totemlayer 0.1.5 → 0.1.6

package/bin/collaboration-listener.mjs

@@ -7,9 +7,9 @@ import { setTimeout as sleep } from "node:timers/promises";
 
 import { inspectLocalRepository } from "./repository.mjs";
 import { localClientEnvironment, streamingClientInvocation } from "./platform-client.mjs";
+import { runFile } from "./mission-worker.mjs";
 
 const MAX_RUNS_PER_TASK = 16;
-const MAX_OUTPUT_BYTES = 2 * 1024 * 1024;
 const MAX_PROMPT_BYTES = 32 * 1024;
 const DEFAULT_RUN_TIMEOUT_MS = 15 * 60 * 1000;
 
@@ -84,7 +84,10 @@ function runnerCommand(provider, sessionId, platform = process.platform) {
   if (provider === "codex")
     invocation = sessionId
       ? { command: "codex", args: ["exec", "resume", "--json", sessionId, "-"] }
-      : { command: "codex", args: ["exec", "--sandbox", "workspace-write", "--json", "-"] };
+      : {
+          command: "codex",
+          args: ["exec", "--sandbox", "workspace-write", "--json", "-"],
+        };
   else if (provider === "claude")
     invocation = {
       command: "claude",
@@ -106,7 +109,9 @@ function runnerCommand(provider, sessionId, platform = process.platform) {
 }
 
 function runnerEnvironment(repositoryRoot, environment = process.env) {
-  return localClientEnvironment(environment, { TOTEM_REPOSITORY_ROOT: repositoryRoot });
+  return localClientEnvironment(environment, {
+    TOTEM_REPOSITORY_ROOT: repositoryRoot,
+  });
 }
 
 export async function runLocalCollaborationAgent({
@@ -120,79 +125,42 @@ export async function runLocalCollaborationAgent({
   spawnProcess = spawn,
 }) {
   const { command, args } = runnerCommand(provider, sessionId, platform);
-  return new Promise((resolveRun, rejectRun) => {
-    const child = spawnProcess(command, args, {
-      cwd: repositoryRoot,
-      env: runnerEnvironment(repositoryRoot),
-      stdio: ["pipe", "pipe", "pipe"],
-      shell: false,
-    });
-    let output = "";
-    let totalOutputBytes = 0;
-    let observedSession = sessionId ?? null;
-    let finalResponse = "";
-    let finished = false;
-    const fail = (error) => {
-      if (finished) return;
-      finished = true;
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", abort);
-      rejectRun(error);
-    };
-    const abort = () => child.kill("SIGTERM");
-    const timer = setTimeout(() => child.kill("SIGTERM"), timeoutMs);
-    signal?.addEventListener("abort", abort, { once: true });
-    if (signal?.aborted) abort();
-    child.stdout.on("data", (chunk) => {
-      totalOutputBytes += chunk.byteLength;
-      output += chunk.toString("utf8");
-      if (totalOutputBytes > MAX_OUTPUT_BYTES) child.kill("SIGTERM");
-      if (provider !== "codex") return;
-      let newline;
-      while ((newline = output.indexOf("\n")) >= 0) {
-        const line = output.slice(0, newline);
-        output = output.slice(newline + 1);
-        try {
-          const event = JSON.parse(line);
-          if (event.type === "thread.started" && typeof event.thread_id === "string")
-            observedSession = event.thread_id;
-          if (event.type === "item.completed" && event.item?.type === "agent_message")
-            finalResponse = String(event.item.text ?? "");
-        } catch {
-          // Ignore non-JSON progress lines; never echo model output to CLI logs.
-        }
-      }
-    });
-    child.stderr.on("data", () => {});
-    child.once("error", (error) => fail(error));
-    child.once("close", (code) => {
-      if (finished) return;
-      if (signal?.aborted) return fail(new Error("The collaboration listener was stopped."));
-      if (code !== 0)
-        return fail(
-          new Error(
-            `The ${provider} run exited with status ${code ?? "unknown"}. Check that client's local logs and permissions.`,
-          ),
-        );
-      if (provider === "claude") {
-        try {
-          const result = JSON.parse(output);
-          observedSession = result.session_id ?? observedSession;
-          finalResponse = typeof result.result === "string" ? result.result : "";
-          if (result.is_error) return fail(new Error("Claude reported a failed run."));
-        } catch {
-          return fail(new Error("Claude returned an invalid JSON result."));
-        }
-      }
-      if (!observedSession)
-        return fail(new Error(`${provider} did not return a resumable session ID.`));
-      finished = true;
-      clearTimeout(timer);
-      signal?.removeEventListener("abort", abort);
-      resolveRun({ sessionId: observedSession, finalResponse });
-    });
-    child.stdin.end(prompt);
+  const { stdout } = await runFile(command, args, {
+    cwd: repositoryRoot,
+    env: runnerEnvironment(repositoryRoot),
+    input: prompt,
+    signal,
+    timeoutMs,
+    platform,
+    spawnProcess,
   });
+  let observedSession = sessionId ?? null;
+  let finalResponse = "";
+  if (provider === "claude") {
+    let result;
+    try {
+      result = JSON.parse(stdout);
+    } catch {
+      throw new Error("Claude returned an invalid JSON result.");
+    }
+    observedSession = result.session_id ?? observedSession;
+    finalResponse = typeof result.result === "string" ? result.result : "";
+    if (result.is_error) throw new Error("Claude reported a failed run.");
+  } else {
+    for (const line of stdout.split("\n")) {
+      try {
+        const event = JSON.parse(line);
+        if (event.type === "thread.started" && typeof event.thread_id === "string")
+          observedSession = event.thread_id;
+        if (event.type === "item.completed" && event.item?.type === "agent_message")
+          finalResponse = String(event.item.text ?? "");
+      } catch {
+        // Ignore non-JSON progress lines; never echo model output to CLI logs.
+      }
+    }
+  }
+  if (!observedSession) throw new Error(`${provider} did not return a resumable session ID.`);
+  return { sessionId: observedSession, finalResponse };
 }
 
 async function readJournal(file) {
@@ -216,7 +184,12 @@ async function latestOutboundTaskCursor(client, taskId, cursor, signal) {
   let latest = cursor;
   for (let page = 0; page < 20; page++) {
     const result = await client.messages.list(
-      { direction: "outbound", taskId, limit: 100, ...(latest ? { cursor: latest } : {}) },
+      {
+        direction: "outbound",
+        taskId,
+        limit: 100,
+        ...(latest ? { cursor: latest } : {}),
+      },
       { signal },
     );
     const messages = result.data ?? [];
@@ -247,7 +220,9 @@ export async function runCollaborationListener({
   if (!Number.isInteger(pollMs) || pollMs < 1000 || pollMs > 60000)
     throw new Error("--poll-ms must be between 1000 and 60000.");
   const root = resolve(repositoryRoot);
-  const repository = await inspectLocalRepository({ TOTEM_REPOSITORY_ROOT: root });
+  const repository = await inspectLocalRepository({
+    TOTEM_REPOSITORY_ROOT: root,
+  });
   const identity = await client.agent({ signal });
   const peer = await client.resolve(peerAddress, { signal });
   if (!peer?.id || peer.address !== peerAddress) throw new Error("The allowed peer was not found.");
@@ -267,7 +242,12 @@ export async function runCollaborationListener({
   }
   try {
     const journal = await readJournal(journalFile);
-    const binding = { agentId: identity.id, peerAddress, repository: repository.repository, root };
+    const binding = {
+      agentId: identity.id,
+      peerAddress,
+      repository: repository.repository,
+      root,
+    };
     if (journal.binding && JSON.stringify(journal.binding) !== JSON.stringify(binding))
       throw new Error("This journal belongs to a different agent, peer, or checkout.");
     if (!journal.binding) {
@@ -301,7 +281,11 @@ export async function runCollaborationListener({
             continue;
           }
           if (prior?.status === "started" || prior?.status === "failed") {
-            emit({ type: "needs_attention", messageId: message.id, taskId: message.taskId });
+            emit({
+              type: "needs_attention",
+              messageId: message.id,
+              taskId: message.taskId,
+            });
             continue;
           }
           const task = await client.tasks.get(message.taskId, { signal });
@@ -352,7 +336,12 @@ export async function runCollaborationListener({
           const outboundBefore = await latestOutboundTaskCursor(client, task.id, undefined, signal);
           journal.messages[message.id] = { status: "started", taskId: task.id };
           await saveJournal(journalFile, journal);
-          emit({ type: "started", messageId: message.id, taskId: task.id, provider });
+          emit({
+            type: "started",
+            messageId: message.id,
+            taskId: task.id,
+            provider,
+          });
           try {
             const result = await runAgent({
               provider,
@@ -377,12 +366,23 @@ export async function runCollaborationListener({
               sessionId: result.sessionId,
               runCount: (savedTask?.runCount ?? 0) + 1,
             };
-            journal.messages[message.id] = { status: "completed", taskId: task.id };
+            journal.messages[message.id] = {
+              status: "completed",
+              taskId: task.id,
+            };
             await saveJournal(journalFile, journal);
             await client.messages.ack(message.id, { signal });
-            emit({ type: "completed", messageId: message.id, taskId: task.id, provider });
+            emit({
+              type: "completed",
+              messageId: message.id,
+              taskId: task.id,
+              provider,
+            });
           } catch (error) {
-            journal.messages[message.id] = { status: "failed", taskId: task.id };
+            journal.messages[message.id] = {
+              status: "failed",
+              taskId: task.id,
+            };
             await saveJournal(journalFile, journal);
             await client.tasks
               .postUpdate(task.id, listenerStatusText(provider, "failed"), {

package/bin/docker-test-sandbox.mjs

@@ -36,7 +36,7 @@ export async function runDockerNodeTests(checkout, signal, runFile) {
         "--env",
         "TMPDIR=/tmp",
         "--mount",
-        `type=bind,source=${root},target=/workspace`,
+        `type=bind,source=${root},target=/workspace,readonly`,
         "--workdir",
         "/workspace",
         NODE_TEST_IMAGE,

package/bin/mcp.mjs

@@ -8,7 +8,7 @@ import * as z from "zod/v4";
 import { Totem } from "./sdk/index.js";
 import { inspectLocalRepository, verifyLocalRepoClaim } from "./repository.mjs";
 
-const VERSION = "0.1.5";
+const VERSION = "0.1.6";
 const MAX_KEY_BYTES = 8 * 1024;
 const MAX_ATTACHMENT_BYTES = 2 * 1024 * 1024;
 const collaborationSchema = z

package/bin/mission-worker.mjs

@@ -52,7 +52,10 @@ const SOURCE_CHANGE = {
   ...FILE_CHANGE,
   properties: {
     ...FILE_CHANGE.properties,
-    path: { ...CODE_PATH, pattern: CODE_PATH.pattern.replace("^(src|test|tests)/", "^src/") },
+    path: {
+      ...CODE_PATH,
+      pattern: CODE_PATH.pattern.replace("^(src|test|tests)/", "^src/"),
+    },
   },
 };
 const TEST_CHANGE = {
@@ -98,7 +101,10 @@ const OUTPUT_SCHEMAS = {
   },
   engineering: {
     summary: TEXT,
-    verdict: { type: "string", enum: ["feasible", "changes_required", "rejected"] },
+    verdict: {
+      type: "string",
+      enum: ["feasible", "changes_required", "rejected"],
+    },
     findings: STRINGS,
     spec: TEXT,
     candidateTitle: TEXT,
@@ -113,11 +119,19 @@ const OUTPUT_SCHEMAS = {
   code: {
     summary: TEXT,
     changes: { type: "array", items: SOURCE_CHANGE, minItems: 1, maxItems: 3 },
-    testChanges: { type: "array", items: TEST_CHANGE, minItems: 1, maxItems: 1 },
+    testChanges: {
+      type: "array",
+      items: TEST_CHANGE,
+      minItems: 1,
+      maxItems: 1,
+    },
   },
   review: {
     summary: TEXT,
-    verdict: { type: "string", enum: ["approved", "changes_required", "rejected"] },
+    verdict: {
+      type: "string",
+      enum: ["approved", "changes_required", "rejected"],
+    },
     findings: STRINGS,
     probes: { type: "array", items: REVIEW_PROBE, maxItems: 3 },
   },
@@ -252,7 +266,12 @@ function rejectedResponseEvidence(response) {
   } catch {
     // Malformed text cannot be safely interpreted as credential-bearing fields.
     // Preserve a fingerprint and length without storing its raw fragments.
-    return { ...metadata, response: null, responseOmitted: "malformed_json", truncated: false };
+    return {
+      ...metadata,
+      response: null,
+      responseOmitted: "malformed_json",
+      truncated: false,
+    };
   }
 }
 
@@ -449,7 +468,9 @@ function structuredEvent(stage, response) {
           outcome: output.outcome.slice(0, 4000),
           selected: output.selected,
           ...(typeof output.selectedCandidateTitle === "string"
-            ? { selectedCandidateTitle: output.selectedCandidateTitle.slice(0, 160) }
+            ? {
+                selectedCandidateTitle: output.selectedCandidateTitle.slice(0, 160),
+              }
             : {}),
           ...(typeof output.rationale === "string"
             ? { rationale: output.rationale.slice(0, 4000) }
@@ -461,7 +482,10 @@ function structuredEvent(stage, response) {
         break;
       return {
         type: "completion",
-        payload: { summary: output.summary.slice(0, 4000), result: output.result },
+        payload: {
+          summary: output.summary.slice(0, 4000),
+          result: output.result,
+        },
       };
   }
   throw new Error("The agent returned a malformed stage result.");
@@ -540,13 +564,22 @@ export function verifiedHandoff(mission, events, response) {
 export function runFile(
   command,
   args,
-  { cwd, input, signal, timeoutMs = 15 * 60_000, env, acceptNonZero = false } = {},
+  {
+    cwd,
+    input,
+    signal,
+    timeoutMs = 15 * 60_000,
+    env,
+    acceptNonZero = false,
+    platform = process.platform,
+    spawnProcess = spawn,
+  } = {},
 ) {
   if (signal?.aborted)
     return Promise.reject(signal.reason ?? new Error("The command was interrupted."));
   return new Promise((resolveRun, rejectRun) => {
-    const grouped = process.platform !== "win32";
-    const child = spawn(command, args, {
+    const grouped = platform !== "win32";
+    const child = spawnProcess(command, args, {
       cwd,
       env,
       shell: false,
@@ -597,13 +630,24 @@ export function runFile(
         if (!grouped) {
           // Windows has no POSIX process groups; taskkill /T includes descendants.
           await new Promise((resolveKill, rejectKill) => {
-            const killer = spawn("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
+            const killer = spawnProcess("taskkill", ["/PID", String(child.pid), "/T", "/F"], {
               shell: false,
               stdio: "ignore",
               windowsHide: true,
             });
-            killer.once("error", rejectKill);
-            killer.once("close", resolveKill);
+            const killTimer = setTimeout(() => {
+              killer.kill("SIGKILL");
+              rejectKill(new Error("Windows process-tree cleanup timed out."));
+            }, 5_000);
+            killer.once("error", (error) => {
+              clearTimeout(killTimer);
+              rejectKill(error);
+            });
+            killer.once("close", (code) => {
+              clearTimeout(killTimer);
+              if (code === 0) resolveKill();
+              else rejectKill(new Error(`Windows process-tree cleanup exited with status ${code}.`));
+            });
           });
           return;
         }
@@ -622,6 +666,8 @@ export function runFile(
         // Give the kernel time to reap killed descendants before checkout cleanup.
         for (let wait = 0; wait < 20 && groupExists(); wait += 1) await sleep(25);
       })().catch((cleanupError) => {
+        // Report an uncertain cleanup failure even if the client never closes.
+        closed = true;
         stopError = new Error(
           `${command} was interrupted but process cleanup failed: ${cleanupError.message}`,
         );
@@ -1021,7 +1067,15 @@ function testSourceTokens(source) {
       }
       if (char === "\\") {
         const escaped = source[index++];
-        const simple = { n: "\n", r: "\r", t: "\t", b: "\b", f: "\f", v: "\v", 0: "\0" };
+        const simple = {
+          n: "\n",
+          r: "\r",
+          t: "\t",
+          b: "\b",
+          f: "\f",
+          v: "\v",
+          0: "\0",
+        };
         if (escaped === "\n") continue;
         if (escaped === "\r") {
           if (source[index] === "\n") index += 1;
@@ -1294,7 +1348,9 @@ async function existingNodeTestTitles(checkout) {
   let entriesSeen = 0;
   let bytes = 0;
   const visit = async (relative = "") => {
-    for (const entry of await readdir(join(checkout, relative), { withFileTypes: true })) {
+    for (const entry of await readdir(join(checkout, relative), {
+      withFileTypes: true,
+    })) {
       if ([".git", "node_modules"].includes(entry.name)) continue;
       if (++entriesSeen > 5000)
         throw new Error(
@@ -1498,7 +1554,10 @@ async function runStructuredMissionAgent({
                 ...TEST_CHANGE,
                 properties: {
                   ...TEST_CHANGE.properties,
-                  path: { ...TEST_CHANGE.properties.path, const: regressionFile.path },
+                  path: {
+                    ...TEST_CHANGE.properties.path,
+                    const: regressionFile.path,
+                  },
                 },
               },
             },
@@ -1511,7 +1570,11 @@ async function runStructuredMissionAgent({
     required: Object.keys(properties),
     additionalProperties: false,
   };
-  const endpoint = missionModelEndpoint(provider, { ollamaUrl, qwenUrl, nimUrl });
+  const endpoint = missionModelEndpoint(provider, {
+    ollamaUrl,
+    qwenUrl,
+    nimUrl,
+  });
   model ??=
     provider === "qwen-local"
       ? "qwen3.5-9b"
@@ -1556,7 +1619,11 @@ async function runStructuredMissionAgent({
           : {
               think: useReasoning,
               format: schema,
-              options: { num_ctx: 16_384, num_predict: generationLimit, temperature: 0.1 },
+              options: {
+                num_ctx: 16_384,
+                num_predict: generationLimit,
+                temperature: 0.1,
+              },
             }),
         messages: [
           {
@@ -1585,7 +1652,10 @@ async function runStructuredMissionAgent({
           });
     } catch (error) {
       if (rejectionEvidenceDirectory) {
-        await mkdir(rejectionEvidenceDirectory, { recursive: true, mode: 0o700 });
+        await mkdir(rejectionEvidenceDirectory, {
+          recursive: true,
+          mode: 0o700,
+        });
         await chmod(rejectionEvidenceDirectory, 0o700);
         await saveJournal(join(rejectionEvidenceDirectory, `response-${attempt + 1}.json`), {
           capturedAt: new Date().toISOString(),
@@ -1654,7 +1724,9 @@ export async function preflightMissionRepository(mission, repositoryRoot) {
   const base = mission.repository?.baseRevision;
   if (!mission.repository || !COMMIT.test(base ?? ""))
     throw new Error("The mission needs a selected repository with a full commit revision.");
-  const local = await inspectLocalRepository({ TOTEM_REPOSITORY_ROOT: repositoryRoot });
+  const local = await inspectLocalRepository({
+    TOTEM_REPOSITORY_ROOT: repositoryRoot,
+  });
   if (local.repository !== mission.repository.url)
     throw new Error("The configured local repository does not match the mission repository.");
   if ((await git(repositoryRoot, "cat-file", "-t", base)) !== "commit")
@@ -1676,7 +1748,9 @@ export async function prepareMissionCheckout(
     throw new Error("Mission code work needs an immutable repository revision and work item ID.");
   if (retryAttempt !== undefined && (!Number.isInteger(retryAttempt) || retryAttempt < 2))
     throw new Error("A retry checkout needs a later server work-item attempt.");
-  const local = await inspectLocalRepository({ TOTEM_REPOSITORY_ROOT: repositoryRoot });
+  const local = await inspectLocalRepository({
+    TOTEM_REPOSITORY_ROOT: repositoryRoot,
+  });
   if (local.repository !== mission.repository.url)
     throw new Error("The selected local checkout does not match the mission repository.");
   const base = await git(repositoryRoot, "rev-parse", mission.repository.baseRevision);
@@ -1714,7 +1788,10 @@ export async function prepareMissionCheckout(
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  await mkdir(join(stateDirectory, "checkouts"), { recursive: true, mode: 0o700 });
+  await mkdir(join(stateDirectory, "checkouts"), {
+    recursive: true,
+    mode: 0o700,
+  });
   await git(repositoryRoot, "worktree", "add", "-b", branch, checkout, startRevision);
   return { checkout, branch, baseRevision: base, startRevision };
 }
@@ -1732,7 +1809,9 @@ export async function prepareReviewCheckout(mission, workItem, repositoryRoot, s
     !UUID.test(workItem.id)
   )
     throw new Error("Review requires a visible local code artifact with full Git revisions.");
-  const local = await inspectLocalRepository({ TOTEM_REPOSITORY_ROOT: repositoryRoot });
+  const local = await inspectLocalRepository({
+    TOTEM_REPOSITORY_ROOT: repositoryRoot,
+  });
   if (local.repository !== mission.repository.url)
     throw new Error("The selected checkout does not match the mission repository.");
   const [resolvedHead, mergeBase] = await Promise.all([
@@ -1753,16 +1832,26 @@ export async function prepareReviewCheckout(mission, workItem, repositoryRoot, s
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  await mkdir(join(stateDirectory, "checkouts"), { recursive: true, mode: 0o700 });
+  await mkdir(join(stateDirectory, "checkouts"), {
+    recursive: true,
+    mode: 0o700,
+  });
   await git(repositoryRoot, "worktree", "add", "--detach", checkout, head);
-  return { checkout, baseRevision: base, headCommit: head, branch: codeArtifact.metadata?.branch };
+  return {
+    checkout,
+    baseRevision: base,
+    headCommit: head,
+    branch: codeArtifact.metadata?.branch,
+  };
 }
 
 export async function prepareBaseReadCheckout(mission, workItem, repositoryRoot, stateDirectory) {
   const base = mission.repository?.baseRevision;
   if (!mission.repository || !COMMIT.test(base ?? "") || !UUID.test(workItem.id))
     throw new Error("Engineering needs a selected immutable repository revision.");
-  const local = await inspectLocalRepository({ TOTEM_REPOSITORY_ROOT: repositoryRoot });
+  const local = await inspectLocalRepository({
+    TOTEM_REPOSITORY_ROOT: repositoryRoot,
+  });
   if (local.repository !== mission.repository.url)
     throw new Error("The local repository does not match the mission selection.");
   const resolved = await git(repositoryRoot, "rev-parse", base);
@@ -1777,7 +1866,10 @@ export async function prepareBaseReadCheckout(mission, workItem, repositoryRoot,
   } catch (error) {
     if (error.code !== "ENOENT") throw error;
   }
-  await mkdir(join(stateDirectory, "checkouts"), { recursive: true, mode: 0o700 });
+  await mkdir(join(stateDirectory, "checkouts"), {
+    recursive: true,
+    mode: 0o700,
+  });
   await git(repositoryRoot, "worktree", "add", "--detach", checkout, base);
   return { checkout, baseRevision: base };
 }
@@ -1950,7 +2042,10 @@ export async function runIndependentReviewProbes(checkout, changedFiles, probes,
   try {
     await writeFile(probePath, contents, { flag: "wx", mode: 0o600 });
     const check = await runIsolatedNodeTests(checkoutPath, signal);
-    return { ...check, command: `${check.command}; independent reviewer probes` };
+    return {
+      ...check,
+      command: `${check.command}; independent reviewer probes`,
+    };
   } finally {
     await rm(probePath, { force: true });
   }
@@ -2106,7 +2201,9 @@ async function settleKnownLocalTestFailure(
     checkoutInfo: record.checkoutInfo,
     failure: record.failure,
   });
-  const remote = await client.missions.listEffects(missionId, workItemId, { signal });
+  const remote = await client.missions.listEffects(missionId, workItemId, {
+    signal,
+  });
   for (const [index, effectId] of record.effectIds.entries()) {
     const effect = remote.find((item) => item.id === effectId);
     if (
@@ -2171,7 +2268,11 @@ async function recoverKnownLocalTestFailures(
       );
     } catch (error) {
       if (error.status === 401 || error.status === 403) throw error;
-      emit({ type: "recovery_waiting", workItemId, message: String(error.message ?? error) });
+      emit({
+        type: "recovery_waiting",
+        workItemId,
+        message: String(error.message ?? error),
+      });
     }
   }
   return handled;
@@ -2207,7 +2308,9 @@ async function settleCompletedResult(client, missionId, workItemId, path, record
     throw new CompletedResultReconciliationFailed(
       "The completed local result cannot be safely reconciled.",
     );
-  const remote = await client.missions.listEffects(missionId, workItemId, { signal });
+  const remote = await client.missions.listEffects(missionId, workItemId, {
+    signal,
+  });
   const effects = record.effectIds.map((id, index) => {
     const effect = remote.find((entry) => entry.id === id);
     if (
@@ -2284,7 +2387,10 @@ async function recoverReadyCompletions(
               "Review the saved result and its lease or assignment before continuing. The worker will not repeat completed actions.",
           },
         },
-        { idempotencyKey: key(agentId, workItemId, "completion-blocker"), signal },
+        {
+          idempotencyKey: key(agentId, workItemId, "completion-blocker"),
+          signal,
+        },
       );
       await saveJournal(path, { ...blocked, blockerRecorded: true });
     };
@@ -2301,7 +2407,11 @@ async function recoverReadyCompletions(
         completionInput(workItemId, record.leaseToken, record.result),
         { idempotencyKey: key(agentId, workItemId, "complete"), signal },
       );
-      await saveJournal(path, { state: "done", stage: record.stage, result: record.result });
+      await saveJournal(path, {
+        state: "done",
+        stage: record.stage,
+        result: record.result,
+      });
       emit({ type: "work_recovered", workItemId });
     } catch (error) {
       if (error.status === 401 || error.status === 403) throw error;
@@ -2323,7 +2433,11 @@ async function recoverReadyCompletions(
         }
         continue;
       }
-      emit({ type: "recovery_waiting", workItemId, message: String(error.message ?? error) });
+      emit({
+        type: "recovery_waiting",
+        workItemId,
+        message: String(error.message ?? error),
+      });
     }
   }
   return handled;
@@ -2509,7 +2623,10 @@ export async function runMissionWorker({
                         "Assign a runtime that supports this work item, or set its stage to a supported kind.",
                     },
                   },
-                  { idempotencyKey: key(agent.id, workItem.id, "unsupported-stage"), signal },
+                  {
+                    idempotencyKey: key(agent.id, workItem.id, "unsupported-stage"),
+                    signal,
+                  },
                 )
                 .catch(() => {});
               emit({
@@ -2525,7 +2642,11 @@ export async function runMissionWorker({
           if (prior?.state === "claim_blocked") {
             if (!reportedAttention.has(workItem.id)) {
               await recordRecoveryBlocker(prior.pendingWorkItem, prior.message);
-              emit({ type: "needs_attention", workItemId: workItem.id, message: prior.message });
+              emit({
+                type: "needs_attention",
+                workItemId: workItem.id,
+                message: prior.message,
+              });
             }
             continue;
           }
@@ -2745,7 +2866,10 @@ export async function runMissionWorker({
               // preceded the request, so another worker's later effects cannot
               // be bypassed by a claim key which never owned that attempt.
               if (claimRecord.previousState) {
-                const restored = { ...claimRecord, state: claimRecord.previousState };
+                const restored = {
+                  ...claimRecord,
+                  state: claimRecord.previousState,
+                };
                 for (const field of [
                   "claimKey",
                   "expectedPriorAttempt",
@@ -2769,7 +2893,11 @@ export async function runMissionWorker({
               };
               await saveJournal(journalPath, blocked);
               await recordRecoveryBlocker(claimRecord.pendingWorkItem, blocked.message);
-              emit({ type: "needs_attention", workItemId: workItem.id, message: blocked.message });
+              emit({
+                type: "needs_attention",
+                workItemId: workItem.id,
+                message: blocked.message,
+              });
               continue;
             }
             // Another worker may have claimed a stale listing, or the mission may
@@ -2810,7 +2938,9 @@ export async function runMissionWorker({
           }, 10_000);
           const renew = setInterval(() => {
             void client.missions
-              .renew(missionId, workItem.id, claim.leaseToken, { signal: combined })
+              .renew(missionId, workItem.id, claim.leaseToken, {
+                signal: combined,
+              })
               .catch((error) => {
                 renewError = error;
                 workSignal.abort();
@@ -2909,7 +3039,11 @@ export async function runMissionWorker({
                 });
               }
               if (effectIds.length) {
-                await saveJournal(journalPath, { state: "dispatching", stage, effectIds });
+                await saveJournal(journalPath, {
+                  state: "dispatching",
+                  stage,
+                  effectIds,
+                });
                 for (const effectId of effectIds) {
                   const dispatch = await client.missions.dispatchEffect(
                     missionId,
@@ -3029,7 +3163,9 @@ export async function runMissionWorker({
               }
               for (const event of promptEvents(events).filter((item) => UUID.test(item.id ?? ""))) {
                 try {
-                  await client.missions.events.ack(missionId, event.id, { signal: combined });
+                  await client.missions.events.ack(missionId, event.id, {
+                    signal: combined,
+                  });
                 } catch (error) {
                   emit({
                     type: "event_ack_pending",
@@ -3046,7 +3182,10 @@ export async function runMissionWorker({
                 for (let repair = 0; repair < 3; repair += 1) {
                   await authorizeLocalLaunch();
                   const check = await runIsolatedNodeTests(checkout, combined);
-                  commands.push({ command: check.command, exitCode: check.exitCode });
+                  commands.push({
+                    command: check.command,
+                    exitCode: check.exitCode,
+                  });
                   localTestRuns.push(check);
                   if (check.exitCode === 0) break;
                   if (repair === 2) throw new LocalCodeTestsFailed(localTestRuns);
@@ -3186,12 +3325,18 @@ export async function runMissionWorker({
               if (reviewCheck)
                 generated.commands = [
                   ...(generated.commands ?? []),
-                  { command: reviewCheck.command, exitCode: reviewCheck.exitCode },
+                  {
+                    command: reviewCheck.command,
+                    exitCode: reviewCheck.exitCode,
+                  },
                 ];
               if (reviewProbeCheck)
                 generated.commands = [
                   ...(generated.commands ?? []),
-                  { command: reviewProbeCheck.command, exitCode: reviewProbeCheck.exitCode },
+                  {
+                    command: reviewProbeCheck.command,
+                    exitCode: reviewProbeCheck.exitCode,
+                  },
                 ];
               const resultSummary = handoff?.summary ?? generated.text.slice(0, 2000);
               result = {
@@ -3224,7 +3369,10 @@ export async function runMissionWorker({
                   contentText: handoff
                     ? JSON.stringify(handoff.detail, null, 2).slice(0, 32000)
                     : generated.text.slice(0, 32000),
-                  metadata: { ...(evidence ?? {}), commands: generated.commands ?? [] },
+                  metadata: {
+                    ...(evidence ?? {}),
+                    commands: generated.commands ?? [],
+                  },
                 },
               };
               if (effectIds.length) {
@@ -3260,7 +3408,10 @@ export async function runMissionWorker({
               missionId,
               workItem.id,
               completionInput(workItem.id, claim.leaseToken, result),
-              { idempotencyKey: key(agent.id, workItem.id, "complete"), signal: combined },
+              {
+                idempotencyKey: key(agent.id, workItem.id, "complete"),
+                signal: combined,
+              },
             );
             await saveJournal(journalPath, { state: "done", stage, result });
             reportedAttention.delete(workItem.id);
@@ -3301,7 +3452,10 @@ export async function runMissionWorker({
                     prior?.state === "local_tests_failed"
                       ? (prior.verifiedFailedEffectIds ?? prior.effectIds ?? [])
                       : [],
-                  failure: { checks: error.checks, completedAt: new Date().toISOString() },
+                  failure: {
+                    checks: error.checks,
+                    completedAt: new Date().toISOString(),
+                  },
                 };
                 await saveJournal(journalPath, record);
                 knownLocalTestFailure = true;

package/bin/totem.mjs

@@ -4,7 +4,7 @@ import { createHash, randomUUID } from "node:crypto";
 import { createReadStream } from "node:fs";
 import { stripVTControlCharacters } from "node:util";
 
-const CLI_VERSION = "0.1.5";
+const CLI_VERSION = "0.1.6";
 const DEFAULT_BASE_URL = "https://totemlayer.com";
 const API_KEY_PATTERN = /^at_(?:live|test)_[A-Za-z0-9_-]{20,}$/;
 const ACTION_PATTERN = /^[a-z0-9][a-z0-9._:-]*$/;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "totemlayer",
-  "version": "0.1.5",
+  "version": "0.1.6",
   "description": "Cross-platform CLI for TotemLayer agent identity and authorization",
   "type": "module",
   "bin": {