webbee 0.3.16__tar.gz → 0.3.17__tar.gz

{webbee-0.3.16 → webbee-0.3.17}/CHANGELOG.md

@@ -1,5 +1,39 @@
 # Changelog
 
+## 0.3.17
+
+Bulletproof core (W1): a marathon can no longer be killed by transport, the
+queue survives every error class, and the client stops leaking memory.
+
+- A gateway blip mid-run (502, deploy, network drop) no longer kills the turn:
+  the stream patiently reconnects and resumes exactly where it left off, the
+  toolbar shows an honest `⟳ reconnecting` state, and only a real sign-out
+  ends the run — with a clear "run /login" message instead of a raw error.
+- A stream 401 gets ONE forced token refresh before it counts as a sign-out,
+  and a refresh that fails because the gateway was mid-deploy no longer burns
+  that chance.
+- Every message now carries a dedup key end-to-end, so a retried send after an
+  ambiguous network failure can never execute the same instruction twice.
+- The turn-start and result posts retry transient failures too — outage
+  recovery drops from minutes to seconds.
+- A turn that ends in an error HOLDS the queued messages (with an honest note)
+  instead of burning them one failing turn at a time; a parked marathon keeps
+  its queued rows visible, tagged ⏸.
+- A stuck busy flag can no longer starve remote-message pickup; a message the
+  kernel deduplicated ends its wait honestly instead of spinning forever.
+- Pull a queued message to edit and resubmit it unchanged — it keeps its dedup
+  identity.
+- Click the queue or todo panel header to collapse it to one row (▸/▾).
+- Performance: one keep-alive connection replaces a TLS handshake every 4s;
+  the idle poll relaxes to 30s after 5 quiet minutes; hours-long marathons no
+  longer grow memory without bound; transcript rendering is O(new output) per
+  print; embedding vectors load memory-mapped.
+- Windows groundwork: `.git` filters now match Windows paths (no reindex
+  storms).
+
+Companion release: imperal-mcp 0.5.2 — only a real 401 means "signed out";
+gateway 5xx/network errors during a token refresh are retryable.
+
 ## 0.3.16
 
 - A message typed while Webbee is working now shows in the queue panel

{webbee-0.3.16 → webbee-0.3.17}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: webbee
-Version: 0.3.16
+Version: 0.3.17
 Summary: Webbee 🐝 — the Imperal Cloud coding agent in your terminal
 Project-URL: Homepage, https://imperal.io
 Project-URL: Documentation, https://docs.imperal.io

{webbee-0.3.16 → webbee-0.3.17}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "webbee"
-version = "0.3.16"
+version = "0.3.17"
 description = "Webbee 🐝 — the Imperal Cloud coding agent in your terminal"
 readme = "README.md"
 license = "MIT"

webbee-0.3.17/src/webbee/__init__.py

@@ -0,0 +1 @@
+__version__ = "0.3.17"

webbee-0.3.17/src/webbee/http.py

@@ -0,0 +1,11 @@
+"""ONE keep-alive httpx.AsyncClient for the client's small gateway calls.
+Before W1 the idle-steer poller opened a NEW AsyncClient — a fresh TCP+TLS
+handshake — every 4s tick, forever (thread.py per-call clients). The repl owns
+one client for the loop's lifetime and passes it down; every callee keeps a
+per-call fallback so tests and old call sites work unchanged."""
+from __future__ import annotations
+
+
+def make_client(cfg):
+    import httpx
+    return httpx.AsyncClient(base_url=cfg.api_url, timeout=10)

{webbee-0.3.16 → webbee-0.3.17}/src/webbee/intel/store.py

@@ -99,10 +99,17 @@ def load_vectors(cache_dir, repo_key, git_ref, model_id):
         if (meta.get("schema_version") != SCHEMA_VERSION or meta.get("git_ref") != git_ref
                 or meta.get("model_id") != model_id):
             return None
-        mat = np.load(os.path.join(d, "embeddings.npy"))
+        # mmap_mode="r": the on-disk cache can be large across a big repo's
+        # chunk set -- read it lazily off disk instead of paging the whole
+        # matrix into RAM up front. save_vectors always writes float32, so
+        # the astype copy below only fires on an actual dtype mismatch
+        # (e.g. an older/foreign cache file), not on every load.
+        mat = np.load(os.path.join(d, "embeddings.npy"), mmap_mode="r")
         ids = meta.get("ids") or []
         if len(ids) != mat.shape[0]:
             return None
-        return ids, mat.astype(np.float32)
+        if mat.dtype != np.float32:
+            mat = mat.astype(np.float32)
+        return ids, mat
     except Exception:
         return None

{webbee-0.3.16 → webbee-0.3.17}/src/webbee/intel/vectors.py

@@ -20,6 +20,15 @@ class VectorStore:
         rows = []
         for i, _id in enumerate(ids):
             if _id in self._pos:
+                if not self._mat.flags.writeable:
+                    # Copy-on-write: _mat may be a read-only mmap loaded
+                    # straight off the vector cache (store.load_vectors'
+                    # mmap_mode="r" perf win) via from_arrays. A read-only
+                    # boot+search session never reaches this branch; only an
+                    # incremental re-embed of an existing chunk id (same id,
+                    # changed content) needs to mutate a row in place, so pay
+                    # for exactly one full copy here, lazily.
+                    self._mat = np.array(self._mat)
                 self._mat[self._pos[_id]] = vecs[i]
             else:
                 self._pos[_id] = len(self._ids)

{webbee-0.3.16 → webbee-0.3.17}/src/webbee/intel/watch.py

@@ -6,6 +6,14 @@ import asyncio
 import os
 
 
+def _ignored(path: str) -> bool:
+    """PURE. True for VCS/vendor churn. Normalized to forward slashes so the
+    filter works on Windows too (watchfiles yields backslash paths there --
+    unfiltered .git churn re-indexed the repo on every checkpoint)."""
+    p = path.replace(os.sep, "/").replace("\\", "/")
+    return "/.git/" in p or "/node_modules/" in p
+
+
 async def watch_workspace(root: str, on_change) -> None:
     """Call on_change(set_of_relpaths) as files change. Fail-soft: if
     watchfiles is unavailable, return immediately (no watcher)."""
@@ -16,7 +24,7 @@ async def watch_workspace(root: str, on_change) -> None:
     async for changes in awatch(root):
         rels = set()
         for _chg, path in changes:
-            if "/.git/" in path or "/node_modules/" in path:
+            if _ignored(path):
                 continue
             try:
                 rels.add(os.path.relpath(path, root))

{webbee-0.3.16 → webbee-0.3.17}/src/webbee/output_pane.py

@@ -24,12 +24,12 @@ class OutputPane:
         self.console = Console(file=self._io, force_terminal=True,
                                color_system="truecolor", width=width, highlight=False)
         self._ANSI = ANSI
-        self._lines_cache = (None, [""])   # (write-pos, split-lines) — memoize the split
+        self._lines_cache = (0, [""])      # (write-pos, split-lines) — memoize the split
         self._offset = 0                   # index of the top visible line
         self._view_h = 20                  # viewport height (updated from render_info)
         self._follow = True                # stick to the tail unless the user scrolled up
         self._sel = None                   # (abs_start, abs_end) during a drag → live highlight
-        self._plain_cache = (None, [""])   # (write-pos, ANSI-stripped lines) for select/highlight
+        self._plain_cache = (0, [""])      # (write-pos, ANSI-stripped lines) for select/highlight
         self.copy_flash = ""               # transient toolbar note after a copy
         self._flash_until = 0.0
         pane = self
@@ -80,21 +80,44 @@ class OutputPane:
     def _all_lines(self):
         # Key the cache on the stream WRITE POSITION (O(1)), not a full-buffer
         # getvalue()+string compare (O(session)) — that ran on EVERY redraw
-        # (keystroke / ticker / scroll) and made big sessions lag. getvalue()
-        # + re-split happen ONLY when new output actually arrived.
+        # (keystroke / ticker / scroll) and made big sessions lag. Beyond that,
+        # only the DELTA since the cached position is read and split — the
+        # cached list is extended IN PLACE, so a print costs O(new output),
+        # never a full-buffer re-split (that made long busy streams
+        # quadratic). Boundary safety: the cache only ever advances at print
+        # boundaries (Console.print completes before notify() runs), so an
+        # SGR escape can never split across a delta read.
         pos = self._io.tell()
-        if self._lines_cache[0] != pos:
-            s = self._io.getvalue()
-            self._lines_cache = (pos, s.split("\n"))
-        return self._lines_cache[1]
+        cpos, lines = self._lines_cache
+        if cpos == pos:
+            return lines
+        if isinstance(cpos, int) and 0 <= cpos < pos:
+            self._io.seek(cpos)
+            delta = self._io.read()          # leaves position at EOF (== pos)
+            parts = delta.split("\n")
+            lines[-1] += parts[0]
+            lines.extend(parts[1:])
+        else:
+            lines = self._io.getvalue().split("\n")
+        self._lines_cache = (pos, lines)
+        return lines
 
     def _plain_lines(self):
         import re
         pos = self._io.tell()
-        if self._plain_cache[0] != pos:
-            s = self._io.getvalue()
-            self._plain_cache = (pos, re.sub(r"\x1b\[[0-9;]*m", "", s).split("\n"))
-        return self._plain_cache[1]
+        cpos, lines = self._plain_cache
+        if cpos == pos:
+            return lines
+        if isinstance(cpos, int) and 0 <= cpos < pos:
+            self._io.seek(cpos)
+            delta = re.sub(r"\x1b\[[0-9;]*m", "", self._io.read())
+            parts = delta.split("\n")
+            lines[-1] += parts[0]
+            lines.extend(parts[1:])
+        else:
+            lines = re.sub(r"\x1b\[[0-9;]*m", "", self._io.getvalue()).split("\n")
+        self._plain_cache = (pos, lines)
+        return lines
 
     def _norm_sel(self):
         (a, b) = self._sel
@@ -151,14 +174,25 @@ class OutputPane:
         except Exception:
             pass
 
-    def _trim(self, max_lines: int = 20000) -> None:
+    def _trim(self, max_lines: int = 20000, keep: int = 15000) -> None:
+        # Hysteresis: only trim once past max_lines, and cut down to `keep`
+        # (not max_lines) — trimming is amortized over 5000 lines of headroom
+        # instead of firing on every single print once the ceiling is hit.
         import io
-        s = self._io.getvalue()
-        if s.count("\n") > max_lines:
-            s = "\n".join(s.split("\n")[-max_lines:])
-            self._io = io.StringIO()
-            self._io.write(s)
-            self.console.file = self._io
+        lines = self._all_lines()
+        if len(lines) <= max_lines:
+            return
+        dropped = len(lines) - keep
+        s = "\n".join(lines[-keep:])
+        self._io = io.StringIO()
+        self._io.write(s)
+        self.console.file = self._io
+        self._lines_cache = (0, [""])
+        self._plain_cache = (0, [""])
+        # A scrolled-up reader keeps looking at the SAME content lines — the
+        # dropped count is subtracted from `_offset` so the viewport doesn't
+        # silently jump when the buffer is rewritten underneath it.
+        self._offset = max(0, self._offset - dropped)
 
     def dump(self) -> str:
         """The full session transcript (ANSI). Printed to real stdout on exit so

{webbee-0.3.16 → webbee-0.3.17}/src/webbee/queue_panel.py

@@ -24,17 +24,21 @@ def one_line(text: str, width: int) -> str:
     return t
 
 
-def queue_height(pending, remote=None) -> int:
+def queue_height(pending, remote=None, collapsed=False) -> int:
     """PURE. Rows the panel needs: 1 header + one per SHOWN item + one
     `… +K more` row when a queue is deeper than QP_MAX_ITEMS (each of the
     two sections — remote rows and local rows — caps independently). 0 when
     both are empty (the ConditionalContainer hides the panel then anyway).
-    The cap keeps the output pane dominant on small terminals; the toolbar's
-    `⋯N queued` segment stays the truth-teller for the full depth."""
+    `collapsed=True` (Task 11 click-to-collapse) always costs exactly 1 row
+    when there's data — screen space back on demand. The cap keeps the
+    output pane dominant on small terminals; the toolbar's `⋯N queued`
+    segment stays the truth-teller for the full depth."""
     n = len(pending)
     r = len(remote or ())
     if not n and not r:
         return 0
+    if collapsed:
+        return 1
     rows = 1
     if r:
         rows += min(r, QP_MAX_ITEMS) + (1 if r > QP_MAX_ITEMS else 0)
@@ -43,21 +47,23 @@ def queue_height(pending, remote=None) -> int:
     return rows
 
 
-def pull_item(pending, buf, index: int) -> bool:
+def pull_item(pending, buf, index: int):
     """The ONE pull-to-edit implementation (serves BOTH the ↑ key — newest,
     index len(pending)-1 — and a panel-row click — that row's index): move
     pending[index] OUT of the queue and into the input buffer for editing,
     cursor at the end. Guards, identical on both paths: a buffer with ANY
     text is never clobbered, and a stale index (the queue drained between
-    render and click) is ignored. Returns True when a pull happened (the
-    caller invalidates)."""
+    render and click) is ignored. Returns the removed item (truthy) or None
+    — callers truthy-check, so a QueuedLine's carried steer_iid rides back
+    out with it (tui._rewrap_pulled reuses it when the line is resubmitted
+    unchanged)."""
     if buf.text or not (0 <= index < len(pending)):
-        return False
+        return None
     item = pending[index]
     del pending[index]
-    buf.text = item
-    buf.cursor_position = len(item)
-    return True
+    buf.text = str(item)
+    buf.cursor_position = len(str(item))
+    return item
 
 
 def _item_handler(pull, index: int):
@@ -74,7 +80,21 @@ def _item_handler(pull, index: int):
     return _h
 
 
-def queue_fragments(pending, pull=None, width: int = 0, remote=None):
+def _toggle_handler(toggle):
+    """Header mouse handler (Task 11 click-to-collapse): MOUSE_UP toggles
+    collapse; everything else falls through (NotImplemented) so wheel scroll
+    keeps working — the exact event discipline of _item_handler."""
+    def _h(mouse_event):
+        from prompt_toolkit.mouse_events import MouseEventType
+        if mouse_event.event_type == MouseEventType.MOUSE_UP:
+            toggle()
+            return None
+        return NotImplemented
+    return _h
+
+
+def queue_fragments(pending, pull=None, width: int = 0, remote=None,
+                     collapsed=False, toggle=None):
     """PURE builder: the panel as prompt_toolkit formatted text, re-invoked
     every redraw (same live mechanics as the toolbar) so every queue
     add/edit/drain shows at once. Layout, top→bottom = drain order (FIFO —
@@ -97,13 +117,24 @@ def queue_fragments(pending, pull=None, width: int = 0, remote=None):
     The header counts both; the `↑ edit last` hint shows only when there is
     a local (pullable) item. When `pull` is given each LOCAL item row is a
     3-tuple fragment carrying a mouse handler that pulls exactly that item
-    (see _item_handler). Both queues empty → [] (the panel is hidden)."""
+    (see _item_handler). Both queues empty → [] (the panel is hidden).
+
+    `collapsed` (Task 11 click-to-collapse) folds the whole panel down to
+    ONE header row ending `▸` (screen space back on demand); `▾` when
+    expanded. Both only render when `toggle` is given — the header then
+    carries a 3-tuple MOUSE_UP handler (see _toggle_handler) that flips it."""
     items = list(pending)
     rem = [r for r in (remote or ()) if isinstance(r, dict)]
     n = len(items)
     if not n and not rem:
         return []
-    frags = [("class:qp.header", f" ⋯ queued ({n + len(rem)})")]
+    marker = "" if toggle is None else (" ▸" if collapsed else " ▾")
+    header = ("class:qp.header", f" ⋯ queued ({n + len(rem)}){marker}")
+    if toggle is not None:
+        header = header + (_toggle_handler(toggle),)
+    frags = [header]
+    if collapsed:
+        return frags
     if n:
         frags.append(("class:qp.item", " · ↑ edit last · click to edit"))
     rstart = max(0, len(rem) - QP_MAX_ITEMS)
@@ -111,7 +142,11 @@ def queue_fragments(pending, pull=None, width: int = 0, remote=None):
         frags.append(("class:qp.remote", f"\n   … +{rstart} more"))
     for r in rem[rstart:]:
         origin = str(r.get("origin") or "") or "remote"
-        row = "\n   " + one_line(f"[{origin}] {r.get('text') or ''}",
+        # A row surviving a marathon PARK (W1 front-3b) is still queued
+        # server-side, not phantom -- the ⏸ prefix tells the user it's
+        # waiting on a wake, not about to run right now.
+        mark = "⏸ " if r.get("parked") else ""
+        row = "\n   " + one_line(f"{mark}[{origin}] {r.get('text') or ''}",
                                  width - 4 if width > 0 else 0)
         frags.append(("class:qp.remote", row))
     start = max(0, n - QP_MAX_ITEMS)

{webbee-0.3.16 → webbee-0.3.17}/src/webbee/render.py

@@ -154,6 +154,10 @@ class RichSink:
         self.current_todos: list = []
         self._todo_counts = (0, 0)      # kernel-reported (done, total)
         self._todos_dirty = False       # a turn touched the list -> end_turn records it
+        self._reconnecting = 0          # stream transport down (W1 front-5): armed attempt#, 0 = none
+        self._reconnect_since = None    # clock() at the moment the outage started
+        self._turn_failed = False       # ERROR (not a user stop) ended the last turn (W1 front-3b)
+        self._parked = False            # marathon PARKED this turn (W1 front-3b) -> end_turn keeps remote_pending
 
     def _nudge(self) -> None:
         """After output/state changes: let the pane follow the tail + redraw."""
@@ -217,17 +221,44 @@ class RichSink:
         self.tokens = 0        # per-turn live counters (usage frames are per-turn cumulative)
         self.credits = 0
         self._busy = True
+        self._reconnecting = 0
+        self._reconnect_since = None
+        self._turn_failed = False
+        self._parked = False
         self.console.print()   # breathing room between the user's message and the response
         self._nudge()
 
+    def mark_turn_failed(self) -> None:
+        """The turn ended in an ERROR (not a user stop): the dock's drain rule
+        holds the type-ahead queue instead of burning one queued line into
+        each failing turn (W1 front-3b). One-turn flag; begin_turn clears."""
+        self._turn_failed = True
+
+    def marathon_parked(self, reason: str) -> None:
+        """The run PARKED (runaway/consent/credits — kernel keeps its task
+        queue alive waiting for a wake). end_turn must NOT clear the remote
+        rows: they are still queued server-side; the panel would lie
+        (W1 front-3b, the post-runaway 'empty panel over a non-empty kernel
+        queue'). Rows re-tag ⏸ parked; the next run's task_dequeued frames
+        remove them by iid as the kernel drains."""
+        self._parked = True
+
     def end_turn(self, final_text: str) -> None:
         self._busy = False
         # The kernel session's own queue only exists while a run is live —
-        # once this turn returns (complete / stopped / parked) the terminal
-        # no longer streams its dequeue frames, so any leftover remote rows
-        # would linger as phantoms. Clear them (in place — the panel holds
-        # this list object).
-        self.remote_pending.clear()
+        # once this turn returns COMPLETE or user-stopped, the terminal no
+        # longer streams its dequeue frames, so any leftover remote rows
+        # would linger as phantoms: clear them (in place — the panel holds
+        # this list object). A PARKED turn is different: the kernel queue is
+        # still alive server-side waiting for a wake, so the rows are kept
+        # (tagged parked, ⏸ in the panel) instead of wiped — the next run's
+        # task_dequeued frames remove them by iid as the kernel drains.
+        if self._parked:
+            for r in self.remote_pending:
+                r["parked"] = True
+            self._parked = False
+        else:
+            self.remote_pending.clear()
         # Sticky-todo scrollback record (0.3.15): in the dock the live panel
         # replaced the inline re-renders, so print the FINAL checklist state
         # ONCE per turn that touched it — the transcript keeps the history
@@ -259,6 +290,23 @@ class RichSink:
         self.console.print(_pad(Text(_clean(message), style=_BEE)))
         self._nudge()
 
+    def reconnecting(self, attempt: int, delay: float) -> None:
+        """Stream transport down (W1 front-5): attempt>0 arms the toolbar's
+        `⟳ reconnecting` state (busy stays true — the steer poller keeps off);
+        attempt==0 clears it, printing ONE honest note when the outage lasted
+        >300s (the 24h/10k durable stream may have trimmed frames past our
+        Last-Event-ID — progress lines may be missing, work is NOT lost)."""
+        if attempt:
+            if self._reconnect_since is None:
+                self._reconnect_since = self._clock()
+            self._reconnecting = int(attempt)
+        else:
+            since, self._reconnect_since = self._reconnect_since, None
+            self._reconnecting = 0
+            if since is not None and self._clock() - since > 300:
+                self.note("⟳ reconnected after a long outage — some progress lines may be missing")
+        self._nudge()
+
     def todos(self, items: list, total: int, done: int) -> None:
         """Checklist state for the coding TODO scratchpad. The kernel
         republishes the FULL list on every todo_write; each update replaces
@@ -621,7 +669,9 @@ class RichSink:
                 "elapsed": self._elapsed(), "tools": self._tools,
                 "tokens": self.session_tokens + (self.tokens if self._busy else 0),
                 "credits": self.session_credits + (self.credits if self._busy else 0),
-                "consent": self.consent_pending()}
+                "consent": self.consent_pending(),
+                "reconnecting": self._reconnecting,
+                "turn_failed": self._turn_failed}
 
     def is_busy(self) -> bool:
         return self._busy

{webbee-0.3.16 → webbee-0.3.17}/src/webbee/repl.py

@@ -47,7 +47,10 @@ async def run_marathon(cfg, mode: str, goal: str, *, sink=None, auth=None,
         sink.end_turn("")   # clear busy (poller starvation guard)
         return ""
     except Exception as e:  # network/auth/etc — never crash
-        sink.note(f"Error: {type(e).__name__}: {e}")
+        if type(e).__name__ in ("StreamAuthError", "NotLoggedInError"):
+            sink.note("Session expired or access revoked — run /login to sign in again.")
+        else:
+            sink.note(f"Error: {type(e).__name__}: {e}")
         sink.end_turn("")   # clear busy: a stuck 'working' also starves the idle-steer poller
         return ""
     sink.end_turn(text)
@@ -55,7 +58,7 @@ async def run_marathon(cfg, mode: str, goal: str, *, sink=None, auth=None,
 
 
 async def _inject_via_gateway(cfg, token_provider, agent, sink,
-                              text: str, steer_iid: str) -> bool:
+                              text: str, steer_iid: str, client=None) -> bool:
     """The gateway leg of the dock's Enter-while-busy fly-in (mid-turn inject,
     0.3.15): POST the line straight into the agent's LIVE running session so
     the marathon absorbs it at the next brain step (seconds), instead of
@@ -64,13 +67,18 @@ async def _inject_via_gateway(cfg, token_provider, agent, sink,
     echo drives the panel row. False on ANY failure (no live session yet,
     network, auth, gateway refusal) — the dock then falls back to today's
     local type-ahead queue (tui._inject_or_queue), carrying the same iid so
-    the kernel ring dedups a twin. Module-level so tests drive it directly."""
+    the kernel ring dedups a twin. Module-level so tests drive it directly.
+    `client=` (Task 12) reuses the repl's shared keep-alive AsyncClient; None
+    keeps the per-call client (existing direct tests of this function)."""
     sid = getattr(agent, "session_id", "")
     if not sid:
         return False
     try:
         from webbee.thread import inject_to_session
-        ok = await inject_to_session(cfg, token_provider, sid, text, steer_iid)
+        # Old-style test doubles for inject_to_session don't accept a client
+        # kwarg -- only pass it when the repl actually gave us one.
+        inject_kw = {"client": client} if client is not None else {}
+        ok = await inject_to_session(cfg, token_provider, sid, text, steer_iid, **inject_kw)
     except Exception:
         return False
     if ok:
@@ -78,6 +86,26 @@ async def _inject_via_gateway(cfg, token_provider, agent, sink,
     return ok
 
 
+def _gate_busy(sink, turn_ref: dict) -> bool:
+    """Pure predicate behind `_poller_busy` (module-level so tests drive it
+    directly, unlike the run_repl closure) -- LOCKOUT-PROOF like
+    tui._busy_live: busy counts only while the turn TASK recorded in
+    `turn_ref` is genuinely alive. A BaseException-class escape (or a raise
+    inside end_turn) that leaves the sink's _busy flag stuck must no longer
+    starve the idle-steer poller. `turn_ref` is populated ONLY on the dock
+    path (the SAME dict object shared into tui.run_session); the fallback
+    loop leaves it at {"task": None} forever, so the raw flag governs there
+    (its end_turn paths are deterministic)."""
+    busy = bool(getattr(sink, "is_busy", None) and sink.is_busy())
+    t = turn_ref.get("task")
+    if busy and t is not None and t.done():
+        busy = False
+    if busy:
+        return True
+    cp = getattr(sink, "consent_pending", None)
+    return bool(cp and cp())
+
+
 async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None, read_line=input,
                    agent_factory=None, auth=None, account_fetcher=None,
                    sessions_client=None, intel_factory=None, shadow_factory=None) -> None:
@@ -101,6 +129,12 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
     from webbee.tokens import make_token_provider
     token_provider = make_token_provider(cfg, auth)
 
+    from webbee import http as _http
+    shared_client = None  # created in _boot (needs the running loop); Task 12:
+                          # ONE keep-alive AsyncClient for the poller/inject/
+                          # thread-replay calls instead of a fresh TCP+TLS
+                          # handshake per call.
+
     # Prod dock path = the default reader + a real tty + no injected sink; tests
     # inject sink/read_line and take the plain fallback loop.
     use_dock = sink is None and read_line is input and sys.stdin.isatty()
@@ -109,6 +143,12 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
     # and /queue clear (dispatched through CommandContext.queued, same
     # mechanism /status uses for session state) see the live deque.
     pending_queue: deque = deque()
+    # Shared with tui.run_session on the dock path ONLY (same dict object):
+    # the poller's lockout-proof busy gate reads whether the turn TASK
+    # recorded here is genuinely alive, mirroring tui._busy_live. The
+    # fallback loop never touches this -- it stays {"task": None} and
+    # _gate_busy falls back to the raw sink flag there.
+    turn_ref: dict = {"task": None}
     _sink = None         # assigned by _boot
     agent = None         # assigned by _boot
     intel = None         # assigned by _boot -- IntelService, or None (off/base-install/boot failure)
@@ -271,8 +311,21 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
             _sink.end_turn("")   # clear busy (poller starvation guard)
             return
         except Exception as e:  # network/auth/etc — never crash the REPL
-            _sink.note(f"Error: {type(e).__name__}: {e}")
+            # W1 task 6: flag the sink so the dock's drain rule HOLDS the
+            # type-ahead queue instead of burning one queued line into this
+            # failing turn (getattr-guarded — minimal sinks in tests/headless
+            # callers may not implement it).
+            _mark = getattr(_sink, "mark_turn_failed", None)
+            if _mark is not None:
+                _mark()
+            if type(e).__name__ in ("StreamAuthError", "NotLoggedInError"):
+                _sink.note("Session expired or access revoked — run /login to sign in again.")
+            else:
+                _sink.note(f"Error: {type(e).__name__}: {e}")
             _sink.end_turn("")   # clear busy: a stuck 'working' also starves the idle-steer poller
+            if pending_queue:
+                _sink.note(f"⏸ queue held: {len(pending_queue)} queued message(s) wait "
+                           "— ↑ pulls the next into the input, /queue clear drops them")
             return
         _sink.end_turn(text)
 
@@ -284,15 +337,14 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
         await _run_turn(text, surface=surface, steer_iid=steer_iid)
 
     def _poller_busy() -> bool:
-        """The idle-steer poller's busy gate: the sink's live turn state PLUS
-        an armed local prompt (the autopilot confirm arms the same pinned-
-        input future a consent uses) -- submitting a steer turn under an
-        armed prompt could double-prompt the input, so the poller holds off
-        until it resolves. Both hooks getattr-guarded (minimal test sinks)."""
-        if bool(getattr(_sink, "is_busy", None) and _sink.is_busy()):
-            return True
-        cp = getattr(_sink, "consent_pending", None)
-        return bool(cp and cp())
+        """The idle-steer poller's busy gate: the sink's live turn state
+        (now LOCKOUT-PROOF via _gate_busy -- a dead turn task overrides a
+        stuck busy flag) PLUS an armed local prompt (the autopilot confirm
+        arms the same pinned-input future a consent uses) -- submitting a
+        steer turn under an armed prompt could double-prompt the input, so
+        the poller holds off until it resolves. Both hooks getattr-guarded
+        (minimal test sinks)."""
+        return _gate_busy(_sink, turn_ref)
 
     def _on_mode(mode: str, surface: str) -> None:
         """Remote coding-mode request (TG/panel → gateway one-shot req_mode →
@@ -342,8 +394,11 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
                 _t.cancel()
 
     async def _boot(s) -> None:
-        nonlocal _sink, agent, intel, watcher_task, shadow, steer_task
+        nonlocal _sink, agent, intel, watcher_task, shadow, steer_task, shared_client
         _sink = s
+        # Task 12: the repl-lifetime keep-alive client (needs the running
+        # loop, hence created here rather than at the top of run_repl).
+        shared_client = _http.make_client(cfg)
         # Queue-panel single-source dedup (0.3.16): hand the sink the SAME
         # type-ahead deque tui mutates, so a kernel task_queued echo can
         # promote a landed local twin (matched by steer_iid) into the one
@@ -377,7 +432,7 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
             cfg, token_provider, workspace=workspace, marathon=not once,
             is_busy=_poller_busy,
             live_session_id=lambda: getattr(agent, "session_id", ""),
-            submit=_steer_submit, on_mode=_on_mode))
+            submit=_steer_submit, on_mode=_on_mode, client=shared_client))
 
     if use_dock:
         ok = False
@@ -416,10 +471,17 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
                         remote_pending=getattr(_sink, "remote_pending", None),
                         todos=getattr(_sink, "current_todos", None),
                         inject=lambda text, iid: _inject_via_gateway(
-                            cfg, token_provider, agent, _sink, text, iid),
+                            cfg, token_provider, agent, _sink, text, iid,
+                            client=shared_client),
+                        turn=turn_ref,
                     )
                 finally:
                     _cancel_background()
+                    if shared_client is not None:
+                        try:
+                            await shared_client.aclose()
+                        except Exception:
+                            pass
         except Exception:
             ok = False
         finally:
@@ -454,3 +516,8 @@ async def run_repl(cfg, mode: str = "default", *, once: bool = False, sink=None,
                 return
     finally:
         _cancel_background()
+        if shared_client is not None:
+            try:
+                await shared_client.aclose()
+            except Exception:
+                pass