commonswarm 0.1.21 → 0.1.22

package/cswarm.cjs

@@ -13503,6 +13503,8 @@ var require_main3 = __commonJS({
 var cli_exports = {};
 __export(cli_exports, {
   EXIT_RESTARTABLE: () => EXIT_RESTARTABLE,
+  TURN_BUDGET_CREDENTIAL_MARGIN_MS: () => TURN_BUDGET_CREDENTIAL_MARGIN_MS,
+  clampTurnBudgetToCredential: () => clampTurnBudgetToCredential,
   describeAudience: () => describeAudience,
   listenerFailureMessage: () => listenerFailureMessage,
   listenerHostLimits: () => listenerHostLimits,
@@ -13510,7 +13512,8 @@ __export(cli_exports, {
   listenerStatusJson: () => listenerStatusJson,
   renderRoster: () => renderRoster,
   resolveDetachedClaudeExecutable: () => resolveDetachedClaudeExecutable,
-  resolveDetachedCodexExecutable: () => resolveDetachedCodexExecutable
+  resolveDetachedCodexExecutable: () => resolveDetachedCodexExecutable,
+  resolveTurnBudgetOrDefer: () => resolveTurnBudgetOrDefer
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_crypto19 = require("node:crypto");
@@ -23058,6 +23061,67 @@ async function listFilesAsHuman(target2, accessToken, workspaceId2, fetcher = fe
   return body;
 }
 
+// src/cloud/feedback.ts
+var FeedbackTransportError = class extends Error {
+  name = "FeedbackTransportError";
+};
+var FeedbackRefusedError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+  name = "FeedbackRefusedError";
+};
+var REQUEST_TIMEOUT_MS2 = 3e4;
+async function submitFeedback(options, request) {
+  const fetcher = options.fetcher ?? fetch;
+  const controller = new AbortController();
+  const timer2 = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS2);
+  let response;
+  try {
+    response = await fetcher(commandEndpoint(options.target), {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${options.credential}`,
+        apikey: options.target.anonKey,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        command_id: newCommandId(),
+        client_version: "0.1.0",
+        workspace_id: options.workspaceId,
+        stream: { kind: "workspace" },
+        command: {
+          kind: "submit_feedback",
+          feedback_id: crypto.randomUUID(),
+          category: request.category,
+          body: request.body,
+          context: request.context ?? null
+        }
+      }),
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (error.name === "AbortError") {
+      throw new FeedbackTransportError("feedback submission timed out");
+    }
+    throw new FeedbackTransportError("feedback submission failed before a response");
+  } finally {
+    clearTimeout(timer2);
+  }
+  const body = await response.json().catch(() => null);
+  if (!response.ok) {
+    const code = typeof body?.error === "string" ? body.error : "http_error";
+    const message = typeof body?.message === "string" ? body.message : `feedback submission was refused (HTTP ${response.status})`;
+    throw new FeedbackRefusedError(code, message);
+  }
+  if (body === null || typeof body.status !== "string") {
+    throw new FeedbackTransportError("the deployment answered without a readable result");
+  }
+  return body;
+}
+
 // src/cloud/current-target.ts
 var import_node_crypto6 = require("node:crypto");
 var import_promises3 = require("node:fs/promises");
@@ -29373,6 +29437,59 @@ async function runInboxFollow(options) {
 // src/host/opencode.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_crypto12 = require("node:crypto");
+
+// src/host/stderr-tail.ts
+var RING_CAPACITY_BYTES = 4096;
+var TAIL_MAX_CHARS = 2048;
+var EXOTIC_SEPARATORS = "\\u00a0\\u1680\\u2000-\\u200d\\u2028\\u2029\\u202a-\\u202e\\u2060\\u2066-\\u2069\\u202f\\u205f\\u3000\\ufeff";
+var SEPARATOR_CLASS_SOURCE = "\\t\\n\\x0b\\f\\r " + EXOTIC_SEPARATORS;
+var ANSI_ESCAPE_GLOBAL_RE2 = new RegExp("\\u001b\\[[0-?]*[ -\\/]*[@-~]", "g");
+var CONTROL_AND_SEPARATOR_STRIP_RE = new RegExp(
+  "[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f" + EXOTIC_SEPARATORS + "]",
+  "g"
+);
+var CREDENTIAL_PREFIX_RE = new RegExp(
+  `swm_(?:agt|inv|cap)_[^${SEPARATOR_CLASS_SOURCE}]*`,
+  "gi"
+);
+function sanitizeStderrTail(raw) {
+  return raw.replace(ANSI_ESCAPE_GLOBAL_RE2, "").replace(CONTROL_AND_SEPARATOR_STRIP_RE, "").replace(CREDENTIAL_PREFIX_RE, "[redacted-credential]").slice(-TAIL_MAX_CHARS).trim();
+}
+function attachStderrTailRing(stderr) {
+  const chunks = [];
+  let total = 0;
+  let evicted = false;
+  stderr.on("data", (chunk) => {
+    const buffer2 = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+    chunks.push(buffer2);
+    total += buffer2.length;
+    while (total > RING_CAPACITY_BYTES && chunks.length > 0) {
+      evicted = true;
+      const head2 = chunks[0];
+      const excess = total - RING_CAPACITY_BYTES;
+      if (head2.length <= excess) {
+        chunks.shift();
+        total -= head2.length;
+      } else {
+        chunks[0] = head2.subarray(excess);
+        total -= excess;
+      }
+    }
+  });
+  stderr.resume();
+  return {
+    read() {
+      let text = Buffer.concat(chunks).toString("utf8");
+      if (evicted) {
+        const newline = text.indexOf("\n");
+        text = newline === -1 ? "" : text.slice(newline + 1);
+      }
+      return sanitizeStderrTail(text);
+    }
+  };
+}
+
+// src/host/opencode.ts
 var import_node_fs3 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
 var import_node_os4 = require("node:os");
@@ -31027,8 +31144,18 @@ async function openOpenCodeAcpSession(options) {
       await disposeHome();
       throw new AcpHostError("spawn_failed", "child missing stdio pipes");
     }
-    child.stderr.on("data", () => void 0);
-    child.stderr.resume();
+    const stderrTail = attachStderrTailRing(child.stderr);
+    if (options.onStderrTail) {
+      const deliverTail = options.onStderrTail;
+      let tailDelivered = false;
+      const publishTail = () => {
+        if (tailDelivered) return;
+        tailDelivered = true;
+        deliverTail(stderrTail.read());
+      };
+      child.once("exit", publishTail);
+      child.once("close", publishTail);
+    }
     let sessionRef = null;
     const transport = createBoundTransport({
       readable: child.stdout,
@@ -31310,8 +31437,18 @@ async function openClaudeAcpSession(options) {
     await terminateClaudeChild(child);
     throw new AcpHostError("spawn_failed", "child missing stdio pipes");
   }
-  child.stderr.on("data", () => void 0);
-  child.stderr.resume();
+  const stderrTail = attachStderrTailRing(child.stderr);
+  if (options.onStderrTail) {
+    const deliverTail = options.onStderrTail;
+    let tailDelivered = false;
+    const publishTail = () => {
+      if (tailDelivered) return;
+      tailDelivered = true;
+      deliverTail(stderrTail.read());
+    };
+    child.once("exit", publishTail);
+    child.once("close", publishTail);
+  }
   let sessionRef = null;
   const transport = createBoundTransport({
     readable: child.stdout,
@@ -31586,8 +31723,18 @@ async function openCodexAcpSession(options) {
     await terminateCodexChild(child);
     throw new AcpHostError("spawn_failed", "child missing stdio pipes");
   }
-  child.stderr.on("data", () => void 0);
-  child.stderr.resume();
+  const stderrTail = attachStderrTailRing(child.stderr);
+  if (options.onStderrTail) {
+    const deliverTail = options.onStderrTail;
+    let tailDelivered = false;
+    const publishTail = () => {
+      if (tailDelivered) return;
+      tailDelivered = true;
+      deliverTail(stderrTail.read());
+    };
+    child.once("exit", publishTail);
+    child.once("close", publishTail);
+  }
   let sessionRef = null;
   const transport = createBoundTransport({
     readable: child.stdout,
@@ -31637,6 +31784,19 @@ async function openCodexAcpSession(options) {
   }
 }
 
+// src/listener/types.ts
+var LISTENER_PROMPT_TIMEOUT_MS = 6e5;
+var ListenerRenewalUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "renewal_unavailable";
+  }
+};
+async function resolveBudgetAndPrompt(session, prompt, budget) {
+  const timeoutMs = typeof budget === "number" ? budget : await budget();
+  return await session.prompt(prompt, { timeoutMs });
+}
+
 // src/listener/engine.ts
 var UUID_RE8 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var TERMINAL_STATES = /* @__PURE__ */ new Set(["done", "expired", "failed"]);
@@ -31751,6 +31911,7 @@ function abortError() {
 }
 function defaultRetryablePromptError(error) {
   if (error instanceof SenderProvenanceUnavailableError) return true;
+  if (error instanceof ListenerRenewalUnavailableError) return true;
   if (error instanceof AcpHostError) return TRANSIENT_ACP_CODES.has(error.code);
   return false;
 }
@@ -32517,8 +32678,18 @@ async function openGrokAcpSession(options) {
     child.kill("SIGKILL");
     throw new AcpHostError("spawn_failed", "child missing stdio pipes");
   }
-  child.stderr.on("data", () => void 0);
-  child.stderr.resume();
+  const stderrTail = attachStderrTailRing(child.stderr);
+  if (options.onStderrTail) {
+    const deliverTail = options.onStderrTail;
+    let tailDelivered = false;
+    const publishTail = () => {
+      if (tailDelivered) return;
+      tailDelivered = true;
+      deliverTail(stderrTail.read());
+    };
+    child.once("exit", publishTail);
+    child.once("close", publishTail);
+  }
   let sessionRef = null;
   const transport = createBoundTransport({
     readable: child.stdout,
@@ -32583,8 +32754,9 @@ var GrokListenerModel = class {
   async prompt(_signal, _mode, prompt) {
     if (this.closed) throw new Error("listener model is closed");
     const worker = await this.ensureWorker();
+    const budget = this.options.promptTimeoutMs ?? LISTENER_PROMPT_TIMEOUT_MS;
     try {
-      return await worker.session.prompt(prompt);
+      return await resolveBudgetAndPrompt(worker.session, prompt, budget);
     } catch (error) {
       if (error instanceof AcpChildExitError) {
         try {
@@ -32619,6 +32791,7 @@ var GrokListenerModel = class {
       ...this.options.model ? { model: this.options.model } : {},
       ...this.options.effort ? { effort: this.options.effort } : {},
       ...this.options.env ? { env: this.options.env } : {},
+      ...this.options.onWorkerStderrTail ? { onStderrTail: this.options.onWorkerStderrTail } : {},
       clientName: "cswarm-listener"
     });
     try {
@@ -32735,8 +32908,9 @@ var OpenCodeListenerModel = class {
   async prompt(_signal, _mode, prompt) {
     if (this.closed) throw new Error("listener model is closed");
     const worker = await this.ensureWorker();
+    const budget = this.options.promptTimeoutMs ?? LISTENER_PROMPT_TIMEOUT_MS;
     try {
-      return await worker.session.prompt(prompt);
+      return await resolveBudgetAndPrompt(worker.session, prompt, budget);
     } catch (error) {
       if (error instanceof AcpChildExitError) {
         const home = this.workerHome;
@@ -33026,6 +33200,7 @@ var OpenCodeListenerModel = class {
         ...this.options.model ? { model: this.options.model } : {},
         ...this.options.env ? { env: this.options.env } : {},
         ...this.options.allowMissingAuth === true ? { allowMissingAuth: true } : {},
+        ...this.options.onWorkerStderrTail ? { onStderrTail: this.options.onWorkerStderrTail } : {},
         clientName: "cswarm-listener"
       });
       pending.phase = "opening";
@@ -33150,8 +33325,9 @@ var ClaudeListenerModel = class {
   async prompt(_signal, _mode, prompt) {
     if (this.closed) throw new Error("listener model is closed");
     const worker = await this.ensureWorker();
+    const budget = this.options.promptTimeoutMs ?? LISTENER_PROMPT_TIMEOUT_MS;
     try {
-      return await worker.session.prompt(prompt);
+      return await resolveBudgetAndPrompt(worker.session, prompt, budget);
     } catch (error) {
       if (error instanceof AcpChildExitError) {
         try {
@@ -33233,6 +33409,7 @@ var ClaudeListenerModel = class {
         ...this.options.executable ? { executable: this.options.executable } : {},
         ...this.options.env ? { env: this.options.env } : {},
         signal: controller.signal,
+        ...this.options.onWorkerStderrTail ? { onStderrTail: this.options.onWorkerStderrTail } : {},
         clientName: "cswarm-listener"
       });
       this.openingHandle = handle;
@@ -33316,8 +33493,9 @@ var CodexListenerModel = class {
   async prompt(_signal, _mode, prompt) {
     if (this.closed) throw new Error("listener model is closed");
     const worker = await this.ensureWorker();
+    const budget = this.options.promptTimeoutMs ?? LISTENER_PROMPT_TIMEOUT_MS;
     try {
-      return await worker.session.prompt(prompt);
+      return await resolveBudgetAndPrompt(worker.session, prompt, budget);
     } catch (error) {
       if (error instanceof AcpChildExitError) {
         try {
@@ -33399,6 +33577,7 @@ var CodexListenerModel = class {
         ...this.options.executable ? { executable: this.options.executable } : {},
         ...this.options.env ? { env: this.options.env } : {},
         signal: controller.signal,
+        ...this.options.onWorkerStderrTail ? { onStderrTail: this.options.onWorkerStderrTail } : {},
         clientName: "cswarm-listener"
       });
       this.openingHandle = handle;
@@ -35043,6 +35222,7 @@ var STATUS_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "stoppedAt",
   "lastSignalId",
   "lastErrorCode",
+  "lastWorkerStderrTail",
   "logPath",
   "deliveryMode",
   "pendingDeliveryCount",
@@ -35097,7 +35277,7 @@ function parseStatus(raw) {
   const nullableUuid2 = (candidate) => candidate === null || typeof candidate === "string" && UUID_RE12.test(candidate);
   const nullableCount = (candidate) => candidate === null || typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate >= 0;
   const nullableTimestamp = (candidate) => candidate === null || typeof candidate === "string" && Number.isFinite(Date.parse(candidate));
-  if (row.version !== 1 || typeof row.instanceId !== "string" || !UUID_RE12.test(row.instanceId) || row.provider !== "grok" && row.provider !== "opencode" && row.provider !== "claude" && row.provider !== "codex" || typeof row.profileId !== "string" || typeof row.workspaceId !== "string" || !UUID_RE12.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE12.test(row.principalId) || !Number.isSafeInteger(row.pid) || row.pid < 1 || typeof row.state !== "string" || !["starting", "ready", "stopping", "stopped", "failed"].includes(row.state) || typeof row.startedAt !== "string" || !Number.isFinite(Date.parse(row.startedAt)) || !(row.readyAt === null || typeof row.readyAt === "string" && Number.isFinite(Date.parse(row.readyAt))) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt)) || !(row.stoppedAt === null || typeof row.stoppedAt === "string" && Number.isFinite(Date.parse(row.stoppedAt))) || !nullableUuid2(row.lastSignalId) || !(row.lastErrorCode === null || typeof row.lastErrorCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorCode)) || typeof row.logPath !== "string" || !(0, import_node_path14.isAbsolute)(row.logPath) || !(row.deliveryMode === void 0 || row.deliveryMode === null || typeof row.deliveryMode === "string" && STATUS_DELIVERY_MODES.has(row.deliveryMode)) || !(row.pendingDeliveryCount === void 0 || nullableCount(row.pendingDeliveryCount)) || !(row.lastTerminalDeliveryFailureCount === void 0 || nullableCount(row.lastTerminalDeliveryFailureCount)) || !(row.lastTerminalDeliveryFailureAt === void 0 || nullableTimestamp(row.lastTerminalDeliveryFailureAt)) || !(row.lastClaimAt === void 0 || nullableTimestamp(row.lastClaimAt)) || !(row.lastAckAt === void 0 || nullableTimestamp(row.lastAckAt))) {
+  if (row.version !== 1 || typeof row.instanceId !== "string" || !UUID_RE12.test(row.instanceId) || row.provider !== "grok" && row.provider !== "opencode" && row.provider !== "claude" && row.provider !== "codex" || typeof row.profileId !== "string" || typeof row.workspaceId !== "string" || !UUID_RE12.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE12.test(row.principalId) || !Number.isSafeInteger(row.pid) || row.pid < 1 || typeof row.state !== "string" || !["starting", "ready", "stopping", "stopped", "failed"].includes(row.state) || typeof row.startedAt !== "string" || !Number.isFinite(Date.parse(row.startedAt)) || !(row.readyAt === null || typeof row.readyAt === "string" && Number.isFinite(Date.parse(row.readyAt))) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt)) || !(row.stoppedAt === null || typeof row.stoppedAt === "string" && Number.isFinite(Date.parse(row.stoppedAt))) || !nullableUuid2(row.lastSignalId) || !(row.lastErrorCode === null || typeof row.lastErrorCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorCode)) || !(row.lastWorkerStderrTail === void 0 || row.lastWorkerStderrTail === null || typeof row.lastWorkerStderrTail === "string" && row.lastWorkerStderrTail.length > 0 && row.lastWorkerStderrTail.length <= 2048 && !/swm_(?:agt|inv|cap)_/i.test(row.lastWorkerStderrTail)) || typeof row.logPath !== "string" || !(0, import_node_path14.isAbsolute)(row.logPath) || !(row.deliveryMode === void 0 || row.deliveryMode === null || typeof row.deliveryMode === "string" && STATUS_DELIVERY_MODES.has(row.deliveryMode)) || !(row.pendingDeliveryCount === void 0 || nullableCount(row.pendingDeliveryCount)) || !(row.lastTerminalDeliveryFailureCount === void 0 || nullableCount(row.lastTerminalDeliveryFailureCount)) || !(row.lastTerminalDeliveryFailureAt === void 0 || nullableTimestamp(row.lastTerminalDeliveryFailureAt)) || !(row.lastClaimAt === void 0 || nullableTimestamp(row.lastClaimAt)) || !(row.lastAckAt === void 0 || nullableTimestamp(row.lastAckAt))) {
     throw new Error("stored listener status is malformed");
   }
   return {
@@ -35107,7 +35287,8 @@ function parseStatus(raw) {
     lastTerminalDeliveryFailureCount: row.lastTerminalDeliveryFailureCount ?? null,
     lastTerminalDeliveryFailureAt: row.lastTerminalDeliveryFailureAt ?? null,
     lastClaimAt: row.lastClaimAt ?? null,
-    lastAckAt: row.lastAckAt ?? null
+    lastAckAt: row.lastAckAt ?? null,
+    lastWorkerStderrTail: row.lastWorkerStderrTail ?? null
   };
 }
 async function writeListenerStatus(paths, status) {
@@ -35144,7 +35325,12 @@ async function appendListenerEvent(paths, event) {
     // D-051 companion 2: why a listener is down, and why it stopped trying.
     "restart_attempts",
     "restartable",
-    "restarts_exhausted"
+    "restarts_exhausted",
+    // D-090 family: the last lines of a dead worker's stderr, sanitized and
+    // bounded by the supervisor, and the prompt-turn budget behind a timeout.
+    // Local log only — this file never feeds a server payload.
+    "worker_stderr_tail",
+    "turn_budget_ms"
   ]);
   const deliveryModes = /* @__PURE__ */ new Set(["durable_claim", "cursor_fallback"]);
   const deliveryOutcomes = /* @__PURE__ */ new Set([
@@ -35166,7 +35352,16 @@ async function appendListenerEvent(paths, event) {
     if (key2 === "outcome" && !(value === null || typeof value === "string" && deliveryOutcomes.has(value))) {
       throw new Error("listener event outcome is not allowed");
     }
-    if (typeof value === "string" && (value.length > 128 || /swm_(?:agt|inv|cap)_/i.test(value))) {
+    if (key2 === "worker_stderr_tail" && !(typeof value === "string" && value.length > 0 && value.length <= 2048)) {
+      throw new Error("listener event stderr tail is not allowed");
+    }
+    if (key2 === "turn_budget_ms" && !(typeof value === "number" && Number.isSafeInteger(value) && value > 0)) {
+      throw new Error("listener event turn budget is not allowed");
+    }
+    if (typeof value === "string" && // worker_stderr_tail is deliberately exempt from the generic 128-char
+    // cap (its own bound is 2048, above); the secret scan still applies to
+    // every string, the tail included.
+    (key2 !== "worker_stderr_tail" && value.length > 128 || /swm_(?:agt|inv|cap)_/i.test(value))) {
       throw new Error("listener event contains unsafe text");
     }
   }
@@ -35443,6 +35638,23 @@ function safeErrorCode(error) {
   const name = error.name.toLowerCase().replace(/[^a-z0-9_-]+/g, "_");
   return name.slice(0, 96) || "listener_error";
 }
+var TAIL_SERIALIZED_BUDGET_BYTES = 3e3;
+function fitWorkerStderrTailForLog(tail) {
+  let fitted = tail.trim();
+  for (; ; ) {
+    if (fitted.length === 0) return fitted;
+    const serializedBytes = Buffer.byteLength(JSON.stringify(fitted), "utf8");
+    if (fitted.length <= 2048 && serializedBytes <= TAIL_SERIALIZED_BUDGET_BYTES) {
+      return fitted;
+    }
+    const dropChars = Math.max(
+      fitted.length - 2048,
+      Math.ceil((serializedBytes - TAIL_SERIALIZED_BUDGET_BYTES) / 6),
+      1
+    );
+    fitted = fitted.slice(dropChars);
+  }
+}
 async function runListenerSupervisor(options) {
   const now = options.now ?? Date.now;
   const startedAt = iso2(now);
@@ -35464,6 +35676,7 @@ async function runListenerSupervisor(options) {
     stoppedAt: null,
     lastSignalId: null,
     lastErrorCode: null,
+    lastWorkerStderrTail: null,
     deliveryMode: null,
     pendingDeliveryCount: null,
     lastTerminalDeliveryFailureCount: null,
@@ -35518,9 +35731,21 @@ async function runListenerSupervisor(options) {
     instance_id: status.instanceId,
     pid: process.pid
   });
+  const takeWorkerStderrTail = options.takeWorkerStderrTail;
+  const takeTail = () => {
+    if (!takeWorkerStderrTail) return null;
+    const tail = takeWorkerStderrTail();
+    if (typeof tail !== "string") return null;
+    const fitted = fitWorkerStderrTailForLog(tail);
+    return fitted.length > 0 ? fitted : null;
+  };
   const onEvent = (event) => {
     if (event.type === "ready") {
-      transition("ready", { readyAt: event.ts, lastErrorCode: null });
+      transition("ready", {
+        readyAt: event.ts,
+        lastErrorCode: null,
+        lastWorkerStderrTail: null
+      });
       log({ ts: event.ts, event: "listener_ready" });
       return;
     }
@@ -35537,7 +35762,15 @@ async function runListenerSupervisor(options) {
         event: "listener_effect",
         signal_id: event.signalId,
         status: event.status,
-        failure_code: event.failureCode
+        failure_code: event.failureCode,
+        // Code comparison, not message matching (D-053). The budget rides
+        // only the timeout class so a reader can see what bound was hit — and
+        // it is the CLAMPED budget actually in force, not the configured cap.
+        ...(() => {
+          if (event.failureCode !== "acptimeouterror") return {};
+          const budget = options.getTurnBudgetMs?.();
+          return typeof budget === "number" && budget > 0 ? { turn_budget_ms: budget } : {};
+        })()
       });
       return;
     }
@@ -35667,14 +35900,20 @@ async function runListenerSupervisor(options) {
       restarts += 1;
       const delayMs = nextListenerRestartMs(restarts, policy, restartRandom);
       const restartCode = safeErrorCode(stop.error);
+      const restartStderrTail = takeTail();
       log({
         ts: iso2(now),
         event: "listener_restarting",
         attempt: restarts,
         delay_ms: delayMs,
-        failure_code: restartCode
+        failure_code: restartCode,
+        ...restartStderrTail !== null ? { worker_stderr_tail: restartStderrTail } : {}
+      });
+      transition("starting", {
+        readyAt: null,
+        lastErrorCode: restartCode,
+        lastWorkerStderrTail: restartStderrTail
       });
-      transition("starting", { readyAt: null, lastErrorCode: restartCode });
       await restartSleep(delayMs, controller.signal);
       if (controller.signal.aborted) {
         stop = { reason: "cancelled" };
@@ -35685,14 +35924,17 @@ async function runListenerSupervisor(options) {
     if (stop.reason === "cancelled") {
       transition("stopped", {
         stoppedAt,
-        lastErrorCode: null
+        lastErrorCode: null,
+        lastWorkerStderrTail: null
       });
       log({ ts: stoppedAt, event: "listener_stopped" });
     } else {
       const code = stop.reason === "credential" ? "credential_stopped" : safeErrorCode(stop.error);
+      const failedStderrTail = takeTail();
       transition("failed", {
         stoppedAt,
-        lastErrorCode: code
+        lastErrorCode: code,
+        lastWorkerStderrTail: failedStderrTail
       });
       log({
         ts: stoppedAt,
@@ -35700,7 +35942,8 @@ async function runListenerSupervisor(options) {
         failure_code: code,
         restart_attempts: restarts,
         restartable: eligible,
-        restarts_exhausted: exhausted
+        restarts_exhausted: exhausted,
+        ...failedStderrTail !== null ? { worker_stderr_tail: failedStderrTail } : {}
       });
     }
   } catch (error) {
@@ -35708,11 +35951,17 @@ async function runListenerSupervisor(options) {
     const code = safeErrorCode(
       error instanceof Error ? error : new Error(String(error))
     );
-    transition("failed", { stoppedAt, lastErrorCode: code });
+    const failedStderrTail = takeTail();
+    transition("failed", {
+      stoppedAt,
+      lastErrorCode: code,
+      lastWorkerStderrTail: failedStderrTail
+    });
     log({
       ts: stoppedAt,
       event: "listener_failed",
-      failure_code: code
+      failure_code: code,
+      ...failedStderrTail !== null ? { worker_stderr_tail: failedStderrTail } : {}
     });
   } finally {
     await writes.catch(() => void 0);
@@ -36564,7 +36813,8 @@ function buildListenerChildArgs(spec) {
     ...provider === "claude" && claudeExe ? ["--claude-executable", claudeExe] : [],
     ...provider === "codex" && codexExe ? ["--codex-executable", codexExe] : [],
     ...spec.model ? ["--model", spec.model] : [],
-    ...provider === "grok" && spec.effort ? ["--effort", spec.effort] : []
+    ...provider === "grok" && spec.effort ? ["--effort", spec.effort] : [],
+    ...spec.turnBudget ? ["--turn-budget", spec.turnBudget] : []
   ];
 }
 async function spawnDetachedListener(options) {
@@ -36649,6 +36899,7 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "to",
   "token-id",
   "ttl-ms",
+  "turn-budget",
   "uid",
   "until",
   "url",
@@ -36682,8 +36933,8 @@ var ACCEPTED_AGENT_CREDENTIAL_MESSAGES = [
   AGENT_CREDENTIAL_MESSAGE_D088
 ];
 function packageVersion() {
-  if ("0.1.21".length > 0) {
-    return "0.1.21";
+  if ("0.1.22".length > 0) {
+    return "0.1.22";
   }
   try {
     const value = JSON.parse(
@@ -36810,7 +37061,8 @@ Usage:
   cswarm file get <name|file-id> [--version <n>] [--out <local-path>] [--force] [--url <url> --anon-key <key>] [--workspace-id <uuid>] [--agent-token-stdin] [--json]
   cswarm file rm <name|file-id> [--url <url> --anon-key <key>] [--workspace-id <uuid>] [--agent-token-stdin] [--json]
   cswarm file restore <name|file-id> [--url <url> --anon-key <key>] [--workspace-id <uuid>] [--agent-token-stdin] [--json]
-  cswarm listen start --agent-token-stdin [--url <url> --anon-key <key>] --workspace-id <uuid> --provider grok|opencode|claude|codex [--cwd <absolute-path>] [--model <model>] [--effort <level>] [--permissions deny|allow] [--grok-executable <path>] [--opencode-executable <path>] [--claude-executable <path>] [--codex-executable <path>] [--foreground] [--json]
+  cswarm feedback "<text>" --kind bug|idea|friction [--about <ref>] [--url <url> --anon-key <key>] [--workspace-id <uuid>] [--agent-token-stdin] [--json]
+  cswarm listen start --agent-token-stdin [--url <url> --anon-key <key>] --workspace-id <uuid> --provider grok|opencode|claude|codex [--cwd <absolute-path>] [--model <model>] [--effort <level>] [--permissions deny|allow] [--grok-executable <path>] [--opencode-executable <path>] [--claude-executable <path>] [--codex-executable <path>] [--turn-budget <duration>] [--foreground] [--json]
   cswarm listen status [--url <url> --anon-key <key>] --workspace-id <uuid> --principal-id <uuid> [--json]
   cswarm listen stop [--url <url> --anon-key <key>] --workspace-id <uuid> --principal-id <uuid> [--json]
   cswarm new "<workspace name>" [--url <url> --anon-key <key>] [--json]
@@ -36845,14 +37097,29 @@ Credential selection for command/dogfood:
                             members       reads only          -- either form
                             file put, file ls, file get, file rm, file restore
                                           read and command, nothing persisted -- either form
+                            feedback      command only, nothing persisted     -- either form
                             listen start  persists durable state, rotates -- needs expires_at
                             token revoke  names what it revokes           -- needs token_id
 
+Found a bug or missing feature in cswarm itself? cswarm feedback sends it to the
+deployment's operators \u2014 agents are encouraged to report friction they hit.
+
 Signals (intention sharing) accept the same credential selection. Agent mode
 never opens a browser or infers a human's saved workspace. Durations use a whole
 number plus m, h, or d (for example 90m, 24h, or 7d) and are capped at 30d.
 Place -- before signal text that itself begins with -- to stop option parsing.
 
+listen start --turn-budget bounds ONE worker prompt turn (default 10m): how long
+the worker may think and use tools on a single message before the turn times out
+and durable delivery retries it. A whole number plus s, m, or h (for example
+90s, 5m, 1h), at least 30s and at most 60m. Each turn is additionally clamped
+to the live credential's remaining lifetime minus 60s, after renewing it when
+due \u2014 a turn never outlives its credential. Right after a rotation the full
+budget is available up to the token TTL minus 60s (about 59m on the default 1h
+TTL); a turn that lands just before a rotation can be clamped to the ~5m
+renewal lead, and if it times out there, durable delivery retries it on the
+fresh credential.
+
 Invite, legacy token accept, principal create/revoke, human token mint/revoke, link, and new require a
 stored human login. Agent self-surrender of a token uses --agent-token-stdin and never takes the secret on argv. Invite-link accept signs in when needed, then accepts and
 registers one principal. Invitation links, agent credentials, and capability links
@@ -38208,6 +38475,38 @@ function signalDuration(value) {
   }
   return milliseconds;
 }
+function listenerTurnBudgetMs(value) {
+  if (value === void 0) return LISTENER_PROMPT_TIMEOUT_MS;
+  const match = /^([1-9]\d*)(s|m|h)$/.exec(value);
+  if (!match) {
+    throw new Error("--turn-budget must be a duration such as 90s, 5m, or 1h");
+  }
+  const unit = match[2] === "s" ? 1e3 : match[2] === "m" ? 6e4 : 36e5;
+  const milliseconds = Number(match[1]) * unit;
+  if (!Number.isSafeInteger(milliseconds) || milliseconds < 3e4 || milliseconds > 36e5) {
+    throw new Error("--turn-budget must be between 30s and 60m");
+  }
+  return milliseconds;
+}
+var TURN_BUDGET_CREDENTIAL_MARGIN_MS = 6e4;
+function clampTurnBudgetToCredential(budgetMs, credentialExpiresAt, nowMs) {
+  if (credentialExpiresAt === null) return budgetMs;
+  const horizonMs = credentialExpiresAt - nowMs - TURN_BUDGET_CREDENTIAL_MARGIN_MS;
+  return Math.max(1e3, Math.min(budgetMs, horizonMs));
+}
+function resolveTurnBudgetOrDefer(configuredBudgetMs, credentialExpiresAt, nowMs, renewalFailed) {
+  if (renewalFailed) {
+    throw new ListenerRenewalUnavailableError(
+      "the worker credential could not be renewed before this turn; deferring the ask for durable redelivery"
+    );
+  }
+  if (credentialExpiresAt !== null && credentialExpiresAt - nowMs <= TURN_BUDGET_CREDENTIAL_MARGIN_MS) {
+    throw new ListenerRenewalUnavailableError(
+      "the live worker credential is inside its rotation margin and was not renewed; deferring the ask for durable redelivery"
+    );
+  }
+  return clampTurnBudgetToCredential(configuredBudgetMs, credentialExpiresAt, nowMs);
+}
 function signalText(value, label) {
   const maximum = label === "body" ? 2e3 : 500;
   if (value.length < (label === "body" ? 1 : 0) || value.length > maximum) {
@@ -38990,6 +39289,13 @@ function renderListenerStatus(status) {
     status.lastSignalId ? `Last handled signal: ${status.lastSignalId}.` : "No signal has been handled yet.",
     status.lastErrorCode ? `Last status code: ${status.lastErrorCode}.` : "No listener error is recorded."
   ];
+  if (status.lastWorkerStderrTail) {
+    const tailLines = status.lastWorkerStderrTail.split("\n").filter((line) => line.trim().length > 0);
+    lines.push("Worker stderr (local log only):");
+    for (const line of tailLines.slice(-3)) {
+      lines.push(`  ${line}`);
+    }
+  }
   if (status.deliveryMode === "durable_claim") {
     lines.push("Delivery mode: durable claim and acknowledgement.");
   } else if (status.deliveryMode === "cursor_fallback") {
@@ -39169,22 +39475,58 @@ async function runConfiguredListener(options) {
     principalId: options.principalId,
     ...options.stateDirectory ? { stateDirectory: options.stateDirectory } : {}
   });
+  const turnBudgetMs = options.turnBudgetMs ?? LISTENER_PROMPT_TIMEOUT_MS;
+  let lastAppliedTurnBudgetMs = null;
+  const resolveTurnBudgetMs = async () => {
+    let renewalFailed = false;
+    try {
+      await credentialSession.bearer();
+    } catch {
+      renewalFailed = true;
+    }
+    const applied = resolveTurnBudgetOrDefer(
+      turnBudgetMs,
+      credentialSession.expiry,
+      Date.now(),
+      renewalFailed
+    );
+    lastAppliedTurnBudgetMs = applied;
+    return applied;
+  };
+  let lastWorkerStderrTail = null;
+  let workerStderrGeneration = 0;
+  const newWorkerStderrTailSink = () => {
+    const generation = ++workerStderrGeneration;
+    lastWorkerStderrTail = null;
+    return (tail) => {
+      if (generation !== workerStderrGeneration) return;
+      lastWorkerStderrTail = tail.length > 0 ? tail : null;
+    };
+  };
   const newModel = () => options.provider === "opencode" ? new OpenCodeListenerModel({
     cwd: options.cwd,
     permissionMode: options.permissionMode,
+    promptTimeoutMs: resolveTurnBudgetMs,
+    onWorkerStderrTail: newWorkerStderrTailSink(),
     ...options.model ? { model: options.model } : {},
     ...options.opencodeExecutable ? { executable: options.opencodeExecutable } : options.executable ? { executable: options.executable } : {}
   }) : options.provider === "claude" ? new ClaudeListenerModel({
     cwd: options.cwd,
     permissionMode: options.permissionMode,
+    promptTimeoutMs: resolveTurnBudgetMs,
+    onWorkerStderrTail: newWorkerStderrTailSink(),
     ...options.claudeExecutable ? { executable: options.claudeExecutable } : options.executable ? { executable: options.executable } : {}
   }) : options.provider === "codex" ? new CodexListenerModel({
     cwd: options.cwd,
     permissionMode: options.permissionMode,
+    promptTimeoutMs: resolveTurnBudgetMs,
+    onWorkerStderrTail: newWorkerStderrTailSink(),
     ...options.codexExecutable ? { executable: options.codexExecutable } : options.executable ? { executable: options.executable } : {}
   }) : new GrokListenerModel({
     cwd: options.cwd,
     permissionMode: options.permissionMode,
+    promptTimeoutMs: resolveTurnBudgetMs,
+    onWorkerStderrTail: newWorkerStderrTailSink(),
     ...options.model ? { model: options.model } : {},
     ...options.effort ? { effort: options.effort } : {},
     ...options.executable ? { executable: options.executable } : {}
@@ -39204,6 +39546,14 @@ async function runConfiguredListener(options) {
       principalId: options.principalId,
       provider: options.provider,
       permissionMode: options.permissionMode,
+      // The bound a timeout event reports: the last turn's clamped budget when
+      // one has run, else the configured cap.
+      getTurnBudgetMs: () => lastAppliedTurnBudgetMs ?? turnBudgetMs,
+      takeWorkerStderrTail: () => {
+        const tail = lastWorkerStderrTail;
+        lastWorkerStderrTail = null;
+        return tail;
+      },
       prepare: async (proposedInstanceId) => {
         const selected = await openListenerDeliveryJournal({
           profileId: options.cloud.profileId,
@@ -39258,6 +39608,7 @@ async function runListenStart(args) {
     "claude-executable",
     "codex-executable",
     "state-dir",
+    "turn-budget",
     "foreground",
     "json"
   ], 2);
@@ -39268,6 +39619,7 @@ async function runListenStart(args) {
   }
   const provider = listenerProvider(args);
   validateListenerProviderFlags(args, provider);
+  const turnBudgetMs = listenerTurnBudgetMs(args.optional("turn-budget"));
   const cloud = await target(args);
   const workspaceId2 = listenerUuid(
     args.optional("workspace-id") ?? process.env.SWARM_CLOUD_WORKSPACE_ID,
@@ -39302,6 +39654,7 @@ async function runListenStart(args) {
       cwd,
       permissionMode,
       provider,
+      turnBudgetMs,
       ...args.optional("model") ? { model: args.required("model") } : {},
       ...args.optional("effort") ? { effort: args.required("effort") } : {},
       ...args.optional("grok-executable") ? { executable: args.required("grok-executable") } : {},
@@ -39352,6 +39705,7 @@ async function runListenStart(args) {
         ...stateDirectory2 ? { stateDirectory: stateDirectory2 } : {},
         ...args.optional("model") ? { model: args.required("model") } : {},
         ...args.optional("effort") ? { effort: args.required("effort") } : {},
+        ...args.optional("turn-budget") ? { turnBudget: args.required("turn-budget") } : {},
         ...args.optional("grok-executable") ? { executable: args.required("grok-executable") } : {},
         ...opencodeExecutable ? { opencodeExecutable } : {},
         ...claudeExecutable ? { claudeExecutable } : {},
@@ -39409,10 +39763,12 @@ async function runListenSupervisor(args) {
     "opencode-executable",
     "claude-executable",
     "codex-executable",
-    "state-dir"
+    "state-dir",
+    "turn-budget"
   ], 1);
   const provider = listenerProvider(args);
   validateListenerProviderFlags(args, provider);
+  const turnBudgetMs = listenerTurnBudgetMs(args.optional("turn-budget"));
   const cloud = await target(args);
   const workspaceId2 = listenerUuid(args.optional("workspace-id"), "workspace-id");
   const principalId = listenerUuid(args.optional("principal-id"), "principal-id");
@@ -39428,6 +39784,7 @@ async function runListenSupervisor(args) {
     cwd,
     permissionMode: listenerPermissionMode(args.optional("permissions")),
     provider,
+    turnBudgetMs,
     ...args.optional("model") ? { model: args.required("model") } : {},
     ...args.optional("effort") ? { effort: args.required("effort") } : {},
     ...args.optional("grok-executable") ? { executable: args.required("grok-executable") } : {},
@@ -39709,6 +40066,48 @@ async function runFileRestore(args) {
 `
   );
 }
+async function runFeedback(args) {
+  const body = args.positionals[1];
+  if (!body) {
+    throw new UsageError(
+      'cswarm feedback needs the feedback text: cswarm feedback "<text>" --kind bug|idea|friction'
+    );
+  }
+  const kind = args.required("kind");
+  if (kind !== "bug" && kind !== "idea" && kind !== "friction") {
+    throw new UsageError("--kind must be bug, idea, or friction");
+  }
+  const about = args.optional("about");
+  const context = await fileContext(args, ["kind", "about"], 2);
+  const submitted = await submitFeedback({
+    target: context.cloud,
+    workspaceId: context.selected.selectedWorkspace,
+    credential: context.selected.bearer
+  }, {
+    category: kind,
+    body,
+    context: {
+      surface: "cli",
+      cswarm_version: CLI_BUILD_VERSION,
+      platform: process.platform,
+      ...about ? { about } : {}
+    }
+  });
+  if (args.has("json")) {
+    process.stdout.write(`${JSON.stringify(submitted, null, 2)}
+`);
+    return;
+  }
+  if (submitted.duplicate === true) {
+    process.stdout.write(
+      "This matches feedback you sent within the hour, so it was not recorded twice. It is already with the operators of this deployment.\n"
+    );
+    return;
+  }
+  process.stdout.write(
+    "Feedback recorded for the operators of this deployment. It is stored durably with your workspace and identity attached, and it is read when they review feedback - there is no reply channel, so nothing further will happen in this session.\n"
+  );
+}
 async function runFile(args) {
   const action = args.positionals[1];
   if (action === "put") return await runFilePut(args);
@@ -39964,6 +40363,10 @@ async function main() {
     await runStatus(args);
     return;
   }
+  if (verb === "feedback") {
+    await runFeedback(args);
+    return;
+  }
   if (verb === "file") {
     await runFile(args);
     return;
@@ -40089,6 +40492,8 @@ ${usage()}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   EXIT_RESTARTABLE,
+  TURN_BUDGET_CREDENTIAL_MARGIN_MS,
+  clampTurnBudgetToCredential,
   describeAudience,
   listenerFailureMessage,
   listenerHostLimits,
@@ -40096,5 +40501,6 @@ ${usage()}
   listenerStatusJson,
   renderRoster,
   resolveDetachedClaudeExecutable,
-  resolveDetachedCodexExecutable
+  resolveDetachedCodexExecutable,
+  resolveTurnBudgetOrDefer
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commonswarm",
-  "version": "0.1.21",
+  "version": "0.1.22",
   "description": "CommonSwarm CLI — coordination for teams where people and AI agents work side by side.",
   "bin": {
     "cswarm": "cswarm.cjs"