@wjarka/cezarion 0.14.3 → 0.14.4-pr455.702

package/dist/core/cursor-provider-error.js

@@ -0,0 +1,53 @@
+import { parseUsageLimit } from './usage-limit.js';
+/**
+ * Cursor provider error envelopes (#443). Cursor 2026.09.15 catches provider
+ * failures and emits them as an `agent_message_chunk` beginning with a literal
+ * `\n\nError: ` prefix, then ends the turn. The runner used to reduce that
+ * envelope to two canned strings, which discarded the reset instants the
+ * auto-resume machinery (spec 2026-08-03) needs and made a transient 429/5xx
+ * indistinguishable from a fatal one.
+ */
+/** Preserved provider text is diagnosis, not transcript bulk — cap it. */
+export const CURSOR_PROVIDER_ERROR_MAX_CHARS = 500;
+const ENVELOPE_PREFIX_RE = /^\n\nError: /u;
+const CONTROL_RE = /[\u0000-\u0008\u000B\u000C\u000E-\u001F\u007F]/gu;
+/**
+ * Transient provider failure signals worth one more prompt. Deliberately wide —
+ * the cost of a false positive is two wasted prompts (bounded below), while the
+ * cost of a false negative is a dead run that needed a human Continue. Fatal
+ * prose like "context length exceeded" or "model not found" matches none of these.
+ */
+const TRANSIENT_SIGNAL_RE = /\b(?:429|500|502|503|504|rate[ _-]?limit(?:ed)?|overloaded|temporar(?:y|ily)|timed?[ _-]?out|bad gateway|service unavailable|internal server error|connection (?:reset|refused|closed|error)|econn(?:reset|refused|aborted)|socket hang up|try again|retry)\b/i;
+/**
+ * Strip the envelope prefix, control characters and runs of whitespace. Uncapped — this is the
+ * form classification and limit parsing read, so a verbose envelope cannot bury its reset
+ * instant past a display bound (#446 round 3).
+ */
+function collapseCursorProviderError(text) {
+    return text.replace(ENVELOPE_PREFIX_RE, '').replace(CONTROL_RE, ' ').replace(/\s+/g, ' ').trim();
+}
+/**
+ * The collapsed text, capped for display. Safe to embed in a run error and transcript;
+ * recovery-relevant structure survives through `classifyCursorProviderError` and the
+ * runner's fatal composition, never through this cap.
+ */
+export function sanitizeCursorProviderError(text) {
+    return collapseCursorProviderError(text).slice(0, CURSOR_PROVIDER_ERROR_MAX_CHARS);
+}
+/**
+ * Classify a raw envelope chunk. Auth wins first (login guidance, fatal);
+ * a limit phrase with a usable reset instant makes it transient-with-instant;
+ * any other transient signal is transient-without-instant; everything else is fatal.
+ */
+export function classifyCursorProviderError(text, now = Date.now()) {
+    const detail = collapseCursorProviderError(text);
+    if (/unauthenticated/i.test(detail))
+        return { kind: 'auth' };
+    const limit = parseUsageLimit(detail, now);
+    if (limit)
+        return { kind: 'transient', resetAt: limit.resetAt };
+    if (TRANSIENT_SIGNAL_RE.test(detail))
+        return { kind: 'transient' };
+    return { kind: 'fatal' };
+}
+//# sourceMappingURL=cursor-provider-error.js.map

package/dist/core/cursor-provider-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cursor-provider-error.js","sourceRoot":"","sources":["../../src/core/cursor-provider-error.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAEnD;;;;;;;GAOG;AAEH,0EAA0E;AAC1E,MAAM,CAAC,MAAM,+BAA+B,GAAG,GAAG,CAAC;AAOnD,MAAM,kBAAkB,GAAG,eAAe,CAAC;AAC3C,MAAM,UAAU,GAAG,kDAAkD,CAAC;AAEtE;;;;;GAKG;AACH,MAAM,mBAAmB,GACvB,gQAAgQ,CAAC;AAEnQ;;;;GAIG;AACH,SAAS,2BAA2B,CAAC,IAAY;IAC/C,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;AACnG,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY;IACtD,OAAO,2BAA2B,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,+BAA+B,CAAC,CAAC;AACrF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAY,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IACxE,MAAM,MAAM,GAAG,2BAA2B,CAAC,IAAI,CAAC,CAAC;IACjD,IAAI,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC7D,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC3C,IAAI,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC;IAChE,IAAI,mBAAmB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IACnE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC"}

package/dist/core/usage-limit.js

@@ -33,7 +33,7 @@ const CLAUDE_MARKER_RE = /claude(?:\s+ai)?\s+usage\s+limit\s+reached\s*\|\s*(\d{
  * "This is a limit, not a crash." Deliberately narrow: it gates the two prose shapes below, and a
  * false positive there would schedule a resume on a timestamp that means something else entirely.
  */
-const LIMIT_PHRASE_RE = /\b(?:usage|rate|session|weekly|hourly)[\s-]?limit\b|\brate[_-]?limit(?:_error|ed)?\b|\bquota\s+(?:exceeded|reached)\b|\bout\s+of\s+(?:credits|quota)\b/i;
+const LIMIT_PHRASE_RE = /\b(?:usage|rate|session|weekly|hourly)[\s-]?limit\b|\brate[\s_-]?limit(?:_error|ed)?\b|\bquota\s+(?:exceeded|reached)\b|\bout\s+of\s+(?:credits|quota)\b/i;
 /** `…try again at 2026-08-03T18:00:00Z`, `…resets at 2026-08-03 18:00`. */
 const RESET_AT_RE = /(?:resets?|reset[s]?\s+at|try\s+again|retry|available\s+again|unlocks?)\b[^\n]{0,24}?\b(\d{4}-\d{2}-\d{2}(?:[T ]\d{2}:\d{2}(?::\d{2})?(?:\.\d+)?(?:Z|[+-]\d{2}:?\d{2})?)?)/i;
 /** `...resets 8:10pm (Europe/Warsaw)`, `...try again at 20:10`. */

package/dist/core/usage-limit.js.map

@@ -1 +1 @@
-{"version":3,"file":"usage-limit.js","sourceRoot":"","sources":["../../src/core/usage-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AASH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE5D,+FAA+F;AAC/F,MAAM,gBAAgB,GAAG,+DAA+D,CAAC;AAEzF;;;GAGG;AACH,MAAM,eAAe,GACnB,yJAAyJ,CAAC;AAE5J,2EAA2E;AAC3E,MAAM,WAAW,GACf,6KAA6K,CAAC;AAEhL,mEAAmE;AACnE,MAAM,cAAc,GAClB,kLAAkL,CAAC;AAErL,oFAAoF;AACpF,MAAM,WAAW,GACf,gJAAgJ,CAAC;AACnJ,MAAM,qBAAqB,GAAG,8CAA8C,CAAC;AAE7E,MAAM,OAAO,GAA2B;IACtC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;IAChE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACrE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;CAC/E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,mFAAmF;QACnF,iEAAiE;QACjE,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,EAAE,EAAE,CAAC;QACP,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB,EAAE,GAAW;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;aAChD,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;;YAC3D,OAAO,IAAI,CAAC;IACnB,CAAC;SAAM,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtE,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IAC/D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG;QAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1E,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,MAAc,EAAE,QAAgB,EAAE,GAAW;IACtF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/F,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChF,SAAS,GAAG,kBAAkB,CAC5B,QAAQ,CAAC,cAAc,EAAE,EACzB,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAC1B,QAAQ,CAAC,UAAU,EAAE,EACrB,IAAI,EACJ,MAAM,EACN,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,SAA6B;IAClD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,KAAa,EACb,GAAW,EACX,IAAY,EACZ,MAAc,EACd,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,SAAS,GAAG,SAAS,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QACpD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAAa;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvG,OAAO,KAAK,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YAC7C,QAAQ;YACR,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACxF,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;YACjB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;SACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,MAAM,CAAC,OAAe,EAAE,GAAW,EAAE,QAAmC;IAC/E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,GAAG,GAAG,GAAG,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC"}
+{"version":3,"file":"usage-limit.js","sourceRoot":"","sources":["../../src/core/usage-limit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AASH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,MAAM,CAAC;AAE5D,+FAA+F;AAC/F,MAAM,gBAAgB,GAAG,+DAA+D,CAAC;AAEzF;;;GAGG;AACH,MAAM,eAAe,GACnB,2JAA2J,CAAC;AAE9J,2EAA2E;AAC3E,MAAM,WAAW,GACf,6KAA6K,CAAC;AAEhL,mEAAmE;AACnE,MAAM,cAAc,GAClB,kLAAkL,CAAC;AAErL,oFAAoF;AACpF,MAAM,WAAW,GACf,gJAAgJ,CAAC;AACnJ,MAAM,qBAAqB,GAAG,8CAA8C,CAAC;AAE7E,MAAM,OAAO,GAA2B;IACtC,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK;IAChE,CAAC,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;IACrE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,SAAS;CAC/E,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAC,OAA2B,EAAE,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;IAC3E,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9B,mFAAmF;QACnF,iEAAiE;QACjE,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,CAAC;QAChD,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,EAAE,eAAe,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAEhD,MAAM,EAAE,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrC,IAAI,EAAE,EAAE,CAAC;QACP,4FAA4F;QAC5F,+FAA+F;QAC/F,+FAA+F;QAC/F,+FAA+F;QAC/F,6FAA6F;QAC7F,MAAM,KAAK,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;QAC1E,IAAI,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,MAAM,GAAG,eAAe,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC3C,IAAI,QAAQ,EAAE,CAAC;QACb,MAAM,IAAI,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAE,CAAC,WAAW,EAAE,CAAC,CAAC;QACjD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnD,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,CAAC;IAEzE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,KAAsB,EAAE,GAAW;IAC1D,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IACjC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7D,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAC3E,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,CAAC;QACzF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,IAAI,GAAG,OAAO,CAAC;IACnB,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE;YAAE,OAAO,IAAI,CAAC;QACvC,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;aAChD,IAAI,QAAQ,KAAK,IAAI;YAAE,IAAI,GAAG,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;;YAC3D,OAAO,IAAI,CAAC;IACnB,CAAC;SAAM,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,EAAE,EAAE,CAAC;QACjC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC;IACjD,IAAI,QAAQ;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC;IACtE,OAAO,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,CAAC;AAC3C,CAAC;AAED,SAAS,cAAc,CAAC,IAAY,EAAE,MAAc,EAAE,GAAW;IAC/D,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,SAAS,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACvC,IAAI,SAAS,CAAC,OAAO,EAAE,GAAG,GAAG;QAAE,SAAS,CAAC,OAAO,CAAC,SAAS,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC;IAC1E,OAAO,SAAS,CAAC,OAAO,EAAE,CAAC;AAC7B,CAAC;AAED,SAAS,mBAAmB,CAAC,IAAY,EAAE,MAAc,EAAE,QAAgB,EAAE,GAAW;IACtF,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,IAAI,SAAS,GAAG,kBAAkB,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IAC/F,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACpC,IAAI,SAAS,GAAG,GAAG,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAChF,SAAS,GAAG,kBAAkB,CAC5B,QAAQ,CAAC,cAAc,EAAE,EACzB,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,EAC1B,QAAQ,CAAC,UAAU,EAAE,EACrB,IAAI,EACJ,MAAM,EACN,QAAQ,CACT,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,aAAa,CAAC,SAA6B;IAClD,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5B,IAAI,CAAC;QACH,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9E,OAAO,SAAS,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CACzB,IAAY,EACZ,KAAa,EACb,GAAW,EACX,IAAY,EACZ,MAAc,EACd,QAAgB;IAEhB,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IACrE,IAAI,SAAS,GAAG,SAAS,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACrD,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QACjC,MAAM,IAAI,GAAG,SAAS,GAAG,MAAM,CAAC;QAChC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,SAAS,CAAC,GAAG,KAAK;YAAE,OAAO,IAAI,CAAC;QACpD,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,gBAAgB,CAAC,QAAgB,EAAE,KAAa;IACvD,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IAC1C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,KAAK,GAAG,CAAC,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;IACvG,OAAO,KAAK,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CACjB,KAAa,EACb,QAAgB;IAEhB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE;YAC7C,QAAQ;YACR,IAAI,EAAE,SAAS;YACf,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,SAAS;YACd,IAAI,EAAE,SAAS;YACf,MAAM,EAAE,SAAS;YACjB,MAAM,EAAE,SAAS;YACjB,SAAS,EAAE,KAAK;SACjB,CAAC,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAClC,MAAM,KAAK,GAAG,CAAC,IAAY,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACxF,OAAO;YACL,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC;YACrB,GAAG,EAAE,KAAK,CAAC,KAAK,CAAC;YACjB,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC;YACnB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;YACvB,MAAM,EAAE,KAAK,CAAC,QAAQ,CAAC;SACxB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,SAAS,MAAM,CAAC,OAAe,EAAE,GAAW,EAAE,QAAmC;IAC/E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3C,IAAI,OAAO,GAAG,GAAG,GAAG,uBAAuB;QAAE,OAAO,IAAI,CAAC;IACzD,OAAO,EAAE,OAAO,EAAE,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;AACjE,CAAC"}

package/dist/delegation/routes.d.ts

@@ -300,18 +300,6 @@ export declare function createDelegationRoutes(service: DelegationService, crede
 } & {
     "/:workerId": {
         $get: {
-            output: {
-                error: string;
-                code?: "invalid_input" | undefined;
-            };
-            outputFormat: "json";
-            status: 400;
-            input: {
-                param: {
-                    workerId: string;
-                };
-            };
-        } | {
             output: {
                 workerId: string;
                 parentRunId: string;
@@ -388,11 +376,7 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     workerId: string;
                 };
             };
-        };
-    };
-} & {
-    "/:workerId/collect": {
-        $post: {
+        } | {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -403,10 +387,12 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                 param: {
                     workerId: string;
                 };
-            } & {
-                json: Record<string, never>;
             };
-        } | {
+        };
+    };
+} & {
+    "/:workerId/collect": {
+        $post: {
             output: {
                 workerId: string;
                 parentRunId: string;
@@ -508,11 +494,7 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             } & {
                 json: Record<string, never>;
             };
-        };
-    };
-} & {
-    "/:workerId/steer": {
-        $post: {
+        } | {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -524,11 +506,13 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     workerId: string;
                 };
             } & {
-                json: {
-                    text: string;
-                };
+                json: Record<string, never>;
             };
-        } | {
+        };
+    };
+} & {
+    "/:workerId/steer": {
+        $post: {
             output: {
                 workerId: string;
                 state: "delivered" | "queued";
@@ -544,11 +528,7 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     text: string;
                 };
             };
-        };
-    };
-} & {
-    "/:workerId/stop": {
-        $post: {
+        } | {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -560,9 +540,15 @@ export declare function createDelegationRoutes(service: DelegationService, crede
                     workerId: string;
                 };
             } & {
-                json: Record<string, never>;
+                json: {
+                    text: string;
+                };
             };
-        } | {
+        };
+    };
+} & {
+    "/:workerId/stop": {
+        $post: {
             output: {
                 workerId: string;
                 state: "stopping" | "terminated";
@@ -576,11 +562,7 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             } & {
                 json: Record<string, never>;
             };
-        };
-    };
-} & {
-    "/:workerId/destroy": {
-        $post: {
+        } | {
             output: {
                 error: string;
                 code?: "invalid_input" | undefined;
@@ -594,7 +576,11 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             } & {
                 json: Record<string, never>;
             };
-        } | {
+        };
+    };
+} & {
+    "/:workerId/destroy": {
+        $post: {
             output: {
                 workerId: string;
                 state: "complete" | "incomplete";
@@ -617,6 +603,20 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             } & {
                 json: Record<string, never>;
             };
+        } | {
+            output: {
+                error: string;
+                code?: "invalid_input" | undefined;
+            };
+            outputFormat: "json";
+            status: 400;
+            input: {
+                param: {
+                    workerId: string;
+                };
+            } & {
+                json: Record<string, never>;
+            };
         } | {
             output: {
                 workerId: string;
@@ -646,11 +646,13 @@ export declare function createDelegationRoutes(service: DelegationService, crede
     "/:workerId/diff": {
         $get: {
             output: {
-                error: string;
-                code?: "invalid_input" | undefined;
+                workerId: string;
+                baselineSha: string;
+                diff: string;
+                truncated: boolean;
             };
             outputFormat: "json";
-            status: 400;
+            status: 200;
             input: {
                 param: {
                     workerId: string;
@@ -658,13 +660,11 @@ export declare function createDelegationRoutes(service: DelegationService, crede
             };
         } | {
             output: {
-                workerId: string;
-                baselineSha: string;
-                diff: string;
-                truncated: boolean;
+                error: string;
+                code?: "invalid_input" | undefined;
             };
             outputFormat: "json";
-            status: 200;
+            status: 400;
             input: {
                 param: {
                     workerId: string;

package/dist/delegation/transport.d.ts

@@ -67,13 +67,13 @@ export declare function createDelegationApp(routes: DelegationRoutes): import("h
             status: 200;
             input: {
                 json: {
-                    requestIds: string[];
-                    mode?: "all" | "any" | "one" | undefined;
-                    timeoutSeconds?: number | undefined;
-                } | {
                     workerIds: string[];
                     timeoutSeconds?: number | undefined;
                     mode?: "all" | "any" | "one" | undefined;
+                } | {
+                    requestIds: string[];
+                    mode?: "all" | "any" | "one" | undefined;
+                    timeoutSeconds?: number | undefined;
                 };
             };
         };

package/dist/runs/agent-tmpdir.d.ts

@@ -13,11 +13,18 @@ export declare function agentTmpDir(dataDir: string, runId: string): string;
  * like the 100-character directories #387 reports, moves to the fallback.
  */
 export declare const MAX_SOCKET_SAFE_DIR_LENGTH = 78;
+/** The first path whose UTF-8 byte length fits the socket budget, or
+ *  `undefined` when none does. Pure on purpose (#440): resolution calls it
+ *  with the real candidates, tests with synthetic ones, so the nothing-fits
+ *  branch stays exercised even though a real platform root is always short. */
+export declare function firstSocketSafeDir(paths: readonly string[]): string | undefined;
 /**
  * The temp directory this run should use: the repo-local per-run directory
- * when it is short enough for unix-socket paths, and a short directory under
- * the OS temp root when it is not (#387). Pure resolution — nothing is
- * created, nothing is probed; `agentTmpEnv` owns the side effects.
+ * when it is short enough for unix-socket paths, and otherwise a short
+ * digest-named directory under the first OS temp root whose candidate fits —
+ * the env-honouring root first, the platform default when `TMPDIR` itself is
+ * too deep (#387, #440). Pure resolution — nothing is created, nothing is
+ * probed; `agentTmpEnv` owns the side effects.
  */
 export declare function resolveAgentTmpDir(dataDir: string, runId: string): string;
 /**
@@ -58,24 +65,26 @@ export declare function agentTmpEnv(dataDir: string, runId: string, env?: NodeJS
  * agent is gone, and a Continue re-creates it through `agentTmpEnv`. Never
  * throws — reaping must not break a terminal transition.
  *
- * Both locations are tried because the resolution depends on the length of
- * `dataDir`, which a Continue or a re-base can change between mint and reap;
- * removing a name that was never minted is a no-op, so trying both is pure
- * safety.
+ * The repo-local directory and the digest name under EVERY root are tried,
+ * because the resolution depends on the lengths of `dataDir` and the ambient
+ * `TMPDIR`, either of which a Continue, a re-base or a changed env can move
+ * between mint and reap; removing a name that was never minted is a no-op, so
+ * trying them all is pure safety.
  */
 export declare function removeAgentTmpDir(dataDir: string, runId: string): void;
 /**
  * Remove every per-run directory that is not in `keepRunIds` — the startup
  * sweep, so a crash (which never reaches the terminal-transition reap) cannot
- * accumulate them forever. Two confined roots are swept and nothing else:
+ * accumulate them forever. Three confined sets are swept and nothing else:
  *
  *   - `<dataDir>/tmp`, where entries ARE the run ids (reports the ids reaped);
- *   - the OS temp root's `cez-agent-<12 hex>` directories (#387), where the
- *     name digests the dataDir and is not reversible to a run id (reports the
+ *   - the `cez-agent-<12 hex>` directories under EVERY OS temp root — the
+ *     env-honouring root and the platform default (#440) — where the name
+ *     digests the dataDir and is not reversible to a run id (reports the
  *     directory names reaped). The pattern is exact — prefix, lowercase hex,
  *     fixed length, directories only — and a directory is removed only when
  *     its `.cez-owner` marker names THIS dataDir and none of this dataDir's
- *     kept runs claims it, so another project's scratch in the shared root is
+ *     kept runs claims it, so another project's scratch in a shared root is
  *     never touched.
  */
 export declare function sweepAgentTmpDirs(dataDir: string, keepRunIds: Iterable<string>): string[];

package/dist/runs/agent-tmpdir.js

@@ -30,7 +30,12 @@
  *      typechecking inside the run. A directory that would land too deep
  *      resolves instead to a short digest-named directory under the OS temp
  *      root — still per-run, still probed, still reaped. A repo whose own path
- *      already fits keeps today's directory, byte for byte.
+ *      already fits keeps today's directory, byte for byte. When the ambient
+ *      `TMPDIR` itself is too deep for that root's candidate (#440 — routine
+ *      inside a cezar task session, whose `TMPDIR` is the checkout's own
+ *      scratch tree per #785), the next root is the platform's own temp root
+ *      (`/tmp`), which `TMPDIR` cannot deepen; only when no root fits does the
+ *      spawn refuse.
  *
  * `CEZ_AGENT_TMPDIR=0` opts out of ALL THREE — cezar keeps its hands off the
  * temp directory entirely and the pre-#785 behaviour is back, byte for byte.
@@ -85,6 +90,33 @@ function osTempRoot() {
         return tmpdir();
     }
 }
+/** The platform's own temp root — the one `TMPDIR`/`TEMP`/`TMP` cannot move.
+ *  POSIX spells it `/tmp` (resolved through symlinks for the same reason
+ *  `osTempRoot` resolves them). Windows has no such constant and no named
+ *  unix sockets to protect, so it contributes no second root and keeps
+ *  today's single-root behaviour. */
+function platformTempRoot() {
+    if (process.platform === 'win32')
+        return undefined;
+    try {
+        return realpathSync('/tmp');
+    }
+    catch {
+        return '/tmp';
+    }
+}
+/** Every root a fallback directory can hang off, most preferred first: the
+ *  env-honouring OS temp root, then the platform default (#440). A cezar task
+ *  session exports a `TMPDIR` as deep as the checkout it belongs to (#785),
+ *  so the first root's candidate can itself cross the socket cap while the
+ *  platform default still fits. Resolution picks the first root whose
+ *  candidate fits; removal and the sweep walk them all, because the env can
+ *  differ between mint and reap. */
+function osTempRoots() {
+    const env = osTempRoot();
+    const platform = platformTempRoot();
+    return platform && platform !== env ? [env, platform] : [env];
+}
 const FALLBACK_PREFIX = 'cez-agent-';
 const FALLBACK_NAME_LENGTH = 12;
 /** The marker file inside a fallback directory naming the dataDir that minted
@@ -124,39 +156,52 @@ function writeOwnerMarker(dir, dataDir) {
     }
 }
 /**
- * Where the fallback lives for this dataDir+run pair. The name digests the
- * dataDir in, because the OS temp root is SHARED: a name derived from the run
- * id alone would let one repo's reap delete another repo's live scratch when
- * two run ids happen to share their leading characters. The name alone cannot
- * make the sweep safe — a digest is not reversible, so a sweep could not tell
- * its own stale directories from another project's live ones — which is why
- * every fallback directory also carries the `.cez-owner` marker.
+ * Where the fallback lives for this dataDir+run pair under one root. The name
+ * digests the dataDir in, because the OS temp roots are SHARED: a name derived
+ * from the run id alone would let one repo's reap delete another repo's live
+ * scratch when two run ids happen to share their leading characters. The name
+ * alone cannot make the sweep safe — a digest is not reversible, so a sweep
+ * could not tell its own stale directories from another project's live ones —
+ * which is why every fallback directory also carries the `.cez-owner` marker.
+ * The digest does not include the root, so the name is stable across roots:
+ * whatever env a later reap or sweep runs under, it can find the directory.
  */
-function fallbackTmpDir(dataDir, runId) {
+function fallbackTmpDir(root, dataDir, runId) {
     const digest = createHash('sha256').update(`${dataDir}:${runId}`).digest('hex');
-    return join(osTempRoot(), FALLBACK_PREFIX + digest.slice(0, FALLBACK_NAME_LENGTH));
+    return join(root, FALLBACK_PREFIX + digest.slice(0, FALLBACK_NAME_LENGTH));
+}
+/** The first path whose UTF-8 byte length fits the socket budget, or
+ *  `undefined` when none does. Pure on purpose (#440): resolution calls it
+ *  with the real candidates, tests with synthetic ones, so the nothing-fits
+ *  branch stays exercised even though a real platform root is always short. */
+export function firstSocketSafeDir(paths) {
+    return paths.find((path) => Buffer.byteLength(path, 'utf8') <= MAX_SOCKET_SAFE_DIR_LENGTH);
 }
 /**
  * The temp directory this run should use: the repo-local per-run directory
- * when it is short enough for unix-socket paths, and a short directory under
- * the OS temp root when it is not (#387). Pure resolution — nothing is
- * created, nothing is probed; `agentTmpEnv` owns the side effects.
+ * when it is short enough for unix-socket paths, and otherwise a short
+ * digest-named directory under the first OS temp root whose candidate fits —
+ * the env-honouring root first, the platform default when `TMPDIR` itself is
+ * too deep (#387, #440). Pure resolution — nothing is created, nothing is
+ * probed; `agentTmpEnv` owns the side effects.
  */
 export function resolveAgentTmpDir(dataDir, runId) {
     const local = agentTmpDir(dataDir, runId);
     if (Buffer.byteLength(local, 'utf8') <= MAX_SOCKET_SAFE_DIR_LENGTH)
         return local;
-    const fallback = fallbackTmpDir(dataDir, runId);
-    if (Buffer.byteLength(fallback, 'utf8') <= MAX_SOCKET_SAFE_DIR_LENGTH)
+    const candidates = osTempRoots().map((root) => fallbackTmpDir(root, dataDir, runId));
+    const fallback = firstSocketSafeDir(candidates);
+    if (fallback)
         return fallback;
-    // Nothing fits — a host TMPDIR so long that even the OS-root candidate
-    // crosses the cap. Minting either would hand the agent a temp directory
-    // that cannot serve unix sockets: the silent failure #387 is about. Fail
-    // the spawn with the named error instead; the remedy names the escape.
-    throw new AgentTempDirError(Buffer.byteLength(fallback) < Buffer.byteLength(local) ? fallback : local, new Error(`no socket-safe temp directory exists — repo-local path is `
-        + `${Buffer.byteLength(local)} bytes and the OS temp root candidate is `
-        + `${Buffer.byteLength(fallback)} bytes, both past the `
-        + `${MAX_SOCKET_SAFE_DIR_LENGTH}-byte unix socket budget`));
+    // Nothing fits — every root, the platform default included, has a candidate
+    // past the cap. Minting any would hand the agent a temp directory that
+    // cannot serve unix sockets: the silent failure #387 is about. Fail the
+    // spawn with the named error instead; the remedy names the escape.
+    const shortest = candidates.reduce((a, b) => Buffer.byteLength(a, 'utf8') < Buffer.byteLength(b, 'utf8') ? a : b);
+    throw new AgentTempDirError(Buffer.byteLength(shortest) < Buffer.byteLength(local) ? shortest : local, new Error(`no socket-safe temp directory exists — repo-local path is `
+        + `${Buffer.byteLength(local)} bytes and every OS temp root candidate is past the `
+        + `${MAX_SOCKET_SAFE_DIR_LENGTH}-byte unix socket budget (tried: `
+        + candidates.map((c) => `${c} (${Buffer.byteLength(c)} bytes)`).join(', ') + ')'));
 }
 /** `errno` → the phrasing a human recognises from their shell. */
 const REASONS = {
@@ -259,15 +304,17 @@ export function agentTmpEnv(dataDir, runId, env = process.env) {
  * agent is gone, and a Continue re-creates it through `agentTmpEnv`. Never
  * throws — reaping must not break a terminal transition.
  *
- * Both locations are tried because the resolution depends on the length of
- * `dataDir`, which a Continue or a re-base can change between mint and reap;
- * removing a name that was never minted is a no-op, so trying both is pure
- * safety.
+ * The repo-local directory and the digest name under EVERY root are tried,
+ * because the resolution depends on the lengths of `dataDir` and the ambient
+ * `TMPDIR`, either of which a Continue, a re-base or a changed env can move
+ * between mint and reap; removing a name that was never minted is a no-op, so
+ * trying them all is pure safety.
  */
 export function removeAgentTmpDir(dataDir, runId) {
     if (!safeRunId(runId))
         return;
-    for (const dir of [agentTmpDir(dataDir, runId), fallbackTmpDir(dataDir, runId)]) {
+    const locations = [agentTmpDir(dataDir, runId), ...osTempRoots().map((root) => fallbackTmpDir(root, dataDir, runId))];
+    for (const dir of locations) {
         try {
             rmSync(dir, { recursive: true, force: true });
         }
@@ -279,15 +326,16 @@ export function removeAgentTmpDir(dataDir, runId) {
 /**
  * Remove every per-run directory that is not in `keepRunIds` — the startup
  * sweep, so a crash (which never reaches the terminal-transition reap) cannot
- * accumulate them forever. Two confined roots are swept and nothing else:
+ * accumulate them forever. Three confined sets are swept and nothing else:
  *
  *   - `<dataDir>/tmp`, where entries ARE the run ids (reports the ids reaped);
- *   - the OS temp root's `cez-agent-<12 hex>` directories (#387), where the
- *     name digests the dataDir and is not reversible to a run id (reports the
+ *   - the `cez-agent-<12 hex>` directories under EVERY OS temp root — the
+ *     env-honouring root and the platform default (#440) — where the name
+ *     digests the dataDir and is not reversible to a run id (reports the
  *     directory names reaped). The pattern is exact — prefix, lowercase hex,
  *     fixed length, directories only — and a directory is removed only when
  *     its `.cez-owner` marker names THIS dataDir and none of this dataDir's
- *     kept runs claims it, so another project's scratch in the shared root is
+ *     kept runs claims it, so another project's scratch in a shared root is
  *     never touched.
  */
 export function sweepAgentTmpDirs(dataDir, keepRunIds) {
@@ -316,44 +364,45 @@ export function sweepAgentTmpDirs(dataDir, keepRunIds) {
             }
         }
     }
-    // The #387 fallback location, in the shared OS temp root. Kept narrow on
+    // The #387 fallback locations, in every shared OS temp root. Kept narrow on
     // purpose: exact prefix, 12 lowercase-hex name, directories only, and
     // ownership — a directory is removed only when its `.cez-owner` marker
     // names THIS dataDir (a marker that is missing or foreign is another
     // project's, or unknown, and is never ours to remove) and none of this
     // dataDir's kept runs claims it.
     const owner = dataDirOwner(dataDir);
-    const claimed = new Set([...keep].filter(safeRunId).map((id) => basename(fallbackTmpDir(dataDir, id))));
-    const osRoot = osTempRoot();
-    let fallbackEntries;
-    try {
-        fallbackEntries = readdirSync(osRoot, { withFileTypes: true });
-    }
-    catch {
-        return reaped;
-    }
-    for (const entry of fallbackEntries) {
-        if (!entry.isDirectory() || !entry.name.startsWith(FALLBACK_PREFIX))
-            continue;
-        if (!/^[0-9a-f]{12}$/.test(entry.name.slice(FALLBACK_PREFIX.length)))
-            continue;
-        let entryOwner;
+    const claimed = new Set([...keep].filter(safeRunId).map((id) => basename(fallbackTmpDir(osTempRoot(), dataDir, id))));
+    for (const osRoot of osTempRoots()) {
+        let fallbackEntries;
         try {
-            entryOwner = readFileSync(join(osRoot, entry.name, OWNER_FILE), 'utf8').trim();
+            fallbackEntries = readdirSync(osRoot, { withFileTypes: true });
         }
         catch {
-            continue; // no readable marker: unknown ownership is never ours to remove.
+            continue; // an unreadable root is skipped, not fatal: others remain.
         }
-        if (entryOwner !== owner)
-            continue;
-        if (claimed.has(entry.name))
-            continue;
-        try {
-            rmSync(join(osRoot, entry.name), { recursive: true, force: true });
-            reaped.push(entry.name);
-        }
-        catch {
-            // best-effort: a locked directory is retried on the next boot.
+        for (const entry of fallbackEntries) {
+            if (!entry.isDirectory() || !entry.name.startsWith(FALLBACK_PREFIX))
+                continue;
+            if (!/^[0-9a-f]{12}$/.test(entry.name.slice(FALLBACK_PREFIX.length)))
+                continue;
+            let entryOwner;
+            try {
+                entryOwner = readFileSync(join(osRoot, entry.name, OWNER_FILE), 'utf8').trim();
+            }
+            catch {
+                continue; // no readable marker: unknown ownership is never ours to remove.
+            }
+            if (entryOwner !== owner)
+                continue;
+            if (claimed.has(entry.name))
+                continue;
+            try {
+                rmSync(join(osRoot, entry.name), { recursive: true, force: true });
+                reaped.push(entry.name);
+            }
+            catch {
+                // best-effort: a locked directory is retried on the next boot.
+            }
         }
     }
     return reaped;