fix(agent)!: bound repair execution and cancellation

[HomenShum]

Slow repairs previously blocked the caller inside spawnSync, including through the Promise facade, with no elapsed-time limit. The existing launcher now yields to the caller, accepts a per-repair deadline and AbortSignal, bounds captured output to 1 MiB per stream, and preserves failure when timeout, cancellation, I/O or cleanup cannot be confirmed. The loop and direct CLI relaunch await the result; a failed repair cannot start another gate or repair.

This deliberately changes the direct public export to Promise<AgentRunResult>. The settled result shape stays the same. Version metadata moves to 0.4.0 and the walkthrough documents await inside try/catch; no package publication or dependency upgrade is included.

Verification:

• Independent Windows Node 22.22.2 ordinary check: build/pretest, 381 passed, three POSIX skips, and zero full/production audit vulnerabilities.
• The unchanged four-second local fixture previously delayed a caller's 100 ms timer to 4,092 ms. Independent candidate replay observed 107 ms; slow CLI/API jobs failed at 1,658/1,652 ms including cleanup, with stopped heartbeats, retained receipts and no follow-on work. The fast repair control passed.
• Scenarios cover cancellation, malformed values, unavailable input/launch, early stdin close, overflow, persistence failure, three concurrent CLI jobs and twelve sequential jobs.
• Independent round 1 review required stronger POSIX termination proof. Round 2 approves the exact corrected candidate: inherited output after root exit or continued activity after ignored TERM, followed by stopped heartbeats before six-second expiry. Independent Linux acceptance also approves the tested merge tree and all 22 reviewed blobs. Ubuntu Node 20.20.2 CI passes 383 tests with one Windows-only skip across 35 files; the existing gate repeats the same suite. Inherited-pipe activity stops in 679/680 ms and TERM-ignoring activity in 1,082/1,081 ms, including a 300 ms observation, before six-second natural expiry. All four observations have stable heartbeats and no cleanup-unverified result. The real POSIX CLI interrupt scenario passes. Full audit, build, conformance and smoke checks pass.

Reviewed patch SHA256: 9b781bbcf9843bf4e169f7064bffd88f7be314961bd0f5b1e018eb46c9271d84. All 22 committed Git blobs match the reviewed binding at head f052988980a0f1c0d5bd1a06aa06ea2a3f0552be, tree 0012154c750fdef9cbf3a4228e411a422d422320.

The timeout covers the owned repair, followed by a fixed cleanup allowance (Windows up to four seconds, POSIX up to two). Synchronous gates and local file I/O are not a hard whole-loop deadline. Failed cleanup stays explicitly cleanup-unverified. Normal exit does not certify arbitrary detached, reparented or remote jobs. Windows console interruption and the Windows inherited-pipe case remain unproved; no provider/model calls or visual changes are part of this patch.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
proofloop	Building	Preview	Oct 14, 2026 9:16pm UTC