cli-jaw 2.17.46 → 2.17.47

package/dist/src/agent/spawn.js

@@ -32,7 +32,7 @@ import { resolveMainCli, consumePendingBootstrapPrompt, peekPendingBootstrapProm
 import { getSessionOwnershipGeneration, isCurrentSessionOwner, persistMainSession, } from './session-persistence.js';
 import { isCompactMarkerRow } from '../core/compact.js';
 import { isRuntimeSettingsMutationInFlight, waitForRuntimeSettingsIdle } from '../core/runtime-settings-gate.js';
-import { hasBlockingWorkers, hasPendingWorkerReplays, getActiveWorkers, clearAllWorkers, clearWorkersForScope } from '../orchestrator/worker-registry.js';
+import { hasBlockingWorkers, hasPendingWorkerReplays, getActiveWorkers, clearAllWorkers, clearWorkersForScope, cancelWorker } from '../orchestrator/worker-registry.js';
 import { sanitizeWorkerProgressTools } from '../orchestrator/worker-progress.js';
 import { handleAgentExit, setSpawnAgent, setMainMetaHandler } from './lifecycle-handler.js';
 import { buildServicePath } from '../core/runtime-path.js';
@@ -84,8 +84,6 @@ export const activeProcesses = new Map(); // agentId → child process
 export function hasActiveAgent(agentId) {
     return activeProcesses.has(agentId) || hasClaudeWorker(agentId);
 }
-/** Kill reason recorded when a duplicate registration reaps the previous child. */
-const DUP_REGISTRATION_KILL_REASON = 'dup-registration';
 /** Grace before escalating that kill to SIGKILL, matching the sibling kill paths. */
 const DUP_REGISTRATION_KILL_GRACE_MS = 2_000;
 function cancelOwnedPiProcess(child, reason) {
@@ -173,7 +171,10 @@ export function releaseMainRun(scopeKey, child, ownerGeneration) {
     activeMainProcesses.delete(scopeKey);
     return true;
 }
-import { hasChildExited, killProcessTree, killProcessTreeIfAlive, ownProcess } from './spawn/process-kill.js';
+import { hasChildExited, ownProcess } from './spawn/process-kill.js';
+import { DUP_REGISTRATION_KILL_REASON, isLifecycleSteerReason } from './spawn/kill-reason.js';
+import { buildSteerStartedEvent } from './spawn/steer-event.js';
+import { armExitSettle, captureExitSettler, settleCapturedExit, settleExit, waitForExitSettled, } from './spawn/exit-settle.js';
 import { releaseChildOutputAfterExit } from './spawn/exit-drain.js';
 import { clampPendingLine } from './spawn/line-buffer.js';
 import { appendBoundedFullText } from './events/fulltext-bound.js';
@@ -256,26 +257,32 @@ export function killAgentById(agentId) {
     try {
         if (cancelOwnedPiProcess(proc, 'user'))
             return true;
-        if (proc.pid) {
-            killProcessTree(proc.pid, 'SIGTERM');
-        }
-        else {
-            proc.kill('SIGTERM');
-        }
-        setTimeout(() => {
-            try {
-                if (proc.pid) {
-                    killProcessTreeIfAlive(proc);
-                }
-                else if (proc.exitCode === null && proc.signalCode === null) {
-                    proc.kill('SIGKILL');
-                }
-            }
-            catch { /* already dead */ }
+        // Record the stop the way killActiveAgent does for a main run (below). Only
+        // the Pi branch above used to stamp a reason, so a deliberately stopped
+        // employee on every other runtime reached handleAgentExit with
+        // wasKilled=false and was classified as a crash. For an employee with a
+        // non-zero exit that is not cosmetic: lifecycle-handler's employee retry
+        // branch (`isEmployee && code !== 0 && !wasKilled`) respawns the very turn
+        // the caller just cancelled.
+        //
+        // Live pid only, for the same reason cancelOwnedPiProcess checks: stamping
+        // an already-exited pid is how a recycled pid inherits a foreign kill reason.
+        if (proc.pid && !hasChildExited(proc))
+            killReasons.set(proc.pid, 'user');
+        // Same owner as killActiveAgent. The hand-rolled version here escalated on a
+        // bare 3s timer with no liveness re-check, so a CLI that traps SIGTERM either
+        // survived or, worse, the delayed SIGKILL landed on a recycled PID. Worker
+        // stop (orchestrator/distribute.ts, orchestrator/pipeline.ts) reaches this
+        // path, which is why it had different lifetime rules from main stop.
+        ownProcess(proc).terminate('cancel');
+        // Stdio teardown stays on its own timer: it must happen even when the owner
+        // short-circuits because the child had already exited.
+        const teardown = setTimeout(() => {
             proc.stdin?.destroy();
             proc.stdout?.destroy();
             proc.stderr?.destroy();
-        }, 3_000);
+        }, DEFAULT_KILL_ESCALATION_MS);
+        teardown.unref?.();
         return true;
     }
     catch {
@@ -360,11 +367,23 @@ function getActiveMainCli(scopeKey) {
     const cli = activeMainProcesses.get(scopeKey)?.meta.cli;
     return typeof cli === 'string' ? cli : null;
 }
-function getKillPolicy(_scopeKey, _reason) {
-    return { signal: 'SIGTERM', escalationMs: DEFAULT_KILL_ESCALATION_MS };
+/**
+ * Read this scope's `agentTimeout` block, global keys overlaid by per-CLI keys.
+ *
+ * `settings` is a live binding from core/config, so this reflects a settings edit made
+ * after the turn started — which is what a steer wants: it is deciding how long to wait
+ * right now, not how long the run was configured to take when it was spawned.
+ */
+function mergeAgentTimeoutCfg(cli) {
+    const raw = settings['agentTimeout'];
+    const global = raw && typeof raw === 'object' ? raw : {};
+    const perCli = cli && global[cli] && typeof global[cli] === 'object'
+        ? global[cli] : {};
+    return { ...global, ...perCli };
 }
-export function getSteerWaitMsForActiveAgent(_scopeKey = 'default') {
-    return DEFAULT_STEER_WAIT_MS;
+export function getSteerWaitMsForActiveAgent(scopeKey = 'default') {
+    const configured = mergeAgentTimeoutCfg(getActiveMainCli(scopeKey))['steerWaitMs'];
+    return typeof configured === 'number' && configured > 0 ? configured : DEFAULT_STEER_WAIT_MS;
 }
 /** Get kill reason for a process (by PID), consuming it */
 function consumeKillReason(pid) {
@@ -375,48 +394,10 @@ function consumeKillReason(pid) {
         killReasons.delete(pid);
     return reason;
 }
-// ─── Steer exit-settle barrier ─────────────────────
-// killActiveAgent removes the scope's activeMainProcesses entry synchronously,
-// so waitForProcessEnd() resolves immediately on a steer kill — long before the
-// exit handler has written the interrupted partial output to the messages table.
-// A follow-up spawn could then read history without the salvage row. The barrier
-// is armed at kill time (never at exit-handler entry — that is already too late)
-// and settled by the exit handler's completion, success or failure.
-const exitSettlers = new Map();
-/** Arm the barrier. Idempotent: a repeated steer keeps the first arm. */
-export function armExitSettle(scopeKey) {
-    if (exitSettlers.has(scopeKey))
-        return;
-    let resolve;
-    const promise = new Promise(r => { resolve = r; });
-    exitSettlers.set(scopeKey, { promise, resolve });
-}
-/** Settle the barrier; a no-op when no steer kill armed it. */
-export function settleExit(scopeKey) {
-    const entry = exitSettlers.get(scopeKey);
-    if (!entry)
-        return;
-    exitSettlers.delete(scopeKey);
-    entry.resolve();
-}
-/**
- * Await the armed exit handler's completion, bounded. A timeout releases the
- * waiter and drops the arm — a wedged exit handler must not hang the steer.
- */
-export function waitForExitSettled(scopeKey, timeoutMs = 5000) {
-    const entry = exitSettlers.get(scopeKey);
-    if (!entry)
-        return Promise.resolve();
-    // The timer is NOT unref'd and is always cleared: an unref'd timer can vanish
-    // with a drained event loop (test runner), leaving the waiter pending forever.
-    let timer;
-    const timeout = new Promise(r => { timer = setTimeout(r, timeoutMs); });
-    return Promise.race([entry.promise, timeout]).then(() => {
-        clearTimeout(timer);
-        if (exitSettlers.get(scopeKey) === entry)
-            exitSettlers.delete(scopeKey);
-    });
-}
+// The steer exit-settle barrier moved to ./spawn/exit-settle.js so it can be imported
+// without this module behind it. Re-exported here because every caller — the HTTP
+// route, the CLI slash handler and eleven test files — imports it from spawn.
+export { armExitSettle, settleExit, waitForExitSettled };
 /**
  * Fix A: 사용자 stop은 메모리 큐 + DB persisted_queue + frontend pending row를
  * 모두 폐기한다. exit handler의 scoped queue 자동 드레인이 stop 직후 잔존
@@ -428,12 +409,32 @@ export function waitForExitSettled(scopeKey, timeoutMs = 5000) {
  * 도 검사하므로, 이걸 비우지 않으면 stop 직후 새 메시지가 busy 분기 → 큐로 떨어지고
  * 프론트는 (1) 낙관 bubble + (2) applyQueuedOverlay 가 만든 queued bubble = 2개를 보여준다.
  */
+/**
+ * Stop the scope's employees, then forget them.
+ *
+ * Clearing the registry only forgets the slot; it never stopped the child. Claude
+ * employees die earlier, inside cancelClaudeScope(..., includeWorkers), so the gap
+ * was invisible there — and every OTHER runtime's employee survived a user stop:
+ * still running, still streaming into a scope the boss had abandoned, still holding
+ * its isolated cwd. The two sibling paths already get this right: orchestrateReset
+ * kills before clearing (orchestrator/pipeline.ts) and the worker timeout calls
+ * killAgentById (orchestrator/distribute.ts). Only the stop path was missing it.
+ *
+ * cancelWorker matches reset for the same reason: deleting a slot leaves its worker
+ * run row 'running' forever, because finishWorker and failWorker both no-op once the
+ * slot is gone. getActiveWorkers returns a fresh array, so killing inside the loop
+ * cannot mutate what is being iterated.
+ */
 function clearWorkerSlotsOnStop(scopeKey, reason) {
-    const active = getActiveWorkers(scopeKey).length;
-    if (active === 0 && !hasPendingWorkerReplays(scopeKey))
+    const active = getActiveWorkers(scopeKey);
+    if (active.length === 0 && !hasPendingWorkerReplays(scopeKey))
         return;
+    for (const slot of active) {
+        killAgentById(slot.agentId);
+        cancelWorker(slot.agentId);
+    }
     clearWorkersForScope(scopeKey);
-    console.log(`[jaw:stop] cleared worker registry (active=${active}, scope=${scopeKey}, reason=${reason})`);
+    console.log(`[jaw:stop] stopped and cleared worker registry (active=${active.length}, scope=${scopeKey}, reason=${reason})`);
 }
 function clearMainLiveRunOnStop(scopeKey, reason) {
     if (reason !== 'api' && reason !== 'user' && reason !== 'steer' && reason !== 'interrupt')
@@ -482,21 +483,22 @@ export function killActiveAgent(scopeKeyOrReason = 'user', scopedReason) {
             activeMainProcesses.delete(scopeKey);
         return hadTimer || cancelledPendingMain || cancelledClaude;
     }
-    const policy = getKillPolicy(scopeKey, reason);
-    console.log(`[jaw:kill] reason=${reason} scope=${scopeKey} cli=${getActiveMainCli(scopeKey) || 'unknown'} signal=${policy.signal} escalationMs=${policy.escalationMs}`);
+    console.log(`[jaw:kill] reason=${reason} scope=${scopeKey} cli=${getActiveMainCli(scopeKey) || 'unknown'} signal=SIGTERM escalationMs=${DEFAULT_KILL_ESCALATION_MS}`);
     if (activeProcess.pid)
         killReasons.set(activeProcess.pid, reason);
     if (reason === 'steer' || reason === 'interrupt')
         armExitSettle(scopeKey);
     const proc = activeProcess;
-    // One owner runs the whole termination: tree walk with the policy signal,
-    // then escalation after policy.escalationMs that re-checks the ORIGINAL
-    // child. The previous escalation guarded on `!proc.killed`, which only
-    // records that a signal was delivered — a CLI that traps SIGTERM stays
-    // alive with killed set, and was therefore never escalated.
-    ownProcess(proc, {
-        policy: () => ({ initialSignal: policy.signal, graceMs: policy.escalationMs }),
-    }).terminate(reason === 'steer' ? 'steer' : 'cancel');
+    // One owner runs the whole termination: tree walk, then escalation after the
+    // grace that re-checks the ORIGINAL child. The previous escalation guarded on
+    // `!proc.killed`, which only records that a signal was delivered — a CLI that
+    // traps SIGTERM stays alive with killed set, and was therefore never escalated.
+    //
+    // No policy override: the owner is memoized on child identity and the FIRST call
+    // wins, so a policy passed here would be honoured for a main run and silently
+    // dropped for a worker that registerActiveProcess already owns. Taking the
+    // default keeps one rule for both.
+    ownProcess(proc).terminate(reason === 'steer' ? 'steer' : 'cancel');
     // Immediately sever stdio to stop late output from reaching broadcast handlers
     proc.stdout?.removeAllListeners('data');
     proc.stderr?.removeAllListeners('data');
@@ -506,7 +508,7 @@ export function killActiveAgent(scopeKeyOrReason = 'user', scopedReason) {
         proc.stdin?.destroy();
         proc.stdout?.destroy();
         proc.stderr?.destroy();
-    }, policy.escalationMs);
+    }, DEFAULT_KILL_ESCALATION_MS);
     teardown.unref?.();
     // Fix C1: 사용자 stop/steer 시 해당 scope busy가 즉시 false가 되도록 참조를 동기 해제.
     // 실제 child 종료는 위 setTimeout SIGKILL이 백그라운드에서 마무리.
@@ -661,10 +663,10 @@ export async function steerAgent(scopeKey, newPrompt, source, meta) {
                 attempted = true; // A partial recording failure must never retry this input.
                 insertMessage.run('user', newPrompt, source, '', workingDir, chatSessionId);
                 broadcast('new_message', { role: 'user', content: newPrompt, source, scope: scopeKey, sessionId: chatSessionId });
-                broadcast('steer_started', stripUndefined({ prompt: newPrompt, origin: source || 'web', scope: scopeKey,
-                    sessionId: chatSessionId, target: capturedMeta.target, chatId: capturedMeta.chatId,
-                    requestId: capturedMeta.requestId, remoteKey: capturedMeta.remoteKey, replyViaTarget: capturedMeta.replyViaTarget,
-                    mode: 'cancel-reprompt', localDispatch: true }));
+                broadcast('steer_started', buildSteerStartedEvent({
+                    prompt: newPrompt, source, scopeKey, chatSessionId, meta: capturedMeta,
+                    mode: 'cancel-reprompt', extra: { localDispatch: true },
+                }));
                 settleOnce(capturedMeta.requestId, 'steered');
             });
         }
@@ -708,7 +710,9 @@ export async function steerAgent(scopeKey, newPrompt, source, meta) {
         }
         insertMessage.run('user', newPrompt, source, '', settings["workingDir"] || null, chatSessionId);
         broadcast('new_message', { role: 'user', content: newPrompt, source, scope: scopeKey, sessionId: chatSessionId });
-        broadcast('steer_started', stripUndefined({ prompt: newPrompt, origin: source || 'web', scope: scopeKey, sessionId: chatSessionId, target: meta?.target, chatId: meta?.chatId, requestId: meta?.requestId, remoteKey: meta?.remoteKey, replyViaTarget: meta?.replyViaTarget, mode: 'native-input' }));
+        broadcast('steer_started', buildSteerStartedEvent({
+            prompt: newPrompt, source, scopeKey, chatSessionId, meta, mode: 'native-input',
+        }));
         settleOnce(meta?.requestId, 'steered');
         return 'steered';
     }
@@ -751,9 +755,9 @@ export async function steerAgent(scopeKey, newPrompt, source, meta) {
     }
     insertMessage.run('user', newPrompt, source, '', settings["workingDir"] || null, chatSessionId);
     broadcast('new_message', { role: 'user', content: newPrompt, source, scope: scopeKey, sessionId: chatSessionId });
-    broadcast('steer_started', stripUndefined({ prompt: newPrompt, origin: source || 'web', scope: scopeKey,
-        sessionId: chatSessionId, target: meta?.target, chatId: meta?.chatId, requestId: meta?.requestId,
-        remoteKey: meta?.remoteKey, replyViaTarget: meta?.replyViaTarget, mode: 'kill-steer', ...slackRestart }));
+    broadcast('steer_started', buildSteerStartedEvent({
+        prompt: newPrompt, source, scopeKey, chatSessionId, meta, mode: 'kill-steer', extra: slackRestart,
+    }));
     const { orchestrate, orchestrateContinue, orchestrateReset, isContinueIntent, isResetIntent } = await import('../orchestrator/pipeline.js');
     const origin = source || 'web';
     // Union of both contracts: the #655 steer identity (target/chatId/remoteKey/
@@ -1308,12 +1312,11 @@ export function spawnAgent(prompt, opts = {}) {
     const agyLogFile = cli === 'agy'
         ? join(os.tmpdir(), `jaw-agy-${agentId || 'main'}-${Date.now()}-${crypto.randomUUID()}.log`)
         : null;
-    const rawTimeoutCfg = settings['agentTimeout'];
-    const globalTimeoutCfg = rawTimeoutCfg && typeof rawTimeoutCfg === 'object'
-        ? rawTimeoutCfg : {};
-    const cliTimeoutCfg = globalTimeoutCfg[cli] && typeof globalTimeoutCfg[cli] === 'object'
-        ? globalTimeoutCfg[cli] : {};
-    const mergedTimeoutCfg = { ...globalTimeoutCfg, ...cliTimeoutCfg };
+    // The single agentTimeout parse for this run. Claude, the print watchdog and
+    // codex-app all read THIS object; before #682 the print path reparsed the same
+    // settings a second time, so fixing a timeout knob meant finding which of two
+    // parsers a given runtime happened to use.
+    const mergedTimeoutCfg = mergeAgentTimeoutCfg(cli);
     const resolvedAgyPrintTimeoutMs = typeof mergedTimeoutCfg['absoluteHardCapMs'] === 'number'
         ? mergedTimeoutCfg['absoluteHardCapMs']
         : DEFAULT_WATCHDOG_ABSOLUTE_HARD_CAP_MS;
@@ -1493,7 +1496,7 @@ export function spawnAgent(prompt, opts = {}) {
                 cancelling: reason => {
                     if (reason === 'steer' || reason === 'interrupt') {
                         armExitSettle(scopeKey);
-                        capturedExit ??= exitSettlers.get(scopeKey);
+                        capturedExit ??= captureExitSettler(scopeKey);
                     }
                 },
                 exit: { cli, model: runtimeModel, effectiveProvider, agentLabel, mainManaged, origin, resumeKey, prompt, opts,
@@ -1535,10 +1538,7 @@ export function spawnAgent(prompt, opts = {}) {
                             cleanupClaudeWorker();
                     }
                     finally {
-                        if (capturedExit && exitSettlers.get(scopeKey) === capturedExit) {
-                            exitSettlers.delete(scopeKey);
-                            capturedExit.resolve();
-                        }
+                        settleCapturedExit(scopeKey, capturedExit);
                         if (mainManaged && (queued || !activeMainProcesses.has(scopeKey)))
                             void processQueue(scopeKey);
                     }
@@ -1696,7 +1696,7 @@ export function spawnAgent(prompt, opts = {}) {
             stopReason ??= reason;
             if (reason === 'steer' || reason === 'interrupt') {
                 armExitSettle(scopeKey);
-                capturedExit ??= exitSettlers.get(scopeKey);
+                capturedExit ??= captureExitSettler(scopeKey);
             }
             nativeRun.cancel(reason);
         };
@@ -1823,7 +1823,7 @@ export function spawnAgent(prompt, opts = {}) {
                     ctx.sessionId = lease.session.nativeSessionId || null;
                 const recordedReason = consumeKillReason(lease?.child.pid);
                 const killReason = stopReason || recordedReason;
-                const wasKilled = Boolean(killReason), wasSteer = killReason === 'steer' || killReason === 'interrupt' || killReason === DUP_REGISTRATION_KILL_REASON;
+                const wasKilled = Boolean(killReason), wasSteer = isLifecycleSteerReason(killReason);
                 const code = outcome.status === 'done' ? 0 : outcome.status === 'stopped' ? 130 : 1;
                 handoffRuntimeOutcome(ctx, outcome);
                 try {
@@ -1878,10 +1878,7 @@ export function spawnAgent(prompt, opts = {}) {
                     // row running or rewrite a lifecycle that already selected a result.
                     if (ctx.runtimeOutcome)
                         closeFailedTrace(ctx.runtimeOutcome);
-                    if (capturedExit && exitSettlers.get(scopeKey) === capturedExit) {
-                        exitSettlers.delete(scopeKey);
-                        capturedExit.resolve();
-                    }
+                    settleCapturedExit(scopeKey, capturedExit);
                     // Exceptional settlement can release the slot before lifecycle requests its normal wake.
                     if (queueRequested || !activeMainProcesses.has(scopeKey))
                         void processQueue(scopeKey);
@@ -2225,7 +2222,7 @@ export function spawnAgent(prompt, opts = {}) {
                 console.warn(`[acp:unexpected-exit] code=${code} signal=${signal} sessionId=${ctx.sessionId || 'none'}`);
             }
             const wasKilled = !!acpKillReason;
-            const wasSteer = acpKillReason === 'steer';
+            const wasSteer = isLifecycleSteerReason(acpKillReason);
             flushThinking(); // Flush any remaining thinking buffer
             const smokeResult = detectSmokeResponse(ctx.fullText, ctx.toolLog, code, cli);
             const acpCode = promptCompleted ? 0 : (code ?? 1);
@@ -2261,13 +2258,8 @@ export function spawnAgent(prompt, opts = {}) {
     }
     // ─── Pi RPC branch ─────────────────────────────
     if (cli === 'pi') {
-        let piExit = exitSettlers.get(scopeKey);
-        const settlePiExit = () => {
-            if (!piExit || exitSettlers.get(scopeKey) !== piExit)
-                return;
-            exitSettlers.delete(scopeKey);
-            piExit.resolve();
-        };
+        let piExit = captureExitSettler(scopeKey);
+        const settlePiExit = () => { settleCapturedExit(scopeKey, piExit); };
         const pi = normalizePiSettings(settings["pi"]);
         const profileId = cfg.provider || pi.defaultProfileId;
         const profile = pi.profiles.find((entry) => entry.id === profileId) || pi.profiles[0];
@@ -2414,15 +2406,7 @@ export function spawnAgent(prompt, opts = {}) {
                 if (!lease) {
                     if (cancelOwnedPiProcess(child))
                         return Promise.resolve();
-                    if (child.pid) {
-                        const pid = child.pid;
-                        killProcessTree(pid, 'SIGTERM');
-                        setTimeout(() => {
-                            killProcessTreeIfAlive(child, pid);
-                        }, 5_000);
-                    }
-                    else
-                        child.kill('SIGTERM');
+                    ownProcess(child).terminate('cancel');
                     return Promise.resolve();
                 }
                 leaseCancel ??= lease.cancel();
@@ -2432,7 +2416,7 @@ export function spawnAgent(prompt, opts = {}) {
                 if (cleanupDone)
                     return;
                 if (reason === 'steer' || reason === 'interrupt')
-                    piExit = exitSettlers.get(scopeKey);
+                    piExit = captureExitSettler(scopeKey);
                 void requestCancel();
             };
             if (lease && mainRun)
@@ -2521,10 +2505,7 @@ export function spawnAgent(prompt, opts = {}) {
                     console.warn('[jaw:pi] exit observer failed');
                 }
                 const wasKilled = !!killReason;
-                // 'dup-registration' behaves like a steer for cleanup purposes: a
-                // replacement child already owns this label, so the stale exit handler
-                // must not delete the new child's map entry.
-                const wasSteer = killReason === 'steer' || killReason === DUP_REGISTRATION_KILL_REASON;
+                const wasSteer = isLifecycleSteerReason(killReason);
                 const smokeResult = detectSmokeResponse(ctx.fullText, ctx.toolLog, result.code, cli);
                 return handleAgentExit({
                     onRuntimeEnd: (end) => { activity.close(end); },
@@ -2555,7 +2536,7 @@ export function spawnAgent(prompt, opts = {}) {
                     handoffRuntimeOutcome(ctx, failedOutcome);
                 const killReason = consumeKillReason(child.pid);
                 const wasKilled = !!killReason;
-                const wasSteer = killReason === 'steer' || killReason === DUP_REGISTRATION_KILL_REASON;
+                const wasSteer = isLifecycleSteerReason(killReason);
                 stopWatchdog();
                 if (ctx.stderrBuf.length < 4000)
                     ctx.stderrBuf += err.message;
@@ -2882,10 +2863,15 @@ export function spawnAgent(prompt, opts = {}) {
             if (!opts.internal)
                 broadcast('agent_status', { running: true, agentId: agentLabel, cli, ...empTag });
             const processExit = { value: null };
+            // The one documented cross-runtime exception. codex-app keeps a 300s idle
+            // bound where the shared watchdog defaults to 90s, because an appserver turn
+            // reports sparse STRUCTURED progress instead of a continuous stream and
+            // nothing here counts stdout as liveness. settings.agentTimeout deliberately
+            // does not narrow it either: a global idleMs written for print CLIs would
+            // cut the default runtime's bound by two thirds. The env overrides remain
+            // the supported knob and are mapped into the watchdog config below.
             const idleMs = configuredPositiveMs(process.env["CODEX_APP_TURN_IDLE_MS"], DEFAULT_CODEX_APP_TURN_IDLE_MS);
             const absoluteMs = configuredPositiveMs(process.env["CODEX_APP_TURN_ABS_MS"], DEFAULT_CODEX_APP_TURN_ABS_MS);
-            let idleTimer;
-            let absoluteTimer;
             let watchdogCancel = null;
             let leaseCancel = null;
             const requestLeaseCancel = () => {
@@ -2920,20 +2906,32 @@ export function spawnAgent(prompt, opts = {}) {
             };
             if (mainRun)
                 mainRun.steerTurnInBand = steerHook;
-            const watchdogTimeout = (kind) => {
+            // The same watchdog every other runtime uses. The bespoke timer pair this
+            // replaces never set `ctx.stallReason`, and that field is the ONLY trigger
+            // for the #405 truncation notice (`error-classifier.ts:149-159`). So on the
+            // DEFAULT runtime a timeout surfaced as a generic error and the #405 fix
+            // never applied to the path most turns actually take.
+            const turnWatchdog = attachWatchdog(child, agentLabel, reason => {
                 if (watchdogCancel)
                     return;
-                console.warn(`[codex-app:turn] watchdog stall (${kind}, idleMs=${idleMs}, absoluteMs=${absoluteMs})`);
+                console.warn(`[codex-app:turn] watchdog stall (${reason}, idleMs=${idleMs}, absoluteMs=${absoluteMs})`);
+                ctx.stallReason = reason;
                 watchdogCancel = requestLeaseCancel();
-                rejectTurn(new Error(`Codex AppServer turn ${kind} watchdog timeout`));
-            };
-            const resetIdleTimer = () => {
-                clearTimeout(idleTimer);
-                idleTimer = setTimeout(() => { watchdogTimeout('idle'); }, idleMs);
-            };
-            idleTimer = setTimeout(() => { watchdogTimeout('idle'); }, idleMs);
-            absoluteTimer = setTimeout(() => { watchdogTimeout('absolute'); }, absoluteMs);
-            markCodexProgress = resetIdleTimer;
+                rejectTurn(new Error(`Codex AppServer turn watchdog timeout: ${reason}`));
+            }, {
+                // This child's stdout IS the JSON-RPC stream and readline already owns
+                // it, so counting raw traffic as liveness would keep a wedged turn
+                // looking alive forever. Progress comes from the turn adapter instead.
+                observeStdio: false,
+                // The two bespoke timers map onto the watchdog's two real gates:
+                // markProgress slides absoluteDeadline to now+absoluteMs, giving
+                // "no progress for idleMs", capped at startedAt+absoluteHardCapMs,
+                // giving "total run beyond absoluteMs". firstProgressMs bounds a turn
+                // that never reports at all.
+                firstProgressMs: idleMs, idleMs, absoluteMs: idleMs, absoluteHardCapMs: absoluteMs,
+            });
+            ctx.stallWatchdog = turnWatchdog;
+            markCodexProgress = () => { turnWatchdog.markProgress(); };
             const listener = listenCodexAppTurnAdapter(appClient, lease, laneScope, ctx, {
                 onProgress: () => { markCodexProgress(); },
                 onRawNotification: (method, params) => {
@@ -3043,8 +3041,7 @@ export function spawnAgent(prompt, opts = {}) {
                     appClient.kill();
             }
             finally {
-                clearTimeout(idleTimer);
-                clearTimeout(absoluteTimer);
+                turnWatchdog.stop();
                 markCodexProgress = () => { };
                 if (watchdogCancel)
                     await watchdogCancel;
@@ -3072,8 +3069,7 @@ export function spawnAgent(prompt, opts = {}) {
                 console.warn(`[codex-app:unexpected-exit] code=${processExit.value.code} signal=${processExit.value.signal} threadId=${ctx.sessionId || 'none'}`);
             }
             const wasKilled = !!killReason;
-            // See above: a dup-registration kill must not clobber the replacement.
-            const wasSteer = killReason === 'steer' || killReason === DUP_REGISTRATION_KILL_REASON;
+            const wasSteer = isLifecycleSteerReason(killReason);
             flushCodexAppThinking();
             const smokeResult = detectSmokeResponse(ctx.fullText, ctx.toolLog, exitCode, cli);
             await handleAgentExit({
@@ -3512,10 +3508,7 @@ export function spawnAgent(prompt, opts = {}) {
             console.log(`[jaw:agy] output quiet for ${quietCompletionDelayMs}ms — completing print run`);
             killReasons.set(child.pid, AGY_COMPLETE_KILL_REASON);
             try {
-                killProcessTree(child.pid, 'SIGTERM');
-                setTimeout(() => {
-                    killProcessTreeIfAlive(child);
-                }, DEFAULT_KILL_ESCALATION_MS);
+                ownProcess(child).terminate('completion');
             }
             catch (e) {
                 console.warn('[jaw:agy] quiet completion kill failed:', e.message);
@@ -3523,21 +3516,18 @@ export function spawnAgent(prompt, opts = {}) {
         }, quietCompletionDelayMs);
     };
     // ─── Subprocess stall watchdog (Phase 1: #178 OAuth2 stall recovery) ───
-    const rawAgentTimeoutCfg = settings["agentTimeout"];
-    const gCfg = rawAgentTimeoutCfg && typeof rawAgentTimeoutCfg === 'object'
-        ? rawAgentTimeoutCfg : {};
-    const cCfg = gCfg[cli] && typeof gCfg[cli] === 'object'
-        ? gCfg[cli] : {};
-    const agentTimeoutCfg = { ...gCfg, ...cCfg };
+    // Reads the same mergedTimeoutCfg the Claude branch does. This block used to
+    // reparse settings.agentTimeout on its own, so a timeout knob behaved differently
+    // depending on which parser a runtime happened to reach (#682).
     const watchdogConfig = {};
-    if (typeof agentTimeoutCfg['firstProgressMs'] === 'number')
-        watchdogConfig.firstProgressMs = agentTimeoutCfg['firstProgressMs'];
-    if (typeof agentTimeoutCfg['idleMs'] === 'number')
-        watchdogConfig.idleMs = agentTimeoutCfg['idleMs'];
-    if (typeof agentTimeoutCfg['absoluteMs'] === 'number')
-        watchdogConfig.absoluteMs = agentTimeoutCfg['absoluteMs'];
-    if (typeof agentTimeoutCfg['absoluteHardCapMs'] === 'number')
-        watchdogConfig.absoluteHardCapMs = agentTimeoutCfg['absoluteHardCapMs'];
+    if (typeof mergedTimeoutCfg['firstProgressMs'] === 'number')
+        watchdogConfig.firstProgressMs = mergedTimeoutCfg['firstProgressMs'];
+    if (typeof mergedTimeoutCfg['idleMs'] === 'number')
+        watchdogConfig.idleMs = mergedTimeoutCfg['idleMs'];
+    if (typeof mergedTimeoutCfg['absoluteMs'] === 'number')
+        watchdogConfig.absoluteMs = mergedTimeoutCfg['absoluteMs'];
+    if (typeof mergedTimeoutCfg['absoluteHardCapMs'] === 'number')
+        watchdogConfig.absoluteHardCapMs = mergedTimeoutCfg['absoluteHardCapMs'];
     const stallWatchdog = attachWatchdog(child, agentLabel, (reason) => {
         console.log(`[jaw:watchdog] killing ${agentLabel} — ${reason}`);
         ctx.stallReason = reason;
@@ -3547,12 +3537,7 @@ export function spawnAgent(prompt, opts = {}) {
             ctx.stderrBuf = ctx.stderrBuf ? `${ctx.stderrBuf}\n${agyWatchdogContext}` : agyWatchdogContext;
             pushTrace(ctx, agyWatchdogContext);
         }
-        if (child.pid) {
-            killProcessTree(child.pid, 'SIGTERM');
-            setTimeout(() => {
-                killProcessTreeIfAlive(child);
-            }, 5_000);
-        }
+        ownProcess(child).terminate('stall');
     }, watchdogConfig);
     ctx.stallWatchdog = stallWatchdog;
     let agyTranscriptWatcher = null;
@@ -3671,8 +3656,7 @@ export function spawnAgent(prompt, opts = {}) {
             if (agyResumeDecision.ok && !agyGuardedStaleDetected && isAgyStaleSessionOutput(text)) {
                 agyGuardedStaleDetected = true;
                 console.log('[jaw:agy] stale guarded resume output detected — terminating for fresh retry');
-                if (child.pid)
-                    killProcessTree(child.pid, 'SIGTERM');
+                ownProcess(child).terminate('cancel');
                 return;
             }
             if (!ctx.sessionId)
@@ -3820,7 +3804,7 @@ export function spawnAgent(prompt, opts = {}) {
         const stdKillReason = consumeKillReason(child.pid);
         const agyCompletedByQuietOutput = cli === 'agy' && stdKillReason === AGY_COMPLETE_KILL_REASON;
         const wasKilled = !!stdKillReason && !agyCompletedByQuietOutput;
-        const wasSteer = stdKillReason === 'steer';
+        const wasSteer = isLifecycleSteerReason(stdKillReason);
         if (cli === 'agy' && !ctx.sessionId)
             ctx.sessionId = extractAgyConversationId(ctx.fullText);
         if (cli === 'agy' && agyLogFile && !ctx.sessionId) {