commonswarm 0.1.21 → 0.1.23

package/cswarm.cjs

@@ -13503,14 +13503,18 @@ var require_main3 = __commonJS({
 var cli_exports = {};
 __export(cli_exports, {
   EXIT_RESTARTABLE: () => EXIT_RESTARTABLE,
+  TURN_BUDGET_CREDENTIAL_MARGIN_MS: () => TURN_BUDGET_CREDENTIAL_MARGIN_MS,
+  clampTurnBudgetToCredential: () => clampTurnBudgetToCredential,
   describeAudience: () => describeAudience,
   listenerFailureMessage: () => listenerFailureMessage,
   listenerHostLimits: () => listenerHostLimits,
   listenerPermissionMode: () => listenerPermissionMode,
   listenerStatusJson: () => listenerStatusJson,
   renderRoster: () => renderRoster,
+  replyRefusalHint: () => replyRefusalHint,
   resolveDetachedClaudeExecutable: () => resolveDetachedClaudeExecutable,
-  resolveDetachedCodexExecutable: () => resolveDetachedCodexExecutable
+  resolveDetachedCodexExecutable: () => resolveDetachedCodexExecutable,
+  resolveTurnBudgetOrDefer: () => resolveTurnBudgetOrDefer
 });
 module.exports = __toCommonJS(cli_exports);
 var import_node_crypto19 = require("node:crypto");
@@ -22159,15 +22163,8 @@ function createWorkspaceError(status, body) {
     return new CreateWorkspaceError(
       status,
       code,
-      /* D-067/D-075. This used to end "Archiving a workspace frees its slot; the CLI cannot archive
-       * one yet, so ask whoever operates this deployment." Both halves were dead ends. Archiving
-       * is unreachable from every surface — `archived_at` exists and nothing writes it — and on a
-       * self-serve deployment the reader IS the operator, so it named a person who does not exist
-       * to perform an action that does not exist.
-       *
-       * It now states the limit, does not offer a remedy that is unimplemented, and names the one
-       * route that does work: someone else's invitation, which is not capped. */
-      `${limit === null ? "You have already created as many workspaces as this account allows." : `You have already created ${limit} workspaces, which is the limit for one account.`} Workspaces cannot be removed yet, so this limit is a ceiling rather than a queue. Workspaces you were invited to do not count against it \u2014 a collaborator can still add you to theirs.`
+      /* Closing one live workspace now frees a slot; name the exact confirmed command. */
+      `${limit === null ? "You have already created as many workspaces as this account allows." : `You have already created ${limit} workspaces, which is the limit for one account.`} Close one with cswarm workspace close <full-id|exact-name> --confirm <same-selector>, then try again. Workspaces you were invited to do not count against it.`
     );
   }
   if (status === 403) {
@@ -22794,6 +22791,12 @@ var CONTENT_TYPES = /* @__PURE__ */ new Map([
   [".md", "text/markdown"],
   [".txt", "text/plain"],
   [".csv", "text/csv"],
+  // .html/.htm: a web/marketing team's deliverables (Fastio feedback 2026-08-19). Every
+  // download is served Content-Disposition: attachment (§5), never rendered inline, so HTML
+  // is no more dangerous than the .svg already permitted — the spec treats all downloads as
+  // untrusted attachments the consumer must not execute.
+  [".html", "text/html"],
+  [".htm", "text/html"],
   [".json", "application/json"],
   [".yaml", "application/yaml"],
   [".yml", "application/yaml"],
@@ -23058,6 +23061,67 @@ async function listFilesAsHuman(target2, accessToken, workspaceId2, fetcher = fe
   return body;
 }
 
+// src/cloud/feedback.ts
+var FeedbackTransportError = class extends Error {
+  name = "FeedbackTransportError";
+};
+var FeedbackRefusedError = class extends Error {
+  constructor(code, message) {
+    super(message);
+    this.code = code;
+  }
+  code;
+  name = "FeedbackRefusedError";
+};
+var REQUEST_TIMEOUT_MS2 = 3e4;
+async function submitFeedback(options, request) {
+  const fetcher = options.fetcher ?? fetch;
+  const controller = new AbortController();
+  const timer2 = setTimeout(() => controller.abort(), REQUEST_TIMEOUT_MS2);
+  let response;
+  try {
+    response = await fetcher(commandEndpoint(options.target), {
+      method: "POST",
+      headers: {
+        authorization: `Bearer ${options.credential}`,
+        apikey: options.target.anonKey,
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        command_id: newCommandId(),
+        client_version: "0.1.0",
+        workspace_id: options.workspaceId,
+        stream: { kind: "workspace" },
+        command: {
+          kind: "submit_feedback",
+          feedback_id: crypto.randomUUID(),
+          category: request.category,
+          body: request.body,
+          context: request.context ?? null
+        }
+      }),
+      signal: controller.signal
+    });
+  } catch (error) {
+    if (error.name === "AbortError") {
+      throw new FeedbackTransportError("feedback submission timed out");
+    }
+    throw new FeedbackTransportError("feedback submission failed before a response");
+  } finally {
+    clearTimeout(timer2);
+  }
+  const body = await response.json().catch(() => null);
+  if (!response.ok) {
+    const code = typeof body?.error === "string" ? body.error : "http_error";
+    const message = typeof body?.message === "string" ? body.message : `feedback submission was refused (HTTP ${response.status})`;
+    throw new FeedbackRefusedError(code, message);
+  }
+  if (body === null || typeof body.status !== "string") {
+    throw new FeedbackTransportError("the deployment answered without a readable result");
+  }
+  return body;
+}
+
 // src/cloud/current-target.ts
 var import_node_crypto6 = require("node:crypto");
 var import_promises3 = require("node:fs/promises");
@@ -27666,6 +27730,7 @@ var DEFAULT_MEMBERSHIP_REVOKED = {
   message: "Your previously selected workspace is no longer available to this account. CommonSwarm cleared that saved selection."
 };
 var PROJECT_NOT_AVAILABLE = "That workspace is not available to this account. Run cswarm workspaces to see workspaces you can select.";
+var ARCHIVED_PROJECT_NOT_AVAILABLE = "That workspace is closed and cannot be selected. Run cswarm workspaces to see live workspaces you can select.";
 function compareText(left, right) {
   return left < right ? -1 : left > right ? 1 : 0;
 }
@@ -27703,8 +27768,8 @@ var WorkspaceResolutionError = class extends WorkspaceCliError {
 };
 var WorkspaceUnavailableError = class extends WorkspaceCliError {
   code = "project_not_available";
-  constructor() {
-    super(PROJECT_NOT_AVAILABLE);
+  constructor(message = PROJECT_NOT_AVAILABLE) {
+    super(message);
     this.name = "WorkspaceUnavailableError";
   }
   structured() {
@@ -27808,41 +27873,41 @@ function cloudWorkspaceDirectory(target2, fetcher = fetch) {
           "workspaces",
           {
             select: "workspace_id,name,archived_at",
+            archived_at: "is.null",
             order: "workspace_id.asc"
           },
           fetcher
         )
       ]);
-      const names = /* @__PURE__ */ new Map();
+      const roles = /* @__PURE__ */ new Map();
+      for (const row of membershipRows) {
+        const workspaceId2 = checkedUuid(row.workspace_id, "workspace_id");
+        roles.set(workspaceId2, checkedRole(row.role));
+      }
+      const result = [];
       for (const row of workspaceRows) {
         const workspaceId2 = checkedUuid(row.workspace_id, "workspace_id");
         const archivedAt = checkedNullableTimestamp(
           row.archived_at,
           "archived_at"
         );
-        names.set(workspaceId2, {
+        if (archivedAt !== null) continue;
+        const role = roles.get(workspaceId2);
+        if (!role) {
+          throw new Error(
+            "workspace read omitted the current user's live membership"
+          );
+        }
+        result.push({
+          workspace_id: workspaceId2,
           name: sanitizeDisplayLabel(
             checkedString(row.name, "workspace name"),
             "Unnamed workspace"
           ),
-          archived: archivedAt !== null
+          role,
+          archived: false
         });
       }
-      const result = membershipRows.map((row) => {
-        const workspaceId2 = checkedUuid(row.workspace_id, "workspace_id");
-        const project = names.get(workspaceId2);
-        if (!project) {
-          throw new Error(
-            "workspace read omitted a workspace for a live membership"
-          );
-        }
-        return {
-          workspace_id: workspaceId2,
-          name: project.name,
-          role: checkedRole(row.role),
-          archived: project.archived
-        };
-      });
       return sortWorkspaces(result);
     },
     async status(session, workspaceId2) {
@@ -27897,6 +27962,9 @@ function cloudWorkspaceDirectory(target2, fetcher = fetch) {
           you: userId === session.userId
         };
       });
+      if (!members.some((member) => member.you)) {
+        throw new WorkspaceUnavailableError();
+      }
       const memberNames = new Map(
         members.map((member) => [member.user_id, member.name])
       );
@@ -28022,6 +28090,32 @@ async function clearWorkspaceDefault(store2, userId, expectedWorkspaceId) {
     return true;
   });
 }
+async function updateWorkspaceDefaultAfterClose(store2, userId, closedWorkspaceId, workspaces) {
+  return await store2.withLock(async () => {
+    const current = await store2.readProfile();
+    if (current.userId !== userId || current.workspaceId !== closedWorkspaceId) {
+      return {
+        closedWasSelected: false,
+        nextWorkspace: null,
+        selectedWorkspaceId: current.userId === userId ? current.workspaceId : null
+      };
+    }
+    const nextWorkspace = sortWorkspaces(workspaces).find(
+      (workspace) => workspace.workspace_id !== closedWorkspaceId && !workspace.archived
+    ) ?? null;
+    await store2.writeProfile({
+      ...current,
+      workspaceId: nextWorkspace?.workspace_id ?? null,
+      principalId: null,
+      principalName: null
+    });
+    return {
+      closedWasSelected: true,
+      nextWorkspace,
+      selectedWorkspaceId: nextWorkspace?.workspace_id ?? null
+    };
+  });
+}
 function workspaceOverride(explicit, environmental) {
   if (explicit !== void 0) {
     if (!UUID_RE6.test(explicit)) {
@@ -28080,6 +28174,14 @@ async function resolveWorkspace(options) {
   throw new WorkspaceResolutionError(workspaces);
 }
 async function selectWorkspace(selector, workspaces, store2, userId) {
+  const selected = resolveWorkspaceSelector(selector, workspaces);
+  if (selected.archived) {
+    throw new WorkspaceUnavailableError(ARCHIVED_PROJECT_NOT_AVAILABLE);
+  }
+  await writeWorkspaceDefault(store2, userId, selected.workspace_id);
+  return selected;
+}
+function resolveWorkspaceSelector(selector, workspaces) {
   const sorted = sortWorkspaces(workspaces);
   let selected;
   if (UUID_RE6.test(selector)) {
@@ -28098,7 +28200,6 @@ async function selectWorkspace(selector, workspaces, store2, userId) {
     selected = matches[0];
   }
   if (!selected) throw new WorkspaceUnavailableError();
-  await writeWorkspaceDefault(store2, userId, selected.workspace_id);
   return selected;
 }
 function holderLabel(holder) {
@@ -28117,13 +28218,8 @@ function relativeExpiry(expiry, now = Date.now()) {
   const amount = relativeMagnitude(remaining);
   return remaining >= 0 ? `expires in ${amount}` : `expired ${amount} ago`;
 }
-var ARCHIVE_NOT_ENFORCED_CODE = "workspace_archive_not_enforced";
-var ARCHIVE_NOT_ENFORCED_MESSAGE = "Archiving a workspace does not restrict what members or their agents can do in it: an archived workspace stays selectable, and commands against it still succeed while your membership is live. Removing a workspace from this list means ending your membership, which this CLI cannot do \u2014 ask whoever runs the workspace.";
 function archiveKnownGaps() {
-  return [{
-    code: ARCHIVE_NOT_ENFORCED_CODE,
-    message: ARCHIVE_NOT_ENFORCED_MESSAGE
-  }];
+  return [];
 }
 function renderWorkspaces(workspaces, currentWorkspaceId) {
   if (workspaces.length === 0) {
@@ -28147,9 +28243,6 @@ function renderWorkspaces(workspaces, currentWorkspaceId) {
       "No workspace is selected. Run cswarm use <full-id|exact-name>."
     );
   }
-  if (workspaces.some((workspace) => workspace.archived)) {
-    lines.push(ARCHIVE_NOT_ENFORCED_MESSAGE);
-  }
   return lines.join("\n");
 }
 function renderStatus(options) {
@@ -29373,6 +29466,59 @@ async function runInboxFollow(options) {
 // src/host/opencode.ts
 var import_node_child_process3 = require("node:child_process");
 var import_node_crypto12 = require("node:crypto");
+
+// src/host/stderr-tail.ts
+var RING_CAPACITY_BYTES = 4096;
+var TAIL_MAX_CHARS = 2048;
+var EXOTIC_SEPARATORS = "\\u00a0\\u1680\\u2000-\\u200d\\u2028\\u2029\\u202a-\\u202e\\u2060\\u2066-\\u2069\\u202f\\u205f\\u3000\\ufeff";
+var SEPARATOR_CLASS_SOURCE = "\\t\\n\\x0b\\f\\r " + EXOTIC_SEPARATORS;
+var ANSI_ESCAPE_GLOBAL_RE2 = new RegExp("\\u001b\\[[0-?]*[ -\\/]*[@-~]", "g");
+var CONTROL_AND_SEPARATOR_STRIP_RE = new RegExp(
+  "[\\u0000-\\u0008\\u000b-\\u001f\\u007f-\\u009f" + EXOTIC_SEPARATORS + "]",
+  "g"
+);
+var CREDENTIAL_PREFIX_RE = new RegExp(
+  `swm_(?:agt|inv|cap)_[^${SEPARATOR_CLASS_SOURCE}]*`,
+  "gi"
+);
+function sanitizeStderrTail(raw) {
+  return raw.replace(ANSI_ESCAPE_GLOBAL_RE2, "").replace(CONTROL_AND_SEPARATOR_STRIP_RE, "").replace(CREDENTIAL_PREFIX_RE, "[redacted-credential]").slice(-TAIL_MAX_CHARS).trim();
+}
+function attachStderrTailRing(stderr) {
+  const chunks = [];
+  let total = 0;
+  let evicted = false;
+  stderr.on("data", (chunk) => {
+    const buffer2 = typeof chunk === "string" ? Buffer.from(chunk) : chunk;
+    chunks.push(buffer2);
+    total += buffer2.length;
+    while (total > RING_CAPACITY_BYTES && chunks.length > 0) {
+      evicted = true;
+      const head2 = chunks[0];
+      const excess = total - RING_CAPACITY_BYTES;
+      if (head2.length <= excess) {
+        chunks.shift();
+        total -= head2.length;
+      } else {
+        chunks[0] = head2.subarray(excess);
+        total -= excess;
+      }
+    }
+  });
+  stderr.resume();
+  return {
+    read() {
+      let text = Buffer.concat(chunks).toString("utf8");
+      if (evicted) {
+        const newline = text.indexOf("\n");
+        text = newline === -1 ? "" : text.slice(newline + 1);
+      }
+      return sanitizeStderrTail(text);
+    }
+  };
+}
+
+// src/host/opencode.ts
 var import_node_fs3 = require("node:fs");
 var import_promises4 = require("node:fs/promises");
 var import_node_os4 = require("node:os");
@@ -31027,8 +31173,18 @@ async function openOpenCodeAcpSession(options) {
       await disposeHome();
       throw new AcpHostError("spawn_failed", "child missing stdio pipes");
     }
-    child.stderr.on("data", () => void 0);
-    child.stderr.resume();
+    const stderrTail = attachStderrTailRing(child.stderr);
+    if (options.onStderrTail) {
+      const deliverTail = options.onStderrTail;
+      let tailDelivered = false;
+      const publishTail = () => {
+        if (tailDelivered) return;
+        tailDelivered = true;
+        deliverTail(stderrTail.read());
+      };
+      child.once("exit", publishTail);
+      child.once("close", publishTail);
+    }
     let sessionRef = null;
     const transport = createBoundTransport({
       readable: child.stdout,
@@ -31310,8 +31466,18 @@ async function openClaudeAcpSession(options) {
     await terminateClaudeChild(child);
     throw new AcpHostError("spawn_failed", "child missing stdio pipes");
   }
-  child.stderr.on("data", () => void 0);
-  child.stderr.resume();
+  const stderrTail = attachStderrTailRing(child.stderr);
+  if (options.onStderrTail) {
+    const deliverTail = options.onStderrTail;
+    let tailDelivered = false;
+    const publishTail = () => {
+      if (tailDelivered) return;
+      tailDelivered = true;
+      deliverTail(stderrTail.read());
+    };
+    child.once("exit", publishTail);
+    child.once("close", publishTail);
+  }
   let sessionRef = null;
   const transport = createBoundTransport({
     readable: child.stdout,
@@ -31586,8 +31752,18 @@ async function openCodexAcpSession(options) {
     await terminateCodexChild(child);
     throw new AcpHostError("spawn_failed", "child missing stdio pipes");
   }
-  child.stderr.on("data", () => void 0);
-  child.stderr.resume();
+  const stderrTail = attachStderrTailRing(child.stderr);
+  if (options.onStderrTail) {
+    const deliverTail = options.onStderrTail;
+    let tailDelivered = false;
+    const publishTail = () => {
+      if (tailDelivered) return;
+      tailDelivered = true;
+      deliverTail(stderrTail.read());
+    };
+    child.once("exit", publishTail);
+    child.once("close", publishTail);
+  }
   let sessionRef = null;
   const transport = createBoundTransport({
     readable: child.stdout,
@@ -31637,6 +31813,19 @@ async function openCodexAcpSession(options) {
   }
 }
 
+// src/listener/types.ts
+var LISTENER_PROMPT_TIMEOUT_MS = 6e5;
+var ListenerRenewalUnavailableError = class extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "renewal_unavailable";
+  }
+};
+async function resolveBudgetAndPrompt(session, prompt, budget) {
+  const timeoutMs = typeof budget === "number" ? budget : await budget();
+  return await session.prompt(prompt, { timeoutMs });
+}
+
 // src/listener/engine.ts
 var UUID_RE8 = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 var TERMINAL_STATES = /* @__PURE__ */ new Set(["done", "expired", "failed"]);
@@ -31751,6 +31940,7 @@ function abortError() {
 }
 function defaultRetryablePromptError(error) {
   if (error instanceof SenderProvenanceUnavailableError) return true;
+  if (error instanceof ListenerRenewalUnavailableError) return true;
   if (error instanceof AcpHostError) return TRANSIENT_ACP_CODES.has(error.code);
   return false;
 }
@@ -32517,8 +32707,18 @@ async function openGrokAcpSession(options) {
     child.kill("SIGKILL");
     throw new AcpHostError("spawn_failed", "child missing stdio pipes");
   }
-  child.stderr.on("data", () => void 0);
-  child.stderr.resume();
+  const stderrTail = attachStderrTailRing(child.stderr);
+  if (options.onStderrTail) {
+    const deliverTail = options.onStderrTail;
+    let tailDelivered = false;
+    const publishTail = () => {
+      if (tailDelivered) return;
+      tailDelivered = true;
+      deliverTail(stderrTail.read());
+    };
+    child.once("exit", publishTail);
+    child.once("close", publishTail);
+  }
   let sessionRef = null;
   const transport = createBoundTransport({
     readable: child.stdout,
@@ -32583,8 +32783,9 @@ var GrokListenerModel = class {
   async prompt(_signal, _mode, prompt) {
     if (this.closed) throw new Error("listener model is closed");
     const worker = await this.ensureWorker();
+    const budget = this.options.promptTimeoutMs ?? LISTENER_PROMPT_TIMEOUT_MS;
     try {
-      return await worker.session.prompt(prompt);
+      return await resolveBudgetAndPrompt(worker.session, prompt, budget);
     } catch (error) {
       if (error instanceof AcpChildExitError) {
         try {
@@ -32619,6 +32820,7 @@ var GrokListenerModel = class {
       ...this.options.model ? { model: this.options.model } : {},
       ...this.options.effort ? { effort: this.options.effort } : {},
       ...this.options.env ? { env: this.options.env } : {},
+      ...this.options.onWorkerStderrTail ? { onStderrTail: this.options.onWorkerStderrTail } : {},
       clientName: "cswarm-listener"
     });
     try {
@@ -32735,8 +32937,9 @@ var OpenCodeListenerModel = class {
   async prompt(_signal, _mode, prompt) {
     if (this.closed) throw new Error("listener model is closed");
     const worker = await this.ensureWorker();
+    const budget = this.options.promptTimeoutMs ?? LISTENER_PROMPT_TIMEOUT_MS;
     try {
-      return await worker.session.prompt(prompt);
+      return await resolveBudgetAndPrompt(worker.session, prompt, budget);
     } catch (error) {
       if (error instanceof AcpChildExitError) {
         const home = this.workerHome;
@@ -33026,6 +33229,7 @@ var OpenCodeListenerModel = class {
         ...this.options.model ? { model: this.options.model } : {},
         ...this.options.env ? { env: this.options.env } : {},
         ...this.options.allowMissingAuth === true ? { allowMissingAuth: true } : {},
+        ...this.options.onWorkerStderrTail ? { onStderrTail: this.options.onWorkerStderrTail } : {},
         clientName: "cswarm-listener"
       });
       pending.phase = "opening";
@@ -33150,8 +33354,9 @@ var ClaudeListenerModel = class {
   async prompt(_signal, _mode, prompt) {
     if (this.closed) throw new Error("listener model is closed");
     const worker = await this.ensureWorker();
+    const budget = this.options.promptTimeoutMs ?? LISTENER_PROMPT_TIMEOUT_MS;
     try {
-      return await worker.session.prompt(prompt);
+      return await resolveBudgetAndPrompt(worker.session, prompt, budget);
     } catch (error) {
       if (error instanceof AcpChildExitError) {
         try {
@@ -33233,6 +33438,7 @@ var ClaudeListenerModel = class {
         ...this.options.executable ? { executable: this.options.executable } : {},
         ...this.options.env ? { env: this.options.env } : {},
         signal: controller.signal,
+        ...this.options.onWorkerStderrTail ? { onStderrTail: this.options.onWorkerStderrTail } : {},
         clientName: "cswarm-listener"
       });
       this.openingHandle = handle;
@@ -33316,8 +33522,9 @@ var CodexListenerModel = class {
   async prompt(_signal, _mode, prompt) {
     if (this.closed) throw new Error("listener model is closed");
     const worker = await this.ensureWorker();
+    const budget = this.options.promptTimeoutMs ?? LISTENER_PROMPT_TIMEOUT_MS;
     try {
-      return await worker.session.prompt(prompt);
+      return await resolveBudgetAndPrompt(worker.session, prompt, budget);
     } catch (error) {
       if (error instanceof AcpChildExitError) {
         try {
@@ -33399,6 +33606,7 @@ var CodexListenerModel = class {
         ...this.options.executable ? { executable: this.options.executable } : {},
         ...this.options.env ? { env: this.options.env } : {},
         signal: controller.signal,
+        ...this.options.onWorkerStderrTail ? { onStderrTail: this.options.onWorkerStderrTail } : {},
         clientName: "cswarm-listener"
       });
       this.openingHandle = handle;
@@ -35043,6 +35251,7 @@ var STATUS_ALLOWED_KEYS = /* @__PURE__ */ new Set([
   "stoppedAt",
   "lastSignalId",
   "lastErrorCode",
+  "lastWorkerStderrTail",
   "logPath",
   "deliveryMode",
   "pendingDeliveryCount",
@@ -35097,7 +35306,7 @@ function parseStatus(raw) {
   const nullableUuid2 = (candidate) => candidate === null || typeof candidate === "string" && UUID_RE12.test(candidate);
   const nullableCount = (candidate) => candidate === null || typeof candidate === "number" && Number.isSafeInteger(candidate) && candidate >= 0;
   const nullableTimestamp = (candidate) => candidate === null || typeof candidate === "string" && Number.isFinite(Date.parse(candidate));
-  if (row.version !== 1 || typeof row.instanceId !== "string" || !UUID_RE12.test(row.instanceId) || row.provider !== "grok" && row.provider !== "opencode" && row.provider !== "claude" && row.provider !== "codex" || typeof row.profileId !== "string" || typeof row.workspaceId !== "string" || !UUID_RE12.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE12.test(row.principalId) || !Number.isSafeInteger(row.pid) || row.pid < 1 || typeof row.state !== "string" || !["starting", "ready", "stopping", "stopped", "failed"].includes(row.state) || typeof row.startedAt !== "string" || !Number.isFinite(Date.parse(row.startedAt)) || !(row.readyAt === null || typeof row.readyAt === "string" && Number.isFinite(Date.parse(row.readyAt))) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt)) || !(row.stoppedAt === null || typeof row.stoppedAt === "string" && Number.isFinite(Date.parse(row.stoppedAt))) || !nullableUuid2(row.lastSignalId) || !(row.lastErrorCode === null || typeof row.lastErrorCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorCode)) || typeof row.logPath !== "string" || !(0, import_node_path14.isAbsolute)(row.logPath) || !(row.deliveryMode === void 0 || row.deliveryMode === null || typeof row.deliveryMode === "string" && STATUS_DELIVERY_MODES.has(row.deliveryMode)) || !(row.pendingDeliveryCount === void 0 || nullableCount(row.pendingDeliveryCount)) || !(row.lastTerminalDeliveryFailureCount === void 0 || nullableCount(row.lastTerminalDeliveryFailureCount)) || !(row.lastTerminalDeliveryFailureAt === void 0 || nullableTimestamp(row.lastTerminalDeliveryFailureAt)) || !(row.lastClaimAt === void 0 || nullableTimestamp(row.lastClaimAt)) || !(row.lastAckAt === void 0 || nullableTimestamp(row.lastAckAt))) {
+  if (row.version !== 1 || typeof row.instanceId !== "string" || !UUID_RE12.test(row.instanceId) || row.provider !== "grok" && row.provider !== "opencode" && row.provider !== "claude" && row.provider !== "codex" || typeof row.profileId !== "string" || typeof row.workspaceId !== "string" || !UUID_RE12.test(row.workspaceId) || typeof row.principalId !== "string" || !UUID_RE12.test(row.principalId) || !Number.isSafeInteger(row.pid) || row.pid < 1 || typeof row.state !== "string" || !["starting", "ready", "stopping", "stopped", "failed"].includes(row.state) || typeof row.startedAt !== "string" || !Number.isFinite(Date.parse(row.startedAt)) || !(row.readyAt === null || typeof row.readyAt === "string" && Number.isFinite(Date.parse(row.readyAt))) || typeof row.updatedAt !== "string" || !Number.isFinite(Date.parse(row.updatedAt)) || !(row.stoppedAt === null || typeof row.stoppedAt === "string" && Number.isFinite(Date.parse(row.stoppedAt))) || !nullableUuid2(row.lastSignalId) || !(row.lastErrorCode === null || typeof row.lastErrorCode === "string" && /^[a-z0-9_-]{1,96}$/.test(row.lastErrorCode)) || !(row.lastWorkerStderrTail === void 0 || row.lastWorkerStderrTail === null || typeof row.lastWorkerStderrTail === "string" && row.lastWorkerStderrTail.length > 0 && row.lastWorkerStderrTail.length <= 2048 && !/swm_(?:agt|inv|cap)_/i.test(row.lastWorkerStderrTail)) || typeof row.logPath !== "string" || !(0, import_node_path14.isAbsolute)(row.logPath) || !(row.deliveryMode === void 0 || row.deliveryMode === null || typeof row.deliveryMode === "string" && STATUS_DELIVERY_MODES.has(row.deliveryMode)) || !(row.pendingDeliveryCount === void 0 || nullableCount(row.pendingDeliveryCount)) || !(row.lastTerminalDeliveryFailureCount === void 0 || nullableCount(row.lastTerminalDeliveryFailureCount)) || !(row.lastTerminalDeliveryFailureAt === void 0 || nullableTimestamp(row.lastTerminalDeliveryFailureAt)) || !(row.lastClaimAt === void 0 || nullableTimestamp(row.lastClaimAt)) || !(row.lastAckAt === void 0 || nullableTimestamp(row.lastAckAt))) {
     throw new Error("stored listener status is malformed");
   }
   return {
@@ -35107,7 +35316,8 @@ function parseStatus(raw) {
     lastTerminalDeliveryFailureCount: row.lastTerminalDeliveryFailureCount ?? null,
     lastTerminalDeliveryFailureAt: row.lastTerminalDeliveryFailureAt ?? null,
     lastClaimAt: row.lastClaimAt ?? null,
-    lastAckAt: row.lastAckAt ?? null
+    lastAckAt: row.lastAckAt ?? null,
+    lastWorkerStderrTail: row.lastWorkerStderrTail ?? null
   };
 }
 async function writeListenerStatus(paths, status) {
@@ -35144,7 +35354,12 @@ async function appendListenerEvent(paths, event) {
     // D-051 companion 2: why a listener is down, and why it stopped trying.
     "restart_attempts",
     "restartable",
-    "restarts_exhausted"
+    "restarts_exhausted",
+    // D-090 family: the last lines of a dead worker's stderr, sanitized and
+    // bounded by the supervisor, and the prompt-turn budget behind a timeout.
+    // Local log only — this file never feeds a server payload.
+    "worker_stderr_tail",
+    "turn_budget_ms"
   ]);
   const deliveryModes = /* @__PURE__ */ new Set(["durable_claim", "cursor_fallback"]);
   const deliveryOutcomes = /* @__PURE__ */ new Set([
@@ -35166,7 +35381,16 @@ async function appendListenerEvent(paths, event) {
     if (key2 === "outcome" && !(value === null || typeof value === "string" && deliveryOutcomes.has(value))) {
       throw new Error("listener event outcome is not allowed");
     }
-    if (typeof value === "string" && (value.length > 128 || /swm_(?:agt|inv|cap)_/i.test(value))) {
+    if (key2 === "worker_stderr_tail" && !(typeof value === "string" && value.length > 0 && value.length <= 2048)) {
+      throw new Error("listener event stderr tail is not allowed");
+    }
+    if (key2 === "turn_budget_ms" && !(typeof value === "number" && Number.isSafeInteger(value) && value > 0)) {
+      throw new Error("listener event turn budget is not allowed");
+    }
+    if (typeof value === "string" && // worker_stderr_tail is deliberately exempt from the generic 128-char
+    // cap (its own bound is 2048, above); the secret scan still applies to
+    // every string, the tail included.
+    (key2 !== "worker_stderr_tail" && value.length > 128 || /swm_(?:agt|inv|cap)_/i.test(value))) {
       throw new Error("listener event contains unsafe text");
     }
   }
@@ -35443,6 +35667,23 @@ function safeErrorCode(error) {
   const name = error.name.toLowerCase().replace(/[^a-z0-9_-]+/g, "_");
   return name.slice(0, 96) || "listener_error";
 }
+var TAIL_SERIALIZED_BUDGET_BYTES = 3e3;
+function fitWorkerStderrTailForLog(tail) {
+  let fitted = tail.trim();
+  for (; ; ) {
+    if (fitted.length === 0) return fitted;
+    const serializedBytes = Buffer.byteLength(JSON.stringify(fitted), "utf8");
+    if (fitted.length <= 2048 && serializedBytes <= TAIL_SERIALIZED_BUDGET_BYTES) {
+      return fitted;
+    }
+    const dropChars = Math.max(
+      fitted.length - 2048,
+      Math.ceil((serializedBytes - TAIL_SERIALIZED_BUDGET_BYTES) / 6),
+      1
+    );
+    fitted = fitted.slice(dropChars);
+  }
+}
 async function runListenerSupervisor(options) {
   const now = options.now ?? Date.now;
   const startedAt = iso2(now);
@@ -35464,6 +35705,7 @@ async function runListenerSupervisor(options) {
     stoppedAt: null,
     lastSignalId: null,
     lastErrorCode: null,
+    lastWorkerStderrTail: null,
     deliveryMode: null,
     pendingDeliveryCount: null,
     lastTerminalDeliveryFailureCount: null,
@@ -35518,9 +35760,21 @@ async function runListenerSupervisor(options) {
     instance_id: status.instanceId,
     pid: process.pid
   });
+  const takeWorkerStderrTail = options.takeWorkerStderrTail;
+  const takeTail = () => {
+    if (!takeWorkerStderrTail) return null;
+    const tail = takeWorkerStderrTail();
+    if (typeof tail !== "string") return null;
+    const fitted = fitWorkerStderrTailForLog(tail);
+    return fitted.length > 0 ? fitted : null;
+  };
   const onEvent = (event) => {
     if (event.type === "ready") {
-      transition("ready", { readyAt: event.ts, lastErrorCode: null });
+      transition("ready", {
+        readyAt: event.ts,
+        lastErrorCode: null,
+        lastWorkerStderrTail: null
+      });
       log({ ts: event.ts, event: "listener_ready" });
       return;
     }
@@ -35537,7 +35791,15 @@ async function runListenerSupervisor(options) {
         event: "listener_effect",
         signal_id: event.signalId,
         status: event.status,
-        failure_code: event.failureCode
+        failure_code: event.failureCode,
+        // Code comparison, not message matching (D-053). The budget rides
+        // only the timeout class so a reader can see what bound was hit — and
+        // it is the CLAMPED budget actually in force, not the configured cap.
+        ...(() => {
+          if (event.failureCode !== "acptimeouterror") return {};
+          const budget = options.getTurnBudgetMs?.();
+          return typeof budget === "number" && budget > 0 ? { turn_budget_ms: budget } : {};
+        })()
       });
       return;
     }
@@ -35667,14 +35929,20 @@ async function runListenerSupervisor(options) {
       restarts += 1;
       const delayMs = nextListenerRestartMs(restarts, policy, restartRandom);
       const restartCode = safeErrorCode(stop.error);
+      const restartStderrTail = takeTail();
       log({
         ts: iso2(now),
         event: "listener_restarting",
         attempt: restarts,
         delay_ms: delayMs,
-        failure_code: restartCode
+        failure_code: restartCode,
+        ...restartStderrTail !== null ? { worker_stderr_tail: restartStderrTail } : {}
+      });
+      transition("starting", {
+        readyAt: null,
+        lastErrorCode: restartCode,
+        lastWorkerStderrTail: restartStderrTail
       });
-      transition("starting", { readyAt: null, lastErrorCode: restartCode });
       await restartSleep(delayMs, controller.signal);
       if (controller.signal.aborted) {
         stop = { reason: "cancelled" };
@@ -35685,14 +35953,17 @@ async function runListenerSupervisor(options) {
     if (stop.reason === "cancelled") {
       transition("stopped", {
         stoppedAt,
-        lastErrorCode: null
+        lastErrorCode: null,
+        lastWorkerStderrTail: null
       });
       log({ ts: stoppedAt, event: "listener_stopped" });
     } else {
       const code = stop.reason === "credential" ? "credential_stopped" : safeErrorCode(stop.error);
+      const failedStderrTail = takeTail();
       transition("failed", {
         stoppedAt,
-        lastErrorCode: code
+        lastErrorCode: code,
+        lastWorkerStderrTail: failedStderrTail
       });
       log({
         ts: stoppedAt,
@@ -35700,7 +35971,8 @@ async function runListenerSupervisor(options) {
         failure_code: code,
         restart_attempts: restarts,
         restartable: eligible,
-        restarts_exhausted: exhausted
+        restarts_exhausted: exhausted,
+        ...failedStderrTail !== null ? { worker_stderr_tail: failedStderrTail } : {}
       });
     }
   } catch (error) {
@@ -35708,11 +35980,17 @@ async function runListenerSupervisor(options) {
     const code = safeErrorCode(
       error instanceof Error ? error : new Error(String(error))
     );
-    transition("failed", { stoppedAt, lastErrorCode: code });
+    const failedStderrTail = takeTail();
+    transition("failed", {
+      stoppedAt,
+      lastErrorCode: code,
+      lastWorkerStderrTail: failedStderrTail
+    });
     log({
       ts: stoppedAt,
       event: "listener_failed",
-      failure_code: code
+      failure_code: code,
+      ...failedStderrTail !== null ? { worker_stderr_tail: failedStderrTail } : {}
     });
   } finally {
     await writes.catch(() => void 0);
@@ -36564,7 +36842,8 @@ function buildListenerChildArgs(spec) {
     ...provider === "claude" && claudeExe ? ["--claude-executable", claudeExe] : [],
     ...provider === "codex" && codexExe ? ["--codex-executable", codexExe] : [],
     ...spec.model ? ["--model", spec.model] : [],
-    ...provider === "grok" && spec.effort ? ["--effort", spec.effort] : []
+    ...provider === "grok" && spec.effort ? ["--effort", spec.effort] : [],
+    ...spec.turnBudget ? ["--turn-budget", spec.turnBudget] : []
   ];
 }
 async function spawnDetachedListener(options) {
@@ -36649,6 +36928,7 @@ var KNOWN_FLAGS = /* @__PURE__ */ new Set([
   "to",
   "token-id",
   "ttl-ms",
+  "turn-budget",
   "uid",
   "until",
   "url",
@@ -36682,8 +36962,8 @@ var ACCEPTED_AGENT_CREDENTIAL_MESSAGES = [
   AGENT_CREDENTIAL_MESSAGE_D088
 ];
 function packageVersion() {
-  if ("0.1.21".length > 0) {
-    return "0.1.21";
+  if ("0.1.23".length > 0) {
+    return "0.1.23";
   }
   try {
     const value = JSON.parse(
@@ -36810,7 +37090,8 @@ Usage:
   cswarm file get <name|file-id> [--version <n>] [--out <local-path>] [--force] [--url <url> --anon-key <key>] [--workspace-id <uuid>] [--agent-token-stdin] [--json]
   cswarm file rm <name|file-id> [--url <url> --anon-key <key>] [--workspace-id <uuid>] [--agent-token-stdin] [--json]
   cswarm file restore <name|file-id> [--url <url> --anon-key <key>] [--workspace-id <uuid>] [--agent-token-stdin] [--json]
-  cswarm listen start --agent-token-stdin [--url <url> --anon-key <key>] --workspace-id <uuid> --provider grok|opencode|claude|codex [--cwd <absolute-path>] [--model <model>] [--effort <level>] [--permissions deny|allow] [--grok-executable <path>] [--opencode-executable <path>] [--claude-executable <path>] [--codex-executable <path>] [--foreground] [--json]
+  cswarm feedback "<text>" --kind bug|idea|friction [--about <ref>] [--url <url> --anon-key <key>] [--workspace-id <uuid>] [--agent-token-stdin] [--json]
+  cswarm listen start --agent-token-stdin [--url <url> --anon-key <key>] --workspace-id <uuid> --provider grok|opencode|claude|codex [--cwd <absolute-path>] [--model <model>] [--effort <level>] [--permissions deny|allow] [--grok-executable <path>] [--opencode-executable <path>] [--claude-executable <path>] [--codex-executable <path>] [--turn-budget <duration>] [--foreground] [--json]
   cswarm listen status [--url <url> --anon-key <key>] --workspace-id <uuid> --principal-id <uuid> [--json]
   cswarm listen stop [--url <url> --anon-key <key>] --workspace-id <uuid> --principal-id <uuid> [--json]
   cswarm new "<workspace name>" [--url <url> --anon-key <key>] [--json]
@@ -36820,6 +37101,7 @@ Usage:
   cswarm invite [--url <url> --anon-key <key>] [--workspace-id <uuid>] --email <email>
   cswarm invite revoke [--url <url> --anon-key <key>] [--workspace-id <uuid>] --invitation-id <uuid> [--json]
   cswarm member remove <full-user-id|exact-name> --confirm <same-selector> [--url <url> --anon-key <key>] [--workspace-id <uuid>] [--json]
+  cswarm workspace close <full-id|exact-name> --confirm <same-selector> [--url <url> --anon-key <key>] [--json]
   cswarm accept --link-stdin [--name <name>] [--no-browser] [--json]
   cswarm accept <https://...#invite=...|cswarm://accept/...> [--name <name>] [--no-browser] [--json]  # unsafe: shell history/process list
   cswarm accept --invitation-token-stdin [--url <url> --anon-key <key>]
@@ -36845,15 +37127,33 @@ Credential selection for command/dogfood:
                             members       reads only          -- either form
                             file put, file ls, file get, file rm, file restore
                                           read and command, nothing persisted -- either form
+                            feedback      command only, nothing persisted     -- either form
                             listen start  persists durable state, rotates -- needs expires_at
                             token revoke  names what it revokes           -- needs token_id
+                            workspace close is human-session-only; it never accepts an agent token
+
+Found a bug or missing feature in cswarm itself? cswarm feedback sends it to the
+deployment's operators \u2014 agents are encouraged to report friction they hit.
 
 Signals (intention sharing) accept the same credential selection. Agent mode
 never opens a browser or infers a human's saved workspace. Durations use a whole
 number plus m, h, or d (for example 90m, 24h, or 7d) and are capped at 30d.
 Place -- before signal text that itself begins with -- to stop option parsing.
+Signal text is at most 2000 characters and --about at most 500; a longer body is
+refused locally before any network call, so compose within the limit.
 
-Invite, legacy token accept, principal create/revoke, human token mint/revoke, link, and new require a
+listen start --turn-budget bounds ONE worker prompt turn (default 10m): how long
+the worker may think and use tools on a single message before the turn times out
+and durable delivery retries it. A whole number plus s, m, or h (for example
+90s, 5m, 1h), at least 30s and at most 60m. Each turn is additionally clamped
+to the live credential's remaining lifetime minus 60s, after renewing it when
+due \u2014 a turn never outlives its credential. Right after a rotation the full
+budget is available up to the token TTL minus 60s (about 59m on the default 1h
+TTL); a turn that lands just before a rotation can be clamped to the ~5m
+renewal lead, and if it times out there, durable delivery retries it on the
+fresh credential.
+
+Invite, legacy token accept, principal create/revoke, human token mint/revoke, link, new, and workspace close require a
 stored human login. Agent self-surrender of a token uses --agent-token-stdin and never takes the secret on argv. Invite-link accept signs in when needed, then accepts and
 registers one principal. Invitation links, agent credentials, and capability links
 appear only in fresh success responses.
@@ -37548,6 +37848,53 @@ async function runMember(args) {
 `);
   }
 }
+async function runWorkspace(args) {
+  args.assertShape([...TARGET_FLAGS, "confirm", "json"], 3);
+  if (args.positionals[1] !== "close") {
+    throw new UsageError(
+      `unknown workspace command: ${args.positionals[1] ?? "(missing)"}`
+    );
+  }
+  const selector = args.positionals[2];
+  if (args.required("confirm") !== selector) {
+    throw new Error(
+      "--confirm must exactly repeat the workspace selector; no request was sent"
+    );
+  }
+  const cloud = await target(args);
+  const human = await humanCredential(args, cloud);
+  const directory = cloudWorkspaceDirectory(cloud);
+  const projects = await directory.list(human);
+  const selected = resolveWorkspaceSelector(selector, projects);
+  const response = (await sendConnectWithPending(
+    new ThinCommandClient(cloud),
+    human,
+    selected.workspace_id,
+    { kind: "archive_workspace" }
+  )).response;
+  if (response.status !== "accepted") {
+    throw new Error(
+      `Workspace close was rejected: ${response.reason ?? "domain rejection"}. The workspace is still open.`
+    );
+  }
+  const { closedWasSelected, nextWorkspace, selectedWorkspaceId } = await updateWorkspaceDefaultAfterClose(
+    human.store,
+    human.userId,
+    selected.workspace_id,
+    projects
+  );
+  const message = nextWorkspace ? `Closed workspace ${selected.name} (${selected.workspace_id}). It is hidden for everyone, and ${nextWorkspace.name} (${nextWorkspace.workspace_id}) is now selected.` : closedWasSelected ? `Closed workspace ${selected.name} (${selected.workspace_id}). It is hidden for everyone. No live workspace remains, so the selected workspace was cleared.` : `Closed workspace ${selected.name} (${selected.workspace_id}). It is hidden for everyone. Your selected workspace was not changed.`;
+  const output = {
+    message,
+    status: response.status,
+    workspace_id: selected.workspace_id,
+    selected_workspace_id: selectedWorkspaceId,
+    command_event_ids: response.event_ids
+  };
+  if (args.has("json")) printJson(output);
+  else process.stdout.write(`${message}
+`);
+}
 async function runLegacyAccept(args) {
   const invitationToken = await invitationCredential(args);
   const cloud = await target(args);
@@ -38208,8 +38555,42 @@ function signalDuration(value) {
   }
   return milliseconds;
 }
+function listenerTurnBudgetMs(value) {
+  if (value === void 0) return LISTENER_PROMPT_TIMEOUT_MS;
+  const match = /^([1-9]\d*)(s|m|h)$/.exec(value);
+  if (!match) {
+    throw new Error("--turn-budget must be a duration such as 90s, 5m, or 1h");
+  }
+  const unit = match[2] === "s" ? 1e3 : match[2] === "m" ? 6e4 : 36e5;
+  const milliseconds = Number(match[1]) * unit;
+  if (!Number.isSafeInteger(milliseconds) || milliseconds < 3e4 || milliseconds > 36e5) {
+    throw new Error("--turn-budget must be between 30s and 60m");
+  }
+  return milliseconds;
+}
+var TURN_BUDGET_CREDENTIAL_MARGIN_MS = 6e4;
+function clampTurnBudgetToCredential(budgetMs, credentialExpiresAt, nowMs) {
+  if (credentialExpiresAt === null) return budgetMs;
+  const horizonMs = credentialExpiresAt - nowMs - TURN_BUDGET_CREDENTIAL_MARGIN_MS;
+  return Math.max(1e3, Math.min(budgetMs, horizonMs));
+}
+function resolveTurnBudgetOrDefer(configuredBudgetMs, credentialExpiresAt, nowMs, renewalFailed) {
+  if (renewalFailed) {
+    throw new ListenerRenewalUnavailableError(
+      "the worker credential could not be renewed before this turn; deferring the ask for durable redelivery"
+    );
+  }
+  if (credentialExpiresAt !== null && credentialExpiresAt - nowMs <= TURN_BUDGET_CREDENTIAL_MARGIN_MS) {
+    throw new ListenerRenewalUnavailableError(
+      "the live worker credential is inside its rotation margin and was not renewed; deferring the ask for durable redelivery"
+    );
+  }
+  return clampTurnBudgetToCredential(configuredBudgetMs, credentialExpiresAt, nowMs);
+}
+var SIGNAL_BODY_MAX = 2e3;
+var SIGNAL_ABOUT_MAX = 500;
 function signalText(value, label) {
-  const maximum = label === "body" ? 2e3 : 500;
+  const maximum = label === "body" ? SIGNAL_BODY_MAX : SIGNAL_ABOUT_MAX;
   if (value.length < (label === "body" ? 1 : 0) || value.length > maximum) {
     throw new Error(
       `${label === "body" ? "signal text" : "--about"} must be ${label === "body" ? "1.." : "at most "}${maximum} characters`
@@ -38468,6 +38849,10 @@ Check whether you are about to do the same work.
 `}`
   );
 }
+function replyRefusalHint(error) {
+  if (!(error instanceof CommandHttpError) || error.status !== 403) return null;
+  return "reply was refused (403). The most common cause is that the signal was not addressed to you \u2014 you cannot reply to your own ask; reply to the other party's signal, reach someone directly with cswarm ask --to <agent>, or post a channel-visible cswarm note. If you did receive that signal, the refusal is an authorization one instead: the credential may be revoked or expired, or it may not be a member of this workspace.";
+}
 async function runReply(args) {
   args.assertShape([
     ...TARGET_FLAGS,
@@ -38499,7 +38884,14 @@ async function runReply(args) {
     about: null,
     ...untilMs2 === void 0 ? {} : { until_ms: untilMs2 }
   };
-  const result = await postSignalCommand(cloud, credential, command2);
+  let result;
+  try {
+    result = await postSignalCommand(cloud, credential, command2);
+  } catch (error) {
+    const hint = replyRefusalHint(error);
+    if (hint !== null) throw new Error(hint);
+    throw error;
+  }
   const signal = result.response.signal;
   if (args.has("json")) {
     printJson({
@@ -38990,6 +39382,13 @@ function renderListenerStatus(status) {
     status.lastSignalId ? `Last handled signal: ${status.lastSignalId}.` : "No signal has been handled yet.",
     status.lastErrorCode ? `Last status code: ${status.lastErrorCode}.` : "No listener error is recorded."
   ];
+  if (status.lastWorkerStderrTail) {
+    const tailLines = status.lastWorkerStderrTail.split("\n").filter((line) => line.trim().length > 0);
+    lines.push("Worker stderr (local log only):");
+    for (const line of tailLines.slice(-3)) {
+      lines.push(`  ${line}`);
+    }
+  }
   if (status.deliveryMode === "durable_claim") {
     lines.push("Delivery mode: durable claim and acknowledgement.");
   } else if (status.deliveryMode === "cursor_fallback") {
@@ -39169,22 +39568,58 @@ async function runConfiguredListener(options) {
     principalId: options.principalId,
     ...options.stateDirectory ? { stateDirectory: options.stateDirectory } : {}
   });
+  const turnBudgetMs = options.turnBudgetMs ?? LISTENER_PROMPT_TIMEOUT_MS;
+  let lastAppliedTurnBudgetMs = null;
+  const resolveTurnBudgetMs = async () => {
+    let renewalFailed = false;
+    try {
+      await credentialSession.bearer();
+    } catch {
+      renewalFailed = true;
+    }
+    const applied = resolveTurnBudgetOrDefer(
+      turnBudgetMs,
+      credentialSession.expiry,
+      Date.now(),
+      renewalFailed
+    );
+    lastAppliedTurnBudgetMs = applied;
+    return applied;
+  };
+  let lastWorkerStderrTail = null;
+  let workerStderrGeneration = 0;
+  const newWorkerStderrTailSink = () => {
+    const generation = ++workerStderrGeneration;
+    lastWorkerStderrTail = null;
+    return (tail) => {
+      if (generation !== workerStderrGeneration) return;
+      lastWorkerStderrTail = tail.length > 0 ? tail : null;
+    };
+  };
   const newModel = () => options.provider === "opencode" ? new OpenCodeListenerModel({
     cwd: options.cwd,
     permissionMode: options.permissionMode,
+    promptTimeoutMs: resolveTurnBudgetMs,
+    onWorkerStderrTail: newWorkerStderrTailSink(),
     ...options.model ? { model: options.model } : {},
     ...options.opencodeExecutable ? { executable: options.opencodeExecutable } : options.executable ? { executable: options.executable } : {}
   }) : options.provider === "claude" ? new ClaudeListenerModel({
     cwd: options.cwd,
     permissionMode: options.permissionMode,
+    promptTimeoutMs: resolveTurnBudgetMs,
+    onWorkerStderrTail: newWorkerStderrTailSink(),
     ...options.claudeExecutable ? { executable: options.claudeExecutable } : options.executable ? { executable: options.executable } : {}
   }) : options.provider === "codex" ? new CodexListenerModel({
     cwd: options.cwd,
     permissionMode: options.permissionMode,
+    promptTimeoutMs: resolveTurnBudgetMs,
+    onWorkerStderrTail: newWorkerStderrTailSink(),
     ...options.codexExecutable ? { executable: options.codexExecutable } : options.executable ? { executable: options.executable } : {}
   }) : new GrokListenerModel({
     cwd: options.cwd,
     permissionMode: options.permissionMode,
+    promptTimeoutMs: resolveTurnBudgetMs,
+    onWorkerStderrTail: newWorkerStderrTailSink(),
     ...options.model ? { model: options.model } : {},
     ...options.effort ? { effort: options.effort } : {},
     ...options.executable ? { executable: options.executable } : {}
@@ -39204,6 +39639,14 @@ async function runConfiguredListener(options) {
       principalId: options.principalId,
       provider: options.provider,
       permissionMode: options.permissionMode,
+      // The bound a timeout event reports: the last turn's clamped budget when
+      // one has run, else the configured cap.
+      getTurnBudgetMs: () => lastAppliedTurnBudgetMs ?? turnBudgetMs,
+      takeWorkerStderrTail: () => {
+        const tail = lastWorkerStderrTail;
+        lastWorkerStderrTail = null;
+        return tail;
+      },
       prepare: async (proposedInstanceId) => {
         const selected = await openListenerDeliveryJournal({
           profileId: options.cloud.profileId,
@@ -39258,6 +39701,7 @@ async function runListenStart(args) {
     "claude-executable",
     "codex-executable",
     "state-dir",
+    "turn-budget",
     "foreground",
     "json"
   ], 2);
@@ -39268,6 +39712,7 @@ async function runListenStart(args) {
   }
   const provider = listenerProvider(args);
   validateListenerProviderFlags(args, provider);
+  const turnBudgetMs = listenerTurnBudgetMs(args.optional("turn-budget"));
   const cloud = await target(args);
   const workspaceId2 = listenerUuid(
     args.optional("workspace-id") ?? process.env.SWARM_CLOUD_WORKSPACE_ID,
@@ -39302,6 +39747,7 @@ async function runListenStart(args) {
       cwd,
       permissionMode,
       provider,
+      turnBudgetMs,
       ...args.optional("model") ? { model: args.required("model") } : {},
       ...args.optional("effort") ? { effort: args.required("effort") } : {},
       ...args.optional("grok-executable") ? { executable: args.required("grok-executable") } : {},
@@ -39352,6 +39798,7 @@ async function runListenStart(args) {
         ...stateDirectory2 ? { stateDirectory: stateDirectory2 } : {},
         ...args.optional("model") ? { model: args.required("model") } : {},
         ...args.optional("effort") ? { effort: args.required("effort") } : {},
+        ...args.optional("turn-budget") ? { turnBudget: args.required("turn-budget") } : {},
         ...args.optional("grok-executable") ? { executable: args.required("grok-executable") } : {},
         ...opencodeExecutable ? { opencodeExecutable } : {},
         ...claudeExecutable ? { claudeExecutable } : {},
@@ -39409,10 +39856,12 @@ async function runListenSupervisor(args) {
     "opencode-executable",
     "claude-executable",
     "codex-executable",
-    "state-dir"
+    "state-dir",
+    "turn-budget"
   ], 1);
   const provider = listenerProvider(args);
   validateListenerProviderFlags(args, provider);
+  const turnBudgetMs = listenerTurnBudgetMs(args.optional("turn-budget"));
   const cloud = await target(args);
   const workspaceId2 = listenerUuid(args.optional("workspace-id"), "workspace-id");
   const principalId = listenerUuid(args.optional("principal-id"), "principal-id");
@@ -39428,6 +39877,7 @@ async function runListenSupervisor(args) {
     cwd,
     permissionMode: listenerPermissionMode(args.optional("permissions")),
     provider,
+    turnBudgetMs,
     ...args.optional("model") ? { model: args.required("model") } : {},
     ...args.optional("effort") ? { effort: args.required("effort") } : {},
     ...args.optional("grok-executable") ? { executable: args.required("grok-executable") } : {},
@@ -39709,6 +40159,48 @@ async function runFileRestore(args) {
 `
   );
 }
+async function runFeedback(args) {
+  const body = args.positionals[1];
+  if (!body) {
+    throw new UsageError(
+      'cswarm feedback needs the feedback text: cswarm feedback "<text>" --kind bug|idea|friction'
+    );
+  }
+  const kind = args.required("kind");
+  if (kind !== "bug" && kind !== "idea" && kind !== "friction") {
+    throw new UsageError("--kind must be bug, idea, or friction");
+  }
+  const about = args.optional("about");
+  const context = await fileContext(args, ["kind", "about"], 2);
+  const submitted = await submitFeedback({
+    target: context.cloud,
+    workspaceId: context.selected.selectedWorkspace,
+    credential: context.selected.bearer
+  }, {
+    category: kind,
+    body,
+    context: {
+      surface: "cli",
+      cswarm_version: CLI_BUILD_VERSION,
+      platform: process.platform,
+      ...about ? { about } : {}
+    }
+  });
+  if (args.has("json")) {
+    process.stdout.write(`${JSON.stringify(submitted, null, 2)}
+`);
+    return;
+  }
+  if (submitted.duplicate === true) {
+    process.stdout.write(
+      "This matches feedback you sent within the hour, so it was not recorded twice. It is already with the operators of this deployment.\n"
+    );
+    return;
+  }
+  process.stdout.write(
+    "Feedback recorded for the operators of this deployment. It is stored durably with your workspace and identity attached, and it is read when they review feedback - there is no reply channel, so nothing further will happen in this session.\n"
+  );
+}
 async function runFile(args) {
   const action = args.positionals[1];
   if (action === "put") return await runFilePut(args);
@@ -39956,6 +40448,10 @@ async function main() {
     await runMember(args);
     return;
   }
+  if (verb === "workspace") {
+    await runWorkspace(args);
+    return;
+  }
   if (verb === "target") {
     await runTarget(args);
     return;
@@ -39964,6 +40460,10 @@ async function main() {
     await runStatus(args);
     return;
   }
+  if (verb === "feedback") {
+    await runFeedback(args);
+    return;
+  }
   if (verb === "file") {
     await runFile(args);
     return;
@@ -40089,12 +40589,16 @@ ${usage()}
 // Annotate the CommonJS export names for ESM import in node:
 0 && (module.exports = {
   EXIT_RESTARTABLE,
+  TURN_BUDGET_CREDENTIAL_MARGIN_MS,
+  clampTurnBudgetToCredential,
   describeAudience,
   listenerFailureMessage,
   listenerHostLimits,
   listenerPermissionMode,
   listenerStatusJson,
   renderRoster,
+  replyRefusalHint,
   resolveDetachedClaudeExecutable,
-  resolveDetachedCodexExecutable
+  resolveDetachedCodexExecutable,
+  resolveTurnBudgetOrDefer
 });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commonswarm",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "CommonSwarm CLI — coordination for teams where people and AI agents work side by side.",
   "bin": {
     "cswarm": "cswarm.cjs"