@koda-sl/baker-bridge 0.108.0-dev.fe3d33fa3 → 0.109.0-dev.3bafd569e

package/dist/hono/bridge-job.test.js

@@ -1,3 +1,4 @@
+import { readFileSync } from "node:fs";
 import { mkdir, mkdtemp, rm, utimes, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
@@ -16,8 +17,10 @@ vi.mock("./runtime-files.ts", async (importOriginal) => {
     };
 });
 import { AVATAR_CASTING_TOOL_NAME } from "./avatar-casting.js";
+import { FACE_PICK_QUESTION } from "./avatar-face-question.js";
 import { BridgeJobExecutor, createStallDetector, isContextOverflowRefusal, isControlChannelDeny, parsePlanDecision, remapAnswersToQuestionText, } from "./bridge-job.js";
 import { CONNECTION_INPUT_TOOL_NAME } from "./connection-input.js";
+import { CREDENTIAL_INPUT_TOOL_NAME } from "./credential-input.js";
 import { FLOW_INPUT_TOOL_NAME } from "./flow-input.js";
 import { bridgeRuntimeFiles } from "./runtime-files.js";
 import { TAG_INPUT_TOOL_NAME } from "./tag-input.js";
@@ -49,6 +52,7 @@ function activeControls() {
         pendingTagInputs: new Map(),
         pendingFlowInputs: new Map(),
         pendingConnectionInputs: new Map(),
+        pendingCredentialInputs: new Map(),
         pendingVoiceCasts: new Map(),
         pendingAvatarCastings: new Map(),
         isActive: () => active,
@@ -82,6 +86,8 @@ function recordingRelay() {
         flowInputResolved: () => Promise.resolve(),
         connectionInputRequest: () => Promise.resolve(true),
         connectionInputResolved: () => Promise.resolve(),
+        credentialInputRequest: () => Promise.resolve(true),
+        credentialInputResolved: () => Promise.resolve(),
         avatarCastingRequest: () => Promise.resolve(true),
         avatarCastingResolved: () => Promise.resolve(),
         assistantEvent: (target, event, model) => {
@@ -222,13 +228,17 @@ function createExecutor(options) {
         stallTimeoutMs: options.stallTimeoutMs,
         stallCheckIntervalMs: options.stallCheckIntervalMs,
         turnEndSettleMs: options.turnEndSettleMs,
+        // A test that ends on a silent settle waits no longer than its settle window.
+        turnEndWakeMs: options.turnEndWakeMs ?? options.turnEndSettleMs,
         turnEndExitGuardMs: options.turnEndExitGuardMs,
+        settleWorkspace: options.settleWorkspace ?? (() => Promise.resolve()),
         ...(options.turnEvents
             ? { recordTurnEvent: (event) => options.turnEvents?.push(event) }
             : {}),
         now: options.now,
         readUsageBaseline: async (sessionId) => options.usageBaselines?.[sessionId],
         stalledCliExitMs: 0,
+        prepareAttachments: options.prepareAttachments,
     });
 }
 function resultMessage(costUsd, sessionId, modelUsage) {
@@ -314,12 +324,12 @@ describe("isControlChannelDeny", () => {
         })).toBe(false);
     });
     it("does not match a PreToolUse hook block that quotes the envelope in its explanation", () => {
-        // Live-run finding: the scaffold's guard-background-commands hook explains
-        // WHY it blocks a backgrounded subagent by quoting the failure it prevents.
+        // Live-run finding: the scaffold's guard-background-commands hook, when it
+        // still blocked backgrounded subagents, explained why by quoting the failure.
         // Its block arrives as an is_error tool_result, so an envelope-substring
         // match counted it as a deny — three blocked spawns in one turn would have
         // tripped the breaker and errored a perfectly healthy turn.
-        expect(isControlChannelDeny(controlChannelDenyMessage("PreToolUse:Agent hook error: [node __tooling__/hooks/base/guard-background-commands.mjs]: " +
+        expect(isControlChannelDeny(controlChannelDenyMessage("PreToolUse:Agent hook error: [node __tooling__/checks/base/guard-background-commands/guard-background-commands.mjs]: " +
             "✗ guard-background-commands — blocked: subagent spawned in the background.\n" +
             "  A subagent that outlives the turn loses its permission channel and orphans\n" +
             "  any work it started (a render inside it fails 'Tool permission request failed')."))).toBe(false);
@@ -1095,7 +1105,10 @@ describe("BridgeJobExecutor", () => {
         // web-plugin opt-out at their integration point: all must actually reach the
         // subprocess body via CLAUDE_CODE_EXTRA_BODY.
         expect(JSON.parse(env?.CLAUDE_CODE_EXTRA_BODY ?? "{}")).toEqual({
-            provider: { order: ["amazon-bedrock"], allow_fallbacks: true },
+            provider: {
+                order: ["amazon-bedrock", "amazon-bedrock/eu-west-1", "amazon-bedrock/us-east-1"],
+                allow_fallbacks: true,
+            },
             session_id: "thread_env",
             plugins: [{ id: "web", enabled: false }],
         });
@@ -1123,7 +1136,31 @@ describe("BridgeJobExecutor", () => {
             NO_COLOR: "1",
         });
     });
-    // The three shared subagents pin themselves to Sonnet 5 in their own
+    // Without the wrapper, a burst of parallel commands can fill the sandbox's
+    // memory and the OOM killer takes the agent or the credential broker instead.
+    it("runs every agent command through the kill-first wrapper, whatever started the bridge", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_wrapped"))],
+        });
+        await executor.execute({ threadId: "thread_wrapped", turnId: "turn_wrapped", prompt: "Research competitors", history: history([]) }, activeControls());
+        const prefix = queryInputs[0]?.options.env?.CLAUDE_CODE_SHELL_PREFIX ?? "";
+        expect(readFileSync(prefix, "utf8")).toContain("oom_score_adj");
+    });
+    // The CLI clamps a Bash call's timeout to 10 minutes by default, so the
+    // workspace hook's 30 minutes for `baker canvas run` became 600 s and a
+    // render with a repair round was moved to the background (dev, Oct 2026).
+    it("lets a Bash call run the 30 minutes the workspace's timeout hook gives a render", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_long"))],
+        });
+        await executor.execute({ threadId: "thread_long", turnId: "turn_long", prompt: "Render the ad", history: history([]) }, activeControls());
+        expect(Number(queryInputs[0]?.options.env?.BASH_MAX_TIMEOUT_MS)).toBeGreaterThanOrEqual(30 * 60_000);
+    });
+    // The four shared subagents pin themselves to Sonnet 5.5 in their own
     // frontmatter. Since CLI 2.1.251 CLAUDE_CODE_SUBAGENT_MODEL is only the default
     // under that pin, so the override needs the FORCE flag to outrank it.
     it("sends the Runtime's model override down to the fan-out workers", async () => {
@@ -1140,7 +1177,7 @@ describe("BridgeJobExecutor", () => {
         });
     });
     // Production pins nothing, and the variable must then be absent rather than
-    // empty: sending it would strip every worker's own Sonnet 5 pin.
+    // empty: sending it would strip every worker's own Sonnet 5.5 pin.
     it("leaves the workers on their own pinned model when nothing is overridden", async () => {
         vi.stubEnv("BAKER_AGENT_MODEL", "");
         const queryInputs = [];
@@ -1169,8 +1206,7 @@ describe("BridgeJobExecutor", () => {
     // Read off a session's own `init` tool list, the CLI offers these to every
     // Session. Each one reaches past what a marketer's chat is for: the worktree
     // pair rearranges the branches Publish owns, `Workflow` fans out a fleet on
-    // the organization's OpenRouter key, and `SendMessage` addresses peers a
-    // single-session Runtime does not have.
+    // the organization's OpenRouter key.
     it("removes the tools that reach outside what a Session is", async () => {
         const queryInputs = [];
         const executor = createExecutor({
@@ -1179,10 +1215,12 @@ describe("BridgeJobExecutor", () => {
         });
         await executor.execute({ threadId: "thread_reach", turnId: "turn_reach", prompt: "Build a landing", history: history([]) }, activeControls());
         const disallowed = queryInputs[0]?.options.disallowedTools ?? [];
-        expect(disallowed).toEqual(expect.arrayContaining(["EnterWorktree", "ExitWorktree", "Workflow", "SendMessage"]));
+        expect(disallowed).toEqual(expect.arrayContaining(["EnterWorktree", "ExitWorktree", "Workflow"]));
         // `Task` is the subagent spawn itself — the scaffold's own fan-out workers
-        // ride it, so blocking multi-agent orchestration must not catch it.
+        // ride it, so blocking multi-agent orchestration must not catch it. And
+        // `SendMessage` is how the agent follows up with a subagent it already ran.
         expect(disallowed).not.toContain("Task");
+        expect(disallowed).not.toContain("SendMessage");
     });
     it("allowlists the workspace's own skills so the CLI's built-in developer skills stay out of the session", async () => {
         const workspace = await mkdtemp(join(tmpdir(), "baker-job-skills-"));
@@ -1370,6 +1408,24 @@ describe("BridgeJobExecutor", () => {
         await executor.execute({ threadId: "thread_uw", turnId: "turn_uw", prompt: "Hi", history: history([]) }, activeControls());
         expect((queryInputs[0]?.options.settings ?? {})).not.toHaveProperty("autoCompactWindow");
     });
+    it("asks for manual approvals outside plan mode, so canUseTool decides every tool call instead of auto mode", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_permission_mode"))],
+        });
+        await executor.execute({ threadId: "thread_pm", turnId: "turn_pm", prompt: "Hi", history: history([]) }, activeControls());
+        expect(queryInputs[0]?.options.permissionMode).toBe("default");
+    });
+    it("keeps subagent prompt caches for an hour, so a subagent outliving a long render still reads its cache", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_subagent_ttl"))],
+        });
+        await executor.execute({ threadId: "thread_ttl", turnId: "turn_ttl", prompt: "Hi", history: history([]) }, activeControls());
+        expect(queryInputs[0]?.options.settings).toMatchObject({ subagentPromptCacheTtl: "1h" });
+    });
     // No output style is sent. `Concise` was pinned against Opus 5's preamble; on
     // Opus 5.5 it suppressed the one-line progress notes a marketer reads while a
     // long turn works. The voice rules live in the scaffold CLAUDE.md instead.
@@ -1382,20 +1438,6 @@ describe("BridgeJobExecutor", () => {
         await executor.execute({ threadId: "thread_style", turnId: "turn_style_1", prompt: "Hi", history: history([]) }, activeControls());
         expect((queryInputs[0]?.options.settings ?? {})).not.toHaveProperty("outputStyle");
     });
-    // Nothing to put in the settings tier (unknown model window, no chat id for the
-    // memory directory) means no `settings` key at all: the SDK forwards even `{}`
-    // to the CLI as a `--settings` flag tier.
-    it("omits the settings tier when nothing in it applies", async () => {
-        vi.stubEnv("BAKER_CHAT_ID", "");
-        const queryInputs = [];
-        const executor = createExecutor({
-            queryInputs,
-            model: "claude-unknown",
-            queryResults: [scriptedMessages(resultMessage(0, "session_no_settings"))],
-        });
-        await executor.execute({ threadId: "thread_ns", turnId: "turn_ns", prompt: "Hi", history: history([]) }, activeControls());
-        expect(queryInputs[0]?.options).not.toHaveProperty("settings");
-    });
     it("runs exact publish commands with the prompt passed through verbatim", async () => {
         const queryInputs = [];
         const executor = createExecutor({
@@ -1440,6 +1482,24 @@ describe("BridgeJobExecutor", () => {
         expect(queryInputs[0]?.prompt).toBe("make the headline bigger");
         expect(queryInputs[0]?.reminder).toContain('landing "Homepage" (slug: homepage)');
     });
+    it("explains a credential the message names beside it, together with the viewing reference", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            queryResults: [scriptedMessages(resultMessage(0, "session_credential"))],
+        });
+        await executor.execute({
+            threadId: "thread_credential",
+            turnId: "turn_credential",
+            prompt: "log in with user admin and password {{credential:password}}",
+            history: history([]),
+            currentReference: { type: "landing", slug: "homepage", title: "Homepage" },
+            credentials: [{ name: "password", label: "Login password", allowedHosts: [] }],
+        }, activeControls());
+        expect(queryInputs[0]?.prompt).toBe("log in with user admin and password {{credential:password}}");
+        expect(queryInputs[0]?.reminder).toContain('landing "Homepage"');
+        expect(queryInputs[0]?.reminder).toContain("`{{credential:password}}` is a credential the user saved");
+    });
     it("strips newlines from the viewing reference so a crafted title can't inject instructions", async () => {
         const queryInputs = [];
         const executor = createExecutor({
@@ -1493,6 +1553,67 @@ describe("BridgeJobExecutor", () => {
         expect(queryInputs[1]?.prompt).not.toContain("preview pane");
         expect(queryInputs[1]?.reminder).toContain('landing "Homepage" (slug: homepage)');
     });
+    // A late answer to a blocking prompt continues a request whose files the
+    // Session received with it. A rebuilt Session only has that request's history,
+    // which names the files but cannot open them, so they are handed over again.
+    it("hands over the continued request's files when the Session is rebuilt", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            queryInputs,
+            prepareAttachments: async (attachments, attachedTo) => `\n\nFILES for ${attachedTo}: ${attachments.map((attachment) => attachment.filename).join(", ")}`,
+        });
+        await executor.execute({
+            threadId: "thread_continued_files",
+            turnId: "turn_continued_files",
+            prompt: "They have now replied: HubSpot",
+            continuedAttachments: [
+                { url: "https://files.example/logo.png", contentType: "image/png", filename: "logo.png" },
+            ],
+            history: history([{ role: "user", text: "Build a page with my logo", createdAt: 1 }]),
+        }, activeControls());
+        expect(queryInputs[0]?.prompt).toContain("FILES for continued_request: logo.png");
+    });
+    it("does not hand the continued request's files over again to a resumed Session", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            loadedBoundary: cleanBoundary("session_holds_files"),
+            queryInputs,
+            prepareAttachments: async (attachments) => `\n\nFILES: ${attachments.map((attachment) => attachment.filename).join(", ")}`,
+        });
+        await executor.execute({
+            threadId: "thread_resumed_files",
+            turnId: "turn_resumed_files",
+            prompt: "They have now replied: HubSpot",
+            continuedAttachments: [
+                { url: "https://files.example/logo.png", contentType: "image/png", filename: "logo.png" },
+            ],
+            history: history([{ role: "user", text: "Build a page with my logo", createdAt: 1 }]),
+        }, activeControls());
+        expect(queryInputs[0]?.prompt).toBe("They have now replied: HubSpot");
+    });
+    it("hands the continued request's files over when a stale Session falls back to history", async () => {
+        const queryInputs = [];
+        const executor = createExecutor({
+            loadedBoundary: cleanBoundary("session_stale_files"),
+            queryInputs,
+            queryResults: [
+                scriptedError(new Error("Cannot resume: session not found")),
+                scriptedMessages(resultMessage(0, "session_rebuilt_files")),
+            ],
+            prepareAttachments: async (attachments) => `\n\nFILES: ${attachments.map((attachment) => attachment.filename).join(", ")}`,
+        });
+        await executor.execute({
+            threadId: "thread_stale_files",
+            turnId: "turn_stale_files",
+            prompt: "They have now replied: HubSpot",
+            continuedAttachments: [
+                { url: "https://files.example/logo.png", contentType: "image/png", filename: "logo.png" },
+            ],
+            history: history([{ role: "user", text: "Build a page with my logo", createdAt: 1 }]),
+        }, activeControls());
+        expect(queryInputs[0]?.prompt).not.toContain("FILES");
+        expect(queryInputs[1]?.prompt).toContain("Current user request\nThey have now replied: HubSpot\n\nFILES: logo.png");
+    });
     it("clears an invalid clean boundary and retries once with rehydrated history", async () => {
         const relay = recordingRelay();
         const clearCalls = [];
@@ -2050,6 +2171,224 @@ describe("BridgeJobExecutor", () => {
         expect(connectionRequests).toHaveLength(1);
         expect(decision).toMatchObject({ behavior: "allow" });
     });
+    it("loads a server the user connected from the card into this same turn, and tells the agent it is ready", async () => {
+        const relay = recordingRelay();
+        relay.connectionInputRequest = () => Promise.resolve(true);
+        const controls = activeControls();
+        const acme = { type: "http", url: "https://acme.dev/mcp" };
+        const asks = [];
+        const loaded = [];
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CONNECTION_INPUT_TOOL_NAME, { connections: [{ server: { name: "acme", url: "https://acme.dev/mcp", auth: "none" }, reason: "r" }] }, { toolUseID: "t1", requestId: "req_t1", signal: new AbortController().signal });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingConnectionInputs) {
+                            pending.resolve({ results: [{ status: "connected", server: "acme", scope: "company" }] });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_after_connect");
+                    },
+                    setMcpServers: (servers) => {
+                        loaded.push(servers);
+                        return Promise.resolve({ added: ["acme"], removed: [], errors: {} });
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+            mcpServersProvider: (_threadId, _actor, options) => {
+                asks.push(options ?? {});
+                const servers = options?.fresh ? { acme } : {};
+                return Promise.resolve(servers);
+            },
+        });
+        await executor.execute({ threadId: "thread_mcp", turnId: "turn_mcp", prompt: "Connect Acme" }, controls);
+        expect(asks).toEqual([{}, { fresh: true }]);
+        expect(Object.keys(loaded[0] ?? {}).sort()).toEqual(["acme", "baker_ui"]);
+        expect(decision).toMatchObject({ behavior: "allow", updatedInput: { resolution: { toolsReady: true } } });
+    });
+    it("names a server that would not start, so the agent does not promise it for the next message", async () => {
+        const relay = recordingRelay();
+        relay.connectionInputRequest = () => Promise.resolve(true);
+        const controls = activeControls();
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CONNECTION_INPUT_TOOL_NAME, { connections: [{ server: { name: "acme", url: "https://acme.dev/mcp" }, reason: "r" }] }, { toolUseID: "t1", requestId: "req_t1", signal: new AbortController().signal });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingConnectionInputs) {
+                            pending.resolve({ results: [{ status: "connected", server: "acme", scope: "company" }] });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_after_failed_load");
+                    },
+                    setMcpServers: () => Promise.resolve({ added: [], removed: [], errors: { acme: "401 Unauthorized" } }),
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+            mcpServersProvider: () => Promise.resolve({ acme: { type: "http", url: "https://acme.dev/mcp" } }),
+        });
+        await executor.execute({ threadId: "thread_bad", turnId: "turn_bad", prompt: "Connect Acme" }, controls);
+        expect(decision).toMatchObject({
+            updatedInput: { resolution: { toolsReady: false, failedToLoad: ["acme"] } },
+        });
+    });
+    it("does not call an app ready when the reloaded tools do not include it", async () => {
+        const relay = recordingRelay();
+        relay.connectionInputRequest = () => Promise.resolve(true);
+        const controls = activeControls();
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CONNECTION_INPUT_TOOL_NAME, { connections: [{ app: "notion", reason: "r" }] }, { toolUseID: "t1", requestId: "req_t1", signal: new AbortController().signal });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingConnectionInputs) {
+                            pending.resolve({ results: [{ status: "connected", app: "notion", scope: "company" }] });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_after_missing_app");
+                    },
+                    setMcpServers: () => Promise.resolve({ added: [], removed: [], errors: {} }),
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+            mcpServersProvider: () => Promise.resolve({}),
+        });
+        await executor.execute({ threadId: "thread_app", turnId: "turn_app", prompt: "Connect Notion" }, controls);
+        expect(decision).toMatchObject({
+            updatedInput: { resolution: { toolsReady: false, failedToLoad: ["notion"] } },
+        });
+    });
+    it("leaves the turn's tools alone when only a platform was connected", async () => {
+        const relay = recordingRelay();
+        relay.connectionInputRequest = () => Promise.resolve(true);
+        const controls = activeControls();
+        let reloads = 0;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CONNECTION_INPUT_TOOL_NAME, { connections: [{ platform: "hubspot", reason: "r" }] }, { toolUseID: "t1", requestId: "req_t1", signal: new AbortController().signal });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingConnectionInputs) {
+                            pending.resolve({ results: [{ status: "connected", platform: "hubspot", selected: [] }] });
+                        }
+                        await asked;
+                        yield resultMessage(0, "session_after_platform");
+                    },
+                    setMcpServers: () => {
+                        reloads += 1;
+                        return Promise.resolve({ added: [], removed: [], errors: {} });
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+        });
+        await executor.execute({ threadId: "thread_pl", turnId: "turn_pl", prompt: "Connect HubSpot" }, controls);
+        expect(reloads).toBe(0);
+    });
+    it("turns request_credential away in a Runtime without Credentials", async () => {
+        const relay = recordingRelay();
+        const requests = [];
+        relay.credentialInputRequest = (_target, request) => {
+            requests.push(request);
+            return Promise.resolve(true);
+        };
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        decision = await input.options.canUseTool?.(CREDENTIAL_INPUT_TOOL_NAME, {
+                            label: "Shopify admin token",
+                            reason: "so I can update the theme",
+                            allowedHosts: ["acme.myshopify.com"],
+                        }, {
+                            toolUseID: "t1",
+                            requestId: "req_t1",
+                            signal: input.options.abortController?.signal ?? new AbortController().signal,
+                        });
+                        yield resultMessage(0, "session_credential_off");
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+        });
+        await executor.execute({ threadId: "thread_co", turnId: "turn_co", prompt: "Fix my theme" }, activeControls());
+        expect(requests).toEqual([]);
+        expect(decision).toMatchObject({ behavior: "deny", message: expect.stringContaining("not available") });
+    });
+    it("parks a credential request and hands the agent only the placeholder the user's answer stored", async () => {
+        vi.stubEnv("BAKER_CREDENTIALS", "1");
+        const relay = recordingRelay();
+        const requests = [];
+        relay.credentialInputRequest = (_target, request) => {
+            requests.push(request);
+            return Promise.resolve(true);
+        };
+        const controls = activeControls();
+        let decision;
+        const executor = new BridgeJobExecutor({
+            sdk: {
+                query: (input) => ({
+                    async *[Symbol.asyncIterator]() {
+                        const asked = input.options.canUseTool?.(CREDENTIAL_INPUT_TOOL_NAME, {
+                            label: "Shopify admin token",
+                            reason: "so I can update the theme",
+                            allowedHosts: ["acme.myshopify.com"],
+                        }, {
+                            toolUseID: "t1",
+                            requestId: "req_t1",
+                            signal: input.options.abortController?.signal ?? new AbortController().signal,
+                        });
+                        await new Promise((resolve) => setTimeout(resolve, 10));
+                        for (const [, pending] of controls.pendingCredentialInputs) {
+                            pending.resolve({
+                                status: "stored",
+                                name: "shopify-admin-token",
+                                placeholder: "{{credential:shopify-admin-token}}",
+                                allowedHosts: ["acme.myshopify.com"],
+                            });
+                        }
+                        decision = await asked;
+                        yield resultMessage(0, "session_credential");
+                    },
+                }),
+            },
+            model: "claude-test",
+            sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
+            relay,
+        });
+        await executor.execute({ threadId: "thread_cr", turnId: "turn_cr", prompt: "Fix my theme" }, controls);
+        expect(requests).toEqual([
+            {
+                toolUseId: "t1",
+                label: "Shopify admin token",
+                reason: "so I can update the theme",
+                allowedHosts: ["acme.myshopify.com"],
+            },
+        ]);
+        expect(decision).toMatchObject({
+            behavior: "allow",
+            updatedInput: { resolution: { status: "stored", placeholder: "{{credential:shopify-admin-token}}" } },
+        });
+    });
     it("refuses to ask for an avatar's face in a tool that renders only text", async () => {
         // Shipped three times, in both modes, after the agent had just read the doc saying
         // not to: "Elige el rostro para Clara, tu presentadora de placas solares" with
@@ -2090,6 +2429,8 @@ describe("BridgeJobExecutor", () => {
             model: "claude-test",
             sessionStore: { load: async () => undefined, save: async () => undefined, clear: async () => undefined },
             relay,
+            // The decision model reads it as a face pick, and not as a question about a page.
+            judge: async (questions) => questions.map(({ instructions }) => (instructions.question === FACE_PICK_QUESTION ? 0.95 : 0.02)),
         });
         await executor.execute({ threadId: "thread_face", turnId: "turn_face", prompt: "Make a TikTok ad" }, controls);
         expect(decision).toMatchObject({ behavior: "deny" });
@@ -2906,6 +3247,30 @@ describe("createStallDetector", () => {
             h.detector.dispose();
         }
     });
+    // Claude Code 2.1.287+ delivers a background task's heartbeats while the model's
+    // stream is stalled; they say nothing about the model, so they must not disarm it.
+    it("still stalls when a background task's heartbeat arrives during the model's silence", async () => {
+        vi.useFakeTimers();
+        const h = harness();
+        try {
+            await h.advance(20);
+            h.detector.observeMessage({
+                type: "tool_progress",
+                tool_use_id: "toolu_bg",
+                tool_name: "Bash",
+                parent_tool_use_id: null,
+                elapsed_time_seconds: 20,
+                heartbeat: true,
+                uuid: "uuid_hb",
+                session_id: "session_a",
+            });
+            await h.advance(30);
+            expect(h.stalls).toHaveLength(1);
+        }
+        finally {
+            h.detector.dispose();
+        }
+    });
     it("does not stall while the silence is still inside the window", async () => {
         vi.useFakeTimers();
         const h = harness();
@@ -3090,6 +3455,29 @@ describe("BridgeJobExecutor turn end with background tasks", () => {
         expect(outcome).toMatchObject({ kind: "completed", costUsd: 0.2 });
         expect(endInputAt.count).toBe(4);
     });
+    it("tells the session watchdog while a tool call or background task is running", async () => {
+        const endInputAt = { count: -1 };
+        const executor = createExecutor({
+            turnEndSettleMs: 20,
+            queryResults: [
+                cliLikeQuery(endInputAt, toolUseAssistantMessage("Bash", { command: "baker canvas run x.canvas.json" }), {
+                    type: "user",
+                    session_id: "session_bg",
+                    message: { role: "user", content: [{ type: "tool_result", tool_use_id: "toolu_stream", content: "ok" }] },
+                }, taskStarted("task_render"), resultMessage(0.1, "session_bg"), taskSettled("task_render"), resultMessage(0.2, "session_bg")),
+            ],
+        });
+        const reported = [];
+        const controls = {
+            ...activeControls(),
+            setWorkInFlight: (inFlight) => {
+                if (reported.at(-1) !== inFlight)
+                    reported.push(inFlight);
+            },
+        };
+        await executor.execute({ threadId: "thread_bg", turnId: "turn_bg", prompt: "Render", history: history([]) }, controls);
+        expect(reported).toEqual([true, false, true, false]);
+    });
     it("ends the turn when the last task settles without waking the model into a second result", async () => {
         // A settle is not guaranteed to produce another result. If only a result
         // could arm the end, this shape would strand in `for await` until the
@@ -3105,6 +3493,120 @@ describe("BridgeJobExecutor turn end with background tasks", () => {
         expect(outcome).toMatchObject({ kind: "completed", costUsd: 0.1 });
         expect(endInputAt.count).toBe(3);
     });
+    it("bills what a task spent after the last result when it settles without waking the model", async () => {
+        // The last result reported $0.10; the task kept working after it. With no
+        // second result, only the CLI's own running total can say what it cost.
+        const endInputAt = { count: -1 };
+        const query = cliLikeQuery(endInputAt, taskStarted("task_silent"), resultMessage(0.1, "session_bg"), taskSettled("task_silent"));
+        const executor = createExecutor({
+            turnEndSettleMs: 20,
+            queryResults: [
+                { ...query, usage: () => Promise.resolve({ totalCostUsd: 0.35, modelUsage: {} }) },
+            ],
+        });
+        const outcome = await executor.execute({ threadId: "thread_silent", turnId: "turn_silent", prompt: "Fan out one producer", history: history([]) }, activeControls());
+        expect(outcome).toMatchObject({ kind: "completed", costUsd: 0.35 });
+    });
+    it("settles the workspace itself when a turn that ran tasks ends, since its last Stop may never come", async () => {
+        // A task settling without waking the model ends the turn with no further
+        // Stop, so the end-of-turn hooks that deferred to a later Stop never run.
+        let settled = 0;
+        const executor = createExecutor({
+            turnEndSettleMs: 5,
+            settleWorkspace: () => {
+                settled += 1;
+                return Promise.resolve();
+            },
+            queryResults: [
+                cliLikeQuery({ count: -1 }, taskStarted("task_silent"), resultMessage(0.1, "session_bg"), taskSettled("task_silent")),
+                cliLikeQuery({ count: -1 }, resultMessage(0.1, "session_plain")),
+            ],
+        });
+        await executor.execute({ threadId: "thread_silent", turnId: "turn_silent", prompt: "Fan out", history: history([]) }, activeControls());
+        expect(settled).toBe(1);
+        await executor.execute({ threadId: "thread_plain", turnId: "turn_plain", prompt: "Say hi", history: history([]) }, activeControls());
+        expect(settled).toBe(1);
+    });
+    it("leaves the workspace untouched after a Session review that ran tasks", async () => {
+        // A review runs with every hook off and may not change anything; the
+        // settle steps format files and reconcile a publish.
+        let settled = 0;
+        const executor = createExecutor({
+            turnEndSettleMs: 5,
+            settleWorkspace: () => {
+                settled += 1;
+                return Promise.resolve();
+            },
+            queryResults: [
+                cliLikeQuery({ count: -1 }, taskStarted("task_read"), taskSettled("task_read"), {
+                    ...resultMessage(0.1, "session_review"),
+                    structured_output: { summary: "fine", findings: [] },
+                }),
+            ],
+        });
+        const outcome = await executor.execute({
+            threadId: "thread_review",
+            turnId: "turn_review",
+            prompt: "You are reviewing…",
+            review: {
+                reviewId: "rev_1",
+                apiKey: "bk_review_key",
+                modelAuthToken: "sk-or-platform",
+                model: "claude-review-model",
+                outputSchema: { type: "object" },
+                threadIds: ["thread_visible"],
+            },
+        }, activeControls());
+        expect(outcome).toMatchObject({ kind: "completed" });
+        expect(settled).toBe(0);
+    });
+    it("keeps input open for a wake that lands while the usage reading is in flight", async () => {
+        // The usage reading sits between deciding to end and ending. A wake queued
+        // in the CLI can land inside it; closing stdin then would deny the woken
+        // turn's first permission-gated tool call.
+        const endInputAt = { count: -1 };
+        const query = cliLikeQuery(endInputAt, taskStarted("task_bg"), resultMessage(0.1, "session_bg"), taskSettled("task_bg"), { pauseMs: 40 }, wakeMessage(), 
+        // The woken turn is still on time-to-first-token when the reading returns.
+        { pauseMs: 150 }, resultMessage(0.2, "session_bg"));
+        const executor = createExecutor({
+            turnEndSettleMs: 5,
+            queryResults: [
+                {
+                    ...query,
+                    usage: () => new Promise((resolveUsage) => setTimeout(() => resolveUsage({ totalCostUsd: 0.2, modelUsage: {} }), 100)),
+                },
+            ],
+        });
+        await executor.execute({ threadId: "thread_wake", turnId: "turn_wake", prompt: "Fan out", history: history([]) }, activeControls());
+        expect(endInputAt.count).toBe(5);
+    });
+    it("leaves a query that ended during the usage reading alone when the reading returns", async () => {
+        // A Stop can close the CLI while the reading is in flight. The run is over
+        // by the time it answers; ending the turn then would log a turn end that
+        // never happened and arm an exit guard against a query nobody is draining.
+        const query = cliLikeQuery({ count: -1 }, taskStarted("task_bg"), resultMessage(0.1, "session_bg"), taskSettled("task_bg"));
+        let answerUsage;
+        const turnEvents = [];
+        const executor = createExecutor({
+            turnEndSettleMs: 5,
+            turnEvents,
+            queryResults: [
+                {
+                    ...query,
+                    usage: () => {
+                        query.close?.();
+                        return new Promise((resolveUsage) => {
+                            answerUsage = () => resolveUsage({ totalCostUsd: 0.2, modelUsage: {} });
+                        });
+                    },
+                },
+            ],
+        });
+        await executor.execute({ threadId: "thread_stop", turnId: "turn_stop", prompt: "Fan out", history: history([]) }, activeControls());
+        answerUsage();
+        await new Promise((resolveTick) => setImmediate(resolveTick));
+        expect(turnEvents.map((event) => event.event)).not.toContain("turn_end");
+    });
     it("re-arms the settle window when a passive system event trails the result", async () => {
         // Passive trailing events (files persisted, session state) must not cancel
         // a scheduled end — only genuine model activity does. A cancel with no
@@ -3174,6 +3676,24 @@ describe("BridgeJobExecutor turn end with background tasks", () => {
         expect(outcome).toMatchObject({ kind: "completed", costUsd: 0.1 });
         expect(endInputAt.count).toBe(3);
     });
+    // Dev chat, Oct 2026: an auto-backgrounded render settled, input ended one
+    // settle window later, and the model woke ~3 s after the settle on a closed
+    // channel; it started a second render in the background, and the CLI's exit
+    // at its result killed it. The CLI streams nothing between a settle and the
+    // woken turn's first token, so only a longer wait after a settle covers it.
+    it("keeps input open for the model a settled background command wakes, though nothing streams for a while", async () => {
+        const endInputAt = { count: -1 };
+        const executor = createExecutor({
+            turnEndSettleMs: 20,
+            turnEndWakeMs: 5_000,
+            queryResults: [
+                cliLikeQuery(endInputAt, backgroundTasksChanged(["bash_render"]), resultMessage(0.1, "session_bg"), backgroundTasksChanged([]), { pauseMs: 60 }, assistantMessage("msg_wake", "The third render is ready", "session_bg"), resultMessage(0.3, "session_bg")),
+            ],
+        });
+        const outcome = await executor.execute({ threadId: "thread_wake_late", turnId: "turn_wake_late", prompt: "Render three", history: history([]) }, activeControls());
+        expect(outcome).toMatchObject({ kind: "completed", costUsd: 0.3 });
+        expect(endInputAt.count).toBe(5);
+    });
     // The production shape: the model refused, the CLI answered with an error
     // result and then waited on stdin like after any other result. The error was
     // no longer thrown, and only a clean result ended input, so the turn sat idle
@@ -3288,7 +3808,10 @@ describe("BridgeJobExecutor review mode", () => {
         const queryInputs = [];
         const executor = createExecutor({ queryInputs });
         await executor.execute(reviewJob(), activeControls());
-        expect((queryInputs[0]?.options).outputFormat).toEqual({
+        const [reviewQuery] = queryInputs;
+        if (!reviewQuery)
+            throw new Error("expected the review to start one query");
+        expect(reviewQuery.options.outputFormat).toEqual({
             type: "json_schema",
             schema: review.outputSchema,
         });
@@ -3325,7 +3848,9 @@ describe("BridgeJobExecutor review mode", () => {
         const options = queryInputs[0]?.options;
         expect(options.model).toBe("claude-session-model");
         expect(options.outputFormat).toBeUndefined();
-        expect(options.hooks).toBeUndefined();
+        // Only the credential scrub, which every turn runs; none of the review's hooks.
+        expect(Object.keys(options.hooks ?? {})).toEqual(["PostToolUse"]);
+        expect(options.hooks?.PostToolUse).toHaveLength(1);
         expect(options.env?.MAX_STRUCTURED_OUTPUT_RETRIES).toBeUndefined();
         expect(options.disallowedTools).not.toContain("Write");
         expect(options.env?.BAKER_DEBUG_LOG).toBeUndefined();