cli-agent-runner 0.3.5__tar.gz → 0.3.7__tar.gz

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/.vulture-whitelist.py

@@ -195,6 +195,7 @@ supervisor_stale_threshold_s
 disk
 memory
 pressure
+brake
 
 # agent_runner.config.models.PhaseOverride
 round_budget_s
@@ -255,6 +256,11 @@ pause_windows
 stash_idempotency_s
 dirty_action
 
+# agent_runner.config.models._HostHealthBrakeConfig
+memory_high
+memory_high_step_pct
+warning_consecutive_samples
+
 # agent_runner.config.models._HostHealthDiskConfig
 warning_pct
 critical_pct
@@ -270,6 +276,7 @@ some_avg10_warning
 critical_consecutive_samples
 in_round_terminate
 cgroup_growth_rate_warning_mb_per_min
+in_round_nudge
 
 # agent_runner.context_store.OrphanState
 round_num

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/CHANGELOG.md

@@ -5,6 +5,19 @@ All notable changes to this project will be documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.3.7] - 2026-09-15
+
+### Added
+- Opt-in cgroup v2 `memory.high` soft-brake (`[monitor.host_health.brake] memory_high`, default off): under sustained warning-level memory pressure the supervisor reversibly writes `memory.high` on its OWN cgroup leaf to throttle a growing round before the host swaps, then restores it on recovery or at round end. `memory_high_step_pct` defaults to `0` = cap-at-current (throttle further growth with no synchronous reclaim burst — safe for SD-backed hosts); `step_pct >= 1` is opt-in aggressive reclaim that dumps ~step% of the leaf to swap at engage. Fail-open; arms only when the leaf is delegated.
+- Opt-in early cooperative SIGTERM (`[monitor.host_health.pressure] in_round_nudge`, default off): fires the hard floor's SIGTERM two samples earlier so a cooperative agent gets its wrap-up grace; recorded as `round_mem_terminated` with a new `tier` field so the mem-loop give-up still converges.
+- New events `memory_high_engaged` / `memory_high_released` / `memory_high_write_failed`; `doctor` and `peek --json` (schema `2.5`) report the brake as `off | armed | inert(<reason>)`.
+
+## [0.3.6] - 2026-09-15
+
+### Changed
+- `agent-runner kill` now reaps a stuck round's detached descendants (a child that `setsid()`'d off its process group) the same way `serve stop` already does, so a forced stop never leaves an orphan behind.
+- A stop (`SIGTERM` / `serve stop`) during a sandboxed third-party spawn hook, or during a plugin-requested `defer`, now takes effect immediately instead of after up to 30 s — and the confined hook's child process is always reaped, never left running. A background process the hook itself forks is not reaped; its abandoned output pipe is dropped after a bounded 2 s drain wait (on a normal hook exit, surfaced as `hook_failed`) rather than stalling the stop.
+
 ## [0.3.5] - 2026-09-15
 
 ### Added

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cli-agent-runner
-Version: 0.3.5
+Version: 0.3.7
 Summary: Restart-on-exit supervisor for autonomous CLI agents
 Project-URL: Homepage, https://github.com/wan9yu/cli-agent-runner
 Project-URL: Documentation, https://github.com/wan9yu/cli-agent-runner#readme

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/agent_runner/_emit/__init__.py

@@ -32,6 +32,9 @@ from agent_runner._emit.memory import (  # noqa: F401 — public re-export
     emit_cgroup_growth_rate_warning,
     emit_host_cgroup_memory_limit,
     emit_mem_pressure_deferred_to_cgroup,
+    emit_memory_high_engaged,
+    emit_memory_high_released,
+    emit_memory_high_write_failed,
     emit_round_cgroup_memory,
     emit_round_deferred,
     emit_round_mem_critical_sample,
@@ -88,6 +91,9 @@ __all__ = [
     "emit_mem_loop",
     "emit_mem_loop_persistent",
     "emit_mem_pressure_deferred_to_cgroup",
+    "emit_memory_high_engaged",
+    "emit_memory_high_released",
+    "emit_memory_high_write_failed",
     "emit_plugin_builtin_name_squat",
     "emit_plugin_checksum_mismatch",
     "emit_plugin_sandbox_degraded",

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/agent_runner/_emit/memory.py

@@ -36,6 +36,7 @@ def emit_round_mem_terminated(
     message: str,
     consecutive: int,
     context: dict,
+    tier: str = "terminate",
 ) -> None:
     """Emit when _spawn_round's mid-round hard floor terminated a ballooning
     round on critical host_health pressure -- the actual coma-preventer (a
@@ -45,7 +46,15 @@ def emit_round_mem_terminated(
     ``consecutive`` (the critical_streak that crossed the threshold)
     and ``context`` (Pressure.context -- the actual psi/mem numbers, e.g.
     psi_full_avg10) make the kill legible from the event stream alone, so an
-    operator can retune host_health thresholds without SSH."""
+    operator can retune host_health thresholds without SSH.
+
+    ``tier`` (``"terminate"`` | ``"nudge"``) distinguishes the hard floor's
+    ``_terminate_round`` (TERM -> grace -> killpg) from the early cooperative
+    nudge (a bare ``proc.terminate()`` two samples earlier, no wait, no
+    killpg) -- both fire this SAME event kind so ``round_was_mem_terminated``
+    and the ``mem_loop`` give-up breaker count a nudged round exactly like a
+    hard-terminated one; the default keeps every existing caller byte-
+    compatible."""
     from agent_runner.events import ROUND_MEM_TERMINATED, emit
 
     emit(
@@ -57,6 +66,7 @@ def emit_round_mem_terminated(
         message=message,
         consecutive=consecutive,
         context=context,
+        tier=tier,
     )
 
 
@@ -246,6 +256,59 @@ def emit_mem_pressure_deferred_to_cgroup(
     emit(log_dir, MEM_PRESSURE_DEFERRED_TO_CGROUP, pid=pid, signal=signal, message=message)
 
 
+def emit_memory_high_engaged(
+    log_dir: Path,
+    *,
+    round_num: int,
+    previous: str,
+    written: int,
+    memory_current: int,
+    write_ms: int,
+    signal: str,
+    context: dict,
+    rate_mb_per_min: float | None,
+) -> None:
+    """Emit when the reversible cgroup memory.high soft-brake engaged on serve's
+    own leaf under sustained warning pressure. ``previous``/``written`` bracket
+    the reversible write; ``signal``/``context`` are the triggering Pressure;
+    ``rate_mb_per_min`` rides along as growth-rate context for Pi calibration."""
+    from agent_runner.events import MEMORY_HIGH_ENGAGED, emit
+
+    emit(
+        log_dir,
+        MEMORY_HIGH_ENGAGED,
+        round_num=round_num,
+        previous=previous,
+        written=written,
+        memory_current=memory_current,
+        write_ms=write_ms,
+        signal=signal,
+        context=context,
+        rate_mb_per_min=rate_mb_per_min,
+    )
+
+
+def emit_memory_high_released(log_dir: Path, *, round_num: int, reason: str) -> None:
+    """Emit when the soft-brake was restored to its stashed value. ``reason`` is
+    ``recovered`` (N healthy ticks) or ``round_end`` (the finally restore, which
+    covers every exit path out of the round incl. wedged/exception)."""
+    from agent_runner.events import MEMORY_HIGH_RELEASED, emit
+
+    emit(log_dir, MEMORY_HIGH_RELEASED, round_num=round_num, reason=reason)
+
+
+def emit_memory_high_write_failed(log_dir: Path, *, round_num: int, errno: int | None) -> None:
+    """Emit once when a memory.high write (engage or restore) hit an OSError --
+    fail-open: the brake disarms for the round and serve continues unthrottled,
+    exactly as when the brake is configured off. ``errno`` is the real OSError
+    code from the engage path; the restore path (which only sees a bool from
+    :func:`agent_runner.metrics.restore_leaf_memory_high`) passes ``None`` --
+    never ``0``, which conventionally reads as POSIX success."""
+    from agent_runner.events import MEMORY_HIGH_WRITE_FAILED, emit
+
+    emit(log_dir, MEMORY_HIGH_WRITE_FAILED, round_num=round_num, errno=errno)
+
+
 def emit_cgroup_growth_rate_warning(
     log_dir: Path,
     *,

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/agent_runner/_lifecycle.py

@@ -181,17 +181,26 @@ def _terminate_round_pid(pid: int) -> None:
     """TERM-first -> grace -> SIGKILL a bare round-child pid.
 
     Mirrors ``serve_cmd._terminate_round``'s shape, but this runs from a
-    SEPARATE CLI process (``kill()``) that only has the pid — not serve's own
+    SEPARATE CLI process (``kill()``) that only has the pid -- not serve's own
     ``Popen`` handle. Never ``killpg``: the round is ``start_new_session=True``,
-    so its own pgid holds only itself, and even a killpg on it cannot reach the
-    agent (itself a separate session again, ``agent_runtime.py``) — only the
-    round's own SIGTERM -> KeyboardInterrupt handler (``round_cmd.py``) walks
-    that link and reaps the agent pgroup via ``_kill_pgroup``. A plain SIGTERM
-    here fires exactly that handler; SIGKILL is only the last-resort escalation
-    for a round that doesn't even get to run its handler."""
+    so a plain SIGTERM here fires the round's own SIGTERM -> KeyboardInterrupt
+    handler (``round_cmd.py``), which walks the link to the agent pgroup and
+    reaps it via ``_kill_pgroup`` (itself snapshotting and reaping any stray).
+    SIGKILL is only the last-resort escalation for a round that never even runs
+    its handler -- and on THAT path the leader's own cooperative reap never
+    happened, so we snapshot the leader's descendants up front (while the leader
+    subtree is still resolvable) via a bare-pid shim and reap the strays here:
+    a descendant that ``setsid()``'d off the leader's pgroup would otherwise
+    survive the leader's death, orphaned. Symmetric with ``serve stop``."""
+    import types
+
+    from agent_runner import agent_runtime
+
+    stray = agent_runtime._snapshot_stray_descendants(types.SimpleNamespace(pid=pid))
     send_signal_to_pid(pid, signal.SIGTERM)
     if _await_pid_exit(pid, _ROUND_TERM_GRACE_S):
         send_signal_to_pid(pid, signal.SIGKILL)
+        agent_runtime._kill_stray_descendants(stray)
 
 
 def stop(project: str | Path) -> ServiceStatus:

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/agent_runner/_notify.py

@@ -78,11 +78,14 @@ def drain(fd: int) -> None:
     ``select()`` on it instantly ready -- an undrained fd busy-spins its
     caller at 100% CPU forever after the first wake, since a level-triggered
     fd stays readable until read. Advisory: the bytes carry no payload and are
-    discarded. Used only by :meth:`Listener.wait` (its own timeout branch) --
-    the pause/sleep waits (``_interruptible_sleep``/``_pause_poll``) are the
-    sole consumers of a live ``Listener``. Nothing watches this fd mid-round
-    (``_spawn_round`` only ever waits on the round leader's own exit fd), so
-    there is no other caller that must drain it itself.
+    discarded. Two callers: :meth:`Listener.wait` self-drains its own fd on the
+    wake branch (the pause/sleep waits ``_interruptible_sleep``/``_pause_poll``
+    are the consumers of a live ``Listener``); and the sandboxed-hook trampoline
+    (``_plugin_sandbox._run_child_process``, P3) drains the CALLER-OWNED wake fd
+    it was handed on the ``"woken"`` branch of its exit wait, before re-checking
+    ``should_stop()`` -- that fd is the serve listener's, watched by
+    ``wait_exit`` for the duration of the hook, so the trampoline must drain it
+    itself rather than leave the next wait instantly ready.
     """
     while True:
         try:
@@ -179,7 +182,13 @@ class Listener:
         """
         deadline = clock.monotonic() + timeout_s
         remaining = max(0.0, deadline - clock.monotonic())
-        ready, _, _ = select.select([self.fd], [], [], remaining)
+        try:
+            ready, _, _ = select.select([self.fd], [], [], remaining)
+        except ValueError:
+            # fd >= FD_SETSIZE (1024) makes select.select raise ValueError --
+            # degrade to a plain timed sleep instead of crashing.
+            clock.sleep(remaining)
+            return False
         if not ready:
             return False
 

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/agent_runner/_plugin_sandbox.py

@@ -17,12 +17,15 @@ from __future__ import annotations
 import json
 import subprocess
 import sys
+from collections.abc import Callable
 from pathlib import Path
 from typing import Literal
 
-from agent_runner import hooks
+from agent_runner import _notify, hooks
+from agent_runner._procwait import wait_exit
 from agent_runner._registry import resolve_entry_target
 from agent_runner.api_types import DirtyOutcome, SpawnDecision
+from agent_runner.clock import SYSTEM_CLOCK
 
 _TRAMPOLINE_TIMEOUT_S = 30.0  # wall-clock; not config-tunable this release
 _MAX_WIRE_BYTES = 64 * 1024
@@ -30,6 +33,17 @@ _MAX_STDERR_BYTES = 8 * 1024  # hard read cap; a runaway child can't OOM the sup
 _REF_CAP = 256
 _STDERR_CAP = 512
 
+# Total wall budget for draining a confined child's pipes AFTER it is reaped. A
+# process the hook itself fork()'d inherits the child's stdout/stderr and can hold
+# them open past the child's own death, so the drain join is BOUNDED, not
+# unbounded -- otherwise a single such pipe-holder stalls the stop forever. The
+# pair of joins shares ONE absolute deadline (not _DRAIN_JOIN_S each), and
+# _DRAIN_JOIN_S + 3 <= _lifecycle._PID_SIGNAL_GRACE_S leaves >=3 s of the
+# stop-confirm window for the rest of the unwind (pinned by
+# tests/invariants/test_timeout_budget_invariant.py; a literal mirror -- this
+# module must never import _lifecycle in production).
+_DRAIN_JOIN_S = 2
+
 # The child's environment is built default-DENY from this allowlist -- NOT copied
 # from the parent's, which holds the real agent secrets (ANTHROPIC_*, and every
 # *_API_KEY/*_TOKEN/*_SECRET agent_runtime injects). A confined plugin is Python
@@ -126,6 +140,13 @@ def _ctx_from_wire(data: dict) -> hooks.HookContext:
 # ---------------------------------------------------------------------------
 
 
+class SpawnHookInterrupted(Exception):  # noqa: N818 -- a control-flow signal, not an error
+    """Raised by ``_run_child_process`` when ``should_stop()`` fires on a wake
+    during a sandboxed spawn hook -- distinct from a plugin failure so the seam
+    returns ``None`` WITHOUT emitting ``hook_failed`` (a stop is not the plugin's
+    fault). Never raised on the dirty round path, which passes no ``wake_fd``."""
+
+
 def run_hook_sandboxed(
     hook_kind: Literal["spawn_hook", "dirty_handler"],
     module_path: str,
@@ -137,6 +158,8 @@ def run_hook_sandboxed(
     dirty_files: list[str] | None = None,
     view: hooks.SpawnView | None = None,
     timeout_s: float = _TRAMPOLINE_TIMEOUT_S,
+    wake_fd: int | None = None,
+    should_stop: Callable[[], bool] | None = None,
 ) -> SpawnDecision | DirtyOutcome | None:
     """Launch the confinement child for one third-party hook call and return its
     validated outcome. ``module_path``/``attr_path`` locate the plugin the child
@@ -172,6 +195,8 @@ def run_hook_sandboxed(
         ],
         json.dumps(payload).encode("utf-8"),
         timeout_s,
+        wake_fd=wake_fd,
+        should_stop=should_stop,
     )
     if returncode < 0:
         from agent_runner.api import emit_plugin_sandbox_kill
@@ -224,14 +249,50 @@ def _drain_capped(stream, cap: int, out: list[bytes]) -> None:
         out.append(bytes(data))
 
 
+def _join_drain_threads(threads: tuple, budget_s: float) -> bool:
+    """Join the drain threads under ONE absolute deadline -- the whole set is
+    bounded by ``budget_s``, NOT ``budget_s`` each -- so a process the hook
+    ``fork()``'d that still holds the reaped child's output pipe open cannot stall
+    the join past ``budget_s``. Returns True iff every thread finished draining
+    within the budget (the normal-exit path raises on False; the ``BaseException``
+    cleanup path ignores it, since it is already unwinding)."""
+    join_deadline = SYSTEM_CLOCK.monotonic() + budget_s
+    for t in threads:
+        t.join(max(0.0, join_deadline - SYSTEM_CLOCK.monotonic()))
+    return not any(t.is_alive() for t in threads)
+
+
 def _run_child_process(
-    argv: list[str], stdin_bytes: bytes, timeout_s: float
+    argv: list[str],
+    stdin_bytes: bytes,
+    timeout_s: float,
+    *,
+    wake_fd: int | None = None,
+    should_stop: Callable[[], bool] | None = None,
 ) -> tuple[int, bytes, bytes]:
     """Spawn the confined child with the minimal env and read BOUNDED stdout/stderr
     concurrently (a thread per stream), so a plugin printing without limit within
     the wall-timeout cannot exhaust supervisor memory. Concurrent draining also
-    avoids a full-pipe deadlock. On timeout the child is killed and
-    ``TimeoutExpired`` propagates (the caller isolates it as ``hook_failed``)."""
+    avoids a full-pipe deadlock.
+
+    The exit wait is the fd-driven ``_procwait.wait_exit`` (not a sleep-poll):
+    ``"exited"`` reaps and returns; ``"timeout"`` kills and raises
+    ``TimeoutExpired`` (the caller isolates it as ``hook_failed``); ``"woken"``
+    (only when ``wake_fd`` is set) drains the advisory byte and, if
+    ``should_stop()`` is now true, kills the child and raises
+    ``SpawnHookInterrupted`` -- otherwise a stray ring re-enters the wait on the
+    SAME ABSOLUTE deadline so it never shortens the hook's budget. The whole wait
+    is wrapped so the confined child NEVER outlives its parent: any BaseException
+    (a round ``KeyboardInterrupt``, a timeout, an interrupt) kills and reaps the
+    child before propagating.
+
+    A process the hook itself ``fork()``s is NOT reaped (that child has no process
+    group of its own -- see the Option-B follow-up), and it can inherit and hold
+    the child's stdout/stderr open past the child's own death; so the drain joins
+    are BOUNDED (``_DRAIN_JOIN_S``, one absolute deadline across the pair) at BOTH
+    the normal-exit tail and the ``BaseException`` cleanup -- such a pipe-holder can
+    never stall the parent. On the normal path a timed-out drain surfaces as a
+    ``RuntimeError`` the seam isolates as ``hook_failed``."""
     import threading
 
     proc = subprocess.Popen(
@@ -243,9 +304,17 @@ def _run_child_process(
     )
     out_box: list[bytes] = []
     err_box: list[bytes] = []
-    # +1 so an over-cap stdout stays over the limit and _parse_dirty_stdout rejects it.
-    t_out = threading.Thread(target=_drain_capped, args=(proc.stdout, _MAX_WIRE_BYTES + 1, out_box))
-    t_err = threading.Thread(target=_drain_capped, args=(proc.stderr, _MAX_STDERR_BYTES, err_box))
+    # daemon=True is load-bearing, not cosmetic: nothing in agent_runner/ calls
+    # os._exit, so a non-daemon drain thread still blocked on a fork()'d
+    # pipe-holder's read() would be joined by threading._shutdown() at interpreter
+    # exit and re-hang the stop the bounded join below just rescued. Matches the
+    # repo's other pump threads (remote_relay._pump, agent_runtime._write_stdin).
+    t_out = threading.Thread(
+        target=_drain_capped, args=(proc.stdout, _MAX_WIRE_BYTES + 1, out_box), daemon=True
+    )
+    t_err = threading.Thread(
+        target=_drain_capped, args=(proc.stderr, _MAX_STDERR_BYTES, err_box), daemon=True
+    )
     t_out.start()
     t_err.start()
     try:
@@ -255,15 +324,26 @@ def _run_child_process(
             pass
         finally:
             proc.stdin.close()
-        proc.wait(timeout=timeout_s)
-    except subprocess.TimeoutExpired:
+        deadline = SYSTEM_CLOCK.monotonic() + timeout_s
+        while True:
+            outcome = wait_exit(proc, deadline=deadline, wake_fd=wake_fd)
+            if outcome == "exited":
+                proc.wait()
+                break
+            if outcome == "timeout":
+                raise subprocess.TimeoutExpired(proc.args, timeout_s)
+            _notify.drain(wake_fd)
+            if should_stop is not None and should_stop():
+                raise SpawnHookInterrupted(f"spawn hook interrupted for {argv[0]!r}")
+    except BaseException:
         proc.kill()
         proc.wait()
-        t_out.join()
-        t_err.join()
+        _join_drain_threads((t_out, t_err), _DRAIN_JOIN_S)
         raise
-    t_out.join()
-    t_err.join()
+    if not _join_drain_threads((t_out, t_err), _DRAIN_JOIN_S):
+        raise RuntimeError(
+            "drain timed out: a process the hook forked still holds its output pipe (not reaped)"
+        )
     return proc.returncode, out_box[0], err_box[0]
 
 

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/agent_runner/_procwait.py

@@ -96,12 +96,13 @@ def wait_exit(
     *,
     deadline: float,
     clock: Clock = SYSTEM_CLOCK,
-) -> Literal["exited", "timeout"]:
-    """Block until ``proc`` exits or ``deadline`` (a ``clock.monotonic()``
-    timestamp) is reached, whichever is soonest. Never calls
-    ``os.waitpid``/``proc.wait``/``proc.poll`` on the fast path -- a caller
-    that gets back ``"exited"`` must reap ``proc`` itself right after this
-    returns (see the module docstring).
+    wake_fd: int | None = None,
+) -> Literal["exited", "timeout", "woken"]:
+    """Block until ``proc`` exits, ``deadline`` (a ``clock.monotonic()``
+    timestamp) is reached, or ``wake_fd`` becomes readable -- whichever is
+    soonest. Never calls ``os.waitpid``/``proc.wait``/``proc.poll`` on the
+    fast path -- a caller that gets back ``"exited"`` must reap ``proc``
+    itself right after this returns (see the module docstring).
 
     Opens and closes its own ``exit_fd(proc)`` registration internally, once
     per call, in a single ``select.select`` -- callers invoke this at most
@@ -110,16 +111,27 @@ def wait_exit(
     across calls.
 
     Returns ``"exited"`` (the caller should immediately reap, e.g.
-    ``proc.wait()``) or ``"timeout"`` (deadline reached, proc still running,
-    caller re-evaluates its own logic). When ``proc`` has already exited by
-    the time ``deadline`` is reached, the exit fd is ready in the SAME
-    ``select`` call that also times out -- the exit always wins that tie, so
-    an already-dead proc is never mistakenly reported as ``"timeout"``.
+    ``proc.wait()``), ``"timeout"`` (deadline reached, proc still running,
+    caller re-evaluates its own logic), or ``"woken"`` (only possible when
+    ``wake_fd`` is given: it became readable before either of the other two).
+    When ``proc`` has already exited by the time ``deadline`` is reached, the
+    exit fd is ready in the SAME ``select`` call that also times out -- the
+    exit always wins that tie, so an already-dead proc is never mistakenly
+    reported as ``"timeout"``. Likewise, when both the exit fd and
+    ``wake_fd`` are ready in the same ``select`` call, the exit fd wins --
+    an already-dead proc is never mistakenly reported as ``"woken"``.
+    ``wake_fd`` is caller-owned: this function neither opens, closes, nor
+    drains it (the caller drains it after a ``"woken"`` return); ``_procwait``
+    never imports ``_notify``.
 
     Fallback (``exit_fd(proc)`` is ``None``): polls ``proc.poll()`` at a
     short, fixed cadence via ``clock.sleep``, with the same two return
-    meanings, so a test driving this path with a fake clock still makes
-    progress without blocking on real wall time.
+    meanings (``wake_fd`` is IGNORED on this path -- a documented latency
+    degrade, not a "woken" report), so a test driving this path with a fake
+    clock still makes progress without blocking on real wall time. The same
+    poll fallback is also used when the fast path's ``select.select`` raises
+    ``ValueError`` (a fd >= ``FD_SETSIZE``, 1024, is unselectable) instead of
+    crashing.
 
     Short-circuits to ``"exited"`` when ``proc.returncode`` is already set:
     this owner has already reaped it, so its pid is freed (and may be reused).
@@ -139,8 +151,19 @@ def wait_exit(
 
     try:
         remaining = max(0.0, deadline - clock.monotonic())
-        ready, _, _ = select.select([fd], [], [], remaining)
-        return "exited" if ready else "timeout"
+        rlist = [fd, wake_fd] if wake_fd is not None else [fd]
+        try:
+            ready, _, _ = select.select(rlist, [], [], remaining)
+        except ValueError:
+            # fd >= FD_SETSIZE (1024) makes select.select raise ValueError --
+            # degrade to the poll fallback (its documented latency) instead
+            # of crashing.
+            return _wait_exit_by_polling(proc, deadline=deadline, clock=clock)
+        if fd in ready:
+            return "exited"
+        if ready:
+            return "woken"
+        return "timeout"
     finally:
         os.close(fd)
 

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/agent_runner/_version.py

@@ -18,7 +18,7 @@ version_tuple: tuple[int | str, ...]
 commit_id: str | None
 __commit_id__: str | None
 
-__version__ = version = '0.3.5'
-__version_tuple__ = version_tuple = (0, 3, 5)
+__version__ = version = '0.3.7'
+__version_tuple__ = version_tuple = (0, 3, 7)
 
 __commit_id__ = commit_id = None

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/agent_runner/agent_runtime.py

@@ -141,7 +141,7 @@ def _snapshot_stray_descendants(proc: subprocess.Popen) -> list[dict]:
     while the leader (and hence its subtree) is still alive -- both reap sites
     (``_kill_pgroup`` and ``cli/_serve_round._terminate_round``) open with it, so
     the capture-before-signal ordering lives in ONE place, not copy-pasted."""
-    stray, _ignored = _live_children(proc)
+    stray, _ignored = _live_children(proc, max_n=None)
     _capture_descendant_pgids(stray)
     return stray
 
@@ -206,7 +206,7 @@ def _live_children(
     proc: subprocess.Popen,
     *,
     ignore_patterns: list[re.Pattern[str]] | None = None,
-    max_n: int = 5,
+    max_n: int | None = 5,
 ) -> tuple[list[dict], list[dict]]:
     """Live (non-zombie) descendants of ``proc``, split into ``(live, ignored)``.
 
@@ -217,6 +217,12 @@ def _live_children(
     events-*.jsonl. Ignore-pattern MATCHING runs against the full cmdline
     (detection unchanged); only what we STORE is minimized.
 
+    ``max_n`` (default 5) bounds only the event-persisted lists this returns
+    to a caller that writes them to events-*.jsonl. The reap snapshot
+    (``_snapshot_stray_descendants``) passes ``max_n=None`` — a real subtree
+    can exceed 5 live descendants, and undercounting it here would leave the
+    excess unreaped, not merely under-logged.
+
     The stored name is read from the kernel-reported process name (comm —
     e.g. /proc/<pid>/comm on Linux), not from ``Path(argv[0]).name``: comm is
     derived from the exec()'d binary, not from argv[0], and is itself
@@ -251,11 +257,11 @@ def _live_children(
                     matched = p.pattern
                     break
         if matched is not None:
-            if len(ignored) < max_n:
+            if max_n is None or len(ignored) < max_n:
                 ignored.append({"name": name, "pid": pid, "matched": matched})
-        elif len(live) < max_n:
+        elif max_n is None or len(live) < max_n:
             live.append({"name": name, "pid": pid})
-        if len(live) >= max_n and len(ignored) >= max_n:
+        if max_n is not None and len(live) >= max_n and len(ignored) >= max_n:
             break
     return live, ignored
 

{cli_agent_runner-0.3.5 → cli_agent_runner-0.3.7}/agent_runner/api.py

@@ -41,6 +41,9 @@ from agent_runner._emit import (  # noqa: E402,F401 — intentional bottom re-ex
     emit_mem_loop,
     emit_mem_loop_persistent,
     emit_mem_pressure_deferred_to_cgroup,
+    emit_memory_high_engaged,
+    emit_memory_high_released,
+    emit_memory_high_write_failed,
     emit_plugin_builtin_name_squat,
     emit_plugin_checksum_mismatch,
     emit_plugin_sandbox_degraded,