@crouton-kit/crouter 0.3.32 → 0.3.34

package/dist/hearth/wake-proxy/__tests__/model-auth-routes.test.js

@@ -0,0 +1,437 @@
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { Readable } from 'node:stream';
+import { test } from 'node:test';
+import { AUTH_STORAGE_STATUS_SCRIPT, AUTH_STORAGE_WRITE_SCRIPT, handleModelAuthRequest } from '../model-auth.js';
+import { finishAnthropicOAuthSession, startAnthropicOAuthSession } from '../anthropic-oauth.js';
+const ownerToken = 'owner-secret-token';
+const ownerTokenHash = createHash('sha256').update(ownerToken, 'utf8').digest('hex');
+const publicOrigin = 'https://hearth.example';
+function makeRuntime(tenantId, statePath) {
+    return {
+        proxy: {
+            host: '127.0.0.1',
+            port: 7878,
+            publicOrigin,
+            statePath,
+            m0RegistryPath: join(statePath, 'homes.json'),
+            ownerUserId: 'owner-user',
+            defaultTenantId: tenantId,
+            ownerTokenHash,
+            idlePauseMs: 60_000,
+            wakeTimeoutMs: 30_000,
+            readyTimeoutMs: 2_000,
+            cookieSecure: true,
+            seedHome: null,
+        },
+        m0: {
+            providerName: 'none',
+            registryPath: join(statePath, 'homes.json'),
+            guestUser: 'agent',
+            guestHome: '/home/agent',
+            guestCodePath: '/opt/crouter',
+            webPort: 7878,
+            nodeKind: 'general',
+            piPackages: [],
+            piAuthJson: null,
+            relayToken: null,
+        },
+    };
+}
+function writeState(statePath, tenantId) {
+    writeFileSync(statePath, `${JSON.stringify({
+        version: 1,
+        owner: {
+            ownerUserId: 'owner-user',
+            defaultTenantId: tenantId,
+            tokenHash: ownerTokenHash,
+            createdAt: '2026-06-26T00:00:00.000Z',
+        },
+        tenants: {},
+    }, null, 2)}\n`, 'utf8');
+}
+function makeRequest(method, url, headers = {}, body = '') {
+    const req = new Readable({ read() { } });
+    req.method = method;
+    req.url = url;
+    req.headers = headers;
+    process.nextTick(() => {
+        if (body !== '')
+            req.push(body);
+        req.push(null);
+    });
+    return req;
+}
+function makeResponse() {
+    return {
+        statusCode: 200,
+        headersSent: false,
+        headers: {},
+        body: '',
+        writeHead(statusCode, headers) {
+            this.statusCode = statusCode;
+            this.headers = { ...this.headers, ...headers };
+            this.headersSent = true;
+            return this;
+        },
+        setHeader(name, value) {
+            this.headers[name.toLowerCase()] = value;
+        },
+        end(chunk) {
+            if (chunk !== undefined)
+                this.body += Buffer.isBuffer(chunk) ? chunk.toString('utf8') : chunk;
+            this.headersSent = true;
+            return this;
+        },
+        destroy() {
+            this.headersSent = true;
+        },
+    };
+}
+function parseJsonBody(res) {
+    return JSON.parse(res.body);
+}
+function extractState(authUrl) {
+    return new URL(authUrl).searchParams.get('state') ?? '';
+}
+test('model-auth routes enforce auth, routing, and method guards', async () => {
+    const tenantId = 'tenant-auth-gates';
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-model-auth-'));
+    const statePath = join(tempDir, 'state.json');
+    writeState(statePath, tenantId);
+    const runtime = makeRuntime(tenantId, statePath);
+    for (const [method, url] of [
+        ['GET', '/__hearth/model-auth/anthropic/status'],
+        ['POST', '/__hearth/model-auth/anthropic/start'],
+        ['POST', '/__hearth/model-auth/anthropic/finish'],
+    ]) {
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest(method, url, {}, '{}'), res, runtime, { guestSource: async () => ({ ok: true, stdout: '{}', stderr: '', exitCode: 0 }) });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 401);
+    }
+    {
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/start', {
+            cookie: `hearth_owner=${encodeURIComponent(ownerToken)}`,
+            origin: 'https://evil.example',
+        }), res, runtime, { startSession: () => ({ ok: true, sessionId: 's', authUrl: 'https://example.test', expiresAt: 1 }) });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 403);
+    }
+    {
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/start?token=' + encodeURIComponent(ownerToken)), res, runtime, { startSession: () => ({ ok: true, sessionId: 's', authUrl: 'https://example.test', expiresAt: 1 }) });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 401);
+    }
+    {
+        let called = 0;
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/start', {
+            authorization: `Bearer ${ownerToken}`,
+        }), res, runtime, {
+            startSession: (tenant) => {
+                called += 1;
+                assert.equal(tenant, tenantId);
+                return { ok: true, sessionId: 'sess-123', authUrl: 'https://example.test', expiresAt: 2 };
+            },
+        });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 200);
+        assert.equal(called, 1);
+        assert.deepEqual(parseJsonBody(res), {
+            provider: 'anthropic',
+            sessionId: 'sess-123',
+            authUrl: 'https://example.test',
+            expiresAt: 2,
+        });
+    }
+    {
+        const wrongMethodRes = makeResponse();
+        const wrongMethodHandled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/status', { authorization: `Bearer ${ownerToken}` }), wrongMethodRes, runtime);
+        assert.equal(wrongMethodHandled, true);
+        assert.equal(wrongMethodRes.statusCode, 405);
+        const unknownRes = makeResponse();
+        const unknownHandled = await handleModelAuthRequest(makeRequest('GET', '/__hearth/model-auth/anthropic/unknown', { authorization: `Bearer ${ownerToken}` }), unknownRes, runtime);
+        assert.equal(unknownHandled, true);
+        assert.equal(unknownRes.statusCode, 404);
+        const falseRes = makeResponse();
+        const falseHandled = await handleModelAuthRequest(makeRequest('GET', '/__hearth/not-model-auth', { authorization: `Bearer ${ownerToken}` }), falseRes, runtime);
+        assert.equal(falseHandled, false);
+        assert.equal(falseRes.headersSent, false);
+    }
+});
+test('model-auth start uses the bounded JSON reader and rejects oversized bodies', async () => {
+    const tenantId = 'tenant-start-body';
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-model-auth-start-body-'));
+    const statePath = join(tempDir, 'state.json');
+    writeState(statePath, tenantId);
+    const runtime = makeRuntime(tenantId, statePath);
+    let called = 0;
+    {
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/start', { authorization: `Bearer ${ownerToken}` }, ''), res, runtime, {
+            startSession: (tenant) => {
+                called += 1;
+                assert.equal(tenant, tenantId);
+                return { ok: true, sessionId: 'sess-empty', authUrl: 'https://example.test/empty', expiresAt: 1 };
+            },
+        });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 200);
+    }
+    {
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/start', { authorization: `Bearer ${ownerToken}` }, JSON.stringify({ note: 'allowed' })), res, runtime, {
+            startSession: (tenant) => {
+                called += 1;
+                assert.equal(tenant, tenantId);
+                return { ok: true, sessionId: 'sess-json', authUrl: 'https://example.test/json', expiresAt: 2 };
+            },
+        });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 200);
+    }
+    {
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/start', { authorization: `Bearer ${ownerToken}` }, `{}${' '.repeat(17 * 1024)}`), res, runtime, { startSession: () => { throw new Error('should not be called for oversized bodies'); } });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 400);
+    }
+    assert.equal(called, 2);
+});
+test('model-auth status uses the fixed guest script and returns only redacted status data', async () => {
+    const tenantId = 'tenant-status';
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-model-auth-status-'));
+    const statePath = join(tempDir, 'state.json');
+    writeState(statePath, tenantId);
+    const runtime = makeRuntime(tenantId, statePath);
+    const calls = [];
+    const res = makeResponse();
+    const handled = await handleModelAuthRequest(makeRequest('GET', '/__hearth/model-auth/anthropic/status', {
+        authorization: `Bearer ${ownerToken}`,
+    }), res, runtime, {
+        guestSource: async (tenantId, request) => {
+            calls.push({ tenantId, request });
+            return {
+                ok: true,
+                exitCode: 0,
+                stdout: JSON.stringify({
+                    storedOauth: true,
+                    expiresAt: 12345,
+                    adapterConfigured: true,
+                    access_token: 'raw-access-token',
+                    refresh_token: 'raw-refresh-token',
+                    auth_json: '/home/agent/.pi/agent/auth.json',
+                }),
+                stderr: '',
+            };
+        },
+    });
+    assert.equal(handled, true);
+    assert.equal(res.statusCode, 200);
+    assert.deepEqual(parseJsonBody(res), {
+        storedOauth: true,
+        expiresAt: 12345,
+        adapterConfigured: true,
+    });
+    assert.deepEqual(calls, [{
+            tenantId,
+            request: {
+                kind: 'exec',
+                bin: 'node',
+                args: ['--input-type=module', '-e', AUTH_STORAGE_STATUS_SCRIPT],
+                cwd: '/opt/crouter',
+            },
+        }]);
+});
+test('model-auth finish uses the fixed guest write script, consumes the session, and redacts tokens', async () => {
+    const tenantId = 'tenant-finish';
+    const now = 1_700_000_000_000;
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-model-auth-finish-'));
+    const statePath = join(tempDir, 'state.json');
+    writeState(statePath, tenantId);
+    const runtime = makeRuntime(tenantId, statePath);
+    const calls = [];
+    const startRes = makeResponse();
+    const startHandled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/start', {
+        authorization: `Bearer ${ownerToken}`,
+    }), startRes, runtime, {
+        now: () => now,
+        startSession: (tenant) => startAnthropicOAuthSession(tenant, () => now),
+    });
+    assert.equal(startHandled, true);
+    assert.equal(startRes.statusCode, 200);
+    const startBody = parseJsonBody(startRes);
+    const state = extractState(startBody.authUrl);
+    assert.notEqual(state, '');
+    const finishSession = async (input) => {
+        return await finishAnthropicOAuthSession(input, {
+            now: () => now,
+            fetch: async () => ({
+                ok: true,
+                status: 200,
+                statusText: 'OK',
+                text: async () => JSON.stringify({
+                    access_token: 'live-access-token',
+                    refresh_token: 'live-refresh-token',
+                    expires_in: 3600,
+                }),
+            }),
+        });
+    };
+    const finishRes = makeResponse();
+    const finishHandled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/finish', {
+        authorization: `Bearer ${ownerToken}`,
+    }, JSON.stringify({
+        sessionId: startBody.sessionId,
+        redirectUrl: `http://localhost:53692/callback?code=code-123&state=${state}`,
+    })), finishRes, runtime, {
+        now: () => now,
+        finishSession,
+        guestSource: async (tenantId, request) => {
+            calls.push({ tenantId, request });
+            return {
+                ok: true,
+                exitCode: 0,
+                stdout: JSON.stringify({
+                    ok: true,
+                    provider: 'anthropic',
+                    storedOauth: true,
+                    expiresAt: now + 3_300_000,
+                    access_token: 'write-access-token',
+                    refresh_token: 'write-refresh-token',
+                }),
+                stderr: '',
+            };
+        },
+    });
+    assert.equal(finishHandled, true);
+    assert.equal(finishRes.statusCode, 200);
+    assert.deepEqual(parseJsonBody(finishRes), {
+        ok: true,
+        provider: 'anthropic',
+        sessionId: startBody.sessionId,
+        storedOauth: true,
+        expiresAt: now + 3_300_000,
+    });
+    assert.equal(JSON.stringify(parseJsonBody(finishRes)).includes('access'), false);
+    assert.equal(JSON.stringify(parseJsonBody(finishRes)).includes('refresh'), false);
+    assert.deepEqual(calls, [{
+            tenantId,
+            request: {
+                kind: 'exec',
+                bin: 'node',
+                args: ['--input-type=module', '-e', AUTH_STORAGE_WRITE_SCRIPT],
+                stdin: JSON.stringify({
+                    provider: 'anthropic',
+                    credential: {
+                        type: 'oauth',
+                        access: 'live-access-token',
+                        refresh: 'live-refresh-token',
+                        expires: now + 3_300_000,
+                    },
+                }),
+                cwd: '/opt/crouter',
+            },
+        }]);
+    const secondRes = makeResponse();
+    const secondHandled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/finish', {
+        authorization: `Bearer ${ownerToken}`,
+    }, JSON.stringify({
+        sessionId: startBody.sessionId,
+        redirectUrl: `http://localhost:53692/callback?code=code-123&state=${state}`,
+    })), secondRes, runtime, {
+        now: () => now,
+        finishSession,
+        guestSource: async () => ({ ok: true, exitCode: 0, stdout: '{}', stderr: '' }),
+    });
+    assert.equal(secondHandled, true);
+    assert.equal(secondRes.statusCode, 400);
+});
+test('model-auth finish rejects guest failures and strict body validation', async () => {
+    const now = 1_700_000_000_000;
+    async function makeContext(tenantId) {
+        const tempDir = mkdtempSync(join(tmpdir(), `crouter-model-auth-${tenantId}-`));
+        const statePath = join(tempDir, 'state.json');
+        writeState(statePath, tenantId);
+        const runtime = makeRuntime(tenantId, statePath);
+        async function startSession() {
+            const startRes = makeResponse();
+            const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/start', { authorization: `Bearer ${ownerToken}` }), startRes, runtime, { now: () => now, startSession: (tenant) => startAnthropicOAuthSession(tenant, () => now) });
+            assert.equal(handled, true);
+            assert.equal(startRes.statusCode, 200);
+            return parseJsonBody(startRes);
+        }
+        const finishSession = async (input) => {
+            return await finishAnthropicOAuthSession(input, {
+                now: () => now,
+                fetch: async () => ({
+                    ok: true,
+                    status: 200,
+                    statusText: 'OK',
+                    text: async () => JSON.stringify({ access_token: 'a', refresh_token: 'b', expires_in: 3600 }),
+                }),
+            });
+        };
+        return { runtime, startSession, finishSession };
+    }
+    {
+        const { runtime, startSession, finishSession } = await makeContext('tenant-finish-bridge');
+        const { sessionId, authUrl } = await startSession();
+        const state = extractState(authUrl);
+        const callbackUrl = `http://localhost:53692/callback?code=code-456&state=${state}`;
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/finish', { authorization: `Bearer ${ownerToken}` }, JSON.stringify({ sessionId, redirectUrl: callbackUrl })), res, runtime, {
+            now: () => now,
+            finishSession,
+            guestSource: async () => ({ ok: true, exitCode: 1, stdout: '', stderr: 'boom' }),
+        });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 502);
+    }
+    {
+        const { runtime, startSession, finishSession } = await makeContext('tenant-finish-status');
+        const { sessionId, authUrl } = await startSession();
+        const state = extractState(authUrl);
+        const callbackUrl = `http://localhost:53692/callback?code=code-456&state=${state}`;
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/finish', { authorization: `Bearer ${ownerToken}` }, JSON.stringify({ sessionId, redirectUrl: callbackUrl })), res, runtime, {
+            now: () => now,
+            finishSession,
+            guestSource: async () => ({
+                ok: true,
+                exitCode: 0,
+                stdout: JSON.stringify({ ok: true, provider: 'anthropic', storedOauth: false, expiresAt: now }),
+                stderr: '',
+            }),
+        });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 502);
+    }
+    {
+        const { runtime, startSession, finishSession } = await makeContext('tenant-finish-body-limit');
+        const { sessionId, authUrl } = await startSession();
+        const state = extractState(authUrl);
+        const callbackUrl = `http://localhost:53692/callback?code=code-456&state=${state}`;
+        const overLimitBody = `${JSON.stringify({ sessionId, redirectUrl: callbackUrl })}${' '.repeat(17 * 1024)}`;
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/finish', { authorization: `Bearer ${ownerToken}` }, overLimitBody), res, runtime, { now: () => now, finishSession, guestSource: async () => ({ ok: true, exitCode: 0, stdout: '{}', stderr: '' }) });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 400);
+    }
+    {
+        const { runtime, startSession, finishSession } = await makeContext('tenant-finish-body-extra');
+        const { sessionId, authUrl } = await startSession();
+        const state = extractState(authUrl);
+        const callbackUrl = `http://localhost:53692/callback?code=code-456&state=${state}`;
+        const res = makeResponse();
+        const handled = await handleModelAuthRequest(makeRequest('POST', '/__hearth/model-auth/anthropic/finish', { authorization: `Bearer ${ownerToken}` }, JSON.stringify({ sessionId, redirectUrl: callbackUrl, extra: true })), res, runtime, { now: () => now, finishSession, guestSource: async () => ({ ok: true, exitCode: 0, stdout: '{}', stderr: '' }) });
+        assert.equal(handled, true);
+        assert.equal(res.statusCode, 400);
+    }
+});

package/dist/hearth/wake-proxy/__tests__/static-asset-allowlist.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hearth/wake-proxy/__tests__/static-asset-allowlist.test.js

@@ -0,0 +1,15 @@
+import assert from 'node:assert/strict';
+import { test } from 'node:test';
+import { isPublicStaticAssetPath } from '../proxy.js';
+test('wake proxy treats SPA bundle and shell assets as public', () => {
+    assert.equal(isPublicStaticAssetPath('/assets/index-1234abcd.js'), true);
+    assert.equal(isPublicStaticAssetPath('/assets/style-1234abcd.css'), true);
+    assert.equal(isPublicStaticAssetPath('/favicon.ico'), true);
+    assert.equal(isPublicStaticAssetPath('/vite.svg'), true);
+});
+test('wake proxy keeps app routes behind auth', () => {
+    assert.equal(isPublicStaticAssetPath('/'), false);
+    assert.equal(isPublicStaticAssetPath('/views/chat'), false);
+    assert.equal(isPublicStaticAssetPath('/__crtr/events'), false);
+    assert.equal(isPublicStaticAssetPath('/node/mqt64sus-e71caa94'), false);
+});

package/dist/hearth/wake-proxy/__tests__/warm-path-concurrency.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/hearth/wake-proxy/__tests__/warm-path-concurrency.test.js

@@ -0,0 +1,141 @@
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { test } from 'node:test';
+import { ensureAwake, configureWakeProxyRuntime, wakeProxyInternals } from '../home.js';
+// Regression for the live soak stall (REPORT.md): every HTTP forward and WS connect funneled through
+// the per-tenant serial wake lock, so a reconnect/SSE/asset burst queued behind each other for up to
+// the 150s wake timeout while the home was directly healthy (<0.4s). The warm read path must NOT run
+// N serial slow probes and must NOT wait behind a stale slow wake when a fresh warm verdict exists.
+const tenantId = 'silas';
+const machineId = 'igd2fkrn1y1ol3vw5i6mt';
+const nodeId = 'mqt64sus-e71caa94';
+const routeUrl = 'https://7878-igd2fkrn1y1ol3vw5i6mt.example.dev';
+const now = '2026-06-25T00:00:00.000Z';
+function makeHome(overrides = {}) {
+    return {
+        tenantId,
+        providerName: 'none',
+        machineId,
+        homeStorage: {
+            kind: 'volume',
+            durability: 'durable-volume',
+            longTermContract: true,
+            ownerMachineId: machineId,
+            guestHome: '/home/agent',
+            volumeId: '48b59d07-8cc9-46f9-bdfd-ac99a55dff40',
+            mountPath: '/home/agent',
+        },
+        state: 'running',
+        nodeId,
+        relayToken: 'relay-token',
+        webRoute: {
+            routeId: '7878-igd2fkrn1y1ol3vw5i6mt.example.dev',
+            machineId,
+            targetPort: 7878,
+            url: routeUrl,
+            concreteUrl: routeUrl,
+            concreteUrlSource: 'provider',
+            createdAt: now,
+            raw: null,
+        },
+        createdAt: now,
+        updatedAt: now,
+        ...overrides,
+    };
+}
+function makeRuntime(registryPath, statePath) {
+    return {
+        proxy: {
+            host: '127.0.0.1',
+            port: 7878,
+            publicOrigin: 'https://hearth-wake-proxy.fly.dev',
+            statePath,
+            m0RegistryPath: registryPath,
+            ownerUserId: 'owner-user',
+            defaultTenantId: tenantId,
+            ownerTokenHash: 'hash',
+            idlePauseMs: 0,
+            wakeTimeoutMs: 30_000,
+            readyTimeoutMs: 2_000,
+            cookieSecure: true,
+            seedHome: null,
+        },
+        m0: {
+            providerName: 'none',
+            registryPath,
+            guestUser: 'agent',
+            guestHome: '/home/agent',
+            guestCodePath: '/opt/crouter',
+            webPort: 7878,
+            nodeKind: 'general',
+            piPackages: [],
+            piAuthJson: null,
+            relayToken: null,
+        },
+    };
+}
+function setup() {
+    const tempDir = mkdtempSync(join(tmpdir(), 'crouter-hearth-warm-'));
+    const registryPath = join(tempDir, 'homes.json');
+    const statePath = join(tempDir, 'state.json');
+    writeFileSync(registryPath, `${JSON.stringify({ [tenantId]: makeHome() }, null, 2)}\n`, 'utf8');
+    // configureWakeProxyRuntime resets the warm-verdict/in-flight caches, isolating each test.
+    configureWakeProxyRuntime(makeRuntime(registryPath, statePath));
+}
+const awakened = { tenantId, nodeId, routeUrl, relayToken: 'relay-token', machineId, webPort: 7878 };
+test('concurrent ensureAwake calls coalesce onto ONE slow probe instead of N serial probes', async (t) => {
+    setup();
+    let releaseProbe;
+    const probeGate = new Promise((resolve) => {
+        releaseProbe = resolve;
+    });
+    const probe = t.mock.method(wakeProxyInternals, 'probeRelayServing', async () => {
+        await probeGate;
+        return true;
+    });
+    t.mock.method(wakeProxyInternals, 'touchTenantWake', async () => undefined);
+    t.mock.method(wakeProxyInternals, 'captureAwakeHome', async () => awakened);
+    const wake = t.mock.method(wakeProxyInternals, 'wakeHome', async () => {
+        throw new Error('wakeHome should not run on the warm path');
+    });
+    // Fire five concurrent callers while the (slow) probe is still gated. They must all share the
+    // single in-flight wake — only one probe runs, not five serialized behind the lock.
+    const calls = [
+        ensureAwake(tenantId),
+        ensureAwake(tenantId),
+        ensureAwake(tenantId),
+        ensureAwake(tenantId),
+        ensureAwake(tenantId),
+    ];
+    // The lock dispatches runEnsureAwake on a microtask, so let that settle before counting; the
+    // probe is gated so it stays at exactly one in-flight call.
+    await new Promise((resolve) => setTimeout(resolve, 10));
+    const probeCallsWhileGated = probe.mock.callCount();
+    releaseProbe();
+    const results = await Promise.all(calls);
+    assert.equal(probeCallsWhileGated, 1);
+    assert.equal(probe.mock.callCount(), 1);
+    assert.equal(wake.mock.callCount(), 0);
+    for (const result of results)
+        assert.equal(result.routeUrl, routeUrl);
+});
+test('a fresh warm verdict serves concurrent reads WITHOUT re-probing or waiting on the slow path', async (t) => {
+    setup();
+    // Freeze time so the verdict stays inside its TTL across the test.
+    t.mock.method(wakeProxyInternals, 'now', () => 1_000);
+    const probe = t.mock.method(wakeProxyInternals, 'probeRelayServing', async () => true);
+    t.mock.method(wakeProxyInternals, 'touchTenantWake', async () => undefined);
+    t.mock.method(wakeProxyInternals, 'captureAwakeHome', async () => awakened);
+    // Prime: first call probes once and records the warm verdict.
+    await ensureAwake(tenantId);
+    assert.equal(probe.mock.callCount(), 1);
+    // Concurrent reads inside the TTL must resolve purely from the warm verdict — no extra probe,
+    // no re-entering the slow wake path. A regression that dropped back into the lock would bump the
+    // probe count past 1 here.
+    const results = await Promise.all([ensureAwake(tenantId), ensureAwake(tenantId), ensureAwake(tenantId)]);
+    assert.equal(probe.mock.callCount(), 1);
+    for (const result of results)
+        assert.equal(result.routeUrl, routeUrl);
+});

package/dist/hearth/wake-proxy/__tests__/ws-teardown-accounting.test.d.ts

@@ -0,0 +1 @@
+export {};