@crouton-kit/crouter 0.3.68 → 0.3.78

package/dist/commands/sys/setup.js

@@ -1,7 +1,8 @@
 import { defineLeaf } from '../../core/command.js';
 import { getMarkdownTheme, getSelectListTheme, getSettingsListTheme } from '@earendil-works/pi-coding-agent';
 import { TUI, ProcessTerminal, Input, matchesKey, truncateToWidth, visibleWidth } from '@earendil-works/pi-tui';
-import { applyTheme } from '../../clients/attach/config-load.js';
+import { applyTheme, defaultAgentDir } from '../../clients/attach/config-load.js';
+import { buildLoginPicker, summarizeProviderAuth } from '../../clients/attach/auth-pickers.js';
 const ANSI_GREEN = (s) => `\x1b[32m${s}\x1b[39m`;
 const ANSI_YELLOW = (s) => `\x1b[33m${s}\x1b[39m`;
 const theme = {
@@ -32,7 +33,7 @@ const theme = {
         return getMarkdownTheme().bold(text);
     },
 };
-import { buildSetupInitialState, executeSetupSubmission, formatSetupExecutionSummary, renderSetupStaticInstructions, resolveExaKeyPath, } from './setup-core.js';
+import { buildSetupInitialState, executeSetupSubmission, formatSetupExecutionSummary, renderSetupStaticInstructions, resolveExaKeyPath, resolveComposioKeyPath, } from './setup-core.js';
 function wrapText(text, width) {
     const clean = text.trim();
     if (clean === '')
@@ -101,8 +102,13 @@ class SetupWizard {
     installedPackageIds;
     systemTools;
     exaInput = new Input();
+    composioInput = new Input();
     selectedPackageIds = new Set();
     selectedSystemTools = new Set();
+    authSummary;
+    reloadAuthSummary;
+    notice;
+    onOpenLogin;
     activeTab = 0;
     pluginIndex = 0;
     systemIndex = 0;
@@ -113,10 +119,12 @@ class SetupWizard {
     _focused = false;
     onSubmit;
     onCancel;
-    constructor(manifest, installedPackageIds, systemTools) {
+    constructor(manifest, installedPackageIds, systemTools, authSummary, reloadAuthSummary) {
         this.manifest = manifest;
         this.installedPackageIds = installedPackageIds;
         this.systemTools = systemTools;
+        this.authSummary = authSummary;
+        this.reloadAuthSummary = reloadAuthSummary;
         for (const entry of this.manifest)
             this.selectedPackageIds.add(entry.id);
         for (const tool of this.systemTools) {
@@ -127,10 +135,13 @@ class SetupWizard {
         this.systemIndex = firstMissingSystem >= 0 ? firstMissingSystem : 0;
         this.exaInput.onSubmit = () => this.finalize();
         this.exaInput.onEscape = () => this.cancel();
+        this.composioInput.onSubmit = () => this.finalize();
+        this.composioInput.onEscape = () => this.cancel();
     }
     set focused(value) {
         this._focused = value;
-        this.exaInput.focused = value && this.activeTab === 2 && !this.confirming;
+        this.exaInput.focused = value && this.activeTab === 3 && !this.confirming;
+        this.composioInput.focused = value && this.activeTab === 4 && !this.confirming;
     }
     get focused() {
         return this._focused;
@@ -139,13 +150,24 @@ class SetupWizard {
         this.cachedWidth = undefined;
         this.cachedLines = undefined;
     }
+    /** Show a one-line notice on the login tab (login success/failure feedback). */
+    setNotice(message) {
+        this.notice = message;
+        this.invalidate();
+    }
+    /** Recompute provider auth status after a login flow closes. */
+    refreshAuth() {
+        this.authSummary = this.reloadAuthSummary();
+        this.invalidate();
+    }
     setTab(next) {
         this.activeTab = next;
-        this.exaInput.focused = this.focused && next === 2 && !this.confirming;
+        this.exaInput.focused = this.focused && next === 3 && !this.confirming;
+        this.composioInput.focused = this.focused && next === 4 && !this.confirming;
         this.invalidate();
     }
     moveTab(delta) {
-        const next = ((this.activeTab + delta + 3) % 3);
+        const next = ((this.activeTab + delta + 5) % 5);
         this.setTab(next);
     }
     cancel() {
@@ -229,6 +251,8 @@ class SetupWizard {
             systemDeps: this.systemTools.filter((tool) => !tool.installed && this.selectedSystemTools.has(tool.tool)).map((tool) => tool.plan),
             exaKey: this.exaInput.getValue().trim(),
             exaKeyPath: resolveExaKeyPath(),
+            composioKey: this.composioInput.getValue().trim(),
+            composioKeyPath: resolveComposioKeyPath(),
         };
     }
     finalize() {
@@ -263,6 +287,13 @@ class SetupWizard {
         if (this.handleGlobalTabSwitch(data))
             return;
         if (this.activeTab === 0) {
+            if (matchesKey(data, 'enter')) {
+                this.onOpenLogin?.();
+                return;
+            }
+            return;
+        }
+        if (this.activeTab === 1) {
             if (matchesKey(data, 'j') || matchesKey(data, 'down')) {
                 this.movePlugin(1);
                 return;
@@ -285,7 +316,7 @@ class SetupWizard {
             }
             return;
         }
-        if (this.activeTab === 1) {
+        if (this.activeTab === 2) {
             if (matchesKey(data, 'j') || matchesKey(data, 'down')) {
                 this.moveSystem(1);
                 return;
@@ -304,10 +335,14 @@ class SetupWizard {
             }
             return;
         }
-        this.exaInput.handleInput(data);
+        if (this.activeTab === 3) {
+            this.exaInput.handleInput(data);
+            return;
+        }
+        this.composioInput.handleInput(data);
     }
     renderHeader(width) {
-        const tabs = ['Plugins', 'System deps', 'Exa key'];
+        const tabs = ['Login', 'Plugins', 'System deps', 'Exa key', 'Composio key'];
         const tabLine = tabs
             .map((label, index) => tabPill(`${index + 1}. ${label}`, index === this.activeTab))
             .join(theme.fg('dim', '  ·  '));
@@ -321,12 +356,41 @@ class SetupWizard {
         const line = this.confirming
             ? 'y/enter confirm · n/esc go back · q cancel'
             : this.activeTab === 0
-                ? 'j/k or ↑/↓ move · space toggle · ? details · enter/Tab advance · ←/→ switch tabs · q cancel'
+                ? 'enter log in · Tab/→ next · q cancel'
                 : this.activeTab === 1
-                    ? 'j/k or ↑/↓ move · space toggle · enter/Tab advance · ←/→ switch tabs · q cancel'
-                    : 'type EXA_API_KEY · enter finish · Tab/Shift-Tab or ←/→ switch tabs · q cancel';
+                    ? 'j/k or ↑/↓ move · space toggle · ? details · enter/Tab advance · ←/→ switch tabs · q cancel'
+                    : this.activeTab === 2
+                        ? 'j/k or ↑/↓ move · space toggle · enter/Tab advance · ←/→ switch tabs · q cancel'
+                        : this.activeTab === 3
+                            ? 'type EXA_API_KEY · enter finish · Tab/Shift-Tab or ←/→ switch tabs · q cancel'
+                            : 'type COMPOSIO_API_KEY · enter finish · Tab/Shift-Tab or ←/→ switch tabs · q cancel';
         return [truncateToWidth(theme.fg('dim', line), width)];
     }
+    renderLogin(width) {
+        const out = [];
+        out.push(truncateToWidth(`${theme.fg('accent', theme.bold('Login'))}${theme.fg('dim', '  optional · same providers as /login')}`, width));
+        for (const line of wrapText('Log in to a model provider so crtr can run turns. With no provider configured, nodes fail to start when you first use the app.', Math.max(1, width))) {
+            out.push(truncateToWidth(theme.fg('muted', line), width));
+        }
+        out.push('');
+        const configured = this.authSummary.filter((p) => p.configured);
+        if (configured.length > 0) {
+            out.push(truncateToWidth(theme.fg('success', `✓ Configured: ${configured.map((p) => p.name).join(', ')}`), width));
+        }
+        else {
+            out.push(truncateToWidth(theme.fg('warning', 'No provider configured yet.'), width));
+        }
+        out.push('');
+        out.push(...framed([
+            theme.fg('accent', theme.bold('Press Enter to open the provider picker')),
+            theme.fg('dim', 'Pick a provider, then complete its OAuth or API-key login.'),
+        ], width));
+        if (this.notice !== undefined) {
+            out.push('');
+            out.push(truncateToWidth(theme.fg('success', this.notice), width));
+        }
+        return out;
+    }
     renderPlugins(width) {
         const out = [];
         out.push(truncateToWidth(`${theme.fg('accent', theme.bold('Plugins'))}${theme.fg('dim', '  default ON')}`, width));
@@ -379,10 +443,22 @@ class SetupWizard {
         ], width));
         return out;
     }
+    renderComposio(width) {
+        const out = [];
+        out.push(truncateToWidth(`${theme.fg('accent', theme.bold('Composio key'))}${theme.fg('dim', '  optional · powers /v1/connectors third-party service access')}`, width));
+        out.push(truncateToWidth(`${theme.fg('mdLink', 'Create a key: ')}${theme.fg('mdLinkUrl', 'https://platform.composio.dev/developers')}`, width));
+        out.push(truncateToWidth(theme.fg('dim', `Will write to: ${resolveComposioKeyPath()}`), width));
+        out.push(...framed([
+            theme.fg('accent', theme.bold('Paste COMPOSIO_API_KEY here')),
+            theme.fg('dim', 'Leave blank to skip.'),
+            ...this.composioInput.render(Math.max(1, width - 4)),
+        ], width));
+        return out;
+    }
     renderConfirm(width) {
         const out = [truncateToWidth(theme.fg('warning', theme.bold('Confirm installs')), width)];
         const submission = this.buildSubmission();
-        if (submission.packages.length === 0 && submission.systemDeps.length === 0 && submission.exaKey === '') {
+        if (submission.packages.length === 0 && submission.systemDeps.length === 0 && submission.exaKey === '' && submission.composioKey === '') {
             out.push(truncateToWidth(theme.fg('success', 'Nothing to install; press enter to finish.'), width));
             return out;
         }
@@ -404,6 +480,9 @@ class SetupWizard {
         if (submission.exaKey !== '') {
             out.push(truncateToWidth(`${theme.fg('accent', 'Exa key')} ${theme.fg('dim', '→')} ${theme.fg('warning', `write ${submission.exaKeyPath}`)}`, width));
         }
+        if (submission.composioKey !== '') {
+            out.push(truncateToWidth(`${theme.fg('accent', 'Composio key')} ${theme.fg('dim', '→')} ${theme.fg('warning', `write ${submission.composioKeyPath}`)}`, width));
+        }
         out.push(truncateToWidth(theme.fg('dim', 'y/enter confirm · n/esc go back'), width));
         return out;
     }
@@ -413,7 +492,17 @@ class SetupWizard {
         const lines = [
             ...this.renderHeader(width),
             '',
-            ...(this.confirming ? this.renderConfirm(width) : this.activeTab === 0 ? this.renderPlugins(width) : this.activeTab === 1 ? this.renderSystems(width) : this.renderExa(width)),
+            ...(this.confirming
+                ? this.renderConfirm(width)
+                : this.activeTab === 0
+                    ? this.renderLogin(width)
+                    : this.activeTab === 1
+                        ? this.renderPlugins(width)
+                        : this.activeTab === 2
+                            ? this.renderSystems(width)
+                            : this.activeTab === 3
+                                ? this.renderExa(width)
+                                : this.renderComposio(width)),
             '',
             ...this.renderFooter(width),
         ];
@@ -422,6 +511,52 @@ class SetupWizard {
         return this.cachedLines;
     }
 }
+const LOGIN_OVERLAY_OPTIONS = { anchor: 'center', width: '80%', maxHeight: '85%' };
+/** Mount pi's real `/login` provider picker + login dialog as a centered overlay
+ *  over the setup wizard, driving the SAME OAuth/API-key flow the in-app /login
+ *  uses (`buildLoginPicker`). Credentials write to `agentDir`'s auth.json; on
+ *  close, focus returns to the wizard and its auth summary refreshes. */
+function openLoginOverlay(tui, wizard, agentDir) {
+    let handle;
+    let current;
+    let done = false;
+    const disposeCurrent = () => {
+        const disposable = current?.component;
+        try {
+            disposable?.dispose?.();
+        }
+        catch {
+            /* ignore dispose errors during teardown */
+        }
+    };
+    const mount = (p) => {
+        handle = tui.showOverlay(p.component, LOGIN_OVERLAY_OPTIONS);
+        tui.setFocus(p.focus);
+    };
+    const unmount = () => handle?.hide();
+    const replace = (component, focus) => {
+        if (done)
+            return;
+        disposeCurrent();
+        unmount();
+        current = { component, focus };
+        mount(current);
+        tui.requestRender();
+    };
+    const close = () => {
+        if (done)
+            return;
+        done = true;
+        disposeCurrent();
+        unmount();
+        wizard.refreshAuth();
+        tui.setFocus(wizard);
+        tui.requestRender();
+    };
+    current = buildLoginPicker(tui, agentDir, () => wizard.refreshAuth(), (msg) => wizard.setNotice(msg), { close, replace });
+    mount(current);
+    tui.requestRender();
+}
 async function runSetup() {
     const state = buildSetupInitialState();
     if (!process.stdout.isTTY) {
@@ -429,9 +564,19 @@ async function runSetup() {
         return;
     }
     applyTheme({ cwd: process.cwd() });
+    const agentDir = defaultAgentDir();
+    const loadAuthSummary = () => {
+        try {
+            return summarizeProviderAuth(agentDir);
+        }
+        catch {
+            return [];
+        }
+    };
     const terminal = new ProcessTerminal();
     const tui = new TUI(terminal, true);
-    const wizard = new SetupWizard(state.manifest, state.installedPackageIds, state.systemTools);
+    const wizard = new SetupWizard(state.manifest, state.installedPackageIds, state.systemTools, loadAuthSummary(), loadAuthSummary);
+    wizard.onOpenLogin = () => openLoginOverlay(tui, wizard, agentDir);
     tui.addChild(wizard);
     tui.setFocus(wizard);
     await new Promise((resolve, reject) => {
@@ -496,17 +641,18 @@ async function runSetup() {
 }
 export const sysSetupLeaf = defineLeaf({
     name: 'setup',
-    description: 'install the bundled pi plugins, system deps, and Exa key setup',
-    whenToUse: 'you want to bootstrap this machine for crtr in one pass: install the vendored pi plugins, confirm tmux and nvim, and save your Exa API key.',
+    description: 'log in to a model provider, install the bundled pi plugins, system deps, and Exa + Composio key setup',
+    whenToUse: 'you want to bootstrap this machine for crtr in one pass: log in to a model provider (same flow as /login), install the vendored pi plugins, confirm tmux and nvim, and save your Exa and Composio API keys.',
     help: {
         name: 'sys setup',
-        summary: 'open the multi-tab setup wizard for bundled pi plugins, system deps, and Exa key',
+        summary: 'open the multi-tab setup wizard for provider login, bundled pi plugins, system deps, and Exa + Composio keys',
         inputNote: 'No input parameters.',
         output: [],
         outputKind: 'object',
         effects: [
-            'Opens a pi-tui wizard that collects companion package installs, system dependency installs, and an Exa API key.',
-            'Runs the bundled pi CLI to install the selected companion packages, writes EXA_API_KEY to ~/.crouter/exa.key when provided, and prints a summary.',
+            'Opens a pi-tui wizard whose first tab logs in to a model provider (pi\'s real OAuth/API-key flow, same as in-app /login) so a fresh install has credentials before running any node.',
+            'Collects companion package installs, system dependency installs, an Exa API key, and a Composio API key across the remaining tabs.',
+            'Runs the bundled pi CLI to install the selected companion packages, writes EXA_API_KEY to ~/.crouter/exa.key and COMPOSIO_API_KEY to ~/.crouter/composio.key when provided, and prints a summary.',
         ],
     },
     run: async () => {

package/dist/core/__tests__/base-worker-prompt.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/base-worker-prompt.test.js

@@ -0,0 +1,24 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { renderPreferencesForSubject } from '../substrate/render.js';
+function subject(mode) {
+    return {
+        kind: 'plan/reviewers/security',
+        mode,
+        lifecycle: 'terminal',
+        hasManager: true,
+        cwd: process.cwd(),
+        scope: 'project',
+        orchestration: { depth: 1 },
+        profile: null,
+    };
+}
+test('base sub-personas receive hands-on guidance instead of universal delegation pressure', () => {
+    const base = renderPreferencesForSubject(subject('base')).block;
+    assert.match(base, /You are a hands-on worker/);
+    assert.match(base, /Each child gets a bounded outcome distinct from your whole assignment/);
+    assert.doesNotMatch(base, /Hand any self-contained unit of work to a child/);
+    const orchestrator = renderPreferencesForSubject(subject('orchestrator')).block;
+    assert.doesNotMatch(orchestrator, /You are a hands-on worker/);
+    assert.match(orchestrator, /You are an orchestrator/);
+});

package/dist/core/__tests__/canvas-inbox-watcher-hold.test.js

@@ -10,7 +10,8 @@ import { mkdirSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import registerCanvasInboxWatcher from '../../pi-extensions/canvas-inbox-watcher.js';
-import { appendInbox } from '../feed/inbox.js';
+import { appendInbox, readCursor } from '../feed/inbox.js';
+import { appendSituationalContext } from '../runtime/situational-context.js';
 import { createNode, setIntent } from '../canvas/canvas.js';
 import { closeDb } from '../canvas/db.js';
 // Drive the watcher's injectable cadence seam (CRTR_WATCHER_TICK_MS /
@@ -36,11 +37,25 @@ function makeFakePi() {
     const handlers = {};
     return {
         injected: [],
+        sentMessages: [],
         on(e, h) { handlers[e] = h; },
         sendUserMessage(content, options) { this.injected.push({ content, deliverAs: options?.deliverAs }); },
+        sendMessage(message) { this.sentMessages.push(message); },
         fire(e, ev, ctx) { handlers[e]?.(ev, ctx); },
     };
 }
+// Fire agent_settled — the ONLY durable-commit boundary in the at-least-once
+// model. `pending` maps to pi's `hasPendingMessages()`: false = pi's
+// steer/followUp queue is drained (the normal production case — pi 0.80.6 drains
+// retry/queued continuations within the same prompt cycle before this settle —
+// so commit proceeds); true = the context still reports an unconsumed handed-off
+// send, which exercises the extension's DEFENSIVE coarse hold (commit is HELD
+// until a later drained settle). The true case is an API-behavior scenario for
+// the guard, not a lifecycle the normal production settle emits.
+function settle(pi, opts = {}) {
+    const pending = opts.pending === true;
+    pi.fire('agent_settled', { type: 'agent_settled' }, { isIdle: () => true, hasPendingMessages: () => pending });
+}
 const wait = (ms) => new Promise((r) => setTimeout(r, ms));
 let origTick;
 let origDebounce;
@@ -116,3 +131,219 @@ describe('canvas inbox watcher — hold + idle delivery', () => {
         assert.equal(pi.injected[0].deliverAs, undefined, 'idle → sendUserMessage triggers a turn, no deliverAs');
     });
 });
+// Durable-cursor model (at-least-once, one conservative boundary): the in-memory
+// `cursor` advances at buffer time (so a burst is never re-read into the same
+// watcher's buffer), but the on-disk cursor commits ONLY at `agent_settled` (and
+// `session_shutdown` as the graceful safety net) — never on the fire-and-forget
+// send return, never at `agent_end` (which fires before pi decides on retry/
+// continuation). A send returning normally is a HANDOFF, and the commit clamps
+// below anything still buffered. When pi still holds an unconsumed handed-off
+// send — a failed/aborted turn RETAINS its in-memory steer/followUp queue for the
+// next turn — `ctx.hasPendingMessages()` is true and the commit is HELD until a
+// later settle drains it. A watcher that dies (crash, SIGTERM, daemon kick)
+// before a committing settle leaves the on-disk cursor behind, so a fresh watcher
+// re-reads and re-delivers rather than silently losing the entry. See
+// canvas-inbox-watcher.ts's header/inline comments on `handedOffWatermark`,
+// `commitTarget`, and `commitAtSettle` for the full rationale.
+describe('canvas inbox watcher — durable cursor (at-least-once)', () => {
+    test('mid-turn handoff, crash before settle: on-disk cursor NOT advanced, fresh watcher re-delivers', async () => {
+        freshNode('node-cursor-crash');
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        // Streaming (mid-turn) so this delivers via followUp, not the idle path.
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 100);
+        appendInbox('node-cursor-crash', { from: 'child-1', tier: 'normal', kind: 'update', label: 'still working' });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.injected.length, 1, 'delivered mid-turn as a followUp');
+        assert.equal(pi1.injected[0].deliverAs, 'followUp');
+        // The durability boundary: no settle has fired, so the on-disk cursor must
+        // still be untouched — this is the assertion that proves the fix (a
+        // commit-at-buffer-time / commit-on-send variant would have committed here).
+        assert.equal(readCursor('node-cursor-crash'), undefined, 'on-disk cursor not committed before a settle');
+        // Simulate the watcher dying without a graceful session_shutdown — never
+        // settle OR fire session_shutdown on pi1. The broker's SIGTERM handler DOES
+        // run a JS handler (disposeAndExit: session.dispose() + process.exit), but
+        // that path never emits this extension's session_shutdown, so its safety-net
+        // commit does not run on a kill. Registering a fresh watcher clears pi1's
+        // timer (the module-level liveTimer guard) without running its teardown,
+        // modeling crash-then-revive rather than a clean stop.
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 1, 'a fresh watcher re-reads and re-delivers the same uncommitted entry');
+        assert.match(pi2.injected[0].content, /still working/);
+    });
+    test('mid-turn handoff + agent_settled: cursor committed, fresh watcher does NOT redeliver', async () => {
+        freshNode('node-cursor-committed');
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 100);
+        const entry = appendInbox('node-cursor-committed', { from: 'child-2', tier: 'normal', kind: 'update', label: 'still working' });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.injected.length, 1);
+        assert.equal(readCursor('node-cursor-committed'), undefined, 'not yet committed before the settle');
+        // The turn settles with pi's queue drained (the followUp was consumed) —
+        // THAT commits the cursor.
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-committed'), entry.ts, 'cursor committed to disk at agent_settled');
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 0, 'a fresh watcher does not redeliver an already-committed entry');
+    });
+    test('idle-path delivery: NOT committed on the void send, committed at agent_settled', async () => {
+        freshNode('node-cursor-idle');
+        const pi = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi));
+        // No agent_start fired → watcher treats the node as idle.
+        await wait(TICK_MS + 100);
+        const entry = appendInbox('node-cursor-idle', { from: 'child-3', tier: 'normal', kind: 'update', label: 'idle update' });
+        await wait(SETTLE_MS);
+        assert.equal(pi.injected.length, 1);
+        assert.equal(pi.injected[0].deliverAs, undefined, 'idle delivery has no deliverAs');
+        // The idle send triggers a turn, but its void return is a handoff, not proof
+        // of acceptance — the cursor stays put until the turn settles. (One rule: no
+        // immediate idle-path commit.)
+        assert.equal(readCursor('node-cursor-idle'), undefined, 'idle send does not commit on the fire-and-forget return');
+        settle(pi);
+        assert.equal(readCursor('node-cursor-idle'), entry.ts, 'idle-path delivery commits at the turn it started settling');
+    });
+    test('synchronous send throw then agent_settled: durable cursor NOT advanced past the re-buffered entry, fresh watcher re-delivers', async () => {
+        freshNode('node-cursor-failsend');
+        const pi1 = makeFakePi();
+        // Persistent synchronous send failure: the entry is read + buffered, flush
+        // throws, it is re-buffered and never handed off.
+        pi1.sendUserMessage = () => { throw new Error('send always fails'); };
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 100);
+        appendInbox('node-cursor-failsend', { from: 'child-1', tier: 'normal', kind: 'update', label: 'never delivered' });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.injected.length, 0, 'the failing send delivered nothing');
+        // agent_settled must NOT commit past the still-re-buffered (never-handed-off) entry.
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-failsend'), undefined, 'durable cursor not advanced past a re-buffered, never-delivered entry');
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 1, 'a fresh watcher re-reads and re-delivers the never-committed entry');
+        assert.match(pi2.injected[0].content, /never delivered/);
+    });
+    test('critical abort then abort-generated settle: pending critical entry NOT committed, fresh watcher re-delivers', async () => {
+        freshNode('node-cursor-critical');
+        const pi1 = makeFakePi();
+        let aborted = 0;
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        // Mid-turn streaming, with an abort() seam on the ctx (a critical entry
+        // preempts via ctx.abort()).
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false, abort: () => { aborted += 1; } });
+        await wait(TICK_MS + 100);
+        appendInbox('node-cursor-critical', { from: 'child-1', tier: 'critical', kind: 'update', label: 'critical work' });
+        await wait(SETTLE_MS);
+        assert.ok(aborted >= 1, 'the critical entry aborted the live turn');
+        assert.equal(pi1.injected.length, 0, 'the critical path re-buffers, it does not deliver mid-stream');
+        // The abort-generated agent_end/settle must not commit the pending critical
+        // entry (it is re-buffered, never handed off).
+        pi1.fire('agent_end', { type: 'agent_end', messages: [] }, { isIdle: () => true });
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-critical'), undefined, 'abort-generated settle does not commit the pending critical entry before its retry');
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 1, 'a fresh watcher re-delivers the critical entry');
+        assert.match(pi2.injected[0].content, /critical work/);
+    });
+    test('batch A settles while batch B still debounces: commit stops at A, fresh watcher re-delivers B', async () => {
+        freshNode('node-cursor-batchB');
+        // Wide debounce for THIS watcher so B stays buffered-but-unflushed when we
+        // settle A; the watcher captures the cadence at registration, so restore the
+        // file default immediately after for the fresh (pi2) watcher.
+        process.env['CRTR_WATCHER_DEBOUNCE_MS'] = '200';
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        process.env['CRTR_WATCHER_DEBOUNCE_MS'] = String(DEBOUNCE_MS);
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 60);
+        const a = appendInbox('node-cursor-batchB', { from: 'child-a', tier: 'normal', kind: 'update', label: 'batch A' });
+        await wait(280); // > 200ms debounce → A flushes and is delivered mid-turn (handoff)
+        assert.equal(pi1.injected.length, 1, 'batch A delivered mid-turn');
+        assert.equal(pi1.injected[0].deliverAs, 'followUp');
+        const b = appendInbox('node-cursor-batchB', { from: 'child-b', tier: 'normal', kind: 'update', label: 'batch B' });
+        await wait(70); // B read into the buffer but < 200ms debounce → not yet flushed
+        // A's turn settles while B is still debouncing in the buffer. The commit must
+        // clamp below the still-buffered B and land on A only.
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-batchB'), a.ts, 'commit lands on handed-off batch A');
+        assert.notEqual(readCursor('node-cursor-batchB'), b.ts, 'commit does not cross the still-buffered batch B');
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS + 40);
+        assert.equal(pi2.injected.length, 1, 'a fresh watcher re-reads from A and re-delivers B');
+        assert.match(pi2.injected[0].content, /batch B/);
+        assert.doesNotMatch(pi2.injected[0].content, /batch A/, 'A is already committed, only B is re-delivered');
+    });
+    // Defensive coarse-hold guard, driven at the API boundary. In the installed pi
+    // 0.80.6 `AgentSession` a handed-off followUp is drained within the same
+    // prompt cycle before the sole extension-facing settle, so the normal
+    // production settle sees `hasPendingMessages() === false`. This test does NOT
+    // reproduce a production failure→pending-settle→later-settle lifecycle; it
+    // pins the guard's contract directly: WHEN a settle's context reports pending
+    // sends (hasPendingMessages() = true), committing would durably consume a
+    // message not yet delivered, so the commit is HELD (never at agent_end, never
+    // at the pending settle); a crash in that window re-delivers; and once a later
+    // settle reports a drained queue (hasPendingMessages() = false) the cursor
+    // commits exactly once.
+    test('settle reporting pending sends: HELD by the defensive guard, then committed once the queue drains', async () => {
+        freshNode('node-cursor-failhold');
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        pi1.fire('agent_start', { type: 'agent_start' }, { isIdle: () => false });
+        await wait(TICK_MS + 100);
+        const entry = appendInbox('node-cursor-failhold', { from: 'child-1', tier: 'normal', kind: 'update', label: 'queued across a failure' });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.injected.length, 1, 'delivered mid-turn as a followUp');
+        assert.equal(pi1.injected[0].deliverAs, 'followUp');
+        // A failure/aborted agent_end is never a commit point regardless of queue
+        // state, so it must NOT commit.
+        pi1.fire('agent_end', { type: 'agent_end', messages: [] }, { isIdle: () => false });
+        assert.equal(readCursor('node-cursor-failhold'), undefined, 'a failure agent_end does not commit');
+        // Drive the guard directly: a settle whose context reports pending sends
+        // (hasPendingMessages = true). The commit is HELD — committing now would
+        // durably consume a message not yet delivered.
+        settle(pi1, { pending: true });
+        assert.equal(readCursor('node-cursor-failhold'), undefined, 'settle reporting pending sends does NOT commit (held)');
+        // A crash in this exact held window re-delivers — nothing was committed.
+        const pi2 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi2));
+        await wait(SETTLE_MS);
+        assert.equal(pi2.injected.length, 1, 'crash while held re-delivers');
+        assert.match(pi2.injected[0].content, /queued across a failure/);
+        // The next settle reports a drained queue (hasPendingMessages = false) →
+        // commit lands exactly once.
+        settle(pi2);
+        assert.equal(readCursor('node-cursor-failhold'), entry.ts, 'the settle after pi drains the queue commits the cursor');
+    });
+    // Situational custom sends do not enter pi's user steer/followUp queue, so
+    // hasPendingMessages() never reflects them: a situational handoff commits at
+    // the next drained settle (a situational send that async-rejected is the
+    // accepted silent-loss window, not held).
+    test('situational custom send: committed at the next drained agent_settled', async () => {
+        freshNode('node-cursor-situational');
+        appendSituationalContext('node-cursor-situational', 'ambient checkout state');
+        const pi1 = makeFakePi();
+        disposers.push(registerCanvasInboxWatcher(pi1));
+        // Idle so the situational-only entry delivers as a hidden custom message.
+        await wait(TICK_MS + 100);
+        const entry = appendInbox('node-cursor-situational', {
+            from: null, tier: 'normal', kind: 'message', label: '(ambient context updated)',
+            data: { situational: true, situationalOnly: true },
+        });
+        await wait(SETTLE_MS);
+        assert.equal(pi1.sentMessages.length, 1, 'the hidden custom message was sent');
+        assert.equal(readCursor('node-cursor-situational'), undefined, 'not committed before the settle');
+        settle(pi1);
+        assert.equal(readCursor('node-cursor-situational'), entry.ts, 'the situational handoff commits at the drained settle');
+    });
+});

package/dist/core/__tests__/fault-classifier.test.js

@@ -28,3 +28,18 @@ test('HTTP 401/403 objects still classify as auth (unchanged path)', () => {
     assert.equal(classify('pi→provider', { status: 401, statusText: 'Unauthorized' }).kind, 'auth');
     assert.equal(classify('pi→provider', { status: 403 }).kind, 'auth');
 });
+// Stale ⚠ triangles — undici mid-stream disconnect text (e.g. a laptop sleep/
+// wake episode) must classify as a transient connection blip (disposition
+// 'auto'), not fall through to 'other' (disposition 'fatal', "needs you").
+test('undici stream-drop texts classify as connection/auto, not other/fatal', () => {
+    for (const msg of ['terminated', 'other side closed', 'premature close']) {
+        const c = classify('pi→provider', msg);
+        assert.equal(c.kind, 'connection', `"${msg}" must classify as connection`);
+        assert.equal(c.disposition, 'auto', `"${msg}" must be auto-retried, not fatal`);
+    }
+});
+test('"terminated" matches as a whole word only (no false positive on substrings)', () => {
+    // \bterminated\b must not match e.g. "unterminated" as a stray substring hit —
+    // guard the word-boundary choice explicitly.
+    assert.notEqual(classify('pi→provider', 'preterminated').kind, 'connection');
+});

package/dist/core/__tests__/full/broker-dialogs.test.js

@@ -142,10 +142,15 @@ test('G6 — zero-viewer dialog resolves immediately; an unanswered attended dia
     assert.equal(r1[base].resolved, false, 'G6a: zero-viewer dialog resolves to the default (deny)');
     assert.ok(r1[base].ms < 2000, `G6a: resolved immediately (noOp), not after the 5000ms timeout — got ${r1[base].ms}ms`);
     // (b) controller attached but silent → the broker resolves on the SHORT explicit
-    // per-dialog timeout (800ms), never the 120s default.
+    // per-dialog timeout (800ms), never the 120s default. On timeout the broker also
+    // broadcasts a correlated `extension_ui_dismiss` keyed to the dialog's id, so the
+    // controller's overlay (which has no independent timer) is torn down by id.
     const c = await ctrl('g6-ctrl');
     h.fakeCmd(id, { cmd: 'dialog', timeout: 800 });
-    await c.waitFrame((f) => f.type === 'extension_ui_request', 'G6b dialog forwarded to controller'); // received, deliberately NOT answered
+    const req = await c.waitFrame((f) => f.type === 'extension_ui_request', 'G6b dialog forwarded to controller'); // received, deliberately NOT answered
+    const reqId = req.id;
+    const dismiss = await c.waitFrame((f) => f.type === 'extension_ui_dismiss' && f.id === reqId, 'G6b broker emits a correlated extension_ui_dismiss on timeout');
+    assert.equal(dismiss.id, reqId, 'G6b: the dismiss frame carries the timed-out dialog id, not another');
     const r2 = await awaitDialogs(base + 2, 'G6b attended dialog resolved on timeout');
     assert.equal(r2[base + 1].resolved, false, 'G6b: an unanswered attended dialog resolves to the default (deny)');
     assert.ok(r2[base + 1].ms >= 600 && r2[base + 1].ms < 5000, `G6b: resolved on the ~800ms per-dialog timeout, not instantly and not the 120s default — got ${r2[base + 1].ms}ms`);