cli-agent-runner 0.2.21__tar.gz → 0.2.23__tar.gz

cli_agent_runner-0.2.23/.github/dependabot.yml

@@ -0,0 +1,6 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/.github/workflows/ci.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 2
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
         with:
           # PR: scan only new commits the PR introduces (base..head).
           # Push to main: scan the just-pushed commits (before..after).
@@ -74,10 +74,10 @@ jobs:
     # granularity AND because coverage requires extra pytest flags not in
     # the local `test` task. CONTRIBUTING.md states the parity intentionally.
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: ${{ matrix.python }}
           cache: pip
@@ -108,7 +108,7 @@ jobs:
         run: pytest tests/literate/ -q
       - name: upload coverage
         if: matrix.python == '3.12' && matrix.os == 'ubuntu-latest'
-        uses: codecov/codecov-action@v6
+        uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f  # v6
         with:
           files: ./coverage.xml
           fail_ci_if_error: false

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/.github/workflows/release.yml

@@ -26,10 +26,10 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@v5
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
         with:
           fetch-depth: 0
-      - uses: actions/setup-python@v6
+      - uses: actions/setup-python@ece7cb06caefa5fff74198d8649806c4678c61a1  # v6
         with:
           python-version: "3.12"
       - name: install build
@@ -38,7 +38,7 @@ jobs:
         run: python -m build
       - name: list dist artifacts
         run: ls -la dist/
-      - uses: actions/upload-artifact@v7
+      - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a  # v7
         with:
           name: dist
           path: dist/
@@ -53,11 +53,15 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/download-artifact@v8
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
         with:
           name: dist
           path: dist/
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      # SHA-pinned to release/v1's composite. NOTE: this pins the composite source;
+      # the image it pulls is still referenced by a moving ghcr tag, so a full pin
+      # would require the ghcr digest — deferred (needs read:packages + release-time
+      # validation). dependabot (github-actions) bumps this SHA.
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # release/v1
         with:
           attestations: true
 
@@ -68,8 +72,8 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v5
-      - uses: actions/download-artifact@v8
+      - uses: actions/checkout@fbc6f3992d24b796d5a048ff273f7fcc4a7b6c09  # v5
+      - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c  # v8
         with:
           name: dist
           path: dist/

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/.vulture-whitelist.py

@@ -110,6 +110,7 @@ pid
 uptime_s
 unit_file
 rate_limit
+system_managed
 
 # agent_runner.api_types.SystemMetrics
 mem_total_mb
@@ -127,6 +128,11 @@ agent
 since_round
 phase
 
+# agent_runner.cli.doctor_cmd.DoctorReport
+checks
+overlaps
+plan
+
 # agent_runner.config.models.AgentConfig
 command
 prompt_arg_template
@@ -134,6 +140,7 @@ name
 env
 prompt_delivery
 exec_prefix
+terminal_marker
 
 # agent_runner.config.models.Config
 agent
@@ -295,6 +302,12 @@ resume_timezone
 skipped
 active_window
 
+# agent_runner.phase_select.WindowOverlap
+phase_a
+phase_b
+window_a
+window_b
+
 # agent_runner.round_log.PruneOutcome
 deleted
 deferred
@@ -318,6 +331,11 @@ reason
 how_to_fix
 permanent
 
+# agent_runner.startup_check.CheckSpec
+kind
+scope
+run
+
 # agent_runner.vcs_state.StashRef
 sha
 message

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/BACKLOG.md

@@ -53,18 +53,6 @@ kind name is the version discriminator; a breaking change ships as
 `round_start_v2`). Reaching this failure requires a contract violation — but the
 suite would not report it.
 
-## `remote_failure_tolerance_s` does not cover `subprocess.TimeoutExpired` — NEEDS_DESIGN
-
-The tolerance window covers ssh exit code 255 only. `monitor.run_remote_command`
-raises `MonitorRemoteError` on rc=255, and `api.monitor_loop`'s retry loop
-catches exactly that. A hung (not failed) ssh connection instead trips the
-`subprocess.run(timeout=...)` guard and raises `subprocess.TimeoutExpired`,
-which bypasses the window and kills the monitor.
-
-The rc=255-only scope is intentional and pinned by the monitor-signals design,
-and the documentation matches the code exactly — there is no drift here. Widening
-it changes a documented recovery path, so it is a design decision, not debt.
-
 ## `anomaly_repetitive_*` default — NEEDS_DESIGN
 
 `monitor.anomaly_repetitive_window` and `anomaly_repetitive_threshold` both
@@ -89,21 +77,6 @@ Deferred because closing it is a naming decision, not cleanup: no event kind
 carries the meaning "stashed but ref lost" (`orphan_stash_failed` would be wrong
 — the stash exists). Left as-is until that kind is designed.
 
-## `_monitor_loop_iter`'s three fail-open guards are hand-duplicated
-
-`api._monitor_loop_iter` wraps the startup `monitor_started` emit, the
-per-tick poll, and `on_alert`'s per-alert dispatch each in its own
-`try/except Exception: warnings.warn(...)` block so a crash in any one of the
-three never ends monitor supervision. The three guards are structurally
-identical (catch, format a `type(e).__name__: {e}` warning, keep the loop
-alive) but hand-copied rather than sharing one implementation; `on_alert`'s
-own `emit()` closure already shows the pattern for factoring a shared guard.
-
-Collapsing them to one shared guard is behavior-preserving — it must not
-change which failures warn vs which propagate, nor the specific fallback
-each site takes on failure (sleep-and-retry after a poll failure,
-`verdict = "failed"` after an `on_alert` failure). Slated for 0.2.19.
-
 ## `oom_kill_delta` is named differently on its two events — NEEDS_DESIGN, DEFERRED to 0.3
 
 The same cgroup `memory.events.oom_kill` delta is emitted under two

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/CHANGELOG.md

@@ -5,6 +5,34 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.2.23] - 2026-09-12
+
+### Added
+- `[agent] terminal_marker` — per-preset grace-kill result marker (default = Claude's token; pi/codewhale set their own; kimi/aider have no marker and run to the wall-clock ceiling).
+- `doctor` — read-only pre-flight (never launches the agent): startup checks, phase-window overlap warnings, and an N-round phase-plan preview.
+- `phase_window_overlap` event — emitted at serve boot when two agent-overriding phases' windows collide in the same timezone.
+
+### Changed
+- Startup-check dispatch and the catalog's kind list now derive from a single descriptor table (no behavior change).
+- The lock-holder pid create_time verify now shares one `lifecycle` helper with `serve.pid` (no behavior change).
+- Default `claude` preset model updated `claude-opus-4-7` → `claude-opus-5`.
+
+### Fixed
+- `peek` no longer prints spurious "cannot coerce None" warnings on a freshly-initialized project; absent metric samples fall back to defaults silently (a genuinely malformed value still warns).
+
+## [0.2.22] - 2026-09-11
+
+### Fixed
+- Container safety: agent-runner now refuses to boot when `runtime.log_dir` resolves inside a containerized `work_dir` — a contained agent could otherwise rewrite the pid/lock/cidfile control files the supervisor trusts. The best-effort container stop also validates the recovered container id (hex, length-bounded) and passes an end-of-options separator, and the injected `--cidfile` moves to a host-private directory, so a poisoned cidfile can no longer stop an unrelated container.
+- `kill` / `restart --force` verify the lock-holder's start time before signaling, so a recycled pid is never sent a signal.
+- System mode (`install --system`): `restart` / `uninstall` recognize a system unit and refuse with the exact `sudo systemctl …` command instead of a misleading one, and `uninstall` no longer aborts with an uncaught error on a host without a systemd user bus.
+
+### Security
+- Release and CI GitHub Actions are pinned to commit SHAs, with Dependabot tracking updates.
+
+### Notes
+- Not breaking: no `agent-runner migrate` step, no systemd unit change. `status --json` gains a `system_managed` field; existing fields unchanged. The one newly-rejected configuration is a containerized agent whose `runtime.log_dir` sits inside `work_dir` — move `log_dir` outside `work_dir` (the default already is).
+
 ## [0.2.21] - 2026-09-11
 
 ### Added

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cli-agent-runner
-Version: 0.2.21
+Version: 0.2.23
 Summary: Restart-on-exit supervisor for autonomous CLI agents
 Project-URL: Homepage, https://github.com/wan9yu/cli-agent-runner
 Project-URL: Documentation, https://github.com/wan9yu/cli-agent-runner#readme
@@ -82,7 +82,7 @@ agent-runner monitor              # live anomaly detection
 
 Full walkthrough: [`docs/quickstart.md`](docs/quickstart.md).
 
-## 16 verbs
+## 17 verbs
 
 | Lifecycle | Observation |
 |---|---|

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/README.md

@@ -44,7 +44,7 @@ agent-runner monitor              # live anomaly detection
 
 Full walkthrough: [`docs/quickstart.md`](docs/quickstart.md).
 
-## 16 verbs
+## 17 verbs
 
 | Lifecycle | Observation |
 |---|---|

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/SECURITY.md

@@ -57,6 +57,23 @@ a narrower safety net than the host-level reaping a bare agent process gets,
 not a wider one — keep running it as a dedicated unprivileged user with no
 passwordless sudo and tight egress limits regardless.
 
+**Residual: `agent-runner.toml` lives inside the mount.** The startup check
+above stops the agent's pid and lock files from sitting inside a mounted
+`work_dir` (the injected cidfile is separately placed in a host-private temp
+dir outside any mount, so it's protected independently of `log_dir`) — but
+`agent-runner.toml` itself is scaffolded at the `work_dir` root, and the
+container recipes in
+[docs/recipes/container-pi.md](docs/recipes/container-pi.md) bind-mount all
+of `work_dir` read-write. Each round re-reads the config, so a containerized
+agent that can write its own mount can rewrite `[agent] command` /
+`exec_prefix` — or `runtime.stop_file`, if it's pointed inside the mount —
+and have it run on the host next round. This is consistent with the threat
+model above: agent-runner bounds a *misbehaving* agent, not a *hostile* one,
+and containment is the container/VM's job, not agent-runner's. An operator
+who needs to contain a not-fully-trusted agent should keep the config (and
+`runtime.stop_file`) outside any bind-mount, or otherwise treat the
+container boundary as their own responsibility to shape.
+
 ## Scope
 
 In scope: the `agent_runner` Python package, its CLI, its bundled systemd

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/agent_runner/_emit/__init__.py

@@ -57,6 +57,7 @@ from agent_runner._emit.serve import (  # noqa: F401 — public re-export
     emit_max_rounds_reached,
     emit_mem_loop,
     emit_mem_loop_persistent,
+    emit_phase_window_overlap,
     emit_rate_limit_stop,
     emit_schedule_paused,
     emit_schedule_phase_skipped,
@@ -78,6 +79,7 @@ __all__ = [
     "emit_mem_loop",
     "emit_mem_loop_persistent",
     "emit_mem_pressure_deferred_to_cgroup",
+    "emit_phase_window_overlap",
     "emit_rate_limit_stop",
     "emit_round_cgroup_memory",
     "emit_round_container_orphan_risk",

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/agent_runner/_emit/serve.py

@@ -191,3 +191,23 @@ def emit_schedule_resumed(log_dir: Path, *, paused_for_s: int) -> None:
     from agent_runner.events import SCHEDULE_RESUMED, emit
 
     emit(log_dir, SCHEDULE_RESUMED, paused_for_s=paused_for_s)
+
+
+def emit_phase_window_overlap(
+    log_dir: Path, *, phase_a: str, phase_b: str, window_a: str, window_b: str
+) -> None:
+    """Emit phase_window_overlap: two agent-overriding phases' own run_windows
+    collide (a rotation footgun; a later release promotes this exact detection
+    to a hard error). Called once at serve boot -- the collision is a property of the
+    static config, not of any one round, so (like emit_max_rounds_reached's
+    cgroup-probe sibling) this must not be called from the per-round path."""
+    from agent_runner.events import PHASE_WINDOW_OVERLAP, emit
+
+    emit(
+        log_dir,
+        PHASE_WINDOW_OVERLAP,
+        phase_a=phase_a,
+        phase_b=phase_b,
+        window_a=window_a,
+        window_b=window_b,
+    )

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/agent_runner/_monitor_state.py

@@ -154,21 +154,41 @@ def _latest_metric_dict(metrics: list[dict[str, Any]]) -> dict[str, Any]:
     return metrics[-1] if metrics else {}
 
 
+def _metric_int(latest: dict[str, Any], key: str, default: int) -> int:
+    """``_coerce_int`` for a metric field, silent on absence.
+
+    A fresh project has no metric events yet, so ``latest`` is ``{}`` and
+    every field reads as None -- "no sample yet", not malformed data. Only a
+    present-but-non-numeric value should still warn (delegated to
+    ``_coerce_int``, which owns that contract)."""
+    from agent_runner._throttle import _coerce_int
+
+    value = latest.get(key)
+    return default if value is None else _coerce_int(value, default)
+
+
+def _metric_float(latest: dict[str, Any], key: str, default: float) -> float:
+    """Float sibling of ``_metric_int`` -- see its docstring."""
+    from agent_runner._throttle import _coerce_float
+
+    value = latest.get(key)
+    return default if value is None else _coerce_float(value, default)
+
+
 def assemble_project_state(source: LocalSource, *, project: str) -> ProjectState:
     metrics = parse_events_from_jsonl_files(source.metrics_files())
     status = read_json(source.status_path()) or {}
     orphan = read_json(source.orphan_path())
     latest = _latest_metric_dict(metrics)
-    from agent_runner._throttle import _coerce_float, _coerce_int
 
     system = SystemMetrics(
-        mem_total_mb=_coerce_int(latest.get("mem_total_mb"), 0),
-        mem_available_mb=_coerce_int(latest.get("mem_available_mb"), 0),
-        disk_used_pct=_coerce_float(latest.get("disk_used_pct"), 0.0),
-        disk_free_gb=_coerce_float(latest.get("disk_free_gb"), 0.0),
+        mem_total_mb=_metric_int(latest, "mem_total_mb", 0),
+        mem_available_mb=_metric_int(latest, "mem_available_mb", 0),
+        disk_used_pct=_metric_float(latest, "disk_used_pct", 0.0),
+        disk_free_gb=_metric_float(latest, "disk_free_gb", 0.0),
         load_1m=latest.get("load_1m"),
         cpu_pct=latest.get("cpu_pct"),
-        agent_process_count=_coerce_int(latest.get("agent_process_count"), 0),
+        agent_process_count=_metric_int(latest, "agent_process_count", 0),
     )
     return ProjectState(
         project=project,

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/agent_runner/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.2.21'
-__version_tuple__ = version_tuple = (0, 2, 21)
+__version__ = version = '0.2.23'
+__version_tuple__ = version_tuple = (0, 2, 23)
 
 __commit_id__ = commit_id = None

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/agent_runner/agent_runtime.py

@@ -14,6 +14,7 @@ import re
 import shutil
 import signal
 import subprocess  # noqa: TID251 — sanctioned subprocess caller
+import tempfile
 import threading
 from collections.abc import Callable
 from dataclasses import dataclass
@@ -246,11 +247,6 @@ def _live_children(
     return live, ignored
 
 
-# Exact compact bytes — matches claude CLI's no-whitespace JSONL output.
-# A future CLI variant emitting `{"type": "result", ...}` (with space) would
-# bypass this scan; revisit if that happens.
-_RESULT_MARKER = b'"type":"result"'
-
 # Decoupled from the 0.2s poll tick: the marker scan only needs to notice the
 # result within max_grace_after_result_s (seconds, integer), so scanning more
 # often than this buys nothing but re-read cost on a growing round log.
@@ -290,6 +286,14 @@ def resolve_exec_target(command0: str, work_dir: Path, env_path: str | None = No
 # ladder) is out of scope here -- left for a future release.
 _CONTAINER_RUNTIMES = frozenset({"docker", "podman"})
 
+# A real docker/podman container id is hex, 12-64 chars (short or full form).
+# The cidfile is a trust-bearing control input -- validated before it's ever
+# handed to a `stop` subprocess argv.
+_CONTAINER_ID_RE = re.compile(r"^[0-9a-fA-F]{12,64}$")
+# A real container id is <=64 hex chars; cap the read so a poisoned giant
+# file can't OOM a constrained host.
+_CIDFILE_READ_CAP = 128
+
 # docker/podman GLOBAL flags (before the subcommand) that take a separate
 # value token -- skipped in pairs so `docker -H unix:///var/run/docker.sock
 # run ...` / `docker --context foo run ...` still resolve to `run`. Not
@@ -507,14 +511,18 @@ def _best_effort_container_stop(
     if cidfile is None:
         return None, None
     try:
-        cid = cidfile.read_text(encoding="utf-8").strip()
+        with cidfile.open("rb") as fh:
+            raw = fh.read(_CIDFILE_READ_CAP + 1)
     except OSError:
         return None, None
-    if not cid:
-        return None, None
+    if len(raw) > _CIDFILE_READ_CAP:
+        return None, None  # oversize — not a real container id
+    cid = raw.decode("utf-8", "replace").strip()
+    if not _CONTAINER_ID_RE.match(cid):
+        return None, None  # not a hex id — detection already fired the loud warn + event
     try:
         result = subprocess.run(
-            [runtime, "stop", "-t", str(REAP_GRACE_S), cid],
+            [runtime, "stop", "-t", str(REAP_GRACE_S), "--", cid],
             stdout=subprocess.DEVNULL,
             stderr=subprocess.PIPE,
             timeout=_CONTAINER_STOP_TIMEOUT_S,
@@ -560,6 +568,7 @@ def run(
     log_path: Path,
     env_extra: dict[str, str],
     max_grace_after_result_s: int = 0,
+    terminal_marker: str = '"type":"result"',  # mirrors config.DEFAULT_TERMINAL_MARKER
     progress_callback: Callable[[dict], None] | None = None,
     progress_interval_s: int = 0,
     on_grace_extended: Callable[[list[dict], list[dict]], None] | None = None,
@@ -575,13 +584,19 @@ def run(
     already-absolute cfg.runtime.work_dir. CLIs with no --cwd flag of their
     own (e.g. pi) depend on this.
 
-    max_grace_after_result_s: when > 0, start a countdown after the first
-    type=result event is detected in the log. After it elapses, reap the
+    max_grace_after_result_s: when > 0, start a countdown after
+    ``terminal_marker`` is first detected in the log. After it elapses, reap the
     process group only if the agent has no live worker processes left (a
     genuine hang). If a worker is still running (e.g. a backgrounded build),
     do not reap — invoke ``on_grace_extended`` once and keep waiting until the
     round finishes or hits the wall-clock ``timeout_s`` ceiling. 0 = disabled.
 
+    terminal_marker: exact compact byte substring the grace-kill scan looks
+    for (default matches claude CLI's no-whitespace JSONL ``{"type":"result",
+    ...}`` output). An empty string disables the marker scan outright, even
+    with max_grace_after_result_s > 0 (honest opt-out, not an
+    empty-substring-matches-everything trap).
+
     progress_callback: when not None and progress_interval_s > 0, called every
     progress_interval_s seconds with a dict of log stats (log_size_kb,
     last_write_age_s, wall_age_s). Keeps agent_runtime event-free; callers
@@ -606,6 +621,12 @@ def run(
     attempt where covered; it just isn't reported).
     """
     stdin_mode = prompt_delivery == "stdin"
+    marker_bytes = terminal_marker.encode("utf-8")
+    # Raising work (mkdir can fail on disk-full/perms/removed log_dir) must
+    # happen BEFORE the container-detection block below creates the
+    # host-private cidfile tempdir -- otherwise a raise here would skip the
+    # try/finally that cleans that tempdir up, leaking it once per round.
+    log_path.parent.mkdir(parents=True, exist_ok=True)
     # Container-orphan defense: detect BEFORE building argv (spawn_command may
     # gain an injected --cidfile) -- see _detect_container_run's module-level
     # note. A non-container command's argv is byte-identical to before:
@@ -638,8 +659,13 @@ def run(
                 # no-silent-orphan floor.
                 pass
             else:
-                container_cidfile = log_path.with_name(log_path.name + ".cid")
-                container_cidfile.unlink(missing_ok=True)  # docker/podman refuse an existing one
+                # A supervisor control file must not live where the container can
+                # write it; put our injected cidfile in a host-private 0700 dir
+                # outside any mount. Docker writes the file host-side; the
+                # container never needs it.
+                container_cid_dir = Path(tempfile.mkdtemp(prefix="agent-runner-cid-"))
+                # Not created here — docker/podman refuse an existing cidfile.
+                container_cidfile = container_cid_dir / "round.cid"
                 container_cidfile_is_ours = True
                 spawn_command = _inject_cidfile(command, run_idx, container_cidfile)
 
@@ -669,7 +695,6 @@ def run(
     # PWD pinned last — it mirrors cwd= (a correctness pin, not a knob), so
     # an [agent.env] PWD cannot silently diverge from where the child runs.
     env = {**os.environ, **env_extra, "PWD": str(work_dir)}
-    log_path.parent.mkdir(parents=True, exist_ok=True)
     proc: subprocess.Popen | None = None
     log_file = None
     try:
@@ -727,7 +752,7 @@ def run(
                     exit_code=exit_code, duration_s=duration, timed_out=True, pid=proc.pid
                 )
             # Grace kill: result emitted but subprocess still running.
-            if max_grace_after_result_s > 0:
+            if max_grace_after_result_s > 0 and marker_bytes:
                 if result_seen_at is None and now - last_result_scan >= _RESULT_SCAN_INTERVAL_S:
                     last_result_scan = now
                     try:
@@ -736,12 +761,16 @@ def run(
                             chunk = f.read()
                         result_scan_offset += len(chunk)
                         haystack = result_scan_carry + chunk
-                        if _RESULT_MARKER in haystack:
+                        if marker_bytes in haystack:
                             result_seen_at = now
                         else:
                             # Keep the tail so a marker split across two read
                             # chunks (this scan vs. the next) still re-forms.
-                            result_scan_carry = haystack[-(len(_RESULT_MARKER) - 1) :]
+                            # A 1-byte marker can't be split, so carry nothing
+                            # -- haystack[-0:] is the WHOLE buffer, not empty,
+                            # so the zero case needs its own branch.
+                            _carry = len(marker_bytes) - 1
+                            result_scan_carry = haystack[-_carry:] if _carry else b""
                     except OSError:
                         pass  # log not flushed yet; retry next interval
                 if result_seen_at is not None and now - result_seen_at > max_grace_after_result_s:
@@ -805,10 +834,10 @@ def run(
     finally:
         if log_file is not None:
             log_file.close()
-        # Cleanup, not correctness: our own injected cidfile is a tiny,
-        # round-scoped tmp file -- delete it once the round is fully done
-        # (read-back for the best-effort stop, if any, already happened
-        # above). Only ours: an operator-supplied --cidfile is never ours to
-        # delete.
+        # Cleanup, not correctness: our own injected cidfile lives in a tiny,
+        # round-scoped private tempdir -- remove that whole dir once the round
+        # is fully done (read-back for the best-effort stop, if any, already
+        # happened above). Only ours: an operator-supplied --cidfile is never
+        # ours to delete.
         if container_cidfile_is_ours and container_cidfile is not None:
-            container_cidfile.unlink(missing_ok=True)
+            shutil.rmtree(container_cidfile.parent, ignore_errors=True)

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/agent_runner/api.py

@@ -193,6 +193,11 @@ def init(
 _SYSTEM_UNITS_DIR = Path("/etc/systemd/system")
 
 
+def _system_unit_exists(project: str) -> bool:
+    """A --system install's root-owned unit; detect_service_mode can't see it (user-scope only)."""
+    return (_SYSTEM_UNITS_DIR / serve_unit_filename(project)).exists()
+
+
 def _install_system(
     cfg: Config, project: str, *, config_path: Path, with_monitor: bool
 ) -> InstallResult:
@@ -283,6 +288,15 @@ def uninstall(work_dir: Path | None = None) -> bool:
     if work_dir is None:
         work_dir = Path.cwd()
     project = _project_name(work_dir)
+    if _system_unit_exists(project):  # root-owned -- don't silently no-op the user-scope dir
+        units = [serve_unit_filename(project)]
+        if (_SYSTEM_UNITS_DIR / monitor_unit_filename(project)).exists():
+            units.append(monitor_unit_filename(project))
+        remedy = " && ".join(
+            f"sudo systemctl disable --now {u} && sudo rm {_SYSTEM_UNITS_DIR / u}" for u in units
+        )
+        print(f"{project} is managed by a system unit; run: {remedy}")
+        return False
     units_dir = lifecycle._user_systemd_dir()
     serve = units_dir / serve_unit_filename(project)
     monitor = units_dir / monitor_unit_filename(project)
@@ -295,7 +309,10 @@ def uninstall(work_dir: Path | None = None) -> bool:
             lifecycle.stop_unit_draining(p.name, clock=SYSTEM_CLOCK, confirm_s=_PID_SIGNAL_GRACE_S)
             _systemctl_user("disable", p.name)
             p.unlink(missing_ok=True)
-    _systemctl_user("daemon-reload")
+    try:
+        _systemctl_user("daemon-reload")
+    except (subprocess.CalledProcessError, FileNotFoundError):
+        pass  # no user bus on this host -- units above (if any) already gone
     return True
 
 
@@ -348,7 +365,10 @@ def _round_holder_pid(log_dir: Path) -> int | None:
     pid = data.get("pid")
     if not lifecycle._valid_pid(pid):
         return None
-    return pid if pid_alive(pid) else None
+    if not pid_alive(pid):
+        return None
+    recorded = data.get("create_time")
+    return pid if lifecycle.create_time_matches(pid, recorded) else None
 
 
 def _terminate_round_pid(pid: int) -> None:
@@ -435,6 +455,11 @@ def restart(project: str | Path, *, force: bool = False) -> ServiceStatus:
     # SYSTEMD_USER unit, so restarting a PID_FILE/NONE service would stop it and
     # never bring it back — the half-execution this fix eliminates.
     pname = _resolve_project(project)
+    if _system_unit_exists(pname):  # root-owned -- below's message would mislead
+        raise RuntimeError(
+            f"{pname} is managed by a system unit; run: "
+            f"sudo systemctl restart {serve_unit_filename(pname)}"
+        )
     log_dir = _log_dir_for_project(project)
     mode = detect_service_mode(pname, log_dir=log_dir)
     if mode != ServiceMode.SYSTEMD_USER:
@@ -463,14 +488,18 @@ def status(project: str | Path) -> ServiceStatus:
     pname = _resolve_project(project)
     log_dir = _log_dir_for_project(project)
     mode = detect_service_mode(pname, log_dir=log_dir)
-    if mode == ServiceMode.PID_FILE:
-        pid = PIDFile(log_dir / "serve.pid").read()
-        return ServiceStatus(mode=mode, active=pid is not None and pid_alive(pid), pid=pid)
     if mode == ServiceMode.SYSTEMD_USER:
         unit = lifecycle._user_systemd_dir() / serve_unit_filename(pname)
         active = _systemd_active(serve_unit_filename(pname), log_dir)
         return ServiceStatus(mode=mode, active=active, unit_file=unit)
-    return ServiceStatus(mode=ServiceMode.NONE, active=False)
+    # detect_service_mode only sees the user-scope unit dir; label a --system
+    # install found here (PID_FILE/NONE) via system_managed, not unit_file.
+    system_managed = _system_unit_exists(pname)
+    if mode == ServiceMode.PID_FILE:
+        pid = PIDFile(log_dir / "serve.pid").read()
+        active = pid is not None and pid_alive(pid)
+        return ServiceStatus(mode=mode, active=active, pid=pid, system_managed=system_managed)
+    return ServiceStatus(mode=ServiceMode.NONE, active=False, system_managed=system_managed)
 
 
 def _resolve_target(project: str | Path | None) -> tuple[str, Path]:
@@ -816,6 +845,7 @@ from agent_runner._emit import (  # noqa: E402,F401 — intentional bottom re-ex
     emit_mem_loop,
     emit_mem_loop_persistent,
     emit_mem_pressure_deferred_to_cgroup,
+    emit_phase_window_overlap,
     emit_rate_limit_stop,
     emit_round_cgroup_memory,
     emit_round_container_orphan_risk,

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/agent_runner/api_types.py

@@ -62,6 +62,11 @@ class ServiceStatus:
     uptime_s: float | None = None
     unit_file: Path | None = None
     rate_limit: RateLimitState | None = None
+    # True when a `--system` install's root-owned unit owns this project but
+    # detect_service_mode fell through to PID_FILE/NONE (it only sees the
+    # user-scope unit dir) -- distinct from `unit_file`, which stays the
+    # live, user-owned, CLI-restartable systemd_user unit's path.
+    system_managed: bool = False
 
 
 @dataclass(frozen=True)

{cli_agent_runner-0.2.21 → cli_agent_runner-0.2.23}/agent_runner/cli/__init__.py

@@ -17,6 +17,7 @@ from pathlib import Path
 
 from agent_runner import __version__
 from agent_runner.cli import (
+    doctor_cmd,
     events_cmd,
     init_cmd,
     install_cmd,
@@ -71,6 +72,7 @@ def _build_parser() -> argparse.ArgumentParser:
     round_cmd.add_parser(sub, parent)
     upgrade_cmd.add_parser(sub, parent)
     migrate_cmd.add_parser(sub, parent)
+    doctor_cmd.add_parser(sub, parent)
 
     return parser