ever-works-node 0.2.4 → 0.2.5

package/cli.js

@@ -5006,6 +5006,41 @@ function resolveExclusiveAgentCredentials(grantedNames, env) {
   return { names: grantedNames.filter((name) => !dropped.has(name)), notes };
 }
 __name(resolveExclusiveAgentCredentials, "resolveExclusiveAgentCredentials");
+var CONVENTIONAL_SUBJECT = /^([a-z]+)(\([^)\n]{1,40}\))?(!)?:\s+(\S.*)$/;
+function classifyFleetChangedPaths(paths) {
+  const list = (paths ?? []).map((path2) => path2.replace(/\\/g, "/").trim()).filter(Boolean);
+  if (list.length === 0) return "none";
+  if (list.every(isDocsPath)) return "docs";
+  if (list.every(isTestPath)) return "test";
+  return "mixed";
+}
+__name(classifyFleetChangedPaths, "classifyFleetChangedPaths");
+function retypeFleetCommitMessage(message, changedPaths) {
+  if (typeof message !== "string" || !message) return message;
+  const newline = message.indexOf("\n");
+  const firstLine = newline === -1 ? message : message.slice(0, newline);
+  const rest = newline === -1 ? "" : message.slice(newline);
+  const parsed = CONVENTIONAL_SUBJECT.exec(firstLine);
+  if (!parsed) return message;
+  const change = classifyFleetChangedPaths(changedPaths);
+  const type = change === "docs" ? "docs" : change === "test" ? "test" : null;
+  if (!type || parsed[1] === type) return message;
+  return `${type}${firstLine.slice(parsed[1].length)}${rest}`;
+}
+__name(retypeFleetCommitMessage, "retypeFleetCommitMessage");
+var DOC_EXTENSIONS = /\.(?:md|mdx|markdown|rst|adoc|txt)$/i;
+var DOC_DIRECTORY = /(?:^|\/)(?:docs?|documentation)\//i;
+var DOC_FILENAMES = /(?:^|\/)(?:readme|changelog|contributing|license|licence|notice|authors|code_of_conduct)(?:\.[a-z]+)?$/i;
+function isDocsPath(path2) {
+  return DOC_EXTENSIONS.test(path2) || DOC_DIRECTORY.test(path2) || DOC_FILENAMES.test(path2);
+}
+__name(isDocsPath, "isDocsPath");
+var TEST_FILE = /(?:^|[./_-])(?:spec|test|tests|e2e)\.[cm]?[jt]sx?$|_test\.(?:go|py|rb)$|(?:^|\/)test_[^/]+\.py$/i;
+var TEST_DIRECTORY = /(?:^|\/)(?:__tests__|__snapshots__|__mocks__|__fixtures__|tests?|e2e|spec|fixtures)\//i;
+function isTestPath(path2) {
+  return TEST_FILE.test(path2) || TEST_DIRECTORY.test(path2) || /\.snap$/i.test(path2);
+}
+__name(isTestPath, "isTestPath");
 var INBOX_MAX_TITLE_CHARS = 300;
 var FLEET_TASK_WORKSPACE_MAX_MOUNTS = 8;
 var FLEET_TASK_WORKSPACE_MOUNT_DIR_PATTERN = /^[A-Za-z0-9](?:[A-Za-z0-9._-]{0,62}[A-Za-z0-9_-])?$/;
@@ -5519,6 +5554,275 @@ function truncateToUtf8Bytes(value, maxBytes) {
   return { value: decoded.replace(/\uFFFD+$/, "").trimEnd(), truncated: true };
 }
 __name(truncateToUtf8Bytes, "truncateToUtf8Bytes");
+var FLEET_JOB_FAILURE_KIND_MODEL_USAGE_LIMIT = "model_usage_limit";
+var FLEET_MODEL_USAGE_LIMIT_FALLBACK_MS = 60 * 60 * 1e3;
+var FLEET_MODEL_USAGE_LIMIT_MIN_MS = 60 * 1e3;
+var FLEET_MODEL_USAGE_LIMIT_MAX_MS = 8 * 24 * 60 * 60 * 1e3;
+var FLEET_MODEL_USAGE_LIMIT_RESET_SLACK_MS = 60 * 1e3;
+var FLEET_MODEL_USAGE_LIMIT_MAX_MESSAGE_LENGTH = 300;
+var LIMIT_SIGNATURES = [
+  { pattern: /\bhit (?:your|the) (?:[\w-]+ )?(?:usage |rate )?limit\b/i, strict: true },
+  {
+    pattern: /\b(?:usage|weekly|daily|session|5[- ]hour|five[- ]hour) limit (?:has been )?(?:reached|exceeded|hit)\b/i,
+    strict: true
+  },
+  { pattern: /\busage[_ ]limit[_ ](?:reached|exceeded)\b/i, strict: true },
+  { pattern: /\brate_limit_error\b/, strict: true },
+  { pattern: /\bexceeded retry limit,? last status:? 429\b/i, strict: true },
+  { pattern: /\b429\b[^\n]{0,40}\btoo many requests\b/i, strict: true },
+  { pattern: /\bAPI Error:? 429\b/i, strict: true },
+  { pattern: /\brate[- ]limit(?:ed)?\b[^\n]{0,20}\b(?:reached|exceeded)\b/i, strict: false },
+  { pattern: /\bout of (?:extra )?usage\b/i, strict: false }
+];
+function detectFleetModelUsageLimit(text, options = {}) {
+  if (typeof text !== "string" || !text.trim()) return null;
+  const strict = options.strict === true;
+  const match = LIMIT_SIGNATURES.find((signature) => (!strict || signature.strict) && signature.pattern.test(text));
+  if (!match) return null;
+  const nowMs = toEpochMs(options.now);
+  const provider = typeof options.provider === "string" && options.provider.trim() ? options.provider.trim() : "claude-code";
+  const resetsAtMs = parseResetInstant(text, nowMs, options.timeZone);
+  const resetsAt = resetsAtMs !== null && resetsAtMs > nowMs ? resetsAtMs : null;
+  return {
+    provider,
+    window: classifyWindow(text),
+    resetsAt: resetsAt === null ? null : new Date(resetsAt).toISOString(),
+    retryAfter: new Date(
+      clampRetryAfterMs(
+        resetsAt === null ? nowMs + FLEET_MODEL_USAGE_LIMIT_FALLBACK_MS : resetsAt + FLEET_MODEL_USAGE_LIMIT_RESET_SLACK_MS,
+        nowMs
+      )
+    ).toISOString(),
+    message: describeLimitSentence(text, match.pattern)
+  };
+}
+__name(detectFleetModelUsageLimit, "detectFleetModelUsageLimit");
+function clampRetryAfterMs(retryAfterMs, nowMs) {
+  const floor = nowMs + FLEET_MODEL_USAGE_LIMIT_MIN_MS;
+  const ceiling = nowMs + FLEET_MODEL_USAGE_LIMIT_MAX_MS;
+  if (!Number.isFinite(retryAfterMs)) return nowMs + FLEET_MODEL_USAGE_LIMIT_FALLBACK_MS;
+  return Math.min(Math.max(retryAfterMs, floor), ceiling);
+}
+__name(clampRetryAfterMs, "clampRetryAfterMs");
+function describeFleetModelProvider(provider) {
+  switch (provider) {
+    case "claude-code":
+      return "Claude Code";
+    case "codex":
+      return "Codex";
+    default:
+      return provider;
+  }
+}
+__name(describeFleetModelProvider, "describeFleetModelProvider");
+function describeFleetModelUsageLimitWindow(window) {
+  switch (window) {
+    case "weekly":
+      return "weekly limit";
+    case "session":
+      return "5-hour limit";
+    case "daily":
+      return "daily limit";
+    case "rate":
+      return "rate limit";
+    default:
+      return "usage limit";
+  }
+}
+__name(describeFleetModelUsageLimitWindow, "describeFleetModelUsageLimitWindow");
+function toEpochMs(value) {
+  if (value instanceof Date) return value.getTime();
+  if (typeof value === "number" && Number.isFinite(value)) return value;
+  return Date.now();
+}
+__name(toEpochMs, "toEpochMs");
+function classifyWindow(text) {
+  if (/\bweekly\b|\bper week\b/i.test(text)) return "weekly";
+  if (/\b(?:5|five)[- ]hour\b|\bsession limit\b/i.test(text)) return "session";
+  if (/\bdaily\b|\bper day\b/i.test(text)) return "daily";
+  if (/\b429\b|rate_limit_error|\brate[- ]limit/i.test(text)) return "rate";
+  return "usage";
+}
+__name(classifyWindow, "classifyWindow");
+function trimSentence(text) {
+  const clean = text.replace(/[\u0000-\u001f\u007f]+/g, " ").replace(/\s+/g, " ").trim();
+  const points = Array.from(clean);
+  return points.length > FLEET_MODEL_USAGE_LIMIT_MAX_MESSAGE_LENGTH ? `${points.slice(0, FLEET_MODEL_USAGE_LIMIT_MAX_MESSAGE_LENGTH - 1).join("").trimEnd()}\u2026` : clean;
+}
+__name(trimSentence, "trimSentence");
+function describeLimitSentence(text, pattern) {
+  const line = text.split(/\r?\n/).find((candidate) => pattern.test(candidate));
+  return trimSentence(line ?? text);
+}
+__name(describeLimitSentence, "describeLimitSentence");
+var MONTHS = {
+  jan: 0,
+  feb: 1,
+  mar: 2,
+  apr: 3,
+  may: 4,
+  jun: 5,
+  jul: 6,
+  aug: 7,
+  sep: 8,
+  sept: 8,
+  oct: 9,
+  nov: 10,
+  dec: 11
+};
+function parseResetInstant(text, nowMs, timeZone) {
+  const epoch = /usage limit reached\|(\d{10,13})\b/i.exec(text);
+  if (epoch) {
+    const value = Number(epoch[1]);
+    return epoch[1].length >= 13 ? value : value * 1e3;
+  }
+  const iso = /\b(?:resets?|reset at|try again at|available again at|until)\s+(?:at\s+)?(\d{4}-\d{2}-\d{2}T\d{2}:\d{2}(?::\d{2}(?:\.\d+)?)?(?:Z|[+-]\d{2}:?\d{2}))/i.exec(
+    text
+  );
+  if (iso) {
+    const value = Date.parse(iso[1]);
+    if (Number.isFinite(value)) return value;
+  }
+  const relative6 = /\b(?:resets?|reset|try again|available again|retry)\s+in\s+((?:\d+\s*(?:d|days?|h|hrs?|hours?|m|mins?|minutes?|s|secs?|seconds?)\b(?:[\s,]+(?:and )?)?)+)/i.exec(
+    text
+  );
+  if (relative6) {
+    const ms = parseDuration(relative6[1]);
+    if (ms > 0) return nowMs + ms;
+  }
+  const wall = /\b(?:resets?|reset at|will reset at|try again at|available again at)\s+(?:at\s+|on\s+)?(?:(jan|feb|mar|apr|may|jun|jul|aug|sept?|oct|nov|dec)[a-z]*\.?\s+(\d{1,2})(?:st|nd|rd|th)?,?\s+(?:at\s+)?)?(\d{1,2})(?::(\d{2}))?\s*(am|pm)?\b(?:\s*\(([A-Za-z_]+(?:\/[A-Za-z0-9_+-]+){0,2}|UTC|GMT)\))?/i.exec(
+    text
+  );
+  if (wall) {
+    const [, monthName, dayText, hourText, minuteText, meridiem, zoneText] = wall;
+    let hour = Number(hourText);
+    const minute = minuteText ? Number(minuteText) : 0;
+    if (!meridiem && !minuteText && !monthName) {
+      return null;
+    }
+    if (meridiem) {
+      if (hour < 1 || hour > 12) return null;
+      hour = hour % 12 + (meridiem.toLowerCase() === "pm" ? 12 : 0);
+    }
+    if (hour > 23 || minute > 59) return null;
+    const zone = resolveZone(zoneText) ?? resolveZone(timeZone) ?? "UTC";
+    const today = zonedParts(nowMs, zone);
+    if (monthName) {
+      const month = MONTHS[monthName.toLowerCase()];
+      const day = Number(dayText);
+      if (month === void 0 || day < 1 || day > 31) return null;
+      let candidate2 = zonedWallTimeToUtc(today.year, month, day, hour, minute, zone);
+      if (candidate2 < nowMs - 24 * 60 * 60 * 1e3) {
+        candidate2 = zonedWallTimeToUtc(today.year + 1, month, day, hour, minute, zone);
+      }
+      return candidate2;
+    }
+    let candidate = zonedWallTimeToUtc(today.year, today.month, today.day, hour, minute, zone);
+    if (candidate <= nowMs) {
+      candidate = zonedWallTimeToUtc(today.year, today.month, today.day + 1, hour, minute, zone);
+    }
+    return candidate;
+  }
+  return null;
+}
+__name(parseResetInstant, "parseResetInstant");
+function parseDuration(text) {
+  let total = 0;
+  let index = 0;
+  const length = Math.min(text.length, 200);
+  while (index < length) {
+    if (!isDigit(text.charCodeAt(index))) {
+      index += 1;
+      continue;
+    }
+    let value = 0;
+    while (index < length && isDigit(text.charCodeAt(index))) {
+      value = Math.min(value * 10 + (text.charCodeAt(index) - 48), 1e6);
+      index += 1;
+    }
+    while (index < length && text[index] === " ") index += 1;
+    let word = "";
+    while (index < length && /[a-z]/i.test(text[index])) {
+      word += text[index].toLowerCase();
+      index += 1;
+    }
+    const unitMs = DURATION_UNITS[word];
+    if (unitMs !== void 0) total += value * unitMs;
+  }
+  return total;
+}
+__name(parseDuration, "parseDuration");
+var DURATION_UNITS = {
+  d: 864e5,
+  day: 864e5,
+  days: 864e5,
+  h: 36e5,
+  hr: 36e5,
+  hrs: 36e5,
+  hour: 36e5,
+  hours: 36e5,
+  m: 6e4,
+  min: 6e4,
+  mins: 6e4,
+  minute: 6e4,
+  minutes: 6e4,
+  s: 1e3,
+  sec: 1e3,
+  secs: 1e3,
+  second: 1e3,
+  seconds: 1e3
+};
+function isDigit(code) {
+  return code >= 48 && code <= 57;
+}
+__name(isDigit, "isDigit");
+function resolveZone(zone) {
+  if (typeof zone !== "string" || !zone.trim()) return null;
+  const candidate = zone.trim();
+  try {
+    new Intl.DateTimeFormat("en-US", { timeZone: candidate });
+    return candidate;
+  } catch {
+    return null;
+  }
+}
+__name(resolveZone, "resolveZone");
+function zonedParts(instantMs, zone) {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone: zone,
+    hourCycle: "h23",
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    second: "2-digit"
+  }).formatToParts(new Date(instantMs));
+  const get = /* @__PURE__ */ __name((type) => Number(parts.find((part) => part.type === type)?.value ?? 0), "get");
+  return {
+    year: get("year"),
+    month: get("month") - 1,
+    day: get("day"),
+    hour: get("hour") % 24,
+    minute: get("minute"),
+    second: get("second")
+  };
+}
+__name(zonedParts, "zonedParts");
+function zoneOffsetMs(instantMs, zone) {
+  const whole = Math.floor(instantMs / 1e3) * 1e3;
+  const p = zonedParts(whole, zone);
+  return Date.UTC(p.year, p.month, p.day, p.hour, p.minute, p.second) - whole;
+}
+__name(zoneOffsetMs, "zoneOffsetMs");
+function zonedWallTimeToUtc(year, month, day, hour, minute, zone) {
+  const asIfUtc = Date.UTC(year, month, day, hour, minute, 0);
+  const firstOffset = zoneOffsetMs(asIfUtc, zone);
+  const guess = asIfUtc - firstOffset;
+  const secondOffset = zoneOffsetMs(guess, zone);
+  return secondOffset === firstOffset ? guess : asIfUtc - secondOffset;
+}
+__name(zonedWallTimeToUtc, "zonedWallTimeToUtc");
 var FLEET_ENROLLABLE_NODE_KINDS = ["desktop-node", "node"];
 function isFleetEnrollableNodeKind(value) {
   return typeof value === "string" && FLEET_ENROLLABLE_NODE_KINDS.includes(value);
@@ -6124,6 +6428,8 @@ var EVER_STATS_KEY_ID_HEADER = CONSTANTS.stats_headers.key_id;
 var EVER_STATS_SIGNATURE_PREFIX = CONSTANTS.stats_signature_prefix;
 var EVER_STATS_MAX_BODY_BYTES = CONSTANTS.stats.max_bytes;
 var DOMAIN_EVENT_CATALOG = [
+  // EW-P2-6 — `org:write` (and the app) create Organizations.
+  { type: "organization.created", domain: "organization", aggregateType: "organization", phase: "P2" },
   { type: "organization.updated", domain: "organization", aggregateType: "organization", phase: "P1" },
   {
     type: "organization.member.added",
@@ -6170,10 +6476,10 @@ var DOMAIN_EVENT_CATALOG = [
   { type: "mission.updated", domain: "missions", aggregateType: "mission", phase: "P2" },
   { type: "mission.status_changed", domain: "missions", aggregateType: "mission", phase: "P2" },
   { type: "mission.deleted", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.goal.linked", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.goal.unlinked", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.work.linked", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.work.unlinked", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.goal.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.goal.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.work.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
+  { type: "mission.work.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
   { type: "goal.created", domain: "goals", aggregateType: "goal", phase: "P2" },
   { type: "goal.updated", domain: "goals", aggregateType: "goal", phase: "P2" },
   { type: "goal.status_changed", domain: "goals", aggregateType: "goal", phase: "P2" },
@@ -6230,6 +6536,11 @@ var DOMAIN_EVENT_TYPES = DOMAIN_EVENT_CATALOG.map((entry) => entry.type);
 var CATALOG_BY_TYPE = new Map(
   DOMAIN_EVENT_CATALOG.map((entry) => [entry.type, entry])
 );
+var RECIPIENT_SCOPED_EVENT_DOMAINS = {
+  inbox: "inbox:read",
+  email: "email:read"
+};
+var RECIPIENT_EVENT_SCOPES = Object.values(RECIPIENT_SCOPED_EVENT_DOMAINS);
 var INTEGRATION_SCOPES = [
   "org:read",
   "org:write",
@@ -8689,6 +9000,7 @@ __name(measureWorkspaceFreeBytes, "measureWorkspaceFreeBytes");
 
 // src/core/worker-loop.ts
 var DEFAULT_IDLE_POLL_MS = 5e3;
+var MODEL_THROTTLE_SYNC_GRACE_MS = 12e4;
 var WORKER_BACKOFF_BASE_MS = 1e3;
 var WORKER_BACKOFF_MAX_MS = 6e4;
 var MIN_KEEPALIVE_MS = 5e3;
@@ -8787,6 +9099,8 @@ var WorkerLoop = class {
   monotonicNow;
   leasePollDrainTimeoutMs;
   publishFenceMarginMs;
+  /** Fleet usage limits: provider → the throttle in force (expiry checked on read). */
+  modelThrottles = /* @__PURE__ */ new Map();
   running = false;
   stopping = false;
   paused = false;
@@ -8846,7 +9160,118 @@ var WorkerLoop = class {
     return [...this.executors.keys()];
   }
   getState() {
-    return { ...this.state, activeJobIds: [...this.state.activeJobIds] };
+    const modelThrottles = this.activeModelThrottles();
+    return {
+      ...this.state,
+      activeJobIds: [...this.state.activeJobIds],
+      ...modelThrottles.length > 0 ? { modelThrottles } : {}
+    };
+  }
+  /**
+   * Fleet usage limits — record that `limit.provider` is out of quota on this
+   * machine until `limit.retryAfter`. From the next poll the loop leases no
+   * `agent-task` for that CLI (all of `agent-task` when every CLI this node
+   * has is out), and refuses — without starting it — any such job the
+   * platform still hands it. Other job kinds keep leasing. A later reset
+   * replaces an earlier one; an earlier one never shortens a later one.
+   */
+  noteModelUsageLimit(limit) {
+    const provider = typeof limit.provider === "string" ? limit.provider.trim() : "";
+    const until = Date.parse(limit.retryAfter);
+    if (!provider || !Number.isFinite(until) || until <= this.now()) return;
+    const previous = this.modelThrottles.get(provider);
+    if (previous && previous.until >= until) return;
+    this.modelThrottles.set(provider, { until, window: limit.window, reason: limit.message, setAt: this.now() });
+    if (!previous || previous.until <= this.now()) {
+      this.options.logger?.warn(
+        `${describeFleetModelProvider(provider)} hit its ${describeFleetModelUsageLimitWindow(limit.window)} on this node \u2014 not leasing ${provider} agent-task jobs until ${new Date(until).toISOString()} (other work still runs)`
+      );
+    }
+    this.patch({});
+  }
+  /**
+   * Fleet usage limits — reconcile with the platform's view of this node's
+   * throttles, as carried on every heartbeat response (`node.modelThrottles`).
+   *
+   * The platform is authoritative both ways:
+   *  - a throttle it holds that this loop does not (a restarted daemon, a
+   *    limit another path recorded) is ADOPTED, so the node stops offering
+   *    itself for that CLI and says so on its next beat;
+   *  - a throttle this loop holds that the platform no longer does — the
+   *    owner pressed "clear limit now" — is LIFTED, but only once it is older
+   *    than `graceMs`: a heartbeat answered just before the platform recorded
+   *    the limit this node just reported must not undo it.
+   * `null` / absent (an API older than the field) changes nothing.
+   */
+  syncModelThrottles(server, graceMs = MODEL_THROTTLE_SYNC_GRACE_MS) {
+    if (!Array.isArray(server)) return;
+    const now = this.now();
+    const held = /* @__PURE__ */ new Set();
+    let changed = false;
+    for (const entry of server) {
+      const provider = typeof entry?.provider === "string" ? entry.provider.trim() : "";
+      const until = typeof entry?.until === "string" ? Date.parse(entry.until) : Number.NaN;
+      if (!provider || !Number.isFinite(until) || until <= now) continue;
+      held.add(provider);
+      const local = this.modelThrottles.get(provider);
+      if (local && local.until >= until) continue;
+      const window = typeof entry.window === "string" ? entry.window : "usage";
+      const reason = typeof entry.reason === "string" ? entry.reason : `${provider} usage limit reached`;
+      this.modelThrottles.set(provider, { until, window, reason, setAt: local?.setAt ?? now });
+      changed = true;
+      if (!local) {
+        this.options.logger?.info(
+          `${describeFleetModelProvider(provider)} is out of quota on this node per the platform \u2014 not leasing ${provider} agent-task jobs until ${new Date(until).toISOString()}`
+        );
+      }
+    }
+    for (const [provider, local] of this.modelThrottles) {
+      if (held.has(provider) || now - local.setAt < graceMs) continue;
+      this.modelThrottles.delete(provider);
+      changed = true;
+      this.options.logger?.info(
+        `${describeFleetModelProvider(provider)} usage limit was cleared on the platform \u2014 leasing ${provider} agent-task jobs again`
+      );
+    }
+    if (changed) {
+      this.patch({});
+      this.pollSoon();
+    }
+  }
+  /** The usage-limit throttles still in force; expired ones are dropped (and logged) here. */
+  activeModelThrottles() {
+    const now = this.now();
+    const active = [];
+    for (const [provider, throttle] of this.modelThrottles) {
+      if (throttle.until <= now) {
+        this.modelThrottles.delete(provider);
+        this.options.logger?.info(
+          `${describeFleetModelProvider(provider)} usage limit has reset \u2014 leasing ${provider} agent-task jobs again`
+        );
+        continue;
+      }
+      active.push({
+        provider,
+        window: throttle.window,
+        until: new Date(throttle.until).toISOString(),
+        reason: throttle.reason
+      });
+    }
+    return active.sort((a, b) => a.provider.localeCompare(b.provider));
+  }
+  /** True when every model CLI this node can run an agent-task with is out of quota. */
+  allAgentCliThrottled() {
+    const active = this.activeModelThrottles();
+    if (active.length === 0) return false;
+    let providers = [];
+    try {
+      providers = this.options.modelProviders?.() ?? [];
+    } catch {
+      providers = [];
+    }
+    if (providers.length === 0) return true;
+    const out = new Set(active.map((throttle) => throttle.provider));
+    return providers.every((provider) => out.has(provider));
   }
   onChange(listener) {
     this.listeners.add(listener);
@@ -9124,8 +9549,10 @@ var WorkerLoop = class {
       };
       if (this.options.capabilities) request.capabilities = this.options.capabilities;
       if (this.options.kinds && this.options.kinds.length > 0) request.kinds = [...this.options.kinds];
-      if (this.options.excludeKinds && this.options.excludeKinds.length > 0) {
-        request.excludeKinds = [...this.options.excludeKinds];
+      const excludeKinds = new Set(this.options.excludeKinds ?? []);
+      if (this.allAgentCliThrottled()) excludeKinds.add("agent-task");
+      if (excludeKinds.size > 0) {
+        request.excludeKinds = [...excludeKinds];
       }
       if (this.options.client.leaseOutcome) {
         const outcome = await this.options.client.leaseOutcome(request, pollController.signal);
@@ -9362,6 +9789,14 @@ var WorkerLoop = class {
       );
       return;
     }
+    const throttled = this.throttledResultFor(job);
+    if (throttled) {
+      this.options.logger?.info(
+        `Fleet job ${job.id} not started: ${String(throttled.failureReason)} \u2014 handed back for the platform to park`
+      );
+      await this.report(job.id, { success: true, result: throttled }, generation, run);
+      return;
+    }
     const keepAlive = this.startKeepAlive(run);
     let successAccepted = false;
     try {
@@ -9370,6 +9805,7 @@ var WorkerLoop = class {
       );
       const result = await executor(job, signal, keepAlive.handle);
       throwIfJobAborted(signal);
+      this.noteUsageLimitResult(result);
       if (this.settleDeferred(job.id, keepAlive.deferral())) return;
       const accepted = await this.report(
         job.id,
@@ -9404,6 +9840,57 @@ var WorkerLoop = class {
       keepAlive.stop();
     }
   }
+  /** A result that says its CLI hit a usage limit throttles that CLI here. */
+  noteUsageLimitResult(result) {
+    if (!result || result.failureKind !== FLEET_JOB_FAILURE_KIND_MODEL_USAGE_LIMIT) return;
+    const limit = result.modelUsageLimit;
+    if (!limit || typeof limit.provider !== "string" || typeof limit.retryAfter !== "string") return;
+    this.noteModelUsageLimit({
+      provider: limit.provider,
+      window: limit.window ?? "usage",
+      retryAfter: limit.retryAfter,
+      message: typeof limit.message === "string" ? limit.message : `${limit.provider} usage limit reached`
+    });
+  }
+  /**
+   * The usage-limit outcome for an `agent-task` whose CLI is out of quota on
+   * this node, or null. Shaped like a real run's result (model block
+   * included) so the platform — current or older — reads it the same way.
+   */
+  throttledResultFor(job) {
+    if (job.kind !== "agent-task") return null;
+    const payload = job.payload ?? {};
+    const execution = payload.execution;
+    const provider = typeof execution?.provider === "string" ? execution.provider : null;
+    if (!provider) return null;
+    const throttle = this.activeModelThrottles().find((entry) => entry.provider === provider);
+    if (!throttle) return null;
+    const failureReason = `${provider} is out of quota on this node until ${throttle.until} (${describeFleetModelUsageLimitWindow(throttle.window)}) \u2014 not started`;
+    return {
+      status: "failed",
+      taskId: typeof payload.taskId === "string" ? payload.taskId : "",
+      runId: typeof payload.runId === "string" ? payload.runId : null,
+      workspace: null,
+      steps: [],
+      model: {
+        provider,
+        status: "failed",
+        exitCode: null,
+        durationMs: 0,
+        summary: throttle.reason
+      },
+      gateStatus: "none",
+      failureReason,
+      failureKind: FLEET_JOB_FAILURE_KIND_MODEL_USAGE_LIMIT,
+      modelUsageLimit: {
+        provider,
+        window: throttle.window,
+        resetsAt: null,
+        retryAfter: throttle.until,
+        message: throttle.reason
+      }
+    };
+  }
   /**
    * Record a job the executor handed back UNSETTLED, and report nothing.
    *
@@ -10994,6 +11481,32 @@ __name(isReportableBytes, "isReportableBytes");
 // src/core/worker-health.ts
 function describeWorkerHealth(state) {
   if (!state) return null;
+  const projected = projectWorkerState(state);
+  const usage = describeModelThrottles(state);
+  if (!usage) return projected;
+  switch (projected.workerState) {
+    case "idle":
+      return health("throttled", usage);
+    case "throttled":
+    case "working":
+      return health(
+        projected.workerState,
+        projected.workerStateReason ? `${projected.workerStateReason}; ${usage}` : usage
+      );
+    default:
+      return projected;
+  }
+}
+__name(describeWorkerHealth, "describeWorkerHealth");
+function describeModelThrottles(state) {
+  const throttles = state.modelThrottles ?? [];
+  if (throttles.length === 0) return null;
+  return throttles.map(
+    (throttle) => `${throttle.provider}: ${describeFleetModelUsageLimitWindow(throttle.window)} until ${throttle.until}`
+  ).join("; ");
+}
+__name(describeModelThrottles, "describeModelThrottles");
+function projectWorkerState(state) {
   switch (state.state) {
     // The fail-closed stop. `lastError` carries the quarantine's own
     // message (`markUnsafe` writes it there), which is the single most
@@ -11023,7 +11536,7 @@ function describeWorkerHealth(state) {
       return health("idle", null);
   }
 }
-__name(describeWorkerHealth, "describeWorkerHealth");
+__name(projectWorkerState, "projectWorkerState");
 function health(workerState, reason) {
   const trimmed = typeof reason === "string" ? reason.trim() : "";
   if (!trimmed) {
@@ -12983,6 +13496,31 @@ async function runResolvedAgentTask(context, io, signal) {
     containment = modelStep.containment;
     throwIfAgentTaskAborted(signal);
     if (model.status !== "succeeded") {
+      const usageLimit = recognizeModelUsageLimit(model, io);
+      if (usageLimit) {
+        if (workspaceResolution.descriptor && io.removeRunEnvFiles) {
+          await io.removeRunEnvFiles(taskId, workspaceResolution.descriptor).catch(() => void 0);
+        }
+        io.logger?.warn(
+          `[fleet-node] job ${job.id}: ${model.provider} hit a usage limit (${usageLimit.window}) \u2014 retry after ${usageLimit.retryAfter}; steps, checks and publish skipped`
+        );
+        return fitNodeOutcomeToResultBudget({
+          status: "failed",
+          taskId,
+          runId,
+          workspace: workspaceResolution.descriptor,
+          steps: [],
+          ...setupResults.length > 0 ? { setup: setupResults } : {},
+          ...setup.length > 0 ? { setupStatus } : {},
+          model,
+          gateStatus: "none",
+          ...mcp ? { mcp } : {},
+          ...containment ? { containment } : {},
+          failureReason: `${describeModelFailure(model)} \u2014 usage limit, retry after ${usageLimit.retryAfter}`,
+          failureKind: FLEET_JOB_FAILURE_KIND_MODEL_USAGE_LIMIT,
+          modelUsageLimit: usageLimit
+        });
+      }
       failures.push(describeModelFailure(model));
     }
   }
@@ -13688,6 +14226,22 @@ function resumeNeverOpened(model) {
   return RESUME_NEVER_OPENED_SIGNATURES.some((signature) => signature.test(said));
 }
 __name(resumeNeverOpened, "resumeNeverOpened");
+function recognizeModelUsageLimit(model, io = {}) {
+  if (model.status === "succeeded" || model.status === "timeout") return null;
+  const now = io.usageLimitClock?.now() ?? Date.now();
+  const timeZone = io.usageLimitClock?.timeZone ?? localTimeZone();
+  const options = { provider: model.provider, now, ...timeZone ? { timeZone } : {} };
+  return detectFleetModelUsageLimit(model.summary, options) ?? detectFleetModelUsageLimit(model.outputTail, { ...options, strict: true });
+}
+__name(recognizeModelUsageLimit, "recognizeModelUsageLimit");
+function localTimeZone() {
+  try {
+    return Intl.DateTimeFormat().resolvedOptions().timeZone || void 0;
+  } catch {
+    return void 0;
+  }
+}
+__name(localTimeZone, "localTimeZone");
 function describeModelFailure(model) {
   switch (model.status) {
     case "timeout":
@@ -15995,6 +16549,8 @@ Object.freeze(
   ACTION_CATEGORIES2.filter((c) => c !== "read.internal")
 );
 var DOMAIN_EVENT_CATALOG2 = [
+  // EW-P2-6 — `org:write` (and the app) create Organizations.
+  { type: "organization.created", domain: "organization", aggregateType: "organization", phase: "P2" },
   { type: "organization.updated", domain: "organization", aggregateType: "organization", phase: "P1" },
   {
     type: "organization.member.added",
@@ -16041,10 +16597,10 @@ var DOMAIN_EVENT_CATALOG2 = [
   { type: "mission.updated", domain: "missions", aggregateType: "mission", phase: "P2" },
   { type: "mission.status_changed", domain: "missions", aggregateType: "mission", phase: "P2" },
   { type: "mission.deleted", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.goal.linked", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.goal.unlinked", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.work.linked", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.work.unlinked", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.goal.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.goal.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.work.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
+  { type: "mission.work.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
   { type: "goal.created", domain: "goals", aggregateType: "goal", phase: "P2" },
   { type: "goal.updated", domain: "goals", aggregateType: "goal", phase: "P2" },
   { type: "goal.status_changed", domain: "goals", aggregateType: "goal", phase: "P2" },
@@ -16591,6 +17147,7 @@ var LocalWorkspacePlugin = class _LocalWorkspacePlugin {
     );
     const dirty = status.stdout.trim().length > 0;
     if (dirty) {
+      const commitMessage = rewriteCommitMessage(opts, status.stdout);
       const identity = opts.identity;
       await this.gitOrThrow(
         [
@@ -16602,7 +17159,7 @@ var LocalWorkspacePlugin = class _LocalWorkspacePlugin {
           ...opts.hardenRepoHooks ? ["--no-verify"] : [],
           ...identity ? [`--author=${identity.authorName} <${identity.authorEmail}>`] : [],
           "-m",
-          opts.commitMessage
+          commitMessage
         ],
         dir,
         opts.auth,
@@ -17845,6 +18402,31 @@ function isSafeCloneArgument(url) {
   return !parsed.hostname.startsWith("-");
 }
 __name(isSafeCloneArgument, "isSafeCloneArgument");
+function parsePorcelainPaths(stdout) {
+  const paths = [];
+  for (const line of stdout.split(/\r?\n/)) {
+    if (line.length < 4) continue;
+    let path2 = line.slice(3);
+    const arrow = path2.lastIndexOf(" -> ");
+    if (arrow !== -1) path2 = path2.slice(arrow + 4);
+    if (path2.startsWith('"') && path2.endsWith('"') && path2.length >= 2) {
+      path2 = path2.slice(1, -1).replace(/\\(.)/g, "$1");
+    }
+    if (path2) paths.push(path2);
+  }
+  return paths;
+}
+__name(parsePorcelainPaths, "parsePorcelainPaths");
+function rewriteCommitMessage(opts, porcelain) {
+  if (typeof opts.commitMessageFor !== "function") return opts.commitMessage;
+  try {
+    const next = opts.commitMessageFor(parsePorcelainPaths(porcelain), opts.commitMessage);
+    return typeof next === "string" && next.trim() && !/[\0\r]/.test(next) ? next : opts.commitMessage;
+  } catch {
+    return opts.commitMessage;
+  }
+}
+__name(rewriteCommitMessage, "rewriteCommitMessage");
 
 // src/core/workspaces/push-credential.ts
 var PUSH_CREDENTIAL_REVOKE_TIMEOUT_MS = 5e3;
@@ -18763,6 +19345,11 @@ var FleetTaskWorkspaceProvisioner = class {
           // pool config. The credentialed push already does this; the flag
           // extends it to the commit.
           hardenRepoHooks: true,
+          // Fleet commit messages: once the change is staged, a
+          // docs-only change commits as `docs`, a tests-only one as
+          // `test`, whatever the Task title implied. Only the type token
+          // of the subject changes; the body and trailers are untouched.
+          commitMessageFor: /* @__PURE__ */ __name((changedPaths, message) => retypeFleetCommitMessage(message, changedPaths), "commitMessageFor"),
           ...signal ? { signal } : {},
           ...opts.publishFence ? { publishFence: opts.publishFence } : {},
           ...authorization.identity ? { identity: authorization.identity } : {},
@@ -20313,6 +20900,8 @@ Object.freeze(
   ACTION_CATEGORIES3.filter((c) => c !== "read.internal")
 );
 var DOMAIN_EVENT_CATALOG3 = [
+  // EW-P2-6 — `org:write` (and the app) create Organizations.
+  { type: "organization.created", domain: "organization", aggregateType: "organization", phase: "P2" },
   { type: "organization.updated", domain: "organization", aggregateType: "organization", phase: "P1" },
   {
     type: "organization.member.added",
@@ -20359,10 +20948,10 @@ var DOMAIN_EVENT_CATALOG3 = [
   { type: "mission.updated", domain: "missions", aggregateType: "mission", phase: "P2" },
   { type: "mission.status_changed", domain: "missions", aggregateType: "mission", phase: "P2" },
   { type: "mission.deleted", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.goal.linked", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.goal.unlinked", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.work.linked", domain: "missions", aggregateType: "mission", phase: "P2" },
-  { type: "mission.work.unlinked", domain: "missions", aggregateType: "mission", phase: "P2" },
+  { type: "mission.goal.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.goal.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "goal" },
+  { type: "mission.work.linked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
+  { type: "mission.work.unlinked", domain: "missions", aggregateType: "mission", phase: "P2", child: "work" },
   { type: "goal.created", domain: "goals", aggregateType: "goal", phase: "P2" },
   { type: "goal.updated", domain: "goals", aggregateType: "goal", phase: "P2" },
   { type: "goal.status_changed", domain: "goals", aggregateType: "goal", phase: "P2" },
@@ -21578,6 +22167,7 @@ function createNodeRuntime(config, io, options = {}) {
   let attendedWake = null;
   const holdableLanes = [];
   let limitTarget = null;
+  let throttleTarget = null;
   const lifecycle = new NodeLifecycleTracker({
     daemonVersion: io.version,
     logger: io.logger,
@@ -21601,6 +22191,7 @@ function createNodeRuntime(config, io, options = {}) {
     onAccepted: /* @__PURE__ */ __name((response) => {
       attendedWake?.(response.pendingComputerSessions);
       lifecycle.applyHeartbeat(response);
+      throttleTarget?.(response.node?.modelThrottles);
     }, "onAccepted")
   };
   const runtime = { client, loop: new HeartbeatLoop(loopOptions), lifecycle, cliCompat };
@@ -21642,7 +22233,11 @@ function createNodeRuntime(config, io, options = {}) {
       // attended lane alone — never parked in (or holding a slot of) the
       // work lane. Sent only under `--attend`, so a work-only node's lease
       // body is exactly what it always was.
-      ...options.attendEnabled ? { excludeKinds: ["computer-session"] } : {}
+      ...options.attendEnabled ? { excludeKinds: ["computer-session"] } : {},
+      // Fleet usage limits: the CLIs an agent-task can run with here, so a
+      // node whose only CLI is out of quota stops leasing agent-task work
+      // until the reset (other kinds keep leasing).
+      modelProviders: /* @__PURE__ */ __name(() => Object.entries(options.modelCli ?? io.environment.modelCli ?? {}).filter(([, path2]) => typeof path2 === "string" && path2.length > 0).map(([provider]) => provider), "modelProviders")
     });
     holdableLanes.push(worker);
     worker.onUpgradeRequired((hold) => lifecycle.applyLeaseRefusal(hold.minNodeVersion));
@@ -21654,6 +22249,9 @@ function createNodeRuntime(config, io, options = {}) {
       }
     }, "limitTarget");
     telemetry.limits = () => worker.resourceLimits;
+    throttleTarget = /* @__PURE__ */ __name((throttles) => {
+      if (Array.isArray(throttles)) worker.syncModelThrottles(throttles);
+    }, "throttleTarget");
     telemetry.workerHealth = () => describeWorkerHealth(worker.getState());
     const housekeeping = new NodeHousekeepingReporter({
       minFreeDiskBytes: io.diskProbe ? effectiveMinFreeDiskBytes(limits) : null,
@@ -23303,10 +23901,12 @@ async function runStart(deps, options) {
   }
   const { loop, worker } = runtime;
   const attendedWorker = runtime.attended?.worker ?? null;
+  let lastLoggedBeat = null;
   loop.onChange((state) => {
-    if (state.state === "connected") {
-      deps.io.logger.info(`Heartbeat accepted \u2014 node ${config.nodeId} is online`);
-    }
+    if (state.state !== "connected") return;
+    if (lastLoggedBeat && lastLoggedBeat.node === state.node && lastLoggedBeat.at === state.lastHeartbeatAt) return;
+    lastLoggedBeat = { node: state.node, at: state.lastHeartbeatAt };
+    deps.io.logger.info(`Heartbeat accepted \u2014 node ${config.nodeId} is online`);
   });
   deps.out(`Starting node ${config.nodeId} \u2192 ${config.apiUrl} (every ${config.heartbeatIntervalMs / 1e3}s)`);
   let requestShutdown = /* @__PURE__ */ __name(() => void 0, "requestShutdown");
@@ -24105,7 +24705,7 @@ function createLogger(options = {}) {
 __name(createLogger, "createLogger");
 
 // src/version.ts
-var NODE_APP_VERSION = "0.2.4";
+var NODE_APP_VERSION = "0.2.5";
 
 // src/cli.ts
 function buildDeps() {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ever-works-node",
-  "version": "0.2.4",
+  "version": "0.2.5",
   "description": "Ever Works Node - headless execution node (CLI + long-running service): fleet enrollment, heartbeat and capability reporting",
   "author": {
     "name": "Ever Co. LTD",