@teamvibe/poller 0.8.2-rc.2 → 0.8.3-rc.4

package/dist/subscription-usage-store.js

@@ -0,0 +1,223 @@
+import { createHash, randomUUID } from 'node:crypto';
+import { mkdir, readFile, rename, rm, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { parseClaudeRateLimitInfo } from './claude-rate-limit.js';
+import { normalizePassiveUsage, record, reactiveEligibleAt, PASSIVE_USAGE_TTL_MS } from './subscription-selection.js';
+export function usageStateForSelection(state, now) {
+    const passive = state.passive ? normalizePassiveUsage(state.passive.rateLimitInfo, state.passive.observedAt) : undefined;
+    // Passive is primary while fresh; a completed optional probe may supplement a stale/missing snapshot.
+    const fresh = passive && passive.observedAt <= now && now < passive.observedAt + PASSIVE_USAGE_TTL_MS;
+    return { usage: fresh ? passive : state.probe?.status === 'ok' ? state.probe.usage : passive, reactive: state.reactive };
+}
+export class SubscriptionUsageStoreError extends Error {
+    constructor() { super('Subscription usage store unavailable'); this.name = 'SubscriptionUsageStoreError'; }
+}
+// Serialize atomic read/modify/write operations across instances in this process.
+const writes = new Map();
+async function serial(path, work) {
+    const previous = writes.get(path) ?? Promise.resolve();
+    const next = previous.catch(() => { }).then(work);
+    writes.set(path, next);
+    try {
+        return await next;
+    }
+    finally {
+        if (writes.get(path) === next)
+            writes.delete(path);
+    }
+}
+function validTime(now) {
+    if (typeof now !== 'number' || !Number.isFinite(now) || now <= 0 || now > 253402300799000)
+        throw new SubscriptionUsageStoreError();
+}
+export function safeRateLimitInfo(info) {
+    const parsed = parseClaudeRateLimitInfo(info) ?? {};
+    // Never persist arbitrary status strings or incidental stream fields.
+    if (parsed.status !== 'allowed' && parsed.status !== 'allowed_warning' && parsed.status !== 'rejected')
+        delete parsed.status;
+    if (parsed.rateLimitType && !/^(five_hour|seven_day)(?:_(sonnet|opus|haiku|fable))?$/.test(parsed.rateLimitType))
+        parsed.rateLimitType = 'uncertain';
+    delete parsed.overageStatus;
+    delete parsed.overageDisabledReason;
+    return parsed;
+}
+export function safeQuota(quota) {
+    const scope = typeof quota.modelScope === 'string' ? quota.modelScope.toLowerCase().match(/^(?:claude-)?(sonnet|opus|haiku)(?:-\d[\w.-]*)?$/)?.[1] : undefined;
+    const reset = typeof quota.resetAt === 'string' ? Date.parse(quota.resetAt) : NaN;
+    return {
+        reason: ['usage_limit', 'weekly_limit', 'session_limit', 'extra_usage'].includes(quota.reason) ? quota.reason : 'usage_limit',
+        ...(quota.window === 'five_hour' || quota.window === 'seven_day' ? { window: quota.window } : {}),
+        ...(quota.modelScope ? { modelScope: scope ?? 'uncertain' } : {}),
+        ...(Number.isFinite(reset) && reset > 0 ? { resetAt: new Date(reset).toISOString() } : {}),
+    };
+}
+function safeProbe(value) {
+    const obj = record(value);
+    const status = obj['status'];
+    if (typeof status !== 'string' || !['attempted', 'ok', 'unsupported', 'unauthorized', 'unavailable', 'cancelled'].includes(status))
+        throw new SubscriptionUsageStoreError();
+    const observedAt = obj['observedAt'];
+    if (typeof observedAt !== 'number')
+        throw new SubscriptionUsageStoreError();
+    validTime(observedAt);
+    const result = { status: status, observedAt };
+    if (status === 'ok' && obj['usage']) {
+        const usage = record(obj['usage']);
+        if (typeof usage['observedAt'] !== 'number' || !Array.isArray(usage['windows']))
+            throw new SubscriptionUsageStoreError();
+        validTime(usage['observedAt']);
+        const windows = usage['windows'].slice(0, 133).map(raw => {
+            const w = record(raw);
+            const window = w['window'] === 'five_hour' ? 'five_hour' : 'seven_day';
+            const scope = typeof w['scope'] === 'string' && ['global', 'sonnet', 'opus', 'haiku', 'fable'].includes(w['scope']) ? w['scope'] : 'uncertain';
+            const percent = typeof w['percent'] === 'number' && Number.isFinite(w['percent']) && w['percent'] >= 0 && w['percent'] <= 100 ? w['percent'] : undefined;
+            const resetAt = typeof w['resetAt'] === 'number' && Number.isFinite(w['resetAt']) && w['resetAt'] > 0 && w['resetAt'] <= 253402300799000 ? w['resetAt'] : undefined;
+            return { window, scope, percent, resetAt };
+        });
+        if (usage['windows'].length > 133)
+            windows.push({ window: 'seven_day', scope: 'uncertain' });
+        result.usage = { source: 'probe', observedAt: usage['observedAt'], windows };
+    }
+    return result;
+}
+function safeVersion(value) {
+    const state = {};
+    if (value.passive) {
+        validTime(value.passive.observedAt);
+        state.passive = { observedAt: value.passive.observedAt, rateLimitInfo: safeRateLimitInfo(value.passive.rateLimitInfo) };
+    }
+    if (value.probe)
+        state.probe = safeProbe(value.probe);
+    return state;
+}
+function safeReactive(value) {
+    if (!Array.isArray(value) || value.length > 64)
+        throw new SubscriptionUsageStoreError();
+    return value.map(raw => {
+        const obj = record(raw);
+        if (typeof obj['observedAt'] !== 'number' || !obj['quota'] || typeof obj['quota'] !== 'object')
+            throw new SubscriptionUsageStoreError();
+        validTime(obj['observedAt']);
+        return { observedAt: obj['observedAt'], quota: safeQuota(obj['quota']) };
+    });
+}
+/** One file per version + one reactive file per workspace/account. No credentials or raw provider bodies. */
+export class FileSubscriptionUsageStore {
+    #directory;
+    constructor(directory) { this.#directory = resolve(directory); }
+    #path(key, version) {
+        const parts = version ? [key.workspaceId, key.accountId, key.credentialVersion] : [key.workspaceId, key.accountId];
+        if (parts.some(p => typeof p !== 'string' || !p))
+            throw new SubscriptionUsageStoreError();
+        return join(this.#directory, `${createHash('sha256').update(JSON.stringify(parts)).digest('hex')}.json`);
+    }
+    async #load(path, fallback) {
+        try {
+            const raw = await readFile(path, 'utf8');
+            if (raw.length > 1024 * 1024)
+                throw new SubscriptionUsageStoreError();
+            const value = JSON.parse(raw);
+            if (!value || typeof value !== 'object' || Array.isArray(value))
+                throw new SubscriptionUsageStoreError();
+            return value;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return fallback;
+            throw new SubscriptionUsageStoreError();
+        }
+    }
+    async #save(path, value) {
+        const temporary = `${path}.${randomUUID()}.tmp`;
+        try {
+            await mkdir(this.#directory, { recursive: true, mode: 0o700 });
+            await writeFile(temporary, JSON.stringify(value), { mode: 0o600, flag: 'wx' });
+            await rename(temporary, path);
+        }
+        catch {
+            throw new SubscriptionUsageStoreError();
+        }
+        finally {
+            await rm(temporary, { force: true }).catch(() => { });
+        }
+    }
+    async read(key) {
+        const [version, account] = await Promise.all([
+            this.#load(this.#path(key, true), {}),
+            this.#load(this.#path(key, false), { reactive: [] }),
+        ]);
+        // Corrupt reactive data must never silently resurrect an exhausted account.
+        if (!Array.isArray(account.reactive) || account.reactive.some(r => !r || !Number.isFinite(r.observedAt) || !r.quota))
+            throw new SubscriptionUsageStoreError();
+        return { ...safeVersion(version), reactive: safeReactive(account.reactive) };
+    }
+    async recordPassive(key, rateLimitInfo, observedAt, options) {
+        validTime(observedAt);
+        const path = this.#path(key, true);
+        await serial(path, async () => {
+            const state = safeVersion(await this.#load(path, {}));
+            if (state.passive && state.passive.observedAt > observedAt && !options?.expireFutureObservations)
+                return;
+            state.passive = { rateLimitInfo: safeRateLimitInfo(rateLimitInfo), observedAt };
+            await this.#save(path, state);
+        });
+    }
+    async recordQuota(key, quota, observedAt, options) {
+        validTime(observedAt);
+        const path = this.#path(key, false);
+        await serial(path, async () => {
+            const state = await this.#load(path, { reactive: [] });
+            state.reactive = safeReactive(state.reactive).filter(r => !options?.expireFutureObservations || r.observedAt <= observedAt);
+            const next = { observedAt, quota: safeQuota(quota) };
+            const until = reactiveEligibleAt;
+            const sameScope = (r) => r.quota.modelScope === next.quota.modelScope && r.quota.window === next.quota.window;
+            const previous = state.reactive.find(sameScope);
+            const reactive = state.reactive.filter(r => !sameScope(r) && until(r) > observedAt);
+            const hasExplicitReset = (r) => r.quota.resetAt !== undefined && Date.parse(r.quota.resetAt) > r.observedAt;
+            // A recheck is not a reset. New matching quota evidence can replace that
+            // provisional deadline with its explicit reset, without clearing a known
+            // active reset or accepting an older observation as revalidation.
+            const revalidated = previous && next.observedAt >= previous.observedAt && !hasExplicitReset(previous) && hasExplicitReset(next);
+            reactive.push(previous && !revalidated && until(previous) > until(next) ? previous : next);
+            await this.#save(path, { reactive });
+        });
+    }
+    async beginProbe(key, observedAt) {
+        validTime(observedAt);
+        const path = this.#path(key, true);
+        return serial(path, async () => {
+            const state = safeVersion(await this.#load(path, {}));
+            if (state.probe)
+                return false;
+            state.probe = { status: 'attempted', observedAt };
+            await this.#save(path, state);
+            return true;
+        });
+    }
+    /** Request claims live in the local data directory, alongside usage, never in a brain. */
+    async claimProbeRequest(requestId, expiresAt) {
+        validTime(expiresAt);
+        const path = join(this.#directory, 'processed-probe-requests.json');
+        return serial(path, async () => {
+            const now = Date.now();
+            const stored = await this.#load(path, {});
+            if (Object.values(stored).some(expiry => !Number.isFinite(expiry)))
+                throw new SubscriptionUsageStoreError();
+            const claims = Object.fromEntries(Object.entries(stored).filter(([, expiry]) => expiry > now));
+            if (Object.hasOwn(claims, requestId))
+                return false;
+            claims[requestId] = Math.max(expiresAt, now + 30 * 60_000);
+            await this.#save(path, claims);
+            return true;
+        });
+    }
+    async finishProbe(key, observation) {
+        validTime(observation.observedAt);
+        const path = this.#path(key, true);
+        await serial(path, async () => {
+            const state = safeVersion(await this.#load(path, {}));
+            state.probe = safeProbe(observation);
+            await this.#save(path, state);
+        });
+    }
+}

package/dist/types.d.ts

@@ -4,7 +4,7 @@ export interface ControlMessage {
     action: 'restart' | 'update';
     targetVersion?: string;
 }
-export type QueueMessage = TeamVibeQueueMessage | ControlMessage;
+export type QueueMessage = TeamVibeQueueMessage | ControlMessage | UsageProbeMessage;
 export interface TeamVibeQueueMessage {
     id: string;
     source: 'slack' | 'email' | 'cron' | 'maintenance' | 'webhook';
@@ -66,7 +66,20 @@ export interface TeamVibeQueueMessage {
         emailHookPrompt?: string;
     };
 }
+export interface SubscriptionPin {
+    inboxFilename?: string;
+    resumePending?: boolean;
+    effectiveCwd?: string;
+    claudeConfigDir?: string;
+    sawSendMessageCall?: boolean;
+    workspaceId: string;
+    accountId: string;
+    credentialVersion: string;
+    model?: string;
+    modelSource?: import('./claude-spawner.js').ModelSource;
+}
 export interface SessionRecord {
+    subscription_pin?: SubscriptionPin;
     PK: string;
     SK: string;
     session_id: string;
@@ -81,13 +94,25 @@ export interface SessionRecord {
 }
 export type SessionStatus = 'processing' | 'idle' | 'waiting_for_input';
 export interface SessionMetrics {
-    duration_ms: number;
-    duration_api_ms: number;
-    num_turns: number;
-    total_cost_usd: number;
-    input_tokens: number;
-    output_tokens: number;
-    cache_read_input_tokens: number;
-    cache_creation_input_tokens: number;
-    model: string;
+    /** Input occupancy of the last assistant message, independent of run totals. */
+    context_tokens?: number;
+    context_window?: number;
+    duration_ms?: number;
+    duration_api_ms?: number;
+    num_turns?: number;
+    total_cost_usd?: number;
+    input_tokens?: number;
+    output_tokens?: number;
+    cache_read_input_tokens?: number;
+    cache_creation_input_tokens?: number;
+    model?: string;
+}
+export interface UsageProbeMessage {
+    kind: 'usage_probe';
+    id: string;
+    workspaceId: string;
+    accountId: string;
+    credentialVersion: string;
+    requestId: string;
+    expiresAt: number;
 }

package/dist/usage-limit-messages.d.ts

@@ -0,0 +1,22 @@
+/** Owner-facing account policy location. */
+export declare const FULL_QUOTA_SETTINGS_PATH = "Settings \u2192 Connections (account menu \u2192 Use until exhausted)";
+export interface UsageResetTiming {
+    resetAt?: number;
+    now?: number;
+    timeZone?: string;
+}
+export interface UsageLimitAccount {
+    useFullQuota?: boolean;
+    label?: string;
+    windows: readonly {
+        percent?: number;
+    }[];
+    rejected?: boolean;
+}
+export interface PoolUsageLimitNotice extends UsageResetTiming {
+    thresholdDeferred?: boolean;
+    accounts?: readonly UsageLimitAccount[];
+}
+export declare function formatUsageReset(input: UsageResetTiming): string | undefined;
+export declare function formatPoolUsageLimitMessage(input: PoolUsageLimitNotice): string;
+export declare function formatLegacyUsageLimitMessage(input: UsageResetTiming): string;

package/dist/usage-limit-messages.js

@@ -0,0 +1,44 @@
+/** Owner-facing account policy location. */
+export const FULL_QUOTA_SETTINGS_PATH = 'Settings → Connections (account menu → Use until exhausted)';
+export function formatUsageReset(input) {
+    if (input.resetAt === undefined || !Number.isFinite(input.resetAt))
+        return undefined;
+    const now = input.now ?? Date.now();
+    let time;
+    try {
+        time = new Intl.DateTimeFormat('en-GB', {
+            timeZone: input.timeZone || 'UTC', hour: '2-digit', minute: '2-digit', hourCycle: 'h23',
+        }).format(input.resetAt) + (input.timeZone ? '' : ' UTC');
+    }
+    catch {
+        time = new Intl.DateTimeFormat('en-GB', {
+            timeZone: 'UTC', hour: '2-digit', minute: '2-digit', hourCycle: 'h23',
+        }).format(input.resetAt) + ' UTC';
+    }
+    // Round up so a reset less than a minute away is not advertised as immediate.
+    const minutes = Math.max(0, Math.ceil((input.resetAt - now) / 60_000));
+    const days = Math.floor(minutes / 1440);
+    const hours = Math.floor(minutes % 1440 / 60);
+    const remainder = minutes % 60;
+    const relative = [days ? `${days} d` : '', hours ? `${hours} h` : '', remainder || !minutes ? `${remainder} min` : ''].filter(Boolean).join(' ');
+    return `${time} (in ${relative})`;
+}
+export function formatPoolUsageLimitMessage(input) {
+    const accounts = input.accounts ?? [];
+    const headroom = accounts.filter(account => !account.useFullQuota && !account.rejected).map(account => {
+        const percentages = account.windows.map(w => w.percent).filter((p) => p !== undefined && Number.isFinite(p) && p >= 0 && p <= 100);
+        return { label: account.label, remaining: percentages.length ? 100 - Math.max(...percentages) : 0 };
+    });
+    const threshold = input.thresholdDeferred === true &&
+        !accounts.some(a => a.rejected) && headroom.reduce((sum, a) => sum + a.remaining, 0) > 0;
+    const reset = formatUsageReset(input);
+    if (threshold) {
+        const labels = headroom.filter(a => a.label && a.remaining > 0).map(a => `${a.label} ${Number(a.remaining.toFixed(2))} %`).join(', ');
+        return `⏳ All Claude accounts in this workspace are above 90 % of their usage limit, so I'm waiting for the next reset${reset ? ` at ${reset}` : ''}. Your message is saved and will run automatically.\n💡 There is still some capacity left${labels ? ` (${labels})` : ''}. A workspace owner can allow the full quota per account in ${FULL_QUOTA_SETTINGS_PATH}.`;
+    }
+    return `⏳ All Claude accounts in this workspace have hit their usage limit. Your message is saved and will run automatically after ${reset ? `the earliest reset at ${reset}` : 'the next reset'}.`;
+}
+export function formatLegacyUsageLimitMessage(input) {
+    const reset = formatUsageReset(input);
+    return `⏳ This poller's Claude login has hit its usage limit. Your message is saved and will run automatically after ${reset ? `the reset at ${reset}` : 'the next reset'}.`;
+}

package/dist/usage-probe-job.d.ts

@@ -0,0 +1,17 @@
+import type { UsageProbeMessage } from './types.js';
+import type { PoolFetchResult } from './subscription-selection.js';
+import type { SubscriptionAccount } from './subscription-pool-client.js';
+import { type SubscriptionUsageStore } from './subscription-usage-store.js';
+interface Options {
+    fetchPool: () => Promise<PoolFetchResult<SubscriptionAccount>>;
+    store: SubscriptionUsageStore;
+    cliPath: string;
+    timeoutMs?: number;
+    isAtCapacity: () => boolean;
+    emit: (type: string, channelId: string, metadata: Record<string, unknown>) => void;
+    log: (line: string) => void;
+}
+export declare function isUsageProbe(value: unknown): value is UsageProbeMessage;
+/** This run deliberately has no message/session/brain context or normal spawn bookkeeping. */
+export declare function handleUsageProbe(job: UsageProbeMessage, options: Options): Promise<void>;
+export {};

package/dist/usage-probe-job.js

@@ -0,0 +1,186 @@
+import { spawn } from 'node:child_process';
+import { mkdtemp, rm, mkdir } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { normalizePassiveUsage } from './subscription-selection.js';
+import { safeRateLimitInfo, } from './subscription-usage-store.js';
+import { parseClaudeRateLimitInfo, } from './claude-rate-limit.js';
+export function isUsageProbe(value) {
+    return (!!value &&
+        typeof value === 'object' &&
+        value.kind === 'usage_probe');
+}
+/** This run deliberately has no message/session/brain context or normal spawn bookkeeping. */
+export async function handleUsageProbe(job, options) {
+    let result = 'unknown';
+    let duplicate = false;
+    let cwd;
+    if (!['workspaceId', 'accountId', 'credentialVersion', 'requestId'].every((k) => {
+        const value = job[k];
+        return (typeof value === 'string' &&
+            /^[A-Za-z0-9_-]{1,128}$/.test(value) &&
+            !/sk-ant-/i.test(value));
+    }) ||
+        !Number.isFinite(job.expiresAt) ||
+        job.expiresAt <= Date.now())
+        return;
+    const metadata = {
+        workspaceId: job.workspaceId,
+        accountId: job.accountId,
+        credentialVersion: job.credentialVersion,
+        requestId: job.requestId,
+        source: 'probe',
+    };
+    try {
+        if (!(await options.store.claimProbeRequest(job.requestId, job.expiresAt))) {
+            duplicate = true;
+            options.log(`[Pool] usage probe request=${job.requestId} result=duplicate_ignored`);
+            return;
+        }
+        const pool = await options.fetchPool();
+        const account = pool.kind === 'ready'
+            ? pool.accounts.find((a) => a.workspaceId === job.workspaceId &&
+                a.accountId === job.accountId &&
+                a.credentialVersion === job.credentialVersion &&
+                a.enabled)
+            : undefined;
+        if (!account)
+            return;
+        if (options.isAtCapacity()) {
+            result = 'cli_at_capacity';
+            return;
+        }
+        cwd = await mkdtemp(join(tmpdir(), 'teamvibe-usage-'));
+        const configDir = join(cwd, 'config');
+        await mkdir(configDir);
+        // Allow only OS execution essentials. No ambient credentials, Slack, API,
+        // brain, hooks, or user's Claude settings reach this isolated child.
+        const env = {
+            PATH: process.env['PATH'],
+            HOME: cwd,
+            TMPDIR: cwd,
+            CLAUDE_CONFIG_DIR: configDir,
+            CLAUDE_CODE_OAUTH_TOKEN: account.credential.unwrap(),
+            CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC: '1',
+        };
+        let info;
+        const outcome = await new Promise((resolve) => {
+            let done = false, buffer = '', errorText = '';
+            const child = spawn(options.cliPath, [
+                '-p',
+                'Reply OK.',
+                '--output-format',
+                'stream-json',
+                '--verbose',
+                '--max-turns',
+                '1',
+                '--tools',
+                '',
+                '--strict-mcp-config',
+                '--mcp-config',
+                '{"mcpServers":{}}',
+                '--no-session-persistence',
+                '--setting-sources',
+                '',
+            ], { cwd, env, stdio: ['ignore', 'pipe', 'pipe'], detached: true });
+            const kill = () => {
+                if (child.pid) {
+                    try {
+                        process.kill(-child.pid, 'SIGKILL');
+                    }
+                    catch {
+                        child.kill('SIGKILL');
+                    }
+                }
+            };
+            const finish = (reason) => {
+                if (done)
+                    return;
+                done = true;
+                clearTimeout(timer);
+                resolve(reason);
+            };
+            const timer = setTimeout(() => {
+                kill();
+                finish('timeout');
+            }, Math.min(options.timeoutMs ?? 60_000, Math.max(1, job.expiresAt - Date.now())));
+            const line = (text) => {
+                try {
+                    const event = JSON.parse(text);
+                    if (event?.type === 'rate_limit_event')
+                        info = parseClaudeRateLimitInfo(event.rate_limit_info);
+                    if (event?.type === 'result' && event.is_error)
+                        errorText = (errorText + String(event.result ?? '').slice(0, 4096)).slice(-8192);
+                }
+                catch { }
+            };
+            child.stdout.on('data', (chunk) => {
+                buffer += chunk.toString();
+                if (buffer.length > 1024 * 1024) {
+                    kill();
+                    finish('unknown');
+                    return;
+                }
+                let end;
+                while ((end = buffer.indexOf('\n')) >= 0) {
+                    line(buffer.slice(0, end));
+                    buffer = buffer.slice(end + 1);
+                }
+            });
+            child.stderr.on('data', (chunk) => {
+                errorText = (errorText + chunk.toString()).slice(-8192);
+            });
+            child.once('error', () => finish('unknown'));
+            // Quota rejection is still a successful observation: it reveals reset
+            // time without requiring the account to complete an assistant turn.
+            child.once('close', (code) => {
+                if (buffer)
+                    line(buffer);
+                finish(/401|unauthorized|invalid.*token|invalid api key|authentication.*(?:fail|error)/i.test(errorText)
+                    ? 'token_rejected'
+                    : /capacity|overloaded/i.test(errorText)
+                        ? 'cli_at_capacity'
+                        : info && (code === 0 || info.status === 'rejected')
+                            ? 'ok'
+                            : 'unknown');
+            });
+        });
+        result = outcome;
+        if (result !== 'ok' || !info)
+            return;
+        const now = Date.now();
+        const safe = safeRateLimitInfo(info);
+        const usage = {
+            ...normalizePassiveUsage(safe, now),
+            source: 'probe',
+        };
+        await options.store.finishProbe(account, {
+            status: 'ok',
+            observedAt: now,
+            usage,
+        });
+        options.emit('pool.usage_observed', 'usage_probe', {
+            ...metadata,
+            accountLabel: account.label ?? account.accountId,
+            reportedAt: now,
+            usage,
+            lastRateLimitInfo: safe,
+            probeStatus: 'ok',
+            probeObservedAt: now,
+        });
+    }
+    catch {
+        result = 'unknown';
+    }
+    finally {
+        if (cwd)
+            await rm(cwd, { recursive: true, force: true }).catch(() => { });
+        if (!duplicate && result !== 'ok')
+            options.emit('pool.probe_failed', 'usage_probe', {
+                ...metadata,
+                reason: result,
+            });
+        if (!duplicate)
+            options.log(`[Pool] usage probe account=${job.accountId} result=${result}`);
+    }
+}

package/dist/worktree-manager.js

@@ -2,6 +2,7 @@ import { mkdir, readdir, stat, appendFile, readFile } from 'fs/promises';
 import { join } from 'path';
 import { execFile } from 'child_process';
 import { promisify } from 'util';
+import { readInboxRuntime } from './inbox-manager.js';
 const execFileAsync = promisify(execFile);
 const WORKTREES_SUBDIR = '.worktrees';
 const EXCLUDE_ENTRY = `${WORKTREES_SUBDIR}/\n`;
@@ -94,6 +95,9 @@ export async function cleanupOrphanWorktrees(brainPath, maxAgeMs = 24 * 60 * 60
     const cutoffMs = Date.now() - maxAgeMs;
     for (const entry of entries) {
         const path = join(worktreesDir, entry);
+        const pending = readInboxRuntime(brainPath, entry);
+        if (pending?.pin.resumePending && pending.pin.effectiveCwd === path)
+            continue;
         try {
             const s = await stat(path);
             if (s.mtimeMs < cutoffMs) {