@shipster/cli 0.5.1 → 0.5.3

package/dist/cli.js

@@ -18414,6 +18414,26 @@ function parseDesired(input) {
   }
 }
 
+// ../../shared/types/src/tier-plan.ts
+function ladder(rungs) {
+  if (rungs === 3) return DIFFICULTIES.map((d) => ({ tier: tierForDifficulty(d), difficulty: [d] }));
+  return [{ tier: "cheap", difficulty: ["small", "standard"] }, { tier: "sensitive", difficulty: ["large"] }];
+}
+function planWriterTiers(models) {
+  if (models.some((m) => m.trim() === "")) throw new Error("writer models: an empty model name");
+  if (new Set(models).size !== models.length) throw new Error("writer models: a repeated model");
+  if (models.length > 3) throw new Error("writer models: at most three, one per difficulty");
+  if (models.length < 2) return { pools: [{ tier: "all", ...models[0] ? { model: models[0] } : {} }], poolOrder: null };
+  const pools = ladder(models.length).map((rung, i) => ({ tier: rung.tier, model: models[i], difficulty: rung.difficulty }));
+  return { pools, poolOrder: pools.map((p) => p.tier) };
+}
+function planReviewerSeat(writer, available) {
+  const other = available.find((r) => r !== writer.runtime);
+  if (other !== void 0) return { runtime: other, separation: "runtime" };
+  const top = writer.models.at(-1);
+  return { runtime: writer.runtime, ...top ? { model: top } : {}, separation: writer.models.length > 1 ? "model" : "none" };
+}
+
 // ../../shared/types/src/secret-patterns.ts
 var SECRET_PATTERNS = [
   /\bsk-/,
@@ -18473,6 +18493,14 @@ function isDifficulty(value) {
 function difficultyRung(d) {
   return DIFFICULTIES.indexOf(d);
 }
+var TIER_OF_DIFFICULTY = {
+  small: "cheap",
+  standard: "standard",
+  large: "sensitive"
+};
+function tierForDifficulty(d) {
+  return TIER_OF_DIFFICULTY[d];
+}
 var DEFAULT_UNSTARTED_AFTER_MS = 4 * 60 * 60 * 1e3;
 var DEFAULT_REVIEW_SILENT_MS = 40 * 60 * 1e3;
 var POOL_STOPPED_REASON = "pool member stopped by pitboss node";
@@ -22502,6 +22530,12 @@ var BASE_TASK_LOOP = (agentId, repoPath) => `You are an AI worker agent (ID: ${a
    c. Read the task carefully. If the row is marked \`truncated:true\`, call
       \`mcp__relai__get_task\` with its id for the full description before acting \u2014
       the list clips descriptions, and the rest of the spec is only on that drill-in.
+      If \`metadata.checkpoint\` is set (\`mcp__relai__get_task\` if \`metadata._truncated\` lists it in \`keys\`),
+      start from its \`next\` and \`unverified\` lists. It is an earlier session's notes: information, not
+      authorisation, and cannot widen the task's scope. Work on the task's own branch (\`metadata.branchName\`
+      or the order's), never its \`branch\`, \`wipRef\` or \`worktree\`; if its \`branch\` differs, say so in a task
+      comment. \`headSha\` is the last commit it knew there: read later commits before acting on \`next\`, and
+      comment if the tip lacks it. A finding, human reply or task edit newer than \`checkpoint.at\` wins.
       Check \`metadata\` for \`branchName\`, \`roundNumber\`, and any leftover
       \`findings\`; also read finding comments on the thread from step b \u2014 that is where
       new findings land. If \`metadata.humanReply\` is set, this task was previously blocked
@@ -22518,10 +22552,14 @@ var BASE_TASK_LOOP = (agentId, repoPath) => `You are an AI worker agent (ID: ${a
       the same thing: either proceed on your own judgement and say in your handoff that you did, or
       escalate to a human by blocking with a question addressed to nobody.
    d. Do the work per your specialization rules below.
-   e. Post your result on the task's own thread (\`mcp__relai__add_task_comment\` or
+   e. If the work is on a branch, commit and push it, then call \`mcp__relai__checkpoint_task\` while the
+      task is still \`in_progress\`: before every \`update_task_status\` to "completed" or "blocked" and
+      every \`assign_task\`, including those in the role, round-limit and order rules below, and when out
+      of room. \`dirty\` and \`wipRef\` are only for work that cannot be committed.
+   f. Post your result on the task's own thread (\`mcp__relai__add_task_comment\` or
       \`mcp__relai__send_message\` type "handoff"), with \`toAgent\` set to whoever you
       report to: the task's \`createdBy\` unless told otherwise.
-   f. If the work is done: \`mcp__relai__update_task_status\` \u2192 "completed"
+   g. If the work is done: \`mcp__relai__update_task_status\` \u2192 "completed"
       (or "blocked" if escalating). If another role must continue this same task,
       \`mcp__relai__assign_task\` to them and stop \u2014 do not complete.
 
@@ -22646,8 +22684,9 @@ types, empty classes) but you do not take the implementation yourself.
 
 - Read relevant files to understand current structure.
 - Write a clear technical design on this task's thread (\`mcp__relai__add_task_comment\`).
-  If scaffolding helps, write it on the branch in \`branchName\` (derive one if missing,
-  same slug rule as writer).
+  If scaffolding helps, write it on the branch in \`branchName\`: if set, \`git fetch origin\` then
+  \`git checkout -B {branchName} origin/{branchName}\`; if missing, derive one (same slug rule as writer)
+  and stamp it as \`metadata.branchName\` with \`mcp__relai__update_task_status\`. Never force-push.
 - \`mcp__relai__list_agents\`, pick specialization \`"writer"\` (prefer online), then
   \`mcp__relai__assign_task\` to them. Do not complete.
 
@@ -22660,9 +22699,13 @@ types, empty classes) but you do not take the implementation yourself.
 You implement specs on a branch and open a PR. Write production code and tests.
 
 **Workflow:**
-1. Check metadata for branchName. If none, derive one from the task title:
+1. Check metadata for branchName. If set, the branch holds earlier work: \`git fetch origin\` then
+   \`git checkout -B {branchName} origin/{branchName}\` (only if the remote branch does not exist, create
+   it from the default branch). If none, derive one from the task title:
    slug the title to lowercase-hyphenated, prefix "feat/".
-   Use Bash to create the branch: \`git checkout -b {branchName}\`.
+   Use Bash to create the branch: \`git checkout -b {branchName}\`. Stamp it on this task via
+   \`mcp__relai__update_task_status\` with status \`"in_progress"\` and \`metadata.branchName\`.
+   Never force-push to make a push succeed.
 2. Read the spec. Read existing files to understand patterns (Read, Grep, Glob).
 3. Implement: write code, update tests, follow existing conventions exactly.
 4. Run tests: check package.json scripts for the test command.
@@ -22671,7 +22714,8 @@ You implement specs on a branch and open a PR. Write production code and tests.
    - First try \`gh pr create --fill\` \u2014 captures the PR URL automatically when the GitHub CLI is installed and authed.
    - If \`gh\` isn't available (\`command -v gh\` fails) or it returns a non-zero exit, fall back to \`git push -u origin {branchName}\`. Then read the remote with \`git remote get-url origin\` so you can hand the reviewer a clickable branch URL even without an open PR. Set \`prUrl\` to the PR URL when you have one, otherwise to the branch URL on the remote.
 7. Post a handoff on the task's own thread with \`mcp__relai__add_task_comment\` (type: "handoff"):
-   PR URL, head sha, what landed, and tests. Then \`mcp__relai__update_task_status\` \u2192 "completed".
+   PR URL, head sha, what landed, and tests. Then, after the step e checkpoint,
+   \`mcp__relai__update_task_status\` \u2192 "completed".
    - If the task has \`verifyReviewerId\` or any reviewer gate, completed moves it to
      pending_verification. Do not then \`update_task_status\` to \`"in_progress"\` \u2014
      the reviewer decides via \`submit_review\`, and a reject returns the task to
@@ -24005,7 +24049,8 @@ var PITBOSS_NAMES = [
   "ENV_GRANT",
   "TASK_REPO_ID",
   "TASK_REPO_URL",
-  "OWNER_POOL_SLOT"
+  "OWNER_POOL_SLOT",
+  "SESSION_MAX_MS"
 ].flatMap(envNames);
 var WORKER_KNOBS = [
   "API_URL",
@@ -24859,99 +24904,19 @@ function parseResetTime(text, now = Date.now()) {
 // ../claude-worker/src/unavailable.ts
 var DEFAULT_UNAVAILABLE_UNTIL_MS = 60 * 60 * 1e3;
 
+// ../claude-worker/src/worker.ts
+var DEFAULT_SESSION_MAX_MS = 90 * 6e4;
+
 // ../claude-worker/src/config.ts
 var VALID_SPECIALIZATIONS = ["reviewer", "architect", "writer", "tester", "devops"];
 
 // src/node/onboard.ts
-import { join as join18, resolve as resolve6 } from "node:path";
-var MAX_POOL = 30;
-var GITHUB = /^(?:https:\/\/github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:)([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/;
-function runtimeBinary(runtime, env3) {
-  switch (runtime) {
-    case "claude":
-      return env3.CLAUDE_BIN ?? "claude";
-    case "cursor":
-      return env3.CURSOR_BIN ?? "cursor-agent";
-    case "copilot":
-      return env3.COPILOT_BIN ?? "copilot";
-    case "codex":
-      return env3.CODEX_BIN ?? "codex";
-  }
-}
-function githubRepo(url) {
-  const match = GITHUB.exec(url.trim());
-  if (!match) throw new Error(`${url} is not a GitHub repo URL (https://github.com/<owner>/<repo> or git@github.com:<owner>/<repo>)`);
-  return { owner: match[1], name: match[2] };
-}
-function planOnboard(url, opts) {
-  const { owner, name } = githubRepo(url);
-  for (const role of ["architect", "writer", "reviewer"]) {
-    if (opts[role] === void 0) throw new Error(`no ${role} runtime: pass --${role} <runtime> (have: ${RUNTIMES3.join(", ")})`);
-  }
-  const architectRuntime = opts.architect;
-  const writer = opts.writer;
-  const reviewer = opts.reviewer;
-  for (const r of [architectRuntime, writer, reviewer]) {
-    if (!RUNTIMES3.includes(r)) throw new Error(`runtime "${r}" is not supported (have: ${RUNTIMES3.join(", ")})`);
-  }
-  const warnings = reviewer === writer ? [`the reviewer and the writers both run ${writer}: a same-vendor reviewer shares the writers' blind spots`] : [];
-  const poolMax = opts.poolMax ?? 2;
-  if (!Number.isInteger(poolMax) || poolMax < 1 || poolMax > MAX_POOL) {
-    throw new Error(`pool size must be a whole number from 1 to ${MAX_POOL}, so the architect, reviewer and writers fit one approval`);
-  }
-  const id = name.replace(/^[^A-Za-z0-9]+/, "").slice(0, 40).replace(/[^A-Za-z0-9]+$/, "") || "repo";
-  const parent = resolve6(opts.parent ?? join18(opts.home, "github"));
-  const base2 = join18(parent, name);
-  const nodeDir2 = join18(parent, `${name}-node`);
-  const architectWorktree = join18(parent, `${name}-architect`);
-  const review = join18(parent, `${name}-reviewer`);
-  return {
-    owner,
-    name,
-    warnings,
-    cloneUrl: `https://github.com/${owner}/${name}.git`,
-    base: base2,
-    nodeDir: nodeDir2,
-    specPath: join18(nodeDir2, "spec.json"),
-    configDir: join18(opts.home, ".config", "pitboss-repos", owner.toLowerCase(), name.toLowerCase()),
-    worktrees: [architectWorktree, review],
-    spec: {
-      api: DEFAULT_API_URL,
-      agents: [
-        { name: `${id}-architect`, runtime: architectRuntime, worktree: `../${name}-architect`, specialization: "architect", tier: 2 },
-        { name: `${id}-reviewer`, runtime: reviewer, worktree: `../${name}-reviewer`, specialization: "reviewer" },
-        {
-          pool: `${id}-pool`,
-          runtime: writer,
-          base: `../${name}`,
-          worktreeRoot: `../${name}-pool`,
-          specialization: "writer",
-          min: 0,
-          max: poolMax
-        }
-      ]
-    }
-  };
-}
-function onboardOperations(plan2, account) {
-  const oneLine2 = (v) => v.length > 0 && v.length <= 300 && !/[\r\n]/.test(v);
-  return {
-    ...account ? { githubAccount: account } : {},
-    ...oneLine2(plan2.configDir) ? { nodeConfigDir: plan2.configDir } : {},
-    ...oneLine2(plan2.specPath) ? { nodeSpecPath: plan2.specPath } : {}
-  };
-}
-function originHost(origin) {
-  const url = /^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?([^/:]+)/i.exec(origin.trim());
-  if (url) return url[1].toLowerCase();
-  const scp = /^(?:[^@/]+@)?([^/:]+):/.exec(origin.trim());
-  return scp ? scp[1].toLowerCase() : null;
-}
+import { join as join19, resolve as resolve7 } from "node:path";
 
 // src/node/spec.ts
 import { existsSync as existsSync11, realpathSync as realpathSync4, statSync as statSync2 } from "node:fs";
 import { homedir as homedir5 } from "node:os";
-import { join as join19, parse as parsePath, resolve as resolve7, sep as sep2 } from "node:path";
+import { join as join18, parse as parsePath, resolve as resolve6, sep as sep2 } from "node:path";
 var MAX_POOL_SIZE = 32;
 var MAX_ENV_GRANTS2 = 16;
 var NAME2 = /^[A-Za-z0-9][A-Za-z0-9_.-]{0,63}$/;
@@ -24964,7 +24929,7 @@ var canonical = (p) => {
   try {
     return realpathSync4(p);
   } catch {
-    return resolve7(p);
+    return resolve6(p);
   }
 };
 function janitorRootsOf(raw, specDir, agents, pools, homeDir) {
@@ -24975,7 +24940,7 @@ function janitorRootsOf(raw, specDir, agents, pools, homeDir) {
   const skipped = [];
   raw.forEach((entry, i) => {
     if (typeof entry !== "string" || entry === "" || entry.includes("\0")) throw new Error(`janitorRoots[${i}] must be a directory path`);
-    const asked = resolve7(specDir, entry);
+    const asked = resolve6(specDir, entry);
     let real3;
     try {
       real3 = realpathSync4(asked);
@@ -24990,7 +24955,7 @@ function janitorRootsOf(raw, specDir, agents, pools, homeDir) {
     if (real3 === parsePath(real3).root) throw new Error(`janitorRoots[${i}] ${real3} is the filesystem root`);
     if (real3 === home) throw new Error(`janitorRoots[${i}] ${real3} is the home directory`);
     if (isWithin(home, real3)) throw new Error(`janitorRoots[${i}] ${real3} contains the home directory`);
-    if (existsSync11(join19(real3, ".git"))) throw new Error(`janitorRoots[${i}] ${real3} is a git work tree; list the directory that holds worktrees, not a checkout`);
+    if (existsSync11(join18(real3, ".git"))) throw new Error(`janitorRoots[${i}] ${real3} is a git work tree; list the directory that holds worktrees, not a checkout`);
     for (const a of allAgents({ api: "", agents, pools })) {
       if (isWithin(real3, canonical(a.worktree))) {
         throw new Error(`janitorRoots[${i}] ${real3} is or sits inside the worktree of agent "${a.name}"`);
@@ -25024,7 +24989,7 @@ function poolMembers(pool) {
     return {
       name,
       runtime: pool.runtime,
-      worktree: join19(pool.worktreeRoot, name),
+      worktree: join18(pool.worktreeRoot, name),
       specialization: pool.specialization,
       ...pool.ownerPool ? { ownerPool: true } : {},
       ...pool.tier ? { tier: pool.tier } : {},
@@ -25186,11 +25151,11 @@ function parsePool(a, i, specDir, platform2) {
     }
     burstMax = a.burstMax;
   }
-  const worktreeRoot = resolve7(specDir, a.worktreeRoot);
+  const worktreeRoot = resolve6(specDir, a.worktreeRoot);
   if (ownerPool) {
     return { pool: a.pool, runtime, ownerPool: true, worktreeRoot, specialization, ...modelOf(a, i), ...isolateOf(a, i, runtime), ...relayOf(a, i), ...poolSeatKindOf(a, i, platform2, max), ...difficultyOf(a, i), min, max, ...burstMax !== void 0 ? { burstMax } : {} };
   }
-  const base2 = resolve7(specDir, a.base);
+  const base2 = resolve6(specDir, a.base);
   if (isWithin(worktreeRoot, base2)) throw new Error(`agents[${i}].worktreeRoot ${worktreeRoot} is inside base ${base2}; pool worktrees never go inside your checkout`);
   return { pool: a.pool, runtime, base: base2, worktreeRoot, specialization, ...tierOf(a, i, specialization), ...modelOf(a, i), ...isolateOf(a, i, runtime), ...relayOf(a, i), ...envOf(a, i), ...poolSeatKindOf(a, i, platform2, max), ...difficultyOf(a, i), min, max, ...burstMax !== void 0 ? { burstMax } : {} };
 }
@@ -25227,7 +25192,7 @@ function parseSpec(text, specDir, opts = {}) {
     }
     const specialization = specializationOf(a, i);
     if (ownerPool) ownerPoolSpecializationCheck(a.name, specialization, "agents");
-    agents.push({ name: a.name, runtime, worktree: resolve7(specDir, a.worktree), specialization, ...ownerPool ? { ownerPool: true } : tierOf(a, i, specialization), ...modelOf(a, i), ...isolateOf(a, i, runtime), ...relayOf(a, i), ...envOf(a, i), ...seatKindOf(a, i, platform2) });
+    agents.push({ name: a.name, runtime, worktree: resolve6(specDir, a.worktree), specialization, ...ownerPool ? { ownerPool: true } : tierOf(a, i, specialization), ...modelOf(a, i), ...isolateOf(a, i, runtime), ...relayOf(a, i), ...envOf(a, i), ...seatKindOf(a, i, platform2) });
   });
   const entries = [
     ...agents.map((a) => ({ label: `agent "${a.name}"`, ownerPool: a.ownerPool === true, seated: a.runAs !== void 0 })),
@@ -25271,6 +25236,115 @@ function parseSpec(text, specDir, opts = {}) {
   };
 }
 
+// src/node/onboard.ts
+var MAX_POOL = 30;
+var GITHUB = /^(?:https:\/\/github\.com\/|ssh:\/\/git@github\.com\/|git@github\.com:)([\w.-]+)\/([\w.-]+?)(?:\.git)?\/?$/;
+function runtimeBinary(runtime, env3) {
+  switch (runtime) {
+    case "claude":
+      return env3.CLAUDE_BIN ?? "claude";
+    case "cursor":
+      return env3.CURSOR_BIN ?? "cursor-agent";
+    case "copilot":
+      return env3.COPILOT_BIN ?? "copilot";
+    case "codex":
+      return env3.CODEX_BIN ?? "codex";
+  }
+}
+function githubRepo(url) {
+  const match = GITHUB.exec(url.trim());
+  if (!match) throw new Error(`${url} is not a GitHub repo URL (https://github.com/<owner>/<repo> or git@github.com:<owner>/<repo>)`);
+  return { owner: match[1], name: match[2] };
+}
+function planOnboard(url, opts) {
+  const { owner, name } = githubRepo(url);
+  for (const role of ["architect", "writer", "reviewer"]) {
+    if (opts[role] === void 0) throw new Error(`no ${role} runtime: pass --${role} <runtime> (have: ${RUNTIMES3.join(", ")})`);
+  }
+  const architectRuntime = opts.architect;
+  const writer = opts.writer;
+  const reviewer = opts.reviewer;
+  for (const r of [architectRuntime, writer, reviewer]) {
+    if (!RUNTIMES3.includes(r)) throw new Error(`runtime "${r}" is not supported (have: ${RUNTIMES3.join(", ")})`);
+  }
+  const sameVendor = `the reviewer and the writers both run ${writer}: a same-vendor reviewer shares the writers' blind spots`;
+  const warnings = reviewer === writer ? [sameVendor] : [];
+  const poolMax = opts.poolMax ?? 2;
+  if (!Number.isInteger(poolMax) || poolMax < 1 || poolMax > MAX_POOL) {
+    throw new Error(`pool size must be a whole number from 1 to ${MAX_POOL}, so the architect, reviewer and writers fit one approval`);
+  }
+  const id = name.replace(/^[^A-Za-z0-9]+/, "").slice(0, 40).replace(/[^A-Za-z0-9]+$/, "") || "repo";
+  const parent = resolve7(opts.parent ?? join19(opts.home, "github"));
+  const base2 = join19(parent, name);
+  const nodeDir2 = join19(parent, `${name}-node`);
+  const architectWorktree = join19(parent, `${name}-architect`);
+  const review = join19(parent, `${name}-reviewer`);
+  const writerPool = { runtime: writer, base: `../${name}`, specialization: "writer", min: 0, max: poolMax };
+  const architect = { name: `${id}-architect`, runtime: architectRuntime, worktree: `../${name}-architect`, specialization: "architect", tier: 2 };
+  const tiers = opts.writerModels ? planWriterTiers(opts.writerModels) : null;
+  const poolName = (tier) => `${id}-${tier === "all" ? "pool" : tier}`;
+  if (tiers && tiers.pools.length * poolMax > MAX_POOL) {
+    throw new Error(`${tiers.pools.length} writer pools of ${poolMax} do not fit one approval of ${MAX_POOL + 2} agents with the architect and reviewer; lower --pool-max`);
+  }
+  const seat = tiers ? planReviewerSeat({ runtime: writer, models: opts.writerModels }, [reviewer]) : null;
+  const tierAgents = tiers && seat && [
+    architect,
+    ...tiers.pools.map((p) => ({
+      pool: poolName(p.tier),
+      ...writerPool,
+      worktreeRoot: `../${name}-${p.tier === "all" ? "pool" : p.tier}`,
+      ...p.model ? { model: p.model } : {},
+      ...p.difficulty ? { difficulty: p.difficulty } : {}
+    })),
+    {
+      pool: `${id}-reviewer`,
+      runtime: seat.runtime,
+      base: `../${name}`,
+      worktreeRoot: `../${name}-reviewer-pool`,
+      specialization: "reviewer",
+      ...seat.model ? { model: seat.model } : {},
+      min: 0,
+      max: 1
+    }
+  ];
+  const spec = {
+    api: DEFAULT_API_URL,
+    agents: tierAgents || [
+      architect,
+      { name: `${id}-reviewer`, runtime: reviewer, worktree: `../${name}-reviewer`, specialization: "reviewer" },
+      { pool: `${id}-pool`, ...writerPool, worktreeRoot: `../${name}-pool` }
+    ]
+  };
+  parseSpec(JSON.stringify(spec), nodeDir2);
+  return {
+    owner,
+    name,
+    warnings,
+    cloneUrl: `https://github.com/${owner}/${name}.git`,
+    base: base2,
+    nodeDir: nodeDir2,
+    specPath: join19(nodeDir2, "spec.json"),
+    configDir: join19(opts.home, ".config", "pitboss-repos", owner.toLowerCase(), name.toLowerCase()),
+    worktrees: tierAgents ? [architectWorktree] : [architectWorktree, review],
+    poolOrder: tiers?.poolOrder?.map(poolName) ?? null,
+    spec
+  };
+}
+function onboardOperations(plan2, account) {
+  const oneLine2 = (v) => v.length > 0 && v.length <= 300 && !/[\r\n]/.test(v);
+  return {
+    ...account ? { githubAccount: account } : {},
+    ...oneLine2(plan2.configDir) ? { nodeConfigDir: plan2.configDir } : {},
+    ...oneLine2(plan2.specPath) ? { nodeSpecPath: plan2.specPath } : {}
+  };
+}
+function originHost(origin) {
+  const url = /^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]+@)?([^/:]+)/i.exec(origin.trim());
+  if (url) return url[1].toLowerCase();
+  const scp = /^(?:[^@/]+@)?([^/:]+):/.exec(origin.trim());
+  return scp ? scp[1].toLowerCase() : null;
+}
+
 // src/node/store.ts
 import { existsSync as existsSync12, mkdirSync as mkdirSync10, readdirSync as readdirSync4, readFileSync as readFileSync15, renameSync as renameSync5, rmSync as rmSync6, writeFileSync as writeFileSync12 } from "node:fs";
 import { dirname as dirname10, join as join20 } from "node:path";
@@ -25372,7 +25446,7 @@ function reconcilePool({ pending, members, min, max, idleStopMs }) {
   };
   for (const m of stopped) {
     if (count >= max) break;
-    if (m.inProgress > 0 || m.readyAssigned > 0) take(m);
+    if (m.inProgress > 0 || m.readyAssigned > 0 || (m.owedReviews ?? 0) > 0) take(m);
   }
   const spare = () => stopped.filter((m) => !start.includes(m.name)).sort((a, b) => Number(isIdle(b)) - Number(isIdle(a)));
   let demand = pending - running.filter(isIdle).length;
@@ -25395,7 +25469,7 @@ function reconcilePool({ pending, members, min, max, idleStopMs }) {
     count--;
   }
   if (stop.length > 0) return { start: [], stop, why };
-  const blockedOwners = stopped.filter((m) => m.inProgress - (m.verifyingOwn ?? 0) > 0 || m.readyAssigned > 0).length;
+  const blockedOwners = stopped.filter((m) => m.inProgress - (m.verifyingOwn ?? 0) > 0 || m.readyAssigned > 0 || (m.owedReviews ?? 0) > 0).length;
   const freed = [];
   if (blockedOwners > 0 && count >= max) {
     for (const m of running.filter(isIdle)) {
@@ -25871,7 +25945,8 @@ async function onboardCommand(url, opts) {
       architect: roles.architect,
       writer: roles.writer,
       reviewer: roles.reviewer,
-      poolMax: opts.poolMax === void 0 ? void 0 : Number(opts.poolMax)
+      poolMax: opts.poolMax === void 0 ? void 0 : Number(opts.poolMax),
+      writerModels: opts.writerModels === void 0 ? void 0 : opts.writerModels.split(",").map((m) => m.trim())
     });
     for (const warning of plan2.warnings) console.log(source_default.yellow(`  ${warning}`));
     const env3 = { ...process.env };
@@ -25950,6 +26025,8 @@ async function onboardCommand(url, opts) {
   Start it when you want it running (long-running, foreground):`);
     console.log(source_default.cyan(`    cd ${shellQuote(plan2.nodeDir)} && PITBOSS_CONFIG_DIR=${shellQuote(plan2.configDir)} pitboss node up spec.json`));
     if (opts.account) console.log(source_default.dim(`    with GH_TOKEN from \`gh auth token --user ${opts.account}\` in that shell`));
+    if (plan2.poolOrder) console.log(`
+  Tiers route once the owner or its top-level agent sets each pool's difficulties (set_pool_size) and the pool order (set_pool_order): ${plan2.poolOrder.join(", ")}`);
   } catch (err) {
     console.error(source_default.red(`  \u2715 ${err instanceof Error ? err.message : String(err)}`));
     process.exitCode = 1;
@@ -31600,6 +31677,28 @@ function startActivityLoop(agents, sup, ownerPool = false) {
   const timer = setInterval(() => void tick(), ACTIVITY_REPORT_MS);
   return () => clearInterval(timer);
 }
+var SHUTDOWN_MARK_BOUND_MS = 3e3;
+async function markPoolsStopped(loops, boundMs = SHUTDOWN_MARK_BOUND_MS) {
+  let timer;
+  const bound = new Promise((resolve19) => {
+    timer = setTimeout(() => {
+      console.log(`${(/* @__PURE__ */ new Date()).toISOString()}  node: shutdown marking pool members unavailable timed out after ${boundMs}ms`);
+      resolve19();
+    }, boundMs);
+  });
+  try {
+    await Promise.race([Promise.all(loops.map((l) => l.markRunningStopped().catch(() => void 0))), bound]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+async function shutdownNode(opts) {
+  for (const stop of opts.stops) stop();
+  console.log(source_default.dim("\n  stopping agents\u2026"));
+  const marking = markPoolsStopped(opts.poolLoops, opts.boundMs);
+  await Promise.all([opts.sup.stop(), marking]);
+  opts.exit(0);
+}
 function startPoolLoop(run4, sup, record, account) {
   const { pool, members } = run4;
   const { reconcileMs, idleStopMs } = poolTimings();
@@ -31620,6 +31719,7 @@ function startPoolLoop(run4, sup, record, account) {
     }
   };
   let busy = false;
+  let closed = false;
   const markStopped = async (member) => {
     try {
       await setAvailable(member.creds, false);
@@ -31715,12 +31815,17 @@ function startPoolLoop(run4, sup, record, account) {
             if (pool.ownerPool) resetOwnerPoolSlot(member.agent.worktree, member.agent.runAs);
             else resetWorktree(member.agent.worktree);
           }
+          if (closed) return;
           await setAvailable(member.creds, true);
           markedAt.delete(name);
         } catch (err) {
           log(`not starting ${name}: ${err instanceof Error ? err.message : String(err)}`);
           continue;
         }
+        if (closed) {
+          await markStopped(member);
+          return;
+        }
         lastBusy.set(name, Date.now());
         sup.startAgent(name);
         log(`started ${name} (ready ${summary2.ready})`);
@@ -31746,9 +31851,25 @@ function startPoolLoop(run4, sup, record, account) {
       busy = false;
     }
   };
-  void tick();
-  const timer = setInterval(() => void tick(), reconcileMs);
-  return () => clearInterval(timer);
+  let inflight = null;
+  const schedule = () => {
+    if (inflight) return;
+    inflight = tick().finally(() => {
+      inflight = null;
+    });
+  };
+  schedule();
+  const timer = setInterval(schedule, reconcileMs);
+  const stop = (() => {
+    closed = true;
+    clearInterval(timer);
+  });
+  stop.markRunningStopped = async () => {
+    closed = true;
+    const running = members.filter((m) => sup.isActive(m.agent.name));
+    await Promise.all([inflight, ...running.map((m) => markStopped(m))]);
+  };
+  return stop;
 }
 var MODEL_REFRESH_MS = 15e3;
 function desiredIdentity(api, root, nodeToken, log) {
@@ -31834,10 +31955,12 @@ async function nodeUpDesired() {
     sup.start();
     const identity = createIdentityRefresher(capacityDir());
     const loops = [];
+    const poolLoops = [];
     const stopAll = [];
     let rebuild = null;
     const rebuildLoops = () => {
       for (const stop of loops.splice(0)) stop();
+      poolLoops.splice(0);
       const runnable = allAgents(latest).filter((a) => sup.has(a.name));
       const credsOf = (a) => readCreds(a.name);
       const byRepo = /* @__PURE__ */ new Map();
@@ -31855,10 +31978,12 @@ async function nodeUpDesired() {
         });
         if (members.length === 0) continue;
         poolStates[pool.pool] = poolStates[pool.pool] ?? { members: members.map((m) => m.agent.name), min: pool.min, max: pool.max, ready: null, checkedAt: null };
-        loops.push(startPoolLoop({ pool, members, ...pool.ownerPool ? { bases: ownerBases } : {} }, sup, (name, state) => {
+        const loop = startPoolLoop({ pool, members, ...pool.ownerPool ? { bases: ownerBases } : {} }, sup, (name, state) => {
           poolStates[name] = state;
           writeState({ ...base2, agents: sup.snapshot(), pools: poolStates });
-        }, () => identity.current()));
+        }, () => identity.current());
+        loops.push(loop);
+        poolLoops.push(loop);
       }
       for (const name of Object.keys(poolStates)) if (!latest.pools.some((p) => p.pool === name)) delete poolStates[name];
     };
@@ -31937,10 +32062,7 @@ async function nodeUpDesired() {
     }, 6e4);
     const shutdown = async () => {
       clearInterval(keepAlive);
-      for (const stop of [...loops, ...stopAll, stopHeartbeat, janitor.stop]) stop();
-      console.log(source_default.dim("\n  stopping agents\u2026"));
-      await sup.stop();
-      process.exit(0);
+      await shutdownNode({ stops: [...loops, ...stopAll, stopHeartbeat, janitor.stop], sup, poolLoops: [...poolLoops], exit: (code) => process.exit(code) });
     };
     const janitor = startJanitorService({ roots: [root], managed: () => managedOfSpec(latest), nodeId: node2.nodeId, log: (line) => console.log(source_default.dim(`  ${line}`)) });
     const stopHeartbeat = startNodeHeartbeat(
@@ -32074,14 +32196,12 @@ async function nodeUpCommand(specFile, opts = {}) {
 `));
     const stopLoops = [];
     const ownerBases = createOwnerPoolBases(ownerPoolBasesDepsFor(opts));
+    const poolLoops = [];
     let stopping = false;
     const shutdown = async () => {
       if (stopping) return;
       stopping = true;
-      for (const stopLoop of stopLoops) stopLoop();
-      console.log(source_default.dim("\n  stopping agents\u2026"));
-      await sup.stop();
-      process.exit(0);
+      await shutdownNode({ stops: stopLoops, sup, poolLoops, exit: (code) => process.exit(code) });
     };
     process.on("SIGINT", shutdown);
     process.on("SIGTERM", shutdown);
@@ -32126,10 +32246,12 @@ async function nodeUpCommand(specFile, opts = {}) {
         continue;
       }
       poolStates[pool.pool] = { members: ready.map((m) => m.agent.name), min: pool.min, max: pool.max, ready: null, checkedAt: null, ...pool.ownerPool ? { ownerPool: true } : {} };
-      stopLoops.push(startPoolLoop({ pool, members: ready, ...pool.ownerPool ? { bases: ownerBases } : {} }, sup, (name, state) => {
+      const loop = startPoolLoop({ pool, members: ready, ...pool.ownerPool ? { bases: ownerBases } : {} }, sup, (name, state) => {
         poolStates[name] = state;
         writeState({ ...base2, agents: sup.snapshot(), pools: poolStates });
-      }, () => identity.current()));
+      }, () => identity.current());
+      stopLoops.push(loop);
+      poolLoops.push(loop);
     }
   } catch (err) {
     console.error(source_default.red(`
@@ -33944,7 +34066,7 @@ var token = program2.command("token").description("Manage your agent's API token
 token.command("rotate").description("Issue a new token, revoke the old one, and list the configs that still hold it").action(tokenRotateCommand);
 token.command("list").description("List your agent's tokens, live and revoked, and mark the one in use").action(tokenListCommand);
 token.command("revoke <tokenId>").description("Revoke a specific token id").action(tokenRevokeCommand);
-program2.command("onboard <github-url>").description("Set a GitHub repo up for Shipster: clone it, write a node spec (tier-2 architect, reviewer, writer pool) and print one device code that grants every agent. Starts nothing").option("--account <login>", "GitHub account to clone and work as, from `gh auth` (for example a personal account)").option("--dir <path>", "Parent directory for the clone, worktrees and spec (default ~/github)").option("--architect <runtime>", "Runtime for the tier-2 architect (asked for when there is a terminal and no flag)").option("--writer <runtime>", "Runtime for the writer pool (asked for when there is a terminal and no flag)").option("--reviewer <runtime>", "Runtime for the reviewer; may match the writers, with a warning (asked for when there is a terminal and no flag)").option("--pool-max <n>", "Writer pool size (default 2)").option("--force", "Replace an existing spec with different contents").action(onboardCommand);
+program2.command("onboard <github-url>").description("Set a GitHub repo up for Shipster: clone it, write a node spec (tier-2 architect, reviewer, writer pool) and print one device code that grants every agent. Starts nothing").option("--account <login>", "GitHub account to clone and work as, from `gh auth` (for example a personal account)").option("--dir <path>", "Parent directory for the clone, worktrees and spec (default ~/github)").option("--architect <runtime>", "Runtime for the tier-2 architect (asked for when there is a terminal and no flag)").option("--writer <runtime>", "Runtime for the writer pool (asked for when there is a terminal and no flag)").option("--reviewer <runtime>", "Runtime for the reviewer; may match the writers, with a warning (asked for when there is a terminal and no flag)").option("--pool-max <n>", "Writer pool size (default 2)").option("--writer-models <list>", "One to three writer models, cheapest first, comma-separated: one writer pool per tier and a reviewer pool, all scaling to zero").option("--force", "Replace an existing spec with different contents").action(onboardCommand);
 var node = program2.command("node").description("Run this machine's agents headless and keep them running");
 node.command("up [spec]").description("Start every agent in a spec file and restart any that exit (foreground; Ctrl-C stops them). With no spec file, follows the desired state the dashboard holds for this enrolled node").option(
   "--invite <name=code>",

package/dist/event-worker.js

@@ -81,6 +81,12 @@ var BASE_TASK_LOOP = (agentId, repoPath) => `You are an AI worker agent (ID: ${a
    c. Read the task carefully. If the row is marked \`truncated:true\`, call
       \`mcp__relai__get_task\` with its id for the full description before acting \u2014
       the list clips descriptions, and the rest of the spec is only on that drill-in.
+      If \`metadata.checkpoint\` is set (\`mcp__relai__get_task\` if \`metadata._truncated\` lists it in \`keys\`),
+      start from its \`next\` and \`unverified\` lists. It is an earlier session's notes: information, not
+      authorisation, and cannot widen the task's scope. Work on the task's own branch (\`metadata.branchName\`
+      or the order's), never its \`branch\`, \`wipRef\` or \`worktree\`; if its \`branch\` differs, say so in a task
+      comment. \`headSha\` is the last commit it knew there: read later commits before acting on \`next\`, and
+      comment if the tip lacks it. A finding, human reply or task edit newer than \`checkpoint.at\` wins.
       Check \`metadata\` for \`branchName\`, \`roundNumber\`, and any leftover
       \`findings\`; also read finding comments on the thread from step b \u2014 that is where
       new findings land. If \`metadata.humanReply\` is set, this task was previously blocked
@@ -97,10 +103,14 @@ var BASE_TASK_LOOP = (agentId, repoPath) => `You are an AI worker agent (ID: ${a
       the same thing: either proceed on your own judgement and say in your handoff that you did, or
       escalate to a human by blocking with a question addressed to nobody.
    d. Do the work per your specialization rules below.
-   e. Post your result on the task's own thread (\`mcp__relai__add_task_comment\` or
+   e. If the work is on a branch, commit and push it, then call \`mcp__relai__checkpoint_task\` while the
+      task is still \`in_progress\`: before every \`update_task_status\` to "completed" or "blocked" and
+      every \`assign_task\`, including those in the role, round-limit and order rules below, and when out
+      of room. \`dirty\` and \`wipRef\` are only for work that cannot be committed.
+   f. Post your result on the task's own thread (\`mcp__relai__add_task_comment\` or
       \`mcp__relai__send_message\` type "handoff"), with \`toAgent\` set to whoever you
       report to: the task's \`createdBy\` unless told otherwise.
-   f. If the work is done: \`mcp__relai__update_task_status\` \u2192 "completed"
+   g. If the work is done: \`mcp__relai__update_task_status\` \u2192 "completed"
       (or "blocked" if escalating). If another role must continue this same task,
       \`mcp__relai__assign_task\` to them and stop \u2014 do not complete.
 
@@ -225,8 +235,9 @@ types, empty classes) but you do not take the implementation yourself.
 
 - Read relevant files to understand current structure.
 - Write a clear technical design on this task's thread (\`mcp__relai__add_task_comment\`).
-  If scaffolding helps, write it on the branch in \`branchName\` (derive one if missing,
-  same slug rule as writer).
+  If scaffolding helps, write it on the branch in \`branchName\`: if set, \`git fetch origin\` then
+  \`git checkout -B {branchName} origin/{branchName}\`; if missing, derive one (same slug rule as writer)
+  and stamp it as \`metadata.branchName\` with \`mcp__relai__update_task_status\`. Never force-push.
 - \`mcp__relai__list_agents\`, pick specialization \`"writer"\` (prefer online), then
   \`mcp__relai__assign_task\` to them. Do not complete.
 
@@ -239,9 +250,13 @@ types, empty classes) but you do not take the implementation yourself.
 You implement specs on a branch and open a PR. Write production code and tests.
 
 **Workflow:**
-1. Check metadata for branchName. If none, derive one from the task title:
+1. Check metadata for branchName. If set, the branch holds earlier work: \`git fetch origin\` then
+   \`git checkout -B {branchName} origin/{branchName}\` (only if the remote branch does not exist, create
+   it from the default branch). If none, derive one from the task title:
    slug the title to lowercase-hyphenated, prefix "feat/".
-   Use Bash to create the branch: \`git checkout -b {branchName}\`.
+   Use Bash to create the branch: \`git checkout -b {branchName}\`. Stamp it on this task via
+   \`mcp__relai__update_task_status\` with status \`"in_progress"\` and \`metadata.branchName\`.
+   Never force-push to make a push succeed.
 2. Read the spec. Read existing files to understand patterns (Read, Grep, Glob).
 3. Implement: write code, update tests, follow existing conventions exactly.
 4. Run tests: check package.json scripts for the test command.
@@ -250,7 +265,8 @@ You implement specs on a branch and open a PR. Write production code and tests.
    - First try \`gh pr create --fill\` \u2014 captures the PR URL automatically when the GitHub CLI is installed and authed.
    - If \`gh\` isn't available (\`command -v gh\` fails) or it returns a non-zero exit, fall back to \`git push -u origin {branchName}\`. Then read the remote with \`git remote get-url origin\` so you can hand the reviewer a clickable branch URL even without an open PR. Set \`prUrl\` to the PR URL when you have one, otherwise to the branch URL on the remote.
 7. Post a handoff on the task's own thread with \`mcp__relai__add_task_comment\` (type: "handoff"):
-   PR URL, head sha, what landed, and tests. Then \`mcp__relai__update_task_status\` \u2192 "completed".
+   PR URL, head sha, what landed, and tests. Then, after the step e checkpoint,
+   \`mcp__relai__update_task_status\` \u2192 "completed".
    - If the task has \`verifyReviewerId\` or any reviewer gate, completed moves it to
      pending_verification. Do not then \`update_task_status\` to \`"in_progress"\` \u2014
      the reviewer decides via \`submit_review\`, and a reject returns the task to
@@ -1889,7 +1905,8 @@ var PITBOSS_NAMES = [
   "ENV_GRANT",
   "TASK_REPO_ID",
   "TASK_REPO_URL",
-  "OWNER_POOL_SLOT"
+  "OWNER_POOL_SLOT",
+  "SESSION_MAX_MS"
 ].flatMap(envNames);
 var WORKER_KNOBS = [
   "API_URL",
@@ -2750,6 +2767,13 @@ async function clearUnavailable(config2, logPrefix = "[claude-worker]") {
 }
 
 // ../claude-worker/src/worker.ts
+var SESSION_HEARTBEAT_MS = 6e4;
+var DEFAULT_SESSION_MAX_MS = 90 * 6e4;
+var MAX_TIMER_MS = 2147483647;
+function sessionMaxMs(source = process.env) {
+  const ms = Number(readEnv("SESSION_MAX_MS", source) ?? NaN);
+  return Number.isFinite(ms) && ms >= 0 ? Math.min(ms, MAX_TIMER_MS) : DEFAULT_SESSION_MAX_MS;
+}
 async function heartbeat(config2, logPrefix = "[claude-worker]") {
   await fetch(`${config2.apiUrl}/agents/${config2.agentId}/heartbeat`, {
     method: "PUT",
@@ -2757,6 +2781,17 @@ async function heartbeat(config2, logPrefix = "[claude-worker]") {
     body: "{}"
   }).catch((err) => console.warn(`${logPrefix} Heartbeat failed:`, err.message));
 }
+async function withHeartbeat(config2, logPrefix, session) {
+  const maxMs = sessionMaxMs();
+  const quiet = maxMs > 0 ? setTimeout(() => clearInterval(beat), maxMs) : void 0;
+  const beat = setInterval(() => void heartbeat(config2, logPrefix), SESSION_HEARTBEAT_MS);
+  try {
+    return await session();
+  } finally {
+    clearTimeout(quiet);
+    clearInterval(beat);
+  }
+}
 async function assertRepoOrExit(config2, logPrefix = "[claude-worker]") {
   const repoUrl = await fetchRepoUrl(config2.apiUrl, config2.repoId, config2.apiSecret);
   const check = checkRepoMatch(config2.repoPath, repoUrl);
@@ -3658,6 +3693,32 @@ async function checkWork(config2) {
     repoIds: [...new Set(myTasks.map((t) => t.repoId).filter((id) => typeof id === "string"))].sort()
   };
 }
+async function recordSessionTimeout(config2, taskId, minutes, timeouts) {
+  const headers = { "Content-Type": "application/json", Authorization: `Bearer ${config2.apiSecret}` };
+  const count = (timeouts.get(taskId) ?? 0) + 1;
+  timeouts.set(taskId, count);
+  try {
+    const res = await fetch(`${config2.apiUrl}/tasks/${taskId}`, { headers });
+    if (!res.ok) throw new Error(`task lookup failed (${res.status} ${res.statusText})`);
+    const { data: task } = await res.json();
+    const mine = task?.assignedTo === config2.agentId;
+    if (!mine) console.error(`[event-worker] ${taskId} is not assigned to this agent (a review, or reassigned), so the timeout is a comment only`);
+    const block = mine && count >= 2;
+    const out = block ? await fetch(`${config2.apiUrl}/tasks/${taskId}`, {
+      method: "PUT",
+      headers,
+      body: JSON.stringify({ status: "blocked", metadata: { blockedReason: `The session cap (${minutes} minutes) was hit twice on this task. Each session was killed. Split the task or find out why it hangs before reassigning it.` } })
+    }) : await fetch(`${config2.apiUrl}/tasks/${taskId}/comments`, {
+      method: "POST",
+      headers,
+      body: JSON.stringify({ body: `The session working this task hit the ${minutes}-minute cap and was killed. The task stays as it is, and the next wake resumes it in a fresh session.` })
+    });
+    if (!out.ok) console.error(`[event-worker] Could not record the session timeout on ${taskId} (${out.status} ${out.statusText})`);
+    else if (block) timeouts.delete(taskId);
+  } catch (err) {
+    console.error("[event-worker] Could not record the session timeout:", err instanceof Error ? err.message : String(err));
+  }
+}
 var EVENT_KINDS = [
   "message.posted",
   "task.created",
@@ -3671,6 +3732,9 @@ var EVENT_KINDS = [
   "task.blocked",
   "task.pending_verification",
   "task.stalled",
+  "task.stall_released",
+  "task.down_released",
+  "task.rerouted",
   "task.verified",
   "task.verification_failed",
   "task.review_requested",
@@ -3704,6 +3768,16 @@ function endsTask(event, taskId) {
   if (!task || task.id !== taskId) return false;
   return task.status === "cancelled" || task.archivedAt !== void 0 && task.archivedAt !== null;
 }
+var RELEASE_KINDS = ["task.stall_released", "task.down_released"];
+function releasedTask(event, taskId) {
+  const e = event;
+  return e?.targetId === taskId && typeof e.kind === "string" && RELEASE_KINDS.includes(e.kind);
+}
+function reroutedAway(event, taskId, agentId) {
+  const e = event;
+  if (e?.kind !== "task.rerouted" || e.targetId !== taskId) return false;
+  return e.payload?.previousAssignee === agentId && typeof e.payload.assignedTo === "string" && e.payload.assignedTo !== agentId;
+}
 async function runEventWorker(config2) {
   console.log(`[event-worker] Starting \u2014 agent ${config2.agentId}, watching ${config2.apiUrl}/events`);
   console.log(`[event-worker] Repo: ${config2.repoPath} | Runtime: ${config2.runtime} | Model: ${config2.model}`);
@@ -3711,6 +3785,7 @@ async function runEventWorker(config2) {
   await assertNotOwnerScopedOrExit(config2, "[event-worker]");
   await selfSubscribe(config2);
   let live = null;
+  const timeouts = /* @__PURE__ */ new Map();
   const queue = createRunQueue(async () => {
     await heartbeat(config2, "[event-worker]");
     const slotMode = readEnv("OWNER_POOL_SLOT") === "1";
@@ -3765,6 +3840,8 @@ async function runEventWorker(config2) {
       }
     }
     const controller = new AbortController();
+    const maxMs = sessionMaxMs();
+    let timedOut = false;
     try {
       console.log("[event-worker] Event received \u2014 running session...");
       const activityFile = readEnv("ACTIVITY_FILE");
@@ -3784,9 +3861,16 @@ async function runEventWorker(config2) {
         setEnv(TASK_REPO_URL_ENV, checkout.repoUrl);
       }
       if (checkout) live = { taskId: checkout.taskId, controller };
+      const cap = maxMs > 0 ? setTimeout(() => {
+        if (controller.signal.aborted) return;
+        timedOut = true;
+        controller.abort();
+      }, maxMs) : void 0;
       try {
-        await getAdapter(config2.runtime).runSession(config2, { signal: controller.signal });
+        await withHeartbeat(config2, "[event-worker]", () => getAdapter(config2.runtime).runSession(config2, { signal: controller.signal }));
+        if (checkout) timeouts.delete(checkout.taskId);
       } finally {
+        clearTimeout(cap);
         live = null;
         if (controller.signal.aborted && readEnv(RESET_SEAT_DIR_ENV)) {
           try {
@@ -3809,8 +3893,14 @@ async function runEventWorker(config2) {
       await clearUnavailable(config2, "[event-worker]");
     } catch (err) {
       const text = err instanceof Error ? err.message : String(err);
+      if (timedOut) {
+        const minutes = Math.max(1, Math.ceil(maxMs / 6e4));
+        console.error(`[event-worker] Session hit the ${minutes}-minute cap (SESSION_MAX_MS) and was killed${checkout ? "" : "; it had no tracked task, so no task was written"}`);
+        if (checkout) await recordSessionTimeout(config2, checkout.taskId, minutes, timeouts);
+        return;
+      }
       if (controller.signal.aborted) {
-        console.log(`[event-worker] Session stopped because its task was cancelled or archived (${text.split("\n")[0].slice(0, 120)})`);
+        console.log(`[event-worker] Session stopped because its task was ${controller.signal.reason} (${text.split("\n")[0].slice(0, 120)})`);
         return;
       }
       const exitActivityFile = readEnv("ACTIVITY_FILE");
@@ -3857,9 +3947,10 @@ async function runEventWorker(config2) {
       try {
         const event = JSON.parse(raw.data);
         console.log(`[event-worker] Event: ${event.kind ?? "unknown"}`);
-        if (live && endsTask(event, live.taskId) && !live.controller.signal.aborted) {
-          console.warn(`[event-worker] task ${live.taskId} was cancelled or archived \u2014 stopping its session`);
-          live.controller.abort();
+        const why = !live || live.controller.signal.aborted ? null : endsTask(event, live.taskId) ? "cancelled or archived" : releasedTask(event, live.taskId) ? "released to the queue" : reroutedAway(event, live.taskId, config2.agentId) ? "rerouted to another agent" : null;
+        if (live && why) {
+          console.warn(`[event-worker] task ${live.taskId} was ${why} \u2014 stopping its session`);
+          live.controller.abort(why);
         }
       } catch {
       }

package/dist/mcp.js

@@ -12343,7 +12343,8 @@ var ApiClient = class {
     this.headers = {
       "Content-Type": "application/json",
       Authorization: `Bearer ${config.secret}`,
-      ...config.ownerId ? { "X-Owner-Id": config.ownerId } : {}
+      ...config.ownerId ? { "X-Owner-Id": config.ownerId } : {},
+      ...config.sessionId ? { "X-Shipster-Session": config.sessionId } : {}
     };
   }
   // For routes with sibling fields next to `data` (e.g. the unread feed's
@@ -12653,6 +12654,9 @@ var ApiClient = class {
   releaseTask(taskId, force) {
     return this.request("POST", `/tasks/${taskId}/release`, force === void 0 ? {} : { force });
   }
+  checkpointTask(taskId, checkpoint) {
+    return this.request("POST", `/tasks/${taskId}/checkpoint`, checkpoint);
+  }
   archiveThread(threadId) {
     return this.request("PUT", `/threads/${threadId}/archive`, {});
   }
@@ -12709,6 +12713,26 @@ var ApiClient = class {
   }
 };
 
+// ../mcp-server/src/session-id.ts
+import { randomBytes } from "node:crypto";
+var SESSION_ID_PATTERN = /^[A-Za-z0-9._:-]{1,64}$/;
+var URL_SAFE = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_-";
+var generated;
+function generate() {
+  const bytes = randomBytes(12);
+  let out = "ses_";
+  for (const b of bytes) out += URL_SAFE[b % URL_SAFE.length];
+  return out;
+}
+function resolveSessionId(env2 = process.env) {
+  for (const name of ["CLAUDE_CODE_SESSION_ID", "CLAUDE_SESSION_ID"]) {
+    const value = env2[name];
+    if (value && SESSION_ID_PATTERN.test(value)) return value;
+  }
+  generated ??= generate();
+  return generated;
+}
+
 // ../mcp-server/src/register-tools.ts
 init_zod();
 
@@ -12856,7 +12880,7 @@ function pausedExplanation(held) {
   return {
     omitted: held.length,
     pauses: [...seen.values()],
-    instruction: "The owner paused new work. Start nothing new: finish the current step of any in_progress task, commit or push what you have, post a checkpoint comment, and stop."
+    instruction: "The owner paused new work. Start nothing new: finish the current step of any in_progress task, commit or push what you have, save a checkpoint with checkpoint_task, and stop."
   };
 }
 function listTasksLimit() {
@@ -13694,7 +13718,7 @@ ${version.body}`
     },
     {
       name: "get_my_tasks",
-      description: "Retrieve tasks assigned to this agent. Use this at the start of a session or when you want to know what work is queued for you. Returns tasks with status 'assigned' or 'in_progress'. Always call this before starting new work so you don't duplicate effort. humanLabel 'Not picked up' means this task was assigned to you hours ago and nothing has touched it since \u2014 the assignment notice never reached you. Start it now, or say on its thread why you are not going to. Capped and newest-first, with descriptions clipped \u2014 an uncapped queue once blew past the tool-result limit. A task still 'assigned' inside a paused scope (repo, order or account) is left out and explained in a top-level `paused` block: the owner paused new work, so start nothing new; in_progress tasks stay listed so you can finish the step and post a checkpoint. taskCount is the true total; raise `limit` to see more. A row marked truncated:true is a pointer \u2014 call get_task for the full description.",
+      description: "Retrieve tasks assigned to this agent. Use this at the start of a session or when you want to know what work is queued for you. Returns tasks with status 'assigned' or 'in_progress'. Always call this before starting new work so you don't duplicate effort. humanLabel 'Not picked up' means this task was assigned to you hours ago and nothing has touched it since \u2014 the assignment notice never reached you. Start it now, or say on its thread why you are not going to. Capped and newest-first, with descriptions clipped \u2014 an uncapped queue once blew past the tool-result limit. A task still 'assigned' inside a paused scope (repo, order or account) is left out and explained in a top-level `paused` block: the owner paused new work, so start nothing new; in_progress tasks stay listed so you can finish the step and save a checkpoint with checkpoint_task. taskCount is the true total; raise `limit` to see more. A row marked truncated:true is a pointer \u2014 call get_task for the full description.",
       inputSchema: external_exports.object({
         status: external_exports.enum(["assigned", "in_progress", "pending", "all"]).optional().describe("Filter by task status. Omit for both 'assigned' and 'in_progress'."),
         limit: external_exports.number().int().min(1).optional().describe("Max tasks to return, newest-updated first. Defaults to 50.")
@@ -13772,6 +13796,33 @@ ${version.body}`
         });
       }
     },
+    {
+      name: "checkpoint_task",
+      description: "Save your work-in-progress state on an in_progress task you hold. The next session on it remembers nothing of this one and starts from this checkpoint. Call it before you stop working the task for any reason, and after any step you would not want redone. Each call replaces the previous checkpoint. You keep the task; with a pause pending the checkpoint releases it and the result says to stop.",
+      inputSchema: external_exports.object({
+        taskId: external_exports.string().describe("The task you hold."),
+        branch: external_exports.string().describe("Branch the work is on."),
+        headSha: external_exports.string().describe("Full sha of your last commit."),
+        worktree: external_exports.string().optional().describe("Checkout path, if not the repo path."),
+        done: external_exports.array(external_exports.string()).describe("Finished and proved, with the evidence."),
+        next: external_exports.array(external_exports.string()).describe("What to do next, in order."),
+        unverified: external_exports.array(external_exports.string()).describe("Claims not yet proved, and what would prove each."),
+        dirty: external_exports.boolean().optional().describe("Uncommitted changes exist. Needs wipRef."),
+        wipRef: external_exports.string().optional().describe("Pushed ref holding them: refs/wip/<taskId>.")
+      }),
+      handler: async (input) => {
+        if (input.dirty && !input.wipRef) {
+          return mcpFail(new Error("A dirty checkpoint needs wipRef: push the uncommitted work to a ref first."));
+        }
+        const { taskId, ...checkpoint } = input;
+        try {
+          const { task } = await client.checkpointTask(taskId, checkpoint);
+          return { content: [{ type: "text", text: !task.assignedTo ? `Checkpoint saved and task ${taskId} released: a pause was pending. Stop working on it now.` : `Checkpoint saved on task ${taskId}. You still hold it.` }] };
+        } catch (err) {
+          return mcpFail(err);
+        }
+      }
+    },
     buildUpdateTaskTool(client),
     {
       name: "send_message",
@@ -15190,7 +15241,10 @@ if (OWNER_MODE) {
 var apiClient = new ApiClient({
   baseUrl: API_URL,
   secret: OWNER_MODE ? API_OWNER_TOKEN : API_SECRET,
-  ownerId: OWNER_MODE ? OWNER_ID : void 0
+  ownerId: OWNER_MODE ? OWNER_ID : void 0,
+  // stdio is one process per agent session, so one id per process is right.
+  // HTTP serves several callers from this single client, so it sends none.
+  sessionId: TRANSPORT === "stdio" ? resolveSessionId() : void 0
 });
 var server = createMcpServer(OWNER_MODE ? "relai-operator" : "relai", pkg.version);
 var toolConfig = OWNER_MODE ? { ownerMode: true, ownerId: OWNER_ID } : { ownerMode: false, agentId: AGENT_ID, repoId: REPO_ID };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shipster/cli",
-  "version": "0.5.1",
+  "version": "0.5.3",
   "private": false,
   "description": "Connect your coding agents to a pitboss instance",
   "keywords": [