@songsid/agend 2.3.0-beta.9 → 2.3.1

package/dist/daemon.js

@@ -1,4 +1,4 @@
-import { AGENT_WHATS_NEW, agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, whatsNewNotice } from "./agent-whats-new.js";
+import { agentWhatsNew, agendVersion, planWhatsNew, readWhatsNewRecord, recordWhatsNew, whatsNewNotice } from "./agent-whats-new.js";
 import { join, dirname, resolve } from "node:path";
 import { checkoutTarget, readCheckouts, releaseCandidate, reposRoot, verifyWorktree, writeCheckouts } from "./repo-worktree-guard.js";
 import { mkdirSync, writeFileSync, readFileSync, readdirSync, existsSync, unlinkSync, rmSync, appendFileSync, statSync, renameSync } from "node:fs";
@@ -10,6 +10,8 @@ import { createHash, randomBytes, randomUUID } from "node:crypto";
 import { EventEmitter } from "node:events";
 import { rotateLogIfNeededAsync } from "./logger.js";
 import { coredumpFilterLaunchPrefix } from "./coredump-filter.js";
+import { observeCliOomIdentity, confirmedCliOom, consecutiveSessionOoms, describeSelfOom } from "./session-oom.js";
+import { assertNoSessionOomStop, readSessionOomStop, writeSessionOomStop, SessionOomStoppedError, sessionOomStopHint } from "./session-oom-stop.js";
 import { mcpServerState } from "./mcp-liveness.js";
 import { clearPausedMarker, writePausedMarker } from "./pause-marker.js";
 import { writeBackgroundWorkEndedMarker } from "./background-work-ended.js";
@@ -19,7 +21,9 @@ import { createTranscriptSource } from "./transcript-sources.js";
 import { TranscriptTurnLedger } from "./transcript-turns.js";
 import { credentialProfileStoreHome, resolveCredentialProfile } from "./backend/credential-profile.js";
 import { resolveToolSet } from "./tool-permissions.js";
+import { dashboardAccessProblem, dashboardFeaturesOff } from "./dashboard-permissions.js";
 import { getAgendHome } from "./paths.js";
+import { readCanvasWorkerEnabled, scopedFleetConfigEnvironment } from "./web-experimental.js";
 import { readAgentEffect, sendEffectInParts } from "./web-effect-upload.js";
 import { readAgentFile } from "./agent-file-read.js";
 import { ASSET_UPLOAD_MAX_BYTES, MOD_FILE, MOD_MAX_PARTS, MOD_UPLOAD_MAX_BYTES, receiveFiles, receivePreview, sendAssetInParts, writeModFile, writePreview } from "./web-asset-parts.js";
@@ -53,7 +57,9 @@ import { measureSyncWork, noteSyncWork } from "./sync-work-attribution.js";
 import { TranscriptDeltaReader } from "./transcript-delta-reader.js";
 import { buildResumeContinuation, clearInFlightTurnMarker, consumeInFlightTurnMarker, decideTurnResume, normalizeResumeBackend, readResumeFingerprint, RESUME_BLOCKING_DELIVERY_STATES, writeInFlightTurnMarker, } from "./turn-resume.js";
 import { codexLiveRowMatches } from "./backend/codex.js";
+import { codexPackageProblemMessage } from "./backend/codex-package.js";
 import { claudeConfigDirFor, claudeProfileConfigDir, claudeSwitchDialog, claudeSwitchTargetMatches } from "./backend/claude-code.js";
+import { MuseBackend } from "./backend/muse.js";
 import { InteractionObservation, INTERACTION_CONFIRM_MS, sameInteractionOwner } from "./interaction-observation.js";
 import { unrecognisedPromptShape } from "./unrecognised-prompt.js";
 /** #2140: deliveries that may carry an unwritten what's-new notice before it is recorded anyway. */
@@ -1157,6 +1163,37 @@ export class Daemon extends EventEmitter {
     // injected by FleetManager below.
     healthCheckTimer = null;
     crashCount = 0;
+    cliOomObservation = null;
+    consecutiveOoms = null;
+    collateralOomRecovery = false;
+    unclearOomStopped = false;
+    sessionOomStopUnpersisted = false;
+    assertSessionOomAdmission() {
+        if (this.sessionOomStopUnpersisted)
+            throw new SessionOomStoppedError(false, { blocked: true, record: null, revision: null, confirmedOom: true });
+        assertNoSessionOomStop(this.instanceDir);
+    }
+    isSessionOomStopped() {
+        return this.sessionOomStopUnpersisted || readSessionOomStop(this.instanceDir).blocked;
+    }
+    isUnclearOomStopped() {
+        return this.unclearOomStopped && this.healthCheckPaused && this.processStatus === "crashed";
+    }
+    stopUnclearOom(exitCode) {
+        this.unclearOomStopped = true;
+        this.healthCheckPaused = true;
+        this.emitSupervisionEnded(t("inst.oom_unclear_stopped"), t("inst.session_oom_remedy"), exitCode, "oom_unclear");
+    }
+    oomSessionKey() {
+        // Claude's per-instance statusline owns its ID. Other current getters
+        // either return null or select by cwd (Muse/Grok): those are not proof
+        // of this pane's session and must not trigger this destructive decision.
+        if ((this.config.backend ?? "claude-code") !== "claude-code")
+            return null;
+        const session = this.backend?.getSessionId?.();
+        return typeof session === "string" && session.trim() && session.length <= 512
+            ? JSON.stringify([this.config.backend ?? "claude-code", session.trim()]) : null;
+    }
     lastCrashAt = 0;
     lastSpawnAt = 0;
     crashTimestamps = [];
@@ -1565,6 +1602,7 @@ export class Daemon extends EventEmitter {
     windowQueryFailureTicks = 0;
     mcpRestartPending = false;
     mcpRestartStaleTimer = null;
+    mcpRestartCooldownTimer = null;
     /** In-flight replacement grace; also the guard against three triggers stacking. */
     mcpRestartGraceTimer = null;
     /**
@@ -1601,6 +1639,20 @@ export class Daemon extends EventEmitter {
     get isErrorState() {
         return this.errorWaitingForRecovery || (this.healthCheckPaused && !this.isPaused) || this.stormWindow?.isActive() === true;
     }
+    /**
+     * #2327: which of isErrorState's conditions holds, so a warning names the one actually observed. A CLI no longer
+     * supervised outranks a tmux recovery, which outranks a detected error pattern — one match is enough for that last
+     * one, so it proves neither a pause nor a repetition.
+     */
+    get errorStateCause() {
+        if (this.healthCheckPaused && !this.isPaused)
+            return "unsupervised";
+        if (this.stormWindow?.isActive() === true)
+            return "tmux_recovering";
+        if (this.errorWaitingForRecovery)
+            return "error_detected";
+        return null;
+    }
     get isPaused() { return this.pauseWakeState !== "active"; }
     /** Current CLI process state for status surfaces and recovery commands. */
     getProcessStatus() {
@@ -1779,6 +1831,12 @@ export class Daemon extends EventEmitter {
             model: config.model ?? "default",
         };
         this.logger = rootLogger.child({ instance: name }, { level: config.log_level });
+        if (backend instanceof MuseBackend) {
+            const log = this.logger;
+            backend.setPlaceholderDebug((rec) => {
+                log.debug(rec, "muse empty-composer placeholder classified as empty");
+            });
+        }
         this.tmuxSessionName = getTmuxSession();
         this.messageBus = new MessageBus();
         this.messageBus.setLogger(this.logger);
@@ -1791,7 +1849,10 @@ export class Daemon extends EventEmitter {
         // finished turn can never resume after a later restart. reset() is
         // deliberately NOT hooked: stop/spawn abandon the in-memory turn while
         // the on-disk interruption must survive for the resume gate.
-        this.turnReplyGuard.onComplete = () => clearInFlightTurnMarker(this.instanceDir);
+        this.turnReplyGuard.onComplete = () => {
+            clearInFlightTurnMarker(this.instanceDir);
+            this.publishWorkingState("turn_closed");
+        };
     }
     /** FleetManager and this daemon share a process, so durable begin/ACK is a direct synchronous store call. */
     setDeliveryOutboxPort(port) {
@@ -2086,6 +2147,11 @@ export class Daemon extends EventEmitter {
      * daemon's own state only; it never inspects the pane itself.
      */
     notAcceptingReason() {
+        if (this.sessionOomStopUnpersisted)
+            return t("inst.session_oom_hold");
+        const oomStop = readSessionOomStop(this.instanceDir);
+        if (oomStop.blocked)
+            return sessionOomStopHint(oomStop);
         if (this.pauseWakeState !== "active")
             return t("delivery.hold_state", this.pauseWakeState);
         if (this.inputBlockedDialogKey !== null)
@@ -2136,6 +2202,7 @@ export class Daemon extends EventEmitter {
         }
     }
     async startAdmitted() {
+        this.assertSessionOomAdmission();
         ensureInstanceDir(this.instanceDir);
         writeFileSync(join(this.instanceDir, "daemon.pid"), String(process.pid));
         this.logger.info(`Starting ${this.name}`);
@@ -2356,6 +2423,7 @@ export class Daemon extends EventEmitter {
                 ackIfPending();
                 this.recordRecentEvent({ type: "assistant_text", preview: text.slice(0, 100) });
             });
+            this.transcriptMonitor.on("codex_package_missing_host", (root) => this.noteCodexPackageMissingHost(root));
             this.transcriptMonitor.startPolling();
             // HangDetector is the notification bridge to the fleet manager; pane state
             // transitions below are the sole source of hang events (see hang-detector.ts).
@@ -2583,6 +2651,24 @@ export class Daemon extends EventEmitter {
             this.fireMcpRestartRequest("already_idle");
         }
     }
+    /** Keep a cooldown-suppressed revival alive without bypassing the idle gate. */
+    deferMcpRestart(delayMs) {
+        this.clearMcpRestartRequest();
+        if (this.config.mcp_auto_restart === false || this.authFailureUnresolved
+            || this.mcpRestartCancelledByRecovery("cooldown"))
+            return;
+        this.mcpRestartPending = true;
+        this.mcpRestartCooldownTimer = setTimeout(() => {
+            this.mcpRestartCooldownTimer = null;
+            if (this.mcpRestartCancelledByRecovery("cooldown_expired"))
+                return;
+            this.clearMcpRestartRequest();
+            if (this.config.mcp_auto_restart === false || this.authFailureUnresolved || this.mcpServerAlive().alive)
+                return;
+            this.armMcpRestartWhenIdle();
+        }, Math.max(0, delayMs));
+        this.mcpRestartCooldownTimer.unref?.();
+    }
     /**
      * Single chokepoint for all three revival triggers (already_idle, idle_edge,
      * stale_timeout) — and therefore the one place worth re-checking reality.
@@ -2600,6 +2686,8 @@ export class Daemon extends EventEmitter {
     fireMcpRestartRequest(trigger) {
         if (this.mcpRestartCancelledByRecovery(trigger))
             return;
+        if (this.mcpRestartCooldownTimer)
+            return;
         // Authoritative re-read — the CLI may have replaced the server since the
         // health tick that armed this.
         if (this.mcpServerAlive().alive) {
@@ -2794,6 +2882,10 @@ export class Daemon extends EventEmitter {
     }
     clearMcpRestartRequest() {
         this.mcpRestartPending = false;
+        if (this.mcpRestartCooldownTimer) {
+            clearTimeout(this.mcpRestartCooldownTimer);
+            this.mcpRestartCooldownTimer = null;
+        }
         if (this.mcpRestartStaleTimer) {
             clearTimeout(this.mcpRestartStaleTimer);
             this.mcpRestartStaleTimer = null;
@@ -2862,6 +2954,19 @@ export class Daemon extends EventEmitter {
                     if (discardStaleHealth())
                         return;
                     if (paneStatus?.alive) {
+                        // Capture only a known primary while it lives. No extra tmux call: PID comes
+                        // from this same status read. Fast/unobserved deaths remain ordinary crashes.
+                        const key = this.oomSessionKey();
+                        if (this.cliOomObservation?.key !== key)
+                            this.cliOomObservation = null;
+                        if (paneStatus.pid && key && !this.cliOomObservation) {
+                            const identity = await observeCliOomIdentity(paneStatus.pid, cliLabel);
+                            if (discardStaleHealth())
+                                return;
+                            if (identity && this.oomSessionKey() === key) {
+                                this.cliOomObservation = { identity, key, owner: healthOwner, tmux: healthTmux };
+                            }
+                        }
                         this.windowQueryFailureTicks = 0;
                         this.stormWindow?.noteWindowAlive(this.name);
                         // Instance output.log is fed by tmux pipe-pane and was previously never
@@ -3016,6 +3121,47 @@ export class Daemon extends EventEmitter {
                         return;
                     this.setProcessStatus("crashed");
                     this.logPaneDeath(cliLabel, exitCode, lastOutput);
+                    const observed = this.cliOomObservation;
+                    const key = this.oomSessionKey();
+                    const oom = paneStatus && exitCode === 137 && observed && observed.key === key
+                        && observed.tmux === healthTmux && sameInteractionOwner(observed.owner, healthOwner)
+                        ? await confirmedCliOom(observed.identity, Date.now()) : null;
+                    if (discardStaleHealth())
+                        return;
+                    this.cliOomObservation = null;
+                    const decisionKey = this.oomSessionKey();
+                    this.consecutiveOoms = consecutiveSessionOoms(this.consecutiveOoms, decisionKey, decisionKey === key && oom?.attribution === "self");
+                    const collateralOom = oom?.attribution === "collateral";
+                    if (collateralOom)
+                        this.logger.warn({ attribution: oom.attribution, pid: oom.pid }, "OOM victim without self-caused proof — preserving session; waiting for memory recovery");
+                    if (this.consecutiveOoms && this.consecutiveOoms.count >= 2) {
+                        // Stop supervision, not an idle pause: queued work must not auto-wake
+                        // the same session. An explicit restart is the person's retry choice.
+                        // No await after the final captured health owner/session check. The
+                        // stop is authoritative before observers can see supervision end.
+                        try {
+                            writeSessionOomStop(this.instanceDir, { owner: healthOwner, sessionKey: decisionKey,
+                                configuration: this.getWorkingStateObservation().configuration, stoppedAt: Date.now(),
+                                count: this.consecutiveOoms.count, victim: { pid: oom.pid, at: oom.at }, evidence: oom.evidence });
+                        }
+                        catch {
+                            // Storage failure cannot revive this CLI in the current process.
+                            // Say explicitly that a fleet restart cannot yet rely on durability.
+                            this.sessionOomStopUnpersisted = true;
+                            this.logger.error("Could not persist session OOM stop; fix storage before restarting the fleet");
+                        }
+                        this.healthCheckPaused = true;
+                        try {
+                            this.appendCrashHistory({ exitCode, lastOutput, crashType, reason: "session_oom", oomEvidence: oom.evidence });
+                        }
+                        catch (error) {
+                            this.logger.warn({ error }, "Could not append session OOM history");
+                        }
+                        this.logger.error({ pid: oom.pid, count: this.consecutiveOoms.count }, "Repeated confirmed CLI OOM — automatic resume stopped; session preserved");
+                        this.emitSupervisionEnded(`${t("inst.session_oom_stopped")} (${describeSelfOom(oom.evidence)})`, t("inst.session_oom_remedy")
+                            + (this.sessionOomStopUnpersisted ? ` ${t("inst.session_oom_save_failed")}` : ""), exitCode, "session_oom");
+                        return;
+                    }
                     // Kill the dead window (remain-on-exit keeps it around) before respawn
                     if (paneStatus) {
                         await healthTmux.killWindow();
@@ -3023,7 +3169,7 @@ export class Daemon extends EventEmitter {
                             return;
                     }
                     // Detect claude-code background session conflict — recover without counting as crash
-                    if (lastOutput && (lastOutput.includes("background agent") || lastOutput.includes("Session is currently running"))) {
+                    if (!oom && lastOutput && (lastOutput.includes("background agent") || lastOutput.includes("Session is currently running"))) {
                         if (!this.backgroundSessionRecoveryAttempted) {
                             this.backgroundSessionRecoveryAttempted = true;
                             this.logger.warn("Detected lingering background agent session — starting fresh (no resume)");
@@ -3063,7 +3209,7 @@ export class Daemon extends EventEmitter {
                     // --continue again and crash in the same way → loop. Clear the session id
                     // and skip resume so the next spawn starts fresh. (skipResume also stops
                     // saveSessionId below from resurrecting the id from statusline.json.)
-                    if (this.paneSaysNoConversation(lastOutput)) {
+                    if (!oom && this.paneSaysNoConversation(lastOutput)) {
                         this.setSessionAside("cli_reported_no_conversation");
                         this.skipResume = true;
                     }
@@ -3084,12 +3230,21 @@ export class Daemon extends EventEmitter {
                         return;
                     }
                     // Detect rapid crash: sliding window — 3+ crashes in 5 minutes
-                    this.crashTimestamps.push(Date.now());
+                    if (!collateralOom)
+                        this.crashTimestamps.push(Date.now());
+                    else
+                        this.crashTimestamps = [];
                     const crashWindowMs = 5 * 60_000;
                     this.crashTimestamps = this.crashTimestamps.filter(t => t > Date.now() - crashWindowMs);
                     if (this.crashTimestamps.length >= 3) {
                         this.healthCheckPaused = true;
                         this.logger.error({ crashesInWindow: this.crashTimestamps.length, lastExitCode: exitCode ?? null, lastOutput: paneTail(lastOutput) ?? null }, "3+ crashes in 5 minutes — pausing respawn");
+                        // Unknown cause is bounded like an ordinary crash, never a
+                        // self-OOM verdict. Preserve the session for the person's choice.
+                        if (oom?.attribution === "unknown") {
+                            this.stopUnclearOom(exitCode);
+                            return;
+                        }
                         // P1: Persist crash state so next process restart skips resume
                         try {
                             writeFileSync(join(this.instanceDir, "crash-state.json"), JSON.stringify({
@@ -3106,18 +3261,23 @@ export class Daemon extends EventEmitter {
                     if (reset_after > 0 && Date.now() - this.lastCrashAt > reset_after) {
                         this.crashCount = 0;
                     }
-                    this.crashCount++;
+                    if (!collateralOom)
+                        this.crashCount++;
                     this.lastCrashAt = Date.now();
-                    if (this.crashCount > max_retries) {
+                    if (!collateralOom && this.crashCount > max_retries) {
                         this.logger.error({ crashCount: this.crashCount, maxRetries: max_retries, lastExitCode: exitCode ?? null, lastOutput: paneTail(lastOutput) ?? null }, "Max crash retries exceeded — not respawning");
                         this.healthCheckPaused = true;
+                        if (oom?.attribution === "unknown") {
+                            this.stopUnclearOom(exitCode);
+                            return;
+                        }
                         this.emitSupervisionEnded(`it crashed ${this.crashCount} times, exceeding restart_policy.max_retries (${max_retries})`, "Check the logs for the cause, then restart it.");
                         return; // don't schedule next — given up
                     }
                     // Calculate backoff delay
                     const delay = backoff === "exponential"
-                        ? Math.min(1000 * Math.pow(2, this.crashCount - 1), 60_000)
-                        : 1000 * this.crashCount;
+                        ? Math.min(1000 * Math.pow(2, Math.max(1, this.crashCount) - 1), 60_000)
+                        : 1000 * Math.max(1, this.crashCount);
                     this.logger.warn({ crashCount: this.crashCount, delay }, `${cliLabel} window died — respawning after backoff`);
                     await new Promise(r => setTimeout(r, delay));
                     try {
@@ -3126,14 +3286,14 @@ export class Daemon extends EventEmitter {
                         // (bounded) session lookup. They only stop LATER ticks; this continuation is already
                         // past that check and must not clear the process/window or respawn an instance that
                         // was just stopped or paused (#1160 review).
-                        if (this.runtimeMonitorsFrozen || this.healthCheckPaused)
+                        if (discardStaleHealth())
                             return;
                         // Reset is synchronous for file sources, but Kiro's baseline is
                         // read off-thread. Finish it before starting the replacement CLI,
                         // otherwise its first work could become part of that baseline.
                         if (!await this.resetTranscriptBeforeAdmission())
                             return;
-                        if (this.runtimeMonitorsFrozen || this.healthCheckPaused)
+                        if (discardStaleHealth())
                             return;
                         // Kill orphan MCP server from the crashed CLI session.
                         // MCP server writes its PID to channel.mcp.pid on startup.
@@ -3157,10 +3317,19 @@ export class Daemon extends EventEmitter {
                             }
                         }
                         catch { /* tmux server may be dead — ensureSession in trySpawn will recover */ }
+                        if (discardStaleHealth())
+                            return;
                         // Write snapshot before spawn — consumed only if resume fails
                         this.writeRotationSnapshot("crash");
                         // Try --resume first; spawnClaudeWindow falls back to fresh session if resume fails
-                        const resumed = await this.spawnClaudeWindow();
+                        this.collateralOomRecovery = collateralOom;
+                        let resumed;
+                        try {
+                            resumed = await this.spawnClaudeWindow();
+                        }
+                        finally {
+                            this.collateralOomRecovery = false;
+                        }
                         if (!resumed) {
                             // Resume failed → fresh session → inject snapshot for context
                             await this.injectSnapshotMessage();
@@ -3254,6 +3423,7 @@ export class Daemon extends EventEmitter {
      * four, carrying a human-readable cause and the operator's next step.
      */
     emitSupervisionEnded(reason, remedy, exitCode, cause) {
+        this.publishWorkingState("supervision_ended");
         this.emit("supervision_ended", {
             name: this.name,
             reason,
@@ -3266,6 +3436,7 @@ export class Daemon extends EventEmitter {
         if (this.processStatus === status)
             return;
         this.processStatus = status;
+        this.publishWorkingState("process");
         if (status === "running") {
             // A successful crash respawn is a new pane generation. It is ready by
             // this point, so an error gate inherited from the dead pane must not keep
@@ -3651,6 +3822,17 @@ export class Daemon extends EventEmitter {
             const key = Daemon.errorPatternKey(ep);
             const count = countMatches(ep.pattern);
             const seen = this.lastErrorCount.get(key) ?? 0;
+            // #2282: a resumed exhausted429 row is history, not even a new
+            // notification/failover incident. Wait for the first live composer to
+            // establish its baseline; later appended occurrences remain eligible.
+            if (ep.type === "rate_limit" && ep.action === "nudge_continue") {
+                const baseline = this.nudgeBaselines?.get(key);
+                if (baseline === undefined || count <= baseline) {
+                    if (baseline !== undefined)
+                        this.lastErrorCount.set(key, count);
+                    continue;
+                }
+            }
             // The generic Codex usage-limit line remains in scrollback after the
             // user selects Luna Reserve. What proves that is NOT a live composer —
             // codex paints one after a plain hit too, and the old live-composer guard
@@ -3803,6 +3985,7 @@ export class Daemon extends EventEmitter {
         this.deliveryEpoch = fleetEpoch === undefined
             ? this.deliveryEpoch + 1
             : Math.max(this.deliveryEpoch, fleetEpoch);
+        this.publishWorkingState("cancelled");
         this.logger.info({ deliveryEpoch: this.deliveryEpoch }, "Pending delivery queue cleared by user cancel");
     }
     /** Board 907c7899: the layout a web /compact's end can be read from on this pane (kiro classic or TUI V2), or null. */
@@ -4371,6 +4554,7 @@ export class Daemon extends EventEmitter {
         return true;
     }
     async stop() {
+        this.publishWorkingState("before_stop");
         this.logger.info("Stopping daemon instance");
         this.clearQuitRelaunchWatch();
         this.fenceDeliveryWritesForStop();
@@ -4519,6 +4703,31 @@ export class Daemon extends EventEmitter {
     getInteractionSnapshot() {
         return this.interactionObservation.snapshot(this.interactionOwner());
     }
+    workingTurnDelivery = null;
+    workingBackgroundObservation = null;
+    /** Pure metadata read: never discovers sessions, captures a pane or reads backend files. */
+    getWorkingStateObservation() {
+        const turn = this.turnReplyGuard.snapshot();
+        const backend = this.config.backend ?? this.backend?.binaryName ?? "unknown";
+        const profile = resolveCredentialProfile(this.config.backend_options?.[backend]);
+        return {
+            owner: this.interactionOwner(), backend,
+            configuration: createHash("sha256").update(JSON.stringify([backend, this.config.working_directory, profile])).digest("hex"),
+            executionState: this.processStatus === "running" ? this.isPaused ? "paused" : this.instanceState : null,
+            processStatus: this.getProcessStatus(), sessionId: null, backendTurnId: null,
+            backgroundWork: this.workingBackgroundObservation,
+            turn: turn ? { generation: turn.generation,
+                deliveryId: this.workingTurnDelivery?.generation === turn.generation ? this.workingTurnDelivery.deliveryId : null,
+                correlationId: turn.target.correlationId ?? null, messageId: turn.target.messageId ?? null,
+                cancelled: turn.cancelledByUser, completionDelivered: turn.completionDelivered } : null,
+        };
+    }
+    publishWorkingState(reason) {
+        try {
+            this.emit("working_state", { reason, observation: this.getWorkingStateObservation() });
+        }
+        catch { /* Journal observers cannot change daemon behavior. */ }
+    }
     /** Key of the last interaction snapshot actually emitted + broadcast (#1219). */
     lastPublishedInteractionKey = null;
     publishInteraction() {
@@ -4677,7 +4886,9 @@ export class Daemon extends EventEmitter {
     static AUTH_RECONFIRM_ROWS = 15;
     /** Why the deferred pause was requested; what its marker records (Phase 2a). */
     pendingPauseReason = "auth";
-    async pause(reason = "operator") {
+    async pause(reason = "operator", admission) {
+        if (admission && !admission.current())
+            return;
         if (this.pauseWakeState === "paused")
             return;
         if (this.pauseWakeState === "pausing" || this.pauseWakeState === "waking") {
@@ -4685,6 +4896,8 @@ export class Daemon extends EventEmitter {
             if (this.getPauseWakeState() !== "active")
                 return;
         }
+        if (admission && !admission.current())
+            return;
         // `pauseAllowStuck` is consumed here, not merely read: it authorises exactly
         // one pause from a stuck pane (the auth-deferred one) and must never leak
         // into an ordinary idle-timeout pause of a busy instance.
@@ -4704,7 +4917,7 @@ export class Daemon extends EventEmitter {
         // this cycle while the backend reports background work; the next idle
         // tick retries once the task ends. A pane-capture failure proceeds (the
         // quit-menu handler below stays the backstop), never wedges unpaused.
-        if (this.backend?.backgroundWorkRunning && this.tmux) {
+        if ((admission || this.backend?.backgroundWorkRunning) && this.tmux) {
             const tmux = this.tmux;
             const windowId = tmux.getWindowId?.();
             const generation = this.spawnGeneration;
@@ -4716,7 +4929,8 @@ export class Daemon extends EventEmitter {
             // #1730 P2-2: the await yields — the pane read is only valid for the
             // world it was taken from. Revalidate owner, phase, state and queue
             // before acting on it; anything that moved defers this cycle.
-            if (this.tmux !== tmux
+            if ((admission && (!admission.current() || pane === null || !admission.accepts(pane)))
+                || this.tmux !== tmux
                 || this.tmux?.getWindowId?.() !== windowId
                 || this.spawnGeneration !== generation
                 || this.getPauseWakeState() !== "active"
@@ -4766,6 +4980,7 @@ export class Daemon extends EventEmitter {
                 this.pauseWakeState = "paused";
                 this.autoPauseController.markPaused();
                 writePausedMarker(this.instanceDir, this.lastPausedAt ?? Date.now(), reason);
+                this.publishWorkingState("execution");
                 this.logger.info({ pausedAt: this.lastPausedAt }, "Instance auto-paused");
                 this.ipcServer?.broadcast({
                     type: "instance_state", instanceName: this.name, state: "paused", pausedAt: this.lastPausedAt,
@@ -4791,6 +5006,7 @@ export class Daemon extends EventEmitter {
     }
     /** Respawn the CLI in the preserved window and block until its prompt is ready. */
     async wake(timeoutMs = 30_000) {
+        this.assertSessionOomAdmission();
         // An explicit wake (e.g. after the user re-logs in) cancels a deferred
         // auth pause — otherwise the instance would pause again the moment it idles.
         this.pausePending = false;
@@ -4858,6 +5074,7 @@ export class Daemon extends EventEmitter {
                 this.clearErrorRecoveryGate();
                 clearPausedMarker(this.instanceDir);
                 this.resumeRuntimeMonitors();
+                this.publishWorkingState("execution");
                 this.logger.info("Instance auto-woke");
                 this.ipcServer?.broadcast({
                     type: "instance_state", instanceName: this.name, state: this.instanceState, pausedAt: null,
@@ -4913,7 +5130,9 @@ export class Daemon extends EventEmitter {
                 this.logger.info({ notLogged: this.stateEdgesNotLogged }, "Instance execution state edges were not logged while it was flapping");
                 this.stateEdgesNotLogged = 0;
             }
-            this.logger.info(fields, "Instance execution state changed");
+            // #2482: idle ↔ working is every turn (40% of daemon.log): debug. Anything involving stuck stays INFO.
+            const routine = previous !== "stuck" && snapshot.state !== "stuck";
+            this.logger[routine ? "debug" : "info"](fields, "Instance execution state changed");
             return;
         }
         if (this.stateEdgesNotLogged === 0) {
@@ -4957,6 +5176,17 @@ export class Daemon extends EventEmitter {
         }
         this.instanceState = snapshot.state;
         this.acceptedInstanceSnapshot = { ...snapshot };
+        // Reuse an already-captured pane and the backend's pure parser, never capture for the journal.
+        if (typeof pane === "string" && this.backend?.backgroundWorkRunning) {
+            try {
+                const background = this.backend.backgroundWorkRunning(pane);
+                if (background !== this.workingBackgroundObservation) {
+                    this.workingBackgroundObservation = background;
+                    this.publishWorkingState("background");
+                }
+            }
+            catch { /* Observational parsing cannot change accepted execution state. */ }
+        }
         // OpenCode creates its session lazily on the first submitted message.
         // Waiting until stop/pause to persist that id loses resume state when the
         // fleet is SIGKILLed or the host reboots.
@@ -5001,6 +5231,7 @@ export class Daemon extends EventEmitter {
         }
         if (snapshot.state !== previous) {
             this.logStateEdge(previous, snapshot);
+            this.publishWorkingState("execution");
             this.emit("instance_state", { name: this.name, ...snapshot });
             this.ipcServer?.broadcast({ type: "instance_state", instanceName: this.name, ...snapshot });
             if (snapshot.state === "stuck" && pane && this.instanceStateReadyPattern) {
@@ -5083,6 +5314,8 @@ export class Daemon extends EventEmitter {
             deliveredText,
             deliveredAt,
         }, this.pendingWork.lastInboundTimestamp());
+        this.workingTurnDelivery = { generation: this.turnReplyGuard.snapshot().generation, deliveryId: meta.delivery_id || null };
+        this.publishWorkingState("turn_started");
         // #1209: persist the in-flight turn with a seam checkpoint. A marker
         // that survives a restart is an interrupted turn by construction —
         // completion (via the guard's onComplete) and cancel paths delete it.
@@ -6353,6 +6586,15 @@ export class Daemon extends EventEmitter {
             this.config.cross_instance_visibility = update.cross_instance_visibility;
         else if (update.cross_instance_visibility === null)
             delete this.config.cross_instance_visibility;
+        if (Number.isInteger(update.board_cards_at_once) && update.board_cards_at_once >= 1)
+            this.config.board_cards_at_once = update.board_cards_at_once;
+        else if (update.board_cards_at_once === null)
+            delete this.config.board_cards_at_once;
+        // The fleet reads it at each tool call; kept current here for the next spawn's tool menu.
+        if (update.dashboard && typeof update.dashboard === "object" && !dashboardAccessProblem(update.dashboard))
+            this.config.dashboard = update.dashboard;
+        else if (update.dashboard === null)
+            delete this.config.dashboard;
         if (["trace", "debug", "info", "warn", "error"].includes(String(update.log_level))) {
             const level = update.log_level;
             if (this.config.log_level !== level) {
@@ -7612,6 +7854,46 @@ export class Daemon extends EventEmitter {
         this.logger.info({ delayMs }, "Model-capacity nudge armed");
         return true;
     }
+    /**
+     * Consume an exhausted nudge only if its failed turn still owns an empty,
+     * idle pane. Unlike arming, this verifies all input/work gates before pause.
+     * The returned owner survives pause's own monitor freeze (which advances the
+     * launch fence), but never another spawn/launch, cancel, delivery or episode.
+     */
+    async prepareCapacityNudgePause() {
+        const nudge = this.capacityNudge, episode = this.lastErrorEpisode;
+        const tmux = this.tmux, attempt = this.launchAttempt, boot = this.bootId;
+        this.cancelCapacityNudge("retries exhausted");
+        if (!nudge || !episode || !tmux)
+            return null;
+        const window = tmux.getWindowId?.();
+        const current = () => this.tmux === tmux && tmux.getWindowId?.() === window
+            && boot === this.bootId && nudge.spawn === this.spawnGeneration && attempt === this.launchAttempt
+            && episode === this.lastErrorEpisode && this.isDeliveryEpochCurrent(nudge.epoch)
+            && !this.startupAborted && !this.spawning && !this.isPaused
+            && this.getProcessStatus() === "running" && this.instanceState === "idle" && this.pasteQueueDepth === 0;
+        const accepts = (pane) => pane === nudge.pane && this.paneAuthoritativelyIdle(pane)
+            && this.backend?.isPeriodicRedrawIdlePane?.(pane) === true
+            && codexLiveRowMatches(pane, nudge.pattern) && !this.backend?.backgroundWorkRunning?.(pane);
+        const revalidate = () => this.paneWriteLock.run(async () => {
+            if (!current())
+                return false;
+            try {
+                const pane = await tmux.capturePane();
+                return current() && accepts(pane);
+            }
+            catch {
+                return false;
+            }
+        });
+        // Initial admission must also respect the captured monitor fence. Later
+        // revalidation deliberately tolerates only pause's own fence advancement.
+        if (nudge.fence !== this.launchFenceEpoch || this.healthCheckPaused || this.runtimeMonitorsFrozen)
+            return null;
+        if (!await revalidate() || nudge.fence !== this.launchFenceEpoch || this.healthCheckPaused || this.runtimeMonitorsFrozen)
+            return null;
+        return { current, accepts, revalidate };
+    }
     /** Drop an armed nudge (the user stopped / paused the instance, or the lifecycle gave up on it). */
     cancelCapacityNudge(reason) {
         if (!this.capacityNudge)
@@ -7954,6 +8236,21 @@ export class Daemon extends EventEmitter {
         this.footerFallbackEpoch = null;
     }
     footerFallbackWarnedGeneration = null;
+    /** #2357: the launch (spawn generation and attempt) the missing code-mode host was last reported for. */
+    codexPackageNoticeEpoch = null;
+    /**
+     * #2357: codex recorded that a tool call could not start its code-mode host. Every tool call of a code-mode-only
+     * account fails this way (AgEnD's reply too) while the pane shows only `⚠ N warnings · f2 to view`. Told once per
+     * launch however often the model retries; the launch check (CodexBackend.buildCommand) may already have said so.
+     */
+    noteCodexPackageMissingHost(root) {
+        const epoch = `${this.spawnGeneration}:${this.launchAttempt}`;
+        if (this.codexPackageNoticeEpoch === epoch)
+            return;
+        this.codexPackageNoticeEpoch = epoch;
+        this.logger.warn({ root }, "Codex tool call failed: code-mode host missing");
+        this.emit("backend_launch_warning", { name: this.name, message: codexPackageProblemMessage(root, { file: "bin/codex-code-mode-host", reason: "missing" }) });
+    }
     /**
      * The input-row proof used before a paste (#931/#947), with one fallback
      * (#1031). Codex sometimes paints an idle composer without its Context
@@ -9918,8 +10215,10 @@ export class Daemon extends EventEmitter {
                 // purposes even before the idle edge completes the guard. Without
                 // this, a restart in the reply-to-idle window would re-inject a
                 // continuation for an already-answered turn.
-                if (replyAttempt?.completionAction)
+                if (replyAttempt?.completionAction) {
                     clearInFlightTurnMarker(this.instanceDir);
+                    this.publishWorkingState("completion_delivered");
+                }
                 // #1377: a confirmed completion action (reply/react/edit_message) ends
                 // the human-facing obligation immediately — the idle edge does not need
                 // to confirm it.  Clear any pending confirmation window so a later
@@ -10414,7 +10713,11 @@ export class Daemon extends EventEmitter {
             }
         }
         // ── MCP server env (dual-track: still passes env vars for MCP instructions fallback) ──
+        const configEnvironment = scopedFleetConfigEnvironment(join(this.instanceDir, "..", ".."));
         const mcpEnv = {
+            // Empty values clear an unrelated reference inherited by the CLI or tmux server.
+            AGEND_FLEET_DATA_DIR: configEnvironment.AGEND_FLEET_DATA_DIR ?? "",
+            AGEND_FLEET_CONFIG_PATH: configEnvironment.AGEND_FLEET_CONFIG_PATH ?? "",
             AGEND_SOCKET_PATH: sockPath,
             AGEND_INSTANCE_NAME: this.name,
             AGEND_WORKING_DIR: this.config.working_directory,
@@ -10437,6 +10740,11 @@ export class Daemon extends EventEmitter {
             ? resolveToolSet(this.config, this.name, "general")
             : resolveToolSet(this.config, this.name);
         mcpEnv.AGEND_TOOL_SET = toolSet;
+        // The dashboard features the person switched off: out of the tool menu from this start (the fleet refuses them
+        // at once, whatever the menu still shows).
+        const dashboardOff = dashboardFeaturesOff(this.config.dashboard);
+        if (dashboardOff.length)
+            mcpEnv.AGEND_DASHBOARD_OFF = dashboardOff.join(",");
         if (this.config.display_name)
             mcpEnv.AGEND_DISPLAY_NAME = this.config.display_name;
         if (this.config.description)
@@ -10469,6 +10777,7 @@ export class Daemon extends EventEmitter {
             catch { /* fallback to empty */ }
             instructions = buildFleetInstructions({
                 instanceName: this.name,
+                taskBoard: !dashboardOff.includes("task_board"),
                 workingDirectory: this.config.working_directory,
                 runtimeIdentity: this.runtimeIdentity,
                 displayName: this.config.display_name,
@@ -10483,6 +10792,7 @@ export class Daemon extends EventEmitter {
         else {
             instructions = buildFleetInstructions({
                 instanceName: this.name,
+                taskBoard: !dashboardOff.includes("task_board"),
                 workingDirectory: this.config.working_directory,
                 runtimeIdentity: this.runtimeIdentity,
                 displayName: this.config.display_name,
@@ -10571,6 +10881,9 @@ export class Daemon extends EventEmitter {
      * into exactly the window this exists to close.
      */
     beginSpawn() {
+        this.unclearOomStopped = false;
+        this.publishWorkingState("before_spawn");
+        this.workingBackgroundObservation = null;
         this.dialogAnswers = null;
         this.capacityNudge = null;
         this.lastErrorEpisode = null;
@@ -10585,6 +10898,7 @@ export class Daemon extends EventEmitter {
         this.clearReplyGuardConfirm();
         this.sawBlockedInput = false;
         if (this.spawnDepth === 0) {
+            this.cliOomObservation = null;
             this.spawnGeneration++;
             this.interactionObservation.reset(this.interactionOwner());
             this.clearInteractionConfirmation();
@@ -10785,6 +11099,7 @@ export class Daemon extends EventEmitter {
         catch { /* best effort */ }
     }
     async spawnClaudeWindow() {
+        this.assertSessionOomAdmission();
         this.beginSpawn();
         let resumedSuccessfully = false;
         try {
@@ -10888,6 +11203,10 @@ export class Daemon extends EventEmitter {
                 // is reachable again (a fresh prompt is local and proves nothing).
                 this.backendOutage?.clear(this.backendKey());
             }
+            // A pre-existing fresh fallback is not another resume of the old session.
+            // Providers may not have rewritten their session reading yet.
+            if (!resumedSuccessfully)
+                this.consecutiveOoms = null;
             this.lastSpawnAt = Date.now();
             // #1217: whatever session this CLI writes from here on is this backend's.
             this.recordSessionOwner();
@@ -11171,11 +11490,20 @@ export class Daemon extends EventEmitter {
      * Returns true if CLI is ready, false if it failed or got stuck.
      */
     async trySpawn(reuseWindow = false, startupTimeoutMs) {
-        const ready = !this.spawnGate ? await this.trySpawnInsideGate(reuseWindow, startupTimeoutMs) : await this.spawnGate.run({
+        const recoveryOwner = this.collateralOomRecovery ? this.interactionOwner() : null;
+        const enter = () => {
+            if (recoveryOwner && (!sameInteractionOwner(recoveryOwner, this.interactionOwner())
+                || this.startupAborted || this.deliveryWritesStopping || this.runtimeMonitorsFrozen || this.healthCheckPaused)) {
+                throw new Error("OOM recovery cancelled: the instance was stopped, paused or replaced while memory was unavailable");
+            }
+            return this.trySpawnInsideGate(reuseWindow, startupTimeoutMs);
+        };
+        const ready = !this.spawnGate ? await enter() : await this.spawnGate.run({
             instanceName: this.name,
             workingDirectory: this.config.working_directory,
             reason: reuseWindow ? "wake" : this.lastSpawnAt > 0 ? "recovery" : "startup",
-        }, () => this.trySpawnInsideGate(reuseWindow, startupTimeoutMs));
+            requireNormalMemory: this.collateralOomRecovery,
+        }, enter);
         // #906: a resumed kiro conversation comes back as the agent it was saved under. Every launch path that reaches a
         // ready CLI (start, recovery, wake) switches it to this instance's own agent here, while the spawn still holds
         // deliveries — and outside the spawn gate, which it does not need.
@@ -11404,16 +11732,41 @@ export class Daemon extends EventEmitter {
             this.pendingWhatsNew = null;
             return null;
         }
-        if (ids.length === pending.ids.length)
-            return pending;
-        const narrowed = { notice: whatsNewNotice(pending.version, AGENT_WHATS_NEW.filter(e => ids.includes(e.id))), ids, version: pending.version };
+        // Rebuild even when ids are unchanged: an experimental switch may have changed
+        // while this delivery waited. Never paste the old enabled capability text.
+        // #2163: rebuilt as planned — only the entries this instance's roles are told; the rest are recorded with them.
+        const roles = this.whatsNewRoles();
+        const shown = agentWhatsNew(readCanvasWorkerEnabled(join(this.instanceDir, "..", ".."))).filter(e => ids.includes(e.id) && (!e.audience || e.audience.some(r => roles.includes(r))));
+        if (!shown.length) {
+            this.pendingWhatsNew = null;
+            try {
+                recordWhatsNew(this.instanceDir, ids, pending.version);
+            }
+            catch (err) {
+                this.logger.warn({ err }, "what's-new record not written — the notice may repeat once");
+            }
+            return null;
+        }
+        const narrowed = { notice: whatsNewNotice(pending.version, shown), ids, version: pending.version };
         this.pendingWhatsNew = narrowed;
         return narrowed;
     }
+    /**
+     * #2163: who this instance is to the what's-new notices — a ClassicBot room's agent, General, or a fleet worker (with
+     * `coordinator` too when its tool set is coordinator or full, the ones that carry get_/set_web_settings).
+     */
+    whatsNewRoles() {
+        if (this.runtimeIdentity?.kind === "classic")
+            return ["classic"];
+        if (this.config.general_topic === true || this.name === "general")
+            return ["general"];
+        const set = resolveToolSet(this.config, this.name);
+        return set === "coordinator" || set === "full" ? ["worker", "coordinator"] : ["worker"];
+    }
     /** #1633: what this instance has not been told about its AgEnD version yet (see agent-whats-new.ts). */
     prepareWhatsNew(fresh, version = agendVersion()) {
         try {
-            const plan = planWhatsNew({ record: readWhatsNewRecord(this.instanceDir), fresh, version });
+            const plan = planWhatsNew({ record: readWhatsNewRecord(this.instanceDir), fresh, version, roles: this.whatsNewRoles(), canvasWorker: readCanvasWorkerEnabled(join(this.instanceDir, "..", "..")) });
             if (!plan) {
                 this.pendingWhatsNew = null;
                 return;
@@ -11432,6 +11785,7 @@ export class Daemon extends EventEmitter {
         }
     }
     async trySpawnInsideGate(reuseWindow = false, startupTimeoutMs) {
+        this.assertSessionOomAdmission();
         this.startupAdmission?.();
         const launchFence = this.launchFenceEpoch;
         const backendConfig = this.buildBackendConfig();
@@ -11480,6 +11834,7 @@ export class Daemon extends EventEmitter {
         // Thrown, not `false`: a false verdict reads as "the CLI failed to start" and sends the startup path
         // into its resume-retry / set-the-session-aside handling, for an instance somebody just stopped.
         this.startupAdmission?.();
+        this.assertSessionOomAdmission();
         if (launchFence !== this.launchFenceEpoch)
             throw new Error("Launch cancelled: the instance was stopped or paused while the launch was being prepared");
         this.backend.writeConfig(backendConfig);
@@ -11505,7 +11860,8 @@ export class Daemon extends EventEmitter {
         // AGEND_HOME points the child's agent-cli at the same data dir the daemon
         // is using, so it can locate <instanceDir>/agent.token.
         const agendHome = join(this.instanceDir, "..", "..");
-        let envPrefix = `TERM=xterm-256color AGEND_INSTANCE_NAME=${shellQuote(this.name)} AGEND_HOME=${shellQuote(agendHome)}`;
+        const configEnvironment = scopedFleetConfigEnvironment(agendHome);
+        let envPrefix = `TERM=xterm-256color AGEND_INSTANCE_NAME=${shellQuote(this.name)} AGEND_HOME=${shellQuote(agendHome)} AGEND_FLEET_DATA_DIR=${shellQuote(configEnvironment.AGEND_FLEET_DATA_DIR ?? "")} AGEND_FLEET_CONFIG_PATH=${shellQuote(configEnvironment.AGEND_FLEET_CONFIG_PATH ?? "")}`;
         if (backendConfig.agentMode === "cli" && backendConfig.agentPort) {
             envPrefix += ` AGEND_PORT=${backendConfig.agentPort}`;
         }
@@ -11565,6 +11921,7 @@ export class Daemon extends EventEmitter {
         }
         this.startupAdmission?.();
         let windowId;
+        this.assertSessionOomAdmission();
         if (reuseWindow) {
             this.controlClient?.unregisterWindow(this.tmux.getWindowId());
             await this.tmux.respawnWindow(cmd, resolvedCwd);
@@ -12199,6 +12556,7 @@ export class Daemon extends EventEmitter {
                 crashType: data.crashType,
                 exitCode: data.exitCode,
                 reason: data.reason,
+                ...(data.oomEvidence ? { oomEvidence: data.oomEvidence } : {}),
                 lastOutput: data.lastOutput,
                 crashCount: this.crashCount + 1,
                 crashesInWindow: this.crashTimestamps.length,
@@ -12228,7 +12586,7 @@ export class Daemon extends EventEmitter {
     }
     // ── Repo Checkout ─────────────────────────────────────────
     async handleCheckoutRepo(args, respond) {
-        const { execFile: execFileCb } = await import("node:child_process");
+        const { execFile: execFileCb } = await import("./child-process.js");
         const { promisify } = await import("node:util");
         const execFileAsync = promisify(execFileCb);
         const rawSource = args.source;
@@ -12264,7 +12622,7 @@ export class Daemon extends EventEmitter {
             respond(null, `Not a git repository: ${source}`);
             return;
         }
-        mkdirSync(join(this.instanceDir, "repos"), { recursive: true });
+        mkdirSync(join(this.instanceDir, "repos"), { recursive: true, mode: 0o700 });
         // Only a fresh direct child of a real repos/ directory (never through a symlinked repos/, never an existing path).
         const target = checkoutTarget(this.instanceDir, source, branch);
         if (!target.ok) {
@@ -12306,7 +12664,7 @@ export class Daemon extends EventEmitter {
             respond(null, `Cannot release: ${root.reason}`);
             return;
         }
-        const { execFile: execFileCb } = await import("node:child_process");
+        const { execFile: execFileCb } = await import("./child-process.js");
         const { promisify } = await import("node:util");
         const execFileAsync = promisify(execFileCb);
         const git = async (gitArgs, cwd) => (await execFileAsync("git", gitArgs, { cwd })).stdout;