@animalabs/connectome-host 0.3.7 → 0.3.8

package/src/strategies/frontdesk-strategy.ts

@@ -123,15 +123,15 @@ export class FrontdeskStrategy extends AutobiographicalStrategy {
     if (ts) parts.push(ts);
 
     if (meta.messageId !== undefined && meta.messageId !== null && meta.messageId !== '') {
-      const mid = String(meta.messageId);
-      const short = mid.length > 12 ? mid.slice(0, 12) : mid;
-      parts.push(`msg ${short}`);
+      // Render the FULL id — truncating (an old token-saving trim) corrupts
+      // Discord snowflakes, so every reply_message/fetch_around/add_reaction
+      // call the agent copies from its own context 404s with Unknown message.
+      parts.push(`msg ${String(meta.messageId)}`);
     }
 
     const threadId = meta.threadId !== undefined && meta.threadId !== null ? String(meta.threadId) : '';
     if (threadId && threadId !== topic) {
-      const short = threadId.length > 12 ? threadId.slice(0, 12) : threadId;
-      parts.push(`thread ${short}`);
+      parts.push(`thread ${threadId}`);
     }
 
     if (parts.length === 0) return null;

package/test/agent-tree-reducer.test.ts

@@ -86,9 +86,12 @@ describe('AgentTreeReducer', () => {
   });
 
   test('inference:exhausted from in-band stream abort also produces cancelled (P1 #3)', () => {
-    // Postmortem 2026-05-28 F1: framework.ts:2108 emits inference:exhausted
-    // for budget-restart / stream-side cancel paths. Same semantics as
-    // aborted — benign termination, not a fault.
+    // Postmortem 2026-05-28 F1: AF used to emit inference:exhausted for
+    // budget-restart / stream-side cancel paths. Same semantics as aborted —
+    // benign termination, not a fault. AF PR #55 (≥ 0.6.5) suppresses the
+    // endTurn/budget-restart cases at the source, but genuine cancels and
+    // reboot-induced exhausted still arrive, and the mapping must keep
+    // handling streams from older AF.
     const r = new AgentTreeReducer();
     r.applyEvent({ type: 'inference:started', agentName: 'a', timestamp: ts(0) });
     r.applyEvent({ type: 'inference:exhausted', agentName: 'a', error: 'budget', timestamp: ts(1) });
@@ -97,6 +100,35 @@ describe('AgentTreeReducer', () => {
     expect(node.status).toBe('cancelled');
   });
 
+  test('inference:turn_ended is terminal in its own right (AF PR #55: no trailing exhausted)', () => {
+    // endTurn = the agent deliberately ended its turn — a successful
+    // terminal. Before AF PR #55 the terminal state of endTurn'd agents came
+    // from the SPURIOUS inference:exhausted the framework emitted right
+    // after; ≥ 0.6.5 no longer sends it, so without this transition an
+    // endTurn'd agent would sit in the tree as 'running' forever.
+    const r = new AgentTreeReducer();
+    r.applyEvent({ type: 'inference:started', agentName: 'a', timestamp: ts(0) });
+    r.applyEvent({ type: 'inference:turn_ended', agentName: 'a', timestamp: ts(1) });
+    const node = r.getNode('a')!;
+    expect(node.phase).toBe('done');
+    expect(node.status).toBe('completed');
+    expect(node.completedAt).toBe(ts(1));
+  });
+
+  test('older AF: the exhausted trailing an endTurn re-terminates as cancelled (harmless)', () => {
+    // Pre-0.6.5 streams still deliver turn_ended followed by the spurious
+    // exhausted. The node flips completed → cancelled one event later; both
+    // are terminal-and-benign, so renderers stay correct either way. Pinned
+    // so the compat behavior is a documented choice, not an accident.
+    const r = new AgentTreeReducer();
+    r.applyEvent({ type: 'inference:started', agentName: 'a', timestamp: ts(0) });
+    r.applyEvent({ type: 'inference:turn_ended', agentName: 'a', timestamp: ts(1) });
+    r.applyEvent({ type: 'inference:exhausted', agentName: 'a', error: 'Stream aborted: user', timestamp: ts(2) });
+    const node = r.getNode('a')!;
+    expect(node.phase).toBe('cancelled');
+    expect(node.status).toBe('cancelled');
+  });
+
   // Postmortem 2026-05-28 F1: the reducer never transitions status to 'completed'.
   // inference:completed only sets phase='done', leaving status='running' for the
   // entire lifetime of the agent — which is fine until a later aborted/exhausted/

package/test/autobio-progress-snapshot.test.ts

@@ -1,14 +1,32 @@
 import { describe, test, expect } from 'bun:test';
 import { AutobiographicalStrategy } from '@animalabs/agent-framework';
+import { ContextManager } from '@animalabs/context-manager';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+
+async function initializedStrategy() {
+  const root = mkdtempSync(join(tmpdir(), 'autobio-progress-'));
+  const path = join(root, 'store');
+  const strategy = new AutobiographicalStrategy({
+    compressionModel: 'claude-sonnet-4-5-20250929',
+    autoTickOnNewMessage: false,
+  });
+  const cm = await ContextManager.open({ path, strategy });
+  return {
+    strategy,
+    close: () => {
+      cm.close();
+      rmSync(root, { recursive: true, force: true });
+    },
+  };
+}
 
 // Guards against silent breakage if upstream renames the protected fields
 // that getProgressSnapshot reads. The shape is what warmup-session.ts relies on.
 describe('AutobiographicalStrategy.getProgressSnapshot', () => {
-  test('returns the expected shape on a fresh strategy', () => {
-    const strategy = new AutobiographicalStrategy({
-      compressionModel: 'claude-sonnet-4-5-20250929',
-      autoTickOnNewMessage: false,
-    });
+  test('returns the expected shape after branch state is initialized', async () => {
+    const { strategy, close } = await initializedStrategy();
     const snapshot = strategy.getProgressSnapshot();
     expect(snapshot).toEqual({
       totalChunks: 0,
@@ -18,16 +36,12 @@ describe('AutobiographicalStrategy.getProgressSnapshot', () => {
       summaryCounts: { l1: 0, l2: 0, l3: 0 },
       pending: false,
     });
+    close();
   });
 
-  test('exposes the keys warmup-session.ts depends on', () => {
-    const strategy = new AutobiographicalStrategy({
-      compressionModel: 'claude-sonnet-4-5-20250929',
-      autoTickOnNewMessage: false,
-    });
+  test('exposes the keys warmup-session.ts depends on', async () => {
+    const { strategy, close } = await initializedStrategy();
     const s = strategy.getProgressSnapshot();
-    // Property access — if any rename happens upstream these become undefined
-    // and the test fails loudly.
     expect(typeof s.totalChunks).toBe('number');
     expect(typeof s.chunksCompressed).toBe('number');
     expect(typeof s.l1QueueLength).toBe('number');
@@ -36,5 +50,6 @@ describe('AutobiographicalStrategy.getProgressSnapshot', () => {
     expect(typeof s.summaryCounts.l1).toBe('number');
     expect(typeof s.summaryCounts.l2).toBe('number');
     expect(typeof s.summaryCounts.l3).toBe('number');
+    close();
   });
 });

package/test/framework-fkm-composition.test.ts

@@ -0,0 +1,160 @@
+import { afterEach, describe, expect, test } from 'bun:test';
+import { mkdtempSync, rmSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { buildFrameworkAgentConfig } from '../src/framework-agent-config.js';
+import { buildFrameworkStrategy } from '../src/framework-strategy.js';
+import { loadSavedRecipe, saveRecipe, validateRecipe } from '../src/recipe.js';
+
+function recipe(agent: Record<string, unknown> = {}) {
+  return {
+    name: 'framework-fkm-composition',
+    agent: {
+      systemPrompt: 'sys',
+      ...agent,
+    },
+  };
+}
+
+function strategyConfigView(strategy: object): Record<string, unknown> {
+  return (strategy as { config?: Record<string, unknown> }).config ?? {};
+}
+
+const tempDirs: string[] = [];
+
+afterEach(() => {
+  while (tempDirs.length > 0) {
+    rmSync(tempDirs.pop()!, { force: true, recursive: true });
+  }
+});
+
+describe('framework FKM composition', () => {
+  test('preserves the pre-merge AgentConfig shape field-for-field when FKM additions are omitted', () => {
+    const parsed = validateRecipe(recipe({
+      provider: 'openai-responses',
+      maxTokens: 4_096,
+      maxStreamTokens: 80_000,
+      contextBudgetTokens: 120_000,
+      cacheTtl: '5m',
+      responses: {
+        reasoningEffort: 'medium',
+        reasoningContext: 'current_turn',
+        serviceTier: 'priority',
+        compactThreshold: 90_000,
+      },
+      thinking: {
+        enabled: true,
+        budgetTokens: 1_024,
+      },
+      refusalHandling: {
+        autoRewind: true,
+        maxRewinds: 2,
+        announceHumanTurns: false,
+      },
+    }));
+    const strategy = { kind: 'baseline-strategy' } as never;
+
+    expect(buildFrameworkAgentConfig(parsed, 'agent', 'model', strategy)).toEqual({
+      name: 'agent',
+      model: 'model',
+      systemPrompt: 'sys',
+      maxTokens: 4_096,
+      maxStreamTokens: 80_000,
+      contextBudgetTokens: 120_000,
+      cacheTtl: '5m',
+      providerParams: {
+        reasoning: {
+          effort: 'medium',
+          context: 'current_turn',
+        },
+        service_tier: 'priority',
+        context_management: [{
+          type: 'compaction',
+          compact_threshold: 90_000,
+        }],
+      },
+      strategy,
+      thinking: {
+        enabled: true,
+        budgetTokens: 1_024,
+      },
+      refusalHandling: {
+        autoRewind: true,
+        maxRewinds: 2,
+        announceHumanTurns: false,
+      },
+    });
+  });
+
+  test('composes validation, serialization, and AF/CM wiring for the merged FKM settings without cross-agent bleed', () => {
+    const parsed = validateRecipe(recipe({
+      provider: 'openai-responses',
+      maxTokens: 4_096,
+      responses: {
+        reasoningEffort: 'high',
+        reasoningContext: 'all_turns',
+        serviceTier: 'priority',
+      },
+      sameRoundThinkTextPolicy: 'private',
+      refusalHandling: {
+        autoRewind: true,
+        primarySummaryFallback: {
+          enabled: true,
+          maxNewSummaries: 4,
+          requestBudgetTokens: 216_000,
+        },
+      },
+      strategy: {
+        type: 'autobiographical',
+        compressionRefusalCurveFallbacks: 2,
+        compressionContextBudgetTokens: 19_000,
+      },
+    }));
+
+    const dir = mkdtempSync(join(tmpdir(), 'connectome-fkm-'));
+    tempDirs.push(dir);
+    saveRecipe(dir, parsed);
+    const reloaded = loadSavedRecipe(dir);
+    expect(reloaded).not.toBeNull();
+
+    expect(reloaded!.agent.sameRoundThinkTextPolicy).toBe('private');
+    expect(reloaded!.agent.refusalHandling?.primarySummaryFallback).toEqual({
+      enabled: true,
+      maxNewSummaries: 4,
+      requestBudgetTokens: 216_000,
+    });
+    expect(reloaded!.agent.strategy?.compressionRefusalCurveFallbacks).toBe(2);
+    expect(reloaded!.agent.strategy?.compressionContextBudgetTokens).toBe(19_000);
+
+    const runtimeStrategy = buildFrameworkStrategy(reloaded!, 'model', 'America/Los_Angeles');
+    const runtimeConfig = strategyConfigView(runtimeStrategy);
+    expect(runtimeConfig.compressionRefusalCurveFallbacks).toBe(2);
+    expect(runtimeConfig.compressionContextBudgetTokens).toBe(19_000);
+
+    const agentConfig = buildFrameworkAgentConfig(reloaded!, 'agent', 'model', runtimeStrategy);
+    expect(agentConfig.sameRoundThinkTextPolicy).toBe('private');
+    expect(agentConfig.refusalHandling?.primarySummaryFallback).toEqual({
+      enabled: true,
+      maxNewSummaries: 4,
+      requestBudgetTokens: 216_000,
+    });
+    expect((agentConfig.providerParams as Record<string, unknown>).service_tier).toBe('priority');
+    expect(Object.keys(agentConfig.providerParams as Record<string, unknown>)
+      .filter((key) => key === 'service_tier')).toHaveLength(1);
+
+    const otherRecipe = validateRecipe(recipe({
+      strategy: {
+        type: 'autobiographical',
+        compressionRefusalCurveFallbacks: 0,
+        compressionContextBudgetTokens: 50_000,
+      },
+    }));
+    const otherStrategy = buildFrameworkStrategy(otherRecipe, 'other-model', 'America/Los_Angeles');
+    const otherConfig = strategyConfigView(otherStrategy);
+    expect(otherConfig.compressionRefusalCurveFallbacks).toBe(0);
+    expect(otherConfig.compressionContextBudgetTokens).toBe(50_000);
+    expect(otherConfig).not.toBe(runtimeConfig);
+    expect(runtimeConfig.compressionRefusalCurveFallbacks).toBe(2);
+    expect(runtimeConfig.compressionContextBudgetTokens).toBe(19_000);
+  });
+});

package/test/logging-adapter-refusal.test.ts

@@ -0,0 +1,57 @@
+/**
+ * Off-path refusal dragnet (observability M3): the logging adapter fires
+ * onRefusal for refusals on complete() calls — the compression/summarizer
+ * path the framework's own noteRefusal never sees — and stays silent for
+ * streamed refusals (main driver's job) and non-refusal completions.
+ */
+import { test, expect } from 'bun:test';
+import { LoggingAnthropicAdapter } from '../src/logging-adapter.js';
+
+function makeAdapter() {
+  const adapter = new LoggingAnthropicAdapter({ apiKey: 'test-key' }, '/tmp/llm-test.jsonl', () => ({ enabled: false, budgetTokens: 0 }));
+  const fired: unknown[] = [];
+  adapter.onRefusal = (info) => fired.push(info);
+  const observe = (kind: 'complete' | 'stream', stopReason?: string, category?: string) =>
+    (adapter as unknown as {
+      observeCall: (k: string, t: string, d: number, req: unknown, raw: unknown, res?: unknown) => void;
+    }).observeCall(kind, new Date().toISOString(), 100,
+      { model: 'claude-fable-5', messages: new Array(37).fill({}) },
+      undefined,
+      stopReason
+        ? {
+            usage: { inputTokens: 64_000, outputTokens: 3, cacheReadTokens: 0, cacheCreationTokens: 0 },
+            stopReason,
+            raw: { stop_reason: stopReason, ...(category ? { stop_details: { category } } : {}) },
+          }
+        : undefined,
+    );
+  return { adapter, fired, observe };
+}
+
+test('complete() refusal fires the dragnet with category + size', () => {
+  const { fired, observe } = makeAdapter();
+  observe('complete', 'refusal', 'reasoning_extraction');
+  expect(fired.length).toBe(1);
+  expect(fired[0]).toMatchObject({
+    kind: 'complete',
+    category: 'reasoning_extraction',
+    model: 'claude-fable-5',
+    messages: 37,
+    inputTokens: 64_000,
+  });
+});
+
+test('streamed refusal does NOT fire (main driver already escalates those)', () => {
+  const { fired, observe } = makeAdapter();
+  observe('stream', 'refusal', 'cyber');
+  expect(fired.length).toBe(0);
+});
+
+test('non-refusal completions and throwing callbacks are harmless', () => {
+  const { adapter, fired, observe } = makeAdapter();
+  observe('complete', 'end_turn');
+  observe('complete');            // error path: no response at all
+  expect(fired.length).toBe(0);
+  adapter.onRefusal = () => { throw new Error('observer bug'); };
+  expect(() => observe('complete', 'refusal', 'cyber')).not.toThrow();
+});

package/test/recipe-compression-fallback.test.ts

@@ -0,0 +1,36 @@
+import { describe, expect, test } from 'bun:test';
+import { validateRecipe } from '../src/recipe.js';
+
+function recipe(strategy: Record<string, unknown>) {
+  return {
+    name: 'compression-fallback-test',
+    agent: { systemPrompt: 'sys', strategy: { type: 'autobiographical', ...strategy } },
+  };
+}
+
+describe('compression recall-curve recipe settings', () => {
+  test('preserves valid fallback count and complete-request budget', () => {
+    const parsed = validateRecipe(recipe({
+      compressionRefusalCurveFallbacks: 3,
+      compressionContextBudgetTokens: 200_000,
+    }));
+    expect(parsed.agent.strategy?.compressionRefusalCurveFallbacks).toBe(3);
+    expect(parsed.agent.strategy?.compressionContextBudgetTokens).toBe(200_000);
+  });
+
+  test('accepts zero as an explicit fallback disable', () => {
+    expect(validateRecipe(recipe({ compressionRefusalCurveFallbacks: 0 }))
+      .agent.strategy?.compressionRefusalCurveFallbacks).toBe(0);
+  });
+
+  test('rejects malformed fallback settings', () => {
+    expect(() => validateRecipe(recipe({ compressionRefusalCurveFallbacks: -1 })))
+      .toThrow(/compressionRefusalCurveFallbacks/);
+    expect(() => validateRecipe(recipe({ compressionRefusalCurveFallbacks: 1.5 })))
+      .toThrow(/compressionRefusalCurveFallbacks/);
+    expect(() => validateRecipe(recipe({ compressionContextBudgetTokens: 0 })))
+      .toThrow(/compressionContextBudgetTokens/);
+    expect(() => validateRecipe(recipe({ compressionContextBudgetTokens: '200000' })))
+      .toThrow(/compressionContextBudgetTokens/);
+  });
+});

package/test/recipe-primary-summary-fallback.test.ts

@@ -0,0 +1,40 @@
+import { describe, expect, test } from 'bun:test';
+import { validateRecipe } from '../src/recipe.js';
+
+function recipe(primarySummaryFallback?: Record<string, unknown>) {
+  return {
+    name: 'primary-summary-fallback-test',
+    agent: {
+      systemPrompt: 'sys',
+      refusalHandling: primarySummaryFallback
+        ? { primarySummaryFallback }
+        : undefined,
+    },
+  };
+}
+
+describe('recipe primary summary fallback validation', () => {
+  test('leaves the fallback disabled by default when omitted', () => {
+    const parsed = validateRecipe(recipe());
+    expect(parsed.agent.refusalHandling?.primarySummaryFallback).toBeUndefined();
+  });
+
+  test('preserves valid fallback settings', () => {
+    const parsed = validateRecipe(recipe({
+      enabled: true,
+      maxNewSummaries: 4,
+      requestBudgetTokens: 216_000,
+    }));
+    expect(parsed.agent.refusalHandling?.primarySummaryFallback).toEqual({
+      enabled: true,
+      maxNewSummaries: 4,
+      requestBudgetTokens: 216_000,
+    });
+  });
+
+  test('rejects malformed fallback settings', () => {
+    expect(() => validateRecipe(recipe({ enabled: 'yes' }))).toThrow(/primarySummaryFallback\.enabled/);
+    expect(() => validateRecipe(recipe({ maxNewSummaries: -1 }))).toThrow(/maxNewSummaries/);
+    expect(() => validateRecipe(recipe({ requestBudgetTokens: 0 }))).toThrow(/requestBudgetTokens/);
+  });
+});

package/test/recipe-think-policy.test.ts

@@ -0,0 +1,39 @@
+import { describe, expect, test } from 'bun:test';
+import { validateRecipe } from '../src/recipe.js';
+import { buildFrameworkAgentConfig } from '../src/framework-agent-config.js';
+
+function recipe(agent: Record<string, unknown> = {}) {
+  return { name: 'think-policy-test', agent: { systemPrompt: 'sys', ...agent } };
+}
+
+describe('recipe sameRoundThinkTextPolicy', () => {
+  test('valid public/private values are preserved and passed through to Agent Framework config', () => {
+    const publicRecipe = validateRecipe(recipe({ sameRoundThinkTextPolicy: 'public' }));
+    expect(publicRecipe.agent.sameRoundThinkTextPolicy).toBe('public');
+    expect(
+      buildFrameworkAgentConfig(publicRecipe, 'agent', 'model', undefined).sameRoundThinkTextPolicy,
+    ).toBe('public');
+
+    const privateRecipe = validateRecipe(recipe({ sameRoundThinkTextPolicy: 'private' }));
+    expect(privateRecipe.agent.sameRoundThinkTextPolicy).toBe('private');
+    expect(
+      buildFrameworkAgentConfig(privateRecipe, 'agent', 'model', undefined).sameRoundThinkTextPolicy,
+    ).toBe('private');
+  });
+
+  test('omitted value stays omitted so Agent Framework can report the compatibility source', () => {
+    const parsed = validateRecipe(recipe());
+    expect(parsed.agent.sameRoundThinkTextPolicy).toBeUndefined();
+    const config = buildFrameworkAgentConfig(parsed, 'agent', 'model', undefined);
+    expect(Object.prototype.hasOwnProperty.call(config, 'sameRoundThinkTextPolicy')).toBe(false);
+  });
+
+  test('invalid strings and types are rejected', () => {
+    expect(() => validateRecipe(recipe({ sameRoundThinkTextPolicy: 'secret' })))
+      .toThrow(/sameRoundThinkTextPolicy/);
+    expect(() => validateRecipe(recipe({ sameRoundThinkTextPolicy: true })))
+      .toThrow(/sameRoundThinkTextPolicy/);
+    expect(() => validateRecipe(recipe({ sameRoundThinkTextPolicy: { mode: 'public' } })))
+      .toThrow(/sameRoundThinkTextPolicy/);
+  });
+});

package/test/subscription-gc-module.test.ts

@@ -37,6 +37,7 @@ function ambient(
     origin: {
       source: 'discord',
       channelId,
+      mcplChannelId: `discord:g1:${channelId}`,
       isMention: !!opts.isMention,
       isDM: !!opts.isDM,
     },
@@ -59,8 +60,9 @@ describe('SubscriptionGcModule', () => {
 
     r = await m.onProcess(ambient('c1', 'ghijkl'), PS); // +6 = 12 > 10 → unsub
     expect(toolCalls.length).toBe(1);
-    expect(toolCalls[0].name).toBe('mcpl--discord--unsubscribe_channel');
-    expect(toolCalls[0].input.channelId).toBe('c1');
+    expect(toolCalls[0].name).toBe('channel_close');
+    expect(toolCalls[0].input.channelId).toBe('discord:g1:c1');
+    expect(toolCalls[0].input.serverId).toBe('discord');
     expect(r.addMessages?.length).toBe(1);
 
     await m.stop();
@@ -100,7 +102,7 @@ describe('SubscriptionGcModule', () => {
     await m.handleToolCall({
       id: 't1',
       name: 'set_channel_idle_limit',
-      input: { channelId: 'c1', limit: 'off' },
+      input: { channelId: 'discord:g1:c1', limit: 'off' },
     });
     await m.onProcess(ambient('c1', 'waytoolongambient'), PS);
     expect(toolCalls.length).toBe(0); // pinned → never unsubscribed
@@ -108,7 +110,7 @@ describe('SubscriptionGcModule', () => {
     // A different channel still accrues, and state is persisted.
     await m.onProcess(ambient('c2', 'abc'), PS);
     const persisted = getState() as { overrides: Record<string, unknown>; counters: Record<string, number> };
-    expect(persisted.overrides.c1).toBe('off');
+    expect(persisted.overrides['discord:g1:c1']).toBe('off');
 
     // Simulate restart: a new module loads the persisted state (counters carry
     // across — a restart is not an activation).
@@ -128,7 +130,7 @@ describe('SubscriptionGcModule', () => {
     // c2 was at 3; +3 = 6 > 5 → unsubscribe (counter survived the "restart")
     await m2.onProcess(ambient('c2', 'def'), PS);
     expect(restart.toolCalls.length).toBe(1);
-    expect(restart.toolCalls[0].input.channelId).toBe('c2');
+    expect(restart.toolCalls[0].input.channelId).toBe('discord:g1:c2');
 
     await m.stop();
     await m2.stop();

package/test/web-ui-observers.test.ts

@@ -220,14 +220,19 @@ describe('scope filters', () => {
 });
 
 describe('ObserverSessions', () => {
-  test('mint/lookup round-trip; bad token null', () => {
+  test('mint/lookup round-trip; bad token null; full flag carried', () => {
     const s = new ObserverSessions();
     const scopes = new Set<ObserverScope>(['health']);
     const token = s.mint(scopes);
     expect(token).toMatch(/^[a-f0-9]{64}$/);
-    expect(s.lookup(token)).toBe(scopes);
+    expect(s.lookup(token)!.scopes).toBe(scopes);
+    expect(s.lookup(token)!.full).toBe(false);
     expect(s.lookup('0'.repeat(64))).toBeNull();
     expect(s.lookup(null)).toBeNull();
+
+    // Full sessions (password sign-in path) carry operator authority.
+    const fullToken = s.mint(new Set(), { full: true });
+    expect(s.lookup(fullToken)!.full).toBe(true);
   });
 });
 
@@ -332,6 +337,26 @@ describe('WebUiModule observer flow (e2e)', () => {
     ws.close();
   }, 15_000);
 
+  test('password sign-in mints a full-session cookie the WS upgrade honors', async () => {
+    // /auth/basic with valid credentials → 302 + full-session cookie.
+    const res = await fetch(`${base()}/auth/basic`, { headers: { authorization: BASIC }, redirect: 'manual' });
+    expect(res.status).toBe(302);
+    const m = /fkm_obs=([a-f0-9]{64})/.exec(res.headers.get('set-cookie') ?? '');
+    expect(m).not.toBeNull();
+
+    // A WS upgrade carrying ONLY the cookie (no Authorization — the Chrome
+    // situation) must be treated as a FULL client: no observer-auth-required
+    // demand. (Full clients are parked silently in this app-less harness;
+    // the observer path would send auth-required immediately.)
+    const ws = new WebSocket(`ws://127.0.0.1:${port}/ws`, { headers: { cookie: `fkm_obs=${m![1]}` } } as never);
+    const firstFrame = await Promise.race([
+      new Promise<string>((r) => ws.addEventListener('message', (ev) => r(String((ev as MessageEvent).data)))),
+      new Promise<string>((r) => setTimeout(() => r('SILENCE'), 1500)),
+    ]);
+    ws.close();
+    expect(firstFrame).toBe('SILENCE'); // not observer-auth-required
+  }, 10_000);
+
   test('wrong key: hello rejected and socket closed', async () => {
     const stranger = makeKeypair();
     const host = `127.0.0.1:${port}`;