agentradar-cli 0.1.1 → 0.1.3

package/dist/vendor-runner/feeder.mjs

@@ -0,0 +1,550 @@
+#!/usr/bin/env node
+// ===========================================================================
+// AgentRadar I2 feeder — the INTERACTIVE-HOST variant of the vendor runner.
+//
+// Unlike runner.mjs (which spawns a fresh `claude` per event, out-of-context), the
+// feeder pushes each drained client event as the NEXT TURN of a PERSISTENT, always-on
+// `claude` running in a tmux pane (real in-session continuity — I1). It:
+//   1. phones home to the single AgentRadar AWP MCP and long-polls `next_event`;
+//   2. injects each event into the live pane via `tmux send-keys` (I2), pinning the
+//      EXPLICIT conversationId so the agent's `reply` never guesses the target;
+//   3. acks an event ONLY after the submitted eventId appears in Claude's pane history
+//      (no-phantom: tmux accepting keystrokes is not enough — compaction can discard them).
+//
+// ISOLATION: the feeder (a trusted container-internal daemon) holds AWP_BEARER to
+// drive next_event. It runs OUTSIDE the agent's tmux session, so the bearer is never
+// in the agent's process env nor the vendor-streamed pane. The agent's own outbound
+// calls (reply/report_usage) use awp-only.json (0600) — same as the runner.
+// ===========================================================================
+
+import { spawn, spawnSync } from "node:child_process";
+import { createHash } from "node:crypto";
+import fs from "node:fs";
+import http from "node:http";
+import https from "node:https";
+import { dirname, join } from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { formatInjectionFrame, formatProbeFrame, sendKeysCommands } from "./session-frame.mjs";
+
+const PANE_LIVE_SH = join(dirname(fileURLToPath(import.meta.url)), "pane-live.sh");
+
+const AWP_MCP_ENDPOINT = process.env.AWP_MCP_URL ?? "https://staging.agentradar.com/api/mcp";
+// #152 credential hygiene: PREFER a 0600 file (AWP_BEARER_FILE) so the bearer is never in this
+// process's environment (i.e. not `ps eww`-visible to a co-resident process). Fall back to the raw
+// AWP_BEARER env var for back-compat (Docker `-e`, older supervisors). The file path is not a secret.
+const AWP_BEARER = (() => {
+  const f = process.env.AWP_BEARER_FILE;
+  if (f) {
+    try {
+      return fs.readFileSync(f, "utf8").trim();
+    } catch (e) {
+      console.error(`[feeder] FATAL: AWP_BEARER_FILE set but unreadable (${f}): ${e.message}`);
+      process.exit(1);
+    }
+  }
+  return process.env.AWP_BEARER ?? "";
+})();
+const TMUX_SESSION = process.env.TMUX_SESSION ?? "agent";
+// The claude pid marker (same predicate entrypoint.sh uses) — proves the pane is live.
+const AGENT_PID_PATTERN = process.env.AGENT_PID_PATTERN ?? "mcp-config.*awp-only";
+
+const MCP_CALL_TIMEOUT_MS = Number(process.env.AWP_MCP_CALL_TIMEOUT_MS ?? "30000");
+// #171: mirror the SERVER long-poll hold (NEXT_EVENT_HOLD_MS, default 200s), held UNDER the ~240s ALB
+// idle-timeout so the receive long-poll returns cleanly instead of the ALB killing its socket every
+// cycle ("fetch failed — re-establishing"). SEPARATE from the server's liveness cadence
+// (NEXT_EVENT_LONGPOLL_MS, pinned 240s) — see #171. Leave NEXT_EVENT_HOLD_MS unset for the 200s default.
+const NEXT_EVENT_HOLD_MS = Number(process.env.NEXT_EVENT_HOLD_MS ?? "200000");
+// Watchdog past the server hold so a dead socket aborts → self-heal (matches runner.mjs). At 200s the
+// watchdog is 230s, still under the ~240s ALB idle-timeout.
+const NEXT_EVENT_TIMEOUT_MS = NEXT_EVENT_HOLD_MS + 30000;
+const IDLE_DELAY_MS = Number(process.env.IDLE_DELAY_MS ?? "1000");
+const ERROR_DELAY_MS = Number(process.env.ERROR_DELAY_MS ?? "3000");
+// How long to wait for the pane to come back (mid-revive) before giving up this round.
+const PANE_WAIT_MS = Number(process.env.PANE_WAIT_MS ?? "15000");
+const PANE_POLL_MS = Number(process.env.PANE_POLL_MS ?? "1000");
+// Small settle between literal-text and Enter, and between events, so the TUI keeps up.
+const KEY_SETTLE_MS = Number(process.env.KEY_SETTLE_MS ?? "150");
+// #156 ACT-liveness: how often the feeder samples the pane fingerprint + reports it (L2 stagnation
+// detection). 0 disables. Independent of the long-poll so stagnation is sampled at a useful cadence.
+const REPORT_PANE_INTERVAL_MS = Number(process.env.REPORT_PANE_INTERVAL_MS ?? "45000");
+// #156 cadence fix: report_pane runs on its OWN short-lived connection (mcpPostIsolated), NOT the
+// long-poll's pooled keep-alive socket — that socket is killed by the ALB idle-timeout at ~240s mid-hold,
+// so a report_pane sharing it hangs to MCP_CALL_TIMEOUT and pane sampling stalls. A short timeout bounds
+// any single failure well under the 45s interval.
+const PANE_MCP_TIMEOUT_MS = Number(process.env.PANE_MCP_TIMEOUT_MS ?? "10000");
+
+function sleep(ms) {
+  return new Promise((r) => setTimeout(r, ms));
+}
+
+// --------------------------------------------------------------------------
+// Minimal MCP client over Streamable-HTTP (initialize + tools/call) — the proven
+// shape from runner.mjs, incl. the dead-socket watchdog + session-id handling.
+// --------------------------------------------------------------------------
+let _sessionId = null;
+function parseMcpBody(text) {
+  const trimmed = text.trim();
+  if (trimmed.startsWith("{")) return JSON.parse(trimmed);
+  for (const line of trimmed.split("\n")) {
+    const m = line.match(/^data:\s*(\{.*\})\s*$/);
+    if (m) return JSON.parse(m[1]);
+  }
+  throw new Error(`unparseable MCP response: ${trimmed.slice(0, 200)}`);
+}
+async function mcpPost(method, params, { notification = false, timeoutMs = MCP_CALL_TIMEOUT_MS } = {}) {
+  const headers = {
+    "content-type": "application/json",
+    accept: "application/json, text/event-stream",
+    authorization: `Bearer ${AWP_BEARER}`,
+  };
+  if (_sessionId) headers["mcp-session-id"] = _sessionId;
+  const body = { jsonrpc: "2.0", method, params: params ?? {} };
+  if (!notification) body.id = Date.now();
+  const ac = new AbortController();
+  let timedOut = false;
+  const timer = timeoutMs > 0 ? setTimeout(() => { timedOut = true; ac.abort(); }, timeoutMs) : null;
+  try {
+    const res = await fetch(AWP_MCP_ENDPOINT, { method: "POST", headers, body: JSON.stringify(body), signal: ac.signal });
+    const sid = res.headers.get("mcp-session-id");
+    if (sid) _sessionId = sid;
+    if (notification) return null;
+    const text = await res.text();
+    if (!res.ok) throw new Error(`MCP ${method} → HTTP ${res.status}: ${text.slice(0, 200)}`);
+    const parsed = parseMcpBody(text);
+    if (parsed.error) throw new Error(`MCP ${method} error: ${JSON.stringify(parsed.error)}`);
+    return parsed.result;
+  } catch (err) {
+    if (timedOut) throw new Error(`MCP ${method} client-side timeout after ${timeoutMs}ms (dead poll/socket)`);
+    throw err;
+  } finally {
+    if (timer) clearTimeout(timer);
+  }
+}
+// #156: issue ONE MCP call over a FRESH, keep-alive-OFF connection, independent of the pooled socket
+// the next_event long-poll holds. The AWP server is STATELESS (no session; fresh transport per request),
+// so a bare tools/call over a brand-new short-lived connection is valid and cheap — and it can never
+// inherit the long-poll socket that the ALB idle-timeout kills at ~240s mid-hold. Used by report_pane so
+// pane sampling stays on its 45s cadence regardless of the receive long-poll's socket lifecycle.
+function mcpPostIsolated(method, params, { timeoutMs = PANE_MCP_TIMEOUT_MS } = {}) {
+  return new Promise((resolve, reject) => {
+    let url;
+    try {
+      url = new URL(AWP_MCP_ENDPOINT);
+    } catch (e) {
+      reject(e);
+      return;
+    }
+    const lib = url.protocol === "https:" ? https : http;
+    const AgentCtor = url.protocol === "https:" ? https.Agent : http.Agent;
+    const agent = new AgentCtor({ keepAlive: false });
+    const payload = JSON.stringify({ jsonrpc: "2.0", id: Date.now(), method, params: params ?? {} });
+    const req = lib.request(
+      url,
+      {
+        method: "POST",
+        agent,
+        headers: {
+          "content-type": "application/json",
+          accept: "application/json, text/event-stream",
+          authorization: `Bearer ${AWP_BEARER}`,
+          "content-length": Buffer.byteLength(payload),
+        },
+        timeout: timeoutMs,
+      },
+      (res) => {
+        let bodyText = "";
+        res.setEncoding("utf8");
+        res.on("data", (c) => { bodyText += c; });
+        res.on("end", () => {
+          agent.destroy();
+          const status = res.statusCode ?? 0;
+          if (status >= 400) {
+            reject(new Error(`MCP ${method} → HTTP ${status}: ${bodyText.slice(0, 200)}`));
+            return;
+          }
+          try {
+            const parsed = parseMcpBody(bodyText);
+            if (parsed.error) {
+              reject(new Error(`MCP ${method} error: ${JSON.stringify(parsed.error)}`));
+              return;
+            }
+            resolve(parsed.result);
+          } catch (e) {
+            reject(e);
+          }
+        });
+      },
+    );
+    req.on("timeout", () => { req.destroy(new Error(`MCP ${method} isolated timeout after ${timeoutMs}ms`)); });
+    req.on("error", (err) => { agent.destroy(); reject(err); });
+    req.end(payload);
+  });
+}
+async function mcpInitialize() {
+  _sessionId = null;
+  await mcpPost("initialize", {
+    protocolVersion: "2024-11-05",
+    capabilities: {},
+    clientInfo: { name: "agentradar-i2-feeder", version: "1.0.0" },
+  });
+  await mcpPost("notifications/initialized", {}, { notification: true });
+}
+function toolJson(result) {
+  const text = result?.content?.find((c) => c.type === "text")?.text;
+  return text ? JSON.parse(text) : {};
+}
+async function nextEvent(ackEventIds) {
+  const args = ackEventIds && ackEventIds.length ? { ackEventIds } : {};
+  const result = await mcpPost("tools/call", { name: "next_event", arguments: args }, { timeoutMs: NEXT_EVENT_TIMEOUT_MS });
+  return toolJson(result); // { events: [...] }
+}
+
+// --------------------------------------------------------------------------
+// tmux injection — push one event into the live pane as the agent's next turn.
+// --------------------------------------------------------------------------
+/** True only when this runner's named tmux pane owns a matching agent process. */
+export function paneIsLive(run = spawnSync) {
+  const r = run("/bin/sh", [PANE_LIVE_SH], {
+    encoding: "utf8",
+    env: {
+      PATH: process.env.PATH,
+      TMUX_BIN: process.env.TMUX_BIN ?? "tmux",
+      TMUX_SESSION,
+      AGENT_PID_PATTERN,
+    },
+  });
+  return r.status === 0;
+}
+/** Wait up to PANE_WAIT_MS for the pane to come back (e.g. mid --continue revive). */
+async function waitForLivePane() {
+  const deadline = Date.now() + PANE_WAIT_MS;
+  while (Date.now() < deadline) {
+    if (paneIsLive()) return true;
+    await sleep(PANE_POLL_MS);
+  }
+  return paneIsLive();
+}
+function tmux(argv) {
+  return new Promise((resolve) => {
+    const child = spawn("tmux", argv, { stdio: ["ignore", "ignore", "inherit"] });
+    child.on("close", (code) => resolve(code === 0));
+    child.on("error", () => resolve(false));
+  });
+}
+/** Push one already-formatted frame into the live pane (literal text + Enter). Returns true only if it
+ *  reached a live pane. Shared by real events (injectEvent) and the #156 liveness probe (injectProbe). */
+async function injectFrame(frame, label) {
+  if (!paneIsLive() && !(await waitForLivePane())) {
+    console.warn(`[feeder] pane ${TMUX_SESSION} not live — NOT injecting ${label} (will re-deliver / probe times out)`);
+    return false;
+  }
+  const [literalCmd, enterCmd] = sendKeysCommands(TMUX_SESSION, frame);
+  const okText = await tmux(literalCmd);
+  await sleep(KEY_SETTLE_MS);
+  const okEnter = okText && (await tmux(enterCmd));
+  if (okEnter) console.log(`[feeder] injected ${label}`);
+  else console.warn(`[feeder] send-keys failed for ${label}`);
+  return Boolean(okEnter);
+}
+/**
+ * 🔴 DELIVERED ≠ ACTED. `injectFrame` only proves the KEYSTROKES landed (`tmux send-keys` exit 0) — and the
+ * ack is keyed off that. Measured 2026-08-03: a real Telegram event was logged `injected … → delivered 1/1 →
+ * will ack` while the pane was mid auto-`/compact`; the TUI discarded the text, no turn ever ran, and the
+ * event was acked and lost permanently. A retry 20 min later answered in 15s, so the path was healthy
+ * throughout — the defect is that "typed at" was treated as "received by".
+ *
+ * The first gate is the pane's OWN in-progress hint, which `capturePane` already computes. Returning false
+ * here means NOT delivered, so the eventId never reaches `_pendingAck` and the server re-delivers on the next
+ * poll. A second gate after injection confirms the exact eventId appears in pane history before acking, which
+ * covers compaction states whose rendering has no in-progress hint.
+ *
+ * 🔴 IT LIVES ON injectEvent, NOT injectFrame — deliberately. A liveness PROBE skipped because the pane is
+ * BUSY would time out server-side and be read as act-DEAD, which is precisely backwards: a busy pane is the
+ * strongest evidence the agent is alive. Probes must keep going in unconditionally.
+ *
+ * ponytail: receipt means Claude rendered the exact eventId as a submitted turn, not that it completed the
+ * work. Completion remains tool-specific (`reply`, `report_usage`, etc.); this gate only prevents permanent
+ * loss when tmux accepts keystrokes that Claude discards.
+ */
+const INJECT_BUSY_WAIT_MS = Number(process.env.INJECT_BUSY_WAIT_MS ?? "120000");
+const INJECT_BUSY_POLL_MS = Number(process.env.INJECT_BUSY_POLL_MS ?? "2000");
+
+/** True once the pane is not mid-turn. Unsamplable pane ⇒ true: never block delivery on a broken instrument.
+ *  Sampler/sleep/budget are injected so the gate is drivable with no real pane and no real time. */
+export async function waitForIdlePane(sample = capturePane, sleepFn = sleep, budgetMs = INJECT_BUSY_WAIT_MS) {
+  const deadline = Date.now() + budgetMs;
+  for (;;) {
+    const p = sample();
+    if (!p || !p.inProgress) return true;
+    if (Date.now() >= deadline) return false;
+    await sleepFn(INJECT_BUSY_POLL_MS);
+  }
+}
+
+/** True only when the submitted event appears in Claude's pane history. `send-keys` success alone merely
+ * proves tmux accepted keystrokes; Claude can discard them during compaction. */
+function paneHasEvent(eventId) {
+  if (!eventId) return false;
+  const r = spawnSync("tmux", ["capture-pane", "-p", "-S", "-1000", "-t", TMUX_SESSION], { encoding: "utf8" });
+  return r.status === 0 && typeof r.stdout === "string" && r.stdout.includes(eventId);
+}
+
+/** Wait for Claude to accept the injected frame as a turn. Unobservable means unacknowledged (fail closed). */
+export async function waitForPaneReceipt(eventId, sample = paneHasEvent, sleepFn = sleep, budgetMs = PANE_WAIT_MS) {
+  const deadline = Date.now() + budgetMs;
+  for (;;) {
+    if (sample(eventId)) return true;
+    if (Date.now() >= deadline) return false;
+    await sleepFn(PANE_POLL_MS);
+  }
+}
+
+/** Inject one client event into the live pane. Returns true only after Claude's pane shows the submitted turn. */
+async function injectEvent(event) {
+  if (!(await waitForIdlePane())) {
+    console.warn(
+      `[feeder] pane ${TMUX_SESSION} still mid-turn after ${INJECT_BUSY_WAIT_MS}ms — NOT injecting eventId=${event.eventId}; leaving it UNACKED for re-delivery`,
+    );
+    return false;
+  }
+  const injected = await injectFrame(
+    formatInjectionFrame(event),
+    `eventId=${event.eventId} (source=${event.source}, conversationId=${event.conversationId ?? "-"})`,
+  );
+  if (!injected) return false;
+  if (await waitForPaneReceipt(event.eventId)) return true;
+  console.warn(
+    `[feeder] pane ${TMUX_SESSION} did not show eventId=${event.eventId} after injection — leaving it UNACKED for re-delivery`,
+  );
+  return false;
+}
+/** #156/#173b/#176: inject a liveness probe through the SAME trusted control-plane frame as real events
+ *  (formatProbeFrame → `[AgentRadar inbound · source=agentradar · eventId=<uuid>]`) so a security-hardened
+ *  agent recognizes it as legitimate platform traffic and honors it, rather than refusing a raw in-chat
+ *  instruction as prompt-injection (#173b root cause). #176: the server mints a real UUID eventId
+ *  (shape-matching a real event) so the frame no longer trips an agent's "genuine events have a UUID
+ *  eventId" trust heuristic; the NONCE remains the sole anti-spoof boundary.
+ *  FENCE: the probe is NEVER acked. Its eventId is NOT added to _pendingAck (this path is separate from
+ *  injectEvent's delivered[] → ack flow; the fence is by code-path, independent of the eventId format) — a
+ *  probe is answered by the agent calling liveness_ack(nonce), not by an ackEventIds echo, so it can never
+ *  double-count or mis-ack a real event.
+ *  Best-effort: if the pane is dead we DON'T inject (the probe then times out server-side → the
+ *  act-signal treats genuine silence as act-dead, the correct verdict). */
+async function injectProbe(probe) {
+  if (!probe || !probe.nonce || !probe.instruction) return;
+  await injectFrame(formatProbeFrame(probe), `liveness-probe nonce=${probe.nonce}`);
+}
+
+// --------------------------------------------------------------------------
+// #156 L2 pane-scan — sample the tmux pane fingerprint + an in-progress hint and report it (report_pane).
+// TOKEN-FREE (no LLM): just tmux capture + one MCP call on a timer. A STAGNANT pane while in-progress is
+// a probe TRIGGER server-side — never a decision (a changing pane may be a silent loop).
+// --------------------------------------------------------------------------
+/**
+ * #173b/§4 — strip claude's CLIENT-SIDE-VOLATILE working line(s) before fingerprinting the pane.
+ *
+ * THE corpse-safety fix. claude's TUI animates a spinner + an elapsed-seconds counter mid-turn, e.g.
+ *   "✻ Brewed for 11s"  /  "✻ Mustering… (19s · still thinking)"  + a "… esc to interrupt" hint.
+ * That counter ticks in the CLIENT, independent of the LLM. On a realistic mid-turn API hang (process
+ * alive, LLM dead) the raw capture keeps CHANGING → a raw hash never stagnates → the agent reads ALIVE
+ * forever → we bill a corpse. Hashing only the transcript body (spinner/counter removed) makes a hung
+ * pane produce a STABLE hash → stagnation is detectable. (in_progress detection still uses the RAW text
+ * — the hint is the trigger signal, not part of the fingerprint.)
+ */
+export function stripVolatilePaneLines(text) {
+  return String(text ?? "")
+    .split("\n")
+    .filter((line) => {
+      // the mid-turn interrupt hint (often carries the ticking counter)
+      if (/\besc to (?:interrupt|cancel)\b/i.test(line)) return false;
+      // claude's spinner line, TWO observed forms — a leading animated glyph + a SINGLE gerund word +
+      // the elapsed counter. Tightly anchored (one word before the counter) so real transcript prose
+      // that merely contains "for 5s"/"(5s)" mid-sentence is NOT stripped. The counter grows through
+      // seconds → minutes → hours ("19s" → "1m 44s" → "1h 2m 3s"): past 60s claude switches to the
+      // "Xm Ys" form, so a seconds-ONLY matcher misses a >60s hang and the strip fails to stabilize the
+      // fingerprint (a corpse-safety hole the #176 live C-HANG caught). `\d+s`(-only) → the h/m/s fragment:
+      //   "✻ Brewed for 11s" / "✻ Brewed for 1m 5s"
+      if (/^\s*[^\w\s]\s+\S+\s+for\s+(?:\d+h\s*)?(?:\d+m\s*)?\d+s\b/.test(line)) return false;
+      //   "✻ Mustering… (19s · still thinking)" / "✶ Twisting… (1m 44s)" / "… (1h 2m 3s)"
+      if (/^\s*[^\w\s]\s+\S+…?\s*\(\s*(?:\d+h\s*)?(?:\d+m\s*)?\d+s\b/.test(line)) return false;
+      // #179 claude's CONNECTION-HANG retry loop. On a connection-LEVEL failure (refused / reset / connect-
+      // timeout — distinct from the stream-alive stall the two spinner matchers above cover), claude retries
+      // ~10× on a status line whose countdown AND attempt counter BOTH tick:
+      //   "✻ Unable to connect to API (ConnectionRefused) · Retrying in 3s · attempt 4/10"
+      // Neither matcher above catches it (no "for Ns"/"(Ns"), and the error text truncates on a narrow pane
+      // — "(ConnectionRefuse…" — so the leading text is unstable too. Result: on a connection-hang the
+      // stripped fingerprint DRIFTS as `attempt X/10` increments (and the "Retrying in Ns" counts down) →
+      // pane_stagnant is transiently defeated → a corpse can read alive (the >60s bug's connection-mode
+      // sibling). Anchor on the stable DUAL signature — glyph + "Retrying in <N>s" + "attempt X/Y" — so
+      // real transcript prose (which won't carry BOTH markers on one line) is never over-stripped; `.*`
+      // between them tolerates the truncating/variable error text.
+      if (/^\s*[^\w\s]\s+.*\bRetrying in\s+(?:\d+h\s*)?(?:\d+m\s*)?\d+s\b.*\battempt\s+\d+\/\d+/i.test(line)) return false;
+      return true;
+    })
+    .join("\n");
+}
+
+function capturePane() {
+  const r = spawnSync("tmux", ["capture-pane", "-p", "-t", TMUX_SESSION], { encoding: "utf8" });
+  if (r.status !== 0 || typeof r.stdout !== "string") {
+    // #156 diagnostics: surface WHY capture failed (session mismatch / tmux error) instead of a silent
+    // null return — otherwise report_pane skips with no trace and pane_observed_at silently stalls.
+    if (process.env.DEBUG_PANE) {
+      const why = r.error ? r.error.message : `status=${r.status} stderr=${(r.stderr ?? "").toString().trim().slice(0, 160)}`;
+      console.warn(`[feeder] capture-pane FAILED for session "${TMUX_SESSION}": ${why}`);
+    }
+    return null;
+  }
+  const text = r.stdout;
+  // Fingerprint the TRANSCRIPT BODY only — strip the client-side-ticking spinner/counter so a mid-turn
+  // API hang (LLM dead, counter still ticking) yields a STABLE hash → stagnation is detectable (§4).
+  const hash = createHash("sha256").update(stripVolatilePaneLines(text)).digest("hex").slice(0, 32);
+  // claude's TUI shows a working line ("… esc to interrupt") while mid-turn. This is only a HINT that
+  // triggers a probe on stagnation — it never decides liveness, so a missed/extra hint is harmless.
+  const inProgress = /esc to interrupt|\besc to cancel\b/i.test(text);
+  return { hash, inProgress };
+}
+/**
+ * #173b (disc obs) — format-drift detector. If the STRIPPED fingerprint keeps CHANGING while the pane
+ * still reads in_progress across consecutive samples, that is the signature of a claude working-line
+ * variant the strip FAILED to catch (an unseen glyph/counter syntax ticking through). It also matches
+ * a genuinely-working agent — so this is a DEBUG-only observability hint, NOT a decision: correlated
+ * with "no genuine acts" (the #4 idle-backstop) it flags a strip that needs a new anchor, instead of
+ * silently corpse-billing. Pure so it's unit-testable.
+ */
+export function looksLikeStripMiss(prev, cur) {
+  return Boolean(prev && cur && prev.inProgress && cur.inProgress && prev.hash !== cur.hash);
+}
+let _lastPaneSample = null;
+let _paneReportCount = 0;
+async function reportPane() {
+  // #156 diagnostics: log EVERY outcome (skip / ok+latency / error) under DEBUG_PANE with a monotonic
+  // counter, so a single capture shows whether report_pane is firing at cadence and, if not, exactly
+  // where it fails (tmux capture vs the MCP call). The previous version logged only the catch, so a
+  // null-capture skip left no trace — the silent-stall blind spot.
+  const n = ++_paneReportCount;
+  const t0 = Date.now();
+  try {
+    const p = capturePane();
+    if (!p) {
+      if (process.env.DEBUG_PANE) console.warn(`[feeder] report_pane #${n}: SKIP (no pane capture)`);
+      return;
+    }
+    // #173b (disc obs): flag a possible strip-MISS (stripped hash still ticking while in_progress) so a
+    // future claude working-line format that defeats the strip is OBSERVABLE, not silently corpse-billing.
+    if (process.env.DEBUG_PANE && looksLikeStripMiss(_lastPaneSample, p)) {
+      console.warn(
+        `[feeder] report_pane #${n}: STRIP-MISS? stripped hash changed while in_progress (${_lastPaneSample.hash.slice(0, 8)}→${p.hash.slice(0, 8)}) — real progress OR an uncaught working-line format; if it persists with NO genuine acts, the strip needs a new anchor.`,
+      );
+    }
+    _lastPaneSample = p;
+    // #156: isolated connection (NOT the shared long-poll socket) so pane sampling never stalls behind
+    // the receive long-poll's ALB-killed socket.
+    await mcpPostIsolated("tools/call", { name: "report_pane", arguments: { paneHash: p.hash, inProgress: p.inProgress } });
+    if (process.env.DEBUG_PANE) {
+      console.log(`[feeder] report_pane #${n}: OK hash=${p.hash.slice(0, 8)} inProgress=${p.inProgress} (${Date.now() - t0}ms)`);
+    }
+  } catch (err) {
+    // Best-effort — an older server without report_pane, or a transient error, must never crash the feeder.
+    if (process.env.DEBUG_PANE) {
+      console.warn(`[feeder] report_pane #${n}: ERROR after ${Date.now() - t0}ms — ${err instanceof Error ? err.message : String(err)}`);
+    }
+  }
+}
+
+// --------------------------------------------------------------------------
+// The loop: initialize → poll next_event → inject each into the live pane → ack the
+// delivered ones on the NEXT poll → self-heal on transient MCP errors (runner shape).
+// --------------------------------------------------------------------------
+let _stopping = false;
+let _pendingAck = [];
+let _paneTimer = null;
+
+/** One receive→inject→ack-select cycle (extracted from loop() + exported so the #173b _pendingAck
+ *  fence is directly testable). Sets `_pendingAck` = the eventIds to ack on the NEXT poll. */
+export async function pollOnce(paneLive = paneIsLive) {
+  // next_event refreshes the portal's runner heartbeat. Never call it for a detached/orphan feeder: a
+  // process without its owned tmux session cannot receive work, so polling would paint a false Live state
+  // while every event stays unacknowledged. The supervisor recreates the session; until then the durable
+  // queue remains untouched and liveness ages out honestly.
+  if (!paneLive()) {
+    console.warn(`[feeder] pane ${TMUX_SESSION} not live — not polling next_event`);
+    await sleep(IDLE_DELAY_MS);
+    return;
+  }
+  const { events = [], livenessProbe } = await nextEvent(_pendingAck.length ? _pendingAck : undefined);
+  _pendingAck = [];
+  // #156/#173b: forward a liveness probe (if any) into the pane so the agent proves it can act.
+  // Framed like an event for TRUST (synthetic `probe-<nonce>` eventId, control-plane source) but
+  // NEVER acked — its synthetic eventId is display-only provenance, NOT pushed to _pendingAck; the
+  // agent answers via liveness_ack(nonce), not an ackEventIds echo. THIS IS THE FENCE: injectProbe is
+  // a separate path from the events→delivered→_pendingAck flow below, so a probe can never be acked
+  // as a delivered event (no double-count / no mis-ack of a real event).
+  if (livenessProbe) await injectProbe(livenessProbe);
+  if (events.length === 0) {
+    await sleep(IDLE_DELAY_MS);
+    return;
+  }
+  console.log(`[feeder] received ${events.length} event(s) → injecting into live session`);
+  const delivered = [];
+  for (const e of events) {
+    // Inject in order; ack ONLY the ones that reached a live pane (no-phantom).
+    // eslint-disable-next-line no-await-in-loop
+    if (await injectEvent(e)) delivered.push(e.eventId);
+    // eslint-disable-next-line no-await-in-loop
+    else break; // pane went away mid-batch → stop; unacked events re-deliver in order.
+    // eslint-disable-next-line no-await-in-loop
+    await sleep(KEY_SETTLE_MS);
+  }
+  _pendingAck = delivered;
+  if (delivered.length) console.log(`[feeder] delivered ${delivered.length}/${events.length} → will ack`);
+}
+
+async function loop() {
+  await mcpInitialize();
+  console.log(`[feeder] connected to ${AWP_MCP_ENDPOINT} — pushing into tmux session "${TMUX_SESSION}"`);
+  // #156: start the L2 pane-scan on its own cadence (independent of the long-poll). Best-effort.
+  if (REPORT_PANE_INTERVAL_MS > 0 && !_paneTimer) {
+    _paneTimer = setInterval(() => { void reportPane(); }, REPORT_PANE_INTERVAL_MS);
+    _paneTimer.unref?.();
+  }
+  while (!_stopping) {
+    try {
+      await pollOnce();
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      console.error(`[feeder] iteration error: ${msg} — re-establishing MCP session`);
+      _sessionId = null;
+      let reconnected = false;
+      for (let attempt = 1; attempt <= 5 && !_stopping && !reconnected; attempt++) {
+        try {
+          await mcpInitialize();
+          reconnected = true;
+          console.log(`[feeder] reconnected (attempt ${attempt}) — resuming poll`);
+        } catch (e) {
+          console.error(`[feeder] reconnect attempt ${attempt} failed: ${e instanceof Error ? e.message : String(e)}`);
+          await sleep(ERROR_DELAY_MS * attempt);
+        }
+      }
+      if (!reconnected) await sleep(ERROR_DELAY_MS);
+    }
+  }
+}
+
+// Run the feeder only when executed directly (not when imported for tests).
+const isMain = process.argv[1] ? pathToFileURL(process.argv[1]).href === import.meta.url : false;
+if (isMain) {
+  for (const sig of ["SIGINT", "SIGTERM"]) {
+    process.on(sig, () => { console.log(`[feeder] ${sig} — stopping`); _stopping = true; if (_paneTimer) clearInterval(_paneTimer); setTimeout(() => process.exit(0), 500); });
+  }
+
+  if (!AWP_BEARER) {
+    console.error("[feeder] FATAL: no AWP bearer — set AWP_BEARER_FILE (0600 file, preferred) or AWP_BEARER; cannot poll next_event");
+    process.exit(1);
+  }
+  console.log("[feeder] starting — interactive-host push feeder; bearer held here, NOT in the agent pane.");
+  loop().catch((err) => { console.error(`[feeder] fatal: ${err?.message ?? err}`); process.exit(1); });
+}
+
+// Exported for tests (#156). Importing this module does NOT start the feeder (see isMain guard).
+export { mcpPost, mcpPostIsolated, reportPane, capturePane, parseMcpBody };

package/dist/vendor-runner/pane-live.sh

@@ -0,0 +1,27 @@
+#!/bin/sh
+# A runner is live only when a matching agent process belongs to a pane in its named tmux session.
+# A machine-global pgrep can borrow another agent (or a stale orphan) and paint this runner Live.
+set -u
+
+: "${TMUX_SESSION:?TMUX_SESSION required}"
+: "${AGENT_PID_PATTERN:?AGENT_PID_PATTERN required}"
+TMUX_BIN="${TMUX_BIN:-tmux}"
+
+frontier="$("${TMUX_BIN}" list-panes -t "${TMUX_SESSION}" -F '#{pane_pid}' 2>/dev/null)" || exit 1
+[ -n "${frontier}" ] || exit 1
+
+depth=0
+while [ -n "${frontier}" ] && [ "${depth}" -lt 8 ]; do
+  next=""
+  for pid in ${frontier}; do
+    if ps -p "${pid}" -o command= 2>/dev/null | grep -Eq -- "${AGENT_PID_PATTERN}"; then
+      exit 0
+    fi
+    children="$(pgrep -P "${pid}" 2>/dev/null || true)"
+    next="${next} ${children}"
+  done
+  frontier="${next}"
+  depth=$((depth + 1))
+done
+
+exit 1