@the-open-engine/zeroshot 6.35.3 → 6.37.0

package/lib/target/discovery-sections.mjs

@@ -1,5 +1,5 @@
 import { TargetDiscoveryError } from './discovery-errors.mjs';
-import { closedRecord, exact, exactStringSet, integer, parseCredentialInstall, sameOriginUrl, stringField, } from './discovery-validation.mjs';
+import { closedRecord, exact, exactStringSet, integer, record, sameOriginUrl, stringField, } from './discovery-validation.mjs';
 import { parseRunIntent } from './run-intent-discovery.mjs';
 import { routeTemplate } from './route-template.mjs';
 export function parseAdapter(discovery) {
@@ -40,29 +40,10 @@ export function parseSizes(discovery) {
 }
 export function parseExtensions(discovery, origin) {
     if (discovery.extensions === undefined || discovery.extensions === null) {
-        return Object.freeze({ credentialInstall: null, runIntent: null });
+        return Object.freeze({ runIntent: null });
     }
-    const extensions = closedRecord(discovery.extensions, 'extensions', [
-        'connections',
-        'credential_install',
-        'run_intent',
-    ]);
-    if (extensions.connections === undefined) {
-        throw new TargetDiscoveryError('extensions.connections is required');
-    }
-    const connections = closedRecord(extensions.connections, 'extensions.connections', [
-        'kind',
-        'base_url',
-        'route_templates',
-    ]);
-    exact(connections.kind, 'zerocloud.connections/v1', 'extensions.connections.kind');
-    sameOriginUrl(connections.base_url, 'extensions.connections.base_url', origin);
-    const routes = closedRecord(connections.route_templates, 'extensions.connections.route_templates', ['list', 'create', 'update']);
-    routeTemplate(routes.list, 'extensions.connections.route_templates.list', []);
-    routeTemplate(routes.create, 'extensions.connections.route_templates.create', []);
-    routeTemplate(routes.update, 'extensions.connections.route_templates.update', ['connection_id']);
+    const extensions = record(discovery.extensions, 'extensions');
     return Object.freeze({
-        credentialInstall: parseCredentialInstall(extensions.credential_install),
         runIntent: parseRunIntent(extensions.run_intent, origin),
     });
 }

package/lib/target/discovery-validation.cjs

@@ -7,9 +7,7 @@ exports.exact = exact;
 exports.integer = integer;
 exports.exactStringSet = exactStringSet;
 exports.sameOriginUrl = sameOriginUrl;
-exports.parseCredentialInstall = parseCredentialInstall;
 const discovery_errors_js_1 = require("./discovery-errors.cjs");
-const route_template_js_1 = require("./route-template.cjs");
 function record(value, field) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} must be an object`);
@@ -44,19 +42,20 @@ function exactStringSet(value, field, expected) {
     if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} must be an array of strings`);
     }
-    if (value.length !== expected.length || new Set(value).size !== value.length ||
+    if (value.length !== expected.length ||
+        new Set(value).size !== value.length ||
         expected.some((item) => !value.includes(item))) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} does not match the supported contract`);
     }
     return Object.freeze([...value]);
 }
 function hasForbiddenUrlComponent(url, value, protocols) {
-    return !protocols.includes(url.protocol) ||
+    return (!protocols.includes(url.protocol) ||
         url.username !== '' ||
         url.password !== '' ||
         url.search !== '' ||
         url.hash !== '' ||
-        url.href !== value;
+        url.href !== value);
 }
 function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     if (typeof value !== 'string' || /[\u0000-\u0020\u007f]|\s/u.test(value)) {
@@ -77,26 +76,3 @@ function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     }
     return url.href;
 }
-function parseCredentialInstall(value) {
-    if (value === undefined || value === null)
-        return null;
-    const extension = closedRecord(value, 'extensions.credential_install', [
-        'kind',
-        'install',
-        'max_body_bytes',
-    ]);
-    exact(extension.kind, 'openengine.capsule-credential-install/v1', 'extensions.credential_install.kind');
-    const install = closedRecord(extension.install, 'extensions.credential_install.install', [
-        'route_template',
-        'method',
-    ]);
-    exact(install.method, 'PUT', 'extensions.credential_install.install.method');
-    return Object.freeze({
-        kind: 'openengine.capsule-credential-install/v1',
-        install: Object.freeze({
-            routeTemplate: (0, route_template_js_1.routeTemplate)(install.route_template, 'extensions.credential_install.install.route_template', ['capsule_id']),
-            method: 'PUT',
-        }),
-        maxBodyBytes: integer(extension.max_body_bytes, 'extensions.credential_install.max_body_bytes', 1, 4 * 1024 * 1024),
-    });
-}

package/lib/target/discovery-validation.d.cts

@@ -1,12 +1,3 @@
-import { type RouteTemplate } from './route-template.js';
-export interface CredentialInstallDescriptor {
-    readonly kind: 'openengine.capsule-credential-install/v1';
-    readonly install: {
-        readonly routeTemplate: RouteTemplate;
-        readonly method: 'PUT';
-    };
-    readonly maxBodyBytes: number;
-}
 export declare function record(value: unknown, field: string): Record<string, unknown>;
 export declare function closedRecord(value: unknown, field: string, fields: readonly string[]): Record<string, unknown>;
 export declare function stringField(source: Record<string, unknown>, field: string, parent?: string): string;
@@ -14,4 +5,3 @@ export declare function exact(value: unknown, expected: unknown, field: string):
 export declare function integer(value: unknown, field: string, min: number, max?: number): number;
 export declare function exactStringSet(value: unknown, field: string, expected: readonly string[]): readonly string[];
 export declare function sameOriginUrl(value: unknown, field: string, origin: string, protocols?: readonly string[]): string;
-export declare function parseCredentialInstall(value: unknown): CredentialInstallDescriptor | null;

package/lib/target/discovery-validation.d.mts

@@ -1,12 +1,3 @@
-import { type RouteTemplate } from './route-template.js';
-export interface CredentialInstallDescriptor {
-    readonly kind: 'openengine.capsule-credential-install/v1';
-    readonly install: {
-        readonly routeTemplate: RouteTemplate;
-        readonly method: 'PUT';
-    };
-    readonly maxBodyBytes: number;
-}
 export declare function record(value: unknown, field: string): Record<string, unknown>;
 export declare function closedRecord(value: unknown, field: string, fields: readonly string[]): Record<string, unknown>;
 export declare function stringField(source: Record<string, unknown>, field: string, parent?: string): string;
@@ -14,4 +5,3 @@ export declare function exact(value: unknown, expected: unknown, field: string):
 export declare function integer(value: unknown, field: string, min: number, max?: number): number;
 export declare function exactStringSet(value: unknown, field: string, expected: readonly string[]): readonly string[];
 export declare function sameOriginUrl(value: unknown, field: string, origin: string, protocols?: readonly string[]): string;
-export declare function parseCredentialInstall(value: unknown): CredentialInstallDescriptor | null;

package/lib/target/discovery-validation.d.ts

@@ -1,12 +1,3 @@
-import { type RouteTemplate } from './route-template.js';
-export interface CredentialInstallDescriptor {
-    readonly kind: 'openengine.capsule-credential-install/v1';
-    readonly install: {
-        readonly routeTemplate: RouteTemplate;
-        readonly method: 'PUT';
-    };
-    readonly maxBodyBytes: number;
-}
 export declare function record(value: unknown, field: string): Record<string, unknown>;
 export declare function closedRecord(value: unknown, field: string, fields: readonly string[]): Record<string, unknown>;
 export declare function stringField(source: Record<string, unknown>, field: string, parent?: string): string;
@@ -14,4 +5,3 @@ export declare function exact(value: unknown, expected: unknown, field: string):
 export declare function integer(value: unknown, field: string, min: number, max?: number): number;
 export declare function exactStringSet(value: unknown, field: string, expected: readonly string[]): readonly string[];
 export declare function sameOriginUrl(value: unknown, field: string, origin: string, protocols?: readonly string[]): string;
-export declare function parseCredentialInstall(value: unknown): CredentialInstallDescriptor | null;

package/lib/target/discovery-validation.js

@@ -7,9 +7,7 @@ exports.exact = exact;
 exports.integer = integer;
 exports.exactStringSet = exactStringSet;
 exports.sameOriginUrl = sameOriginUrl;
-exports.parseCredentialInstall = parseCredentialInstall;
 const discovery_errors_js_1 = require("./discovery-errors.js");
-const route_template_js_1 = require("./route-template.js");
 function record(value, field) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} must be an object`);
@@ -44,19 +42,20 @@ function exactStringSet(value, field, expected) {
     if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} must be an array of strings`);
     }
-    if (value.length !== expected.length || new Set(value).size !== value.length ||
+    if (value.length !== expected.length ||
+        new Set(value).size !== value.length ||
         expected.some((item) => !value.includes(item))) {
         throw new discovery_errors_js_1.TargetDiscoveryError(`${field} does not match the supported contract`);
     }
     return Object.freeze([...value]);
 }
 function hasForbiddenUrlComponent(url, value, protocols) {
-    return !protocols.includes(url.protocol) ||
+    return (!protocols.includes(url.protocol) ||
         url.username !== '' ||
         url.password !== '' ||
         url.search !== '' ||
         url.hash !== '' ||
-        url.href !== value;
+        url.href !== value);
 }
 function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     if (typeof value !== 'string' || /[\u0000-\u0020\u007f]|\s/u.test(value)) {
@@ -77,26 +76,3 @@ function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     }
     return url.href;
 }
-function parseCredentialInstall(value) {
-    if (value === undefined || value === null)
-        return null;
-    const extension = closedRecord(value, 'extensions.credential_install', [
-        'kind',
-        'install',
-        'max_body_bytes',
-    ]);
-    exact(extension.kind, 'openengine.capsule-credential-install/v1', 'extensions.credential_install.kind');
-    const install = closedRecord(extension.install, 'extensions.credential_install.install', [
-        'route_template',
-        'method',
-    ]);
-    exact(install.method, 'PUT', 'extensions.credential_install.install.method');
-    return Object.freeze({
-        kind: 'openengine.capsule-credential-install/v1',
-        install: Object.freeze({
-            routeTemplate: (0, route_template_js_1.routeTemplate)(install.route_template, 'extensions.credential_install.install.route_template', ['capsule_id']),
-            method: 'PUT',
-        }),
-        maxBodyBytes: integer(extension.max_body_bytes, 'extensions.credential_install.max_body_bytes', 1, 4 * 1024 * 1024),
-    });
-}

package/lib/target/discovery-validation.mjs

@@ -1,5 +1,4 @@
 import { TargetDiscoveryError } from './discovery-errors.mjs';
-import { routeTemplate } from './route-template.mjs';
 export function record(value, field) {
     if (value === null || typeof value !== 'object' || Array.isArray(value)) {
         throw new TargetDiscoveryError(`${field} must be an object`);
@@ -34,19 +33,20 @@ export function exactStringSet(value, field, expected) {
     if (!Array.isArray(value) || value.some((item) => typeof item !== 'string')) {
         throw new TargetDiscoveryError(`${field} must be an array of strings`);
     }
-    if (value.length !== expected.length || new Set(value).size !== value.length ||
+    if (value.length !== expected.length ||
+        new Set(value).size !== value.length ||
         expected.some((item) => !value.includes(item))) {
         throw new TargetDiscoveryError(`${field} does not match the supported contract`);
     }
     return Object.freeze([...value]);
 }
 function hasForbiddenUrlComponent(url, value, protocols) {
-    return !protocols.includes(url.protocol) ||
+    return (!protocols.includes(url.protocol) ||
         url.username !== '' ||
         url.password !== '' ||
         url.search !== '' ||
         url.hash !== '' ||
-        url.href !== value;
+        url.href !== value);
 }
 export function sameOriginUrl(value, field, origin, protocols = ['https:', 'http:']) {
     if (typeof value !== 'string' || /[\u0000-\u0020\u007f]|\s/u.test(value)) {
@@ -67,26 +67,3 @@ export function sameOriginUrl(value, field, origin, protocols = ['https:', 'http
     }
     return url.href;
 }
-export function parseCredentialInstall(value) {
-    if (value === undefined || value === null)
-        return null;
-    const extension = closedRecord(value, 'extensions.credential_install', [
-        'kind',
-        'install',
-        'max_body_bytes',
-    ]);
-    exact(extension.kind, 'openengine.capsule-credential-install/v1', 'extensions.credential_install.kind');
-    const install = closedRecord(extension.install, 'extensions.credential_install.install', [
-        'route_template',
-        'method',
-    ]);
-    exact(install.method, 'PUT', 'extensions.credential_install.install.method');
-    return Object.freeze({
-        kind: 'openengine.capsule-credential-install/v1',
-        install: Object.freeze({
-            routeTemplate: routeTemplate(install.route_template, 'extensions.credential_install.install.route_template', ['capsule_id']),
-            method: 'PUT',
-        }),
-        maxBodyBytes: integer(extension.max_body_bytes, 'extensions.credential_install.max_body_bytes', 1, 4 * 1024 * 1024),
-    });
-}

package/lib/target/discovery.cjs

@@ -67,7 +67,6 @@ function parseDiscoveryDocument(discovery, origin) {
         capsule,
         transport,
         capabilityFlags,
-        credentialInstall: extensions.credentialInstall,
         runIntent: extensions.runIntent,
         additional,
     });

package/lib/target/discovery.d.cts

@@ -1,8 +1,6 @@
 import type { HttpTransport } from './device-flow.js';
 import type { RouteTemplate } from './route-template.js';
-import { type CredentialInstallDescriptor } from './discovery-validation.js';
 import type { RunIntentDescriptor } from './run-intent-discovery.js';
-export type { CredentialInstallDescriptor } from './discovery-validation.js';
 export type { RunIntentDescriptor } from './run-intent-discovery.js';
 export { TargetDiscoveryError } from './discovery-errors.js';
 export { expandRoute, type RouteTemplate } from './route-template.js';
@@ -57,7 +55,6 @@ export interface TargetDiscoveryDescriptor {
         };
     };
     readonly capabilityFlags: readonly string[];
-    readonly credentialInstall: CredentialInstallDescriptor | null;
     readonly runIntent: RunIntentDescriptor | null;
     readonly additional: Readonly<Record<string, unknown>>;
 }

package/lib/target/discovery.d.mts

@@ -1,8 +1,6 @@
 import type { HttpTransport } from './device-flow.js';
 import type { RouteTemplate } from './route-template.js';
-import { type CredentialInstallDescriptor } from './discovery-validation.js';
 import type { RunIntentDescriptor } from './run-intent-discovery.js';
-export type { CredentialInstallDescriptor } from './discovery-validation.js';
 export type { RunIntentDescriptor } from './run-intent-discovery.js';
 export { TargetDiscoveryError } from './discovery-errors.js';
 export { expandRoute, type RouteTemplate } from './route-template.js';
@@ -57,7 +55,6 @@ export interface TargetDiscoveryDescriptor {
         };
     };
     readonly capabilityFlags: readonly string[];
-    readonly credentialInstall: CredentialInstallDescriptor | null;
     readonly runIntent: RunIntentDescriptor | null;
     readonly additional: Readonly<Record<string, unknown>>;
 }

package/lib/target/discovery.d.ts

@@ -1,8 +1,6 @@
 import type { HttpTransport } from './device-flow.js';
 import type { RouteTemplate } from './route-template.js';
-import { type CredentialInstallDescriptor } from './discovery-validation.js';
 import type { RunIntentDescriptor } from './run-intent-discovery.js';
-export type { CredentialInstallDescriptor } from './discovery-validation.js';
 export type { RunIntentDescriptor } from './run-intent-discovery.js';
 export { TargetDiscoveryError } from './discovery-errors.js';
 export { expandRoute, type RouteTemplate } from './route-template.js';
@@ -57,7 +55,6 @@ export interface TargetDiscoveryDescriptor {
         };
     };
     readonly capabilityFlags: readonly string[];
-    readonly credentialInstall: CredentialInstallDescriptor | null;
     readonly runIntent: RunIntentDescriptor | null;
     readonly additional: Readonly<Record<string, unknown>>;
 }

package/lib/target/discovery.js

@@ -67,7 +67,6 @@ function parseDiscoveryDocument(discovery, origin) {
         capsule,
         transport,
         capabilityFlags,
-        credentialInstall: extensions.credentialInstall,
         runIntent: extensions.runIntent,
         additional,
     });

package/lib/target/discovery.mjs

@@ -1,6 +1,6 @@
 import { readBoundedResponseJson } from './bounded-response.mjs';
 import { TargetDiscoveryError } from './discovery-errors.mjs';
-import { exact, exactStringSet, record, } from './discovery-validation.mjs';
+import { exact, exactStringSet, record } from './discovery-validation.mjs';
 import { parseAdapter, parseCapsule, parseEndpoint, parseExtensions, parseOAuth, parseSession, parseSizes, parseTransport, validateOAuthMetadata, } from './discovery-sections.mjs';
 export { TargetDiscoveryError } from './discovery-errors.mjs';
 export { expandRoute } from './route-template.mjs';
@@ -60,7 +60,6 @@ function parseDiscoveryDocument(discovery, origin) {
         capsule,
         transport,
         capabilityFlags,
-        credentialInstall: extensions.credentialInstall,
         runIntent: extensions.runIntent,
         additional,
     });

package/lib/target/index.d.ts

@@ -3,4 +3,4 @@ export { acquireTargetLock } from './credential-lock.js';
 export { requestDeviceCode, pollForToken, parseTokenResponse, DeviceFlowDeniedError, DeviceFlowExpiredError, UnboundSessionError, type DeviceCodeResponse, type DeviceExchangeContext, type TokenResponse, type HttpTransport, type Clock, } from './device-flow.js';
 export { addTarget, removeTarget, getTarget, listTargets, updateTargetOrganization, validateTargetName, normalizeAndValidateUrl, TargetNameInvalidError, TargetNameExistsError, TargetNotFoundError, TargetUrlInvalidError, type TargetRecord, type SettingsPort, } from './target-registry.js';
 export { TargetSessionManager, LoginRequiredError, type BrowserOpener, type TargetSessionDeps, type TargetSessionManagerInit, } from './target-session.js';
-export { discoverTarget, discoverTargetSessionEndpoints, expandRoute, TargetDiscoveryError, type CredentialInstallDescriptor, type RunIntentDescriptor, type RouteTemplate, type TargetDiscoveryDescriptor, type TargetSessionEndpoints, } from './discovery.js';
+export { discoverTarget, discoverTargetSessionEndpoints, expandRoute, TargetDiscoveryError, type RunIntentDescriptor, type RouteTemplate, type TargetDiscoveryDescriptor, type TargetSessionEndpoints, } from './discovery.js';

package/lib/target/run-intent-discovery.cjs

@@ -6,12 +6,14 @@ const discovery_validation_js_1 = require("./discovery-validation.cjs");
 function parseRunIntent(value, origin) {
     if (value === undefined || value === null)
         return null;
+    const advertised = (0, discovery_validation_js_1.record)(value, 'extensions.run_intent');
+    if (advertised.kind !== 'zeroshot.run-intent/v2')
+        return null;
     const extension = (0, discovery_validation_js_1.closedRecord)(value, 'extensions.run_intent', [
         'kind',
         'base_url',
         'route_templates',
     ]);
-    (0, discovery_validation_js_1.exact)(extension.kind, 'zeroshot.run-intent/v2', 'extensions.run_intent.kind');
     const routes = (0, discovery_validation_js_1.closedRecord)(extension.route_templates, 'extensions.run_intent.route_templates', [
         'submit',
         'status',

package/lib/target/run-intent-discovery.js

@@ -6,12 +6,14 @@ const discovery_validation_js_1 = require("./discovery-validation.js");
 function parseRunIntent(value, origin) {
     if (value === undefined || value === null)
         return null;
+    const advertised = (0, discovery_validation_js_1.record)(value, 'extensions.run_intent');
+    if (advertised.kind !== 'zeroshot.run-intent/v2')
+        return null;
     const extension = (0, discovery_validation_js_1.closedRecord)(value, 'extensions.run_intent', [
         'kind',
         'base_url',
         'route_templates',
     ]);
-    (0, discovery_validation_js_1.exact)(extension.kind, 'zeroshot.run-intent/v2', 'extensions.run_intent.kind');
     const routes = (0, discovery_validation_js_1.closedRecord)(extension.route_templates, 'extensions.run_intent.route_templates', [
         'submit',
         'status',

package/lib/target/run-intent-discovery.mjs

@@ -1,14 +1,16 @@
 import { routeTemplate } from './route-template.mjs';
-import { closedRecord, exact, sameOriginUrl } from './discovery-validation.mjs';
+import { closedRecord, record, sameOriginUrl } from './discovery-validation.mjs';
 export function parseRunIntent(value, origin) {
     if (value === undefined || value === null)
         return null;
+    const advertised = record(value, 'extensions.run_intent');
+    if (advertised.kind !== 'zeroshot.run-intent/v2')
+        return null;
     const extension = closedRecord(value, 'extensions.run_intent', [
         'kind',
         'base_url',
         'route_templates',
     ]);
-    exact(extension.kind, 'zeroshot.run-intent/v2', 'extensions.run_intent.kind');
     const routes = closedRecord(extension.route_templates, 'extensions.run_intent.route_templates', [
         'submit',
         'status',

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.35.3",
+  "version": "6.37.0",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@the-open-engine/zeroshot",
-      "version": "6.35.3",
+      "version": "6.37.0",
       "hasInstallScript": true,
       "license": "MIT",
       "dependencies": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@the-open-engine/zeroshot",
-  "version": "6.35.3",
+  "version": "6.37.0",
   "description": "Independent executor–verifier orchestration for software changes.",
   "main": "src/orchestrator.js",
   "bin": {

package/src/agent/agent-lifecycle.js

@@ -17,7 +17,7 @@ const { executeHook } = require('./agent-hook-executor');
 const IsolationManager = require('../isolation-manager');
 const crypto = require('crypto');
 const { bufferMessage, scheduleDrain, drainBufferedMessages } = require('../message-buffer');
-const { isPlatformSupported } = require('./agent-stuck-detector');
+const { createLivenessPoll } = require('./agent-liveness-poll');
 const { normalizeProviderName, getDefaultProviderId } = require('../../lib/provider-names');
 const { loadSettings } = require('../../lib/settings');
 const { findPlatformMismatchReason } = require('./validation-platform');
@@ -223,7 +223,7 @@ async function stop(agent) {
   stopLivenessCheck(agent);
 
   const hasNestedExecutions = agent.nestedExecutions?.hasActive === true;
-  if (!agent.running && !agent.currentTask && !hasNestedExecutions) {
+  if (!agent.running && !agent.currentTask && !hasNestedExecutions && !agent._currentExecution) {
     return;
   }
 
@@ -242,26 +242,26 @@ async function stop(agent) {
       throw new Error(`Task shutdown could not confirm termination: ${termination.reason}`);
     }
   }
-
-  // Wait for in-flight execution to complete (up to 5 seconds)
-  // This prevents write-after-close race conditions
-  if (agent._currentExecution) {
+  const currentExecution = agent._currentExecution;
+  if (currentExecution) {
     let executionTimeout = null;
     try {
-      await Promise.race([
-        agent._currentExecution,
+      const outcome = await Promise.race([
+        Promise.resolve(currentExecution).then(
+          () => 'settled',
+          () => 'settled'
+        ),
         new Promise((resolve) => {
-          executionTimeout = setTimeout(resolve, 5000);
+          executionTimeout = setTimeout(() => resolve('timeout'), 5000);
         }),
       ]);
-    } catch {
-      // Ignore errors from cancelled execution
-    } finally {
-      if (executionTimeout) {
-        clearTimeout(executionTimeout);
+      if (outcome === 'timeout') {
+        throw new Error(`Agent ${agent.id} execution did not settle after task termination`);
       }
-      agent._currentExecution = null;
+    } finally {
+      if (executionTimeout) clearTimeout(executionTimeout);
     }
+    if (agent._currentExecution === currentExecution) agent._currentExecution = null;
   }
 
   agent._log(`Agent ${agent.id} stopped`);
@@ -1268,67 +1268,16 @@ function startLivenessCheck(agent) {
   agent.livenessTerminationAttempts = 0;
   agent.livenessTerminationRetryAt = 0;
 
-  agent.livenessCheckInterval = setInterval(() => {
-    const hasRecoverableTask =
-      Boolean(agent.currentTask) ||
-      Boolean(agent.isolation?.enabled && agent.currentTaskId) ||
-      agent.nestedExecutions?.hasActive === true;
-    if (!hasRecoverableTask || agent.livenessTerminationStarted) {
-      return;
-    }
-
-    const now = Date.now();
-    if (agent.livenessTerminationContext) {
-      if (now >= agent.livenessTerminationRetryAt) {
-        attemptLivenessTermination(agent, settings);
-      }
-      return;
-    }
-
-    const taskStartedAt = agent.taskStartedAt || agent.lastOutputTime || now;
-    const lastOutputTime = agent.lastOutputTime || taskStartedAt;
-    const taskRuntime = now - taskStartedAt;
-    const timeSinceLastOutput = now - lastOutputTime;
-
-    if (configuredTimeout && taskRuntime >= configuredTimeout) {
-      const reason = `Task timed out after ${configuredTimeout}ms`;
-      beginLivenessTermination(agent, settings, reason, 'AGENT_TASK_TIMEOUT', {
-        taskId: agent.currentTaskId,
-        taskRuntime,
-        timeout: configuredTimeout,
-      });
-      return;
-    }
-
-    if (timeSinceLastOutput < staleDuration) {
-      agent.consecutiveStaleWarnings = 0;
-      return;
-    }
-
-    agent.consecutiveStaleWarnings += 1;
-    agent._publishLifecycle('AGENT_STALE_WARNING', {
-      taskId: agent.currentTaskId,
-      timeSinceLastOutput,
-      staleDuration,
-      lastOutputTime,
-      consecutiveWarnings: agent.consecutiveStaleWarnings,
-      warningsBeforeKill,
-      processDiagnosticsAvailable: isPlatformSupported(),
-      analysis: `Provider produced no output for ${timeSinceLastOutput}ms`,
-    });
-
-    if (agent.consecutiveStaleWarnings < warningsBeforeKill) {
-      return;
-    }
-
-    const reason = `Provider produced no output for ${timeSinceLastOutput}ms`;
-    beginLivenessTermination(agent, settings, reason, 'PROVIDER_INACTIVITY_TIMEOUT', {
-      taskId: agent.currentTaskId,
-      timeSinceLastOutput,
-      staleDuration,
-      consecutiveWarnings: agent.consecutiveStaleWarnings,
-    });
-  }, checkIntervalMs);
+  const poll = createLivenessPoll({
+    agent,
+    settings,
+    configuredTimeout,
+    staleDuration,
+    warningsBeforeKill,
+    attemptTermination: attemptLivenessTermination,
+    beginTermination: beginLivenessTermination,
+  });
+  agent.livenessCheckInterval = setInterval(poll, checkIntervalMs);
 }
 
 const MAX_LIVENESS_TERMINATION_ATTEMPTS = 3;