@tokenfactory/acc-runner 0.40.26 → 0.40.27

package/dist/git-auth/probe.js

@@ -0,0 +1,72 @@
+/**
+ * GIT-AUTH-ALERT: a masked, read-only git-credential health probe.
+ *
+ * Runs `git ls-remote --heads origin` in the runner's base clone — a dry-run
+ * that touches the remote (so an expired/revoked token 403s exactly as a real
+ * fetch would) but transfers no objects, so it is cheap enough to run every 60s
+ * both to DETECT the initial failure and to poll for RECOVERY. The result is a
+ * three-way `{ ok, failureClass, detail }` where `detail` is ALWAYS masked so no
+ * credential material (a token embedded in the remote URL, a `x-access-token:…`
+ * pair, a raw PAT) can reach a log line, an activity event, or `doctor` output.
+ */
+import { execa } from "execa";
+import { buildEnv } from "../bin-resolve.js";
+import { classifyGitFetchError } from "./classify.js";
+/**
+ * Redact credential material from arbitrary git output. Covers:
+ *   - userinfo in URLs:  scheme://user:token@host  →  scheme://***@host
+ *   - GitHub token shapes anywhere: ghp_/gho_/ghu_/ghs_/ghr_…, github_pat_…
+ * Idempotent and never throws; a masked-but-imperfect string is preferred to
+ * leaking, so callers can mask defensively at every boundary.
+ */
+export function maskGitCredentials(input) {
+    if (!input)
+        return input;
+    let out = input;
+    // scheme://userinfo@host — strip everything between the scheme and the '@'.
+    out = out.replace(/([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1***@");
+    // Bare GitHub token shapes that might appear outside a URL (e.g. in an error).
+    out = out.replace(/\bgh[posru]_[A-Za-z0-9]{16,}\b/g, "***");
+    out = out.replace(/\bgithub_pat_[A-Za-z0-9_]{20,}\b/g, "***");
+    return out;
+}
+/** First non-empty line of a message, masked and length-bounded. */
+function summarize(raw) {
+    const firstLine = raw.split(/\r?\n/).find((l) => l.trim().length > 0) ?? raw;
+    return maskGitCredentials(firstLine.trim()).slice(0, 300);
+}
+async function defaultRun(repoPath, args) {
+    // GIT_TERMINAL_PROMPT=0 → a missing credential fails FAST with "terminal
+    // prompts disabled" instead of blocking on an interactive username/password.
+    const { stdout } = await execa("git", args, {
+        cwd: repoPath,
+        env: { ...buildEnv(), GIT_TERMINAL_PROMPT: "0" },
+    });
+    return { stdout };
+}
+/**
+ * Build a `GitAuthProbe` bound to a repo path. `GIT_TERMINAL_PROMPT=0` is forced
+ * on so a missing credential fails FAST with "terminal prompts disabled" instead
+ * of hanging waiting for an interactive username/password.
+ */
+export function makeGitAuthProbe(opts) {
+    const run = opts.run ?? defaultRun;
+    return async () => {
+        try {
+            await run(opts.repoPath, ["ls-remote", "--heads", "origin"]);
+            return { ok: true, failureClass: null, detail: "ls-remote origin ok" };
+        }
+        catch (err) {
+            const failureClass = classifyGitFetchError(err);
+            const message = err?.stderr ??
+                err?.message ??
+                String(err);
+            return {
+                ok: false,
+                failureClass,
+                detail: summarize(typeof message === "string" ? message : String(message)),
+            };
+        }
+    };
+}
+//# sourceMappingURL=probe.js.map

package/dist/git-auth/probe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe.js","sourceRoot":"","sources":["../../src/git-auth/probe.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAC7C,OAAO,EAAE,qBAAqB,EAA6B,MAAM,eAAe,CAAC;AAcjF;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,4EAA4E;IAC5E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,qCAAqC,EAAE,QAAQ,CAAC,CAAC;IACnE,+EAA+E;IAC/E,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,iCAAiC,EAAE,KAAK,CAAC,CAAC;IAC5D,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,mCAAmC,EAAE,KAAK,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC;AACb,CAAC;AAED,oEAAoE;AACpE,SAAS,SAAS,CAAC,GAAW;IAC5B,MAAM,SAAS,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,IAAI,GAAG,CAAC;IAC7E,OAAO,kBAAkB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAC5D,CAAC;AASD,KAAK,UAAU,UAAU,CACvB,QAAgB,EAChB,IAAc;IAEd,yEAAyE;IACzE,6EAA6E;IAC7E,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,KAAK,EAAE,IAAI,EAAE;QAC1C,GAAG,EAAE,QAAQ;QACb,GAAG,EAAE,EAAE,GAAG,QAAQ,EAAE,EAAE,mBAAmB,EAAE,GAAG,EAAE;KACjD,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,CAAC;AACpB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAyB;IACxD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IACnC,OAAO,KAAK,IAAI,EAAE;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;YAC7D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;QACzE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,YAAY,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;YAChD,MAAM,OAAO,GACV,GAA+C,EAAE,MAAM;gBACvD,GAAa,EAAE,OAAO;gBACvB,MAAM,CAAC,GAAG,CAAC,CAAC;YACd,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,YAAY;gBACZ,MAAM,EAAE,SAAS,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;aAC3E,CAAC;QACJ,CAAC;IACH,CAAC,CAAC;AACJ,CAAC"}

package/dist/watch.d.ts

@@ -7,6 +7,7 @@ import { runTask, type RunTaskController } from "./task-runner.js";
 import { type ReviewAssignment, type ReviewerOutcome } from "./runtime/reviewer.js";
 import { type SingletonLock } from "./runtime/singleton.js";
 import { type SelfUpgradeResult, type SelfUpdate426Result } from "./runtime/self-upgrade.js";
+import { GitAuthController, type GitAuthProbe } from "./git-auth/index.js";
 import { ResumeController, type ResumeControllerDeps } from "./capacity/resume-controller.js";
 import { AccountProbeScheduler } from "./engines/account-probe.js";
 import { type FleetChatServingHandle } from "./watch-chat/wire.js";
@@ -194,6 +195,23 @@ export interface WatchOptions {
      * guard.
      */
     enforceSingleton?: boolean;
+    /**
+     * GIT-AUTH-ALERT: cadence (ms) of the git-credential health probe. Defaults to
+     * 60s. Tests set a large value so only the `gitAuthProbeOnce()` hook drives it.
+     */
+    gitAuthProbeIntervalMs?: number;
+    /**
+     * GIT-AUTH-ALERT: consecutive auth-class probe failures before the runner
+     * trips the degraded `git_auth_failed` state. Defaults to 2 (the spec bar).
+     */
+    gitAuthFailureThreshold?: number;
+    /**
+     * GIT-AUTH-ALERT: injectable probe seam. Production builds an `ls-remote`
+     * probe bound to the base clone (cfg.worktreeRepoPath ?? cfg.repoPath); tests
+     * inject a fake to drive the state machine without shelling out to git. When
+     * neither this nor a base repo path is available the probe loop is disabled.
+     */
+    gitAuthProbe?: GitAuthProbe;
 }
 /**
  * v0.12.0 (T-52-7): resolve ACC_RUNNER_IDLE_TTL_MIN into ms. Returns null
@@ -228,6 +246,13 @@ export interface WatchHandle {
      * from the backstop timer.
      */
     claimBackstopOnce(): Promise<void>;
+    /**
+     * GIT-AUTH-ALERT test hook: forces one git-credential health probe and
+     * resolves when it finishes (including any degraded/recovered emit). Resolves
+     * to `false` when the probe loop is disabled (no base repo path). Production
+     * drives this from the probe timer.
+     */
+    gitAuthProbeOnce(): Promise<boolean>;
     /** v0.10 T-49-2: number of tasks currently executing. Useful for tests. */
     runningCount(): number;
 }
@@ -278,6 +303,19 @@ interface WatchState {
     claimBackstopTimer: NodeJS.Timeout;
     claimBackstopIntervalMs: number;
     backstopScanning: boolean;
+    /**
+     * GIT-AUTH-ALERT: the git-credential health state machine + its timer.
+     * `gitAuthController` is null when the probe loop is disabled (no base repo
+     * path resolvable, or in tests that don't opt in). `gitAuthFailed` mirrors the
+     * controller's degraded flag so pump() can read it synchronously (like the
+     * capacity flags) to pause task-lane claiming. `gitAuthChecking` is the
+     * single-flight guard so a slow probe can't overlap itself.
+     */
+    gitAuthController: GitAuthController | null;
+    gitAuthTimer: NodeJS.Timeout | null;
+    gitAuthProbeIntervalMs: number;
+    gitAuthChecking: boolean;
+    gitAuthFailed: boolean;
     /**
      * v0.68 (T-68-1): realtime channel-health recovery. The `.subscribe`
      * status callback previously handled ONLY `SUBSCRIBED`; a `CHANNEL_ERROR`

package/dist/watch.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../src/watch.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAGlB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,EAAE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAKnC,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAK9F,OAAO,EAAE,qBAAqB,EAAmB,MAAM,4BAA4B,CAAC;AAKpF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYhD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EAEtB,oBAAoB,EAEpB,KAAK,kBAAkB,EACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,kBAAkB,GACxB,CAAC;AA4EF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,OAAO,CAAC;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,CAChB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;QAAE,QAAQ,EAAE,oBAAoB,CAAA;KAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnF;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAWf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,wEAAwE;IACxE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC;CACxB;AAED,KAAK,eAAe,GAAG,CACrB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;IAAE,QAAQ,EAAE,oBAAoB,CAAA;CAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B,UAAU,UAAU;IAClB,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,uEAAuE;IACvE,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;IAC1B,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC;IAChC,kFAAkF;IAClF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+EAA+E;IAC/E,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxC;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;;;OAMG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;;;;OAOG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACpC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpF,aAAa,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,OAAO,CAAC;IAClC;;;;;;OAMG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC1C;AAuID,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAMD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB5E;AAshBD,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAwsBnF;AA8QD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,UAAU,CAAC,EAC/C,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwBf;AA6LD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,IAAI,CACL,oBAAoB,EACpB,gBAAgB,GAAG,YAAY,GAAG,kBAAkB,GAAG,eAAe,GAAG,OAAO,CACjF,CA6GA"}
+{"version":3,"file":"watch.d.ts","sourceRoot":"","sources":["../src/watch.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAC7D,OAAO,EAML,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAGlB,MAAM,aAAa,CAAC;AAIrB,OAAO,EAAE,uBAAuB,EAAE,0BAA0B,EAAE,MAAM,aAAa,CAAC;AAClF,OAAO,EAAoB,KAAK,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAG3E,OAAO,EAAsB,KAAK,oBAAoB,EAAE,MAAM,eAAe,CAAC;AAE9E,OAAO,EAAE,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,kBAAkB,CAAC;AACnE,OAAO,EAEL,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACrB,MAAM,uBAAuB,CAAC;AAK/B,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,wBAAwB,CAAC;AAKhC,OAAO,EAIL,KAAK,iBAAiB,EACtB,KAAK,mBAAmB,EACzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,iBAAiB,EAIjB,KAAK,YAAY,EAClB,MAAM,qBAAqB,CAAC;AAI7B,OAAO,EAAE,gBAAgB,EAAE,KAAK,oBAAoB,EAAE,MAAM,iCAAiC,CAAC;AAK9F,OAAO,EAAE,qBAAqB,EAAmB,MAAM,4BAA4B,CAAC;AAKpF,OAAO,EAEL,KAAK,sBAAsB,EAC5B,MAAM,sBAAsB,CAAC;AAE9B,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAGhE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAYhD,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EAEtB,oBAAoB,EAEpB,KAAK,kBAAkB,EACxB,MAAM,6BAA6B,CAAC;AAErC,OAAO,EACL,yBAAyB,EACzB,sBAAsB,EACtB,oBAAoB,EACpB,KAAK,kBAAkB,GACxB,CAAC;AAoFF;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE;IAC1C,gBAAgB,EAAE,MAAM,CAAC;IACzB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB,GAAG,MAAM,CAMT;AAED,MAAM,WAAW,YAAY;IAC3B,0DAA0D;IAC1D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,yDAAyD;IACzD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;;;OAOG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;;;;;;OASG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;OAOG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B;;;;;;;;OAQG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC,0EAA0E;IAC1E,iBAAiB,CAAC,EAAE,OAAO,OAAO,CAAC;IACnC,yEAAyE;IACzE,eAAe,CAAC,EAAE,CAChB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;QAAE,QAAQ,EAAE,oBAAoB,CAAA;KAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;IAC9B;;;;;;;;OAQG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B;;;;;OAKG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,+DAA+D;IAC/D,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,uEAAuE;IACvE,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC9B;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;OAKG;IACH,WAAW,CAAC,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACnF;;;;;OAKG;IACH,aAAa,CAAC,EAAE,CAAC,KAAK,EAAE;QACtB,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC3B,OAAO,EAAE,OAAO,CAAC;KAClB,KAAK,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B;;;OAGG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;OAKG;IACH,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,0BAA0B,CAAC,EAAE,MAAM,CAAC;IACpC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,MAAM,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACpD;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAC3B;;;OAGG;IACH,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC;;;OAGG;IACH,uBAAuB,CAAC,EAAE,MAAM,CAAC;IACjC;;;;;OAKG;IACH,YAAY,CAAC,EAAE,YAAY,CAAC;CAC7B;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAC9B,GAAG,GAAE,MAAM,CAAC,UAAwB,GACnC,MAAM,GAAG,IAAI,CAWf;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACtB,wEAAwE;IACxE,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC1B;;;OAGG;IACH,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/B;;;;OAIG;IACH,cAAc,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IAChC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;OAIG;IACH,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;IACnC;;;;;OAKG;IACH,gBAAgB,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,2EAA2E;IAC3E,YAAY,IAAI,MAAM,CAAC;CACxB;AAED,KAAK,eAAe,GAAG,CACrB,UAAU,EAAE,gBAAgB,EAC5B,IAAI,EAAE;IAAE,QAAQ,EAAE,oBAAoB,CAAA;CAAE,KACrC,OAAO,CAAC,eAAe,CAAC,CAAC;AAE9B,UAAU,UAAU;IAClB,GAAG,EAAE,YAAY,CAAC;IAClB,OAAO,EAAE,aAAa,CAAC;IACvB,uEAAuE;IACvE,aAAa,EAAE,aAAa,CAAC;IAC7B,QAAQ,EAAE,oBAAoB,CAAC;IAC/B,OAAO,EAAE,eAAe,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC;IAC7B,SAAS,EAAE,MAAM,CAAC,OAAO,CAAC;IAC1B,iFAAiF;IACjF,cAAc,EAAE,MAAM,CAAC,OAAO,CAAC;IAC/B,sFAAsF;IACtF,mBAAmB,EAAE,MAAM,CAAC;IAC5B,+EAA+E;IAC/E,aAAa,EAAE,OAAO,CAAC;IACvB,6EAA6E;IAC7E,eAAe,EAAE,MAAM,CAAC,OAAO,CAAC;IAChC,kFAAkF;IAClF,oBAAoB,EAAE,MAAM,CAAC;IAC7B,+EAA+E;IAC/E,cAAc,EAAE,OAAO,CAAC;IACxB;;;;;;;OAOG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,oBAAoB,EAAE,MAAM,CAAC;IAC7B,kBAAkB,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,qBAAqB,EAAE,OAAO,CAAC;IAC/B;;;;;;OAMG;IACH,kBAAkB,EAAE,MAAM,CAAC,OAAO,CAAC;IACnC,uBAAuB,EAAE,MAAM,CAAC;IAChC,gBAAgB,EAAE,OAAO,CAAC;IAC1B;;;;;;;OAOG;IACH,iBAAiB,EAAE,iBAAiB,GAAG,IAAI,CAAC;IAC5C,YAAY,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACpC,sBAAsB,EAAE,MAAM,CAAC;IAC/B,eAAe,EAAE,OAAO,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB;;;;;;;OAOG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC;;;;;OAKG;IACH,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;IACxC;;;;;OAKG;IACH,gBAAgB,EAAE,MAAM,CAAC;IACzB;;;;OAIG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;OAMG;IACH,eAAe,EAAE,MAAM,CAAC;IACxB,uBAAuB,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,sBAAsB,EAAE,OAAO,CAAC;IAChC;;;;;OAKG;IACH,iBAAiB,EAAE,iBAAiB,CAAC;IACrC;;;;;;OAMG;IACH,wBAAwB,EAAE,OAAO,CAAC;IAClC;;;;;;;OAOG;IACH,mBAAmB,EAAE,OAAO,CAAC;IAC7B,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,4EAA4E;IAC5E,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,UAAU,EAAE,OAAO,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC;IACpC,2EAA2E;IAC3E,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB;;;;;OAKG;IACH,WAAW,EAAE,gBAAgB,EAAE,CAAC;IAChC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IACzB,aAAa,EAAE,OAAO,CAAC;IACvB,SAAS,EAAE,eAAe,CAAC;IAC3B;;;;;OAKG;IACH,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;;OAOG;IACH,gBAAgB,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9B;;;;;OAKG;IACH,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACjC,2DAA2D;IAC3D,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;;OAMG;IACH,gBAAgB,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;IACxC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,aAAa,EAAE,CAAC,KAAK,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,KAAK,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACpF,aAAa,EAAE,OAAO,CAAC;IACvB;;;;OAIG;IACH,iBAAiB,EAAE,OAAO,OAAO,CAAC;IAClC;;;;;;OAMG;IACH,cAAc,EAAE,OAAO,CAAC;IACxB,uEAAuE;IACvE,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B;;;;;;OAMG;IACH,qBAAqB,EAAE,MAAM,GAAG,IAAI,CAAC;IACrC;;;;;OAKG;IACH,mBAAmB,EAAE,MAAM,CAAC;IAC5B;;;;;;;OAOG;IACH,gBAAgB,EAAE,gBAAgB,CAAC;IACnC;;;;;OAKG;IACH,YAAY,EAAE,qBAAqB,GAAG,IAAI,CAAC;IAC3C;;;;OAIG;IACH,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC;;;;;OAKG;IACH,aAAa,EAAE,OAAO,CAAC;IACvB,sEAAsE;IACtE,iBAAiB,EAAE,MAAM,CAAC;IAC1B,cAAc,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,aAAa,EAAE,aAAa,GAAG,IAAI,CAAC;IACpC;;;;OAIG;IACH,SAAS,EAAE,sBAAsB,GAAG,IAAI,CAAC;CAC1C;AAuID,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,OAAO,CAAC,IAAI,CAAC,CAoBf;AAMD,wBAAsB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAqB5E;AAshBD,wBAAsB,YAAY,CAAC,OAAO,GAAE,YAAiB,GAAG,OAAO,CAAC,WAAW,CAAC,CAouBnF;AA8QD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,GAAG,UAAU,CAAC,EAC/C,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,EACzB,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,EAC9B,MAAM,EAAE,QAAQ,GAAG,SAAS,GAC3B,OAAO,CAAC,IAAI,CAAC,CAwBf;AAkSD;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAgB,yBAAyB,CACvC,KAAK,EAAE,UAAU,EACjB,OAAO,EAAE,OAAO,OAAO,GACtB,IAAI,CACL,oBAAoB,EACpB,gBAAgB,GAAG,YAAY,GAAG,kBAAkB,GAAG,eAAe,GAAG,OAAO,CACjF,CA6GA"}

package/dist/watch.js

@@ -43,6 +43,7 @@ import { acquireSingletonLock, singletonRunnerId, SingletonLockHeldError, } from
 import { getClaudeVersion, recordTaskClaudeVersion, } from "./runtime/version-drift.js";
 import { autoUpgradeDisabled, maybeSelfUpgrade, maybeSelfUpdateOn426, } from "./runtime/self-upgrade.js";
 import { postRunnerStateMessage } from "./messaging.js";
+import { GitAuthController, makeGitAuthProbe, RUNNER_GIT_AUTH_FAILED_VERB, RUNNER_GIT_AUTH_RECOVERED_VERB, } from "./git-auth/index.js";
 // AS-3 (RESUME-WIRE): drive the live capacity pause/resume through the
 // ResumeController (pause-until reset OR account-change OR ping) instead of a
 // fixed pause-until-reset setTimeout, and off the AS-2 account-probe cadence.
@@ -119,6 +120,13 @@ const DEFAULT_CLAIM_WATCHDOG_CHECK_MS = 30_000;
 // regressions of the same shape. Default 60s — prompt recovery without a third
 // frequent DB poll racing the watchdog. Knob: `claim_backstop_interval_ms`.
 const DEFAULT_CLAIM_BACKSTOP_INTERVAL_MS = 60_000;
+// GIT-AUTH-ALERT: how often the runner probes its base clone's git credential
+// (a masked `ls-remote origin` dry-run). The same 60s cadence detects the first
+// failure AND polls for recovery — while degraded, task-lane claiming is paused
+// and this probe is the only thing that can clear it. Tests set a large value so
+// only the `gitAuthProbeOnce()` hook drives it deterministically. Knob:
+// `git_auth_probe_interval_ms`.
+const DEFAULT_GIT_AUTH_PROBE_INTERVAL_MS = 60_000;
 // v0.56 (T-56-1): capacity-aware pause. When claude reports a session/usage
 // limit (api_error_status 429) the runner pauses claiming tasks AND reviews
 // until the stated reset time. When no reset time is parseable, fall back to
@@ -915,6 +923,7 @@ export async function watchCommand(options = {}) {
                 reviewScanOnce: async () => { },
                 claimWatchdogOnce: async () => { },
                 claimBackstopOnce: async () => { },
+                gitAuthProbeOnce: async () => false,
                 runningCount: () => 0,
             };
         }
@@ -1096,6 +1105,13 @@ export async function watchCommand(options = {}) {
         claimBackstopTimer: undefined,
         claimBackstopIntervalMs: options.claimBackstopIntervalMs ?? DEFAULT_CLAIM_BACKSTOP_INTERVAL_MS,
         backstopScanning: false,
+        // GIT-AUTH-ALERT: controller wired below once `state` exists (its emit
+        // callbacks close over `state`); timer armed in the timer-setup block.
+        gitAuthController: null,
+        gitAuthTimer: null,
+        gitAuthProbeIntervalMs: options.gitAuthProbeIntervalMs ?? DEFAULT_GIT_AUTH_PROBE_INTERVAL_MS,
+        gitAuthChecking: false,
+        gitAuthFailed: false,
         // v0.68 (T-68-1): realtime channel-health recovery state.
         resubscribing: false,
         resubscribeAttempts: 0,
@@ -1167,6 +1183,10 @@ export async function watchCommand(options = {}) {
     // starting account is seeded before any claim can 429. Both timers unref so
     // the probe/poll cadence never holds the process open on its own.
     await wireCapacityResume(state, taskRunnerFactory, options);
+    // GIT-AUTH-ALERT: build the git-credential health controller (no-op when no
+    // base clone is resolvable). The probe timer is armed in the timer-setup
+    // block below alongside the claim/review scans.
+    wireGitAuthController(state, options);
     subscribeChannel(state, taskRunnerFactory);
     // v0.34-B / v0.62 (T-62-1): one-shot startup claim scan. The 5-minute
     // pollSince watermark (v0.30-B) can miss a task dispatched (runner_id set)
@@ -1243,6 +1263,17 @@ export async function watchCommand(options = {}) {
     state.claimBackstopTimer = setInterval(() => {
         void claimBackstopScan(state, taskRunnerFactory);
     }, state.claimBackstopIntervalMs);
+    // GIT-AUTH-ALERT: periodic git-credential health probe. Armed only when the
+    // controller is wired (a base clone is resolvable). The same cadence detects
+    // the first auth failure AND polls for recovery while degraded. Single-flight
+    // inside gitAuthProbeScan(); unref'd so the probe never holds the process
+    // open on its own.
+    if (state.gitAuthController) {
+        state.gitAuthTimer = setInterval(() => {
+            void gitAuthProbeScan(state);
+        }, state.gitAuthProbeIntervalMs);
+        state.gitAuthTimer.unref?.();
+    }
     // v0.13-MULTI-RUNNER: refresh the runner's capability tags so an
     // operator change to ACC_RUNNER_CAPABILITIES (or to ~/.config/acc-
     // runner/config.json) takes effect on the next restart without
@@ -1337,6 +1368,8 @@ export async function watchCommand(options = {}) {
         clearInterval(state.reviewScanTimer); // v0.65 (T-65-2)
         clearInterval(state.claimWatchdogTimer); // v0.73 (T-73-2)
         clearInterval(state.claimBackstopTimer); // FIX-D
+        if (state.gitAuthTimer)
+            clearInterval(state.gitAuthTimer); // GIT-AUTH-ALERT
         if (state.resubscribeTimer)
             clearTimeout(state.resubscribeTimer); // v0.68 (T-68-1)
         if (state.idleTimer)
@@ -1447,6 +1480,7 @@ export async function watchCommand(options = {}) {
         reviewScanOnce: () => reviewScan(state, "periodic"), // v0.65 (T-65-2)
         claimWatchdogOnce: () => claimWatchdogScan(state, taskRunnerFactory), // v0.73 (T-73-2)
         claimBackstopOnce: () => claimBackstopScan(state, taskRunnerFactory), // FIX-D
+        gitAuthProbeOnce: () => gitAuthProbeScan(state), // GIT-AUTH-ALERT
         runningCount: () => state.running.size,
     };
 }
@@ -1788,6 +1822,99 @@ async function pumpReviews(state) {
  * duplicate audit events. Sets the in-memory flag synchronously (pump()
  * reads it without an async hop) and best-effort persists + announces.
  */
+/**
+ * GIT-AUTH-ALERT: build the git-credential health controller and stash it on
+ * `state`. The probe defaults to a masked `ls-remote origin` against the base
+ * clone (worktreeRepoPath ?? repoPath); tests inject `options.gitAuthProbe`.
+ * When neither is available the controller stays null and the probe loop is
+ * never armed — the feature is a no-op for chat-only / repo-less runners.
+ *
+ * The degraded/recovered callbacks flip `state.gitAuthFailed` (read
+ * synchronously in pump() to pause task-lane claiming) and emit the
+ * runner-scoped `runner.git_auth_failed` / `runner.git_auth_recovered` audit
+ * events the alerts tick scans to page the operator. Both emits name the machine
+ * and carry only masked, credential-safe detail.
+ */
+function wireGitAuthController(state, options) {
+    const repoPath = state.cfg.worktreeRepoPath ?? state.cfg.repoPath;
+    const probe = options.gitAuthProbe ?? (repoPath ? makeGitAuthProbe({ repoPath }) : null);
+    if (!probe)
+        return;
+    const machine = machineIdentity();
+    const runnerId = state.session.runner_id;
+    state.gitAuthController = new GitAuthController({
+        probe,
+        threshold: options.gitAuthFailureThreshold,
+        onDegraded: async ({ consecutiveFailures, detail }) => {
+            state.gitAuthFailed = true;
+            process.stderr.write(chalk.red.bold(`[acc-runner] GIT AUTH FAILED on ${machine} (runner ${runnerId}): ${detail} ` +
+                `— ${consecutiveFailures} consecutive auth-class fetch failures. Pausing ` +
+                `task-lane claiming until a fetch succeeds (probe every ` +
+                `${Math.round(state.gitAuthProbeIntervalMs / 1000)}s). ` +
+                `Fix: run \`gh auth login\` or renew the PAT.\n`));
+            try {
+                await state.supabase.rpc("log_activity", {
+                    p_verb: RUNNER_GIT_AUTH_FAILED_VERB,
+                    p_target_id: runnerId,
+                    p_payload: {
+                        runner_id: runnerId,
+                        machine,
+                        consecutive_failures: consecutiveFailures,
+                        detail,
+                        remediation: "Run `gh auth login` on the runner host, or renew the PAT it uses.",
+                        version: PACKAGE_VERSION,
+                    },
+                    p_target_type: "runner",
+                });
+            }
+            catch {
+                /* best-effort audit — a failed emit must not wedge the probe loop. */
+            }
+        },
+        onRecovered: async ({ failuresBeforeRecovery, detail }) => {
+            state.gitAuthFailed = false;
+            process.stderr.write(chalk.green(`[acc-runner] git auth RECOVERED on ${machine} (runner ${runnerId}): ${detail}. ` +
+                `Resuming task-lane claiming.\n`));
+            try {
+                await state.supabase.rpc("log_activity", {
+                    p_verb: RUNNER_GIT_AUTH_RECOVERED_VERB,
+                    p_target_id: runnerId,
+                    p_payload: {
+                        runner_id: runnerId,
+                        machine,
+                        failures_before_recovery: failuresBeforeRecovery,
+                        version: PACKAGE_VERSION,
+                    },
+                    p_target_type: "runner",
+                });
+            }
+            catch {
+                /* best-effort audit. */
+            }
+            // Re-drive the pump so queued work is claimed immediately on recovery
+            // instead of waiting for the next poll/scan tick.
+            void pump(state, state.taskRunnerFactory);
+        },
+    });
+}
+/**
+ * GIT-AUTH-ALERT: run exactly one git-credential probe. Single-flight via
+ * `gitAuthChecking` so a slow probe can't overlap itself. Returns false (a
+ * no-op) when the controller is disabled. Production drives this from the
+ * probe timer; tests drive it via the `gitAuthProbeOnce()` handle hook.
+ */
+async function gitAuthProbeScan(state) {
+    if (state.stopped || !state.gitAuthController || state.gitAuthChecking)
+        return false;
+    state.gitAuthChecking = true;
+    try {
+        await state.gitAuthController.check();
+        return true;
+    }
+    finally {
+        state.gitAuthChecking = false;
+    }
+}
 function enterQuarantine(state, taskId, cause, detail, 
 // v0.53 T-53-4: how many consecutive instant-empty exits produced an
 // env_broken cause (1 = definitive, 2 = heuristic confirmed by the
@@ -2107,7 +2234,11 @@ async function pump(state, factory) {
             capacityProbe: state.capacityProbe,
             // RVU-2 (FU-RVU2R): pause NEW task claims under review capacity pressure so
             // reviews get the scarce subscription capacity first (cap-priority).
-            claimPaused: state.capacityClaimPaused,
+            // GIT-AUTH-ALERT: also pause NEW task claims while the base git credential
+            // is degraded — every claim would fail at phase=git and requeue, so backing
+            // off (task-lane only; reviews keep draining) avoids the churn the live
+            // 2026-07-22 incident spammed. Cleared by the recovery probe.
+            claimPaused: state.capacityClaimPaused || state.gitAuthFailed,
         });
         // Fill available concurrency slots from the queue.
         while (!state.stopped &&