ai-foreman 1.7.16 → 1.7.18

package/dist/activity.js

@@ -188,9 +188,16 @@ export class ActivityReporter {
             this.lastSemanticKey = semanticKey;
             return;
         }
+        const semanticKey = semanticStatusKey(body);
+        // Append-only outputs cannot replace an earlier line.  Emit the first
+        // state and meaningful state changes, but do not turn a changing counter
+        // or elapsed time into an endless log stream.
+        if (semanticKey === this.lastSemanticKey)
+            return;
         if (force || now - this.lastHeartbeatAt >= this.heartbeatMs) {
             this.lastHeartbeatAt = now;
             this.output.write(`[${new Date(now).toISOString()}] rafi working: ${body} (${formatDuration(now - this.commandStartedAt)})\n`);
+            this.lastSemanticKey = semanticKey;
         }
     }
     clearLine() {
@@ -277,7 +284,13 @@ function clean(value, maximum) {
     return value.replace(/[\r\n\t]+/g, " ").replace(/\s+/g, " ").trim().slice(0, maximum);
 }
 function semanticStatusKey(body) {
-    return body.replace(/\p{Number}+(?:[.,]\p{Number}+)*/gu, "#");
+    return body
+        // Counters, percentages, ticket suffixes, and model version numbers.
+        .replace(/\p{Number}+(?:[.,]\p{Number}+)*/gu, "#")
+        // Commit IDs, request IDs, and generated hexadecimal identifiers.
+        .replace(/\b[\da-f]{7,}\b/giu, "#")
+        .replace(/\s+/g, " ")
+        .trim();
 }
 function resolveTtyMode(requested) {
     const configured = requested ?? configuredTtyMode(process.env.RAFI_ACTIVITY_RENDER_MODE);

package/dist/adapters/claude.d.ts

@@ -102,5 +102,10 @@ export declare class ClaudeAdapter implements BuilderAdapter {
     private failSessionIdentity;
     private observeSession;
     private settlePending;
+    private touchPendingTurn;
+    private beginProviderQuestionWait;
+    private endProviderQuestionWait;
+    private armPendingTurn;
+    private providerIdleTimeoutMs;
     private streamFailureResult;
 }

package/dist/adapters/claude.js

@@ -17,6 +17,7 @@ import { normalizeRuntimeErrorText } from "../runtimeAuth.js";
 import { classifyClaudeSdkFailure, resolveExecutablePath, sanitizeDiagnostics, } from "../runtimeReadiness.js";
 import { createProviderSessionRef, validateProviderSessionScope, canonicalSessionPath } from "../sessionIdentity.js";
 import { SessionUnavailableError, sessionUnavailableResult } from "./sessionFailure.js";
+const DEFAULT_PROVIDER_IDLE_TIMEOUT_MS = 30 * 60_000;
 /**
  * Pure function: build the `options` object passed to `query()`.
  * Extracted so tests can assert on the shape without making a live SDK call.
@@ -33,7 +34,10 @@ export function buildClaudeQueryOptions(opts) {
         permissionMode: qaReadOnly ? "default" : "acceptEdits",
         effort: opts.effort,
         extraArgs: opts.fast ? { fast: null } : undefined,
-        settingSources: qaReadOnly ? [] : ["user", "project", "local"],
+        // Read-only roles still need the user's Claude authentication settings (for
+        // example, an enterprise apiKeyHelper). Do not load repository-controlled
+        // settings in those roles.
+        settingSources: qaReadOnly ? ["user"] : ["user", "project", "local"],
         ...(qaReadOnly ? { disallowedTools: ["Write", "Edit", "NotebookEdit"] } : {}),
         ...(qaReadOnly ? { sandbox: {
                 enabled: true,
@@ -56,7 +60,7 @@ export function buildClaudeQueryOptions(opts) {
     return base;
 }
 function qaEnvironment(source, cwd) {
-    const allowed = ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "TMPDIR", "LANG", "LC_ALL", "TERM", "NO_COLOR", "FORCE_COLOR", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY", "SSL_CERT_FILE", "SSL_CERT_DIR", "NODE_EXTRA_CA_CERTS"];
+    const allowed = ["PATH", "HOME", "USER", "LOGNAME", "SHELL", "TMPDIR", "LANG", "LC_ALL", "TERM", "NO_COLOR", "FORCE_COLOR", "ANTHROPIC_API_KEY", "ANTHROPIC_AUTH_TOKEN", "ANTHROPIC_BASE_URL", "CLAUDE_CODE_API_KEY_HELPER_TTL_MS", "HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY", "SSL_CERT_FILE", "SSL_CERT_DIR", "NODE_EXTRA_CA_CERTS"];
     return { ...Object.fromEntries(allowed.flatMap((key) => source[key] === undefined ? [] : [[key, source[key]]])), TMPDIR: join(dirname(cwd), "scratch") };
 }
 export async function probeClaudeSession(ref, input) {
@@ -255,18 +259,30 @@ export class ClaudeAdapter {
                                 }] }] },
                 stderr: (data) => this.captureStderr(data),
                 canUseTool: async (toolName, input, requestOptions = {}) => {
-                    const decision = await opts.permission({
-                        toolName,
-                        input,
-                        signal: requestOptions.signal,
-                        title: requestOptions.title,
-                        displayName: requestOptions.displayName,
-                        description: requestOptions.description,
-                        decisionReason: requestOptions.decisionReason,
-                        blockedPath: requestOptions.blockedPath,
-                        toolUseID: requestOptions.toolUseID,
-                    });
-                    return permissionDecisionToClaudeResult(decision, requestOptions.toolUseID);
+                    const isProviderQuestion = toolName === "AskUserQuestion";
+                    if (isProviderQuestion)
+                        this.beginProviderQuestionWait();
+                    try {
+                        const decision = await opts.permission({
+                            toolName,
+                            input,
+                            signal: requestOptions.signal,
+                            title: requestOptions.title,
+                            displayName: requestOptions.displayName,
+                            description: requestOptions.description,
+                            decisionReason: requestOptions.decisionReason,
+                            blockedPath: requestOptions.blockedPath,
+                            toolUseID: requestOptions.toolUseID,
+                        });
+                        if (isProviderQuestion)
+                            this.endProviderQuestionWait(decision.behavior === "allow");
+                        return permissionDecisionToClaudeResult(decision, requestOptions.toolUseID);
+                    }
+                    catch (error) {
+                        if (isProviderQuestion)
+                            this.endProviderQuestionWait(false);
+                        throw error;
+                    }
                 },
             },
         });
@@ -310,6 +326,7 @@ export class ClaudeAdapter {
         }
     }
     handle(msg) {
+        this.touchPendingTurn();
         if ("session_id" in msg && typeof msg.session_id === "string") {
             this.observeSession(msg.session_id, "cwd" in msg && typeof msg.cwd === "string" ? msg.cwd : undefined);
         }
@@ -510,7 +527,8 @@ export class ClaudeAdapter {
             this.turnSignals = [];
             this.structuredError = undefined;
             this.apiErrorStatus = undefined;
-            this.pending = { resolve, reject, instruction: text, turnId: this.activeProviderTurnId ?? randomUUID() };
+            const pending = this.pending = { resolve, reject, instruction: text, turnId: this.activeProviderTurnId ?? randomUUID() };
+            this.armPendingTurn(pending);
             this.inbox.push({
                 type: "user",
                 message: { role: "user", content: text },
@@ -770,6 +788,8 @@ export class ClaudeAdapter {
         if (!pending)
             return;
         this.pending = undefined;
+        if (pending.idleTimer)
+            clearTimeout(pending.idleTimer);
         if (!result.turnId) {
             result.turnId = pending.turnId;
             result.hostInstruction = pending.instruction;
@@ -782,6 +802,52 @@ export class ClaudeAdapter {
             this.eventQueue.push({ kind: "turn-complete", result, turnId: result.turnId });
         pending.resolve(result);
     }
+    touchPendingTurn() {
+        if (this.pending)
+            this.armPendingTurn(this.pending);
+    }
+    beginProviderQuestionWait() {
+        const pending = this.pending;
+        if (!pending)
+            return;
+        pending.providerQuestionWaits = (pending.providerQuestionWaits ?? 0) + 1;
+        if (pending.idleTimer)
+            clearTimeout(pending.idleTimer);
+        pending.idleTimer = undefined;
+    }
+    endProviderQuestionWait(answered) {
+        const pending = this.pending;
+        if (!pending)
+            return;
+        pending.providerQuestionWaits = Math.max(0, (pending.providerQuestionWaits ?? 1) - 1);
+        pending.providerQuestionAnswered ||= answered;
+        if (pending.providerQuestionWaits === 0)
+            this.armPendingTurn(pending);
+    }
+    armPendingTurn(pending) {
+        if (pending.idleTimer)
+            clearTimeout(pending.idleTimer);
+        if ((pending.providerQuestionWaits ?? 0) > 0)
+            return;
+        const timeoutMs = this.providerIdleTimeoutMs();
+        pending.idleTimer = setTimeout(() => {
+            if (this.pending !== pending || this.closed)
+                return;
+            const context = pending.providerQuestionAnswered ? " after your answer was sent" : "";
+            const message = `Claude provider was silent for ${Math.round(timeoutMs / 60_000)} minutes${context}; the turn may have been dispatched and will not be retried automatically`;
+            const result = this.streamFailureResult(message, false);
+            this.eventQueue.push({ kind: "error", message });
+            this.settlePending(result);
+            // Do not leave a hidden stream running after the host has declared its
+            // result uncertain.  close() is intentionally not awaited here.
+            void this.close();
+        }, timeoutMs);
+        pending.idleTimer.unref();
+    }
+    providerIdleTimeoutMs() {
+        const configured = this.opts.providerIdleTimeoutMs;
+        return Number.isFinite(configured) && configured > 0 ? configured : DEFAULT_PROVIDER_IDLE_TIMEOUT_MS;
+    }
     streamFailureResult(message, sessionUnavailable) {
         if (sessionUnavailable) {
             const availability = {

package/dist/adapters/codex.d.ts

@@ -71,6 +71,8 @@ export declare class CodexAdapter implements BuilderAdapter {
     private handle;
     private observationContext;
     private waitFor;
+    private touchWaiters;
+    private providerIdleTimeoutMs;
     private disconnect;
     private restartForAutoCompaction;
     private buildSkillsAppendix;

package/dist/adapters/codex.js

@@ -24,6 +24,8 @@ export function parseCodexLine(raw) {
         return { events: [{ kind: "error", message: String(raw.error?.message ?? JSON.stringify(raw)) }] };
     return { events: [] };
 }
+/** A provider can legitimately take a long time, but not without any event. */
+const DEFAULT_PROVIDER_IDLE_TIMEOUT_MS = 30 * 60_000;
 /** Persistent JSON-RPC controller for one live Codex thread. */
 export class CodexAdapter {
     opts;
@@ -129,7 +131,7 @@ export class CodexAdapter {
             await this.ensureThread();
             this.activeText = [];
             this.lastTurnTokens = undefined;
-            const completion = this.waitFor("turn/completed", (params) => params.threadId === this._sessionId);
+            const completion = this.waitFor("turn/completed", (params) => params.threadId === this._sessionId, this.providerIdleTimeoutMs(), true);
             turnStartDispatched = true;
             await this.request("turn/start", {
                 threadId: this._sessionId,
@@ -478,6 +480,7 @@ export class CodexAdapter {
         this.process.stdin.write(`${JSON.stringify(message)}\n`);
     }
     handle(message) {
+        this.touchWaiters();
         if (message.id !== undefined) {
             const pending = this.pending.get(message.id);
             if (pending) {
@@ -614,28 +617,42 @@ export class CodexAdapter {
             ticketId: this.opts.ticketId ?? inherited.ticketId, deliveryUnitId: this.opts.deliveryUnitId ?? inherited.deliveryUnitId,
             parentSpanId: this.activeProviderTurnSpanId ?? inherited.parentSpanId, providerTurnId: this.activeProviderTurnId ?? inherited.providerTurnId };
     }
-    waitFor(method, predicate, timeoutMs) {
+    waitFor(method, predicate, timeoutMs, resetOnProviderActivity = false) {
         return new Promise((resolve, reject) => {
             let timeout;
+            const clear = () => { if (timeout)
+                clearTimeout(timeout); timeout = undefined; };
             const waiter = {
                 predicate,
-                resolve: (params) => { if (timeout)
-                    clearTimeout(timeout); resolve(params); },
-                reject: (error) => { if (timeout)
-                    clearTimeout(timeout); reject(error); },
+                resolve: (params) => { clear(); resolve(params); },
+                reject: (error) => { clear(); reject(error); },
             };
             const waiters = this.notificationWaiters.get(method) ?? [];
             waiters.push(waiter);
             this.notificationWaiters.set(method, waiters);
             if (timeoutMs !== undefined) {
-                timeout = setTimeout(() => {
-                    const active = this.notificationWaiters.get(method) ?? [];
-                    this.notificationWaiters.set(method, active.filter((candidate) => candidate !== waiter));
-                    reject(new Error(`Timed out waiting for Codex app-server notification ${method}`));
-                }, timeoutMs);
+                const arm = () => {
+                    timeout = setTimeout(() => {
+                        const active = this.notificationWaiters.get(method) ?? [];
+                        this.notificationWaiters.set(method, active.filter((candidate) => candidate !== waiter));
+                        reject(new Error(`Codex provider was silent for ${Math.round(timeoutMs / 60_000)} minutes while waiting for ${method}; the turn may have been dispatched and will not be retried automatically`));
+                    }, timeoutMs);
+                };
+                if (resetOnProviderActivity)
+                    waiter.touch = () => { clear(); arm(); };
+                arm();
             }
         });
     }
+    touchWaiters() {
+        for (const waiters of this.notificationWaiters.values())
+            for (const waiter of waiters)
+                waiter.touch?.();
+    }
+    providerIdleTimeoutMs() {
+        const configured = this.opts.providerIdleTimeoutMs;
+        return Number.isFinite(configured) && configured > 0 ? configured : DEFAULT_PROVIDER_IDLE_TIMEOUT_MS;
+    }
     disconnect(error) {
         const child = this.process;
         this.process = undefined;

package/dist/adapters/types.d.ts

@@ -246,6 +246,13 @@ export interface BuilderAdapterOptions {
     allowAutoCompactionSetupTurn?: boolean;
     /** Raw-adapter observability; wrapper adapters must not persist re-emitted events. */
     observer?: RunObserver;
+    /**
+     * Maximum time a dispatched provider turn may remain completely silent.
+     * This is an idle timeout, not a total turn limit: every provider message
+     * resets it.  A timeout is intentionally terminal and has unknown dispatch
+     * state, so callers must never replay the instruction automatically.
+     */
+    providerIdleTimeoutMs?: number;
 }
 export interface BuilderAdapter {
     readonly agent: "claude" | "codex";

package/dist/branch/git.js

@@ -129,7 +129,9 @@ export function mergeBranchToLocalBase(projectDir, branch, baseBranch, message,
         runGit(projectDir, ["checkout", baseBranch]);
     }
     if (method === "squash") {
-        runGit(projectDir, ["merge", "--squash", branch]);
+        // A user's global `merge.ff=only` conflicts with `--squash`; pin the
+        // ordinary merge policy so direct delivery remains independent of it.
+        runGit(projectDir, ["-c", "merge.ff=true", "merge", "--squash", branch]);
         runGit(projectDir, ["commit", "-m", message]);
     }
     else if (method === "merge") {

package/dist/branch/github.js

@@ -53,10 +53,10 @@ export function originLooksLikeGitHub(cwd) {
 export function checkGitHubReadiness(cwd) {
     const ghVersion = runCommand(cwd, "gh", ["--version"], 5_000);
     if (!ghVersion.ok) {
-        return failure("gh_missing", "GitHub CLI is not installed or is not on PATH.", [
+        return classifyCommandFailure(ghVersion, "gh_missing", "GitHub CLI is not installed or is not on PATH.", [
             "Install GitHub CLI: https://cli.github.com/",
             "gh --version",
-        ], ghVersion);
+        ]);
     }
     const remote = inspectGitHubRemote(cwd);
     if (!remote.ok)

package/dist/buildRuns.js

@@ -1,5 +1,5 @@
 import { createHash, randomUUID } from "node:crypto";
-import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, statSync, writeFileSync } from "node:fs";
+import { existsSync, mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from "node:fs";
 import { hostname } from "node:os";
 import { join, resolve } from "node:path";
 import { execFileSync } from "node:child_process";
@@ -12,6 +12,7 @@ import { captureCurrentWorkflowSessionIdentity, currentWorkflowIdentityKey } fro
 import { isTicketsInitialized, loadTicketsConfig, resolveTicketPaths } from "./tickets/config.js";
 import { loadTickets } from "./tickets/ticketLoader.js";
 import { loadProjectAutonomyConfig, resolveAutonomyPolicy } from "./recoveryPolicy.js";
+import { isLiveProcessIdentity, processStartIdentity } from "./processIdentity.js";
 export const BUILD_RUN_VERSION = 3;
 export const BUILD_RUN_DIRECTORY = ".foreman/runs";
 export const BUILD_HEARTBEAT_MS = 10_000;
@@ -280,13 +281,7 @@ function workflowLeaseLooksLive(lease, now) {
         return false;
     if (lease.host !== hostname())
         return true;
-    try {
-        process.kill(lease.pid, 0);
-        return lease.processStart === processStartIdentity(lease.pid);
-    }
-    catch {
-        return false;
-    }
+    return isLiveProcessIdentity(lease.pid, lease.processStart);
 }
 /**
  * Current-branch runs created before ticket checkpointing did not retain their
@@ -331,13 +326,7 @@ export function isLeaseActive(run, now = new Date()) {
         return false;
     if (run.lease.hostname !== hostname())
         return true;
-    try {
-        process.kill(run.lease.pid, 0);
-        return run.lease.processStart === processStartIdentity(run.lease.pid);
-    }
-    catch {
-        return false;
-    }
+    return isLiveProcessIdentity(run.lease.pid, run.lease.processStart);
 }
 export function buildRecoveryPreview(run) {
     const completed = Object.keys(run.receipts).sort();
@@ -477,14 +466,6 @@ export function formatBuildRecoveryProjection(projection) {
 function currentLease(now) {
     return { hostname: hostname(), pid: process.pid, processStart: processStartIdentity(process.pid), heartbeatAt: now.toISOString() };
 }
-function processStartIdentity(pid) {
-    try {
-        return statSync(`/proc/${pid}`).birthtimeMs.toString();
-    }
-    catch {
-        return pid === process.pid ? `${Date.now() - Math.round(process.uptime() * 1000)}` : "unknown";
-    }
-}
 function validateBuildRun(run) {
     if (![1, 2, 3].includes(run.version) || !run.runId || !run.repository?.root || !run.repository.worktree || !run.createdAt || !run.updatedAt) {
         throw new Error("invalid build run record");

package/dist/cli/events.js

@@ -2,6 +2,7 @@ import { currentActivity } from "../activity.js";
 /** Print a compact live feed of builder activity. */
 export async function printEvents(events) {
     let atLineStart = true;
+    const startedTools = new Set();
     for await (const ev of events) {
         if (ev.kind === "text") {
             if (ev.text) {
@@ -17,11 +18,30 @@ export async function printEvents(events) {
             }
         }
         else if (ev.kind === "tool") {
+            const key = ev.callId ?? `${ev.name}\u0000${briefInput(ev.input)}`;
+            // A tool normally arrives as started, progress, then completed.  The
+            // activity reporter owns that mutable live state; keeping only its
+            // initial permanent line avoids printing the same operation three times.
+            if (ev.lifecycle === "progress")
+                continue;
+            if (ev.lifecycle === "completed" && startedTools.delete(key) && ev.status !== "failed" && (ev.exitCode === undefined || ev.exitCode === 0))
+                continue;
+            if (ev.lifecycle === "started") {
+                startedTools.add(key);
+                // The activity display is mutable, so a started tool is shown there
+                // and then replaced by its next state instead of becoming a durable
+                // line in the feed.
+                if (currentActivity())
+                    continue;
+            }
             if (!atLineStart) {
                 process.stdout.write("\n");
                 atLineStart = true;
             }
-            writeLine(`  -> ${ev.name} ${briefInput(ev.input)}`);
+            const outcome = ev.lifecycle === "completed"
+                ? ev.status === "failed" || (ev.exitCode !== undefined && ev.exitCode !== 0) ? " failed" : " completed"
+                : "";
+            writeLine(`  -> ${ev.name} ${briefInput(ev.input)}${outcome}`.trimEnd());
         }
         else if (ev.kind === "turn-complete") {
             if (!atLineStart) {

package/dist/cli/start.js

@@ -1857,7 +1857,7 @@ export function buildStartCommand() {
                             } },
                         }, (line, snapshot) => {
                             const activity = currentActivity();
-                            if (activity && process.stdout.isTTY)
+                            if (activity)
                                 activity.setAgentStatus(line.replace(/^\[[^\]]+\]\s*/, ""));
                             else
                                 console.log(line);
@@ -2153,7 +2153,7 @@ export function buildStartCommand() {
             } },
         }, (line, snapshot) => {
             const activity = currentActivity();
-            if (activity && process.stdout.isTTY)
+            if (activity)
                 activity.setAgentStatus(line.replace(/^\[[^\]]+\]\s*/, ""));
             else
                 console.log(line);

package/dist/cli/tickets.d.ts

@@ -1,9 +1,10 @@
 import { Command } from "commander";
+import type { StructuredPlanV1 } from "rafi-spec";
 import { Log } from "../log.js";
 import type { EffortLevel } from "../adapters/types.js";
 import { type RoleBuilderOptions } from "../agentRun.js";
 import type { TicketsConfig } from "../tickets/config.js";
-export declare function buildPopulateInstruction(sourceHints?: string[], progressDoc?: string): string;
+export declare function buildPopulateInstruction(approvedPlanPath: string, contextSources?: string[], progressDoc?: string): string;
 export declare function resolvePopulateSources(projectDir: string, explicitSources: string[] | undefined, ticketsConfig: TicketsConfig): string[] | undefined;
 export declare function buildPopulateAgentRunOptions(opts: {
     projectDir: string;
@@ -26,6 +27,17 @@ interface PopulateCommandOptions {
 }
 export declare function combineRequirementSelections(selected: string[], additions: string): string[];
 export declare function cmdPopulateCli(opts: PopulateCommandOptions): Promise<void>;
+export interface PopulationPlanResolution {
+    /** Repository-relative path when possible, for both agent instructions and diagnostics. */
+    path: string;
+    plan: StructuredPlanV1;
+}
+/**
+ * Locate the plan that Rafi approved independently of the documents the user
+ * wants Ticket Maker to use as context. In particular, FEATURES.md is not a
+ * promise that FEATURES.json is a Rafi plan.
+ */
+export declare function resolvePopulationPlan(projectDir: string, contextSources: string[], ticketsConfig: TicketsConfig): PopulationPlanResolution;
 export interface TicketOwnershipReceipt {
     path: string;
     category: "tickets";

package/dist/cli/tickets.js

@@ -1,6 +1,6 @@
 import { Command } from "commander";
 import { existsSync, readFileSync } from "node:fs";
-import { dirname, isAbsolute, join, resolve } from "node:path";
+import { dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { parse as parseYaml } from "yaml";
 import { select, text, confirm, isCancel, multiselect } from "@clack/prompts";
 import { loadConfig } from "../config.js";
@@ -64,23 +64,27 @@ function validateEffort(effort) {
         fail(err instanceof Error ? err.message : String(err));
     }
 }
-export function buildPopulateInstruction(sourceHints, progressDoc = "docs/ticket-progress.md") {
-    const sources = sourceHints ?? [];
+export function buildPopulateInstruction(approvedPlanPath, contextSources, progressDoc = "docs/ticket-progress.md") {
+    const sources = contextSources ?? [];
     const sourceHintBlock = sources.length > 0
         ? `
-User-provided planning source hints:
+Original context source hints:
 ${sources.map((source) => `- ${source}`).join("\n")}
 
 Treat these as files, folders, or globs to check first. Any reasonable project-planning format is acceptable because you are responsible for interpreting it. If a hinted source does not exist or is ambiguous, continue scanning the repository before asking for help.
 `
         : `
-No specific planning sources were provided. Scan the repository for relevant planning and ticketing documents.
+No original context sources were provided. Use the approved plan and scan the repository only when it is needed to resolve its references.
 `;
     return `You are being run by Foreman to populate this repository's Foreman ticket tracker.
 
 Goal:
 - Convert every existing project ticket, task, backlog item, roadmap item, or implementation step into Foreman's structured ticket system.
 - Do not implement product/code changes. Only update ticket-tracker files.
+\nApproved structured Rafi plan (authoritative for plan identity and slice mapping):
+- ${approvedPlanPath}
+
+Read this approved plan before all other sources. It determines the exact plan_id, revision, and slice_ref values that the proposal must use. The context sources below provide supporting product and implementation detail; they do not replace or redefine the approved plan.
 ${sourceHintBlock}
 
 Before proposing, read these tracker control files:
@@ -89,7 +93,7 @@ Before proposing, read these tracker control files:
 - .tickets/tracker-rules.md
 - ${progressDoc} if it exists
 
-Then inspect the repository for existing planning sources, beginning with the approved structured Rafi plan. You are proposal-only: do not edit any file, run tracker mutation commands, allocate final ticket IDs, or write delivery configuration. Rafi validates and performs all writes after approval.
+Then inspect the repository for the context required by the approved structured Rafi plan. You are proposal-only: do not edit any file, run tracker mutation commands, allocate final ticket IDs, or write delivery configuration. Rafi validates and performs all writes after approval.
 
 Return ticket content using Foreman's schema:
 - slice_ref: the exact approved plan slice reference. Do not allocate ticket IDs.
@@ -355,13 +359,13 @@ async function collectTicketSetupPatch(dir, opts, current) {
         };
     }
     const section = await select({
-        message: "Which ticket setup section should be configured?",
+        message: "What would you like to configure for tickets?",
         options: [
-            { value: "sources", label: "Ticket sources" },
-            { value: "populate", label: "Populate defaults" },
-            { value: "build", label: "Build defaults" },
-            { value: "limits", label: "Tracker limits" },
-            { value: "all", label: "All sections" },
+            { value: "sources", label: "Where tickets come from", hint: "Choose planning files, issue trackers, or other sources." },
+            { value: "populate", label: "How Rafi creates tickets from those sources", hint: "Set import and enrichment behavior." },
+            { value: "build", label: "How Rafi implements tickets", hint: "Set branches, validation, and completion behavior." },
+            { value: "limits", label: "Ticket tracker limits", hint: "Set how many tickets Rafi can show or work on at once." },
+            { value: "all", label: "Configure everything", hint: "Walk through every ticket setting." },
         ],
     });
     if (isCancel(section))
@@ -387,6 +391,15 @@ async function collectTicketSetupPatch(dir, opts, current) {
         };
     }
     if (section === "populate" || section === "all") {
+        console.log([
+            "Recommended population settings:",
+            "  • Use the saved ticket sources by default.",
+            "  • Use the project's configured agent when both runtimes are available.",
+            `  • Import up to ${DEFAULT_TICKET_SETUP.populate.import_cap} tickets per run.`,
+            `  • Import up to ${DEFAULT_TICKET_SETUP.populate.comment_limit} comments per external ticket.`,
+            "  • Generate deterministic recommendations during population.",
+            "  • Recommend splitting XL tickets.",
+        ].join("\n"));
         const defaults = await confirm({ message: "Use the recommended population settings?", initialValue: true });
         if (isCancel(defaults))
             cancelTicketInterview();
@@ -492,7 +505,7 @@ async function collectTicketSetupPatch(dir, opts, current) {
             buildPatch.cleanup = true;
             buildPatch.auto_merge_wait = false;
             buildPatch.auto_merge_timeout_minutes = null;
-            buildPatch.validation_checklist = await promptRequirementList("validation checklist", current.build.validation_checklist);
+            buildPatch.validation_checklist = await promptValidationChecklist(current.build.validation_checklist);
             return {
                 sources,
                 limits,
@@ -540,7 +553,7 @@ async function collectTicketSetupPatch(dir, opts, current) {
                 description_sections: await promptRequirementList("required PR/MR description sections", current.build.review.description_sections),
             };
         }
-        buildPatch.validation_checklist = await promptRequirementList("validation checklist", current.build.validation_checklist);
+        buildPatch.validation_checklist = await promptValidationChecklist(current.build.validation_checklist);
         if (completion === "auto-merge") {
             const wait = await confirm({
                 message: "Wait for dependency PR/MRs to merge before starting dependent tickets?",
@@ -596,6 +609,44 @@ async function promptNonNegativeInteger(message, initial) {
         cancelTicketInterview();
     return Number(answer);
 }
+async function promptValidationChecklist(initial) {
+    console.log([
+        "Rafi gives these project-wide checks to its QA reviewer for every ticket.",
+        "Current validation checklist:",
+        ...(initial.length ? initial.map((item) => `  • ${item}`) : ["  • No checks configured."]),
+    ].join("\n"));
+    const mode = await select({
+        message: "Which project-wide checks should Rafi's QA reviewer verify for every ticket?",
+        initialValue: "keep",
+        options: [
+            { value: "keep", label: "Keep all of these checks for every ticket (Recommended)" },
+            { value: "choose", label: "Choose from these checks and add others" },
+            { value: "replace", label: "Replace these with my own checks" },
+        ],
+    });
+    if (isCancel(mode))
+        cancelTicketInterview();
+    if (mode === "keep")
+        return [...initial];
+    if (mode === "replace") {
+        const replacement = await text({ message: "Project-wide checks for QA to verify on every ticket (comma-separated):", defaultValue: "" });
+        if (isCancel(replacement))
+            cancelTicketInterview();
+        return splitCommaList(String(replacement));
+    }
+    const selected = initial.length ? await multiselect({
+        message: "Select the project-wide checks QA should verify for every ticket:",
+        options: initial.map((value) => ({ value, label: value })),
+        initialValues: initial,
+        required: false,
+    }) : [];
+    if (isCancel(selected))
+        cancelTicketInterview();
+    const additions = await text({ message: "Additional project-wide QA checks (comma-separated, optional):", defaultValue: "" });
+    if (isCancel(additions))
+        cancelTicketInterview();
+    return combineRequirementSelections(selected, String(additions));
+}
 async function promptRequirementList(label, initial) {
     console.log(`Current recommended ${label}: ${initial.join("; ") || "none"}`);
     const mode = await select({
@@ -996,7 +1047,8 @@ export async function cmdPopulateCli(opts) {
             return;
         }
     }
-    const structuredPlan = loadPopulationPlan(dir, sourceHints);
+    const approvedPlan = resolvePopulationPlan(dir, sourceHints, ticketsConfig);
+    const contextSources = sourceHints.filter((source) => !isApprovedPlanArtifact(dir, source, approvedPlan.path));
     if (!opts.yes) {
         const action = await select({
             message: "Ask the read-only Ticket Maker for a structured population proposal?",
@@ -1032,10 +1084,11 @@ export async function cmdPopulateCli(opts) {
         console.log(`foreman tickets: project ${dir}`);
         console.log(`foreman tickets: role ${TICKET_POPULATE_ROLE}`);
         console.log(`foreman tickets: log ${logPath}\n`);
-        if (sourceHints.length) {
-            console.log(`foreman tickets: source hints ${sourceHints.join(" ")}`);
+        console.log(`foreman tickets: approved plan ${approvedPlan.path}`);
+        if (contextSources.length) {
+            console.log(`foreman tickets: context sources ${contextSources.join(" ")}`);
         }
-        const turn = await foreman.runInstruction(buildPopulateInstruction(sourceHints, ticketsConfig.paths.progressDoc));
+        const turn = await foreman.runInstruction(buildPopulateInstruction(approvedPlan.path, contextSources, ticketsConfig.paths.progressDoc));
         await builder.close();
         await viewer;
         log.write("ticket-populate", {
@@ -1056,7 +1109,7 @@ export async function cmdPopulateCli(opts) {
         }
         const existing = loadTickets(resolveTicketPaths(ticketsConfig, dir).tickets);
         const proposal = extractTicketPopulationProposal(turn.result.text);
-        const materialized = materializeTicketPopulation(proposal, structuredPlan, existing);
+        const materialized = materializeTicketPopulation(proposal, approvedPlan.plan, existing);
         let retirementsConfirmed = false;
         if (!opts.yes) {
             console.log(`foreman tickets: proposal maps ${materialized.sliceToTicket.size} slice(s) and retires ${materialized.retirements.join(", ") || "none"}`);
@@ -1099,16 +1152,76 @@ async function prepareDocumentSources(projectDir, sources) {
     }
     return unique(prepared);
 }
-function loadPopulationPlan(projectDir, sources) {
-    for (const source of sources) {
-        const candidate = source.endsWith(".json") ? resolve(projectDir, source) : source.endsWith(".md") ? resolve(projectDir, source.replace(/\.md$/, ".json")) : undefined;
-        if (!candidate || !existsSync(candidate))
+/**
+ * Locate the plan that Rafi approved independently of the documents the user
+ * wants Ticket Maker to use as context. In particular, FEATURES.md is not a
+ * promise that FEATURES.json is a Rafi plan.
+ */
+export function resolvePopulationPlan(projectDir, contextSources, ticketsConfig) {
+    const explicit = unique(contextSources.filter((source) => source.toLowerCase().endsWith(".json")));
+    const explicitResolution = findPopulationPlan(projectDir, explicit);
+    if (explicitResolution)
+        return explicitResolution;
+    const activeCandidates = activePopulationPlanCandidates(projectDir, ticketsConfig);
+    const activeResolution = findPopulationPlan(projectDir, activeCandidates);
+    if (activeResolution)
+        return activeResolution;
+    const locations = unique([...explicit, ...activeCandidates]);
+    throw new Error(`ticket population could not find a valid approved Rafi plan. Looked for: ${locations.join(", ") || "configured Rafi plan locations"}. `
+        + "Run `rafi plan --validate` (or run `rafi plan` first) and retry.");
+}
+function activePopulationPlanCandidates(projectDir, ticketsConfig) {
+    const configured = RAFI_CONFIG_FILES.map((file) => resolveConfiguredRafiPlanPath(projectDir, file)).filter((path) => Boolean(path));
+    return unique([
+        ...configured,
+        join(dirname(ticketsConfig.paths.progressDoc), "rafi-plan.json"),
+        "docs/rafi-plan.json",
+    ]);
+}
+function resolveConfiguredRafiPlanPath(projectDir, file) {
+    const configPath = join(projectDir, file);
+    if (!existsSync(configPath))
+        return undefined;
+    const raw = parseYaml(readFileSync(configPath, "utf8"));
+    if (!raw || typeof raw !== "object" || Array.isArray(raw)) {
+        throw new Error(`${file}: expected a YAML object`);
+    }
+    const docs = raw.docs;
+    if (typeof docs?.root !== "string")
+        return undefined;
+    return `${validateDocsRoot(projectDir, docs.root)}/rafi-plan.json`;
+}
+function findPopulationPlan(projectDir, candidates) {
+    for (const candidate of candidates) {
+        const absolute = resolve(projectDir, candidate);
+        if (!existsSync(absolute))
             continue;
-        const plan = JSON.parse(readFileSync(candidate, "utf8"));
-        if (plan.version === 1 && plan.plan_id && Number.isInteger(plan.revision) && plan.content_digest)
-            return plan;
+        try {
+            const plan = JSON.parse(readFileSync(absolute, "utf8"));
+            if (plan.version === 1 && typeof plan.plan_id === "string" && plan.plan_id && Number.isInteger(plan.revision) && typeof plan.content_digest === "string" && plan.content_digest) {
+                return { path: displayPath(projectDir, absolute), plan };
+            }
+        }
+        catch {
+            // A JSON context document is not necessarily a Rafi plan. Keep looking
+            // for the active approved plan and report every location if none exists.
+        }
     }
-    throw new Error("ticket population requires the approved paired structured plan (normally docs/rafi-plan.json); run `rafi plan --validate` first");
+    return undefined;
+}
+function displayPath(projectDir, absolutePath) {
+    const path = relative(projectDir, absolutePath).replace(/\\/g, "/");
+    return path && !path.startsWith("../") ? path : absolutePath;
+}
+function samePath(projectDir, first, second) {
+    return resolve(projectDir, first) === resolve(projectDir, second);
+}
+function isApprovedPlanArtifact(projectDir, source, approvedDataPath) {
+    if (samePath(projectDir, source, approvedDataPath))
+        return true;
+    const dataPath = resolve(projectDir, approvedDataPath);
+    return source.toLowerCase().endsWith(".md")
+        && resolve(projectDir, source) === dataPath.replace(/\.json$/i, ".md");
 }
 function ticketOwnershipReceipts(projectDir, commandName, _afterWrite) {
     const candidates = [

package/dist/diagnostics.js

@@ -7,6 +7,7 @@ import { diagnosticDigest, ObservabilityReader, sanitizeDiagnosticValue } from "
 import { WorkflowReader } from "./workflowReader.js";
 import { isTicketsInitialized, loadTicketsConfig, resolveTicketPaths } from "./tickets/config.js";
 import { loadTickets } from "./tickets/ticketLoader.js";
+import { isLiveProcessIdentity } from "./processIdentity.js";
 const WAIT_KINDS = new Set(["user_wait", "dependency_wait", "external_ci_wait"]);
 const ALLOWED_GIT = new Set(["status", "rev-parse", "rev-list", "diff"]);
 export function selectDiagnosticRun(projectDir, requestedRunId) {
@@ -317,13 +318,7 @@ function evaluateLease(lease, now) {
     catch {
         exists = false;
     }
-    let sameStart = false;
-    try {
-        sameStart = readFileSync(`/proc/${lease.pid}/stat`, "utf8").split(" ")[21] === lease.processStart;
-    }
-    catch {
-        sameStart = false;
-    }
+    const sameStart = isLiveProcessIdentity(lease.pid, lease.processStart);
     const live = age <= 45_000 && exists && sameStart;
     return { summary: live ? `Lease heartbeat is fresh (${formatDuration(age)} old) and PID/start identity match.` : `Lease health failed: heartbeat age ${formatDuration(age)}, process exists=${exists}, process-start matches=${sameStart}.`, live, failureObserved: !live && (!exists || !sameStart) };
 }

package/dist/observability.js

@@ -5,6 +5,7 @@ import { gzipSync } from "node:zlib";
 import { hostname, loadavg } from "node:os";
 import { dirname, join, resolve, sep } from "node:path";
 import Database from "better-sqlite3";
+import { processStartIdentity } from "./processIdentity.js";
 export const OBSERVABILITY_DB_FILE = ".rafi/observability.sqlite3";
 export const OBSERVABILITY_SCHEMA_VERSION = 2;
 export const DEFAULT_OBSERVABILITY_CONFIG = {
@@ -963,12 +964,6 @@ function stableJson(value) {
         return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${stableJson(item)}`).join(",")}}`;
     return JSON.stringify(value ?? null);
 }
-function processStartIdentity(pid) { try {
-    return readFileSync(`/proc/${pid}/stat`, "utf8").split(" ")[21] ?? "unavailable";
-}
-catch {
-    return "unavailable";
-} }
 function databaseBytes(path) { return [path, `${path}-wal`, `${path}-shm`].reduce((sum, item) => sum + (existsSync(item) ? statSync(item).size : 0), 0); }
 function fileSize(path) { try {
     return statSync(path).size;

package/dist/processIdentity.d.ts

@@ -0,0 +1,8 @@
+/**
+ * A stable, host-local process incarnation marker. Linux exposes it through
+ * procfs; macOS does not, so use `ps lstart` instead. The value is persisted
+ * only to detect PID reuse and is never treated as a portable identifier.
+ */
+export declare function processStartIdentity(pid?: number): string;
+/** True only when the PID exists and represents the recorded incarnation. */
+export declare function isLiveProcessIdentity(pid: number, expectedStart: string): boolean;

package/dist/processIdentity.js

@@ -0,0 +1,40 @@
+import { execFileSync } from "node:child_process";
+import { readFileSync } from "node:fs";
+/**
+ * A stable, host-local process incarnation marker. Linux exposes it through
+ * procfs; macOS does not, so use `ps lstart` instead. The value is persisted
+ * only to detect PID reuse and is never treated as a portable identifier.
+ */
+export function processStartIdentity(pid = process.pid) {
+    try {
+        const value = readFileSync(`/proc/${pid}/stat`, "utf8").split(" ")[21];
+        // Preserve the historical Linux representation so an upgrade does not
+        // invalidate a lease that was created by the prior release.
+        if (value)
+            return value;
+    }
+    catch {
+        // procfs is intentionally absent on macOS and some constrained hosts.
+    }
+    try {
+        const value = execFileSync("ps", ["-o", "lstart=", "-p", String(pid)], {
+            encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 1_000,
+        }).trim();
+        if (value)
+            return `ps:${value}`;
+    }
+    catch {
+        // A caller will treat unavailable identity as unverified, never matching.
+    }
+    return "unavailable";
+}
+/** True only when the PID exists and represents the recorded incarnation. */
+export function isLiveProcessIdentity(pid, expectedStart) {
+    try {
+        process.kill(pid, 0);
+        return expectedStart !== "unavailable" && processStartIdentity(pid) === expectedStart;
+    }
+    catch {
+        return false;
+    }
+}

package/dist/projectDiagnostics.js

@@ -1,10 +1,10 @@
 import { hostname } from "node:os";
-import { readFileSync } from "node:fs";
 import { resolve } from "node:path";
 import { BUILD_LEASE_STALE_MS, readBuildRuns } from "./buildRuns.js";
 import { collectManagerDiagnostics } from "./diagnostics.js";
 import { diagnosticDigest, ObservabilityReader } from "./observability.js";
 import { WorkflowReader } from "./workflowReader.js";
+import { isLiveProcessIdentity } from "./processIdentity.js";
 export const MANAGER_CATALOG_LIMIT = 30;
 export const MANAGER_LOOKUP_MAX_ROUNDS = 2;
 export const MANAGER_LOOKUP_MAX_OPERATIONS = 6;
@@ -261,26 +261,13 @@ function verifiedActiveRunId(lease, now) {
         return undefined;
     if (lease.host !== hostname())
         return undefined;
-    try {
-        process.kill(lease.pid, 0);
-        const start = readFileSync(`/proc/${lease.pid}/stat`, "utf8").split(" ")[21];
-        return start === lease.processStart ? lease.runId : undefined;
-    }
-    catch {
-        return undefined;
-    }
+    return isLiveProcessIdentity(lease.pid, lease.processStart) ? lease.runId : undefined;
 }
 function verifiedSnapshotLease(run, now) {
     const lease = run.lease;
     if (!lease || now.getTime() - Date.parse(lease.heartbeatAt) > BUILD_LEASE_STALE_MS || lease.hostname !== hostname())
         return false;
-    try {
-        process.kill(lease.pid, 0);
-        return readFileSync(`/proc/${lease.pid}/stat`, "utf8").split(" ")[21] === lease.processStart;
-    }
-    catch {
-        return false;
-    }
+    return isLiveProcessIdentity(lease.pid, lease.processStart);
 }
 function runUpdatedAt(runId, builds, stored, workflows, rollups) { return builds.get(runId)?.updatedAt ?? workflows.get(runId)?.updatedAt ?? stored.get(runId)?.updatedAt ?? rollups.get(runId)?.completedAt ?? rollups.get(runId)?.createdAt ?? ""; }
 function ticketsFromWorkflow(run) { const value = run?.originalWork; return Array.isArray(value?.tickets) ? value.tickets.filter((item) => typeof item === "string") : []; }

package/dist/providerQuestions.js

@@ -1,4 +1,5 @@
 import { isCancel, multiselect, select, text } from "@clack/prompts";
+import { currentActivity, pauseActivityForInput } from "./activity.js";
 const ASK_USER_QUESTION_TOOL = "AskUserQuestion";
 const CUSTOM_VALUE = "__rafi_custom_response__";
 export const GRILL_ME_STOP_CHOICE = "Stop questions and make the plan now";
@@ -24,7 +25,9 @@ export async function handleProviderQuestionTool(req, opts) {
     const answers = recordFromUnknown(req.input.answers);
     const annotations = annotationRecordFromUnknown(req.input.annotations);
     for (const question of questions) {
-        const answered = await askOneQuestion(question, prompts, req.signal);
+        // A native provider question is a local terminal interaction, not provider
+        // work. Keep the live activity renderer from overwriting Clack's prompt.
+        const answered = await pauseActivityForInput(() => askOneQuestion(question, prompts, req.signal));
         if (answered.cancelled) {
             return {
                 behavior: "deny",
@@ -35,6 +38,7 @@ export async function handleProviderQuestionTool(req, opts) {
         answers[question.question] = answered.answer;
         if (answered.annotation)
             annotations[question.question] = answered.annotation;
+        currentActivity()?.update("answer sent; waiting for Claude");
         if (answered.answer.trim()) {
             opts.onAnsweredQuestion?.({
                 toolName: ASK_USER_QUESTION_TOOL,

package/dist/qaProtocolV2.d.ts

@@ -28,7 +28,8 @@ export interface QaConfinementV2 {
     sourceMode: "read-only";
     scratchMode: "isolated";
     networkMode: "disabled" | "provider-required";
-    settingsSources: "none";
+    /** "user" permits the machine owner's Claude authentication settings, but no project settings. */
+    settingsSources: "none" | "user";
     environmentDigest: string;
     policyDigest: string;
 }

package/dist/qaReview.js

@@ -8,6 +8,7 @@ import { randomUUID } from "node:crypto";
 import { execFileSync } from "node:child_process";
 import { resolve } from "node:path";
 import { WorkflowDb } from "./workflowDb.js";
+import { canonicalSessionPath } from "./sessionIdentity.js";
 import { loadProjectAutonomyConfig, resolveAutonomyPolicy } from "./recoveryPolicy.js";
 import { appendQaRecoveryAttempt, appendQaRecoveryResource, appendQaRecoveryReviewedState, compareQaRecoveryReviewedState, createQaRecoveryPacket, ensureQaRecoveryExcluded, loadQaRecoveryPacket, materializeQaRecoveryContext, qaRecoveryInventory, qaReportDigest, renderQaRecoveryAcknowledgementInstruction, updateQaRecoveryPosition, updateQaRecoveryReviewIdentity, validateManualQaReport, validateQaRecoveryAcknowledgement, } from "./qaRecovery.js";
 import { canonicalJson, createQaFindingRefs, qaDigest } from "./qaProtocolV2.js";
@@ -1445,14 +1446,14 @@ function validateQaSessionHandle(handle, reviewedSnapshotPath) {
     if (identity.version !== 1 || identity.role !== "qa" || identity.stream !== "qa" || identity.provider !== handle.adapter.agent
         || !identity.sessionId || /^(?:unavailable|unknown)$/i.test(identity.sessionId.trim())
         || !Number.isSafeInteger(identity.generation) || identity.generation < 0
-        || resolve(identity.cwd) !== resolve(reviewedSnapshotPath) || !identity.configRoot
+        || canonicalSessionPath(identity.cwd) !== canonicalSessionPath(reviewedSnapshotPath) || !identity.configRoot
         || Number.isNaN(Date.parse(identity.createdAt)) || !identity.validatedAt || Number.isNaN(Date.parse(identity.validatedAt))
         || handle.adapter.sessionId() !== identity.sessionId || !adapterIdentity
         || stableProviderSessionIdentity(adapterIdentity) !== stableProviderSessionIdentity(identity)) {
         throw new Error("QA session handle has an invalid or mismatched scoped identity");
     }
     if (!handle.effectiveRoleInstructions.trim() || confinement.version !== 2 || confinement.sourceMode !== "read-only"
-        || confinement.scratchMode !== "isolated" || confinement.settingsSources !== "none"
+        || confinement.scratchMode !== "isolated" || !["none", "user"].includes(confinement.settingsSources)
         || !["disabled", "provider-required"].includes(confinement.networkMode)
         || !/^[a-f0-9]{64}$/.test(confinement.environmentDigest) || !/^[a-f0-9]{64}$/.test(confinement.policyDigest)
         || digest !== qaDigest("qa-confinement", confinementFields)) {

package/dist/qaRuntime.js

@@ -9,10 +9,14 @@ export function frozenQaRuntimeSettings(adapter, metadata) {
 }
 export function describeQaRuntimeHandle(adapter, metadata, handoffReceipt) {
     const settings = frozenQaRuntimeSettings(adapter, metadata);
-    const confinementPolicy = { sandboxMode: "read-only", settingsSources: "none", permissions: readOnlyPermissionConfig(), dependencyProjection: "read-only-symlink", scratch: "sibling-temp-directory" };
+    // `settingSources` is a Claude Agent SDK control. Claude read-only sessions
+    // need the machine owner's authentication settings; Codex does not receive
+    // that SDK option.
+    const settingsSources = adapter.agent === "claude" ? "user" : "none";
+    const confinementPolicy = { sandboxMode: "read-only", settingsSources, permissions: readOnlyPermissionConfig(), dependencyProjection: "read-only-symlink", scratch: "sibling-temp-directory" };
     const confinementBase = {
         version: 2, sourceMode: "read-only", scratchMode: "isolated",
-        settingsSources: "none", networkMode: "provider-required",
+        settingsSources, networkMode: "provider-required",
         environmentDigest: qaDigest("qa-confinement-environment", { runtime: settings.make, model: settings.model, reasoning: settings.reasoning, fast: settings.fast, platform: process.platform, arch: process.arch }),
         policyDigest: qaDigest("qa-confinement-policy", confinementPolicy),
     };

package/dist/workflowDb.js

@@ -4,6 +4,7 @@ import { hostname } from "node:os";
 import { dirname, join, resolve } from "node:path";
 import Database from "better-sqlite3";
 import { providerSessionKey } from "./sessionIdentity.js";
+import { isLiveProcessIdentity, processStartIdentity } from "./processIdentity.js";
 import { initialQaReducerState, qaDigest, reduceQaState, } from "./qaProtocolV2.js";
 export const WORKFLOW_DB_FILE = ".rafi/recovery.sqlite3";
 /** Read the current project lease without creating or migrating recovery state. */
@@ -1523,24 +1524,12 @@ function sanitizeContinuityValue(value, depth = 0) {
         return Object.fromEntries(Object.entries(value).filter(([key]) => !/^(credential|secret|hidden_reasoning|raw_transcript|api_key|token|password)$/i.test(key)).slice(0, 500).map(([key, entry]) => [key, sanitizeContinuityValue(entry, depth + 1)]));
     return value;
 }
-function processStartIdentity(pid = process.pid) { try {
-    return readFileSync(`/proc/${pid}/stat`, "utf8").split(" ")[21] ?? "unavailable";
-}
-catch {
-    return "unavailable";
-} }
 function leaseVerifiedLive(lease, now, staleMs) {
     if (now.getTime() - new Date(lease.heartbeatAt).getTime() > staleMs)
         return false;
     if (lease.host !== hostname())
         return true;
-    try {
-        process.kill(lease.pid, 0);
-        return processStartIdentity(lease.pid) === lease.processStart;
-    }
-    catch {
-        return false;
-    }
+    return isLiveProcessIdentity(lease.pid, lease.processStart);
 }
 function ensureRecoveryGitignore(projectDir) {
     const localExclude = join(projectDir, ".git", "info", "exclude");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ai-foreman",
-  "version": "1.7.16",
+  "version": "1.7.18",
   "description": "An orchestrator that keeps Codex CLI / Claude Code builders moving through their step list unattended. Part of Rafi.",
   "license": "Apache-2.0",
   "type": "module",
@@ -195,7 +195,7 @@
   "scripts": {
     "build": "tsc -p tsconfig.build.json",
     "dev": "tsx src/index.ts",
-    "test": "tsx --test test/*.test.ts",
+    "test": "tsx --test --test-concurrency=1 test/*.test.ts",
     "typecheck": "tsc --noEmit",
     "test:live-providers": "RAFI_LIVE_PROVIDER_SESSIONS=1 tsx --test test/providerSmoke.test.ts",
     "prepublishOnly": "tsc -p ../spec/tsconfig.build.json && tsc -p tsconfig.build.json && pnpm --filter ai-foreman test && tsc --noEmit"