teamshare-bridge 0.27.5 → 0.28.2

package/dist/lib/harness/spawn.js

@@ -1,5 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.isContextOverflowText = isContextOverflowText;
 exports.killTree = killTree;
 exports.isIsolatedTree = isIsolatedTree;
 exports.formatShellContinuation = formatShellContinuation;
@@ -29,6 +30,7 @@ const line_assembler_1 = require("./line-assembler");
 const opencode_outcome_1 = require("./opencode-outcome");
 const opencode_control_1 = require("./opencode-control");
 const activity_1 = require("./activity");
+const turn_watch_1 = require("./turn-watch");
 const agy_pty_1 = require("./agy-pty");
 const prompt_file_1 = require("./prompt-file");
 const diagnostics_1 = require("../diagnostics");
@@ -37,12 +39,6 @@ const relay_key_1 = require("./relay-key");
 const resume_1 = require("./resume");
 const opencode_session_1 = require("../llm/opencode-session");
 const session_store_1 = require("./session-store");
-/**
- * Maximum prompt length before we switch to temp-file delivery.
- * Windows argv limit is 32,767 chars; we leave headroom for binary path,
- * MCP config, and other flags.
- */
-const PROMPT_FILE_THRESHOLD = 28_000;
 /** Real task ids are UUIDs; synthetic keys (chat-<projectId>) are not reported. */
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
 let warnedNoPty = false;
@@ -85,6 +81,37 @@ function createRawCapture(settings) {
 function msg(err) {
     return err instanceof Error ? err.message : String(err);
 }
+/**
+ * Does this harness output line report "the conversation is too big for the
+ * model's context window"? (2026-12)
+ *
+ * Harnesses fail this way in words, not codes, and every vendor phrases it
+ * differently: OpenAI says "maximum context length", Anthropic "prompt is too
+ * long", Gemini "input token count ... exceeds", local models print
+ * "context window exceeded". We only need to recognise it well enough to
+ * ROTATE instead of failing the reply - a false positive costs one fresh
+ * session, a false negative loses the human's message.
+ *
+ * Deliberately narrow: bare "token" or "context" alone would match ordinary
+ * chatter, so each pattern pairs the idea with a limit/exceed verb.
+ */
+function isContextOverflowText(text) {
+    const t = text.toLowerCase();
+    return (/maximum context length/.test(t) ||
+        /context[ _-]?(?:length|window)[^.\n]{0,40}(?:exceed|too (?:long|large|big)|limit)/.test(t) ||
+        /(?:exceed|over)[^.\n]{0,30}(?:context|token) (?:limit|window|length)/.test(t) ||
+        /prompt is too long/.test(t) ||
+        /input token count[^.\n]{0,40}exceed/.test(t) ||
+        /too many (?:input )?tokens/.test(t) ||
+        /(?:reduce|shorten)[^.\n]{0,40}(?:prompt|conversation|messages)/.test(t) ||
+        /context_length_exceeded/.test(t));
+}
+/** The budget a conversational session runs under (project override or default). */
+function contextBudget(limit) {
+    return typeof limit === 'number' && limit > 0
+        ? limit
+        : session_store_1.DEFAULT_CHAT_CONTEXT_TOKENS;
+}
 /**
  * Does this task still have a question a human has not answered?
  *
@@ -261,12 +288,54 @@ function spawnHarness(harness, prompt, log, settings = {}) {
     let resumeReq = settings.resume;
     let preassignedId;
     let priorAttempts = 0;
+    // Context accounting (2026-12): this record is what makes rotation possible.
+    let sessionRecord = store
+        ? (0, session_store_1.peekHarnessSession)(store.agentId, store.taskId, store.mode)
+        : null;
+    /** Characters already in the conversation we are about to resume (2026-12). */
+    let priorContextChars = sessionRecord?.contextChars ?? 0;
+    const budget = contextBudget(settings.contextLimitTokens);
     if (!resumeReq && store && spec && !settings.fresh) {
         const rec = (0, session_store_1.loadHarnessSession)(store.agentId, store.taskId, store.mode, resolved, cwd);
         if (rec) {
-            priorAttempts = rec.attempts ?? 0;
-            resumeReq = { id: rec.id, ...(settings.fork ? { fork: true } : {}) };
-            log(`[resume] continuing ${adapter.name} session ${shortId(rec.id)}`);
+            // ── CONTEXT BUDGET: rotate instead of overflowing ────────────────
+            // A resumed conversation keeps everything it has said. When the estimate
+            // reaches the project's budget we FORGET the session and start a new one
+            // - the alternative is the model eventually hitting its own window in
+            // the middle of a reply, which the human sees as a broken agent.
+            if ((0, session_store_1.sessionContextExceeded)(rec, budget)) {
+                const estimated = (0, session_store_1.estimateSessionTokens)(rec.contextChars);
+                (0, session_store_1.clearHarnessSession)(store.agentId, store.taskId, store.mode);
+                log(`[resume] context budget reached (${estimated.toLocaleString()} of ` +
+                    `${budget.toLocaleString()} estimated tokens) - starting a NEW ` +
+                    `${adapter.name} session so the conversation continues cleanly`);
+                try {
+                    settings.onSessionRotated?.({
+                        reason: 'context-budget',
+                        estimatedTokens: estimated,
+                        limitTokens: budget,
+                        previousSessionId: rec.id,
+                    });
+                }
+                catch {
+                    /* a notice callback must never break the run */
+                }
+                // Keep the rotation count on the NEW record (written after the run).
+                priorContextChars = 0;
+                sessionRecord = {
+                    ...(sessionRecord ?? rec),
+                    rotations: (rec.rotations ?? 0) + 1,
+                    lastRotatedReason: 'context-budget',
+                    contextChars: 0,
+                    turns: 0,
+                    consecutiveFailures: 0,
+                };
+            }
+            else {
+                priorAttempts = rec.attempts ?? 0;
+                resumeReq = { id: rec.id, ...(settings.fork ? { fork: true } : {}) };
+                log(`[resume] continuing ${adapter.name} session ${shortId(rec.id)}`);
+            }
         }
         else if (spec.preassign) {
             preassignedId = (0, resume_1.newHarnessSessionId)();
@@ -302,45 +371,56 @@ function spawnHarness(harness, prompt, log, settings = {}) {
         log(`[harness] ${adapter.binary} not found - install it first.`, 'stderr');
         return Promise.resolve(1);
     }
-    // ── Long prompt → temp file delivery (decided once) ────────────────────
-    let promptFile = null;
-    const longPrompt = prompt.length > PROMPT_FILE_THRESHOLD && adapter.supportsPromptFile;
-    if (longPrompt) {
-        promptFile = (0, prompt_file_1.writePromptFile)(prompt);
-        log(`[harness] prompt too long for argv (${prompt.length} chars) — wrote to temp file`, 'stderr');
-    }
-    const buildArgs = (req, promptOverride) => {
+    // ── Long prompt → file delivery (decided PER INVOCATION) ───────────────
+    //
+    // The decision is taken inside buildArgs, from the prompt ACTUALLY being
+    // sent and from the whole assembled command line. It used to be taken once,
+    // above, and then skipped whenever `promptOverride` was passed - and runOnce
+    // ALWAYS passes it (`buildArgs(req, effectivePrompt)`), so the file was
+    // written, logged, and never used: the 62 KB brief still went on argv and
+    // `spawn` died with `ENAMETOOLONG` before the harness started.
+    const promptFiles = [];
+    /**
+     * Write one prompt file. Never throws: a full/read-only disk must produce a
+     * log line, not an exception on a path that is already a last resort.
+     */
+    const openPromptFile = (text) => {
+        try {
+            const file = (0, prompt_file_1.writePromptFile)(text);
+            promptFiles.push(file);
+            return file;
+        }
+        catch (err) {
+            log(`[harness] could not write the prompt file (${msg(err)}) - ` +
+                'falling back to argv, which may exceed the OS command-line limit', 'stderr');
+            return null;
+        }
+    };
+    const buildArgs = (req, promptForRun) => {
         const opts = req
             ? { ...settings, resume: req }
             : { ...settings, resume: undefined };
-        const effectivePrompt = promptOverride ?? prompt;
-        // A continuation prompt is a SHORT follow-up ("your shell finished, carry
-        // on"), so it is always passed on argv - never re-written to the prompt
-        // file, which still holds the original task brief.
-        if (promptFile && !promptOverride) {
-            if (adapter.promptFileFlag) {
-                const a = adapter.headlessArgs(effectivePrompt, opts, true);
-                a.push(adapter.promptFileFlag, promptFile);
-                return a;
-            }
-            const a = adapter.headlessArgs(effectivePrompt, opts, true);
-            const shortInstruction = `Read the file "${promptFile}" and follow its instructions exactly. ` +
-                'Do not respond until you have read the file. ' +
-                'The file contains your complete instructions including project context, tools, and the user message.';
-            if (['claude', 'gemini', 'antigravity', 'copilot', 'cursor'].includes(resolved)) {
-                a.unshift('-p', shortInstruction);
-            }
-            else {
-                a.push(shortInstruction);
-            }
-            return a;
+        const effectivePrompt = promptForRun ?? prompt;
+        const inline = adapter.headlessArgs(effectivePrompt, opts);
+        const commandLineChars = (0, prompt_file_1.argvChars)([
+            bin.file,
+            ...(bin.args ?? []),
+            ...inline,
+        ]);
+        if (!(0, prompt_file_1.shouldUsePromptFile)(adapter, effectivePrompt.length, commandLineChars)) {
+            return inline;
         }
-        return adapter.headlessArgs(effectivePrompt, opts);
+        const file = openPromptFile(effectivePrompt);
+        if (!file)
+            return inline;
+        log(`[harness] prompt too long for argv (${effectivePrompt.length} chars, ` +
+            `~${commandLineChars} char command line) — wrote it to ${file} and ` +
+            'passed the path instead', 'stderr');
+        return (0, prompt_file_1.promptFileArgs)(adapter, adapter.headlessArgs(effectivePrompt, opts, true), file);
     };
     const cleanupPrompt = () => {
-        if (promptFile)
-            (0, prompt_file_1.cleanupPromptFile)(promptFile);
-        promptFile = null;
+        for (const file of promptFiles.splice(0))
+            (0, prompt_file_1.cleanupPromptFile)(file);
     };
     // Shell/subagent lifecycle (2026-10): OpenCode V2 executes `shell` and
     // subagent work on the SHARED SERVICE. Both can outlive the CLI client and
@@ -375,9 +455,24 @@ function spawnHarness(harness, prompt, log, settings = {}) {
         // project for it. Without this the run's MCP identity config landed in
         // the HUMAN's project, and their interactive session silently acted as
         // the agent (one project = one MCP client).
+        //
+        // STABLE PER CONVERSATION (2026-12). The scope id used to be the bridge
+        // session id, which is new on every wake - so an opencode conversation was
+        // re-registered under a different project directory each run, and a resumed
+        // harness session came from "another project". When the caller has a
+        // conversation scope, the directory is now derived from it, so the same
+        // chat/doc/board/plan conversation always resumes in the same directory.
+        // The agent id is part of the id: two agents answering in one channel are
+        // two conversations and must not share a config directory.
         let scope = null;
         if ((0, run_scope_1.needsRunScope)(settings.cwd)) {
-            scope = (0, run_scope_1.createRunScope)(settings.cwd, settings.sessionId ?? settings.opencodeSessionId ?? `run-${Date.now()}`);
+            const conversationId = store
+                ? `${store.agentId.slice(0, 8)}-${store.taskId}-${store.mode}`
+                : undefined;
+            scope = (0, run_scope_1.createRunScope)(settings.cwd, conversationId ??
+                settings.sessionId ??
+                settings.opencodeSessionId ??
+                `run-${Date.now()}`);
             if (scope)
                 (0, run_scope_1.excludeRunScopeFromGit)(scope.projectRoot);
         }
@@ -544,7 +639,13 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                 // The relay token was minted before the guard could be checked; it must
                 // not linger for a run that never started.
                 void revokeRelayKey(runKey);
-                return { code: 1, resumeFailure: false };
+                return {
+                    code: 1,
+                    resumeFailure: false,
+                    outputChars: 0,
+                    contextOverflow: false,
+                    promptChars: (effectivePrompt ?? prompt).length,
+                };
             }
         }
         const args = buildArgs(req, effectivePrompt);
@@ -580,6 +681,26 @@ function spawnHarness(harness, prompt, log, settings = {}) {
              * kill fires only when ALL of them have been quiet for the budget.
              */
             const activity = new activity_1.ActivityClock();
+            /**
+             * TURN WATCHDOG (2026-11) - see `turn-watch.ts`.
+             *
+             * The activity clock answers "is anything happening ANYWHERE"; this one
+             * answers "is a model turn OPEN with no output", which is the exact shape
+             * of a hung provider call (a `step_start` and then nothing for 19 minutes
+             * was the Aga Autos chat incident). Ladder: warn -> interrupt -> kill.
+             * The kill reuses exit 124 so the conversation is kept for a retry.
+             */
+            const turn = new turn_watch_1.TurnWatch();
+            const turnBudget = (0, turn_watch_1.turnBudgets)(settings.sessionMode ?? store?.mode, settings.timeoutMin ?? 60);
+            const turnWatchOff = /^(0|off|false|no)$/i.test(process.env.TEAMSHARE_TURN_WATCH ?? '');
+            /** One warning / interrupt per step id, so a recovered run is not re-hit. */
+            let turnWarnedStep = null;
+            let turnInterruptedStep = null;
+            let turnInterruptedAt = null;
+            /** Hard guard inputs - real work in flight is never a stall. */
+            let shellRunningNow = false;
+            let relayInFlight = 0;
+            let lastSubagentAt = 0;
             const STALL_WARN_MS = Math.max(1, Number(process.env.TEAMSHARE_STALL_WARN_MIN) || 5) * 60_000;
             const HEARTBEAT_MS = 5 * 60_000;
             /**
@@ -716,6 +837,9 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                                     // A NEW subagent message is real work even though the parent
                                     // CLI printed nothing for it (the line below is OUR log).
                                     activity.note('subagent', `ses ${shortId(child.id)}`);
+                                    // The turn watchdog's "active subagent" guard: a child that
+                                    // is producing output must never be killed as a stalled turn.
+                                    lastSubagentAt = Date.now();
                                     startIdleTimer();
                                     if (Date.now() - lastHeartbeatAt >= HEARTBEAT_MS) {
                                         lastHeartbeatAt = Date.now();
@@ -746,15 +870,33 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                     subagentTimer = null;
                 }
             };
+            // Context accounting for THIS invocation (2026-12).
+            let outputChars = 0;
+            let contextOverflow = false;
             // Line sinks reassemble across pipe chunks: Windows reads cap at 64KB,
             // and a large NDJSON event split mid-line used to fail JSON.parse and
             // print RAW into the console, flooding/breaking the stream (gotchas.md).
             const handleLine = (line, level) => {
                 settings.onRawLine?.(line);
+                // Context accounting (2026-12): every emitted character counts toward
+                // this conversation's budget, and the harness's own "too long" error is
+                // how we learn the model's window is smaller than the project setting.
+                outputChars += line.length + 1;
+                if (!contextOverflow && isContextOverflowText(line)) {
+                    contextOverflow = true;
+                }
                 // A transcript is a log, not a vault: a key the model echoes must not
                 // reach the console or the diagnostic sidecar (2026-10-25).
                 const safeLine = (0, diagnostics_1.scrubSecrets)(line);
                 rawCapture(safeLine);
+                // TURN WATCHDOG (2026-11): feed the open-step clock. A `step_start`
+                // that never reaches `step_finish` is a hung model turn, not work -
+                // see `turn-watch.ts` for the incident this exists for.
+                if (!turnWatchOff && resolved === 'opencode') {
+                    const turnEvent = (0, turn_watch_1.extractTurnEvent)(line);
+                    if (turnEvent)
+                        turn.note(turnEvent);
+                }
                 // SCOPE GUARD (2026-10-25): see `tripScopeGuard`.
                 tripScopeGuard(safeLine);
                 // Track background shells the service owns (they outlive this CLI).
@@ -813,7 +955,14 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                 if (killTimer)
                     clearTimeout(killTimer);
                 cleanMcp();
-                resolve({ code: scopeAborted ? 1 : code, resumeFailure, capturedId });
+                resolve({
+                    code: scopeAborted ? 1 : code,
+                    resumeFailure,
+                    capturedId,
+                    outputChars,
+                    contextOverflow,
+                    promptChars: (effectivePrompt ?? prompt).length,
+                });
             };
             const startIdleTimer = () => {
                 if (killTimer)
@@ -887,6 +1036,9 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                         if (settled)
                             return;
                         const now = Date.now();
+                        // Turn-watchdog guards are re-derived every tick: a shell that
+                        // exited must stop shielding a stalled turn, and vice versa.
+                        shellRunningNow = false;
                         // 1) Relayed MCP/tool activity. Give up after 3 misses (no daemon,
                         //    or a run wired straight to the API) instead of polling forever.
                         if (runKey && relayProbeMisses < 3) {
@@ -896,6 +1048,9 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                             }
                             else {
                                 relayProbeMisses = 0;
+                                // A call that has not answered yet is work in flight, so the
+                                // turn watchdog must not treat the silence as a hung model.
+                                relayInFlight = signal.inFlight;
                                 if (signal.lastActivityAt > lastRelayActivityAt) {
                                     lastRelayActivityAt = signal.lastActivityAt;
                                     activity.note('mcp', signal.lastTool ?? 'tool call');
@@ -941,6 +1096,9 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                                     continue;
                                 }
                                 activity.note('shell', shell.command ?? shell.id);
+                                // HARD GUARD: a running command is real work. The turn
+                                // watchdog must never kill a run the agent is waiting on.
+                                shellRunningNow = true;
                                 startIdleTimer();
                                 heartbeat(`background shell ${shell.command ?? shell.id} is still running`);
                                 break;
@@ -963,6 +1121,110 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                                 ? 'no output at all'
                                 : `no stdout for ${Math.max(1, stdoutMin)} min`} - last activity: ${(0, activity_1.activityActor)(latest)}. Not dead unless the ${Math.max(1, Math.round(timeoutMs / 60_000))} min idle timeout is reached.`, 'stdout');
                         }
+                        // 4) TURN WATCHDOG (2026-11) - see `turn-watch.ts`.
+                        //
+                        //    The activity clock above is deliberately patient: it cannot
+                        //    tell a hung provider call from a long tool call, so it waits the
+                        //    full idle budget. A model turn that OPENED and never produced a
+                        //    token is not ambiguous, though - it is the Aga Autos incident
+                        //    (a `step_start`, then 19 silent minutes). Ladder: warn ->
+                        //    interrupt -> kill, and the kill reuses exit 124 so the
+                        //    conversation is kept for a retry instead of starting over.
+                        if (!turnWatchOff && !settled) {
+                            const turnSnap = turn.snapshot();
+                            // A DIFFERENT step means the session recovered (or moved on):
+                            // clear the interrupt latch so the next stall is judged fresh.
+                            if (turnInterruptedStep !== null &&
+                                turnSnap.stepId !== turnInterruptedStep) {
+                                turnInterruptedStep = null;
+                                turnInterruptedAt = null;
+                            }
+                            const verdict = (0, turn_watch_1.decideTurnAction)({
+                                snapshot: turnSnap,
+                                now,
+                                budgets: turnBudget,
+                                inFlightMcp: relayInFlight,
+                                shellRunning: shellRunningNow,
+                                subagentActive: lastSubagentAt > 0 &&
+                                    now - lastSubagentAt < turnBudget.subagentGraceMs,
+                                interruptedAt: turnInterruptedAt,
+                            });
+                            const stepKey = turnSnap.stepId ?? `step-${turnSnap.stepOpenedAt ?? 0}`;
+                            if (verdict.action === 'warn' && turnWarnedStep !== stepKey) {
+                                turnWarnedStep = stepKey;
+                                log(`[harness] ${adapter.name} model turn open for ` +
+                                    `${Math.max(1, Math.round(verdict.openForMs / 60_000))} min, ` +
+                                    `silent for ${Math.max(1, Math.round(verdict.silentMs / 60_000))} min ` +
+                                    `(${verdict.reason}) - interrupting at ` +
+                                    `${Math.round(turnBudget.interruptMs / 60_000)} min, killing at ` +
+                                    `${Math.round(turnBudget.killMs / 60_000)} min unless it recovers`, 'stderr');
+                                (0, diagnostics_1.reportDiagnosticSafe)({
+                                    kind: 'harness_failure',
+                                    severity: 'warning',
+                                    message: `model turn stalled (${verdict.reason})`,
+                                    errorCode: 'HARNESS_TURN_STALL',
+                                    agentId: store?.agentId,
+                                    context: {
+                                        harness: resolved,
+                                        mode: settings.sessionMode ?? null,
+                                        runKey: runKey ?? null,
+                                        openForMs: verdict.openForMs,
+                                        silentMs: verdict.silentMs,
+                                    },
+                                });
+                            }
+                            if (verdict.action === 'interrupt' &&
+                                turnInterruptedStep !== stepKey) {
+                                turnInterruptedStep = stepKey;
+                                turnInterruptedAt = now;
+                                log(`[harness] ${adapter.name} model turn stalled ` +
+                                    `(${verdict.reason}) - interrupting the service session so it ` +
+                                    'can continue; no work is lost', 'stderr');
+                                if (capturedId)
+                                    await (0, opencode_control_1.interruptOpencodeSession)(capturedId);
+                            }
+                            if (verdict.action === 'kill') {
+                                // Same contract as the idle kill: OUR decision, not a broken
+                                // conversation, so the session is kept for a retry.
+                                idleKilled = true;
+                                forcedExitCode = 124;
+                                log(`[harness] ${adapter.name} model turn stalled ` +
+                                    `(${verdict.reason}) - killing the run; the conversation is ` +
+                                    'kept so the next attempt continues it', 'stderr');
+                                (0, diagnostics_1.reportDiagnosticSafe)({
+                                    kind: 'harness_failure',
+                                    severity: 'error',
+                                    message: `model turn stalled and was killed (${verdict.reason})`,
+                                    errorCode: 'HARNESS_TURN_STALLED',
+                                    agentId: store?.agentId,
+                                    context: {
+                                        harness: resolved,
+                                        mode: settings.sessionMode ?? null,
+                                        runKey: runKey ?? null,
+                                        openForMs: verdict.openForMs,
+                                        silentMs: verdict.silentMs,
+                                    },
+                                });
+                                // Interrupt FIRST: on OpenCode V2 the shared service owns the
+                                // turn, so killing the CLI alone leaves a silent session.
+                                if (capturedId)
+                                    await (0, opencode_control_1.interruptOpencodeSession)(capturedId);
+                                try {
+                                    killTree(child.pid);
+                                }
+                                catch {
+                                    /* ignore */
+                                }
+                                try {
+                                    child.kill();
+                                }
+                                catch {
+                                    /* ignore */
+                                }
+                                done(124);
+                                return;
+                            }
+                        }
                     })();
                 }, 30_000);
                 activityTimer.unref?.();
@@ -1018,11 +1280,33 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                 done(forcedExitCode ?? code ?? 1);
             });
         }).catch((err) => {
-            // `spawn()` can throw SYNCHRONOUSLY (bad argv, ENOENT before the `error`
-            // event), which means the `close` handler above never runs. Clean the MCP
-            // config here too - it holds the agent API key - and let the rejection
-            // reach the caller.
+            // `spawn()` can throw SYNCHRONOUSLY (bad argv, ENAMETOOLONG, ENOENT
+            // before the `error` event), which means the `close` handler above never
+            // runs. Clean the MCP config here too - it holds the agent API key - and
+            // let the rejection reach the caller.
             cleanMcp();
+            // A raw `spawn ENAMETOOLONG` reaches the task as if the binary were
+            // broken. Name the real cause and the fix instead.
+            if (err?.code === 'ENAMETOOLONG') {
+                const detail = `the ${adapter.name} command line was too long to start ` +
+                    `(prompt ${prompt.length} chars, OS limit ~32k). Shorten the task ` +
+                    'brief / project context, or use a harness that supports prompt files.';
+                log(`[harness] ${detail}`, 'stderr');
+                (0, diagnostics_1.reportDiagnosticSafe)({
+                    kind: 'harness_failure',
+                    severity: 'error',
+                    message: detail,
+                    errorCode: 'HARNESS_ENAMETOOLONG',
+                    agentId: settings.sessionStore?.agentId,
+                    context: {
+                        harness: adapter.name,
+                        promptChars: prompt.length,
+                        mode: settings.sessionMode ?? null,
+                        taskId: settings.sessionStore?.taskId ?? null,
+                    },
+                });
+                throw new Error(`spawn ENAMETOOLONG: ${detail}`);
+            }
             throw err;
         });
     };
@@ -1037,9 +1321,35 @@ function spawnHarness(harness, prompt, log, settings = {}) {
         // a pre-assigned fresh run that fails just clears below.
         const wasContinuation = Boolean(resumeReq?.id || resumeReq?.latest);
         if (wasContinuation && (result.resumeFailure || result.code !== 0)) {
-            log('[resume] continuation failed - starting a fresh session', 'stderr');
+            // ── CONTEXT OVERFLOW IS A ROTATION, NOT A FAILURE (2026-12) ────────
+            //
+            // The project budget was below the model's real window (or the estimate
+            // drifted low), so the model itself refused the prompt. Forgetting the
+            // session and retrying once fresh is exactly what a human wants: the
+            // reply still happens, and the next turn starts a clean conversation.
+            if (result.contextOverflow) {
+                const estimated = (0, session_store_1.estimateSessionTokens)(sessionRecord?.contextChars ?? 0);
+                log(`[resume] the model rejected this conversation as too long - ` +
+                    `starting a NEW session for this turn`, 'stderr');
+                try {
+                    settings.onSessionRotated?.({
+                        reason: 'context-overflow',
+                        estimatedTokens: estimated,
+                        limitTokens: budget,
+                        previousSessionId: resumeReq?.id,
+                    });
+                }
+                catch {
+                    /* a notice callback must never break the run */
+                }
+            }
+            else {
+                log('[resume] continuation failed - starting a fresh session', 'stderr');
+            }
             if (store)
                 (0, session_store_1.clearHarnessSession)(store.agentId, store.taskId, store.mode);
+            // The conversation restarted: its context estimate restarts with it.
+            priorContextChars = 0;
             preassignedId = spec?.preassign ? (0, resume_1.newHarnessSessionId)() : undefined;
             const freshReq = preassignedId
                 ? { preassignId: preassignedId }
@@ -1237,11 +1547,38 @@ function spawnHarness(harness, prompt, log, settings = {}) {
             // "the session is poisoned". Discarding it made the retry repeat hours
             // of work from zero. Real harness failures still forget the session.
             const keepForIdleResume = failedRun && idleKilled && Boolean(finalReq?.id ?? result.capturedId);
-            if (failedRun && !questionStillOpen && !keepForIdleResume) {
+            // ── CONVERSATIONAL MODES KEEP THEIR CONVERSATION (2026-12) ──────────
+            //
+            // A chat / doc / board reply is ONE TURN of a long conversation. Clearing
+            // the session on every non-zero exit means a single transient provider
+            // error silently restarts the thread from zero - the human sees an agent
+            // that "forgot everything". The agent-loop rule (a failed attempt's
+            // session is consumed) exists because a retry must not resume a poisoned
+            // planning session; a conversation is different, so it gets one retry and
+            // is replaced only after the SECOND consecutive failure.
+            //
+            // `failedRun` is REQUIRED here (2026-11): without it a SUCCESSFUL turn
+            // took this branch too, and logged "run failed (attempt 0) - KEEPING the
+            // conversation" on every single reply. Live case: a chat mention answered
+            // the question, posted the message through MCP, exited 0 - and the
+            // console still said the run failed.
+            const conversational = session_store_1.CONVERSATIONAL_MODES.has(store.mode);
+            const failureCount = failedRun
+                ? Math.max(1, (0, session_store_1.noteHarnessSessionFailure)(store.agentId, store.taskId, store.mode, `${adapter.name} exited with code ${finalCode}`))
+                : 0;
+            const keepForConversation = failedRun && conversational && failureCount < 2;
+            if (failedRun &&
+                !questionStillOpen &&
+                !keepForIdleResume &&
+                !keepForConversation) {
                 (0, session_store_1.clearHarnessSession)(store.agentId, store.taskId, store.mode);
                 log(`[resume] run failed - forgetting session (next attempt starts fresh)`);
             }
             else if (spec.capture !== 'none') {
+                if (keepForConversation) {
+                    log(`[resume] run failed (attempt ${failureCount} of 2) - keeping the ` +
+                        `conversation so the next message continues instead of starting over`, 'stderr');
+                }
                 if (questionStillOpen) {
                     log(`[resume] run failed but a question is still open - keeping the ` +
                         `session so the human's answer can resume it`);
@@ -1270,6 +1607,18 @@ function spawnHarness(harness, prompt, log, settings = {}) {
                         createdAt: now,
                         lastUsedAt: now,
                         attempts: priorAttempts + 1,
+                        // Context accounting (2026-12): what this turn ADDED to the
+                        // conversation. `priorContextChars` is 0 whenever the session was
+                        // rotated/replaced, so a new conversation starts counting clean.
+                        contextChars: priorContextChars + result.promptChars + result.outputChars,
+                        turns: (sessionRecord?.turns ?? 0) + 1,
+                        consecutiveFailures: 0,
+                        ...(sessionRecord?.rotations
+                            ? { rotations: sessionRecord.rotations }
+                            : {}),
+                        ...(sessionRecord?.lastRotatedReason
+                            ? { lastRotatedReason: sessionRecord.lastRotatedReason }
+                            : {}),
                     });
                     log(`[resume] recorded ${adapter.name} session ${shortId(id)} for future runs`);
                     // ONE lightweight report per run (never per line) so the cloud can
@@ -1326,9 +1675,11 @@ async function readRelayActivity(runKey) {
         const at = Number(body.lastActivityAt);
         if (!Number.isFinite(at) || at <= 0)
             return null;
+        const inFlight = Number(body.inFlight);
         return {
             lastActivityAt: at,
             lastTool: typeof body.lastTool === 'string' ? body.lastTool : null,
+            inFlight: Number.isFinite(inFlight) && inFlight > 0 ? inFlight : 0,
         };
     }
     catch {
@@ -1392,28 +1743,33 @@ function spawnThroughPty(binary, prompt, log, settings, name) {
     const adapterLike = (0, harness_adapter_1.getAdapter)(name);
     let promptFile = null;
     let args;
-    if (prompt.length > PROMPT_FILE_THRESHOLD && adapterLike.supportsPromptFile) {
-        promptFile = (0, prompt_file_1.writePromptFile)(prompt);
-        log(`[harness] prompt too long for argv (${prompt.length} chars) — wrote to temp file`, 'stderr');
-        if (adapterLike.promptFileFlag) {
-            args = adapterLike.headlessArgs(prompt, settings, true);
-            args.push(adapterLike.promptFileFlag, promptFile);
+    const inlineArgs = adapterLike.headlessArgs(prompt, settings);
+    const commandLineChars = (0, prompt_file_1.argvChars)([
+        bin.file,
+        ...(bin.args ?? []),
+        ...inlineArgs,
+    ]);
+    if ((0, prompt_file_1.shouldUsePromptFile)(adapterLike, prompt.length, commandLineChars)) {
+        try {
+            promptFile = (0, prompt_file_1.writePromptFile)(prompt);
+        }
+        catch (err) {
+            promptFile = null;
+            log(`[harness] could not write the prompt file (${msg(err)}) - ` +
+                'falling back to argv, which may exceed the OS command-line limit', 'stderr');
+        }
+        if (promptFile) {
+            log(`[harness] prompt too long for argv (${prompt.length} chars, ` +
+                `~${commandLineChars} char command line) — wrote it to ` +
+                `${promptFile} and passed the path instead`, 'stderr');
+            args = (0, prompt_file_1.promptFileArgs)(adapterLike, adapterLike.headlessArgs(prompt, settings, true), promptFile);
         }
         else {
-            args = adapterLike.headlessArgs(prompt, settings, true);
-            const shortInstruction = `Read the file "${promptFile}" and follow its instructions exactly. ` +
-                'Do not respond until you have read the file. ' +
-                'The file contains your complete instructions including project context, tools, and the user message.';
-            if (['claude', 'gemini', 'antigravity', 'copilot', 'cursor'].includes(name)) {
-                args.unshift('-p', shortInstruction);
-            }
-            else {
-                args.push(shortInstruction);
-            }
+            args = inlineArgs;
         }
     }
     else {
-        args = adapterLike.headlessArgs(prompt, settings);
+        args = inlineArgs;
     }
     let mcpOverride = null;
     if (adapterLike.supportsMcp &&