agentbox-app 0.1.12 → 0.1.16

package/main/claude-launch-env.mjs

@@ -0,0 +1,54 @@
+// An npm Claude Code from before the package shipped a native binary is a
+// `#!/usr/bin/env node` script. Opened from the Dock, the app's PATH is
+// launchd's four folders, and with nvm lazy-loaded no profile adds node, so the
+// app found that Claude Code and every worker died with
+// `env: node: No such file or directory`
+// (tests/an-old-npm-claude-code-starts-as-a-worker-from-the-dock).
+//
+// Narrower than main/codex-launch-env.mjs on purpose. A worker's PATH is the
+// PATH its agent's own commands run under, so it is changed only when this
+// binary needs node and none is on it, and the node found is added at the end,
+// where it cannot shadow anything the person's own PATH chose.
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { candidatePaths, versionedPaths } from './claude-bin.mjs';
+
+function executable(file) {
+  try {
+    fs.accessSync(file, fs.constants.X_OK);
+    return fs.statSync(file).isFile();
+  } catch { return false; }
+}
+
+/** Whether `bin`, followed through its links, is a script run by node. */
+function runsOnNode(bin) {
+  try {
+    const fd = fs.openSync(fs.realpathSync(bin), 'r');
+    const head = Buffer.alloc(128);
+    const read = fs.readSync(fd, head, 0, head.length, 0);
+    fs.closeSync(fd);
+    const first = head.subarray(0, read).toString('utf8').split('\n')[0];
+    return /^#!.*\bnode\b/.test(first);
+  } catch { return false; }
+}
+
+export function claudeLaunchEnv(bin, source = process.env, {
+  home = source.HOME || os.homedir(), exists = executable, readdir,
+} = {}) {
+  if (!bin || !runsOnNode(bin)) return { ...source };
+  const inherited = (source.PATH || '').split(path.delimiter).filter(Boolean);
+  if (inherited.some(dir => exists(path.join(dir, 'node')))) return { ...source };
+  // The node npm installed it with sits beside the link, or beside the real
+  // file's package; then the places a Node install usually lives.
+  let real = bin;
+  try { real = fs.realpathSync(bin); } catch { /* keep the link */ }
+  const directories = [...new Set([
+    path.dirname(bin), path.dirname(real),
+    ...candidatePaths(home).map(path.dirname),
+    ...versionedPaths(home, readdir).map(path.dirname),
+  ])];
+  const nodeDir = directories.find(dir => exists(path.join(dir, 'node')));
+  if (!nodeDir) return { ...source };
+  return { ...source, PATH: [...inherited, nodeDir].join(path.delimiter) };
+}

package/main/claude-models.mjs

@@ -39,8 +39,35 @@
 // at all.
 
 import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
 import { CLAUDE_MODELS, READ_FROM } from '../shared/claude-models.generated.mjs';
 
+// WHAT THE LAST BUILD ON THIS MACHINE READ, which is a better floor than the
+// committed table and is not a file anybody edits.
+//
+// The committed table is tracked, so a build that wrote over it made every
+// folder that had run the app look like it held work (w-6bbb709b1f, 2026-10-07).
+// The build writes this instead. It is gitignored, it is absent on a machine
+// that has never built, and it is read with `fs` rather than imported, for the
+// one reason that decides the whole shape: this module is node, but
+// shared/claude-commands.mjs next door is shared with the renderer, where an
+// import of a file that may not exist cannot be made to resolve. A read is a
+// read in node and nothing at all in a bundle.
+const LOCAL = path.join(path.dirname(fileURLToPath(import.meta.url)), '..', 'shared', 'claude-models.local.json');
+
+/** The table this machine read at build time, or null if there is none to trust. */
+function readLocal(at) {
+  try {
+    const table = JSON.parse(fs.readFileSync(at, 'utf8'));
+    if (!Array.isArray(table.models) || !table.models.length) return null;
+    // Every row has to carry what the picker draws. A half-written file is a
+    // worse answer than the committed table, not a better one.
+    if (!table.models.every((m) => m && typeof m.alias === 'string' && typeof m.label === 'string')) return null;
+    return table;
+  } catch { return null; }
+}
+
 /**
  * HER ORDER, AND ONLY HER ORDER. Not a filter: an alias missing from this list
  * is still offered, after these. Her three are from and Fable is the one she
@@ -203,8 +230,10 @@ function stampOf(binPath) {
  * WHAT MAY SHE BE OFFERED FOR CLAUDE CODE, and what version said so.
  *
  * `{ models: [{ alias, id, label }], readFrom, source }` where `source` is
- * `'cli'` when it came off this Mac's Claude Code and `'built'` when it is the
- * table committed at build time. Never empty: the committed table is the floor.
+ * `'cli'` when it came off this Mac's Claude Code at the moment it was asked,
+ * `'read'` when it is what the last build on this machine read out of it, and
+ * `'built'` when it is the table committed to the repository. Never empty: the
+ * committed table is the floor under both of them.
  *
  * THE PATH IS HANDED IN, NEVER SEARCHED FOR HERE. `config.claudeBin` is already
  * resolved once at startup (main/config.mjs), and `findClaudeBin` falls back to
@@ -216,15 +245,18 @@ function stampOf(binPath) {
  * `--version` so the Settings screen could say which one it read. That is one
  * `execFileSync` on the path a settings read takes, and no label on a screen is
  * worth a process started while she waits. `readFrom` is the committed table's
- * version, and it is meaningful only when `source` is `'built'`.
+ * version, and it is meaningful whenever `source` is not `'cli'`.
  */
-export function claudeModels({ bin = null } = {}) {
+export function claudeModels({ bin = null, local = LOCAL } = {}) {
+  // THE FLOOR IS THE FRESHER OF THE TWO TABLES NOBODY HAS TO ASK FOR: what the
+  // last build on this machine read, and the one committed to the repository.
+  const read = readLocal(local);
   const built = {
-    models: CLAUDE_MODELS.map((m) => ({
+    models: (read?.models ?? CLAUDE_MODELS).map((m) => ({
       alias: m.alias, id: m.id, label: m.label, defaultLevel: m.defaultLevel ?? null,
     })),
-    readFrom: READ_FROM,
-    source: 'built',
+    readFrom: read ? read.readFrom ?? null : READ_FROM,
+    source: read ? 'read' : 'built',
   };
   if (!bin) return built;
   const stamp = stampOf(bin);

package/main/claude-plan.mjs

@@ -71,6 +71,9 @@ export function planLabel(raw) {
   if (!s) return null;
   const bare = s.replace(/^default_/, '').replace(/^claude_/, '');
   if (!bare) return null;
+  // Claude's saved Enterprise tier includes an internal name. Keep the raw
+  // tier for capacity decisions, but show only the subscription name.
+  if (bare === 'raven_enterprise') return 'Enterprise';
   return bare
     .split('_')
     .filter(Boolean)
@@ -93,27 +96,35 @@ export function isMaxTier(raw) {
  *  Claude Code has not fetched a profile for yet: all of them come back
  *  `known: false`, which every caller here treats as "leave everything exactly
  *  as it was". */
+const planCache = new Map();
+
 export function readPlan(profile, { home = os.homedir(), file = null } = {}) {
   const at = file ?? planFile(profile, home);
+  // Keyed on the file's mtime AND its size, as accountIdentity is keyed on the
+  // mtime alone: the cloud tiles ask on every snapshot.
+  //
+  // THE SIZE IS THERE BECAUSE AN MTIME CAN STAND STILL (w-dac993a554). Two
+  // writes inside one tick of the filesystem's clock carry the same mtime, and
+  // the cache then served the first one's plan for ever. A subscription
+  // renewed in that window read as ended until the file was written again, so
+  // `Supervisor#_forgetRenewedSubscriptions` never let the account back in.
+  let stat = null;
+  try { stat = fs.statSync(at); } catch { /* read below says none */ }
+  const hit = planCache.get(at);
+  if (stat && hit?.mtime === stat.mtimeMs && hit?.size === stat.size) return hit.plan;
+  const plan = readPlanNow(at);
+  if (stat) planCache.set(at, { mtime: stat.mtimeMs, size: stat.size, plan });
+  return plan;
+}
+
+function readPlanNow(at) {
+  const none = { known: false, max: false, label: null, tier: null, from: null, file: at };
   let account = null;
   try {
     account = JSON.parse(fs.readFileSync(at, 'utf8'))?.oauthAccount ?? null;
   } catch {
-    return planOfAccount(null, at);
+    return none;
   }
-  return planOfAccount(account, at);
-}
-
-/**
- * THE SAME ANSWER OFF AN `oauthAccount` SOMEBODY ALREADY HAS IN HAND.
- *
- *  Lifted out of `readPlan` so a caller that has read the file for its own
- *  reasons (main/runs-on.mjs, which also wants to know whether there is a login
- *  in there at all) does not carry a second copy of the tier ordering. One copy
- *  of that rule, and the file read stays in one place per caller.
- */
-export function planOfAccount(account, at = null) {
-  const none = { known: false, max: false, label: null, tier: null, from: null, file: at };
   if (!account || typeof account !== 'object') return none;
   // THE ORDER IS MOST SPECIFIC FIRST. A rate limit tier names the plan AND its
   // size (`max_20x` against `max_5x`), which is the thing worth showing; the
@@ -126,7 +137,43 @@ export function planOfAccount(account, at = null) {
   const from = tier === account.organizationRateLimitTier
     ? 'org-tier'
     : tier === account.userRateLimitTier ? 'user-tier' : 'org-type';
-  return { known: true, max: isMaxTier(tier), label: planLabel(tier), tier, from, file: at };
+  // A SUBSCRIPTION THAT HAS ENDED STILL NAMES ITS OLD TIER. Measured
+  // 2026-10-11 on a lapsed personal Max login: `billingType` had gone to
+  // "none" (a paying one says "stripe_subscription") while the tier still said
+  // `default_claude_max_20x`, so the page went on saying "Max 20x". Only the
+  // exact word counts; a file that names no billing at all is read as before.
+  if (account.billingType === 'none') {
+    return { known: true, ended: true, max: false, label: 'Subscription ended', tier, from, file: at };
+  }
+  return { known: true, ended: false, max: isMaxTier(tier), label: planLabel(tier), tier, from, file: at };
+}
+
+/**
+ * WHICH ACCOUNT AND PLAN ONE LOGIN IS ON, as a string that changes only when
+ *  one of them does: an upgrade, extra usage switched on, a renewal, or a
+ *  /login as somebody else. Claude Code rewrites this file all day for other
+ *  reasons, so only these fields count (named as Claude Code 2.1.305 writes
+ *  them). Null when the file names no account or cannot be read.
+ */
+const PLAN_FIELDS = ['accountUuid', 'organizationUuid', 'organizationType', 'organizationRateLimitTier',
+  'userRateLimitTier', 'seatTier', 'billingType', 'hasExtraUsageEnabled', 'planDisplayName', 'subscriptionCreatedAt'];
+const stampCache = new Map();
+
+export function planStamp(profile, { home = os.homedir(), file = null } = {}) {
+  const at = file ?? planFile(profile, home);
+  let mtime;
+  try { mtime = fs.statSync(at).mtimeMs; } catch { return null; }
+  const hit = stampCache.get(at);
+  if (hit?.mtime === mtime) return hit.stamp;
+  let stamp = null;
+  try {
+    const account = JSON.parse(fs.readFileSync(at, 'utf8'))?.oauthAccount;
+    if (account?.accountUuid) {
+      stamp = JSON.stringify(PLAN_FIELDS.map((k) => (k === 'hasExtraUsageEnabled' ? account[k] === true : account[k] ?? null)));
+    }
+  } catch { /* half written: the next write has a new mtime and is read again */ }
+  stampCache.set(at, { mtime, stamp });
+  return stamp;
 }
 
 /**
@@ -154,7 +201,8 @@ export function readPlans(profiles, { home = os.homedir() } = {}) {
  *  AND AN UNREADABLE ACCOUNT NEVER LOWERS IT. Somebody whose config file we
  *  cannot parse gets exactly the app they had before this existed. */
 export function slotsForPlans(plans, fallback = 3) {
-  const known = (plans ?? []).filter((p) => p.known);
+  // An ended subscription runs nothing, so it has no say in how many run.
+  const known = (plans ?? []).filter((p) => p.known && !p.ended);
   if (!known.length) return fallback;
   return known.every((p) => p.max) ? fallback : 1;
 }

package/main/claude-session-open.mjs

@@ -0,0 +1,28 @@
+// Whether Claude Code still has a session open somewhere, read off the state
+// file it keeps for each open session (`<home>/sessions/<pid>.json`, with the
+// session id and the pid holding it). A state file whose process has gone is a
+// session somebody closed.
+import fs from 'node:fs';
+import path from 'node:path';
+
+function alive(pid) {
+  try { process.kill(pid, 0); return true; } catch (err) { return err?.code === 'EPERM'; }
+}
+
+export function claudeSessionOpen(sessionId, homes = []) {
+  const id = String(sessionId ?? '').trim();
+  if (!id) return false;
+  for (const home of new Set(homes.filter(Boolean))) {
+    const dir = path.join(home, 'sessions');
+    let names = [];
+    try { names = fs.readdirSync(dir); } catch { continue; }
+    for (const name of names) {
+      if (!name.endsWith('.json')) continue;
+      let rec = null;
+      try { rec = JSON.parse(fs.readFileSync(path.join(dir, name), 'utf8')); } catch { continue; }
+      const pid = Number(rec?.pid);
+      if (rec?.sessionId === id && pid > 0 && alive(pid)) return true;
+    }
+  }
+  return false;
+}

package/main/claude-usage-process.mjs

@@ -0,0 +1,40 @@
+import { spawn } from 'node:child_process';
+import { attachClaudeInput } from './claude-input.mjs';
+
+// No user message is submitted. The CLI owns authentication and the provider request.
+export function runClaudeUsage(bin, args, opts, done) {
+  let child, timer, killTimer, finished = false, bytes = 0;
+  const finish = (error, report = '') => {
+    if (finished) return;
+    finished = true;
+    clearTimeout(timer);
+    if (child?.exitCode == null && child?.pid) {
+      child.kill('SIGTERM');
+      killTimer = setTimeout(() => child.kill('SIGKILL'), 1000);
+      killTimer.unref();
+    }
+    done(error, report);
+  };
+  try {
+    child = attachClaudeInput(spawn(bin, args, { cwd: opts.cwd, env: opts.env, stdio: ['pipe', 'pipe', 'ignore'] }));
+    child.holdInput(true);
+    child.once('error', error => finish(error));
+    child.once('exit', () => {
+      clearTimeout(killTimer);
+      finish(Error('Claude Code closed before reporting usage.'));
+    });
+    child.stdout.on('data', data => {
+      bytes += data.length;
+      if (bytes > opts.maxBuffer) finish(Error('Claude Code sent too much usage output.'));
+    });
+    timer = setTimeout(() => finish(Error('Claude Code did not report usage in time.')), opts.timeout);
+    void (async () => {
+      try {
+        await child.control({ subtype: 'initialize' }, opts.timeout);
+        const report = await child.control({ subtype: 'get_usage', skip_behaviors: true }, opts.timeout);
+        finish(null, JSON.stringify(report));
+      } catch (error) { finish(error); }
+    })();
+  } catch (error) { finish(error); }
+  return child;
+}

package/main/claude-usage.mjs

@@ -1,39 +1,13 @@
-// RUNNING `/usage`, WHICH TAKES TWENTY-FIVE SECONDS AND MUST NEVER BE WAITED ON.
-//
-// The pure half is shared/claude-usage.mjs: the text in, the limits out, the
-// words the pill prints. This is the half that shells out, and everything about
-// its shape comes from one measurement.
-//
-// TIMED TWICE ON HER MAC, 2026-08-31: 23.2s and 28.0s for `claude -p '/usage'`.
-// The percentage did not move between the two, which is the other half of the
-// answer: this is not a number that changes second to second, so nothing is lost
-// by reading it every few minutes and everything is lost by reading it on a
-// timer the window waits for.
-//
-// SO IT IS A CACHE WITH A BACKGROUND REFRESH, and never a call anything awaits:
-//
-//   - `read` answers instantly, always, from the last measurement or with null.
-//     It never blocks and never throws.
-//   - A refresh is kicked off when the cached figure is older than STALE_MS,
-//     and only ever one at a time.
-//   - The window is told when a new one lands, the same way everything else in
-//     this app tells it: a push.
-//
-// WHY NOT A SESSION. Agentbox spawns real workers through the supervisor and could
-// have asked one of them. It must not: a worker is a unit of her work, it lands
-// in her inbox and burns a slot in the fleet, and this is a status reading. It
-// gets its own short-lived child process with no store, no brief and no row.
-//
-// WHAT IS NOT SENT ANYWHERE. The output carries her usage figures and nothing
-// else leaves this machine because of it; `main/analytics.mjs` is the only file
-// that sends, and none of its eight counts is fed from here.
+// Cached provider usage, read through Claude Code without starting a model turn.
+// Snapshots never wait; only an explicit refresh waits for the CLI's answer.
 
-import { execFile } from 'node:child_process';
 import fs from 'node:fs';
 import os from 'node:os';
 import path from 'node:path';
-import { readUsage } from '../shared/claude-usage.mjs';
-import { localZone } from '../shared/usage.mjs';
+import { readUsageReport } from '../shared/claude-usage.mjs';
+import { localZone, USAGE_UNREADABLE } from '../shared/usage.mjs';
+import { runClaudeUsage } from './claude-usage-process.mjs';
+import { NO_METERED_KEY } from './harnesses/claude.mjs';
 
 // WHERE THE READING RUNS, AND WHY IT IS NOT "WHEREVER THE APP IS". An app
 // opened from Finder has `/` as its working directory, and this used to spawn
@@ -61,9 +35,7 @@ export function usageCwd() {
 // than the number itself is reported to.
 export const STALE_MS = 5 * 60_000;
 
-// Long enough for the slowest run measured plus most of the same again. Past
-// this the reading is not late, it is not coming.
-const TIMEOUT_MS = 90_000;
+const TIMEOUT_MS = 30_000;
 
 // After a failure, how long before it is worth trying again. A machine that is
 // signed out, rate limited, or has no Claude Code at all would otherwise be
@@ -76,20 +48,36 @@ export class ClaudeUsage {
    * is, asked each time rather than captured: it can be installed while the
    * app is running, and the settings screen already promises that works.
    * @param { => void} [how.onChange] Told when a new reading lands, so the
-   * window redraws. Never called for a refresh that changed nothing.
+   * window redraws, including a new checked time on unchanged percentages.
+   * @param { => { profile: string, env?: object }} [how.account] WHOSE LIMIT
+   * IS READ, asked each time. It used to be nobody's in particular: the
+   * command ran with the app's own environment, which is the default login,
+   * so a Mac with a second account picked as In use showed "No usage reading
+   * yet" for good, because the default one was at its limit and Claude Code
+   * printed no limits for it (2026-10-08, Claude Code 2.1.293). `profile` is
+   * the account's name ('default' or its CLAUDE_CONFIG_DIR) and `env` is the
+   * environment to run it in. Supervisor.usageAccount is the real one.
    */
-  constructor({ bin, onChange = () => {}, run = execFile, now = () => Date.now(), where = usageCwd } = {}) {
+  constructor({ bin, onChange = () => {}, run = runClaudeUsage, now = () => Date.now(), where = usageCwd, account = () => ({ profile: 'default' }) } = {}) {
     this._bin = bin;
+    this._selectedProfile = null;
+    this._generation = 0;
+    this._pending = null;
     this._onChange = onChange;
     this._run = run;
     this._now = now;
     this._where = where;
-    /** @type {{ limits: any[], at: number, zone: string|null }|null} */
+    this._account = account;
+    /** @type {{ limits: any[], at: number, zone: string|null, profile: string }|null} */
     this._last = null;
     this._busy = false;
     this._missedUntil = 0;
   }
 
+  _who() {
+    try { return this._account() ?? { profile: 'default' }; } catch { return { profile: 'default' }; }
+  }
+
   /**
    * THE LAST READING, INSTANTLY, and a refresh started if it has gone stale.
    *
@@ -98,13 +86,28 @@ export class ClaudeUsage {
    * than a pill full of dashes.
    */
   read() {
+    this._syncProfile();
     this._maybeRefresh();
-    return this._last ? { limits: this._last.limits, at: this._last.at } : null;
+    return this.peek();
   }
 
   // The secondary subscription can show its last reading without starting
   // another coding process merely to populate the sidebar.
-  peek() { return this._last ? { limits: this._last.limits, at: this._last.at } : null; }
+  peek() {
+    this._syncProfile();
+    return this._last ? { limits: this._last.limits, at: this._last.at, profile: this._last.profile } : null;
+  }
+
+  _syncProfile() {
+    const account = this._who().profile || 'default';
+    if (account !== this._selectedProfile) {
+      this._selectedProfile = account;
+      this._generation++;
+      this._last = null;
+      this._missedUntil = 0;
+    }
+    return account;
+  }
 
   _maybeRefresh() {
     const now = this._now();
@@ -114,33 +117,65 @@ export class ClaudeUsage {
   }
 
   /** Ask again now, whatever the cache says. The settings screen's own button. */
-  refreshNow() {
+  async refreshNow() {
+    this._syncProfile();
     this._missedUntil = 0;
-    if (!this._busy) this._refresh();
+    // Join an existing reading, including one begun by the background poll.
+    // If it belongs to the previous login, wait for it and then ask this one.
+    const generation = this._generation;
+    const pendingGeneration = this._pendingGeneration;
+    const result = await (this._pending ?? this._refresh());
+    this._syncProfile();
+    if (generation !== this._generation) return { ok: false, error: 'The account changed. Refresh usage again.' };
+    if (pendingGeneration != null && pendingGeneration !== generation) return this.refreshNow();
+    return result;
   }
 
   _refresh() {
+    const profile = this._syncProfile();
+    const generation = this._generation;
     const bin = (() => { try { return this._bin(); } catch { return null; } })();
-    if (!bin) { this._missed(); return; }
+    const failure = (error = USAGE_UNREADABLE) => ({ ok: false, error });
+    if (!bin) { this._missed(); return Promise.resolve(failure()); }
     this._busy = true;
-    this._run(
+    this._pendingGeneration = generation;
+    let resolve;
+    const pending = new Promise(done => { resolve = done; });
+    this._pending = pending;
+    const finish = (err, stdout) => {
+      this._busy = false;
+      this._pending = null;
+      this._pendingGeneration = null;
+      this._syncProfile();
+      if (generation !== this._generation) { resolve(failure()); this._onChange(); return; }
+      // Failed or unreadable output cannot acquire a fresh checked time.
+      const limits = err ? [] : readUsageReport(stdout, this._now());
+      if (!limits.length) {
+        this._missed();
+        const unsupported = /get_usage.*(?:not supported|unknown)|unknown.*get_usage/i.test(err?.message ?? '');
+        resolve(failure(unsupported ? 'Update Claude Code to read usage for this account.' : USAGE_UNREADABLE));
+        return;
+      }
+      this._last = { limits, at: this._now(), zone: localZone(), profile };
+      resolve({ ok: true, reading: this.peek() });
+      // Even unchanged percentages now have a newly checked time to draw.
+      this._onChange();
+    };
+    const env = { ...(this._who().env ?? process.env) };
+    for (const key of Object.keys(env)) {
+      if (/^ANTHROPIC_|^CLAUDE_CODE_/.test(key) || ['CLAUDECODE', 'CLAUDE_PID', 'CLAUDE_EFFORT', 'CLAUDE_CONFIG_DIR'].includes(key)) delete env[key];
+    }
+    if (profile !== 'default') env.CLAUDE_CONFIG_DIR = profile;
+    try { this._run(
       bin,
-      ['-p', '/usage', '--output-format', 'text'],
+      ['-p', '--input-format', 'stream-json', '--output-format', 'stream-json', '--verbose',
+        '--no-session-persistence', '--strict-mcp-config', '--mcp-config', '{"mcpServers":{}}', '--tools', '',
+        '--settings', JSON.stringify({ ...NO_METERED_KEY, disableAllHooks: true })],
       // `cwd` is the whole fix for the permission panels; see usageCwd above.
-      { cwd: this._where(), timeout: TIMEOUT_MS, maxBuffer: 4 * 1024 * 1024, encoding: 'utf8' },
-      (err, stdout) => {
-        this._busy = false;
-        // A COMMAND THAT FAILED LEAVES THE OLD READING ALONE. It is stale rather
-        // than wrong, and a corner that empties itself every time the network
-        // hiccups is worse than one that is five minutes behind.
-        if (err && !stdout) { this._missed(); return; }
-        const limits = readUsage(stdout, this._now(), localZone());
-        if (!limits.length) { this._missed(); return; }
-        const before = JSON.stringify(this._last?.limits ?? null);
-        this._last = { limits, at: this._now(), zone: localZone() };
-        if (JSON.stringify(limits) !== before) this._onChange();
-      },
-    );
+      { cwd: this._where(), env, timeout: TIMEOUT_MS, maxBuffer: 4 * 1024 * 1024, encoding: 'utf8' },
+      finish,
+    ); } catch (err) { finish(err, ''); }
+    return pending;
   }
 
   _missed() {