flowviant 0.39.0 → 0.40.1

package/bin/lib/live.mjs

@@ -34,7 +34,7 @@ import {
   ALLOW_PATCHES,
 } from './config.mjs';
 import { c, info, ok, warn } from './ui.mjs';
-import { sleep } from './claude.mjs';
+import { sleep, runTurn, mcpFor, sawSentinel, blockedId } from './claude.mjs';
 import {
   git,
   resetWorktree,
@@ -44,7 +44,7 @@ import {
   clearWip,
 } from './git.mjs';
 import { applyPatch, fileDiffs, ownerCurrentBranch, withPatchLock } from './patch.mjs';
-import { RUNTIMES } from './runtimes.mjs';
+import { RUNTIMES, runtimeById, drivableHere, mediated } from './runtimes.mjs';
 import { loadPreviewConfig, startPreview } from './preview.mjs';
 import { materializeInto, scrub as envScrub } from './env.mjs';
 
@@ -53,16 +53,19 @@ import { materializeInto, scrub as envScrub } from './env.mjs';
 const LIVE_TARGET_URL = FLEET_URL.replace(/\/agents\/?$/, '/live-target');
 
 /**
- * What a live session can build, sent on every claim.
+ * What THIS WORKER can build, sent on every claim.
  *
- * Read off the registry rather than written as `['claude']` so that the day a
- * second runtime gains an SDK session, marking `live: true` there is the whole
- * change — a hand-written list here would keep withholding its work and the
- * reason would be three files away from the flag that looks like it decides.
+ * Deliberately the same predicate the roster report uses (`drivableHere`), not a
+ * hand-written list. The claim and the report answer the same question to two
+ * different consumers, and if they ever disagree the daemon either claims work it
+ * cannot build — the exact bug this argument was added to close — or refuses work
+ * it can. One source, so they cannot drift.
+ *
+ * Note this is NOT the live-session list. A live worker builds Claude tasks
+ * through the SDK and everything else through `driveSubprocess`, so both belong
+ * here; `live` chooses the driver, it does not gate participation.
  */
-const LIVE_RUNTIMES = Object.values(RUNTIMES)
-  .filter((r) => r.live === true && r.mcp && r.args)
-  .map((r) => r.id);
+const DRIVABLE_HERE = Object.values(RUNTIMES).filter(drivableHere).map((r) => r.id);
 // Short TTL + a heartbeat that re-asserts while the tunnel is alive. So a live
 // preview stays linked indefinitely (survives long reviews), but one whose
 // daemon DIED ungracefully (no more heartbeats) drops off the card within the
@@ -204,6 +207,36 @@ questions, delivery summaries, commits, or PRs — reference keys by NAME only
 (e.g. "set STRIPE_KEY"). Never screenshot a terminal or page that displays a
 credential, and never commit an env file.`;
 
+/**
+ * The same contract, for a runtime that has no live session.
+ *
+ * A non-live runtime is driven as a SUBPROCESS: one headless turn, then the
+ * process exits and the daemon decides what happens next. That transport cannot
+ * see tool calls the way the SDK stream can — there is no `tool_use` block to
+ * read `complete` or `report_blocker` off — so the turn has to SAY how it ended.
+ * Hence the sentinels, which are the same three words the legacy poll path has
+ * always used; this is a transport detail bolted onto the contract, not a second
+ * contract, which is why it is SYSTEM_LIVE plus an epilogue rather than a
+ * parallel prompt that would drift from it.
+ *
+ * The claim instruction that opens SYSTEM_SINGLE is deliberately absent: the
+ * daemon already claimed this task before spawning, so a second claim would come
+ * back `active_run` and the turn would waste itself puzzling over it.
+ */
+const SYSTEM_SUBPROCESS = `${SYSTEM_LIVE}
+
+HOW THIS TURN ENDS. You are running as a one-shot process, not in a live session,
+so the daemon can only see what you print. End your turn by printing EXACTLY ONE
+of these on a line by itself, as the last thing you output:
+  DONE                — the task is complete (you called complete, and opened the
+                        PR unless placement is "patch")
+  BLOCKED:<blockerId> — you called report_blocker and are waiting on a human. Use
+                        the id report_blocker returned. STOP after printing it;
+                        you will be run again with the answer.
+Print nothing else on that line. Do not print a sentinel you have not earned — a
+DONE without a complete call strands the work, and the team is told the task
+finished when it did not.`;
+
 /** The brief minus the parts rendered as prose below (conversations, the ask). */
 function briefWithoutThread(brief) {
   const {
@@ -568,6 +601,648 @@ async function landPatch({ mcpUrl, token, runId, intentId, repoRoot, cwd, patchB
   warn(`patch not applied: ${reason}`);
 }
 
+/**
+ * The FORM a mediated runtime fills in instead of calling tools.
+ *
+ * Every field maps to one control-plane call the daemon makes on the agent's
+ * behalf, which is why the shape is this small: it is not a report, it is the
+ * arguments to `complete` / `report_blocker` / `attach_pr` with the runId taken
+ * out (the agent has no business naming a run it cannot see).
+ */
+const MEDIATED_RESULT_SCHEMA = {
+  type: 'object',
+  required: ['outcome', 'summary'],
+  additionalProperties: false,
+  properties: {
+    outcome: { type: 'string', enum: ['done', 'blocked', 'failed'] },
+    summary: { type: 'string' },
+    prUrl: { type: 'string' },
+    branch: { type: 'string' },
+    blockerQuestion: { type: 'string' },
+    blockerOptions: { type: 'array', items: { type: 'string' } },
+    criteria: {
+      type: 'array',
+      items: {
+        type: 'object',
+        required: ['index', 'met'],
+        properties: {
+          index: { type: 'number' },
+          met: { type: 'boolean' },
+          note: { type: 'string' },
+        },
+      },
+    },
+  },
+};
+
+/**
+ * The contract for a runtime that cannot reach the flowviant MCP server.
+ *
+ * SYSTEM_LIVE tells the agent to call tools. This one tells it there are none —
+ * which has to be said explicitly, because the brief it is about to read is full
+ * of references to a control plane it cannot touch, and an agent that spends its
+ * turn hunting for `report_progress` is an agent that does not build anything.
+ */
+const SYSTEM_MEDIATED = `You are a Flowviant build agent working ONE task, running FULLY AUTONOMOUSLY.
+There is NO interactive user, NO terminal to ask in, and — importantly — NO
+Flowviant tools available to you in this session. Do not look for them. A daemon
+is watching this run and reports on your behalf: your file edits, commands and
+progress are already visible to the team as you work.
+
+Do the work described in the brief below, in the checkout you are running in.
+Ship it exactly as the brief's "placement" says:
+• placement "patch": commit your change with a one-line message and STOP. No
+  branch, no push, no PR — the daemon carries it into the owner's checkout.
+• placement "branch" (the default): create the branch named in "branchName" (use
+  that exact name), push it, and open ONE draft pull request with
+  \`gh pr create --draft\`. If the brief has a "baseBranch", target it with
+  \`--base <baseBranch>\`. NEVER merge.
+
+THEN RETURN THE RESULT FORM as your final answer, and nothing else — it is a
+strict JSON schema and it is the only way anything you did gets recorded:
+• outcome "done" — you finished. Include a plain-language "summary" for the
+  humans (it becomes your delivery card), the "prUrl" and "branch" if you opened
+  one, and a "criteria" self-report indexing into the brief's "done when" list.
+• outcome "blocked" — you hit a decision only a human can make. Put the question
+  in "blockerQuestion" and any choices in "blockerOptions", and STOP. You will be
+  run again with the answer.
+• outcome "failed" — you could not do it. Say why in "summary".
+Do not invent a prUrl you did not open, and do not report "done" for work you did
+not finish: the summary is shown to a person as a claim about what exists.
+SECRETS: env files (.env, .dev.vars, …) hold the team's synced secrets. Their
+VALUES must NEVER appear in the summary, in commits, or in a PR — reference keys
+by NAME only. Never commit an env file.`;
+
+/**
+ * Walk forward from an opening brace to its MATCHING close, or null.
+ *
+ * String-aware, because the thing being matched is JSON and this object's whole
+ * job is to carry human prose: a summary reading `fixed the {x} case` would
+ * otherwise close the object early, and an escaped quote inside it would end the
+ * string early. Depth counting alone is not enough.
+ */
+function balancedSpan(text, start) {
+  let depth = 0;
+  let inStr = false;
+  let esc = false;
+  for (let i = start; i < text.length; i++) {
+    const ch = text[i];
+    if (inStr) {
+      if (esc) esc = false;
+      else if (ch === '\\') esc = true;
+      else if (ch === '"') inStr = false;
+      continue;
+    }
+    if (ch === '"') inStr = true;
+    else if (ch === '{') depth++;
+    else if (ch === '}' && --depth === 0) return text.slice(start, i + 1);
+  }
+  return null;
+}
+
+/** Pull the result object out of a turn's output. */
+function parseMediatedResult(out) {
+  const text = String(out ?? '').trim();
+  if (!text) return null;
+  // The whole answer SHOULD be the object — that is what schema enforcement
+  // buys. Fall back to the last balanced {...} for a runtime that wraps it in a
+  // fence or adds a sentence, so one chatty model does not strand a finished
+  // build. Last rather than first: any preamble comes before the answer.
+  const direct = tryJson(text);
+  if (direct) return direct;
+  // Each candidate open brace gets its OWN close, found by scanning forward.
+  // The previous version anchored every attempt on `text.lastIndexOf('}')` —
+  // recomputed per iteration but loop-INVARIANT, so it was always the final `}`
+  // of the whole output. Only the start moved; the end never retreated. Any
+  // sentence after the object containing a brace (`Note: the } above closes it`)
+  // therefore made every slice unparseable, and a FINISHED build came back as
+  // `stalled` after two nudges. Reproduced before fixing.
+  let tried = 0;
+  for (let i = text.lastIndexOf('{'); i >= 0; i = text.lastIndexOf('{', i - 1)) {
+    // A candidate must OPEN ITS OWN LINE (whitespace aside). A form echoed
+    // mid-sentence is how a hypothetical became a delivery card: `I would
+    // return {"outcome":"done",…} once done. But I could not…` parsed as done
+    // and posted a completed card for a failed build (reproduced). A real form
+    // — bare, fenced, or followed by notes — opens at a line start, and a
+    // wrapper that inlines it gets the nudge, which asks for the bare object
+    // anyway. A wrong card has no recovery; a nudge does. Skipped candidates
+    // don't count against the bound, which also keeps a trailing prose brace
+    // from burning slots the real object needs.
+    const bol = text.lastIndexOf('\n', i - 1) + 1;
+    if (!text.slice(bol, i).trim()) {
+      // Bounded: an unbalanced brace scans to end-of-text, and a build's output
+      // can be very long. The real object is at the end — 200 candidates is far
+      // past any honest wrapper and keeps a pathological output from stalling
+      // the turn loop instead of the model.
+      if (++tried > 200) break;
+      const span = balancedSpan(text, i);
+      const cand = span && tryJson(span);
+      if (cand) return cand;
+    }
+    if (i === 0) break;
+  }
+  return null;
+}
+function tryJson(s) {
+  try {
+    const v = JSON.parse(s);
+    return v && typeof v === 'object' && typeof v.outcome === 'string' ? v : null;
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * The server's own rule for a PR URL (`mcpAttachPrSchema`), checked BEFORE the
+ * call instead of discovered as a swallowed rejection after it.
+ *
+ * The result schema can only say `prUrl: string` — the model writes the value
+ * freehand — and the server's zod REJECTS a non-github or non-pull URL, so a
+ * plausible-looking mistake meant the PR was never linked and the task never
+ * moved to `review`, with nothing anywhere saying so. Deliberately NOT expressed
+ * as a `pattern` in MEDIATED_RESULT_SCHEMA: the mediated path is the one whose
+ * schema enforcement is a vendor flag we verified empirically on exactly one
+ * version, and adding a keyword that CLI may not implement risks the working
+ * case to defend the broken one. Validate on our side, where we know the rules.
+ */
+const PR_URL_RE = /^https:\/\/github\.com\/[^/]+\/[^/]+\/pull\/\d+/;
+
+/**
+ * Coerce the model's criteria self-report into the shape `complete` accepts.
+ *
+ * MEDIATED_RESULT_SCHEMA can only say `index: number`; the server says
+ * `int().min(0)`, note ≤500, array ≤50 — and ONE bad row makes the whole
+ * `complete` call throw, which on this path means no delivery card at all. So
+ * repairable rows are repaired and the rest dropped: a self-report missing an
+ * entry is worth far more than a card that never arrives.
+ */
+function sanitizeCriteria(criteria) {
+  if (!Array.isArray(criteria)) return null;
+  const rows = criteria
+    // A negative index is DROPPED, not clamped: Math.max(0, …) would silently
+    // re-attribute the row to criterion 0, which is a wrong self-report rather
+    // than a missing one.
+    .filter((c) => c && Number.isFinite(c.index) && c.index >= 0 && typeof c.met === 'boolean')
+    .map((c) => ({
+      index: Math.trunc(c.index),
+      met: c.met,
+      ...(typeof c.note === 'string' && c.note ? { note: c.note.slice(0, 500) } : {}),
+    }))
+    .slice(0, 50);
+  return rows.length ? rows : null;
+}
+
+/**
+ * Post the delivery card, and get one honest retry at it.
+ *
+ * The retry drops `criteria` on purpose. runId, outcome and summary are all
+ * daemon-controlled and already clamped, so the only argument that can still be
+ * rejected is the one the model wrote — and dropping it also re-enters
+ * `complete`'s idempotent branch, which is what recovers the OTHER failure the
+ * server documents here (`task_status_failed`: the run row moved but the task's
+ * status write didn't, and the fix is to call again).
+ *
+ * Returns false only on an EXPLICIT `ok: false`. An unparseable or empty
+ * response is treated as success: this verdict decides whether the run is left
+ * for the stale sweep to roll back and rebuild, and a transient hiccup is not
+ * worth rebuilding a finished task over.
+ */
+async function postComplete({ mcpUrl, token, runId, outcome, summary, criteria }) {
+  const rows = sanitizeCriteria(criteria);
+  const call = (args) =>
+    mcpCall(mcpUrl, token, 'complete', args).catch((e) => ({
+      ok: false,
+      reason: e?.message ?? String(e),
+    }));
+  const base = { runId, outcome, summary };
+  let res = await call(rows ? { ...base, criteria: rows } : base);
+  if (res?.ok === false && rows) {
+    warn(`complete rejected (${res.reason ?? 'unknown'}) — retrying without the criteria self-report`);
+    res = await call(base);
+  }
+  return res?.ok !== false;
+}
+
+/**
+ * Drive a task with a runtime that cannot reach the MCP server at all.
+ *
+ * THE CLI DOES THE WORK; THE DAEMON DOES THE PAPERWORK. Antigravity's server
+ * list is machine-wide (measured — a workspace-local config is never read), so
+ * handing it a per-lane worker token is impossible and handing it a shared one
+ * would make every lane indistinguishable to the control plane. Instead nothing
+ * is handed over: the agent gets a brief and returns a filled-in form, and every
+ * control-plane call below is made by the daemon with the lane's OWN token, over
+ * its own HTTP. Per-lane isolation is preserved by removing the need for the
+ * agent to have a credential at all.
+ *
+ * The cost, and it is real: NO ON-DEMAND CONTEXT. A direct-MCP agent can call
+ * search_wiki or get_module_files the moment it realises it does not understand
+ * a subsystem. A mediated one only knows what was in the brief. That is a
+ * genuine capability difference and it is why this is the fallback shape rather
+ * than the default — runtimes that CAN hold an MCP config keep the full tool
+ * surface.
+ *
+ * Also not yet carried: attach_evidence. A mediated agent cannot upload a
+ * screenshot, so its delivery card arrives without the proof a Claude lane's
+ * would have. Fixable (the agent writes files, the daemon uploads them) and
+ * deliberately not in this first pass.
+ */
+async function driveMediated({
+  runtimeId,
+  mcpUrl,
+  token,
+  runId,
+  intentId,
+  title,
+  cwd,
+  brief,
+  isPatch,
+  patchBase,
+  repoRoot,
+  baseRef,
+  label,
+  seedText,
+  isAlive,
+  onChild,
+  markLanded,
+}) {
+  const rt = runtimeById(runtimeId);
+  const dir = mkdtempSync(join(tmpdir(), 'flowviant-schema-'));
+  const schemaPath = join(dir, 'result.schema.json');
+
+  // The agent cannot call report_progress, so the daemon narrates for it off the
+  // parsed activity stream. Throttled: a build touches hundreds of files and the
+  // thread is for humans, not for a filesystem log.
+  let lastReport = 0;
+  const narrate = (activity) => {
+    if (!activity?.label) return;
+    const now = Date.now();
+    if (now - lastReport < 8000) return;
+    lastReport = now;
+    void mcpCall(mcpUrl, token, 'report_progress', {
+      runId,
+      kind: activity.kind === 'error' ? 'error' : 'progress',
+      message: envScrub(activity.label),
+    }).catch(() => {});
+  };
+
+  let prompt = seedText;
+  let resume = false;
+  let nudges = 0;
+  try {
+    // Inside the try so a failed write (disk full) still removes `dir` in the
+    // finally instead of leaking one temp directory per attempt.
+    writeFileSync(schemaPath, JSON.stringify(MEDIATED_RESULT_SCHEMA), { mode: 0o600 });
+    for (;;) {
+      if (!isAlive()) return { outcome: 'blocked', title, intentId };
+      let out = '';
+      try {
+        out = await runTurn({
+          prompt,
+          resume,
+          system: SYSTEM_MEDIATED,
+          cwd,
+          runtime: runtimeId,
+          // NO MCP. That is the entire point of this path.
+          resultSchemaArgs: rt.resultSchema?.(schemaPath) ?? [],
+          label,
+          model: brief.agentModel || undefined,
+          effort: brief.agentEffort || undefined,
+          onActivity: narrate,
+          onSpawn: (ch) => onChild?.(ch),
+        });
+      } catch (e) {
+        return { outcome: 'error', error: e?.message ?? String(e), title, intentId };
+      } finally {
+        onChild?.(null);
+      }
+      if (!isAlive()) return { outcome: 'blocked', title, intentId };
+      resume = true;
+
+      const rl = classifyRateLimit(String(out).slice(-4000));
+      const result = parseMediatedResult(out);
+      if (!result && rl.isRateLimit) {
+        await mcpCall(mcpUrl, token, 'report_paused', { runId, resetAt: rl.resetAt }).catch(() => {});
+        return { outcome: 'rate_limited', resetAt: rl.resetAt, runId, title, intentId };
+      }
+
+      if (!result) {
+        // No form came back. Same posture as a missing sentinel on the other
+        // paths: nudge, then give up rather than invent an outcome.
+        if (nudges < 2) {
+          nudges++;
+          prompt =
+            'You did not return the result form. Return ONLY the JSON object described in your instructions, describing what you did.';
+          continue;
+        }
+        return { outcome: 'stalled', title, intentId };
+      }
+
+      if (result.outcome === 'blocked') {
+        // Clamp AND scrub, same discipline as postComplete below, and for the
+        // same reason: on this path the DAEMON is the caller, so the model never
+        // sees the server's zod rejection and cannot self-correct. The server
+        // caps question at 2000 and options at 10×500 (questionPayloadSchema) —
+        // an oversize value posted raw is a rejected post, i.e. a question that
+        // silently never reaches the human. And the question is model narration
+        // leaving the box, exactly what the uplink scrub exists for.
+        const q =
+          envScrub(String(result.blockerQuestion ?? result.summary ?? '').trim()).slice(0, 2000) ||
+          'The agent stopped and did not say why.';
+        const options = (Array.isArray(result.blockerOptions) ? result.blockerOptions : [])
+          .filter((o) => typeof o === 'string' && o.trim())
+          .map((o) => envScrub(o.trim()).slice(0, 500))
+          .filter(Boolean)
+          .slice(0, 10);
+        const post = () =>
+          mcpCall(mcpUrl, token, 'report_blocker', {
+            runId,
+            taskId: intentId,
+            type: 'question',
+            payload: { question: q, ...(options.length ? { options } : {}) },
+          }).catch(() => null);
+        // One retry: reportBlockerOnce is idempotent server-side, and a dropped
+        // response is the documented reason it is.
+        let posted = await post();
+        if (!posted?.blockerId && !posted?.id) {
+          await sleep(2);
+          posted = await post();
+        }
+        const blockerId = posted?.blockerId ?? posted?.id ?? null;
+        if (!blockerId) {
+          // The question exists only in this process. Say why on the way out —
+          // silence here reads identically to a human who has not answered yet.
+          //
+          // 'error', NOT 'blocked': on every driver 'blocked' means "shutting
+          // down mid-park", and runLiveWorker BREAKS on it — a lane that ends
+          // its loop is never respawned (workers.delete fires only on roster
+          // removal), so returning it here turned one failed post into a lane
+          // that sat dead-but-listed until the daemon restarted. 'error' takes
+          // the refresh-token-and-retry path, and the shared finally's
+          // checkpoint keeps the work for whoever picks the task back up.
+          warn(`report_blocker did not return an id (${posted?.reason ?? posted?.raw ?? 'no response'}) — the question was not posted`);
+          return { outcome: 'error', error: 'report_blocker failed', title, intentId };
+        }
+        const res = await waitForResolution(mcpUrl, token, blockerId, isAlive);
+        if (res.status === 'resolved') {
+          prompt = `The human answered your blocker: ${JSON.stringify(res.answer)}\nApply it and continue, then return the result form.`;
+          nudges = 0;
+          continue;
+        }
+        if (res.status === 'timeout') return { outcome: 'parked', title, intentId };
+        return { outcome: 'blocked', title, intentId };
+      }
+
+      // done / failed — either way the turn is over and the thread gets a card.
+      //
+      // NOTHING FROM HERE DOWN IS BEST-EFFORT, and that is the difference this
+      // path has to make up for. On the direct-MCP paths the AGENT makes these
+      // calls and sees the rejection, so it corrects and retries; a mediated
+      // agent never learns that the daemon's call failed. Swallowing them (which
+      // is what this shipped as) produced the worst available outcome: the PR
+      // silently unlinked, the task never moved to `review`, no delivery card —
+      // and `markLanded()` firing anyway, so the shared `finally` DELETED the WIP
+      // checkpoint for work the control plane had never been told about.
+      if (result.prUrl && !isPatch) {
+        const prUrl = String(result.prUrl).trim();
+        if (!PR_URL_RE.test(prUrl)) {
+          // The model can fix this one, so ask it to — it already opened the PR.
+          if (nudges < 2) {
+            nudges++;
+            prompt =
+              `"${prUrl}" is not a GitHub pull request URL (expected https://github.com/<owner>/<repo>/pull/<number>). ` +
+              'Do NOT redo any work and do NOT open another PR. Return the result form again with the real URL of the ' +
+              'pull request you already opened, or omit prUrl entirely if you did not open one.';
+            continue;
+          }
+          warn(`attach_pr skipped: unusable prUrl ${prUrl}`);
+        } else {
+          const attached = await mcpCall(mcpUrl, token, 'attach_pr', {
+            runId,
+            prUrl,
+            ...(result.branch ? { branch: String(result.branch) } : {}),
+          }).catch((e) => ({ ok: false, reason: e?.message ?? String(e) }));
+          if (attached?.ok === false) warn(`attach_pr rejected: ${attached.reason ?? 'unknown'}`);
+        }
+      }
+      clearTaskMarker(cwd);
+      const done = result.outcome === 'done';
+      if (done && isPatch) {
+        await landPatch({ mcpUrl, token, runId, intentId, repoRoot, cwd, patchBase, baseRef });
+      }
+      const carded = await postComplete({
+        mcpUrl,
+        token,
+        runId,
+        outcome: done ? 'completed' : 'failed',
+        summary: envScrub(String(result.summary ?? '').slice(0, 4000)),
+        criteria: result.criteria,
+      });
+      if (!carded) {
+        // No delivery card exists, so this run is not done however the work
+        // ended. `landed` deliberately stays false: the shared finally takes one
+        // last checkpoint instead of deleting the WIP ref, and the run is left
+        // active for the stale sweep to roll back and re-dispatch — recoverable,
+        // unlike reporting success into a thread that shows nothing.
+        warn('complete failed — leaving the run for the server to reclaim');
+        return { outcome: 'error', error: 'complete rejected', title, intentId };
+      }
+      if (done) markLanded();
+      return { outcome: done ? 'done' : 'stalled', title, intentId };
+    }
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+}
+
+/**
+ * Drive a task with a runtime that has no live session.
+ *
+ * Same job, same outcomes, different transport. `runLiveTask` owns everything
+ * around this — the claim, the worktree, the branch/patch/stack setup, the WIP
+ * checkpoint timer, the diffstat sampler and the teardown — and calls one of two
+ * drivers in the middle. That split is the whole point: routing non-live
+ * runtimes at the WORKER level instead (the obvious shortcut, since the legacy
+ * poll worker already spawns Codex) would have sent them down a path with no
+ * patch landing, no WIP checkpoint/restore and no preview, so a `placement:
+ * "patch"` task would follow its instructions to commit-and-stop and then wait
+ * forever for a daemon that never picks it up.
+ *
+ * What is genuinely lost versus a live session, stated plainly rather than
+ * discovered: a teammate's mid-task message cannot interrupt a running turn. It
+ * lands between turns instead, which is the same place a poll-mode message has
+ * always landed. Everything else — blockers, stop, teardown, release, patches,
+ * checkpoints — behaves the same because it is the same surrounding code.
+ */
+async function driveSubprocess({
+  runtimeId,
+  mcpUrl,
+  token,
+  runId,
+  intentId,
+  title,
+  cwd,
+  brief,
+  isPatch,
+  patchBase,
+  repoRoot,
+  baseRef,
+  label,
+  seedText,
+  afterId,
+  isAlive,
+  onChild,
+  markLanded,
+}) {
+  let resume = false;
+  let nudges = 0;
+  let held = false;
+  let prompt = seedText;
+
+  for (;;) {
+    if (!isAlive()) return { outcome: 'blocked', title, intentId };
+
+    // A fresh token hand-off per turn: the worker token is minted per lane and
+    // may rotate between turns, and for Codex it rides in the environment rather
+    // than on disk, so there is nothing to clean up in that case (`dir` is null).
+    const { dir, args: mcpArgs, env: mcpEnv } = mcpFor(runtimeId, token, mcpUrl);
+    let out = '';
+    try {
+      out = await runTurn({
+        prompt,
+        resume,
+        system: SYSTEM_SUBPROCESS,
+        cwd,
+        runtime: runtimeId,
+        mcpArgs,
+        mcpEnv,
+        label,
+        // Per-task first, this machine's default second — off the BRIEF, which is
+        // the task we actually hold, never the roster's guess.
+        model: brief.agentModel || undefined,
+        effort: brief.agentEffort || undefined,
+        onSpawn: (ch) => onChild?.(ch),
+      });
+    } catch (e) {
+      // Defensive only. runTurn resolves rather than rejects on a failed child —
+      // see the rate-limit note below — so this catches a throw from the
+      // plumbing around it, not from the CLI.
+      return { outcome: 'error', error: e?.message ?? String(e), title, intentId };
+    } finally {
+      if (dir) rmSync(dir, { recursive: true, force: true });
+      onChild?.(null);
+    }
+    if (!isAlive()) return { outcome: 'blocked', title, intentId };
+
+    // A USAGE LIMIT reads differently here than it does in a live session, and
+    // getting that wrong would show the user's own plan limit as a Flowviant
+    // stall. The SDK THROWS on a 429, which is why the live path classifies an
+    // exception; `runTurn` resolves with whatever the child printed no matter
+    // how it exited, so the only evidence a subprocess leaves is text.
+    //
+    // Read the TAIL only, and only when the turn produced no sentinel. The whole
+    // transcript is the model's narration, and an agent that writes "we should
+    // handle rate limit errors" into a code comment would otherwise park a
+    // perfectly healthy run. A fatal CLI error is the last thing printed. Both
+    // ways of being wrong here are recoverable — a false park retries after the
+    // reset, a missed limit reads as a stall and is re-dispatched — so the tail
+    // heuristic buys the common case without risking the work.
+    if (!sawSentinel(out, 'DONE') && !blockedId(out)) {
+      const rl = classifyRateLimit(out.slice(-4000));
+      if (rl.isRateLimit) {
+        await mcpCall(mcpUrl, token, 'report_paused', { runId, resetAt: rl.resetAt }).catch(() => {});
+        return { outcome: 'rate_limited', resetAt: rl.resetAt, runId, title, intentId };
+      }
+    }
+
+    // Every turn after the first continues the CLI's own session where the
+    // runtime supports it (`--continue` / `resume --last`), so the agent keeps
+    // its reasoning rather than re-reading the brief cold each time.
+    resume = true;
+
+    const bid = blockedId(out);
+    if (bid) {
+      const res = await waitForResolution(mcpUrl, token, bid, isAlive);
+      if (res.status === 'resolved') {
+        prompt = `The human answered your blocker: ${JSON.stringify(res.answer)}\nApply it and continue.`;
+        nudges = 0;
+        continue;
+      }
+      if (res.status === 'timeout') return { outcome: 'parked', title, intentId };
+      return { outcome: 'blocked', title, intentId };
+    }
+
+    if (sawSentinel(out, 'DONE')) {
+      // Identical to the live path's completion, and it must stay identical: the
+      // marker clear is what stops this worktree being read as a resume of a
+      // task that has finished (or been discarded and restarted).
+      clearTaskMarker(cwd);
+      if (isPatch) {
+        await landPatch({ mcpUrl, token, runId, intentId, repoRoot, cwd, patchBase, baseRef });
+      }
+      markLanded();
+      return { outcome: 'done', title, intentId };
+    }
+
+    // No sentinel: the turn ended without saying how. Before nudging, find out
+    // whether the RUN still exists — a restart or a release from the app tears
+    // it down out from under us, and nudging a dead run just burns the user's
+    // quota. Same three answers the live loop reads, for the same reasons.
+    const poll = await mcpCall(mcpUrl, token, 'poll_channel', {
+      runId,
+      ...(afterId ? { afterId } : {}),
+    }).catch(() => null);
+    if (poll && poll.ok === false && poll.released) {
+      return { outcome: 'released', title, intentId };
+    }
+    if (poll && poll.ok === false && poll.reason === 'run_not_active') {
+      clearTaskMarker(cwd);
+      try {
+        git(['worktree', 'remove', '--force', cwd], repoRoot);
+      } catch {
+        resetWorktree(cwd, baseRef);
+      }
+      return { outcome: 'torn_down', title, intentId };
+    }
+
+    const fresh = (poll?.messages ?? []).filter((x) => x.role === 'user');
+    if (fresh.length) afterId = fresh[fresh.length - 1].id;
+
+    if (fresh.some((f) => STOP_RE.test(f.content))) {
+      held = true;
+      prompt =
+        'A teammate asked you to STOP. Halt, summarize where you are in one line, and wait for direction — do not continue until told.';
+      continue;
+    }
+    if (fresh.length) {
+      prompt = fresh
+        .map((f) => (f.authorName ? `${f.authorName}: ` : '') + f.content)
+        .join('\n');
+      nudges = 0;
+      held = false;
+      continue;
+    }
+    if (held) {
+      const next = await waitForMessage(mcpUrl, token, runId, afterId, isAlive);
+      if (!next) return { outcome: 'parked', title, intentId };
+      held = false;
+      nudges = 0;
+      afterId = next.id;
+      prompt = (next.authorName ? `${next.authorName}: ` : '') + next.content;
+      continue;
+    }
+
+    if (nudges < 2) {
+      nudges++;
+      prompt = isPatch
+        ? 'Continue until the task is complete: commit your change (no branch, no push, no PR) and call complete, then print DONE. Or report a blocker and print BLOCKED:<id>.'
+        : 'Continue until the task is complete: open a draft PR and call complete, then print DONE. Or report a blocker and print BLOCKED:<id>.';
+      continue;
+    }
+    return { outcome: 'stalled', title, intentId };
+  }
+}
+
 export async function runLiveTask({
   mcpUrl,
   token,
@@ -592,12 +1267,11 @@ export async function runLiveTask({
   // the only dispatch in this product, and silently answering it with a different
   // CLI is the same class of bug as dispatching from the wrong surface.
   //
-  // A live session is Claude-only by construction, not by configuration — it is
-  // an SDK, not a subprocess — so this list is exactly the runtimes marked
-  // `live` in the registry. An older server ignores the argument and behaves as
-  // before; that degrade is what `daemon:min` is for.
+  // The list is every runtime this daemon can spawn or session, NOT just the
+  // live ones — `driveSubprocess` below builds the rest. An older server ignores
+  // the argument and behaves as before; that degrade is what `daemon:min` is for.
   const claim = await mcpCall(mcpUrl, token, 'claim_next_task', {
-    runtimes: LIVE_RUNTIMES,
+    runtimes: DRIVABLE_HERE,
   }).catch(() => null);
   if (!claim || claim.claimed !== true) return { outcome: 'nothing' };
   const { runId, intentId } = claim;
@@ -792,8 +1466,16 @@ export async function runLiveTask({
   // already told us the real intent.
   const stopDiffstat = sampleDiffstat?.(cwd, baseRef, intentId, agentId) ?? null;
 
-  const input = makeInput(seedPrompt(runId, brief, transcript, resumedInPlace));
-  const session = query({
+  // WHICH CLI builds this one, off the brief — the task we actually hold, not
+  // the roster's prediction. Only Claude has a live session (it is an Anthropic
+  // SDK, not a CLI contract); everything else is driven as a subprocess by
+  // `driveSubprocess` below, which is what the registry's `live` flag has always
+  // said would happen and what live mode never implemented.
+  const rt = runtimeById(brief.agentRuntime ?? 'claude');
+  const seedText = seedPrompt(runId, brief, transcript, resumedInPlace);
+  const input = rt.live ? makeInput(seedText) : null;
+  const session = rt.live
+    ? query({
     prompt: input.stream(),
     options: {
       cwd,
@@ -821,26 +1503,32 @@ export async function runLiveTask({
         },
       },
     },
-  });
+      })
+    : null;
 
   // Mark this worker BUSY for the daemon's reconcile loop: buildHave keeps the
   // worker's token while a session is live (never rotate a credential out from
   // under it), and teardown/agent-removal can interrupt the SDK session via this
   // marker's kill(). Cleared in finally. Mirrors poll mode's onChild(child).
-  onChild?.({
-    kill: () => {
-      try {
-        session.interrupt?.();
-      } catch {
-        /* already ending */
-      }
-      try {
-        session.return?.();
-      } catch {
-        /* already closed */
-      }
-    },
-  });
+  // The subprocess driver registers its own handle per turn (runTurn's onSpawn),
+  // because there the killable thing is a child process and it only exists while
+  // a turn is actually running.
+  if (session) {
+    onChild?.({
+      kill: () => {
+        try {
+          session.interrupt?.();
+        } catch {
+          /* already ending */
+        }
+        try {
+          session.return?.();
+        } catch {
+          /* already closed */
+        }
+      },
+    });
+  }
 
   let turnId = null;
   let turnText = '';
@@ -860,6 +1548,25 @@ export async function runLiveTask({
     lastBeat = Date.now();
     void mcpCall(mcpUrl, token, 'heartbeat', { runId }).catch(() => {});
   };
+  // AND ON A TIMER, because "activity" is not a signal every driver has.
+  //
+  // `beat()` used to be called from exactly ONE place — the live session's
+  // message loop, below — and the two other drivers return before they ever
+  // reach it. So a mediated or subprocess turn renewed the task lease only
+  // incidentally: `report_progress`, which fires only when the CLI happens to
+  // emit a tool activity and is throttled to one per 8s. Meanwhile Antigravity
+  // is handed `--print-timeout 60m` and AGENT_LEASE_TTL_MINUTES is 30, so a
+  // quiet stretch INSIDE a turn we explicitly permitted made the task stale to
+  // `isEligible` and claimable by another worker while it was still building it.
+  // `heartbeat` renews the task lease server-side (refreshTaskLeaseRemote), not
+  // just this token's last-seen, which is exactly the thing that goes stale.
+  //
+  // Fires at half the throttle window; `beat()`'s own guard is what rate-limits
+  // the wire, so session traffic and this timer cannot double up. Started here
+  // rather than in each driver for the same reason the checkpoint timer is
+  // shared: three drivers with three answers is how this diverged once already.
+  const heartbeatTimer = setInterval(beat, 30_000);
+  heartbeatTimer.unref?.();
 
   const flush = async () => {
     if (turnId && turnText.trim()) {
@@ -880,6 +1587,65 @@ export async function runLiveTask({
   };
 
   try {
+    // THE SEAM. Everything above prepared this task — the claim, the checkout,
+    // the branch or patch base, the restored work in progress, the checkpoint
+    // timer and the diffstat sampler — and everything in the `finally` below
+    // tears it down. Only the middle differs by runtime, so only the middle
+    // branches, and a non-live runtime inherits the other two thirds unchanged.
+    if (!session && mediated(rt)) {
+      // No MCP config this runtime can hold, so it is handed none: the daemon
+      // makes every control-plane call itself with this lane's own token.
+      return await driveMediated({
+        runtimeId: rt.id,
+        mcpUrl,
+        token,
+        runId,
+        intentId,
+        title,
+        cwd,
+        brief,
+        isPatch,
+        patchBase,
+        repoRoot,
+        baseRef,
+        label: `[${rt.label}]`,
+        seedText,
+        isAlive,
+        onChild,
+        markLanded: () => {
+          landed = true;
+        },
+      });
+    }
+
+    if (!session) {
+      return await driveSubprocess({
+        runtimeId: rt.id,
+        mcpUrl,
+        token,
+        runId,
+        intentId,
+        title,
+        cwd,
+        brief,
+        isPatch,
+        patchBase,
+        repoRoot,
+        baseRef,
+        label: `[${rt.label}]`,
+        seedText,
+        afterId,
+        isAlive,
+        onChild,
+        // `landed` decides whether the finally deletes this task's WIP ref or
+        // takes one last checkpoint, so the driver has to be able to set it —
+        // returning it would be too late, the finally runs first.
+        markLanded: () => {
+          landed = true;
+        },
+      });
+    }
+
     for await (const m of session) {
       if (!isAlive()) return { outcome: 'blocked', title, intentId };
       beat(); // any session traffic = alive (throttled to 1/min)
@@ -1020,6 +1786,7 @@ export async function runLiveTask({
     return { outcome: 'error', error: e?.message ?? String(e), title, intentId };
   } finally {
     clearInterval(checkpointTimer);
+    clearInterval(heartbeatTimer);
     // Same finally as the checkpoint: every path out of this task — done,
     // parked, rate-limited, thrown — must stop reporting a worktree that is
     // about to stop being this run's.
@@ -1038,14 +1805,17 @@ export async function runLiveTask({
     }
     onChild?.(null); // no longer busy — token may rotate between tasks
     onIntent?.(null);
-    input.close();
+    // Only a live session has a streaming input to close or a generator to
+    // return. The subprocess driver's children are already gone — runTurn awaits
+    // each one — and it clears its own onChild handle per turn.
+    input?.close();
     try {
-      await session.interrupt?.();
+      await session?.interrupt?.();
     } catch {
       /* session already ended */
     }
     try {
-      await session.return?.();
+      await session?.return?.();
     } catch {
       /* generator already closed */
     }