@crouton-kit/crouter 0.3.68 → 0.3.78

package/dist/core/__tests__/full/broker-pane-resolution.test.js

@@ -33,7 +33,7 @@
 import { test, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { createHarness, hasTmux } from '../helpers/harness.js';
+import { createHarness, hasTmux, TMUX_TIMEOUT_MS } from '../helpers/harness.js';
 import { closeDb } from '../../canvas/db.js';
 import { getFocusByNode, listFocuses } from '../../canvas/focuses.js';
 import { nodeInPane } from '../../../commands/node.js';
@@ -50,13 +50,16 @@ after(async () => {
 });
 /** Split a throwaway pane in the harness session; return its %id. */
 function makePane() {
-    const r = spawnSync('tmux', ['split-window', '-d', '-t', h.session, '-P', '-F', '#{pane_id}', 'sleep 100000'], { encoding: 'utf8' });
+    const r = spawnSync('tmux', ['split-window', '-d', '-t', h.session, '-P', '-F', '#{pane_id}', 'sleep 100000'], { encoding: 'utf8', timeout: TMUX_TIMEOUT_MS });
     const pane = (r.stdout ?? '').trim();
     assert.ok(pane.startsWith('%'), `expected a %pane_id, got "${pane}" (stderr: ${r.stderr})`);
     return pane;
 }
 function tagPane(pane, value) {
-    spawnSync('tmux', ['set-option', '-p', '-t', pane, '@crtr_node', value], { stdio: 'ignore' });
+    spawnSync('tmux', ['set-option', '-p', '-t', pane, '@crtr_node', value], {
+        stdio: 'ignore',
+        timeout: TMUX_TIMEOUT_MS,
+    });
 }
 /** Parse `crtr`'s human-list stdout (`- key: value` lines) into a map. */
 function parseList(stdout) {
@@ -70,13 +73,13 @@ function parseList(stdout) {
 }
 /** Read a pane's `@crtr_node` option ('' when unset / pane gone). */
 function paneTag(pane) {
-    const r = spawnSync('tmux', ['show-options', '-p', '-v', '-t', pane, '@crtr_node'], { encoding: 'utf8' });
+    const r = spawnSync('tmux', ['show-options', '-p', '-v', '-t', pane, '@crtr_node'], { encoding: 'utf8', timeout: TMUX_TIMEOUT_MS });
     return (r.stdout ?? '').trim();
 }
 /** Every pane in the harness session whose `@crtr_node` tag names `id` — the live
  *  on-screen viewer panes for that node. A correct dedup keeps this at exactly 1. */
 function taggedViewerPanes(session, id) {
-    const r = spawnSync('tmux', ['list-panes', '-s', '-t', session, '-F', '#{pane_id} #{@crtr_node}'], { encoding: 'utf8' });
+    const r = spawnSync('tmux', ['list-panes', '-s', '-t', session, '-F', '#{pane_id} #{@crtr_node}'], { encoding: 'utf8', timeout: TMUX_TIMEOUT_MS });
     return (r.stdout ?? '')
         .split('\n')
         .map((l) => l.trim())
@@ -112,7 +115,7 @@ test('Gap 1 — nodeInPane resolves a broker node from its tagged viewer pane (u
     closeDb();
     assert.equal(nodeInPane(viewer), broker, 'tagged viewer pane → resolves the broker (the fix)');
     // A stale tag pointing at a DONE node is ignored (must be live: active/idle).
-    spawnSync('tmux', ['kill-pane', '-t', viewer], { stdio: 'ignore' });
+    spawnSync('tmux', ['kill-pane', '-t', viewer], { stdio: 'ignore', timeout: TMUX_TIMEOUT_MS });
 });
 test('Gap 2 — recycle preserves the broker host: finalizes the node, boots a fresh BROKER root', async (t) => {
     if (!hasTmux())

package/dist/core/__tests__/full/cascade-close.test.js

@@ -54,10 +54,13 @@ import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { createHarness, hasTmux } from '../helpers/harness.js';
+import { createHarness, hasTmux, TMUX_TIMEOUT_MS } from '../helpers/harness.js';
 import { isPidAlive } from '../../canvas/pid.js';
 function sessionExists(session) {
-    return spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0;
+    return (spawnSync('tmux', ['has-session', '-t', session], {
+        stdio: 'ignore',
+        timeout: TMUX_TIMEOUT_MS,
+    }).status === 0);
 }
 function seedAssistantSession(sessionFile) {
     mkdirSync(join(sessionFile, '..'), { recursive: true });

package/dist/core/__tests__/full/dead-pane-regression.test.js

@@ -27,12 +27,12 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { hasTmux } from '../helpers/harness.js';
+import { hasTmux, TMUX_TIMEOUT_MS } from '../helpers/harness.js';
 import { spawnAndDetach } from '../../spawn.js';
 const SKIP = !hasTmux();
 // --- LOCAL tmux drivers (keyed on a raw %pane id, not a canvas node) --------
 function tmux(args) {
-    const r = spawnSync('tmux', args, { encoding: 'utf8' });
+    const r = spawnSync('tmux', args, { encoding: 'utf8', timeout: TMUX_TIMEOUT_MS });
     return { code: r.status ?? -1, out: (r.stdout ?? '').trim(), err: (r.stderr ?? '').trim() };
 }
 /** Every pane in the session (across windows) with its dead flag. */
@@ -146,6 +146,9 @@ test('dead-pane regression: spawnAndDetach into a remain-on-exit-ON window is DE
             else
                 process.env['TMUX'] = origTmux;
         }
-        assert.equal(spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0, false, 'isolated session killed — no stray');
+        assert.equal(spawnSync('tmux', ['has-session', '-t', session], {
+            stdio: 'ignore',
+            timeout: TMUX_TIMEOUT_MS,
+        }).status === 0, false, 'isolated session killed — no stray');
     }
 });

package/dist/core/__tests__/full/detach-focus.test.js

@@ -26,18 +26,23 @@ import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
 import { mkdirSync, writeFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { createHarness, hasTmux } from '../helpers/harness.js';
+import { createHarness, hasTmux, TMUX_TIMEOUT_MS } from '../helpers/harness.js';
 import { getNode } from '../../canvas/canvas.js';
 import { getFocusByNode, getFocusByPane, listFocuses } from '../../canvas/focuses.js';
 import { closeDb } from '../../canvas/db.js';
 import { isPidAlive } from '../../canvas/pid.js';
 const SKIP = !hasTmux() ? 'tmux unavailable' : false;
 function sessionExists(session) {
-    return spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0;
+    return (spawnSync('tmux', ['has-session', '-t', session], {
+        stdio: 'ignore',
+        timeout: TMUX_TIMEOUT_MS,
+    }).status === 0);
 }
 function paneExistsReal(pane) {
-    return ((spawnSync('tmux', ['display-message', '-p', '-t', pane, '#{pane_id}'], { encoding: 'utf8' }).stdout ?? '').trim() ===
-        pane);
+    return ((spawnSync('tmux', ['display-message', '-p', '-t', pane, '#{pane_id}'], {
+        encoding: 'utf8',
+        timeout: TMUX_TIMEOUT_MS,
+    }).stdout ?? '').trim() === pane);
 }
 // Split a throwaway pane in the harness session; return its %id. The caller pane
 // `node focus` opens the viewer beside (a09b71f: spawn no longer auto-opens one).
@@ -49,7 +54,7 @@ function seedAssistantSession(sessionFile) {
     writeFileSync(sessionFile, JSON.stringify({ type: 'message', message: { role: 'assistant', content: [{ type: 'text', text: 'hi' }] } }) + '\n');
 }
 function makePane(session) {
-    const r = spawnSync('tmux', ['split-window', '-d', '-t', session, '-P', '-F', '#{pane_id}', 'sleep 100000'], { encoding: 'utf8' });
+    const r = spawnSync('tmux', ['split-window', '-d', '-t', session, '-P', '-F', '#{pane_id}', 'sleep 100000'], { encoding: 'utf8', timeout: TMUX_TIMEOUT_MS });
     const pane = (r.stdout ?? '').trim();
     assert.ok(pane.startsWith('%'), `expected a %pane_id, got "${pane}" (stderr: ${r.stderr})`);
     return pane;

package/dist/core/__tests__/full/human-new-window-regression.test.js

@@ -21,11 +21,11 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawnSync } from 'node:child_process';
-import { hasTmux } from '../helpers/harness.js';
+import { hasTmux, TMUX_TIMEOUT_MS } from '../helpers/harness.js';
 import { spawnAndDetach } from '../../spawn.js';
 const SKIP = !hasTmux();
 function tmux(args) {
-    const r = spawnSync('tmux', args, { encoding: 'utf8' });
+    const r = spawnSync('tmux', args, { encoding: 'utf8', timeout: TMUX_TIMEOUT_MS });
     return { code: r.status ?? -1, out: (r.stdout ?? '').trim(), err: (r.stderr ?? '').trim() };
 }
 /** window id of a pane (across the server). '' on error. */
@@ -96,6 +96,9 @@ test('human-new-window regression: spawnAndDetach new-window into a watched-pane
             else
                 process.env['TMUX'] = origTmux;
         }
-        assert.equal(spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0, false, 'isolated session killed — no stray');
+        assert.equal(spawnSync('tmux', ['has-session', '-t', session], {
+            stdio: 'ignore',
+            timeout: TMUX_TIMEOUT_MS,
+        }).status === 0, false, 'isolated session killed — no stray');
     }
 });

package/dist/core/__tests__/full/review-render-pane-regression.test.js

@@ -32,12 +32,12 @@ import { tmpdir } from 'node:os';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { createRequire } from 'node:module';
-import { hasTmux } from '../helpers/harness.js';
+import { hasTmux, TMUX_TIMEOUT_MS } from '../helpers/harness.js';
 const CROUTER = join(dirname(fileURLToPath(import.meta.url)), '..', '..', '..', '..');
 const CLI_SRC = join(CROUTER, 'src', 'cli.ts');
 const TSX_ESM = createRequire(import.meta.url).resolve('tsx/esm');
 function tmux(args) {
-    const r = spawnSync('tmux', args, { encoding: 'utf8' });
+    const r = spawnSync('tmux', args, { encoding: 'utf8', timeout: TMUX_TIMEOUT_MS });
     return { code: r.status ?? -1, out: (r.stdout ?? '').trim(), err: (r.stderr ?? '').trim() };
 }
 function sessionPanes(session) {

package/dist/core/__tests__/helpers/harness.d.ts

@@ -1,5 +1,6 @@
 import type { NodeMeta, NodeStatus, Mode, Lifecycle, ExitIntent } from '../../canvas/types.js';
 import type { InboxEntry } from '../../feed/inbox.js';
+export declare const TMUX_TIMEOUT_MS = 10000;
 /** True when a usable tmux is on PATH — tests gate on this and SKIP otherwise. */
 export declare function hasTmux(): boolean;
 export interface WaitOpts {

package/dist/core/__tests__/helpers/harness.js

@@ -45,12 +45,28 @@ const TSX_ESM = createRequire(import.meta.url).resolve('tsx/esm');
 // A multi-word launcher, baked verbatim ahead of the (shell-quoted) argv by the
 // seam. Absolute paths so it works regardless of the spawned window's cwd.
 const FAKE_PI_BINARY = `${process.execPath} --import ${TSX_ESM} ${FAKE_PI_HOST}`;
+// Every raw `tmux` call the harness/full-tier tests make against the shared
+// DEFAULT server is synchronous (spawnSync). Node's spawnSync blocks the WHOLE
+// worker (no event loop, no `node --test` timeout can preempt it) until the
+// child exits — with no `timeout` option it can wait FOREVER. A wedged/CPU-
+// starved tmux server (the acknowledged "intermittent Linux-only crash-revive
+// wedge", CI-only) has been observed to hang one of these calls indefinitely,
+// which permanently consumes one of the `--test-concurrency` slots; as more
+// full-tier files each hit the SAME wedged server, every slot eventually gets
+// consumed the same way and the whole suite flatlines with zero further TAP
+// output (confirmed 3/3 in CI, see ci-full-suite-hang-blocker.md). TMUX_TIMEOUT_MS
+// bounds every raw tmux spawnSync call so a wedge fails that ONE call (and the
+// test it belongs to) fast instead of hanging the run.
+export const TMUX_TIMEOUT_MS = 10_000;
 /** True when a usable tmux is on PATH — tests gate on this and SKIP otherwise. */
 export function hasTmux() {
-    return spawnSync('tmux', ['-V'], { stdio: 'ignore' }).status === 0;
+    return spawnSync('tmux', ['-V'], { stdio: 'ignore', timeout: TMUX_TIMEOUT_MS }).status === 0;
 }
 function tmuxSessionExists(session) {
-    return spawnSync('tmux', ['has-session', '-t', session], { stdio: 'ignore' }).status === 0;
+    return (spawnSync('tmux', ['has-session', '-t', session], {
+        stdio: 'ignore',
+        timeout: TMUX_TIMEOUT_MS,
+    }).status === 0);
 }
 // Every canvas/tmux var the harness itself runs under — scrubbed from each child
 // env so a spawned CLI cannot leak the REAL canvas into the isolated test.
@@ -172,14 +188,19 @@ export async function createHarness(opts = {}) {
     if (!headless) {
         spawnSync('tmux', ['new-session', '-d', '-s', session, '-c', CROUTER, 'sleep 100000'], {
             stdio: 'ignore',
+            timeout: TMUX_TIMEOUT_MS,
         });
         // Put CRTR_PI_BINARY in the SESSION environment so EVERY pane/process spawned
         // in this session inherits it — so any pi the runtime launches (boot, revive)
         // resolves to the fake-pi vehicle, not a real pi.
         spawnSync('tmux', ['set-environment', '-t', session, 'CRTR_PI_BINARY', FAKE_PI_BINARY], {
             stdio: 'ignore',
+            timeout: TMUX_TIMEOUT_MS,
+        });
+        spawnSync('tmux', ['set-environment', '-t', session, 'CRTR_HOME', home], {
+            stdio: 'ignore',
+            timeout: TMUX_TIMEOUT_MS,
         });
-        spawnSync('tmux', ['set-environment', '-t', session, 'CRTR_HOME', home], { stdio: 'ignore' });
     }
     const pidsToKill = new Set();
     let nextRootSeq = 0;
@@ -517,7 +538,10 @@ export async function createHarness(opts = {}) {
             return subscriptionsOf(nodeId).map((s) => ({ node_id: s.node_id, active: s.active }));
         },
         async dispose() {
-            spawnSync('tmux', ['kill-session', '-t', session], { stdio: 'ignore' });
+            spawnSync('tmux', ['kill-session', '-t', session], {
+                stdio: 'ignore',
+                timeout: TMUX_TIMEOUT_MS,
+            });
             // Best-effort: a superviseTick-triggered revive of a fabricated node fires
             // a DETACHED throwaway broker (it loads the real SDK; the rmSync of home
             // below makes a mid-boot one self-terminate when its files vanish). Kill

package/dist/core/__tests__/host-teardown-process-group.test.js

@@ -62,7 +62,7 @@
 import { test, before, after } from 'node:test';
 import assert from 'node:assert/strict';
 import { spawn } from 'node:child_process';
-import { existsSync, mkdtempSync, readFileSync, rmSync } from 'node:fs';
+import { mkdtempSync, readFileSync, rmSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { createHarness } from './helpers/harness.js';
@@ -180,9 +180,20 @@ async function spawnBrokerWithSharedGroupDescendant(tag, descendantScript = 'sle
     if (leader.pid == null)
         throw new Error('failed to spawn fake broker leader');
     trackPid(leader.pid);
-    await h.waitFor(() => existsSync(pidFile), { label: `${tag}: descendant pid file written` });
-    const descendantPid = Number.parseInt(readFileSync(pidFile, 'utf8').trim(), 10);
-    assert.ok(Number.isInteger(descendantPid) && descendantPid > 0, `${tag}: parsed a real descendant pid`);
+    const descendantPid = await h.waitFor(() => {
+        try {
+            const record = readFileSync(pidFile, 'utf8');
+            if (!/^\d+\n$/.test(record))
+                return false;
+            const pid = Number(record.slice(0, -1));
+            return Number.isSafeInteger(pid) && pid > 0 ? pid : false;
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return false;
+            throw error;
+        }
+    }, { label: `${tag}: valid descendant pid written` });
     trackPid(descendantPid);
     await h.waitFor(() => isPidAlive(descendantPid), { label: `${tag}: descendant alive before teardown` });
     return { leaderPid: leader.pid, descendantPid };

package/dist/core/__tests__/live-mutation-verbs.test.js

@@ -47,6 +47,7 @@ import { commitPersonaAck, personaDrift } from '../runtime/persona.js';
 function persona(m) {
     return { mode: m.mode, lifecycle: m.lifecycle };
 }
+const FULL_CLI_TEST_TIMEOUT_MS = 180_000;
 // ===========================================================================
 // (b) THE demote / recycle SPLIT — two DISTINCT verbs:
 //   • `node lifecycle demote`  flips a LIVE node's lifecycle→TERMINAL IN PLACE — it keeps
@@ -60,9 +61,9 @@ function persona(m) {
 // ===========================================================================
 test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle recycle is FINISH+RECYCLE', 
 // Drives several full-CLI subprocess spawns (each a cold tsx compile of the
-// whole CLI) + recycleNode; a 20s budget blew on the slower, concurrency-
-// oversubscribed CI runner though it passes in ~8s locally. 60s = safe margin.
-{ timeout: 60_000 }, async () => {
+// whole CLI) + recycleNode; this is a subprocess-heavy regression and gets a
+// CI-safe per-test budget while the npm script isolates it at file concurrency 1.
+{ timeout: FULL_CLI_TEST_TIMEOUT_MS }, async () => {
     const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-demote' });
     try {
         const A = h.spawnRoot('resident root');
@@ -136,7 +137,7 @@ test('node lifecycle demote flips lifecycle→terminal IN PLACE; node lifecycle
 // ===========================================================================
 test('A4: a base→orchestrator yield auto-promotes + sets refresh but leaves persona_ack PENDING (the steer is never delivered)', 
 // Full-CLI subprocess spawn under load — see the sibling test's budget note.
-{ timeout: 60_000 }, async () => {
+{ timeout: FULL_CLI_TEST_TIMEOUT_MS }, async () => {
     const h = await createHeadlessHarness({ sessionPrefix: 'crtr-live-a4' });
     try {
         const A = h.spawnRoot('resident root');

package/dist/core/__tests__/review-model-floor.test.js

@@ -27,7 +27,7 @@ test('review still permits equal-or-stronger explicit models', () => {
     assert.equal(spec('review', 'ultra'), normalizeModel('ultra'));
 });
 test('explore remains cheap by default and may explicitly run light', () => {
-    assert.equal(spec('explore'), normalizeModel('anthropic/light'));
+    assert.equal(spec('explore'), normalizeModel('openai/light'));
     assert.equal(spec('explore', 'light'), normalizeModel('light'));
 });
 // `node new --model` widened to the full spec grammar (provider/tier, exact

package/dist/core/__tests__/stream-watchdog.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/core/__tests__/stream-watchdog.test.js

@@ -0,0 +1,70 @@
+// Run with: node --import tsx/esm --test src/core/__tests__/stream-watchdog.test.ts
+//
+// Unit-level contract test for StreamWatchdog (see stream-watchdog.ts): a
+// single-timer dead-man's switch the broker pokes while a turn awaits the
+// provider (disarmed during tool execution) and clears at agent_end. This
+// locks the class's arm/clear/single-fire/token contract directly — no broker
+// or fake-engine harness needed (that integration surface is deliberately out
+// of scope; see
+// the roadmap's Fix 3 test-scope note).
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { StreamWatchdog } from '../runtime/stream-watchdog.js';
+const MS = 30;
+const sleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+test('poke() arms the watchdog, firing once after ms with no further poke', async () => {
+    let calls = 0;
+    const wd = new StreamWatchdog(() => calls++, MS);
+    wd.poke(0);
+    assert.equal(calls, 0, 'must not fire before ms elapses');
+    await sleep(MS * 2);
+    assert.equal(calls, 1, 'must fire exactly once after ms with no further poke');
+});
+test('repeated pokes rearm the deadline from the LAST poke, not the first', async () => {
+    // A cancel-without-reschedule bug (clear the old timer but never arm a new
+    // one) would also "never fire while poked", so proving no-fire mid-stream is
+    // not enough. Prove the deadline actually REARMS: no fire around the original
+    // deadline, then exactly one fire measured from the FINAL poke.
+    let calls = 0;
+    const wd = new StreamWatchdog(() => calls++, MS);
+    wd.poke(0);
+    // Re-poke well inside the window, several times, always resetting the clock.
+    // The last poke lands at ~t=2.5*MS, so the original t=MS deadline must pass
+    // with no fire.
+    for (let i = 0; i < 5; i++) {
+        await sleep(MS / 2);
+        wd.poke(0);
+    }
+    assert.equal(calls, 0, 'no fire around the original deadline — each poke rearmed it');
+    // From the final poke the timer must still be armed and fire exactly once.
+    await sleep(MS * 2);
+    assert.equal(calls, 1, 'exactly one fire, measured from the final poke — proves rearming');
+});
+test('clear() after poke prevents firing', async () => {
+    let calls = 0;
+    const wd = new StreamWatchdog(() => calls++, MS);
+    wd.poke(0);
+    wd.clear();
+    await sleep(MS * 2);
+    assert.equal(calls, 0, 'a cleared watchdog must never fire');
+});
+test('fires exactly once even if left armed well past ms', async () => {
+    let calls = 0;
+    const wd = new StreamWatchdog(() => calls++, MS);
+    wd.poke(0);
+    await sleep(MS * 5);
+    assert.equal(calls, 1, 'must fire only once, not repeatedly, past the deadline');
+});
+test('onStall receives the token of the arm that fired (generation binding)', async () => {
+    // The broker stamps each poke with the current session generation and no-ops
+    // a stall whose token is stale. This pins that the token travels with the
+    // arm: a re-poke supersedes the prior token, so a fire after a rebind carries
+    // the NEW generation — and an old timer that somehow survived would deliver
+    // the OLD one, which the broker guard rejects.
+    const tokens = [];
+    const wd = new StreamWatchdog((token) => tokens.push(token), MS);
+    wd.poke(1);
+    wd.poke(2); // supersedes generation 1 before it can fire
+    await sleep(MS * 2);
+    assert.deepEqual(tokens, [2], 'exactly one fire, carrying the most-recent arm\'s token');
+});

package/dist/core/__tests__/tmux-surface.test.js

@@ -18,8 +18,11 @@
 import { test } from 'node:test';
 import assert from 'node:assert/strict';
 import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { spawnSync } from 'node:child_process';
 import { fileURLToPath } from 'node:url';
 import { dirname, join, basename } from 'node:path';
+import { installTmuxBindings } from '../runtime/tmux-chrome.js';
+import { resolveKeybindings } from '../keybindings/index.js';
 const __dirname = dirname(fileURLToPath(import.meta.url));
 const SRC_ROOT = join(__dirname, '..', '..'); // .../src
 const TMUX_TS = join(SRC_ROOT, 'core', 'runtime', 'tmux.ts');
@@ -113,3 +116,72 @@ test('§5.1 lint: only placement.ts / tmux-chrome.ts import the tmux driver', ()
         .map((f) => f.slice(SRC_ROOT.length + 1));
     assert.deepEqual(offenders, [], `modules importing tmux.ts directly: ${offenders.join(', ')}`);
 });
+function isolatedTmux(socket, args) {
+    const result = spawnSync('tmux', ['-S', socket, ...args], { encoding: 'utf8' });
+    return { status: result.status, stdout: result.stdout ?? '', stderr: result.stderr ?? '' };
+}
+function tmuxBinding(socket, table, key) {
+    const result = isolatedTmux(socket, ['list-keys', '-T', table]);
+    if (result.status !== 0)
+        return null;
+    return result.stdout.split('\n').find((line) => {
+        const match = line.match(/^bind-key\s+(?:-r\s+)?-T\s+\S+\s+(\S+)\s+/);
+        return match?.[1] === key;
+    }) ?? null;
+}
+test('tmux installer remaps owned pairs and preserves occupied user bindings', (t) => {
+    if (spawnSync('tmux', ['-V']).status !== 0) {
+        t.skip('tmux is unavailable');
+        return;
+    }
+    const name = `crtr-keybindings-${process.pid}-${Date.now()}`;
+    const boot = spawnSync('tmux', ['-L', name, 'new-session', '-d', '-s', 'test'], { encoding: 'utf8' });
+    assert.equal(boot.status, 0, boot.stderr);
+    const socketResult = spawnSync('tmux', ['-L', name, 'display-message', '-p', '#{socket_path}'], { encoding: 'utf8' });
+    const socket = socketResult.stdout.trim();
+    assert.notEqual(socket, '');
+    const priorTmux = process.env['TMUX'];
+    process.env['TMUX'] = `${socket},1,0`;
+    try {
+        isolatedTmux(socket, ['bind-key', '-T', 'root', 'M-]', 'run-shell', `crtr node cycle --dir next --pane '#{pane_id}' >/dev/null 2>&1`]);
+        const first = installTmuxBindings(resolveKeybindings());
+        assert.equal(first.ok, true, JSON.stringify(first.diagnostics));
+        assert.ok(first.installed.some((pair) => pair.table === 'root' && pair.key === 'M-]'));
+        assert.match(tmuxBinding(socket, 'root', 'M-c') ?? '', /display-menu/);
+        assert.match(tmuxBinding(socket, 'root', 'M-v') ?? '', /switch-client/);
+        const remapped = installTmuxBindings(resolveKeybindings({
+            'crtr.tmux.menu.open': ['alt+shift+z'],
+            'crtr.tmux.menu.graph': ['shift+z'],
+            'crtr.tmux.node.next': [],
+            'crtr.tmux.view.next': ['alt+z > n'],
+            'crtr.tmux.view.previous': ['alt+z > p'],
+        }));
+        assert.equal(remapped.ok, true, JSON.stringify(remapped.diagnostics));
+        assert.equal(tmuxBinding(socket, 'root', 'M-c'), null);
+        assert.equal(tmuxBinding(socket, 'root', 'M-]'), null);
+        const menu = tmuxBinding(socket, 'root', 'M-Z') ?? '';
+        assert.match(menu, /graph view/);
+        assert.match(menu, /Z/);
+        const prefix = tmuxBinding(socket, 'root', 'M-z') ?? '';
+        assert.match(prefix, /switch-client/);
+        const again = installTmuxBindings(resolveKeybindings({
+            'crtr.tmux.menu.open': ['alt+shift+y'],
+            'crtr.tmux.node.next': [],
+            'crtr.tmux.view.next': ['alt+z > n'],
+            'crtr.tmux.view.previous': ['alt+z > p'],
+        }));
+        assert.equal(again.ok, true, JSON.stringify(again.diagnostics));
+        isolatedTmux(socket, ['bind-key', '-T', 'root', 'M-Z', 'display-message', 'user-owned']);
+        const occupied = installTmuxBindings(resolveKeybindings({ 'crtr.tmux.menu.open': ['alt+shift+z'] }));
+        assert.equal(occupied.ok, true);
+        assert.ok(occupied.diagnostics.some((diagnostic) => diagnostic.code === 'occupied' && diagnostic.bindingId === 'crtr.tmux.menu.open'));
+        assert.match(tmuxBinding(socket, 'root', 'M-Z') ?? '', /user-owned/);
+    }
+    finally {
+        if (priorTmux === undefined)
+            delete process.env['TMUX'];
+        else
+            process.env['TMUX'] = priorTmux;
+        isolatedTmux(socket, ['kill-server']);
+    }
+});

package/dist/core/canvas/__tests__/remote-event-stream.test.js

@@ -45,7 +45,7 @@ async function waitFor(predicate, timeoutMs = 2000, intervalMs = 5) {
         await new Promise((r) => setTimeout(r, intervalMs));
     }
 }
-test('a listener fires once per known-kind SSE event, and never for a ping or an unknown kind', async () => {
+test('a listener fires once per known-kind SSE event, and never for a ping or an unknown kind', async (t) => {
     const server = await startSseServer((res) => {
         res.writeHead(200, { 'content-type': 'text/event-stream' });
         res.write(': connected\n\n');
@@ -55,15 +55,18 @@ test('a listener fires once per known-kind SSE event, and never for a ping or an
         res.end();
     });
     const stream = new RemoteEventStream(server.url, 'tok');
+    // Register cleanup BEFORE any assertion runs — a thrown assertion must not
+    // leave the client's reconnect loop or the server's listening socket alive
+    // (see the CI-hang postmortem on rebuild-coalescer.test.ts).
+    t.after(() => { stream.stop(); return server.close(); });
     const seen = [];
     stream.subscribe((kind) => seen.push(kind));
     stream.start();
     await waitFor(() => seen.length > 0);
     stream.stop();
     assert.deepEqual(seen, ['nodes']);
-    await server.close();
 });
-test('the SSE connection carries the token ONLY in the Authorization header — not in the URL or any other header', async () => {
+test('the SSE connection carries the token ONLY in the Authorization header — not in the URL or any other header', async (t) => {
     const server = await startSseServer((res) => {
         res.writeHead(200, { 'content-type': 'text/event-stream' });
         res.end();
@@ -73,6 +76,7 @@ test('the SSE connection carries the token ONLY in the Authorization header —
     // no header, including Host, is permitted to carry it.
     const token = 'secret-sse-token-value';
     const stream = new RemoteEventStream(server.url, token);
+    t.after(() => { stream.stop(); return server.close(); });
     stream.start();
     await waitFor(() => server.requests.length > 0);
     stream.stop();
@@ -87,9 +91,8 @@ test('the SSE connection carries the token ONLY in the Authorization header —
         assert.ok(!String(v).includes(token), `header ${k} must not carry the token`);
     }
     assert.ok(!req.url.includes(token));
-    await server.close();
 });
-test('stop() cancels a pending reconnect timer — no zombie loop survives a stop()+start() cycle', async () => {
+test('stop() cancels a pending reconnect timer — no zombie loop survives a stop()+start() cycle', async (t) => {
     const server = await startSseServer((res) => {
         res.writeHead(500);
         res.end();
@@ -101,6 +104,7 @@ test('stop() cancels a pending reconnect timer — no zombie loop survives a sto
     // wide enough that ordinary event-loop/scheduler jitter can't flip it.
     const BACKOFF = 200;
     const stream = new RemoteEventStream(server.url, 'tok', { initialBackoffMs: BACKOFF });
+    t.after(() => { stream.stop(); return server.close(); });
     stream.start();
     // t≈0: first request fires+fails, backoff(BACKOFF) scheduled → stale deadline ≈ BACKOFF.
     await waitFor(() => server.hitCount() >= 1);
@@ -119,10 +123,8 @@ test('stop() cancels a pending reconnect timer — no zombie loop survives a sto
     // this window; a cleared one (fixed) leaves it at 2.
     await new Promise((r) => setTimeout(r, BACKOFF * 0.7));
     assert.equal(server.hitCount(), 2, "no zombie request from the stopped loop's dangling timer");
-    stream.stop();
-    await server.close();
 });
-test('stop() halts the reconnect loop — no further requests after it is called', async () => {
+test('stop() halts the reconnect loop — no further requests after it is called', async (t) => {
     const server = await startSseServer((res) => {
         // Every connection is refused immediately (no SSE headers, just a close)
         // so the client's loop falls into its backoff-and-retry path.
@@ -131,6 +133,7 @@ test('stop() halts the reconnect loop — no further requests after it is called
     });
     const BACKOFF = 20;
     const stream = new RemoteEventStream(server.url, 'tok', { initialBackoffMs: BACKOFF });
+    t.after(() => { stream.stop(); return server.close(); });
     stream.start();
     await waitFor(() => server.hitCount() >= 1);
     const hitsAtStop = server.hitCount();
@@ -140,5 +143,4 @@ test('stop() halts the reconnect loop — no further requests after it is called
     // continuing to retry in the background after stop() returned.
     await new Promise((r) => setTimeout(r, BACKOFF * 5));
     assert.equal(server.hitCount(), hitsAtStop);
-    await server.close();
 });

package/dist/core/canvas/__tests__/render-remote.test.js

@@ -140,7 +140,7 @@ function seedPoisonedLocalState() {
     ].join('\n'));
     return sf;
 }
-test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource suppress every local-read field to its safe default for a RemoteCanvasSource, even with conflicting local state for the same node id', async () => {
+test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource suppress every local-read field to its safe default for a RemoteCanvasSource, even with conflicting local state for the same node id', async (t) => {
     sessionFile = seedPoisonedLocalState();
     const server = await startMockCrtrServer((args) => {
         if (args[1] === 'node' && args[2] === 'inspect' && args[3] === 'list') {
@@ -164,6 +164,10 @@ test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource
         }
         return { status: 500, body: {} };
     });
+    // Register the close BEFORE any assertion runs — a listening server left
+    // open by a thrown assertion keeps this test file's process alive forever
+    // (see the CI-hang postmortem on rebuild-coalescer.test.ts).
+    t.after(() => server.close());
     const source = new RemoteCanvasSource(server.url, 'tok');
     const rows = await dashboardRowsAllFromSource(source);
     assert.equal(rows.length, 1);
@@ -180,7 +184,6 @@ test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource
     assert.equal(previewed.prompts, undefined, 'a local session transcript must not leak into a remote preview');
     assert.equal(previewed.lastAssistant, undefined, 'a local session transcript must not leak into a remote preview');
     assert.equal(previewed.previewLoaded, true);
-    await server.close();
 });
 // The non-TTY `canvas browse` path (browse/app.ts's `if (!process.stdin.isTTY)`
 // branch) calls `renderForestFromSource(source)` directly — a SEPARATE code
@@ -190,7 +193,7 @@ test('dashboardRowsAllFromSource / enrichRowsFromSource / loadPreviewFromSource
 // test above never exercises it, so a regression that reintroduced local
 // telemetry/ask/fault reads into the static forest renderer specifically would
 // pass that test while still leaking poisoned local state here.
-test('renderForestFromSource suppresses local-read fields (ctx, asks, hanging) for a RemoteCanvasSource, even with conflicting local state for the same node id', async () => {
+test('renderForestFromSource suppresses local-read fields (ctx, asks, hanging) for a RemoteCanvasSource, even with conflicting local state for the same node id', async (t) => {
     const sf = seedPoisonedLocalState();
     const server = await startMockCrtrServer((args) => {
         if (args[1] === 'node' && args[2] === 'inspect' && args[3] === 'list') {
@@ -211,11 +214,11 @@ test('renderForestFromSource suppresses local-read fields (ctx, asks, hanging) f
         }
         return { status: 500, body: {} };
     });
+    t.after(() => server.close());
     const source = new RemoteCanvasSource(server.url, 'tok');
     const out = await renderForestFromSource(source);
     assert.match(out, /ctx 0k/, 'the remote node must render with the suppressed ctx default, not a real token read');
     assert.doesNotMatch(out, /⚑/, 'no ask badge — local asks must not leak into the static forest render');
     assert.doesNotMatch(out, /POISON FAULT/, 'a local active fault must not leak into the static forest render');
     assert.doesNotMatch(out, /POISON/, 'no poisoned local telemetry/goal/session text may appear anywhere in the output');
-    await server.close();
 });