@teamvibe/poller 0.8.6 → 0.8.7

package/dist/inbox-manager.d.ts

@@ -1,3 +1,4 @@
+import type { PoolDefer } from './pool-defer.js';
 import type { ClaudeRateLimitInfo } from './claude-rate-limit.js';
 import type { PoolAttempt } from './subscription-runtime.js';
 import type { TeamVibeQueueMessage, SubscriptionPin } from './types.js';
@@ -81,3 +82,6 @@ export declare function discardHandledInboxDrops(brainPath: string, threadId: st
 export declare function restartInboxInDirectory(source: string, target: string, threadId: string): void;
 /** Preserve unroutable work for operator review and remove it from replay queues. */
 export declare function quarantineInbox(brainPath: string, threadId: string, includeFailed?: boolean): void;
+/** Only original queue deliveries carry inbound identity; synthetic drops never wake holds. */
+export declare function inboxQueueMessageIds(brainPath: string, threadId: string): string[];
+export declare function hasInboxMessageAfter(brainPath: string, threadId: string, pause: Pick<PoolDefer, 'handledInboundIds'>): boolean;

package/dist/inbox-manager.js

@@ -305,3 +305,32 @@ export function quarantineInbox(brainPath, threadId, includeFailed = false) {
         renameSync(join(root, name), join(quarantine, `${Date.now()}-${name}`));
     }
 }
+/** Only original queue deliveries carry inbound identity; synthetic drops never wake holds. */
+export function inboxQueueMessageIds(brainPath, threadId) {
+    const ids = new Set();
+    for (const subdir of [PROCESSING_DIR, NEW_DIR]) {
+        const directory = join(getInboxPath(brainPath, threadId), subdir);
+        let names;
+        try {
+            names = readdirSync(directory);
+        }
+        catch {
+            continue;
+        }
+        for (const name of names) {
+            if (!name.endsWith('.txt'))
+                continue;
+            try {
+                const message = JSON.parse(readFileSync(join(directory, name), 'utf8'));
+                if (message.executionOrigin === 'queue' && message.thread_id === threadId && typeof message.id === 'string' && message.id)
+                    ids.add(message.id);
+            }
+            catch { /* Plain background drops and concurrent moves have no inbound identity. */ }
+        }
+    }
+    return [...ids];
+}
+export function hasInboxMessageAfter(brainPath, threadId, pause) {
+    const handled = new Set(pause.handledInboundIds ?? []);
+    return inboxQueueMessageIds(brainPath, threadId).some(id => !handled.has(id));
+}

package/dist/inbox-watcher.js

@@ -1,7 +1,7 @@
 import { executionDirectory } from './brain-directory.js';
-import { discardHandledInboxDrops, markProcessed, quarantineInbox, readInboxChannelContext, readInboxContext, readInboxRuntime, restartInboxInDirectory } from './inbox-manager.js';
+import { hasInboxMessageAfter, discardHandledInboxDrops, markProcessed, quarantineInbox, readInboxChannelContext, readInboxContext, readInboxRuntime, restartInboxInDirectory } from './inbox-manager.js';
 import { listThreadRoutings, readThreadRouting, removeThreadRouting, threadRoutingKey } from './thread-routing.js';
-import { isPoolDeferred, readPoolDefer } from './pool-defer.js';
+import { observePoolAccounts, isPoolDeferred, readPoolDefer } from './pool-defer.js';
 import { existsSync, readdirSync, rmSync, watch as fsWatch } from 'fs';
 import { join } from 'path';
 import { config } from './config.js';
@@ -11,6 +11,7 @@ import { logger } from './logger.js';
 import { isAtCapacity } from './claude-spawner.js';
 import { getTrackedBrains } from './maintenance-cron.js';
 import { runInboxLoop, isInboxLoopActive } from './poller.js';
+import { fetchRuntimePool } from './subscription-runtime.js';
 import { isQuotaPaused } from './quota-pause.js';
 import { emitError } from './event-queue.js';
 import { sendSlackMessage } from './slack-client.js';
@@ -151,6 +152,7 @@ export async function checkInboxForNewSessions(deps = defaultDeps()) {
     const expired = await sweepThreadRouting(deps, brains);
     const started = new Set();
     const recoveries = [];
+    const checkedPools = new Set();
     scan: for (const brainPath of brains) {
         if (deps.isAtCapacity())
             break;
@@ -160,7 +162,7 @@ export async function checkInboxForNewSessions(deps = defaultDeps()) {
                 break scan;
             if (expired.has(threadRoutingKey(threadId)))
                 continue;
-            if (started.has(threadId) || recoveringThreads.has(threadId) || deps.isInboxLoopActive(threadId) || isPoolDeferred(threadId))
+            if (started.has(threadId) || recoveringThreads.has(threadId) || deps.isInboxLoopActive(threadId))
                 continue;
             discardHandledInboxDrops(brainPath, threadId);
             const runtime = readInboxRuntime(brainPath, threadId);
@@ -193,6 +195,17 @@ export async function checkInboxForNewSessions(deps = defaultDeps()) {
                 quarantineRetainedThread(deps, brainPath, threadId, durable);
                 continue;
             }
+            if (isPoolDeferred(threadId)) {
+                // Held work still observes pool membership on every watcher tick.
+                const key = JSON.stringify([info.workspaceId, info.channelId]);
+                if (!checkedPools.has(key)) {
+                    checkedPools.add(key);
+                    observePoolAccounts(info.workspaceId, await fetchRuntimePool(message));
+                }
+                const pause = readPoolDefer(threadId);
+                if (isPoolDeferred(threadId) && pause && !hasInboxMessageAfter(brainPath, threadId, pause))
+                    continue;
+            }
             started.add(threadId);
             recoveringThreads.add(threadId);
             recoveries.push((async () => {

package/dist/maintenance-cron.d.ts

@@ -37,6 +37,12 @@ export interface BootstrapBrainInfo {
     botId: string;
     botToken: string;
     channelId: string;
+    connectionId?: string;
+    credentialVersion?: string;
+    bindingVersion?: number;
+    channelConnectionId?: string;
+    channelCredentialVersion?: string;
+    channelBindingVersion?: number;
 }
 /**
  * Seed trackedBrains at startup from the backend's authoritative brain list

package/dist/poller.js

@@ -1,3 +1,4 @@
+import { startGitCredentialJanitor, registeredGitCredentialTasks } from './git-credential-session.js';
 import { isUsageProbe, handleUsageProbe } from './usage-probe-job.js';
 import { fetchSubscriptionPool } from './subscription-pool-client.js';
 import { formatPoolUsageLimitMessage } from './usage-limit-messages.js';
@@ -13,7 +14,7 @@ import { classifyFailedIteration } from './classify-failed-iteration.js';
 import { fetchSecretsForSpawn } from './secrets-client.js';
 import { PoolDeferredError, fetchRuntimePool, subscriptionUsageStore, HELD_PROBE_INTERVAL_MS } from './subscription-runtime.js';
 import { POOL_RECHECK_MS } from './subscription-selection.js';
-import { isPoolDeferred, readPoolDefer, deferPool, setPoolNotice, clearPoolDefer } from './pool-defer.js';
+import { invalidatePoolDefer, invalidateWorkspacePoolDefers, observePoolAccounts, isPoolDeferred, readPoolDefer, deferPool, setPoolNotice, clearPoolDefer } from './pool-defer.js';
 import { isQuotaPaused, pauseForQuota, clearQuotaPauseAfterSuccess, QuotaPausedError } from './quota-pause.js';
 import { acquireSessionLock, releaseSessionLock, updateSessionId } from './session-store.js';
 import { ensureDirectories, ensureBaseBrain, pushBrainChanges } from './brain-manager.js';
@@ -25,7 +26,7 @@ import { registerBrain, startMaintenanceLoop, stopMaintenanceLoop } from './main
 import { bootstrapTrackedBrains } from './brains-bootstrap.js';
 import { startEventQueue, stopEventQueue, flush as flushEventQueue, emitEvent, emitError } from './event-queue.js';
 import { startMetricsCron, stopMetricsCron } from './metrics/scheduler.js';
-import { writeMessage, pickNextMessage, markProcessed, markFailed, hasUnprocessed, requeueMessage, saveInboxContext, saveInboxRuntime, readInboxRuntime, clearInboxRuntime } from './inbox-manager.js';
+import { inboxQueueMessageIds, hasInboxMessageAfter, writeMessage, pickNextMessage, markProcessed, markFailed, hasUnprocessed, requeueMessage, saveInboxContext, saveInboxRuntime, readInboxRuntime, clearInboxRuntime } from './inbox-manager.js';
 import { saveThreadRouting } from './thread-routing.js';
 import { startInboxWatcher, stopInboxWatcher } from './inbox-watcher.js';
 import { Cron } from 'croner';
@@ -256,12 +257,17 @@ export async function runInboxLoop(threadId, selectedDirectory, queueMessage, se
     if (isQuotaPaused() && !getPollerId())
         return;
     const initialPool = await fetchRuntimePool(queueMessage);
+    observePoolAccounts(queueMessage.teamvibe.workspaceId, initialPool, { log: line => sessionLog.info(line) });
     if (initialPool.kind === 'no_accounts_configured') {
         if (isQuotaPaused())
             return;
     }
-    else if (isPoolDeferred(threadId))
-        return;
+    else if (isPoolDeferred(threadId)) {
+        const pause = readPoolDefer(threadId);
+        if (!hasInboxMessageAfter(kbPath, threadId, pause))
+            return;
+        invalidatePoolDefer(threadId, queueMessage.teamvibe.workspaceId, 'new_message', { log: line => sessionLog.info(line) }, inboxQueueMessageIds(kbPath, threadId));
+    }
     if (activeLoops.has(threadId)) {
         sessionLog.info(`Loop already running for thread ${threadId}, skipping`);
         return;
@@ -369,6 +375,7 @@ export async function runInboxLoop(threadId, selectedDirectory, queueMessage, se
             // Dispatch before ANY pool state/context/model preparation. The explicit
             // no-pool outcome runs the original spawn and #408 pause gates.
             const pool = iteration === 0 ? initialPool : await fetchRuntimePool(queueMessage);
+            observePoolAccounts(queueMessage.teamvibe.workspaceId, pool, { log: line => sessionLog.info(line) });
             poolIteration = pool.kind !== 'no_accounts_configured';
             if (!poolIteration && isQuotaPaused())
                 break;
@@ -620,7 +627,7 @@ export async function runInboxLoop(threadId, selectedDirectory, queueMessage, se
                     // Revisit held work hourly so background probes can refresh the account.
                     // Selection still enforces each window's real reset before inference.
                     const recheckAt = error.cause === 'usage' ? Math.min(error.eligibleAt, Date.now() + HELD_PROBE_INTERVAL_MS) : error.eligibleAt;
-                    const pause = deferPool(threadId, recheckAt, error.resetAt);
+                    const pause = deferPool(threadId, recheckAt, error.resetAt, inboxQueueMessageIds(kbPath, threadId));
                     const retained = readInboxRuntime(kbPath, threadId);
                     // Rechecks of one exhaustion episode do not inflate the episode count.
                     quotaDeferEpisodes = Math.max(1, quotaDeferEpisodes);
@@ -900,7 +907,7 @@ async function processMessage(received) {
     const kbPath = directory.path;
     // Write raw message to inbox (spawnClaudeCode handles prompt formatting)
     const { botToken: _inboxToken, ...inboxTeamvibe } = queueMessage.teamvibe;
-    writeMessage(kbPath, threadId, JSON.stringify({ ...queueMessage, teamvibe: inboxTeamvibe }));
+    writeMessage(kbPath, threadId, JSON.stringify({ ...queueMessage, executionOrigin: receiptHandle ? 'queue' : 'maintenance', teamvibe: inboxTeamvibe }));
     sessionLog.info(`Wrote message to inbox`);
     // Delete SQS message immediately — it's now persisted in the inbox
     if (receiptHandle) {
@@ -1028,6 +1035,7 @@ export async function pollLoop() {
                             apiUrl: config.TEAMVIBE_API_URL,
                             pollerToken: config.TEAMVIBE_POLLER_TOKEN || '',
                         }),
+                        onHeadroom: workspaceId => invalidateWorkspacePoolDefers(workspaceId, 'usage_update'),
                         store: subscriptionUsageStore(),
                         cliPath: config.CLAUDE_CLI_PATH,
                         isAtCapacity,
@@ -1232,7 +1240,8 @@ export async function startPoller() {
         logger.error(`Startup base brain failed permanently: ${startupFailureDetail(error, 'BaseBrain', [config.TEAMVIBE_POLLER_TOKEN ?? '', config.BASE_BRAIN_REPO])}`);
         process.exit(1);
     }
-    reconcileBgTasksOnBoot();
+    startGitCredentialJanitor();
+    reconcileBgTasksOnBoot(registeredGitCredentialTasks());
     if (config.IDLE_RESTART_ENABLED) {
         // Defaults off (tv#317 follow-up, DevGuru review): a silent disabled gate and an
         // enabled gate that just hasn't hit its threshold yet look identical in production

package/dist/pool-defer.d.ts

@@ -1,4 +1,16 @@
+import { emitEvent } from './event-queue.js';
+import type { PoolFetchResult } from './subscription-selection.js';
 export interface PoolDefer {
+    /** Additive ownership index; older markers use the existing hashed routing file. */
+    scope?: {
+        workspaceId: string;
+        threadId: string;
+        channelId: string;
+    };
+    /** Enabled capacity known when this hold was last evaluated. */
+    poolAccountIds?: string[];
+    /** Queue arrivals already considered in this exhaustion episode. */
+    handledInboundIds?: string[];
     createdAt: number;
     resumeAt: number;
     resetAt?: string;
@@ -7,7 +19,18 @@ export interface PoolDefer {
 }
 export declare function readPoolDefer(threadId: string): PoolDefer | undefined;
 export declare function isPoolDeferred(threadId: string): boolean;
-export declare function deferPool(threadId: string, eligibleAt: number, resetAt?: string): PoolDefer;
+export declare function deferPool(threadId: string, eligibleAt: number, resetAt?: string, handledInboundIds?: string[]): PoolDefer;
 /** Claim durably before Slack I/O. Ambiguous sends are never blindly replayed. */
 export declare function setPoolNotice(threadId: string, episodeId: string, notice: PoolDefer['notice']): boolean;
 export declare function clearPoolDefer(threadId: string): void;
+export type PoolDeferInvalidationReason = 'usage_update' | 'pool_changed' | 'new_message';
+interface InvalidationObserver {
+    emit?: typeof emitEvent;
+    log?: (line: string) => void;
+}
+/** Expire atomically, retaining the episode and notice claim until a successful spawn. */
+export declare function invalidatePoolDefer(threadId: string, workspaceId: string, reason: PoolDeferInvalidationReason, observer?: InvalidationObserver, handledInboundIds?: string[]): void;
+export declare function invalidateWorkspacePoolDefers(workspaceId: string, reason: Exclude<PoolDeferInvalidationReason, 'new_message'>, observer?: InvalidationObserver): void;
+/** Only authoritative enabled account sets advance the baseline; never cache credentials. */
+export declare function observePoolAccounts(workspaceId: string, pool: PoolFetchResult, observer?: InvalidationObserver): void;
+export {};

package/dist/pool-defer.js

@@ -1,19 +1,27 @@
 import { createHash, randomUUID } from 'node:crypto';
-import { mkdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { mkdirSync, readdirSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { config } from './config.js';
 import { logger } from './logger.js';
+import { emitEvent } from './event-queue.js';
+import { readThreadRouting, threadRoutingKey } from './thread-routing.js';
 import { POOL_RECHECK_MS } from './subscription-selection.js';
 function pathFor(threadId) {
     return join(config.TEAMVIBE_DATA_DIR, 'pool-defer', `${createHash('sha256').update(threadId).digest('hex')}.json`);
 }
 const warned = new Set();
 export function readPoolDefer(threadId) {
-    const path = pathFor(threadId);
+    return readMarker(pathFor(threadId));
+}
+function readMarker(path) {
     try {
         const state = JSON.parse(readFileSync(path, 'utf8'));
-        if (!Number.isFinite(state.createdAt) || !Number.isFinite(state.resumeAt) || state.resumeAt <= state.createdAt || state.resumeAt > 253402300799000 || typeof state.episodeId !== 'string' || !['pending', 'claimed', 'delivered', 'ambiguous'].includes(state.notice))
+        if (!Number.isFinite(state.createdAt) || !Number.isFinite(state.resumeAt) || state.resumeAt < state.createdAt || state.resumeAt > 253402300799000 || typeof state.episodeId !== 'string' || !['pending', 'claimed', 'delivered', 'ambiguous'].includes(state.notice))
             throw new Error('Invalid defer');
+        for (const ids of [state.poolAccountIds, state.handledInboundIds]) {
+            if (ids !== undefined && (!Array.isArray(ids) || ids.some(id => typeof id !== 'string')))
+                throw new Error('Invalid defer baseline');
+        }
         warned.delete(path);
         return state;
     }
@@ -56,10 +64,14 @@ function write(threadId, state) {
         catch { }
     }
 }
-export function deferPool(threadId, eligibleAt, resetAt) {
+export function deferPool(threadId, eligibleAt, resetAt, handledInboundIds = []) {
     const previous = readPoolDefer(threadId);
     const now = Date.now();
-    const state = { createdAt: now, resumeAt: Number.isFinite(eligibleAt) && eligibleAt > now ? eligibleAt : now + POOL_RECHECK_MS, episodeId: previous?.episodeId ?? randomUUID(), notice: previous?.notice ?? 'pending', ...(resetAt ? { resetAt } : {}) };
+    const routing = readThreadRouting(threadId);
+    const scope = routing ? { workspaceId: routing.workspaceId, channelId: routing.channelId, threadId } : previous?.scope;
+    const fingerprint = scope ? poolFingerprints.get(poolKey(scope.workspaceId)) : undefined;
+    const poolAccountIds = fingerprint === undefined ? previous?.poolAccountIds : JSON.parse(fingerprint);
+    const state = { ...(scope ? { scope } : {}), ...(poolAccountIds ? { poolAccountIds } : {}), handledInboundIds: [...new Set([...(previous?.handledInboundIds ?? []), ...handledInboundIds])], createdAt: now, resumeAt: Number.isFinite(eligibleAt) && eligibleAt > now ? eligibleAt : now + POOL_RECHECK_MS, episodeId: previous?.episodeId ?? randomUUID(), notice: previous?.notice ?? 'pending', ...(resetAt ? { resetAt } : {}) };
     write(threadId, state);
     return state;
 }
@@ -79,3 +91,87 @@ export function clearPoolDefer(threadId) {
         logger.warn('[PoolDefer] Completed episode cleanup will be retried');
     }
 }
+/** Expire atomically, retaining the episode and notice claim until a successful spawn. */
+export function invalidatePoolDefer(threadId, workspaceId, reason, observer = {}, handledInboundIds = []) {
+    const state = readPoolDefer(threadId);
+    if (!state || !isPoolDeferred(threadId))
+        return;
+    const routing = readThreadRouting(threadId);
+    const scope = state.scope ?? (routing ? { ...routing, threadId } : undefined);
+    if (!scope || scope.workspaceId !== workspaceId)
+        return;
+    write(threadId, { ...state, resumeAt: state.createdAt, handledInboundIds: [...new Set([...(state.handledInboundIds ?? []), ...handledInboundIds])] });
+    const metadata = { workspaceId, threadId, reason, episodeId: state.episodeId };
+    // Observability cannot undo the durable wake-up.
+    try {
+        (observer.log ?? (line => logger.info(line)))(`[Pool] defer invalidated workspace=${JSON.stringify(workspaceId)} thread=${JSON.stringify(threadId)} reason=${reason} episode=${JSON.stringify(state.episodeId)}`);
+    }
+    catch { }
+    try {
+        (observer.emit ?? emitEvent)('pool.defer_invalidated', scope.channelId, metadata);
+    }
+    catch { }
+}
+/** One directory scan, one bounded routing lookup per legacy marker; no inbox scan. */
+function* workspacePoolDefers(workspaceId) {
+    const root = join(config.TEAMVIBE_DATA_DIR, 'pool-defer');
+    let names;
+    try {
+        names = readdirSync(root);
+    }
+    catch {
+        return;
+    }
+    for (const name of names) {
+        if (!/^[a-f0-9]{64}\.json$/.test(name))
+            continue;
+        try {
+            const state = readMarker(join(root, name));
+            if (!state)
+                continue;
+            let scope = state.scope;
+            if (!scope) {
+                // Pre-#572 markers share their hash with durable thread routing.
+                scope = JSON.parse(readFileSync(join(config.TEAMVIBE_DATA_DIR, 'thread-routing', name), 'utf8'));
+            }
+            if (scope?.workspaceId === workspaceId && typeof scope.threadId === 'string' && threadRoutingKey(scope.threadId) === name)
+                yield { state, scope };
+        }
+        catch {
+            logger.warn('[PoolDefer] Workspace invalidation will be retried');
+        }
+    }
+}
+export function invalidateWorkspacePoolDefers(workspaceId, reason, observer = {}) {
+    for (const { scope } of workspacePoolDefers(workspaceId))
+        invalidatePoolDefer(scope.threadId, workspaceId, reason, observer);
+}
+const poolFingerprints = new Map();
+function poolKey(workspaceId) {
+    return JSON.stringify([config.TEAMVIBE_DATA_DIR, workspaceId]);
+}
+/** Only authoritative enabled account sets advance the baseline; never cache credentials. */
+export function observePoolAccounts(workspaceId, pool, observer = {}) {
+    if (pool.kind !== 'ready' && pool.kind !== 'no_accounts_configured' && !(pool.kind === 'fetch_unavailable' && pool.reason === 'no_usable_accounts'))
+        return;
+    const poolAccountIds = pool.kind === 'ready' ? [...new Set(pool.accounts.filter(a => a.enabled && a.workspaceId === workspaceId).map(a => a.accountId))].sort() : [];
+    const fingerprint = JSON.stringify(poolAccountIds);
+    const key = poolKey(workspaceId);
+    if (poolFingerprints.get(key) === fingerprint)
+        return;
+    // The first fetch after boot also compares the durable per-marker baselines.
+    for (const { state, scope } of workspacePoolDefers(workspaceId)) {
+        const now = Date.now();
+        if (now < state.createdAt || now >= state.resumeAt)
+            continue;
+        if (state.poolAccountIds && poolAccountIds.some(id => !state.poolAccountIds.includes(id))) {
+            invalidatePoolDefer(scope.threadId, workspaceId, 'pool_changed', observer);
+        }
+        else {
+            // Reductions never add capacity. Adopt them so a later re-enable wakes work.
+            // A legacy marker adopts its first observed baseline without waking work.
+            write(scope.threadId, { ...state, poolAccountIds });
+        }
+    }
+    poolFingerprints.set(key, fingerprint);
+}

package/dist/pool-telemetry.js

@@ -139,6 +139,7 @@ export function emitPoolSelection(msg, selection) {
         selectedAccountLabel: safeText(selection.account.label) ?? 'unlabeled',
         decidedAt: lastSelectionAt,
         candidates: selection.candidates ?? [],
+        ...(selection.pinned ? { pinned: true } : {}),
         ...(selection.switch ? { switch: selection.switch } : {}),
     });
 }

package/dist/redact-text.d.ts

@@ -1,2 +1,4 @@
-/** Redact credentials in diagnostics without initializing poller authentication. */
+export declare function registerConfiguredToken(token: string): void;
+export declare function redactRepoUrl(url: string): string;
+export declare function redactGitDiagnostic(text: string): string;
 export declare function redactStartupText(text: string, configuredTokens?: readonly string[]): string;

package/dist/redact-text.js

@@ -1,4 +1,20 @@
 /** Redact credentials in diagnostics without initializing poller authentication. */
+const issuedTokens = new Set();
+export function registerConfiguredToken(token) { if (token)
+    issuedTokens.add(token); }
+export function redactRepoUrl(url) {
+    return redactGitDiagnostic(url.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, '$1<redacted>@'));
+}
+export function redactGitDiagnostic(text) {
+    let safe = text
+        .replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, '$1<redacted>@')
+        .replace(/\b(?:x-access-token|oauth2):[^\s/@]+/gi, match => match.split(':')[0] + ':<redacted>')
+        .replace(/\bgh[pos]_[A-Za-z0-9]{20,}\b/g, '<redacted>');
+    for (const token of issuedTokens)
+        if (token)
+            safe = safe.split(token).join('<redacted>');
+    return safe;
+}
 export function redactStartupText(text, configuredTokens = []) {
     let safe = text
         .replace(/https?:\/\/[^\s/@]+@/gi, 'https://[REDACTED]@')
@@ -7,7 +23,7 @@ export function redactStartupText(text, configuredTokens = []) {
         // Cover both Claude's token name and the opt-in subprocess alias in
         // shell assignments and JSON env diagnostics, even without a token list.
         .replace(/(\b(?:CLAUDE_CODE_OAUTH_TOKEN|TEAMVIBE_CLAUDE_OAUTH_TOKEN)["']?\s*[:=]\s*)(?:"(?:\\.|[^"\\])*"|'[^']*'|[^\s,;]+)/gi, '$1[REDACTED]');
-    for (const token of configuredTokens) {
+    for (const token of [...issuedTokens, ...configuredTokens]) {
         if (token)
             safe = safe.split(token).join('[REDACTED]');
     }

package/dist/session-instance.d.ts

@@ -0,0 +1,9 @@
+export interface SessionInstance {
+    sessionInstanceId: string;
+    createdAt: string;
+}
+export declare function createSessionInstance(): SessionInstance;
+export declare function readSessionOwner(path: string): SessionInstance | undefined;
+export declare function writeSessionOwner(path: string, owner: SessionInstance): void;
+export declare function sameSessionInstance(a: SessionInstance | undefined, b: SessionInstance | undefined): boolean;
+export declare function reportSessionOwnerMismatch(owner: SessionInstance, current?: SessionInstance): void;

package/dist/session-instance.js

@@ -0,0 +1,36 @@
+import { randomUUID } from 'node:crypto';
+import { chmodSync, readFileSync, renameSync, rmSync, writeFileSync } from 'node:fs';
+import { logger } from './logger.js';
+export function createSessionInstance() {
+    return { sessionInstanceId: randomUUID(), createdAt: new Date().toISOString() };
+}
+export function readSessionOwner(path) {
+    try {
+        const owner = JSON.parse(readFileSync(path, 'utf8'));
+        if (typeof owner.sessionInstanceId === 'string' && typeof owner.createdAt === 'string')
+            return owner;
+    }
+    catch { /* Missing or malformed ownership is never permission to delete. */ }
+    return undefined;
+}
+export function writeSessionOwner(path, owner) {
+    const temporary = `${path}.${randomUUID()}.tmp`;
+    try {
+        writeFileSync(temporary, JSON.stringify({ sessionInstanceId: owner.sessionInstanceId, createdAt: owner.createdAt }), { mode: 0o600, flag: 'wx' });
+        chmodSync(temporary, 0o600);
+        renameSync(temporary, path);
+    }
+    finally {
+        rmSync(temporary, { force: true });
+    }
+}
+export function sameSessionInstance(a, b) {
+    return a !== undefined && b !== undefined && a.sessionInstanceId === b.sessionInstanceId && a.createdAt === b.createdAt;
+}
+const reported = new Set();
+export function reportSessionOwnerMismatch(owner, current) {
+    if (reported.has(owner.sessionInstanceId))
+        return;
+    reported.add(owner.sessionInstanceId);
+    logger.warn(`[GitCredential] Cleanup ownership changed; retaining successor worktree and credentials (expected ${owner.sessionInstanceId}, actual ${current?.sessionInstanceId ?? 'missing-or-malformed'})`);
+}

package/dist/subscription-runtime.js

@@ -1,4 +1,5 @@
 import { isAtCapacity, isSubscriptionAccountRunning } from './claude-spawner.js';
+import { invalidateWorkspacePoolDefers } from './pool-defer.js';
 import { emitEvent } from './event-queue.js';
 import { logger } from './logger.js';
 import { runUsageProbe } from './usage-probe-job.js';
@@ -149,6 +150,7 @@ export async function preparePool(msg, resolved, pin, fetched, log, probeOptions
     if (pool.kind === 'ready')
         probeUnknownAccounts(pool.accounts, selected.kind === 'selected' ? selected.account.accountId : undefined, resolved, store, {
             cliPath: config.CLAUDE_CLI_PATH, isAtCapacity, emit: emitEvent,
+            onHeadroom: workspaceId => invalidateWorkspacePoolDefers(workspaceId, 'usage_update'),
             log: line => (log ?? logger).info(line), ...probeOptions, store,
         }, msg.teamvibe.channelId);
     if (selected.kind === 'selected') {

package/dist/usage-probe-job.d.ts

@@ -6,6 +6,8 @@ import { type SubscriptionUsageStore } from './subscription-usage-store.js';
 import type { UsageProbeFailureReason as Reason } from './usage-probe-contract.js';
 type ProbeResult = Reason | 'ok' | 'cancelled';
 export interface UsageProbeOptions {
+    /** Poller-owned wake-up; keeps shared probe imports independent of poller configuration. */
+    onHeadroom?: (workspaceId: string) => void;
     store: SubscriptionUsageStore;
     cliPath: string;
     /** Use the session's resolved model for local probes; platform jobs default to CLI behavior. */

package/dist/usage-probe-job.js

@@ -2,7 +2,7 @@ import { spawn } from 'node:child_process';
 import { mkdtemp, rm, mkdir } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
-import { normalizePassiveUsage } from './subscription-selection.js';
+import { selectSubscriptionAccount, normalizePassiveUsage } from './subscription-selection.js';
 import { safeRateLimitInfo, usageStateForSelection, } from './subscription-usage-store.js';
 import { parseClaudeRateLimitInfo, } from './claude-rate-limit.js';
 import { formatPoolUsageWindows, poolInfo, poolLabel } from './pool-logging.js';
@@ -221,6 +221,12 @@ export async function runUsageProbe(account, options, context = {}) {
             usage,
         });
         const stored = await options.store.read(account);
+        if (selectSubscriptionAccount({ pool: { kind: 'ready', accounts: [account] }, states: { [account.accountId]: usageStateForSelection(stored, now) }, model: undefined, now }).kind === 'selected') {
+            try {
+                options.onHeadroom?.(account.workspaceId);
+            }
+            catch { /* Wake-up failures must not discard a measured observation. */ }
+        }
         // Requestless local observations use real channel authorization; the
         // workspace-job namespace is reserved for platform request IDs.
         options.emit('pool.usage_observed', context.channelId ?? 'usage_probe', {

package/dist/worktree-manager.d.ts

@@ -1,3 +1,4 @@
+import { type SessionInstance } from './session-instance.js';
 /**
  * Create a fresh worktree for a spawned session. Returns the absolute path of
  * the worktree, which the caller should use as the spawned process's `cwd`.
@@ -5,17 +6,19 @@
  * Idempotent against existing worktrees at the same path: if one is found,
  * it's removed and recreated to guarantee a clean start.
  */
-export declare function createWorktree(brainPath: string, sessionId: string, branch?: string): Promise<string>;
+export declare function createWorktree(brainPath: string, sessionId: string, branch?: string, instance?: SessionInstance): Promise<string>;
 /**
  * Remove a worktree by session ID. Force-removes so dirty state from a crashed
  * session doesn't block cleanup — the contract is that any session work the
  * caller wanted to preserve has already been pushed to `origin/<branch>`.
  */
-export declare function removeWorktree(brainPath: string, sessionId: string): Promise<void>;
+export declare function removeWorktree(brainPath: string, sessionId: string, instance?: SessionInstance | null): Promise<void>;
 /**
  * Sweep orphan worktrees left behind by crashed sessions. Removes every
- * worktree under `<brainPath>/.worktrees/` whose directory mtime is older
- * than `maxAgeMs`. Intended to run once at poller startup.
+ * known-dead instance immediately, or an unregistered/legacy orphan older
+ * than `maxAgeMs`. Live sessions and registered tasks always retain their
+ * worktrees, including those with missing, malformed or changed markers.
+ * Intended to run once at poller startup.
  */
 export declare function cleanupOrphanWorktrees(brainPath: string, maxAgeMs?: number): Promise<{
     removed: string[];