c8ctl-plugin-nano 1.44.2 → 1.44.4

package/c8ctl-plugin.js

@@ -51,6 +51,7 @@ import {
   unwatchFile,
 } from 'node:fs';
 import { createConnection, createServer } from 'node:net';
+import { lookup as dnsLookup } from 'node:dns/promises';
 import { randomUUID, createHash, randomBytes } from 'node:crypto';
 import { homedir, platform as osPlatform, devNull, tmpdir, hostname } from 'node:os';
 import { join, isAbsolute, resolve as resolvePath, dirname, basename, sep } from 'node:path';
@@ -63,6 +64,11 @@ import { platformForHost } from './platforms.mjs';
 import { createWorkChannel, redactAgenticUrl, buildAgenticUrl } from './work-channel.mjs';
 import { createRelaySession, roleTerminalMode } from './work-relay.mjs';
 import { createBufferMonitor, resolveBufferCapacity } from './work-buffer.mjs';
+// Canonical ACP → transcript wire bridge (nanobpm/nano-ide#534), consumed through
+// the single agentic import surface. `acpUpdateToTranscriptChunk(update)` maps one
+// raw ACP `session/update` to the exact transcript-chunk bytes the cockpit decodes,
+// replacing the plugin's former hand-rolled `nwfTranscriptEvent` envelope grammar.
+import { sessionAcp as agenticSessionAcp } from './agentic.mjs';
 
 const requireFromHere = createRequire(import.meta.url);
 const pluginDir = dirname(fileURLToPath(import.meta.url));
@@ -2203,6 +2209,254 @@ function killTree(child) {
   try { child.kill('SIGKILL'); } catch { /* already gone */ }
 }
 
+// ---- Progress-aware idle liveness (#130) ---------------------------------
+// The idle-liveness kill used to treat terminal silence as "wedged": a harness
+// that emitted no stdout/stderr for `idleTimeoutMs` was killed, which stops the
+// broker lock extension and lets the job be reclaimed. But an agent running a
+// long, QUIET subprocess (e.g. a cold `./mvnw -q … | tail` reactor build) can
+// produce zero output for 10+ minutes while actively progressing — a silence
+// that is NOT a hang. The fix: before the idle-kill fires, probe the spawned
+// process subtree; if a descendant is doing work (aggregate CPU time across the
+// tree is advancing) treat the agent as live and defer the kill instead of
+// reclaiming a job that is genuinely making forward progress. Only a quiescent
+// tree — no live descendant, or descendants burning no CPU across the window —
+// ages out and is killed, so a truly wedged agent is still reclaimed.
+
+/**
+ * Parse a `ps`-style CPU time field (`[[dd-]hh:]mm:ss[.frac]`) into whole
+ * seconds. Best-effort: an unrecognised token yields 0 so a single odd line
+ * never poisons the aggregate.
+ */
+function parsePsTime(token) {
+  if (typeof token !== 'string') return 0;
+  let s = token.trim();
+  let days = 0;
+  const dash = s.indexOf('-');
+  if (dash !== -1) { days = Number(s.slice(0, dash)) || 0; s = s.slice(dash + 1); }
+  const parts = s.split(':').map((p) => Number.parseFloat(p));
+  if (parts.length === 0 || parts.some((n) => !Number.isFinite(n))) return 0;
+  let secs = 0;
+  for (const p of parts) secs = secs * 60 + p;
+  return Math.floor(days * 86_400 + secs);
+}
+
+/**
+ * Sample the process subtree rooted at `rootPid` from Linux `/proc`.
+ * Returns `{ descendants, cpu }` — the count of live descendant processes
+ * (excluding the root) and the aggregate CPU time (utime+stime, in clock ticks)
+ * summed across the WHOLE subtree including the root — or `null` when the tree
+ * cannot be read (e.g. `/proc` unavailable). The descendant count is the
+ * presence gate (a childless silent agent still ages out on silence); the CPU
+ * aggregate is the progress signal (a present-but-hung `java` burning no CPU
+ * still ages out).
+ */
+function sampleSubtreeCpuProc(rootPid) {
+  let entries;
+  try { entries = readdirSync('/proc'); } catch { return null; }
+  const children = new Map(); // ppid -> [pid]
+  const cpu = new Map();      // pid  -> aggregate ticks (utime+stime)
+  for (const name of entries) {
+    if (name.charCodeAt(0) < 48 || name.charCodeAt(0) > 57) continue; // fast /^\d/ gate
+    if (!/^\d+$/.test(name)) continue;
+    const pid = Number(name);
+    let stat;
+    try { stat = readFileSync(`/proc/${name}/stat`, 'utf8'); } catch { continue; }
+    // `comm` (field #2) is parenthesised and may itself contain spaces or
+    // parentheses, so split on the LAST ')' — everything after it is the
+    // space-separated tail starting at field #3 (state).
+    const rparen = stat.lastIndexOf(')');
+    if (rparen < 0) continue;
+    // Split the post-`comm` tail on RUNS of whitespace (not a single space): a
+    // stray double space would otherwise yield empty tokens and shift the
+    // ppid/utime/stime field indexes, mis-sampling the subtree.
+    const tail = stat.slice(rparen + 1).trim().split(/\s+/);
+    // tail[0]=state(#3), tail[1]=ppid(#4) … utime(#14)=tail[11], stime(#15)=tail[12].
+    const ppid = Number(tail[1]);
+    if (!Number.isFinite(ppid)) continue;
+    const utime = Number(tail[11]);
+    const stime = Number(tail[12]);
+    if (!children.has(ppid)) children.set(ppid, []);
+    children.get(ppid).push(pid);
+    cpu.set(pid, (Number.isFinite(utime) ? utime : 0) + (Number.isFinite(stime) ? stime : 0));
+  }
+  if (!cpu.has(rootPid) && !children.has(rootPid)) return null; // root already gone
+  let descendants = 0;
+  let totalCpu = cpu.get(rootPid) || 0;
+  const seen = new Set([rootPid]);
+  const stack = [...(children.get(rootPid) || [])];
+  while (stack.length) {
+    const pid = stack.pop();
+    if (seen.has(pid)) continue;
+    seen.add(pid);
+    descendants += 1;
+    totalCpu += cpu.get(pid) || 0;
+    const kids = children.get(pid);
+    if (kids) for (const k of kids) if (!seen.has(k)) stack.push(k);
+  }
+  return { descendants, cpu: totalCpu };
+}
+
+/**
+ * Non-Linux fallback: sample the subtree via a one-shot `ps`. Heavier than the
+ * `/proc` read (it spawns a process) but only runs during an idle window, which
+ * is rare by construction. Returns the same `{ descendants, cpu }` shape (cpu in
+ * whole seconds here) plus `resolutionMs: 1000` to flag the coarse whole-second
+ * CPU granularity — the monitor uses that so a probe window shorter than a
+ * whole-second tick can't read flat CPU and false-kill a still-progressing but
+ * low-churn subtree. Returns `null` when `ps` is unavailable/unparsable.
+ */
+function sampleSubtreeCpuPs(rootPid) {
+  let out;
+  try {
+    const r = spawnSync('ps', ['-A', '-o', 'pid=,ppid=,time='], { encoding: 'utf8', timeout: 5_000 });
+    if (r.status !== 0 || !r.stdout) return null;
+    out = r.stdout;
+  } catch { return null; }
+  const children = new Map();
+  const cpu = new Map();
+  for (const line of out.split('\n')) {
+    const m = line.trim().match(/^(\d+)\s+(\d+)\s+(\S+)$/);
+    if (!m) continue;
+    const pid = Number(m[1]);
+    const ppid = Number(m[2]);
+    if (!children.has(ppid)) children.set(ppid, []);
+    children.get(ppid).push(pid);
+    cpu.set(pid, parsePsTime(m[3]));
+  }
+  if (!cpu.has(rootPid) && !children.has(rootPid)) return null;
+  let descendants = 0;
+  let totalCpu = cpu.get(rootPid) || 0;
+  const seen = new Set([rootPid]);
+  const stack = [...(children.get(rootPid) || [])];
+  while (stack.length) {
+    const pid = stack.pop();
+    if (seen.has(pid)) continue;
+    seen.add(pid);
+    descendants += 1;
+    totalCpu += cpu.get(pid) || 0;
+    const kids = children.get(pid);
+    if (kids) for (const k of kids) if (!seen.has(k)) stack.push(k);
+  }
+  return { descendants, cpu: totalCpu, resolutionMs: 1000 };
+}
+
+/**
+ * Sample the aggregate CPU + descendant count of the process subtree rooted at
+ * `rootPid`. Linux reads `/proc`; other POSIX platforms fall back to `ps`.
+ * Returns `null` when sampling is unsupported/failed, so callers degrade to the
+ * legacy silence-only liveness rather than mis-killing.
+ */
+function sampleSubtreeCpu(rootPid) {
+  if (typeof rootPid !== 'number' || !(rootPid > 0)) return null;
+  if (process.platform === 'win32') return null;
+  if (process.platform === 'linux') return sampleSubtreeCpuProc(rootPid);
+  return sampleSubtreeCpuPs(rootPid);
+}
+
+/**
+ * Build a progress-aware idle-liveness monitor shared by the pipe/PTY/ACP
+ * capture paths. `arm()` is called on every output chunk (and once at start) to
+ * (re)start the silence window; `stop()` is called when the run settles.
+ *
+ * When the silence window elapses the monitor probes the subtree via `sampleCpu`
+ * instead of killing outright:
+ *  - no usable sample OR no live descendant → the tree is childless/quiescent →
+ *    `onIdleKill()` (preserves the legacy "silence == wedged" behaviour, so a
+ *    genuinely wedged agent with no children still ages out).
+ *  - a live descendant whose aggregate CPU advanced since the last probe → the
+ *    tree is doing work → defer another probe window (`recoveryWindowMs`, or the
+ *    idle window when unset) instead of killing.
+ *  - a live descendant whose aggregate CPU regressed → a busy descendant exited
+ *    (its ticks no longer count) → that is progress, not a stall → re-baseline
+ *    and defer instead of killing.
+ *  - a live descendant whose CPU was exactly unchanged across a probe window →
+ *    a candidate stall, but only a *confirmed* stall once the cumulative flat
+ *    time reaches the sampler's CPU-time resolution (`sample.resolutionMs`, e.g.
+ *    the whole-second `ps` fallback reports 1000ms). A probe window shorter than
+ *    that resolution can read flat CPU while a low-churn subtree is still
+ *    progressing but hasn't crossed the next whole-second tick, so a single flat
+ *    read under a coarse sampler must NOT kill; the fine-grained `/proc` path
+ *    carries no resolution and so ages out on the first flat window as before →
+ *    `onIdleKill()`.
+ * The first elapse with live descendants takes a baseline (a single sample can't
+ * show movement) and re-probes after the recovery window. The absolute
+ * `--job-timeout` hard cap remains the ultimate backstop, untouched by this.
+ */
+function createIdleLivenessMonitor({ getPid, idleTimeoutMs, recoveryWindowMs, onIdleKill, isSettled, sampleCpu = sampleSubtreeCpu }) {
+  const enabled = idleTimeoutMs && idleTimeoutMs > 0;
+  const probeWindow = recoveryWindowMs && recoveryWindowMs > 0 ? recoveryWindowMs : idleTimeoutMs;
+  let timer = null;
+  let prev = null; // last subtree CPU probe taken during the current silent stretch
+  let flatMs = 0;  // cumulative time observed with flat CPU since the last movement/baseline
+  let lastWindow = idleTimeoutMs; // duration of the currently pending probe window
+  const settled = () => (typeof isSettled === 'function' ? isSettled() : false);
+  const clear = () => { if (timer) { clearTimeout(timer); timer = null; } };
+  const schedule = (ms) => { lastWindow = ms; timer = setTimeout(onElapse, ms); };
+  function onElapse() {
+    timer = null;
+    if (settled()) return;
+    const elapsed = lastWindow;
+    const pid = typeof getPid === 'function' ? getPid() : undefined;
+    const sample = pid != null ? sampleCpu(pid) : null;
+    // Childless / unsampleable / dead tree → silence really is a hang: kill.
+    if (!sample || sample.descendants <= 0) { onIdleKill(); return; }
+    if (prev != null) {
+      // Aggregate CPU advanced across the window → the tree is doing work; defer.
+      if (sample.cpu > prev.cpu) { prev = sample; flatMs = 0; schedule(probeWindow); return; }
+      // Aggregate CPU REGRESSED → `sampleSubtreeCpu*` only sums CPU for live
+      // PIDs, so the total can legitimately drop when a busy descendant exits
+      // (its ticks stop counting) even though the subtree just made progress.
+      // A regression is activity, not a stall: re-baseline and defer rather
+      // than mis-killing a silent-but-busy job.
+      if (sample.cpu < prev.cpu) { prev = sample; flatMs = 0; schedule(probeWindow); return; }
+      // Live descendants but CPU exactly unchanged across a full window → a
+      // candidate stall. Only confirm it once we have observed flat CPU for at
+      // least the sampler's CPU-time resolution: a probe window shorter than the
+      // granularity (the whole-second `ps` fallback) can read flat while a
+      // low-churn subtree is still progressing but hasn't crossed the next tick.
+      flatMs += elapsed;
+      const resolutionMs = Number.isFinite(sample.resolutionMs) ? sample.resolutionMs : 0;
+      if (flatMs >= resolutionMs) { onIdleKill(); return; }
+      schedule(probeWindow);
+      return;
+    }
+    // First elapse with live descendants: baseline, then re-probe (can't judge
+    // progress from one sample).
+    prev = sample;
+    flatMs = 0;
+    schedule(probeWindow);
+  }
+  return {
+    enabled: !!enabled,
+    arm() {
+      if (!enabled || settled()) return;
+      prev = null; // output resumed → a fresh silent stretch starts
+      flatMs = 0;
+      clear();
+      schedule(idleTimeoutMs);
+    },
+    stop() { clear(); },
+  };
+}
+
+/**
+ * Resolve the effective per-job liveness values (#130) from the task envelope
+ * with precedence: envelope override → worker-flag default → built-in default.
+ * Each override is clamped to a sane max so a task envelope can't request an
+ * unbounded window. Absent/invalid envelope fields fall through to the
+ * worker-flag value unchanged. `hardCapMs` (0 = no absolute cap) is preserved as
+ * the ultimate backstop; an envelope `timeoutMs` can raise it (clamped).
+ */
+function resolveLivenessOverrides(envelopeTask, { idleTimeoutMs, recoveryWindowMs, hardCapMs } = {}) {
+  const task = isPlainObject(envelopeTask) ? envelopeTask : {};
+  const clampPos = (v, max) => (Number.isFinite(v) && v > 0 ? Math.min(v, max) : undefined);
+  return {
+    idleTimeoutMs: clampPos(task.idleTimeoutMs, MAX_TASK_IDLE_TIMEOUT_MS) ?? idleTimeoutMs,
+    recoveryWindowMs: clampPos(task.recoveryWindowMs, MAX_TASK_RECOVERY_WINDOW_MS) ?? recoveryWindowMs,
+    hardCapMs: clampPos(task.timeoutMs, MAX_TASK_HARD_CAP_MS) ?? hardCapMs,
+  };
+}
+
 // ===========================================================================
 // Agent task envelope + sandboxed execution (issue #8, increment 1)
 // ===========================================================================
@@ -2223,6 +2477,14 @@ const AGENT_RESULT_KEY = 'io.nanobpm.agentResult';
 const LINKED_RESOURCES_HEADER = 'linkedResources';
 const DEFAULT_PROMPT_LINK_NAME = 'prompt';
 const TASK_ENVELOPE_SCHEMA_VERSION = 1;
+// Upper bounds for per-task liveness overrides (#130). A task envelope may widen
+// the idle/recovery window (and the absolute hard cap) for a long-idle task
+// class, but never unboundedly — a runaway or malicious envelope can't pin a
+// worker forever. Generous but finite: 1h of silence-with-progress, 1h recovery
+// cadence, 24h absolute runtime cap.
+const MAX_TASK_IDLE_TIMEOUT_MS = 60 * 60_000;
+const MAX_TASK_RECOVERY_WINDOW_MS = 60 * 60_000;
+const MAX_TASK_HARD_CAP_MS = 24 * 60 * 60_000;
 // The result-envelope version is intentionally independent of the task-envelope
 // version so the two contracts can evolve separately without silently coupling.
 const RESULT_ENVELOPE_SCHEMA_VERSION = 1;
@@ -2467,6 +2729,16 @@ function normalizeTaskEnvelope(customHeaders, variables, opts = {}) {
     promptFile: str(task.promptFile),
     maxIterations: coerceInt(task.maxIterations, undefined),
     timeoutMs: coerceInt(task.timeoutMs, undefined),
+    // #130: per-task liveness overrides. `idleTimeoutMs` is the max silence
+    // (with no subtree CPU progress) before the harness is treated as wedged;
+    // `recoveryWindowMs` is the cadence at which a silent-but-working tree is
+    // re-probed and also the broker lock recovery window. Both let the
+    // orchestrator widen the window for a specific long-idle task class (e.g. a
+    // JVM-heavy monorepo build) without a global `--idle-timeout` widen. Absent
+    // → the worker-flag defaults apply, unchanged. Clamped to a sane max at the
+    // point of use so a task can't request an unbounded window.
+    idleTimeoutMs: coerceInt(task.idleTimeoutMs, undefined),
+    recoveryWindowMs: coerceInt(task.recoveryWindowMs, undefined),
     allowPr: coerceBool(task.allowPr, false),
     prBase: str(task.prBase),
   };
@@ -2474,6 +2746,71 @@ function normalizeTaskEnvelope(customHeaders, variables, opts = {}) {
   return env;
 }
 
+// Does a string look like a usable git clone URL? Used to fail-closed on a
+// half-specified repository envelope (issue #129) rather than silently degrading
+// to a launch/temp cwd. Deliberately permissive — it only rejects values git
+// clone could never resolve to a remote:
+//   - `scheme://host/…` (https/http/ssh/git), host required;
+//   - `file://…` with a path;
+//   - scp-like `user@host:path` (e.g. `git@github.com:o/r.git`);
+//   - a POSIX local filesystem path (`/…`, `./…`, `../…`);
+//   - a Windows local path — drive-absolute (`C:\repo`, `C:/repo`), UNC
+//     (`\\server\share\repo`), or backslash-relative (`.\repo`, `..\repo`) —
+//     since the plugin also runs on win32 hosts.
+// Anything else (a bare word, `github.com/o/r` with no scheme) is treated as
+// malformed.
+function isPlausibleRepoUrl(url) {
+  const s = String(url == null ? '' : url).trim();
+  if (!s) return false;
+  // scp-like syntax has no scheme: user@host:path (the colon is not a port).
+  if (/^[^\s/@]+@[^\s/:]+:.+/.test(s)) return true;
+  // Windows local paths — checked BEFORE new URL() because a drive letter like
+  // `C:` parses as a (hostname-less) URL scheme and would otherwise be rejected.
+  if (/^[A-Za-z]:[\\/]/.test(s) || /^\\\\[^\\]/.test(s) || s.startsWith('.\\') || s.startsWith('..\\')) return true;
+  try {
+    const u = new URL(s);
+    if (u.protocol === 'file:') return !!u.pathname && u.pathname !== '/';
+    return !!u.hostname;
+  } catch { /* not a URL — fall through to the local-path check */ }
+  return s.startsWith('/') || s.startsWith('./') || s.startsWith('../');
+}
+
+// Classify the RAW `repository` block of a task envelope BEFORE normalization
+// drops it (issue #129). `normalizeTaskEnvelope` only emits `env.repository`
+// when a truthy `url` is present, so a half-specified repo block (other
+// `repository.*` fields, but `url` absent — or a `url` that isn't a usable clone
+// target) is invisible downstream and silently degrades to a repo-less run in
+// the launch/temp cwd. This surfaces that intent so the job handler can
+// fail-closed on it.
+//
+// Returns { present, url, malformed }:
+//   - present   — repository intent was supplied: a `repository` block that
+//                 either carries at least one non-empty field OR explicitly
+//                 includes a `url` key at all (even blank/whitespace — spelling
+//                 out `repository.url` IS intent to clone, so it must fail-closed
+//                 rather than silently degrade). A task with NO repository block,
+//                 or one with only blank non-url fields, is legitimately
+//                 repo-less and is `present: false`.
+//   - url       — the trimmed url string when present & non-empty, else null.
+//   - malformed — repository intent is expected but unusable: the block is
+//                 present with fields but the `url` is absent/blank, or the `url`
+//                 is a non-empty string that isn't a plausible clone target.
+function classifyRepoEnvelope(customHeaders, variables) {
+  const raw = deepMerge(collectEnvelopeFrom(customHeaders), collectEnvelopeFrom(variables));
+  const repo = raw.repository;
+  if (!isPlainObject(repo)) return { present: false, url: null, malformed: false };
+  // A `url` key present at all — even blank/whitespace/null — is repository
+  // intent, so an envelope carrying only a blank `repository.url` must
+  // fail-closed instead of silently running repo-less in the temp cwd.
+  const hasUrlKey = Object.prototype.hasOwnProperty.call(repo, 'url');
+  const hasAnyField = Object.keys(repo).some((k) => repo[k] != null && String(repo[k]).trim() !== '');
+  if (!hasUrlKey && !hasAnyField) return { present: false, url: null, malformed: false };
+  const url = repo.url == null ? '' : String(repo.url).trim();
+  if (!url) return { present: true, url: null, malformed: true };
+  if (!isPlausibleRepoUrl(url)) return { present: true, url, malformed: true };
+  return { present: true, url, malformed: false };
+}
+
 // ---- Linked resources → live agent prompt (issue #63) ----------------------
 // A job's `linkedResources` activation header carries KEYS (not content); the
 // worker resolves each to the LATEST deployed bytes over the broker REST API, so
@@ -3784,7 +4121,7 @@ const MAX_CAPTURE_BYTES = 1_048_576; // 1 MiB per stream
 // Spawn a child, pipe `stdinData`, capture byte-capped stdout/stderr, enforce a
 // timeout (invoking `onTimeout(child)` to tear the child down), and resolve to a
 // uniform result. Used by both the host and container executors.
-function spawnCaptureOneShot({ command, args = [], shell = false, detached = false, cwd, env, stdinData, timeoutMs, idleTimeoutMs, onTimeout, stream = false, streamPrefix = '', onStreamOut, onStreamErr, relayTap = null }) {
+function spawnCaptureOneShot({ command, args = [], shell = false, detached = false, cwd, env, stdinData, timeoutMs, idleTimeoutMs, recoveryWindowMs, onTimeout, stream = false, streamPrefix = '', onStreamOut, onStreamErr, relayTap = null }) {
   return new Promise((resolve) => {
     let child;
     const stdoutChunks = [];
@@ -3795,7 +4132,7 @@ function spawnCaptureOneShot({ command, args = [], shell = false, detached = fal
     let stderrTruncated = false;
     let settled = false;
     let timer = null;
-    let idleTimer = null;
+    let idleMon = null;
 
     // Live "spy" tee (--stream): mirror the child's output line-by-line to a
     // caller-supplied emitter (the worker routes these through c8ctl's
@@ -3832,7 +4169,7 @@ function spawnCaptureOneShot({ command, args = [], shell = false, detached = fal
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      if (idleTimer) clearTimeout(idleTimer);
+      if (idleMon) idleMon.stop();
       if (teeOut) teeOut('', true);
       if (teeErr) teeErr('', true);
       resolve(result);
@@ -3852,21 +4189,27 @@ function spawnCaptureOneShot({ command, args = [], shell = false, detached = fal
         }, timeoutMs)
       : null;
 
-    // Idle-liveness kill: if the child emits no stdout/stderr for `idleTimeoutMs`,
-    // treat it as wedged and kill the tree. This is the liveness signal the
-    // worker's lock-extender relies on — a silent hang stops producing output, we
-    // kill it here, `runAgentJob` resolves, and the worker fails the job
-    // (retryable) so the broker reclaims it. Distinct from the absolute `timeoutMs`
-    // hard cap: this fires on *silence*, not total runtime. Re-armed on every chunk.
-    const armIdle = () => {
-      if (settled) return;
-      if (!(idleTimeoutMs && idleTimeoutMs > 0)) return;
-      if (idleTimer) clearTimeout(idleTimer);
-      idleTimer = setTimeout(() => {
+    // Idle-liveness kill: if the child emits no stdout/stderr for `idleTimeoutMs`
+    // AND its process subtree is quiescent (no live descendant, or descendants
+    // burning no CPU across the window), treat it as wedged and kill the tree.
+    // This is the liveness signal the worker's lock-extender relies on — a silent
+    // hang stops producing output, we kill it here, `runAgentJob` resolves, and
+    // the worker fails the job (retryable) so the broker reclaims it. Distinct
+    // from the absolute `timeoutMs` hard cap: this fires on *silence without
+    // progress*, not total runtime. A long, QUIET subprocess that keeps a
+    // descendant doing work (advancing subtree CPU) is deferred, not killed
+    // (#130). Re-armed on every chunk.
+    idleMon = createIdleLivenessMonitor({
+      getPid: () => child?.pid,
+      idleTimeoutMs,
+      recoveryWindowMs,
+      isSettled: () => settled,
+      onIdleKill: () => {
         try { if (onTimeout) onTimeout(child); } catch { /* best effort */ }
-        finish({ ok: false, exitCode: null, stdout: joinCapped(stdoutChunks), stderr: joinCapped(stderrChunks), error: `no output for ${idleTimeoutMs}ms (idle)`, timedOut: true, idle: true, truncated: stdoutTruncated, stderrTruncated });
-      }, idleTimeoutMs);
-    };
+        finish({ ok: false, exitCode: null, stdout: joinCapped(stdoutChunks), stderr: joinCapped(stderrChunks), error: `no output and no subtree progress for >= ${idleTimeoutMs}ms (idle)`, timedOut: true, idle: true, truncated: stdoutTruncated, stderrTruncated });
+      },
+    });
+    const armIdle = () => idleMon.arm();
     armIdle();
 
     child.stdout.on('data', (d) => {
@@ -3948,7 +4291,7 @@ function ptyAvailable(ptyFactory) {
 // spawnCaptureOneShot. A PTY merges stdout+stderr into one stream, so stderr is
 // always '' here; that is expected for a live terminal. `ptyFactory` is
 // injectable for tests (defaults to node-pty).
-function spawnCapturePty({ command, args = [], cwd, env, stdinData, timeoutMs, idleTimeoutMs, cols = 120, rows = 30, ptyFactory, relayTap = null, stream = false, streamPrefix = '', onStreamOut }) {
+function spawnCapturePty({ command, args = [], cwd, env, stdinData, timeoutMs, idleTimeoutMs, recoveryWindowMs, cols = 120, rows = 30, ptyFactory, relayTap = null, stream = false, streamPrefix = '', onStreamOut }) {
   return new Promise((resolve) => {
     const factory = ptyFactory || loadPtyModule();
     if (!factory || typeof factory.spawn !== 'function') {
@@ -3961,7 +4304,7 @@ function spawnCapturePty({ command, args = [], cwd, env, stdinData, timeoutMs, i
     let truncated = false;
     let settled = false;
     let timer = null;
-    let idleTimer = null;
+    let idleMon = null;
     let detachSteer = null;
     let term;
 
@@ -3992,7 +4335,7 @@ function spawnCapturePty({ command, args = [], cwd, env, stdinData, timeoutMs, i
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      if (idleTimer) clearTimeout(idleTimer);
+      if (idleMon) idleMon.stop();
       if (detachSteer) { try { detachSteer(); } catch { /* best effort */ } detachSteer = null; }
       if (teeSink) tee('', true);
       resolve(result);
@@ -4012,15 +4355,17 @@ function spawnCapturePty({ command, args = [], cwd, env, stdinData, timeoutMs, i
         }, timeoutMs)
       : null;
 
-    const armIdle = () => {
-      if (settled) return;
-      if (!(idleTimeoutMs && idleTimeoutMs > 0)) return;
-      if (idleTimer) clearTimeout(idleTimer);
-      idleTimer = setTimeout(() => {
+    const armIdle = () => idleMon.arm();
+    idleMon = createIdleLivenessMonitor({
+      getPid: () => term?.pid,
+      idleTimeoutMs,
+      recoveryWindowMs,
+      isSettled: () => settled,
+      onIdleKill: () => {
         killTerm();
-        finish({ ok: false, exitCode: null, stdout: joinCapped(chunks), stderr: '', error: `no output for ${idleTimeoutMs}ms (idle)`, timedOut: true, idle: true, truncated, stderrTruncated: false });
-      }, idleTimeoutMs);
-    };
+        finish({ ok: false, exitCode: null, stdout: joinCapped(chunks), stderr: '', error: `no output and no subtree progress for >= ${idleTimeoutMs}ms (idle)`, timedOut: true, idle: true, truncated, stderrTruncated: false });
+      },
+    });
     armIdle();
 
     term.onData((d) => {
@@ -4165,15 +4510,17 @@ const ACP_MAX_LINE_BYTES = 8 * 1024 * 1024; // 8 MiB
 
 // Drive an ACP (Agent Client Protocol) agent over JSON-RPC 2.0 on stdio.
 //
-// This executor drives ACP end-to-end. Each `session/update` is mapped to a
-// typed `nwfTranscriptEvent` envelope (#110, step 2) and published on the relay
-// session's typed publish seam (`relayTap.relayEnvelope`) — the rich cockpit
-// format its derive+render consumes. The raw relay TRANSPORT is untouched (still
-// `relaySession.relay(text)`); only the payload shape on the lane changes. When
-// an update has no typed mapping, or the relay exposes no typed seam (minimal
-// mode / a plain tap), it falls back to the step-1 human-TEXT chunk on the same
-// lane (`relayTap.onData`) so nothing is dropped. The raw JSON-RPC is never
-// tee'd either way.
+// This executor drives ACP end-to-end. Each `session/update` is mapped to the
+// CANONICAL transcript-chunk wire form via the shared `@nanobpm/agentic` bridge
+// (`acpUpdateToTranscriptChunk` — nanobpm/nano-ide#534) and published on the relay
+// session's transcript-chunk seam (`relayTap.relayTranscriptChunk`) — the exact
+// `{ nwfTranscriptEvent: 1, kind, … }` bytes the cockpit's `parseTranscriptEvent` +
+// `deriveView` decode into messages / tool cards. The raw relay TRANSPORT is
+// untouched (still `relaySession.relay(text)`); only the payload shape on the lane
+// changes. When an update has no canonical mapping (an `ignored` classification), or
+// the relay exposes no transcript seam (minimal mode / a plain tap), it falls back
+// to the human-TEXT chunk on the same lane (`relayTap.onData`) so nothing is
+// dropped. The raw JSON-RPC is never tee'd either way.
 //
 // Framing: ACP frames are newline-delimited JSON-RPC 2.0 messages on stdio (one
 // compact JSON object per line, `\n`-terminated). We implement a tiny inline
@@ -4197,7 +4544,7 @@ const ACP_MAX_LINE_BYTES = 8 * 1024 * 1024; // 8 MiB
 // and every caller work unchanged. Because the raw stream is JSON-RPC (not human
 // output), `stdout` here is the accumulated human-readable transcript text (what
 // we relay), and `stderr` is the child's real stderr (agent diagnostics).
-function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, idleTimeoutMs, relayTap = null, stream = false, streamPrefix = '', onStreamOut, onStreamErr, permission = 'yolo', shell = false }) {
+function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, idleTimeoutMs, recoveryWindowMs, relayTap = null, stream = false, streamPrefix = '', onStreamOut, onStreamErr, permission = 'yolo', shell = false }) {
   return new Promise((resolve) => {
     const logger = getLogger();
     const humanChunks = [];
@@ -4208,7 +4555,7 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
     let stderrTruncated = false;
     let settled = false;
     let timer = null;
-    let idleTimer = null;
+    let idleMon = null;
     let detachSteer = null;
     let child;
     let sessionId = null;
@@ -4256,9 +4603,9 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
 
     // Local mirrors of a human text chunk: the --stream spy tee and the byte-
     // capped stdout capture (what the result envelope carries). Deliberately does
-    // NOT touch the relay lane, so a typed-transcript update can mirror its human
-    // text locally (for the result + spy) WITHOUT also re-emitting raw text onto
-    // the relay lane — which, in step 2, carries the typed envelope instead.
+    // NOT touch the relay lane, so a canonical-transcript update can mirror its
+    // human text locally (for the result + spy) WITHOUT also re-emitting raw text
+    // onto the relay lane — which carries the canonical transcript chunk instead.
     const captureHuman = (text) => {
       if (!text) return;
       const buf = Buffer.from(text, 'utf8');
@@ -4273,8 +4620,8 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
     // use: the relay tap (framed + jobKey-tagged by the caller) and the local
     // --stream spy tee. Byte-capped like the raw captures. This is the minimal-
     // mode text path — used for stderr, and as the fallback for any session/update
-    // that has no typed nwfTranscriptEvent mapping (or when the relay exposes no
-    // typed publish seam).
+    // that has no canonical transcript mapping (or when the relay exposes no
+    // transcript-chunk seam).
     const emitHuman = (text) => {
       if (!text) return;
       if (relayTap && typeof relayTap.onData === 'function') {
@@ -4287,7 +4634,7 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
       if (settled) return;
       settled = true;
       if (timer) clearTimeout(timer);
-      if (idleTimer) clearTimeout(idleTimer);
+      if (idleMon) idleMon.stop();
       if (settleTimer) { clearTimeout(settleTimer); settleTimer = null; }
       if (detachSteer) { try { detachSteer(); } catch { /* best effort */ } detachSteer = null; }
       if (teeSink) { tee('', true); teeErr('', true); }
@@ -4395,75 +4742,45 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
       }
     };
 
-    // #110 step 2: map an ACP session/update to a typed `nwfTranscriptEvent`
-    // envelope — the rich cockpit wire format (the existing downstream
-    // derive+render consumes it). Returns null for an update kind we don't model,
-    // so the caller falls back to the minimal human-text path (nothing dropped,
-    // no regression vs step 1). The `text` field carries the same plain text the
-    // fallback would relay, so a lightweight consumer can still render it.
-    const TRANSCRIPT_EVENT_TYPE = 'nwfTranscriptEvent';
-    const TRANSCRIPT_EVENT_VERSION = 1;
-    const mapTranscriptEnvelope = (update) => {
-      if (!update || typeof update !== 'object') return null;
-      const kind = update.sessionUpdate || update.type;
-      if (!kind) return null;
-      const base = { type: TRANSCRIPT_EVENT_TYPE, v: TRANSCRIPT_EVENT_VERSION, ts: Date.now() };
-      // Optional fields stay `undefined` (JSON encoding omits them) rather than
-      // becoming explicit `null`s, and `??` preserves empty strings — so
-      // consumers see omitted/optional strings, not coerced nulls. `status`
-      // falls through to the kind's default only when genuinely absent.
-      const toolOf = (u, defaultStatus) => ({
-        id: u.toolCallId ?? undefined,
-        title: u.title ?? undefined,
-        status: u.status ?? defaultStatus ?? undefined,
-        kind: u.kind ?? undefined,
-      });
-      switch (kind) {
-        case 'agent_message_chunk':
-          return { ...base, kind: 'message', role: 'agent', text: acpTextOf(update.content) };
-        case 'agent_thought_chunk':
-          return { ...base, kind: 'thought', role: 'agent', text: acpTextOf(update.content) };
-        case 'user_message_chunk':
-          return { ...base, kind: 'message', role: 'user', text: acpTextOf(update.content) };
-        case 'tool_call':
-          // `text` mirrors the fallback's plain text so the typed envelope stays
-          // self-contained for lightweight renderers (matches the stated contract).
-          return { ...base, kind: 'tool_call', text: describeUpdate(update), tool: toolOf(update, 'pending') };
-        case 'tool_call_update':
-          return { ...base, kind: 'tool_call_update', text: describeUpdate(update), tool: toolOf(update, undefined) };
-        case 'plan':
-          // Carry the actual plan entries (rich cockpit renders them), not a
-          // count — an absent/malformed payload stays `undefined` (omitted).
-          return { ...base, kind: 'plan', entries: Array.isArray(update.entries) ? update.entries : undefined };
-        default:
-          // Unmodelled kind → no typed envelope; caller uses the text fallback.
-          return null;
-      }
+    // #110 / nanobpm/nano-ide#534: map an ACP session/update to the CANONICAL
+    // transcript-chunk wire form via the shared `@nanobpm/agentic` bridge —
+    // `classifyUpdate` composed with `encodeTranscriptEvent` behind the single
+    // `acpUpdateToTranscriptChunk` helper. It returns the exact
+    // `{ nwfTranscriptEvent: 1, kind, … }` bytes the cockpit's `parseTranscriptEvent`
+    // decodes and `deriveView` folds into messages / tool cards, or `null` for an
+    // update with no canonical meaning (an `ignored` classification: a plan, an
+    // intermediate tool_call_update, a non-text chunk, or a malformed update). No
+    // envelope grammar or vocab is hand-rolled here anymore — the marker, version,
+    // kinds and fields all come from the package, so a producer and a consumer can
+    // never diverge on the wire again. `null` (and any bridge throw) falls through
+    // to the minimal human-text path below, so nothing is ever dropped.
+    const encodeTranscriptChunk = (update) => {
+      try { return agenticSessionAcp.acpUpdateToTranscriptChunk(update); }
+      catch { return null; }
     };
 
-    // Publish a session/update: prefer the typed nwfTranscriptEvent envelope on
-    // the relay's typed publish seam; fall back to the minimal human-text path
-    // when the update has no typed mapping OR the relay exposes no typed seam, so
-    // nothing is ever dropped (no regression vs minimal mode).
+    // Publish a session/update: prefer the canonical transcript chunk on the
+    // relay's transcript-chunk seam; fall back to the minimal human-text path when
+    // the update has no canonical mapping OR the relay exposes no transcript seam,
+    // so nothing is ever dropped (no regression vs minimal mode).
     const emitTranscript = (update) => {
-      const env = mapTranscriptEnvelope(update);
-      if (env && relayTap && typeof relayTap.relayEnvelope === 'function') {
-        // Only skip the text fallback when the typed publish ACTUALLY succeeded.
+      const chunk = encodeTranscriptChunk(update);
+      if (chunk && relayTap && typeof relayTap.relayTranscriptChunk === 'function') {
+        // Only skip the text fallback when the chunk publish ACTUALLY succeeded.
         // If the seam throws (a downstream tap implementation, not just the
-        // built-in best-effort stringify guard), the envelope never reached the
-        // relay lane — so we must fall through to the text path or that update
-        // would be silently dropped, breaking the "nothing is ever dropped"
-        // guarantee.
+        // built-in best-effort guard), the chunk never reached the relay lane — so
+        // we must fall through to the text path or that update would be silently
+        // dropped, breaking the "nothing is ever dropped" guarantee.
         let published = false;
-        try { relayTap.relayEnvelope(env); published = true; } catch { /* relay best-effort */ }
+        try { relayTap.relayTranscriptChunk(chunk); published = true; } catch { /* relay best-effort */ }
         if (published) {
           // Mirror the human text locally (spy tee + captured stdout) so the
           // result envelope and --stream spy are unchanged — without re-emitting
-          // raw text onto the relay lane, which now carries the typed envelope.
+          // raw text onto the relay lane, which now carries the canonical chunk.
           captureHuman(describeUpdate(update));
           return;
         }
-        // Typed publish threw → fall through to the text lane below.
+        // Chunk publish threw → fall through to the text lane below.
       }
       // Fallback: minimal text-chunk path (relay text + spy tee + capture).
       emitHuman(describeUpdate(update));
@@ -4508,15 +4825,17 @@ function spawnCaptureAcp({ command, args = [], cwd, env, stdinData, timeoutMs, i
         }, timeoutMs)
       : null;
 
-    const armIdle = () => {
-      if (settled) return;
-      if (!(idleTimeoutMs && idleTimeoutMs > 0)) return;
-      if (idleTimer) clearTimeout(idleTimer);
-      idleTimer = setTimeout(() => {
+    const armIdle = () => idleMon.arm();
+    idleMon = createIdleLivenessMonitor({
+      getPid: () => child?.pid,
+      idleTimeoutMs,
+      recoveryWindowMs,
+      isSettled: () => settled,
+      onIdleKill: () => {
         try { killTree(child); } catch { /* best effort */ }
-        finish({ ok: false, exitCode: null, stdout: humanStdout(), stderr: joinCapped(stderrChunks), error: `no output for ${idleTimeoutMs}ms (idle)`, timedOut: true, idle: true, truncated: humanTruncated, stderrTruncated });
-      }, idleTimeoutMs);
-    };
+        finish({ ok: false, exitCode: null, stdout: humanStdout(), stderr: joinCapped(stderrChunks), error: `no output and no subtree progress for >= ${idleTimeoutMs}ms (idle)`, timedOut: true, idle: true, truncated: humanTruncated, stderrTruncated });
+      },
+    });
     armIdle();
 
     // Newline-delimited JSON-RPC parser over stdout. Progress on stdout re-arms
@@ -4804,7 +5123,7 @@ function startLockExtender(job, windowMs, intervalMs, tag, logger) {
  * Both paths resolve to the same result contract.
  */
 function runAgentJob(profile, job, opts = {}) {
-  const { timeoutMs, idleTimeoutMs, envelope, sandbox = 'none', image, runId, secretEnv = {}, passThroughSecretNames = [], cwd, extraEnv = {}, profileEnv = {}, resultFile, stream = false, streamPrefix = '', onStreamOut, onStreamErr, args: commandArgs, terminal = 'pipe', protocol = 'pipe', permission = 'yolo', relaySession = null, ptyFactory } = opts;
+  const { timeoutMs, idleTimeoutMs, recoveryWindowMs, envelope, sandbox = 'none', image, runId, secretEnv = {}, passThroughSecretNames = [], cwd, extraEnv = {}, profileEnv = {}, resultFile, stream = false, streamPrefix = '', onStreamOut, onStreamErr, args: commandArgs, terminal = 'pipe', protocol = 'pipe', permission = 'yolo', relaySession = null, ptyFactory } = opts;
   // #110: `protocol`/`permission` drive the ACP executor branch below. The
   // pipe/PTY paths are unchanged, so `protocol === 'pipe'` behaviour is identical.
   const payload = JSON.stringify(buildAgentPayload(profile, job, envelope));
@@ -4825,17 +5144,18 @@ function runAgentJob(profile, job, opts = {}) {
   const relayTap = relaySession
     ? {
         onData: (buf) => relaySession.relay(buf),
-        // #110 step 2: typed transcript publish seam. The ACP producer maps each
-        // session/update to an `nwfTranscriptEvent` envelope and publishes it
-        // here; we JSON-encode it (newline-delimited) onto the SAME relay lane —
-        // the raw relay TRANSPORT (ring/QoS/offsets/jobKey routing) is unchanged,
-        // still `relaySession.relay(text)`. Consumers (cockpit derive+render)
-        // parse the envelope; unmapped updates fall back to the `onData` text path
-        // so nothing is dropped (no regression vs the minimal-mode floor).
-        // Best-effort: a bad envelope (circular refs / BigInt making
-        // JSON.stringify throw) must never crash the worker, so swallow here.
-        relayEnvelope: (env) => {
-          try { relaySession.relay(`${JSON.stringify(env)}\n`); } catch { /* relay best-effort */ }
+        // #110 / nanobpm/nano-ide#534: canonical transcript-chunk publish seam. The
+        // ACP producer maps each session/update to the exact `{ nwfTranscriptEvent:
+        // 1, kind, … }` chunk bytes via `acpUpdateToTranscriptChunk` and hands them
+        // here PRE-ENCODED; we relay them verbatim (newline-framed) onto the SAME
+        // relay lane — the raw relay TRANSPORT (ring/QoS/offsets/jobKey routing) is
+        // unchanged, still `relaySession.relay(text)`. Consumers (cockpit
+        // parseTranscriptEvent + deriveView) decode the chunk; unmapped updates fall
+        // back to the `onData` text path so nothing is dropped (no regression vs the
+        // minimal-mode floor). Best-effort: a relay-transport failure must never
+        // crash the worker, so swallow here.
+        relayTranscriptChunk: (chunk) => {
+          try { relaySession.relay(`${chunk}\n`); } catch { /* relay best-effort */ }
         },
         attachSteer: (write) => relaySession.attachSteer(write),
       }
@@ -4873,6 +5193,7 @@ function runAgentJob(profile, job, opts = {}) {
         stdinData: payload,
         timeoutMs,
         idleTimeoutMs,
+        recoveryWindowMs,
         relayTap,
         stream,
         streamPrefix,
@@ -4895,6 +5216,7 @@ function runAgentJob(profile, job, opts = {}) {
         stdinData: payload,
         timeoutMs,
         idleTimeoutMs,
+        recoveryWindowMs,
         ptyFactory,
         relayTap,
         stream,
@@ -4916,6 +5238,7 @@ function runAgentJob(profile, job, opts = {}) {
       stdinData: payload,
       timeoutMs,
       idleTimeoutMs,
+      recoveryWindowMs,
       onTimeout: (child) => killTree(child),
       stream,
       streamPrefix,
@@ -4977,6 +5300,7 @@ function runAgentJob(profile, job, opts = {}) {
     stdinData: payload,
     timeoutMs,
     idleTimeoutMs,
+    recoveryWindowMs,
     stream,
     streamPrefix,
     onStreamOut,
@@ -5150,6 +5474,23 @@ function wsHostPart(host) {
   return h.includes(':') && !h.startsWith('[') ? `[${h}]` : h;
 }
 
+/**
+ * URL-encode the zone id of an IPv6 scoped address so it is safe to embed in a
+ * URL host (#133). A resolver may return a link-local address carrying an
+ * interface zone id (e.g. `fe80::1%en0`); the raw `%` is not URL-safe and yields
+ * an invalid `ws://[fe80::1%en0]:…` that fails to parse even when the address is
+ * reachable. Percent-encode the delimiter (`%` → `%25`) so the bracketed host is
+ * valid. Idempotent — an already-encoded zone id (`%25`) is left untouched — and
+ * a no-op for any host without a zone id.
+ *
+ * @param {string} host a raw address, possibly `<ipv6>%<zone>`
+ * @returns {string}
+ */
+function encodeIpZoneId(host) {
+  const h = String(host || '');
+  return h.replace(/%(25)?/g, '%25');
+}
+
 /**
  * Normalise the engine's `GET /console/api/projects` payload into the running
  * embedded apps that advertise an agentic UI port. Accepts the shapes the
@@ -5229,6 +5570,136 @@ function probeAgenticChannel(port, {
   });
 }
 
+/**
+ * Is `address` a link-local address? Node's default `dns.lookup` can return an
+ * IPv6 link-local `fe80::…` (interface-scoped) address FIRST for a `.local`/mDNS
+ * host, and on some hosts (notably macOS) opening a TCP/WS connection to such a
+ * peer stalls for hundreds of ms — long enough to blow the discovery budget and
+ * strand the worker in `advisory` (#133). Covers IPv6 `fe80::/10` and IPv4
+ * link-local `169.254.0.0/16`; tolerates URL brackets and a zone-id suffix.
+ * @param {string} address
+ * @returns {boolean}
+ */
+function isLinkLocalAddress(address) {
+  const a = String(address || '')
+    .trim().toLowerCase()
+    .replace(/^\[|\]$/g, '')
+    .replace(/%.*$/, '');
+  // IPv6 link-local is the full fe80::/10 block, whose first hextet spans
+  // fe80–febf (the low byte's top two bits are `10`), not just the fe80:
+  // prefix — match the whole range so e.g. fe90::/fea0::/febf:: are covered too.
+  return /^fe[89ab][0-9a-f]:/.test(a) || /^169\.254\./.test(a);
+}
+
+/**
+ * Is `host` an IP literal (v4 or bracketed/bare v6) that needs no DNS
+ * resolution? Used to skip the resolver for an address that is already concrete.
+ * @param {string} host
+ * @returns {boolean}
+ */
+function isIpLiteral(host) {
+  const h = String(host || '').trim().replace(/^\[|\]$/g, '');
+  if (!h) return false;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(h)) return true; // IPv4 dotted-quad
+  return h.includes(':'); // any colon → IPv6 literal
+}
+
+/**
+ * Order resolved connect candidates routable-first (#133, fix B). Ranks a
+ * link-local `fe80::`/`169.254.` candidate LAST (stable within a rank) so a fast
+ * routable IPv4/global address wins the Happy-Eyeballs race instead of a slow
+ * interface-scoped one dominating the connect budget.
+ * @param {Array<{address:string, family?:number}>} addresses
+ * @returns {Array<{address:string, family?:number}>} a new, rank-sorted array
+ */
+function orderProbeAddresses(addresses) {
+  const list = Array.isArray(addresses) ? addresses.filter((a) => a && a.address) : [];
+  return list
+    .map((a, i) => ({ a, i, rank: isLinkLocalAddress(a.address) ? 1 : 0 }))
+    .sort((x, y) => (x.rank - y.rank) || (x.i - y.i))
+    .map((x) => x.a);
+}
+
+/**
+ * Resolve a probe host to an ordered list of candidate host strings to try,
+ * routable-first (#133, fix B). A loopback host, an IP literal, or an
+ * unavailable resolver yields the single host verbatim (unchanged legacy
+ * behaviour); a real hostname is resolved via `lookupImpl(host, { all:true })`
+ * and its addresses are ranked so a link-local `fe80::` never dominates the
+ * connect budget. Fail-open: any resolver error or empty result falls back to
+ * `[host]`, so a host that can't be pre-resolved still gets its one legacy probe.
+ * @param {string} host
+ * @param {{ lookupImpl?: Function }} [opts]
+ * @returns {Promise<string[]>}
+ */
+async function resolveProbeCandidates(host, { lookupImpl = dnsLookup } = {}) {
+  const h = String(host || '').trim();
+  if (!h) return [];
+  if (isLoopbackHost(h) || isIpLiteral(h) || typeof lookupImpl !== 'function') return [h];
+  try {
+    const all = await lookupImpl(h, { all: true });
+    const hosts = orderProbeAddresses(Array.isArray(all) ? all : [])
+      .map((a) => wsHostPart(encodeIpZoneId(String(a.address))));
+    return hosts.length ? hosts : [h];
+  } catch {
+    return [h];
+  }
+}
+
+/**
+ * Race a WS `/agentic` probe across ordered candidate hosts (Happy-Eyeballs,
+ * #133 fix B) and resolve with the FIRST host whose socket opens — or `null` if
+ * every candidate fails/times out. Candidates are tried in order (routable
+ * first) with a small stagger so the preferred address gets a head start but a
+ * slow-to-open one can't stall the whole probe: a fast later candidate still
+ * wins. Each per-host probe is bounded by `timeoutMs`. A single candidate skips
+ * the racing machinery entirely (unchanged legacy path).
+ * @param {number} port
+ * @param {{ hosts?: string[], token?: string, timeoutMs?: number, wsProbe?: Function, staggerMs?: number }} [opts]
+ * @returns {Promise<string|null>} the winning host, or null
+ */
+async function raceProbeCandidates(port, {
+  hosts = [],
+  token = LOCAL_AGENTIC_TOKEN,
+  timeoutMs = AGENTIC_DISCOVERY_TIMEOUT_MS,
+  wsProbe = probeAgenticChannel,
+  staggerMs = 250,
+} = {}) {
+  const list = Array.isArray(hosts) ? hosts.filter(Boolean) : [];
+  if (list.length === 0) return null;
+  if (list.length === 1) {
+    try {
+      return (await wsProbe(port, { host: list[0], token, timeoutMs })) ? list[0] : null;
+    } catch {
+      return null;
+    }
+  }
+  return new Promise((resolve) => {
+    let pending = list.length;
+    let settled = false;
+    const timers = [];
+    const done = (host) => {
+      if (settled) return;
+      settled = true;
+      timers.forEach(clearTimeout);
+      resolve(host);
+    };
+    const start = (host) => {
+      Promise.resolve()
+        .then(() => wsProbe(port, { host, token, timeoutMs }))
+        .catch(() => false)
+        .then((ok) => {
+          if (ok) done(host);
+          else if (--pending === 0) done(null);
+        });
+    };
+    list.forEach((host, idx) => {
+      if (idx === 0) start(host);
+      else timers.push(setTimeout(() => start(host), staggerMs * idx));
+    });
+  });
+}
+
 /**
  * Auto-discover the embedded nwf agentic hub(s) reachable from an engine base
  * URL (#75, #96). Reads `GET <engine>/console/api/projects`, keeps the apps that
@@ -5238,20 +5709,25 @@ function probeAgenticChannel(port, {
  * loopback engine probes `127.0.0.1`, a remote engine (e.g. `merlin.local`)
  * probes that same host — the port is taken from the projects API but the host is
  * always the engine's, so a rogue projects API can never steer a probe at the
- * worker's own loopback (#76). Enforces a single shared time budget across the
- * fetch + probes, and is fail-open: any error — not a nano engine (Camunda),
- * network failure, malformed body, or an overall timeout — degrades to `[]` so
- * the worker's real job is never blocked.
+ * worker's own loopback (#76). Gives the projects fetch and each WS probe
+ * INDEPENDENT deadlines (#133) so a slow fetch can't starve the probe, prefers a
+ * routable address over a link-local `fe80::` one (Happy-Eyeballs), and is
+ * fail-open: any error — not a nano engine (Camunda), network failure, malformed
+ * body, or a timeout — degrades to `[]` so the worker's real job is never
+ * blocked.
  *
  * @param {string} engineBaseUrl the engine base URL (e.g. `http://merlin.local:8080`)
- * @param {{ token?: string, fetchImpl?: Function, wsProbe?: Function, timeoutMs?: number }} [opts]
+ * @param {{ token?: string, fetchImpl?: Function, wsProbe?: Function, lookupImpl?: Function, timeoutMs?: number, fetchTimeoutMs?: number, probeTimeoutMs?: number }} [opts]
  * @returns {Promise<Array<{ project: string, port: number, label?: string, host: string }>>}
  */
 async function discoverAgenticHubs(engineBaseUrl, {
   token = LOCAL_AGENTIC_TOKEN,
   fetchImpl = globalThis.fetch,
   wsProbe = probeAgenticChannel,
+  lookupImpl = dnsLookup,
   timeoutMs = AGENTIC_DISCOVERY_TIMEOUT_MS,
+  fetchTimeoutMs = timeoutMs,
+  probeTimeoutMs = timeoutMs,
 } = {}) {
   if (typeof fetchImpl !== 'function' || typeof engineBaseUrl !== 'string' || !engineBaseUrl.trim()) {
     return [];
@@ -5272,14 +5748,15 @@ async function discoverAgenticHubs(engineBaseUrl, {
     return [];
   }
   const probeHost = isLoopbackHost(host) ? '127.0.0.1' : host;
-  // Single discovery budget: the projects fetch and the WS probes share ONE
-  // deadline, so total discovery can't approach 2× timeoutMs (the fetch could
-  // consume ~timeoutMs and then each probe was previously given a fresh full
-  // budget). Probes get only the time left after the fetch (#76).
-  const deadline = Date.now() + timeoutMs;
+  // (C) Decoupled budgets (#133): the projects fetch and each WS probe get their
+  // OWN independent deadline. Previously they shared one 2s budget, so a fetch
+  // that consumed most of the window starved the probe to ~0ms remaining and
+  // stranded an otherwise-reachable worker in `advisory`. They no longer subtract
+  // from each other — the fetch is bounded by `fetchTimeoutMs`, each probe by
+  // `probeTimeoutMs`.
   let projects;
   const controller = new AbortController();
-  const timer = setTimeout(() => controller.abort(), timeoutMs);
+  const timer = setTimeout(() => controller.abort(), fetchTimeoutMs);
   try {
     const res = await fetchImpl(`${base}/console/api/projects`, { signal: controller.signal });
     if (!res || !res.ok) return [];
@@ -5291,15 +5768,23 @@ async function discoverAgenticHubs(engineBaseUrl, {
   }
   const apps = normalizeProjectApps(projects);
   if (apps.length === 0) return [];
-  const remainingMs = deadline - Date.now();
-  if (remainingMs <= 0) return [];
-  // Probe candidate ports concurrently within the remaining shared budget. Each
-  // surviving hub carries the engine host so the caller builds the right URL.
+  // (B) Prefer a routable address over a link-local one and race families
+  // (Happy-Eyeballs, #133): resolve the engine host to ordered candidate
+  // addresses (routable first) so a fast IPv4/global address wins over a slow
+  // `fe80::` link-local one that Node's default dns.lookup may return first. Each
+  // surviving hub carries the WINNING host so the caller (and the real channel
+  // connect) reuse that fast, routable address rather than re-resolving to the
+  // slow link-local path.
+  const candidates = await resolveProbeCandidates(probeHost, { lookupImpl });
   const settled = await Promise.all(apps.map(async (app) => {
     try {
-      return (await wsProbe(app.port, { host: probeHost, token, timeoutMs: remainingMs }))
-        ? { ...app, host: probeHost }
-        : null;
+      const winner = await raceProbeCandidates(app.port, {
+        hosts: candidates,
+        token,
+        timeoutMs: probeTimeoutMs,
+        wsProbe,
+      });
+      return winner ? { ...app, host: winner } : null;
     } catch {
       return null;
     }
@@ -5324,10 +5809,16 @@ async function discoverAgenticHubs(engineBaseUrl, {
  *     no projects API / not a nano engine, or discovery error/timeout). The
  *     worker continues doing real work with no channel.
  *
- * @param {{ camunda?: object, fetchImpl?: Function, wsProbe?: Function, timeoutMs?: number }} [opts]
+ * (C) When a `cache` Map is supplied, a successfully-resolved hub URL is
+ * remembered against the engine base URL, and a later discovery that comes up
+ * empty for that same engine reuses the cached known-good hub instead of dropping
+ * to `advisory` — so a brief blip doesn't strip visibility from an
+ * already-connected worker (#133).
+ *
+ * @param {{ camunda?: object, fetchImpl?: Function, wsProbe?: Function, lookupImpl?: Function, cache?: Map, timeoutMs?: number }} [opts]
  * @returns {Promise<{ status: string, config?: object, message?: string, candidates?: Array }>}
  */
-async function resolveAgenticTarget({ camunda, ...opts } = {}) {
+async function resolveAgenticTarget({ camunda, cache, ...opts } = {}) {
   const base = resolveAgenticConfig(camunda);
   if (!base) return { status: 'off' };
   // Explicit target wins verbatim and skips discovery entirely.
@@ -5346,14 +5837,14 @@ async function resolveAgenticTarget({ camunda, ...opts } = {}) {
 
   if (hubs.length === 1) {
     const { project, port, host } = hubs[0];
-    return {
-      status: 'connect',
-      config: {
-        ...base,
-        url: `http://${wsHostPart(host)}:${port}`,
-        discovered: { project, port, host },
-      },
+    const config = {
+      ...base,
+      url: `http://${wsHostPart(host)}:${port}`,
+      discovered: { project, port, host },
     };
+    // Cache the known-good hub so a later blip self-heals from cache (#133-C).
+    if (cache && typeof cache.set === 'function') cache.set(base.url, config);
+    return { status: 'connect', config };
   }
   if (hubs.length > 1) {
     const list = hubs.map((h) => `${h.project} → :${h.port}`).join(', ');
@@ -5364,6 +5855,13 @@ async function resolveAgenticTarget({ camunda, ...opts } = {}) {
         + `Disambiguate by setting NANO_AGENTIC_URL=http://${suggestHost}:<port> (or persisted agenticUrl) to the one you want.`,
     };
   }
+  // Zero matches: reuse a cached known-good hub for this engine if we have one, so
+  // a transient discovery miss doesn't drop an already-known-good worker to
+  // advisory (#133-C).
+  if (cache && typeof cache.get === 'function') {
+    const cached = cache.get(base.url);
+    if (cached) return { status: 'connect', config: { ...cached, fromCache: true } };
+  }
   return {
     status: 'advisory',
     message: `agentic visibility was not discoverable at ${base.url} — the embedded app port could `
@@ -5372,6 +5870,94 @@ async function resolveAgenticTarget({ camunda, ...opts } = {}) {
   };
 }
 
+/**
+ * A jittered backoff schedule (ms) for background agentic re-discovery (#133-A):
+ * ~2s → 4s → 8s → 16s → 30s (capped), each waited value randomised ±20%, spanning
+ * roughly `ceilingMs` (default ~5 minutes) of total elapsed retry time before the
+ * loop gives up. A worker that lost the cold-start discovery race walks this
+ * schedule to upgrade `advisory → connected` without a restart.
+ * @param {{ base?: number, cap?: number, ceilingMs?: number, rng?: () => number }} [opts]
+ * @returns {number[]} the ordered per-attempt wait durations
+ */
+function defaultAgenticRediscoveryDelays({
+  base = 2_000,
+  cap = 30_000,
+  ceilingMs = 5 * 60 * 1_000,
+  rng = Math.random,
+} = {}) {
+  const delays = [];
+  let d = base;
+  let total = 0;
+  while (total < ceilingMs) {
+    const jitter = Math.round((rng() - 0.5) * 0.4 * d); // ±20%
+    const wait = Math.max(500, d + jitter);
+    delays.push(wait);
+    total += wait;
+    d = Math.min(cap, d * 2);
+  }
+  return delays;
+}
+
+/**
+ * Background self-heal loop for agentic discovery (#133-A). After an initial
+ * cold-start miss leaves a worker in `advisory`, re-run `resolveTarget` on a
+ * jittered backoff schedule and, on the FIRST attempt that yields a
+ * `status:'connect'` target, invoke `onConnect(target)` and stop — so the worker
+ * upgrades to `connected` without a restart. Fail-open: an attempt whose
+ * `resolveTarget` throws is swallowed and the loop continues; likewise, if
+ * `onConnect` itself throws (a transient channel-open failure), the loop keeps
+ * re-discovering rather than stopping, so retries proceed until a connect
+ * callback actually succeeds. The loop also stops early whenever
+ * `shouldContinue()` returns false (e.g. a channel already came up, or the worker
+ * is shutting down). Returns the connecting target, or `null` if the schedule was
+ * exhausted / cancelled without a hit. Timers and the resolver are injectable so
+ * this is unit-testable without real waits or sockets.
+ *
+ * @param {{
+ *   resolveTarget: () => Promise<{status:string, config?:object}>,
+ *   onConnect?: (target: {status:string, config?:object}) => (void|Promise<void>),
+ *   delaysMs?: number[],
+ *   sleep?: (ms:number) => Promise<void>,
+ *   shouldContinue?: () => boolean,
+ *   logger?: object,
+ * }} opts
+ * @returns {Promise<object|null>}
+ */
+async function rediscoverAgenticUntilConnected({
+  resolveTarget,
+  onConnect,
+  delaysMs = defaultAgenticRediscoveryDelays(),
+  sleep = (ms) => new Promise((r) => setTimeout(r, ms)),
+  shouldContinue = () => true,
+  logger = null,
+} = {}) {
+  if (typeof resolveTarget !== 'function') return null;
+  for (const delay of delaysMs) {
+    if (!shouldContinue()) return null;
+    try { await sleep(delay); } catch { return null; }
+    if (!shouldContinue()) return null;
+    let target;
+    try {
+      target = await resolveTarget();
+    } catch (err) {
+      logger?.debug?.(`agentic re-discovery attempt failed: ${err?.message || err}`);
+      continue;
+    }
+    if (target && target.status === 'connect') {
+      try {
+        await onConnect?.(target);
+      } catch (err) {
+        // A transient channel-open failure must not prematurely stop self-heal:
+        // keep re-discovering until an onConnect callback actually succeeds.
+        logger?.debug?.(`agentic re-discovery onConnect failed, will retry: ${err?.message || err}`);
+        continue;
+      }
+      return target;
+    }
+  }
+  return null;
+}
+
 /**
  * Collapse an agentic disconnect/failure detail into the single short string the
  * marker's `agentic.message` field carries (#99 contract). Accepts the close
@@ -5874,7 +6460,17 @@ async function workAgent(req, flags) {
   // `supervisor status` reflects connecting/advisory/off immediately, before
   // the socket opens (or without a channel at all).
   writeActivity();
-  if (agenticCfg) {
+  // Track the live connection state on the activity marker so the supervisor
+  // shows connected↔disconnected transitions (#99). A close carries a normalized
+  // diagnostic under the contract `agentic.message` field (not `reason`) so a hub
+  // drop explains WHY; a fresh (re)connect clears any stale message.
+  const markAgentic = (status, message = null) => { agenticState = { ...agenticState, status, message }; writeActivity(); };
+  // Open (or re-open) the visibility channel for a resolved connect config. This
+  // is the SINGLE place the connected+authenticated client is instantiated — the
+  // initial connect path and the background self-heal loop (#133) both call it,
+  // (re)assigning the shared `workChannel`/`bufferMonitor` closures the job
+  // recorders and shutdown path already track.
+  const openAgenticChannel = async (cfg) => {
     try {
       workChannel = await createWorkChannel({
         instance: workerName,
@@ -5885,30 +6481,25 @@ async function workAgent(req, flags) {
           host: hostname(),
         },
         listJobKeys: () => [...activeJobs.keys()],
-        url: agenticCfg.url,
-        token: agenticCfg.token,
-        credential: agenticCfg.credential,
-        bufferCapacity: agenticCfg.bufferCapacity,
+        url: cfg.url,
+        token: cfg.token,
+        credential: cfg.credential,
+        bufferCapacity: cfg.bufferCapacity,
         logger,
       });
-      const shown = redactAgenticUrl(buildAgenticUrl(agenticCfg.url, {}));
-      const mode = agenticCfg.secure ? 'secure' : 'local';
-      if (agenticCfg.discovered) {
-        const d = agenticCfg.discovered;
+      const shown = redactAgenticUrl(buildAgenticUrl(cfg.url, {}));
+      const mode = cfg.secure ? 'secure' : 'local';
+      if (cfg.discovered) {
+        const d = cfg.discovered;
         logger.info(`  agentic channel: auto-discovered ${d.project} on the app's /agentic port ${wsHostPart(d.host)}:${d.port} (bypassing the WS-incapable console proxy).`);
       }
       logger.info(`  agentic channel (${mode}): announcing presence as ${workerName} on ${shown}`);
-      // Track the live connection state on the activity marker so the
-      // supervisor shows connected↔disconnected transitions (#99). onConnect
-      // fires only for listeners present at first open, so also reconcile the
-      // already-open case synchronously via connected(). If the socket opened
-      // and then dropped inside the createWorkChannel() await window (before
-      // these listeners existed), connected() is false but everConnected() is
-      // true — record that as `disconnected` rather than leaving it stuck at
-      // `connecting`. A close carries a normalized diagnostic under the contract
-      // `agentic.message` field (not `reason`) so a hub drop explains WHY; a
-      // fresh (re)connect clears any stale message.
-      const markAgentic = (status, message = null) => { agenticState = { ...agenticState, status, message }; writeActivity(); };
+      // onConnect fires only for listeners present at first open, so also
+      // reconcile the already-open case synchronously via connected(). If the
+      // socket opened and then dropped inside the createWorkChannel() await window
+      // (before these listeners existed), connected() is false but everConnected()
+      // is true — record that as `disconnected` rather than leaving it stuck at
+      // `connecting`.
       workChannel.onConnect(() => markAgentic('connected'));
       workChannel.onReconnect(() => markAgentic('connected'));
       workChannel.onDisconnect((info) => markAgentic('disconnected', normalizeAgenticMessage(info)));
@@ -5924,6 +6515,7 @@ async function workAgent(req, flags) {
       agenticState = { ...agenticState, status: 'disconnected', message: normalizeAgenticMessage(err) };
       writeActivity();
       logger.warn(`  agentic channel unavailable (${err?.message || err}); continuing without visibility.`);
+      return;
     }
     // C4 (#43): observe the client's built-in outbound buffer across the
     // channel lifecycle — surface a high-water mark and warn when the bound
@@ -5934,7 +6526,7 @@ async function workAgent(req, flags) {
     if (workChannel) {
       try {
         bufferMonitor = createBufferMonitor(workChannel, {
-          capacity: agenticCfg.bufferCapacity,
+          capacity: cfg.bufferCapacity,
           logger,
         });
       } catch (err) {
@@ -5942,6 +6534,39 @@ async function workAgent(req, flags) {
         logger.warn(`  agentic buffer monitor unavailable (${err?.message || err}); channel presence still active.`);
       }
     }
+  };
+
+  if (agenticCfg) {
+    await openAgenticChannel(agenticCfg);
+  } else if (agenticTarget.status === 'advisory') {
+    // (A) Self-heal a cold-start discovery miss (#133): discovery is one-shot at
+    // enrolment, so a worker that merely lost the cold-start race (e.g. a slow
+    // link-local candidate blew the budget) would otherwise run `advisory` for
+    // its whole lifetime — the only recovery being a restart. Keep re-discovering
+    // in the background on a jittered backoff and, on a later success, upgrade
+    // advisory→connected WITHOUT a restart, flipping the AGENTIC status surface.
+    // A shared cache lets a brief blip reuse the last known-good hub (#133-C).
+    const hubCache = new Map();
+    rediscoverAgenticUntilConnected({
+      resolveTarget: () => resolveAgenticTarget({ camunda, logger, cache: hubCache }),
+      onConnect: async (target) => {
+        agenticCfg = target.config;
+        agenticState = agenticStateForTarget(target, safeAgenticDisplayUrl);
+        writeActivity();
+        logger.info('  agentic channel: background re-discovery succeeded — upgrading advisory → connecting.');
+        await openAgenticChannel(agenticCfg);
+        // openAgenticChannel swallows its own open failures (it nulls
+        // workChannel and returns rather than throwing), so a failed open must
+        // be re-thrown here — otherwise the self-heal loop treats this attempt
+        // as success and stops retrying with workChannel still null (#133).
+        if (workChannel === null) {
+          throw new Error('agentic channel failed to open after background re-discovery');
+        }
+      },
+      // Stop as soon as a channel exists (loop won this or a prior attempt did).
+      shouldContinue: () => workChannel === null,
+      logger,
+    }).catch(() => { /* best-effort self-heal — never surfaces an error */ });
   }
 
   // C3 (#42): the role's live-terminal mode — a full PTY (streamed on the relay
@@ -6047,9 +6672,57 @@ async function workAgent(req, flags) {
           return job.fail({ errorMessage: msg, retries });
         }
 
+        // #130: per-task liveness overrides. Precedence: envelope override →
+        // worker-flag default → built-in default, each clamped to a sane max so
+        // a task can't request an unbounded window. Absent envelope fields leave
+        // the worker-flag behaviour unchanged. These drive BOTH the harness idle
+        // liveness (idle/recovery) AND the broker lock recovery window, so a
+        // JVM-heavy task can widen its own window without a global flag change.
+        const {
+          idleTimeoutMs: effectiveIdleTimeoutMs,
+          recoveryWindowMs: effectiveRecoveryWindowMs,
+          hardCapMs: effectiveHardCapMs,
+        } = resolveLivenessOverrides(envelope.task, { idleTimeoutMs, recoveryWindowMs, hardCapMs });
+        // Recompute the lock-extend cadence from the effective recovery window
+        // (same ~1/3-of-window rule as at startup) so a widened window still
+        // renews comfortably before it lapses.
+        const effectiveLockExtendIntervalMs = Math.min(
+          Math.max(5_000, Math.floor(effectiveRecoveryWindowMs / 3)),
+          Math.max(1, Math.floor(effectiveRecoveryWindowMs * 0.75)),
+        );
+        if (
+          effectiveIdleTimeoutMs !== idleTimeoutMs ||
+          effectiveRecoveryWindowMs !== recoveryWindowMs ||
+          effectiveHardCapMs !== hardCapMs
+        ) {
+          logger.info(`[${jobType}] job ${job.jobKey} liveness (envelope override) → idle timeout: ${effectiveIdleTimeoutMs}ms; recovery window: ${effectiveRecoveryWindowMs}ms; hard cap: ${effectiveHardCapMs > 0 ? `${effectiveHardCapMs}ms` : 'off'}`);
+        }
+
         const runId = randomUUID();
         if (isContainer) liveRunIds.add(runId);
 
+        // Fail-closed on a half-specified repository envelope (issue #129,
+        // hardening 2): a `repository` block that declares intent (any field set)
+        // but whose `url` is absent or not a usable clone target almost always
+        // means an orchestrator bug. Refuse the job LOUDLY (retryable) instead of
+        // silently degrading to a launch/temp cwd and running an agent with no
+        // repo where one was expected. A task with NO `repository` block at all
+        // is legitimately repo-less and takes the temp-cwd default below.
+        // Container runs don't provision a host repo (cloning is a later
+        // increment), so this gate is host-only, mirroring `hasRepo`.
+        if (!isContainer) {
+          const repoIntent = classifyRepoEnvelope(job.customHeaders ?? {}, job.variables ?? {});
+          if (repoIntent.malformed) {
+            const retries = Math.max(0, (Number(job.retries) || 1) - 1);
+            const why = repoIntent.url
+              ? `repository.url ${JSON.stringify(repoIntent.url)} is not a usable clone target`
+              : 'repository.url is missing';
+            const msg = `incomplete repository envelope — ${why}; refusing to run in the launch/temp cwd (likely an orchestrator bug emitting a half-specified repository block)`;
+            logger.warn(`[${jobType}] job ${job.jobKey} not provisioned — ${msg}; retries left ${retries}`);
+            return job.fail({ errorMessage: msg.slice(0, 2000), retries, retryBackOff: 15_000 });
+          }
+        }
+
         // Host git provisioning (increment 2a): sandbox=none + a repository →
         // clone into a throwaway workspace, run the harness there, then push +
         // reconcile the agent PR. Container-side cloning is a later increment.
@@ -6061,7 +6734,7 @@ async function workAgent(req, flags) {
         // here — ahead of provisionRepo — guarantees the first renewal is queued
         // before the clone, so the lock can't lapse mid-provision and trigger the
         // duplicate-activation / stale-409 race. The `finally` below stops it.
-        stopLockExtender = startLockExtender(job, recoveryWindowMs, lockExtendIntervalMs, `[${jobType}] job ${job.jobKey}`, logger);
+        stopLockExtender = startLockExtender(job, effectiveRecoveryWindowMs, effectiveLockExtendIntervalMs, `[${jobType}] job ${job.jobKey}`, logger);
         let cwd;
         let extraEnv;
         let repoToken = null;
@@ -6105,6 +6778,32 @@ async function workAgent(req, flags) {
             logger.warn(`[${jobType}] job ${job.jobKey} not provisioned — ${msg}; retries left ${retries}`);
             return job.fail({ errorMessage: msg.slice(0, 2000), retries, retryBackOff: 15_000 });
           }
+        } else if (!isContainer) {
+          // Repo-less host job (issue #129, hardening 1): nothing is provisioned,
+          // so default the agent's cwd to a fresh, empty `run-*` dir under the
+          // runs root instead of leaving it undefined (which inherits the
+          // worker's launch dir and lets stray scratch files / a `git init`
+          // pollute it — or worse, an agent `cd` into a shared checkout). Track
+          // it in `liveRunDirs` and let the SAME `finally` below reap it, reusing
+          // the existing run-dir lifecycle — the only difference from the
+          // provisioned path is an EMPTY workspace.
+          //
+          // Hygiene, not a sandbox: the agent runs as the user with full
+          // filesystem access, so an empty cwd does not CONFINE it (it can still
+          // `cd` to a known absolute path). True confinement is the container
+          // increment; a provisioned repository envelope stays the preferred path.
+          try {
+            mkdirSync(agentRunsRoot(), { recursive: true });
+            runDir = mkdtempSync(join(agentRunsRoot(), 'run-'));
+            liveRunDirs.add(runDir);
+            cwd = runDir;
+          } catch (err) {
+            if (runDir) { try { rmSync(runDir, { recursive: true, force: true }); } catch { /* best effort */ } liveRunDirs.delete(runDir); runDir = null; }
+            const retries = Math.max(0, (Number(job.retries) || 1) - 1);
+            const msg = `could not create a temp workspace under the runs root: ${err.message}`;
+            logger.warn(`[${jobType}] job ${job.jobKey} not provisioned — ${msg}; retries left ${retries}`);
+            return job.fail({ errorMessage: msg.slice(0, 2000), retries, retryBackOff: 15_000 });
+          }
         }
 
         let result;
@@ -6137,8 +6836,9 @@ async function workAgent(req, flags) {
           } catch { resultDir = null; resultFile = null; }
 
           result = await runAgentJob(profile, job, {
-            timeoutMs: hardCapMs,
-            idleTimeoutMs,
+            timeoutMs: effectiveHardCapMs,
+            idleTimeoutMs: effectiveIdleTimeoutMs,
+            recoveryWindowMs: effectiveRecoveryWindowMs,
             envelope,
             sandbox,
             image,
@@ -10823,6 +11523,14 @@ export { buildNpmInvocation };
 export { resolveAgenticConfig, LOCAL_AGENTIC_TOKEN };
 export { resolveAgenticSetting, PROTOCOLS, PERMISSION_MODES };
 export { resolveAgenticTarget, discoverAgenticHubs, probeAgenticChannel, normalizeProjectApps, isLoopbackHost };
+export {
+  orderProbeAddresses,
+  resolveProbeCandidates,
+  raceProbeCandidates,
+  isLinkLocalAddress,
+  rediscoverAgenticUntilConnected,
+  defaultAgenticRediscoveryDelays,
+};
 export { compareSemver, githubRepoSlug, filterReleasesSince, renderReleaseBody };
 export {
   webConsoleUrl,
@@ -10833,6 +11541,8 @@ export {
 export {
   normalizeTaskEnvelope,
   collectEnvelopeFrom,
+  classifyRepoEnvelope,
+  isPlausibleRepoUrl,
   parseLinkedResources,
   pickLinkedResource,
   resolveBrokerRestConfig,
@@ -10869,6 +11579,10 @@ export {
   runAgentJob,
   spawnCapturePty,
   spawnCaptureAcp,
+  sampleSubtreeCpu,
+  createIdleLivenessMonitor,
+  resolveLivenessOverrides,
+  parsePsTime,
   ensureAcpFlag,
   startLockExtender,
   provisionRepo,