Monitor `persistent` (removed in Claude Code v2.1.271) is still injected on every background-agent launch; TaskOutput still in allow list and KNOWN_TOOL_NAMES

[cristbc]

Version

LifeOS 7.40.4 (main @ 5e2f2e8), checked against Claude Code 2.1.280.

What is broken

1. Monitor persistent. Claude Code v2.1.271: "Changed Monitor watches to always have a deadline (at most 30 minutes; 10 in single-prompt -p runs) and notify Claude to re-arm, replacing the no-timeout persistent option". The Pulse agent guard still returns this on every background Agent spawn:

Monitor({ description: "Agent watchdog", persistent: true, timeout_ms: 3600000, command: "bun $HOME/.claude/LIFEOS/TOOLS/AgentWatchdog.ts" })

persistent no longer exists and 60 minutes is past the new ceiling, so the model gets told to make a call the harness won't take in that shape. The same guidance sits in AgentWatchdog's usage comment and in two docs.

2. TaskOutput in config. Separate from #2169, which covers the system-prompt line: TaskOutput (removed in v2.1.278) is still in the shipped permissions.allow and in MergeSettings' KNOWN_TOOL_NAMES. MergeSettings prunes rules that name a tool outside that set, so dropping it there also cleans the allow rule on existing installs, the same way the MultiEdit removal did.

Where (file:line)

• LifeOS/install/LIFEOS/PULSE/modules/hooks.ts:118
• LifeOS/install/LIFEOS/TOOLS/AgentWatchdog.ts:21-22
• LifeOS/install/LIFEOS/DOCUMENTATION/Delegation/DelegationSystem.md:207
• LifeOS/install/LIFEOS/DOCUMENTATION/Tools/Tools.md:488, 497, 526, 552
• LifeOS/install/settings.system.json:193
• LifeOS/install/LIFEOS/TOOLS/MergeSettings.ts:229

Repro

curl -s -X POST localhost:31337/hooks/agent-guard -H 'Content-Type: application/json' \
  -d '{"tool_input":{"run_in_background":true,"subagent_type":"general-purpose"}}' | grep -o 'persistent: true'
# -> persistent: true

Suggested fix

Drop persistent, set timeout_ms: 1800000, and add a line telling the model to re-arm the same call when the deadline notice arrives. Remove "TaskOutput" from KNOWN_TOOL_NAMES and from the allow list. Tried on a local install: after a Pulse restart the guard returns timeout_ms: 1800000 plus the re-arm line, and SettingsCheck shows the allow list one rule shorter with nothing else pruned.