agent-relay-runner 0.129.11 → 0.129.13

package/src/runner-core.ts

@@ -2,31 +2,34 @@ import { hostname } from "node:os";
 import { mkdirSync, writeFileSync } from "node:fs";
 import { dirname, join } from "node:path";
 import type { AgentLifecycle, AgentProfile, ContextState, Message, MessageSessionMeta, ProviderState, SendMessageInput, TaskStatusInput, WorkspaceMetadata } from "agent-relay-sdk";
-import { errMessage, RelayBusClient, RelayHttpClient } from "agent-relay-sdk";
+import { errMessage, RelayBusClient, RelayHttpClient, isCodexLeanWorkerProfile, CODEX_WORKER_ONDEMAND_TOOLS } from "agent-relay-sdk";
 import { contextStateFromProbeMetrics, quotaStateFromProbeMetrics } from "agent-relay-sdk/context-probe";
 import { isPidAlive } from "agent-relay-sdk/process-utils";
 import { providerAttachmentText, providerMessageText } from "./adapter";
 import { computeLivenessSignal, type LivenessInputs } from "./liveness";
-import type { ManagedProcess, ProviderAdapter, ProviderConfig, ProviderPermissionDecision, ProviderPermissionDecisionInput, ProviderSessionEvent, ProviderSessionEventBatch, ProviderSessionTurnContext, ProviderSessionTurnInput, ProviderStatusUpdate, ProviderUserPromptInput, RunnerSpawnConfig, SemanticStatus, TerminalAttachSpec } from "./adapter";
+import type { ManagedProcess, PaneObservation, ProviderAdapter, ProviderConfig, ProviderPermissionDecision, ProviderPermissionDecisionInput, ProviderSessionEvent, ProviderSessionEventBatch, ProviderSessionTurnContext, ProviderSessionTurnInput, ProviderStatusUpdate, ProviderUserPromptInput, RunnerSpawnConfig, SemanticStatus, TerminalAttachSpec } from "./adapter";
 import { messagesWithCachedAttachments } from "./attachment-cache";
 import { ClaimTracker } from "./claim-tracker";
 import { ProviderQuotaHarvest } from "./adapters/provider-quota-harvest";
 import { readRunnerContextProbeState } from "./context-probe-state";
+import { transcriptDerivedContext, type TranscriptContextCache } from "./transcript-context";
 import { startControlServer, type ControlServer, type ResolvedPermissionPrompt } from "./control-server";
 import { ReplyObligationCache, obligationRequiresExplicitReply, responseCaptureReplyRoute } from "./reply-obligation-cache";
 import { Outbox, type OutboxRecord } from "./outbox";
 import { getManifest } from "agent-relay-providers";
 import { profileUsesProviderHostGlobals } from "./profile-home";
 import { RELAY_MCP_TOKEN_ENV, relayMcpEndpoint, resolveSharedMcpUrl } from "./relay-mcp";
-import { RelayMcpProxy } from "./relay-mcp-proxy";
+import { RelayMcpProxy, isolatedWorkspaceDescriptor } from "./relay-mcp-proxy";
 import { runtimeMetadata } from "./version";
 import { logger, parseLogLevel } from "./logger";
 import { ensureSessionScratch, reapSessionLauncher, reapSessionScratch, sweepStaleLaunchers, sweepStaleSessions, type SessionScratchLayout } from "./session-scratch";
 import { deliverBufferedMcpCall as deliverBufferedMcpOutboxCall, deliverRunnerOutboxEvent } from "./mcp-outbox";
 import { RunnerInsights } from "./runner-insights";
 import { BusyReconciler } from "./busy-reconciler";
+import { reconciledTurnTimelineEvent } from "./turn-reconcile-event";
 import { publishCapturedResponse } from "./response-capture-report";
 import { PendingPermissionStore, type PendingPermissionRequestRecord } from "./pending-permission-store";
+import { ProviderInputQueue, type ProviderInputTicket } from "./provider-input-queue";
 import { runnerLaunchInjectionSessionEvents, type RunnerRelayInjectionEvent } from "./relay-injection-events";
 import { providerTerminalSession, providerTerminalSocket } from "./process-meta";
 import { capsFromEnv, logLevelFromEnv, mcpProxyEnabledFromEnv, orchestratorBaseDirFromEnv, orchestratorUrlFromEnv, registrationTimeoutMsFromEnv, runnerInfoFileFromEnv, runnerLogFileFromEnv, runnerOutboxDirWithInfoFallback, sessionDebugEnabled, tagsFromEnv, workspaceModeFromEnv } from "./config";
@@ -41,7 +44,9 @@ import {
   isContextState,
   isHttpAuthError,
   isHttpStatusError,
+  isTurnInProgressDeliveryError,
   lifecycleCapabilities,
+  PROVIDER_INPUT_COMMAND_TYPES,
   providerExitLastError,
   providerExitDiagnostics,
   providerExitResumeId,
@@ -183,6 +188,14 @@ export class AgentRunner {
   // delivery (and vice versa); its backoff is capped low since a stale live-mirror frame is cheap.
   private readonly sessionOutbox: Outbox;
   private readonly pendingPermissionStore: PendingPermissionStore;
+  // #1565 F1 — the one gate in front of the provider's single input channel. Every payload the
+  // runner delivers (message batch, injected prompt, self-resume continuation, memory preamble)
+  // passes through it, so two payloads for one agent can never interleave at the wire. FIFO, with
+  // the place in line taken synchronously at dispatch, so the payload the relay created first is
+  // the one delivered first.
+  private readonly providerInput = new ProviderInputQueue({
+    onStuck: (heldMs) => logger.warn("delivery", `provider input stream held for ${heldMs}ms; force-releasing so delivery cannot wedge`),
+  });
   private sessionBatchSeq = 0;
   private readonly insights: RunnerInsights;
   private readonly busyReconciler: BusyReconciler;
@@ -232,6 +245,14 @@ export class AgentRunner {
   // Last transcript path seen this session — used by end-of-session Insights (#184)
   // when the SessionEnd hook payload omits it.
   private lastTranscriptPath?: string;
+  // #1512: mtime-keyed cache of the last transcript-derived context usage, so the
+  // heartbeat's fallback parse doesn't re-read a large transcript that hasn't changed.
+  private transcriptContextCache?: TranscriptContextCache;
+  // #1235 — true while a monitorless (hookless) provider turn is being mirrored natively:
+  // the adapter supplied a transcript path on the provider-turn busy edge, so the runner
+  // drives the reasoning tail itself (start on busy, final-capture on idle) instead of via
+  // Stop/UserPromptSubmit hooks the lean/isolated worker never installs.
+  private nativeSessionCaptureActive = false;
   private lifecycleAction?: LifecycleAction;
   // Coalesces concurrent pre-session-destroy runs (e.g. the shutdown bus command and the
   // SessionEnd hook both fire for the same teardown) so the cursor isn't raced.
@@ -423,8 +444,45 @@ export class AgentRunner {
   }
 
   private registerProviderSessionRoutes(): void {
-    this.options.adapter.onSessionEvent?.((event) => { void this.publishProviderSessionEvent(event); });
-    this.options.adapter.onSessionEvents?.((events) => { void this.publishProviderSessionEvents(events); });
+    // (#1617) — neither publisher has a try/catch of its own, and both bottom out in
+    // sessionOutbox.enqueue: a synchronous bun:sqlite INSERT that throws outright once the outbox
+    // is closed (teardown ordering in stop(): the adapter keeps emitting after close) or the
+    // database errors. This is the highest-frequency fire-and-forget site in the runner — every
+    // provider session event passes through it — so leaving it unguarded is the likeliest way a
+    // live agent silently stops existing (Bun exits(1) on an unhandled rejection, #1614).
+    this.options.adapter.onSessionEvent?.((event) => { void this.publishProviderSessionEvent(event).catch((error) => this.reportBackgroundRejection("provider session event publish", "session.publish_failed", "Provider session event not mirrored", error)); });
+    this.options.adapter.onSessionEvents?.((events) => { void this.publishProviderSessionEvents(events).catch((error) => this.reportBackgroundRejection("provider session event batch publish", "session.publish_failed", "Provider session events not mirrored", error)); });
+  }
+
+  // The adapter's status seam, split out of run() (#1617) so the guarded restart call below is
+  // reachable without booting a whole runner — the crash it guards against is exactly the one a
+  // test has to be able to drive.
+  /**
+   * #1651 — the terminus of the pane-diagnostic channel. It writes to the session log and
+   * stops. This method exists to be boring: it is the proof that a pane reading has somewhere
+   * to go OTHER than setProviderStatus, which is what let the five prompt gates and the
+   * connection-retry detector be stripped of their authority without going silent. If a future
+   * change makes this mutate anything, it has re-created the defect class #1651 closed.
+   */
+  private recordPaneObservation(observation: PaneObservation): void {
+    const detail = observation.message ? `: ${observation.message}` : "";
+    this.sessionLog(`pane observation (advisory, no state change) ${observation.eventType}/${observation.detectorId}${detail}`);
+  }
+
+  private handleAdapterStatusChange(status: ProviderStatusUpdate): void {
+    if (this.restartInProgress || this.restartPending) return;
+    const semanticStatus = typeof status === "string" ? status : status.status;
+    if (this.shouldRestartUnexpectedProviderExit(semanticStatus)) {
+      // (#1617) — restartUnexpectedProviderExit is an outer try/finally with NO catch wrapped
+      // around awaited work that can still throw (recoverNativeSelfResumeExit, the undetermined-
+      // exit confirmation read, the timeline/status publishes). A reject here used to kill the
+      // runner outright: the crash path for the exact situation this method exists to recover
+      // from, on a runner nothing respawns (#1618).
+      void this.restartUnexpectedProviderExit(semanticStatus).catch((error) => this.reportBackgroundRejection("unexpected provider exit restart", "provider.restart_failed", "Provider restart after unexpected exit failed", error));
+      return;
+    }
+    this.setProviderStatus(status);
+    if (runnerShouldResolveProviderExit(semanticStatus, this.exitCommandInProgress)) this.options.onProviderExit?.(semanticStatus === "offline" ? 0 : 1);
   }
 
   async run(): Promise<void> {
@@ -449,16 +507,8 @@ export class AgentRunner {
     });
     this.startMcpProxy();
     this.writeRunnerInfoFile();
-    this.options.adapter.onStatusChange((status) => {
-      if (this.restartInProgress || this.restartPending) return;
-      const semanticStatus = typeof status === "string" ? status : status.status;
-      if (this.shouldRestartUnexpectedProviderExit(semanticStatus)) {
-        void this.restartUnexpectedProviderExit(semanticStatus);
-        return;
-      }
-      this.setProviderStatus(status);
-      if (runnerShouldResolveProviderExit(semanticStatus, this.exitCommandInProgress)) this.options.onProviderExit?.(semanticStatus === "offline" ? 0 : 1);
-    });
+    this.options.adapter.onStatusChange((status) => this.handleAdapterStatusChange(status));
+    this.options.adapter.onPaneObservation?.((observation) => this.recordPaneObservation(observation));
     this.registerProviderSessionRoutes();
     this.bus.on("message.new", (message) => {
       // A delivered message may create a new reply obligation — warm the snapshot so the
@@ -468,7 +518,7 @@ export class AgentRunner {
       this.enqueueMessage(msg);
     });
     this.bus.on("command", (type, params, commandId, command) => {
-      void this.handleCommand(type, params, commandId, command);
+      this.dispatchCommand(type, params, commandId, command);
     });
     this.bus.on("error", (code, message) => this.handleBusError(String(code), String(message)));
     await registerWithinDeadline(this.bus, registrationTimeoutMsFromEnv(), this.options.relayUrl, (reason) => logger.fatal("register", reason));
@@ -516,6 +566,7 @@ export class AgentRunner {
     this.disarmBusyLivenessReconcile();
     this.busyReconciler.disarm();
     this.stopReasoningTail();
+    this.nativeSessionCaptureActive = false;
     this.obligationCache.stop();
     this.outbox.close(); this.sessionOutbox.close(); this.pendingPermissionStore.close();
     this.proxy?.stop();
@@ -527,9 +578,24 @@ export class AgentRunner {
   // relay with the runner's LIVE token, buffers bufferable writes durably during a relay outage,
   // and narrows the tool list to this agent's workspace context. Best-effort: if it can't bind,
   // we fall back to a direct relay MCP connection (the agent env still works, no resilience).
+  // #1450 — the on-demand relay set to hide from a lean Codex worker's DIRECT relay client (so only
+  // the eager hot-path set boots), or undefined for any agent that keeps its full relay surface. The
+  // gate MIRRORS the callmux relay-downstream gate (launch-assembly) EXACTLY — worker profile, no
+  // client-native tool deferral, sharedMcp on (the metaOnly callmux that fronts these exists), relay
+  // mcp on — so the direct client is narrowed only when callmux is simultaneously fronting the set.
+  // ("proxy active" is implicit: only a constructed proxy consults this, and the relay downstream is
+  // added only when the proxy is active — the two are on/off together, never a half state.)
+  private codexWorkerOnDemandTools(): Set<string> | undefined {
+    const profile = this.options.agentProfile;
+    if (!isCodexLeanWorkerProfile(profile?.name) || !profile?.sharedMcp || profile?.relay?.mcp === false) return undefined;
+    if (getManifest(this.options.provider)?.mcpToolManifest?.clientNativeToolDeferral !== false) return undefined;
+    return new Set(CODEX_WORKER_ONDEMAND_TOOLS);
+  }
+
   private startMcpProxy(): void {
     if (!this.mcpProxyEnabled) return;
     try {
+      const onDemandTools = this.codexWorkerOnDemandTools();
       this.proxy = new RelayMcpProxy({
         relayMcpEndpoint: relayMcpEndpoint(this.options.relayUrl),
         getToken: () => this.currentToken,
@@ -541,7 +607,8 @@ export class AgentRunner {
             idempotencyKey: call.idempotencyKey,
           });
         },
-        initialContext: { isolatedWorktree: this.ownsIsolatedWorktree() },
+        initialContext: { isolatedWorktree: this.ownsIsolatedWorktree(), workspaceDescriptor: isolatedWorkspaceDescriptor(this.options.workspace, this.ownsIsolatedWorktree()) },
+        ...(onDemandTools ? { onDemandTools } : {}),
       });
       this.mcpProxyEndpoint = this.proxy.start().url;
       logger.info("mcp-proxy", `runner MCP proxy listening at ${this.mcpProxyEndpoint} (worktree=${this.ownsIsolatedWorktree()})`);
@@ -617,6 +684,10 @@ export class AgentRunner {
       // Stage 2 (#215): the MCP endpoint the agent's client should target — the runner-local
       // proxy when active, undefined when disabled (adapters fall back to the direct relay URL).
       ...(this.mcpProxyEndpoint ? { relayMcpEndpoint: this.mcpProxyEndpoint } : {}),
+      // #1450: the proxy secret, exposed to the assembler ONLY when the proxy is active, so the
+      // Codex per-agent metaOnly callmux can reach the relay endpoint on-demand THROUGH the proxy
+      // (live-token-injected — never the relay token on disk, #215).
+      ...(this.mcpProxyEndpoint ? { mcpProxySecret: this.mcpProxySecret } : {}),
       // #672: the shared host-listener URL the `callmux bridge` connects to (env → default).
       // Always resolved; the assembler only emits the bridge when `agentProfile.sharedMcp` is on.
       sharedMcpUrl: resolveSharedMcpUrl(),
@@ -689,7 +760,7 @@ export class AgentRunner {
     this.deliveringInitialPrompt = true;
     const attempt = (this.initialPromptAttempts += 1);
     try {
-      this.recordInjectedPrompt(prompt); await this.options.adapter.deliverInitialPrompt(this.process, prompt, { readyTimeoutMs, isInitial: true });
+      this.recordInjectedPrompt(prompt); await this.providerInput.run(() => this.options.adapter.deliverInitialPrompt!(this.process!, prompt, { readyTimeoutMs, isInitial: true }));
       this.pendingInitialPrompt = undefined;
     } catch (error) {
       const giveUp = attempt >= MAX_INITIAL_PROMPT_ATTEMPTS;
@@ -754,7 +825,9 @@ export class AgentRunner {
         agentId: this.agentId,
         onError: (message) => logger.error("runner", message),
       });
-      await this.options.adapter.deliver(this.process, prepared);
+      // #1565 F1 — behind the same gate as injected payloads: a message batch and a boundary
+      // inject arriving together must not paste into each other.
+      await this.providerInput.run(() => this.options.adapter.deliver(this.process!, prepared));
       for (const message of deliverable) {
         await this.http.recordMessageDeliveryAttempt(message.id, { agentId: this.agentId, status: "delivered" }).catch(() => {});
         await this.http.markRead(message.id, this.agentId).catch(() => {});
@@ -774,7 +847,24 @@ export class AgentRunner {
     }
   }
 
-  private async handleCommand(type: string, params: Record<string, unknown>, commandId: string, command?: Record<string, unknown>): Promise<void> {
+  /**
+   * The bus dispatch seam (#1565 F1).
+   *
+   * Commands that put a payload into the provider's input channel take their place in the
+   * `providerInput` queue HERE, synchronously, before the first `await` — so the order the relay
+   * created them in (continuation first, memory beside it) is the order they are delivered in, no
+   * matter how long each command's own bookkeeping takes. Everything else keeps dispatching
+   * fire-and-forget: the gate is on the wire, not on command handling.
+   *
+   * The ticket is released when the command settles even if delivery never happened (a throw before
+   * the deliver, an unsupported provider), so a failed command can never wedge the stream.
+   */
+  private dispatchCommand(type: string, params: Record<string, unknown>, commandId: string, command?: Record<string, unknown>): void {
+    const ticket = PROVIDER_INPUT_COMMAND_TYPES.has(type) ? this.providerInput.reserve() : undefined;
+    void this.handleCommand(type, params, commandId, command, ticket).finally(() => ticket?.release());
+  }
+
+  private async handleCommand(type: string, params: Record<string, unknown>, commandId: string, command?: Record<string, unknown>, ticket?: ProviderInputTicket): Promise<void> {
     const target = typeof command?.target === "string" ? command.target : this.agentId;
     if (target !== this.agentId && target !== this.options.runnerId) return;
     if (type !== "agent.shutdown" && type !== "agent.restart" && type !== "agent.reconnect" && type !== "agent.kill" && type !== "agent.compact" && type !== "agent.clearContext" && type !== "agent.injectContext" && type !== "agent.permissionDecision" && type !== "agent.interrupt" && type !== "prompt.inject") return;
@@ -814,6 +904,8 @@ export class AgentRunner {
       } else if (type === "agent.clearContext") {
         if (!this.options.adapter.clearContext || !this.process) throw new Error("provider does not support clearContext");
         providerResult = await this.options.adapter.clearContext(this.process);
+        const coupled = await this.deliverCoupledContinuationAfterClear(params, providerResult || undefined, ticket);
+        if (coupled) providerResult = { ...(providerResult ?? {}), ...coupled };
       } else if (type === "agent.interrupt") {
         if (!this.options.adapter.interrupt || !this.process) throw new Error("provider does not support interrupt");
         const redirect = params.redirect && typeof params.redirect === "object" && !Array.isArray(params.redirect)
@@ -829,11 +921,11 @@ export class AgentRunner {
         if (redirect) providerResult = { interrupt: providerResult, redirect: await this.injectPrompt(redirect) };
       } else if (type === "agent.injectContext") {
         if (!this.process) throw new Error("provider process is unavailable");
-        providerResult = await this.injectContext(params);
+        providerResult = await this.injectContext(params, ticket);
       } else if (type === "agent.permissionDecision") {
         providerResult = await this.respondToPermissionDecision(params);
       } else if (type === "prompt.inject") {
-        providerResult = await this.injectPrompt(params);
+        providerResult = await this.injectPrompt(params, ticket);
       } else await this.shutdownProvider(type === "agent.kill", commandTimeoutMs(params));
       await this.updateCommand(commandId, "succeeded", {
         action: type,
@@ -868,7 +960,54 @@ export class AgentRunner {
     }
   }
 
-  private async injectContext(params: Record<string, unknown>): Promise<Record<string, unknown>> {
+  // #1588 — couple the self-resume continuation delivery into the SAME clearContext command that
+  // wipes the context, so the two can never race across separate commands/transports again. The
+  // relay embeds the fully-built (identity-augmented) continuation in the clear command's
+  // `selfResume.continuation`; we deliver it in-process, strictly AFTER adapter.clearContext has
+  // returned. `continuationDelivered` tells the relay whether it can skip the redundant reactive
+  // inject or must still fire its #1023 backstop — and it MUST be truthful, because the relay skips
+  // BOTH backstops on continuationDelivered===true, so a false-positive true is a silent-wipe risk
+  // with no recovery. So `true` requires TWO things: (1) the adapter's clear-aware barrier
+  // POSITIVELY confirmed the TUI clear committed (clearResult.clearConfirmed === true — the strong
+  // clear-committed evidence), and (2) the in-process deliver resolved. A settle timeout / uncertain
+  // clear → clearConfirmed !== true → we still deliver in-process (best effort) but report false so
+  // the backstop re-injects. Uncertainty ALWAYS resolves to false (backstop covers), never true.
+  private async deliverCoupledContinuationAfterClear(params: Record<string, unknown>, clearResult: Record<string, unknown> | undefined, ticket?: ProviderInputTicket): Promise<Record<string, unknown> | undefined> {
+    // Opt-in per provider: only adapters whose clearContext is a fire-and-forget keystroke with no
+    // completion barrier (Claude) couple the continuation in-process. Codex's clearContext is an
+    // awaited atomic threadStart (the await IS the barrier), so it keeps the separate confirmed-inject
+    // flow untouched — never sets continuationDelivered, so the relay never skips its reactive inject.
+    if (!this.options.adapter.couplesClearInjectContinuation) return undefined;
+    const selfResume = params.selfResume !== null && typeof params.selfResume === "object" && !Array.isArray(params.selfResume)
+      ? params.selfResume as Record<string, unknown>
+      : undefined;
+    if (!selfResume || selfResume.mode !== "clear-inject") return undefined;
+    const continuation = typeof selfResume.continuation === "string" ? selfResume.continuation.trim() : "";
+    if (!continuation) return undefined;
+    // Only a genuine clear-commit confirmation from the adapter's clear-aware barrier permits a
+    // truthful continuationDelivered:true. Absent/false (older runner, or a settle timeout) → false.
+    const clearConfirmed = clearResult?.clearConfirmed === true;
+    try {
+      // #1607 N3 — reuse the outer clearContext ticket instead of letting injectContext reserve a
+      // fresh one, which would queue behind (and thus deadlock on) the still-held outer ticket.
+      await this.injectContext({ content: continuation, reason: "self-resume-continuation", selfResume }, ticket);
+      if (!clearConfirmed) {
+        // Deliver ran, but the clear was NOT positively confirmed committed — the continuation may
+        // have raced a still-processing clear. Report false so the relay backstop re-injects out of
+        // band. A redundant re-inject is always preferable to a silent wipe.
+        this.sessionLog("coupled self-resume continuation delivered but clear commit was NOT confirmed; relay backstop will re-inject");
+      }
+      return { continuationDelivered: clearConfirmed };
+    } catch (error) {
+      // The clear already ran — reporting the command as failed would strand the agent with the
+      // relay unaware its context is gone. Instead report the clear succeeded WITHOUT
+      // continuationDelivered so the relay's reactive/sweep backstop re-injects out-of-band.
+      this.sessionLog(`coupled self-resume continuation delivery failed, relay backstop will retry: ${errMessage(error)}`);
+      return { continuationDelivered: false };
+    }
+  }
+
+  private async injectContext(params: Record<string, unknown>, ticket?: ProviderInputTicket): Promise<Record<string, unknown>> {
     const content = typeof params.content === "string" ? params.content.trim() : "";
     if (!content) throw new Error("content required");
     const memoryIds = Array.isArray(params.memoryIds) ? params.memoryIds.filter((id): id is string => typeof id === "string") : [];
@@ -877,7 +1016,7 @@ export class AgentRunner {
       ? params.selfResume as Record<string, unknown>
       : undefined;
     const isSelfResumeContinuation = reason === "self-resume-continuation" || Boolean(selfResume);
-    await this.options.adapter.deliver(this.process!, [{
+    const payload: Message = {
       id: 0,
       from: "system",
       to: this.agentId,
@@ -893,7 +1032,24 @@ export class AgentRunner {
       },
       readBy: [],
       createdAt: Date.now(),
-    }]);
+    };
+    // #1565 F1 — one payload at a time, in dispatch order (see dispatchCommand). The ticket, when
+    // present, is the place in line this command took the moment it arrived.
+    const deliver = (slot?: ProviderInputTicket) => this.providerInput.run(() => this.options.adapter.deliver(this.process!, [payload]), slot);
+    try {
+      await deliver(ticket);
+    } catch (error) {
+      // Codex has no input buffer: a payload offered during a live turn is rejected rather than
+      // queued (#1339). Serializing the boundary pair means the SECOND payload now meets the turn
+      // the first one started, so re-offer it once the turn ends instead of failing the command —
+      // the same queue-behind-the-turn semantics Claude's transports get for free from the CLI's
+      // own buffer. A timeout waiting for the turn re-throws: the command fails, the memory
+      // delta-gate does not advance, and the relay backstop re-sends. Never a silent drop.
+      if (!isTurnInProgressDeliveryError(error)) throw error;
+      this.sessionLog(`context injection (${reason ?? "no reason"}) deferred behind the active provider turn; re-delivering when it ends`);
+      await this.busyReconciler.waitForProviderTurnClear();
+      await deliver();
+    }
     return { memoryIds, injectedMemoryCount: memoryIds.length };
   }
 
@@ -928,7 +1084,7 @@ export class AgentRunner {
     return { approvalId, decision, ...(result ? { providerResult: result } : {}) };
   }
 
-  private async injectPrompt(params: Record<string, unknown>): Promise<Record<string, unknown>> {
+  private async injectPrompt(params: Record<string, unknown>, ticket?: ProviderInputTicket): Promise<Record<string, unknown>> {
     const body = typeof params.body === "string" ? params.body : "";
     if (!body) throw new Error("body required");
     if (!this.process) throw new Error("provider process is unavailable");
@@ -944,7 +1100,7 @@ export class AgentRunner {
     this.recordInjectedPrompt(prompt.trim());
     // #1228: prompt injection is a manual dashboard "continue"/chat-box send, not the
     // agent's genuine first turn — never label it as the initial prompt.
-    await this.options.adapter.deliverInitialPrompt(this.process, prompt, { isInitial: false });
+    await this.providerInput.run(() => this.options.adapter.deliverInitialPrompt!(this.process!, prompt, { isInitial: false }), ticket);
     return { injected: true, messageId, attachmentCount: attachments.length };
   }
 
@@ -967,7 +1123,7 @@ export class AgentRunner {
     }
     this.recordInjectedPrompt(text.trim());
     // #1228: this resolves a held AskUserQuestion mid-session — never the initial prompt.
-    await this.options.adapter.deliverInitialPrompt(this.process, text, { isInitial: false }).catch((error) => {
+    await this.providerInput.run(() => this.options.adapter.deliverInitialPrompt!(this.process!, text, { isInitial: false })).catch((error) => {
       this.sessionLog(`failed to inject AskUserQuestion answer for ${input.approvalId}: ${errMessage(error)}`);
     });
   }
@@ -1280,6 +1436,30 @@ export class AgentRunner {
     this.publishStatus();
   }
 
+  // (#1617) — the reporting half of a guarded fire-and-forget call. Bun exits(1) on an unhandled
+  // rejection and the runner installs no `unhandledRejection` handler, so any `void this.foo()`
+  // whose target can reject takes the whole agent down — and nothing respawns it (#1618).
+  //
+  // Deliberately NOT a fire-and-forget wrapper: the `.catch` still has to be written out at every
+  // call site, so adding one stays a visible decision rather than something a helper hides. All
+  // this fixes is the SHAPE of the report — the same logger.error + publishRunnerTimelineEvent
+  // pair attemptInitialPromptDelivery and the #1614 obligation re-injection already use, so a
+  // background operation that dies is loud on the agent's own timeline instead of vanishing.
+  private reportBackgroundRejection(scope: string, status: string, title: string, error: unknown): void {
+    const body = errMessage(error);
+    logger.error("runner", `${scope} failed: ${body}`);
+    this.publishRunnerTimelineEvent({ status, timestamp: Date.now(), title, body });
+  }
+
+  // (#1617) — renewRuntimeToken is an outer try/finally with no catch: the orchestrator re-mint
+  // gate, publishStatus and scheduleRuntimeTokenRenewal all run unguarded after the inner
+  // self-renew try. Both callers are timers/edges with nobody to await the promise, so a reject
+  // reaches the top. Reported, never swallowed — a token that silently stops renewing strands the
+  // agent off the bus, which is the exact failure this renewal loop exists to prevent.
+  private renewRuntimeTokenInBackground(): void {
+    void this.renewRuntimeToken().catch((error) => this.reportBackgroundRejection("runtime token renewal", "runtime-token-renewal-failed", "Runtime token renewal aborted", error));
+  }
+
   private async updateCommand(commandId: string, status: string, result?: Record<string, unknown>, error?: string): Promise<void> {
     await this.bus.updateCommand(commandId, { status, ...(result ? { result } : {}), ...(error ? { error } : {}) });
   }
@@ -1408,20 +1588,49 @@ export class AgentRunner {
         // answer/dismiss path already cleared this; this is the fallback for every other way
         // forward progress can happen, so a stale question never lingers past its own turn.
         this.pendingQuestionHold = undefined;
+        // #1235 — a hookless (monitorless) adapter turn carries its live transcript path on the
+        // busy edge. Drive the reasoning tail natively so lean/isolated Claude workers, which
+        // never install the Stop/UserPromptSubmit hooks, still stream chat. Hook-driven agents
+        // never set transcriptPath here, so their hook-triggered capture is untouched.
+        const nativeTranscriptPath = typeof update !== "string" ? update.transcriptPath : undefined;
+        if (nativeTranscriptPath) {
+          this.lastTranscriptPath = nativeTranscriptPath;
+          this.nativeSessionCaptureActive = true;
+          void this.startNativeSessionCapture(nativeTranscriptPath);
+        }
       }
       id = this.currentTurnId;
       this.busyReconciler.arm();
     } else if (status === "idle" && reason === "provider-turn") {
       id = typeof update !== "string" && update.id ? update.id : this.currentTurnId ?? reason;
       if (this.currentTurnId) { this.completedProviderTurns += 1; this.sessionLog(`turn ended via provider idle (turn ${this.currentTurnId})`); }
+      // #1235 — for a native (hookless) turn, capture the final assistant response from the
+      // transcript BEFORE tearing down the tail. Snapshot the ctx while currentTurnId is still
+      // set so the closing response is tagged with the correct turn.
+      const nativeFinish = this.nativeSessionCaptureActive;
+      const nativeTranscriptPath = nativeFinish ? ((typeof update !== "string" ? update.transcriptPath : undefined) ?? this.lastTranscriptPath) : undefined;
+      const nativeCtx = nativeFinish ? this.sessionTurnContext() : undefined;
       this.currentTurnId = undefined;
       this.currentTurnStartedAt = undefined;
       this.compactionMidTurn = false;
       this.busyReconciler.disarm();
-      this.stopReasoningTail();
+      if (nativeFinish) {
+        this.nativeSessionCaptureActive = false;
+        void this.finishNativeSessionCapture(nativeTranscriptPath, nativeCtx!);
+      } else {
+        this.stopReasoningTail();
+      }
       // Providers with append-system-prompt policy use lifecycle hooks for obligation handling;
       // others need the runner to re-inject pending obligations on idle.
-      if (getManifest(this.options.provider)?.launch?.managedPolicyPrompt?.alwaysOn !== "append-system-prompt") void this.reInjectPendingObligation();
+      // (#1614) — this delivery can suspend on the FIFO (#1607 N1) and, once resumed, reject if
+      // the process died out from under it or the adapter is mid-turn; reported the same way
+      // attemptInitialPromptDelivery reports its own adapter.deliver failures, so it can never
+      // reach the top as an unhandled rejection (Bun exits(1) on those) and never vanish silently.
+      // (#1617) folded onto the shared reportBackgroundRejection shape — same channel, same
+      // status/title/body, one less hand-rolled copy of the reporting block.
+      if (getManifest(this.options.provider)?.launch?.managedPolicyPrompt?.alwaysOn !== "append-system-prompt") {
+        void this.reInjectPendingObligation().catch((error) => this.reportBackgroundRejection("re-inject pending obligation", "obligation.reinject_failed", "Pending reply obligation not re-injected", error));
+      }
     }
     // A genuine restart back to forward progress clears the terminal-exit marker so a later offline
     // doesn't re-announce a stale provider exit.
@@ -1434,11 +1643,16 @@ export class AgentRunner {
       // kill), the reconcile clears the stuck turn → idle. A dead pid means the turn is
       // definitively over, so this can never falsely clear a live turn (#653's hazard).
       const reportedPids = typeof update === "string" ? undefined : update.pids;
-      const livenessPids = reportedPids?.length
-        ? reportedPids
-        : reason === "provider-turn" && typeof this.process?.pid === "number" && this.process.pid > 0
-          ? [this.process.pid]
-          : undefined;
+      // #1138: process.pid is undefined for tmux-launched providers (Claude) — only
+      // the adapter can resolve a real pid from the tmux session/socket. Without this,
+      // an ordinary hook-driven turn tracks no pid at all, so the stale-turn backstop
+      // below has nothing but elapsed time to go on.
+      const fallbackPid = reason === "provider-turn"
+        ? (typeof this.process?.pid === "number" && this.process.pid > 0
+            ? this.process.pid
+            : this.process ? this.options.adapter.resolveBusyPid?.(this.process) : undefined)
+        : undefined;
+      const livenessPids = reportedPids?.length ? reportedPids : (fallbackPid ? [fallbackPid] : undefined);
       this.claims.startWork(reason, id, typeof update === "string" ? (livenessPids ? { pids: livenessPids } : {}) : {
         label: update.label,
         role: update.role,
@@ -1479,7 +1693,15 @@ export class AgentRunner {
       this.rateLimitHold = hold;
       if (fresh) this.publishRateLimitNotice(hold);
     }
-    if (status === "idle" && this.nativeSelfResume.active) {
+    // #1146: native self-resume is invoked by the agent itself mid-turn (a tool call from
+    // within its own active response), so the very next idle is almost always the CALLING
+    // turn's own natural end — long before Claude Code even starts processing the queued
+    // `/compact <continuation>`. Resolving on any idle here raced that unrelated end against
+    // the real compaction and (de facto always) won, marking the command "succeeded" and
+    // firing the continuation injection before compaction ever ran — a silent no-op. Gate on
+    // `compactedAt` (stamped only by the genuine PostCompact "compacted" timeline event, via
+    // noteCompacted) so this only resolves once compaction has actually happened.
+    if (status === "idle" && this.nativeSelfResume.active?.compactedAt !== undefined) {
       this.nativeSelfResume.resolve(this.nativeSelfResume.active, { resumed: true, via: "provider-idle" });
     }
     this.publishStatus();
@@ -1519,7 +1741,8 @@ export class AgentRunner {
       // by the RELAY_INJECTION_MARKERS prefix check, but record it explicitly as
       // defense-in-depth for adapters that might echo only the unformatted body text.
       this.recordInjectedPrompt(providerMessageText([replayMessage]));
-      await this.options.adapter.deliver(this.process, [replayMessage]);
+      // #1607 N1 — route through the FIFO like every other deliver/deliverInitialPrompt call site.
+      await this.providerInput.run(() => this.options.adapter.deliver(this.process!, [replayMessage]));
       // Kick off a cache refresh so a cleared obligation (agent replied) is detected
       // before the next idle fires — without this, the stale snapshot re-injects up to
       // MAX_REINJECTIONS times even after the agent has already /reply-ed.
@@ -1711,14 +1934,17 @@ export class AgentRunner {
         this.sessionLog(`pre-destroy capture failed: ${errMessage(error)}`);
       }
       // For exit-bound transitions the runner won't be alive afterward to drain the durable
-      // outbox, so block (bounded) on delivering what capture just enqueued. This runs before
+      // outboxes, so block (bounded) on delivering what capture just enqueued. The session
+      // outbox is separate from the Insights outbox: provider turn-final/report-up captures
+      // live there, and closing it without a flush loses a transient worker's last report
+      // after the reaper has already closed its work window (#1139). This runs before
       // handleCommand's finally deletes the agent, so the runtime token is still valid here.
       if (reasonExitsRunner(reason)) {
         try {
-          const delivered = await this.outbox.flush(OUTBOX_FLUSH_TIMEOUT_MS);
-          if (!delivered) this.sessionLog(`insights: outbox flush incomplete before ${reason} (${this.outbox.pendingCount()} pending)`);
+          const [delivered, sessionDelivered] = await Promise.all([this.outbox.flush(OUTBOX_FLUSH_TIMEOUT_MS), this.sessionOutbox.flush(OUTBOX_FLUSH_TIMEOUT_MS)]);
+          if (!delivered || !sessionDelivered) this.sessionLog(`teardown outbox flush incomplete before ${reason}`);
         } catch (error) {
-          this.sessionLog(`insights: outbox flush failed: ${errMessage(error)}`);
+          this.sessionLog(`teardown outbox flush failed: ${errMessage(error)}`);
         }
       }
     })();
@@ -1832,6 +2058,7 @@ export class AgentRunner {
         origin: event.origin ?? "provider",
         ...(turnId ? { turnId } : {}),
         ...(event.label ? { label: event.label } : {}),
+        ...(event.category ? { toolCategory: event.category } : {}),
         ...(event.status ? { status: event.status } : {}),
         ...(event.streaming !== undefined ? { streaming: event.streaming } : {}),
         ...(event.stepId ? { stepId: event.stepId } : {}),
@@ -1868,13 +2095,17 @@ export class AgentRunner {
   // deliberately leaves the reasoning tail alone so a late clear can't truncate
   // a turn's activity stream.
   private forceClearProviderTurn(reason: string): void {
-    if (!this.claims.activeWork().some((w) => w.kind === "provider-turn")) return;
+    const work = this.claims.activeWork().find((w) => w.kind === "provider-turn");
+    if (!work) return;
     this.sessionLog(`force-clearing stuck provider-turn (${reason})`);
+    const event = reconciledTurnTimelineEvent({ turnId: this.currentTurnId ?? work.id, reason, startedAt: work.startedAt });
     this.claims.clearWorkKind("provider-turn");
     this.busyReconciler.providerTurnCleared();
     this.currentTurnId = undefined;
     this.compactionMidTurn = false;
-    this.publishStatus();
+    // #1621: the clear is EMITTED, not silently applied — publishRunnerTimelineEvent publishes
+    // the status too, so the idle edge and its explanation travel in the same frame.
+    this.publishRunnerTimelineEvent(event);
   }
 
   // #650: reconcile pid-bearing busy work against actual process liveness. A tracked
@@ -1920,6 +2151,33 @@ export class AgentRunner {
     this.options.adapter.stopSessionTrace?.();
   }
 
+  // #1235 — start the transcript reasoning tail for a hookless (monitorless) turn. Reuses the
+  // exact adapter capture path the UserPromptSubmit hook drives for hooked agents; only the
+  // trigger differs (native turn-start vs hook). A missing/old transcript makes the tail a
+  // graceful no-op (poll finds nothing), so this can never crash a turn.
+  private async startNativeSessionCapture(transcriptPath: string): Promise<void> {
+    try {
+      await this.options.adapter.handleUserPrompt?.({ prompt: "", transcriptPath }, this.sessionTurnContext());
+    } catch (error) {
+      this.sessionLog(`native session capture start failed: ${errMessage(error)}`);
+    }
+  }
+
+  // #1235 — capture the final assistant response for a hookless turn (the Stop hook's job for
+  // hooked agents), then tear down the tail. captureSessionTurn drains the tail, reads the
+  // closing turn text from the transcript, and emits the final `response` session event.
+  private async finishNativeSessionCapture(transcriptPath: string | undefined, ctx: ProviderSessionTurnContext): Promise<void> {
+    try {
+      if (transcriptPath) {
+        await this.options.adapter.captureSessionTurn?.({ transcriptPath, ...(ctx.turnId ? { promptId: ctx.turnId } : {}) }, ctx);
+      }
+    } catch (error) {
+      this.sessionLog(`native session capture finish failed: ${errMessage(error)}`);
+    } finally {
+      this.stopReasoningTail();
+    }
+  }
+
   // Mirror a discreet, durable "context compacted" marker into chat via the existing
   // session-mirror lane (not a parallel channel). `notice` renders as an inline timeline
   // marker (never a bubble) and survives reload, unlike the ephemeral timeline-status one.
@@ -1966,7 +2224,7 @@ export class AgentRunner {
 
   private isStaleProviderTurnOnlyBusy(
     status: SemanticStatus,
-    activeWork: Array<{ kind: string }>,
+    activeWork: Array<{ kind: string; pids?: number[] }>,
     busyReasons: string[],
     liveness: { hasLiveWork: boolean; lastProgressAt: number },
   ): boolean {
@@ -1974,6 +2232,13 @@ export class AgentRunner {
     if (activeWork.length === 0 || activeWork.some((work) => work.kind !== "provider-turn")) return false;
     if (busyReasons.some((reason) => reason !== "provider-turn")) return false;
     if (liveness.hasLiveWork || !liveness.lastProgressAt) return false;
+    // #1138: a turn whose tracked pid is still alive is definitively still running — a
+    // silent single Claude turn (no subagents, no compaction event) must not be
+    // force-healed to idle purely because it's been quiet past the threshold. Only fall
+    // back to the elapsed-time heuristic when there's no pid evidence to check; the #650
+    // reconcile independently clears a confirmed-dead pid's work the instant it dies, so
+    // this can never mask a genuine leak.
+    if (activeWork.some((work) => work.pids?.some((pid) => isPidAlive(pid)))) return false;
     return Date.now() - liveness.lastProgressAt >= STALE_PROVIDER_TURN_BUSY_MS;
   }
 
@@ -2108,7 +2373,7 @@ export class AgentRunner {
     if (this.reactiveTokenRecoveryAt && now - this.reactiveTokenRecoveryAt < REACTIVE_TOKEN_RECOVERY_DEBOUNCE_MS) return;
     this.reactiveTokenRecoveryAt = now;
     this.logRunnerDiagnostic(`[runner] relay auth failure on ${source}; recovering runtime token`);
-    void this.renewRuntimeToken();
+    this.renewRuntimeTokenInBackground();
   }
 
   private logHttpLivenessFailure(error: unknown, authFailed: boolean): void {
@@ -2195,7 +2460,7 @@ export class AgentRunner {
         this.scheduleRuntimeTokenRenewal();
         return;
       }
-      void this.renewRuntimeToken();
+      this.renewRuntimeTokenInBackground();
     }, schedule.delayMs);
   }
 
@@ -2325,7 +2590,18 @@ export class AgentRunner {
     const processContext = this.latestProcessContext();
     const probeMetrics = this.latestProbeMetrics();
     const probeContext = probeMetrics ? contextStateFromProbeMetrics(probeMetrics) : undefined;
-    const context = processContext ?? probeContext;
+    let context = processContext ?? probeContext;
+    // #1512: when a provider has no event-stream context of its own, fall back to
+    // the transcript so context.lastUpdatedAt keeps advancing after an in-process
+    // compact/clear/native-resume freezes the status-line probe. Freshest wins, so
+    // a live probe still takes precedence (source stays "statusline").
+    if (!processContext) {
+      const derived = transcriptDerivedContext({ transcriptPath: this.lastTranscriptPath, derive: this.options.adapter.contextUsageFromTranscript, tokensMax: probeMetrics?.tokensMax, cache: this.transcriptContextCache, now: Date.now() });
+      this.transcriptContextCache = derived.cache;
+      if (derived.context && (!probeContext || derived.context.lastUpdatedAt > probeContext.lastUpdatedAt)) {
+        context = derived.context;
+      }
+    }
     const quota = probeMetrics ? quotaStateFromProbeMetrics(probeMetrics) : undefined;
     const terminalSession = providerTerminalSession(this.process);
     const terminalSocket = providerTerminalSocket(this.process);