@tokenfactory/acc-runner 0.25.1 → 0.27.0

package/dist/watch.js

@@ -1,1532 +0,0 @@
-/**
- * `acc-runner watch` — long-running command. Subscribes to broadcast
- * tasks, dispatches them concurrently (v0.10+), heartbeats every 4s.
- * v0.2.5 refreshes the access token on startup + every 30 min, and exits
- * loudly after 5 consecutive heartbeat failures.
- *
- * v0.3 adds a 30s polling fallback: if a Realtime broadcast is dropped
- * during a reconnect, the next poll pass picks the task up via the
- * `acc.list_assigned_queued_tasks` RPC. A `seen` set keeps the poll
- * and the broadcast from fighting over the same task_id.
- *
- * v0.6.2 (v0.12-REVIEW-LOCAL) listens for `review_assigned` on the same
- * `runner:<id>` channel and dispatches to runtime/reviewer.ts. Reviews
- * are independently tracked (separate `seenReviews` set).
- *
- * v0.10 (T-49-2): concurrent task dispatch. pump() now launches up to
- * `concurrencyLimit` (default 2) tasks simultaneously. Each task runs in
- * its own isolated git worktree so concurrent tasks never share files.
- * `createTaskAsAdmin` in api/_lib/supabase-admin.ts is the sanctioned
- * Manager seed path that feeds this dispatch loop.
- *
- * v0.12.0 (T-52-7): ephemeral-runner support. Sessions load through the
- * token-provider abstraction (keychain by default — byte-identical desktop
- * behaviour; ACC_RUNNER_TOKEN_MODE=env for containers). Env-token runners
- * register an acc-eph-<random> identity on boot, and ACC_RUNNER_IDLE_TTL_MIN
- * arms a clean self-termination after n minutes without work.
- */
-import chalk from "chalk";
-import { loadConfig } from "./config.js";
-import { getTokenProvider } from "./token-provider.js";
-import { machineIdentity, detectInstalledModels, RUNNER_CAPS } from "./login.js";
-import { createRunnerClient } from "./supabase.js";
-import { runTask } from "./task-runner.js";
-import { runReview, } from "./runtime/reviewer.js";
-import { getQuarantine, setQuarantine, } from "./runtime/quarantine.js";
-import { acquireSingletonLock, SingletonLockHeldError, } from "./runtime/singleton.js";
-import { getClaudeVersion, recordTaskClaudeVersion, } from "./runtime/version-drift.js";
-import { postRunnerStateMessage } from "./messaging.js";
-import { checkVersion, compareSemver } from "./version-check.js";
-import { PROTOCOL_VERSION } from "./types.js";
-import { PACKAGE_VERSION } from "./pkg-version.js";
-import { resolveAuthMode, describeAuthMode, authPrecedenceHint } from "./anthropic-auth.js";
-export class RefreshReuseDetectedError extends Error {
-    constructor(message) {
-        super(message);
-        this.name = "RefreshReuseDetectedError";
-    }
-}
-const ONE_HOUR_MS = 60 * 60 * 1000;
-const REFRESH_CHECK_MS = 30 * 60 * 1000;
-// v0.12.0 (T-52-7): idle-TTL check cadence ceiling. The actual cadence is
-// min(IDLE_CHECK_MS, ttl) so a tiny test TTL still gets checked in time.
-const IDLE_CHECK_MS = 30_000;
-const HEARTBEAT_REFRESH_AFTER = 3;
-const HEARTBEAT_EXIT_AFTER = 5;
-const POLL_INTERVAL_MS = 30_000;
-// v0.30-B: widen the startup `pollSince` watermark so a task dispatched in
-// the minutes before `watch` started is still caught by the first poll.
-// The 30s window the previous code used was tighter than the gap between
-// dispatch and runner restart in real operator workflows.
-const STARTUP_POLL_LOOKBACK_MS = 5 * 60 * 1000;
-// v0.62 (T-62-1): cadence of the periodic full claim scan — the realtime-miss
-// safety net. The delta-poll's forward-only watermark can permanently skip a
-// task assigned with an `updated_at` at/behind the watermark whose realtime
-// `task_assigned` push was dropped (stale subscription). This full scan
-// (epoch watermark, every assigned+queued task for this runner) re-claims any
-// such task within one interval, so an alive-but-wedged runner self-recovers
-// instead of needing a manual restart. Knob: `claim_scan_interval_ms`.
-const DEFAULT_CLAIM_SCAN_INTERVAL_MS = 3 * 60 * 1000;
-// v0.73 (T-73-2, G-M): claim-loop watchdog. A task can sit assigned+queued for
-// this runner (acc.tasks.runner_id = me, status='queued') while the runner
-// heartbeats fine but never claims it — the channel looks healthy (so T-68-1's
-// auto-recovery never fires) but the claim path is wedged. CLAIM_WATCHDOG_STALE_MS
-// is how long a task may stay assigned-but-unclaimed (with a live heartbeat)
-// before the watchdog treats the claim path as wedged and forces the same
-// recovery a terminal channel status does. Default 90s — comfortably under the
-// server's 300s rescue grace, so we self-heal before the rescue churns rather
-// than waiting for a manual `pkill acc-runner watch`. CLAIM_WATCHDOG_CHECK_MS is
-// how often the watchdog re-evaluates; well under the threshold so detection +
-// recovery land inside the grace window. Knobs: tests override both for speed.
-const DEFAULT_CLAIM_WATCHDOG_STALE_MS = 90_000;
-const DEFAULT_CLAIM_WATCHDOG_CHECK_MS = 30_000;
-// v0.56 (T-56-1): capacity-aware pause. When claude reports a session/usage
-// limit (api_error_status 429) the runner pauses claiming tasks AND reviews
-// until the stated reset time. When no reset time is parseable, fall back to
-// this fixed backoff. Resume fires at the target + a small random jitter so a
-// fleet that all hit the limit on the same broadcast doesn't thunder back in
-// lockstep the instant the window reopens.
-const DEFAULT_CAPACITY_BACKOFF_MS = 30 * 60 * 1000;
-const DEFAULT_RESUME_JITTER_MS = 15_000;
-/**
- * v0.6.0: exponential backoff between heartbeat attempts when the
- * previous one failed. The dogfood loop fired a heartbeat every 4s
- * even when the network was wedged, producing a wall of "fetch failed"
- * stderr noise and reaching the EXIT_AFTER cap in 20s. Spreading
- * attempts out gives flaky links time to recover before we tear down
- * the watch process.
- */
-const HEARTBEAT_BACKOFF_MS = [4_000, 8_000, 16_000, 32_000, 60_000];
-/**
- * v0.6.0: classify the heartbeat RPC error so we (a) emit a useful
- * stderr line for the operator and (b) only attempt a JWT refresh
- * when the failure shape actually implies an auth problem. Refreshing
- * on a transient network blip just burns the refresh-token rotation
- * chain and surfaces a confusing "refresh failed" line on top of the
- * real underlying network error.
- */
-export function classifyHeartbeatError(err) {
-    if (!err)
-        return "unknown";
-    const msg = (err.message ?? "").toLowerCase();
-    const code = (err.code ?? "").toLowerCase();
-    if (code === "pgrst301" ||
-        code === "401" ||
-        code === "403" ||
-        msg.includes("jwt") ||
-        msg.includes("invalid token") ||
-        msg.includes("token has expired") ||
-        msg.includes("unauthorized") ||
-        msg.includes("forbidden")) {
-        return "auth";
-    }
-    if (msg.includes("enotfound") || msg.includes("getaddrinfo") || msg.includes("eai_again")) {
-        return "dns";
-    }
-    if (msg.includes("econnreset") || msg.includes("connection reset")) {
-        return "reset";
-    }
-    if (msg.includes("certificate") ||
-        msg.includes("self-signed") ||
-        msg.includes("self signed") ||
-        msg.includes("tls") ||
-        msg.includes("ssl")) {
-        return "tls";
-    }
-    if (msg.includes("etimedout") || msg.includes("timeout")) {
-        return "timeout";
-    }
-    if (msg.includes("fetch failed") ||
-        msg.includes("econnrefused") ||
-        msg.includes("network") ||
-        msg.includes("socket hang up")) {
-        return "network";
-    }
-    return "unknown";
-}
-/** Pick the next inter-heartbeat delay from the backoff ladder. Caller
- *  passes the number of consecutive failures (1 → first retry). The
- *  return is at least baseMs so a tighter operator-configured cadence
- *  is never slowed by the backoff scheme. */
-export function nextHeartbeatDelayMs(consecutiveFailures, baseMs) {
-    if (consecutiveFailures <= 0)
-        return baseMs;
-    const idx = Math.min(consecutiveFailures - 1, HEARTBEAT_BACKOFF_MS.length - 1);
-    return Math.max(baseMs, HEARTBEAT_BACKOFF_MS[idx]);
-}
-/**
- * v0.12.0 (T-52-7): resolve ACC_RUNNER_IDLE_TTL_MIN into ms. Returns null
- * (TTL disabled) when unset; warns and returns null on junk so a typo'd
- * env never strands a container in "never exits" mode silently.
- */
-export function resolveIdleTtlMs(env = process.env) {
-    const raw = env.ACC_RUNNER_IDLE_TTL_MIN?.trim();
-    if (!raw)
-        return null;
-    const minutes = Number(raw);
-    if (!Number.isFinite(minutes) || minutes <= 0) {
-        process.stderr.write(`[acc-runner] ACC_RUNNER_IDLE_TTL_MIN=${JSON.stringify(raw)} is not a positive number; idle TTL disabled\n`);
-        return null;
-    }
-    return minutes * 60_000;
-}
-/** v0.12.0 (T-52-7): record work-related activity for the idle TTL clock. */
-function touchActivity(state) {
-    state.lastActivityMs = Date.now();
-}
-function expiresSoon(session, leadMs = ONE_HOUR_MS) {
-    const expires = Date.parse(session.access_expires_at);
-    if (!Number.isFinite(expires))
-        return true;
-    return expires < Date.now() + leadMs;
-}
-async function refreshAccessToken(cfg, session) {
-    const res = await fetch(`${cfg.publicUrl.replace(/\/+$/, "")}/api/runner/refresh`, {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/json",
-            "User-Agent": `acc-runner/${PROTOCOL_VERSION}`,
-        },
-        body: JSON.stringify({ refresh_token: session.refresh_token }),
-    });
-    if (res.status === 401) {
-        const body = (await res.json().catch(() => ({})));
-        if (body.error === "refresh_reuse_detected") {
-            throw new RefreshReuseDetectedError(body.hint ??
-                "refresh token reuse detected; keychain may be compromised. Run `acc-runner login` from a trusted machine.");
-        }
-        throw new Error(body.hint ?? "refresh token expired; run `acc-runner login`");
-    }
-    if (!res.ok) {
-        throw new Error(`refresh failed: ${res.status} ${await res.text()}`);
-    }
-    const body = (await res.json());
-    return {
-        ...session,
-        access_token: body.access_token,
-        access_expires_at: new Date(body.expires_at * 1000).toISOString(),
-        // v0.4-E: server rotates on every refresh. Persist the new refresh token
-        // so the next call doesn't replay the old one (which would now look like
-        // reuse and trip the chain-revocation path).
-        refresh_token: body.refresh_token ?? session.refresh_token,
-    };
-}
-// Centralised handler for the reuse-detected case. Loud red banner so the
-// operator notices immediately, then exit(1) — there's no safe recovery
-// from the watch loop, the keychain has to be reset by `acc-runner login`.
-function failOnReuse(err) {
-    process.stderr.write(chalk.red.bold("\n[acc-runner] CRITICAL: refresh-token reuse detected.\n"));
-    process.stderr.write(chalk.red(`${err.message}\n`));
-    process.stderr.write(chalk.red("If this machine is the legitimate owner, an attacker may have rotated your tokens.\n" +
-        "Rotate any other credentials that were on this box and run `acc-runner login` from a trusted machine.\n"));
-    process.exit(1);
-}
-// Single source of truth for "this task is new — push it into the runner
-// queue". Both the Realtime listener and the polling loop go through here.
-function enqueue(state, taskId, factory) {
-    if (state.seen.has(taskId))
-        return false;
-    // v0.10 T-49-2: check the running Map (replaces v0.9 state.current check).
-    if (state.running.has(taskId)) {
-        state.seen.add(taskId);
-        return false;
-    }
-    state.seen.add(taskId);
-    state.queue.push(taskId);
-    touchActivity(state);
-    void pump(state, factory);
-    return true;
-}
-// Single source of truth for "this review is new — push it into the review
-// queue". The Realtime listener AND the periodic review scan (v0.65 T-65-2)
-// both go through here; the shared `seenReviews` guard dedupes a review that
-// arrives on both paths. Returns true only when the review was actually
-// enqueued (new + well-formed), so the scan can count what it recovered.
-function enqueueReview(state, payload) {
-    const p = payload;
-    if (!p?.review_id || !p?.task_id || !p?.pr_number)
-        return false;
-    if (state.seenReviews.has(p.review_id))
-        return false;
-    state.seenReviews.add(p.review_id);
-    state.reviewQueue.push({
-        review_id: p.review_id,
-        task_id: p.task_id,
-        pr_number: p.pr_number,
-    });
-    touchActivity(state);
-    void pumpReviews(state);
-    return true;
-}
-function subscribeChannel(state, taskRunnerFactory) {
-    state.channel = state.supabase
-        .channel(`runner:${state.session.runner_id}`, {
-        config: { broadcast: { ack: false, self: false } },
-    })
-        .on("broadcast", { event: "task_assigned" }, ({ payload }) => {
-        const taskId = payload?.task_id;
-        if (taskId)
-            enqueue(state, taskId, taskRunnerFactory);
-    })
-        .on("broadcast", { event: "task_cancelled" }, ({ payload }) => {
-        const taskId = payload?.task_id;
-        if (!taskId)
-            return;
-        // v0.10 T-49-2: cancel from the running Map; fall back to queue removal.
-        const ctrl = state.running.get(taskId);
-        if (ctrl) {
-            ctrl.cancel();
-        }
-        else {
-            state.queue = state.queue.filter((t) => t !== taskId);
-        }
-        // Drop from seen so a re-queue (cancel → re-start) is honored on
-        // the next broadcast or poll.
-        state.seen.delete(taskId);
-    })
-        .on("broadcast", { event: "review_assigned" }, ({ payload }) => {
-        enqueueReview(state, payload);
-    })
-        .subscribe((status) => {
-        if (status === "SUBSCRIBED") {
-            // v0.68 (T-68-1): healthy subscribe — reset the resubscribe backoff.
-            state.resubscribeAttempts = 0;
-            console.log(chalk.green(`✓ Listening on runner:${state.session.runner_id}`));
-        }
-        else if (status === "CHANNEL_ERROR" ||
-            status === "TIMED_OUT" ||
-            status === "CLOSED") {
-            // v0.68 (T-68-1): the realtime channel dropped. Previously unhandled —
-            // which left the runner silently deaf to task_assigned / review_assigned
-            // broadcasts until token expiry or a manual restart (the stale-
-            // subscription root cause behind the repeated "task stuck in queued →
-            // swept to blocked" incidents). Recover it.
-            if (!state.stopped)
-                scheduleResubscribe(state, taskRunnerFactory, status);
-        }
-    });
-}
-// v0.68 (T-68-1): single-flight, backed-off recovery of a dropped realtime
-// channel. Like doRefresh's remove+resubscribe, but WITHOUT a token rotation
-// (the token is still valid; only the channel died) and driven by channel
-// status rather than token expiry. Backoff 1s→30s, reset to 0 on a healthy
-// SUBSCRIBED. After a fresh subscribe we run the poll + claim/review scans so
-// anything the dead channel missed is recovered at once rather than waiting
-// for the periodic 3-min scans.
-function scheduleResubscribe(state, factory, status) {
-    if (state.stopped || state.resubscribing || state.resubscribeTimer)
-        return;
-    const delay = Math.min(30_000, 1_000 * 2 ** Math.min(state.resubscribeAttempts, 5));
-    process.stderr.write(`[acc-runner] realtime channel ${status}; resubscribing in ${delay}ms ` +
-        `(attempt ${state.resubscribeAttempts + 1})\n`);
-    state.resubscribeTimer = setTimeout(() => {
-        state.resubscribeTimer = null;
-        void resubscribeChannel(state, factory);
-    }, delay);
-    if (state.resubscribeTimer.unref)
-        state.resubscribeTimer.unref();
-}
-export async function resubscribeChannel(state, factory) {
-    if (state.stopped || state.resubscribing)
-        return;
-    state.resubscribing = true;
-    state.resubscribeAttempts += 1;
-    try {
-        try {
-            await state.supabase.removeChannel(state.channel);
-        }
-        catch {
-            /* channel may already be torn down */
-        }
-        subscribeChannel(state, factory);
-        // Recover anything the dead channel missed during the gap. Best-effort;
-        // the `seen` / `seenReviews` guards dedupe against a late re-delivery.
-        void pollOnce(state, factory);
-        void claimScan(state, factory, "periodic");
-        void reviewScan(state, "periodic");
-    }
-    finally {
-        state.resubscribing = false;
-    }
-}
-// Single-flight poll. The watermark advances only after a clean response so
-// a transient error doesn't permanently skip rows.
-async function pollOnce(state, factory) {
-    if (state.stopped || state.polling)
-        return;
-    state.polling = true;
-    try {
-        const { data, error } = await state.supabase.rpc("list_assigned_queued_tasks", {
-            p_runner_id: state.session.runner_id,
-            p_since: state.pollSince,
-        });
-        if (error) {
-            process.stderr.write(`[acc-runner] poll failed: ${error.message}\n`);
-            return;
-        }
-        const rows = (data ?? []);
-        let maxSeen = state.pollSince;
-        for (const row of rows) {
-            if (!row?.id)
-                continue;
-            // v0.62 (T-62-1): advance the forward-only watermark ONLY for rows we
-            // actually claimed this pass (enqueue returned true). Previously the
-            // watermark advanced to max(updated_at) over EVERY returned row,
-            // including no-ops (a task already seen/in-flight via realtime or a
-            // prior poll). A high-updated_at no-op could then drag the watermark
-            // past a still-queued task assigned with an older updated_at, so the
-            // next delta-poll (`> watermark`) silently dropped it — only a restart
-            // (one-shot startup scan) recovered it. Advancing solely on real claims
-            // keeps the watermark a conservative "newest task I claimed by polling"
-            // mark and stops the delta-poll losing still-queued work. The periodic
-            // full claim scan (claimScan) is the belt to this braces.
-            const claimed = enqueue(state, row.id, factory);
-            if (claimed && row.updated_at && row.updated_at > maxSeen) {
-                maxSeen = row.updated_at;
-            }
-        }
-        state.pollSince = maxSeen;
-    }
-    finally {
-        state.polling = false;
-    }
-}
-/**
- * v0.62 (T-62-1): full claim scan — lists EVERY assigned+queued task for this
- * runner with an epoch watermark (`1970-…Z`) and enqueues any the in-process
- * `seen` guard hasn't already accounted for. Used two ways:
- *
- *   - once at startup (replaces the v0.34-B inline block), and
- *   - on a periodic timer (`claim_scan_interval_ms`, default 3 min) as the
- *     realtime-miss safety net: a runner that dropped a `task_assigned`
- *     broadcast self-recovers within one interval instead of sitting next to
- *     a free runner until a manual restart.
- *
- * Deliberately does NOT touch `state.pollSince` — the delta-poll keeps its own
- * forward-only watermark. Idempotent: `enqueue`'s shared `seen`/`running`
- * guards mean a task already taken by realtime or the delta-poll is a no-op
- * here, so realtime + delta-poll + scan all seeing the same task still yields
- * exactly one run. Single-flight via `claimScanning` so a slow RPC can't let
- * two scans overlap.
- */
-async function claimScan(state, factory, context) {
-    if (state.stopped || state.claimScanning)
-        return;
-    state.claimScanning = true;
-    try {
-        const { data, error } = await state.supabase.rpc("list_assigned_queued_tasks", {
-            p_runner_id: state.session.runner_id,
-            p_since: "1970-01-01T00:00:00.000Z",
-        });
-        if (error) {
-            process.stderr.write(`[acc-runner] ${context} claim scan failed: ${error.message}\n`);
-            return;
-        }
-        const rows = (data ?? []);
-        let enqueued = 0;
-        for (const row of rows) {
-            if (!row?.id)
-                continue;
-            if (enqueue(state, row.id, factory))
-                enqueued += 1;
-        }
-        if (context === "startup") {
-            console.log(`[acc-runner] startup claim scan: ${rows.length} task(s) found`);
-        }
-        else if (enqueued > 0) {
-            // Only chirp when the safety net actually caught something — a periodic
-            // scan that finds nothing is the steady state and must stay quiet.
-            console.log(`[acc-runner] periodic claim scan recovered ${enqueued} realtime-missed task(s)`);
-        }
-    }
-    catch (err) {
-        process.stderr.write(`[acc-runner] ${context} claim scan failed: ${err.message}\n`);
-    }
-    finally {
-        state.claimScanning = false;
-    }
-}
-/**
- * v0.73 (T-73-2, G-M): claim-loop watchdog — the self-heal for an
- * "assigned-but-unclaimed while heartbeating" strand.
- *
- * SYMPTOM (prod 2026-06-10): a runner heartbeated fine (status online, fresh
- * heartbeat, idle) but never claimed a task the dispatcher had ASSIGNED to it
- * (acc.tasks.runner_id = me, status='queued'). The server rescue sweep
- * re-dispatched every ~6 min but the runner never claimed; only a manual
- * `pkill acc-runner watch && acc-runner watch` cleared it. T-68-1's channel
- * auto-recovery did NOT catch it — the channel looked healthy but the claim
- * path was wedged.
- *
- * Mechanism: each tick lists the runner's own assigned+queued (= unclaimed)
- * tasks via the same `list_assigned_queued_tasks` RPC the claim scan uses, and
- * tracks per task id the first instant it was OBSERVED as
- * assigned-to-me-but-not-claimed. A task that stays unclaimed past
- * `claimWatchdogStaleMs` (default 90s — comfortably under the server's 300s
- * rescue grace) WHILE heartbeats are succeeding means the claim path is wedged:
- * trigger the SAME single-flight recovery a terminal channel status does
- * (resubscribeChannel: removeChannel + subscribeChannel + pollOnce + claimScan
- * + reviewScan), logged as `claim_watchdog_resubscribe`.
- *
- * Reset semantics: a task's observed-stale timer is dropped the moment it
- * leaves the assigned+queued set (claimed → status moved off 'queued', or
- * unassigned → runner_id cleared). A heartbeat failure clears ALL timers — a
- * network/auth outage is a different failure with its own handling, and we must
- * not carry a stale age across it into a false trigger when heartbeats recover.
- *
- * Single-flight: respects the existing resubscribe guard/backoff
- * (`resubscribing` / `resubscribeTimer`) so concurrent staleness can't stack
- * resubscribes, and resets the stale timers on trigger so a recovery that
- * didn't help waits another full threshold before re-firing. Bounded and
- * side-effect-safe: never throws out of the loop.
- */
-async function claimWatchdogScan(state, factory) {
-    if (state.stopped || state.claimWatchdogChecking)
-        return;
-    state.claimWatchdogChecking = true;
-    try {
-        // Only treat "unclaimed" as wedged while heartbeats are healthy. A
-        // heartbeat failure means the network/auth path is down — the claim RPC
-        // would fail too, and the fix there is the heartbeat refresh/exit path, not
-        // a resubscribe. Clear the observed-stale timers so an age never spans an
-        // outage and falsely trips the watchdog the instant heartbeats recover.
-        if (state.heartbeatFailures > 0) {
-            state.claimWatchdogSince.clear();
-            return;
-        }
-        const { data, error } = await state.supabase.rpc("list_assigned_queued_tasks", {
-            p_runner_id: state.session.runner_id,
-            p_since: "1970-01-01T00:00:00.000Z",
-        });
-        if (error) {
-            process.stderr.write(`[acc-runner] claim watchdog scan failed: ${error.message}\n`);
-            return;
-        }
-        const rows = (data ?? []);
-        const now = Date.now();
-        const currentIds = new Set();
-        for (const row of rows) {
-            if (row?.id)
-                currentIds.add(row.id);
-        }
-        // Reset: drop timers for tasks no longer assigned+queued (claimed/unassigned).
-        for (const id of [...state.claimWatchdogSince.keys()]) {
-            if (!currentIds.has(id))
-                state.claimWatchdogSince.delete(id);
-        }
-        // Observe: stamp the first-seen instant for newly assigned-unclaimed tasks;
-        // collect any that have now been stale past the threshold.
-        const stale = [];
-        for (const id of currentIds) {
-            const since = state.claimWatchdogSince.get(id);
-            if (since === undefined) {
-                state.claimWatchdogSince.set(id, now);
-            }
-            else if (now - since >= state.claimWatchdogStaleMs) {
-                stale.push(id);
-            }
-        }
-        if (stale.length === 0)
-            return;
-        // Single-flight: never stack on a resubscribe already in flight or
-        // scheduled (the existing T-68-1 guard/backoff owns the recovery).
-        if (state.resubscribing || state.resubscribeTimer)
-            return;
-        process.stderr.write(`[acc-runner] claim_watchdog_resubscribe: task(s) ${stale.join(", ")} ` +
-            `assigned but unclaimed > ${state.claimWatchdogStaleMs}ms with a live ` +
-            `heartbeat; claim path looks wedged — forcing resubscribe + claim scan.\n`);
-        // Reset the stale timers so a recovery that didn't help waits another full
-        // threshold before re-triggering (backoff alongside the resubscribe guard).
-        for (const id of stale)
-            state.claimWatchdogSince.set(id, now);
-        void (async () => {
-            try {
-                await state.supabase.rpc("log_activity", {
-                    p_verb: "runner.claim_watchdog_resubscribe",
-                    p_target_id: state.session.runner_id,
-                    p_payload: {
-                        task_ids: stale,
-                        stale_ms: state.claimWatchdogStaleMs,
-                        version: PACKAGE_VERSION,
-                    },
-                    p_target_type: "runner",
-                });
-            }
-            catch { /* best-effort breadcrumb */ }
-        })();
-        void resubscribeChannel(state, factory);
-    }
-    catch (err) {
-        process.stderr.write(`[acc-runner] claim watchdog scan failed: ${err.message}\n`);
-    }
-    finally {
-        state.claimWatchdogChecking = false;
-    }
-}
-/**
- * v0.65 (T-65-2): full review scan — the review twin of claimScan. Lists EVERY
- * pending review assigned to this runner with an epoch watermark (`1970-…Z`)
- * via `list_assigned_pending_reviews` and feeds each row into the existing
- * `enqueueReview`, whose shared `seenReviews` guard dedupes a review the
- * realtime `review_assigned` broadcast already delivered. Used two ways:
- *
- *   - once at startup (next to the startup claim scan), and
- *   - on a periodic timer (`review_scan_interval_ms`, default 3 min) as the
- *     realtime-miss safety net: a runner that dropped a `review_assigned`
- *     broadcast recovers the review within one interval instead of letting it
- *     strand in acc.review_queue (PR #544's review stranded 16h last cycle).
- *
- * Idempotent: `enqueueReview`'s `seenReviews` guard means a review already
- * taken by realtime is a no-op here, so realtime + scan both seeing the same
- * review still yields exactly one review run. Single-flight via
- * `reviewScanning` so a slow RPC can't let two scans overlap. Skipped while
- * paused for capacity — matching `pumpReviews`, the runner deliberately holds
- * reviews until its session window reopens.
- */
-async function reviewScan(state, context) {
-    if (state.stopped || state.reviewScanning)
-        return;
-    // v0.56 (T-56-1) parity with pumpReviews: don't claim reviews while paused
-    // for capacity. The scheduled resume re-drives the review pump.
-    if (state.pausedCapacity)
-        return;
-    state.reviewScanning = true;
-    try {
-        const { data, error } = await state.supabase.rpc("list_assigned_pending_reviews", {
-            p_runner_id: state.session.runner_id,
-            p_since: "1970-01-01T00:00:00.000Z",
-        });
-        if (error) {
-            process.stderr.write(`[acc-runner] ${context} review scan failed: ${error.message}\n`);
-            return;
-        }
-        const rows = (data ?? []);
-        let enqueued = 0;
-        for (const row of rows) {
-            if (enqueueReview(state, row))
-                enqueued += 1;
-        }
-        if (context === "startup") {
-            console.log(`[acc-runner] startup review scan: ${rows.length} pending review(s) found`);
-        }
-        else if (enqueued > 0) {
-            // Only chirp when the safety net actually caught something — a periodic
-            // scan that finds nothing is the steady state and must stay quiet.
-            console.log(`[acc-runner] periodic review scan recovered ${enqueued} realtime-missed review(s)`);
-        }
-    }
-    catch (err) {
-        process.stderr.write(`[acc-runner] ${context} review scan failed: ${err.message}\n`);
-    }
-    finally {
-        state.reviewScanning = false;
-    }
-}
-// Single-flight refresh. Recreates the Supabase client (so future RPC +
-// channel auth use the new JWT) and resubscribes the broadcast channel.
-async function doRefresh(state, taskRunnerFactory) {
-    // v0.12.0 (T-52-7): an env-token runner without ACC_RUNNER_REFRESH_TOKEN
-    // cannot rotate. Refusing here (instead of POSTing an empty token) keeps
-    // the failure mode a clear stderr line rather than a server-side 400.
-    if (!state.tokenProvider.canRefresh()) {
-        process.stderr.write("[acc-runner] token refresh unavailable (no refresh token in env); runner will exit when the access token expires\n");
-        return false;
-    }
-    if (state.refreshing)
-        return state.refreshing;
-    state.refreshing = (async () => {
-        try {
-            const updated = await refreshAccessToken(state.cfg, state.session);
-            state.session = updated;
-            await state.tokenProvider.save(updated);
-            try {
-                await state.supabase.removeChannel(state.channel);
-            }
-            catch {
-                /* channel may already be torn down */
-            }
-            state.supabase = createRunnerClient(state.cfg, state.session.access_token);
-            subscribeChannel(state, taskRunnerFactory);
-            return true;
-        }
-        catch (err) {
-            if (err instanceof RefreshReuseDetectedError)
-                failOnReuse(err);
-            process.stderr.write(`[acc-runner] refresh failed: ${err.message}\n`);
-            return false;
-        }
-        finally {
-            state.refreshing = null;
-        }
-    })();
-    return state.refreshing;
-}
-export async function watchCommand(options = {}) {
-    const cfg = loadConfig();
-    const exitFn = options.exit ?? ((code) => process.exit(code));
-    // v0.14.0 (T-54-2, GA-3): single-instance guard. Acquired BEFORE the
-    // session load + realtime connection so a duplicate exits immediately,
-    // before it can race the holder on worktree locks or git refs. A second
-    // runner for the same repo path is a hard error; a stale lock from a dead
-    // pid self-reclaims inside acquireSingletonLock.
-    const enforceSingleton = options.enforceSingleton ?? !options.taskRunnerFactory;
-    let singletonLock = null;
-    if (enforceSingleton) {
-        try {
-            singletonLock = await acquireSingletonLock(cfg.repoPath);
-        }
-        catch (err) {
-            if (err instanceof SingletonLockHeldError) {
-                process.stderr.write(chalk.red.bold("\n[acc-runner] ANOTHER RUNNER IS ALREADY ACTIVE.\n"));
-                process.stderr.write(chalk.red(`Repo path ${err.holder.repoPath} is served by pid ${err.holder.pid} ` +
-                    `(acc-runner v${err.holder.version}, since ${err.holder.acquiredAt}).\n` +
-                    "Refusing to start a second runner for the same repo — concurrent " +
-                    "runners corrupt worktrees and race git refs.\n"));
-                process.stderr.write(chalk.gray(`To stop the other runner:  kill ${err.holder.pid}\n` +
-                    `If it is already dead, remove ${err.lockFile} (or just retry — ` +
-                    "stale locks self-reclaim).\n"));
-                exitFn(1);
-                // exitFn is process.exit in production (never returns); in tests it
-                // is a stub, so re-throw to halt watchCommand cleanly.
-                throw err;
-            }
-            throw err;
-        }
-    }
-    const tokenProvider = getTokenProvider();
-    let session = await tokenProvider.load();
-    if (!session) {
-        process.stderr.write(tokenProvider.mode === "env"
-            ? "No session in env. Set ACC_RUNNER_ACCESS_TOKEN (token mode: env).\n"
-            : "Not logged in. Run `acc-runner login`.\n");
-        process.exit(1);
-    }
-    const v = await checkVersion(cfg.publicUrl);
-    if (!v.ok && v.reason === "outdated") {
-        throw new Error(`acc-runner is below the server's minimum version (${v.serverMin}). Run \`pnpm add -g @tokenfactory/acc-runner@latest\`.`);
-    }
-    // v0.31-B: warn when running behind current_version (above min but stale).
-    // Launchd daemon often runs an old binary silently; this surfaces it at
-    // startup before the first heartbeat so the operator can update promptly.
-    if (v.ok && v.serverCurrent && compareSemver(PACKAGE_VERSION, v.serverCurrent) < 0) {
-        process.stderr.write(`[acc-runner] WARNING: running v${PACKAGE_VERSION}, server current is v${v.serverCurrent}. ` +
-            `Run \`npm install -g @tokenfactory/acc-runner@latest\` then reload launchd.\n`);
-    }
-    // v0.74-B: surface how spawned claude sessions will authenticate. api-key
-    // (ANTHROPIC_API_KEY set) bills against the API account with no per-session
-    // cap; interactive-session falls back to the operator's OAuth login, which
-    // hits 429 session caps during long autonomous runs.
-    const authMode = resolveAuthMode();
-    console.log(chalk.gray(`Anthropic auth: ${describeAuthMode(authMode)}`));
-    // v0.76-A (GA-11): surface the API-key-vs-claude.ai-login precedence hint so
-    // a 429-on-a-key-configured-runner is diagnosable from the banner.
-    const authHint = authPrecedenceHint();
-    if (authHint)
-        console.log(chalk.gray(`Anthropic auth: ${authHint}`));
-    // Startup refresh: if the access token expires in less than an hour,
-    // grab a fresh one before opening the realtime connection.
-    // v0.12.0 (T-52-7): skipped when the provider has no refresh token —
-    // an env-token runner just runs out its 8h access token (the idle TTL
-    // normally exits it long before then).
-    if (tokenProvider.canRefresh() && expiresSoon(session)) {
-        try {
-            session = await refreshAccessToken(cfg, session);
-            await tokenProvider.save(session);
-        }
-        catch (err) {
-            if (err instanceof RefreshReuseDetectedError)
-                failOnReuse(err);
-            process.stderr.write(`Refresh failed; run \`acc-runner login\`. (${err.message})\n`);
-            process.exit(1);
-        }
-    }
-    // v0.12.0 (T-52-7): env-token (ephemeral) runners had no `login` flow, so
-    // nothing registered an acc.runners row yet. Register on boot under the
-    // acc-eph-<random> identity. register_runner may resolve to an existing
-    // row (same bound user + machine, e.g. a restarted container with a
-    // pinned hostname) — adopt whatever id it returns so the realtime
-    // channel, heartbeats, and polling all agree.
-    if (tokenProvider.mode === "env") {
-        const boot = createRunnerClient(cfg, session.access_token);
-        const models = await detectInstalledModels();
-        const { data: resolvedId, error: regErr } = await boot.rpc("register_runner", {
-            p_id: session.runner_id,
-            p_name: session.runner_id,
-            p_owner: session.email ?? session.user_id,
-            p_machine: machineIdentity(),
-            p_models: models,
-            p_caps: RUNNER_CAPS,
-            p_version: PACKAGE_VERSION,
-        });
-        if (regErr) {
-            process.stderr.write(`[acc-runner] ephemeral register_runner failed: ${regErr.message}\n`);
-            process.exit(1);
-        }
-        if (typeof resolvedId === "string" && resolvedId && resolvedId !== session.runner_id) {
-            session = { ...session, runner_id: resolvedId };
-        }
-        await tokenProvider.save(session);
-        console.log(chalk.green(`✓ Registered ephemeral runner: ${session.runner_id}`));
-    }
-    const taskRunnerFactory = options.taskRunnerFactory ?? runTask;
-    const heartbeatMs = options.heartbeatMs ?? 4_000;
-    const pollMs = options.pollMs ?? POLL_INTERVAL_MS;
-    const reviewerFactory = options.reviewerFactory ?? ((assignment, deps) => runReview(assignment, deps));
-    // v0.48: check for an existing quarantine file before opening the
-    // realtime connection. If quarantined, emit a loud warning — the
-    // runner will not claim tasks until `acc-runner quarantine clear` runs.
-    const startupQuarantine = await getQuarantine().catch(() => null);
-    if (startupQuarantine) {
-        process.stderr.write(chalk.red.bold(`[acc-runner] QUARANTINED (${startupQuarantine.cause}): ${startupQuarantine.detail}\n`));
-        process.stderr.write(chalk.red(`[acc-runner] Runner will NOT claim tasks. Resolve the issue then run ` +
-            `\`acc-runner quarantine clear\`.\n`));
-    }
-    // v0.12.0 (T-52-7): idle TTL — option override wins (tests), then env.
-    const idleTtlMs = options.idleTtlMs !== undefined ? options.idleTtlMs : resolveIdleTtlMs();
-    const state = {
-        cfg,
-        session,
-        tokenProvider,
-        supabase: createRunnerClient(cfg, session.access_token),
-        channel: undefined,
-        heartbeatTimer: undefined,
-        refreshTimer: undefined,
-        pollTimer: undefined,
-        claimScanTimer: undefined, // v0.62 (T-62-1)
-        claimScanIntervalMs: options.claimScanIntervalMs ?? DEFAULT_CLAIM_SCAN_INTERVAL_MS,
-        claimScanning: false,
-        reviewScanTimer: undefined, // v0.65 (T-65-2)
-        reviewScanIntervalMs: options.reviewScanIntervalMs ?? DEFAULT_CLAIM_SCAN_INTERVAL_MS,
-        reviewScanning: false,
-        // v0.73 (T-73-2, G-M): claim-loop watchdog.
-        claimWatchdogTimer: undefined,
-        claimWatchdogStaleMs: options.claimWatchdogStaleMs ?? DEFAULT_CLAIM_WATCHDOG_STALE_MS,
-        claimWatchdogSince: new Map(),
-        claimWatchdogChecking: false,
-        // v0.68 (T-68-1): realtime channel-health recovery state.
-        resubscribing: false,
-        resubscribeAttempts: 0,
-        resubscribeTimer: null,
-        // v0.10 T-49-2: concurrent running Map replaces v0.9 single `current`.
-        running: new Map(),
-        concurrencyLimit: options.concurrencyLimit ?? 2,
-        queue: [],
-        seen: new Set(),
-        pumping: false,
-        stopped: false,
-        heartbeatFailures: 0,
-        refreshing: null,
-        pollSince: new Date(Date.now() - STARTUP_POLL_LOOKBACK_MS).toISOString(),
-        polling: false,
-        reviewQueue: [],
-        seenReviews: new Set(),
-        reviewPumping: false,
-        runReview: reviewerFactory,
-        quarantined: startupQuarantine !== null,
-        authRetriedTasks: new Set(),
-        idleTtlMs,
-        lastActivityMs: Date.now(),
-        idleTimer: null,
-        idleExiting: false,
-        taskRunnerFactory,
-        pausedCapacity: false,
-        pausedUntil: null,
-        pauseTimer: null,
-        capacityProbe: false,
-        capacityBackoffMs: options.capacityBackoffMs ?? DEFAULT_CAPACITY_BACKOFF_MS,
-        resumeJitterMs: options.resumeJitterMs ?? DEFAULT_RESUME_JITTER_MS,
-        singletonLock,
-    };
-    subscribeChannel(state, taskRunnerFactory);
-    // v0.34-B / v0.62 (T-62-1): one-shot startup claim scan. The 5-minute
-    // pollSince watermark (v0.30-B) can miss a task dispatched (runner_id set)
-    // more than 5 minutes before the runner started whose realtime task_assigned
-    // event was lost during the restart window. claimScan() scans with an epoch
-    // watermark so any task currently assigned to this runner_id is enqueued
-    // regardless of dispatch age. Does NOT update state.pollSince — the ongoing
-    // poll loop keeps its 5-min watermark. The same routine runs periodically
-    // below as the realtime-miss safety net.
-    await claimScan(state, taskRunnerFactory, "startup");
-    // v0.65 (T-65-2): one-shot startup review scan, the review twin of the
-    // startup claim scan above. A `review_assigned` broadcast dropped during the
-    // restart window would otherwise strand the review in acc.review_queue until
-    // a manual restart; the epoch-watermark scan re-enqueues any pending review
-    // assigned to this runner regardless of when it was requested. enqueueReview's
-    // seenReviews guard keeps it idempotent against the realtime path.
-    await reviewScan(state, "startup");
-    // v0.30-B: fire an immediate poll right after subscribing so any task
-    // dispatched before the runner came online (where the fire-and-forget
-    // Realtime broadcast went to a dead channel) is picked up at startup
-    // instead of waiting `pollMs` for the first scheduled poll. Awaited so
-    // `state.polling` is back to false before the timer-driven polls and
-    // any caller-driven `pollOnce()` can run.
-    await pollOnce(state, taskRunnerFactory);
-    // v0.6.0: self-rescheduling setTimeout (not setInterval) so the
-    // backoff ladder in nextHeartbeatDelayMs actually pauses between
-    // attempts. setInterval would keep firing every heartbeatMs even
-    // while the link is down.
-    scheduleHeartbeat(state, taskRunnerFactory, heartbeatMs);
-    // v0.12.0 (T-52-7): no refresh timer when the provider can't rotate —
-    // doRefresh would just emit the same "unavailable" line every 30 min.
-    state.refreshTimer = setInterval(() => {
-        if (state.tokenProvider.canRefresh() && expiresSoon(state.session)) {
-            void doRefresh(state, taskRunnerFactory);
-        }
-    }, REFRESH_CHECK_MS);
-    state.pollTimer = setInterval(() => {
-        void pollOnce(state, taskRunnerFactory);
-    }, pollMs);
-    // v0.62 (T-62-1): periodic full claim scan — the realtime-miss safety net.
-    // Independent of the delta-poll watermark, so a task assigned with an
-    // updated_at at/behind the watermark (and whose task_assigned broadcast was
-    // dropped) is re-claimed within one interval rather than waiting for a
-    // manual restart. Single-flight inside claimScan(); enqueue's seen-guard
-    // keeps it from double-claiming work the realtime path or delta-poll took.
-    state.claimScanTimer = setInterval(() => {
-        void claimScan(state, taskRunnerFactory, "periodic");
-    }, state.claimScanIntervalMs);
-    // v0.65 (T-65-2): periodic full review scan — the realtime-miss safety net
-    // for reviews. Mirrors the claim-scan timer above: a `review_assigned`
-    // broadcast missed by a stale subscription is recovered within one interval
-    // instead of stranding in acc.review_queue. Single-flight inside
-    // reviewScan(); enqueueReview's seenReviews guard prevents double-claiming a
-    // review the realtime path already took.
-    state.reviewScanTimer = setInterval(() => {
-        void reviewScan(state, "periodic");
-    }, state.reviewScanIntervalMs);
-    // v0.73 (T-73-2, G-M): claim-loop watchdog timer. Independent of the claim
-    // scan (whose 3-min cadence is too coarse for a 90s threshold): it ages the
-    // runner's own assigned-but-unclaimed tasks and forces a resubscribe + claim
-    // scan when one stays unclaimed past the threshold while heartbeats succeed —
-    // the self-heal for the "online + heartbeating but never claims" strand that
-    // T-68-1's channel recovery can't see (healthy channel, wedged claim path).
-    const claimWatchdogCheckMs = options.claimWatchdogCheckMs ?? DEFAULT_CLAIM_WATCHDOG_CHECK_MS;
-    state.claimWatchdogTimer = setInterval(() => {
-        void claimWatchdogScan(state, taskRunnerFactory);
-    }, claimWatchdogCheckMs);
-    // v0.13-MULTI-RUNNER: refresh the runner's capability tags so an
-    // operator change to ACC_RUNNER_CAPABILITIES (or to ~/.config/acc-
-    // runner/config.json) takes effect on the next restart without
-    // requiring a full `acc-runner login` re-flow. Default-empty is the
-    // backward-compat path for 0.6.3 runners and matches any task with
-    // an empty required_capabilities array.
-    {
-        const { error: capsErr } = await state.supabase.rpc("set_runner_capabilities", {
-            p_id: state.session.runner_id,
-            p_capabilities: cfg.capabilities ?? [],
-        });
-        if (capsErr) {
-            // Non-fatal: a pre-0114 server (or an Old DB the runner is
-            // pointed at during local dev) will 404 this RPC. The watch
-            // loop continues so an operator on an older deploy isn't
-            // wedged by a missing function.
-            process.stderr.write(`[acc-runner] set_runner_capabilities failed (continuing): ${capsErr.message}\n`);
-        }
-    }
-    // Initial heartbeat fires immediately so the runner page reflects "online".
-    await state.supabase.rpc("heartbeat_runner", {
-        p_id: state.session.runner_id,
-        p_version: PACKAGE_VERSION,
-    });
-    console.log(chalk.gray(`Runner ${state.session.runner_id} is online. Ctrl-C to stop.`));
-    const stop = async () => {
-        if (state.stopped)
-            return;
-        state.stopped = true;
-        clearTimeout(state.heartbeatTimer);
-        clearInterval(state.refreshTimer);
-        clearInterval(state.pollTimer);
-        clearInterval(state.claimScanTimer); // v0.62 (T-62-1)
-        clearInterval(state.reviewScanTimer); // v0.65 (T-65-2)
-        clearInterval(state.claimWatchdogTimer); // v0.73 (T-73-2)
-        if (state.resubscribeTimer)
-            clearTimeout(state.resubscribeTimer); // v0.68 (T-68-1)
-        if (state.idleTimer)
-            clearInterval(state.idleTimer);
-        if (state.pauseTimer)
-            clearTimeout(state.pauseTimer); // v0.56 (T-56-1)
-        // v0.10 T-49-2: cancel every in-flight task (replaces v0.9 single cancel).
-        for (const ctrl of state.running.values()) {
-            ctrl.cancel();
-        }
-        try {
-            await state.supabase.removeChannel(state.channel);
-        }
-        catch { /* ignore */ }
-        // v0.12-RUNNER-HEALTH: log shutdown_intent BEFORE flipping status so
-        // the audit trail records the intent even if the status RPC fails.
-        // The 1-min runner-watchdog cron uses status='online'+stale heartbeat
-        // as its crash detector; this event gives operators a timestamped
-        // breadcrumb when investigating "why did this runner go offline?"
-        try {
-            await state.supabase.rpc("log_activity", {
-                p_verb: "runner.shutdown_intent",
-                p_target_id: state.session.runner_id,
-                p_payload: { version: PACKAGE_VERSION },
-                p_target_type: "runner",
-            });
-        }
-        catch { /* best-effort; network may already be gone */ }
-        try {
-            await state.supabase.rpc("set_runner_status", {
-                p_id: state.session.runner_id,
-                p_status: "offline",
-            });
-        }
-        catch { /* network may already be gone */ }
-        // v0.14.0 (T-54-2): release the single-instance lock last, so the slot
-        // is only freed once this runner has fully deregistered. SIGINT/SIGTERM
-        // and the idle-TTL exit all route through stop(), so all clean shutdown
-        // paths release it. A hard crash leaves a stale lock that the next
-        // start reclaims.
-        try {
-            await state.singletonLock?.release();
-        }
-        catch { /* best-effort */ }
-    };
-    // v0.12.0 (T-52-7): arm the idle-TTL timer. Desktop runners (no TTL env,
-    // no option) never reach this branch — zero behaviour change. Armed after
-    // `stop` exists so the exit sequence can reuse the one shutdown path.
-    if (state.idleTtlMs !== null && state.idleTtlMs > 0) {
-        const checkMs = options.idleCheckMs ?? Math.min(IDLE_CHECK_MS, state.idleTtlMs);
-        state.idleTimer = setInterval(() => {
-            void maybeIdleExit(state, stop, exitFn);
-        }, checkMs);
-        // Don't hold the event loop open for the idle check alone.
-        state.idleTimer.unref?.();
-        console.log(chalk.gray(`Idle TTL armed: exiting after ${Math.round(state.idleTtlMs / 60_000)} min without work.`));
-    }
-    if (!options.taskRunnerFactory) {
-        // v0.33-C: best-effort terminal status flush on runner shutdown. If
-        // launchd (or another OS-driven kill) sends SIGTERM while a task is
-        // mid-run, transition_task('failed') as a last resort so the task
-        // doesn't sit in 'running' until the 5-15 min sweep fires. SIGINT
-        // (Ctrl-C, operator-driven) skips the flush — the sweep is the right
-        // path there because the task should be retried as-is, not failed.
-        // SIGKILL / OOM can't be caught, so the sweep is still the real
-        // safety net; this just shrinks the window when the kill is catchable.
-        const onSignal = (signal) => {
-            void (async () => {
-                // v0.10 T-49-2: on SIGTERM, transition ALL in-flight tasks to
-                // failed (replaces v0.9 single-task transition). SIGINT (Ctrl-C)
-                // still skips the flush — the 5-min sweep handles that path.
-                if (signal === "SIGTERM" && state.running.size > 0) {
-                    await Promise.allSettled([...state.running.keys()].map(async (taskId) => {
-                        try {
-                            await state.supabase.rpc("transition_task", {
-                                p_task_id: taskId,
-                                p_new_status: "failed",
-                            });
-                        }
-                        catch { /* best-effort — sweep covers us if RPC can't get out */ }
-                    }));
-                }
-                await stop();
-                process.exit(0);
-            })();
-        };
-        process.once("SIGINT", () => onSignal("SIGINT"));
-        process.once("SIGTERM", () => onSignal("SIGTERM"));
-    }
-    return {
-        stop,
-        pollOnce: () => pollOnce(state, taskRunnerFactory),
-        claimScanOnce: () => claimScan(state, taskRunnerFactory, "periodic"), // v0.62 (T-62-1)
-        reviewScanOnce: () => reviewScan(state, "periodic"), // v0.65 (T-65-2)
-        claimWatchdogOnce: () => claimWatchdogScan(state, taskRunnerFactory), // v0.73 (T-73-2)
-        runningCount: () => state.running.size,
-    };
-}
-function scheduleHeartbeat(state, taskRunnerFactory, baseMs) {
-    if (state.stopped)
-        return;
-    const delay = nextHeartbeatDelayMs(state.heartbeatFailures, baseMs);
-    state.heartbeatTimer = setTimeout(() => {
-        void (async () => {
-            const { error } = await state.supabase.rpc("heartbeat_runner", {
-                p_id: state.session.runner_id,
-                p_version: PACKAGE_VERSION,
-            });
-            if (!error) {
-                state.heartbeatFailures = 0;
-            }
-            else {
-                state.heartbeatFailures += 1;
-                const kind = classifyHeartbeatError(error);
-                process.stderr.write(`[acc-runner] heartbeat failed (${kind}): ${error.message}\n`);
-                // v0.6.0 REG-294 sibling: only refresh on an auth-shaped error
-                // AND once we've crossed the consecutive-failure threshold. A
-                // single 401 on a flaky network shouldn't burn a refresh, and a
-                // DNS outage shouldn't trigger refresh at all.
-                if (state.heartbeatFailures >= HEARTBEAT_REFRESH_AFTER &&
-                    kind === "auth") {
-                    process.stderr.write("[acc-runner] auth-shaped heartbeat failure, attempting JWT refresh\n");
-                    void doRefresh(state, taskRunnerFactory);
-                }
-                if (state.heartbeatFailures >= HEARTBEAT_EXIT_AFTER) {
-                    process.stderr.write("[acc-runner] heartbeat dead, exiting\n");
-                    clearTimeout(state.heartbeatTimer);
-                    clearInterval(state.refreshTimer);
-                    clearInterval(state.pollTimer);
-                    clearInterval(state.claimScanTimer); // v0.62 (T-62-1)
-                    clearInterval(state.reviewScanTimer); // v0.65 (T-65-2)
-                    clearInterval(state.claimWatchdogTimer); // v0.73 (T-73-2)
-                    if (state.resubscribeTimer)
-                        clearTimeout(state.resubscribeTimer); // v0.68 (T-68-1)
-                    process.exit(1);
-                }
-            }
-            scheduleHeartbeat(state, taskRunnerFactory, baseMs);
-        })();
-    }, delay);
-}
-/**
- * v0.12.0 (T-52-7): idle-TTL exit check. Fires from the idle timer; exits
- * the process cleanly when the runner has had no queued or in-flight work
- * (tasks OR reviews) for idleTtlMs. The exit sequence:
- *
- *   1. log_activity runner.idle_ttl_exit — the audit breadcrumb the
- *      autoscale sweep and operators read ("why did acc-eph-x vanish?").
- *   2. final heartbeat_runner — so the runners panel shows a fresh
- *      timestamp right up to the clean exit (vs. a stale-heartbeat crash).
- *   3. stop() — shutdown_intent + set_runner_status('offline'), the same
- *      deregistration path `acc-runner logout` and SIGTERM use.
- *   4. exit(0).
- *
- * In-flight work always wins: any running task, queued task, or queued
- * review resets the decision to "not idle" — the TTL never kills a runner
- * mid-task.
- */
-async function maybeIdleExit(state, stop, exitFn) {
-    if (state.stopped || state.idleExiting || state.idleTtlMs === null)
-        return;
-    // v0.56 (T-56-1): a capacity pause is not idleness — the runner is
-    // deliberately waiting for its session window to reopen. Don't TTL-exit
-    // it out from under the scheduled resume.
-    if (state.pausedCapacity)
-        return;
-    if (state.running.size > 0 ||
-        state.queue.length > 0 ||
-        state.reviewQueue.length > 0 ||
-        state.reviewPumping) {
-        return;
-    }
-    const idleMs = Date.now() - state.lastActivityMs;
-    if (idleMs < state.idleTtlMs)
-        return;
-    state.idleExiting = true;
-    const idleMinutes = Math.round(idleMs / 60_000);
-    console.log(chalk.gray(`[acc-runner] idle TTL reached (${idleMinutes} min without work); exiting cleanly.`));
-    try {
-        await state.supabase.rpc("log_activity", {
-            p_verb: "runner.idle_ttl_exit",
-            p_target_id: state.session.runner_id,
-            p_payload: { idle_minutes: idleMinutes, version: PACKAGE_VERSION },
-            p_target_type: "runner",
-        });
-    }
-    catch { /* best-effort */ }
-    try {
-        await state.supabase.rpc("heartbeat_runner", {
-            p_id: state.session.runner_id,
-            p_version: PACKAGE_VERSION,
-        });
-    }
-    catch { /* best-effort */ }
-    await stop();
-    exitFn(0);
-}
-async function pumpReviews(state) {
-    if (state.reviewPumping)
-        return;
-    // v0.56 (T-56-1): don't claim reviews while paused for capacity, and hold
-    // reviews back during the single-probe window so the probe TASK confirms
-    // the session reopened before we spend more capacity on reviews.
-    if (state.pausedCapacity || state.capacityProbe)
-        return;
-    state.reviewPumping = true;
-    try {
-        while (!state.stopped &&
-            !state.pausedCapacity &&
-            !state.capacityProbe &&
-            state.reviewQueue.length > 0) {
-            const next = state.reviewQueue.shift();
-            if (!next)
-                continue;
-            try {
-                const outcome = await state.runReview(next, { supabase: state.supabase });
-                const tag = outcome.decision === "reviewer_error" ? chalk.red : chalk.gray;
-                console.log(tag(`[acc-runner] review ${next.review_id} task=${next.task_id} pr=${next.pr_number} decision=${outcome.decision} confidence=${outcome.confidence.toFixed(2)}`));
-                // v0.56 (T-56-1): a reviewer that hit the session/usage limit reports
-                // a DISTINCT outcome (reviewer_capacity, NOT reviewer_error) so the
-                // api side (T-56-2) can exclude it from automerge retry caps and
-                // re-dispatch the review. runReview has already submitted the
-                // reviewer_capacity row; here we pause the whole runner exactly as a
-                // capacity_exhausted task does.
-                if (outcome.decision === "reviewer_capacity") {
-                    enterCapacityPause(state, next.task_id, outcome.resume_at ?? null, `reviewer ${next.review_id} hit session/usage limit`);
-                    return;
-                }
-            }
-            catch (err) {
-                process.stderr.write(`[acc-runner] review ${next.review_id} crashed: ${err.message}\n`);
-            }
-            finally {
-                touchActivity(state); // v0.12.0 (T-52-7): idle clock restarts at review end
-            }
-        }
-    }
-    finally {
-        state.reviewPumping = false;
-    }
-}
-/**
- * v0.48 / v0.49 T-49-6: enter quarantine after a machine-level failure.
- *
- * Extracted from pump()'s completion handler so both the immediate
- * quarantine path and the auth_expired "refresh failed → quarantine"
- * path share one implementation. Idempotent: a no-op once the runner is
- * already quarantined, so concurrent machine-level failures don't fire
- * duplicate audit events. Sets the in-memory flag synchronously (pump()
- * reads it without an async hop) and best-effort persists + announces.
- */
-function enterQuarantine(state, taskId, cause, detail, 
-// v0.53 T-53-4: how many consecutive instant-empty exits produced an
-// env_broken cause (1 = definitive, 2 = heuristic confirmed by the
-// retry). Persisted into quarantine.json's additive `consecutive` field.
-consecutive) {
-    if (state.quarantined)
-        return;
-    state.quarantined = true;
-    const qState = {
-        cause,
-        classifiedAt: new Date().toISOString(),
-        taskId,
-        detail,
-        ...(consecutive !== undefined ? { consecutive } : {}),
-    };
-    void setQuarantine(qState).catch((err) => {
-        process.stderr.write(`[acc-runner] setQuarantine failed: ${err.message}\n`);
-    });
-    process.stderr.write(chalk.red.bold(`[acc-runner] QUARANTINE: runner ${state.session.runner_id} quarantined ` +
-        `(${cause}) after task ${taskId} failed.\n`));
-    void postRunnerStateMessage(state.supabase, {
-        task_id: taskId,
-        sender_id: state.session.runner_id,
-        state: "blocked",
-        protocol: "error_context",
-        payload: {
-            capacity_alert: true,
-            quarantine_cause: cause,
-            runner_id: state.session.runner_id,
-            detail,
-        },
-        kind: "blocked",
-    }).catch((err) => {
-        process.stderr.write(`[acc-runner] capacity alert post failed: ${err.message}\n`);
-    });
-    void (async () => {
-        try {
-            await state.supabase.rpc("log_activity", {
-                p_verb: "runner.quarantine_enter",
-                p_target_id: state.session.runner_id,
-                p_payload: { cause, task_id: taskId, detail },
-                p_target_type: "runner",
-            });
-        }
-        catch { /* best-effort */ }
-    })();
-}
-/**
- * v0.56 (T-56-1): enter a capacity pause.
- *
- * Triggered when a task OR a review reports capacity_exhausted (Claude
- * account out of session/usage capacity). The runner:
- *   - stops claiming tasks AND reviews (pump/pumpReviews bail on the flag);
- *   - schedules an automatic resume at the stated reset time (or a default
- *     backoff when none was parseable) plus a small jitter;
- *   - keeps heartbeating so the board shows online-but-paused, and emits a
- *     `runner.paused_capacity` activity event + a runner-level bus message
- *     carrying `resume_at` so health/board surfaces can show WHY the fleet
- *     is idle (heartbeat_runner's RPC shape is frozen, so the detail is
- *     carried additively through these existing channels).
- *
- * Idempotent: a second capacity hit while already paused only ever pushes
- * the resume later, never earlier, so a straggler task that 429s a moment
- * after the first one can't shorten the wait.
- */
-function enterCapacityPause(state, triggerTaskId, resumeAtIso, detail) {
-    const now = Date.now();
-    const parsed = resumeAtIso ? Date.parse(resumeAtIso) : NaN;
-    const resumeMs = Number.isFinite(parsed) && parsed > now ? parsed : now + state.capacityBackoffMs;
-    const source = Number.isFinite(parsed) && parsed > now ? "reset_time" : "default_backoff";
-    // Already paused: only extend the window, never shorten it.
-    if (state.pausedCapacity && state.pausedUntil !== null && resumeMs <= state.pausedUntil) {
-        return;
-    }
-    state.pausedCapacity = true;
-    state.pausedUntil = resumeMs;
-    if (state.pauseTimer) {
-        clearTimeout(state.pauseTimer);
-        state.pauseTimer = null;
-    }
-    const jitter = state.resumeJitterMs > 0 ? Math.floor(Math.random() * state.resumeJitterMs) : 0;
-    const delay = Math.max(0, resumeMs - now) + jitter;
-    const resumeAtFinal = new Date(now + delay).toISOString();
-    process.stderr.write(chalk.yellow(`[acc-runner] PAUSED (capacity): ${detail}. Not claiming tasks or reviews; ` +
-        `resuming at ${resumeAtFinal} (${source}).\n`));
-    void (async () => {
-        try {
-            await state.supabase.rpc("log_activity", {
-                p_verb: "runner.paused_capacity",
-                p_target_id: state.session.runner_id,
-                p_payload: {
-                    resume_at: resumeAtFinal,
-                    source,
-                    detail,
-                    version: PACKAGE_VERSION,
-                },
-                p_target_type: "runner",
-            });
-        }
-        catch { /* best-effort */ }
-    })();
-    // Runner-level bus message so operators see the paused status + reason on
-    // /messages even though heartbeat_runner itself can't carry a detail field.
-    // Anchored to the triggering task so the RPC can resolve the org scope
-    // (post_agent_message looks up org_id from acc.tasks for a non-null id).
-    void postRunnerStateMessage(state.supabase, {
-        task_id: triggerTaskId,
-        sender_id: state.session.runner_id,
-        state: "blocked",
-        protocol: "info",
-        payload: {
-            capacity_paused: true,
-            runner_id: state.session.runner_id,
-            resume_at: resumeAtFinal,
-            source,
-            detail,
-        },
-        kind: "blocked",
-    }).catch((err) => {
-        process.stderr.write(`[acc-runner] capacity pause bus post failed: ${err.message}\n`);
-    });
-    state.pauseTimer = setTimeout(() => {
-        void resumeFromCapacity(state);
-    }, delay);
-    state.pauseTimer.unref?.();
-}
-/**
- * v0.56 (T-56-1): resume from a capacity pause.
- *
- * Clears the pause and arms the single-probe clamp: the runner claims at
- * most ONE task to confirm the window actually reopened before resuming
- * full task concurrency and reviews. If the probe itself 429s, the
- * completion handler re-enters the pause; if it succeeds, the probe clamp
- * clears and normal claiming resumes.
- */
-async function resumeFromCapacity(state) {
-    if (state.stopped)
-        return;
-    state.pausedCapacity = false;
-    state.pausedUntil = null;
-    if (state.pauseTimer) {
-        clearTimeout(state.pauseTimer);
-        state.pauseTimer = null;
-    }
-    state.capacityProbe = true;
-    console.log(chalk.gray(`[acc-runner] capacity window reopened — resuming with a single probe task.`));
-    try {
-        await state.supabase.rpc("log_activity", {
-            p_verb: "runner.resume_capacity",
-            p_target_id: state.session.runner_id,
-            p_payload: { probe: true, version: PACKAGE_VERSION },
-            p_target_type: "runner",
-        });
-    }
-    catch { /* best-effort */ }
-    // Poll first (the stale-running sweep may have re-queued the released task
-    // to another runner; this picks up whatever is still assigned here), then
-    // pump — the probe clamp bounds it to one task.
-    await pollOnce(state, state.taskRunnerFactory);
-    void pump(state, state.taskRunnerFactory);
-}
-/**
- * v0.10 T-49-2: concurrent task pump.
- *
- * Launches up to state.concurrencyLimit tasks in parallel. Each task
- * gets its own isolated git worktree (prepareTaskWorktree in task-runner)
- * so there is zero shared-file risk between concurrent runs. Database-side
- * `claim_task_with_locks` provides a second guard: it rejects a claim when
- * the task's file scope overlaps another in-flight task.
- *
- * Design: rather than `await`ing each task inside a while loop (v0.9
- * serial behaviour), tasks are launched fire-and-forget. Each task's
- * `.then()` handler removes it from `state.running` and re-fires pump()
- * so newly freed capacity immediately picks up the next queued item.
- * The `pumping` mutex prevents two concurrent pump() invocations from
- * both launching into the same concurrencyLimit slot.
- */
-async function pump(state, factory) {
-    if (state.pumping)
-        return;
-    state.pumping = true;
-    try {
-        // v0.48: check quarantine before claiming any task.
-        if (state.quarantined) {
-            process.stderr.write(`[acc-runner] QUARANTINED: runner ${state.session.runner_id} is not claiming tasks.\n` +
-                `[acc-runner] Fix the underlying issue then run \`acc-runner quarantine clear\`.\n`);
-            return;
-        }
-        // v0.56 (T-56-1): out of session/usage capacity — don't claim. Queued
-        // tasks stay queued; the scheduled resume re-drives pump().
-        if (state.pausedCapacity) {
-            return;
-        }
-        // v0.56 (T-56-1): during the post-resume probe window, claim exactly one
-        // task to confirm the session reopened before unleashing full concurrency.
-        const effectiveLimit = state.capacityProbe ? 1 : state.concurrencyLimit;
-        // Fill available concurrency slots from the queue.
-        while (!state.stopped &&
-            !state.quarantined &&
-            !state.pausedCapacity &&
-            state.queue.length > 0 &&
-            state.running.size < effectiveLimit) {
-            const next = state.queue.shift();
-            if (!next)
-                continue;
-            const ctrl = factory(next, {
-                supabase: state.supabase,
-                cfg: state.cfg,
-                session: {
-                    accessToken: state.session.access_token,
-                    runnerId: state.session.runner_id,
-                },
-                publicUrl: state.cfg.publicUrl,
-            });
-            state.running.set(next, ctrl);
-            // Detached completion handler. Runs AFTER pump() returns so the
-            // running Map slot is occupied by the time the while condition
-            // re-checks running.size on the next iteration.
-            void ctrl.promise
-                .then((outcome) => {
-                state.running.delete(next);
-                touchActivity(state); // v0.12.0 (T-52-7): idle clock restarts at task end
-                // v0.56 (T-56-1): capacity exhaustion pauses the WHOLE runner —
-                // never a task_error, never quarantine. The task was left 'running'
-                // for the stale-running sweep to requeue losslessly (runner_id
-                // cleared). Do not re-fire pump for new work; the scheduled resume
-                // does that with a single probe.
-                if (outcome.status === "capacity_paused" || outcome.capacity_exhausted) {
-                    enterCapacityPause(state, next, outcome.resume_at ?? null, outcome.error || "task hit session/usage limit");
-                    return;
-                }
-                // v0.21 T-66-1: a transient git-provision contention requeue. runTask
-                // already returned the task to 'queued' server-side for a clean
-                // retry — NOT a failure (no quarantine, no pause, no retry-budget
-                // burn). Fall through to the pump re-fire below so the runner stays
-                // healthy and the requeued task re-dispatches normally.
-                if (outcome.status === "requeued") {
-                    process.stderr.write(`[acc-runner] task ${next} requeued (transient): ${outcome.error ?? "git provision contention"}\n`);
-                }
-                // v0.14.0 (T-54-2, GA-6): record the claude CLI version at the last
-                // successful task so `doctor` can WARN when claude auto-updates
-                // under the runner. Best-effort and detached — never blocks pump.
-                if (outcome.status === "ok") {
-                    void getClaudeVersion()
-                        .then((v) => recordTaskClaudeVersion(v))
-                        .catch(() => {
-                        /* best-effort cache write */
-                    });
-                }
-                if (outcome.status === "failed") {
-                    const reason = outcome.error?.trim() ||
-                        (outcome.exitCode != null ? `exit ${outcome.exitCode}` : "unknown");
-                    process.stderr.write(`[acc-runner] task ${next} phase=${outcome.phase ?? "unknown"} failed: ${reason}\n`);
-                    // v0.48: machine-level failure → quarantine. Guard with
-                    // !state.quarantined so concurrent tasks don't fire duplicate
-                    // quarantine events when two machine-level failures land
-                    // simultaneously (both already in-flight; only the first to
-                    // resolve sets the flag and writes the audit trail).
-                    if (outcome.quarantine_cause && !state.quarantined) {
-                        const cause = outcome.quarantine_cause;
-                        // v0.49 T-49-6: a transient auth_expired (the access token
-                        // lapsed while the task ran) gets ONE JWT refresh before we
-                        // quarantine. If the refresh recovers, the runner stays
-                        // online and resumes claiming queued work; if it fails — or
-                        // this task already burned its one retry — we quarantine.
-                        // usage_limit / env_broken skip this path: a token refresh
-                        // can't fix a spent quota or a broken host.
-                        if (cause === "auth_expired" && !state.authRetriedTasks.has(next)) {
-                            state.authRetriedTasks.add(next);
-                            process.stderr.write(chalk.yellow(`[acc-runner] auth_expired after task ${next}; attempting one ` +
-                                `token refresh before quarantine.\n`));
-                            void doRefresh(state, factory).then((ok) => {
-                                if (ok) {
-                                    process.stderr.write(chalk.green(`[acc-runner] token refresh recovered auth after task ${next}; ` +
-                                        `staying online.\n`));
-                                    void (async () => {
-                                        try {
-                                            await state.supabase.rpc("log_activity", {
-                                                p_verb: "runner.auth_retry_recovered",
-                                                p_target_id: state.session.runner_id,
-                                                p_payload: { task_id: next, cause },
-                                                p_target_type: "runner",
-                                            });
-                                        }
-                                        catch { /* best-effort */ }
-                                    })();
-                                    // Resume claiming: the freed slot can pick up queued work
-                                    // now that the JWT is fresh.
-                                    void pump(state, factory);
-                                }
-                                else {
-                                    enterQuarantine(state, next, cause, reason, outcome.quarantine_consecutive);
-                                }
-                            });
-                            return;
-                        }
-                        enterQuarantine(state, next, cause, reason, outcome.quarantine_consecutive);
-                        // Quarantined — do not re-fire pump for new tasks.
-                        // Other in-flight tasks (still in state.running) complete
-                        // normally; we just stop accepting new work.
-                        return;
-                    }
-                }
-                // v0.56 (T-56-1): a non-capacity completion (ok, or a genuine
-                // task_error) proves the session window is open — clear the probe
-                // clamp and let reviews resume alongside full task concurrency.
-                if (state.capacityProbe) {
-                    state.capacityProbe = false;
-                    void pumpReviews(state);
-                }
-                // Task done (ok, failed without quarantine, or cancelled).
-                // Re-fire pump so the next queued task can claim the freed slot.
-                void pump(state, factory);
-            })
-                .catch((err) => {
-                state.running.delete(next);
-                touchActivity(state); // v0.12.0 (T-52-7): idle clock restarts at task end
-                process.stderr.write(`[acc-runner] task ${next} crashed: ${err.message}\n`);
-                // v0.56 (T-56-1): a crash is not a capacity signal — clear the probe
-                // clamp so the runner doesn't stay stuck at concurrency 1.
-                if (state.capacityProbe) {
-                    state.capacityProbe = false;
-                    void pumpReviews(state);
-                }
-                void pump(state, factory);
-            });
-        }
-        // v0.56 (T-56-1): the probe found nothing to test with (no queued task at
-        // resume) — clear the clamp and release any held reviews so an idle
-        // resume doesn't strand pending reviews behind a probe that never runs.
-        if (state.capacityProbe && state.running.size === 0 && state.queue.length === 0) {
-            state.capacityProbe = false;
-            void pumpReviews(state);
-        }
-    }
-    finally {
-        state.pumping = false;
-    }
-}
-//# sourceMappingURL=watch.js.map