gate and Sentry scrubber.
+  if (capture) captureHostError(new Error(diagnostic), context);
+}

package/lib/agents/codex.ts

@@ -13,7 +13,7 @@
  *   initialized       (notification) → sent by us
  *   thread/start      (request)      → result `{ thread: { id, … } }`
  *   turn/start        (request)      → output streams as notifications;
- *                                      the response itself is ignored
+ *                                      response/activity acknowledges acceptance
  *
  * Streaming notifications consumed (`mapCodexNotification`):
  *   item/agentMessage/delta        → message_delta
@@ -39,6 +39,7 @@ import { getDb, schema } from "../db";
 import { requireContainerRuntimeOperational } from "../runtime-guard";
 import type { TaskEnvironmentAgentSessionSurface } from "../task-environment/types";
 import { newId } from "../ulid";
+import { agentErrorMessage, reportAgentError } from "../agent-errors";
 import { attachCompatibilityKeysMatch } from "./attach-compatibility";
 import { createAgentTransport, type LineTransport } from "./transport";
 import { rateLimitErrorUsage, resetSecondsToEpochMs } from "./rate-limit";
@@ -76,6 +77,10 @@ const CODEX_DEFAULT_EFFORT = "medium";
 export const CODEX_USAGE_WARNING_PERCENT = 90;
 export const CODEX_USAGE_LIMITED_PERCENT = 100;
 export const CODEX_USAGE_POLL_INTERVAL_MS = 5 * 60_000;
+/** Only bounds acceptance, never the duration of an acknowledged turn. A
+ * minute allows cold starts/network setup while bounding false working state.
+ * Queued starts wait for accepted work to finish before this clock runs. */
+export const CODEX_TURN_START_TIMEOUT_MS = 60_000;
 
 // ---------------------------------------------------------------------------
 // Pure protocol mapping — JSON-RPC notification → AgentEvent[].
@@ -580,8 +585,20 @@ export class CodexSession implements AgentSession {
   >();
   /** permission_request id → the JSON-RPC request id to answer with. */
   private readonly approvals = new Map<string, number | string>();
-  /** Fire-and-forget turn/start ids whose error responses end turn polling. */
-  private readonly turnStartRpcIds = new Set<number>();
+  /** Responses can follow notifications, so keep ids until completion. */
+  private readonly turnStarts = new Map<number, {
+    timer: ReturnType<typeof setTimeout> | null;
+    turnId: string | null;
+    accepted: boolean;
+    settles: number;
+  }>();
+  /** Merged request id → the canonical start, until its turn completes. */
+  private readonly mergedStarts = new Map<number, number>();
+  private readonly firedRequests = new Map<number, string>();
+  /** Live provider turns plus unacknowledged starts, excluding merged aliases. */
+  private outstandingTurns = 0;
+  private failed = false;
+  private cliVersion: string | null = null;
 
   private threadId: string | null = null;
   private readonly ready: Promise<void>;
@@ -668,20 +685,17 @@ export class CodexSession implements AgentSession {
     this.proc.onLine((line) => this.onLine(line));
     this.proc.onExit((code) => {
       if (this.closed) return;
-      this.turnRunning = false;
-      this.clearRateLimitsTimer();
-      this.turnStartRpcIds.clear();
-      if (code !== 0) {
+      if (!this.failed && (code !== 0 || this.outstandingTurns > 0)) {
         const tail = this.proc.stderrTail.trim();
-        this.emit({
-          type: "error",
-          message:
-            `codex process exited (${code ?? "spawn failed"})` +
+        this.failTurn(
+            (code === null ? `${this.cliLabel} process stopped unexpectedly` :
+              `${this.cliLabel} process exited (${code})${code === 0 ? " before replying to the message" : ""}`) +
             (tail
               ? `:\n${tail}`
-              : " — is the codex CLI installed in the task container, and is the container running?"),
-        });
+              : ". Please try again."),
+        );
       }
+      this.clearTurnState();
       this.closed = true;
       for (const waiter of this.pending.values()) {
         waiter.reject(new Error("codex process exited"));
@@ -691,12 +705,9 @@ export class CodexSession implements AgentSession {
     });
 
     this.ready = this.handshake().catch((err: unknown) => {
-      this.emit({
-        type: "error",
-        message: `codex handshake failed: ${
+      this.failTurn(`${this.cliLabel} could not start: ${
           err instanceof Error ? err.message : String(err)
-        }`,
-      });
+        }`, (err as { rpcCode?: number }).rpcCode);
     });
   }
 
@@ -706,7 +717,7 @@ export class CodexSession implements AgentSession {
     // close() severs this generation before the durable runner necessarily
     // exits. Ignore buffered notifications so a late thread/started cannot
     // restore the resume id that a live roster edit just cleared.
-    if (this.closed) return;
+    if (this.closed || this.failed) return;
     let msg: unknown;
     try {
       msg = JSON.parse(line);
@@ -720,10 +731,13 @@ export class CodexSession implements AgentSession {
     // Response to one of our requests (id, no method).
     if (hasId && !("method" in msg)) {
       const id = typeof msg.id === "number" ? msg.id : -1;
-      if (this.turnStartRpcIds.delete(id)) {
+      const fired = this.firedRequests.get(id);
+      this.firedRequests.delete(id);
+      if (this.turnStarts.has(id) || this.mergedStarts.has(id)) {
         if (isObj(msg.error)) {
-          this.turnRunning = false;
-          this.clearRateLimitsTimer();
+          this.failRpc(msg.error);
+        } else {
+          this.acknowledgeTurn(id, msg.result);
         }
         return;
       }
@@ -743,6 +757,11 @@ export class CodexSession implements AgentSession {
         } else {
           waiter.resolve(msg.result);
         }
+      } else if (fired === "turn/interrupt" && isObj(msg.error)) {
+        const code = typeof msg.error.code === "number" ? msg.error.code : undefined;
+        const message = `Couldn't stop the message: ${this.cliLabel}${code === undefined ? "" : ` (code ${code})`}: ${str(msg.error.message, "Unknown error. Please try again.")}`;
+        this.reportError(message, code);
+        this.emit({ type: "notice", message: agentErrorMessage(message) });
       }
       return;
     }
@@ -760,6 +779,13 @@ export class CodexSession implements AgentSession {
     // Notification (method, no id).
     if ("method" in msg) {
       const method = str(msg.method);
+      // Account usage responses are not proof of a running turn. Turn/item
+      // activity (including an approval request below) is acceptance even on
+      // CLIs that defer the turn/start response until the turn ends.
+      if (method === "turn/started" || method.startsWith("item/") ||
+        method === "thread/tokenUsage/updated" || method === "turn/completed") {
+        this.acknowledgeActivity(msg.params, method === "turn/started");
+      }
       if (method === "thread/tokenUsage/updated") {
         this.turnUsage.observe(msg.params);
       }
@@ -767,10 +793,35 @@ export class CodexSession implements AgentSession {
         method === "turn/completed"
           ? this.turnUsage.complete(msg.params, this.actualModel)
           : undefined;
+      let settles = 1;
       if (method === "turn/completed") {
-        this.turnRunning = false;
-        this.clearRateLimitsTimer();
-        this.turnStartRpcIds.clear();
+        if (isObj(msg.params) && isObj(msg.params.turn) &&
+          msg.params.turn.status === "failed" && isObj(msg.params.turn.error)) {
+          this.failRpc(msg.params.turn.error, completedUsage);
+          return;
+        }
+        this.outstandingTurns = Math.max(0, this.outstandingTurns - 1);
+        const turnId = this.notificationTurnId(msg.params);
+        const completed = [...this.turnStarts].find(([, turn]) => turnId !== null && turn.turnId === turnId)
+          ?? [...this.turnStarts].find(([, turn]) => turn.accepted);
+        if (completed) {
+          settles = completed[1].settles;
+          this.turnStarts.delete(completed[0]);
+          this.firedRequests.delete(completed[0]);
+          for (const [alias, owner] of this.mergedStarts) {
+            if (owner !== completed[0]) continue;
+            this.mergedStarts.delete(alias);
+            this.firedRequests.delete(alias);
+          }
+        }
+        this.turnRunning = this.outstandingTurns > 0;
+        if (!this.turnRunning) this.clearTurnState();
+        else this.reconcileAcceptanceTimers();
+      }
+      if (method === "error") {
+        const params = isObj(msg.params) ? msg.params : {};
+        this.failRpc(isObj(params.error) ? params.error : {});
+        return;
       }
       // The thread id arrives on `thread/started`; also captured from
       // the `thread/start` response in handshake().
@@ -790,7 +841,11 @@ export class CodexSession implements AgentSession {
         Date.now(),
         completedUsage,
       )) {
-        this.emit(ev);
+        this.emit(ev.type === "turn_complete" ? {
+          ...ev,
+          ...(settles > 1 ? { settles } : {}),
+          ...(isObj(msg.params) && isObj(msg.params.turn) && msg.params.turn.status === "interrupted" ? { aborted: true } : {}),
+        } : ev);
       }
     }
   }
@@ -801,6 +856,7 @@ export class CodexSession implements AgentSession {
     params: unknown,
   ): void {
     if (APPROVAL_METHODS.has(method)) {
+      this.acknowledgeActivity(params);
       const permId = newId();
       this.approvals.set(permId, id);
       const p = isObj(params) ? params : {};
@@ -851,9 +907,10 @@ export class CodexSession implements AgentSession {
 
   /** Send a JSON-RPC request without awaiting it — for `turn/start`,
    *  whose output streams as notifications and whose response can take
-   *  minutes. The eventual response is ignored (no pending waiter). */
+   *  minutes. Acceptance/errors are handled separately, without a waiter. */
   private fireRequest(method: string, params: unknown): number {
     const id = this.nextRpcId++;
+    this.firedRequests.set(id, method);
     this.proc.writeLine({
       jsonrpc: "2.0",
       id,
@@ -880,7 +937,7 @@ export class CodexSession implements AgentSession {
   }
 
   private async handshake(): Promise<void> {
-    await this.request("initialize", {
+    const initialized = await this.request("initialize", {
       clientInfo: { name: "uai", version: "0.2" },
       // ADR-078: unlock experimental fields. thread/resume's `excludeTurns`
       // (resume without replaying history — see tryResumeThread) is gated on
@@ -889,6 +946,12 @@ export class CodexSession implements AgentSession {
       // we fall back to a fresh thread, losing the whole conversation.
       capabilities: { experimentalApi: true },
     });
+    // The server's user agent starts with <client-name>/<CLI-version>; it
+    // does not use the clientInfo.version we sent (verified on codex 0.164).
+    if (isObj(initialized)) {
+      this.cliVersion = str(initialized.userAgent)
+        .match(/^[^/\s]+\/(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)(?:\s|$)/)?.[1] ?? null;
+    }
     this.notify("initialized", {});
     // ADR-078: a thread id from a prior host process means this is a restart —
     // resume the SAME durable thread so the conversation survives, instead of
@@ -917,9 +980,13 @@ export class CodexSession implements AgentSession {
             : null;
         if (usage) this.emit({ type: "account_usage", usage });
       })
-      .catch(() => {
+      .catch((error: unknown) => {
         // Usage is advisory. Authentication/turn errors still follow their
         // normal app-server notifications and must not be duplicated here.
+        if (!this.closed && !this.failed) {
+          this.reportError(`${this.cliLabel} usage read failed: ${error instanceof Error ? error.message : String(error)}`,
+            (error as { rpcCode?: number }).rpcCode, false);
+        }
       });
   }
 
@@ -1041,28 +1108,144 @@ export class CodexSession implements AgentSession {
     for (const h of this.handlers) h(event);
   }
 
+  private get cliLabel(): string {
+    return this.cliVersion ? `codex-cli ${this.cliVersion}` : "Codex";
+  }
+
+  private notificationTurnId(params: unknown): string | null {
+    if (!isObj(params)) return null;
+    return str(params.turnId) || (isObj(params.turn) ? str(params.turn.id) : "") || null;
+  }
+
+  private acknowledgeTurn(id: number, params?: unknown): void {
+    const turn = this.turnStarts.get(id);
+    if (!turn) return;
+    if (turn.timer) clearTimeout(turn.timer);
+    turn.timer = null;
+    turn.accepted = true;
+    turn.turnId = this.notificationTurnId(params) ?? turn.turnId;
+    const owner = turn.turnId === null ? undefined : [...this.turnStarts].find(
+      ([otherId, other]) => otherId !== id && other.accepted && other.turnId === turn.turnId,
+    );
+    if (owner) {
+      // Codex 0.164 steers a mid-turn start into the existing turn. One
+      // provider completion must settle every logical delivery it absorbed.
+      owner[1].settles += turn.settles;
+      this.turnStarts.delete(id);
+      this.outstandingTurns = Math.max(0, this.outstandingTurns - 1);
+      for (const [alias, target] of this.mergedStarts) {
+        if (target === id) this.mergedStarts.set(alias, owner[0]);
+      }
+      this.mergedStarts.set(id, owner[0]);
+    }
+    this.reconcileAcceptanceTimers();
+  }
+
+  private acknowledgeActivity(params: unknown, started = false): void {
+    const turnId = this.notificationTurnId(params);
+    if (turnId && [...this.turnStarts.values()].some(turn => turn.turnId === turnId)) {
+      // Ordinary chunks still belong to the running turn. Only an explicit
+      // new start notification can identify another start as merged here.
+      const pending = started && [...this.turnStarts].find(([, turn]) => !turn.accepted);
+      if (pending) this.acknowledgeTurn(pending[0], params);
+      return;
+    }
+    // Associate the first activity with an already acknowledged start before
+    // attributing it to a newer queued request. Old output must not cancel a
+    // different request's watchdog.
+    const unknown = [...this.turnStarts].find(([, turn]) => turn.turnId === null && turn.accepted);
+    if (unknown) {
+      if (turnId) unknown[1].turnId = turnId;
+      return;
+    }
+    const pending = [...this.turnStarts].find(([, turn]) => !turn.accepted);
+    if (pending) this.acknowledgeTurn(pending[0], params);
+  }
+
+  private reconcileAcceptanceTimers(): void {
+    // A late turn/start response can be queued behind accepted work on this
+    // thread. Bound waiting only when the thread is free, and give queued
+    // starts a fresh deadline when the last accepted message completes.
+    const occupied = [...this.turnStarts.values()].some(turn => turn.accepted);
+    for (const turn of this.turnStarts.values()) {
+      if (occupied) {
+        if (turn.timer) clearTimeout(turn.timer);
+        turn.timer = null;
+      } else if (!turn.timer) {
+        turn.timer = setTimeout(() => {
+          this.failTurn(`${this.cliLabel} didn't start this message within 60 seconds. Please try again.`);
+        }, CODEX_TURN_START_TIMEOUT_MS);
+        turn.timer.unref?.();
+      }
+    }
+  }
+
+  private clearTurnState(): void {
+    this.turnRunning = false;
+    this.outstandingTurns = 0;
+    this.clearRateLimitsTimer();
+    for (const turn of this.turnStarts.values()) if (turn.timer) clearTimeout(turn.timer);
+    this.turnStarts.clear();
+    this.mergedStarts.clear();
+    this.firedRequests.clear();
+  }
+
+  private failRpc(error: Record<string, unknown>, usage?: AgentUsage): void {
+    const code = typeof error.code === "number" ? error.code : undefined;
+    this.failTurn(`${this.cliLabel} rejected the message${code === undefined ? "" : ` (code ${code})`}: ${str(error.message, "Unknown error. Please try again.")}`, code, usage);
+  }
+
+  private reportError(message: string, rpcCode?: number, capture = true): void {
+    reportAgentError(message, { taskId: this.taskId, agentId: this.agentId, engine: this.kind, rpcCode }, { capture });
+  }
+
+  /** One terminal failure per generation. Late responses, completion and
+   * process exit cannot end this turn twice or leak into a replacement. */
+  private failTurn(message: string, code?: number, usage?: AgentUsage): void {
+    if (this.failed || this.closed) return;
+    this.failed = true;
+    this.reportError(message, code);
+    const aborted = this.outstandingTurns > 0;
+    const settles = this.outstandingTurns + [...this.turnStarts.values()]
+      .reduce((merged, turn) => merged + turn.settles - 1, 0);
+    this.clearTurnState();
+    const display = agentErrorMessage(message);
+    for (const event of mapCodexNotification("error", { error: { message } })) {
+      this.emit(event.type === "error" ? { ...event, message: display,
+        ...(display === message ? {} : { diagnosticMessage: message }), code, aborted } : event);
+    }
+    if (aborted) this.emit({ type: "turn_complete", aborted: true,
+      ...(settles > 1 ? { settles } : {}), ...(usage ? { usage } : {}) });
+    for (const waiter of this.pending.values()) waiter.reject(new Error(message));
+    this.pending.clear();
+    void this.proc.close().catch(() => {});
+  }
+
   async send(text: string): Promise<void> {
-    if (this.closed) return;
+    if (this.closed || this.failed) throw new Error(`${this.cliLabel} is no longer available. Please try again.`);
+    this.outstandingTurns += 1;
     await this.ready;
-    if (this.closed) return;
+    if (this.closed || this.failed) return;
     if (!this.handshakeOk || !this.threadId) {
-      this.emit({
-        type: "error",
-        message:
-          "codex is unavailable — the app-server handshake did not complete.",
-      });
+      this.failTurn(`${this.cliLabel} could not start. Please try again.`);
       return;
     }
 
     // `ready` may have waited across a runtime generation change. Recheck at
     // the turn/start write rather than trusting session construction time.
-    requireContainerRuntimeOperational();
+    try {
+      requireContainerRuntimeOperational();
+    } catch (error) {
+      this.outstandingTurns -= 1;
+      throw error;
+    }
     const turnStartId = this.fireRequest("turn/start", {
       threadId: this.threadId,
       input: [{ type: "text", text }],
     });
-    this.turnStartRpcIds.add(turnStartId);
     this.turnRunning = true;
+    this.turnStarts.set(turnStartId, { timer: null, turnId: null, accepted: false, settles: 1 });
+    this.reconcileAcceptanceTimers();
     this.scheduleRateLimitsRead();
   }
 
@@ -1093,9 +1276,7 @@ export class CodexSession implements AgentSession {
       return;
     }
     this.closed = true;
-    this.turnRunning = false;
-    this.clearRateLimitsTimer();
-    this.turnStartRpcIds.clear();
+    this.clearTurnState();
     for (const waiter of this.pending.values()) {
       waiter.reject(new Error("session closed"));
     }

package/lib/agents/machine-durable.ts

@@ -451,14 +451,20 @@ export class MachineDurableProcess implements LineTransport {
     if (this.#debug) this.#log(`-> ${json.slice(0, 1000)}`);
     this.#inboxChain = this.#inboxChain
       .then(() =>
-        appendEnvironmentFile(
+        this.#closed || this.#detached ? undefined : appendEnvironmentFile(
           this.#environment,
           this.#inboxPath,
           `${inputMeta}\n${json}\n`,
         ),
       )
       .catch(() => {
-        // Transport error — liveness probes will surface a dead session.
+        if (this.#closed || this.#detached) return;
+        // A fresh heartbeat proves the runner lives, not that it received the
+        // message. Fail immediately through the adapter's normal error path.
+        // Never include the frame or exec stderr: either may contain secrets.
+        this.#stderrBuf = "Could not deliver the message to the agent because its input could not be written. Please try again.";
+        this.#finish(null, "inbox append failed");
+        void this.#killRemoteRunner();
       });
   }
 

package/lib/agents/types.ts

@@ -152,18 +152,32 @@ export type AgentEvent =
   | { type: "permission_request"; id: string; title: string; detail: string }
   /** The agent addressed another agent — uai routes this as a peer message. */
   | { type: "peer_message"; toAgentId: string; text: string }
-  /** The turn (one request → response cycle) is done; agent is idle.
+  /** The provider turn is done; it may have absorbed multiple deliveries.
    *  `usage` carries this turn's token/cost accounting when the CLI reports it. */
-  | { type: "turn_complete"; usage?: AgentUsage }
+  | {
+      type: "turn_complete";
+      usage?: AgentUsage;
+      aborted?: boolean;
+      /** Logical deliveries combined into this one provider turn (default 1). */
+      settles?: number;
+    }
   /** Account-level capacity reported by the engine CLI. This never contains
    * credentials or provider account identifiers. */
   | { type: "account_usage"; usage: AgentAccountUsage }
+  /** A nonterminal operation failed; leave the current message running. */
+  | { type: "notice"; message: string }
   /** A recoverable error surfaced by the agent. `retryable` marks errors the
    *  orchestrator can fail over from — "rate_limit" triggers account rotation
    *  (ADR-076). */
   | {
       type: "error";
       message: string;
+      /** Host-only full diagnostic for classification. Never put on the wire. */
+      diagnosticMessage?: string;
+      /** Provider RPC error code, when supplied. */
+      code?: number;
+      /** The adapter has ended the accepted turn, including before output. */
+      aborted?: boolean;
       retryable?: "rate_limit";
       /** Parsed from the same rate-limit error text, when unambiguous. */
       resetsAt?: number;

package/lib/orchestrator.ts

@@ -40,6 +40,7 @@ import { inArray } from "drizzle-orm";
 
 import { getDb, schema } from "./db";
 import { newId } from "./ulid";
+import { agentErrorMessage, reportAgentError } from "./agent-errors";
 import { mockAgentFactory } from "./agents/mock";
 import { realAgentFactory } from "./agents/factory";
 import { resolveAgentMode } from "./agents/mode";
@@ -50,6 +51,7 @@ import {
 } from "./agents/session-state";
 import {
   type AgentEvent,
+  type AgentEventHandler,
   type AgentSession,
   type AgentSessionFactory,
   type Roster,
@@ -709,7 +711,11 @@ const BROWSER_RETRY_COOLDOWN_MS = 60_000;
  * poisons the runtime generation synchronously; normal detection/recovery owns
  * the eventual ready edge and deferred-prompt replay.
  */
-async function agentTerminationLostContainerRuntime(): Promise<boolean> {
+async function agentTerminationLostContainerRuntime(channel: Channel): Promise<boolean> {
+  // Machine/self tasks have no Docker/Apple daemon. A failed Docker probe
+  // there would turn a real engine failure into silent runtime recovery.
+  if (isEnvironmentTransportProvider(channel.agentHandle?.descriptor.locator.provider) ||
+    isEnvironmentTransportProvider(getHostTask(channel.taskId)?.environmentProvider)) return false;
   if (!backgroundContainerWorkAllowed()) return true;
   let reachable = false;
   try {
@@ -809,6 +815,7 @@ export interface OrchestratorTaskStopResult {
 }
 
 export class Orchestrator {
+  private readonly sessionEventHandlers = new WeakMap<AgentSession, AgentEventHandler>();
   private readonly channels = new Map<string, Channel>();
   private readonly channelSpecs = new Map<string, ChannelEnsureInput>();
   /** Teardown tombstones prevent a cloud ensure from reopening a task between
@@ -2915,7 +2922,7 @@ export class Orchestrator {
     // transport emission order across that await; otherwise the later boundary
     // can consume/reorder prompt state while the earlier error still owns it.
     let eventTail: Promise<void> = Promise.resolve();
-    session.onEvent((event) => {
+    const onEvent: AgentEventHandler = (event) => {
       this.markChannelActivity(channel.taskId);
       // Recycle/teardown deletes the old session before calling close().
       // Adapters deliberately emit a final exit event; without this identity
@@ -2957,7 +2964,9 @@ export class Orchestrator {
         () => channel.eventOperations.delete(operation),
         () => channel.eventOperations.delete(operation),
       );
-    });
+    };
+    this.sessionEventHandlers.set(session, onEvent);
+    session.onEvent(onEvent);
   }
 
   /**
@@ -4616,11 +4625,11 @@ export class Orchestrator {
     }
   }
 
-  /** Consume one queued/active turn and report how many remain. */
-  private decrementActiveTurns(channel: Channel, agentId: string): number {
+  /** Consume deliveries settled by one provider boundary. */
+  private decrementActiveTurns(channel: Channel, agentId: string, settles = 1): number {
     const remaining = Math.max(
       0,
-      (channel.activeTurns.get(agentId) ?? 1) - 1,
+      (channel.activeTurns.get(agentId) ?? 1) - settles,
     );
     if (remaining === 0) channel.activeTurns.delete(agentId);
     else channel.activeTurns.set(agentId, remaining);
@@ -4759,26 +4768,29 @@ export class Orchestrator {
     this.incrementActiveTurns(channel, agentId);
     void session.send(text).catch((err: unknown) => {
       if (turn) journal?.failed(sessionId, turn.turnId);
+      const diagnosticMessage = `Could not send the message to ${agentId}: ${err instanceof Error ? err.message : String(err)}`;
+      reportAgentError(diagnosticMessage, { taskId: channel.taskId, agentId, engine: session.kind },
+        { capture: !(err instanceof ContainerRuntimeUnavailableError) });
       if (channel.sessions.get(agentId) === session) {
-        this.removeAcceptedPrompt(channel, agentId, accepted);
-        const remaining = this.decrementActiveTurns(channel, agentId);
-        if (
-          remaining === 0 &&
-          channel.lastPrompt.get(agentId) === accepted
-        ) {
-          channel.lastPrompt.delete(agentId);
-        }
         if (err instanceof ContainerRuntimeUnavailableError) {
+          this.removeAcceptedPrompt(channel, agentId, accepted);
+          const remaining = this.decrementActiveTurns(channel, agentId);
+          if (remaining === 0 && channel.lastPrompt.get(agentId) === accepted) {
+            channel.lastPrompt.delete(agentId);
+          }
           this.deferPromptUntilRuntimeReady(channel, agentId, accepted);
         } else {
-          this.startNextPendingPrompt(channel, agentId);
+          // Share the ordered terminal-event path with adapter failures. It
+          // retires the active count and publishes the error/aborted boundary;
+          // a concurrent adapter error or exit can consume it only once.
+          this.sessionEventHandlers.get(session)?.({
+            type: "error",
+            message: agentErrorMessage(diagnosticMessage),
+            diagnosticMessage,
+            aborted: true,
+          });
         }
       }
-      console.warn(
-        `[orchestrator] ${channel.taskId}/${agentId}: send failed: ${
-          err instanceof Error ? err.message : String(err)
-        }`,
-      );
     });
   }
 
@@ -4794,13 +4806,14 @@ export class Orchestrator {
     if (prompts.length === 0) channel.acceptedPrompts.delete(agentId);
   }
 
-  private completeNextAcceptedPrompt(
+  private completeAcceptedPrompts(
     channel: Channel,
     agentId: string,
+    settles = 1,
   ): void {
     const prompts = channel.acceptedPrompts.get(agentId);
     if (!prompts) return;
-    prompts.shift();
+    prompts.splice(0, settles);
     if (prompts.length === 0) channel.acceptedPrompts.delete(agentId);
   }
 
@@ -5257,8 +5270,13 @@ export class Orchestrator {
         });
         break;
       }
+      case "notice": {
+        this.emitSystemNote(channel.taskId, agentErrorMessage(`${agentId}: ${event.message}`));
+        break;
+      }
       case "error": {
-        if (await agentTerminationLostContainerRuntime()) {
+        const diagnosticMessage = event.diagnosticMessage ?? event.message;
+        if (await agentTerminationLostContainerRuntime(channel)) {
           // `error` and `exit` can arrive back-to-back while the daemon probe
           // is pending. Only the first terminal event still owns this session.
           if (channel.sessions.get(agentId) !== session) break;
@@ -5272,7 +5290,7 @@ export class Orchestrator {
         if (channel.sessions.get(agentId) !== session) break;
         // The turn died with the session — drop its turn-state flags so a
         // respawned session starts clean.
-        const abortBoundaryOnRosterChange =
+        let abortBoundaryOnRosterChange =
           this.needsAbortedTurnBoundary(channel, agentId);
         this.retainRetiredTurnBoundary(
           channel,
@@ -5280,6 +5298,14 @@ export class Orchestrator {
           abortBoundaryOnRosterChange,
         );
         this.retireRunnerGeneration(channel, agentId);
+        if (event.aborted) {
+          this.emitRetiredTurnAbort(channel, agentId);
+          const change = channel.rosterSessionChanges.get(agentId);
+          if (change) change.abortPublished = true;
+          // A recovery may replay the prompt, but the failed turn already
+          // ended. Do not publish a second boundary for this generation.
+          abortBoundaryOnRosterChange = false;
+        }
         // Claude under load (especially Docker Desktop macOS) occasionally
         // unlinks ~/.claude.json mid-write during atomic config rewrites,
         // and a concurrent claude spawn lands during the gap and exits 0
@@ -5325,7 +5351,7 @@ export class Orchestrator {
         if (
           agent &&
           agent.kind !== "claude" &&
-          isCredentialInvalidSignal(agent.kind, event.message)
+          isCredentialInvalidSignal(agent.kind, diagnosticMessage)
         ) {
           console.warn(
             `[orchestrator] ${channel.taskId}/${agentId}: ${agent.kind} credential-invalid pattern matched: ${event.message.slice(0, 300)}`,
@@ -5407,7 +5433,7 @@ export class Orchestrator {
           }
         }
         const isClaude = agent?.kind === "claude";
-        if (isClaude && agent && isClaudeAuthRevoked(event.message)) {
+        if (isClaude && agent && isClaudeAuthRevoked(diagnosticMessage)) {
           // Token revoked/expired: the env-injected credential only changes on
           // a fresh runner. Re-spawn on the re-resolved account (picks up a
           // reconnected token); bounded so a still-bad token can't loop.
@@ -5424,7 +5450,7 @@ export class Orchestrator {
           break;
         }
         const configMissing = CLAUDE_CONFIG_MISSING_PATTERNS.some((re) =>
-          re.test(event.message),
+          re.test(diagnosticMessage),
         );
         if (isClaude && configMissing) {
           // This recovery path deliberately starts the next queued turn rather
@@ -5439,7 +5465,7 @@ export class Orchestrator {
           break;
         }
         channel.lastPrompt.delete(agentId);
-        channel.retiredTurnBoundaries.delete(agentId);
+        this.emitRetiredTurnAbort(channel, agentId);
         this.emitHost({
           kind: "agent.exit",
           taskId: channel.taskId,
@@ -5469,9 +5495,11 @@ export class Orchestrator {
         // turn's messages and wakes the mentioned peers with the full turn.
         // An interrupted (ESC'd) turn goes out `aborted`: it's a half-turn, so
         // the cloud discards the buffer instead of handing it to peers.
-        const aborted = channel.interrupted.delete(agentId);
-        this.completeNextAcceptedPrompt(channel, agentId);
-        const remainingTurns = this.decrementActiveTurns(channel, agentId);
+        const aborted = channel.interrupted.delete(agentId) || event.aborted === true;
+        const settles = event.settles !== undefined && Number.isSafeInteger(event.settles) && event.settles > 0
+          ? event.settles : 1;
+        this.completeAcceptedPrompts(channel, agentId, settles);
+        const remainingTurns = this.decrementActiveTurns(channel, agentId, settles);
         channel.openTurns.delete(agentId);
         // ADR-076: a turn that completed means the current account is healthy —
         // reset its rotation budget so a LATER rate-limit gets a fresh failover.
@@ -5522,7 +5550,15 @@ export class Orchestrator {
         break;
       }
       case "exit":
-        if (await agentTerminationLostContainerRuntime()) {
+        if (event.code === 0 && this.needsAbortedTurnBoundary(channel, agentId)) {
+          await this.handleAgentEvent(channel, agentId, session, {
+            type: "error",
+            message: `${session.kind} stopped before replying to the message. Please try again.`,
+            aborted: true,
+          });
+          break;
+        }
+        if (await agentTerminationLostContainerRuntime(channel)) {
           if (channel.sessions.get(agentId) !== session) break;
           await this.retireSessionForRuntimeLoss(
             channel,
@@ -7319,7 +7355,10 @@ export function buildSystemPreamble(
         `${taskBranch}\` from inside the project, then open a PR with \`gh pr`,
         "create` (the container has gh authenticated). For multi-project",
         "tasks, each project's PR is independent — open one per project whose",
-        "worktree you actually changed.",
+        "worktree you actually changed. For a separate branch, create it in",
+        "this task's namespace — `git switch -c \"$(uai branch name fix-foo)\"`",
+        "makes `uai/<taskId>/fix-foo`. Only task-branch and namespace PRs link to",
+        "this task (reviews, `--pr`, Usage); a PR from any other branch does not.",
         "",
         "The `.uai/` directory under each task is uai's own scaffolding",
         "(rendered Dockerfile, compose file, container scripts) — it is NOT",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runuai/host",
-  "version": "0.9.169",
+  "version": "0.9.170",
   "description": "Uai host \u2014 runs ephemeral AI tasks in containers on a machine you control.",
   "license": "MIT",
   "author": "Uai Tech <team@runuai.com>",